diff --git a/Cargo.lock b/Cargo.lock
index fbf8b8688..c47be165a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6262,9 +6262,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.43"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -7020,7 +7020,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
diff --git a/nodedb-cluster-tests/tests/common_suite/cases/shuffle_aggregate_cross_node.rs b/nodedb-cluster-tests/tests/common_suite/cases/shuffle_aggregate_cross_node.rs
index d534d18ba..e56ec23b5 100644
--- a/nodedb-cluster-tests/tests/common_suite/cases/shuffle_aggregate_cross_node.rs
+++ b/nodedb-cluster-tests/tests/common_suite/cases/shuffle_aggregate_cross_node.rs
@@ -111,6 +111,8 @@ fn producer_plan(rows: &[&Row]) -> Vec<u8> {
         limit: None,
         offset: 0,
         distinct: false,
+        computed_columns: Vec::new(),
+        window_functions: Vec::new(),
     });
     let plan = PhysicalPlan::Query(QueryOp::PartialAggregateState {
         collection: QualifiedCollection::new(nodedb_types::id::DatabaseId::DEFAULT, ""),
diff --git a/nodedb-cluster-tests/tests/common_suite/cases/shuffle_consume_cross_node.rs b/nodedb-cluster-tests/tests/common_suite/cases/shuffle_consume_cross_node.rs
index 205772766..4b41f71a0 100644
--- a/nodedb-cluster-tests/tests/common_suite/cases/shuffle_consume_cross_node.rs
+++ b/nodedb-cluster-tests/tests/common_suite/cases/shuffle_consume_cross_node.rs
@@ -108,6 +108,8 @@ fn provider_scan_plan(rows: &[&Row]) -> Vec<u8> {
         limit: None,
         offset: 0,
         distinct: false,
+        computed_columns: Vec::new(),
+        window_functions: Vec::new(),
     });
     plan_wire::encode(&plan).expect("encode provider scan plan")
 }
diff --git a/nodedb-cluster-tests/tests/common_suite/cases/shuffle_produce_cross_node.rs b/nodedb-cluster-tests/tests/common_suite/cases/shuffle_produce_cross_node.rs
index 3f0602c28..ee3640bec 100644
--- a/nodedb-cluster-tests/tests/common_suite/cases/shuffle_produce_cross_node.rs
+++ b/nodedb-cluster-tests/tests/common_suite/cases/shuffle_produce_cross_node.rs
@@ -112,6 +112,8 @@ fn provider_scan_plan(rows: &[Vec<u8>]) -> Vec<u8> {
         limit: None,
         offset: 0,
         distinct: false,
+        computed_columns: Vec::new(),
+        window_functions: Vec::new(),
     });
     plan_wire::encode(&plan).expect("encode provider scan plan")
 }
diff --git a/nodedb-physical/src/physical_plan/kv/op.rs b/nodedb-physical/src/physical_plan/kv/op.rs
index 1fe9126c7..17e01d800 100644
--- a/nodedb-physical/src/physical_plan/kv/op.rs
+++ b/nodedb-physical/src/physical_plan/kv/op.rs
@@ -152,6 +152,14 @@ pub enum KvOp {
         /// See `Get::surrogate_ceiling`; drops entries above the ceiling.
         #[serde(default)]
         surrogate_ceiling: Option<u32>,
+        /// Output column names (same format as DocumentOp::Scan). Empty =
+        /// return the whole row document.
+        #[serde(default)]
+        projection: Vec<String>,
+        /// Serialized `Vec<ComputedColumn>` applied per row after the scan
+        /// (same format as DocumentOp::Scan). Empty = none.
+        #[serde(default)]
+        computed_columns: Vec<u8>,
     },
 
     /// Set or update TTL on an existing key.
diff --git a/nodedb-physical/src/physical_plan/query.rs b/nodedb-physical/src/physical_plan/query.rs
index 96f087d3c..5de8629f4 100644
--- a/nodedb-physical/src/physical_plan/query.rs
+++ b/nodedb-physical/src/physical_plan/query.rs
@@ -78,6 +78,18 @@ pub enum QueryOp {
         /// Output column names to keep. Empty = emit all columns.
         #[serde(default)]
         projection: Vec<String>,
+        /// Serialized `Vec<ComputedColumn>` applied per row after
+        /// projection-name extraction (same wire format as the engine
+        /// scans). Expression projections over materialized rows (derived
+        /// tables, constant subqueries) need these — name-only projection
+        /// would silently drop them.
+        #[serde(default)]
+        computed_columns: Vec<u8>,
+        /// Serialized `Vec<WindowFuncSpec>` evaluated per partition after
+        /// computed columns (window over derived-table rows — issue #295
+        /// Gap 3). Empty = no window functions.
+        #[serde(default)]
+        window_functions: Vec<u8>,
         /// ORDER BY terms, each an expression. Empty = unordered.
         #[serde(default)]
         sort_keys: Vec<crate::physical_plan::SortKeySpec>,
@@ -118,6 +130,14 @@ pub enum QueryOp {
         /// Output column names to keep. Empty = emit all columns.
         #[serde(default)]
         projection: Vec<String>,
+        /// Serialized `Vec<ComputedColumn>` applied per row (see
+        /// `ProviderScan::computed_columns`).
+        #[serde(default)]
+        computed_columns: Vec<u8>,
+        /// Serialized `Vec<WindowFuncSpec>` (see
+        /// `ProviderScan::window_functions`).
+        #[serde(default)]
+        window_functions: Vec<u8>,
         /// ORDER BY terms, each an expression. Empty = unordered.
         #[serde(default)]
         sort_keys: Vec<crate::physical_plan::SortKeySpec>,
diff --git a/nodedb-query/src/window/eval.rs b/nodedb-query/src/window/eval.rs
index cf6085ad6..b97791e6d 100644
--- a/nodedb-query/src/window/eval.rs
+++ b/nodedb-query/src/window/eval.rs
@@ -32,6 +32,13 @@ pub fn evaluate_window_functions(
         let partitions = build_partitions(rows, &spec.partition_by)?;
 
         for partition_indices in &partitions {
+            // Evaluate the partition in the window's own ORDER BY — the
+            // query's sort, when present, orders by different keys. Without
+            // this, row_number numbered by arrival order and the rank family
+            // compared peers in the wrong sequence.
+            let ordered =
+                super::helpers::ordered_partition_indices(rows, partition_indices, &spec.order_by)?;
+            let partition_indices = &ordered;
             match spec.func_name.as_str() {
                 "row_number" => apply_row_number(rows, partition_indices, &spec.alias),
                 "rank" => apply_rank(rows, partition_indices, &spec.alias, &spec.order_by)?,
@@ -134,6 +141,84 @@ mod tests {
         assert_eq!(rows[4].1["rn"], json!(2));
     }
 
+    /// `row_number() OVER (ORDER BY ...)` must number by the window's own
+    /// ordering, not by arrival order: arrival is salary 100, 120, 90; ORDER
+    /// BY salary DESC must give 120 → 1, 100 → 2, 90 → 3.
+    #[test]
+    fn row_number_follows_the_window_ordering() {
+        let mut rows = make_rows();
+        let spec = WindowFuncSpec {
+            alias: "rn".into(),
+            func_name: "row_number".into(),
+            args: vec![],
+            partition_by: vec![],
+            order_by: vec![(SqlExpr::Column("salary".into()), false)],
+            frame: WindowFrame::default(),
+        };
+        evaluate_window_functions(&mut rows, &[spec]).unwrap();
+        assert_eq!(rows[1].1["rn"], json!(1), "120 is the highest salary");
+        assert_eq!(rows[4].1["rn"], json!(2), "110 is second");
+        assert_eq!(rows[0].1["rn"], json!(3), "100 is third");
+        assert_eq!(rows[2].1["rn"], json!(4), "90 is fourth");
+        assert_eq!(rows[3].1["rn"], json!(5), "80 is fifth");
+    }
+
+    /// An ORDER BY key that divides by zero fails the query instead of being
+    /// skipped along with the ordering.
+    #[test]
+    fn row_number_ordering_error_propagates() {
+        let mut rows = make_rows();
+        let spec = WindowFuncSpec {
+            alias: "rn".into(),
+            func_name: "row_number".into(),
+            args: vec![],
+            partition_by: vec![],
+            order_by: vec![(
+                SqlExpr::BinaryOp {
+                    left: Box::new(SqlExpr::Column("salary".into())),
+                    op: crate::expr::BinaryOp::Div,
+                    right: Box::new(SqlExpr::Literal(nodedb_types::Value::Integer(0))),
+                },
+                true,
+            )],
+            frame: WindowFrame::default(),
+        };
+        let err = evaluate_window_functions(&mut rows, &[spec])
+            .expect_err("ordering by a division by zero must fail");
+        assert!(
+            matches!(err, crate::expr::EvalError::DivisionByZero),
+            "unexpected error: {err:?}"
+        );
+    }
+
+    /// A singleton partition still evaluates its ordering key: the result
+    /// cannot change, but the error must be raised like anywhere else.
+    #[test]
+    fn singleton_partition_ordering_error_propagates() {
+        let mut rows = vec![("1".to_string(), json!({"n": 1}))];
+        let spec = WindowFuncSpec {
+            alias: "rn".into(),
+            func_name: "row_number".into(),
+            args: vec![],
+            partition_by: vec![],
+            order_by: vec![(
+                SqlExpr::BinaryOp {
+                    left: Box::new(SqlExpr::Column("n".into())),
+                    op: crate::expr::BinaryOp::Div,
+                    right: Box::new(SqlExpr::Literal(nodedb_types::Value::Integer(0))),
+                },
+                true,
+            )],
+            frame: WindowFrame::default(),
+        };
+        let err = evaluate_window_functions(&mut rows, &[spec])
+            .expect_err("a division by zero in the ordering key must fail");
+        assert!(
+            matches!(err, crate::expr::EvalError::DivisionByZero),
+            "unexpected error: {err:?}"
+        );
+    }
+
     #[test]
     fn running_sum() {
         let mut rows = make_rows();
@@ -146,11 +231,14 @@ mod tests {
             frame: WindowFrame::default(),
         };
         evaluate_window_functions(&mut rows, &[spec]).unwrap();
-        assert_eq!(rows[0].1["running_total"], json!(100.0));
-        assert_eq!(rows[1].1["running_total"], json!(220.0));
-        assert_eq!(rows[2].1["running_total"], json!(310.0));
-        assert_eq!(rows[3].1["running_total"], json!(80.0));
-        assert_eq!(rows[4].1["running_total"], json!(190.0));
+        // Partition `eng` in salary order is 90, 100, 120 and `sales` is 80,
+        // 110. Arrival order (100, 120, 90 / 80, 110) is NOT the window's
+        // order, so the running total must follow the sorted sequence.
+        assert_eq!(rows[2].1["running_total"], json!(90.0), "eng 90 first");
+        assert_eq!(rows[0].1["running_total"], json!(190.0), "eng +100");
+        assert_eq!(rows[1].1["running_total"], json!(310.0), "eng +120");
+        assert_eq!(rows[3].1["running_total"], json!(80.0), "sales 80 first");
+        assert_eq!(rows[4].1["running_total"], json!(190.0), "sales +110");
     }
 
     #[test]
diff --git a/nodedb-query/src/window/helpers.rs b/nodedb-query/src/window/helpers.rs
index 3bd7b36fb..cf61b1e98 100644
--- a/nodedb-query/src/window/helpers.rs
+++ b/nodedb-query/src/window/helpers.rs
@@ -82,3 +82,91 @@ pub(super) fn order_keys_equal(
     }
     Ok(true)
 }
+
+/// Indices of one partition, ordered by a window spec's ORDER BY keys.
+///
+/// Window functions receive the sorted result set, but a window's own ORDER
+/// BY is a different ordering from the query's — nothing upstream sorts by
+/// it. Evaluating a partition in arrival order silently assigned
+/// row numbers by arrival and compared peers in the wrong sequence, so every
+/// ranking and running frame was wrong whenever the two orders differed.
+///
+/// Keys are evaluated once per row; a division/modulo-by-zero propagates as
+/// `Err(EvalError::DivisionByZero)`. The sort is stable, so rows with equal
+/// keys keep their arrival order.
+pub(super) fn ordered_partition_indices(
+    rows: &[(String, serde_json::Value)],
+    indices: &[usize],
+    order_by: &[(SqlExpr, bool)],
+) -> Result<Vec<usize>, crate::expr::EvalError> {
+    if order_by.is_empty() {
+        return Ok(indices.to_vec());
+    }
+    // Keys are evaluated even for a one-row partition: the ordering cannot
+    // change the result, but a key that divides by zero is still a statement
+    // error in PostgreSQL, and skipping the evaluation would answer where
+    // the same expression anywhere else fails.
+    let mut keyed: Vec<(usize, Vec<serde_json::Value>)> = Vec::with_capacity(indices.len());
+    for &i in indices {
+        let mut keys = Vec::with_capacity(order_by.len());
+        for (expr, _) in order_by {
+            keys.push(eval_expr_on_json(expr, &rows[i].1)?);
+        }
+        keyed.push((i, keys));
+    }
+    keyed.sort_by(|(_, a), (_, b)| compare_key_values(a, b, order_by));
+    Ok(keyed.into_iter().map(|(i, _)| i).collect())
+}
+
+/// Compare two pre-evaluated ORDER BY key vectors under their direction flags.
+fn compare_key_values(
+    a: &[serde_json::Value],
+    b: &[serde_json::Value],
+    order_by: &[(SqlExpr, bool)],
+) -> std::cmp::Ordering {
+    for ((va, vb), (_expr, ascending)) in a.iter().zip(b.iter()).zip(order_by.iter()) {
+        let ord = compare_with_direction(va, vb, *ascending);
+        if ord != std::cmp::Ordering::Equal {
+            return ord;
+        }
+    }
+    std::cmp::Ordering::Equal
+}
+
+/// Compare two key values, applying the window ORDER BY null convention:
+/// NULLS LAST under ASC, NULLS FIRST under DESC.
+fn compare_with_direction(
+    a: &serde_json::Value,
+    b: &serde_json::Value,
+    ascending: bool,
+) -> std::cmp::Ordering {
+    use serde_json::Value as J;
+    use std::cmp::Ordering;
+
+    let base = match (a, b) {
+        (J::Null, J::Null) => Ordering::Equal,
+        (J::Null, _) => Ordering::Greater,
+        (_, J::Null) => Ordering::Less,
+        _ => json_rank(a).cmp(&json_rank(b)).then_with(|| {
+            if let (Some(x), Some(y)) = (as_f64(a), as_f64(b)) {
+                x.partial_cmp(&y).unwrap_or(Ordering::Equal)
+            } else {
+                a.to_string().cmp(&b.to_string())
+            }
+        }),
+    };
+    if ascending { base } else { base.reverse() }
+}
+
+/// Rank JSON kinds so mixed-type keys still compare deterministically.
+fn json_rank(v: &serde_json::Value) -> u8 {
+    use serde_json::Value as J;
+    match v {
+        J::Null => 0,
+        J::Bool(_) => 1,
+        J::Number(_) => 2,
+        J::String(_) => 3,
+        J::Array(_) => 4,
+        J::Object(_) => 5,
+    }
+}
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs b/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs
new file mode 100644
index 000000000..2fac116f9
--- /dev/null
+++ b/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs
@@ -0,0 +1,285 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Consume-tracking cursor over a graph DSL token list.
+//!
+//! The module's parse is seek-based: a clause reader finds its keyword
+//! wherever it appears and ignores every token between. That is fine while
+//! every token belongs to some clause. It is wrong the moment a token belongs
+//! to none: `GRAPH TRAVERSE FROM 1 DEPTS 3 IN g` finds no `DEPTH`, defaults
+//! the depth, and leaves `DEPTS 3` unread — the statement answers a different
+//! question than it asked, with no error.
+//!
+//! The cursor records which tokens each clause consumed. After the statement
+//! is built, [`Cursor::finish`] refuses the first token no clause claimed.
+//! A typo is then a parse error that names the token, and a new clause cannot
+//! be added without deciding what it consumes.
+
+use super::tokenizer::Tok;
+use crate::error::SqlError;
+
+/// A token list plus the set of tokens a clause has claimed.
+pub(super) struct Cursor<'a> {
+    toks: Vec<Tok<'a>>,
+    used: Vec<bool>,
+}
+
+impl<'a> Cursor<'a> {
+    /// Build a cursor over `toks`. The first `prefix_len` tokens are the
+    /// command words (`GRAPH TRAVERSE`), which the dispatcher matched and no
+    /// clause will claim.
+    pub(super) fn new(toks: Vec<Tok<'a>>, prefix_len: usize) -> Self {
+        let mut used = vec![false; toks.len()];
+        for slot in used.iter_mut().take(prefix_len.min(toks.len())) {
+            *slot = true;
+        }
+        Self { toks, used }
+    }
+
+    fn is_keyword(tok: &Tok<'_>, keyword: &str) -> bool {
+        matches!(tok, Tok::Word(w) if w.eq_ignore_ascii_case(keyword))
+    }
+
+    /// Position of `keyword`, claiming it. A keyword already claimed by an
+    /// earlier clause still matches: `IN` in one statement is one clause, but
+    /// the seek-based readers may be called in any order.
+    fn find(&mut self, keyword: &str) -> Option<usize> {
+        let pos = self
+            .toks
+            .iter()
+            .position(|tok| Self::is_keyword(tok, keyword))?;
+        self.used[pos] = true;
+        Some(pos)
+    }
+
+    /// Claim the value token at `pos` when it is a word or a quoted literal.
+    /// An object literal is claimed by the callers that accept one.
+    fn claim_text(&mut self, pos: usize) -> Option<String> {
+        let value = match self.toks.get(pos)? {
+            Tok::Quoted(s) => s.clone().into_owned(),
+            Tok::Word(w) => (*w).to_string(),
+            Tok::Object(_) => return None,
+        };
+        self.used[pos] = true;
+        Some(value)
+    }
+
+    /// The word or quoted literal after `keyword`.
+    pub(super) fn quoted_after(&mut self, keyword: &str) -> Option<String> {
+        let pos = self.find(keyword)?;
+        self.claim_text(pos + 1)
+    }
+
+    /// Every consecutive word or quoted literal after `keyword`, up to the
+    /// first token that is neither. Used by `AS <label> [, <label>…]`.
+    pub(super) fn quoted_list_after(&mut self, keyword: &str) -> Vec<String> {
+        let Some(pos) = self.find(keyword) else {
+            return Vec::new();
+        };
+        let mut out = Vec::new();
+        let mut at = pos + 1;
+        while let Some(value) = self.claim_text(at) {
+            out.push(value);
+            at += 1;
+        }
+        out
+    }
+
+    /// The brace-balanced object literal after `keyword`.
+    pub(super) fn object_after(&mut self, keyword: &str) -> Option<String> {
+        let pos = self.find(keyword)?;
+        match self.toks.get(pos + 1)? {
+            Tok::Object(s) => {
+                self.used[pos + 1] = true;
+                Some((*s).to_string())
+            }
+            _ => None,
+        }
+    }
+
+    /// The bare word after `keyword`.
+    pub(super) fn word_after(&mut self, keyword: &str) -> Option<String> {
+        let pos = self.find(keyword)?;
+        match self.toks.get(pos + 1)? {
+            Tok::Word(w) => {
+                self.used[pos + 1] = true;
+                Some((*w).to_string())
+            }
+            _ => None,
+        }
+    }
+
+    /// The unsigned integer after `keyword`.
+    pub(super) fn usize_after(&mut self, keyword: &str) -> Option<usize> {
+        self.word_after(keyword)?.parse().ok()
+    }
+
+    /// The float after `keyword`.
+    pub(super) fn float_after(&mut self, keyword: &str) -> Option<f64> {
+        self.word_after(keyword)?.parse().ok()
+    }
+
+    /// The next `count` float words after `keyword`.
+    ///
+    /// Used by the cursor's own tests; the fixed-arity clause families that
+    /// would call it at runtime still read their floats through
+    /// `helpers::array_floats_after`. Kept as the typed accessor the cursor
+    /// tests pin the `claim` bookkeeping to.
+    #[allow(dead_code)] // exercised from `#[cfg(test)]`, so the lib build has no caller
+    pub(super) fn floats_after<const N: usize>(&mut self, keyword: &str) -> Option<[f64; N]> {
+        let pos = self.find(keyword)?;
+        let mut out = [0.0f64; N];
+        for (offset, slot) in out.iter_mut().enumerate() {
+            let value = match self.toks.get(pos + 1 + offset)? {
+                Tok::Word(w) => w.parse::<f64>().ok()?,
+                _ => return None,
+            };
+            self.used[pos + 1 + offset] = true;
+            *slot = value;
+        }
+        Some(out)
+    }
+
+    /// Read a `DIRECTION` clause.
+    ///
+    /// An omitted clause defaults to `out`. A value outside the vocabulary is
+    /// refused by name — defaulting it would answer a question the caller did
+    /// not ask, and `DIRECTION INBOUND` is indistinguishable from `DIRECTION
+    /// BANANA` once both have become `out`.
+    pub(super) fn direction_after(
+        &mut self,
+        keyword: &str,
+    ) -> Result<super::super::statement::GraphDirection, SqlError> {
+        use super::super::statement::GraphDirection;
+        let Some(word) = self.word_after(keyword) else {
+            return Ok(GraphDirection::Out);
+        };
+        match word.to_ascii_uppercase().as_str() {
+            "IN" => Ok(GraphDirection::In),
+            "OUT" => Ok(GraphDirection::Out),
+            "BOTH" => Ok(GraphDirection::Both),
+            _ => Err(SqlError::Parse {
+                detail: format!("{keyword} must be one of in, out, both — found '{word}'"),
+            }),
+        }
+    }
+
+    /// An optional numeric clause, refusing a value that is present but not a
+    /// number. `Ok(None)` means the clause was omitted, so the caller applies
+    /// its own default; it never means "the value was unreadable".
+    pub(super) fn usize_after_checked(&mut self, keyword: &str) -> Result<Option<usize>, SqlError> {
+        let Some(word) = self.word_after(keyword) else {
+            return Ok(None);
+        };
+        word.parse().map(Some).map_err(|_| SqlError::Parse {
+            detail: format!("{keyword} must be a non-negative integer — found '{word}'"),
+        })
+    }
+
+    /// The `PROPERTIES {…}` / `PROPERTIES 'literal'` clause.
+    pub(super) fn extract_properties(&mut self) -> super::super::statement::GraphProperties {
+        use super::super::statement::GraphProperties;
+        let Some(pos) = self.find("PROPERTIES") else {
+            return GraphProperties::None;
+        };
+        match self.toks.get(pos + 1) {
+            Some(Tok::Object(obj_str)) => {
+                self.used[pos + 1] = true;
+                GraphProperties::Object((*obj_str).to_string())
+            }
+            Some(Tok::Quoted(s)) => {
+                self.used[pos + 1] = true;
+                GraphProperties::Quoted(s.clone().into_owned())
+            }
+            _ => GraphProperties::None,
+        }
+    }
+
+    /// The token slice, for readers that validate their own span (fusion
+    /// parameters read the bracket payload from the raw statement text).
+    pub(super) fn tokens(&self) -> &[Tok<'a>] {
+        &self.toks
+    }
+
+    /// Claim every remaining token.
+    ///
+    /// For a statement whose parameters a dedicated extractor validated
+    /// (`GRAPH RAG FUSION`), where this cursor's clause readers do not see the
+    /// bracket payload the extractor reads from the raw text.
+    pub(super) fn consume_rest(&mut self) {
+        for slot in self.used.iter_mut() {
+            *slot = true;
+        }
+    }
+
+    /// Refuse the first token no clause claimed.
+    pub(super) fn finish(self, statement: &str) -> Result<(), SqlError> {
+        for (tok, used) in self.toks.iter().zip(self.used.iter()) {
+            if *used {
+                continue;
+            }
+            let text = match tok {
+                Tok::Word(w) => (*w).to_string(),
+                Tok::Quoted(s) => s.to_string(),
+                Tok::Object(_) => "{…}".to_string(),
+            };
+            return Err(SqlError::Parse {
+                detail: format!("{statement}: unexpected token '{text}'"),
+            });
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ddl_ast::graph_parse::tokenizer::tokenize;
+
+    #[test]
+    fn a_mistyped_keyword_is_left_unclaimed() {
+        let toks = tokenize("GRAPH TRAVERSE FROM 1 DEPTS 3 IN g");
+        let mut cursor = Cursor::new(toks, 2);
+        assert_eq!(cursor.quoted_after("FROM").as_deref(), Some("1"));
+        assert_eq!(cursor.quoted_after("IN").as_deref(), Some("g"));
+        assert!(cursor.usize_after_checked("DEPTH").unwrap().is_none());
+        let err = cursor.finish("GRAPH TRAVERSE").unwrap_err();
+        assert!(
+            err.to_string().contains("DEPTS"),
+            "the error must name the unclaimed token: {err}"
+        );
+    }
+
+    #[test]
+    fn a_consumed_clause_leaves_nothing_unclaimed() {
+        let toks = tokenize("GRAPH TRAVERSE FROM 1 DEPTH 3 IN g DIRECTION both");
+        let mut cursor = Cursor::new(toks, 2);
+        assert_eq!(cursor.quoted_after("FROM").as_deref(), Some("1"));
+        assert_eq!(cursor.usize_after_checked("DEPTH").unwrap(), Some(3));
+        assert_eq!(cursor.quoted_after("IN").as_deref(), Some("g"));
+        let _ = cursor.direction_after("DIRECTION").unwrap();
+        cursor
+            .finish("GRAPH TRAVERSE")
+            .expect("every token claimed");
+    }
+
+    #[test]
+    fn a_stray_quoted_literal_is_refused() {
+        let toks = tokenize("GRAPH PATH FROM 'a' TO 'b' 'stray'");
+        let mut cursor = Cursor::new(toks, 2);
+        assert_eq!(cursor.quoted_after("FROM").as_deref(), Some("a"));
+        assert_eq!(cursor.quoted_after("TO").as_deref(), Some("b"));
+        let err = cursor.finish("GRAPH PATH").unwrap_err();
+        assert!(err.to_string().contains("stray"), "{err}");
+    }
+
+    #[test]
+    fn a_float_pair_is_claimed_together() {
+        let toks = tokenize("GRAPH RAG FUSION ON g RRF_K (60.0, 35.0)");
+        let mut cursor = Cursor::new(toks, 3);
+        assert_eq!(cursor.word_after("ON").as_deref(), Some("g"));
+        assert_eq!(cursor.floats_after::<2>("RRF_K"), Some([60.0, 35.0]));
+        cursor
+            .finish("GRAPH RAG FUSION")
+            .expect("every token claimed");
+    }
+}
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/entry.rs b/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
index 1976639ac..cc138dd02 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
@@ -3,7 +3,11 @@
 //! Graph DSL entry point.
 
 use super::super::statement::{GraphStmt, NodedbStatement};
-use super::{tokenizer, variants};
+use super::{
+    cursor::Cursor,
+    tokenizer::{self, Tok},
+    variants,
+};
 use crate::error::SqlError;
 
 /// Parse a graph DSL statement.
@@ -31,23 +35,29 @@ pub fn try_parse(sql: &str) -> Option<Result<NodedbStatement, SqlError>> {
     let toks = tokenizer::tokenize(trimmed);
 
     let parsed = if upper.starts_with("GRAPH INSERT EDGE ") {
-        variants::parse_insert_edge(&toks)
+        run(toks, 3, "GRAPH INSERT EDGE", variants::parse_insert_edge)
     } else if upper.starts_with("GRAPH DELETE EDGE ") {
-        variants::parse_delete_edge(&toks)
+        run(toks, 3, "GRAPH DELETE EDGE", variants::parse_delete_edge)
     } else if upper.starts_with("GRAPH LABEL ") {
-        variants::parse_set_labels(&toks, false)
+        run(toks, 2, "GRAPH LABEL", |cursor| {
+            variants::parse_set_labels(cursor, false)
+        })
     } else if upper.starts_with("GRAPH UNLABEL ") {
-        variants::parse_set_labels(&toks, true)
+        run(toks, 2, "GRAPH UNLABEL", |cursor| {
+            variants::parse_set_labels(cursor, true)
+        })
     } else if upper.starts_with("GRAPH TRAVERSE ") {
-        variants::parse_traverse(&toks)
+        run(toks, 2, "GRAPH TRAVERSE", variants::parse_traverse)
     } else if upper.starts_with("GRAPH NEIGHBORS ") {
-        variants::parse_neighbors(&toks)
+        run(toks, 2, "GRAPH NEIGHBORS", variants::parse_neighbors)
     } else if upper.starts_with("GRAPH PATH ") {
-        variants::parse_path(&toks)
+        run(toks, 2, "GRAPH PATH", variants::parse_path)
     } else if upper.starts_with("GRAPH ALGO ") {
-        variants::parse_algo(&toks)
+        run(toks, 2, "GRAPH ALGO", variants::parse_algo)
     } else if upper.starts_with("GRAPH RAG FUSION ") {
-        variants::parse_rag_fusion(&toks, trimmed)
+        run(toks, 3, "GRAPH RAG FUSION", |cursor| {
+            variants::parse_rag_fusion(cursor, trimmed)
+        })
     } else {
         // Starts with `GRAPH ` but names no known command. Still graph DSL,
         // so report it here rather than letting the SQL parser guess.
@@ -59,6 +69,22 @@ pub fn try_parse(sql: &str) -> Option<Result<NodedbStatement, SqlError>> {
     Some(parsed)
 }
 
+/// Run one variant with a consume-tracking cursor, then refuse any token the
+/// statement left unclaimed.
+///
+/// `prefix_len` counts the command words the dispatcher matched
+/// (`GRAPH TRAVERSE` is two, `GRAPH INSERT EDGE` is three); no clause claims
+/// them.
+fn run<'a>(
+    toks: Vec<Tok<'a>>,
+    prefix_len: usize,
+    statement: &str,
+    parse: impl FnOnce(&mut Cursor<'a>) -> Result<NodedbStatement, SqlError>,
+) -> Result<NodedbStatement, SqlError> {
+    let mut cursor = Cursor::new(toks, prefix_len);
+    parse(&mut cursor).and_then(|stmt| cursor.finish(statement).map(|()| stmt))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/helpers.rs b/nodedb-sql/src/ddl_ast/graph_parse/helpers.rs
index c109438f3..7a9f0db59 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/helpers.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/helpers.rs
@@ -1,9 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 
-use super::{
-    super::statement::{GraphDirection, GraphProperties},
-    tokenizer::Tok,
-};
+use super::tokenizer::Tok;
 use crate::error::SqlError;
 
 pub(super) fn find_keyword(toks: &[Tok<'_>], keyword: &str) -> Option<usize> {
@@ -20,31 +17,10 @@ pub(super) fn quoted_after(toks: &[Tok<'_>], keyword: &str) -> Option<String> {
     }
 }
 
-pub(super) fn quoted_list_after(toks: &[Tok<'_>], keyword: &str) -> Vec<String> {
-    let Some(pos) = find_keyword(toks, keyword) else {
-        return Vec::new();
-    };
-    toks[pos + 1..]
-        .iter()
-        .map_while(|t| match t {
-            Tok::Quoted(s) => Some(s.clone().into_owned()),
-            _ => None,
-        })
-        .collect()
-}
-
 /// Extract a brace-balanced object literal (`{…}`, braces included) that
 /// immediately follows `keyword`. Used for `PERSONALIZATION {…}` in
 /// `GRAPH ALGO`. Returns `None` when the keyword is absent or is not followed
 /// by an object token.
-pub(super) fn object_after(toks: &[Tok<'_>], keyword: &str) -> Option<String> {
-    let pos = find_keyword(toks, keyword)?;
-    match toks.get(pos + 1)? {
-        Tok::Object(s) => Some((*s).to_string()),
-        _ => None,
-    }
-}
-
 pub(super) fn word_after(toks: &[Tok<'_>], keyword: &str) -> Option<String> {
     let pos = find_keyword(toks, keyword)?;
     if let Tok::Word(w) = toks.get(pos + 1)? {
@@ -58,10 +34,6 @@ pub(super) fn usize_after(toks: &[Tok<'_>], keyword: &str) -> Option<usize> {
     word_after(toks, keyword)?.parse().ok()
 }
 
-pub(super) fn float_after(toks: &[Tok<'_>], keyword: &str) -> Option<f64> {
-    word_after(toks, keyword)?.parse().ok()
-}
-
 /// Extract the two consecutive float tokens that follow `keyword`.
 ///
 /// The tokenizer strips `(` and `)`, so `RRF_K (60.0, 35.0)` becomes the
@@ -102,41 +74,6 @@ pub(super) fn float_triple_after(toks: &[Tok<'_>], keyword: &str) -> Option<(f64
     Some((k1, k2, k3))
 }
 
-/// Read a `DIRECTION` clause.
-///
-/// An omitted clause defaults to `out`. A value outside the vocabulary is
-/// refused by name — defaulting it would answer a question the caller did
-/// not ask, and `DIRECTION INBOUND` is indistinguishable from `DIRECTION
-/// BANANA` once both have become `out`.
-pub(super) fn direction_after(toks: &[Tok<'_>]) -> Result<GraphDirection, SqlError> {
-    let Some(word) = word_after(toks, "DIRECTION") else {
-        return Ok(GraphDirection::Out);
-    };
-    match word.to_ascii_uppercase().as_str() {
-        "IN" => Ok(GraphDirection::In),
-        "OUT" => Ok(GraphDirection::Out),
-        "BOTH" => Ok(GraphDirection::Both),
-        _ => Err(SqlError::Parse {
-            detail: format!("DIRECTION must be one of in, out, both — found '{word}'"),
-        }),
-    }
-}
-
-/// Read an optional numeric clause, refusing a value that is present but
-/// not a number. `Ok(None)` means the clause was omitted, so the caller
-/// applies its own default; it never means "the value was unreadable".
-pub(super) fn usize_after_checked(
-    toks: &[Tok<'_>],
-    keyword: &str,
-) -> Result<Option<usize>, SqlError> {
-    let Some(word) = word_after(toks, keyword) else {
-        return Ok(None);
-    };
-    word.parse().map(Some).map_err(|_| SqlError::Parse {
-        detail: format!("{keyword} must be a non-negative integer — found '{word}'"),
-    })
-}
-
 /// A required clause was absent.
 pub(super) fn missing_clause(statement: &str, clause: &str) -> SqlError {
     SqlError::Parse {
@@ -144,17 +81,6 @@ pub(super) fn missing_clause(statement: &str, clause: &str) -> SqlError {
     }
 }
 
-pub(super) fn extract_properties(toks: &[Tok<'_>]) -> GraphProperties {
-    let Some(pos) = find_keyword(toks, "PROPERTIES") else {
-        return GraphProperties::None;
-    };
-    match toks.get(pos + 1) {
-        Some(Tok::Object(obj_str)) => GraphProperties::Object((*obj_str).to_string()),
-        Some(Tok::Quoted(s)) => GraphProperties::Quoted(s.clone().into_owned()),
-        _ => GraphProperties::None,
-    }
-}
-
 /// Extract `ARRAY[f1, f2, …]` that appears after `keyword` in raw SQL.
 ///
 /// Used for `QUERY ARRAY[…]` in `GRAPH RAG FUSION` where the vector payload
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/mod.rs b/nodedb-sql/src/ddl_ast/graph_parse/mod.rs
index aab9f0408..fbc404dc0 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/mod.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/mod.rs
@@ -20,6 +20,7 @@
 //! vocabulary, means no statement reaches the boundary at all. Both are
 //! reported as a parse error naming what is wrong.
 
+mod cursor;
 mod entry;
 pub mod fusion_params;
 mod helpers;
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/variants.rs b/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
index 6939e724b..917128bf8 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
@@ -7,26 +7,35 @@
 //! here, so "this clause is missing" must not be reported the same way as
 //! "this was never a graph statement" — the second sends the input to the
 //! general SQL parser, which can only say `GRAPH` is not SQL.
+//!
+//! Each parser reads its clauses through [`Cursor`], which claims the tokens
+//! it consumes; the dispatcher refuses any token left unclaimed. A mistyped
+//! keyword is then a parse error naming the token, not a silently defaulted
+//! clause.
 
 use super::{
     super::statement::{GraphStmt, NodedbStatement},
+    cursor::Cursor,
     fusion_params::{FusionParams, RAG_FUSION_KEYWORDS},
-    helpers::{
-        direction_after, extract_properties, missing_clause, quoted_after, quoted_list_after,
-        usize_after, usize_after_checked, word_after,
-    },
-    tokenizer::Tok,
+    helpers::missing_clause,
 };
 use crate::error::SqlError;
 
-pub(super) fn parse_insert_edge(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlError> {
+pub(super) fn parse_insert_edge(cursor: &mut Cursor<'_>) -> Result<NodedbStatement, SqlError> {
     const STMT: &str = "GRAPH INSERT EDGE";
-    let collection =
-        quoted_after(toks, "IN").ok_or_else(|| missing_clause(STMT, "IN <collection>"))?;
-    let src = quoted_after(toks, "FROM").ok_or_else(|| missing_clause(STMT, "FROM <node>"))?;
-    let dst = quoted_after(toks, "TO").ok_or_else(|| missing_clause(STMT, "TO <node>"))?;
-    let label = quoted_after(toks, "TYPE").ok_or_else(|| missing_clause(STMT, "TYPE <label>"))?;
-    let properties = extract_properties(toks);
+    let collection = cursor
+        .quoted_after("IN")
+        .ok_or_else(|| missing_clause(STMT, "IN <collection>"))?;
+    let src = cursor
+        .quoted_after("FROM")
+        .ok_or_else(|| missing_clause(STMT, "FROM <node>"))?;
+    let dst = cursor
+        .quoted_after("TO")
+        .ok_or_else(|| missing_clause(STMT, "TO <node>"))?;
+    let label = cursor
+        .quoted_after("TYPE")
+        .ok_or_else(|| missing_clause(STMT, "TYPE <label>"))?;
+    let properties = cursor.extract_properties();
     Ok(NodedbStatement::Graph(GraphStmt::GraphInsertEdge {
         collection,
         src,
@@ -36,13 +45,20 @@ pub(super) fn parse_insert_edge(toks: &[Tok<'_>]) -> Result<NodedbStatement, Sql
     }))
 }
 
-pub(super) fn parse_delete_edge(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlError> {
+pub(super) fn parse_delete_edge(cursor: &mut Cursor<'_>) -> Result<NodedbStatement, SqlError> {
     const STMT: &str = "GRAPH DELETE EDGE";
-    let collection =
-        quoted_after(toks, "IN").ok_or_else(|| missing_clause(STMT, "IN <collection>"))?;
-    let src = quoted_after(toks, "FROM").ok_or_else(|| missing_clause(STMT, "FROM <node>"))?;
-    let dst = quoted_after(toks, "TO").ok_or_else(|| missing_clause(STMT, "TO <node>"))?;
-    let label = quoted_after(toks, "TYPE").ok_or_else(|| missing_clause(STMT, "TYPE <label>"))?;
+    let collection = cursor
+        .quoted_after("IN")
+        .ok_or_else(|| missing_clause(STMT, "IN <collection>"))?;
+    let src = cursor
+        .quoted_after("FROM")
+        .ok_or_else(|| missing_clause(STMT, "FROM <node>"))?;
+    let dst = cursor
+        .quoted_after("TO")
+        .ok_or_else(|| missing_clause(STMT, "TO <node>"))?;
+    let label = cursor
+        .quoted_after("TYPE")
+        .ok_or_else(|| missing_clause(STMT, "TYPE <label>"))?;
     Ok(NodedbStatement::Graph(GraphStmt::GraphDeleteEdge {
         collection,
         src,
@@ -52,13 +68,14 @@ pub(super) fn parse_delete_edge(toks: &[Tok<'_>]) -> Result<NodedbStatement, Sql
 }
 
 pub(super) fn parse_set_labels(
-    toks: &[Tok<'_>],
+    cursor: &mut Cursor<'_>,
     remove: bool,
 ) -> Result<NodedbStatement, SqlError> {
     let keyword = if remove { "UNLABEL" } else { "LABEL" };
-    let node_id = quoted_after(toks, keyword)
+    let node_id = cursor
+        .quoted_after(keyword)
         .ok_or_else(|| missing_clause(&format!("GRAPH {keyword}"), "<node>"))?;
-    let labels = quoted_list_after(toks, "AS");
+    let labels = cursor.quoted_list_after("AS");
     Ok(NodedbStatement::Graph(GraphStmt::GraphSetLabels {
         node_id,
         labels,
@@ -66,14 +83,17 @@ pub(super) fn parse_set_labels(
     }))
 }
 
-pub(super) fn parse_traverse(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlError> {
+pub(super) fn parse_traverse(cursor: &mut Cursor<'_>) -> Result<NodedbStatement, SqlError> {
     const STMT: &str = "GRAPH TRAVERSE";
-    let collection =
-        quoted_after(toks, "IN").ok_or_else(|| missing_clause(STMT, "IN <collection>"))?;
-    let start = quoted_after(toks, "FROM").ok_or_else(|| missing_clause(STMT, "FROM <node>"))?;
-    let depth = usize_after_checked(toks, "DEPTH")?.unwrap_or(2);
-    let edge_label = quoted_after(toks, "LABEL");
-    let direction = direction_after(toks)?;
+    let collection = cursor
+        .quoted_after("IN")
+        .ok_or_else(|| missing_clause(STMT, "IN <collection>"))?;
+    let start = cursor
+        .quoted_after("FROM")
+        .ok_or_else(|| missing_clause(STMT, "FROM <node>"))?;
+    let depth = cursor.usize_after_checked("DEPTH")?.unwrap_or(2);
+    let edge_label = cursor.quoted_after("LABEL");
+    let direction = cursor.direction_after("DIRECTION")?;
     Ok(NodedbStatement::Graph(GraphStmt::GraphTraverse {
         collection,
         start,
@@ -83,13 +103,16 @@ pub(super) fn parse_traverse(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlErr
     }))
 }
 
-pub(super) fn parse_neighbors(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlError> {
+pub(super) fn parse_neighbors(cursor: &mut Cursor<'_>) -> Result<NodedbStatement, SqlError> {
     const STMT: &str = "GRAPH NEIGHBORS";
-    let collection =
-        quoted_after(toks, "IN").ok_or_else(|| missing_clause(STMT, "IN <collection>"))?;
-    let node = quoted_after(toks, "OF").ok_or_else(|| missing_clause(STMT, "OF <node>"))?;
-    let edge_label = quoted_after(toks, "LABEL");
-    let direction = direction_after(toks)?;
+    let collection = cursor
+        .quoted_after("IN")
+        .ok_or_else(|| missing_clause(STMT, "IN <collection>"))?;
+    let node = cursor
+        .quoted_after("OF")
+        .ok_or_else(|| missing_clause(STMT, "OF <node>"))?;
+    let edge_label = cursor.quoted_after("LABEL");
+    let direction = cursor.direction_after("DIRECTION")?;
     Ok(NodedbStatement::Graph(GraphStmt::GraphNeighbors {
         collection,
         node,
@@ -98,14 +121,19 @@ pub(super) fn parse_neighbors(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlEr
     }))
 }
 
-pub(super) fn parse_path(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlError> {
+pub(super) fn parse_path(cursor: &mut Cursor<'_>) -> Result<NodedbStatement, SqlError> {
     const STMT: &str = "GRAPH PATH";
-    let collection =
-        quoted_after(toks, "IN").ok_or_else(|| missing_clause(STMT, "IN <collection>"))?;
-    let src = quoted_after(toks, "FROM").ok_or_else(|| missing_clause(STMT, "FROM <node>"))?;
-    let dst = quoted_after(toks, "TO").ok_or_else(|| missing_clause(STMT, "TO <node>"))?;
-    let max_depth = usize_after_checked(toks, "MAX_DEPTH")?.unwrap_or(10);
-    let edge_label = quoted_after(toks, "LABEL");
+    let collection = cursor
+        .quoted_after("IN")
+        .ok_or_else(|| missing_clause(STMT, "IN <collection>"))?;
+    let src = cursor
+        .quoted_after("FROM")
+        .ok_or_else(|| missing_clause(STMT, "FROM <node>"))?;
+    let dst = cursor
+        .quoted_after("TO")
+        .ok_or_else(|| missing_clause(STMT, "TO <node>"))?;
+    let max_depth = cursor.usize_after_checked("MAX_DEPTH")?.unwrap_or(10);
+    let edge_label = cursor.quoted_after("LABEL");
     Ok(NodedbStatement::Graph(GraphStmt::GraphPath {
         collection,
         src,
@@ -115,24 +143,23 @@ pub(super) fn parse_path(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlError>
     }))
 }
 
-pub(super) fn parse_algo(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlError> {
+pub(super) fn parse_algo(cursor: &mut Cursor<'_>) -> Result<NodedbStatement, SqlError> {
     const STMT: &str = "GRAPH ALGO";
-    let algorithm = super::helpers::find_keyword(toks, "ALGO")
-        .and_then(|i| match toks.get(i + 1)? {
-            Tok::Word(w) => Some(w.to_ascii_uppercase()),
-            _ => None,
-        })
+    let algorithm = cursor
+        .word_after("ALGO")
+        .map(|word| word.to_ascii_uppercase())
         .ok_or_else(|| missing_clause(STMT, "ALGO <algorithm>"))?;
 
     // Accept either a bare word (`ON users`) or a quoted literal (`ON 'users'`)
     // so clients can escape collection names safely.
-    let collection_raw =
-        quoted_after(toks, "ON").ok_or_else(|| missing_clause(STMT, "ON <collection>"))?;
+    let collection_raw = cursor
+        .quoted_after("ON")
+        .ok_or_else(|| missing_clause(STMT, "ON <collection>"))?;
 
     // Reject the `ON (subquery)` form: the tokenizer strips `(` and `)`, so
-    // `ON (SELECT …)` becomes `[ON, SELECT, …]` and `quoted_after("ON")`
-    // returns `"SELECT"`, which would be stored as the collection name and
-    // then ignored — producing tenant-wide results.
+    // `ON (SELECT …)` becomes `[ON, SELECT, …]` and the reader returns
+    // `"SELECT"`, which would be stored as the collection name and then
+    // ignored — producing tenant-wide results.
     const SUBQUERY_KEYWORDS: &[&str] = &["SELECT", "WITH", "VALUES", "TABLE"];
     if SUBQUERY_KEYWORDS
         .iter()
@@ -147,30 +174,90 @@ pub(super) fn parse_algo(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlError>
     Ok(NodedbStatement::Graph(GraphStmt::GraphAlgo {
         algorithm,
         collection,
-        edge_label: quoted_after(toks, "EDGE_LABEL"),
-        damping: super::helpers::float_after(toks, "DAMPING"),
-        tolerance: super::helpers::float_after(toks, "TOLERANCE"),
-        resolution: super::helpers::float_after(toks, "RESOLUTION"),
-        max_iterations: usize_after(toks, "ITERATIONS"),
-        sample_size: usize_after(toks, "SAMPLE"),
-        source_node: quoted_after(toks, "FROM").or_else(|| quoted_after(toks, "SOURCE")),
-        direction: word_after(toks, "DIRECTION"),
-        mode: word_after(toks, "MODE"),
-        personalization: super::helpers::object_after(toks, "PERSONALIZATION"),
+        edge_label: cursor.quoted_after("EDGE_LABEL"),
+        damping: cursor.float_after("DAMPING"),
+        tolerance: cursor.float_after("TOLERANCE"),
+        resolution: cursor.float_after("RESOLUTION"),
+        max_iterations: cursor.usize_after("ITERATIONS"),
+        sample_size: cursor.usize_after("SAMPLE"),
+        source_node: cursor
+            .quoted_after("FROM")
+            .or_else(|| cursor.quoted_after("SOURCE")),
+        direction: cursor.word_after("DIRECTION"),
+        mode: cursor.word_after("MODE"),
+        personalization: cursor.object_after("PERSONALIZATION"),
     }))
 }
 
 /// Parse `GRAPH RAG FUSION ON <collection> QUERY ARRAY[…] [options…]`.
 ///
-/// All fusion parameters are delegated to [`FusionParams::extract`] so
-/// every fusion SQL surface shares one typed, quote-aware extractor.
-pub(super) fn parse_rag_fusion(toks: &[Tok<'_>], sql: &str) -> Result<NodedbStatement, SqlError> {
-    let collection = word_after(toks, "ON")
-        .or_else(|| quoted_after(toks, "ON"))
+/// All fusion parameters are delegated to [`FusionParams::extract`] so every
+/// fusion SQL surface shares one typed, quote-aware extractor. That extractor
+/// reads the bracket payload from the raw text, so it claims no tokens here —
+/// the variant claims the rest, and the extractor's own validation is what
+/// refuses a malformed option.
+pub(super) fn parse_rag_fusion(
+    cursor: &mut Cursor<'_>,
+    sql: &str,
+) -> Result<NodedbStatement, SqlError> {
+    let collection = cursor
+        .word_after("ON")
+        .or_else(|| cursor.quoted_after("ON"))
         .ok_or_else(|| missing_clause("GRAPH RAG FUSION", "ON <collection>"))?;
-    let params = FusionParams::extract(toks, sql, &RAG_FUSION_KEYWORDS);
+    let params = FusionParams::extract(cursor.tokens(), sql, &RAG_FUSION_KEYWORDS);
+    cursor.consume_rest();
     Ok(NodedbStatement::Graph(GraphStmt::GraphRagFusion {
         collection,
         params,
     }))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ddl_ast::graph_parse::cursor::Cursor;
+    use crate::ddl_ast::graph_parse::tokenizer;
+
+    fn parse(sql: &str, prefix_len: usize, statement: &str) -> Result<NodedbStatement, SqlError> {
+        let mut cursor = Cursor::new(tokenizer::tokenize(sql), prefix_len);
+        let parsed = match statement {
+            "GRAPH TRAVERSE" => parse_traverse(&mut cursor),
+            "GRAPH PATH" => parse_path(&mut cursor),
+            other => panic!("unhandled test statement {other}"),
+        };
+        parsed.and_then(|stmt| cursor.finish(statement).map(|()| stmt))
+    }
+
+    #[test]
+    fn a_mistyped_keyword_fails_the_statement() {
+        let err = parse("GRAPH TRAVERSE FROM 1 DEPTS 3 IN g", 2, "GRAPH TRAVERSE")
+            .expect_err("DEPTS is not a clause");
+        assert!(err.to_string().contains("DEPTS"), "{err}");
+    }
+
+    #[test]
+    fn a_valid_statement_still_parses() {
+        let stmt = parse(
+            "GRAPH TRAVERSE FROM 1 DEPTH 3 IN g DIRECTION both",
+            2,
+            "GRAPH TRAVERSE",
+        )
+        .expect("every token belongs to a clause");
+        let NodedbStatement::Graph(GraphStmt::GraphTraverse { depth, .. }) = stmt else {
+            panic!("expected a traverse statement");
+        };
+        assert_eq!(depth, 3);
+    }
+
+    #[test]
+    fn a_stray_literal_fails_the_statement() {
+        // The statement needs its required IN clause: without it the parser
+        // correctly refuses for the missing clause before it ever reaches the
+        // stray token. With IN present, the unclaimed trailing literal is what
+        // the cursor's finish step must name.
+        let err = parse("GRAPH PATH IN g FROM 'a' TO 'b' 'stray'", 2, "GRAPH PATH")
+            .expect_err("the stray literal belongs to no clause");
+        assert!(err.to_string().contains("stray"), "{err}");
+        assert!(err.to_string().contains("unexpected token"), "{err}");
+    }
+}
diff --git a/nodedb-sql/src/planner/aggregate.rs b/nodedb-sql/src/planner/aggregate.rs
index 10a1d8b7c..58539173f 100644
--- a/nodedb-sql/src/planner/aggregate.rs
+++ b/nodedb-sql/src/planner/aggregate.rs
@@ -413,8 +413,13 @@ pub fn extract_aggregates_from_projection(
             // lowercases. Without this match the row description
             // column `count(distinct user_id)` would not resolve to
             // the JSON value stored under `COUNT(DISTINCT user_id)`,
-            // and the client would see NULL.
-            ast::SelectItem::UnnamedExpr(expr) => (expr, format!("{expr}").to_lowercase()),
+            // and the client would see NULL. The lowercase rule lives in
+            // `unaliased_projection_alias` so no site can derive it
+            // differently.
+            ast::SelectItem::UnnamedExpr(expr) => (
+                expr,
+                crate::planner::ast_helpers::unaliased_projection_alias(expr),
+            ),
             ast::SelectItem::ExprWithAlias { expr, alias } => (expr, normalize_ident(alias)),
             _ => continue,
         };
diff --git a/nodedb-sql/src/planner/aggregate_order.rs b/nodedb-sql/src/planner/aggregate_order.rs
index 6b89fe2d2..97e563c68 100644
--- a/nodedb-sql/src/planner/aggregate_order.rs
+++ b/nodedb-sql/src/planner/aggregate_order.rs
@@ -87,7 +87,7 @@ pub fn compute_output_order(
         if crate::aggregate_walk::contains_aggregate(expr, functions) {
             let alias = match item {
                 ast::SelectItem::ExprWithAlias { alias, .. } => normalize_ident(alias),
-                _ => format!("{expr}").to_lowercase(),
+                _ => crate::planner::ast_helpers::unaliased_projection_alias(expr),
             };
             let produced =
                 crate::aggregate_walk::extract_aggregates(expr, &alias, functions, scope)?.len();
diff --git a/nodedb-sql/src/planner/ast_helpers.rs b/nodedb-sql/src/planner/ast_helpers.rs
index d6723e1ee..559b5d9ad 100644
--- a/nodedb-sql/src/planner/ast_helpers.rs
+++ b/nodedb-sql/src/planner/ast_helpers.rs
@@ -19,6 +19,18 @@ pub fn qualified_ident_pair(expr: &ast::Expr) -> Option<(String, String)> {
     }
 }
 
+/// The output name an unaliased projection item takes: the lowercased SQL
+/// text of the expression.
+///
+/// This is the single derivation every consumer must use. A window spec is
+/// matched back to its projection by alias, so deriving the name twice — once
+/// lowercased here, once verbatim in the window extractor — silently detached
+/// every unaliased windowed projection from its spec and answered a NULL
+/// column with no error.
+pub fn unaliased_projection_alias(expr: &ast::Expr) -> String {
+    format!("{expr}").to_lowercase()
+}
+
 /// Flatten a right-leaning AND expression tree into a list of conjuncts.
 pub fn flatten_and_expr(expr: &ast::Expr, out: &mut Vec<ast::Expr>) {
     match expr {
diff --git a/nodedb-sql/src/planner/catalog_fold.rs b/nodedb-sql/src/planner/catalog_fold.rs
index d29db868b..88ee8067c 100644
--- a/nodedb-sql/src/planner/catalog_fold.rs
+++ b/nodedb-sql/src/planner/catalog_fold.rs
@@ -112,6 +112,7 @@ fn walk_plan(
             input,
             mut filters,
             mut projection,
+            mut window_functions,
             mut sort_keys,
             offset,
             distinct,
@@ -122,10 +123,15 @@ fn walk_plan(
             }
             fold_projection(&mut projection, catalog, database_id, tenant_id);
             fold_sort_keys(&mut sort_keys, catalog, database_id, tenant_id);
+            // Window specs carry their own exprs (args, PARTITION BY,
+            // ORDER BY) — a wrapper that skips them leaves catalog casts
+            // inside window exprs unfolded, which then match no row.
+            fold_windows(&mut window_functions, catalog, database_id, tenant_id);
             SqlPlan::Subquery {
                 input: Box::new(walk_plan(*input, catalog, database_id, tenant_id)),
                 filters,
                 projection,
+                window_functions,
                 sort_keys,
                 offset,
                 distinct,
diff --git a/nodedb-sql/src/planner/catalog_plan_validate.rs b/nodedb-sql/src/planner/catalog_plan_validate.rs
index 8f947256e..2f569b626 100644
--- a/nodedb-sql/src/planner/catalog_plan_validate.rs
+++ b/nodedb-sql/src/planner/catalog_plan_validate.rs
@@ -107,12 +107,14 @@ pub(super) fn validate_catalog_exprs(
             filters,
             projection,
             sort_keys,
+            window_functions,
             ..
         } => {
             validate_catalog_exprs(input, catalog, database_id, tenant_id)?;
             validate_filters(filters, catalog, database_id, tenant_id)?;
             validate_projection(projection, catalog, database_id, tenant_id)?;
             validate_sort_keys(sort_keys, catalog, database_id, tenant_id)?;
+            validate_windows(window_functions, catalog, database_id, tenant_id)?;
         }
         SqlPlan::Join {
             left,
diff --git a/nodedb-sql/src/planner/defaults/compiled.rs b/nodedb-sql/src/planner/defaults/compiled.rs
index 9905e3e23..2568d7d89 100644
--- a/nodedb-sql/src/planner/defaults/compiled.rs
+++ b/nodedb-sql/src/planner/defaults/compiled.rs
@@ -186,6 +186,61 @@ pub fn validate_default_expr(expr: &str, column: &str) -> crate::Result<()> {
     CompiledDefault::declare(column, expr).map(|_| ())
 }
 
+/// Whether a declared value-producing expression references a row column.
+///
+/// A column `DEFAULT` and a typeguard `DEFAULT`/`VALUE` are evaluated with no
+/// row in scope, so an expression that names a column can never produce a
+/// value there. Callers that carry such an expression into a column `DEFAULT`
+/// (CONVERT's typeguard path) use this to refuse at declaration time instead
+/// of failing the first insert with [`crate::SqlError::UnevaluableDefault`].
+///
+/// Classifies and parses through the same resolver gate a DEFAULT passes;
+/// evaluates nothing. A second name list or expression walker is not written.
+pub fn default_expr_references_columns(expr: &str) -> crate::Result<bool> {
+    let parsed = crate::parse_expr_string(expr)?;
+    Ok(expr_references_column(&parsed))
+}
+
+/// Recursive column-reference scan over a parsed DEFAULT expression.
+fn expr_references_column(expr: &SqlExpr) -> bool {
+    match expr {
+        SqlExpr::Column { .. } => true,
+        SqlExpr::Literal(_) | SqlExpr::Wildcard | SqlExpr::Subquery(_) => false,
+        SqlExpr::BinaryOp { left, right, .. } => {
+            expr_references_column(left) || expr_references_column(right)
+        }
+        SqlExpr::UnaryOp { expr, .. }
+        | SqlExpr::IsNull { expr, .. }
+        | SqlExpr::Cast { expr, .. } => expr_references_column(expr),
+        SqlExpr::Function { args, .. } => args.iter().any(expr_references_column),
+        SqlExpr::Case {
+            operand,
+            when_then,
+            else_expr,
+        } => {
+            operand.as_deref().is_some_and(expr_references_column)
+                || when_then
+                    .iter()
+                    .any(|(w, t)| expr_references_column(w) || expr_references_column(t))
+                || else_expr.as_deref().is_some_and(expr_references_column)
+        }
+        SqlExpr::InList { expr, list, .. } => {
+            expr_references_column(expr) || list.iter().any(expr_references_column)
+        }
+        SqlExpr::Between {
+            expr, low, high, ..
+        } => {
+            expr_references_column(expr)
+                || expr_references_column(low)
+                || expr_references_column(high)
+        }
+        SqlExpr::Like { expr, pattern, .. } => {
+            expr_references_column(expr) || expr_references_column(pattern)
+        }
+        SqlExpr::ArrayLiteral(items) => items.iter().any(expr_references_column),
+    }
+}
+
 /// Classify a DEFAULT into its compiled form.
 fn classify(column: &str, expr: &str) -> crate::Result<DefaultKind> {
     let upper = expr.trim().to_uppercase();
diff --git a/nodedb-sql/src/planner/defaults/mod.rs b/nodedb-sql/src/planner/defaults/mod.rs
index 98b05a51b..a9755e854 100644
--- a/nodedb-sql/src/planner/defaults/mod.rs
+++ b/nodedb-sql/src/planner/defaults/mod.rs
@@ -26,5 +26,7 @@ mod compiled;
 mod convert;
 mod kind;
 
-pub use compiled::{ColumnDefaults, CompiledDefault, validate_default_expr};
+pub use compiled::{
+    ColumnDefaults, CompiledDefault, default_expr_references_columns, validate_default_expr,
+};
 pub use convert::default_value_to_sql;
diff --git a/nodedb-sql/src/planner/select/entry.rs b/nodedb-sql/src/planner/select/entry.rs
index 48a41f8f6..5e4d54cb1 100644
--- a/nodedb-sql/src/planner/select/entry.rs
+++ b/nodedb-sql/src/planner/select/entry.rs
@@ -49,6 +49,9 @@ fn is_pure_vector_projection(projection: &[Projection]) -> bool {
                 }
             }
             Projection::Star | Projection::QualifiedStar(_) => return false,
+            // A sequence stamp is a client-visible counter, not a column of
+            // the scanned row: this is not the pure vector-search shape.
+            Projection::Sequence { .. } => return false,
         }
     }
     true
@@ -173,6 +176,7 @@ pub fn plan_query(
                     SqlPlan::Subquery {
                         filters,
                         projection,
+                        window_functions,
                         sort_keys,
                         offset,
                         distinct,
@@ -182,6 +186,7 @@ pub fn plan_query(
                         input: Box::new(upgraded_leaf),
                         filters,
                         projection,
+                        window_functions,
                         sort_keys,
                         offset,
                         distinct,
diff --git a/nodedb-sql/src/planner/select/helpers.rs b/nodedb-sql/src/planner/select/helpers.rs
index d8bcc2f2c..cb6e241df 100644
--- a/nodedb-sql/src/planner/select/helpers.rs
+++ b/nodedb-sql/src/planner/select/helpers.rs
@@ -25,6 +25,39 @@ pub(super) fn source_projection(plan: &SqlPlan) -> Vec<Projection> {
     }
 }
 
+/// Recognise `nextval('<literal>')` as a projection item.
+///
+/// Returns the sequence name. The caller turns this into a
+/// [`Projection::Sequence`] without converting the expression, so the
+/// per-row gate in the function resolver never fires for the one accessor
+/// the control plane can evaluate per row. A non-literal argument (a column,
+/// a parameter) is not recognised and keeps the loud refusal.
+fn nextval_sequence_argument(expr: &ast::Expr) -> Option<String> {
+    let ast::Expr::Function(func) = expr else {
+        return None;
+    };
+    let is_nextval = matches!(
+        func.name.0.as_slice(),
+        [ast::ObjectNamePart::Identifier(ident)]
+            if crate::parser::normalize::normalize_ident(ident).eq_ignore_ascii_case("nextval")
+    );
+    if !is_nextval {
+        return None;
+    }
+    let ast::FunctionArguments::List(list) = &func.args else {
+        return None;
+    };
+    match list.args.as_slice() {
+        [ast::FunctionArg::Unnamed(ast::FunctionArgExpr::Expr(ast::Expr::Value(v)))] => {
+            match &v.value {
+                ast::Value::SingleQuotedString(name) => Some(name.clone()),
+                _ => None,
+            }
+        }
+        _ => None,
+    }
+}
+
 /// Convert SELECT projection items.
 pub fn convert_projection(
     items: &[ast::SelectItem],
@@ -35,6 +68,13 @@ pub fn convert_projection(
     for item in items {
         match item {
             ast::SelectItem::UnnamedExpr(expr) => {
+                if let Some(sequence) = nextval_sequence_argument(expr) {
+                    result.push(Projection::Sequence {
+                        sequence,
+                        alias: format!("{expr}").to_lowercase(),
+                    });
+                    continue;
+                }
                 let sql_expr = convert_expr(expr, &scope)?;
                 match &sql_expr {
                     SqlExpr::Column { table, name } => {
@@ -46,12 +86,19 @@ pub fn convert_projection(
                     _ => {
                         result.push(Projection::Computed {
                             expr: sql_expr,
-                            alias: format!("{expr}").to_lowercase(),
+                            alias: crate::planner::ast_helpers::unaliased_projection_alias(expr),
                         });
                     }
                 }
             }
             ast::SelectItem::ExprWithAlias { expr, alias } => {
+                if let Some(sequence) = nextval_sequence_argument(expr) {
+                    result.push(Projection::Sequence {
+                        sequence,
+                        alias: normalize_ident(alias),
+                    });
+                    continue;
+                }
                 let sql_expr = convert_expr(expr, &scope)?;
                 result.push(Projection::Computed {
                     expr: sql_expr,
diff --git a/nodedb-sql/src/planner/select/post_process.rs b/nodedb-sql/src/planner/select/post_process.rs
index 3d351cefa..e5c7de934 100644
--- a/nodedb-sql/src/planner/select/post_process.rs
+++ b/nodedb-sql/src/planner/select/post_process.rs
@@ -37,6 +37,7 @@ pub(in crate::planner::select) fn post_process(
         input: Box::new(input),
         filters: Vec::new(),
         projection,
+        window_functions: Vec::new(),
         sort_keys,
         offset,
         distinct: false,
@@ -128,6 +129,7 @@ fn projects_column(projection: &[Projection], table: Option<&str>, name: &str) -
             projected.eq_ignore_ascii_case(&qualified) || bare(projected).eq_ignore_ascii_case(name)
         }
         Projection::Computed { alias, .. } => alias.eq_ignore_ascii_case(name),
+        Projection::Sequence { alias, .. } => alias.eq_ignore_ascii_case(name),
         Projection::Star | Projection::QualifiedStar(_) => true,
     })
 }
diff --git a/nodedb-sql/src/planner/select/select_stmt.rs b/nodedb-sql/src/planner/select/select_stmt.rs
index 3ab107f9e..8178a9de1 100644
--- a/nodedb-sql/src/planner/select/select_stmt.rs
+++ b/nodedb-sql/src/planner/select/select_stmt.rs
@@ -89,6 +89,25 @@ pub(super) fn plan_select(
                     columns.push(name.clone());
                     values.push(SqlValue::Null);
                 }
+                // A FROM-less `nextval('<literal>')` is recognised as a
+                // sequence projection before the expression resolver runs, so
+                // it never reaches `Projection::Computed`. There is no row set
+                // to stamp: evaluate the accessor here, at plan time, exactly
+                // as a `Computed` accessor would be. Doing so also records the
+                // value in the session's `currval` map and surfaces an
+                // undefined sequence as `42704`.
+                Projection::Sequence { sequence, alias } => {
+                    columns.push(alias.clone());
+                    volatile = true;
+                    let expr = SqlExpr::Function {
+                        name: "nextval".into(),
+                        args: vec![SqlExpr::Literal(SqlValue::String(sequence.clone()))],
+                        distinct: false,
+                    };
+                    values.push(crate::planner::catalog_expr_fold::eval_catalog_constant(
+                        &expr, catalog, functions,
+                    )?);
+                }
                 _ => {
                     columns.push(format!("col{i}"));
                     values.push(SqlValue::Null);
diff --git a/nodedb-sql/src/planner/window/extract.rs b/nodedb-sql/src/planner/window/extract.rs
index 21db3f862..7cc72b75d 100644
--- a/nodedb-sql/src/planner/window/extract.rs
+++ b/nodedb-sql/src/planner/window/extract.rs
@@ -36,7 +36,10 @@ pub fn extract_window_functions(
     let mut specs = Vec::new();
     for item in &select.projection {
         let (expr, alias) = match item {
-            ast::SelectItem::UnnamedExpr(e) => (e, format!("{e}")),
+            ast::SelectItem::UnnamedExpr(e) => (
+                e,
+                crate::planner::ast_helpers::unaliased_projection_alias(e),
+            ),
             ast::SelectItem::ExprWithAlias { expr, alias } => (expr, normalize_ident(alias)),
             _ => continue,
         };
diff --git a/nodedb-sql/src/resolver/derived.rs b/nodedb-sql/src/resolver/derived.rs
index 104c5e1b3..257157bf3 100644
--- a/nodedb-sql/src/resolver/derived.rs
+++ b/nodedb-sql/src/resolver/derived.rs
@@ -86,7 +86,34 @@ fn infer_projection(
     catalog: &dyn SqlCatalog,
     query: &ast::Query,
 ) -> Result<(Vec<ColumnInfo>, bool)> {
-    infer_body(catalog, &query.body)
+    let (mut columns, open) = infer_body(catalog, &query.body)?;
+
+    // The SEARCH preprocessor rewrites `SEARCH c USING VECTOR(...)` into
+    // `SELECT * FROM c ORDER BY vector_distance(...) LIMIT k`, and the
+    // response layer appends a synthetic `distance` cell to every row of such
+    // a query. Derived-relation inference must declare that column: without
+    // it `s.distance` over a closed-schema source resolves against no
+    // relation and is refused with 42703, while the same projection over an
+    // open-schema source runs.
+    if !columns.iter().any(|c| c.name == "distance")
+        && query.order_by.iter().any(|order| match &order.kind {
+            ast::OrderByKind::Expressions(exprs) => {
+                exprs.iter().any(|ordered| match &ordered.expr {
+                    Expr::Function(func) => matches!(
+                        func.name.0.as_slice(),
+                        [ast::ObjectNamePart::Identifier(ident)]
+                            if normalize_ident(ident) == "vector_distance"
+                    ),
+                    _ => false,
+                })
+            }
+            ast::OrderByKind::All(_) => false,
+        })
+    {
+        columns.push(synthetic_column("distance"));
+    }
+
+    Ok((columns, open))
 }
 
 fn infer_body(catalog: &dyn SqlCatalog, body: &SetExpr) -> Result<(Vec<ColumnInfo>, bool)> {
@@ -320,4 +347,22 @@ mod tests {
         assert_eq!(names, vec!["p", "q"]);
         assert_eq!(info.columns[0].data_type, SqlDataType::Int64);
     }
+
+    #[test]
+    fn vector_search_projection_declares_the_synthetic_distance_column() {
+        // `SEARCH c USING VECTOR(...)` preprocesses to `ORDER BY
+        // vector_distance(...)`; the response layer appends a `distance`
+        // cell, so the derived relation must name it even when the source
+        // schema is closed.
+        let info = infer("SELECT * FROM src ORDER BY vector_distance(b, ARRAY[0.1, 0.2]) LIMIT 2");
+        let names: Vec<&str> = info.columns.iter().map(|c| c.name.as_str()).collect();
+        assert!(names.contains(&"distance"), "columns: {names:?}");
+    }
+
+    #[test]
+    fn plain_ordered_projection_has_no_distance_column() {
+        let info = infer("SELECT * FROM src ORDER BY b LIMIT 2");
+        let names: Vec<&str> = info.columns.iter().map(|c| c.name.as_str()).collect();
+        assert!(!names.contains(&"distance"), "columns: {names:?}");
+    }
 }
diff --git a/nodedb-sql/src/types/plan/variants.rs b/nodedb-sql/src/types/plan/variants.rs
index f5ad2b736..4560fbe24 100644
--- a/nodedb-sql/src/types/plan/variants.rs
+++ b/nodedb-sql/src/types/plan/variants.rs
@@ -525,6 +525,9 @@ pub enum SqlPlan {
         filters: Vec<Filter>,
         /// Outer projection (target list). Empty = inherit the body's columns.
         projection: Vec<Projection>,
+        /// Window functions evaluated over the materialized rows. Empty =
+        /// none.
+        window_functions: Vec<crate::types::WindowSpec>,
         /// Outer `ORDER BY` keys applied over the materialized rows.
         sort_keys: Vec<SortKey>,
         /// Outer `OFFSET` (0 = none).
diff --git a/nodedb-sql/src/types/query.rs b/nodedb-sql/src/types/query.rs
index cf5db8743..be478414f 100644
--- a/nodedb-sql/src/types/query.rs
+++ b/nodedb-sql/src/types/query.rs
@@ -66,6 +66,14 @@ pub enum Projection {
     QualifiedStar(String),
     /// Computed expression: `SELECT price * qty AS total`
     Computed { expr: SqlExpr, alias: String },
+    /// Sequence accessor: `SELECT nextval('s') AS n`.
+    ///
+    /// The control plane allocates one value per output row and stamps the
+    /// cell after shaping. The Data Plane never sees the accessor: it holds no
+    /// sequence state and would answer NULL for every row. Only `nextval` in
+    /// a top-level projection item becomes a stamp; an accessor anywhere else
+    /// stays refused at plan time.
+    Sequence { sequence: String, alias: String },
 }
 
 /// Sort key for ORDER BY.
diff --git a/nodedb-sql/src/visitor/plan_visitor/args.rs b/nodedb-sql/src/visitor/plan_visitor/args.rs
index 81207a39a..76e95427a 100644
--- a/nodedb-sql/src/visitor/plan_visitor/args.rs
+++ b/nodedb-sql/src/visitor/plan_visitor/args.rs
@@ -37,6 +37,7 @@ pub struct SubqueryVisitArgs<'a> {
     pub input: &'a SqlPlan,
     pub filters: &'a [Filter],
     pub projection: &'a [Projection],
+    pub window_functions: &'a [crate::types::WindowSpec],
     pub sort_keys: &'a [SortKey],
     pub offset: usize,
     pub distinct: bool,
diff --git a/nodedb-sql/src/visitor/plan_visitor/dispatch_rest.rs b/nodedb-sql/src/visitor/plan_visitor/dispatch_rest.rs
index 0f5f61452..1a24ee07b 100644
--- a/nodedb-sql/src/visitor/plan_visitor/dispatch_rest.rs
+++ b/nodedb-sql/src/visitor/plan_visitor/dispatch_rest.rs
@@ -26,6 +26,7 @@ pub(super) fn dispatch_rest<V: PlanVisitor>(
             input,
             filters,
             projection,
+            window_functions,
             sort_keys,
             offset,
             distinct,
@@ -34,6 +35,7 @@ pub(super) fn dispatch_rest<V: PlanVisitor>(
             input,
             filters,
             projection,
+            window_functions,
             sort_keys,
             offset: *offset,
             distinct: *distinct,
diff --git a/nodedb/src/bridge/mod.rs b/nodedb/src/bridge/mod.rs
index 0d18936ac..70c3a27c7 100644
--- a/nodedb/src/bridge/mod.rs
+++ b/nodedb/src/bridge/mod.rs
@@ -15,6 +15,89 @@ pub mod expr_eval {
 pub mod scan_filter;
 pub mod window_func {
     pub use nodedb_query::window::*;
+
+    /// Evaluate `specs` over MessagePack-encoded object rows, in place.
+    ///
+    /// The rows keep the `nodedb_types::Value` codec end to end. Decoding them
+    /// to JSON first downgrades tagged cells — MessagePack binary has no JSON
+    /// representation, so a `BYTES` cell becomes a base64 `String` — and every
+    /// cell the window set does not even touch changes shape with it.
+    ///
+    /// Every step fails loudly: a malformed row, a non-object row, or an
+    /// evaluator column count that does not match the rows is an internal
+    /// error, never a silently skipped row.
+    pub fn evaluate_window_functions_on_msgpack_rows(
+        rows: &mut [Vec<u8>],
+        specs: &[WindowFuncSpec],
+    ) -> crate::Result<()> {
+        if specs.is_empty() || rows.is_empty() {
+            return Ok(());
+        }
+
+        let mut maps: Vec<nodedb_types::Value> = Vec::with_capacity(rows.len());
+        let mut column_index: std::collections::HashMap<String, usize> =
+            std::collections::HashMap::new();
+        for row in rows.iter() {
+            let value =
+                nodedb_types::value_from_msgpack(row).map_err(|e| crate::Error::Internal {
+                    detail: format!("window row decode: {e}"),
+                })?;
+            let nodedb_types::Value::Object(map) = &value else {
+                return Err(crate::Error::Internal {
+                    detail: "window row is not an object".to_string(),
+                });
+            };
+            for key in map.keys() {
+                let next = column_index.len();
+                column_index.entry(key.clone()).or_insert(next);
+            }
+            maps.push(value);
+        }
+
+        let width = column_index.len();
+        let mut arrays: Vec<Vec<nodedb_types::Value>> = maps
+            .iter()
+            .map(|value| {
+                let nodedb_types::Value::Object(map) = value else {
+                    unreachable!("every row was validated as an object above");
+                };
+                let mut cells = vec![nodedb_types::Value::Null; width];
+                for (key, position) in &column_index {
+                    if let Some(cell) = map.get(key) {
+                        cells[*position] = cell.clone();
+                    }
+                }
+                cells
+            })
+            .collect();
+
+        let new_cols = evaluate_window_functions_value(&mut arrays, &column_index, specs)?;
+
+        for (value, cells) in maps.iter_mut().zip(arrays) {
+            if cells.len() != width + new_cols.len() {
+                return Err(crate::Error::Internal {
+                    detail: format!(
+                        "window evaluator appended {} columns but a row carries {} cells",
+                        new_cols.len(),
+                        cells.len().saturating_sub(width)
+                    ),
+                });
+            }
+            let nodedb_types::Value::Object(map) = value else {
+                unreachable!("every row was validated as an object above");
+            };
+            for (offset, name) in new_cols.iter().enumerate() {
+                map.insert(name.clone(), cells[width + offset].clone());
+            }
+        }
+
+        for (slot, value) in rows.iter_mut().zip(maps) {
+            *slot = nodedb_types::value_to_msgpack(&value).map_err(|e| crate::Error::Internal {
+                detail: format!("window row encode: {e}"),
+            })?;
+        }
+        Ok(())
+    }
 }
 
 pub use admission_chokepoint::writes_bypassed_admission_gate;
diff --git a/nodedb/src/control/clone/resolver/rewrite.rs b/nodedb/src/control/clone/resolver/rewrite.rs
index 237ee8f23..81803de84 100644
--- a/nodedb/src/control/clone/resolver/rewrite.rs
+++ b/nodedb/src/control/clone/resolver/rewrite.rs
@@ -117,6 +117,8 @@ pub fn rewrite_plan_for_source(params: RewriteForSourceParams<'_>) -> crate::Res
             input,
             filters,
             projection,
+            computed_columns,
+            window_functions,
             sort_keys,
             limit,
             offset,
@@ -139,6 +141,8 @@ pub fn rewrite_plan_for_source(params: RewriteForSourceParams<'_>) -> crate::Res
                         input: child,
                         filters: filters.clone(),
                         projection: projection.clone(),
+                        computed_columns: computed_columns.clone(),
+                        window_functions: window_functions.clone(),
                         sort_keys: sort_keys.clone(),
                         limit: *limit,
                         offset: *offset,
@@ -249,6 +253,8 @@ pub fn rewrite_plan_for_source(params: RewriteForSourceParams<'_>) -> crate::Res
             // (clones-of-clones still funnel through here per-level);
             // the resolver overrides it for source delegation below.
             surrogate_ceiling: _,
+            projection,
+            computed_columns,
         }) if collection == &target_qualified => {
             Ok(SourceRewrite::task(PhysicalPlan::Kv(KvOp::Scan {
                 collection: source_qualified,
@@ -258,6 +264,8 @@ pub fn rewrite_plan_for_source(params: RewriteForSourceParams<'_>) -> crate::Res
                 match_pattern: match_pattern.clone(),
                 sort_keys: sort_keys.clone(),
                 surrogate_ceiling: kv_surrogate_ceiling,
+                projection: projection.clone(),
+                computed_columns: computed_columns.clone(),
             })))
         }
 
@@ -626,6 +634,8 @@ mod tests {
                 input: Box::new(gather(plan)),
                 filters: Vec::new(),
                 projection: Vec::new(),
+                computed_columns: Vec::new(),
+                window_functions: Vec::new(),
                 sort_keys: Vec::new(),
                 limit: None,
                 offset: 0,
diff --git a/nodedb/src/control/insert_select/expand_staged.rs b/nodedb/src/control/insert_select/expand_staged.rs
index 583c42011..ea2f7cada 100644
--- a/nodedb/src/control/insert_select/expand_staged.rs
+++ b/nodedb/src/control/insert_select/expand_staged.rs
@@ -19,7 +19,7 @@ use nodedb_types::{DatabaseId, Surrogate, TenantId};
 
 use crate::bridge::envelope::PhysicalPlan;
 use crate::control::insert_select::copy_rows::{assign_page_rows, resolve_copy_spec};
-use crate::control::maintenance::clone_materializer::scan_source_page;
+use crate::control::maintenance::clone_materializer::scan_source_page_auto;
 use crate::control::state::SharedState;
 use crate::types::{TxnId, VShardId};
 use nodedb_physical::physical_plan::DocumentOp;
@@ -174,7 +174,7 @@ async fn materialize_copy(
     let mut rows: Vec<(String, Vec<u8>, Surrogate)> = Vec::new();
 
     while remaining > 0 {
-        let (entries, next_cursor) = scan_source_page(
+        let (entries, next_cursor) = scan_source_page_auto(
             state,
             tenant_id,
             database_id,
diff --git a/nodedb/src/control/insert_select/orchestrator.rs b/nodedb/src/control/insert_select/orchestrator.rs
index 0c2d5c442..7208d5145 100644
--- a/nodedb/src/control/insert_select/orchestrator.rs
+++ b/nodedb/src/control/insert_select/orchestrator.rs
@@ -19,7 +19,7 @@ use nodedb_types::{DatabaseId, Lsn, Surrogate, TenantId};
 
 use crate::bridge::envelope::{Payload, PhysicalPlan, Response, Status};
 use crate::control::insert_select::copy_rows::{assign_page_rows, resolve_copy_spec};
-use crate::control::maintenance::clone_materializer::{dispatch_local, scan_source_page};
+use crate::control::maintenance::clone_materializer::{dispatch_local, scan_source_page_auto};
 use crate::control::state::SharedState;
 use nodedb_physical::physical_plan::DocumentOp;
 
@@ -99,7 +99,7 @@ pub(crate) async fn run_insert_select(
 
     while remaining > 0 {
         // Phase 1: scan one source page (point-in-time snapshot).
-        let (entries, next_cursor) = scan_source_page(
+        let (entries, next_cursor) = scan_source_page_auto(
             state,
             tenant_id,
             database_id,
diff --git a/nodedb/src/control/maintenance/clone_materializer/auto_source.rs b/nodedb/src/control/maintenance/clone_materializer/auto_source.rs
new file mode 100644
index 000000000..e8823115e
--- /dev/null
+++ b/nodedb/src/control/maintenance/clone_materializer/auto_source.rs
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Engine-aware source scan for `INSERT ... SELECT`.
+//!
+//! The document materializer reads the document store; a kv collection keeps
+//! nothing there, so scanning a kv source with it materializes zero rows and
+//! the statement reports `INSERT 0 0`. Route on the source collection's own
+//! engine and normalize every page to the document entry shape
+//! `(doc_id, source_surrogate, value_bytes)`: the copy pipeline ignores the
+//! ids and shapes the body through its column map, and for kv the body is the
+//! stored msgpack row, so expression cells evaluate exactly as they do over a
+//! document source.
+
+use nodedb_sql::types::EngineType;
+
+use super::{document, kv};
+
+pub(crate) async fn scan_source_page(
+    state: &crate::control::state::SharedState,
+    tenant_id: nodedb_types::TenantId,
+    database_id: nodedb_types::DatabaseId,
+    source_qualified: &str,
+    cursor: &[u8],
+    system_as_of_ms: Option<i64>,
+    txn_id: Option<crate::types::TxnId>,
+) -> crate::Result<(Vec<(String, u32, Vec<u8>)>, Vec<u8>)> {
+    let catalog = state.credentials.catalog();
+    let stored = catalog
+        .get_collection(
+            database_id,
+            tenant_id.as_u64(),
+            &crate::control::target_identity::bare_collection_name(database_id, source_qualified),
+        )?
+        .ok_or_else(|| crate::Error::CollectionNotFound {
+            tenant_id,
+            collection: source_qualified.to_string(),
+        })?;
+    let (engine, _, _) =
+        crate::control::planner::catalog_adapter::type_convert::convert_collection_type(&stored);
+
+    match engine {
+        EngineType::DocumentSchemaless | EngineType::DocumentStrict => {
+            document::scan_source_page(
+                state,
+                tenant_id,
+                database_id,
+                source_qualified,
+                cursor,
+                system_as_of_ms,
+                txn_id,
+            )
+            .await
+        }
+        EngineType::KeyValue => {
+            let (pairs, next) =
+                kv::scan_source_page(state, tenant_id, database_id, source_qualified, cursor)
+                    .await?;
+            let entries = pairs
+                .into_iter()
+                .map(|(key, value)| (String::from_utf8_lossy(&key).into_owned(), 0, value))
+                .collect();
+            Ok((entries, next))
+        }
+        // Refused by name instead of silently copied as nothing; these
+        // engines have their own materializers that are not wired here yet.
+        EngineType::Columnar | EngineType::Timeseries | EngineType::Spatial | EngineType::Array => {
+            Err(crate::Error::PlanError {
+                detail: format!("INSERT ... SELECT from {engine:?} sources is not supported yet"),
+            })
+        }
+    }
+}
diff --git a/nodedb/src/control/maintenance/clone_materializer/kv.rs b/nodedb/src/control/maintenance/clone_materializer/kv.rs
index abe438050..b930bc09d 100644
--- a/nodedb/src/control/maintenance/clone_materializer/kv.rs
+++ b/nodedb/src/control/maintenance/clone_materializer/kv.rs
@@ -189,7 +189,7 @@ fn checkpoint_progress(
 /// Run one source-side `MaterializeScan` round-trip. Returns the entries in
 /// this page (raw `(key, value)` byte pairs) plus the next-cursor; the
 /// cursor is empty when the scan is complete.
-async fn scan_source_page(
+pub(crate) async fn scan_source_page(
     state: &SharedState,
     tenant_id: TenantId,
     source_db_id: DatabaseId,
diff --git a/nodedb/src/control/maintenance/clone_materializer/mod.rs b/nodedb/src/control/maintenance/clone_materializer/mod.rs
index 23f0ef7ca..163bd07d9 100644
--- a/nodedb/src/control/maintenance/clone_materializer/mod.rs
+++ b/nodedb/src/control/maintenance/clone_materializer/mod.rs
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: BUSL-1.1
 
+mod auto_source;
 mod columnar;
 mod dispatch;
 mod document;
@@ -17,5 +18,6 @@ pub use walker::{
 
 // Shared with the `INSERT ... SELECT` orchestrator, which reuses the same
 // local-dispatch primitive and source-scan cursor decode.
+pub(crate) use auto_source::scan_source_page as scan_source_page_auto;
 pub(crate) use dispatch::{dispatch_local, dispatch_local_on_vshard};
-pub(crate) use document::{read_all_source_rows, scan_source_page};
+pub(crate) use document::read_all_source_rows;
diff --git a/nodedb/src/control/planner/catalog_adapter/mod.rs b/nodedb/src/control/planner/catalog_adapter/mod.rs
index fe5c8beca..f0bb06dd1 100644
--- a/nodedb/src/control/planner/catalog_adapter/mod.rs
+++ b/nodedb/src/control/planner/catalog_adapter/mod.rs
@@ -33,6 +33,6 @@
 mod adapter;
 mod sequence_access;
 mod sql_catalog_impl;
-mod type_convert;
+pub(crate) mod type_convert;
 
 pub use adapter::OriginCatalog;
diff --git a/nodedb/src/control/planner/catalog_adapter/type_convert.rs b/nodedb/src/control/planner/catalog_adapter/type_convert.rs
index 7438b2666..e13742daf 100644
--- a/nodedb/src/control/planner/catalog_adapter/type_convert.rs
+++ b/nodedb/src/control/planner/catalog_adapter/type_convert.rs
@@ -6,7 +6,7 @@ use nodedb_sql::types::{ColumnInfo, EngineType, SqlDataType};
 use nodedb_types::columnar::{FloatWidth, IntWidth};
 
 /// Convert a StoredCollection to engine type, columns, and primary key.
-pub(super) fn convert_collection_type(
+pub(crate) fn convert_collection_type(
     stored: &crate::control::security::catalog::StoredCollection,
 ) -> (EngineType, Vec<ColumnInfo>, Option<String>) {
     use nodedb_types::CollectionType;
diff --git a/nodedb/src/control/planner/materialized_sum/resolve.rs b/nodedb/src/control/planner/materialized_sum/resolve.rs
index c36dc0e61..0eba4e8a2 100644
--- a/nodedb/src/control/planner/materialized_sum/resolve.rs
+++ b/nodedb/src/control/planner/materialized_sum/resolve.rs
@@ -20,8 +20,102 @@ use super::stored::stored_row_scope;
 use crate::control::server::shared::session::read_set::ReadSetEntry;
 use crate::control::server::surrogate_exchange::lookup_surrogate_routed;
 use crate::control::state::SharedState;
+use crate::query::sum_target_is_co_resident;
 use crate::types::{DatabaseId, TenantId, TraceId, VShardId};
 
+/// Replace every `BatchInsert` page whose source drives a CROSS-SHARD
+/// materialized-sum binding with one `PointInsert` task per row.
+///
+/// The page shape is settled per settlement on the Data Plane and per sibling
+/// task on the Control Plane; a page that needs a cross-shard sibling never
+/// completes its Calvin transaction. The per-row shape is exactly what this
+/// server shipped before pages existed, and it settles the same rows, so the
+/// page is un-batched before resolution rather than settled by a new path.
+/// Pages whose bindings are all co-resident (and pages over collections that
+/// drive no binding at all) keep their single task.
+fn un_batch_cross_shard_pages(
+    state: &SharedState,
+    tasks: &mut Vec<PhysicalTask>,
+    tenant_id: TenantId,
+    database_id: DatabaseId,
+) -> crate::Result<()> {
+    let schema_version = state.schema_version.current();
+    let catalog = state.credentials.catalog();
+    let mut rebuilt: Vec<PhysicalTask> = Vec::with_capacity(tasks.len());
+
+    for task in tasks.drain(..) {
+        // Decide from a borrow first: the common path (a co-resident page, a
+        // page whose collection drives no binding, or any non-page task) must
+        // not pay a deep clone of the page's row bodies.
+        let cross_shard_page = match &task.plan {
+            PhysicalPlan::Document(DocumentOp::BatchInsert {
+                collection,
+                documents,
+                ..
+            }) if !documents.is_empty() => {
+                let bindings = state.materialized_sum_index.bindings_for_source(
+                    catalog,
+                    schema_version,
+                    database_id,
+                    tenant_id,
+                    strip_db_prefix(database_id, collection.as_str()),
+                )?;
+                bindings.is_some_and(|bindings| {
+                    bindings.iter().any(|binding| {
+                        !sum_target_is_co_resident(
+                            database_id,
+                            collection.as_str(),
+                            &binding.target_collection,
+                        )
+                    })
+                })
+            }
+            _ => false,
+        };
+        if !cross_shard_page {
+            rebuilt.push(task);
+            continue;
+        }
+
+        // Un-batch: take the page apart by value. The shape was checked on the
+        // borrow above.
+        let PhysicalPlan::Document(DocumentOp::BatchInsert {
+            collection,
+            documents,
+            surrogates,
+            returning,
+            rls_filters,
+            ..
+        }) = task.plan
+        else {
+            unreachable!("checked above: only a cross-shard BatchInsert reaches here");
+        };
+        for ((document_id, value), surrogate) in documents.into_iter().zip(surrogates) {
+            rebuilt.push(PhysicalTask {
+                tenant_id: task.tenant_id,
+                vshard_id: task.vshard_id,
+                database_id: task.database_id,
+                plan: PhysicalPlan::Document(DocumentOp::PointInsert {
+                    collection: collection.clone(),
+                    document_id,
+                    value,
+                    if_absent: false,
+                    surrogate,
+                    returning: returning.clone(),
+                    rls_filters: rls_filters.clone(),
+                    resolved_sum_targets: Vec::new(),
+                    deferred_sum_targets: Vec::new(),
+                }),
+                post_set_op: task.post_set_op,
+                txn_id: task.txn_id,
+            });
+        }
+    }
+
+    *tasks = rebuilt;
+    Ok(())
+}
+
 /// Resolve the materialized-sum target rows for every document write in
 /// `tasks`, storing the result in that op's `resolved_sum_targets`.
 ///
@@ -50,6 +144,16 @@ pub async fn resolve_materialized_sum_targets(
     database_id: DatabaseId,
     trace_id: TraceId,
 ) -> crate::Result<Vec<ReadSetEntry>> {
+    // A `BatchInsert` page whose source drives a CROSS-SHARD balance cannot
+    // ride one page: the settlement below appends an `ApplyBalanceDelta`
+    // sibling per settled target, and a page carrying that join never reaches
+    // Calvin completion — the statement dies on the completion deadline
+    // ("timed out waiting for Calvin transaction completion"). The per-row
+    // `PointInsert` shape settles the same rows correctly, so a cross-shard
+    // page is un-batched here, before the resolution below runs. A page whose
+    // bindings are all co-resident keeps its page.
+    un_batch_cross_shard_pages(state, tasks, tenant_id, database_id)?;
+
     let schema_version = state.schema_version.current();
     let catalog = state.credentials.catalog();
     let mut appended: Vec<PhysicalTask> = Vec::new();
@@ -672,10 +776,12 @@ mod tests {
         );
     }
 
-    /// A batch resolves each DISTINCT join value once, so a page of rows
-    /// against one account yields one entry rather than one per row.
+    /// A page over a CROSS-SHARD binding is un-batched before resolution:
+    /// each row becomes its own point insert carrying its own resolution, so
+    /// the page never carries a sibling-dependent settlement. Two rows naming
+    /// one account resolve that account once per row.
     #[tokio::test]
-    async fn repeated_join_values_resolve_once() {
+    async fn a_cross_shard_page_is_un_batched_into_resolved_rows() {
         let (state, _directory) = test_state();
         declare_binding(&state);
         let target_surrogate = state
@@ -683,29 +789,62 @@ mod tests {
             .assign(DB, TENANT, "accounts", b"acc-1")
             .expect("bind target row");
 
-        let mut tasks = vec![PhysicalTask {
-            tenant_id: TENANT,
-            vshard_id: VShardId::new(0),
-            database_id: DB,
-            plan: PhysicalPlan::Document(DocumentOp::BatchInsert {
-                collection: nodedb_types::QualifiedCollection::new(DB, "entries"),
-                documents: vec![
-                    ("e1".to_string(), body("acc-1")),
-                    ("e2".to_string(), body("acc-1")),
-                ],
-                surrogates: vec![Surrogate::new(901), Surrogate::new(902)],
-                returning: None,
-                rls_filters: Vec::new(),
-                resolved_sum_targets: Vec::new(),
-                deferred_sum_targets: Vec::new(),
-            }),
-            post_set_op: PostSetOp::None,
-            txn_id: None,
-        }];
+        let mut tasks = vec![page_task(
+            "entries",
+            &[("e1", "acc-1"), ("e2", "acc-1")],
+            &[901, 902],
+        )];
         resolve_materialized_sum_targets(&state, &mut tasks, TENANT, DB, TraceId::ZERO)
             .await
             .expect("resolution succeeds");
 
+        assert_eq!(
+            tasks.len(),
+            2,
+            "a cross-shard page must become one task per row"
+        );
+        for task in &tasks {
+            match &task.plan {
+                PhysicalPlan::Document(DocumentOp::PointInsert {
+                    resolved_sum_targets,
+                    ..
+                }) => assert_eq!(
+                    resolved_sum_targets,
+                    &[ResolvedSumTarget::new(
+                        "accounts",
+                        "acc-1",
+                        target_surrogate
+                    )]
+                ),
+                other => panic!("expected the per-row point shape, got {other:?}"),
+            }
+        }
+    }
+
+    /// A page whose binding is CO-RESIDENT keeps its single task, and its rows
+    /// resolve each DISTINCT join value once: two rows against one account
+    /// yield one entry rather than one per row.
+    #[tokio::test]
+    async fn a_co_resident_page_stays_one_task_and_resolves_once() {
+        let (state, _directory) = test_state();
+        declare_binding(&state);
+        let source = co_resident_source("accounts");
+        declare_source(&state, &source);
+        let target_surrogate = state
+            .surrogate_assigner
+            .assign(DB, TENANT, "accounts", b"acc-1")
+            .expect("bind target row");
+
+        let mut tasks = vec![page_task(
+            &source,
+            &[("e1", "acc-1"), ("e2", "acc-1")],
+            &[901, 902],
+        )];
+        resolve_materialized_sum_targets(&state, &mut tasks, TENANT, DB, TraceId::ZERO)
+            .await
+            .expect("resolution succeeds");
+
+        assert_eq!(tasks.len(), 1, "a co-resident page keeps its page");
         match &tasks[0].plan {
             PhysicalPlan::Document(DocumentOp::BatchInsert {
                 resolved_sum_targets,
@@ -721,4 +860,63 @@ mod tests {
             other => panic!("plan shape changed: {other:?}"),
         }
     }
+
+    /// Declare `source` as another source of the `accounts` binding, so a test
+    /// can pick a source whose vShard co-resides with the target's.
+    fn declare_source(state: &SharedState, source: &str) {
+        let catalog = state.credentials.catalog();
+        let mut target = StoredCollection::new(TENANT.as_u64(), "accounts", "tester");
+        target.materialized_sums.push(MaterializedSumDef {
+            target_collection: "accounts".to_string(),
+            target_column: "balance".to_string(),
+            source_collection: source.to_string(),
+            join_column: "account_id".to_string(),
+            value_expr: nodedb_query::expr::SqlExpr::Column("amount".to_string()),
+        });
+        catalog
+            .put_collection(DB, &target)
+            .expect("persist target collection");
+        let stored = StoredCollection::new(TENANT.as_u64(), source, "tester");
+        catalog
+            .put_collection(DB, &stored)
+            .expect("persist source collection");
+        state.materialized_sum_index.invalidate();
+    }
+
+    /// A source that homes to `target`'s own vShard. Co-residency is the
+    /// exception, so the name is searched: printable ASCII pairs give ~9,000
+    /// candidates over 1,024 vShards, so a hit is found with near certainty.
+    fn co_resident_source(target: &str) -> String {
+        for first in 33u8..=126 {
+            for second in 33u8..=126 {
+                let name = format!("{}{}", first as char, second as char);
+                if crate::query::sum_target_is_co_resident(DB, &name, target) {
+                    return name;
+                }
+            }
+        }
+        panic!("a co-resident source name must exist");
+    }
+
+    fn page_task(collection: &str, rows: &[(&str, &str)], surrogates: &[u32]) -> PhysicalTask {
+        PhysicalTask {
+            tenant_id: TENANT,
+            vshard_id: VShardId::new(0),
+            database_id: DB,
+            plan: PhysicalPlan::Document(DocumentOp::BatchInsert {
+                collection: nodedb_types::QualifiedCollection::new(DB, collection),
+                documents: rows
+                    .iter()
+                    .map(|(id, account)| (id.to_string(), body(account)))
+                    .collect(),
+                surrogates: surrogates.iter().copied().map(Surrogate::new).collect(),
+                returning: None,
+                rls_filters: Vec::new(),
+                resolved_sum_targets: Vec::new(),
+                deferred_sum_targets: Vec::new(),
+            }),
+            post_set_op: PostSetOp::None,
+            txn_id: None,
+        }
+    }
 }
diff --git a/nodedb/src/control/planner/redaction_refusal/plan.rs b/nodedb/src/control/planner/redaction_refusal/plan.rs
index dd71f71eb..4e1f08fe0 100644
--- a/nodedb/src/control/planner/redaction_refusal/plan.rs
+++ b/nodedb/src/control/planner/redaction_refusal/plan.rs
@@ -461,6 +461,8 @@ mod tests {
             input: Box::new(aggregate_plan("users", vec![agg_spec("min", "ssn")])),
             filters: Vec::new(),
             projection: Vec::new(),
+            computed_columns: Vec::new(),
+            window_functions: Vec::new(),
             sort_keys: Vec::new(),
             limit: None,
             offset: 0,
diff --git a/nodedb/src/control/planner/rls_injection/permission_tree/plan.rs b/nodedb/src/control/planner/rls_injection/permission_tree/plan.rs
index 742d8716f..0ada83e52 100644
--- a/nodedb/src/control/planner/rls_injection/permission_tree/plan.rs
+++ b/nodedb/src/control/planner/rls_injection/permission_tree/plan.rs
@@ -414,6 +414,8 @@ mod tests {
             input: Box::new(columnar_scan("events")),
             filters: Vec::new(),
             projection: Vec::new(),
+            computed_columns: Vec::new(),
+            window_functions: Vec::new(),
             sort_keys: Vec::new(),
             limit: None,
             offset: 0,
diff --git a/nodedb/src/control/planner/rls_injection/plan.rs b/nodedb/src/control/planner/rls_injection/plan.rs
index 57cf47739..671884b88 100644
--- a/nodedb/src/control/planner/rls_injection/plan.rs
+++ b/nodedb/src/control/planner/rls_injection/plan.rs
@@ -412,6 +412,8 @@ mod tests {
             input: Box::new(rag_fusion("docs")),
             filters: Vec::new(),
             projection: Vec::new(),
+            computed_columns: Vec::new(),
+            window_functions: Vec::new(),
             sort_keys: Vec::new(),
             limit: None,
             offset: 0,
diff --git a/nodedb/src/control/planner/sql_plan_convert/aggregate/plan.rs b/nodedb/src/control/planner/sql_plan_convert/aggregate/plan.rs
index 2f9c4c3bc..21bf131d8 100644
--- a/nodedb/src/control/planner/sql_plan_convert/aggregate/plan.rs
+++ b/nodedb/src/control/planner/sql_plan_convert/aggregate/plan.rs
@@ -166,6 +166,8 @@ pub(in crate::control::planner::sql_plan_convert) fn convert_aggregate(
             // before the rows reach the aggregate.
             filters: filter_bytes.clone(),
             projection: Vec::new(),
+            computed_columns: Vec::new(),
+            window_functions: Vec::new(),
             sort_keys: Vec::new(),
             limit: None,
             offset: 0,
@@ -198,6 +200,71 @@ pub(in crate::control::planner::sql_plan_convert) fn convert_aggregate(
         }]);
     }
 
+    // Aggregate over a derived/CTE body: the input is not a Scan (a
+    // constant subquery, a set operation, a join materialized earlier), so
+    // there is no per-shard collection to aggregate. Lower the body to a
+    // single coordinator-local ProviderScan sub-plan — the same shape the
+    // catalog path uses above — so the executor receives the body's rows and
+    // evaluates the aggregate arguments / group keys against them. Without
+    // this the aggregate scanned an empty (non-existent) collection and
+    // silently returned NULL / no rows (issue #295).
+    if !matches!(input, SqlPlan::Scan { .. }) {
+        let derived_group_specs = group_by_to_specs(group_by);
+        let derived_agg_specs: Vec<AggregateSpec> =
+            aggregates.iter().map(agg_expr_to_spec).collect();
+        let mut body_tasks = super::super::convert::convert_one(input, tenant_id, ctx)?;
+        if body_tasks.len() == 1
+            && let Some(body_task) = body_tasks.pop()
+        {
+            let body_plan = body_task.plan;
+            let body_provider = if let PhysicalPlan::Query(QueryOp::ProviderScan {
+                rows,
+                filters,
+                computed_columns,
+                window_functions,
+                ..
+            }) = &body_plan
+            {
+                PhysicalPlan::Query(QueryOp::ProviderScan {
+                    provider: None,
+                    rows: rows.clone(),
+                    filters: filters.clone(),
+                    projection: Vec::new(),
+                    computed_columns: computed_columns.clone(),
+                    window_functions: window_functions.clone(),
+                    sort_keys: Vec::new(),
+                    limit: None,
+                    offset: 0,
+                    distinct: false,
+                })
+            } else {
+                body_plan
+            };
+            return Ok(vec![PhysicalTask {
+                tenant_id,
+                vshard_id: VShardId::from_collection_in_database(ctx.database_id, ""),
+                database_id: ctx.database_id,
+                plan: PhysicalPlan::Query(QueryOp::Aggregate {
+                    collection: nodedb_types::QualifiedCollection::from_stored(
+                        raw_collection.clone(),
+                    ),
+                    input: Some(Box::new(body_provider)),
+                    group_by: derived_group_specs,
+                    aggregates: derived_agg_specs,
+                    filters: Vec::new(),
+                    having: having_bytes,
+                    limit,
+                    sub_group_by: Vec::new(),
+                    sub_aggregates: Vec::new(),
+                    grouping_sets: Vec::new(),
+                    sort_keys: bridge_sort_keys,
+                }),
+                post_set_op: PostSetOp::None,
+                txn_id: None,
+            }]);
+        }
+    }
+
     let collection = db_qualified(ctx.database_id, &raw_collection);
     let qualified_collection =
         nodedb_types::QualifiedCollection::new(ctx.database_id, &raw_collection);
diff --git a/nodedb/src/control/planner/sql_plan_convert/aggregate/projection.rs b/nodedb/src/control/planner/sql_plan_convert/aggregate/projection.rs
index 2591a3d9f..291490276 100644
--- a/nodedb/src/control/planner/sql_plan_convert/aggregate/projection.rs
+++ b/nodedb/src/control/planner/sql_plan_convert/aggregate/projection.rs
@@ -70,25 +70,29 @@ pub(in crate::control::planner::sql_plan_convert) fn serialize_join_computed_pro
         });
     }
 
-    let computed = proj
-        .iter()
-        .map(|item| match item {
-            Projection::Column(name) => Some(crate::bridge::expr_eval::ComputedColumn {
+    let mut computed = Vec::new();
+    for item in proj {
+        match item {
+            Projection::Column(name) => computed.push(crate::bridge::expr_eval::ComputedColumn {
                 alias: name.clone(),
                 expr: crate::bridge::expr_eval::SqlExpr::Column(name.clone()),
             }),
             Projection::Computed { expr, alias } => {
-                Some(crate::bridge::expr_eval::ComputedColumn {
+                computed.push(crate::bridge::expr_eval::ComputedColumn {
                     alias: alias.clone(),
                     expr: sql_expr_to_bridge_expr_qualified(expr),
                 })
             }
-            Projection::Star | Projection::QualifiedStar(_) => None,
-        })
-        .collect::<Option<Vec<_>>>()
-        .ok_or_else(|| crate::Error::BadRequest {
-            detail: "wildcard join projection reached computed-expression lowering".into(),
-        })?;
+            // A sequence stamp reads nothing and evaluates nothing on the
+            // Data Plane; the control plane fills the cell after shaping.
+            Projection::Sequence { .. } => {}
+            Projection::Star | Projection::QualifiedStar(_) => {
+                return Err(crate::Error::BadRequest {
+                    detail: "wildcard join projection reached computed-expression lowering".into(),
+                });
+            }
+        }
+    }
     encode_computed_columns(computed, "join computed projection")
 }
 
diff --git a/nodedb/src/control/planner/sql_plan_convert/convert.rs b/nodedb/src/control/planner/sql_plan_convert/convert.rs
index 91f6ae37b..2a533d3fb 100644
--- a/nodedb/src/control/planner/sql_plan_convert/convert.rs
+++ b/nodedb/src/control/planner/sql_plan_convert/convert.rs
@@ -273,6 +273,8 @@ pub fn convert(
                     rows: Vec::new(),
                     filters: Vec::new(),
                     projection: Vec::new(),
+                    computed_columns: Vec::new(),
+                    window_functions: Vec::new(),
                     sort_keys: Vec::new(),
                     limit: None,
                     offset: 0,
diff --git a/nodedb/src/control/planner/sql_plan_convert/dml/insert/convert.rs b/nodedb/src/control/planner/sql_plan_convert/dml/insert/convert.rs
index dc4a3b110..4a2a9d432 100644
--- a/nodedb/src/control/planner/sql_plan_convert/dml/insert/convert.rs
+++ b/nodedb/src/control/planner/sql_plan_convert/dml/insert/convert.rs
@@ -89,6 +89,14 @@ pub(in super::super::super) fn convert_insert(
     let mut balanced_documents: Vec<(String, Vec<u8>)> = Vec::new();
     let mut balanced_surrogates: Vec<Surrogate> = Vec::new();
 
+    // Rows of a plain multi-row INSERT, accumulated across the loop and
+    // emitted as ONE `BatchInsert` page. One statement answers one
+    // CommandComplete with the row count, and its rows commit or fail
+    // together. `ON CONFLICT DO NOTHING` and CRDT rows stay per-row: their
+    // outcome is decided per row and a page cannot express the skip.
+    let mut batch_documents: Vec<(String, Vec<u8>)> = Vec::new();
+    let mut batch_surrogates: Vec<Surrogate> = Vec::new();
+
     // Every engine's rows expand their DEFAULTs here, ahead of identity
     // derivation. A DEFAULT materialized after the primary-key NOT NULL gate
     // refuses a key the declaration supplies.
@@ -124,45 +132,106 @@ pub(in super::super::super) fn convert_insert(
                     balanced_surrogates.push(surrogate);
                     continue;
                 }
-                let plan = if is_crdt {
-                    PhysicalPlan::Crdt(CrdtOp::DocUpsert {
-                        collection: qualified_collection.clone(),
-                        document_id: doc_id,
-                        fields_json: super::super::crdt_gate::row_to_fields_json(row)?,
-                        surrogate,
-                        partial: false,
-                        returning: None,
-                        rls_filters: Vec::new(),
-                    })
-                } else {
-                    PhysicalPlan::Document(DocumentOp::PointInsert {
+                if is_crdt {
+                    tasks.push(PhysicalTask {
+                        tenant_id,
+                        vshard_id: vshard,
+                        database_id: ctx.database_id,
+                        plan: PhysicalPlan::Crdt(CrdtOp::DocUpsert {
+                            collection: qualified_collection.clone(),
+                            document_id: doc_id,
+                            fields_json: super::super::crdt_gate::row_to_fields_json(row)?,
+                            surrogate,
+                            partial: false,
+                            returning: None,
+                            rls_filters: Vec::new(),
+                        }),
+                        post_set_op: PostSetOp::None,
+                        txn_id: None,
+                    });
+                    continue;
+                }
+                if if_absent {
+                    // `ON CONFLICT DO NOTHING` decides per row which rows
+                    // already exist, so the rows cannot share one page.
+                    tasks.push(PhysicalTask {
+                        tenant_id,
+                        vshard_id: vshard,
+                        database_id: ctx.database_id,
+                        plan: PhysicalPlan::Document(DocumentOp::PointInsert {
+                            collection: qualified_collection.clone(),
+                            document_id: doc_id,
+                            value: value_bytes,
+                            if_absent,
+                            surrogate,
+                            // Both filled in after conversion: the RETURNING
+                            // spec by the protocol layer's injection pass, the
+                            // read filter by the RLS injection pass.
+                            returning: None,
+                            rls_filters: Vec::new(),
+                            // Filled by the materialized-sum resolution pass,
+                            // which runs after conversion.
+                            resolved_sum_targets: Vec::new(),
+                            deferred_sum_targets: Vec::new(),
+                        }),
+                        post_set_op: PostSetOp::None,
+                        txn_id: None,
+                    });
+                    continue;
+                }
+                batch_documents.push((doc_id, value_bytes));
+                batch_surrogates.push(surrogate);
+            }
+        }
+    }
+
+    // Emit the statement's plain rows: one `BatchInsert` page when there is
+    // more than one, so the driver sees a single `INSERT 0 n` tag and the
+    // rows share one atomic write; a lone row keeps its `PointInsert` task.
+    match batch_documents.len() {
+        0 => {}
+        1 => {
+            if let Some(((document_id, value), surrogate)) =
+                batch_documents.pop().zip(batch_surrogates.pop())
+            {
+                tasks.push(PhysicalTask {
+                    tenant_id,
+                    vshard_id: vshard,
+                    database_id: ctx.database_id,
+                    plan: PhysicalPlan::Document(DocumentOp::PointInsert {
                         collection: qualified_collection.clone(),
-                        document_id: doc_id,
-                        value: value_bytes,
-                        if_absent,
+                        document_id,
+                        value,
+                        if_absent: false,
                         surrogate,
-                        // Both filled in after conversion: the RETURNING spec
-                        // by the protocol layer's injection pass, the read
-                        // filter by the RLS injection pass.
                         returning: None,
                         rls_filters: Vec::new(),
-                        // Filled by the materialized-sum resolution pass,
-                        // which runs after conversion (it needs the catalog
-                        // and, in cluster mode, a routed lookup).
                         resolved_sum_targets: Vec::new(),
                         deferred_sum_targets: Vec::new(),
-                    })
-                };
-                tasks.push(PhysicalTask {
-                    tenant_id,
-                    vshard_id: vshard,
-                    database_id: ctx.database_id,
-                    plan,
+                    }),
                     post_set_op: PostSetOp::None,
                     txn_id: None,
                 });
             }
         }
+        _ => {
+            tasks.push(PhysicalTask {
+                tenant_id,
+                vshard_id: vshard,
+                database_id: ctx.database_id,
+                plan: PhysicalPlan::Document(DocumentOp::BatchInsert {
+                    collection: qualified_collection.clone(),
+                    documents: batch_documents,
+                    surrogates: batch_surrogates,
+                    returning: None,
+                    rls_filters: Vec::new(),
+                    resolved_sum_targets: Vec::new(),
+                    deferred_sum_targets: Vec::new(),
+                }),
+                post_set_op: PostSetOp::None,
+                txn_id: None,
+            });
+        }
     }
 
     if !balanced_documents.is_empty() {
diff --git a/nodedb/src/control/planner/sql_plan_convert/expr.rs b/nodedb/src/control/planner/sql_plan_convert/expr.rs
index 80119f4ff..20a056fc3 100644
--- a/nodedb/src/control/planner/sql_plan_convert/expr.rs
+++ b/nodedb/src/control/planner/sql_plan_convert/expr.rs
@@ -280,6 +280,26 @@ pub(super) fn convert_sort_keys(keys: &[SortKey]) -> Vec<SortKeySpec> {
         .collect()
 }
 
+/// Whether a projection list carries anything beyond bare column
+/// references / stars. A computed expression (`x/0`, a function call, a
+/// window over a column) has no row to evaluate against once the CTE body
+/// is inlined as a bare value row — the response shaper would look the
+/// aliased column up, find nothing, and emit NULL. Such projections need a
+/// real Subquery post-processor over the materialized rows, not a bare
+/// `cte_plan.clone()`.
+fn has_expression_projection(projection: &[nodedb_sql::types::query::Projection]) -> bool {
+    projection.iter().any(|p| match p {
+        nodedb_sql::types::query::Projection::Computed { .. } => true,
+        // A sequence output column has no row expression to evaluate: the
+        // response boundary allocates its value, so it never needs the
+        // Subquery post-processor a computed expression does.
+        nodedb_sql::types::query::Projection::Column(_)
+        | nodedb_sql::types::query::Projection::Star
+        | nodedb_sql::types::query::Projection::QualifiedStar(_)
+        | nodedb_sql::types::query::Projection::Sequence { .. } => false,
+    })
+}
+
 /// Replace scans on `cte_name` with the CTE's actual subquery plan.
 ///
 /// Outer constraints on the CTE reference are merged onto the CTE body as far
@@ -298,6 +318,7 @@ pub(super) fn inline_cte(plan: &SqlPlan, cte_name: &str, cte_plan: &SqlPlan) ->
             limit,
             offset,
             distinct,
+            window_functions,
             ..
         } if collection == cte_name => {
             // If the outer query adds filters/sort/limit, wrap the CTE plan.
@@ -347,7 +368,18 @@ pub(super) fn inline_cte(plan: &SqlPlan, cte_name: &str, cte_plan: &SqlPlan) ->
                         // offset 0 = unspecified → inherit CTE's offset.
                         offset: if *offset > 0 { *offset } else { *inner_o },
                         distinct: *distinct || *inner_d,
-                        window_functions: inner_w.clone(),
+                        // Window functions: the derived body's own specs run
+                        // first (they produce columns the outer may reference),
+                        // then the outer's. Dropping the outer's here left
+                        // `SUM(n) OVER ...` over a derived table with a Scan
+                        // body silently NULL (issue #295).
+                        window_functions: {
+                            let mut merged = inner_w.clone();
+                            if !window_functions.is_empty() {
+                                merged.extend(window_functions.iter().cloned());
+                            }
+                            merged
+                        },
                         temporal: *inner_t,
                     }
                 } else if let SqlPlan::VectorSearch { .. } = cte_plan {
@@ -386,6 +418,7 @@ pub(super) fn inline_cte(plan: &SqlPlan, cte_name: &str, cte_plan: &SqlPlan) ->
                             input: Box::new(leaf),
                             filters: Vec::new(),
                             projection: projection.clone(),
+                            window_functions: window_functions.clone(),
                             sort_keys: sort_keys.clone(),
                             offset: *offset,
                             distinct: *distinct,
@@ -399,11 +432,14 @@ pub(super) fn inline_cte(plan: &SqlPlan, cte_name: &str, cte_plan: &SqlPlan) ->
                     && *offset == 0
                     && !*distinct
                     && limit.is_none()
+                    && !has_expression_projection(projection)
+                    && window_functions.is_empty()
                 {
                     // Any other non-`Scan` body (Aggregate, Join, TextSearch,
                     // HybridSearch, SparseSearch, SpatialScan, MultiVectorSearch,
-                    // ...) with only an outer projection: the response boundary
-                    // projects by output schema, so no post-processor is needed.
+                    // ...) with only an outer projection of bare columns: the
+                    // response boundary projects by output schema, so no
+                    // post-processor is needed.
                     cte_plan.clone()
                 } else {
                     // The body has no slot for these outer constraints. Apply
@@ -413,6 +449,7 @@ pub(super) fn inline_cte(plan: &SqlPlan, cte_name: &str, cte_plan: &SqlPlan) ->
                         input: Box::new(cte_plan.clone()),
                         filters: filters.clone(),
                         projection: projection.clone(),
+                        window_functions: window_functions.clone(),
                         sort_keys: sort_keys.clone(),
                         offset: *offset,
                         distinct: *distinct,
@@ -508,6 +545,7 @@ pub(super) fn inline_cte(plan: &SqlPlan, cte_name: &str, cte_plan: &SqlPlan) ->
             input,
             filters,
             projection,
+            window_functions,
             sort_keys,
             offset,
             distinct,
@@ -516,6 +554,7 @@ pub(super) fn inline_cte(plan: &SqlPlan, cte_name: &str, cte_plan: &SqlPlan) ->
             input: Box::new(inline_cte(input, cte_name, cte_plan)),
             filters: filters.clone(),
             projection: projection.clone(),
+            window_functions: window_functions.clone(),
             sort_keys: sort_keys.clone(),
             offset: *offset,
             distinct: *distinct,
diff --git a/nodedb/src/control/planner/sql_plan_convert/lateral.rs b/nodedb/src/control/planner/sql_plan_convert/lateral.rs
index cda271938..195a3c519 100644
--- a/nodedb/src/control/planner/sql_plan_convert/lateral.rs
+++ b/nodedb/src/control/planner/sql_plan_convert/lateral.rs
@@ -198,6 +198,9 @@ fn projection_to_join_projections(projection: &[Projection]) -> Vec<JoinProjecti
                 source: alias.clone(),
                 output: alias.clone(),
             }),
+            // A sequence stamp reads no column from the joined rows: the
+            // control plane fills the cell after shaping. Nothing to fetch.
+            Projection::Sequence { .. } => None,
             Projection::Star | Projection::QualifiedStar(_) => None,
         })
         .collect()
diff --git a/nodedb/src/control/planner/sql_plan_convert/output_schema/build.rs b/nodedb/src/control/planner/sql_plan_convert/output_schema/build.rs
index f7b9fa374..2f9f22653 100644
--- a/nodedb/src/control/planner/sql_plan_convert/output_schema/build.rs
+++ b/nodedb/src/control/planner/sql_plan_convert/output_schema/build.rs
@@ -73,6 +73,7 @@ pub fn build_output_schema<C: SqlCatalog + ?Sized>(
                     display_name: key.clone(),
                     lookup_key: key.clone(),
                     ty: types.get(key).copied().unwrap_or(DdlColType::Text),
+                    sequence: None,
                 });
             }
             for agg in aggregates {
@@ -82,6 +83,7 @@ pub fn build_output_schema<C: SqlCatalog + ?Sized>(
                     display_name: key.clone(),
                     lookup_key: key,
                     ty: DdlColType::Text,
+                    sequence: None,
                 });
             }
             OutputSchema {
@@ -173,17 +175,27 @@ pub fn build_output_schema<C: SqlCatalog + ?Sized>(
             let types = super::join_types::join_column_types(left, right, catalog, database_id);
             schema_from_projection(projection, &types, &[])
         }
-        SqlPlan::ConstantResult { columns, .. } => OutputSchema {
-            columns: columns
-                .iter()
-                .map(|c| OutputColumn {
-                    display_name: c.clone(),
-                    lookup_key: c.clone(),
-                    ty: DdlColType::Text,
-                })
-                .collect(),
-            is_star: false,
-        },
+        SqlPlan::ConstantResult { columns, .. } => {
+            // The row payload keys each cell by the unique per-column key
+            // (`cell_keys`), not the raw display name: two constant columns may
+            // share a name (`SELECT nextval('s'), nextval('s')`), and a single
+            // JSON object would collapse them. `display_name` keeps the
+            // client-facing name; `lookup_key` is the cell key.
+            let lookup_keys = crate::control::server::response_shape::project::cell_keys(columns);
+            OutputSchema {
+                columns: columns
+                    .iter()
+                    .zip(lookup_keys)
+                    .map(|(c, lookup_key)| OutputColumn {
+                        display_name: c.clone(),
+                        lookup_key,
+                        ty: DdlColType::Text,
+                        sequence: None,
+                    })
+                    .collect(),
+                is_star: false,
+            }
+        }
         SqlPlan::Aggregate {
             input,
             group_by,
@@ -223,6 +235,7 @@ pub fn build_output_schema<C: SqlCatalog + ?Sized>(
                     display_name: agg.alias.clone(),
                     lookup_key: agg.alias.clone(),
                     ty: infer_aggregate_type(agg, &types),
+                    sequence: None,
                 })
             };
             let mut columns = Vec::with_capacity(group_by.len() + aggregates.len());
@@ -270,6 +283,7 @@ pub fn build_output_schema<C: SqlCatalog + ?Sized>(
                     display_name: name.clone(),
                     lookup_key: name.clone(),
                     ty: DdlColType::Text,
+                    sequence: None,
                 })
                 .collect(),
             is_star: false,
@@ -322,6 +336,7 @@ pub fn build_output_schema<C: SqlCatalog + ?Sized>(
                     display_name: name.clone(),
                     lookup_key: name.clone(),
                     ty: DdlColType::Text,
+                    sequence: None,
                 })
                 .collect(),
             is_star: false,
diff --git a/nodedb/src/control/planner/sql_plan_convert/output_schema/columns.rs b/nodedb/src/control/planner/sql_plan_convert/output_schema/columns.rs
index 78cea8a45..b2b8dee76 100644
--- a/nodedb/src/control/planner/sql_plan_convert/output_schema/columns.rs
+++ b/nodedb/src/control/planner/sql_plan_convert/output_schema/columns.rs
@@ -57,6 +57,7 @@ pub(super) fn projection_to_column(
                 display_name,
                 lookup_key: qname.clone(),
                 ty,
+                sequence: None,
             })
         }
         Projection::Computed { expr, alias } => {
@@ -78,9 +79,16 @@ pub(super) fn projection_to_column(
                 display_name: alias.clone(),
                 lookup_key,
                 ty: infer_computed_expr_type(expr, types),
+                sequence: None,
             })
         }
         Projection::Star | Projection::QualifiedStar(_) => None,
+        Projection::Sequence { sequence, alias } => Some(OutputColumn {
+            display_name: alias.clone(),
+            lookup_key: alias.clone(),
+            ty: DdlColType::Int8,
+            sequence: Some(sequence.clone()),
+        }),
     }
 }
 
@@ -148,6 +156,7 @@ pub(super) fn group_by_key_column(
                 display_name,
                 lookup_key,
                 ty,
+                sequence: None,
             }
         }
         _ => {
@@ -163,6 +172,7 @@ pub(super) fn group_by_key_column(
                 display_name,
                 lookup_key,
                 ty: infer_computed_expr_type(expr, types),
+                sequence: None,
             }
         }
     }
@@ -190,6 +200,7 @@ pub(super) fn ordered_columns_for<C: SqlCatalog + ?Sized>(
                     c.int_width,
                     c.float_width,
                 ),
+                sequence: None,
             })
             .collect(),
         _ => Vec::new(),
diff --git a/nodedb/src/control/planner/sql_plan_convert/scan/core.rs b/nodedb/src/control/planner/sql_plan_convert/scan/core.rs
index 5e56c2697..4d34d8cb7 100644
--- a/nodedb/src/control/planner/sql_plan_convert/scan/core.rs
+++ b/nodedb/src/control/planner/sql_plan_convert/scan/core.rs
@@ -58,6 +58,8 @@ pub(in crate::control::planner::sql_plan_convert) fn convert_scan(
                 rows: Vec::new(),
                 filters: filter_bytes,
                 projection: proj_names,
+                computed_columns: Vec::new(),
+                window_functions: Vec::new(),
                 sort_keys: sort,
                 limit: *limit,
                 offset: *offset,
@@ -134,6 +136,11 @@ pub(in crate::control::planner::sql_plan_convert) fn convert_scan(
             // Original SQL planner output never carries a clone ceiling;
             // the clone resolver overrides it when delegating to source.
             surrogate_ceiling: None,
+            // KV scan parity with doc/columnar/timeseries: carry the SELECT
+            // output columns so expression projections are evaluated in the
+            // Data Plane instead of surfacing as NULL at response shaping.
+            projection: proj_names,
+            computed_columns: computed_bytes,
         }),
         EngineType::DocumentSchemaless | EngineType::DocumentStrict => {
             PhysicalPlan::Document(DocumentOp::Scan {
diff --git a/nodedb/src/control/planner/sql_plan_convert/set_ops.rs b/nodedb/src/control/planner/sql_plan_convert/set_ops.rs
index a9d435fe6..2b09c7631 100644
--- a/nodedb/src/control/planner/sql_plan_convert/set_ops.rs
+++ b/nodedb/src/control/planner/sql_plan_convert/set_ops.rs
@@ -19,13 +19,19 @@ pub(super) fn convert_constant_result(
     tenant_id: TenantId,
     ctx: &ConvertContext,
 ) -> crate::Result<Vec<PhysicalTask>> {
+    // A constant row is one JSON object, which cannot hold two cells under one
+    // key. `SELECT nextval('s'), nextval('s')` legally repeats an output name;
+    // keying both cells by the name would collapse them to the last value. Use
+    // the same unique per-column keys every response encoder derives, so each
+    // column keeps its own cell.
+    let cell_keys = crate::control::server::response_shape::project::cell_keys(columns);
     let mut obj = serde_json::Map::new();
-    for (col, val) in columns.iter().zip(values.iter()) {
+    for ((_col, val), key) in columns.iter().zip(values.iter()).zip(cell_keys.iter()) {
         let json_val = match val {
             SqlValue::Null => serde_json::Value::Null,
             other => serde_json::Value::String(sql_value_to_string(other)),
         };
-        obj.insert(col.clone(), json_val);
+        obj.insert(key.clone(), json_val);
     }
     let arr = serde_json::Value::Array(vec![serde_json::Value::Object(obj)]);
     let payload = nodedb_types::json_to_msgpack(&arr).map_err(|e| crate::Error::Serialization {
@@ -41,6 +47,8 @@ pub(super) fn convert_constant_result(
             rows: payload,
             filters: Vec::new(),
             projection: Vec::new(),
+            computed_columns: Vec::new(),
+            window_functions: Vec::new(),
             sort_keys: Vec::new(),
             limit: None,
             offset: 0,
@@ -247,6 +255,7 @@ pub(super) fn convert_subquery(
         input,
         filters,
         projection,
+        window_functions,
         sort_keys,
         offset,
         distinct,
@@ -311,6 +320,16 @@ pub(super) fn convert_subquery(
             input: Box::new(child),
             filters: super::filter::serialize_filters(filters)?,
             projection: lower_subquery_projection(projection)?,
+            // Expression projections ride as computed columns so the
+            // materialized-row ProviderScan evaluates them per row instead
+            // of the response shaper looking up an alias that was never
+            // computed (silent NULL — issue #295). Window-aliased items are
+            // excluded here; they ride as window specs below.
+            computed_columns: super::aggregate::extract_computed_columns(
+                projection,
+                window_functions,
+            )?,
+            window_functions: super::aggregate::serialize_window_functions(window_functions)?,
             sort_keys: lower_subquery_sort_keys(sort_keys, merged_doc_body),
             limit,
             offset,
@@ -341,6 +360,9 @@ fn lower_subquery_projection(projection: &[Projection]) -> crate::Result<Vec<Str
             }
             Projection::Star | Projection::QualifiedStar(_) => return Ok(Vec::new()),
             Projection::Computed { alias, .. } => names.push(alias.clone()),
+            // A sequence item rides the body under the same alias the response
+            // boundary stamps it into.
+            Projection::Sequence { alias, .. } => names.push(alias.clone()),
         }
     }
     Ok(names)
diff --git a/nodedb/src/control/server/exchange/full_scan.rs b/nodedb/src/control/server/exchange/full_scan.rs
index 58fb851d2..277c58f93 100644
--- a/nodedb/src/control/server/exchange/full_scan.rs
+++ b/nodedb/src/control/server/exchange/full_scan.rs
@@ -151,6 +151,8 @@ pub fn full_scan_plan_for_collection(
             sort_keys: Vec::new(),
             match_pattern: None,
             surrogate_ceiling: None,
+            projection: Vec::new(),
+            computed_columns: Vec::new(),
         }),
         CollectionType::Columnar(ColumnarProfile::Plain)
         | CollectionType::Columnar(ColumnarProfile::Spatial { .. }) => {
diff --git a/nodedb/src/control/server/exchange/resolve/exchange/dispatch.rs b/nodedb/src/control/server/exchange/resolve/exchange/dispatch.rs
index c312c65c4..fcdccdade 100644
--- a/nodedb/src/control/server/exchange/resolve/exchange/dispatch.rs
+++ b/nodedb/src/control/server/exchange/resolve/exchange/dispatch.rs
@@ -157,6 +157,8 @@ pub(super) async fn resolve_exchange(
             input,
             filters,
             projection,
+            computed_columns,
+            window_functions,
             sort_keys,
             limit,
             offset,
@@ -170,6 +172,8 @@ pub(super) async fn resolve_exchange(
                     input,
                     filters,
                     projection,
+                    computed_columns,
+                    window_functions,
                     sort_keys,
                     limit,
                     offset,
diff --git a/nodedb/src/control/server/exchange/resolve/exchange/post_process_arm.rs b/nodedb/src/control/server/exchange/resolve/exchange/post_process_arm.rs
index 9e4920724..0bc66c706 100644
--- a/nodedb/src/control/server/exchange/resolve/exchange/post_process_arm.rs
+++ b/nodedb/src/control/server/exchange/resolve/exchange/post_process_arm.rs
@@ -29,6 +29,8 @@ pub(super) struct PostProcessFields {
     pub input: Box<PhysicalPlan>,
     pub filters: Vec<u8>,
     pub projection: Vec<String>,
+    pub computed_columns: Vec<u8>,
+    pub window_functions: Vec<u8>,
     pub sort_keys: Vec<SortKeySpec>,
     pub limit: Option<usize>,
     pub offset: usize,
@@ -107,6 +109,8 @@ pub(super) async fn resolve_post_process(
         input,
         filters,
         projection,
+        computed_columns,
+        window_functions,
         sort_keys,
         limit,
         offset,
@@ -223,6 +227,8 @@ pub(super) async fn resolve_post_process(
             rows,
             filters,
             projection,
+            computed_columns,
+            window_functions,
             sort_keys,
             limit,
             offset,
diff --git a/nodedb/src/control/server/exchange/resolve/join_input.rs b/nodedb/src/control/server/exchange/resolve/join_input.rs
index 16a50d81b..2d3e1ab32 100644
--- a/nodedb/src/control/server/exchange/resolve/join_input.rs
+++ b/nodedb/src/control/server/exchange/resolve/join_input.rs
@@ -60,6 +60,8 @@ pub(super) async fn resolve_join_input(
                 rows: flatten_to_relational_rows(&outcome.merged_array),
                 filters: Vec::new(),
                 projection: Vec::new(),
+                computed_columns: Vec::new(),
+                window_functions: Vec::new(),
                 sort_keys: Vec::new(),
                 limit: None,
                 offset: 0,
@@ -134,6 +136,8 @@ pub(super) async fn resolve_join_input(
                 rows: flatten_to_relational_rows(&merged),
                 filters: Vec::new(),
                 projection: Vec::new(),
+                computed_columns: Vec::new(),
+                window_functions: Vec::new(),
                 sort_keys: Vec::new(),
                 limit: None,
                 offset: 0,
@@ -236,6 +240,8 @@ pub(super) async fn gather_join_build_side(
         rows: flatten_to_relational_rows(&outcome.merged_array),
         filters: Vec::new(),
         projection: Vec::new(),
+        computed_columns: Vec::new(),
+        window_functions: Vec::new(),
         sort_keys: Vec::new(),
         limit: None,
         offset: 0,
diff --git a/nodedb/src/control/server/exchange/resolve/materialize.rs b/nodedb/src/control/server/exchange/resolve/materialize.rs
index 1d2a2c417..a4b53518d 100644
--- a/nodedb/src/control/server/exchange/resolve/materialize.rs
+++ b/nodedb/src/control/server/exchange/resolve/materialize.rs
@@ -34,6 +34,8 @@ pub(super) async fn materialize_providers(
             rows: _,
             filters,
             projection,
+            computed_columns,
+            window_functions,
             sort_keys,
             limit,
             offset,
@@ -46,6 +48,8 @@ pub(super) async fn materialize_providers(
                 rows: encoded,
                 filters,
                 projection,
+                computed_columns,
+                window_functions,
                 sort_keys,
                 limit,
                 offset,
@@ -223,6 +227,8 @@ pub(super) async fn materialize_providers(
             input,
             filters,
             projection,
+            computed_columns,
+            window_functions,
             sort_keys,
             limit,
             offset,
@@ -233,6 +239,8 @@ pub(super) async fn materialize_providers(
                 input: Box::new(input),
                 filters,
                 projection,
+                computed_columns,
+                window_functions,
                 sort_keys,
                 limit,
                 offset,
diff --git a/nodedb/src/control/server/http/routes/query/materialized.rs b/nodedb/src/control/server/http/routes/query/materialized.rs
index 91e1344da..34ddd0f4d 100644
--- a/nodedb/src/control/server/http/routes/query/materialized.rs
+++ b/nodedb/src/control/server/http/routes/query/materialized.rs
@@ -434,6 +434,7 @@ pub async fn query(
                     database_id,
                     tenant_id,
                     redaction: Some(redaction.ctx(&state.shared.redaction)),
+                    session_sequences: None,
                 }) {
                     Ok(HttpShaped::Rows(rows)) => result_rows.extend(rows),
                     Ok(HttpShaped::Passthrough) => result_rows.push(passthrough_json_row(payload)),
@@ -550,6 +551,7 @@ fn append_response(
         database_id: append.database_id,
         tenant_id: append.tenant_id,
         redaction: Some(append.redaction.ctx(&append.state.shared.redaction)),
+        session_sequences: None,
     }) {
         Ok(HttpShaped::Rows(rows)) => result_rows.extend(rows),
         Ok(HttpShaped::Passthrough) => result_rows.push(passthrough_json_row(&payload)),
diff --git a/nodedb/src/control/server/http/routes/query/ndjson.rs b/nodedb/src/control/server/http/routes/query/ndjson.rs
index eeaa46697..9563200ba 100644
--- a/nodedb/src/control/server/http/routes/query/ndjson.rs
+++ b/nodedb/src/control/server/http/routes/query/ndjson.rs
@@ -153,6 +153,8 @@ pub async fn query_ndjson(
                         stream,
                         limit,
                         projection: Some(output_schema.clone()),
+                        database_id: database_id.as_u64(),
+                        tenant_id: tenant_id.as_u64(),
                         // `try_open_stream` returns `Some` only for a single-task plan.
                         redaction: tasks.first().map(|task| {
                             QueryRedaction::for_plan(tenant_id, scope.auth(), &task.plan)
@@ -330,6 +332,7 @@ pub async fn query_ndjson(
                         database_id,
                         tenant_id,
                         redaction: Some(redaction.ctx(&state.shared.redaction)),
+                        session_sequences: None,
                     }) {
                         Ok(HttpShaped::Rows(rows)) => {
                             task_rows += rows.len() as u64;
diff --git a/nodedb/src/control/server/http/routes/query_stream.rs b/nodedb/src/control/server/http/routes/query_stream.rs
index df1e8b265..82130f749 100644
--- a/nodedb/src/control/server/http/routes/query_stream.rs
+++ b/nodedb/src/control/server/http/routes/query_stream.rs
@@ -114,6 +114,11 @@ pub(super) struct NdjsonBody {
     /// Global take-N across the whole union.
     pub limit: usize,
     pub projection: Option<OutputSchema>,
+    /// Statement identity, used by the response boundary to build a
+    /// `nextval(...)` sequence stamper. A sequence output column carries no
+    /// Data-Plane value, so the value is allocated here, per batch.
+    pub database_id: u64,
+    pub tenant_id: u64,
     /// The statement's redaction inputs, resolved ONCE before the first batch
     /// is pulled. Re-resolving per batch would risk the first NDJSON lines
     /// going out unredacted.
@@ -141,6 +146,8 @@ pub(super) fn ndjson_body_stream(
         stream,
         limit,
         projection,
+        database_id,
+        tenant_id,
         redaction,
         state,
         lease_scope,
@@ -191,10 +198,21 @@ pub(super) fn ndjson_body_stream(
             // `{"id": …, "id_1": …}` rather than collapsing to one cell.
             // Only re-borrows the once-resolved inputs, so the very first
             // batch is redacted under the same policy as the last.
+            // Sequence stamps work per batch: the allocator is shared and
+            // draws fresh values for each batch's row count, so the values
+            // continue across batches in output order.
             let shaped = match shape_decoded_rows(
                 &value,
                 projection.as_ref(),
                 redaction.as_ref().map(|r| r.ctx(&state.redaction)),
+                Some(
+                    &crate::control::server::response_shape::sequence_stamp::SequenceStamper::new(
+                        std::sync::Arc::clone(&state.sequence_registry),
+                        database_id,
+                        tenant_id,
+                        None,
+                    ),
+                ),
             ) {
                 Ok(s) => s,
                 Err(e) => {
@@ -289,6 +307,8 @@ mod tests {
             stream,
             limit: usize::MAX,
             projection: None,
+            database_id: 1,
+            tenant_id: 1,
             redaction: None,
             state: test_state(),
             lease_scope: crate::control::lease::QueryLeaseScope::empty(),
@@ -306,6 +326,8 @@ mod tests {
             stream,
             limit: 1500,
             projection: None,
+            database_id: 1,
+            tenant_id: 1,
             redaction: None,
             state: test_state(),
             lease_scope: crate::control::lease::QueryLeaseScope::empty(),
@@ -328,6 +350,8 @@ mod tests {
             stream,
             limit: usize::MAX,
             projection: None,
+            database_id: 1,
+            tenant_id: 1,
             redaction: None,
             state: test_state(),
             lease_scope: crate::control::lease::QueryLeaseScope::empty(),
@@ -410,6 +434,8 @@ mod tests {
                 stream,
                 limit: usize::MAX,
                 projection: None,
+                database_id: 1,
+                tenant_id: 1,
                 redaction: None,
                 state: Arc::clone(&state),
                 lease_scope: crate::control::lease::QueryLeaseScope::empty(),
diff --git a/nodedb/src/control/server/native/dispatch/conversion.rs b/nodedb/src/control/server/native/dispatch/conversion.rs
index bf6ed5c04..1782357e8 100644
--- a/nodedb/src/control/server/native/dispatch/conversion.rs
+++ b/nodedb/src/control/server/native/dispatch/conversion.rs
@@ -237,6 +237,7 @@ pub(crate) fn calvin_native_response(
                 database_id,
                 tenant_id,
                 redaction: redaction.as_ref().map(|r| r.ctx(&state.redaction)),
+                session_sequences: None,
             })
     {
         let (cols, rows) = to_native_columns_rows(&shaped);
diff --git a/nodedb/src/control/server/native/dispatch/plan_builder/kv.rs b/nodedb/src/control/server/native/dispatch/plan_builder/kv.rs
index d66f38600..1559914d8 100644
--- a/nodedb/src/control/server/native/dispatch/plan_builder/kv.rs
+++ b/nodedb/src/control/server/native/dispatch/plan_builder/kv.rs
@@ -27,6 +27,8 @@ pub(crate) fn build_scan(
         match_pattern,
         sort_keys: Vec::new(),
         surrogate_ceiling: None,
+        projection: Vec::new(),
+        computed_columns: Vec::new(),
     }))
 }
 
diff --git a/nodedb/src/control/server/native/dispatch/response.rs b/nodedb/src/control/server/native/dispatch/response.rs
index aeba1e6e5..09fa83a37 100644
--- a/nodedb/src/control/server/native/dispatch/response.rs
+++ b/nodedb/src/control/server/native/dispatch/response.rs
@@ -36,6 +36,7 @@ pub(crate) fn data_plane_response_to_native(
         database_id: ctx.database_id(),
         tenant_id: ctx.tenant_id(),
         redaction: Some(redaction.ctx(&ctx.state.redaction)),
+        session_sequences: None,
     }) {
         Ok(ShapeOutcome::Rows(shaped)) => {
             let (columns, rows) = to_native_columns_rows(&shaped);
diff --git a/nodedb/src/control/server/native/dispatch/sql.rs b/nodedb/src/control/server/native/dispatch/sql.rs
index fef03ff46..fc2ec9bd7 100644
--- a/nodedb/src/control/server/native/dispatch/sql.rs
+++ b/nodedb/src/control/server/native/dispatch/sql.rs
@@ -392,7 +392,7 @@ async fn execute_planned(
                 if let Err(error) = stream.attach_lease_scope(scope) {
                     return resp(error_to_native(seq, &error));
                 }
-                return SqlOutcome::Stream(stream);
+                return SqlOutcome::Stream(Box::new(stream));
             }
             Ok(None) => {}
             Err(error) => return resp(error_to_native(seq, &error)),
diff --git a/nodedb/src/control/server/native/dispatch/sql_loop.rs b/nodedb/src/control/server/native/dispatch/sql_loop.rs
index d7c3397d3..00e51ed5c 100644
--- a/nodedb/src/control/server/native/dispatch/sql_loop.rs
+++ b/nodedb/src/control/server/native/dispatch/sql_loop.rs
@@ -204,6 +204,7 @@ pub(super) async fn run_dispatch_loop(
                         database_id,
                         tenant_id: ctx.tenant_id(),
                         redaction: Some(redaction.ctx(&ctx.state.redaction)),
+                        session_sequences: None,
                     }) {
                         Ok(ShapeOutcome::Rows(mut shaped)) => {
                             if let Some(notice) = shaped.notice.take() {
@@ -315,6 +316,7 @@ pub(super) async fn run_dispatch_loop(
                 database_id,
                 tenant_id: ctx.tenant_id(),
                 redaction: Some(redaction.ctx(&ctx.state.redaction)),
+                session_sequences: None,
             }) {
                 Ok(ShapeOutcome::Rows(mut shaped)) => {
                     if let Some(notice) = shaped.notice.take() {
diff --git a/nodedb/src/control/server/native/dispatch/streaming.rs b/nodedb/src/control/server/native/dispatch/streaming.rs
index cda6e6e18..75c84ea6b 100644
--- a/nodedb/src/control/server/native/dispatch/streaming.rs
+++ b/nodedb/src/control/server/native/dispatch/streaming.rs
@@ -35,8 +35,10 @@ use super::DispatchCtx;
 pub(crate) enum SqlOutcome {
     /// A single materialized response — encoded/chunked by the session loop.
     Response(Box<NativeResponse>),
-    /// A lazy row stream to be emitted as multiple frames.
-    Stream(SqlStream),
+    /// A lazy row stream to be emitted as multiple frames. Boxed: a stream
+    /// carries its projection, redaction, lease scope, and sequence stamper,
+    /// which is far larger than the response variant.
+    Stream(Box<SqlStream>),
 }
 
 impl SqlOutcome {
@@ -78,6 +80,11 @@ pub(crate) struct SqlStream {
     /// stream, so retaining the scope here holds leases until final emission
     /// or connection teardown drops the stream.
     pub(crate) lease_scope: Option<crate::control::lease::QueryLeaseScope>,
+    /// Sequence stamps for this statement, when its SELECT list carries
+    /// `nextval(...)`: the value is allocated at the response boundary, since
+    /// the Data Plane evaluates nothing for a sequence output column.
+    pub sequence_stamper:
+        Option<crate::control::server::response_shape::sequence_stamp::SequenceStamper>,
 }
 
 impl SqlStream {
@@ -186,5 +193,13 @@ pub(crate) async fn try_open_sql_stream(
             &child_plan,
         )),
         lease_scope: None,
+        sequence_stamper: Some(
+            crate::control::server::response_shape::sequence_stamp::SequenceStamper::new(
+                std::sync::Arc::clone(&ctx.state.sequence_registry),
+                ctx.database_id().as_u64(),
+                ctx.tenant_id().as_u64(),
+                None,
+            ),
+        ),
     }))
 }
diff --git a/nodedb/src/control/server/native/session/run.rs b/nodedb/src/control/server/native/session/run.rs
index 165f1c655..8f6469a45 100644
--- a/nodedb/src/control/server/native/session/run.rs
+++ b/nodedb/src/control/server/native/session/run.rs
@@ -311,7 +311,7 @@ impl NativeSession {
                 dispatch::SqlOutcome::Stream(sql_stream) => {
                     super::session_stream::emit_sql_stream(
                         &mut self.stream,
-                        sql_stream,
+                        *sql_stream,
                         format,
                         self.state.as_ref(),
                     )
diff --git a/nodedb/src/control/server/native/session/session_stream.rs b/nodedb/src/control/server/native/session/session_stream.rs
index e452226c9..1974154bc 100644
--- a/nodedb/src/control/server/native/session/session_stream.rs
+++ b/nodedb/src/control/server/native/session/session_stream.rs
@@ -40,10 +40,11 @@ fn decode_batch_to_columns_rows(
     json_text: &str,
     projection: Option<&OutputSchema>,
     redaction: Option<RedactionCtx<'_>>,
+    stamper: Option<&crate::control::server::response_shape::sequence_stamp::SequenceStamper>,
 ) -> crate::Result<(Vec<String>, Vec<Vec<Value>>)> {
     match sonic_rs::from_str::<serde_json::Value>(json_text) {
         Ok(decoded) => {
-            let shaped = shape_decoded_rows(&decoded, projection, redaction)?;
+            let shaped = shape_decoded_rows(&decoded, projection, redaction, stamper)?;
             Ok(to_native_columns_rows(&shaped))
         }
         Err(_) => Ok((
@@ -77,6 +78,7 @@ pub(super) async fn emit_sql_stream(
         projection,
         redaction,
         lease_scope: _lease_scope,
+        sequence_stamper,
     } = sql_stream;
 
     let mut emitted: usize = 0;
@@ -106,6 +108,7 @@ pub(super) async fn emit_sql_stream(
             &json_text,
             projection.as_ref(),
             redaction.as_ref().map(|r| r.ctx(&state.redaction)),
+            sequence_stamper.as_ref(),
         )?;
         if batch_rows.is_empty() {
             continue;
@@ -245,6 +248,7 @@ mod tests {
             let mut conn = ConnStream::plain(sock);
             let stream: ResultStream = Box::pin(futures::stream::iter(batches));
             let sql_stream = SqlStream {
+                sequence_stamper: None,
                 seq: 7,
                 limit,
                 stream,
diff --git a/nodedb/src/control/server/pgwire/handler/prepared/execute.rs b/nodedb/src/control/server/pgwire/handler/prepared/execute.rs
index 6838c9221..939add88b 100644
--- a/nodedb/src/control/server/pgwire/handler/prepared/execute.rs
+++ b/nodedb/src/control/server/pgwire/handler/prepared/execute.rs
@@ -145,6 +145,7 @@ impl NodeDbPgHandler {
                         // matching PostgreSQL text form and, for binary
                         // columns, extract the correctly-typed scalar.
                         ty: pg_type_to_ddl_col_type(f.datatype()),
+                        sequence: None,
                     })
                     .collect(),
                 is_star: false,
diff --git a/nodedb/src/control/server/pgwire/handler/routing/calvin_response.rs b/nodedb/src/control/server/pgwire/handler/routing/calvin_response.rs
index dd305ec63..e930deb35 100644
--- a/nodedb/src/control/server/pgwire/handler/routing/calvin_response.rs
+++ b/nodedb/src/control/server/pgwire/handler/routing/calvin_response.rs
@@ -81,6 +81,7 @@ pub(super) fn calvin_execution_response(
                 database_id,
                 tenant_id,
                 redaction: Some(redaction.ctx(&state.redaction)),
+                session_sequences: None,
             })
     {
         return Ok(CalvinTaskOutcome::Rows(shaped));
diff --git a/nodedb/src/control/server/pgwire/handler/routing/cluster_array.rs b/nodedb/src/control/server/pgwire/handler/routing/cluster_array.rs
index 0024ffc96..8982383de 100644
--- a/nodedb/src/control/server/pgwire/handler/routing/cluster_array.rs
+++ b/nodedb/src/control/server/pgwire/handler/routing/cluster_array.rs
@@ -19,7 +19,7 @@ use crate::control::server::response_shape::redaction::QueryRedaction;
 use crate::control::server::response_shape::schema::OutputSchema;
 use crate::control::server::shared::session::SessionId;
 
-use super::super::super::types::{error_to_sqlstate, sqlstate_error};
+use super::super::super::types::{error_to_sqlstate, numeric_code_to_sqlstate, sqlstate_error};
 use super::super::core::NodeDbPgHandler;
 use super::super::plan::{PlanKind, payload_to_response};
 use super::super::shape_encode;
@@ -128,7 +128,7 @@ impl NodeDbPgHandler {
             projection,
             Some(redaction.ctx(&self.state.redaction)),
         )
-        .map_err(|e| sqlstate_error("XX000", e.message()))?
+        .map_err(|e| sqlstate_error(numeric_code_to_sqlstate(e.code()), e.message()))?
         {
             ShapeOutcome::Rows(shaped) => {
                 let (response, notice) =
diff --git a/nodedb/src/control/server/pgwire/handler/routing/dispatch_loop.rs b/nodedb/src/control/server/pgwire/handler/routing/dispatch_loop.rs
index 01baa406c..e20660e66 100644
--- a/nodedb/src/control/server/pgwire/handler/routing/dispatch_loop.rs
+++ b/nodedb/src/control/server/pgwire/handler/routing/dispatch_loop.rs
@@ -23,7 +23,9 @@ use crate::control::server::shared::session::SessionId;
 use crate::types::TenantId;
 use nodedb_physical::physical_task::{PhysicalTask, PostSetOp};
 
-use super::super::super::types::{error_to_sqlstate, response_status_to_sqlstate, sqlstate_error};
+use super::super::super::types::{
+    error_to_sqlstate, numeric_code_to_sqlstate, response_status_to_sqlstate, sqlstate_error,
+};
 use super::super::core::NodeDbPgHandler;
 use super::super::plan::{PlanKind, describe_plan, payload_to_response};
 use super::super::shape_encode;
@@ -401,8 +403,12 @@ impl NodeDbPgHandler {
                     database_id: task_database_id,
                     tenant_id,
                     redaction: Some(redaction.ctx(&self.state.redaction)),
+                    session_sequences: self.sessions.sequence_values(session_id),
                 })
-                .map_err(|e| sqlstate_error("XX000", e.message()))?
+                // Preserve the shaper error's own SQLSTATE: hardcoding XX000
+                // turned a client-visible refusal such as an undefined
+                // sequence into an internal fault.
+                .map_err(|e| sqlstate_error(numeric_code_to_sqlstate(e.code()), e.message()))?
                 {
                     ShapeOutcome::Rows(shaped) => {
                         task_rows = Some(shaped.rows.len() as u64);
diff --git a/nodedb/src/control/server/pgwire/handler/routing/execute_dml_hooks.rs b/nodedb/src/control/server/pgwire/handler/routing/execute_dml_hooks.rs
index 41cbb3a3e..1711cc74d 100644
--- a/nodedb/src/control/server/pgwire/handler/routing/execute_dml_hooks.rs
+++ b/nodedb/src/control/server/pgwire/handler/routing/execute_dml_hooks.rs
@@ -21,7 +21,7 @@ use crate::control::trigger::dml_hook::DmlWriteInfo;
 use crate::types::TenantId;
 use nodedb_physical::physical_task::PhysicalTask;
 
-use super::super::super::types::{error_to_sqlstate, sqlstate_error};
+use super::super::super::types::{error_to_sqlstate, numeric_code_to_sqlstate, sqlstate_error};
 use super::super::core::NodeDbPgHandler;
 use super::super::plan::PlanKind;
 
@@ -332,7 +332,7 @@ impl NodeDbPgHandler {
                         projection,
                         Some(redaction.ctx(&self.state.redaction)),
                     )
-                    .map_err(|e| sqlstate_error("XX000", e.message()))?
+                    .map_err(|e| sqlstate_error(numeric_code_to_sqlstate(e.code()), e.message()))?
                     {
                         ShapeOutcome::Rows(shaped) => {
                             // Clone write-path DML result (PointUpdate/PointDelete):
diff --git a/nodedb/src/control/server/pgwire/handler/routing/gateway_dispatch.rs b/nodedb/src/control/server/pgwire/handler/routing/gateway_dispatch.rs
index b7bdd9960..cba3f624a 100644
--- a/nodedb/src/control/server/pgwire/handler/routing/gateway_dispatch.rs
+++ b/nodedb/src/control/server/pgwire/handler/routing/gateway_dispatch.rs
@@ -22,7 +22,7 @@ use crate::control::server::shared::metering::{PlanMeteringInfo, meter_dispatch}
 use crate::types::{TenantId, TraceId};
 use nodedb_physical::physical_task::PhysicalTask;
 
-use super::super::super::types::sqlstate_error;
+use super::super::super::types::{numeric_code_to_sqlstate, sqlstate_error};
 use super::super::core::NodeDbPgHandler;
 use super::super::plan::{PlanKind, multirow_payload_to_response};
 use super::super::shape_encode;
@@ -75,7 +75,7 @@ fn push_shaped_response(
         projection,
         Some(redaction.ctx(&state.redaction)),
     )
-    .map_err(|e| sqlstate_error("XX000", e.message()))?
+    .map_err(|e| sqlstate_error(numeric_code_to_sqlstate(e.code()), e.message()))?
     {
         ShapeOutcome::Rows(shaped) => {
             let (response, notice) = shape_encode::shaped_query_response(shaped, result_formats);
@@ -228,7 +228,7 @@ impl NodeDbPgHandler {
                         projection,
                         Some(redaction.ctx(&self.state.redaction)),
                     )
-                    .map_err(|e| sqlstate_error("XX000", e.message()))?
+                    .map_err(|e| sqlstate_error(numeric_code_to_sqlstate(e.code()), e.message()))?
                     {
                         ShapeOutcome::Rows(shaped) => {
                             task_rows = Some(task_rows.unwrap_or(0) + shaped.rows.len() as u64);
diff --git a/nodedb/src/control/server/pgwire/handler/routing/set_ops.rs b/nodedb/src/control/server/pgwire/handler/routing/set_ops.rs
index 2baaaa9a3..736caabca 100644
--- a/nodedb/src/control/server/pgwire/handler/routing/set_ops.rs
+++ b/nodedb/src/control/server/pgwire/handler/routing/set_ops.rs
@@ -13,7 +13,7 @@ use crate::control::server::response_shape::compose::{self, ShapeOutcome};
 use crate::control::server::response_shape::redaction::RedactionCtx;
 use crate::control::server::response_shape::schema::OutputSchema;
 
-use super::super::super::types::sqlstate_error;
+use super::super::super::types::{numeric_code_to_sqlstate, sqlstate_error};
 use super::super::plan::{PlanKind, multirow_payload_to_response};
 use super::super::shape_encode;
 
@@ -37,7 +37,7 @@ pub(super) fn apply_set_ops(
     };
     Ok(
         match compose::shape_payload_no_plan(&merged, PlanKind::MultiRow, projection, redaction)
-            .map_err(|e| sqlstate_error("XX000", e.message()))?
+            .map_err(|e| sqlstate_error(numeric_code_to_sqlstate(e.code()), e.message()))?
         {
             ShapeOutcome::Rows(shaped) => {
                 shape_encode::shaped_query_response(shaped, result_formats)
diff --git a/nodedb/src/control/server/pgwire/handler/routing/streaming.rs b/nodedb/src/control/server/pgwire/handler/routing/streaming.rs
index 01cfdc0dc..554c96c18 100644
--- a/nodedb/src/control/server/pgwire/handler/routing/streaming.rs
+++ b/nodedb/src/control/server/pgwire/handler/routing/streaming.rs
@@ -22,7 +22,7 @@ use crate::control::server::response_shape::redaction::QueryRedaction;
 use crate::control::server::shared::session::SessionId;
 
 use super::super::super::types::error_to_sqlstate;
-use super::super::super::types::sqlstate_error;
+use super::super::super::types::{numeric_code_to_sqlstate, sqlstate_error};
 use super::super::core::NodeDbPgHandler;
 use super::super::plan::{PlanKind, multirow_payload_to_response};
 use super::super::stream_response;
@@ -141,8 +141,9 @@ impl NodeDbPgHandler {
                             shaping.projection,
                             Some(redaction.ctx(&state.redaction)),
                         )
-                        .map_err(|e| sqlstate_error("XX000", e.message()))?
-                        {
+                        .map_err(|e| {
+                            sqlstate_error(numeric_code_to_sqlstate(e.code()), e.message())
+                        })? {
                             ShapeOutcome::Rows(shaped) => {
                                 let (response, _notice) = crate::control::server::pgwire::handler::shape_encode::shaped_query_response(
                                 shaped,
@@ -231,6 +232,14 @@ impl NodeDbPgHandler {
                         redaction,
                         state: std::sync::Arc::clone(&state),
                         meter_guard,
+                        sequence_stamper: Some(
+                            crate::control::server::response_shape::sequence_stamp::SequenceStamper::new(
+                                std::sync::Arc::clone(&state.sequence_registry),
+                                task.database_id.as_u64(),
+                                task.tenant_id.as_u64(),
+                                self.sessions.sequence_values(session_id),
+                            ),
+                        ),
                     },
                 )
             }
@@ -252,6 +261,10 @@ impl NodeDbPgHandler {
                     redaction,
                     state: std::sync::Arc::clone(&state),
                     meter_guard,
+                    // The raw multirow shape ships each row as one opaque JSON
+                    // text cell, so a sequence output column has no addressable
+                    // cell here. The projected shape above carries the stamper.
+                    sequence_stamper: None,
                 },
             ),
         };
diff --git a/nodedb/src/control/server/pgwire/handler/stream_response.rs b/nodedb/src/control/server/pgwire/handler/stream_response.rs
index 84103a59a..9a12143a4 100644
--- a/nodedb/src/control/server/pgwire/handler/stream_response.rs
+++ b/nodedb/src/control/server/pgwire/handler/stream_response.rs
@@ -15,6 +15,7 @@ use pgwire::error::{ErrorInfo, PgWireError, PgWireResult};
 use crate::control::server::response_shape::compose::shape_decoded_rows;
 use crate::control::server::response_shape::redaction::{QueryRedaction, redact_envelope_row};
 use crate::control::server::response_shape::schema::OutputSchema;
+use crate::control::server::response_shape::sequence_stamp::SequenceStamper;
 use crate::control::server::response_shape::types::DdlColType;
 use crate::control::server::result_stream::ResultStream;
 use crate::control::server::shared::metering::DetachedMeterGuard;
@@ -39,6 +40,10 @@ pub(crate) struct StreamResponseContext {
     pub(crate) state: Arc<SharedState>,
     /// `None` when metering is disabled, or when this request is not billable.
     pub(crate) meter_guard: Option<DetachedMeterGuard>,
+    /// Sequence stamps for this statement, when its SELECT list carries
+    /// `nextval(...)`. Built once from the same identity redaction uses, so
+    /// every streamed batch stamps from one plan and one sequence set.
+    pub(crate) sequence_stamper: Option<SequenceStamper>,
 }
 
 /// Build a streaming multi-row pgwire `Response` whose `DataRow`s are pulled
@@ -65,6 +70,10 @@ pub(crate) fn streaming_multirow_response(
         redaction,
         state,
         meter_guard,
+        // This shape emits one opaque `result` text column per row, so it never
+        // reaches the shaping core and has no addressable cell to stamp. The
+        // projected shape's own response builder applies the stamper.
+        sequence_stamper: _,
     } = context;
 
     let schema = Arc::new(vec![text_field("result")]);
@@ -155,6 +164,7 @@ pub(crate) fn streaming_shaped_response(
         redaction,
         state,
         meter_guard,
+        sequence_stamper,
     } = context;
 
     let display_columns: Vec<String> = schema_out
@@ -228,6 +238,7 @@ pub(crate) fn streaming_shaped_response(
                 &value,
                 Some(&schema_out),
                 redaction.as_ref().map(|r| r.ctx(&state.redaction)),
+                sequence_stamper.as_ref(),
             )
             .map_err(|e| {
                 PgWireError::UserError(Box::new(ErrorInfo::new(
@@ -343,6 +354,7 @@ pub(crate) async fn streaming_star_response(
         &serde_json::Value::Array(values),
         None,
         redaction.as_ref().map(|r| r.ctx(&state.redaction)),
+        None,
     ) {
         Ok(s) => s,
         Err(e) => {
diff --git a/nodedb/src/control/server/pgwire/types/error_map.rs b/nodedb/src/control/server/pgwire/types/error_map.rs
index 976634640..dfbcaa9fd 100644
--- a/nodedb/src/control/server/pgwire/types/error_map.rs
+++ b/nodedb/src/control/server/pgwire/types/error_map.rs
@@ -197,7 +197,7 @@ pub fn error_to_sqlstate(err: &crate::Error) -> (&'static str, &'static str, Str
 /// numeric code, so a constraint violation (say) maps to the same SQLSTATE
 /// whether it happened locally or on a remote node. Unmapped/unknown codes
 /// fall back to INTERNAL_ERROR — the behaviour before codes were preserved.
-pub(crate) fn numeric_code_to_sqlstate(code: nodedb_types::error::ErrorCode) -> &'static str {
+pub fn numeric_code_to_sqlstate(code: nodedb_types::error::ErrorCode) -> &'static str {
     use nodedb_types::error::ErrorCode as Ec;
     match code {
         // Mirrors the `RejectedConstraint` arm.
@@ -213,6 +213,27 @@ pub(crate) fn numeric_code_to_sqlstate(code: nodedb_types::error::ErrorCode) ->
         Ec::DOCUMENT_NOT_FOUND => sqlstate::NO_DATA,
         // Mirrors the `BadRequest` / `PlanError` arms.
         Ec::BAD_REQUEST | Ec::PLAN_ERROR => sqlstate::SYNTAX_ERROR,
+        // A named catalog object (a sequence, most commonly) that does not
+        // exist. Without this arm the code falls back to INTERNAL_ERROR
+        // (XX000), so a client-visible "undefined object" reaches pgwire as an
+        // internal fault — the same error-class leak the response-shaping path
+        // had.
+        Ec::UNDEFINED_OBJECT => sqlstate::UNDEFINED_OBJECT,
+        // The object exists but its prerequisite step has not run, such as
+        // `currval` before this session called `nextval`. Mirrors the
+        // `ObjectNotInPrerequisiteState` arm.
+        Ec::OBJECT_NOT_READY => sqlstate::OBJECT_NOT_IN_PREREQUISITE_STATE,
+        // A generic lookup miss. Mirrors `crate::Error::DocumentNotFound`'s
+        // no-data class for the callers that use the generic code.
+        Ec::NOT_FOUND => sqlstate::NO_DATA,
+        // The named database does not exist.
+        Ec::DATABASE_NOT_FOUND => sqlstate::INVALID_CATALOG_NAME,
+        // SQL is disabled for this server; not a retryable internal fault.
+        Ec::SQL_NOT_ENABLED => sqlstate::FEATURE_NOT_SUPPORTED,
+        // A value could not be coerced to the target type.
+        Ec::TYPE_MISMATCH => sqlstate::CANNOT_COERCE,
+        // A value outside the target type's range.
+        Ec::OVERFLOW => sqlstate::NUMERIC_VALUE_OUT_OF_RANGE,
         // Mirrors the `UndefinedFunction` arm.
         Ec::UNDEFINED_FUNCTION => sqlstate::UNDEFINED_FUNCTION,
         // Mirrors the `UndefinedColumn` arm.
diff --git a/nodedb/src/control/server/pgwire/types/mod.rs b/nodedb/src/control/server/pgwire/types/mod.rs
index e4796724b..98c839ac9 100644
--- a/nodedb/src/control/server/pgwire/types/mod.rs
+++ b/nodedb/src/control/server/pgwire/types/mod.rs
@@ -11,7 +11,8 @@ pub mod parse;
 pub mod privilege;
 
 pub use error_map::{
-    error_to_sqlstate, notice_warning, response_status_to_sqlstate, sqlstate_error,
+    error_to_sqlstate, notice_warning, numeric_code_to_sqlstate, response_status_to_sqlstate,
+    sqlstate_error,
 };
 pub use field::{
     bool_field, bytea_field, float4_array_field, float4_field, float8_array_field, float8_field,
diff --git a/nodedb/src/control/server/resp/handler.rs b/nodedb/src/control/server/resp/handler.rs
index 0568646e5..ce17d7c83 100644
--- a/nodedb/src/control/server/resp/handler.rs
+++ b/nodedb/src/control/server/resp/handler.rs
@@ -348,6 +348,8 @@ async fn handle_scan(cmd: &RespCommand, session: &RespSession, state: &SharedSta
         match_pattern,
         sort_keys: Vec::new(),
         surrogate_ceiling: None,
+        projection: Vec::new(),
+        computed_columns: Vec::new(),
     });
 
     match dispatch_kv(state, session, plan).await {
@@ -382,6 +384,8 @@ async fn handle_keys(cmd: &RespCommand, session: &RespSession, state: &SharedSta
         match_pattern: Some(pattern.to_string()),
         sort_keys: Vec::new(),
         surrogate_ceiling: None,
+        projection: Vec::new(),
+        computed_columns: Vec::new(),
     });
 
     match dispatch_kv(state, session, plan).await {
@@ -412,6 +416,8 @@ async fn handle_dbsize(session: &RespSession, state: &SharedState) -> RespValue
         match_pattern: None,
         sort_keys: Vec::new(),
         surrogate_ceiling: None,
+        projection: Vec::new(),
+        computed_columns: Vec::new(),
     });
 
     match dispatch_kv(state, session, plan).await {
diff --git a/nodedb/src/control/server/response_shape/compose.rs b/nodedb/src/control/server/response_shape/compose.rs
index 5e1286d97..667f3f609 100644
--- a/nodedb/src/control/server/response_shape/compose.rs
+++ b/nodedb/src/control/server/response_shape/compose.rs
@@ -35,6 +35,7 @@ use super::redaction::RedactionCtx;
 use super::request::MaterializedShapeRequest;
 use super::returning::shape_returning_rows;
 use super::schema::OutputSchema;
+use super::sequence_stamp::SequenceStamper;
 use super::types::{DdlColType, PlanKind, ShapedRows};
 
 /// NOTICE text for an `AS OF SYSTEM TIME` cutoff older than the oldest
@@ -71,6 +72,7 @@ pub fn shape_response_materialized(
         database_id,
         tenant_id,
         redaction,
+        session_sequences,
     } = request;
 
     match plan_kind {
@@ -81,6 +83,18 @@ pub fn shape_response_materialized(
         | PlanKind::MultiRow => {}
     }
 
+    // Sequence stamps: the one place a `nextval` value is produced for a
+    // SELECT or RETURNING row set. Built from the request's own identity, so
+    // every materialized caller stamps without opting in. The session map is
+    // threaded through so a stamped value updates the caller's `currval`.
+    let stamper = SequenceStamper::new(
+        std::sync::Arc::clone(&state.sequence_registry),
+        database_id.as_u64(),
+        tenant_id.as_u64(),
+        session_sequences,
+    );
+    let stamper = Some(&stamper);
+
     // Seam-1 order, exactly as pgwire's `dispatch_task_loop` applies it
     // (apply_kv_wrap -> translate_search_response) before any decode/shape step.
     let wrapped = apply_kv_wrap(plan, payload);
@@ -90,9 +104,11 @@ pub fn shape_response_materialized(
         PlanKind::ArraySlice => shape_array_slice(&translated, redaction)?,
         // `RETURNING` rows are held to the columns already announced to the
         // client, when any were — see `super::returning`.
-        PlanKind::ReturningRows => shape_returning_rows(&translated, projection, redaction)?,
+        PlanKind::ReturningRows => {
+            shape_returning_rows(&translated, projection, redaction, stamper)?
+        }
         PlanKind::SingleDocument | PlanKind::MultiRow => {
-            shape_generic_rows(&translated, projection, redaction)?
+            shape_generic_rows(&translated, projection, redaction, stamper)?
         }
         // Handled by the early return above; kept exhaustive (no catch-all,
         // no panic) so a future PlanKind desync degrades to passthrough
@@ -120,10 +136,13 @@ pub fn shape_payload_no_plan(
         PlanKind::Execution | PlanKind::DmlResult(_) => ShapeOutcome::Passthrough,
         PlanKind::ArraySlice => ShapeOutcome::Rows(shape_array_slice(payload, redaction)?),
         PlanKind::ReturningRows => {
-            ShapeOutcome::Rows(shape_returning_rows(payload, projection, redaction)?)
+            ShapeOutcome::Rows(shape_returning_rows(payload, projection, redaction, None)?)
         }
         PlanKind::SingleDocument | PlanKind::MultiRow => {
-            ShapeOutcome::Rows(shape_generic_rows(payload, projection, redaction)?)
+            // No plan in scope means no statement identity either, so no
+            // sequence stamps: a `nextval(...)` column only ever reaches this
+            // shaper through a streamed/materialized path that carries one.
+            ShapeOutcome::Rows(shape_generic_rows(payload, projection, redaction, None)?)
         }
     })
 }
@@ -155,7 +174,7 @@ fn shape_array_slice(
     let notice = truncated.then(|| TRUNCATED_BEFORE_HORIZON_NOTICE.to_string());
 
     let mut shaped = match sonic_rs::from_str::<JsonValue>(&rows_json) {
-        Ok(value) => shape_decoded_rows(&value, None, redaction)?,
+        Ok(value) => shape_decoded_rows(&value, None, redaction, None)?,
         Err(_) => empty_shaped(),
     };
     shaped.notice = notice;
@@ -171,13 +190,14 @@ fn shape_generic_rows(
     payload: &[u8],
     projection: Option<&OutputSchema>,
     redaction: Option<RedactionCtx<'_>>,
+    stamper: Option<&SequenceStamper>,
 ) -> crate::Result<ShapedRows> {
     if payload.is_empty() {
         return Ok(empty_shaped());
     }
     let text = decode_payload_to_json(payload);
     match sonic_rs::from_str::<JsonValue>(&text) {
-        Ok(value) => shape_decoded_rows(&value, projection, redaction),
+        Ok(value) => shape_decoded_rows(&value, projection, redaction, stamper),
         Err(_) => Ok(single_result_row(text)),
     }
 }
@@ -199,6 +219,7 @@ pub fn shape_decoded_rows(
     decoded: &JsonValue,
     projection: Option<&OutputSchema>,
     redaction: Option<RedactionCtx<'_>>,
+    stamper: Option<&SequenceStamper>,
 ) -> crate::Result<ShapedRows> {
     let mut rows = Vec::new();
     push_flat_rows(decoded.clone(), &mut rows)?;
@@ -224,16 +245,24 @@ pub fn shape_decoded_rows(
             // columns to the last value. Encoders re-derive the same keys via
             // `cell_keys` when reading cells.
             let keys = super::project::cell_keys(&display_names);
-            let projected_rows = rows
+            let column_types: Vec<DdlColType> = s.columns.iter().map(|c| c.ty).collect();
+            let mut projected_rows: Vec<Map<String, JsonValue>> = rows
                 .iter()
                 .map(|row| project_row(row, &lookup_keys, &display_names, &keys))
                 .collect();
-            // Carry each projected column's real catalog type, aligned in
-            // order with `display_names`. Only the pgwire encoder consumes
-            // these — mapping them to typed RowDescription OIDs and rendering
-            // each cell in that type's PostgreSQL text form; native/http
-            // ignore column types entirely.
-            let column_types: Vec<DdlColType> = s.columns.iter().map(|c| c.ty).collect();
+            // The declared catalog types travel with the shaped rows: pgwire's
+            // encoder maps them to RowDescription OIDs and renders each cell in
+            // that type's PostgreSQL text form.
+            scale_declared_instants(&mut projected_rows, &keys, &column_types)?;
+            // Sequence stamps run after every projection, at the same boundary
+            // the instant conversion uses: the Data Plane evaluated nothing for
+            // a `nextval(...)` column, so its value is allocated here, once per
+            // output row, in output order.
+            if let Some(stamper) = stamper {
+                let sequences: Vec<Option<String>> =
+                    s.columns.iter().map(|c| c.sequence.clone()).collect();
+                stamper.stamp(&mut projected_rows, &keys, &sequences)?;
+            }
             Ok(ShapedRows {
                 columns: display_names,
                 column_types,
@@ -247,6 +276,28 @@ pub fn shape_decoded_rows(
             // schemaless collections.
             let columns = derive_columns(&rows);
             let column_types = ShapedRows::text_types(columns.len());
+            // A declared collection's star still carries the resolved catalog
+            // types for its declared columns. They are not announced, but a
+            // declared instant is stored in milliseconds and leaves as the
+            // wire's microseconds here too: the same once-only conversion the
+            // named-projection path applies. A column with no declared type
+            // (a schemaless field) stays TEXT and is left untouched.
+            if let Some(s) = projection
+                && s.is_star
+                && !s.columns.is_empty()
+            {
+                let types: Vec<DdlColType> = columns
+                    .iter()
+                    .map(|name| {
+                        s.columns
+                            .iter()
+                            .find(|c| c.lookup_key == *name || c.display_name == *name)
+                            .map(|c| c.ty)
+                            .unwrap_or(DdlColType::Text)
+                    })
+                    .collect();
+                scale_declared_instants(&mut rows, &columns, &types)?;
+            }
             Ok(ShapedRows {
                 columns,
                 column_types,
@@ -257,6 +308,60 @@ pub fn shape_decoded_rows(
     }
 }
 
+/// Convert declared instant cells from the storage unit to the wire unit.
+///
+/// A timeseries collection stores every instant as epoch milliseconds and the
+/// wire renders epoch microseconds. The conversion happens exactly once, here
+/// at the response boundary, after every predicate and projection — so the
+/// Data Plane, joins, and computed expressions all observe milliseconds, and a
+/// remote scan agrees with a local one.
+///
+/// Non-instant columns, SQL NULL, and cells that are not integral numbers pass
+/// through untouched. An instant that would overflow microseconds fails the
+/// response instead of wrapping.
+///
+/// Invariant recorded for the numeric arm below: every engine emits a declared
+/// instant either as a `DateTime`/string (which skips this function) or as a
+/// numeric value in **milliseconds**. A future engine emitting a numeric
+/// instant in microseconds would be scaled ×1000 here unnoticed.
+pub(super) fn scale_declared_instants(
+    rows: &mut [Map<String, JsonValue>],
+    keys: &[String],
+    column_types: &[DdlColType],
+) -> crate::Result<()> {
+    let instant_keys: Vec<&String> = keys
+        .iter()
+        .zip(column_types.iter())
+        .filter(|(_, ct)| matches!(ct, DdlColType::Timestamp | DdlColType::Timestamptz))
+        .map(|(key, _)| key)
+        .collect();
+    if instant_keys.is_empty() {
+        return Ok(());
+    }
+    for row in rows.iter_mut() {
+        for key in &instant_keys {
+            let Some(cell) = row.get_mut(*key) else {
+                continue;
+            };
+            let JsonValue::Number(n) = cell else {
+                continue;
+            };
+            let Some(millis) = n.as_i64() else {
+                continue;
+            };
+            // One constructor owns the millisecond-to-microsecond rule and
+            // its range check, so a future change to either lands here.
+            let micros = nodedb_types::NdbDateTime::from_millis(millis)
+                .map_err(|e| crate::Error::Internal {
+                    detail: format!("declared instant column {key} at {millis} ms: {e}"),
+                })?
+                .micros;
+            *cell = JsonValue::from(micros);
+        }
+    }
+    Ok(())
+}
+
 /// Apply the statement's column-level redaction policy to every flat row.
 ///
 /// A `None` context means the producer has no requester identity in scope and
@@ -438,6 +543,7 @@ mod tests {
             database_id: DatabaseId::new(1),
             tenant_id: TenantId::new(1),
             redaction: None,
+            session_sequences: None,
         })
         .expect("execution plan passthrough");
         assert!(matches!(materialized, ShapeOutcome::Passthrough));
@@ -533,6 +639,7 @@ mod tests {
                     display_name: (*display).to_string(),
                     lookup_key: (*lookup).to_string(),
                     ty: DdlColType::Text,
+                    sequence: None,
                 })
                 .collect(),
             is_star: false,
@@ -556,7 +663,7 @@ mod tests {
         let sources = vec![(String::new(), "users".to_string())];
         let decoded = one_row(serde_json::json!({"email": "a@b.c", "name": "Alice"}));
 
-        let shaped = shape_decoded_rows(&decoded, None, Some(ctx(&store, &roles, &sources)))
+        let shaped = shape_decoded_rows(&decoded, None, Some(ctx(&store, &roles, &sources)), None)
             .expect("shape rows");
         assert_eq!(shaped.rows[0]["email"], JsonValue::String("***".into()));
         assert_eq!(shaped.rows[0]["name"], JsonValue::String("Alice".into()));
@@ -576,8 +683,8 @@ mod tests {
         let sources = vec![(String::new(), "users".to_string())];
         let decoded = one_row(serde_json::json!({"email": "a@b.c", "name": "Alice"}));
 
-        let baseline = shape_decoded_rows(&decoded, None, None).expect("shape rows");
-        let shaped = shape_decoded_rows(&decoded, None, Some(ctx(&store, &roles, &sources)))
+        let baseline = shape_decoded_rows(&decoded, None, None, None).expect("shape rows");
+        let shaped = shape_decoded_rows(&decoded, None, Some(ctx(&store, &roles, &sources)), None)
             .expect("shape rows");
         assert_eq!(shaped.rows, baseline.rows);
         assert_eq!(shaped.columns, baseline.columns);
@@ -602,6 +709,7 @@ mod tests {
             &decoded,
             Some(&projection),
             Some(ctx(&store, &roles, &sources)),
+            None,
         )
         .expect("shape rows");
         assert_eq!(shaped.columns, vec!["contact".to_string()]);
@@ -630,6 +738,7 @@ mod tests {
             &decoded,
             Some(&projection),
             Some(ctx(&store, &roles, &sources)),
+            None,
         )
         .expect("shape rows");
         // `cell_keys` suffixes the duplicate display name.
@@ -651,7 +760,7 @@ mod tests {
         let sources = vec![(String::new(), "users".to_string())];
         let decoded = one_row(serde_json::json!({"id": "u1", "email": "a@b.c"}));
 
-        let shaped = shape_decoded_rows(&decoded, None, Some(ctx(&store, &roles, &sources)))
+        let shaped = shape_decoded_rows(&decoded, None, Some(ctx(&store, &roles, &sources)), None)
             .expect("shape rows");
         assert!(
             shaped.columns.contains(&"email".to_string()),
diff --git a/nodedb/src/control/server/response_shape/mod.rs b/nodedb/src/control/server/response_shape/mod.rs
index e578e3ea7..3709b8169 100644
--- a/nodedb/src/control/server/response_shape/mod.rs
+++ b/nodedb/src/control/server/response_shape/mod.rs
@@ -9,6 +9,7 @@ pub mod redaction;
 pub mod request;
 pub mod returning;
 pub mod schema;
+pub mod sequence_stamp;
 pub mod types;
 
 pub use redaction::{redact_decoded_value, redact_envelope_row, redact_stored_value_bytes};
diff --git a/nodedb/src/control/server/response_shape/request.rs b/nodedb/src/control/server/response_shape/request.rs
index bcccc0c28..797bc0be8 100644
--- a/nodedb/src/control/server/response_shape/request.rs
+++ b/nodedb/src/control/server/response_shape/request.rs
@@ -7,6 +7,8 @@
 //! tenant and redaction context together, and a positional list that long is
 //! both unreadable and easy to transpose at a call site.
 
+use std::sync::Arc;
+
 use crate::bridge::envelope::PhysicalPlan;
 use crate::control::state::SharedState;
 use nodedb_types::{DatabaseId, TenantId};
@@ -31,4 +33,8 @@ pub struct MaterializedShapeRequest<'a> {
     /// Column-level redaction for this statement, resolved once per query.
     /// `None` only where the producer has no requester identity at all.
     pub redaction: Option<RedactionCtx<'a>>,
+    /// The calling session's `currval` map, so a per-row `nextval` stamp is
+    /// visible to a later `currval` in the same session. `None` where the
+    /// producer has no session (HTTP, internal merges).
+    pub session_sequences: Option<Arc<crate::control::sequence::SessionSequenceValues>>,
 }
diff --git a/nodedb/src/control/server/response_shape/returning.rs b/nodedb/src/control/server/response_shape/returning.rs
index 82af689ec..a0ede8a8d 100644
--- a/nodedb/src/control/server/response_shape/returning.rs
+++ b/nodedb/src/control/server/response_shape/returning.rs
@@ -44,6 +44,7 @@ use super::compose::{project_row, redact_rows, single_result_row};
 use super::project::cell_keys;
 use super::redaction::RedactionCtx;
 use super::schema::OutputSchema;
+use super::sequence_stamp::SequenceStamper;
 use super::types::{DdlColType, ShapedRows};
 
 /// Shape a DML-with-`RETURNING` response.
@@ -55,6 +56,7 @@ pub fn shape_returning_rows(
     payload: &[u8],
     projection: Option<&OutputSchema>,
     redaction: Option<RedactionCtx<'_>>,
+    stamper: Option<&SequenceStamper>,
 ) -> Result<ShapedRows, NodeDbError> {
     let announced = announced_columns(projection);
 
@@ -106,7 +108,7 @@ pub fn shape_returning_rows(
             notice: None,
         });
     };
-    Ok(project_onto_announced(schema, &rows))
+    project_onto_announced(schema, &rows, stamper)
 }
 
 /// The announced output columns, or `None` when the caller announced nothing
@@ -140,7 +142,11 @@ fn rows_keyed_by_column(rp: &RowsPayload) -> Vec<Map<String, JsonValue>> {
 /// Uses the same `project_row` + `cell_keys` pair the SELECT path uses, so a
 /// `RETURNING` result and a `SELECT` result of the same columns are laid out
 /// identically for the encoders.
-fn project_onto_announced(schema: &OutputSchema, rows: &[Map<String, JsonValue>]) -> ShapedRows {
+fn project_onto_announced(
+    schema: &OutputSchema,
+    rows: &[Map<String, JsonValue>],
+    stamper: Option<&SequenceStamper>,
+) -> Result<ShapedRows, NodeDbError> {
     let lookup_keys: Vec<String> = schema
         .columns
         .iter()
@@ -154,7 +160,7 @@ fn project_onto_announced(schema: &OutputSchema, rows: &[Map<String, JsonValue>]
     let column_types: Vec<DdlColType> = schema.columns.iter().map(|c| c.ty).collect();
     let keys = cell_keys(&display_names);
 
-    let projected = rows
+    let mut projected: Vec<Map<String, JsonValue>> = rows
         .iter()
         .map(|row| {
             let mut out = project_row(row, &lookup_keys, &display_names, &keys);
@@ -166,13 +172,26 @@ fn project_onto_announced(schema: &OutputSchema, rows: &[Map<String, JsonValue>]
             out
         })
         .collect();
+    // The one instant conversion, shared with the SELECT path: stored
+    // milliseconds become the microseconds the wire renders. It runs before
+    // the stamps: stored data converts once, then generated values fill the
+    // cells no projection supplied.
+    super::compose::scale_declared_instants(&mut projected, &keys, &column_types)
+        .map_err(NodeDbError::from)?;
+    if let Some(stamper) = stamper {
+        let sequences: Vec<Option<String>> =
+            schema.columns.iter().map(|c| c.sequence.clone()).collect();
+        stamper
+            .stamp(&mut projected, &keys, &sequences)
+            .map_err(NodeDbError::from)?;
+    }
 
-    ShapedRows {
+    Ok(ShapedRows {
         columns: display_names,
         column_types,
         rows: projected,
         notice: None,
-    }
+    })
 }
 
 /// Re-read a `RETURNING` cell's TEXT form as the column's announced type.
@@ -195,7 +214,8 @@ fn retype_cell(ct: DdlColType, cell: &mut JsonValue) {
         DdlColType::Int8
         | DdlColType::Int4
         | DdlColType::Int2
-        // Epoch microseconds; the encoder formats the number as ISO-8601.
+        // Epoch milliseconds, the storage unit; the response boundary scales
+        // declared instants to the microseconds the wire renders.
         | DdlColType::Timestamp
         | DdlColType::Timestamptz => text.parse::<i64>().ok().map(JsonValue::from),
         DdlColType::Float8 | DdlColType::Float4 => text
@@ -271,6 +291,7 @@ mod tests {
                     display_name: (*name).to_string(),
                     lookup_key: (*name).to_string(),
                     ty: *ty,
+                    sequence: None,
                 })
                 .collect(),
             is_star: false,
@@ -286,7 +307,7 @@ mod tests {
             &["id", "name", "score"],
             &[&[Some("a"), Some("x"), Some("1")]],
         );
-        let shaped = shape_returning_rows(&bytes, None, None).expect("shape");
+        let shaped = shape_returning_rows(&bytes, None, None, None).expect("shape");
         assert_eq!(shaped.columns, ["id", "name", "score"]);
         assert_eq!(shaped.rows.len(), 1);
     }
@@ -300,7 +321,7 @@ mod tests {
             &[&[Some("a"), Some("x"), Some("surprise")]],
         );
         let schema = announced(&[("id", DdlColType::Text), ("name", DdlColType::Text)]);
-        let shaped = shape_returning_rows(&bytes, Some(&schema), None).expect("shape");
+        let shaped = shape_returning_rows(&bytes, Some(&schema), None, None).expect("shape");
         assert_eq!(shaped.columns, ["id", "name"]);
         assert_eq!(shaped.column_types.len(), shaped.columns.len());
         let keys = shaped.cell_keys();
@@ -319,7 +340,7 @@ mod tests {
             ("name", DdlColType::Text),
             ("score", DdlColType::Int8),
         ]);
-        let shaped = shape_returning_rows(&bytes, Some(&schema), None).expect("shape");
+        let shaped = shape_returning_rows(&bytes, Some(&schema), None, None).expect("shape");
         assert_eq!(shaped.columns, ["id", "name", "score"]);
         assert_eq!(shaped.rows[0]["id"], JsonValue::String("a".into()));
         assert_eq!(shaped.rows[0]["name"], JsonValue::Null);
@@ -340,7 +361,7 @@ mod tests {
             ("b", DdlColType::Bool),
             ("s", DdlColType::Text),
         ]);
-        let shaped = shape_returning_rows(&bytes, Some(&schema), None).expect("shape");
+        let shaped = shape_returning_rows(&bytes, Some(&schema), None, None).expect("shape");
         assert_eq!(shaped.rows[0]["i"], JsonValue::from(42i64));
         assert_eq!(shaped.rows[0]["f"], JsonValue::from(1.5f64));
         assert_eq!(shaped.rows[0]["b"], JsonValue::Bool(true));
@@ -354,7 +375,7 @@ mod tests {
     fn an_unparseable_cell_stays_text() {
         let bytes = payload(&["i"], &[&[Some("not a number")]]);
         let schema = announced(&[("i", DdlColType::Int8)]);
-        let shaped = shape_returning_rows(&bytes, Some(&schema), None).expect("shape");
+        let shaped = shape_returning_rows(&bytes, Some(&schema), None, None).expect("shape");
         assert_eq!(
             shaped.rows[0]["i"],
             JsonValue::String("not a number".into())
@@ -366,7 +387,7 @@ mod tests {
     #[test]
     fn an_empty_payload_keeps_the_announced_columns() {
         let schema = announced(&[("id", DdlColType::Text), ("score", DdlColType::Int8)]);
-        let shaped = shape_returning_rows(&[], Some(&schema), None).expect("shape");
+        let shaped = shape_returning_rows(&[], Some(&schema), None, None).expect("shape");
         assert_eq!(shaped.columns, ["id", "score"]);
         assert!(shaped.rows.is_empty());
     }
@@ -377,7 +398,7 @@ mod tests {
     fn a_rowless_payload_keeps_the_announced_columns() {
         let bytes = payload(&[], &[]);
         let schema = announced(&[("id", DdlColType::Text)]);
-        let shaped = shape_returning_rows(&bytes, Some(&schema), None).expect("shape");
+        let shaped = shape_returning_rows(&bytes, Some(&schema), None, None).expect("shape");
         assert_eq!(shaped.columns, ["id"]);
         assert!(shaped.rows.is_empty());
     }
@@ -388,14 +409,14 @@ mod tests {
     #[test]
     fn a_malformed_payload_fails_when_columns_were_announced() {
         let schema = announced(&[("id", DdlColType::Text)]);
-        assert!(shape_returning_rows(&[0xFF, 0xFE], Some(&schema), None).is_err());
+        assert!(shape_returning_rows(&[0xFF, 0xFE], Some(&schema), None, None).is_err());
     }
 
     /// With nothing announced there is no contract to violate, so the legacy
     /// single-column fallback still applies.
     #[test]
     fn a_malformed_payload_falls_back_when_nothing_was_announced() {
-        let shaped = shape_returning_rows(&[0xFF, 0xFE], None, None).expect("fallback");
+        let shaped = shape_returning_rows(&[0xFF, 0xFE], None, None, None).expect("fallback");
         assert_eq!(shaped.columns, ["result"]);
     }
 }
diff --git a/nodedb/src/control/server/response_shape/schema.rs b/nodedb/src/control/server/response_shape/schema.rs
index 63a5b6784..abe93d24d 100644
--- a/nodedb/src/control/server/response_shape/schema.rs
+++ b/nodedb/src/control/server/response_shape/schema.rs
@@ -19,6 +19,12 @@ pub struct OutputColumn {
     pub display_name: String,
     pub lookup_key: String,
     pub ty: super::types::DdlColType,
+    /// Set when the column is a sequence accessor (`SELECT nextval('s')`).
+    ///
+    /// The Data Plane emits no cell for it: the control plane allocates one
+    /// value per output row and stamps the cell after shaping, where the row
+    /// count is known. `None` for every ordinary column.
+    pub sequence: Option<String>,
 }
 
 /// The authoritative output schema of a query, resolved by the planner.
diff --git a/nodedb/src/control/server/response_shape/sequence_stamp.rs b/nodedb/src/control/server/response_shape/sequence_stamp.rs
new file mode 100644
index 000000000..165005f8a
--- /dev/null
+++ b/nodedb/src/control/server/response_shape/sequence_stamp.rs
@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Sequence stamps: one `nextval` value per output row, written at the
+//! response boundary.
+//!
+//! A projection item `nextval('<literal>')` is carried by the plan as a
+//! sequence projection and announced in the output schema through
+//! [`OutputColumn::sequence`](super::schema::OutputColumn). The Data Plane
+//! evaluates nothing for it: it holds no sequence state and answered NULL for
+//! every row before this path existed.
+//!
+//! [`SequenceStamper`] allocates the values on the control plane and writes
+//! one cell per row, in output order, after every predicate and projection —
+//! the same boundary the declared-instant conversion uses, so one place
+//! decides what a client sees.
+//!
+//! Allocation goes through [`SequenceRegistry::nextval_batch`]: one atomic
+//! batch per stamped column per row set. A retried statement can leave a gap;
+//! PostgreSQL accepts gaps for the same reason.
+//!
+//! The last value of each batch is recorded in the calling session's map, so a
+//! later `currval` (or a column `DEFAULT currval(...)`) in the same session
+//! answers with the last per-row stamp, matching PostgreSQL.
+
+use serde_json::{Map, Value as JsonValue};
+use std::sync::Arc;
+
+use crate::control::sequence::{SequenceError, SequenceRegistry, SessionSequenceValues};
+
+/// Allocates and writes sequence stamps for one shaped row set.
+pub struct SequenceStamper {
+    registry: Arc<SequenceRegistry>,
+    database_id: u64,
+    tenant_id: u64,
+    /// The calling session's `currval` map. `None` for a shaper with no
+    /// session behind it, which then records nothing.
+    session: Option<Arc<SessionSequenceValues>>,
+}
+
+impl SequenceStamper {
+    pub(in crate::control::server) fn new(
+        registry: Arc<SequenceRegistry>,
+        database_id: u64,
+        tenant_id: u64,
+        session: Option<Arc<SessionSequenceValues>>,
+    ) -> Self {
+        Self {
+            registry,
+            database_id,
+            tenant_id,
+            session,
+        }
+    }
+
+    /// Write one freshly allocated value into every row's cell for each
+    /// stamped column, in row order.
+    pub(super) fn stamp(
+        &self,
+        rows: &mut [Map<String, JsonValue>],
+        keys: &[String],
+        sequences: &[Option<String>],
+    ) -> crate::Result<()> {
+        for (key, sequence) in keys.iter().zip(sequences.iter()) {
+            let Some(name) = sequence else {
+                continue;
+            };
+            let values = self
+                .registry
+                .nextval_batch(self.database_id, self.tenant_id, name, rows.len())
+                .map_err(|e| match e {
+                    SequenceError::NotFound { .. } => crate::Error::UndefinedObject {
+                        kind: "sequence",
+                        name: name.clone(),
+                    },
+                    other => crate::Error::Internal {
+                        detail: format!("nextval('{name}'): {other}"),
+                    },
+                })?;
+            // Record the batch's last value as this session's `currval`.
+            if let (Some(session), Some(last)) = (&self.session, values.last()) {
+                session.record(self.database_id, self.tenant_id, name, *last);
+            }
+            for (row, value) in rows.iter_mut().zip(values) {
+                row.insert(key.clone(), JsonValue::from(value));
+            }
+        }
+        Ok(())
+    }
+}
diff --git a/nodedb/src/control/server/response_shape/types.rs b/nodedb/src/control/server/response_shape/types.rs
index b70d97615..bdf59a5e2 100644
--- a/nodedb/src/control/server/response_shape/types.rs
+++ b/nodedb/src/control/server/response_shape/types.rs
@@ -147,7 +147,10 @@ pub fn describe_plan(plan: &PhysicalPlan) -> PlanKind {
         PhysicalPlan::Document(DocumentOp::PointPut { .. })
         | PhysicalPlan::Document(DocumentOp::PointInsert { .. })
         | PhysicalPlan::Document(DocumentOp::BatchInsert { .. })
+        | PhysicalPlan::Kv(KvOp::Insert { .. })
         | PhysicalPlan::Kv(KvOp::InsertIfAbsent { .. })
+        | PhysicalPlan::Kv(KvOp::Put { .. })
+        | PhysicalPlan::Kv(KvOp::BatchPut { .. })
         | PhysicalPlan::Columnar(ColumnarOp::Insert { .. }) => DmlResult("INSERT"),
 
         PhysicalPlan::Document(DocumentOp::PointUpdate {
diff --git a/nodedb/src/control/server/shared/authorization/requirements.rs b/nodedb/src/control/server/shared/authorization/requirements.rs
index dc7b1e6c6..7655de50f 100644
--- a/nodedb/src/control/server/shared/authorization/requirements.rs
+++ b/nodedb/src/control/server/shared/authorization/requirements.rs
@@ -73,6 +73,8 @@ mod tests {
             rows: Vec::new(),
             filters: Vec::new(),
             projection: Vec::new(),
+            computed_columns: Vec::new(),
+            window_functions: Vec::new(),
             sort_keys: Vec::new(),
             limit: None,
             offset: 0,
diff --git a/nodedb/src/control/server/shared/ddl/neutral/collection/dml/parse/dispatch.rs b/nodedb/src/control/server/shared/ddl/neutral/collection/dml/parse/dispatch.rs
index 5859703b5..48de1804f 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/collection/dml/parse/dispatch.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/collection/dml/parse/dispatch.rs
@@ -440,6 +440,7 @@ pub(in crate::control::server::shared::ddl::neutral::collection) async fn plan_a
                 database_id,
                 tenant_id,
                 redaction: Some(redaction.ctx(&state.redaction)),
+                session_sequences: None,
             })
             .map_err(|error| ddl_err("XX000", error.message().to_string()))?;
             // Folded rather than pushed: a statement is ONE result set, however
diff --git a/nodedb/src/control/server/shared/ddl/neutral/convert/driver.rs b/nodedb/src/control/server/shared/ddl/neutral/convert/driver.rs
index 66fb8f94d..fbacb7335 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/convert/driver.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/convert/driver.rs
@@ -61,6 +61,49 @@ pub async fn convert_collection(
         _ => None,
     };
 
+    // Preserve the source collection's declared identity through the
+    // conversion. Without this, a schemaless source declared `id TEXT PRIMARY
+    // KEY` converts to a strict schema whose columns carry no primary key, and
+    // every insert after the conversion fails `no resolved primary key`. A
+    // column list that omits the source key is refused rather than silently
+    // minting new row identities.
+    let mut columns = columns;
+    if let Some(cols) = columns.as_mut() {
+        let source_pk = match &coll.collection_type {
+            nodedb_types::CollectionType::Document(nodedb_types::DocumentMode::Strict(schema)) => {
+                schema
+                    .columns
+                    .iter()
+                    .find(|c| c.primary_key)
+                    .map(|c| c.name.clone())
+            }
+            nodedb_types::CollectionType::KeyValue(config) => config
+                .schema
+                .columns
+                .iter()
+                .find(|c| c.primary_key)
+                .map(|c| c.name.clone()),
+            nodedb_types::CollectionType::Document(nodedb_types::DocumentMode::Schemaless) => {
+                coll.declared_primary_key.clone()
+            }
+            nodedb_types::CollectionType::Columnar(_) => None,
+        };
+        if let Some(ref pk) = source_pk {
+            match cols.iter_mut().find(|c| &c.name == pk) {
+                Some(col) => col.primary_key = true,
+                None => {
+                    return Err(err(
+                        "42601",
+                        format!(
+                            "converted schema must keep the source primary key column \
+                             '{pk}'; it is absent from the column list"
+                        ),
+                    ));
+                }
+            }
+        }
+    }
+
     let schema_json_for_dp = if let Some(ref cols) = columns {
         sonic_rs::to_string(cols).map_err(|e| err("XX000", format!("schema serialization: {e}")))?
     } else {
diff --git a/nodedb/src/control/server/shared/ddl/neutral/convert/typeguard_columns.rs b/nodedb/src/control/server/shared/ddl/neutral/convert/typeguard_columns.rs
index 0bc1749cc..11d6e5196 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/convert/typeguard_columns.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/convert/typeguard_columns.rs
@@ -49,8 +49,38 @@ pub(super) fn typeguards_to_column_defs(
         };
         // A guard carries either DEFAULT or VALUE, never both. Strict schema
         // has one materialization slot, so both land on the column `DEFAULT`.
-        if let Some(expr) = guard.default_expr.clone().or(guard.value_expr.clone()) {
+        let carried = guard
+            .default_expr
+            .clone()
+            .map(|expr| ("DEFAULT", expr))
+            .or(guard.value_expr.clone().map(|expr| ("VALUE", expr)));
+        if let Some((clause, expr)) = carried {
             validate_column_default(&col.name, &expr)?;
+            // A guard VALUE is evaluated per row against the document; a
+            // strict-schema column DEFAULT is evaluated with no row in scope.
+            // Carrying a column-referencing expression over would accept the
+            // CONVERT and fail every insert with `UnevaluableDefault`, so it
+            // is refused here, naming the clause and the field.
+            let references_column = nodedb_sql::planner::defaults::default_expr_references_columns(
+                &expr,
+            )
+            .map_err(|e| {
+                err(
+                    "42601",
+                    format!("field '{}': {clause} is invalid: {e}", guard.field),
+                )
+            })?;
+            if references_column {
+                return Err(err(
+                    "42601",
+                    format!(
+                        "field '{}': {clause} expression '{expr}' references another column; \
+                         a strict-schema column DEFAULT is evaluated with no row in scope. \
+                         Give a constant expression, or keep the collection schemaless",
+                        guard.field
+                    ),
+                ));
+            }
             col.default = Some(expr);
         }
         columns.push(col);
diff --git a/nodedb/src/control/server/shared/ddl/neutral/router/string_schema.rs b/nodedb/src/control/server/shared/ddl/neutral/router/string_schema.rs
index 53d24cb8b..d634ca80d 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/router/string_schema.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/router/string_schema.rs
@@ -138,22 +138,37 @@ pub(super) async fn try_string(
     // before the parse gate). Replicate that exactly here, before the parse
     // gate, so the prefix recognition and syntax messages stay byte-identical.
     if upper.starts_with("CREATE TYPEGUARD ") || upper.starts_with("CREATE OR REPLACE TYPEGUARD ") {
-        return Some(typeguard::create_typeguard(state, identity, sql));
+        return Some(typeguard::create_typeguard(
+            state,
+            identity,
+            database_id,
+            sql,
+        ));
     }
     if upper.starts_with("ALTER TYPEGUARD ") {
-        return Some(typeguard::alter_typeguard(state, identity, sql));
+        return Some(typeguard::alter_typeguard(
+            state,
+            identity,
+            database_id,
+            sql,
+        ));
     }
     if upper.starts_with("DROP TYPEGUARD ") {
-        return Some(typeguard::drop_typeguard(state, identity, sql));
+        return Some(typeguard::drop_typeguard(state, identity, database_id, sql));
     }
     if upper.starts_with("VALIDATE TYPEGUARD ON ") {
-        return Some(typeguard::validate_typeguard(state, identity, sql).await);
+        return Some(typeguard::validate_typeguard(state, identity, database_id, sql).await);
     }
     if upper.starts_with("SHOW TYPEGUARD ON ") {
-        return Some(typeguard::show_typeguard(state, identity, sql));
+        return Some(typeguard::show_typeguard(state, identity, database_id, sql));
     }
     if upper == "SHOW TYPEGUARDS" || upper.starts_with("SHOW TYPEGUARDS") {
-        return Some(typeguard::show_typeguards(state, identity, sql));
+        return Some(typeguard::show_typeguards(
+            state,
+            identity,
+            database_id,
+            sql,
+        ));
     }
 
     None
diff --git a/nodedb/src/control/server/shared/ddl/neutral/typeguard/handlers.rs b/nodedb/src/control/server/shared/ddl/neutral/typeguard/handlers.rs
index 19ab0c828..3c18678e2 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/typeguard/handlers.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/typeguard/handlers.rs
@@ -58,6 +58,7 @@ fn status(command: &str) -> Vec<DdlResult> {
 pub fn create_typeguard(
     state: &SharedState,
     identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
     sql: &str,
 ) -> Result<Vec<DdlResult>, DdlError> {
     let or_replace = find_ascii_case_insensitive(sql, "OR REPLACE").is_some();
@@ -77,7 +78,7 @@ pub fn create_typeguard(
 
     let tenant_id = identity.tenant_id.as_u64();
     let mut coll = catalog
-        .get_collection(DatabaseId::DEFAULT, tenant_id, &coll_name)
+        .get_collection(database_id, tenant_id, &coll_name)
         .map_err(|e| err("XX000", &e.to_string()))?
         .ok_or_else(|| err("42P01", &format!("collection '{coll_name}' not found")))?;
 
@@ -100,7 +101,7 @@ pub fn create_typeguard(
     }
 
     coll.type_guards = guards;
-    persist_collection_replicated(state, DatabaseId::DEFAULT, &coll)
+    persist_collection_replicated(state, database_id, &coll)
         .map_err(|e| err("XX000", &e.to_string()))?;
 
     state.schema_version.bump();
@@ -114,6 +115,7 @@ pub fn create_typeguard(
 pub fn alter_typeguard_add(
     state: &SharedState,
     identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
     sql: &str,
 ) -> Result<Vec<DdlResult>, DdlError> {
     let coll_name = extract_collection_name(sql)?;
@@ -128,7 +130,7 @@ pub fn alter_typeguard_add(
 
     let tenant_id = identity.tenant_id.as_u64();
     let mut coll = catalog
-        .get_collection(DatabaseId::DEFAULT, tenant_id, &coll_name)
+        .get_collection(database_id, tenant_id, &coll_name)
         .map_err(|e| err("XX000", &e.to_string()))?
         .ok_or_else(|| err("42P01", &format!("collection '{coll_name}' not found")))?;
 
@@ -152,7 +154,7 @@ pub fn alter_typeguard_add(
     }
 
     coll.type_guards.push(guard);
-    persist_collection_replicated(state, DatabaseId::DEFAULT, &coll)
+    persist_collection_replicated(state, database_id, &coll)
         .map_err(|e| err("XX000", &e.to_string()))?;
 
     state.schema_version.bump();
@@ -164,6 +166,7 @@ pub fn alter_typeguard_add(
 pub fn alter_typeguard_drop(
     state: &SharedState,
     identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
     sql: &str,
 ) -> Result<Vec<DdlResult>, DdlError> {
     let coll_name = extract_collection_name(sql)?;
@@ -180,7 +183,7 @@ pub fn alter_typeguard_drop(
 
     let tenant_id = identity.tenant_id.as_u64();
     let mut coll = catalog
-        .get_collection(DatabaseId::DEFAULT, tenant_id, &coll_name)
+        .get_collection(database_id, tenant_id, &coll_name)
         .map_err(|e| err("XX000", &e.to_string()))?
         .ok_or_else(|| err("42P01", &format!("collection '{coll_name}' not found")))?;
 
@@ -194,7 +197,7 @@ pub fn alter_typeguard_drop(
         ));
     }
 
-    persist_collection_replicated(state, DatabaseId::DEFAULT, &coll)
+    persist_collection_replicated(state, database_id, &coll)
         .map_err(|e| err("XX000", &e.to_string()))?;
 
     state.schema_version.bump();
@@ -206,13 +209,14 @@ pub fn alter_typeguard_drop(
 pub fn alter_typeguard(
     state: &SharedState,
     identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
     sql: &str,
 ) -> Result<Vec<DdlResult>, DdlError> {
     let upper = sql.to_uppercase();
     if upper.contains(" ADD ") {
-        alter_typeguard_add(state, identity, sql)
+        alter_typeguard_add(state, identity, database_id, sql)
     } else if upper.contains(" DROP ") {
-        alter_typeguard_drop(state, identity, sql)
+        alter_typeguard_drop(state, identity, database_id, sql)
     } else {
         Err(err(
             "42601",
@@ -227,6 +231,7 @@ pub fn alter_typeguard(
 pub fn drop_typeguard(
     state: &SharedState,
     identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
     sql: &str,
 ) -> Result<Vec<DdlResult>, DdlError> {
     let upper = sql.to_uppercase();
@@ -238,7 +243,7 @@ pub fn drop_typeguard(
 
     let tenant_id = identity.tenant_id.as_u64();
     let mut coll = catalog
-        .get_collection(DatabaseId::DEFAULT, tenant_id, &coll_name)
+        .get_collection(database_id, tenant_id, &coll_name)
         .map_err(|e| err("XX000", &e.to_string()))?
         .ok_or_else(|| err("42P01", &format!("collection '{coll_name}' not found")))?;
 
@@ -253,7 +258,7 @@ pub fn drop_typeguard(
     }
 
     coll.type_guards.clear();
-    persist_collection_replicated(state, DatabaseId::DEFAULT, &coll)
+    persist_collection_replicated(state, database_id, &coll)
         .map_err(|e| err("XX000", &e.to_string()))?;
 
     state.schema_version.bump();
@@ -267,6 +272,7 @@ pub fn drop_typeguard(
 pub fn show_typeguard(
     state: &SharedState,
     identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
     sql: &str,
 ) -> Result<Vec<DdlResult>, DdlError> {
     let coll_name = extract_collection_name(sql)?;
@@ -275,7 +281,7 @@ pub fn show_typeguard(
 
     let tenant_id = identity.tenant_id.as_u64();
     let coll = catalog
-        .get_collection(DatabaseId::DEFAULT, tenant_id, &coll_name)
+        .get_collection(database_id, tenant_id, &coll_name)
         .map_err(|e| err("XX000", &e.to_string()))?
         .ok_or_else(|| err("42P01", &format!("collection '{coll_name}' not found")))?;
 
@@ -316,13 +322,14 @@ pub fn show_typeguard(
 pub fn show_typeguards(
     state: &SharedState,
     identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
     _sql: &str,
 ) -> Result<Vec<DdlResult>, DdlError> {
     let catalog = state.credentials.catalog();
 
     let tenant_id = identity.tenant_id.as_u64();
     let collections = catalog
-        .load_collections_for_tenant(DatabaseId::DEFAULT, tenant_id)
+        .load_collections_for_tenant(database_id, tenant_id)
         .map_err(|e| err("XX000", &e.to_string()))?;
 
     let columns = vec!["collection".to_string(), "fields".to_string()];
diff --git a/nodedb/src/control/server/shared/ddl/neutral/typeguard/validate.rs b/nodedb/src/control/server/shared/ddl/neutral/typeguard/validate.rs
index 141675359..43237a971 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/typeguard/validate.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/typeguard/validate.rs
@@ -30,6 +30,7 @@ use super::super::super::result::{DdlError, DdlResult};
 pub async fn validate_typeguard(
     state: &SharedState,
     identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
     sql: &str,
 ) -> Result<Vec<DdlResult>, DdlError> {
     let coll_name = super::parse::extract_collection_name(sql)?;
@@ -38,7 +39,7 @@ pub async fn validate_typeguard(
     let catalog = state.credentials.catalog();
 
     let coll = catalog
-        .get_collection(DatabaseId::DEFAULT, tenant_id.as_u64(), &coll_name)
+        .get_collection(database_id, tenant_id.as_u64(), &coll_name)
         .map_err(|e| super::parse::err("XX000", &format!("catalog error: {e}")))?
         .ok_or_else(|| {
             super::parse::err("42P01", &format!("collection '{coll_name}' not found"))
@@ -70,7 +71,7 @@ pub async fn validate_typeguard(
             state,
             identity,
             &scan_sql,
-            DatabaseId::DEFAULT,
+            database_id,
         )
         .await
         .map_err(|error| super::parse::err(&error.sqlstate, &error.message))?;
diff --git a/nodedb/src/control/server/shared/ddl/neutral/weighted_pick.rs b/nodedb/src/control/server/shared/ddl/neutral/weighted_pick.rs
index 847cb1519..a739c73a6 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/weighted_pick.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/weighted_pick.rs
@@ -246,6 +246,8 @@ async fn scan_all_entries(
         match_pattern: None,
         sort_keys: Vec::new(),
         surrogate_ceiling: None,
+        projection: Vec::new(),
+        computed_columns: Vec::new(),
     });
     gate.inject_rls(&mut plan)?;
 
diff --git a/nodedb/src/control/server/shared/write_admission/predicate/txn_buffering/classify.rs b/nodedb/src/control/server/shared/write_admission/predicate/txn_buffering/classify.rs
index 29c9350d4..6c5d3c293 100644
--- a/nodedb/src/control/server/shared/write_admission/predicate/txn_buffering/classify.rs
+++ b/nodedb/src/control/server/shared/write_admission/predicate/txn_buffering/classify.rs
@@ -1186,6 +1186,8 @@ mod tests {
                 match_pattern: None,
                 sort_keys: Vec::new(),
                 surrogate_ceiling: None,
+                projection: Vec::new(),
+                computed_columns: Vec::new(),
             }),
             PhysicalPlan::Kv(KvOp::Expire {
                 collection: QualifiedCollection::new(DatabaseId::DEFAULT, "c"),
@@ -1520,6 +1522,8 @@ mod tests {
                 rows: Vec::new(),
                 filters: Vec::new(),
                 projection: Vec::new(),
+                computed_columns: Vec::new(),
+                window_functions: Vec::new(),
                 sort_keys: Vec::new(),
                 limit: None,
                 offset: 0,
diff --git a/nodedb/src/data/executor/core_loop/ts_declared_schema.rs b/nodedb/src/data/executor/core_loop/ts_declared_schema.rs
index acad6049d..4a2d3dbfc 100644
--- a/nodedb/src/data/executor/core_loop/ts_declared_schema.rs
+++ b/nodedb/src/data/executor/core_loop/ts_declared_schema.rs
@@ -168,37 +168,6 @@ impl CoreLoop {
             })
             .collect()
     }
-
-    /// Declared columns of a timeseries collection that carry an instant.
-    ///
-    /// A column declared `TIMESTAMP` or `TIMESTAMPTZ` is one. The memtable
-    /// keeps every timestamp column in epoch milliseconds, while a client
-    /// reads a `TIMESTAMP` cell as epoch microseconds, so row emission scales
-    /// exactly these columns.
-    ///
-    /// A `BIGINT TIME_KEY` shares the same millisecond column and is absent
-    /// from this list: its declared type is an integer, so it hands back the
-    /// number that was inserted.
-    ///
-    /// An undeclared measurement (raw ILP protocol ingest) has no entry and
-    /// yields an empty list — the planner types its columns as text, so no
-    /// cell of it is read as an instant.
-    pub(in crate::data::executor) fn ts_instant_columns(
-        &self,
-        database_id: DatabaseId,
-        tid: TenantId,
-        collection: &str,
-    ) -> Vec<String> {
-        let Some(declared) = self.declared_timeseries(database_id, tid, collection) else {
-            return Vec::new();
-        };
-        declared
-            .columns
-            .iter()
-            .filter(|(_, type_str)| declared_type_is_instant(type_str))
-            .map(|(name, _)| name.clone())
-            .collect()
-    }
 }
 
 /// How one grouped timeseries column renders in an aggregate result row.
@@ -208,7 +177,8 @@ impl CoreLoop {
 /// timeseries column can take on the wire.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(in crate::data::executor) enum TsGroupKeyKind {
-    /// A declared `TIMESTAMP` / `TIMESTAMPTZ` column: epoch microseconds.
+    /// A declared `TIMESTAMP` / `TIMESTAMPTZ` column: stored epoch
+    /// milliseconds; the response boundary converts declared instants once.
     Instant,
     /// An integer column, including a `BIGINT TIME_KEY`, in its stored unit.
     Integer,
diff --git a/nodedb/src/data/executor/dispatch/query.rs b/nodedb/src/data/executor/dispatch/query.rs
index cbe383a73..38a7e7ad7 100644
--- a/nodedb/src/data/executor/dispatch/query.rs
+++ b/nodedb/src/data/executor/dispatch/query.rs
@@ -8,7 +8,6 @@ use nodedb_physical::physical_plan::{GroupKeySpec, QueryOp};
 use crate::data::executor::core_loop::CoreLoop;
 use crate::data::executor::handlers::join::{
     HashJoinParams, JoinParams, NestedLoopJoinParams, ShuffleJoinInputs, SortMergeJoinParams,
-    instant_scale::JoinInstantSide,
     lateral::{LateralLoopParams, LateralTopKParams},
 };
 use crate::data::executor::task::ExecutionTask;
@@ -69,6 +68,7 @@ impl CoreLoop {
             ),
 
             QueryOp::ProviderScan {
+                provider: _,
                 rows,
                 filters,
                 projection,
@@ -76,13 +76,16 @@ impl CoreLoop {
                 limit,
                 offset,
                 distinct,
-                ..
+                computed_columns,
+                window_functions,
             } => self.execute_provider_scan(
                 task,
                 crate::data::executor::handlers::provider_scan::ProviderScanParams {
                     rows_bytes: rows,
                     filters_bytes: filters,
                     projection,
+                    computed_columns,
+                    window_functions,
                     sort_keys,
                     limit: *limit,
                     offset: *offset,
@@ -112,32 +115,6 @@ impl CoreLoop {
                 right_scan_filters,
                 ..
             } => {
-                // Only a side this join scans itself carries stored
-                // milliseconds. A side supplied by a sub-plan was already
-                // rescaled by the handler that read it, so listing it here
-                // would scale one instant twice.
-                let mut local_sides = Vec::with_capacity(2);
-                if left_input.is_none() {
-                    local_sides.push(JoinInstantSide {
-                        collection: left_collection.as_str(),
-                        qualifier: left_alias
-                            .as_deref()
-                            .unwrap_or_else(|| left_collection.as_str()),
-                    });
-                }
-                if right_input.is_none() {
-                    local_sides.push(JoinInstantSide {
-                        collection: right_collection.as_str(),
-                        qualifier: right_alias
-                            .as_deref()
-                            .unwrap_or_else(|| right_collection.as_str()),
-                    });
-                }
-                let instant_columns = self.join_instant_columns(
-                    task.request.database_id,
-                    crate::types::TenantId::new(tid),
-                    &local_sides,
-                );
                 self.execute_hash_join(HashJoinParams {
                 join: JoinParams {
                     task,
@@ -148,7 +125,6 @@ impl CoreLoop {
                     computed_projection_bytes: computed_projection,
                     join_filter_bytes: join_filters,
                     post_filter_bytes: post_filters,
-                    instant_columns: &instant_columns,
                 },
                 tid,
                 left_collection: left_collection.as_str(),
@@ -194,7 +170,6 @@ impl CoreLoop {
                     // A shuffle consumer's rows are gathered by the
                     // coordinator, not sent to a client, and its staged
                     // frames were produced by the sides' own scans.
-                    instant_columns: &[],
                 };
                 let inputs = ShuffleJoinInputs {
                     build_path: std::path::PathBuf::from(build_path),
@@ -217,20 +192,6 @@ impl CoreLoop {
                 left_rls_filters,
                 right_rls_filters,
             } => {
-                let instant_columns = self.join_instant_columns(
-                    task.request.database_id,
-                    crate::types::TenantId::new(tid),
-                    &[
-                        JoinInstantSide {
-                            collection: left_collection.as_str(),
-                            qualifier: left_collection.as_str(),
-                        },
-                        JoinInstantSide {
-                            collection: right_collection.as_str(),
-                            qualifier: right_collection.as_str(),
-                        },
-                    ],
-                );
                 self.execute_nested_loop_join(NestedLoopJoinParams {
                     task,
                     tid,
@@ -241,7 +202,6 @@ impl CoreLoop {
                     limit: *limit,
                     left_rls_filters,
                     right_rls_filters,
-                    instant_columns: &instant_columns,
                 })
             }
 
@@ -255,20 +215,6 @@ impl CoreLoop {
                 left_rls_filters,
                 right_rls_filters,
             } => {
-                let instant_columns = self.join_instant_columns(
-                    task.request.database_id,
-                    crate::types::TenantId::new(tid),
-                    &[
-                        JoinInstantSide {
-                            collection: left_collection.as_str(),
-                            qualifier: left_collection.as_str(),
-                        },
-                        JoinInstantSide {
-                            collection: right_collection.as_str(),
-                            qualifier: right_collection.as_str(),
-                        },
-                    ],
-                );
                 self.execute_sort_merge_join(SortMergeJoinParams {
                     task,
                     tid,
@@ -280,7 +226,6 @@ impl CoreLoop {
                     pre_sorted: *pre_sorted,
                     left_rls_filters,
                     right_rls_filters,
-                    instant_columns: &instant_columns,
                 })
             }
 
diff --git a/nodedb/src/data/executor/handlers/document/read/emit.rs b/nodedb/src/data/executor/handlers/document/read/emit.rs
index f4b182d52..4d9bd96a8 100644
--- a/nodedb/src/data/executor/handlers/document/read/emit.rs
+++ b/nodedb/src/data/executor/handlers/document/read/emit.rs
@@ -2,10 +2,9 @@
 
 //! Response emission helpers for document scans.
 //!
-//! Two emission shapes are kept distinct: transformed rows (decoded → projected
-//! → re-encoded via response_codec::encode) and raw rows (msgpack passthrough
-//! via encode_raw_document_rows). Both honour the chunked-streaming contract
-//! when row count exceeds `stream_chunk_size`.
+//! Rows are emitted as MessagePack passthrough (`encode_raw_document_rows`),
+//! with the chunked-streaming contract honoured when row count exceeds
+//! `stream_chunk_size`.
 //!
 //! A chunk boundary is a deadline safe point. A statement that goes over
 //! mid-stream returns a terminal `DeadlineExceeded` frame instead of its last
@@ -16,32 +15,10 @@
 use crate::bridge::dispatch::BridgeResponse;
 use crate::bridge::envelope::{ErrorCode, Response};
 use crate::data::executor::core_loop::CoreLoop;
-use crate::data::executor::response_codec::{self, DocumentRow};
+use crate::data::executor::response_codec;
 use crate::data::executor::task::ExecutionTask;
 
 impl CoreLoop {
-    /// Send transformed document rows (decoded → projected → re-encoded).
-    pub(in crate::data::executor) fn send_document_rows_transformed(
-        &mut self,
-        task: &ExecutionTask,
-        result: &Vec<DocumentRow>,
-        chunk_size: usize,
-    ) -> Response {
-        if result.len() <= chunk_size {
-            match response_codec::encode(result) {
-                Ok(payload) => self.response_with_payload(task, payload),
-                Err(e) => self.response_error(
-                    task,
-                    ErrorCode::Internal {
-                        detail: e.to_string(),
-                    },
-                ),
-            }
-        } else {
-            self.stream_chunks_transformed(task, result, chunk_size)
-        }
-    }
-
     /// Send raw document rows with msgpack passthrough (no decode+re-encode).
     pub(in crate::data::executor) fn send_document_rows_raw(
         &mut self,
@@ -64,51 +41,6 @@ impl CoreLoop {
         }
     }
 
-    /// Stream transformed document rows in chunks.
-    fn stream_chunks_transformed(
-        &mut self,
-        task: &ExecutionTask,
-        result: &[DocumentRow],
-        chunk_size: usize,
-    ) -> Response {
-        let deadline = crate::data::executor::deadline::DeadlineCheck::for_task(task);
-        let chunks: Vec<_> = result.chunks(chunk_size).collect();
-        let last_idx = chunks.len().saturating_sub(1);
-        for (i, chunk) in chunks.iter().enumerate() {
-            // Safe point: a chunk boundary. Every partial already pushed stays
-            // on the ring, but the terminal frame this returns carries
-            // `DeadlineExceeded`, and the Control Plane surfaces the error
-            // rather than the rows it collected. See the module docs.
-            if deadline.expired_now() {
-                return self.response_error(task, ErrorCode::DeadlineExceeded);
-            }
-            let is_last = i == last_idx;
-            match response_codec::encode(&chunk.to_vec()) {
-                Ok(payload) => {
-                    if is_last {
-                        return self.response_with_payload(task, payload);
-                    }
-                    let partial = self.response_partial(task, payload);
-                    let _ = self.response_tx.try_push(BridgeResponse { inner: partial });
-                }
-                Err(e) => {
-                    return self.response_error(
-                        task,
-                        ErrorCode::Internal {
-                            detail: e.to_string(),
-                        },
-                    );
-                }
-            }
-        }
-        self.response_error(
-            task,
-            ErrorCode::Internal {
-                detail: "streaming response incomplete".into(),
-            },
-        )
-    }
-
     /// Stream raw document rows in chunks with msgpack passthrough.
     fn stream_chunks_raw(
         &mut self,
@@ -120,7 +52,7 @@ impl CoreLoop {
         let chunks: Vec<_> = rows.chunks(chunk_size).collect();
         let last_idx = chunks.len().saturating_sub(1);
         for (i, chunk) in chunks.iter().enumerate() {
-            // Safe point: a chunk boundary. See `stream_chunks_transformed`.
+            // Safe point: a chunk boundary. See the module docs.
             if deadline.expired_now() {
                 return self.response_error(task, ErrorCode::DeadlineExceeded);
             }
diff --git a/nodedb/src/data/executor/handlers/document/read/projection.rs b/nodedb/src/data/executor/handlers/document/read/projection.rs
index 947c27987..e9145fb37 100644
--- a/nodedb/src/data/executor/handlers/document/read/projection.rs
+++ b/nodedb/src/data/executor/handlers/document/read/projection.rs
@@ -2,62 +2,13 @@
 
 //! Projection and computed-column application for document scans.
 //!
-//! Two parallel paths must agree on missing-key semantics:
-//! a projection key absent from the row maps to SQL NULL on **both** the JSON
-//! and the msgpack code paths. Silently skipping a missing key drops the
-//! column from the response and breaks the pgwire RowDescription contract.
+//! One codec serves every read path: rows stay MessagePack end to end (see
+//! [`apply_projection_msgpack`]). A projection key absent from the row maps to
+//! SQL NULL; silently skipping a missing key drops the column from the
+//! response and breaks the pgwire RowDescription contract.
 
 use crate::bridge::expr_eval::ComputedColumn;
 
-/// Apply projection or computed columns to a decoded document.
-///
-/// Missing projection keys are emitted as `Value::Null`, mirroring
-/// [`apply_projection_msgpack`]. Earlier revisions silently skipped them,
-/// which produced responses where window-function aliases (or any computed
-/// alias not yet present on the row) disappeared from the output without an
-/// error.
-pub(in crate::data::executor) fn apply_projection(
-    data: serde_json::Value,
-    computed_cols: &[ComputedColumn],
-    projection: &[String],
-) -> crate::Result<serde_json::Value> {
-    Ok(match data {
-        serde_json::Value::Object(obj) => {
-            if computed_cols.is_empty() && projection.is_empty() {
-                return Ok(serde_json::Value::Object(obj));
-            }
-
-            let doc_val = nodedb_types::Value::from(serde_json::Value::Object(obj.clone()));
-            let mut out = if projection.is_empty() {
-                serde_json::Map::with_capacity(computed_cols.len())
-            } else {
-                let mut projected =
-                    serde_json::Map::with_capacity(projection.len() + computed_cols.len());
-                for col in projection {
-                    let val = obj.get(col).cloned().unwrap_or(serde_json::Value::Null);
-                    projected.insert(col.clone(), val);
-                }
-                projected
-            };
-
-            for cc in computed_cols {
-                let existing = out.get(&cc.alias);
-                if matches!(existing, Some(v) if !v.is_null()) {
-                    continue;
-                }
-                // A division/modulo-by-zero in a computed column fails the
-                // whole query instead of silently materializing NULL into
-                // the response.
-                let v = cc.expr.eval(&doc_val)?;
-                out.insert(cc.alias.clone(), serde_json::Value::from(v));
-            }
-
-            serde_json::Value::Object(out)
-        }
-        other => other,
-    })
-}
-
 /// Apply projection and computed columns on raw msgpack bytes.
 ///
 /// For projection-only (no computed columns), uses zero-decode binary field extraction.
@@ -118,90 +69,89 @@ pub(in crate::data::executor) fn apply_projection_msgpack(
 mod tests {
     use super::*;
     use crate::bridge::expr_eval::SqlExpr;
+    use std::collections::HashMap;
+
+    fn row(fields: &[(&str, nodedb_types::Value)]) -> Vec<u8> {
+        let mut map = HashMap::new();
+        for (key, value) in fields {
+            map.insert((*key).to_string(), value.clone());
+        }
+        nodedb_types::value_to_msgpack(&nodedb_types::Value::Object(map)).unwrap()
+    }
+
+    fn decoded(bytes: &[u8]) -> HashMap<String, nodedb_types::Value> {
+        match nodedb_types::value_from_msgpack(bytes).unwrap() {
+            nodedb_types::Value::Object(map) => map,
+            other => panic!(
+                "expected an object, got the {:?} variant",
+                std::mem::discriminant(&other)
+            ),
+        }
+    }
 
     #[test]
-    fn apply_projection_keeps_base_fields_when_computed_columns_exist() {
-        let data = serde_json::json!({
-            "id": "u1",
-            "name": "Ada",
-            "age": 42
-        });
+    fn projection_keeps_base_fields_when_computed_columns_exist() {
+        let data = row(&[
+            ("id", nodedb_types::Value::String("u1".into())),
+            ("name", nodedb_types::Value::String("Ada".into())),
+            ("age", nodedb_types::Value::Integer(42)),
+        ]);
         let computed = vec![ComputedColumn {
             alias: "label".into(),
             expr: SqlExpr::Column("name".into()),
         }];
         let projection = vec!["name".to_string(), "age".to_string()];
 
-        let projected = apply_projection(data, &computed, &projection).unwrap();
+        let projected = decoded(&apply_projection_msgpack(&data, &computed, &projection).unwrap());
 
         assert_eq!(
-            projected,
-            serde_json::json!({
-                "name": "Ada",
-                "age": 42,
-                "label": "Ada"
-            })
+            projected.len(),
+            3,
+            "keys: {:?}",
+            projected.keys().collect::<Vec<_>>()
+        );
+        assert_eq!(
+            projected.get("name"),
+            Some(&nodedb_types::Value::String("Ada".into()))
+        );
+        assert_eq!(
+            projected.get("age"),
+            Some(&nodedb_types::Value::Integer(42))
         );
-    }
-
-    #[test]
-    fn apply_projection_does_not_overwrite_existing_window_alias() {
-        let data = serde_json::json!({
-            "name": "Ada",
-            "age": 42,
-            "rn": 1
-        });
-        let computed = vec![ComputedColumn {
-            alias: "rn".into(),
-            expr: SqlExpr::Function {
-                name: "row_number".into(),
-                args: Vec::new(),
-            },
-        }];
-        let projection = vec!["name".to_string(), "age".to_string(), "rn".to_string()];
-
-        let projected = apply_projection(data, &computed, &projection).unwrap();
-
         assert_eq!(
-            projected,
-            serde_json::json!({
-                "name": "Ada",
-                "age": 42,
-                "rn": 1
-            })
+            projected.get("label"),
+            Some(&nodedb_types::Value::String("Ada".into()))
         );
     }
 
     #[test]
-    fn apply_projection_emits_null_for_missing_keys() {
-        let data = serde_json::json!({
-            "id": "u1",
-            "score": 1.0
-        });
+    fn projection_emits_null_for_missing_keys() {
+        let data = row(&[
+            ("id", nodedb_types::Value::String("u1".into())),
+            ("score", nodedb_types::Value::Float(1.0)),
+        ]);
         let projection = vec![
             "id".to_string(),
             "score".to_string(),
             "pr_score".to_string(),
         ];
 
-        let projected = apply_projection(data, &[], &projection).unwrap();
+        let projected = decoded(&apply_projection_msgpack(&data, &[], &projection).unwrap());
 
         assert_eq!(
-            projected,
-            serde_json::json!({
-                "id": "u1",
-                "score": 1.0,
-                "pr_score": serde_json::Value::Null,
-            })
+            projected.get("pr_score"),
+            Some(&nodedb_types::Value::Null),
+            "a missing projection key must be SQL NULL; keys: {:?}",
+            projected.keys().collect::<Vec<_>>()
         );
     }
 
     /// A computed column that divides by zero fails the projection instead
     /// of silently materializing `NULL`.
     #[test]
-    fn apply_projection_computed_column_division_by_zero_errors() {
+    fn projection_computed_column_division_by_zero_errors() {
         use crate::bridge::expr_eval::BinaryOp;
-        let data = serde_json::json!({"denom": 0});
+        let data = row(&[("denom", nodedb_types::Value::Integer(0))]);
         let computed = vec![ComputedColumn {
             alias: "bad".into(),
             expr: SqlExpr::BinaryOp {
@@ -210,7 +160,7 @@ mod tests {
                 right: Box::new(SqlExpr::Column("denom".into())),
             },
         }];
-        let err = apply_projection(data, &computed, &[]).unwrap_err();
+        let err = apply_projection_msgpack(&data, &computed, &[]).unwrap_err();
         assert!(matches!(err, crate::Error::DivisionByZero), "got {err:?}");
     }
 }
diff --git a/nodedb/src/data/executor/handlers/document/read/scan.rs b/nodedb/src/data/executor/handlers/document/read/scan.rs
index 6439f1e6d..759657956 100644
--- a/nodedb/src/data/executor/handlers/document/read/scan.rs
+++ b/nodedb/src/data/executor/handlers/document/read/scan.rs
@@ -5,13 +5,12 @@
 use nodedb_types::StorageKey;
 use tracing::{debug, warn};
 
-use super::projection::{apply_projection, apply_projection_msgpack};
+use super::projection::apply_projection_msgpack;
 use super::{DocFetchParams, DocScanMode};
 use crate::bridge::envelope::{ErrorCode, Response};
 use crate::bridge::scan_filter::ScanFilter;
 use crate::data::executor::core_loop::CoreLoop;
 use crate::data::executor::handlers::document::sort;
-use crate::data::executor::response_codec::DocumentRow;
 use crate::data::executor::scan_normalize::sparse_row_to_doc;
 use crate::data::executor::sparse_body_format::SparseBodyFormatRef;
 use crate::data::executor::task::ExecutionTask;
@@ -70,14 +69,36 @@ impl CoreLoop {
             if window_functions_bytes.is_empty() {
                 Vec::new()
             } else {
-                zerompk::from_msgpack(window_functions_bytes).unwrap_or_default()
+                match zerompk::from_msgpack(window_functions_bytes) {
+                    Ok(specs) => specs,
+                    Err(e) => {
+                        warn!(core = self.core_id, error = %e, "failed to parse window functions");
+                        return self.response_error(
+                            task,
+                            ErrorCode::Internal {
+                                detail: format!("malformed window functions: {e}"),
+                            },
+                        );
+                    }
+                }
             };
 
         let computed_cols: Vec<crate::bridge::expr_eval::ComputedColumn> =
             if computed_columns_bytes.is_empty() {
                 Vec::new()
             } else {
-                zerompk::from_msgpack(computed_columns_bytes).unwrap_or_default()
+                match zerompk::from_msgpack(computed_columns_bytes) {
+                    Ok(cols) => cols,
+                    Err(e) => {
+                        warn!(core = self.core_id, error = %e, "failed to parse computed columns");
+                        return self.response_error(
+                            task,
+                            ErrorCode::Internal {
+                                detail: format!("malformed computed columns: {e}"),
+                            },
+                        );
+                    }
+                }
             };
 
         let scan_budget_bytes = self.query_tuning.max_scan_result_bytes;
@@ -325,34 +346,35 @@ impl CoreLoop {
                 }
 
                 if !window_specs.is_empty() {
-                    let mut decoded_rows: Vec<(String, serde_json::Value)> = match sorted
-                        .into_iter()
-                        .map(|(doc_id, mp)| {
-                            crate::data::executor::doc_format::decode_document(&mp)
-                                .map(|doc| (doc_id, doc))
-                        })
-                        .collect::<crate::Result<Vec<_>>>()
+                    // Window evaluation rides the same MessagePack rows the
+                    // other arms send. Decoding each document to JSON here
+                    // downgraded tagged cells — MessagePack binary has no JSON
+                    // representation, so a `BYTES` cell came back as a base64
+                    // `String` — and evaluated the window set over the
+                    // degraded rows.
+                    let mut windowed: Vec<(String, Vec<u8>)> = sorted;
+                    let mut payloads: Vec<Vec<u8>> =
+                        windowed.iter().map(|(_, mp)| mp.clone()).collect();
+                    if let Err(e) =
+                        crate::bridge::window_func::evaluate_window_functions_on_msgpack_rows(
+                            &mut payloads,
+                            &window_specs,
+                        )
                     {
-                        Ok(rows) => rows,
-                        Err(e) => return self.response_error(task, e),
-                    };
-                    if let Err(e) = crate::bridge::window_func::evaluate_window_functions(
-                        &mut decoded_rows,
-                        &window_specs,
-                    ) {
-                        return self.response_error(task, crate::Error::from(e));
+                        return self.response_error(task, e);
+                    }
+                    for ((_, mp), edited) in windowed.iter_mut().zip(payloads) {
+                        *mp = edited;
                     }
 
-                    // Project first, then dedupe on the projected JSON value
-                    // so `SELECT DISTINCT col` honours SQL semantics.
-                    let projected_rows: Vec<_> = match decoded_rows
+                    // Project first, then dedupe on the projected row so
+                    // `SELECT DISTINCT col` honours SQL semantics.
+                    let projected_rows: Vec<_> = match windowed
                         .into_iter()
-                        .map(|(doc_id, data)| {
-                            let projected = apply_projection(data, &computed_cols, projection)?;
-                            Ok(DocumentRow {
-                                id: doc_id,
-                                data: projected,
-                            })
+                        .map(|(doc_id, mp)| {
+                            let projected =
+                                apply_projection_msgpack(&mp, &computed_cols, projection)?;
+                            Ok((doc_id, projected))
                         })
                         .collect::<crate::Result<Vec<_>>>()
                     {
@@ -364,14 +386,14 @@ impl CoreLoop {
                         let mut seen = std::collections::HashSet::new();
                         projected_rows
                             .into_iter()
-                            .filter(|row| seen.insert(row.data.to_string()))
+                            .filter(|(_, value)| seen.insert(value.clone()))
                             .collect()
                     } else {
                         projected_rows
                     };
 
                     let result: Vec<_> = deduped.into_iter().skip(offset).take(limit).collect();
-                    self.send_document_rows_transformed(task, &result, stream_chunk_size)
+                    self.send_document_rows_raw(task, &result, stream_chunk_size)
                 } else {
                     let needs_transform = !computed_cols.is_empty() || !projection.is_empty();
 
diff --git a/nodedb/src/data/executor/handlers/join/instant_scale.rs b/nodedb/src/data/executor/handlers/join/instant_scale.rs
deleted file mode 100644
index 4f2e41620..000000000
--- a/nodedb/src/data/executor/handlers/join/instant_scale.rs
+++ /dev/null
@@ -1,86 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-
-//! Rescale the declared-instant cells a join materialized itself.
-//!
-//! A timeseries collection stores every timestamp column in epoch
-//! milliseconds, and a client reads a `TIMESTAMP` cell as epoch microseconds.
-//! A join scans its local sides through `scan_collection`, which hands back
-//! the stored millisecond value, so the join rescales those cells as it emits
-//! them — after every predicate has run, so the join itself still compares
-//! milliseconds against milliseconds.
-//!
-//! Exactly once: a handler rescales ONLY the cells it read from a local
-//! collection scan. Rows that arrive from a sub-plan response were already
-//! rescaled by the handler that read them, and are never touched again.
-//!
-//! The rescale runs on the merged row, before any projection. A cell is named
-//! by the key the join itself wrote, so a rename cannot hide it: the rename
-//! happens strictly downstream, and a projected cell copies bytes the rescale
-//! has already corrected.
-
-use crate::data::executor::core_loop::CoreLoop;
-use crate::data::executor::handlers::timeseries::raw_scan::scale_instant_cells;
-use crate::types::{DatabaseId, TenantId};
-
-/// One locally-scanned join side: the collection its rows come from, and the
-/// qualifier the merged row prefixes that side's keys with.
-pub(in crate::data::executor) struct JoinInstantSide<'a> {
-    pub(in crate::data::executor) collection: &'a str,
-    pub(in crate::data::executor) qualifier: &'a str,
-}
-
-impl CoreLoop {
-    /// The merged-row keys of the declared-instant cells `sides` contribute.
-    ///
-    /// A merged join row keys every cell `<qualifier>.<column>`, so the
-    /// returned names are what the row carries before any projection runs. A
-    /// side that is not a timeseries collection contributes none, so a join
-    /// over ordinary collections returns an empty list and pays nothing.
-    pub(in crate::data::executor) fn join_instant_columns(
-        &self,
-        database_id: DatabaseId,
-        tid: TenantId,
-        sides: &[JoinInstantSide<'_>],
-    ) -> Vec<String> {
-        let mut merged_keys = Vec::new();
-        for side in sides {
-            for column in self.ts_instant_columns(database_id, tid, side.collection) {
-                merged_keys.push(format!("{}.{column}", side.qualifier));
-            }
-        }
-        merged_keys
-    }
-}
-
-/// Rescale the named cells of merged join rows, in place.
-///
-/// Each row is a msgpack map. An empty `instant_columns` is a no-op, so a
-/// join that touches no timeseries collection never decodes a row.
-pub(in crate::data::executor) fn scale_join_instant_rows(
-    rows: &mut [Vec<u8>],
-    instant_columns: &[String],
-) -> crate::Result<()> {
-    if instant_columns.is_empty() {
-        return Ok(());
-    }
-    for row in rows.iter_mut() {
-        let mut decoded = [
-            crate::util::bounded_msgpack::read_value(row.as_slice()).map_err(|e| {
-                crate::Error::Serialization {
-                    format: "msgpack".into(),
-                    detail: format!("decode join row for instant rescale: {e}"),
-                }
-            })?,
-        ];
-        scale_instant_cells(&mut decoded, instant_columns)?;
-        let mut buf = Vec::with_capacity(row.len());
-        rmpv::encode::write_value(&mut buf, &decoded[0]).map_err(|e| {
-            crate::Error::Serialization {
-                format: "msgpack".into(),
-                detail: format!("encode join row after instant rescale: {e}"),
-            }
-        })?;
-        *row = buf;
-    }
-    Ok(())
-}
diff --git a/nodedb/src/data/executor/handlers/join/mod.rs b/nodedb/src/data/executor/handlers/join/mod.rs
index a6dc9bff6..f9d4f8ad7 100644
--- a/nodedb/src/data/executor/handlers/join/mod.rs
+++ b/nodedb/src/data/executor/handlers/join/mod.rs
@@ -10,7 +10,6 @@ mod grace_repartition;
 mod grace_spill;
 pub mod hash;
 mod hash_handlers;
-pub(in crate::data::executor) mod instant_scale;
 pub mod lateral;
 pub mod nested_loop;
 pub mod params;
diff --git a/nodedb/src/data/executor/handlers/join/nested_loop.rs b/nodedb/src/data/executor/handlers/join/nested_loop.rs
index d961bbc6a..e0e6db89a 100644
--- a/nodedb/src/data/executor/handlers/join/nested_loop.rs
+++ b/nodedb/src/data/executor/handlers/join/nested_loop.rs
@@ -30,7 +30,6 @@ impl CoreLoop {
             limit,
             left_rls_filters,
             right_rls_filters,
-            instant_columns,
         } = p;
         debug!(
             core = self.core_id,
@@ -225,18 +224,6 @@ impl CoreLoop {
             return self.response_error(task, ErrorCode::ResourcesExhausted);
         }
 
-        // Last step before emission: the scans above compared the
-        // milliseconds storage holds, and the client reads microseconds.
-        if let Err(e) = super::instant_scale::scale_join_instant_rows(&mut results, instant_columns)
-        {
-            return self.response_error(
-                task,
-                ErrorCode::Internal {
-                    detail: e.to_string(),
-                },
-            );
-        }
-
         let payload = super::super::super::response_codec::encode_binary_rows(&results);
         self.response_with_payload(task, payload)
     }
diff --git a/nodedb/src/data/executor/handlers/join/params.rs b/nodedb/src/data/executor/handlers/join/params.rs
index 8b14df27f..c5620115e 100644
--- a/nodedb/src/data/executor/handlers/join/params.rs
+++ b/nodedb/src/data/executor/handlers/join/params.rs
@@ -17,11 +17,6 @@ pub(crate) struct JoinParams<'a> {
     pub computed_projection_bytes: &'a [u8],
     pub join_filter_bytes: &'a [u8],
     pub post_filter_bytes: &'a [u8],
-    /// Merged-row keys of the declared-instant cells this join reads from its
-    /// own local scans. Empty when no timeseries collection is scanned
-    /// locally — including for every side supplied by a sub-plan, whose rows
-    /// were already rescaled by the handler that read them.
-    pub instant_columns: &'a [String],
 }
 
 /// Hash join: scans both sides from storage or executes resolved child sub-plans.
@@ -81,9 +76,6 @@ pub(crate) struct NestedLoopJoinParams<'a> {
     pub left_rls_filters: &'a [u8],
     /// Row-level-security filters for the locally-scanned right side.
     pub right_rls_filters: &'a [u8],
-    /// Merged-row keys of the declared-instant cells the two local scans
-    /// contribute. Empty when neither side is a timeseries collection.
-    pub instant_columns: &'a [String],
 }
 
 /// Sort-merge join: O((N+M)·log N) equi-join with optional pre-sorted inputs.
@@ -103,9 +95,6 @@ pub(crate) struct SortMergeJoinParams<'a> {
     pub left_rls_filters: &'a [u8],
     /// Row-level-security filters for the locally-scanned right side.
     pub right_rls_filters: &'a [u8],
-    /// Merged-row keys of the declared-instant cells the two local scans
-    /// contribute. Empty when neither side is a timeseries collection.
-    pub instant_columns: &'a [String],
 }
 
 // ── Test helpers ─────────────────────────────────────────────────────────────
@@ -202,11 +191,6 @@ impl JoinParams<'_> {
             }
         }
 
-        // Every predicate above compared the milliseconds storage holds, and
-        // the client reads microseconds. Scale here, on the keys the join
-        // wrote, so a projection that renames a cell copies a corrected value.
-        super::instant_scale::scale_join_instant_rows(results, self.instant_columns)?;
-
         if !self.computed_projection_bytes.is_empty() {
             let computed: Vec<crate::bridge::expr_eval::ComputedColumn> =
                 zerompk::from_msgpack(self.computed_projection_bytes).map_err(|e| {
@@ -274,7 +258,6 @@ mod tests {
             computed_projection_bytes: &[],
             join_filter_bytes: &[],
             post_filter_bytes: &[],
-            instant_columns: &[],
         };
         let mut results = vec![vec![1u8, 2, 3], vec![4u8, 5, 6]];
         assert!(params.filter_and_project(&mut results).is_ok());
@@ -297,7 +280,6 @@ mod tests {
             computed_projection_bytes: &[],
             join_filter_bytes: &[],
             post_filter_bytes: corrupt,
-            instant_columns: &[],
         };
         let mut results = vec![vec![0u8; 8]]; // would be "leaked" under the old code
         let err = params.filter_and_project(&mut results);
@@ -313,50 +295,6 @@ mod tests {
         );
     }
 
-    /// A renaming projection cannot hide an instant cell from the rescale.
-    ///
-    /// The rescale names the merged key the join wrote, and the projection
-    /// renames the cell afterwards, so the emitted cell carries microseconds
-    /// under its output name.
-    #[test]
-    fn projection_rename_still_rescales_the_instant_cell() {
-        let task = make_dummy_task();
-        let projection = vec![JoinProjection {
-            source: "e.captured_at".into(),
-            output: "ts".into(),
-        }];
-        let params = JoinParams {
-            task: &task,
-            on: &[],
-            join_type: "inner",
-            limit: usize::MAX,
-            projection: &projection,
-            computed_projection_bytes: &[],
-            join_filter_bytes: &[],
-            post_filter_bytes: &[],
-            instant_columns: &["e.captured_at".to_string()],
-        };
-        let mut results = vec![
-            nodedb_types::json_to_msgpack(
-                &serde_json::json!({"e.captured_at": 1_583_402_400_000i64}),
-            )
-            .expect("encode test row"),
-        ];
-        params
-            .filter_and_project(&mut results)
-            .expect("filter_and_project");
-
-        let decoded = nodedb_types::value_from_msgpack(&results[0]).expect("decode emitted row");
-        let nodedb_types::Value::Object(fields) = decoded else {
-            panic!("emitted row must be a map, got {decoded:?}");
-        };
-        assert_eq!(
-            fields.get("ts"),
-            Some(&nodedb_types::Value::Integer(1_583_402_400_000_000)),
-            "the renamed cell must carry epoch microseconds: {fields:?}"
-        );
-    }
-
     /// Valid encoded filters → matching rows retained, non-matching rows dropped
     /// (happy path unchanged).
     #[test]
@@ -372,7 +310,6 @@ mod tests {
             computed_projection_bytes: &[],
             join_filter_bytes: &[],
             post_filter_bytes: &filter_bytes,
-            instant_columns: &[],
         };
         let mut results = vec![
             row_with_score(99), // should be kept
diff --git a/nodedb/src/data/executor/handlers/join/shuffle_join.rs b/nodedb/src/data/executor/handlers/join/shuffle_join.rs
index 2cbe7abfd..d1fceefad 100644
--- a/nodedb/src/data/executor/handlers/join/shuffle_join.rs
+++ b/nodedb/src/data/executor/handlers/join/shuffle_join.rs
@@ -439,7 +439,6 @@ mod tests {
             computed_projection_bytes: &[],
             join_filter_bytes: &[],
             post_filter_bytes: &[],
-            instant_columns: &[],
         };
         let inputs = ShuffleJoinInputs {
             build_path,
diff --git a/nodedb/src/data/executor/handlers/join/sort_merge.rs b/nodedb/src/data/executor/handlers/join/sort_merge.rs
index c4803a8a5..286de26f6 100644
--- a/nodedb/src/data/executor/handlers/join/sort_merge.rs
+++ b/nodedb/src/data/executor/handlers/join/sort_merge.rs
@@ -51,7 +51,6 @@ impl CoreLoop {
             pre_sorted,
             left_rls_filters,
             right_rls_filters,
-            instant_columns,
         } = p;
         debug!(
             core = self.core_id,
@@ -300,18 +299,6 @@ impl CoreLoop {
             return self.response_error(task, ErrorCode::ResourcesExhausted);
         }
 
-        // Last step before emission: the scans above compared the
-        // milliseconds storage holds, and the client reads microseconds.
-        if let Err(e) = super::instant_scale::scale_join_instant_rows(&mut results, instant_columns)
-        {
-            return self.response_error(
-                task,
-                ErrorCode::Internal {
-                    detail: e.to_string(),
-                },
-            );
-        }
-
         let payload = super::super::super::response_codec::encode_binary_rows(&results);
         self.response_with_payload(task, payload)
     }
diff --git a/nodedb/src/data/executor/handlers/kv/crud/write_basic.rs b/nodedb/src/data/executor/handlers/kv/crud/write_basic.rs
index 39594631c..292c42046 100644
--- a/nodedb/src/data/executor/handlers/kv/crud/write_basic.rs
+++ b/nodedb/src/data/executor/handlers/kv/crud/write_basic.rs
@@ -80,7 +80,10 @@ impl CoreLoop {
             // stored post-image, not an echo of the request.
             return self.kv_stored_returning_response(task, spec, rls_filters, &[(key, value)]);
         }
-        self.response_ok(task)
+        // A put always writes its row, so the statement affected exactly one:
+        // the tag is `INSERT 0 1`, never a bare `OK` (pgwire's generic tag for
+        // a plan that reports nothing).
+        self.response_affected(task, 1)
     }
 
     /// SQL `INSERT` semantics: write only if key doesn't already exist.
@@ -167,7 +170,10 @@ impl CoreLoop {
         if let Some(spec) = returning {
             return self.kv_stored_returning_response(task, spec, rls_filters, &[(key, value)]);
         }
-        self.response_ok(task)
+        // An insert writes exactly one row or fails the statement, so the
+        // affected count is 1 and pgwire renders `INSERT 0 1` — the same tag
+        // the document engine's point insert produces.
+        self.response_affected(task, 1)
     }
 
     /// SQL `INSERT ... ON CONFLICT DO NOTHING` semantics: write if absent,
diff --git a/nodedb/src/data/executor/handlers/kv/dispatch.rs b/nodedb/src/data/executor/handlers/kv/dispatch.rs
index e5c6d040b..d2cf0dd7a 100644
--- a/nodedb/src/data/executor/handlers/kv/dispatch.rs
+++ b/nodedb/src/data/executor/handlers/kv/dispatch.rs
@@ -138,6 +138,8 @@ impl CoreLoop {
                 match_pattern,
                 sort_keys,
                 surrogate_ceiling,
+                projection,
+                computed_columns,
             } => self.execute_kv_scan(
                 task,
                 super::scan::KvScanHandlerParams {
@@ -150,6 +152,8 @@ impl CoreLoop {
                     filters,
                     sort_keys,
                     surrogate_ceiling: *surrogate_ceiling,
+                    projection,
+                    computed_columns,
                 },
             ),
             KvOp::Expire {
diff --git a/nodedb/src/data/executor/handlers/kv/scan.rs b/nodedb/src/data/executor/handlers/kv/scan.rs
index 188f489b3..223dddedd 100644
--- a/nodedb/src/data/executor/handlers/kv/scan.rs
+++ b/nodedb/src/data/executor/handlers/kv/scan.rs
@@ -22,6 +22,8 @@ pub(in crate::data::executor) struct KvScanHandlerParams<'a> {
     pub filters: &'a [u8],
     pub sort_keys: &'a [nodedb_physical::physical_plan::SortKeySpec],
     pub surrogate_ceiling: Option<u32>,
+    pub projection: &'a [String],
+    pub computed_columns: &'a [u8],
 }
 
 impl CoreLoop {
@@ -40,6 +42,8 @@ impl CoreLoop {
             filters,
             sort_keys,
             surrogate_ceiling,
+            projection,
+            computed_columns,
         } = params;
 
         debug!(core = self.core_id, %collection, count, "kv scan");
@@ -155,6 +159,42 @@ impl CoreLoop {
             return self.response_error(task, crate::Error::from(e));
         }
 
+        // Computed-column parity with the document scan path (same wire
+        // format, same evaluator). Without this, SELECT-list expressions
+        // over kv collections surfaced as NULL at response shaping
+        // (`SELECT 1 + 1 FROM kv` returned an empty column), and sequence
+        // accessors could not raise their typed 0A000 here.
+        //
+        // Plain projections (no computed columns) deliberately stay
+        // full-row: clone-source delegation merges rows by primary key at
+        // the control plane, then the response shape extracts columns —
+        // projecting here would strip the keys and break tombstone
+        // suppression (clone_write_suppresses_source_row).
+        if !computed_columns.is_empty() {
+            let computed_cols: Vec<crate::bridge::expr_eval::ComputedColumn> =
+                match zerompk::from_msgpack(computed_columns) {
+                    Ok(cols) => cols,
+                    Err(e) => {
+                        return self.response_error(
+                            task,
+                            ErrorCode::Internal {
+                                detail: format!("KV scan: malformed computed columns: {e}"),
+                            },
+                        );
+                    }
+                };
+            for entry in result_entries.iter_mut() {
+                match crate::data::executor::handlers::document::read::projection::
+                    apply_projection_msgpack(entry, &computed_cols, projection)
+                {
+                    Ok(out) => *entry = out,
+                    Err(e) => {
+                        return self.response_error(task, e);
+                    }
+                }
+            }
+        }
+
         // Build response as flat msgpack array — same format as document/columnar scan.
         // RESP SCAN handles cursor pagination at its own handler layer.
         let mut payload =
diff --git a/nodedb/src/data/executor/handlers/point/apply_put/stored_body.rs b/nodedb/src/data/executor/handlers/point/apply_put/stored_body.rs
index 63c8a0e11..5180a2f15 100644
--- a/nodedb/src/data/executor/handlers/point/apply_put/stored_body.rs
+++ b/nodedb/src/data/executor/handlers/point/apply_put/stored_body.rs
@@ -127,7 +127,7 @@ impl CoreLoop {
             strict_format::bytes_to_binary_tuple(&value, schema, collection)
         }
         .map_err(|e| match e {
-            crate::Error::UnknownStrictField { .. } => e,
+            crate::Error::UnknownStrictField { .. } | crate::Error::BadRequest { .. } => e,
             other => crate::Error::Serialization {
                 format: "binary_tuple".into(),
                 detail: other.to_string(),
diff --git a/nodedb/src/data/executor/handlers/provider_scan.rs b/nodedb/src/data/executor/handlers/provider_scan.rs
index b48f92e9d..2e4322768 100644
--- a/nodedb/src/data/executor/handlers/provider_scan.rs
+++ b/nodedb/src/data/executor/handlers/provider_scan.rs
@@ -21,6 +21,8 @@ pub(in crate::data::executor) struct ProviderScanParams<'a> {
     pub rows_bytes: &'a [u8],
     pub filters_bytes: &'a [u8],
     pub projection: &'a [String],
+    pub computed_columns: &'a [u8],
+    pub window_functions: &'a [u8],
     pub sort_keys: &'a [nodedb_physical::physical_plan::SortKeySpec],
     pub limit: Option<usize>,
     pub offset: usize,
@@ -41,6 +43,8 @@ impl CoreLoop {
             rows_bytes,
             filters_bytes,
             projection,
+            computed_columns,
+            window_functions,
             sort_keys,
             limit,
             offset,
@@ -108,7 +112,113 @@ impl CoreLoop {
             return self.response_error(task, crate::Error::from(e));
         }
 
-        // ── 5. Distinct (on the would-be projected row). ──────────────────────
+        // ── 5. Computed columns. ──────────────────────────────────────────────
+        // Expression projections over materialized rows (derived tables,
+        // constant subqueries) ride as computed columns: evaluate each per
+        // row BEFORE distinct/project so the aliased value exists in the row
+        // map and division/accessor errors fail the query instead of
+        // silently NULLing (issue #295).
+        if !computed_columns.is_empty() {
+            let computed_cols: Vec<crate::bridge::expr_eval::ComputedColumn> =
+                match zerompk::from_msgpack(computed_columns) {
+                    Ok(c) => c,
+                    Err(e) => {
+                        return self.response_error(
+                            task,
+                            ErrorCode::Internal {
+                                detail: format!("ProviderScan: malformed computed columns: {e}"),
+                            },
+                        );
+                    }
+                };
+            for row in rows.iter_mut() {
+                let doc_val = match nodedb_types::value_from_msgpack(row) {
+                    Ok(value) => value,
+                    Err(e) => {
+                        return self.response_error(
+                            task,
+                            ErrorCode::Internal {
+                                detail: format!("ProviderScan: computed-column row decode: {e}"),
+                            },
+                        );
+                    }
+                };
+                let mut map = match doc_val {
+                    nodedb_types::Value::Object(m) => m,
+                    _ => {
+                        return self.response_error(
+                            task,
+                            ErrorCode::Internal {
+                                detail: "ProviderScan: computed-column row is not an object"
+                                    .to_string(),
+                            },
+                        );
+                    }
+                };
+                for cc in &computed_cols {
+                    if matches!(map.get(&cc.alias), Some(v) if !v.is_null()) {
+                        continue;
+                    }
+                    match cc.expr.eval(&nodedb_types::Value::Object(map.clone())) {
+                        Ok(v) => {
+                            map.insert(cc.alias.clone(), v);
+                        }
+                        Err(e) => {
+                            return self
+                                .response_error(task, ErrorCode::from(crate::Error::from(e)));
+                        }
+                    }
+                }
+                match nodedb_types::value_to_msgpack(&nodedb_types::Value::Object(map)) {
+                    Ok(encoded) => *row = encoded,
+                    Err(e) => {
+                        return self.response_error(
+                            task,
+                            ErrorCode::Internal {
+                                detail: format!("ProviderScan: computed-column row encode: {e}"),
+                            },
+                        );
+                    }
+                }
+            }
+        }
+
+        // ── 5b. Window functions. ───────────────────────────────────────────
+        // Window functions over a derived table: evaluate each spec
+        // per partition AFTER computed columns (window args may reference
+        // computed aliases) and BEFORE distinct/project (the window alias
+        // must exist in the row map). Partition/order/argument errors —
+        // including division-by-zero — fail the query instead of
+        // silently NULLing. Evaluation is in place, so row order is kept.
+        if !window_functions.is_empty() {
+            let specs: Vec<crate::bridge::window_func::WindowFuncSpec> =
+                match zerompk::from_msgpack(window_functions) {
+                    Ok(s) => s,
+                    Err(e) => {
+                        return self.response_error(
+                            task,
+                            ErrorCode::Internal {
+                                detail: format!("ProviderScan: malformed window bytes: {e}"),
+                            },
+                        );
+                    }
+                };
+            if !specs.is_empty() && !rows.is_empty() {
+                // The shared helper keeps the whole row set on the Value
+                // codec: a JSON round trip here would downgrade every tagged
+                // cell in rows the window set does not even touch, and each
+                // step fails loudly instead of skipping a row.
+                if let Err(e) =
+                    crate::bridge::window_func::evaluate_window_functions_on_msgpack_rows(
+                        &mut rows, &specs,
+                    )
+                {
+                    return self.response_error(task, ErrorCode::from(e));
+                }
+            }
+        }
+
+        // ── 6. Distinct (on the would-be projected row). ──────────────────────
         // Deduplicate on the projected shape so SQL DISTINCT semantics are
         // honoured: two rows with the same projected columns but different
         // non-projected columns are considered equal.
diff --git a/nodedb/src/data/executor/handlers/timeseries/encode.rs b/nodedb/src/data/executor/handlers/timeseries/encode.rs
index 922b4dfdc..752bc8df0 100644
--- a/nodedb/src/data/executor/handlers/timeseries/encode.rs
+++ b/nodedb/src/data/executor/handlers/timeseries/encode.rs
@@ -9,9 +9,10 @@ use crate::data::executor::core_loop::TsGroupKeyKind;
 /// Render one GROUP BY key part with the type its column carries ungrouped.
 ///
 /// The grouped scan reduces every key to a string, so the column's own type
-/// is put back here. An empty part is SQL NULL. A declared instant is stored
-/// in milliseconds and read in microseconds, exactly as row emission reads
-/// it, so the two routes to one stored instant render it identically.
+/// is put back here. An empty part is SQL NULL. A declared instant stays in
+/// its stored millisecond unit; the response boundary converts declared
+/// instants once, after every aggregate, so every route to one stored instant
+/// renders it identically.
 ///
 /// A part that does not parse as its column's type falls back to the text it
 /// holds: the key is data the scan produced, and dropping the group would
@@ -22,14 +23,7 @@ fn group_key_value(part: Option<&&str>, kind: TsGroupKeyKind) -> crate::Result<r
     };
     let value = match kind {
         TsGroupKeyKind::Instant => match text.parse::<i64>() {
-            Ok(millis) => {
-                let micros = nodedb_types::NdbDateTime::from_millis(millis)
-                    .map_err(|e| crate::Error::Internal {
-                        detail: format!("grouped timeseries key at {millis} ms: {e}"),
-                    })?
-                    .micros;
-                rmpv::Value::Integer(micros.into())
-            }
+            Ok(millis) => rmpv::Value::Integer(millis.into()),
             Err(_) => rmpv::Value::String((*text).into()),
         },
         TsGroupKeyKind::Integer => match text.parse::<i64>() {
diff --git a/nodedb/src/data/executor/handlers/timeseries/ingest.rs b/nodedb/src/data/executor/handlers/timeseries/ingest.rs
index 1135c32a6..b92823149 100644
--- a/nodedb/src/data/executor/handlers/timeseries/ingest.rs
+++ b/nodedb/src/data/executor/handlers/timeseries/ingest.rs
@@ -327,7 +327,7 @@ impl CoreLoop {
         // missing float field is stored as NaN and both paths render it as SQL
         // NULL, which a hand-written projection over the ingest values would
         // have printed as "NaN".
-        let mut returned_rows: Vec<rmpv::Value> = match returning {
+        let returned_rows: Vec<rmpv::Value> = match returning {
             Some(_) => match self.columnar_memtables.get(&key) {
                 Some(mt) => {
                     super::raw_scan::emit_memtable_rows_at(mt, &outcome.accepted_row_indices)
@@ -336,14 +336,6 @@ impl CoreLoop {
             },
             None => Vec::new(),
         };
-        // Same scan-unit rule `SELECT` applies: a declared `TIMESTAMP` cell
-        // leaves the engine as epoch microseconds, not the milliseconds
-        // storage holds.
-        let instant_columns = self.ts_instant_columns(task.request.database_id, tid, collection);
-        if let Err(e) = super::raw_scan::scale_instant_cells(&mut returned_rows, &instant_columns) {
-            return self.response_error(task, e);
-        }
-
         if accepted > 0
             && let Some(lsn) = wal_lsn
         {
diff --git a/nodedb/src/data/executor/handlers/timeseries/raw_scan/mod.rs b/nodedb/src/data/executor/handlers/timeseries/raw_scan/mod.rs
index 9b346ff12..081da03b5 100644
--- a/nodedb/src/data/executor/handlers/timeseries/raw_scan/mod.rs
+++ b/nodedb/src/data/executor/handlers/timeseries/raw_scan/mod.rs
@@ -8,5 +8,5 @@ pub mod partition_scan;
 pub mod row_emit;
 pub mod scan;
 
-pub(in crate::data::executor) use row_emit::{emit_memtable_rows_at, scale_instant_cells};
+pub(in crate::data::executor) use row_emit::emit_memtable_rows_at;
 pub(in crate::data::executor) use scan::RawScanParams;
diff --git a/nodedb/src/data/executor/handlers/timeseries/raw_scan/row_emit.rs b/nodedb/src/data/executor/handlers/timeseries/raw_scan/row_emit.rs
index 63180c16b..1e50d4018 100644
--- a/nodedb/src/data/executor/handlers/timeseries/raw_scan/row_emit.rs
+++ b/nodedb/src/data/executor/handlers/timeseries/raw_scan/row_emit.rs
@@ -210,128 +210,3 @@ pub(super) fn nodedb_value_to_rmpv(v: &nodedb_types::Value) -> rmpv::Value {
         _ => rmpv::Value::Nil,
     }
 }
-
-/// Rescale every declared-instant cell of `rows` from the milliseconds the
-/// memtable and the partitions store to the epoch microseconds a `TIMESTAMP`
-/// cell carries on the wire.
-///
-/// The engine's own unit stays milliseconds: partition ranges, retention,
-/// `time_bucket` and every scan predicate read it. The scale therefore runs
-/// once, as rows leave the scan — after filtering, sorting and computed
-/// columns — so nothing inside the engine sees the wire unit.
-///
-/// `instant_columns` comes from `CoreLoop::ts_instant_columns`, which lists
-/// the columns declared `TIMESTAMP` or `TIMESTAMPTZ`. A `BIGINT TIME_KEY`
-/// lives in the same millisecond column and is not in that list, so it keeps
-/// the integer the client inserted.
-///
-/// SQL NULL cells pass through untouched. A stored value that cannot be
-/// expressed in microseconds fails the read rather than wrapping.
-pub(in crate::data::executor) fn scale_instant_cells(
-    rows: &mut [rmpv::Value],
-    instant_columns: &[String],
-) -> crate::Result<()> {
-    if instant_columns.is_empty() {
-        return Ok(());
-    }
-    for row in rows.iter_mut() {
-        let rmpv::Value::Map(fields) = row else {
-            continue;
-        };
-        for (key, value) in fields.iter_mut() {
-            let Some(name) = key.as_str() else { continue };
-            if !instant_columns.iter().any(|c| c == name) {
-                continue;
-            }
-            let rmpv::Value::Integer(stored) = value else {
-                continue;
-            };
-            let millis = stored.as_i64().ok_or_else(|| crate::Error::Internal {
-                detail: format!(
-                    "timeseries column {name} holds {stored}, which is not a millisecond \
-                     count an instant can be read from"
-                ),
-            })?;
-            let micros = nodedb_types::NdbDateTime::from_millis(millis)
-                .map_err(|e| crate::Error::Internal {
-                    detail: format!("timeseries column {name} at {millis} ms: {e}"),
-                })?
-                .micros;
-            *value = rmpv::Value::Integer(micros.into());
-        }
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::scale_instant_cells;
-
-    fn row(cells: &[(&str, i64)]) -> rmpv::Value {
-        rmpv::Value::Map(
-            cells
-                .iter()
-                .map(|(k, v)| {
-                    (
-                        rmpv::Value::String((*k).into()),
-                        rmpv::Value::Integer((*v).into()),
-                    )
-                })
-                .collect(),
-        )
-    }
-
-    fn cell(row: &rmpv::Value, name: &str) -> Option<i64> {
-        let rmpv::Value::Map(fields) = row else {
-            return None;
-        };
-        fields
-            .iter()
-            .find(|(k, _)| k.as_str() == Some(name))
-            .and_then(|(_, v)| v.as_i64())
-    }
-
-    /// A declared `TIMESTAMP` column is read as epoch microseconds, so the
-    /// millisecond value storage holds is scaled on the way out. 2020-03-05
-    /// stays 2020-03-05 instead of landing 50 years earlier.
-    #[test]
-    fn a_declared_instant_column_leaves_the_scan_in_microseconds() {
-        let mut rows = vec![row(&[("captured_at", 1_583_402_400_000)])];
-        scale_instant_cells(&mut rows, &["captured_at".to_string()]).expect("scale");
-        assert_eq!(cell(&rows[0], "captured_at"), Some(1_583_402_400_000_000));
-    }
-
-    /// A `BIGINT TIME_KEY` shares the millisecond storage column but is not a
-    /// declared instant, so its value is handed back exactly as inserted.
-    #[test]
-    fn a_column_that_is_not_a_declared_instant_keeps_its_value() {
-        let mut rows = vec![row(&[("ts", 1000), ("n", 7)])];
-        scale_instant_cells(&mut rows, &["other".to_string()]).expect("scale");
-        assert_eq!(cell(&rows[0], "ts"), Some(1000));
-        assert_eq!(cell(&rows[0], "n"), Some(7));
-    }
-
-    /// A NULL instant cell stays NULL — there is no instant to scale.
-    #[test]
-    fn a_null_instant_cell_passes_through() {
-        let mut rows = vec![rmpv::Value::Map(vec![(
-            rmpv::Value::String("captured_at".into()),
-            rmpv::Value::Nil,
-        )])];
-        scale_instant_cells(&mut rows, &["captured_at".to_string()]).expect("scale");
-        assert_eq!(cell(&rows[0], "captured_at"), None);
-    }
-
-    /// A stored millisecond count past the microsecond range fails the read.
-    /// Wrapping it would hand back an instant that is not the stored one.
-    #[test]
-    fn a_millisecond_value_beyond_the_microsecond_range_fails_the_read() {
-        let mut rows = vec![row(&[("captured_at", i64::MAX)])];
-        let err = scale_instant_cells(&mut rows, &["captured_at".to_string()])
-            .expect_err("i64::MAX ms cannot be expressed in microseconds");
-        assert!(
-            err.to_string().contains("captured_at"),
-            "the error must name the column: {err}"
-        );
-    }
-}
diff --git a/nodedb/src/data/executor/handlers/timeseries/raw_scan/scan.rs b/nodedb/src/data/executor/handlers/timeseries/raw_scan/scan.rs
index a51828b8f..7bd08d57b 100644
--- a/nodedb/src/data/executor/handlers/timeseries/raw_scan/scan.rs
+++ b/nodedb/src/data/executor/handlers/timeseries/raw_scan/scan.rs
@@ -271,15 +271,9 @@ impl CoreLoop {
         }
         results.truncate(limit);
 
-        // The engine stores its timestamp columns in milliseconds; a client
-        // reads a `TIMESTAMP` cell as epoch microseconds. Scale here, once
-        // every predicate, sort and computed column has run against the
-        // engine's own unit.
-        let instant_columns = self.ts_instant_columns(task.request.database_id, tid, collection);
-        if let Err(e) = super::row_emit::scale_instant_cells(&mut results, &instant_columns) {
-            return self.response_error(task, e);
-        }
-
+        // Cells leave the engine in its own millisecond unit; the response
+        // boundary converts declared instants once, after every predicate,
+        // sort and computed column has run.
         let array = rmpv::Value::Array(results);
         let mut buf = Vec::new();
         rmpv::encode::write_value(&mut buf, &array).unwrap_or(());
diff --git a/nodedb/src/data/executor/handlers/transaction/stage_write/body.rs b/nodedb/src/data/executor/handlers/transaction/stage_write/body.rs
index 979a46b07..8dd5e3578 100644
--- a/nodedb/src/data/executor/handlers/transaction/stage_write/body.rs
+++ b/nodedb/src/data/executor/handlers/transaction/stage_write/body.rs
@@ -126,7 +126,7 @@ impl CoreLoop {
                 strict_format::bytes_to_binary_tuple(&encoded_input, schema, collection)
             }
             .map_err(|e| match e {
-                crate::Error::UnknownStrictField { .. } => e,
+                crate::Error::UnknownStrictField { .. } | crate::Error::BadRequest { .. } => e,
                 other => crate::Error::Serialization {
                     format: "binary_tuple".into(),
                     detail: other.to_string(),
@@ -245,7 +245,7 @@ impl CoreLoop {
                     strict_format::value_to_binary_tuple(&ndb_val, schema, collection)
                 }
                 .map_err(|e| match e {
-                    crate::Error::UnknownStrictField { .. } => e,
+                    crate::Error::UnknownStrictField { .. } | crate::Error::BadRequest { .. } => e,
                     other => crate::Error::Serialization {
                         format: "binary_tuple".into(),
                         detail: other.to_string(),
diff --git a/nodedb/src/data/executor/handlers/transaction/stage_write/stage_upsert.rs b/nodedb/src/data/executor/handlers/transaction/stage_write/stage_upsert.rs
index 1d100b7d3..562072666 100644
--- a/nodedb/src/data/executor/handlers/transaction/stage_write/stage_upsert.rs
+++ b/nodedb/src/data/executor/handlers/transaction/stage_write/stage_upsert.rs
@@ -175,7 +175,7 @@ impl CoreLoop {
                 strict_format::value_to_binary_tuple(&merged, schema, ctx.collection)
             };
             result.map_err(|e| match e {
-                crate::Error::UnknownStrictField { .. } => e,
+                crate::Error::UnknownStrictField { .. } | crate::Error::BadRequest { .. } => e,
                 other => crate::Error::Serialization {
                     format: "binary_tuple".into(),
                     detail: other.to_string(),
diff --git a/nodedb/src/data/executor/strict_format/coerce.rs b/nodedb/src/data/executor/strict_format/coerce.rs
index d2ec8eec1..83681ca85 100644
--- a/nodedb/src/data/executor/strict_format/coerce.rs
+++ b/nodedb/src/data/executor/strict_format/coerce.rs
@@ -166,7 +166,7 @@ pub fn coerce_value(val: &Value, col_type: &ColumnType, col_name: &str) -> crate
         ColumnType::Vector(dim) => match val {
             Value::Bytes(b) if b.len() == *dim as usize * 4 => Ok(val.clone()),
             Value::Array(arr) => {
-                let floats = extract_vector_floats(arr);
+                let floats = extract_vector_floats(col_name, arr)?;
                 validate_and_encode_vector(col_name, *dim, &floats)
             }
             Value::String(s) => {
@@ -229,15 +229,56 @@ pub fn coerce_value(val: &Value, col_type: &ColumnType, col_name: &str) -> crate
     }
 }
 
-/// Extract f32 floats from a `Value::Array`.
-fn extract_vector_floats(arr: &[Value]) -> Vec<f32> {
-    arr.iter()
-        .filter_map(|v| match v {
-            Value::Float(f) => Some(*f as f32),
-            Value::Integer(n) => Some(*n as f32),
-            _ => None,
-        })
-        .collect()
+/// Extract `f32` floats from a `Value::Array` for a VECTOR column.
+///
+/// Accepts the element shapes the planner actually produces for an
+/// `ARRAY[...]` literal — `Float`, `Integer`, `Decimal` (a folded numeric
+/// literal arrives as `Decimal`), and numeric `String` — matching the
+/// schemaless point-put path (`vector_string::floats_from_value`), so one
+/// literal behaves the same on every engine.
+///
+/// A non-numeric element is rejected by index and type. A `filter_map` here
+/// used to drop it silently, which reported the literal as having fewer
+/// elements than the user wrote and surfaced the mismatch as an internal
+/// error.
+fn extract_vector_floats(col_name: &str, arr: &[Value]) -> crate::Result<Vec<f32>> {
+    let mut floats = Vec::with_capacity(arr.len());
+    for (i, v) in arr.iter().enumerate() {
+        let f = match v {
+            Value::Float(f) => *f as f32,
+            Value::Integer(n) => *n as f32,
+            Value::Decimal(d) => {
+                use rust_decimal::prelude::ToPrimitive;
+                d.to_f32().ok_or_else(|| crate::Error::BadRequest {
+                    detail: format!(
+                        "column '{col_name}': VECTOR element {i}: cannot represent DECIMAL {d} as FLOAT"
+                    ),
+                })?
+            }
+            Value::String(s) => s.parse::<f32>().map_err(|_| crate::Error::BadRequest {
+                detail: format!(
+                    "column '{col_name}': VECTOR element {i}: expected a numeric element, got String({s:?})"
+                ),
+            })?,
+            other => {
+                return Err(crate::Error::BadRequest {
+                    detail: format!(
+                        "column '{col_name}': VECTOR element {i}: expected a numeric element, got {}",
+                        other.type_name()
+                    ),
+                });
+            }
+        };
+        if !f.is_finite() {
+            return Err(crate::Error::BadRequest {
+                detail: format!(
+                    "column '{col_name}': VECTOR element {i}: expected a finite element, got {f}"
+                ),
+            });
+        }
+        floats.push(f);
+    }
+    Ok(floats)
 }
 
 /// Validate dimension count and encode as little-endian bytes.
@@ -415,4 +456,51 @@ mod tests {
         let msg = result.unwrap_err().to_string();
         assert!(msg.contains("\"extra\"") && msg.contains("does not exist"));
     }
+
+    #[test]
+    fn vector_accepts_decimal_and_numeric_string_elements() {
+        // `ARRAY[0.1, 0.2, 0.3]` folds its numeric literals to `Decimal`
+        // elements; numeric strings are accepted like the schemaless path.
+        let arr = vec![
+            Value::Decimal(rust_decimal::Decimal::new(1, 1)),
+            Value::String("0.2".into()),
+            Value::Integer(3),
+        ];
+        let floats = extract_vector_floats("embedding", &arr).unwrap();
+        assert_eq!(floats.len(), 3);
+        assert!((floats[0] - 0.1).abs() < 1e-6, "{floats:?}");
+        assert!((floats[1] - 0.2).abs() < 1e-6, "{floats:?}");
+        assert!((floats[2] - 3.0).abs() < 1e-6, "{floats:?}");
+    }
+
+    #[test]
+    fn vector_element_error_names_index_and_type() {
+        let arr = vec![Value::Float(0.1), Value::String("x".into())];
+        let err = extract_vector_floats("embedding", &arr)
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("VECTOR element 1"), "{err}");
+        assert!(err.contains("String"), "{err}");
+    }
+
+    #[test]
+    fn vector_rejects_non_finite_elements() {
+        let arr = vec![Value::Float(f64::NAN)];
+        assert!(extract_vector_floats("embedding", &arr).is_err());
+    }
+
+    #[test]
+    fn vector_encodes_three_decimals_at_full_width() {
+        let arr = vec![
+            Value::Decimal(rust_decimal::Decimal::new(1, 1)),
+            Value::Decimal(rust_decimal::Decimal::new(2, 1)),
+            Value::Decimal(rust_decimal::Decimal::new(3, 1)),
+        ];
+        let floats = extract_vector_floats("embedding", &arr).unwrap();
+        let encoded = validate_and_encode_vector("embedding", 3, &floats).unwrap();
+        match encoded {
+            Value::Bytes(b) => assert_eq!(b.len(), 12),
+            other => panic!("expected Bytes, got {other:?}"),
+        }
+    }
 }
diff --git a/nodedb/src/error_from.rs b/nodedb/src/error_from.rs
index 7a5fd470e..06d05fc31 100644
--- a/nodedb/src/error_from.rs
+++ b/nodedb/src/error_from.rs
@@ -28,6 +28,22 @@ impl From<nodedb_query::EvalError> for Error {
     }
 }
 
+/// The value-codec window evaluator's error. A missing partition column or a
+/// bad frame is an internal plan error; an argument failure wraps the shared
+/// `EvalError` so the wire class matches the other evaluators.
+impl From<nodedb_query::WindowError> for Error {
+    fn from(e: nodedb_query::WindowError) -> Self {
+        match e {
+            nodedb_query::WindowError::Eval(inner) => Self::from(inner),
+            nodedb_query::WindowError::ColumnNotFound { name } => Self::Internal {
+                detail: format!("window column '{name}' not found in result columns"),
+            },
+            nodedb_query::WindowError::ArgEval { detail } => Self::Internal { detail },
+            nodedb_query::WindowError::BadFrame { detail } => Self::Internal { detail },
+        }
+    }
+}
+
 impl From<crate::engine::timeseries::ilp::IlpError> for Error {
     fn from(e: crate::engine::timeseries::ilp::IlpError) -> Self {
         Self::BadRequest {
diff --git a/nodedb/tests/inproc/cases/executor_tests/test_cross_type_join/inline_hash_join.rs b/nodedb/tests/inproc/cases/executor_tests/test_cross_type_join/inline_hash_join.rs
index 8ce8e1420..5f30bf18d 100644
--- a/nodedb/tests/inproc/cases/executor_tests/test_cross_type_join/inline_hash_join.rs
+++ b/nodedb/tests/inproc/cases/executor_tests/test_cross_type_join/inline_hash_join.rs
@@ -171,6 +171,8 @@ fn inline_hash_join_honors_qualified_left_keys() {
                 rows: response_codec::flatten_to_relational_rows(&left_data),
                 filters: Vec::new(),
                 projection: Vec::new(),
+                computed_columns: Vec::new(),
+                window_functions: Vec::new(),
                 sort_keys: Vec::new(),
                 limit: None,
                 offset: 0,
@@ -181,6 +183,8 @@ fn inline_hash_join_honors_qualified_left_keys() {
                 rows: response_codec::flatten_to_relational_rows(&right_data),
                 filters: Vec::new(),
                 projection: Vec::new(),
+                computed_columns: Vec::new(),
+                window_functions: Vec::new(),
                 sort_keys: Vec::new(),
                 limit: None,
                 offset: 0,
diff --git a/nodedb/tests/inproc/cases/executor_tests/test_cross_type_join/multi_core_joins.rs b/nodedb/tests/inproc/cases/executor_tests/test_cross_type_join/multi_core_joins.rs
index 0452152fc..a21f97c42 100644
--- a/nodedb/tests/inproc/cases/executor_tests/test_cross_type_join/multi_core_joins.rs
+++ b/nodedb/tests/inproc/cases/executor_tests/test_cross_type_join/multi_core_joins.rs
@@ -80,6 +80,8 @@ fn multi_core_broadcast_inner_join() {
             sort_keys: Vec::new(),
             match_pattern: None,
             surrogate_ceiling: None,
+            projection: Vec::new(),
+            computed_columns: Vec::new(),
         }),
     );
 
@@ -126,6 +128,8 @@ fn multi_core_broadcast_inner_join() {
                 rows: response_codec::flatten_to_relational_rows(&phase1_payload),
                 filters: Vec::new(),
                 projection: Vec::new(),
+                computed_columns: Vec::new(),
+                window_functions: Vec::new(),
                 sort_keys: Vec::new(),
                 limit: None,
                 offset: 0,
@@ -234,6 +238,8 @@ fn multi_core_broadcast_left_join() {
             sort_keys: Vec::new(),
             match_pattern: None,
             surrogate_ceiling: None,
+            projection: Vec::new(),
+            computed_columns: Vec::new(),
         }),
     );
 
@@ -268,6 +274,8 @@ fn multi_core_broadcast_left_join() {
                 rows: response_codec::flatten_to_relational_rows(&phase1_payload),
                 filters: Vec::new(),
                 projection: Vec::new(),
+                computed_columns: Vec::new(),
+                window_functions: Vec::new(),
                 sort_keys: Vec::new(),
                 limit: None,
                 offset: 0,
@@ -401,6 +409,8 @@ fn multi_core_broadcast_merge_simulation() {
         sort_keys: Vec::new(),
         match_pattern: None,
         surrogate_ceiling: None,
+        projection: Vec::new(),
+        computed_columns: Vec::new(),
     });
     let payload0 = send_ok(
         &mut core0.core,
@@ -450,6 +460,8 @@ fn multi_core_broadcast_merge_simulation() {
                 rows: response_codec::flatten_to_relational_rows(&data),
                 filters: Vec::new(),
                 projection: Vec::new(),
+                computed_columns: Vec::new(),
+                window_functions: Vec::new(),
                 sort_keys: Vec::new(),
                 limit: None,
                 offset: 0,
diff --git a/nodedb/tests/inproc/cases/executor_tests/test_kv.rs b/nodedb/tests/inproc/cases/executor_tests/test_kv.rs
index 52a8aa244..8f6790598 100644
--- a/nodedb/tests/inproc/cases/executor_tests/test_kv.rs
+++ b/nodedb/tests/inproc/cases/executor_tests/test_kv.rs
@@ -234,6 +234,8 @@ fn kv_scan_returns_entries() {
             match_pattern: None,
             sort_keys: Vec::new(),
             surrogate_ceiling: None,
+            projection: Vec::new(),
+            computed_columns: Vec::new(),
         }),
     );
 
@@ -283,6 +285,8 @@ fn kv_scan_with_match_pattern() {
             match_pattern: Some("user:*".into()),
             sort_keys: Vec::new(),
             surrogate_ceiling: None,
+            projection: Vec::new(),
+            computed_columns: Vec::new(),
         }),
     );
 
diff --git a/nodedb/tests/inproc/cases/executor_tests/test_kv_advanced.rs b/nodedb/tests/inproc/cases/executor_tests/test_kv_advanced.rs
index 5dba10d7e..3132cf0fe 100644
--- a/nodedb/tests/inproc/cases/executor_tests/test_kv_advanced.rs
+++ b/nodedb/tests/inproc/cases/executor_tests/test_kv_advanced.rs
@@ -611,6 +611,8 @@ fn kv_index_write_amp_ratio_matches() {
             match_pattern: None,
             sort_keys: Vec::new(),
             surrogate_ceiling: None,
+            projection: Vec::new(),
+            computed_columns: Vec::new(),
         }),
     );
     let json: serde_json::Value = payload_value(&payload);
diff --git a/nodedb/tests/inproc/cases/executor_tests/test_kv_scan_budget.rs b/nodedb/tests/inproc/cases/executor_tests/test_kv_scan_budget.rs
index 28ba8fc7a..be11e865b 100644
--- a/nodedb/tests/inproc/cases/executor_tests/test_kv_scan_budget.rs
+++ b/nodedb/tests/inproc/cases/executor_tests/test_kv_scan_budget.rs
@@ -48,6 +48,8 @@ fn kv_scan(collection: &str, count: usize) -> PhysicalPlan {
         match_pattern: None,
         sort_keys: Vec::new(),
         surrogate_ceiling: None,
+        projection: Vec::new(),
+        computed_columns: Vec::new(),
     })
 }
 
diff --git a/nodedb/tests/wire/cases/derived_expression_errors.rs b/nodedb/tests/wire/cases/derived_expression_errors.rs
new file mode 100644
index 000000000..9ebf6cd02
--- /dev/null
+++ b/nodedb/tests/wire/cases/derived_expression_errors.rs
@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Expression errors over a constant derived table must raise, not fold to
+//! NULL / empty rows. The derived body materializes as rows on the
+//! coordinator; expression projections and aggregate/group-key arguments
+//! evaluate against those rows per-row, so division raises 22012 and a bare
+//! `nextval` stamps one value per output row. `currval`/`setval` have no
+//! defined per-row value and still raise 0A000.
+
+use crate::harness::TestServer;
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn projection_division_over_derived_raises() {
+    let server = TestServer::start().await;
+    server
+        .expect_error("SELECT x/0 FROM (SELECT 1 AS x) s", "22012")
+        .await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn projection_division_over_derived_with_filter_raises() {
+    let server = TestServer::start().await;
+    server
+        .expect_error("SELECT x/0 FROM (SELECT 1 AS x) s WHERE x > 0", "22012")
+        .await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn aggregate_argument_division_over_derived_raises() {
+    let server = TestServer::start().await;
+    server
+        .expect_error("SELECT sum(x/0) FROM (SELECT 1 AS x) s", "22012")
+        .await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn group_by_division_over_derived_raises() {
+    let server = TestServer::start().await;
+    server
+        .expect_error(
+            "SELECT x, count(*) FROM (SELECT 1 AS x) s GROUP BY x/0",
+            "22012",
+        )
+        .await;
+}
+
+/// A bare `nextval` over a derived table is stamped once per materialized
+/// row. `currval` over the same shape stays refused.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn accessor_over_derived_stamps_each_row() {
+    let server = TestServer::start().await;
+    server.exec("CREATE SEQUENCE der_seq").await.unwrap();
+
+    let rows = server
+        .query_text("SELECT nextval('der_seq') FROM (SELECT 1 AS x) s")
+        .await
+        .expect("per-row nextval over a derived table must return the stamped value");
+    assert_eq!(rows, vec!["1".to_string()], "one row, one value");
+
+    server
+        .expect_error("SELECT currval('der_seq') FROM (SELECT 1 AS x) s", "0A000")
+        .await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn window_partition_division_over_derived_raises() {
+    let server = TestServer::start().await;
+    server
+        .expect_error(
+            "SELECT sum(x) OVER (PARTITION BY x/0) FROM (SELECT 1 AS x) s",
+            "22012",
+        )
+        .await;
+}
diff --git a/nodedb/tests/wire/cases/graph_dsl_handlers.rs b/nodedb/tests/wire/cases/graph_dsl_handlers.rs
index 47041f072..69c1952c7 100644
--- a/nodedb/tests/wire/cases/graph_dsl_handlers.rs
+++ b/nodedb/tests/wire/cases/graph_dsl_handlers.rs
@@ -448,3 +448,39 @@ async fn graph_traverse_node_id_containing_keyword_substring() {
         "traversal must reach 'b'; substring 'DEPTH' in src id must not be parsed as DEPTH keyword; got: {blob}"
     );
 }
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn graph_traverse_rejects_a_mistyped_clause_keyword() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION mistyped").await.unwrap();
+    server
+        .exec("GRAPH INSERT EDGE IN 'mistyped' FROM '1' TO '2' TYPE 'l'")
+        .await
+        .unwrap();
+
+    // `DEPTS` is not a clause. Seeking for DEPTH, finding none, and defaulting
+    // the depth left `DEPTS 3` unread: the statement answered a different
+    // question than it asked, and reported success.
+    server
+        .expect_error(
+            "GRAPH TRAVERSE IN 'mistyped' FROM '1' DEPTS 3 LABEL 'l'",
+            "42601",
+        )
+        .await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn graph_path_rejects_a_stray_literal() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION strays").await.unwrap();
+    server
+        .exec("GRAPH INSERT EDGE IN 'strays' FROM 'a' TO 'b' TYPE 'l'")
+        .await
+        .unwrap();
+
+    // The trailing literal belongs to no clause. Ignoring it accepted a
+    // statement whose text does not mean what it parses to.
+    server
+        .expect_error("GRAPH PATH IN 'strays' FROM 'a' TO 'b' 'stray'", "42601")
+        .await;
+}
diff --git a/nodedb/tests/wire/cases/kv_select_expressions.rs b/nodedb/tests/wire/cases/kv_select_expressions.rs
new file mode 100644
index 000000000..48fcd0a9e
--- /dev/null
+++ b/nodedb/tests/wire/cases/kv_select_expressions.rs
@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! kv-engine SELECT projection expression evaluation.
+//!
+//! Previously the kv scan carried neither the SELECT projection list nor
+//! computed columns, so expression projections were never evaluated: the
+//! column came back NULL at response shaping (`SELECT 1 + 1 FROM kv`
+//! returned an empty column). The scan now carries projection + computed
+//! columns like the document/columnar paths, so:
+//!
+//! - scalar expressions over kv rows evaluate per row;
+//! - a bare `nextval` in a kv SELECT list is stamped once per emitted row at
+//!   the response boundary, while `currval`/`setval` stay refused (0A000):
+//!   only `nextval` has a defined value per output row.
+
+use crate::harness::TestServer;
+
+async fn setup(server: &TestServer) {
+    server
+        .exec("CREATE COLLECTION kvsel (id BIGINT PRIMARY KEY, v TEXT) WITH (engine = 'kv')")
+        .await
+        .unwrap();
+    server
+        .exec("INSERT INTO kvsel (id, v) VALUES (1, 'hello'), (2, 'world')")
+        .await
+        .unwrap();
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn scalar_expressions_evaluate_per_row() {
+    let server = TestServer::start().await;
+    setup(&server).await;
+
+    let rows = server
+        .query_named_rows("SELECT upper(v) AS u, 1 + 1 AS s FROM kvsel ORDER BY id")
+        .await
+        .expect("rows");
+    assert_eq!(rows.len(), 2, "{rows:?}");
+    let u: Vec<_> = rows
+        .iter()
+        .map(|r| r.get("u").map(|s| s.as_str()))
+        .collect();
+    assert_eq!(u, vec![Some("HELLO"), Some("WORLD")], "{rows:?}");
+    let s: Vec<_> = rows
+        .iter()
+        .map(|r| r.get("s").map(|s| s.as_str()))
+        .collect();
+    assert_eq!(s, vec![Some("2"), Some("2")], "{rows:?}");
+}
+
+/// A bare `nextval` in a kv SELECT list is a control-plane stamp: one value
+/// per emitted row, in output order. `currval` and `setval` have no defined
+/// per-row value and stay refused with `0A000`.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn nextval_in_select_list_stamps_each_row() {
+    let server = TestServer::start().await;
+    setup(&server).await;
+    server
+        .exec("CREATE SEQUENCE seq_kvsel_stamp")
+        .await
+        .unwrap();
+
+    let rows = server
+        .query_text("SELECT nextval('seq_kvsel_stamp') FROM kvsel ORDER BY id")
+        .await
+        .expect("per-row nextval over a kv scan must return the stamped values");
+    assert_eq!(
+        rows,
+        vec!["1".to_string(), "2".to_string()],
+        "one consecutive value per emitted row"
+    );
+
+    server
+        .expect_error("SELECT currval('seq_kvsel_stamp') FROM kvsel", "0A000")
+        .await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn plain_projection_still_returns_stored_columns() {
+    let server = TestServer::start().await;
+    setup(&server).await;
+    let rows = server
+        .query_named_rows("SELECT id, v FROM kvsel ORDER BY id")
+        .await
+        .expect("rows");
+    assert_eq!(rows.len(), 2, "{rows:?}");
+    assert_eq!(
+        rows.iter()
+            .map(|r| r.get("v").map(|s| s.as_str()))
+            .collect::<Vec<_>>(),
+        vec![Some("hello"), Some("world")]
+    );
+}
diff --git a/nodedb/tests/wire/cases/mod.rs b/nodedb/tests/wire/cases/mod.rs
index e47f21052..60d88c956 100644
--- a/nodedb/tests/wire/cases/mod.rs
+++ b/nodedb/tests/wire/cases/mod.rs
@@ -47,6 +47,7 @@ mod ddl_float_width_aliases_strict_kv;
 mod ddl_int_width_aliases_strict_kv;
 mod ddl_numeric_width_schemaless;
 mod define_field_type_update;
+mod derived_expression_errors;
 mod dml_returning_columnar;
 mod dml_returning_columnar_policies;
 mod dml_returning_insert;
@@ -96,6 +97,7 @@ mod http_result_projection;
 mod insert_select_cross_engine;
 mod kv_column_defaults;
 mod kv_predicate_dml;
+mod kv_select_expressions;
 mod kv_sql_select;
 mod kv_write_row_level_security;
 mod kv_write_row_level_security_atomics;
@@ -160,14 +162,10 @@ mod sql_bitemporal_document_visibility;
 mod sql_check_constraints;
 mod sql_collection_drop_index_cleanup;
 mod sql_conflict_policy;
-mod sql_convert_column_defs;
 mod sql_copy_from;
 mod sql_copy_to;
 mod sql_cursors;
-mod sql_declared_column_types;
 mod sql_default_expressions;
-mod sql_default_vector_primary;
-mod sql_default_volatility;
 mod sql_division_by_zero;
 mod sql_division_by_zero_composite;
 mod sql_dml_affected_counts;
@@ -249,7 +247,6 @@ mod sql_transactions_unique_violation;
 mod sql_transactions_upsert_overlay;
 mod sql_transactions_vector_overlay;
 mod sql_trigger_fuel;
-mod sql_typeguard_default_gate;
 mod sql_typeguard_defaults;
 mod sql_undefined_column;
 mod sql_undefined_column_dml;
@@ -268,7 +265,6 @@ mod strict_bitemporal_audit_query;
 mod strict_bitemporal_select_star;
 mod strict_schema_restart;
 mod timeseries_declared_time_key;
-mod timeseries_join_time_rendering;
 mod timeseries_write_row_level_security;
 mod transactional_ddl_atomicity;
 mod transactional_ddl_compensation;
diff --git a/nodedb/tests/wire/cases/sql_default_expressions.rs b/nodedb/tests/wire/cases/sql_default_expressions.rs
index cee4bbd03..e3ae5e29f 100644
--- a/nodedb/tests/wire/cases/sql_default_expressions.rs
+++ b/nodedb/tests/wire/cases/sql_default_expressions.rs
@@ -433,6 +433,57 @@ async fn default_currval_fills_a_column() {
     );
 }
 
+/// A `nextval` in the SELECT list is evaluated once per returned row, in
+/// output order, on the control plane. The Data Plane holds no sequence
+/// state, so this statement used to be refused outright.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn select_list_nextval_advances_once_per_row() {
+    let server = TestServer::start().await;
+
+    server.exec("CREATE SEQUENCE seq_sel_rows").await.unwrap();
+    server
+        .exec("CREATE COLLECTION sel_seq (id INT PRIMARY KEY, v TEXT)")
+        .await
+        .unwrap();
+    server
+        .exec("INSERT INTO sel_seq (id, v) VALUES (1,'a'),(2,'b'),(3,'c')")
+        .await
+        .unwrap();
+
+    let rows = server
+        .query_text("SELECT nextval('seq_sel_rows') AS n FROM sel_seq ORDER BY id")
+        .await
+        .expect("per-row nextval must plan and run");
+    assert_eq!(
+        rows,
+        vec!["1".to_string(), "2".to_string(), "3".to_string()],
+        "one consecutive value per returned row, in row order"
+    );
+
+    // A filter shrinks the row set: only emitted rows consume values.
+    let rows = server
+        .query_text("SELECT nextval('seq_sel_rows') AS n FROM sel_seq WHERE id > 2")
+        .await
+        .expect("filtered per-row nextval");
+    assert_eq!(rows, vec!["4".to_string()], "the filter removed two rows");
+}
+
+/// An embedded sequence accessor stays refused at plan time: only a bare
+/// projection item has a defined per-row value.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn embedded_nextval_stays_refused() {
+    let server = TestServer::start().await;
+    server.exec("CREATE SEQUENCE seq_embedded").await.unwrap();
+    server
+        .exec("CREATE COLLECTION emb_seq (id INT PRIMARY KEY)")
+        .await
+        .unwrap();
+
+    server
+        .expect_error("SELECT nextval('seq_embedded') + 1 FROM emb_seq", "0A000")
+        .await;
+}
+
 /// Asserts a rendered row carries a real value in place of an absent or NULL column.
 fn assert_not_null(row: &str, label: &str) {
     let trimmed = row.trim();
diff --git a/nodedb/tests/wire/cases/sql_search_subquery_composition.rs b/nodedb/tests/wire/cases/sql_search_subquery_composition.rs
index 3e76a1d04..753a44007 100644
--- a/nodedb/tests/wire/cases/sql_search_subquery_composition.rs
+++ b/nodedb/tests/wire/cases/sql_search_subquery_composition.rs
@@ -264,3 +264,74 @@ async fn outer_order_by_distance_then_limit_takes_farthest() {
         "LIMIT after an outer ORDER BY must cut the reordered rows, got: {rows:?}"
     );
 }
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn outer_order_by_vector_distance_declares_distance() {
+    let server = TestServer::start().await;
+    create_vector_collection(&server, "vec_implicit").await;
+
+    // A hand-written `ORDER BY vector_distance(...)` derived table (no SEARCH
+    // keyword) takes the same sort-trigger rewrite as the SEARCH form, so the
+    // synthetic `distance` column must resolve AND carry a value: declaring
+    // the column without producing a cell would make `s.distance` a phantom.
+    let rows = server
+        .query_text(
+            "SELECT s.distance FROM \
+             (SELECT * FROM vec_implicit \
+              ORDER BY vector_distance(embedding, ARRAY[0.1, 0.2, 0.3, 0.4]) LIMIT 2) s",
+        )
+        .await
+        .unwrap();
+    assert_eq!(rows.len(), 2, "two rows expected, got: {rows:?}");
+    let first: f64 = rows[0]
+        .parse()
+        .unwrap_or_else(|_| panic!("distance must be numeric, got: {rows:?}"));
+    let second: f64 = rows[1]
+        .parse()
+        .unwrap_or_else(|_| panic!("distance must be numeric, got: {rows:?}"));
+    assert!(
+        first <= second,
+        "distance must be ordered nearest-first, got: {rows:?}"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn outer_order_by_vector_distance_without_index_stays_consistent() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION vec_no_index").await.unwrap();
+    for (id, v) in [
+        ("r0", [0.10f32, 0.20, 0.30, 0.40]),
+        ("r1", [0.11, 0.21, 0.31, 0.41]),
+    ] {
+        server
+            .exec(&format!(
+                "INSERT INTO vec_no_index (id, embedding) VALUES ('{id}', ARRAY[{},{},{},{}])",
+                v[0], v[1], v[2], v[3]
+            ))
+            .await
+            .unwrap();
+    }
+
+    // The no-index negative case: the sort-trigger rewrite does not consult
+    // the index, so the derived table must either serve numeric distances
+    // (brute force) or refuse the statement outright. The only wrong outcome
+    // is a declared `distance` column with silent NULL cells (schema-vs-row
+    // skew), so a success must carry a value per row.
+    let result = server
+        .query_text(
+            "SELECT s.distance FROM \
+             (SELECT * FROM vec_no_index \
+              ORDER BY vector_distance(embedding, ARRAY[0.1, 0.2, 0.3, 0.4]) LIMIT 2) s",
+        )
+        .await;
+    match result {
+        Ok(rows) => assert!(
+            rows.iter().all(|row| row.parse::<f64>().is_ok()),
+            "distance cells must be numeric when the query succeeds, got: {rows:?}"
+        ),
+        Err(e) => assert!(
+            !e.to_string().is_empty(),
+            "a refusal must carry its reason, got an empty error"
+        ),
+    }
+}
diff --git a/nodedb/tests/wire/cases/sql_sequences.rs b/nodedb/tests/wire/cases/sql_sequences.rs
index a14daefa6..35a92699c 100644
--- a/nodedb/tests/wire/cases/sql_sequences.rs
+++ b/nodedb/tests/wire/cases/sql_sequences.rs
@@ -330,20 +330,32 @@ async fn two_row_collection_with_sequence(server: &TestServer, label: &str) -> (
     (sequence, collection)
 }
 
-/// `nextval` in a SELECT list over a FROM relation raises `0A000`
-/// (feature_not_supported). Per-row allocation is not implemented, and a
-/// silent NULL for every row is worse than the refusal.
+/// A bare `nextval` in a SELECT list over a FROM relation is stamped at the
+/// response boundary: one consecutive value per emitted row, in output order.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn nextval_in_a_select_list_over_a_scan_is_refused() {
+async fn nextval_in_a_select_list_over_a_scan_allocates_per_row() {
     let server = TestServer::start().await;
     let (sequence, collection) = two_row_collection_with_sequence(&server, "nextval").await;
 
-    server
-        .expect_error(
-            &format!("SELECT nextval('{sequence}') FROM {collection}"),
-            "0A000",
-        )
-        .await;
+    let rows = server
+        .query_text(&format!(
+            "SELECT nextval('{sequence}') FROM {collection} ORDER BY id"
+        ))
+        .await
+        .expect("per-row nextval over a scan must return the stamped values");
+    assert_eq!(
+        rows,
+        vec!["1".to_string(), "2".to_string()],
+        "one consecutive value per emitted row"
+    );
+
+    // The next allocation continues the sequence, proving the statement
+    // consumed exactly the two values it emitted.
+    let next = server
+        .query_text(&format!("SELECT nextval('{sequence}')"))
+        .await
+        .unwrap();
+    assert_eq!(next, vec!["3".to_string()], "two rows consumed two values");
 }
 
 /// `currval` in a SELECT list over a FROM relation raises `0A000`, the same
@@ -365,20 +377,27 @@ async fn currval_in_a_select_list_over_a_scan_is_refused() {
         .await;
 }
 
-/// A projection mixing a plain column with a sequence accessor is refused as
-/// a whole. Returning the column and a NULL beside it would ship the silent
-/// cell this refusal exists to prevent.
+/// A projection mixing a plain column with a sequence accessor ships the real
+/// column value beside a real stamp, never an empty cell.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn a_projection_mixing_a_column_and_an_accessor_is_refused() {
+async fn a_projection_mixing_a_column_and_an_accessor_stamps_the_accessor() {
     let server = TestServer::start().await;
     let (sequence, collection) = two_row_collection_with_sequence(&server, "mixed").await;
 
-    server
-        .expect_error(
-            &format!("SELECT id, nextval('{sequence}') FROM {collection}"),
-            "0A000",
-        )
-        .await;
+    let rows = server
+        .query_rows(&format!(
+            "SELECT id, nextval('{sequence}') FROM {collection} ORDER BY id"
+        ))
+        .await
+        .expect("a mixed projection must run");
+    assert_eq!(
+        rows,
+        vec![
+            vec!["1".to_string(), "1".to_string()],
+            vec!["2".to_string(), "2".to_string()],
+        ],
+        "the plain column and the stamp travel together"
+    );
 }
 
 /// A sequence accessor in a WHERE clause over a FROM relation is refused for
@@ -396,33 +415,95 @@ async fn a_sequence_accessor_in_a_where_clause_is_refused() {
         .await;
 }
 
-/// The refusal yields no result set at all, so no row can carry an empty or
-/// NULL cell, and the statement allocates nothing from the sequence.
+/// Two `nextval` calls in one FROM-less SELECT allocate the next two values,
+/// and each keeps its own cell even though both output columns share a name.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn a_refused_accessor_produces_no_row_and_no_allocation() {
+async fn two_nextvals_in_one_select_each_keep_their_cell() {
     let server = TestServer::start().await;
-    let (sequence, collection) = two_row_collection_with_sequence(&server, "guard").await;
+    server
+        .exec("CREATE SEQUENCE seq_two_nextval")
+        .await
+        .unwrap();
 
-    let result = server
-        .query_text(&format!("SELECT nextval('{sequence}') FROM {collection}"))
+    let rows = server
+        .query_rows("SELECT nextval('seq_two_nextval'), nextval('seq_two_nextval')")
+        .await
+        .expect("two from-less nextvals must each return");
+    assert_eq!(
+        rows,
+        vec![vec!["1".to_string(), "2".to_string()]],
+        "each nextval call owns its cell"
+    );
+}
+
+/// A per-row `nextval` stamp updates the session's `currval`, so a later
+/// `currval` answers with the last stamped value — the PostgreSQL contract.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_per_row_stamp_updates_the_session_currval() {
+    let server = TestServer::start().await;
+    let (sequence, collection) = two_row_collection_with_sequence(&server, "stamp_currval").await;
+
+    let stamped = server
+        .query_text(&format!(
+            "SELECT nextval('{sequence}') FROM {collection} ORDER BY id"
+        ))
+        .await
+        .unwrap();
+    assert_eq!(stamped, vec!["1".to_string(), "2".to_string()]);
+
+    let currval = server
+        .query_text(&format!("SELECT currval('{sequence}')"))
+        .await
+        .unwrap();
+    assert_eq!(
+        currval,
+        vec!["2".to_string()],
+        "currval must echo the last per-row stamp"
+    );
+}
+
+/// An unknown sequence in a per-row projection is an undefined object
+/// (`42704`), never an internal fault (`XX000`) and never a silent success.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn an_unknown_sequence_in_a_select_list_raises_42704() {
+    let server = TestServer::start().await;
+    let (_sequence, collection) = two_row_collection_with_sequence(&server, "unknown").await;
+
+    server
+        .expect_error(
+            &format!("SELECT nextval('seq_never_created') FROM {collection}"),
+            "42704",
+        )
         .await;
-    let message = match result {
-        Ok(rows) => panic!("per-row nextval must not return rows, got {rows:?}"),
-        Err(message) => message,
-    };
-    assert!(
-        message.contains("0A000"),
-        "refusal must carry SQLSTATE 0A000, got: {message}"
+}
+
+/// A filter shrinks the stamped row set: only emitted rows consume a value,
+/// and no emitted cell is empty.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_filtered_scan_consumes_only_emitted_rows() {
+    let server = TestServer::start().await;
+    let (sequence, collection) = two_row_collection_with_sequence(&server, "guard").await;
+
+    let rows = server
+        .query_text(&format!(
+            "SELECT nextval('{sequence}') FROM {collection} WHERE id = 2"
+        ))
+        .await
+        .expect("a filtered per-row nextval must return the stamped value");
+    assert_eq!(
+        rows,
+        vec!["1".to_string()],
+        "one emitted row consumed one value, got {rows:?}"
     );
 
-    // A refused statement consumes nothing, so the first real allocation is 1.
-    let first = server
+    // The un-emitted row consumed nothing, so the next allocation is 2.
+    let next = server
         .query_text(&format!("SELECT nextval('{sequence}')"))
         .await
         .unwrap();
     assert_eq!(
-        first,
-        vec!["1".to_string()],
-        "the refused statement must not have allocated, got {first:?}"
+        next,
+        vec!["2".to_string()],
+        "the filtered-out row must not have allocated, got {next:?}"
     );
 }
diff --git a/nodedb/tests/wire/cases/sql_window_functions.rs b/nodedb/tests/wire/cases/sql_window_functions.rs
index 31f08bfc8..4208fa108 100644
--- a/nodedb/tests/wire/cases/sql_window_functions.rs
+++ b/nodedb/tests/wire/cases/sql_window_functions.rs
@@ -416,3 +416,126 @@ async fn window_offset_over_expression_argument_returns_previous_evaluated_value
         );
     }
 }
+
+// ── window functions over a DERIVED table ──
+//
+// A derived-table body that is itself a plain Scan (e.g. `SELECT * FROM s`)
+// inlines through the CTE path, where the outer window spec was previously
+// dropped in favour of the inner scan's (empty) window list — every window
+// column answered NULL. These lock in the carriage AND the values.
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn derived_table_window_sum_returns_values_not_null() {
+    let server = TestServer::start().await;
+    setup_numbered_rows(&server).await;
+
+    let rows = server
+        .query_rows(
+            "SELECT id, SUM(n) OVER (ORDER BY n) AS s \
+             FROM (SELECT * FROM s) d ORDER BY n",
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(rows.len(), 5, "expected 5 rows: {rows:?}");
+    for (i, row) in rows.iter().enumerate() {
+        let s = row.get(1).cloned().unwrap_or_default();
+        assert!(
+            !s.is_empty() && s.to_lowercase() != "null",
+            "SUM window dropped at row {i}: {row:?}"
+        );
+    }
+
+    let got = parse_f64s(&rows, 1);
+    let want = [1.0, 3.0, 6.0, 10.0, 15.0];
+    for (i, (g, w)) in got.iter().zip(want.iter()).enumerate() {
+        assert!(
+            (g - w).abs() < 1e-9,
+            "derived SUM[{i}] = {g}, want {w}; rows = {rows:?}"
+        );
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn derived_table_window_row_number_orders_correctly() {
+    let server = TestServer::start().await;
+    setup_numbered_rows(&server).await;
+
+    let rows = server
+        .query_rows(
+            "SELECT id, row_number() OVER (ORDER BY n) AS rn \
+             FROM (SELECT * FROM s) d ORDER BY n",
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(rows.len(), 5, "expected 5 rows: {rows:?}");
+    for (i, row) in rows.iter().enumerate() {
+        let rn = row.get(1).cloned().unwrap_or_default();
+        assert!(
+            !rn.is_empty() && rn.to_lowercase() != "null",
+            "row_number dropped at row {i}: {row:?}"
+        );
+    }
+
+    let got = parse_f64s(&rows, 1);
+    let want = [1.0, 2.0, 3.0, 4.0, 5.0];
+    for (i, (g, w)) in got.iter().zip(want.iter()).enumerate() {
+        assert!(
+            (g - w).abs() < 1e-9,
+            "derived row_number[{i}] = {g}, want {w}; rows = {rows:?}"
+        );
+    }
+}
+
+/// A tagged cell must survive window evaluation over a derived table.
+///
+/// The window path once round-tripped every row through JSON, where
+/// MessagePack binary has no representation: a `BYTES` cell came back as a
+/// base64 `String`. The text rendering is identical, so the skew only shows
+/// through an operator that reads the type — `length()` here (byte strings are
+/// not strings to it) — which must answer the same with and without a window
+/// alias beside the column.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn window_evaluation_preserves_tagged_cells() {
+    let server = TestServer::start().await;
+    server
+        .exec("CREATE COLLECTION win_tagged (id STRING PRIMARY KEY, b BYTES) TYPE DOCUMENT STRICT")
+        .await
+        .unwrap();
+    server
+        .exec("INSERT INTO win_tagged (id, b) VALUES ('a', X'0102'), ('b', X'030405')")
+        .await
+        .unwrap();
+
+    // Reference rendering: no window alias anywhere in the query.
+    let plain = server
+        .query_rows("SELECT b, length(b) FROM win_tagged ORDER BY id")
+        .await
+        .unwrap();
+
+    // The same cells now pass through window evaluation: the derived table
+    // carries a `row_number()` alias, so every row is decoded and re-encoded.
+    let windowed = server
+        .query_rows(
+            "SELECT b, length(b) FROM \
+             (SELECT id, b, row_number() OVER (ORDER BY id) AS rn FROM win_tagged) s \
+             ORDER BY id",
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(
+        windowed, plain,
+        "a cell beside a window alias must keep its type; plain = {plain:?}"
+    );
+    let first = plain
+        .first()
+        .and_then(|row| row.first())
+        .cloned()
+        .unwrap_or_default();
+    assert!(
+        first.to_lowercase().contains("aqi") && !first.contains('['),
+        "expected the base64 rendering of X'0102', got {first:?}"
+    );
+}