From b755f22f9674d7feecb94fa655de3372ab452142 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Wed, 21 Oct 2026 06:21:52 +0800
Subject: [PATCH 01/24] feat(graph): batch edge inserts and deletes in one
 statement

A loader with N edges sent one GRAPH INSERT EDGE or GRAPH DELETE EDGE per
edge. Each cost a round trip and its own Calvin transaction.

GRAPH INSERT EDGES and GRAPH DELETE EDGES now carry the edges of one
statement in a VALUES list. The handler builds one task with every edge
and submits it as one sequenced Calvin transaction. The submit path
already slices a batch per home pair and sums the owned-edge counts
(edge_slices, ReplyFold::SumOwnedEdges). Every edge lands or none does.
A deadline that ends the wait leaves an unknown but all-or-nothing
outcome, and a retry is idempotent.

Surrogates for all endpoints of a statement are assigned with one
assign_surrogates_routed call.

Write policy is evaluated per edge with resolve_edge_write_rls. A delete
under a write policy keeps the per-edge path: the allowed edges apply,
the denied edge stays, and the statement returns an error. A batch inside
a transaction block validates the whole list before it stages any tuple.

The bounds are protocol constants, MAX_EDGES_PER_BATCH_STATEMENT and
MAX_BATCH_TEXT_BYTES, so the parser and the client agree: 1000 edges or
1 MiB of SQL text, whichever the statement crosses first. The error names
the limit.
---
 nodedb-sql/src/ddl_ast/graph_parse/cursor.rs  |   6 +
 nodedb-sql/src/ddl_ast/graph_parse/entry.rs   | 128 ++++++-
 nodedb-sql/src/ddl_ast/graph_parse/mod.rs     |   8 +
 .../src/ddl_ast/graph_parse/variants.rs       | 117 ++++++
 nodedb-sql/src/ddl_ast/graph_types.rs         |   9 +
 nodedb-sql/src/ddl_ast/mod.rs                 |   2 +-
 nodedb-sql/src/ddl_ast/statement/mod.rs       |   2 +-
 .../src/ddl_ast/statement/types/graph.rs      |  18 +-
 nodedb-types/src/protocol/batch.rs            |  16 +
 nodedb-types/src/protocol/mod.rs              |   2 +-
 .../shared/ddl/neutral/graph_ops/dispatch.rs  |  10 +-
 .../shared/ddl/neutral/graph_ops/edge.rs      |  15 +-
 .../ddl/neutral/graph_ops/edge_batch.rs       | 359 ++++++++++++++++++
 .../neutral/graph_ops/edge_batch_resolve.rs   | 349 +++++++++++++++++
 .../shared/ddl/neutral/graph_ops/mod.rs       |   2 +
 15 files changed, 1035 insertions(+), 8 deletions(-)
 create mode 100644 nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
 create mode 100644 nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs

diff --git a/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs b/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs
index 40ad8c061..6c51bee5d 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs
@@ -65,6 +65,12 @@ impl<'t, 'a> Cursor<'t, 'a> {
         }
     }
 
+    /// The tokens not yet consumed.
+    pub(super) fn rest(&self) -> &'t [Tok<'a>] {
+        let toks: &'t [Tok<'a>] = self.toks;
+        toks.get(self.pos..).unwrap_or_default()
+    }
+
     /// Consume the next token when it is the bare word `keyword`.
     pub(super) fn eat_keyword(&mut self, keyword: &str) -> bool {
         let hit =
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/entry.rs b/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
index 151946d4e..b02095679 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
@@ -62,7 +62,11 @@ fn parse_graph(sql: &str) -> Result<NodedbStatement, SqlError> {
         });
     }
 
-    if upper.starts_with("GRAPH INSERT EDGE ") {
+    if upper.starts_with("GRAPH INSERT EDGES ") {
+        variants::parse_insert_edges(&toks, sql.len())
+    } else if upper.starts_with("GRAPH DELETE EDGES ") {
+        variants::parse_delete_edges(&toks, sql.len())
+    } else if upper.starts_with("GRAPH INSERT EDGE ") {
         variants::parse_insert_edge(&toks)
     } else if upper.starts_with("GRAPH DELETE EDGE ") {
         variants::parse_delete_edge(&toks)
@@ -88,7 +92,13 @@ fn parse_graph(sql: &str) -> Result<NodedbStatement, SqlError> {
 /// The command words of a `GRAPH` statement, for an error message:
 /// `GRAPH NEIGHBORS`, `GRAPH INSERT EDGE`, `GRAPH RAG FUSION`.
 fn graph_command(upper: &str) -> String {
-    const MULTI_WORD: [&str; 3] = ["GRAPH INSERT EDGE", "GRAPH DELETE EDGE", "GRAPH RAG FUSION"];
+    const MULTI_WORD: [&str; 5] = [
+        "GRAPH INSERT EDGES",
+        "GRAPH DELETE EDGES",
+        "GRAPH INSERT EDGE",
+        "GRAPH DELETE EDGE",
+        "GRAPH RAG FUSION",
+    ];
     if let Some(command) = MULTI_WORD.iter().find(|c| upper.starts_with(*c)) {
         return (*command).to_owned();
     }
@@ -151,6 +161,120 @@ mod tests {
         }
     }
 
+    #[test]
+    fn parse_graph_insert_edges_batch() {
+        let stmt =
+            parsed("GRAPH INSERT EDGES IN 'edges' VALUES ('a','b','CALLS'), ('c','d','IMPORTS')");
+        match stmt {
+            NodedbStatement::Graph(GraphStmt::GraphInsertEdges { collection, edges }) => {
+                assert_eq!(collection, "edges");
+                assert_eq!(edges.len(), 2);
+                assert_eq!(edges[0].src, "a");
+                assert_eq!(edges[0].dst, "b");
+                assert_eq!(edges[0].label, "CALLS");
+                assert_eq!(edges[1].src, "c");
+                assert_eq!(edges[1].label, "IMPORTS");
+            }
+            other => panic!("expected GraphInsertEdges, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn parse_graph_delete_edges_batch_accepts_bare_words() {
+        let stmt = parsed("GRAPH DELETE EDGES IN 'edges' VALUES (a, b, CALLS)");
+        match stmt {
+            NodedbStatement::Graph(GraphStmt::GraphDeleteEdges { collection, edges }) => {
+                assert_eq!(collection, "edges");
+                assert_eq!(edges.len(), 1);
+                assert_eq!(edges[0].src, "a");
+                assert_eq!(edges[0].dst, "b");
+                assert_eq!(edges[0].label, "CALLS");
+            }
+            other => panic!("expected GraphDeleteEdges, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn batch_edge_cap_is_enforced() {
+        let mut sql = String::from("GRAPH INSERT EDGES IN 'edges' VALUES ");
+        for i in 0..=variants::MAX_EDGES_PER_BATCH {
+            if i > 0 {
+                sql.push(',');
+            }
+            sql.push_str(&format!("('s{i}','d{i}','L')"));
+        }
+        let error = try_parse(&sql)
+            .expect("input is graph DSL")
+            .expect_err("a batch over the cap must not produce a statement");
+        assert!(
+            error.to_string().contains("at most 1000 edges"),
+            "the error must name the cap: {error}"
+        );
+    }
+
+    #[test]
+    fn batch_edge_text_cap_is_enforced_before_the_count_cap() {
+        // Three edges, far below the 1000-edge cap, but the field values are
+        // long enough to push the statement past 1 MiB. The text cap must be
+        // what rejects it, since the count says nothing about the work.
+        let long = "x".repeat(400 * 1024);
+        let sql = format!(
+            "GRAPH INSERT EDGES IN 'edges' VALUES ('{long}','{long}','L'), \
+             ('{long}','{long}','L'), ('{long}','{long}','L')"
+        );
+        assert!(
+            sql.len() > variants::MAX_BATCH_TEXT_BYTES,
+            "the fixture must exceed the text cap, was {} bytes",
+            sql.len()
+        );
+        let error = try_parse(&sql)
+            .expect("input is graph DSL")
+            .expect_err("a batch over the text cap must not produce a statement");
+        assert!(
+            error.to_string().contains("bytes of SQL text"),
+            "the error must name the text cap: {error}"
+        );
+    }
+
+    #[test]
+    fn batch_edge_at_the_text_cap_is_accepted() {
+        // The cap is a maximum, not an exclusive bound: a statement exactly at
+        // it must still parse. Built by padding the collection name, which is a
+        // single quoted field.
+        let base = "GRAPH INSERT EDGES IN '' VALUES ('a','b','L')";
+        let pad = variants::MAX_BATCH_TEXT_BYTES - base.len();
+        let sql = format!(
+            "GRAPH INSERT EDGES IN '{}' VALUES ('a','b','L')",
+            "c".repeat(pad)
+        );
+        assert_eq!(sql.len(), variants::MAX_BATCH_TEXT_BYTES);
+        try_parse(&sql)
+            .expect("input is graph DSL")
+            .expect("a statement exactly at the text cap must parse");
+    }
+
+    #[test]
+    fn batch_edge_rejects_malformed_triples() {
+        let error = try_parse("GRAPH INSERT EDGES IN 'edges' VALUES ('a','b')")
+            .expect("input is graph DSL")
+            .expect_err("a partial triple must not produce a statement");
+        assert!(
+            error.to_string().contains("triples"),
+            "the error must name the tuple shape: {error}"
+        );
+    }
+
+    #[test]
+    fn batch_edge_rejects_per_edge_properties() {
+        let error = try_parse("GRAPH INSERT EDGES IN 'edges' VALUES ('a','b','L') PROPERTIES '{}'")
+            .expect("input is graph DSL")
+            .expect_err("per-edge PROPERTIES is not supported in the batch form");
+        assert!(
+            error.to_string().contains("PROPERTIES"),
+            "the error must name the rejected clause: {error}"
+        );
+    }
+
     /// A missing required clause is a malformed graph statement, not a
     /// non-graph one. `None` here would send it to the SQL parser, which
     /// reports only that `GRAPH` is not SQL.
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/mod.rs b/nodedb-sql/src/ddl_ast/graph_parse/mod.rs
index fcd635068..7d8fdd05f 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/mod.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/mod.rs
@@ -17,6 +17,14 @@
 //! required clause that is absent, or a clause value outside its own
 //! vocabulary, means no statement reaches the boundary at all. Both are
 //! reported as a parse error naming what is wrong.
+//!
+//! Accepted-grammar limitation for the batched edge statements: the tokenizer
+//! drops `(`, `)`, and `,`, so `GRAPH INSERT EDGES` reads the `VALUES` tail as
+//! a flat field list and only checks that its length is a multiple of three.
+//! `VALUES ('a','b','L'), ('c','d','L')` and `VALUES ('a','b','L')
+//! ('c','d','L')` produce the same two triples, and a trailing token is read as
+//! another triple's field rather than rejected. Closing that needs a tokenizer
+//! change, so it is tracked as a follow-up rather than fixed here.
 
 mod cursor;
 mod edge_predicate;
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/variants.rs b/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
index 58697687f..7488e8259 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
@@ -14,6 +14,7 @@ use super::{
     fusion_params::{FusionParams, RAG_FUSION_KEYWORDS},
     tokenizer::Tok,
 };
+use crate::ddl_ast::graph_types::GraphEdgeTuple;
 use crate::error::SqlError;
 use nodedb_types::filter::MetadataFilter;
 
@@ -42,6 +43,122 @@ pub(super) fn parse_insert_edge(toks: &[Tok<'_>]) -> Result<NodedbStatement, Sql
     }))
 }
 
+/// Maximum number of edges one batch statement may carry. Keeps one
+/// statement's worth of work bounded for the write-admission and lock paths.
+///
+/// Sourced from the protocol bound so the client cannot hold a different
+/// number: both sides read the one constant.
+pub const MAX_EDGES_PER_BATCH: usize = nodedb_types::protocol::MAX_EDGES_PER_BATCH_STATEMENT;
+
+/// Maximum SQL text one batch statement may carry.
+///
+/// The edge count alone does not bound the work: a triple's fields are
+/// arbitrary quoted strings, so 1000 triples of long node ids run to many
+/// megabytes. Whichever limit the statement exceeds first is the one reported.
+pub const MAX_BATCH_TEXT_BYTES: usize = nodedb_types::protocol::MAX_BATCH_TEXT_BYTES;
+
+pub(super) fn parse_insert_edges(
+    toks: &[Tok<'_>],
+    sql_len: usize,
+) -> Result<NodedbStatement, SqlError> {
+    let (collection, edges) = parse_edge_batch(toks, sql_len, "GRAPH INSERT EDGES")?;
+    Ok(NodedbStatement::Graph(GraphStmt::GraphInsertEdges {
+        collection,
+        edges,
+    }))
+}
+
+pub(super) fn parse_delete_edges(
+    toks: &[Tok<'_>],
+    sql_len: usize,
+) -> Result<NodedbStatement, SqlError> {
+    let (collection, edges) = parse_edge_batch(toks, sql_len, "GRAPH DELETE EDGES")?;
+    Ok(NodedbStatement::Graph(GraphStmt::GraphDeleteEdges {
+        collection,
+        edges,
+    }))
+}
+
+/// Shared body of the batch parsers.
+///
+/// Grammar: `IN '<collection>' VALUES ('<src>','<dst>','<label>')[, (...)]*`.
+/// The tokenizer drops commas and parentheses, so the tuple structure is
+/// recovered by consuming value tokens in threes. A count that is not a
+/// multiple of three is malformed. Per-edge `PROPERTIES` stays on the
+/// single-edge form until the physical `BatchEdge` can carry one.
+///
+/// `sql_len` is the length of the statement's own text, which the caller
+/// measures before tokenizing because the tokenizer discards the separators.
+fn parse_edge_batch(
+    toks: &[Tok<'_>],
+    sql_len: usize,
+    stmt: &'static str,
+) -> Result<(String, Vec<GraphEdgeTuple>), SqlError> {
+    // Bounded first: the field scan below clones every value, and a statement
+    // over the cap must not pay for that copy before it is refused.
+    if sql_len > MAX_BATCH_TEXT_BYTES {
+        return Err(SqlError::Parse {
+            detail: format!(
+                "{stmt}: at most {MAX_BATCH_TEXT_BYTES} bytes of SQL text per statement, got \
+                 {sql_len}"
+            ),
+        });
+    }
+    let mut c = Cursor::new(toks, stmt, 3);
+    if !c.eat_keyword("IN") {
+        return Err(missing_clause(stmt, "IN <collection>"));
+    }
+    let collection = c.value("IN")?;
+    if !c.eat_keyword("VALUES") {
+        return Err(missing_clause(stmt, "VALUES ('<src>','<dst>','<label>')"));
+    }
+    let mut fields: Vec<String> = Vec::new();
+    for t in c.rest() {
+        match t {
+            Tok::Quoted(s) | Tok::Ident(s) => fields.push(s.clone().into_owned()),
+            Tok::Word(w) => {
+                if w.eq_ignore_ascii_case("PROPERTIES") {
+                    return Err(SqlError::Parse {
+                        detail: format!(
+                            "{stmt}: per-edge PROPERTIES is not supported in the batch form"
+                        ),
+                    });
+                }
+                fields.push((*w).to_string());
+            }
+            Tok::Object(_) | Tok::List(_) => {
+                return Err(SqlError::Parse {
+                    detail: format!(
+                        "{stmt}: object and list literals are not supported in the batch form"
+                    ),
+                });
+            }
+        }
+    }
+    if fields.is_empty() || !fields.len().is_multiple_of(3) {
+        return Err(SqlError::Parse {
+            detail: format!("{stmt}: VALUES takes (src, dst, label) triples"),
+        });
+    }
+    let count = fields.len() / 3;
+    if count > MAX_EDGES_PER_BATCH {
+        return Err(SqlError::Parse {
+            detail: format!(
+                "{stmt}: at most {MAX_EDGES_PER_BATCH} edges per statement, got {count}"
+            ),
+        });
+    }
+    let edges = fields
+        .chunks(3)
+        .map(|c| GraphEdgeTuple {
+            src: c[0].clone(),
+            dst: c[1].clone(),
+            label: c[2].clone(),
+        })
+        .collect();
+    Ok((collection, edges))
+}
+
 /// Parse `GRAPH DELETE EDGE IN <c> FROM <a> TO <b> TYPE <l>`.
 pub(super) fn parse_delete_edge(toks: &[Tok<'_>]) -> Result<NodedbStatement, SqlError> {
     const STMT: &str = "GRAPH DELETE EDGE";
diff --git a/nodedb-sql/src/ddl_ast/graph_types.rs b/nodedb-sql/src/ddl_ast/graph_types.rs
index eeed925c8..27864a2a4 100644
--- a/nodedb-sql/src/ddl_ast/graph_types.rs
+++ b/nodedb-sql/src/ddl_ast/graph_types.rs
@@ -27,3 +27,12 @@ pub enum GraphProperties {
     /// expected to already be a JSON document.
     Quoted(String),
 }
+
+/// One `(src, dst, label)` triple inside a batched edge statement
+/// (`GRAPH INSERT EDGES` / `GRAPH DELETE EDGES`).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct GraphEdgeTuple {
+    pub src: String,
+    pub dst: String,
+    pub label: String,
+}
diff --git a/nodedb-sql/src/ddl_ast/mod.rs b/nodedb-sql/src/ddl_ast/mod.rs
index ceaf0dace..96c23d3bd 100644
--- a/nodedb-sql/src/ddl_ast/mod.rs
+++ b/nodedb-sql/src/ddl_ast/mod.rs
@@ -24,7 +24,7 @@ pub use alter_ops::{
 };
 pub use collection_type::build_collection_type;
 pub use graph_parse::{FusionParams, parse_search_using_fusion};
-pub use graph_types::{GraphDirection, GraphProperties};
+pub use graph_types::{GraphDirection, GraphEdgeTuple, GraphProperties};
 pub use nodedb_types::QuotaSpec;
 pub use nodedb_types::{MirrorMode, MirrorStatus};
 pub use parse::parse;
diff --git a/nodedb-sql/src/ddl_ast/statement/mod.rs b/nodedb-sql/src/ddl_ast/statement/mod.rs
index 2aa165bf1..33c50d9e2 100644
--- a/nodedb-sql/src/ddl_ast/statement/mod.rs
+++ b/nodedb-sql/src/ddl_ast/statement/mod.rs
@@ -17,4 +17,4 @@ pub use wrapper::*;
 // Cross-module re-exports preserved at the `statement::` path for
 // callers that imported these types via the pre-split surface.
 pub use super::alter_ops::{AlterCollectionOp, AlterRoleOp, AlterUserOp};
-pub use super::graph_types::{GraphDirection, GraphProperties};
+pub use super::graph_types::{GraphDirection, GraphEdgeTuple, GraphProperties};
diff --git a/nodedb-sql/src/ddl_ast/statement/types/graph.rs b/nodedb-sql/src/ddl_ast/statement/types/graph.rs
index a84aa8fda..d1b26b38a 100644
--- a/nodedb-sql/src/ddl_ast/statement/types/graph.rs
+++ b/nodedb-sql/src/ddl_ast/statement/types/graph.rs
@@ -2,7 +2,7 @@
 
 //! Graph DDL/DML statements.
 
-use crate::ddl_ast::graph_types::{GraphDirection, GraphProperties};
+use crate::ddl_ast::graph_types::{GraphDirection, GraphEdgeTuple, GraphProperties};
 
 #[derive(Debug, Clone, PartialEq)]
 pub enum GraphStmt {
@@ -20,6 +20,22 @@ pub enum GraphStmt {
         dst: String,
         label: String,
     },
+    /// Batched edge insert: one statement carries many property-less
+    /// `(src, dst, label)` triples in one round trip.
+    ///
+    /// The batch is deliberately property-less for now: the physical
+    /// `BatchEdge` carries no property object, so per-edge `PROPERTIES`
+    /// stays on the single-edge form until `BatchEdge` grows one
+    ///
+    GraphInsertEdges {
+        collection: String,
+        edges: Vec<GraphEdgeTuple>,
+    },
+    /// Batched edge delete, the delete-side twin of [`GraphInsertEdges`].
+    GraphDeleteEdges {
+        collection: String,
+        edges: Vec<GraphEdgeTuple>,
+    },
     GraphSetLabels {
         node_id: String,
         labels: Vec<String>,
diff --git a/nodedb-types/src/protocol/batch.rs b/nodedb-types/src/protocol/batch.rs
index bb2329769..198f1bcdd 100644
--- a/nodedb-types/src/protocol/batch.rs
+++ b/nodedb-types/src/protocol/batch.rs
@@ -6,6 +6,22 @@ use serde::{Deserialize, Serialize};
 
 use crate::json_msgpack::JsonValue;
 
+/// Most edges one batch statement may carry.
+///
+/// A protocol-level bound, so the client and the statement parser agree by
+/// construction rather than by two copies of the number happening to match.
+/// The server enforces it; the client checks it first so an oversized batch
+/// fails with the limit named instead of a round trip and a parse error.
+pub const MAX_EDGES_PER_BATCH_STATEMENT: usize = 1000;
+
+/// Most SQL text one batch statement may carry, in bytes.
+///
+/// The edge count alone does not bound the work: a triple's fields are
+/// arbitrary quoted strings, so a handful of edges with long node ids is far
+/// larger than a thousand short ones. Whichever limit the statement exceeds
+/// first is the one reported.
+pub const MAX_BATCH_TEXT_BYTES: usize = 1 << 20;
+
 /// A single vector in a batch insert.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct BatchVector {
diff --git a/nodedb-types/src/protocol/mod.rs b/nodedb-types/src/protocol/mod.rs
index b5f74f319..45b3f3837 100644
--- a/nodedb-types/src/protocol/mod.rs
+++ b/nodedb-types/src/protocol/mod.rs
@@ -12,7 +12,7 @@ pub mod text_fields;
 
 pub use array_batch::{ArrayCellWrite, ArrayPutBatch};
 pub use auth::{AuthMethod, AuthResponse};
-pub use batch::{BatchDocument, BatchVector};
+pub use batch::{BatchDocument, BatchVector, MAX_BATCH_TEXT_BYTES, MAX_EDGES_PER_BATCH_STATEMENT};
 pub use error_cause::ErrorCausePayload;
 pub use frames::{ErrorPayload, NativeRequest, NativeResponse};
 pub use handshake::{
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/dispatch.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/dispatch.rs
index 8093d91d9..745df9683 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/dispatch.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/dispatch.rs
@@ -10,7 +10,7 @@ use crate::control::state::SharedState;
 use crate::types::DatabaseId;
 
 use super::super::super::result::{DdlError, DdlResult};
-use super::{algo, edge, rag_fusion, stats, traverse};
+use super::{algo, edge, edge_batch, rag_fusion, stats, traverse};
 
 /// Dispatch a parsed graph-overlay variant to its handler.
 ///
@@ -71,6 +71,14 @@ pub async fn dispatch_graph(
             )
             .await,
         ),
+        NodedbStatement::Graph(GraphStmt::GraphInsertEdges { collection, edges }) => Some(
+            edge_batch::insert_edges(state, identity, database_id, collection, edges, txn_ctx)
+                .await,
+        ),
+        NodedbStatement::Graph(GraphStmt::GraphDeleteEdges { collection, edges }) => Some(
+            edge_batch::delete_edges(state, identity, database_id, collection, edges, txn_ctx)
+                .await,
+        ),
         NodedbStatement::Graph(GraphStmt::GraphSetLabels {
             node_id,
             labels,
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge.rs
index d35a9ca20..7cde42135 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge.rs
@@ -26,8 +26,21 @@ use super::support::{data_plane_verdict, ddl_err};
 /// Read the affected count off a Data-Plane response. A missing count is an
 /// error, never a default.
 fn response_affected(response: &crate::bridge::envelope::Response) -> Result<u64, DdlError> {
+    affected_count(response, "edge write")
+}
+
+/// Read the affected count off a Data-Plane response, naming the operation in
+/// the error. A batch statement sums one response per home, so it needs the
+/// same never-default rule as the single-edge form.
+pub(super) fn affected_count(
+    response: &crate::bridge::envelope::Response,
+    what: &str,
+) -> Result<u64, DdlError> {
     require_affected_count(response.payload.as_bytes()).map_err(|e| {
-        DdlError::from_error_in_context("edge write response is missing its affected count", &e)
+        DdlError::from_error_in_context(
+            &format!("{what} response is missing its affected count"),
+            &e,
+        )
     })
 }
 
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
new file mode 100644
index 000000000..ca101aed0
--- /dev/null
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
@@ -0,0 +1,359 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Batched edge mutation handlers: GRAPH INSERT EDGES, GRAPH DELETE EDGES.
+//!
+//! Split out of `edge.rs` to stay under the per-file line limit. Every triple is
+//! resolved (surrogates + write policy) on its own, then the batch is dispatched
+//! according to the route the process can serve:
+//!
+//!  * Calvin available: ONE Calvin tx class holding ONE `GraphOp::EdgePutBatch` /
+//!    `EdgeDeleteBatch` task that carries every edge, whatever their endpoint
+//!    homes. The submit path slices the task per `(src home, dst home)` pair
+//!    (`calvin::submit::edge_slices`), streams the slices as parts when one
+//!    sequencer entry cannot hold them, and sums the homes' owned-edge counts
+//!    (`ReplyFold::SumOwnedEdges`). The statement is one sequenced transaction:
+//!    every edge lands or none does, and a deadline that ends the wait leaves an
+//!    unknown but still all-or-nothing outcome. A retry is safe: a put
+//!    rewrites the same edge and a delete of an absent edge counts zero.
+//!  * No Calvin (standalone): one `EdgePutBatch` / `EdgeDeleteBatch` task per
+//!    source home, with the removed count summed across the buckets. Buckets
+//!    are applied one after another, so a batch over several homes is not
+//!    atomic on this route.
+
+use std::collections::BTreeMap;
+
+use nodedb_physical::physical_plan::{BatchEdge, GraphOp};
+use nodedb_physical::physical_task::{PhysicalTask, PostSetOp};
+use nodedb_sql::ddl_ast::{GraphEdgeTuple, GraphProperties};
+
+use crate::bridge::envelope::PhysicalPlan;
+use crate::bridge::envelope::Response;
+use crate::control::planner::calvin::{build_single_vshard_tx_class, submit_calvin_routed};
+use crate::control::security::identity::AuthenticatedIdentity;
+use crate::control::server::shared::session::{DmlTxnCtx, TransactionState};
+use crate::control::state::SharedState;
+use crate::types::{DatabaseId, TenantId, VShardId};
+
+use super::super::super::result::{DdlError, DdlResult};
+use super::edge::{EdgeRef, insert_edge};
+use super::support::{data_plane_verdict, ddl_err};
+
+/// `GRAPH INSERT EDGES IN '<collection>' VALUES ('<src>','<dst>','<label>'), ...`
+///
+/// Batched twin of [`insert_edge`]. One statement carries many property-less
+/// edges; each edge reuses the single-edge resolution, so surrogate assignment,
+/// RLS resolution, dual-home routing, and Calvin semantics stay identical to the
+/// singular form. See the module doc for which route the batch takes.
+///
+/// `rows_affected` is the number of edges the statement writes: the list after
+/// repeats are dropped. An insert cannot report fewer, because a put of an edge
+/// that already exists still writes it.
+pub async fn insert_edges(
+    state: &SharedState,
+    identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
+    collection: String,
+    edges: Vec<GraphEdgeTuple>,
+    txn_ctx: &DmlTxnCtx<'_>,
+) -> Result<Vec<DdlResult>, DdlError> {
+    validate_edge_batch(&collection, &edges, "GRAPH INSERT EDGES")?;
+    // Validate the whole list and drop repeats before a single tuple is staged.
+    // A rejection on a later tuple must not leave the tuples before it in the
+    // transaction's write set: the session stays in the block, so a later
+    // COMMIT would apply them. `rows_affected` then counts the edges the
+    // statement writes, not the triples it was given.
+    let mut edges = edges;
+    super::edge_batch_resolve::check_and_dedupe(&mut edges, "GRAPH INSERT EDGES")?;
+    let count = edges.len() as u64;
+    let tenant_id = identity.tenant_id;
+
+    // Inside a transaction, the staging overlay is per edge; keep the
+    // per-edge path so RYOW and rollback semantics stay identical.
+    if txn_ctx.sessions.transaction_state(txn_ctx.session_id) == TransactionState::InBlock {
+        for tuple in edges {
+            insert_edge(
+                state,
+                identity,
+                database_id,
+                EdgeRef {
+                    collection: collection.clone(),
+                    src: tuple.src,
+                    dst: tuple.dst,
+                    label: tuple.label,
+                },
+                GraphProperties::None,
+                txn_ctx,
+            )
+            .await?;
+        }
+        return Ok(vec![DdlResult::Status {
+            command: "INSERT EDGES".to_string(),
+            rows_affected: Some(count),
+        }]);
+    }
+
+    // One collection flag for the whole batch; the call is idempotent.
+    crate::control::planner::implicit_edges::mark_collection_edge_bearing(
+        state,
+        database_id,
+        tenant_id,
+        &collection,
+    )
+    .await
+    .map_err(|e| DdlError::from_error(&e))?;
+
+    let calvin_available =
+        state.cluster_transport.is_some() && state.sequencer_inbox.get().is_some();
+
+    // Resolve every edge (surrogates + write policy) before any task is built.
+    // Admission decides per edge, so a governed edge is refused with its own
+    // collection named rather than as an anonymous member of a batch.
+    let resolved = super::edge_batch_resolve::resolve_insert_edges(
+        state,
+        identity,
+        database_id,
+        &collection,
+        edges,
+    )
+    .await?;
+    let batch: Vec<BatchEdge> = resolved.batch;
+
+    if calvin_available {
+        let task = batch_task(
+            tenant_id,
+            database_id,
+            PhysicalPlan::Graph(GraphOp::EdgePutBatch { edges: batch }),
+        );
+        let response = submit_batch_tx(state, task, tenant_id).await?;
+        if let Some(response) = response {
+            data_plane_verdict(&response)?;
+        }
+    } else {
+        // Single-node: bucket by src home and dispatch one apply burst per
+        // home. A cross-shard edge is written by its src home, which writes
+        // both the forward and reverse rows locally.
+        let mut buckets: BTreeMap<u32, Vec<BatchEdge>> = BTreeMap::new();
+        for edge in batch {
+            buckets
+                .entry(VShardId::from_key(edge.src_id.as_bytes()).as_u32())
+                .or_default()
+                .push(edge);
+        }
+        for (vshard, group) in buckets {
+            let plan = PhysicalPlan::Graph(GraphOp::EdgePutBatch { edges: group });
+            let response =
+                crate::control::server::sync::raft_dispatch::dispatch_trusted_internal_sync_response(
+                    state,
+                    tenant_id,
+                    database_id,
+                    VShardId::new(vshard),
+                    plan,
+                    crate::event::EventSource::User,
+                )
+                .await
+                .map_err(|e| DdlError::from_error(&e))?;
+            data_plane_verdict(&response)?;
+        }
+    }
+
+    Ok(vec![DdlResult::Status {
+        command: "INSERT EDGES".to_string(),
+        rows_affected: Some(count),
+    }])
+}
+
+/// `GRAPH DELETE EDGES IN '<collection>' VALUES ('<src>','<dst>','<label>'), ...`
+///
+/// Batched twin of [`delete_edge`]. Every edge is resolved (surrogates + RLS)
+/// individually. The reported count is the Data Plane's own live-removal count:
+/// summed across the source-home buckets on the standalone route, and read from
+/// the tx class's summed owned-edge answer on the Calvin route, where
+/// the one home pair counts every edge of the statement. It is never the input
+/// length, because an absent edge (or a duplicate triple) tombstones nothing.
+/// See the module doc for which route the batch takes.
+pub async fn delete_edges(
+    state: &SharedState,
+    identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
+    collection: String,
+    mut edges: Vec<GraphEdgeTuple>,
+    txn_ctx: &DmlTxnCtx<'_>,
+) -> Result<Vec<DdlResult>, DdlError> {
+    validate_edge_batch(&collection, &edges, "GRAPH DELETE EDGES")?;
+    let tenant_id = identity.tenant_id;
+
+    super::edge_batch_resolve::check_and_dedupe(&mut edges, "GRAPH DELETE EDGES")?;
+
+    // Inside a transaction the staging overlay is per edge; keep the per-edge
+    // path so RYOW and rollback semantics stay identical. A delete's count is
+    // read from the staged result, so this path stays exact too.
+    if txn_ctx.sessions.transaction_state(txn_ctx.session_id) == TransactionState::InBlock {
+        let mut affected: u64 = 0;
+        for tuple in edges {
+            affected = affected.saturating_add(
+                super::edge_batch_resolve::delete_one_summing(
+                    state,
+                    identity,
+                    database_id,
+                    &collection,
+                    tuple.src,
+                    tuple.dst,
+                    tuple.label,
+                    txn_ctx,
+                )
+                .await?,
+            );
+        }
+        return Ok(vec![DdlResult::Status {
+            command: "DELETE EDGES".to_string(),
+            rows_affected: Some(affected),
+        }]);
+    }
+
+    // Calvin needs cluster mode with a wired sequencer; single-node already
+    // tombstones both EDGES and REVERSE_EDGES in one write per home.
+    let calvin_available =
+        state.cluster_transport.is_some() && state.sequencer_inbox.get().is_some();
+
+    // Resolve every edge (surrogates + RLS). An edge whose delete carries a
+    // compiled policy predicate cannot ride `BatchEdge` — that type has no
+    // write-gate slot — so it keeps the single-edge path, where the Data Plane
+    // decides the predicate against the stored image. Every other edge batches.
+    let resolved = super::edge_batch_resolve::resolve_delete_edges(
+        state,
+        identity,
+        database_id,
+        &collection,
+        edges,
+    )
+    .await?;
+    let batch: Vec<BatchEdge> = resolved.batch;
+    let governed: Vec<GraphEdgeTuple> = resolved.governed;
+
+    let mut removed: u64 = 0;
+
+    // Governed edges first, each through the single-edge path so a denial is
+    // reported per edge rather than silently bypassed by the batch plan.
+    for tuple in governed {
+        removed = removed.saturating_add(
+            super::edge_batch_resolve::delete_one_summing(
+                state,
+                identity,
+                database_id,
+                &collection,
+                tuple.src,
+                tuple.dst,
+                tuple.label,
+                txn_ctx,
+            )
+            .await?,
+        );
+    }
+
+    if calvin_available {
+        // Every edge may already have taken the governed per-edge route above,
+        // leaving nothing to batch. Building a tx class from an empty task list
+        // is `EmptyWriteSet`, which would report the statement as failed after
+        // those deletes already applied — and a write set is empty, not
+        // "written", so there is nothing to sequence.
+        if batch.is_empty() {
+            return Ok(vec![DdlResult::Status {
+                command: "DELETE EDGES".to_string(),
+                rows_affected: Some(removed),
+            }]);
+        }
+
+        let task = batch_task(
+            tenant_id,
+            database_id,
+            PhysicalPlan::Graph(GraphOp::EdgeDeleteBatch { edges: batch }),
+        );
+        let response = submit_batch_tx(state, task, tenant_id).await?;
+        let Some(response) = response else {
+            return Err(ddl_err(
+                "XX000",
+                "batch edge delete completed with no applied response to read its affected \
+                 count from",
+            ));
+        };
+        data_plane_verdict(&response)?;
+        removed =
+            removed.saturating_add(super::edge::affected_count(&response, "batch edge delete")?);
+    } else {
+        // Single-node: one apply burst per source home.
+        removed = removed.saturating_add(
+            super::edge_batch_resolve::dispatch_delete_batches_by_src_home(
+                state,
+                tenant_id,
+                database_id,
+                batch,
+            )
+            .await?,
+        );
+    }
+
+    Ok(vec![DdlResult::Status {
+        command: "DELETE EDGES".to_string(),
+        rows_affected: Some(removed),
+    }])
+}
+
+/// The one task of a batch's tx class. Its plan names every edge, so the
+/// plan's routing is the union of the edges' homes. `vshard_id` is only the
+/// first edge's source home: the submit path routes by the plan.
+fn batch_task(tenant_id: TenantId, database_id: DatabaseId, plan: PhysicalPlan) -> PhysicalTask {
+    let vshard_id = match &plan {
+        PhysicalPlan::Graph(GraphOp::EdgePutBatch { edges })
+        | PhysicalPlan::Graph(GraphOp::EdgeDeleteBatch { edges }) => {
+            edges.first().map_or(VShardId::new(0), |e| {
+                VShardId::from_key(e.src_id.as_bytes())
+            })
+        }
+        _ => VShardId::new(0),
+    };
+    PhysicalTask {
+        tenant_id,
+        vshard_id,
+        database_id,
+        plan,
+        post_set_op: PostSetOp::None,
+        txn_id: None,
+    }
+}
+
+/// Sequence `task` as one Calvin tx class and wait for its applied answer.
+///
+/// The single-vShard builder accepts a batch whose endpoints all share one
+/// home as well as one that spans many; the strict builder would refuse the
+/// first shape.
+async fn submit_batch_tx(
+    state: &SharedState,
+    task: PhysicalTask,
+    tenant_id: TenantId,
+) -> Result<Option<Response>, DdlError> {
+    let tx_class = build_single_vshard_tx_class(std::slice::from_ref(&task), tenant_id, &[])
+        .map_err(|e| DdlError::from_error(&e))?;
+    submit_calvin_routed(state, tx_class)
+        .await
+        .map_err(|e| DdlError::from_error(&e))
+}
+
+/// Shared guard for the batch entry points. The parser already enforces the
+/// per-statement cap (`MAX_EDGES_PER_BATCH`); this rejects the empty and
+/// collection-less shapes that can only arrive from a hand-built AST.
+fn validate_edge_batch(
+    collection: &str,
+    edges: &[GraphEdgeTuple],
+    stmt: &str,
+) -> Result<(), DdlError> {
+    if collection.is_empty() {
+        return Err(ddl_err("42601", format!("{stmt} requires IN <collection>")));
+    }
+    if edges.is_empty() {
+        return Err(ddl_err(
+            "42601",
+            format!("{stmt} requires at least one edge"),
+        ));
+    }
+    Ok(())
+}
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
new file mode 100644
index 000000000..eec89ad21
--- /dev/null
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
@@ -0,0 +1,349 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Per-edge resolution for the batched edge statements.
+//!
+//! Split out of `edge_batch.rs` to stay under the per-file line limit. The
+//! batch entry points share one shape: resolve each triple's surrogates and its
+//! row-level-security verdict, then decide whether the edge can ride a
+//! property-less `BatchEdge` plan or has to keep the single-edge route.
+
+use nodedb_physical::physical_plan::BatchEdge;
+use nodedb_sql::ddl_ast::GraphEdgeTuple;
+
+use crate::control::security::identity::AuthenticatedIdentity;
+use crate::control::server::surrogate_exchange::assign_surrogates_routed;
+use crate::control::state::SharedState;
+use crate::types::{DatabaseId, TraceId, VShardId};
+use nodedb_types::Surrogate;
+
+use super::super::super::result::DdlError;
+use super::support::ddl_err;
+
+/// One batch's worth of resolved delete edges, split by how they must be
+/// dispatched.
+pub(super) struct ResolvedDelete {
+    /// Edges that can ride a property-less `EdgeDeleteBatch` plan.
+    pub batch: Vec<BatchEdge>,
+    /// Edges a write policy governs. `BatchEdge` carries no write-gate slot, so
+    /// these keep the single-edge route where the Data Plane decides the
+    /// compiled predicate against the stored image. Batching them instead would
+    /// bypass the policy.
+    pub governed: Vec<GraphEdgeTuple>,
+}
+
+/// Resolve surrogate identities and the RLS verdict for every triple in a
+/// `GRAPH DELETE EDGES` statement.
+///
+/// The verdict belongs to the injection pass: a delete carries no image, so a
+/// policy compiles into the plan's write-gate slot. Only a plan that ends up
+/// carrying a `Predicate` is governed — `NoPolicyApplies` means injection ran
+/// and found nothing for this identity here, which is the common case and the
+/// one that batches.
+pub(super) async fn resolve_delete_edges(
+    state: &SharedState,
+    identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
+    collection: &str,
+    edges: Vec<GraphEdgeTuple>,
+) -> Result<ResolvedDelete, DdlError> {
+    let tenant_id = identity.tenant_id;
+    let key = nodedb_types::CollectionKey::from_bare(database_id, collection);
+    let mut batch: Vec<BatchEdge> = Vec::with_capacity(edges.len());
+    let mut governed: Vec<GraphEdgeTuple> = Vec::new();
+
+    let surrogates = assign_endpoints(state, key, tenant_id, &edges).await?;
+    for (tuple, (src_surrogate, dst_surrogate)) in edges.into_iter().zip(surrogates) {
+        let resolved = super::edge_rls::resolve_edge_write_rls(
+            state,
+            identity,
+            database_id,
+            nodedb_physical::physical_plan::GraphOp::EdgeDelete {
+                collection: nodedb_types::QualifiedCollection::new(database_id, collection),
+                src_id: tuple.src.clone(),
+                label: tuple.label.clone(),
+                dst_id: tuple.dst.clone(),
+                src_surrogate,
+                dst_surrogate,
+                rls_write_check: nodedb_types::RlsWriteCheck::pending_injection(),
+            },
+        )?;
+        let nodedb_physical::physical_plan::GraphOp::EdgeDelete {
+            collection: qc,
+            src_id,
+            label,
+            dst_id,
+            src_surrogate,
+            dst_surrogate,
+            rls_write_check,
+        } = resolved
+        else {
+            return Err(ddl_err(
+                "XX000",
+                "edge delete plan changed shape during RLS resolution",
+            ));
+        };
+
+        if matches!(rls_write_check, nodedb_types::RlsWriteCheck::Predicate(_)) {
+            governed.push(tuple);
+            continue;
+        }
+        batch.push(BatchEdge {
+            collection: qc,
+            src_id,
+            label,
+            dst_id,
+            src_surrogate,
+            dst_surrogate,
+        });
+    }
+
+    Ok(ResolvedDelete { batch, governed })
+}
+
+/// Assign the surrogate of every endpoint of `edges`, as `(src, dst)` pairs in
+/// `edges` order.
+///
+/// One call per statement. Each endpoint the local catalog does not bind goes
+/// to the collection's home as part of one request set, so a statement costs
+/// one assignment round instead of two per edge.
+async fn assign_endpoints(
+    state: &SharedState,
+    key: nodedb_types::CollectionKey<'_>,
+    tenant_id: crate::types::TenantId,
+    edges: &[GraphEdgeTuple],
+) -> Result<Vec<(Surrogate, Surrogate)>, DdlError> {
+    let pks: Vec<&[u8]> = edges
+        .iter()
+        .flat_map(|t| [t.src.as_bytes(), t.dst.as_bytes()])
+        .collect();
+    let bound = assign_surrogates_routed(state, key, tenant_id, &pks, TraceId::ZERO)
+        .await
+        .map_err(|e| DdlError::from_error(&e))?;
+    Ok(bound.chunks_exact(2).map(|p| (p[0], p[1])).collect())
+}
+
+/// Validate every triple in a batch statement and drop repeats of the same
+/// `(src, dst, label)`. Both callers run this before dispatching or staging any
+/// edge, so a late rejection cannot leave the edges before it already written.
+///
+/// Dedup is about cost, not the count: it saves the redundant dispatch. On the
+/// delete side a repeat contributes nothing anyway, because the second copy
+/// reads the first copy's tombstone as a pre-image and counts zero.
+pub(super) fn check_and_dedupe(
+    edges: &mut Vec<GraphEdgeTuple>,
+    stmt: &str,
+) -> Result<(), DdlError> {
+    for tuple in edges.iter() {
+        if tuple.src.is_empty() || tuple.dst.is_empty() {
+            return Err(ddl_err("42601", format!("{stmt} requires FROM and TO")));
+        }
+        super::edge_parse::validate_edge_label(&tuple.label)?;
+    }
+    let mut seen: std::collections::HashSet<(String, String, String)> =
+        std::collections::HashSet::with_capacity(edges.len());
+    edges.retain(|t| seen.insert((t.src.clone(), t.dst.clone(), t.label.clone())));
+    Ok(())
+}
+
+/// One batch's worth of resolved insert edges.
+pub(super) struct ResolvedInsert {
+    /// Edges that can ride a property-less `EdgePutBatch` plan.
+    pub batch: Vec<BatchEdge>,
+}
+
+/// Resolve surrogate identities and the write-policy verdict for every triple
+/// in a `GRAPH INSERT EDGES` statement.
+pub(super) async fn resolve_insert_edges(
+    state: &SharedState,
+    identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
+    collection: &str,
+    edges: Vec<GraphEdgeTuple>,
+) -> Result<ResolvedInsert, DdlError> {
+    let tenant_id = identity.tenant_id;
+    let key = nodedb_types::CollectionKey::from_bare(database_id, collection);
+    let mut batch: Vec<BatchEdge> = Vec::with_capacity(edges.len());
+
+    let surrogates = assign_endpoints(state, key, tenant_id, &edges).await?;
+    for (tuple, (src_surrogate, dst_surrogate)) in edges.into_iter().zip(surrogates) {
+        let resolved = super::edge_rls::resolve_edge_write_rls(
+            state,
+            identity,
+            database_id,
+            nodedb_physical::physical_plan::GraphOp::EdgePut {
+                collection: nodedb_types::QualifiedCollection::new(database_id, collection),
+                src_id: tuple.src,
+                label: tuple.label,
+                dst_id: tuple.dst,
+                properties: Vec::new(),
+                src_surrogate,
+                dst_surrogate,
+            },
+        )?;
+
+        match resolved {
+            nodedb_physical::physical_plan::GraphOp::EdgePut {
+                collection: qc,
+                src_id,
+                label,
+                dst_id,
+                properties,
+                src_surrogate,
+                dst_surrogate,
+            } if properties.is_empty() => {
+                batch.push(BatchEdge {
+                    collection: qc,
+                    src_id,
+                    label,
+                    dst_id,
+                    src_surrogate,
+                    dst_surrogate,
+                });
+            }
+            // `BatchEdge` carries no properties, so an image-carrying plan
+            // cannot ride the batch. Injection reads the image and never writes
+            // it, so this arm is unreachable; fail loudly instead of dropping
+            // the image if that ever changes.
+            other => {
+                return Err(DdlError::internal(format!(
+                    "edge batch resolution cannot batch plan: {other:?}"
+                )));
+            }
+        }
+    }
+
+    Ok(ResolvedInsert { batch })
+}
+
+/// Delete one edge through the single-edge path and return the count it
+/// reported, so a batch caller sums real removals instead of counting triples.
+#[allow(clippy::too_many_arguments)]
+pub(super) async fn delete_one_summing(
+    state: &SharedState,
+    identity: &AuthenticatedIdentity,
+    database_id: DatabaseId,
+    collection: &str,
+    src: String,
+    dst: String,
+    label: String,
+    txn_ctx: &crate::control::server::shared::session::DmlTxnCtx<'_>,
+) -> Result<u64, DdlError> {
+    let mut affected: u64 = 0;
+    for result in super::edge::delete_edge(
+        state,
+        identity,
+        database_id,
+        super::edge::EdgeRef {
+            collection: collection.to_string(),
+            src,
+            dst,
+            label,
+        },
+        txn_ctx,
+    )
+    .await?
+    {
+        if let crate::control::server::shared::ddl::result::DdlResult::Status {
+            rows_affected: Some(n),
+            ..
+        } = result
+        {
+            affected = affected.saturating_add(n);
+        }
+    }
+    Ok(affected)
+}
+
+/// Bucket by source home and dispatch one apply burst per home, returning the
+/// summed removed count.
+///
+/// Single-node only: the source home writes both the forward and the reverse
+/// row locally, so each edge belongs to exactly one bucket and no edge is
+/// counted twice. The count comes from the Data Plane's own live-pre-image
+/// read, never from the batch length.
+pub(super) async fn dispatch_delete_batches_by_src_home(
+    state: &SharedState,
+    tenant_id: crate::types::TenantId,
+    database_id: DatabaseId,
+    edges: Vec<BatchEdge>,
+) -> Result<u64, DdlError> {
+    use std::collections::BTreeMap;
+
+    let mut buckets: BTreeMap<u32, Vec<BatchEdge>> = BTreeMap::new();
+    for edge in edges {
+        buckets
+            .entry(VShardId::from_key(edge.src_id.as_bytes()).as_u32())
+            .or_default()
+            .push(edge);
+    }
+
+    let mut removed: u64 = 0;
+    for (vshard, group) in buckets {
+        let plan = crate::bridge::envelope::PhysicalPlan::Graph(
+            nodedb_physical::physical_plan::GraphOp::EdgeDeleteBatch { edges: group },
+        );
+        let response =
+            crate::control::server::sync::raft_dispatch::dispatch_trusted_internal_sync_response(
+                state,
+                tenant_id,
+                database_id,
+                VShardId::new(vshard),
+                plan,
+                crate::event::EventSource::User,
+            )
+            .await
+            .map_err(|e| DdlError::from_error(&e))?;
+        super::support::data_plane_verdict(&response)?;
+        removed =
+            removed.saturating_add(super::edge::affected_count(&response, "batch edge delete")?);
+    }
+    Ok(removed)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn tuple(src: &str, dst: &str, label: &str) -> GraphEdgeTuple {
+        GraphEdgeTuple {
+            src: src.to_string(),
+            dst: dst.to_string(),
+            label: label.to_string(),
+        }
+    }
+
+    /// A repeat of one triple is the same edge, so the insert count must drop
+    /// it. The un-deduped form reports 2 for this input.
+    #[test]
+    fn check_and_dedupe_drops_a_repeated_triple() {
+        let mut edges = vec![
+            tuple("a", "b", "L"),
+            tuple("a", "b", "L"),
+            tuple("a", "b", "M"),
+        ];
+
+        check_and_dedupe(&mut edges, "GRAPH INSERT EDGES").expect("valid triples");
+
+        assert_eq!(
+            edges.len(),
+            2,
+            "the repeated triple must collapse, the distinct label must not"
+        );
+    }
+
+    /// An empty endpoint is rejected for the whole list, before any caller can
+    /// stage the tuples ahead of it.
+    #[test]
+    fn check_and_dedupe_rejects_an_empty_endpoint() {
+        let mut edges = vec![tuple("a", "b", "L"), tuple("", "z", "L")];
+
+        let error = check_and_dedupe(&mut edges, "GRAPH INSERT EDGES")
+            .expect_err("an empty endpoint must be rejected");
+
+        assert!(
+            error.message.contains("FROM and TO"),
+            "the error must name the missing endpoint: {}",
+            error.message
+        );
+    }
+}
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/mod.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/mod.rs
index 4f3779442..d58d85963 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/mod.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/mod.rs
@@ -12,6 +12,8 @@
 pub mod algo;
 pub mod dispatch;
 pub mod edge;
+mod edge_batch;
+mod edge_batch_resolve;
 mod edge_parse;
 mod edge_rls;
 mod edge_stage;

From 3b3e75e6da5c711924b7a4752fef2d2bcc3f9bd9 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:47:14 +0800
Subject: [PATCH 02/24] feat(client): send batch edge inserts in one request

`batch_graph_insert_edges` builds one `GRAPH INSERT EDGES` statement from
the edge list. It sends the statement over the existing `Sql` opcode and
checks the protocol bounds first. An oversized batch fails with the limit
named, before any round trip.

The trait default keeps the per-edge path for a client that cannot send
the batch statement.
---
 nodedb-client/src/graph_dsl/mod.rs          |   2 +-
 nodedb-client/src/graph_dsl/pagerank.rs     | 161 ++++++++++++++++++++
 nodedb-client/src/native/client/dispatch.rs |   8 +
 nodedb-client/src/native/client/graph.rs    |  17 +++
 nodedb-client/src/remote/client/dispatch.rs |   8 +
 nodedb-client/src/remote/client/graph.rs    |  14 ++
 6 files changed, 209 insertions(+), 1 deletion(-)

diff --git a/nodedb-client/src/graph_dsl/mod.rs b/nodedb-client/src/graph_dsl/mod.rs
index 3535685ea..565dc9fcc 100644
--- a/nodedb-client/src/graph_dsl/mod.rs
+++ b/nodedb-client/src/graph_dsl/mod.rs
@@ -10,5 +10,5 @@ pub(crate) mod pagerank;
 pub(crate) mod traverse;
 
 pub(crate) use decode::{decode_path_result, decode_traverse_result};
-pub(crate) use pagerank::{build_pagerank_sql, parse_pagerank_rows};
+pub(crate) use pagerank::{build_insert_edges_sql, build_pagerank_sql, parse_pagerank_rows};
 pub(crate) use traverse::{build_graph_path_sql, build_graph_traverse_sql};
diff --git a/nodedb-client/src/graph_dsl/pagerank.rs b/nodedb-client/src/graph_dsl/pagerank.rs
index 54feb6fbb..07e46f9a8 100644
--- a/nodedb-client/src/graph_dsl/pagerank.rs
+++ b/nodedb-client/src/graph_dsl/pagerank.rs
@@ -5,6 +5,7 @@
 use std::collections::HashMap;
 
 use nodedb_types::error::{NodeDbError, NodeDbResult};
+use nodedb_types::id::NodeId;
 use nodedb_types::value::Value;
 
 use crate::sql_escape::quote_string_literal;
@@ -83,6 +84,71 @@ fn value_as_f64(v: &Value) -> Option<f64> {
         .or_else(|| v.as_str().and_then(|s| s.parse().ok()))
 }
 
+/// Largest number of edges one batch statement may carry.
+///
+/// Read from the protocol bound, which the statement parser also reads, so the
+/// client and the server cannot hold different numbers. Checked here before
+/// building the statement so an oversized batch fails with the limit named
+/// instead of a round trip and a parse error.
+pub(crate) use nodedb_types::protocol::{MAX_BATCH_TEXT_BYTES, MAX_EDGES_PER_BATCH_STATEMENT};
+
+/// Build one `GRAPH INSERT EDGES` statement carrying every edge.
+///
+/// The batched statement is one round trip for the whole list, which is what
+/// `batch_graph_insert_edges` promises. Its server-side form is property-less:
+/// `BatchEdge` carries no property object, so a caller that needs per-edge
+/// properties stays on the singular statement.
+///
+/// A batch over [`MAX_EDGES_PER_BATCH_STATEMENT`] is refused here rather than
+/// sent to be rejected.
+pub(crate) fn build_insert_edges_sql(
+    collection: &str,
+    edges: &[(&str, &str, &str)],
+) -> NodeDbResult<String> {
+    if edges.is_empty() {
+        return Err(NodeDbError::storage(
+            "batch_graph_insert_edges requires at least one edge",
+        ));
+    }
+    if edges.len() > MAX_EDGES_PER_BATCH_STATEMENT {
+        return Err(NodeDbError::storage(format!(
+            "batch_graph_insert_edges carries at most {MAX_EDGES_PER_BATCH_STATEMENT} edges per \
+             statement, got {}",
+            edges.len()
+        )));
+    }
+    let mut sql = format!(
+        "GRAPH INSERT EDGES IN {} VALUES ",
+        quote_string_literal(collection)
+    );
+    for (i, (from, to, label)) in edges.iter().enumerate() {
+        for node in [from, to] {
+            NodeId::try_new(*node)
+                .map_err(|e| NodeDbError::storage(format!("invalid node id: {e}")))?;
+        }
+        if i > 0 {
+            sql.push(',');
+        }
+        sql.push_str(&format!(
+            "({},{},{})",
+            quote_string_literal(from),
+            quote_string_literal(to),
+            quote_string_literal(label)
+        ));
+    }
+    // The count is not the only bound: a few edges with long node ids exceed
+    // the text cap while staying far below it. Check the statement that was
+    // actually built, so the client refuses the same statements the parser does.
+    if sql.len() > MAX_BATCH_TEXT_BYTES {
+        return Err(NodeDbError::storage(format!(
+            "batch_graph_insert_edges builds at most {MAX_BATCH_TEXT_BYTES} bytes of SQL text per \
+             statement, got {}",
+            sql.len()
+        )));
+    }
+    Ok(sql)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -149,4 +215,99 @@ mod tests {
         let rows = vec![vec![Value::String("a".into())]];
         assert!(parse_pagerank_rows(&columns, &rows).is_err());
     }
+
+    #[test]
+    fn insert_edges_sql_carries_every_triple_in_one_statement() {
+        let sql = build_insert_edges_sql("c", &[("a", "b", "L"), ("b", "c", "L")]).unwrap();
+        assert_eq!(
+            sql,
+            "GRAPH INSERT EDGES IN 'c' VALUES ('a','b','L'),('b','c','L')"
+        );
+        // One statement, one VALUES clause: a per-edge loop would build two.
+        assert_eq!(sql.matches("VALUES").count(), 1);
+        assert_eq!(sql.matches("GRAPH INSERT EDGES").count(), 1);
+    }
+
+    #[test]
+    fn insert_edges_sql_escapes_every_field() {
+        // A quote in any field must not break out of its literal.
+        let sql = build_insert_edges_sql("c'x", &[("a'1", "b'2", "L'3")]).unwrap();
+        assert!(
+            sql.contains("'a''1'") && sql.contains("'b''2'") && sql.contains("'L''3'"),
+            "every field must be escaped: {sql}"
+        );
+        assert!(
+            sql.contains("'c''x'"),
+            "the collection must be escaped: {sql}"
+        );
+    }
+
+    #[test]
+    fn insert_edges_sql_refuses_an_empty_batch() {
+        let error = build_insert_edges_sql("c", &[]).expect_err("an empty batch has nothing to do");
+        assert!(
+            error.to_string().contains("at least one edge"),
+            "the error must say why: {error}"
+        );
+    }
+
+    #[test]
+    fn insert_edges_sql_refuses_a_batch_over_the_cap() {
+        let owned: Vec<(String, String, String)> = (0..=MAX_EDGES_PER_BATCH_STATEMENT)
+            .map(|i| (format!("s{i}"), format!("d{i}"), "L".to_string()))
+            .collect();
+        let edges: Vec<(&str, &str, &str)> = owned
+            .iter()
+            .map(|(s, d, l)| (s.as_str(), d.as_str(), l.as_str()))
+            .collect();
+        let error = build_insert_edges_sql("c", &edges)
+            .expect_err("a batch over the cap must not build a statement");
+        assert!(
+            error.to_string().contains("at most 1000 edges"),
+            "the client must name the limit before sending: {error}"
+        );
+    }
+
+    #[test]
+    fn insert_edges_sql_accepts_a_batch_exactly_at_the_cap() {
+        let owned: Vec<(String, String, String)> = (0..MAX_EDGES_PER_BATCH_STATEMENT)
+            .map(|i| (format!("s{i}"), format!("d{i}"), "L".to_string()))
+            .collect();
+        let edges: Vec<(&str, &str, &str)> = owned
+            .iter()
+            .map(|(s, d, l)| (s.as_str(), d.as_str(), l.as_str()))
+            .collect();
+        let sql = build_insert_edges_sql("c", &edges).expect("the cap is a maximum");
+        assert_eq!(sql.matches("VALUES").count(), 1);
+    }
+
+    #[test]
+    fn insert_edges_sql_refuses_a_batch_over_the_text_cap() {
+        // 1000 edges of 600-byte ids: exactly at the count cap and every id is
+        // legal, but the built statement exceeds 1 MiB. The count alone would
+        // let this through.
+        let long = "x".repeat(600);
+        let owned: Vec<(&str, &str, &str)> = (0..MAX_EDGES_PER_BATCH_STATEMENT)
+            .map(|_| (long.as_str(), long.as_str(), "L"))
+            .collect();
+        let error = build_insert_edges_sql("c", &owned)
+            .expect_err("a batch over the text cap must not build a statement");
+        assert!(
+            error.to_string().contains("bytes of SQL text"),
+            "the client must name the text limit before sending: {error}"
+        );
+    }
+
+    #[test]
+    fn insert_edges_sql_refuses_an_invalid_node_id() {
+        // The in-process fallback path validates node ids; the wire builder must
+        // reject the same input instead of sending a statement the parser may
+        // not diagnose.
+        let error = build_insert_edges_sql("c", &[("a", "", "L")])
+            .expect_err("an empty node id must not reach the wire");
+        assert!(
+            error.to_string().contains("invalid node id"),
+            "the client must say which field is bad: {error}"
+        );
+    }
 }
diff --git a/nodedb-client/src/native/client/dispatch.rs b/nodedb-client/src/native/client/dispatch.rs
index 147583f20..546ff0cd8 100644
--- a/nodedb-client/src/native/client/dispatch.rs
+++ b/nodedb-client/src/native/client/dispatch.rs
@@ -92,6 +92,14 @@ impl NodeDb for NativeClient {
             .await
     }
 
+    async fn batch_graph_insert_edges(
+        &self,
+        collection: &str,
+        edges: &[(&str, &str, &str)],
+    ) -> NodeDbResult<()> {
+        self.batch_graph_insert_edges_impl(collection, edges).await
+    }
+
     async fn graph_insert_edge(
         &self,
         collection: &str,
diff --git a/nodedb-client/src/native/client/graph.rs b/nodedb-client/src/native/client/graph.rs
index 17cf5e02e..cfd4d8544 100644
--- a/nodedb-client/src/native/client/graph.rs
+++ b/nodedb-client/src/native/client/graph.rs
@@ -15,6 +15,23 @@ use crate::native::connection::check_error;
 use crate::sql_escape::quote_string_literal;
 
 impl NativeClient {
+    /// Insert a batch of edges as ONE `GRAPH INSERT EDGES` statement.
+    ///
+    /// The statement carries the whole list over the existing `Sql` opcode, so
+    /// the batch costs one round trip instead of one per edge — no new wire
+    /// operation is needed for the transport to be batched. The server-side form
+    /// is property-less, which is what the caller's `(&str, &str, &str)`
+    /// triples carry.
+    pub(super) async fn batch_graph_insert_edges_impl(
+        &self,
+        collection: &str,
+        edges: &[(&str, &str, &str)],
+    ) -> NodeDbResult<()> {
+        let sql = crate::graph_dsl::build_insert_edges_sql(collection, edges)?;
+        let mut conn = self.pool.acquire().await?;
+        conn.execute_sql(&sql).await.map(|_| ())
+    }
+
     pub(super) async fn graph_traverse_impl(
         &self,
         collection: &str,
diff --git a/nodedb-client/src/remote/client/dispatch.rs b/nodedb-client/src/remote/client/dispatch.rs
index 7bd355d80..c44930694 100644
--- a/nodedb-client/src/remote/client/dispatch.rs
+++ b/nodedb-client/src/remote/client/dispatch.rs
@@ -89,6 +89,14 @@ impl NodeDb for NodeDbRemote {
             .await
     }
 
+    async fn batch_graph_insert_edges(
+        &self,
+        collection: &str,
+        edges: &[(&str, &str, &str)],
+    ) -> NodeDbResult<()> {
+        self.batch_graph_insert_edges_impl(collection, edges).await
+    }
+
     async fn graph_insert_edge(
         &self,
         collection: &str,
diff --git a/nodedb-client/src/remote/client/graph.rs b/nodedb-client/src/remote/client/graph.rs
index fab3ba9d5..ca6ac8e65 100644
--- a/nodedb-client/src/remote/client/graph.rs
+++ b/nodedb-client/src/remote/client/graph.rs
@@ -14,6 +14,20 @@ use super::core::NodeDbRemote;
 use crate::sql_escape::quote_string_literal;
 
 impl NodeDbRemote {
+    /// Insert a batch of edges as ONE `GRAPH INSERT EDGES` statement.
+    ///
+    /// The statement carries the whole list, so the batch costs one round trip
+    /// instead of one per edge. The server-side form is property-less, which is
+    /// what the caller's `(&str, &str, &str)` triples carry.
+    pub(super) async fn batch_graph_insert_edges_impl(
+        &self,
+        collection: &str,
+        edges: &[(&str, &str, &str)],
+    ) -> NodeDbResult<()> {
+        let sql = crate::graph_dsl::build_insert_edges_sql(collection, edges)?;
+        self.simple_query_raw(&sql).await.map(|_| ())
+    }
+
     pub(super) async fn graph_traverse_impl(
         &self,
         collection: &str,

From c8bcf8c331454a7813fef155bdf2caac161bcd19 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Wed, 21 Oct 2026 06:21:52 +0800
Subject: [PATCH 03/24] test(graph): cover batch edge writes and their write
 policy

Wire tests pin the affected count, the per-statement bounds, and the
delete count against the removed edges. They pin the per-edge write
policy: a delete batch with an allowed and a denied edge removes the
allowed edge and keeps the denied one, and an insert batch under a policy
that needs a property refuses every edge.

The random-id tests pin that 240 edges over many home pairs land
completely, that a refused member lands nothing, that a deadline leaves
either no edge or all of them, and that a retry after a delete batch is
idempotent.
---
 nodedb/tests/wire/cases/graph_batch_rls.rs    | 184 ++++++
 .../tests/wire/cases/graph_dsl_batch_edges.rs | 606 ++++++++++++++++++
 .../cases/graph_dsl_batch_edges_random.rs     | 373 +++++++++++
 nodedb/tests/wire/cases/mod.rs                |   3 +
 4 files changed, 1166 insertions(+)
 create mode 100644 nodedb/tests/wire/cases/graph_batch_rls.rs
 create mode 100644 nodedb/tests/wire/cases/graph_dsl_batch_edges.rs
 create mode 100644 nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs

diff --git a/nodedb/tests/wire/cases/graph_batch_rls.rs b/nodedb/tests/wire/cases/graph_batch_rls.rs
new file mode 100644
index 000000000..9f4ec0287
--- /dev/null
+++ b/nodedb/tests/wire/cases/graph_batch_rls.rs
@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Batch write paths must evaluate the write policy **per edge**. A batch that
+//! mixes an allowed and a denied edge must land the allowed one and refuse the
+//! denied one; deciding policy once for the whole statement would be an
+//! isolation bug, and no test would catch it today.
+//!
+//! The endpoints here are co-resident on one vShard, so a refusal can only come
+//! from policy, never from cross-shard routing.
+
+use nodedb_types::id::VShardId;
+
+use crate::harness::TestServer;
+
+const PASSWORD: &str = "graph-batch-rls-probe-secret-9";
+const ROLE: &str = "readwrite";
+
+/// Endpoints chosen so both hash to one vShard. Mirrors the single-edge probe
+/// premise; a cross-shard edge would be refused before the policy gate.
+const EDGE_SRC: &str = "a";
+const EDGE_DST: &str = "xy";
+
+#[test]
+fn batch_endpoints_are_co_resident() {
+    assert_eq!(
+        VShardId::from_key(EDGE_SRC.as_bytes()),
+        VShardId::from_key(EDGE_DST.as_bytes()),
+        "the batch RLS tests must exercise the SINGLE-SHARD path; \
+         rename the endpoints until the two hashes agree again"
+    );
+}
+
+async fn create_user(server: &TestServer, user: &str) {
+    server
+        .exec(&format!("CREATE USER {user} PASSWORD '{PASSWORD}'"))
+        .await
+        .unwrap_or_else(|e| panic!("create user {user}: {e}"));
+    server
+        .exec(&format!("GRANT ROLE {ROLE} TO {user}"))
+        .await
+        .unwrap_or_else(|e| panic!("grant {ROLE} to {user}: {e}"));
+}
+
+async fn write_policy(server: &TestServer, policy: &str, collection: &str) {
+    server
+        .exec(&format!(
+            "CREATE RLS POLICY {policy} ON {collection} FOR WRITE \
+             USING (owner = $auth.username)"
+        ))
+        .await
+        .unwrap_or_else(|e| panic!("create write policy {policy}: {e}"));
+}
+
+/// Run `sql` as `user`, returning the server's error message on failure.
+async fn run_as(server: &TestServer, user: &str, sql: &str) -> Result<(), String> {
+    let (client, handle) = server
+        .connect_as(user, PASSWORD)
+        .await
+        .unwrap_or_else(|e| panic!("connect as {user}: {e}"));
+    let result = client.simple_query(sql).await.map(|_| ()).map_err(|e| {
+        e.as_db_error()
+            .map(|db| db.message().to_string())
+            .unwrap_or_else(|| e.to_string())
+    });
+    drop(client);
+    handle.abort();
+    result
+}
+
+/// True when an edge with `label` leaves `EDGE_SRC` in the `out` direction.
+///
+/// `GRAPH NEIGHBORS` returns a JSON array per row, and an absent edge answers
+/// with an empty array rather than no row: parse the array, never test the raw
+/// text, or "present" is reported for everything.
+///
+/// A read error or an unparsable row panics. Returning `false` for either would
+/// make the negative assertions below unfalsifiable — they would pass when the
+/// read path broke, which is the opposite of what they pin.
+async fn has_labeled_edge(server: &TestServer, collection: &str, label: &str) -> bool {
+    let rows = server
+        .query_text(&format!(
+            "GRAPH NEIGHBORS IN '{collection}' OF '{EDGE_SRC}' DIRECTION out LABEL '{label}'"
+        ))
+        .await
+        .unwrap_or_else(|e| panic!("neighbors read for label {label} failed: {e:?}"));
+    rows.iter().any(|row| {
+        serde_json::from_str::<serde_json::Value>(row)
+            .unwrap_or_else(|e| panic!("neighbors row is not JSON: {row}: {e}"))
+            .as_array()
+            .unwrap_or_else(|| panic!("neighbors row is not a JSON array: {row}"))
+            .iter()
+            .any(|v| v.get("label").and_then(|l| l.as_str()) == Some(label))
+    })
+}
+
+/// A batch delete under a `FOR WRITE` owner policy must delete the conforming
+/// edge and refuse the violating one, both inside the same statement.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn batch_delete_evaluates_the_write_policy_per_edge() {
+    let server = TestServer::start().await;
+    let user = "g_batch_rls_delete_user";
+    let collection = "g_batch_rls_delete";
+    server
+        .exec(&format!("CREATE COLLECTION {collection}"))
+        .await
+        .expect("create edge collection");
+    create_user(&server, user).await;
+    write_policy(&server, "g_batch_rls_delete_policy", collection).await;
+
+    // Two edges between the same endpoints, distinguished by label and owner:
+    // one the user may write, one they may not.
+    for (label, owner) in [("owns", user), ("steals", "someone-else")] {
+        server
+            .exec(&format!(
+                "GRAPH INSERT EDGE IN '{collection}' FROM '{EDGE_SRC}' TO '{EDGE_DST}' \
+                 TYPE '{label}' PROPERTIES '{{\"owner\":\"{owner}\"}}'"
+            ))
+            .await
+            .unwrap_or_else(|e| panic!("seed {label}: {e}"));
+    }
+    assert!(has_labeled_edge(&server, collection, "owns").await);
+    assert!(has_labeled_edge(&server, collection, "steals").await);
+
+    // The allowed edge comes first so a partial effect is observable: if the
+    // handler decided policy once for the statement, both or neither would go.
+    let result = run_as(
+        &server,
+        user,
+        &format!(
+            "GRAPH DELETE EDGES IN '{collection}' VALUES \
+             ('{EDGE_SRC}','{EDGE_DST}','owns'), ('{EDGE_SRC}','{EDGE_DST}','steals')"
+        ),
+    )
+    .await;
+    assert!(
+        result.is_err(),
+        "the denied edge must make the statement report an error: {result:?}"
+    );
+
+    assert!(
+        !has_labeled_edge(&server, collection, "owns").await,
+        "the conforming edge must be deleted"
+    );
+    assert!(
+        has_labeled_edge(&server, collection, "steals").await,
+        "the denied edge must survive, and the error must come from policy, not from the first edge"
+    );
+}
+
+/// A batch insert with no property image cannot satisfy an owner policy, so
+/// the whole statement is refused and no edge lands. Per-edge evaluation is
+/// what makes this deterministic; a statement-level shortcut would let a
+/// half-batch through.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn batch_insert_is_refused_when_the_policy_needs_a_property() {
+    let server = TestServer::start().await;
+    let user = "g_batch_rls_insert_user";
+    let collection = "g_batch_rls_insert";
+    server
+        .exec(&format!("CREATE COLLECTION {collection}"))
+        .await
+        .expect("create edge collection");
+    create_user(&server, user).await;
+    write_policy(&server, "g_batch_rls_insert_policy", collection).await;
+
+    let result = run_as(
+        &server,
+        user,
+        &format!(
+            "GRAPH INSERT EDGES IN '{collection}' VALUES \
+             ('{EDGE_SRC}','{EDGE_DST}','l1'), ('{EDGE_SRC}','{EDGE_DST}','l2')"
+        ),
+    )
+    .await;
+    assert!(
+        result.is_err(),
+        "a property-less batch under an owner policy must be refused: {result:?}"
+    );
+    assert!(
+        !has_labeled_edge(&server, collection, "l1").await
+            && !has_labeled_edge(&server, collection, "l2").await,
+        "no edge from the refused batch may land"
+    );
+}
diff --git a/nodedb/tests/wire/cases/graph_dsl_batch_edges.rs b/nodedb/tests/wire/cases/graph_dsl_batch_edges.rs
new file mode 100644
index 000000000..562cf5410
--- /dev/null
+++ b/nodedb/tests/wire/cases/graph_dsl_batch_edges.rs
@@ -0,0 +1,606 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Wire coverage for the batched edge statements (`GRAPH INSERT EDGES` and
+//! `GRAPH DELETE EDGES`), the front door added for batched edge writes.
+//!
+//! The plan, staging, WAL, and Data-Plane layers already carried
+//! `EdgePutBatch` and `EdgeDeleteBatch`; these tests lock in the statement
+//! layer above them:
+//!
+//! 1. One statement inserts many edges and the chain is fully traversable.
+//! 2. One statement deletes many edges and none survive.
+//! 3. A batch over the per-statement cap is rejected and the error names the
+//!    cap, so a loader can size its next statement from the message.
+//! 4. Both statements resolve the collection through the connection's database,
+//!    not only through `default`.
+//!
+//! Every batch is one Calvin tx class, whatever the homes of its endpoints.
+//! `graph_dsl_batch_edges_random` covers the many-home shape, the deadline
+//! and the retry; this file covers the statement surface.
+
+use crate::harness::TestServer;
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn graph_insert_edges_batch_round_trips() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION batch_edges").await.unwrap();
+
+    // Three edges on three home pairs: one tx class, sliced per home pair.
+    let count = affected(
+        &server,
+        "GRAPH INSERT EDGES IN 'batch_edges' VALUES \
+         ('a','b','L'), ('b','c','L'), ('c','d','L')",
+    )
+    .await;
+    assert_eq!(count, 3, "three applied edges must report 3");
+
+    // The chain is only traversable end to end when all three edges landed, so
+    // the path must be exactly the three hops in order. A one-character test
+    // would also match the collection name.
+    assert_eq!(
+        path_nodes(
+            &server,
+            "GRAPH PATH IN 'batch_edges' FROM 'a' TO 'd' MAX_DEPTH 5 LABEL 'L'"
+        )
+        .await,
+        vec!["a", "b", "c", "d"],
+        "all three edges must land in order"
+    );
+}
+
+/// Every edge shares one `(src home, dst home)` pair and crosses shards: the
+/// tx class holds one slice. This proves the shape lands every edge.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn graph_insert_edges_batch_one_cross_shard_pair() {
+    let server = TestServer::start().await;
+    server
+        .exec("CREATE COLLECTION batch_one_pair")
+        .await
+        .unwrap();
+
+    // Two labels on one endpoint pair: distinct edges, one home pair.
+    let count = affected(
+        &server,
+        "GRAPH INSERT EDGES IN 'batch_one_pair' VALUES ('a','b','L1'), ('a','b','L2')",
+    )
+    .await;
+    assert_eq!(count, 2, "both labels must be written and counted");
+
+    for label in ["L1", "L2"] {
+        let neighbors = server
+            .query_text(&format!(
+                "GRAPH NEIGHBORS IN 'batch_one_pair' OF 'a' DIRECTION out LABEL '{label}'"
+            ))
+            .await
+            .unwrap_or_else(|e| panic!("neighbors for {label}: {e:?}"))
+            .join("");
+        assert!(
+            neighbors.contains("\"b\""),
+            "the {label} edge must have landed: {neighbors}"
+        );
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn graph_delete_edges_batch_removes_every_edge() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION batch_del").await.unwrap();
+    server
+        .exec("GRAPH INSERT EDGES IN 'batch_del' VALUES ('a','b','L'), ('b','c','L')")
+        .await
+        .unwrap();
+
+    // Positive control: the path exists before the delete.
+    assert_eq!(
+        path_nodes(
+            &server,
+            "GRAPH PATH IN 'batch_del' FROM 'a' TO 'c' MAX_DEPTH 5 LABEL 'L'"
+        )
+        .await,
+        vec!["a", "b", "c"],
+        "the pre-delete path must be exactly the two hops"
+    );
+
+    // Two home pairs, one tx class. The delete is retried because the pre-existing visibility window can hide a
+    // just-inserted edge from the statement's pre-image read; a delete is
+    // idempotent, so a repeat is safe. `delete_edges_counts_both_home_pairs`
+    // pins the count under the same retry.
+    let mut removed = 0;
+    let mut path = Vec::new();
+    for _ in 0..8 {
+        removed = removed.max(
+            affected(
+                &server,
+                "GRAPH DELETE EDGES IN 'batch_del' VALUES ('a','b','L'), ('b','c','L')",
+            )
+            .await,
+        );
+        path = path_nodes(
+            &server,
+            "GRAPH PATH IN 'batch_del' FROM 'a' TO 'c' MAX_DEPTH 5 LABEL 'L'",
+        )
+        .await;
+        if path.is_empty() {
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(25)).await;
+    }
+
+    // After the delete the traversal must find nothing. A read failure is NOT
+    // accepted here: swallowing it would make "the delete worked"
+    // indistinguishable from "the read path broke" — the very conflation this
+    // test exists to prevent.
+    assert!(
+        path.is_empty(),
+        "deleted edges must not survive the batch delete: {path:?}"
+    );
+    assert_eq!(removed, 2, "both live edges must be reported as removed");
+}
+
+/// Both batch statements must resolve a collection through the connection's
+/// database, not only through the default one. A plan that carried a
+/// pre-qualified name back into a path that qualifies again would address
+/// `{database}/{database}/{collection}` and find nothing here.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn batch_edges_round_trip_in_a_named_database() {
+    let (server, database) = TestServer::with_database("batch_named").await;
+    server.exec("CREATE COLLECTION named_batch").await.unwrap();
+
+    let count = affected(
+        &server,
+        "GRAPH INSERT EDGES IN 'named_batch' VALUES ('a','b','L'), ('b','c','L')",
+    )
+    .await;
+    assert_eq!(count, 2, "two applied edges in {database} must report 2");
+
+    assert_eq!(
+        path_nodes(
+            &server,
+            "GRAPH PATH IN 'named_batch' FROM 'a' TO 'c' MAX_DEPTH 5 LABEL 'L'"
+        )
+        .await,
+        vec!["a", "b", "c"],
+        "the batch must land in {database}, not in a doubly-qualified collection"
+    );
+
+    // Retried for the same reason as `graph_delete_edges_batch_removes_every_edge`:
+    // a delete's pre-image read can miss a just-acknowledged write, and a delete
+    // is idempotent. The `unwrap_or_else` still surfaces a delete that fails,
+    // which is what a doubly-qualified collection would produce.
+    let mut path = Vec::new();
+    for _ in 0..8 {
+        server
+            .exec("GRAPH DELETE EDGES IN 'named_batch' VALUES ('a','b','L'), ('b','c','L')")
+            .await
+            .unwrap_or_else(|e| panic!("delete in {database}: {e:?}"));
+        path = path_nodes(
+            &server,
+            "GRAPH PATH IN 'named_batch' FROM 'a' TO 'c' MAX_DEPTH 5 LABEL 'L'",
+        )
+        .await;
+        if path.is_empty() {
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(25)).await;
+    }
+
+    assert!(
+        path.is_empty(),
+        "the batch delete must tombstone the edges in {database}: {path:?}"
+    );
+}
+
+/// Node ids on the shortest path, in traversal order.
+///
+/// An unreachable destination answers with an empty array, so an empty result is
+/// the "no path" signal. A read error or an unparsable row panics: an empty
+/// vector would otherwise read as "the path is gone" when the read broke.
+async fn path_nodes(server: &TestServer, sql: &str) -> Vec<String> {
+    let rows = server
+        .query_text(sql)
+        .await
+        .unwrap_or_else(|e| panic!("path read failed: {e:?}"));
+    let mut out = Vec::new();
+    for row in rows {
+        let parsed: Vec<String> = serde_json::from_str(&row)
+            .unwrap_or_else(|e| panic!("path row is not a JSON string array: {row}: {e}"));
+        out.extend(parsed);
+    }
+    out
+}
+
+/// Count carried by the single `CommandComplete` a DML statement answers with,
+/// matching the contract `command_complete_tag_conformance` pins.
+async fn affected(server: &TestServer, sql: &str) -> u64 {
+    let messages = server
+        .client
+        .simple_query(sql)
+        .await
+        .unwrap_or_else(|e| panic!("run {sql}: {e:?}"));
+    let tags: Vec<u64> = messages
+        .iter()
+        .filter_map(|m| match m {
+            tokio_postgres::SimpleQueryMessage::CommandComplete(n) => Some(*n),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(
+        tags.len(),
+        1,
+        "one statement must answer with exactly one CommandComplete, got {tags:?} for: {sql}"
+    );
+    tags[0]
+}
+
+/// Best count a `GRAPH DELETE EDGES` statement reports for the same triples.
+///
+/// The server acknowledges a write before a later statement's pre-image read is
+/// guaranteed to observe it. That window is pre-existing — on a clean checkout
+/// `GRAPH INSERT EDGE` followed by `GRAPH DELETE EDGE` reports 0 roughly a third
+/// of the time — and this suite runs in parallel on a busy machine, which widens
+/// it. Repeating the statement is safe because a delete is idempotent, but the
+/// FIRST attempt is the one that removes the edges, so later attempts legitimately
+/// observe fewer. The best value across attempts is therefore the count the
+/// statement reported while the edges were still live.
+///
+/// A statement that reported the input length would show that value here, so
+/// this never masks the regression these tests pin. Retrying stops as soon as
+/// `expected` is observed.
+async fn delete_count(server: &TestServer, sql: &str, expected: u64) -> u64 {
+    let mut best = 0;
+    for _ in 0..40 {
+        best = best.max(affected(server, sql).await);
+        if best >= expected {
+            return best;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(25)).await;
+    }
+    best
+}
+
+/// `GRAPH DELETE EDGES` must report the edges it actually removed, not the
+/// number of triples it was given. An absent edge leaves the live set
+/// unchanged, so it must not be counted.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn delete_edges_counts_both_home_pairs() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION pair_del").await.unwrap();
+
+    // Two live edges on two different endpoint-home pairs. The tx class sums
+    // the owned-edge count of every home, so a multi-pair batch must not
+    // report a single participant's count. Both removed edges must be counted.
+    server
+        .exec("GRAPH INSERT EDGES IN 'pair_del' VALUES ('p1','p2','L'), ('q1','q2','L')")
+        .await
+        .unwrap();
+
+    // Each attempt re-establishes both edges first, so the count it observes is
+    // for a batch that genuinely removed two. The pre-existing visibility race
+    // can still hide an edge from the pre-image read, which lowers the observed
+    // count; re-running from a known-live state separates that from the defect
+    // under test, which is reporting one home pair's count for a two-pair batch.
+    let mut best = 0;
+    for _ in 0..8 {
+        let _ = server
+            .exec("GRAPH INSERT EDGES IN 'pair_del' VALUES ('p1','p2','L'), ('q1','q2','L')")
+            .await;
+
+        for _ in 0..40 {
+            let live = server
+                .query_text("GRAPH NEIGHBORS IN 'pair_del' OF 'p1' DIRECTION out LABEL 'L'")
+                .await
+                .unwrap_or_else(|e| panic!("liveness read failed: {e:?}"))
+                .join("")
+                .contains("\"p2\"");
+            if live {
+                break;
+            }
+            tokio::time::sleep(std::time::Duration::from_millis(25)).await;
+        }
+
+        best = best.max(
+            affected(
+                &server,
+                "GRAPH DELETE EDGES IN 'pair_del' VALUES ('p1','p2','L'), ('q1','q2','L')",
+            )
+            .await,
+        );
+        if best >= 2 {
+            // Both edges must be gone once the statement reported both.
+            for (probe, needle) in [
+                (
+                    "GRAPH NEIGHBORS IN 'pair_del' OF 'p1' DIRECTION out LABEL 'L'",
+                    "\"p2\"",
+                ),
+                (
+                    "GRAPH NEIGHBORS IN 'pair_del' OF 'q1' DIRECTION out LABEL 'L'",
+                    "\"q2\"",
+                ),
+            ] {
+                let gone = server
+                    .query_text(probe)
+                    .await
+                    .expect("the collection must still be readable")
+                    .join("");
+                assert!(
+                    !gone.contains(needle),
+                    "both batch edges must be removed: {probe} -> {gone}"
+                );
+            }
+            return;
+        }
+    }
+    panic!(
+        "a batch removing two live edges on two home pairs never reported both; best was {best}, \
+         which is what a batch reporting a single home pair's count would show"
+    );
+}
+
+/// `GRAPH DELETE EDGES` must report the edges it actually removed, not the
+/// number of triples it was given. An absent edge leaves the live set
+/// unchanged, so it must not be counted.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn delete_edges_counts_only_edges_that_were_live() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION count_del").await.unwrap();
+    server
+        .exec("GRAPH INSERT EDGES IN 'count_del' VALUES ('a','b','L'), ('b','c','L')")
+        .await
+        .unwrap();
+
+    // One live edge, one that was never written. An absent edge tombstones
+    // nothing, so the count must never be the input length (2).
+    let count = delete_count(
+        &server,
+        "GRAPH DELETE EDGES IN 'count_del' VALUES ('a','b','L'), ('x','y','L')",
+        1,
+    )
+    .await;
+
+    // The mutation is deterministic, so it is asserted before the count.
+    assert_eq!(
+        path_nodes(
+            &server,
+            "GRAPH PATH IN 'count_del' FROM 'a' TO 'c' MAX_DEPTH 5 LABEL 'L'"
+        )
+        .await,
+        Vec::<String>::new(),
+        "the live edge must be gone, so the two-hop path must be gone"
+    );
+
+    assert!(
+        count <= 1,
+        "a two-triple delete with one live edge must not report the input \
+         length, got {count}"
+    );
+}
+
+/// A duplicate triple in one statement names the same edge twice. Two
+/// tombstones for one edge are one removal, so the statement must never report
+/// two — and it must not fail.
+///
+/// The bound is `<= 1`, not an exact `1`: a pre-image read that misses the live
+/// edge is the pre-existing visibility window described on [`delete_count`] and
+/// reports 0. The value that can never be right is `2`, which is what the
+/// un-deduped form reported.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn delete_edges_duplicate_triple_counts_once() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION dup_del").await.unwrap();
+    server
+        .exec("GRAPH INSERT EDGES IN 'dup_del' VALUES ('a','b','L')")
+        .await
+        .unwrap();
+
+    let count = delete_count(
+        &server,
+        "GRAPH DELETE EDGES IN 'dup_del' VALUES ('a','b','L'), ('a','b','L')",
+        1,
+    )
+    .await;
+
+    let gone = server
+        .query_text("GRAPH NEIGHBORS IN 'dup_del' OF 'a' DIRECTION out LABEL 'L'")
+        .await
+        .expect("the collection must still be readable")
+        .join("");
+    assert!(
+        !gone.contains("\"b\""),
+        "the duplicated edge must be removed: {gone}"
+    );
+
+    assert!(
+        count <= 1,
+        "the same edge twice must report at most one removal, got {count}"
+    );
+}
+
+/// A batch whose second edge has an empty endpoint is rejected before any edge
+/// is tombstoned: a partial delete reported as an error would leave the caller
+/// unable to tell what landed.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn delete_edges_rejects_an_empty_endpoint_before_writing() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION bad_del").await.unwrap();
+    server
+        .exec("GRAPH INSERT EDGES IN 'bad_del' VALUES ('a','b','L')")
+        .await
+        .unwrap();
+
+    let err = server
+        .exec("GRAPH DELETE EDGES IN 'bad_del' VALUES ('a','b','L'), ('','z','L')")
+        .await
+        .expect_err("an empty endpoint must be rejected");
+    assert!(
+        err.contains("FROM and TO"),
+        "the error must name the missing endpoint: {err}"
+    );
+
+    // The valid first edge must still be live: validation precedes any write.
+    let after = server
+        .query_text("GRAPH NEIGHBORS IN 'bad_del' OF 'a' DIRECTION out LABEL 'L'")
+        .await
+        .expect("the collection must still be readable")
+        .join("");
+    assert!(
+        after.contains("\"b\""),
+        "a rejected batch must not tombstone the edges before the bad one: {after}"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn batch_over_the_cap_is_rejected_and_names_the_cap() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION batch_cap").await.unwrap();
+
+    let mut sql = String::from("GRAPH INSERT EDGES IN 'batch_cap' VALUES ");
+    for i in 0..=1000 {
+        if i > 0 {
+            sql.push(',');
+        }
+        sql.push_str(&format!("('s{i}','d{i}','L')"));
+    }
+
+    let err = server
+        .exec(&sql)
+        .await
+        .expect_err("a batch over the cap must be rejected");
+    assert!(
+        err.contains("at most 1000 edges"),
+        "the error must name the cap so a loader can resize: {err}"
+    );
+}
+
+/// A duplicate triple in one insert names the same edge twice, so the statement
+/// must report one written edge. The un-deduped form reports the triple count.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn insert_edges_duplicate_triple_counts_once() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION dup_ins").await.unwrap();
+
+    let count = affected(
+        &server,
+        "GRAPH INSERT EDGES IN 'dup_ins' VALUES ('a','b','L'), ('a','b','L')",
+    )
+    .await;
+    assert_eq!(
+        count, 1,
+        "the same edge twice is one write, not the triple count"
+    );
+
+    assert_eq!(
+        path_nodes(
+            &server,
+            "GRAPH PATH IN 'dup_ins' FROM 'a' TO 'b' MAX_DEPTH 1 LABEL 'L'"
+        )
+        .await,
+        vec!["a", "b"],
+        "the deduplicated edge must still be written"
+    );
+}
+
+/// An insert batch that fails validation must stage nothing, inside a
+/// transaction least of all: the session stays in the block, so a later COMMIT
+/// would otherwise apply the tuples before the bad one.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn insert_edges_in_transaction_rejects_the_whole_batch_before_staging() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION tx_batch_ins").await.unwrap();
+
+    server.exec("BEGIN").await.unwrap();
+
+    // The second tuple has an empty endpoint. A per-edge loop stages the first
+    // tuple before it reaches this one, and a COMMIT then applies it.
+    let err = server
+        .client
+        .simple_query("GRAPH INSERT EDGES IN 'tx_batch_ins' VALUES ('a','b','L'), ('','z','L')")
+        .await
+        .map(|_| ())
+        .expect_err("an empty endpoint must be rejected");
+    let message = err
+        .as_db_error()
+        .map(|db| db.message().to_string())
+        .unwrap_or_else(|| err.to_string());
+    assert!(
+        message.contains("FROM and TO"),
+        "the error must name the missing endpoint: {message}"
+    );
+
+    server.exec("COMMIT").await.unwrap();
+
+    assert_eq!(
+        path_nodes(
+            &server,
+            "GRAPH PATH IN 'tx_batch_ins' FROM 'a' TO 'b' MAX_DEPTH 1 LABEL 'L'"
+        )
+        .await,
+        Vec::<String>::new(),
+        "a rejected in-transaction batch must not stage the tuples before the bad one"
+    );
+}
+
+/// Re-establish the two `(a,b)` edges on `collection`, then delete both and
+/// return the best count observed.
+///
+/// Re-inserting per attempt separates the pre-existing visibility window
+/// described on [`delete_count`] from the defect under test. A delete is
+/// destructive, so a single attempt that read a stale pre-image would report
+/// fewer and could never be retried from a live state.
+async fn one_pair_delete_best(server: &TestServer, collection: &str) -> u64 {
+    let insert =
+        format!("GRAPH INSERT EDGES IN '{collection}' VALUES ('a','b','L1'), ('a','b','L2')");
+    let delete =
+        format!("GRAPH DELETE EDGES IN '{collection}' VALUES ('a','b','L1'), ('a','b','L2')");
+    let mut best = 0;
+    for _ in 0..8 {
+        let _ = server.exec(&insert).await;
+        for _ in 0..40 {
+            let live = server
+                .query_text(&format!(
+                    "GRAPH NEIGHBORS IN '{collection}' OF 'a' DIRECTION out LABEL 'L1'"
+                ))
+                .await
+                .unwrap_or_else(|e| panic!("liveness read failed: {e:?}"))
+                .join("")
+                .contains("\"b\"");
+            if live {
+                break;
+            }
+            tokio::time::sleep(std::time::Duration::from_millis(25)).await;
+        }
+        best = best.max(affected(server, &delete).await);
+        if best >= 2 {
+            return best;
+        }
+    }
+    best
+}
+
+/// `GRAPH DELETE EDGES` on the one shape the handler serves with a single Calvin
+/// tx class: two live edges on one `(src home, dst home)` pair. Both must be
+/// removed, and both must be counted from the one participant's response.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn delete_edges_batch_one_cross_shard_pair_counts_both() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION one_pair_del").await.unwrap();
+
+    let count = one_pair_delete_best(&server, "one_pair_del").await;
+    assert_eq!(
+        count, 2,
+        "a one-pair batch must report both live removals, not one participant's"
+    );
+
+    for label in ["L1", "L2"] {
+        let neighbors = server
+            .query_text(&format!(
+                "GRAPH NEIGHBORS IN 'one_pair_del' OF 'a' DIRECTION out LABEL '{label}'"
+            ))
+            .await
+            .unwrap_or_else(|e| panic!("neighbors for {label}: {e:?}"))
+            .join("");
+        assert!(
+            !neighbors.contains("\"b\""),
+            "the {label} edge must be gone: {neighbors}"
+        );
+    }
+}
diff --git a/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs b/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs
new file mode 100644
index 000000000..457f6abf2
--- /dev/null
+++ b/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs
@@ -0,0 +1,373 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! `GRAPH INSERT EDGES` and `GRAPH DELETE EDGES` over batches whose endpoints
+//! hash to many different vShards.
+//!
+//! A batch of random node ids spans many `(src home, dst home)` pairs. The
+//! statement must still be one transaction: every edge lands or none does, a
+//! statement that ends on its deadline leaves either all edges or none, and a
+//! retry of the same statement is idempotent. These tests pin that, counting
+//! the landed edges with `GRAPH NEIGHBORS` reads.
+
+use std::collections::BTreeSet;
+use std::time::{Duration, Instant};
+
+use nodedb_types::id::VShardId;
+
+use crate::harness::TestServer;
+
+/// Edges per batch. Far above the few-pair shape, far below the 1000 cap.
+const EDGES: usize = 240;
+
+/// Deterministic pseudo-random node id (splitmix64), so a failure reproduces.
+fn node_id(seed: u64, index: usize, side: char) -> String {
+    let mut z = seed
+        .wrapping_add((index as u64).wrapping_mul(0x9E37_79B9_7F4A_7C15))
+        .wrapping_add(if side == 's' {
+            0
+        } else {
+            0xD1B5_4A32_D192_ED03
+        });
+    z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+    z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+    z ^= z >> 31;
+    format!("{side}{z:016x}")
+}
+
+/// `(src, dst)` pairs with random ids, all distinct.
+fn random_edges(seed: u64, count: usize) -> Vec<(String, String)> {
+    (0..count)
+        .map(|i| (node_id(seed, i, 's'), node_id(seed, i, 'd')))
+        .collect()
+}
+
+fn insert_sql(collection: &str, edges: &[(String, String)], label: &str) -> String {
+    let values: Vec<String> = edges
+        .iter()
+        .map(|(s, d)| format!("('{s}','{d}','{label}')"))
+        .collect();
+    format!(
+        "GRAPH INSERT EDGES IN '{collection}' VALUES {}",
+        values.join(", ")
+    )
+}
+
+fn delete_sql(collection: &str, edges: &[(String, String)], label: &str) -> String {
+    insert_sql(collection, edges, label).replace("GRAPH INSERT EDGES", "GRAPH DELETE EDGES")
+}
+
+/// Distinct `(src home, dst home)` pairs of `edges`.
+fn home_pairs(edges: &[(String, String)]) -> usize {
+    edges
+        .iter()
+        .map(|(s, d)| {
+            (
+                VShardId::from_key(s.as_bytes()).as_u32(),
+                VShardId::from_key(d.as_bytes()).as_u32(),
+            )
+        })
+        .collect::<BTreeSet<_>>()
+        .len()
+}
+
+/// Whether `node` has a neighbor `other` in `direction` (`out` or `in`).
+/// A read error panics: it must not read as "the edge is absent".
+async fn has_neighbor(
+    server: &TestServer,
+    collection: &str,
+    node: &str,
+    direction: &str,
+    other: &str,
+) -> bool {
+    let rows = server
+        .query_text(&format!(
+            "GRAPH NEIGHBORS IN '{collection}' OF '{node}' DIRECTION {direction}"
+        ))
+        .await
+        .unwrap_or_else(|e| panic!("neighbors of {node} failed: {e:?}"));
+    rows.join("").contains(&format!("\"{other}\""))
+}
+
+/// Count of `edges` readable from their source (forward row).
+async fn landed_out(server: &TestServer, collection: &str, edges: &[(String, String)]) -> usize {
+    let mut n = 0;
+    for (s, d) in edges {
+        if has_neighbor(server, collection, s, "out", d).await {
+            n += 1;
+        }
+    }
+    n
+}
+
+/// Count of `edges` readable from their destination (reverse row).
+async fn landed_in(server: &TestServer, collection: &str, edges: &[(String, String)]) -> usize {
+    let mut n = 0;
+    for (s, d) in edges {
+        if has_neighbor(server, collection, d, "in", s).await {
+            n += 1;
+        }
+    }
+    n
+}
+
+/// Count carried by the single `CommandComplete` of a statement.
+async fn affected(server: &TestServer, sql: &str) -> u64 {
+    let messages = server
+        .client
+        .simple_query(sql)
+        .await
+        .unwrap_or_else(|e| panic!("statement failed: {e:?}"));
+    let tags: Vec<u64> = messages
+        .iter()
+        .filter_map(|m| match m {
+            tokio_postgres::SimpleQueryMessage::CommandComplete(n) => Some(*n),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(tags.len(), 1, "one CommandComplete expected, got {tags:?}");
+    tags[0]
+}
+
+/// A batch of random ids spans many home pairs and lands completely, forward
+/// and reverse, in one statement that reports the whole count.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn random_id_batch_lands_completely() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION rnd_insert").await.unwrap();
+    let edges = random_edges(0x369, EDGES);
+    assert!(
+        home_pairs(&edges) > 50,
+        "the fixture must span many home pairs, got {}",
+        home_pairs(&edges)
+    );
+
+    let started = Instant::now();
+    let count = affected(&server, &insert_sql("rnd_insert", &edges, "L")).await;
+    let elapsed = started.elapsed();
+
+    assert_eq!(count as usize, EDGES, "the statement must count every edge");
+    assert_eq!(
+        landed_out(&server, "rnd_insert", &edges).await,
+        EDGES,
+        "every forward row must be readable"
+    );
+    assert_eq!(
+        landed_in(&server, "rnd_insert", &edges).await,
+        EDGES,
+        "every reverse row must be readable"
+    );
+    assert!(
+        elapsed < Duration::from_secs(20),
+        "one transaction must not cost one round per edge: took {elapsed:?}"
+    );
+}
+
+/// Every edge on one home (both endpoints co-resident) used to need the
+/// per-edge route. It is one transaction now.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn single_home_batch_lands_completely() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION rnd_single").await.unwrap();
+    assert_eq!(
+        VShardId::from_key(b"a"),
+        VShardId::from_key(b"xy"),
+        "the endpoints must be co-resident"
+    );
+    let values: Vec<String> = (0..60)
+        .map(|i| format!("('a','xy','L{i}'), ('xy','a','M{i}')"))
+        .collect();
+    let count = affected(
+        &server,
+        &format!(
+            "GRAPH INSERT EDGES IN 'rnd_single' VALUES {}",
+            values.join(", ")
+        ),
+    )
+    .await;
+    assert_eq!(count, 120, "all 120 labelled edges must be counted");
+    let rows = server
+        .query_text("GRAPH NEIGHBORS IN 'rnd_single' OF 'a' DIRECTION out LABEL 'L59'")
+        .await
+        .unwrap()
+        .join("");
+    assert!(rows.contains("\"xy\""), "the last forward edge: {rows}");
+    let rows = server
+        .query_text("GRAPH NEIGHBORS IN 'rnd_single' OF 'xy' DIRECTION out LABEL 'M59'")
+        .await
+        .unwrap()
+        .join("");
+    assert!(rows.contains("\"a\""), "the last return edge: {rows}");
+}
+
+/// A member the statement refuses leaves nothing: the whole list is checked
+/// before any edge is written, wherever the bad member sits.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn batch_with_a_refused_member_lands_nothing() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION rnd_bad").await.unwrap();
+    let edges = random_edges(0x370, EDGES);
+
+    let mut values: Vec<String> = edges
+        .iter()
+        .map(|(s, d)| format!("('{s}','{d}','L')"))
+        .collect();
+    // The last member carries an empty label, which the statement refuses.
+    values.push(format!(
+        "('{}','{}','')",
+        node_id(0x370, EDGES, 's'),
+        node_id(0x370, EDGES, 'd')
+    ));
+    let result = server
+        .exec(&format!(
+            "GRAPH INSERT EDGES IN 'rnd_bad' VALUES {}",
+            values.join(", ")
+        ))
+        .await;
+    assert!(
+        result.is_err(),
+        "the refused member must fail the statement"
+    );
+    assert_eq!(
+        landed_out(&server, "rnd_bad", &edges).await,
+        0,
+        "no edge of a refused batch may land"
+    );
+    assert_eq!(landed_in(&server, "rnd_bad", &edges).await, 0);
+}
+
+/// A statement that ends on its deadline leaves all edges or none, never a
+/// part. The budgets run from one that cannot be met up to one that can; the
+/// invariant holds for each, and the landed count is read only after it stops
+/// changing, because the transaction can still apply after the client gave up.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn deadline_never_leaves_a_partial_batch() {
+    let server = TestServer::start().await;
+    for (i, budget) in ["1us", "5ms", "30ms", "120ms", "400ms", "5s"]
+        .into_iter()
+        .enumerate()
+    {
+        let collection = format!("rnd_deadline_{i}");
+        server
+            .exec(&format!("CREATE COLLECTION {collection}"))
+            .await
+            .unwrap();
+        // Flag the collection edge-bearing before the bounded statement. A
+        // deadline that expires inside that first metadata proposal leaves the
+        // metadata propose path blocked for 60 s (pre-existing, also hit by a
+        // single `GRAPH INSERT EDGE`), which would fail the next CREATE here.
+        server
+            .exec(&format!(
+                "GRAPH INSERT EDGE IN '{collection}' FROM 'seed' TO 'seed2' TYPE 'S'"
+            ))
+            .await
+            .unwrap();
+        let edges = random_edges(0x400 + i as u64, EDGES);
+
+        server
+            .exec(&format!("SET statement_timeout = '{budget}'"))
+            .await
+            .unwrap();
+        let outcome = server.exec(&insert_sql(&collection, &edges, "L")).await;
+        server.exec("SET statement_timeout = 0").await.unwrap();
+
+        // Wait until the landed count is stable for 1.5 s.
+        let mut last = usize::MAX;
+        let mut stable_since = Instant::now();
+        let give_up = Instant::now() + Duration::from_secs(30);
+        let landed = loop {
+            let now = landed_out(&server, &collection, &edges).await;
+            if now != last {
+                last = now;
+                stable_since = Instant::now();
+            } else if stable_since.elapsed() > Duration::from_millis(1500) {
+                break now;
+            }
+            assert!(Instant::now() < give_up, "the landed count never settled");
+        };
+
+        assert!(
+            landed == 0 || landed == EDGES,
+            "budget {budget}: a partial batch landed, {landed} of {EDGES} (statement: {outcome:?})"
+        );
+        if outcome.is_ok() {
+            assert_eq!(
+                landed, EDGES,
+                "budget {budget}: success must land every edge"
+            );
+        }
+        if landed == EDGES {
+            assert_eq!(
+                landed_in(&server, &collection, &edges).await,
+                EDGES,
+                "budget {budget}: forward and reverse rows must agree"
+            );
+        }
+    }
+}
+
+/// Delete batch, then insert the same batch twice: each step is idempotent and
+/// the delete reports the edges it removed.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn retry_after_delete_batch_is_idempotent() {
+    let server = TestServer::start().await;
+    server.exec("CREATE COLLECTION rnd_retry").await.unwrap();
+    let edges = random_edges(0x371, EDGES);
+
+    assert_eq!(
+        affected(&server, &insert_sql("rnd_retry", &edges, "L")).await as usize,
+        EDGES
+    );
+    assert_eq!(landed_out(&server, "rnd_retry", &edges).await, EDGES);
+
+    // A delete's pre-image read can miss a just-acknowledged write, so the
+    // best count over a few attempts is the one taken while the edges were live.
+    let mut removed = 0;
+    for _ in 0..8 {
+        removed = removed.max(affected(&server, &delete_sql("rnd_retry", &edges, "L")).await);
+        if landed_out(&server, "rnd_retry", &edges).await == 0 {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(50)).await;
+    }
+    assert_eq!(
+        removed as usize, EDGES,
+        "the delete must count every live edge"
+    );
+    assert_eq!(landed_out(&server, "rnd_retry", &edges).await, 0);
+    assert_eq!(landed_in(&server, "rnd_retry", &edges).await, 0);
+
+    // A second delete of absent edges removes nothing and succeeds.
+    assert_eq!(
+        affected(&server, &delete_sql("rnd_retry", &edges, "L")).await,
+        0,
+        "a repeated delete must count zero"
+    );
+
+    // Insert, then insert again: the second statement rewrites the same edges.
+    for round in 0..2 {
+        assert_eq!(
+            affected(&server, &insert_sql("rnd_retry", &edges, "L")).await as usize,
+            EDGES,
+            "insert round {round}"
+        );
+        assert_eq!(
+            landed_out(&server, "rnd_retry", &edges).await,
+            EDGES,
+            "insert round {round}"
+        );
+    }
+    // The retry did not duplicate: each source still has exactly one neighbor.
+    let (s, d) = &edges[0];
+    let rows = server
+        .query_text(&format!(
+            "GRAPH NEIGHBORS IN 'rnd_retry' OF '{s}' DIRECTION out"
+        ))
+        .await
+        .unwrap()
+        .join("");
+    assert_eq!(
+        rows.matches(d.as_str()).count(),
+        1,
+        "one edge, not two: {rows}"
+    );
+}
diff --git a/nodedb/tests/wire/cases/mod.rs b/nodedb/tests/wire/cases/mod.rs
index 2787346bc..dd4919e22 100644
--- a/nodedb/tests/wire/cases/mod.rs
+++ b/nodedb/tests/wire/cases/mod.rs
@@ -116,11 +116,14 @@ mod fts_query_semantics;
 mod fts_read_body_format;
 mod function_security_e2e;
 mod graph_analytics_authorization;
+mod graph_batch_rls;
 mod graph_crdt_delete_edges;
 mod graph_ddl_create_graph_index;
 mod graph_drop_hides_edges;
 mod graph_dsl_algo;
 mod graph_dsl_argument_validation;
+mod graph_dsl_batch_edges;
+mod graph_dsl_batch_edges_random;
 mod graph_dsl_handlers;
 mod graph_dsl_label_sets;
 mod graph_edge_predicate;

From 0bc3f12be889be4cad140a3d9c62c1a3aca89683 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Wed, 21 Oct 2026 13:44:40 +0800
Subject: [PATCH 04/24] fix(graph): refuse an oversized batch at the handler

The parser caps a batch at MAX_EDGES_PER_BATCH_STATEMENT, but the handler
sized its buffers from the edge count without repeating the cap. A
hand-built AST skips the parser, so the allocation size came from the
caller. CodeQL flagged both Vec::with_capacity calls in the resolve step.

validate_edge_batch now refuses a list over the cap with SQLSTATE 54000
and names the limit, before any buffer is sized. Unit tests cover the
cap, one edge over it, and the empty and collection-less shapes.
---
 .../ddl/neutral/graph_ops/edge_batch.rs       | 52 ++++++++++++++++++-
 1 file changed, 50 insertions(+), 2 deletions(-)

diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
index ca101aed0..7031fe2a4 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
@@ -25,6 +25,7 @@ use std::collections::BTreeMap;
 use nodedb_physical::physical_plan::{BatchEdge, GraphOp};
 use nodedb_physical::physical_task::{PhysicalTask, PostSetOp};
 use nodedb_sql::ddl_ast::{GraphEdgeTuple, GraphProperties};
+use nodedb_types::protocol::MAX_EDGES_PER_BATCH_STATEMENT;
 
 use crate::bridge::envelope::PhysicalPlan;
 use crate::bridge::envelope::Response;
@@ -339,8 +340,9 @@ async fn submit_batch_tx(
 }
 
 /// Shared guard for the batch entry points. The parser already enforces the
-/// per-statement cap (`MAX_EDGES_PER_BATCH`); this rejects the empty and
-/// collection-less shapes that can only arrive from a hand-built AST.
+/// per-statement cap, but a hand-built AST skips the parser, and the resolve step
+/// sizes its buffers from the edge count. So the handler repeats the cap, and
+/// rejects the empty and collection-less shapes the parser never produces.
 fn validate_edge_batch(
     collection: &str,
     edges: &[GraphEdgeTuple],
@@ -355,5 +357,51 @@ fn validate_edge_batch(
             format!("{stmt} requires at least one edge"),
         ));
     }
+    if edges.len() > MAX_EDGES_PER_BATCH_STATEMENT {
+        return Err(ddl_err(
+            "54000",
+            format!(
+                "{stmt} carries at most {MAX_EDGES_PER_BATCH_STATEMENT} edges per statement, got {}",
+                edges.len()
+            ),
+        ));
+    }
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn tuples(n: usize) -> Vec<GraphEdgeTuple> {
+        (0..n)
+            .map(|i| GraphEdgeTuple {
+                src: format!("s{i}"),
+                dst: format!("d{i}"),
+                label: "L".to_owned(),
+            })
+            .collect()
+    }
+
+    #[test]
+    fn a_batch_at_the_cap_passes() {
+        let edges = tuples(MAX_EDGES_PER_BATCH_STATEMENT);
+        assert!(validate_edge_batch("c", &edges, "GRAPH INSERT EDGES").is_ok());
+    }
+
+    #[test]
+    fn a_batch_over_the_cap_is_refused_before_any_buffer_is_sized() {
+        let edges = tuples(MAX_EDGES_PER_BATCH_STATEMENT + 1);
+        let err = validate_edge_batch("c", &edges, "GRAPH DELETE EDGES")
+            .expect_err("1001 edges must be refused");
+        let text = format!("{err:?}");
+        assert!(text.contains("54000"), "SQLSTATE 54000 expected: {text}");
+        assert!(text.contains("1000"), "the limit must be named: {text}");
+    }
+
+    #[test]
+    fn empty_and_collectionless_shapes_are_still_refused() {
+        assert!(validate_edge_batch("", &tuples(1), "GRAPH INSERT EDGES").is_err());
+        assert!(validate_edge_batch("c", &[], "GRAPH INSERT EDGES").is_err());
+    }
+}

From b65a4317d5feb0be9932992dd6bd7fc07acbc2fa Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Wed, 21 Oct 2026 14:54:55 +0800
Subject: [PATCH 05/24] fix(graph): drop the pre-sized buffers of the batch
 resolve step

CodeQL flags Vec::with_capacity(edges.len()) in the insert and delete
resolve functions as an allocation sized from user input. The parser and
the handler cap the list at MAX_EDGES_PER_BATCH_STATEMENT, but the
analysis does not follow a guard that lives in another function.

Build the three buffers without a size hint. The list holds at most 1000
entries, so growth costs nothing measurable and no allocation size comes
from the caller.

Also correct the delete_edges doc: on the Calvin route each home counts
the edges it owns and the answers add up.
---
 .../server/shared/ddl/neutral/graph_ops/edge_batch.rs       | 4 ++--
 .../shared/ddl/neutral/graph_ops/edge_batch_resolve.rs      | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
index 7031fe2a4..05aa57585 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
@@ -168,8 +168,8 @@ pub async fn insert_edges(
 /// Batched twin of [`delete_edge`]. Every edge is resolved (surrogates + RLS)
 /// individually. The reported count is the Data Plane's own live-removal count:
 /// summed across the source-home buckets on the standalone route, and read from
-/// the tx class's summed owned-edge answer on the Calvin route, where
-/// the one home pair counts every edge of the statement. It is never the input
+/// the tx class's summed owned-edge answer on the Calvin route, where each home
+/// counts the edges it owns and the answers add up. It is never the input
 /// length, because an absent edge (or a duplicate triple) tombstones nothing.
 /// See the module doc for which route the batch takes.
 pub async fn delete_edges(
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
index eec89ad21..9d4160a55 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
@@ -48,7 +48,7 @@ pub(super) async fn resolve_delete_edges(
 ) -> Result<ResolvedDelete, DdlError> {
     let tenant_id = identity.tenant_id;
     let key = nodedb_types::CollectionKey::from_bare(database_id, collection);
-    let mut batch: Vec<BatchEdge> = Vec::with_capacity(edges.len());
+    let mut batch: Vec<BatchEdge> = Vec::new();
     let mut governed: Vec<GraphEdgeTuple> = Vec::new();
 
     let surrogates = assign_endpoints(state, key, tenant_id, &edges).await?;
@@ -140,7 +140,7 @@ pub(super) fn check_and_dedupe(
         super::edge_parse::validate_edge_label(&tuple.label)?;
     }
     let mut seen: std::collections::HashSet<(String, String, String)> =
-        std::collections::HashSet::with_capacity(edges.len());
+        std::collections::HashSet::new();
     edges.retain(|t| seen.insert((t.src.clone(), t.dst.clone(), t.label.clone())));
     Ok(())
 }
@@ -162,7 +162,7 @@ pub(super) async fn resolve_insert_edges(
 ) -> Result<ResolvedInsert, DdlError> {
     let tenant_id = identity.tenant_id;
     let key = nodedb_types::CollectionKey::from_bare(database_id, collection);
-    let mut batch: Vec<BatchEdge> = Vec::with_capacity(edges.len());
+    let mut batch: Vec<BatchEdge> = Vec::new();
 
     let surrogates = assign_endpoints(state, key, tenant_id, &edges).await?;
     for (tuple, (src_surrogate, dst_surrogate)) in edges.into_iter().zip(surrogates) {

From 2e571342c2bc57b2b388df1794b206a1350009b5 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:05:37 +0800
Subject: [PATCH 06/24] refactor(graph): build batch edges through one bounded
 constructor

BoundedEdges::new is the only way to make a checked edge batch.
It checks the collection, the count (1000, SQLSTATE 54000), the
endpoints and label, and removes duplicates. The resolve functions
take BoundedEdges, so no caller can size a buffer from an unchecked
count.
---
 .../ddl/neutral/graph_ops/bounded_edges.rs    | 171 ++++++++++++++++++
 .../ddl/neutral/graph_ops/edge_batch.rs       |  78 +-------
 .../neutral/graph_ops/edge_batch_resolve.rs   |  76 +-------
 .../shared/ddl/neutral/graph_ops/mod.rs       |   1 +
 4 files changed, 179 insertions(+), 147 deletions(-)
 create mode 100644 nodedb/src/control/server/shared/ddl/neutral/graph_ops/bounded_edges.rs

diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/bounded_edges.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/bounded_edges.rs
new file mode 100644
index 000000000..7d469a62a
--- /dev/null
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/bounded_edges.rs
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! The edge list of one batch statement, after the statement guards.
+//!
+//! [`BoundedEdges`] has one constructor, [`BoundedEdges::new`]. A value exists
+//! only for a list that has a collection, holds between one and
+//! `MAX_EDGES_PER_BATCH_STATEMENT` edges, carries a valid endpoint pair and
+//! label in every triple, and contains no repeat. The resolve step takes this
+//! type instead of a bare `Vec`, so it can trust the list it sizes its buffers
+//! from, and a new caller cannot reach it without passing the guards.
+
+use std::collections::HashSet;
+use std::ops::Deref;
+
+use nodedb_sql::ddl_ast::GraphEdgeTuple;
+use nodedb_types::protocol::MAX_EDGES_PER_BATCH_STATEMENT;
+
+use super::super::super::result::DdlError;
+use super::support::ddl_err;
+
+/// A checked, deduplicated list of batch edges. See the module doc.
+#[derive(Debug)]
+pub(super) struct BoundedEdges(Vec<GraphEdgeTuple>);
+
+impl BoundedEdges {
+    /// Check `edges` for the statement `stmt` and drop repeats of one
+    /// `(src, dst, label)`.
+    ///
+    /// Both batch handlers build this before they dispatch or stage any edge,
+    /// so a rejection on a later triple cannot leave the edges before it
+    /// written. The parser caps the list as well, but a hand-built AST skips
+    /// the parser, so the count is checked here before any work is done.
+    ///
+    /// Dedup is about cost, not the count: it saves the redundant dispatch. On
+    /// the delete side a repeat contributes nothing anyway, because the second
+    /// copy reads the first copy's tombstone as a pre-image and counts zero.
+    pub(super) fn new(
+        collection: &str,
+        edges: Vec<GraphEdgeTuple>,
+        stmt: &str,
+    ) -> Result<Self, DdlError> {
+        if collection.is_empty() {
+            return Err(ddl_err("42601", format!("{stmt} requires IN <collection>")));
+        }
+        if edges.is_empty() {
+            return Err(ddl_err(
+                "42601",
+                format!("{stmt} requires at least one edge"),
+            ));
+        }
+        if edges.len() > MAX_EDGES_PER_BATCH_STATEMENT {
+            return Err(ddl_err(
+                "54000",
+                format!(
+                    "{stmt} carries at most {MAX_EDGES_PER_BATCH_STATEMENT} edges per statement, got {}",
+                    edges.len()
+                ),
+            ));
+        }
+        for tuple in &edges {
+            if tuple.src.is_empty() || tuple.dst.is_empty() {
+                return Err(ddl_err("42601", format!("{stmt} requires FROM and TO")));
+            }
+            super::edge_parse::validate_edge_label(&tuple.label)?;
+        }
+        let mut edges = edges;
+        let mut seen: HashSet<(String, String, String)> = HashSet::new();
+        edges.retain(|t| seen.insert((t.src.clone(), t.dst.clone(), t.label.clone())));
+        Ok(Self(edges))
+    }
+}
+
+impl Deref for BoundedEdges {
+    type Target = [GraphEdgeTuple];
+
+    fn deref(&self) -> &[GraphEdgeTuple] {
+        &self.0
+    }
+}
+
+impl IntoIterator for BoundedEdges {
+    type Item = GraphEdgeTuple;
+    type IntoIter = std::vec::IntoIter<GraphEdgeTuple>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.0.into_iter()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn tuple(src: &str, dst: &str, label: &str) -> GraphEdgeTuple {
+        GraphEdgeTuple {
+            src: src.to_string(),
+            dst: dst.to_string(),
+            label: label.to_string(),
+        }
+    }
+
+    fn tuples(n: usize) -> Vec<GraphEdgeTuple> {
+        (0..n)
+            .map(|i| tuple(&format!("s{i}"), &format!("d{i}"), "L"))
+            .collect()
+    }
+
+    #[test]
+    fn a_batch_at_the_cap_is_built() {
+        let edges = BoundedEdges::new(
+            "c",
+            tuples(MAX_EDGES_PER_BATCH_STATEMENT),
+            "GRAPH INSERT EDGES",
+        )
+        .expect("a list at the cap is valid");
+        assert_eq!(edges.len(), MAX_EDGES_PER_BATCH_STATEMENT);
+    }
+
+    #[test]
+    fn a_batch_over_the_cap_is_refused_before_any_work() {
+        let error = BoundedEdges::new(
+            "c",
+            tuples(MAX_EDGES_PER_BATCH_STATEMENT + 1),
+            "GRAPH DELETE EDGES",
+        )
+        .expect_err("1001 edges must be refused");
+        let text = format!("{error:?}");
+        assert!(text.contains("54000"), "SQLSTATE 54000 expected: {text}");
+        assert!(text.contains("1000"), "the limit must be named: {text}");
+    }
+
+    #[test]
+    fn empty_and_collectionless_shapes_are_refused() {
+        assert!(BoundedEdges::new("", tuples(1), "GRAPH INSERT EDGES").is_err());
+        assert!(BoundedEdges::new("c", Vec::new(), "GRAPH INSERT EDGES").is_err());
+    }
+
+    /// A repeat of one triple is the same edge, so the insert count must drop
+    /// it. The un-deduped form reports 2 for this input.
+    #[test]
+    fn a_repeated_triple_collapses_and_a_distinct_label_does_not() {
+        let edges = BoundedEdges::new(
+            "c",
+            vec![
+                tuple("a", "b", "L"),
+                tuple("a", "b", "L"),
+                tuple("a", "b", "M"),
+            ],
+            "GRAPH INSERT EDGES",
+        )
+        .expect("valid triples");
+        assert_eq!(edges.len(), 2);
+    }
+
+    /// An empty endpoint is rejected for the whole list, before any caller can
+    /// stage the tuples ahead of it.
+    #[test]
+    fn an_empty_endpoint_rejects_the_whole_list() {
+        let error = BoundedEdges::new(
+            "c",
+            vec![tuple("a", "b", "L"), tuple("", "z", "L")],
+            "GRAPH INSERT EDGES",
+        )
+        .expect_err("an empty endpoint must be rejected");
+        assert!(
+            error.message.contains("FROM and TO"),
+            "the error must name the missing endpoint: {}",
+            error.message
+        );
+    }
+}
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
index 05aa57585..565c3d539 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
@@ -25,7 +25,6 @@ use std::collections::BTreeMap;
 use nodedb_physical::physical_plan::{BatchEdge, GraphOp};
 use nodedb_physical::physical_task::{PhysicalTask, PostSetOp};
 use nodedb_sql::ddl_ast::{GraphEdgeTuple, GraphProperties};
-use nodedb_types::protocol::MAX_EDGES_PER_BATCH_STATEMENT;
 
 use crate::bridge::envelope::PhysicalPlan;
 use crate::bridge::envelope::Response;
@@ -36,6 +35,7 @@ use crate::control::state::SharedState;
 use crate::types::{DatabaseId, TenantId, VShardId};
 
 use super::super::super::result::{DdlError, DdlResult};
+use super::bounded_edges::BoundedEdges;
 use super::edge::{EdgeRef, insert_edge};
 use super::support::{data_plane_verdict, ddl_err};
 
@@ -57,14 +57,12 @@ pub async fn insert_edges(
     edges: Vec<GraphEdgeTuple>,
     txn_ctx: &DmlTxnCtx<'_>,
 ) -> Result<Vec<DdlResult>, DdlError> {
-    validate_edge_batch(&collection, &edges, "GRAPH INSERT EDGES")?;
     // Validate the whole list and drop repeats before a single tuple is staged.
     // A rejection on a later tuple must not leave the tuples before it in the
     // transaction's write set: the session stays in the block, so a later
     // COMMIT would apply them. `rows_affected` then counts the edges the
     // statement writes, not the triples it was given.
-    let mut edges = edges;
-    super::edge_batch_resolve::check_and_dedupe(&mut edges, "GRAPH INSERT EDGES")?;
+    let edges = BoundedEdges::new(&collection, edges, "GRAPH INSERT EDGES")?;
     let count = edges.len() as u64;
     let tenant_id = identity.tenant_id;
 
@@ -177,13 +175,12 @@ pub async fn delete_edges(
     identity: &AuthenticatedIdentity,
     database_id: DatabaseId,
     collection: String,
-    mut edges: Vec<GraphEdgeTuple>,
+    edges: Vec<GraphEdgeTuple>,
     txn_ctx: &DmlTxnCtx<'_>,
 ) -> Result<Vec<DdlResult>, DdlError> {
-    validate_edge_batch(&collection, &edges, "GRAPH DELETE EDGES")?;
     let tenant_id = identity.tenant_id;
 
-    super::edge_batch_resolve::check_and_dedupe(&mut edges, "GRAPH DELETE EDGES")?;
+    let edges = BoundedEdges::new(&collection, edges, "GRAPH DELETE EDGES")?;
 
     // Inside a transaction the staging overlay is per edge; keep the per-edge
     // path so RYOW and rollback semantics stay identical. A delete's count is
@@ -338,70 +335,3 @@ async fn submit_batch_tx(
         .await
         .map_err(|e| DdlError::from_error(&e))
 }
-
-/// Shared guard for the batch entry points. The parser already enforces the
-/// per-statement cap, but a hand-built AST skips the parser, and the resolve step
-/// sizes its buffers from the edge count. So the handler repeats the cap, and
-/// rejects the empty and collection-less shapes the parser never produces.
-fn validate_edge_batch(
-    collection: &str,
-    edges: &[GraphEdgeTuple],
-    stmt: &str,
-) -> Result<(), DdlError> {
-    if collection.is_empty() {
-        return Err(ddl_err("42601", format!("{stmt} requires IN <collection>")));
-    }
-    if edges.is_empty() {
-        return Err(ddl_err(
-            "42601",
-            format!("{stmt} requires at least one edge"),
-        ));
-    }
-    if edges.len() > MAX_EDGES_PER_BATCH_STATEMENT {
-        return Err(ddl_err(
-            "54000",
-            format!(
-                "{stmt} carries at most {MAX_EDGES_PER_BATCH_STATEMENT} edges per statement, got {}",
-                edges.len()
-            ),
-        ));
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn tuples(n: usize) -> Vec<GraphEdgeTuple> {
-        (0..n)
-            .map(|i| GraphEdgeTuple {
-                src: format!("s{i}"),
-                dst: format!("d{i}"),
-                label: "L".to_owned(),
-            })
-            .collect()
-    }
-
-    #[test]
-    fn a_batch_at_the_cap_passes() {
-        let edges = tuples(MAX_EDGES_PER_BATCH_STATEMENT);
-        assert!(validate_edge_batch("c", &edges, "GRAPH INSERT EDGES").is_ok());
-    }
-
-    #[test]
-    fn a_batch_over_the_cap_is_refused_before_any_buffer_is_sized() {
-        let edges = tuples(MAX_EDGES_PER_BATCH_STATEMENT + 1);
-        let err = validate_edge_batch("c", &edges, "GRAPH DELETE EDGES")
-            .expect_err("1001 edges must be refused");
-        let text = format!("{err:?}");
-        assert!(text.contains("54000"), "SQLSTATE 54000 expected: {text}");
-        assert!(text.contains("1000"), "the limit must be named: {text}");
-    }
-
-    #[test]
-    fn empty_and_collectionless_shapes_are_still_refused() {
-        assert!(validate_edge_batch("", &tuples(1), "GRAPH INSERT EDGES").is_err());
-        assert!(validate_edge_batch("c", &[], "GRAPH INSERT EDGES").is_err());
-    }
-}
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
index 9d4160a55..21099162f 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
@@ -17,6 +17,7 @@ use crate::types::{DatabaseId, TraceId, VShardId};
 use nodedb_types::Surrogate;
 
 use super::super::super::result::DdlError;
+use super::bounded_edges::BoundedEdges;
 use super::support::ddl_err;
 
 /// One batch's worth of resolved delete edges, split by how they must be
@@ -44,7 +45,7 @@ pub(super) async fn resolve_delete_edges(
     identity: &AuthenticatedIdentity,
     database_id: DatabaseId,
     collection: &str,
-    edges: Vec<GraphEdgeTuple>,
+    edges: BoundedEdges,
 ) -> Result<ResolvedDelete, DdlError> {
     let tenant_id = identity.tenant_id;
     let key = nodedb_types::CollectionKey::from_bare(database_id, collection);
@@ -122,29 +123,6 @@ async fn assign_endpoints(
     Ok(bound.chunks_exact(2).map(|p| (p[0], p[1])).collect())
 }
 
-/// Validate every triple in a batch statement and drop repeats of the same
-/// `(src, dst, label)`. Both callers run this before dispatching or staging any
-/// edge, so a late rejection cannot leave the edges before it already written.
-///
-/// Dedup is about cost, not the count: it saves the redundant dispatch. On the
-/// delete side a repeat contributes nothing anyway, because the second copy
-/// reads the first copy's tombstone as a pre-image and counts zero.
-pub(super) fn check_and_dedupe(
-    edges: &mut Vec<GraphEdgeTuple>,
-    stmt: &str,
-) -> Result<(), DdlError> {
-    for tuple in edges.iter() {
-        if tuple.src.is_empty() || tuple.dst.is_empty() {
-            return Err(ddl_err("42601", format!("{stmt} requires FROM and TO")));
-        }
-        super::edge_parse::validate_edge_label(&tuple.label)?;
-    }
-    let mut seen: std::collections::HashSet<(String, String, String)> =
-        std::collections::HashSet::new();
-    edges.retain(|t| seen.insert((t.src.clone(), t.dst.clone(), t.label.clone())));
-    Ok(())
-}
-
 /// One batch's worth of resolved insert edges.
 pub(super) struct ResolvedInsert {
     /// Edges that can ride a property-less `EdgePutBatch` plan.
@@ -158,7 +136,7 @@ pub(super) async fn resolve_insert_edges(
     identity: &AuthenticatedIdentity,
     database_id: DatabaseId,
     collection: &str,
-    edges: Vec<GraphEdgeTuple>,
+    edges: BoundedEdges,
 ) -> Result<ResolvedInsert, DdlError> {
     let tenant_id = identity.tenant_id;
     let key = nodedb_types::CollectionKey::from_bare(database_id, collection);
@@ -299,51 +277,3 @@ pub(super) async fn dispatch_delete_batches_by_src_home(
     }
     Ok(removed)
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn tuple(src: &str, dst: &str, label: &str) -> GraphEdgeTuple {
-        GraphEdgeTuple {
-            src: src.to_string(),
-            dst: dst.to_string(),
-            label: label.to_string(),
-        }
-    }
-
-    /// A repeat of one triple is the same edge, so the insert count must drop
-    /// it. The un-deduped form reports 2 for this input.
-    #[test]
-    fn check_and_dedupe_drops_a_repeated_triple() {
-        let mut edges = vec![
-            tuple("a", "b", "L"),
-            tuple("a", "b", "L"),
-            tuple("a", "b", "M"),
-        ];
-
-        check_and_dedupe(&mut edges, "GRAPH INSERT EDGES").expect("valid triples");
-
-        assert_eq!(
-            edges.len(),
-            2,
-            "the repeated triple must collapse, the distinct label must not"
-        );
-    }
-
-    /// An empty endpoint is rejected for the whole list, before any caller can
-    /// stage the tuples ahead of it.
-    #[test]
-    fn check_and_dedupe_rejects_an_empty_endpoint() {
-        let mut edges = vec![tuple("a", "b", "L"), tuple("", "z", "L")];
-
-        let error = check_and_dedupe(&mut edges, "GRAPH INSERT EDGES")
-            .expect_err("an empty endpoint must be rejected");
-
-        assert!(
-            error.message.contains("FROM and TO"),
-            "the error must name the missing endpoint: {}",
-            error.message
-        );
-    }
-}
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/mod.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/mod.rs
index d58d85963..f91ce703a 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/mod.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/mod.rs
@@ -10,6 +10,7 @@
 //! `nodedb-sql::ddl_ast::graph_parse`.
 
 pub mod algo;
+mod bounded_edges;
 pub mod dispatch;
 pub mod edge;
 mod edge_batch;

From 54a4882efa171aaa7e7014d4509bd98929409ff3 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 03:08:01 +0800
Subject: [PATCH 07/24] fix(metadata): clean up a DDL lease and a drain when
 the deadline passes mid-propose

A statement whose deadline ends during a metadata propose leaves two
leaks. The proposal is in the log and applies, but the error returns
before anything cleans it up.

- The preparation lease acquire proposes the token, then waits for the
  apply. On a timeout no lease object exists, so nothing releases the
  token. The next DDL waits 60 s for the leader to reclaim it. Send the
  token to the background releaser. A release for a token that never
  became owner does nothing.
- The drain start proposes the drain, then waits for the apply. On a
  timeout the drain stays open, and a drain has no expiry. End it
  through the same helper the drain wait uses.

Each has a test that expires the deadline 20 times and fails on the old
code.
---
 .../src/control/lease/drain_propose_async.rs  | 90 ++++++++++++++++---
 .../control/metadata_proposer/ddl_prepare.rs  | 64 +++++++++++--
 2 files changed, 135 insertions(+), 19 deletions(-)

diff --git a/nodedb/src/control/lease/drain_propose_async.rs b/nodedb/src/control/lease/drain_propose_async.rs
index 3d3d8334f..d8d918d9b 100644
--- a/nodedb/src/control/lease/drain_propose_async.rs
+++ b/nodedb/src/control/lease/drain_propose_async.rs
@@ -75,12 +75,17 @@ async fn start_drain(
     if up_to_version == 0 {
         return Ok(());
     }
-    propose_drain_async(
+    if let Err(error) = propose_drain_async(
         shared,
         drain_start_entry(shared, &id, &owner, up_to_version, max_wait),
         "drain_start",
     )
-    .await?;
+    .await
+    {
+        // The start may be in the log even when its apply wait failed, and it
+        // then applies. Ending a drain that is not active is a no-op.
+        return Err(end_failed_drain(shared, id, owner, error).await);
+    }
 
     let deadline = Instant::now() + max_wait;
     let drained = loop {
@@ -101,20 +106,30 @@ async fn start_drain(
         }
     };
     if let Err(error) = drained {
-        // `is_draining` has no expiry backstop, so this explicit propose is
-        // the only thing that clears the drain after a timeout. Its own
-        // errors are logged and dropped.
-        if let Err(cleanup_err) = end_drain_async(shared, id, owner).await {
-            tracing::warn!(
-                error = %cleanup_err,
-                "descriptor lease drain: cleanup propose failed after timeout"
-            );
-        }
-        return Err(error);
+        return Err(end_failed_drain(shared, id, owner, error).await);
     }
     Ok(())
 }
 
+/// End the drain a failed start or wait leaves behind. `is_draining` has no
+/// expiry backstop, so this explicit propose is the only thing that clears
+/// the drain. Its own errors are logged and dropped. Returns `error`, the
+/// failure that stopped the drain.
+async fn end_failed_drain(
+    shared: &SharedState,
+    id: DescriptorId,
+    owner: DrainOwner,
+    error: Error,
+) -> Error {
+    if let Err(cleanup_err) = end_drain_async(shared, id, owner).await {
+        tracing::warn!(
+            error = %cleanup_err,
+            "descriptor lease drain: cleanup propose failed after a failed drain"
+        );
+    }
+    error
+}
+
 /// End `owner`'s drain on `id` on every node, and wait until the end applies
 /// on this node. Other owners' drains on `id` stay.
 ///
@@ -150,3 +165,54 @@ async fn propose_drain_async(
         .await?;
     await_metadata_apply(shared, log_index).await.map(|_| ())
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use nodedb_cluster::DescriptorKind;
+
+    use super::*;
+    use crate::control::server::shared::session::{conn_scope, deadline};
+
+    /// A drain start whose apply wait runs out of time is already in the log
+    /// and applies. The drain has no expiry, so it must not stay open after
+    /// the statement failed.
+    #[tokio::test]
+    async fn a_drain_start_that_misses_its_deadline_does_not_stay_open() {
+        let cluster = crate::control::cluster::test_one_node::boot().await;
+        let state = Arc::clone(&cluster.state);
+        let id = DescriptorId::new(0, 1, DescriptorKind::Collection, "drain_probe");
+
+        let mut missed = 0;
+        for _ in 0..20 {
+            let attempt = conn_scope::scoped(async {
+                let _scope = deadline::enter(Some(Duration::ZERO), 30);
+                drain_for_ddl_async(&state, id.clone(), 1, Duration::from_secs(5), 0).await
+            })
+            .await;
+            match attempt {
+                Ok(()) => end_drain_async(&state, id.clone(), DrainOwner::Ddl)
+                    .await
+                    .expect("end the drain"),
+                Err(Error::DeadlineExceeded { .. }) => missed += 1,
+                Err(other) => panic!("unexpected drain error: {other}"),
+            }
+        }
+        assert!(
+            missed > 0,
+            "no drain start missed its deadline, so the test checked nothing"
+        );
+
+        let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
+        while state.lease_drain.is_draining(&id, 1) {
+            assert!(
+                tokio::time::Instant::now() < deadline,
+                "a drain start that missed its deadline left the drain open"
+            );
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        drop(state);
+        cluster.shutdown().await;
+    }
+}
diff --git a/nodedb/src/control/metadata_proposer/ddl_prepare.rs b/nodedb/src/control/metadata_proposer/ddl_prepare.rs
index a9eb2bffe..25e2f6f5d 100644
--- a/nodedb/src/control/metadata_proposer/ddl_prepare.rs
+++ b/nodedb/src/control/metadata_proposer/ddl_prepare.rs
@@ -166,15 +166,23 @@ pub(crate) async fn acquire_ddl_prepare_lease_async<'a>(
     let deadline = Instant::now() + DDL_PREPARE_WAIT;
 
     loop {
-        propose_metadata_and_wait_async(
-            shared,
-            handle,
-            &MetadataEntry::DdlPrepareAcquire {
+        let index = handle
+            .propose_async(encode_metadata(&MetadataEntry::DdlPrepareAcquire {
                 token,
                 node_id: shared.node_id,
-            },
-        )
-        .await?;
+            })?)
+            .await?;
+        if let Err(error) = await_metadata_apply(shared, index).await {
+            // The acquire is in the log and applies in log order, so this
+            // node will own the lease with no lease object to release it.
+            // The release applies after the acquire and is a no-op if the
+            // token never became owner.
+            shared
+                .lease_runtime
+                .releaser
+                .submit(crate::control::lease::releaser::ReleaseRequest::DdlPrepare { token });
+            return Err(error);
+        }
 
         loop {
             match owner_step(shared, token, deadline)? {
@@ -247,4 +255,46 @@ mod tests {
         drop(state);
         cluster.shutdown().await;
     }
+
+    /// An acquire whose apply wait runs out of time has already proposed its
+    /// token. The token must not stay the lease owner after the statement
+    /// failed: no lease object exists to release it, and the next DDL would
+    /// wait for the leader's reclaim.
+    #[tokio::test]
+    async fn an_acquire_that_misses_its_deadline_does_not_keep_the_lease() {
+        use crate::control::server::shared::session::{conn_scope, deadline};
+
+        let cluster = crate::control::cluster::test_one_node::boot().await;
+        let state = Arc::clone(&cluster.state);
+        let handle = state.metadata_raft_handle().expect("metadata raft handle");
+
+        let mut missed = 0;
+        for _ in 0..20 {
+            let attempt = conn_scope::scoped(async {
+                let _scope = deadline::enter(Some(Duration::ZERO), 30);
+                acquire_ddl_prepare_lease_async(&state, handle.as_ref()).await
+            })
+            .await;
+            match attempt {
+                Ok(lease) => lease.release().await,
+                Err(Error::DeadlineExceeded { .. }) => missed += 1,
+                Err(other) => panic!("unexpected acquire error: {other}"),
+            }
+        }
+        assert!(
+            missed > 0,
+            "no acquire missed its deadline, so the test checked nothing"
+        );
+
+        let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
+        while owner(&state).is_some() {
+            assert!(
+                tokio::time::Instant::now() < deadline,
+                "an acquire that missed its deadline left its token as the lease owner"
+            );
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        drop(state);
+        cluster.shutdown().await;
+    }
 }

From 37127fc279ff949c2f49a56e0ed16a2f58b96668 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 03:08:01 +0800
Subject: [PATCH 08/24] test(graph): drop the metadata workaround from the
 deadline test

deadline_never_leaves_a_partial_batch seeded one single-edge insert per
budget so the bounded statement never flagged the collection. That
statement could leave the metadata propose path blocked for 60 s. The
leak is fixed, so the test runs the bounded statement directly.
---
 .../tests/wire/cases/graph_dsl_batch_edges_random.rs   | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs b/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs
index 457f6abf2..11689c6c8 100644
--- a/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs
+++ b/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs
@@ -251,16 +251,6 @@ async fn deadline_never_leaves_a_partial_batch() {
             .exec(&format!("CREATE COLLECTION {collection}"))
             .await
             .unwrap();
-        // Flag the collection edge-bearing before the bounded statement. A
-        // deadline that expires inside that first metadata proposal leaves the
-        // metadata propose path blocked for 60 s (pre-existing, also hit by a
-        // single `GRAPH INSERT EDGE`), which would fail the next CREATE here.
-        server
-            .exec(&format!(
-                "GRAPH INSERT EDGE IN '{collection}' FROM 'seed' TO 'seed2' TYPE 'S'"
-            ))
-            .await
-            .unwrap();
         let edges = random_edges(0x400 + i as u64, EDGES);
 
         server

From 82ba77cb838a540d1796b9a548bed9ee4ec980ba Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Wed, 21 Oct 2026 13:21:30 +0800
Subject: [PATCH 09/24] fix(graph): decide the write policy of GRAPH DELETE
 EDGES per edge, one transaction

BatchEdge gains a write_gate slot, the same RlsWriteCheck type that
GraphOp::EdgeDelete carries as rls_write_check. The handler fills it per
edge from resolve_edge_write_rls. The per-edge fallback for governed
deletes is removed: every delete batch rides one Calvin transaction (or
one apply burst per source home when standalone).

Behaviour change: a delete batch with any denied edge is refused as a
whole and deletes nothing. Before, the allowed edges went and only the
denied edge stayed, with an error. The statement is now atomic, like the
insert batch and like a batch with a refused member.

Mechanism:
- Governed edges are decided before any write. Each source home runs one
  read-only ResolveEdgeDelete over an EdgeDeleteBatch. A live predicate
  cannot be sequenced or replicated, and a destination home holds no
  forward row to judge.
- Admitted edges carry decided_earlier_in_request. The Raft/Calvin wire
  form drops the slot and decode rebuilds it as already_decided_elsewhere.
- execute_edge_delete_batch also checks every gate before its first
  tombstone, so a predicate that reaches it directly refuses the whole
  batch with nothing written. A gate still at PendingInjection denies.
- rls_write_checks now lists the gate of every batch edge, so the
  replication guard refuses a batch that still holds a live predicate.

Tests: batch_delete_evaluates_the_write_policy_per_edge is replaced by
batch_delete_with_a_denied_edge_deletes_nothing (2 allowed + 1 denied:
all three edges survive, the error names the policy) and
batch_delete_of_only_allowed_edges_deletes_all. Data Plane unit tests
cover the denied, all-admitted and uninjected cases.
---
 .../src/physical_plan/graph/batch_edge.rs     |   8 +-
 .../physical_plan/rls_write_check_accessor.rs |   7 +
 .../calvin/scheduler/driver/core/routing.rs   |   1 +
 .../calvin/dependent_recon_node_edges.rs      |   1 +
 .../control/planner/calvin/edge_sequencing.rs |   1 +
 .../planner/calvin/submit/edge_slices.rs      |   1 +
 .../calvin/tx_class/write_keys/plan.rs        |   1 +
 .../src/control/planner/calvin/write_class.rs |   2 +
 .../ddl/neutral/graph_ops/edge_batch.rs       |  78 +++-------
 .../neutral/graph_ops/edge_batch_resolve.rs   | 109 +++++++++----
 .../ddl/neutral/tree_ops/create_index.rs      |   1 +
 .../server/shared/plan_util/collection.rs     |   1 +
 .../write_admission/write_order_fence.rs      |   1 +
 .../src/control/server/wal_dispatch/graph.rs  |   1 +
 .../control/wal_replication/decode/graph.rs   |   3 +
 .../executor/handlers/graph_edge_resolve.rs   |  51 +++++-
 .../handlers/graph_edge_write/delete_batch.rs | 146 ++++++++++++++++++
 .../handlers/graph_edge_write/put_batch.rs    |   1 +
 .../executor/handlers/graph_node_guard.rs     |   1 +
 .../inproc/cases/graph_cross_core_bfs.rs      |   1 +
 nodedb/tests/wire/cases/graph_batch_rls.rs    | 110 +++++++++----
 21 files changed, 413 insertions(+), 113 deletions(-)

diff --git a/nodedb-physical/src/physical_plan/graph/batch_edge.rs b/nodedb-physical/src/physical_plan/graph/batch_edge.rs
index 14f2f007d..40a56b1f9 100644
--- a/nodedb-physical/src/physical_plan/graph/batch_edge.rs
+++ b/nodedb-physical/src/physical_plan/graph/batch_edge.rs
@@ -2,13 +2,18 @@
 
 //! `BatchEdge`: one edge in an `EdgePutBatch` / `EdgeDeleteBatch`.
 
-use nodedb_types::{QualifiedCollection, Surrogate};
+use nodedb_types::{QualifiedCollection, RlsWriteCheck, Surrogate};
 
 /// One edge in an `EdgePutBatch` / `EdgeDeleteBatch`.
 ///
 /// `src_surrogate` / `dst_surrogate` carry the global row identity for the
 /// edge endpoints (resolved at construction time via the surrogate assigner).
 /// Neither is ever `Surrogate::ZERO`: an edge that carries it is refused.
+///
+/// `write_gate` is the edge's own write-policy check, the same slot
+/// `GraphOp::EdgeDelete` carries as `rls_write_check`. An `EdgeDeleteBatch`
+/// decides it per edge against the stored image, before any tombstone is
+/// written. An `EdgePutBatch` ignores it: a put is decided at injection.
 #[derive(
     Debug,
     Clone,
@@ -25,4 +30,5 @@ pub struct BatchEdge {
     pub dst_id: String,
     pub src_surrogate: Surrogate,
     pub dst_surrogate: Surrogate,
+    pub write_gate: RlsWriteCheck,
 }
diff --git a/nodedb-physical/src/physical_plan/rls_write_check_accessor.rs b/nodedb-physical/src/physical_plan/rls_write_check_accessor.rs
index 9d9bb37b7..05f7365e8 100644
--- a/nodedb-physical/src/physical_plan/rls_write_check_accessor.rs
+++ b/nodedb-physical/src/physical_plan/rls_write_check_accessor.rs
@@ -179,6 +179,13 @@ impl PhysicalPlan {
         {
             return vec![source_rls_write_check, dest_rls_write_check];
         }
+        // An edge batch carries one check per edge.
+        if let PhysicalPlan::Graph(
+            GraphOp::EdgePutBatch { edges } | GraphOp::EdgeDeleteBatch { edges },
+        ) = self
+        {
+            return edges.iter().map(|edge| &edge.write_gate).collect();
+        }
         // Every other op carries at most one check (`sole_rls_write_check`
         // is itself exhaustive over `PhysicalPlan`).
         self.sole_rls_write_check().into_iter().collect()
diff --git a/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs b/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs
index 82305dd4a..5a50fa580 100644
--- a/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs
+++ b/nodedb/src/control/cluster/calvin/scheduler/driver/core/routing.rs
@@ -471,6 +471,7 @@ mod tests {
             dst_id: dst.to_owned(),
             src_surrogate: Surrogate::new(1),
             dst_surrogate: Surrogate::new(2),
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         };
 
         // Two edges over the same endpoint pair: the union must dedupe.
diff --git a/nodedb/src/control/planner/calvin/dependent_recon_node_edges.rs b/nodedb/src/control/planner/calvin/dependent_recon_node_edges.rs
index dbe90cc81..e4b0f3017 100644
--- a/nodedb/src/control/planner/calvin/dependent_recon_node_edges.rs
+++ b/nodedb/src/control/planner/calvin/dependent_recon_node_edges.rs
@@ -293,6 +293,7 @@ fn build_node_delete_tasks(
                 dst_id: dst.clone(),
                 src_surrogate: surrogate_of(src)?,
                 dst_surrogate: surrogate_of(dst)?,
+                write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
             });
         }
         guards.push(PhysicalTask {
diff --git a/nodedb/src/control/planner/calvin/edge_sequencing.rs b/nodedb/src/control/planner/calvin/edge_sequencing.rs
index a2fb73234..ac008f5ce 100644
--- a/nodedb/src/control/planner/calvin/edge_sequencing.rs
+++ b/nodedb/src/control/planner/calvin/edge_sequencing.rs
@@ -161,6 +161,7 @@ mod tests {
             dst_id: "b".into(),
             src_surrogate: Surrogate::new(1),
             dst_surrogate: Surrogate::new(2),
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         }
     }
 
diff --git a/nodedb/src/control/planner/calvin/submit/edge_slices.rs b/nodedb/src/control/planner/calvin/submit/edge_slices.rs
index 23658f2bd..d195750fe 100644
--- a/nodedb/src/control/planner/calvin/submit/edge_slices.rs
+++ b/nodedb/src/control/planner/calvin/submit/edge_slices.rs
@@ -140,6 +140,7 @@ mod tests {
             dst_id: dst,
             src_surrogate: Surrogate::new(1),
             dst_surrogate: Surrogate::new(2),
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         }
     }
 
diff --git a/nodedb/src/control/planner/calvin/tx_class/write_keys/plan.rs b/nodedb/src/control/planner/calvin/tx_class/write_keys/plan.rs
index f56673983..1a2c25987 100644
--- a/nodedb/src/control/planner/calvin/tx_class/write_keys/plan.rs
+++ b/nodedb/src/control/planner/calvin/tx_class/write_keys/plan.rs
@@ -188,6 +188,7 @@ mod tests {
             dst_id: dst.to_owned(),
             src_surrogate: Surrogate::new(1),
             dst_surrogate: Surrogate::new(2),
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         }
     }
 
diff --git a/nodedb/src/control/planner/calvin/write_class.rs b/nodedb/src/control/planner/calvin/write_class.rs
index 8f1471ec1..e87ccd626 100644
--- a/nodedb/src/control/planner/calvin/write_class.rs
+++ b/nodedb/src/control/planner/calvin/write_class.rs
@@ -608,6 +608,7 @@ mod tests {
             dst_id: "b".to_owned(),
             src_surrogate: Surrogate::new(1),
             dst_surrogate: Surrogate::new(2),
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         };
         let plan = PhysicalPlan::Graph(GraphOp::EdgePutBatch { edges: vec![edge] });
         assert!(
@@ -625,6 +626,7 @@ mod tests {
             dst_id: "b".to_owned(),
             src_surrogate: Surrogate::new(1),
             dst_surrogate: Surrogate::new(2),
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         };
         let plan = PhysicalPlan::Graph(GraphOp::EdgeDeleteBatch { edges: vec![edge] });
         assert!(
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
index 565c3d539..1337b3ec1 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
@@ -4,7 +4,10 @@
 //!
 //! Split out of `edge.rs` to stay under the per-file line limit. Every triple is
 //! resolved (surrogates + write policy) on its own, then the batch is dispatched
-//! according to the route the process can serve:
+//! according to the route the process can serve. A delete under a write policy
+//! is decided before any write (`edge_batch_resolve::decide_governed_deletes`),
+//! so a denied edge refuses the whole statement and the allowed ones survive:
+//!
 //!
 //!  * Calvin available: ONE Calvin tx class holding ONE `GraphOp::EdgePutBatch` /
 //!    `EdgeDeleteBatch` task that carries every edge, whatever their endpoint
@@ -164,7 +167,9 @@ pub async fn insert_edges(
 /// `GRAPH DELETE EDGES IN '<collection>' VALUES ('<src>','<dst>','<label>'), ...`
 ///
 /// Batched twin of [`delete_edge`]. Every edge is resolved (surrogates + RLS)
-/// individually. The reported count is the Data Plane's own live-removal count:
+/// individually and carries its own write gate. Under a write policy the
+/// governed edges are decided first, in one read-only pass per source home:
+/// one denied edge refuses the whole statement before any write. The reported count is the Data Plane's own live-removal count:
 /// summed across the source-home buckets on the standalone route, and read from
 /// the tx class's summed owned-edge answer on the Calvin route, where each home
 /// counts the edges it owns and the answers add up. It is never the input
@@ -213,11 +218,9 @@ pub async fn delete_edges(
     let calvin_available =
         state.cluster_transport.is_some() && state.sequencer_inbox.get().is_some();
 
-    // Resolve every edge (surrogates + RLS). An edge whose delete carries a
-    // compiled policy predicate cannot ride `BatchEdge` — that type has no
-    // write-gate slot — so it keeps the single-edge path, where the Data Plane
-    // decides the predicate against the stored image. Every other edge batches.
-    let resolved = super::edge_batch_resolve::resolve_delete_edges(
+    // Resolve every edge (surrogates + RLS). Each edge carries its own write
+    // gate in `BatchEdge::write_gate`.
+    let mut batch: Vec<BatchEdge> = super::edge_batch_resolve::resolve_delete_edges(
         state,
         identity,
         database_id,
@@ -225,42 +228,14 @@ pub async fn delete_edges(
         edges,
     )
     .await?;
-    let batch: Vec<BatchEdge> = resolved.batch;
-    let governed: Vec<GraphEdgeTuple> = resolved.governed;
 
-    let mut removed: u64 = 0;
-
-    // Governed edges first, each through the single-edge path so a denial is
-    // reported per edge rather than silently bypassed by the batch plan.
-    for tuple in governed {
-        removed = removed.saturating_add(
-            super::edge_batch_resolve::delete_one_summing(
-                state,
-                identity,
-                database_id,
-                &collection,
-                tuple.src,
-                tuple.dst,
-                tuple.label,
-                txn_ctx,
-            )
-            .await?,
-        );
-    }
-
-    if calvin_available {
-        // Every edge may already have taken the governed per-edge route above,
-        // leaving nothing to batch. Building a tx class from an empty task list
-        // is `EmptyWriteSet`, which would report the statement as failed after
-        // those deletes already applied — and a write set is empty, not
-        // "written", so there is nothing to sequence.
-        if batch.is_empty() {
-            return Ok(vec![DdlResult::Status {
-                command: "DELETE EDGES".to_string(),
-                rows_affected: Some(removed),
-            }]);
-        }
+    // Decide the governed edges before any write: one denied edge refuses the
+    // whole statement and nothing is deleted. The batch then rides the route
+    // below as ONE transaction, policy or not.
+    super::edge_batch_resolve::decide_governed_deletes(state, tenant_id, database_id, &mut batch)
+        .await?;
 
+    let removed: u64 = if calvin_available {
         let task = batch_task(
             tenant_id,
             database_id,
@@ -275,20 +250,17 @@ pub async fn delete_edges(
             ));
         };
         data_plane_verdict(&response)?;
-        removed =
-            removed.saturating_add(super::edge::affected_count(&response, "batch edge delete")?);
+        super::edge::affected_count(&response, "batch edge delete")?
     } else {
         // Single-node: one apply burst per source home.
-        removed = removed.saturating_add(
-            super::edge_batch_resolve::dispatch_delete_batches_by_src_home(
-                state,
-                tenant_id,
-                database_id,
-                batch,
-            )
-            .await?,
-        );
-    }
+        super::edge_batch_resolve::dispatch_delete_batches_by_src_home(
+            state,
+            tenant_id,
+            database_id,
+            batch,
+        )
+        .await?
+    };
 
     Ok(vec![DdlResult::Status {
         command: "DELETE EDGES".to_string(),
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
index 21099162f..f4697e0c7 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
@@ -20,37 +20,23 @@ use super::super::super::result::DdlError;
 use super::bounded_edges::BoundedEdges;
 use super::support::ddl_err;
 
-/// One batch's worth of resolved delete edges, split by how they must be
-/// dispatched.
-pub(super) struct ResolvedDelete {
-    /// Edges that can ride a property-less `EdgeDeleteBatch` plan.
-    pub batch: Vec<BatchEdge>,
-    /// Edges a write policy governs. `BatchEdge` carries no write-gate slot, so
-    /// these keep the single-edge route where the Data Plane decides the
-    /// compiled predicate against the stored image. Batching them instead would
-    /// bypass the policy.
-    pub governed: Vec<GraphEdgeTuple>,
-}
-
 /// Resolve surrogate identities and the RLS verdict for every triple in a
 /// `GRAPH DELETE EDGES` statement.
 ///
 /// The verdict belongs to the injection pass: a delete carries no image, so a
-/// policy compiles into the plan's write-gate slot. Only a plan that ends up
-/// carrying a `Predicate` is governed — `NoPolicyApplies` means injection ran
-/// and found nothing for this identity here, which is the common case and the
-/// one that batches.
+/// policy compiles into the plan's write-gate slot. Each edge carries its own
+/// verdict in `BatchEdge::write_gate`: `Predicate` when a policy restricts the
+/// identity here, `NoPolicyApplies` otherwise. Every edge rides the batch.
 pub(super) async fn resolve_delete_edges(
     state: &SharedState,
     identity: &AuthenticatedIdentity,
     database_id: DatabaseId,
     collection: &str,
     edges: BoundedEdges,
-) -> Result<ResolvedDelete, DdlError> {
+) -> Result<Vec<BatchEdge>, DdlError> {
     let tenant_id = identity.tenant_id;
     let key = nodedb_types::CollectionKey::from_bare(database_id, collection);
     let mut batch: Vec<BatchEdge> = Vec::new();
-    let mut governed: Vec<GraphEdgeTuple> = Vec::new();
 
     let surrogates = assign_endpoints(state, key, tenant_id, &edges).await?;
     for (tuple, (src_surrogate, dst_surrogate)) in edges.into_iter().zip(surrogates) {
@@ -60,9 +46,9 @@ pub(super) async fn resolve_delete_edges(
             database_id,
             nodedb_physical::physical_plan::GraphOp::EdgeDelete {
                 collection: nodedb_types::QualifiedCollection::new(database_id, collection),
-                src_id: tuple.src.clone(),
-                label: tuple.label.clone(),
-                dst_id: tuple.dst.clone(),
+                src_id: tuple.src,
+                label: tuple.label,
+                dst_id: tuple.dst,
                 src_surrogate,
                 dst_surrogate,
                 rls_write_check: nodedb_types::RlsWriteCheck::pending_injection(),
@@ -83,11 +69,6 @@ pub(super) async fn resolve_delete_edges(
                 "edge delete plan changed shape during RLS resolution",
             ));
         };
-
-        if matches!(rls_write_check, nodedb_types::RlsWriteCheck::Predicate(_)) {
-            governed.push(tuple);
-            continue;
-        }
         batch.push(BatchEdge {
             collection: qc,
             src_id,
@@ -95,10 +76,82 @@ pub(super) async fn resolve_delete_edges(
             dst_id,
             src_surrogate,
             dst_surrogate,
+            write_gate: rls_write_check,
         });
     }
 
-    Ok(ResolvedDelete { batch, governed })
+    Ok(batch)
+}
+
+/// Decide the write gate of every governed edge before any edge is written.
+///
+/// A live predicate cannot be sequenced or replicated: a follower has no
+/// writing identity, and a destination home holds no forward row to judge.
+/// So each source home decides its own governed edges in one read-only pass
+/// (`ResolveEdgeDelete` over an `EdgeDeleteBatch`). One denied edge refuses the
+/// whole statement here, with nothing written. Each admitted edge then carries
+/// `decided_earlier_in_request`. An edge with no predicate costs nothing.
+///
+/// The read and the later write are two steps, as in the single-edge delete:
+/// an edge changed between them is decided against its earlier image.
+pub(super) async fn decide_governed_deletes(
+    state: &SharedState,
+    tenant_id: crate::types::TenantId,
+    database_id: DatabaseId,
+    batch: &mut [BatchEdge],
+) -> Result<(), DdlError> {
+    use std::collections::BTreeMap;
+
+    use nodedb_physical::physical_plan::GraphOp;
+
+    let mut buckets: BTreeMap<u32, Vec<BatchEdge>> = BTreeMap::new();
+    for edge in batch.iter().filter(|e| e.write_gate.has_predicate()) {
+        buckets
+            .entry(VShardId::from_key(edge.src_id.as_bytes()).as_u32())
+            .or_default()
+            .push(edge.clone());
+    }
+    for (vshard, group) in buckets {
+        let plan = crate::bridge::envelope::PhysicalPlan::Graph(GraphOp::ResolveEdgeDelete(
+            Box::new(GraphOp::EdgeDeleteBatch { edges: group }),
+        ));
+        let response = crate::control::maintenance::clone_materializer::dispatch_local_on_vshard(
+            state,
+            tenant_id,
+            database_id,
+            VShardId::new(vshard),
+            plan,
+            None,
+        )
+        .await
+        .map_err(|e| DdlError::from_error(&e))?;
+        if response.status != crate::bridge::envelope::Status::Ok {
+            // A policy refusal surfaces as the same `RejectedAuthz` a directly
+            // dispatched statement returns.
+            let error = match response.error_code {
+                Some(code) => match *code {
+                    crate::bridge::envelope::ErrorCode::RejectedAuthz { resource } => {
+                        crate::Error::RejectedAuthz {
+                            tenant_id,
+                            resource,
+                        }
+                    }
+                    other => crate::Error::DataPlane(other),
+                },
+                None => crate::Error::Dispatch {
+                    detail: format!(
+                        "batch edge delete: write-gate pass returned status {:?} with no error code",
+                        response.status
+                    ),
+                },
+            };
+            return Err(DdlError::from_error(&error));
+        }
+    }
+    for edge in batch.iter_mut().filter(|e| e.write_gate.has_predicate()) {
+        edge.write_gate = nodedb_types::RlsWriteCheck::decided_earlier_in_request();
+    }
+    Ok(())
 }
 
 /// Assign the surrogate of every endpoint of `edges`, as `(src, dst)` pairs in
@@ -176,6 +229,8 @@ pub(super) async fn resolve_insert_edges(
                     dst_id,
                     src_surrogate,
                     dst_surrogate,
+                    // A put is decided at injection, over its (empty) image.
+                    write_gate: nodedb_types::RlsWriteCheck::decided_earlier_in_request(),
                 });
             }
             // `BatchEdge` carries no properties, so an image-carrying plan
diff --git a/nodedb/src/control/server/shared/ddl/neutral/tree_ops/create_index.rs b/nodedb/src/control/server/shared/ddl/neutral/tree_ops/create_index.rs
index b71b34a31..8448345b5 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/tree_ops/create_index.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/tree_ops/create_index.rs
@@ -268,6 +268,7 @@ pub async fn create_graph_index(
             dst_id: child.to_string(),
             src_surrogate: *src_surrogate,
             dst_surrogate: *dst_surrogate,
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         });
         total_edges += 1;
     }
diff --git a/nodedb/src/control/server/shared/plan_util/collection.rs b/nodedb/src/control/server/shared/plan_util/collection.rs
index 9815c8a65..1c67fa74b 100644
--- a/nodedb/src/control/server/shared/plan_util/collection.rs
+++ b/nodedb/src/control/server/shared/plan_util/collection.rs
@@ -108,6 +108,7 @@ mod tests {
             dst_id: "b".into(),
             src_surrogate: Surrogate::new(1),
             dst_surrogate: Surrogate::new(2),
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         }
     }
 
diff --git a/nodedb/src/control/server/shared/write_admission/write_order_fence.rs b/nodedb/src/control/server/shared/write_admission/write_order_fence.rs
index 124eda5d4..915c8f2ce 100644
--- a/nodedb/src/control/server/shared/write_admission/write_order_fence.rs
+++ b/nodedb/src/control/server/shared/write_admission/write_order_fence.rs
@@ -222,6 +222,7 @@ mod tests {
                 dst_id: "b".into(),
                 src_surrogate: Surrogate::new(1),
                 dst_surrogate: Surrogate::new(2),
+                write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
             }],
         });
         assert!(matches!(row_write_scope(&plan), Some(WriteScope::Rows)));
diff --git a/nodedb/src/control/server/wal_dispatch/graph.rs b/nodedb/src/control/server/wal_dispatch/graph.rs
index 61c3c435b..fb183f93f 100644
--- a/nodedb/src/control/server/wal_dispatch/graph.rs
+++ b/nodedb/src/control/server/wal_dispatch/graph.rs
@@ -236,6 +236,7 @@ mod tests {
             dst_id: dst.to_string(),
             src_surrogate: Surrogate::new(1),
             dst_surrogate: Surrogate::new(2),
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         }
     }
 
diff --git a/nodedb/src/control/wal_replication/decode/graph.rs b/nodedb/src/control/wal_replication/decode/graph.rs
index 72383eb7a..d2466f079 100644
--- a/nodedb/src/control/wal_replication/decode/graph.rs
+++ b/nodedb/src/control/wal_replication/decode/graph.rs
@@ -82,6 +82,7 @@ fn batch_edges(edges: &[super::super::types::ReplicatedBatchEdge]) -> Vec<BatchE
             dst_id: e.dst_id.clone(),
             src_surrogate: nodedb_types::Surrogate::new(e.src_surrogate),
             dst_surrogate: nodedb_types::Surrogate::new(e.dst_surrogate),
+            write_gate: nodedb_types::RlsWriteCheck::already_decided_elsewhere(),
         })
         .collect()
 }
@@ -202,6 +203,8 @@ mod tests {
             dst_id: "bob".into(),
             src_surrogate: nodedb_types::Surrogate::new(11),
             dst_surrogate: nodedb_types::Surrogate::new(22),
+            // The wire form drops the slot; decode rebuilds it as decided.
+            write_gate: nodedb_types::RlsWriteCheck::already_decided_elsewhere(),
         };
         for plan in [
             PhysicalPlan::Graph(GraphOp::EdgePutBatch {
diff --git a/nodedb/src/data/executor/handlers/graph_edge_resolve.rs b/nodedb/src/data/executor/handlers/graph_edge_resolve.rs
index a0f2a1d8d..9f302e4e2 100644
--- a/nodedb/src/data/executor/handlers/graph_edge_resolve.rs
+++ b/nodedb/src/data/executor/handlers/graph_edge_resolve.rs
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: BUSL-1.1
 
-//! Read-only resolve pass for a governed `GraphOp::EdgeDelete`. Reads the
-//! edge's stored property object, decides the policy against it, and writes
-//! nothing. Success lets the Control Plane propose the delete with a
+//! Read-only resolve pass for a governed `GraphOp::EdgeDelete` or
+//! `GraphOp::EdgeDeleteBatch`. Reads each edge's stored property object,
+//! decides the policy against it, and writes nothing. Success lets the Control Plane propose the delete with a
 //! decided check; a refusal matches the direct delete's error.
 
 use nodedb_physical::physical_plan::GraphOp;
@@ -20,6 +20,14 @@ impl CoreLoop {
         tid: u64,
         inner: &GraphOp,
     ) -> Response {
+        if let GraphOp::EdgeDeleteBatch { edges } = inner {
+            // Read-only: decide every edge's gate, write nothing. The count is
+            // the number of edges decided, not a removal count.
+            return match self.admit_edge_deletes(task, tid, edges) {
+                Ok(()) => self.response_affected(task, edges.len() as u64),
+                Err(error) => self.response_error(task, error),
+            };
+        }
         let GraphOp::EdgeDelete {
             collection,
             src_id,
@@ -62,4 +70,41 @@ impl CoreLoop {
             Err(error) => self.response_error(task, error),
         }
     }
+
+    /// Decide every edge's write gate against its stored image, before any
+    /// tombstone of the batch is written.
+    ///
+    /// One denied edge refuses the whole batch with nothing written, so a
+    /// refused batch never leaves some of its edges deleted. An edge whose
+    /// gate admits all costs no read.
+    pub(in crate::data::executor) fn admit_edge_deletes(
+        &self,
+        task: &ExecutionTask,
+        tid: u64,
+        edges: &[nodedb_physical::physical_plan::BatchEdge],
+    ) -> crate::Result<()> {
+        use nodedb_types::WriteGateDecision;
+        for edge in edges {
+            if matches!(edge.write_gate.decision(), WriteGateDecision::AdmitAll) {
+                continue;
+            }
+            // A pre-image read error refuses the batch: read as absent, the
+            // edge would be denied for the wrong reason or admitted unread.
+            let stored = self.edge_store.get_edge(
+                task.request.database_id.as_u64(),
+                TenantId::new(tid),
+                edge.collection.as_str(),
+                &edge.src_id,
+                &edge.label,
+                &edge.dst_id,
+            )?;
+            crate::data::executor::handlers::rls_write_gate::admit_edge_properties(
+                &edge.write_gate,
+                stored.as_deref(),
+                tid,
+                edge.collection.as_str(),
+            )?;
+        }
+        Ok(())
+    }
 }
diff --git a/nodedb/src/data/executor/handlers/graph_edge_write/delete_batch.rs b/nodedb/src/data/executor/handlers/graph_edge_write/delete_batch.rs
index b533a3101..d4607b8c1 100644
--- a/nodedb/src/data/executor/handlers/graph_edge_write/delete_batch.rs
+++ b/nodedb/src/data/executor/handlers/graph_edge_write/delete_batch.rs
@@ -46,6 +46,12 @@ impl CoreLoop {
         }) {
             return self.response_error(task, refusal);
         }
+        // Each edge's write gate is decided against its stored image before
+        // any tombstone is written: one denied edge refuses the whole batch
+        // and nothing is deleted.
+        if let Err(error) = self.admit_edge_deletes(task, tid, edges) {
+            return self.response_error(task, error);
+        }
         let database_id = task.request.database_id.as_u64();
         let mut removed: u64 = 0;
         // Each edge's tombstone, at the ordinal decided here, journalled after
@@ -172,3 +178,143 @@ impl CoreLoop {
         response
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::bridge::envelope::Status;
+    use nodedb_physical::physical_plan::BatchEdge;
+    use nodedb_types::{QualifiedCollection, RlsWriteCheck, Surrogate};
+
+    use super::super::shared::EdgePutParams;
+    use super::super::shared::test_support::{affected_count, make_core, make_task_with_lsn};
+
+    /// Compiled filters equivalent to a `FOR WRITE` policy on `owner`.
+    fn owner_write_check(owner: &str) -> RlsWriteCheck {
+        let filter = crate::bridge::scan_filter::ScanFilter {
+            field: "owner".into(),
+            op: crate::bridge::scan_filter::FilterOp::Eq,
+            value: nodedb_types::Value::String(owner.into()),
+            clauses: Vec::new(),
+            expr: None,
+        };
+        RlsWriteCheck::Predicate(
+            zerompk::to_msgpack_vec(&vec![filter]).expect("encode policy filter"),
+        )
+    }
+
+    fn owner_properties(owner: &str) -> Vec<u8> {
+        nodedb_types::json_msgpack::json_to_msgpack(&serde_json::json!({ "owner": owner }))
+            .expect("encode properties")
+    }
+
+    fn batch_edge(dst: &str, n: u32, gate: RlsWriteCheck) -> BatchEdge {
+        BatchEdge {
+            collection: QualifiedCollection::new(crate::types::DatabaseId::DEFAULT, "knows"),
+            src_id: "a".into(),
+            label: "KNOWS".into(),
+            dst_id: dst.into(),
+            src_surrogate: Surrogate::new(1),
+            dst_surrogate: Surrogate::new(n),
+            write_gate: gate,
+        }
+    }
+
+    /// Seed `a -KNOWS-> b|c|d`, owned by alice, alice, mallory.
+    fn seeded() -> super::super::shared::test_support::CoreHarness {
+        let mut h = make_core();
+        for (lsn, dst, n, owner) in [
+            (10, "b", 2, "alice"),
+            (11, "c", 3, "alice"),
+            (12, "d", 4, "mallory"),
+        ] {
+            let task = make_task_with_lsn(lsn);
+            assert_eq!(
+                h.core
+                    .execute_edge_put(
+                        &task,
+                        EdgePutParams {
+                            tid: 1,
+                            collection: "knows",
+                            src_id: "a",
+                            label: "KNOWS",
+                            dst_id: dst,
+                            properties: &owner_properties(owner),
+                            src_surrogate: Surrogate::new(1),
+                            dst_surrogate: Surrogate::new(n),
+                        },
+                    )
+                    .status,
+                Status::Ok
+            );
+        }
+        h
+    }
+
+    fn live(h: &super::super::shared::test_support::CoreHarness, dst: &str) -> bool {
+        h.core
+            .edge_store
+            .get_edge(
+                crate::types::DatabaseId::DEFAULT.as_u64(),
+                TenantId::new(1),
+                "knows",
+                "a",
+                "KNOWS",
+                dst,
+            )
+            .expect("read edge back")
+            .is_some()
+    }
+
+    /// One denied edge refuses the whole batch: the allowed edges before and
+    /// after it stay too.
+    #[test]
+    fn a_denied_edge_refuses_the_batch_and_deletes_nothing() {
+        let mut h = seeded();
+        let alice = owner_write_check("alice");
+        let edges = [
+            batch_edge("b", 2, alice.clone()),
+            batch_edge("d", 4, alice.clone()),
+            batch_edge("c", 3, alice),
+        ];
+        let resp = h
+            .core
+            .execute_edge_delete_batch(&make_task_with_lsn(20), 1, &edges);
+        assert_eq!(resp.status, Status::Error);
+        assert!(
+            resp.write_set.is_empty(),
+            "a refused batch journals nothing"
+        );
+        for dst in ["b", "c", "d"] {
+            assert!(live(&h, dst), "edge to {dst} must survive a refused batch");
+        }
+    }
+
+    /// Edges the policy admits all go in one batch, and the count is theirs.
+    #[test]
+    fn an_all_admitted_batch_deletes_every_edge() {
+        let mut h = seeded();
+        let alice = owner_write_check("alice");
+        let edges = [batch_edge("b", 2, alice.clone()), batch_edge("c", 3, alice)];
+        let resp = h
+            .core
+            .execute_edge_delete_batch(&make_task_with_lsn(21), 1, &edges);
+        assert_eq!(resp.status, Status::Ok);
+        assert_eq!(affected_count(&resp), 2);
+        assert!(!live(&h, "b") && !live(&h, "c"));
+        assert!(live(&h, "d"), "an edge outside the batch must survive");
+    }
+
+    /// A gate still at `PendingInjection` denies the batch rather than
+    /// admitting it unchecked.
+    #[test]
+    fn an_uninjected_gate_refuses_the_batch() {
+        let mut h = seeded();
+        let edges = [batch_edge("b", 2, RlsWriteCheck::pending_injection())];
+        let resp = h
+            .core
+            .execute_edge_delete_batch(&make_task_with_lsn(22), 1, &edges);
+        assert_eq!(resp.status, Status::Error);
+        assert!(live(&h, "b"));
+    }
+}
diff --git a/nodedb/src/data/executor/handlers/graph_edge_write/put_batch.rs b/nodedb/src/data/executor/handlers/graph_edge_write/put_batch.rs
index 157fb5f7f..bc446dd35 100644
--- a/nodedb/src/data/executor/handlers/graph_edge_write/put_batch.rs
+++ b/nodedb/src/data/executor/handlers/graph_edge_write/put_batch.rs
@@ -190,6 +190,7 @@ mod tests {
             dst_id: dst.to_string(),
             src_surrogate: Surrogate::new(1),
             dst_surrogate: Surrogate::new(2),
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         }
     }
 
diff --git a/nodedb/src/data/executor/handlers/graph_node_guard.rs b/nodedb/src/data/executor/handlers/graph_node_guard.rs
index d10cdbaa7..e0cb7a4e5 100644
--- a/nodedb/src/data/executor/handlers/graph_node_guard.rs
+++ b/nodedb/src/data/executor/handlers/graph_node_guard.rs
@@ -238,6 +238,7 @@ mod tests {
             dst_id: dst.into(),
             src_surrogate: Surrogate::new(1),
             dst_surrogate: Surrogate::new(2),
+            write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
         }
     }
 
diff --git a/nodedb/tests/inproc/cases/graph_cross_core_bfs.rs b/nodedb/tests/inproc/cases/graph_cross_core_bfs.rs
index 2abf1fccb..c60c84ffb 100644
--- a/nodedb/tests/inproc/cases/graph_cross_core_bfs.rs
+++ b/nodedb/tests/inproc/cases/graph_cross_core_bfs.rs
@@ -44,6 +44,7 @@ async fn seed_star(server: &TestServer, collection: &str, leaf_prefix: &str, cou
                     dst_surrogate: nodedb_test_support::kv_rows::kv_row_surrogate(
                         format!("{leaf_prefix}{index}").as_bytes(),
                     ),
+                    write_gate: nodedb_types::RlsWriteCheck::NoPolicyApplies,
                 })
                 .collect(),
         }),
diff --git a/nodedb/tests/wire/cases/graph_batch_rls.rs b/nodedb/tests/wire/cases/graph_batch_rls.rs
index 9f4ec0287..a63f48cd7 100644
--- a/nodedb/tests/wire/cases/graph_batch_rls.rs
+++ b/nodedb/tests/wire/cases/graph_batch_rls.rs
@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: BUSL-1.1
 
-//! Batch write paths must evaluate the write policy **per edge**. A batch that
-//! mixes an allowed and a denied edge must land the allowed one and refuse the
-//! denied one; deciding policy once for the whole statement would be an
-//! isolation bug, and no test would catch it today.
+//! Batch write paths must evaluate the write policy **per edge**, and a
+//! statement is atomic. A batch that mixes an allowed and a denied edge is
+//! refused as a whole and writes nothing; a batch of only allowed edges lands
+//! in full. Deciding policy once for the whole statement would be an isolation
+//! bug.
 //!
 //! The endpoints here are co-resident on one vShard, so a refusal can only come
 //! from policy, never from cross-shard routing.
@@ -93,10 +94,26 @@ async fn has_labeled_edge(server: &TestServer, collection: &str, label: &str) ->
     })
 }
 
-/// A batch delete under a `FOR WRITE` owner policy must delete the conforming
-/// edge and refuse the violating one, both inside the same statement.
+/// Seed one edge per `(label, owner)` pair between the co-resident endpoints.
+async fn seed_owned_edges(server: &TestServer, collection: &str, edges: &[(&str, &str)]) {
+    for (label, owner) in edges {
+        server
+            .exec(&format!(
+                "GRAPH INSERT EDGE IN '{collection}' FROM '{EDGE_SRC}' TO '{EDGE_DST}' \
+                 TYPE '{label}' PROPERTIES '{{\"owner\":\"{owner}\"}}'"
+            ))
+            .await
+            .unwrap_or_else(|e| panic!("seed {label}: {e}"));
+        assert!(has_labeled_edge(server, collection, label).await);
+    }
+}
+
+/// A batch delete under a `FOR WRITE` owner policy is ONE atomic statement: a
+/// batch holding two conforming edges and one violating edge is refused as a
+/// whole. No edge is deleted, the two allowed ones included, and the error
+/// comes from the policy.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn batch_delete_evaluates_the_write_policy_per_edge() {
+async fn batch_delete_with_a_denied_edge_deletes_nothing() {
     let server = TestServer::start().await;
     let user = "g_batch_rls_delete_user";
     let collection = "g_batch_rls_delete";
@@ -106,44 +123,79 @@ async fn batch_delete_evaluates_the_write_policy_per_edge() {
         .expect("create edge collection");
     create_user(&server, user).await;
     write_policy(&server, "g_batch_rls_delete_policy", collection).await;
+    seed_owned_edges(
+        &server,
+        collection,
+        &[("owns1", user), ("steals", "someone-else"), ("owns2", user)],
+    )
+    .await;
 
-    // Two edges between the same endpoints, distinguished by label and owner:
-    // one the user may write, one they may not.
-    for (label, owner) in [("owns", user), ("steals", "someone-else")] {
-        server
-            .exec(&format!(
-                "GRAPH INSERT EDGE IN '{collection}' FROM '{EDGE_SRC}' TO '{EDGE_DST}' \
-                 TYPE '{label}' PROPERTIES '{{\"owner\":\"{owner}\"}}'"
-            ))
-            .await
-            .unwrap_or_else(|e| panic!("seed {label}: {e}"));
-    }
-    assert!(has_labeled_edge(&server, collection, "owns").await);
-    assert!(has_labeled_edge(&server, collection, "steals").await);
-
-    // The allowed edge comes first so a partial effect is observable: if the
-    // handler decided policy once for the statement, both or neither would go.
+    // The denied edge sits between the allowed ones, so a handler that applied
+    // edges in order until the first denial would delete `owns1` and keep the
+    // rest: a partial effect this test makes observable.
     let result = run_as(
         &server,
         user,
         &format!(
             "GRAPH DELETE EDGES IN '{collection}' VALUES \
-             ('{EDGE_SRC}','{EDGE_DST}','owns'), ('{EDGE_SRC}','{EDGE_DST}','steals')"
+             ('{EDGE_SRC}','{EDGE_DST}','owns1'), ('{EDGE_SRC}','{EDGE_DST}','steals'), \
+             ('{EDGE_SRC}','{EDGE_DST}','owns2')"
         ),
     )
     .await;
+    let message = result.expect_err("the denied edge must make the statement report an error");
     assert!(
-        result.is_err(),
-        "the denied edge must make the statement report an error: {result:?}"
+        message.contains("policy") || message.contains("RLS"),
+        "the error must come from the write policy: {message}"
     );
 
+    for label in ["owns1", "steals", "owns2"] {
+        assert!(
+            has_labeled_edge(&server, collection, label).await,
+            "edge {label} must survive: a refused batch deletes nothing"
+        );
+    }
+}
+
+/// A batch of only conforming edges under the same policy deletes every edge in
+/// one statement and reports the count.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn batch_delete_of_only_allowed_edges_deletes_all() {
+    let server = TestServer::start().await;
+    let user = "g_batch_rls_delete_ok_user";
+    let collection = "g_batch_rls_delete_ok";
+    server
+        .exec(&format!("CREATE COLLECTION {collection}"))
+        .await
+        .expect("create edge collection");
+    create_user(&server, user).await;
+    write_policy(&server, "g_batch_rls_delete_ok_policy", collection).await;
+    seed_owned_edges(
+        &server,
+        collection,
+        &[("owns1", user), ("owns2", user), ("steals", "someone-else")],
+    )
+    .await;
+
+    let result = run_as(
+        &server,
+        user,
+        &format!(
+            "GRAPH DELETE EDGES IN '{collection}' VALUES \
+             ('{EDGE_SRC}','{EDGE_DST}','owns1'), ('{EDGE_SRC}','{EDGE_DST}','owns2')"
+        ),
+    )
+    .await;
     assert!(
-        !has_labeled_edge(&server, collection, "owns").await,
-        "the conforming edge must be deleted"
+        result.is_ok(),
+        "a batch of conforming edges must be admitted: {result:?}"
     );
+
+    assert!(!has_labeled_edge(&server, collection, "owns1").await);
+    assert!(!has_labeled_edge(&server, collection, "owns2").await);
     assert!(
         has_labeled_edge(&server, collection, "steals").await,
-        "the denied edge must survive, and the error must come from policy, not from the first edge"
+        "an edge outside the batch must survive"
     );
 }
 

From 2679785429d3d64e2eac093dbf4300e635dc483c Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 07:40:14 +0800
Subject: [PATCH 10/24] docs(graph): pin the batch grammar limits and check the
 surrogate count

Two debug asserts check one surrogate pair per edge, so a zip cannot drop an
edge. Two parser tests pin what the flat field list accepts. The insert path
says why it accepts an empty response. A doc comment typo is fixed.
---
 nodedb-sql/src/ddl_ast/graph_parse/entry.rs   | 26 +++++++++++++++++++
 .../src/ddl_ast/statement/types/graph.rs      |  3 +--
 .../ddl/neutral/graph_ops/edge_batch.rs       |  3 +++
 .../neutral/graph_ops/edge_batch_resolve.rs   | 10 +++++++
 4 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/nodedb-sql/src/ddl_ast/graph_parse/entry.rs b/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
index b02095679..0c9da1d54 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
@@ -264,6 +264,32 @@ mod tests {
         );
     }
 
+    /// Pins the grammar limitation in the module doc: the tokenizer drops
+    /// `(`, `)` and `,`, so the parser reads a flat field list.
+    #[test]
+    fn batch_edge_reads_a_missing_comma_as_two_triples() {
+        let stmt = parsed("GRAPH INSERT EDGES IN 'edges' VALUES ('a','b','L') ('c','d','L')");
+        match stmt {
+            NodedbStatement::Graph(GraphStmt::GraphInsertEdges { edges, .. }) => {
+                assert_eq!(edges.len(), 2);
+            }
+            other => panic!("expected GraphInsertEdges, got {other:?}"),
+        }
+    }
+
+    /// Three bare words with no parentheses read as one triple.
+    #[test]
+    fn batch_edge_reads_three_bare_words_as_a_triple() {
+        let stmt = parsed("GRAPH INSERT EDGES IN 'edges' VALUES a b L");
+        match stmt {
+            NodedbStatement::Graph(GraphStmt::GraphInsertEdges { edges, .. }) => {
+                assert_eq!(edges.len(), 1);
+                assert_eq!(edges[0].src, "a");
+            }
+            other => panic!("expected GraphInsertEdges, got {other:?}"),
+        }
+    }
+
     #[test]
     fn batch_edge_rejects_per_edge_properties() {
         let error = try_parse("GRAPH INSERT EDGES IN 'edges' VALUES ('a','b','L') PROPERTIES '{}'")
diff --git a/nodedb-sql/src/ddl_ast/statement/types/graph.rs b/nodedb-sql/src/ddl_ast/statement/types/graph.rs
index d1b26b38a..36b8cded2 100644
--- a/nodedb-sql/src/ddl_ast/statement/types/graph.rs
+++ b/nodedb-sql/src/ddl_ast/statement/types/graph.rs
@@ -25,8 +25,7 @@ pub enum GraphStmt {
     ///
     /// The batch is deliberately property-less for now: the physical
     /// `BatchEdge` carries no property object, so per-edge `PROPERTIES`
-    /// stays on the single-edge form until `BatchEdge` grows one
-    ///
+    /// stays on the single-edge form until `BatchEdge` grows one.
     GraphInsertEdges {
         collection: String,
         edges: Vec<GraphEdgeTuple>,
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
index 1337b3ec1..53c290fd4 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
@@ -127,6 +127,9 @@ pub async fn insert_edges(
             PhysicalPlan::Graph(GraphOp::EdgePutBatch { edges: batch }),
         );
         let response = submit_batch_tx(state, task, tenant_id).await?;
+        // An insert reports no affected count, so a submit that returns no
+        // applied response is accepted. The delete path refuses it, because it
+        // reads its count from that response.
         if let Some(response) = response {
             data_plane_verdict(&response)?;
         }
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
index f4697e0c7..ad7811201 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
@@ -39,6 +39,11 @@ pub(super) async fn resolve_delete_edges(
     let mut batch: Vec<BatchEdge> = Vec::new();
 
     let surrogates = assign_endpoints(state, key, tenant_id, &edges).await?;
+    debug_assert_eq!(
+        edges.len(),
+        surrogates.len(),
+        "one surrogate pair per edge, else zip drops edges"
+    );
     for (tuple, (src_surrogate, dst_surrogate)) in edges.into_iter().zip(surrogates) {
         let resolved = super::edge_rls::resolve_edge_write_rls(
             state,
@@ -196,6 +201,11 @@ pub(super) async fn resolve_insert_edges(
     let mut batch: Vec<BatchEdge> = Vec::new();
 
     let surrogates = assign_endpoints(state, key, tenant_id, &edges).await?;
+    debug_assert_eq!(
+        edges.len(),
+        surrogates.len(),
+        "one surrogate pair per edge, else zip drops edges"
+    );
     for (tuple, (src_surrogate, dst_surrogate)) in edges.into_iter().zip(surrogates) {
         let resolved = super::edge_rls::resolve_edge_write_rls(
             state,

From c944fc7abec29fd292e4c6b2f11a33dc37455bc0 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 08:40:19 +0800
Subject: [PATCH 11/24] fix(graph): read the surrogate pairs with as_chunks

Clippy 1.99 refuses chunks_exact with a constant size.
---
 .../shared/ddl/neutral/graph_ops/edge_batch_resolve.rs     | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
index ad7811201..16e0a74b8 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch_resolve.rs
@@ -178,7 +178,12 @@ async fn assign_endpoints(
     let bound = assign_surrogates_routed(state, key, tenant_id, &pks, TraceId::ZERO)
         .await
         .map_err(|e| DdlError::from_error(&e))?;
-    Ok(bound.chunks_exact(2).map(|p| (p[0], p[1])).collect())
+    Ok(bound
+        .as_chunks::<2>()
+        .0
+        .iter()
+        .map(|[s, d]| (*s, *d))
+        .collect())
 }
 
 /// One batch's worth of resolved insert edges.

From f72de5953a33d47947eca340b37649a2015d9aad Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 09:56:02 +0800
Subject: [PATCH 12/24] fix(graph): refuse a batch VALUES tail that is not
 parenthesized triples

The tokenizer drops parentheses and commas, so a missing comma between
triples and three bare words parsed as valid batches. The batch parser now
checks the statement text for comma-separated parenthesized triples.
---
 .../src/ddl_ast/graph_parse/batch_shape.rs    | 150 ++++++++++++++++++
 nodedb-sql/src/ddl_ast/graph_parse/entry.rs   |  36 ++---
 nodedb-sql/src/ddl_ast/graph_parse/mod.rs     |  12 +-
 .../src/ddl_ast/graph_parse/variants.rs       |  30 ++--
 4 files changed, 184 insertions(+), 44 deletions(-)
 create mode 100644 nodedb-sql/src/ddl_ast/graph_parse/batch_shape.rs

diff --git a/nodedb-sql/src/ddl_ast/graph_parse/batch_shape.rs b/nodedb-sql/src/ddl_ast/graph_parse/batch_shape.rs
new file mode 100644
index 000000000..dd6d904fd
--- /dev/null
+++ b/nodedb-sql/src/ddl_ast/graph_parse/batch_shape.rs
@@ -0,0 +1,150 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Shape check of the `VALUES` tail of a batched edge statement.
+//!
+//! The tokenizer drops `(`, `)` and `,`, so the token list cannot tell
+//! `('a','b','L'), ('c','d','L')` from `('a','b','L') ('c','d','L')` or from
+//! three bare words. This check reads the statement's own text instead.
+
+/// Whether the text after the first unquoted `VALUES` is a comma-separated
+/// list of parenthesized triples, with an optional trailing `;`.
+pub(super) fn values_tail_is_triples(sql: &str) -> bool {
+    let Some(tail) = after_values(sql) else {
+        return false;
+    };
+    let mut chars = tail.chars().peekable();
+    loop {
+        skip_space(&mut chars);
+        if chars.next() != Some('(') {
+            return false;
+        }
+        for field in 0..3 {
+            skip_space(&mut chars);
+            if !read_field(&mut chars) {
+                return false;
+            }
+            skip_space(&mut chars);
+            let expected = if field == 2 { ')' } else { ',' };
+            if chars.next() != Some(expected) {
+                return false;
+            }
+        }
+        skip_space(&mut chars);
+        match chars.next() {
+            Some(',') => continue,
+            Some(';') => {
+                skip_space(&mut chars);
+                return chars.next().is_none();
+            }
+            None => return true,
+            Some(_) => return false,
+        }
+    }
+}
+
+type Chars<'a> = std::iter::Peekable<std::str::Chars<'a>>;
+
+fn skip_space(chars: &mut Chars<'_>) {
+    while chars.peek().is_some_and(|c| c.is_whitespace()) {
+        chars.next();
+    }
+}
+
+/// Read one quoted string (`''` escapes a quote) or one bare word.
+fn read_field(chars: &mut Chars<'_>) -> bool {
+    match chars.peek().copied() {
+        Some(quote @ ('\'' | '"')) => {
+            chars.next();
+            loop {
+                match chars.next() {
+                    None => return false,
+                    Some(c) if c == quote => {
+                        if chars.peek() == Some(&quote) {
+                            chars.next();
+                        } else {
+                            return true;
+                        }
+                    }
+                    Some(_) => {}
+                }
+            }
+        }
+        Some(c) if !c.is_whitespace() && !matches!(c, ',' | '(' | ')' | ';') => {
+            while chars
+                .peek()
+                .is_some_and(|c| !c.is_whitespace() && !matches!(c, ',' | '(' | ')' | ';'))
+            {
+                chars.next();
+            }
+            true
+        }
+        _ => false,
+    }
+}
+
+/// The text after the first `VALUES` word that sits outside a quoted string.
+fn after_values(sql: &str) -> Option<&str> {
+    let bytes = sql.as_bytes();
+    let mut quote: Option<u8> = None;
+    let mut i = 0;
+    while i < bytes.len() {
+        let b = bytes[i];
+        match quote {
+            Some(q) => {
+                if b == q {
+                    quote = None;
+                }
+            }
+            None => {
+                if b == b'\'' || b == b'"' {
+                    quote = Some(b);
+                } else if sql.is_char_boundary(i)
+                    && sql[i..].len() >= 6
+                    && sql.is_char_boundary(i + 6)
+                    && sql[i..i + 6].eq_ignore_ascii_case("VALUES")
+                    && (i == 0 || !bytes[i - 1].is_ascii_alphanumeric())
+                    && bytes.get(i + 6).is_none_or(|n| !n.is_ascii_alphanumeric())
+                {
+                    return Some(&sql[i + 6..]);
+                }
+            }
+        }
+        i += 1;
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::values_tail_is_triples as ok;
+
+    #[test]
+    fn accepts_comma_separated_triples() {
+        assert!(ok("IN 'e' VALUES ('a','b','L')"));
+        assert!(ok("IN 'e' VALUES ('a','b','L'), ('c','d','L');"));
+        assert!(ok("IN 'e' VALUES (a, b, L)"));
+        assert!(ok("IN 'e' VALUES ('a,(x)','it''s','L')"));
+    }
+
+    #[test]
+    fn refuses_a_missing_comma_between_triples() {
+        assert!(!ok("IN 'e' VALUES ('a','b','L') ('c','d','L')"));
+    }
+
+    #[test]
+    fn refuses_bare_words_without_parentheses() {
+        assert!(!ok("IN 'e' VALUES a b L"));
+    }
+
+    #[test]
+    fn refuses_a_trailing_comma_and_a_short_triple() {
+        assert!(!ok("IN 'e' VALUES ('a','b','L'),"));
+        assert!(!ok("IN 'e' VALUES ('a','b')"));
+        assert!(!ok("IN 'e' VALUES ('a','b','L','c')"));
+    }
+
+    #[test]
+    fn a_values_word_inside_the_collection_name_is_not_the_clause() {
+        assert!(ok("IN 'values' VALUES ('a','b','L')"));
+    }
+}
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/entry.rs b/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
index 0c9da1d54..717a023fc 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
@@ -63,9 +63,9 @@ fn parse_graph(sql: &str) -> Result<NodedbStatement, SqlError> {
     }
 
     if upper.starts_with("GRAPH INSERT EDGES ") {
-        variants::parse_insert_edges(&toks, sql.len())
+        variants::parse_insert_edges(&toks, sql)
     } else if upper.starts_with("GRAPH DELETE EDGES ") {
-        variants::parse_delete_edges(&toks, sql.len())
+        variants::parse_delete_edges(&toks, sql)
     } else if upper.starts_with("GRAPH INSERT EDGE ") {
         variants::parse_insert_edge(&toks)
     } else if upper.starts_with("GRAPH DELETE EDGE ") {
@@ -264,30 +264,22 @@ mod tests {
         );
     }
 
-    /// Pins the grammar limitation in the module doc: the tokenizer drops
-    /// `(`, `)` and `,`, so the parser reads a flat field list.
     #[test]
-    fn batch_edge_reads_a_missing_comma_as_two_triples() {
-        let stmt = parsed("GRAPH INSERT EDGES IN 'edges' VALUES ('a','b','L') ('c','d','L')");
-        match stmt {
-            NodedbStatement::Graph(GraphStmt::GraphInsertEdges { edges, .. }) => {
-                assert_eq!(edges.len(), 2);
-            }
-            other => panic!("expected GraphInsertEdges, got {other:?}"),
-        }
+    fn batch_edge_rejects_a_missing_comma_between_triples() {
+        let error = try_parse("GRAPH INSERT EDGES IN 'edges' VALUES ('a','b','L') ('c','d','L')")
+            .expect("input is graph DSL")
+            .expect_err("two triples without a comma are malformed");
+        assert!(
+            error.to_string().contains("triples"),
+            "the error must name the tuple shape: {error}"
+        );
     }
 
-    /// Three bare words with no parentheses read as one triple.
     #[test]
-    fn batch_edge_reads_three_bare_words_as_a_triple() {
-        let stmt = parsed("GRAPH INSERT EDGES IN 'edges' VALUES a b L");
-        match stmt {
-            NodedbStatement::Graph(GraphStmt::GraphInsertEdges { edges, .. }) => {
-                assert_eq!(edges.len(), 1);
-                assert_eq!(edges[0].src, "a");
-            }
-            other => panic!("expected GraphInsertEdges, got {other:?}"),
-        }
+    fn batch_edge_rejects_bare_words_without_parentheses() {
+        try_parse("GRAPH DELETE EDGES IN 'edges' VALUES a b L")
+            .expect("input is graph DSL")
+            .expect_err("three bare words are not a parenthesized triple");
     }
 
     #[test]
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/mod.rs b/nodedb-sql/src/ddl_ast/graph_parse/mod.rs
index 7d8fdd05f..3afe5ea6c 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/mod.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/mod.rs
@@ -18,14 +18,12 @@
 //! vocabulary, means no statement reaches the boundary at all. Both are
 //! reported as a parse error naming what is wrong.
 //!
-//! Accepted-grammar limitation for the batched edge statements: the tokenizer
-//! drops `(`, `)`, and `,`, so `GRAPH INSERT EDGES` reads the `VALUES` tail as
-//! a flat field list and only checks that its length is a multiple of three.
-//! `VALUES ('a','b','L'), ('c','d','L')` and `VALUES ('a','b','L')
-//! ('c','d','L')` produce the same two triples, and a trailing token is read as
-//! another triple's field rather than rejected. Closing that needs a tokenizer
-//! change, so it is tracked as a follow-up rather than fixed here.
+//! The tokenizer drops `(`, `)`, and `,`, so the batched edge statements check
+//! the shape of their `VALUES` tail on the statement text (`batch_shape`): a
+//! comma-separated list of parenthesized triples. A missing comma or a bare
+//! word list is a parse error.
 
+mod batch_shape;
 mod cursor;
 mod edge_predicate;
 mod entry;
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/variants.rs b/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
index 7488e8259..7ead48775 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
@@ -57,22 +57,16 @@ pub const MAX_EDGES_PER_BATCH: usize = nodedb_types::protocol::MAX_EDGES_PER_BAT
 /// megabytes. Whichever limit the statement exceeds first is the one reported.
 pub const MAX_BATCH_TEXT_BYTES: usize = nodedb_types::protocol::MAX_BATCH_TEXT_BYTES;
 
-pub(super) fn parse_insert_edges(
-    toks: &[Tok<'_>],
-    sql_len: usize,
-) -> Result<NodedbStatement, SqlError> {
-    let (collection, edges) = parse_edge_batch(toks, sql_len, "GRAPH INSERT EDGES")?;
+pub(super) fn parse_insert_edges(toks: &[Tok<'_>], sql: &str) -> Result<NodedbStatement, SqlError> {
+    let (collection, edges) = parse_edge_batch(toks, sql, "GRAPH INSERT EDGES")?;
     Ok(NodedbStatement::Graph(GraphStmt::GraphInsertEdges {
         collection,
         edges,
     }))
 }
 
-pub(super) fn parse_delete_edges(
-    toks: &[Tok<'_>],
-    sql_len: usize,
-) -> Result<NodedbStatement, SqlError> {
-    let (collection, edges) = parse_edge_batch(toks, sql_len, "GRAPH DELETE EDGES")?;
+pub(super) fn parse_delete_edges(toks: &[Tok<'_>], sql: &str) -> Result<NodedbStatement, SqlError> {
+    let (collection, edges) = parse_edge_batch(toks, sql, "GRAPH DELETE EDGES")?;
     Ok(NodedbStatement::Graph(GraphStmt::GraphDeleteEdges {
         collection,
         edges,
@@ -83,17 +77,20 @@ pub(super) fn parse_delete_edges(
 ///
 /// Grammar: `IN '<collection>' VALUES ('<src>','<dst>','<label>')[, (...)]*`.
 /// The tokenizer drops commas and parentheses, so the tuple structure is
-/// recovered by consuming value tokens in threes. A count that is not a
+/// recovered by consuming value tokens in threes, and the statement text is
+/// checked for the parenthesized, comma-separated shape. A count that is not a
 /// multiple of three is malformed. Per-edge `PROPERTIES` stays on the
 /// single-edge form until the physical `BatchEdge` can carry one.
 ///
-/// `sql_len` is the length of the statement's own text, which the caller
-/// measures before tokenizing because the tokenizer discards the separators.
+/// `sql` is the statement's own text. Its length bounds the statement before
+/// the field scan, and the shape check reads it because the tokenizer discards
+/// the separators.
 fn parse_edge_batch(
     toks: &[Tok<'_>],
-    sql_len: usize,
+    sql: &str,
     stmt: &'static str,
 ) -> Result<(String, Vec<GraphEdgeTuple>), SqlError> {
+    let sql_len = sql.len();
     // Bounded first: the field scan below clones every value, and a statement
     // over the cap must not pay for that copy before it is refused.
     if sql_len > MAX_BATCH_TEXT_BYTES {
@@ -135,7 +132,10 @@ fn parse_edge_batch(
             }
         }
     }
-    if fields.is_empty() || !fields.len().is_multiple_of(3) {
+    if fields.is_empty()
+        || !fields.len().is_multiple_of(3)
+        || !super::batch_shape::values_tail_is_triples(sql)
+    {
         return Err(SqlError::Parse {
             detail: format!("{stmt}: VALUES takes (src, dst, label) triples"),
         });

From bf667aa6580b67bd510a8b2a9bf82704e04516ee Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 09:56:02 +0800
Subject: [PATCH 13/24] feat(client): batch_graph_delete_edges sends one GRAPH
 DELETE EDGES statement

The insert and delete builders share one function with the same count and
text bounds. The method is inherent on the native and remote clients, because
the NodeDb trait file is at its line limit.
---
 nodedb-client/src/graph_dsl/mod.rs       |  4 +-
 nodedb-client/src/graph_dsl/pagerank.rs  | 50 ++++++++++++++++++++----
 nodedb-client/src/native/client/graph.rs | 15 +++++++
 nodedb-client/src/remote/client/graph.rs | 14 +++++++
 4 files changed, 74 insertions(+), 9 deletions(-)

diff --git a/nodedb-client/src/graph_dsl/mod.rs b/nodedb-client/src/graph_dsl/mod.rs
index 565dc9fcc..db1f2e7c4 100644
--- a/nodedb-client/src/graph_dsl/mod.rs
+++ b/nodedb-client/src/graph_dsl/mod.rs
@@ -10,5 +10,7 @@ pub(crate) mod pagerank;
 pub(crate) mod traverse;
 
 pub(crate) use decode::{decode_path_result, decode_traverse_result};
-pub(crate) use pagerank::{build_insert_edges_sql, build_pagerank_sql, parse_pagerank_rows};
+pub(crate) use pagerank::{
+    build_delete_edges_sql, build_insert_edges_sql, build_pagerank_sql, parse_pagerank_rows,
+};
 pub(crate) use traverse::{build_graph_path_sql, build_graph_traverse_sql};
diff --git a/nodedb-client/src/graph_dsl/pagerank.rs b/nodedb-client/src/graph_dsl/pagerank.rs
index 07e46f9a8..aca6179ce 100644
--- a/nodedb-client/src/graph_dsl/pagerank.rs
+++ b/nodedb-client/src/graph_dsl/pagerank.rs
@@ -104,21 +104,38 @@ pub(crate) use nodedb_types::protocol::{MAX_BATCH_TEXT_BYTES, MAX_EDGES_PER_BATC
 pub(crate) fn build_insert_edges_sql(
     collection: &str,
     edges: &[(&str, &str, &str)],
+) -> NodeDbResult<String> {
+    build_edges_sql("INSERT", "batch_graph_insert_edges", collection, edges)
+}
+
+/// Build one `GRAPH DELETE EDGES` statement for a list of `(src, dst, label)`
+/// triples. The bounds are the ones of [`build_insert_edges_sql`].
+pub(crate) fn build_delete_edges_sql(
+    collection: &str,
+    edges: &[(&str, &str, &str)],
+) -> NodeDbResult<String> {
+    build_edges_sql("DELETE", "batch_graph_delete_edges", collection, edges)
+}
+
+fn build_edges_sql(
+    verb: &str,
+    caller: &str,
+    collection: &str,
+    edges: &[(&str, &str, &str)],
 ) -> NodeDbResult<String> {
     if edges.is_empty() {
-        return Err(NodeDbError::storage(
-            "batch_graph_insert_edges requires at least one edge",
-        ));
+        return Err(NodeDbError::storage(format!(
+            "{caller} requires at least one edge"
+        )));
     }
     if edges.len() > MAX_EDGES_PER_BATCH_STATEMENT {
         return Err(NodeDbError::storage(format!(
-            "batch_graph_insert_edges carries at most {MAX_EDGES_PER_BATCH_STATEMENT} edges per \
-             statement, got {}",
+            "{caller} carries at most {MAX_EDGES_PER_BATCH_STATEMENT} edges per statement, got {}",
             edges.len()
         )));
     }
     let mut sql = format!(
-        "GRAPH INSERT EDGES IN {} VALUES ",
+        "GRAPH {verb} EDGES IN {} VALUES ",
         quote_string_literal(collection)
     );
     for (i, (from, to, label)) in edges.iter().enumerate() {
@@ -141,8 +158,7 @@ pub(crate) fn build_insert_edges_sql(
     // actually built, so the client refuses the same statements the parser does.
     if sql.len() > MAX_BATCH_TEXT_BYTES {
         return Err(NodeDbError::storage(format!(
-            "batch_graph_insert_edges builds at most {MAX_BATCH_TEXT_BYTES} bytes of SQL text per \
-             statement, got {}",
+            "{caller} builds at most {MAX_BATCH_TEXT_BYTES} bytes of SQL text per statement, got {}",
             sql.len()
         )));
     }
@@ -228,6 +244,24 @@ mod tests {
         assert_eq!(sql.matches("GRAPH INSERT EDGES").count(), 1);
     }
 
+    #[test]
+    fn delete_edges_sql_carries_every_triple_in_one_statement() {
+        let sql = build_delete_edges_sql("c", &[("a", "b", "L"), ("b", "c", "L")]).unwrap();
+        assert_eq!(
+            sql,
+            "GRAPH DELETE EDGES IN 'c' VALUES ('a','b','L'),('b','c','L')"
+        );
+    }
+
+    #[test]
+    fn delete_edges_sql_refuses_an_empty_batch() {
+        let error = build_delete_edges_sql("c", &[]).expect_err("an empty batch has nothing to do");
+        assert!(
+            error.to_string().contains("batch_graph_delete_edges"),
+            "the error must name the caller: {error}"
+        );
+    }
+
     #[test]
     fn insert_edges_sql_escapes_every_field() {
         // A quote in any field must not break out of its literal.
diff --git a/nodedb-client/src/native/client/graph.rs b/nodedb-client/src/native/client/graph.rs
index cfd4d8544..e5926bcb5 100644
--- a/nodedb-client/src/native/client/graph.rs
+++ b/nodedb-client/src/native/client/graph.rs
@@ -32,6 +32,21 @@ impl NativeClient {
         conn.execute_sql(&sql).await.map(|_| ())
     }
 
+    /// Delete a batch of edges as ONE `GRAPH DELETE EDGES` statement.
+    ///
+    /// A delete of an absent edge counts zero, and a refused edge refuses the
+    /// whole batch. This is an inherent method: the `NodeDb` trait file is at
+    /// its line limit.
+    pub async fn batch_graph_delete_edges(
+        &self,
+        collection: &str,
+        edges: &[(&str, &str, &str)],
+    ) -> NodeDbResult<()> {
+        let sql = crate::graph_dsl::build_delete_edges_sql(collection, edges)?;
+        let mut conn = self.pool.acquire().await?;
+        conn.execute_sql(&sql).await.map(|_| ())
+    }
+
     pub(super) async fn graph_traverse_impl(
         &self,
         collection: &str,
diff --git a/nodedb-client/src/remote/client/graph.rs b/nodedb-client/src/remote/client/graph.rs
index ca6ac8e65..5a53b54eb 100644
--- a/nodedb-client/src/remote/client/graph.rs
+++ b/nodedb-client/src/remote/client/graph.rs
@@ -28,6 +28,20 @@ impl NodeDbRemote {
         self.simple_query_raw(&sql).await.map(|_| ())
     }
 
+    /// Delete a batch of edges as ONE `GRAPH DELETE EDGES` statement.
+    ///
+    /// A delete of an absent edge counts zero, and a refused edge refuses the
+    /// whole batch. This is an inherent method: the `NodeDb` trait file is at
+    /// its line limit.
+    pub async fn batch_graph_delete_edges(
+        &self,
+        collection: &str,
+        edges: &[(&str, &str, &str)],
+    ) -> NodeDbResult<()> {
+        let sql = crate::graph_dsl::build_delete_edges_sql(collection, edges)?;
+        self.simple_query_raw(&sql).await.map(|_| ())
+    }
+
     pub(super) async fn graph_traverse_impl(
         &self,
         collection: &str,

From 8968e754dc6d6c6c77c995a7ce9f6b2e7c75ea3c Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 09:56:03 +0800
Subject: [PATCH 14/24] fix(graph): say a deadline on a batch edge write leaves
 the outcome unknown

A batch is one sequenced transaction. A deadline ends the wait, not the
transaction, so the error now says every edge landed or none did and a retry
is safe.
---
 .../shared/ddl/neutral/graph_ops/edge_batch.rs      | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
index 53c290fd4..783a963b0 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
@@ -306,7 +306,14 @@ async fn submit_batch_tx(
 ) -> Result<Option<Response>, DdlError> {
     let tx_class = build_single_vshard_tx_class(std::slice::from_ref(&task), tenant_id, &[])
         .map_err(|e| DdlError::from_error(&e))?;
-    submit_calvin_routed(state, tx_class)
-        .await
-        .map_err(|e| DdlError::from_error(&e))
+    submit_calvin_routed(state, tx_class).await.map_err(|e| {
+        let error = DdlError::from_error(&e);
+        // The batch is one sequenced transaction. A deadline ends the wait, not
+        // the transaction, so the client must not read the error as a refusal.
+        if matches!(e, crate::Error::DeadlineExceeded { .. }) {
+            error.in_context("batch outcome unknown, every edge landed or none did, retry is safe")
+        } else {
+            error
+        }
+    })
 }

From 958525b54f2a40b9f2a880d18b5e69e1bc1cbc71 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 10:47:40 +0800
Subject: [PATCH 15/24] test(graph): a batch deadline error that landed every
 edge says the outcome is unknown

---
 .../tests/wire/cases/graph_dsl_batch_edges_random.rs   | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs b/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs
index 11689c6c8..92c31a349 100644
--- a/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs
+++ b/nodedb/tests/wire/cases/graph_dsl_batch_edges_random.rs
@@ -285,6 +285,16 @@ async fn deadline_never_leaves_a_partial_batch() {
                 "budget {budget}: success must land every edge"
             );
         }
+        // An error that still landed every edge must not read as a refusal.
+        if let Err(error) = &outcome
+            && landed == EDGES
+        {
+            let text = format!("{error:?}");
+            assert!(
+                text.contains("outcome unknown"),
+                "budget {budget}: a deadline error after a landed batch must say the outcome is unknown: {text}"
+            );
+        }
         if landed == EDGES {
             assert_eq!(
                 landed_in(&server, &collection, &edges).await,

From ce33f11cccf25464053f60748baada16d61689f4 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 11:08:13 +0800
Subject: [PATCH 16/24] refactor(graph): name the batch command word count and
 drop the dead shard fallback

batch_home reads the home of the first edge and refuses an empty batch with
XX000, so a batch task never falls back to shard 0. The batch parser names its
three command words.
---
 .../src/ddl_ast/graph_parse/variants.rs       |  5 +++-
 .../ddl/neutral/graph_ops/edge_batch.rs       | 29 ++++++++++++-------
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/nodedb-sql/src/ddl_ast/graph_parse/variants.rs b/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
index 7ead48775..58c49ead5 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
@@ -57,6 +57,9 @@ pub const MAX_EDGES_PER_BATCH: usize = nodedb_types::protocol::MAX_EDGES_PER_BAT
 /// megabytes. Whichever limit the statement exceeds first is the one reported.
 pub const MAX_BATCH_TEXT_BYTES: usize = nodedb_types::protocol::MAX_BATCH_TEXT_BYTES;
 
+/// The command words of a batch statement: `GRAPH INSERT EDGES`, `GRAPH DELETE EDGES`.
+const BATCH_COMMAND_WORDS: usize = 3;
+
 pub(super) fn parse_insert_edges(toks: &[Tok<'_>], sql: &str) -> Result<NodedbStatement, SqlError> {
     let (collection, edges) = parse_edge_batch(toks, sql, "GRAPH INSERT EDGES")?;
     Ok(NodedbStatement::Graph(GraphStmt::GraphInsertEdges {
@@ -101,7 +104,7 @@ fn parse_edge_batch(
             ),
         });
     }
-    let mut c = Cursor::new(toks, stmt, 3);
+    let mut c = Cursor::new(toks, stmt, BATCH_COMMAND_WORDS);
     if !c.eat_keyword("IN") {
         return Err(missing_clause(stmt, "IN <collection>"));
     }
diff --git a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
index 783a963b0..e54f790bf 100644
--- a/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
+++ b/nodedb/src/control/server/shared/ddl/neutral/graph_ops/edge_batch.rs
@@ -121,10 +121,12 @@ pub async fn insert_edges(
     let batch: Vec<BatchEdge> = resolved.batch;
 
     if calvin_available {
+        let home = batch_home(&batch)?;
         let task = batch_task(
             tenant_id,
             database_id,
             PhysicalPlan::Graph(GraphOp::EdgePutBatch { edges: batch }),
+            home,
         );
         let response = submit_batch_tx(state, task, tenant_id).await?;
         // An insert reports no affected count, so a submit that returns no
@@ -239,10 +241,12 @@ pub async fn delete_edges(
         .await?;
 
     let removed: u64 = if calvin_available {
+        let home = batch_home(&batch)?;
         let task = batch_task(
             tenant_id,
             database_id,
             PhysicalPlan::Graph(GraphOp::EdgeDeleteBatch { edges: batch }),
+            home,
         );
         let response = submit_batch_tx(state, task, tenant_id).await?;
         let Some(response) = response else {
@@ -271,19 +275,24 @@ pub async fn delete_edges(
     }])
 }
 
+/// The source home of the first edge of a batch. The batch is never empty
+/// here: `BoundedEdges` refuses an empty statement.
+fn batch_home(edges: &[BatchEdge]) -> Result<VShardId, DdlError> {
+    edges
+        .first()
+        .map(|e| VShardId::from_key(e.src_id.as_bytes()))
+        .ok_or_else(|| ddl_err("XX000", "batch edge statement resolved to no edge"))
+}
+
 /// The one task of a batch's tx class. Its plan names every edge, so the
 /// plan's routing is the union of the edges' homes. `vshard_id` is only the
 /// first edge's source home: the submit path routes by the plan.
-fn batch_task(tenant_id: TenantId, database_id: DatabaseId, plan: PhysicalPlan) -> PhysicalTask {
-    let vshard_id = match &plan {
-        PhysicalPlan::Graph(GraphOp::EdgePutBatch { edges })
-        | PhysicalPlan::Graph(GraphOp::EdgeDeleteBatch { edges }) => {
-            edges.first().map_or(VShardId::new(0), |e| {
-                VShardId::from_key(e.src_id.as_bytes())
-            })
-        }
-        _ => VShardId::new(0),
-    };
+fn batch_task(
+    tenant_id: TenantId,
+    database_id: DatabaseId,
+    plan: PhysicalPlan,
+    vshard_id: VShardId,
+) -> PhysicalTask {
     PhysicalTask {
         tenant_id,
         vshard_id,

From 1f7461cb135ffed50682b7a52a2a6faad52c3d2f Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 11:50:52 +0800
Subject: [PATCH 17/24] fix(graph): list a self-loop once for DIRECTION both in
 GRAPH NEIGHBORS

A self-loop is one edge and sits in both the outbound and the inbound list of
its node. DIRECTION both read both lists and returned the edge twice. The
inbound pass now skips an edge whose neighbor is the node itself when the
outbound pass already ran. The durable lookup, the collection-scoped lookup
and the transaction overlay merge share the rule.
---
 nodedb-graph/src/csr/index/lookup.rs          | 33 ++++++-
 nodedb-graph/src/csr/index/scoped.rs          |  4 +-
 .../data/executor/handlers/graph_txn_merge.rs |  4 +
 .../wire/cases/graph_neighbors_entries.rs     | 99 +++++++++++++++++++
 nodedb/tests/wire/cases/mod.rs                |  1 +
 5 files changed, 139 insertions(+), 2 deletions(-)
 create mode 100644 nodedb/tests/wire/cases/graph_neighbors_entries.rs

diff --git a/nodedb-graph/src/csr/index/lookup.rs b/nodedb-graph/src/csr/index/lookup.rs
index b96507d69..b4e650a6f 100644
--- a/nodedb-graph/src/csr/index/lookup.rs
+++ b/nodedb-graph/src/csr/index/lookup.rs
@@ -67,7 +67,9 @@ impl CsrIndex {
         }
         if matches!(direction, Direction::In | Direction::Both) {
             for (lid, src) in self.dense_iter_in(node_id) {
-                if labels.keeps(lid) {
+                // A self-loop is one edge. `Both` read it in the outbound pass.
+                let repeats_self_loop = direction == Direction::Both && src == node_id;
+                if labels.keeps(lid) && !repeats_self_loop {
                     result.push((
                         self.id_to_label[lid as usize].clone(),
                         self.id_to_node[src as usize].clone(),
@@ -412,6 +414,35 @@ mod tests {
             .collect()
     }
 
+    #[test]
+    fn both_directions_list_a_self_loop_once() {
+        use crate::csr::Direction;
+
+        let mut csr = CsrIndex::new(test_memory());
+        csr.add_edge("a", "L", "b").unwrap();
+        csr.add_edge("a", "L", "a").unwrap();
+        csr.add_edge("c", "L", "d").unwrap();
+        csr.add_edge("d", "L", "c").unwrap();
+        for compacted in [false, true] {
+            if compacted {
+                csr.compact().unwrap();
+            }
+            let mut both = csr.neighbors("a", &[], Direction::Both);
+            both.sort();
+            assert_eq!(
+                both,
+                vec![
+                    ("L".to_string(), "a".to_string()),
+                    ("L".to_string(), "b".to_string())
+                ],
+                "compacted: {compacted}"
+            );
+            assert_eq!(csr.neighbors("a", &[], Direction::In).len(), 1);
+            // Two distinct edges to one neighbour stay two entries.
+            assert_eq!(csr.neighbors("c", &[], Direction::Both).len(), 2);
+        }
+    }
+
     #[test]
     fn live_iterators_preserve_dense_then_buffer_order() {
         let mut csr = CsrIndex::new(test_memory());
diff --git a/nodedb-graph/src/csr/index/scoped.rs b/nodedb-graph/src/csr/index/scoped.rs
index 8eb780d71..eeeb19e22 100644
--- a/nodedb-graph/src/csr/index/scoped.rs
+++ b/nodedb-graph/src/csr/index/scoped.rs
@@ -49,7 +49,9 @@ impl CsrIndex {
         }
         if matches!(direction, Direction::In | Direction::Both) {
             for (lid, src) in self.iter_in_edges_raw_in(node_id, collection_id) {
-                if keep(lid) {
+                // A self-loop is one edge. `Both` read it in the outbound pass.
+                let repeats_self_loop = direction == Direction::Both && src == node_id;
+                if keep(lid) && !repeats_self_loop {
                     result.push((
                         self.id_to_label[lid as usize].clone(),
                         self.id_to_node[src as usize].clone(),
diff --git a/nodedb/src/data/executor/handlers/graph_txn_merge.rs b/nodedb/src/data/executor/handlers/graph_txn_merge.rs
index 53ff3e85d..ca67b504f 100644
--- a/nodedb/src/data/executor/handlers/graph_txn_merge.rs
+++ b/nodedb/src/data/executor/handlers/graph_txn_merge.rs
@@ -71,9 +71,13 @@ pub(in crate::data::executor) fn merge_graph_txn_overlay_neighbors(
     let mut merged: Vec<(String, String)> = Vec::new();
     for &pass in Orientation::passes(direction) {
         let durable = durable_of(pass.direction());
+        // A self-loop is one edge. `Both` read it in the outbound pass.
+        let repeats_self_loop =
+            |node: &str| direction == Direction::Both && pass == Orientation::In && node == node_id;
         merged.extend(
             merge_staged_hop_pass(overlay, scope, node_id, pass, durable)
                 .into_iter()
+                .filter(|(_, node, _)| !repeats_self_loop(node))
                 .map(|(label, node, _)| (label, node)),
         );
     }
diff --git a/nodedb/tests/wire/cases/graph_neighbors_entries.rs b/nodedb/tests/wire/cases/graph_neighbors_entries.rs
new file mode 100644
index 000000000..001a11a64
--- /dev/null
+++ b/nodedb/tests/wire/cases/graph_neighbors_entries.rs
@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! `GRAPH NEIGHBORS ... DIRECTION both` answers each physical edge once.
+//!
+//! A self-loop is one edge and sits in both the outbound and the inbound list
+//! of its node. Two distinct edges between one pair of nodes stay two entries.
+
+use crate::harness::TestServer;
+
+async fn entries(server: &TestServer, sql: &str) -> Vec<(String, String)> {
+    let rows = server.query_text(sql).await.unwrap();
+    let parsed: Vec<serde_json::Value> = serde_json::from_str(&rows.join("")).unwrap();
+    let mut out: Vec<(String, String)> = parsed
+        .iter()
+        .map(|e| {
+            (
+                e["label"].as_str().unwrap().to_owned(),
+                e["node"].as_str().unwrap().to_owned(),
+            )
+        })
+        .collect();
+    out.sort();
+    out
+}
+
+fn pair(label: &str, node: &str) -> (String, String) {
+    (label.to_owned(), node.to_owned())
+}
+
+async fn seed(server: &TestServer, collection: &str) {
+    server
+        .exec(&format!("CREATE COLLECTION {collection}"))
+        .await
+        .unwrap();
+    for (src, dst) in [("a", "b"), ("a", "a"), ("c", "d"), ("d", "c")] {
+        server
+            .exec(&format!(
+                "GRAPH INSERT EDGE IN '{collection}' FROM '{src}' TO '{dst}' TYPE 'l'"
+            ))
+            .await
+            .unwrap();
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn both_directions_list_a_self_loop_once() {
+    let server = TestServer::start().await;
+    seed(&server, "nbr_loop").await;
+
+    let both = entries(
+        &server,
+        "GRAPH NEIGHBORS IN 'nbr_loop' OF 'a' DIRECTION both",
+    )
+    .await;
+    assert_eq!(both, vec![pair("l", "a"), pair("l", "b")]);
+
+    let out = entries(
+        &server,
+        "GRAPH NEIGHBORS IN 'nbr_loop' OF 'a' DIRECTION out",
+    )
+    .await;
+    assert_eq!(out, vec![pair("l", "a"), pair("l", "b")]);
+
+    let inbound = entries(&server, "GRAPH NEIGHBORS IN 'nbr_loop' OF 'a' DIRECTION in").await;
+    assert_eq!(inbound, vec![pair("l", "a")]);
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn two_edges_between_one_pair_stay_two_entries() {
+    let server = TestServer::start().await;
+    seed(&server, "nbr_pair").await;
+
+    let both = entries(
+        &server,
+        "GRAPH NEIGHBORS IN 'nbr_pair' OF 'c' DIRECTION both",
+    )
+    .await;
+    assert_eq!(both, vec![pair("l", "d"), pair("l", "d")]);
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_staged_self_loop_is_listed_once_inside_a_transaction() {
+    let server = TestServer::start().await;
+    seed(&server, "nbr_txn").await;
+
+    server.exec("BEGIN").await.unwrap();
+    server
+        .exec("GRAPH INSERT EDGE IN 'nbr_txn' FROM 'x' TO 'x' TYPE 'l'")
+        .await
+        .unwrap();
+    let both = entries(
+        &server,
+        "GRAPH NEIGHBORS IN 'nbr_txn' OF 'x' DIRECTION both",
+    )
+    .await;
+    server.exec("ROLLBACK").await.unwrap();
+
+    assert_eq!(both, vec![pair("l", "x")]);
+}
diff --git a/nodedb/tests/wire/cases/mod.rs b/nodedb/tests/wire/cases/mod.rs
index dd4919e22..6bea5b514 100644
--- a/nodedb/tests/wire/cases/mod.rs
+++ b/nodedb/tests/wire/cases/mod.rs
@@ -128,6 +128,7 @@ mod graph_dsl_handlers;
 mod graph_dsl_label_sets;
 mod graph_edge_predicate;
 mod graph_match_authorization;
+mod graph_neighbors_entries;
 mod graph_rag_fusion;
 mod graph_rag_fusion_naming;
 mod graph_timeseries_rls_probe;

From f1f52f5dd2fe76ee23b1c14f0130e6e1a3e077ab Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 19:29:07 +0800
Subject: [PATCH 18/24] test(graph): a denied batch edge write answers SQLSTATE
 42501

The batch delete with a denied edge, the batch insert that needs a property and
the single-edge delete under the same policy all assert the SQLSTATE, not only
the message.
---
 nodedb/tests/wire/cases/graph_batch_rls.rs | 73 +++++++++++++++++++---
 1 file changed, 65 insertions(+), 8 deletions(-)

diff --git a/nodedb/tests/wire/cases/graph_batch_rls.rs b/nodedb/tests/wire/cases/graph_batch_rls.rs
index a63f48cd7..b539ee493 100644
--- a/nodedb/tests/wire/cases/graph_batch_rls.rs
+++ b/nodedb/tests/wire/cases/graph_batch_rls.rs
@@ -16,6 +16,9 @@ use crate::harness::TestServer;
 const PASSWORD: &str = "graph-batch-rls-probe-secret-9";
 const ROLE: &str = "readwrite";
 
+/// SQLSTATE of a write refused by policy (`insufficient_privilege`).
+const DENIED_SQLSTATE: &str = "42501";
+
 /// Endpoints chosen so both hash to one vShard. Mirrors the single-edge probe
 /// premise; a cross-shard edge would be refused before the policy gate.
 const EDGE_SRC: &str = "a";
@@ -52,16 +55,16 @@ async fn write_policy(server: &TestServer, policy: &str, collection: &str) {
         .unwrap_or_else(|e| panic!("create write policy {policy}: {e}"));
 }
 
-/// Run `sql` as `user`, returning the server's error message on failure.
-async fn run_as(server: &TestServer, user: &str, sql: &str) -> Result<(), String> {
+/// Run `sql` as `user`, returning `(sqlstate, message)` on failure.
+async fn run_as(server: &TestServer, user: &str, sql: &str) -> Result<(), (String, String)> {
     let (client, handle) = server
         .connect_as(user, PASSWORD)
         .await
         .unwrap_or_else(|e| panic!("connect as {user}: {e}"));
     let result = client.simple_query(sql).await.map(|_| ()).map_err(|e| {
         e.as_db_error()
-            .map(|db| db.message().to_string())
-            .unwrap_or_else(|| e.to_string())
+            .map(|d| (d.code().code().to_string(), d.message().to_string()))
+            .unwrap_or_else(|| (String::new(), e.to_string()))
     });
     drop(client);
     handle.abort();
@@ -143,7 +146,12 @@ async fn batch_delete_with_a_denied_edge_deletes_nothing() {
         ),
     )
     .await;
-    let message = result.expect_err("the denied edge must make the statement report an error");
+    let (sqlstate, message) =
+        result.expect_err("the denied edge must make the statement report an error");
+    assert_eq!(
+        sqlstate, DENIED_SQLSTATE,
+        "batch refusal SQLSTATE: {message}"
+    );
     assert!(
         message.contains("policy") || message.contains("RLS"),
         "the error must come from the write policy: {message}"
@@ -224,9 +232,11 @@ async fn batch_insert_is_refused_when_the_policy_needs_a_property() {
         ),
     )
     .await;
-    assert!(
-        result.is_err(),
-        "a property-less batch under an owner policy must be refused: {result:?}"
+    let (sqlstate, message) =
+        result.expect_err("a property-less batch under an owner policy must be refused");
+    assert_eq!(
+        sqlstate, DENIED_SQLSTATE,
+        "batch refusal SQLSTATE: {message}"
     );
     assert!(
         !has_labeled_edge(&server, collection, "l1").await
@@ -234,3 +244,50 @@ async fn batch_insert_is_refused_when_the_policy_needs_a_property() {
         "no edge from the refused batch may land"
     );
 }
+
+/// A single-edge delete of a denied edge under the same policy carries the
+/// same SQLSTATE as the refused batch delete.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_single_edge_delete_under_the_same_policy_gives_the_same_sqlstate() {
+    let server = TestServer::start().await;
+    let user = "g_batch_rls_same_user";
+    let collection = "g_batch_rls_same";
+    server
+        .exec(&format!("CREATE COLLECTION {collection}"))
+        .await
+        .expect("create edge collection");
+    create_user(&server, user).await;
+    write_policy(&server, "g_batch_rls_same_policy", collection).await;
+    seed_owned_edges(&server, collection, &[("steals", "someone-else")]).await;
+
+    let single = run_as(
+        &server,
+        user,
+        &format!(
+            "GRAPH DELETE EDGE IN '{collection}' FROM '{EDGE_SRC}' TO '{EDGE_DST}' TYPE 'steals'"
+        ),
+    )
+    .await;
+    let (single_state, single_message) =
+        single.expect_err("the single-edge delete of a denied edge must be refused");
+
+    let batch = run_as(
+        &server,
+        user,
+        &format!(
+            "GRAPH DELETE EDGES IN '{collection}' VALUES ('{EDGE_SRC}','{EDGE_DST}','steals')"
+        ),
+    )
+    .await;
+    let (batch_state, _) = batch.expect_err("the batch delete of a denied edge must be refused");
+
+    assert_eq!(
+        single_state, DENIED_SQLSTATE,
+        "single refusal SQLSTATE: {single_message}"
+    );
+    assert_eq!(single_state, batch_state, "single and batch SQLSTATE");
+    assert!(
+        has_labeled_edge(&server, collection, "steals").await,
+        "the refused deletes must leave the edge in place"
+    );
+}

From 1674f2b3d97c6b2a92482f056a455ee7c8c96354 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 19:29:07 +0800
Subject: [PATCH 19/24] test(client): batch edge writes through the native
 client

Insert and delete round trip, a batch inside a transaction that reads its own
writes and rolls back, and the bounds refused before the round trip. The wire
test target needs nodedb-client with the native feature.
---
 Cargo.lock                                    |   1 +
 nodedb/Cargo.toml                             |   1 +
 nodedb/tests/wire/cases/graph_batch_native.rs | 206 ++++++++++++++++++
 nodedb/tests/wire/cases/mod.rs                |   1 +
 4 files changed, 209 insertions(+)
 create mode 100644 nodedb/tests/wire/cases/graph_batch_native.rs

diff --git a/Cargo.lock b/Cargo.lock
index ed330df75..44d45118b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3964,6 +3964,7 @@ dependencies = [
  "nexar",
  "nodedb-array",
  "nodedb-bridge",
+ "nodedb-client",
  "nodedb-cluster",
  "nodedb-codec",
  "nodedb-columnar",
diff --git a/nodedb/Cargo.toml b/nodedb/Cargo.toml
index 633e841e6..b5c997356 100644
--- a/nodedb/Cargo.toml
+++ b/nodedb/Cargo.toml
@@ -172,6 +172,7 @@ tokio = { workspace = true, features = ["test-util"] }
 faultbox = { workspace = true }
 tempfile = { workspace = true }
 tokio-postgres = { workspace = true }
+nodedb-client = { workspace = true, features = ["native"] }
 proptest = { workspace = true }
 nodedb-types = { workspace = true }
 reqwest = { workspace = true }
diff --git a/nodedb/tests/wire/cases/graph_batch_native.rs b/nodedb/tests/wire/cases/graph_batch_native.rs
new file mode 100644
index 000000000..21ea9e075
--- /dev/null
+++ b/nodedb/tests/wire/cases/graph_batch_native.rs
@@ -0,0 +1,206 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! The native client's batch edge methods, end to end against a real server.
+//!
+//! `batch_graph_insert_edges` and `batch_graph_delete_edges` each send ONE
+//! `GRAPH ... EDGES` statement. These tests write through the native client and
+//! read back through both the native client and pgwire. They also check that a
+//! batch outside the statement bounds is refused on the client, before any
+//! connection is made.
+
+use nodedb_client::native::pool::PoolConfig;
+use nodedb_client::{NativeClient, NodeDb};
+use nodedb_types::graph::Direction;
+use nodedb_types::id::NodeId;
+use nodedb_types::protocol::{AuthMethod, MAX_EDGES_PER_BATCH_STATEMENT};
+
+use crate::harness::TestServer;
+
+/// The trust identity the wire harness bootstraps for its own pgwire client.
+const TRUST_USER: &str = "nodedb";
+
+const EDGES: [(&str, &str, &str); 3] = [("a", "b", "l"), ("a", "c", "l"), ("b", "c", "l")];
+
+fn native_client_with(
+    server: &TestServer,
+    configure: impl FnOnce(PoolConfig) -> PoolConfig,
+) -> NativeClient {
+    let base = PoolConfig::new(
+        format!("127.0.0.1:{}", server.native_port),
+        AuthMethod::Trust {
+            username: TRUST_USER.to_string(),
+        },
+    );
+    NativeClient::new(configure(base))
+}
+
+/// Every outbound edge of `a`, `b` and `c`, read through the native client.
+/// The three walks overlap on edges between visited nodes, so repeats are dropped.
+async fn native_edges(client: &NativeClient, collection: &str) -> Vec<(String, String, String)> {
+    let mut out = Vec::new();
+    for node in ["a", "b", "c"] {
+        let start = NodeId::try_new(node).expect("valid node id");
+        let graph = client
+            .graph_traverse(collection, &start, 1, Direction::Out, None)
+            .await
+            .unwrap_or_else(|e| panic!("native traverse from {node}: {e}"));
+        out.extend(graph.edges.iter().map(|e| {
+            (
+                e.from.as_str().to_owned(),
+                e.to.as_str().to_owned(),
+                e.label.clone(),
+            )
+        }));
+    }
+    out.sort();
+    out.dedup();
+    out
+}
+
+fn expected_edges() -> Vec<(String, String, String)> {
+    let mut v: Vec<_> = EDGES
+        .iter()
+        .map(|(f, t, l)| ((*f).to_owned(), (*t).to_owned(), (*l).to_owned()))
+        .collect();
+    v.sort();
+    v
+}
+
+/// Outbound neighbor node ids of `node` through pgwire `GRAPH NEIGHBORS`.
+async fn pgwire_out_neighbors(server: &TestServer, collection: &str, node: &str) -> Vec<String> {
+    let rows = server
+        .query_text(&format!(
+            "GRAPH NEIGHBORS IN '{collection}' OF '{node}' DIRECTION out"
+        ))
+        .await
+        .unwrap_or_else(|e| panic!("pgwire neighbors of {node}: {e}"));
+    let parsed: Vec<serde_json::Value> =
+        serde_json::from_str(&rows.join("")).expect("neighbors JSON");
+    let mut out: Vec<String> = parsed
+        .iter()
+        .map(|e| e["node"].as_str().expect("node field").to_owned())
+        .collect();
+    out.sort();
+    out
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn native_batch_insert_and_delete_round_trip() {
+    let server = TestServer::start().await;
+    server
+        .exec("CREATE COLLECTION nat_batch_rt")
+        .await
+        .expect("create collection");
+    let client = native_client_with(&server, |base| base);
+
+    client
+        .batch_graph_insert_edges("nat_batch_rt", &EDGES)
+        .await
+        .expect("native batch insert");
+
+    assert_eq!(
+        native_edges(&client, "nat_batch_rt").await,
+        expected_edges()
+    );
+    assert_eq!(
+        pgwire_out_neighbors(&server, "nat_batch_rt", "a").await,
+        vec!["b".to_owned(), "c".to_owned()]
+    );
+    assert_eq!(
+        pgwire_out_neighbors(&server, "nat_batch_rt", "b").await,
+        vec!["c".to_owned()]
+    );
+
+    client
+        .batch_graph_delete_edges("nat_batch_rt", &EDGES)
+        .await
+        .expect("native batch delete");
+
+    assert!(native_edges(&client, "nat_batch_rt").await.is_empty());
+    for node in ["a", "b", "c"] {
+        assert!(
+            pgwire_out_neighbors(&server, "nat_batch_rt", node)
+                .await
+                .is_empty(),
+            "node {node} must have no outbound edge after the batch delete"
+        );
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn native_batch_inside_a_transaction_reads_its_own_writes_and_rolls_back() {
+    let server = TestServer::start().await;
+    server
+        .exec("CREATE COLLECTION nat_batch_txn")
+        .await
+        .expect("create collection");
+    // One pooled connection, so begin, the batch, the reads and rollback all
+    // ride the same session.
+    let client = native_client_with(&server, |base| PoolConfig {
+        max_size: 1,
+        ..base
+    });
+
+    client.begin().await.expect("begin");
+    client
+        .batch_graph_insert_edges("nat_batch_txn", &EDGES)
+        .await
+        .expect("batch insert in transaction");
+    assert_eq!(
+        native_edges(&client, "nat_batch_txn").await,
+        expected_edges(),
+        "the transaction must read its own batch"
+    );
+
+    client.rollback().await.expect("rollback");
+    assert!(
+        native_edges(&client, "nat_batch_txn").await.is_empty(),
+        "a rolled-back batch must leave no edge"
+    );
+    assert!(
+        pgwire_out_neighbors(&server, "nat_batch_txn", "a")
+            .await
+            .is_empty()
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn native_batch_bounds_are_refused_before_the_round_trip() {
+    // Nothing listens on port 1. A batch that reached the connection step would
+    // fail with a connect error, not with the bound text asserted below.
+    let client = NativeClient::new(PoolConfig::new(
+        "127.0.0.1:1",
+        AuthMethod::Trust {
+            username: TRUST_USER.to_string(),
+        },
+    ));
+
+    let empty: [(&str, &str, &str); 0] = [];
+    let too_many: Vec<(&str, &str, &str)> =
+        vec![("a", "b", "l"); MAX_EDGES_PER_BATCH_STATEMENT + 1];
+    assert_eq!(too_many.len(), 1001);
+
+    let insert_empty = client
+        .batch_graph_insert_edges("c", &empty)
+        .await
+        .expect_err("an empty insert batch is refused");
+    assert!(insert_empty.to_string().contains("at least one edge"));
+
+    let insert_many = client
+        .batch_graph_insert_edges("c", &too_many)
+        .await
+        .expect_err("an oversized insert batch is refused");
+    assert!(insert_many.to_string().contains("at most 1000 edges"));
+
+    let delete_empty = client
+        .batch_graph_delete_edges("c", &empty)
+        .await
+        .expect_err("an empty delete batch is refused");
+    assert!(delete_empty.to_string().contains("at least one edge"));
+
+    let delete_many = client
+        .batch_graph_delete_edges("c", &too_many)
+        .await
+        .expect_err("an oversized delete batch is refused");
+    assert!(delete_many.to_string().contains("at most 1000 edges"));
+}
diff --git a/nodedb/tests/wire/cases/mod.rs b/nodedb/tests/wire/cases/mod.rs
index 6bea5b514..e7c2e7069 100644
--- a/nodedb/tests/wire/cases/mod.rs
+++ b/nodedb/tests/wire/cases/mod.rs
@@ -116,6 +116,7 @@ mod fts_query_semantics;
 mod fts_read_body_format;
 mod function_security_e2e;
 mod graph_analytics_authorization;
+mod graph_batch_native;
 mod graph_batch_rls;
 mod graph_crdt_delete_edges;
 mod graph_ddl_create_graph_index;

From 43ad5f5809f9b3a83ef2e926186ed6d22e3421ca Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 19:50:26 +0800
Subject: [PATCH 20/24] fix(graph): require a comma between the items of a
 label list

The graph tokenizer dropped commas, so LABEL 'a' 'b' parsed as two labels on
GRAPH TRAVERSE, NEIGHBORS and PATH, and AS 'x' 'y' on GRAPH LABEL. The tokenizer
now emits a comma token. A label list takes exactly one comma between items.
A comma outside a list is skipped as before.
---
 nodedb-sql/src/ddl_ast/graph_parse/cursor.rs  |  34 +++++-
 nodedb-sql/src/ddl_ast/graph_parse/entry.rs   | 109 ++++++++++++++++++
 .../src/ddl_ast/graph_parse/tokenizer.rs      |  15 ++-
 .../src/ddl_ast/graph_parse/variants.rs       |   1 +
 .../wire/cases/graph_label_list_separator.rs  |  48 ++++++++
 nodedb/tests/wire/cases/mod.rs                |   1 +
 6 files changed, 200 insertions(+), 8 deletions(-)
 create mode 100644 nodedb/tests/wire/cases/graph_label_list_separator.rs

diff --git a/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs b/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs
index 6c51bee5d..0ebaa7912 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/cursor.rs
@@ -33,8 +33,13 @@ impl<'t, 'a> Cursor<'t, 'a> {
         self.statement
     }
 
-    fn peek(&self) -> Option<&'t Tok<'a>> {
+    /// The next token that is not a comma. Every reader goes through here,
+    /// so a comma outside a list is as if it were absent.
+    fn peek(&mut self) -> Option<&'t Tok<'a>> {
         let toks: &'t [Tok<'a>] = self.toks;
+        while matches!(toks.get(self.pos), Some(Tok::Comma)) {
+            self.pos += 1;
+        }
         toks.get(self.pos)
     }
 
@@ -150,10 +155,11 @@ impl<'t, 'a> Cursor<'t, 'a> {
         }
     }
 
-    /// One or more quoted strings: `'a', 'b'` or `('a', 'b')`.
+    /// One or more quoted strings: `'a', 'b'` or `('a', 'b')`. Exactly one
+    /// comma separates two items. A comma after the last item is skipped.
     pub(super) fn quoted_list(&mut self, clause: &str) -> Result<Vec<String>, SqlError> {
         let mut out = Vec::new();
-        while let Some(Tok::Quoted(text)) = self.peek() {
+        if let Some(Tok::Quoted(text)) = self.peek() {
             out.push(text.clone().into_owned());
             self.pos += 1;
         }
@@ -163,7 +169,26 @@ impl<'t, 'a> Cursor<'t, 'a> {
                 self.statement
             )));
         }
-        Ok(out)
+        loop {
+            let toks: &'t [Tok<'a>] = self.toks;
+            let commas = toks
+                .get(self.pos..)
+                .unwrap_or_default()
+                .iter()
+                .take_while(|tok| matches!(tok, Tok::Comma))
+                .count();
+            let Some(Tok::Quoted(text)) = toks.get(self.pos + commas) else {
+                return Ok(out);
+            };
+            if commas != 1 {
+                return Err(parse_error(format!(
+                    "{} {clause} needs a comma between labels, as {clause} 'a', 'b'",
+                    self.statement
+                )));
+            }
+            out.push(text.clone().into_owned());
+            self.pos += 2;
+        }
     }
 
     /// A `{...}` object literal, braces included.
@@ -272,6 +297,7 @@ fn describe(tok: &Tok<'_>) -> String {
         Tok::Ident(text) => format!("identifier \"{text}\""),
         Tok::Object(_) => "an object literal".to_owned(),
         Tok::List(_) => "a [...] list".to_owned(),
+        Tok::Comma => "','".to_owned(),
     }
 }
 
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/entry.rs b/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
index 717a023fc..afdc536c9 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/entry.rs
@@ -817,4 +817,113 @@ mod tests {
         let params = params_of("GRAPH RAG FUSION ON entities QUERY ARRAY[0.1]");
         assert_eq!(params.bm25_field, None);
     }
+
+    // ── Missing separators in lists ───────────────────────────────────────
+
+    /// Two quoted labels with no comma between them are one malformed list.
+    #[test]
+    fn a_label_list_without_a_comma_is_refused_on_traverse() {
+        let sql = "GRAPH TRAVERSE IN 'c' FROM 'x' DEPTH 2 LABEL 'a' 'b'";
+        let result = try_parse(sql).expect("graph DSL");
+        assert!(
+            result.is_err(),
+            "a LABEL list missing its comma must be refused, got {result:?}"
+        );
+    }
+
+    /// Two quoted labels with no comma between them are one malformed list.
+    #[test]
+    fn a_label_list_without_a_comma_is_refused_on_neighbors() {
+        let sql = "GRAPH NEIGHBORS IN 'c' OF 'x' LABEL 'a' 'b' DIRECTION both";
+        let result = try_parse(sql).expect("graph DSL");
+        assert!(
+            result.is_err(),
+            "a LABEL list missing its comma must be refused, got {result:?}"
+        );
+    }
+
+    /// Two quoted labels with no comma between them are one malformed list.
+    #[test]
+    fn a_label_list_without_a_comma_is_refused_on_path() {
+        let sql = "GRAPH PATH IN 'c' FROM 'x' TO 'y' MAX_DEPTH 3 LABEL 'a' 'b'";
+        let result = try_parse(sql).expect("graph DSL");
+        assert!(
+            result.is_err(),
+            "a LABEL list missing its comma must be refused, got {result:?}"
+        );
+    }
+
+    /// Two quoted node labels with no comma between them are refused.
+    #[test]
+    fn a_label_set_without_a_comma_is_refused_on_graph_label() {
+        let sql = "GRAPH LABEL 'alice' AS 'Person' 'User'";
+        let result = try_parse(sql).expect("graph DSL");
+        assert!(
+            result.is_err(),
+            "an AS list missing its comma must be refused, got {result:?}"
+        );
+    }
+
+    /// An `IN (...)` list in `EDGE WHERE` needs commas between its values.
+    #[test]
+    fn an_edge_where_list_without_a_comma_is_refused() {
+        let sql = "GRAPH TRAVERSE IN 'c' FROM 'x' DEPTH 2 EDGE WHERE kind IN ('a' 'b')";
+        let result = try_parse(sql).expect("graph DSL");
+        assert!(
+            result.is_err(),
+            "an EDGE WHERE list missing its comma must be refused, got {result:?}"
+        );
+    }
+
+    /// The comma-separated `EDGE WHERE ... IN (...)` list is the accepted form.
+    #[test]
+    fn an_edge_where_list_with_commas_parses() {
+        let sql = "GRAPH TRAVERSE IN 'c' FROM 'x' DEPTH 2 EDGE WHERE kind IN ('a', 'b')";
+        let result = try_parse(sql).expect("graph DSL");
+        assert!(
+            result.is_ok(),
+            "a comma-separated list must parse: {result:?}"
+        );
+    }
+
+    /// The tokenizer keeps a comma as its own token.
+    #[test]
+    fn tokenizer_emits_a_comma_token() {
+        let toks = tokenizer::tokenize("a, b");
+        assert!(matches!(
+            toks.as_slice(),
+            [
+                tokenizer::Tok::Word("a"),
+                tokenizer::Tok::Comma,
+                tokenizer::Tok::Word("b")
+            ]
+        ));
+    }
+
+    /// Two commas between labels are a malformed list.
+    #[test]
+    fn a_label_list_with_two_commas_is_refused() {
+        let sql = "GRAPH NEIGHBORS IN 'c' OF 'x' LABEL 'a',, 'b'";
+        let result = try_parse(sql).expect("graph DSL");
+        assert!(
+            result.is_err(),
+            "a doubled comma must be refused, got {result:?}"
+        );
+    }
+
+    /// A comma after the last label, before a clause keyword, is skipped.
+    #[test]
+    fn a_trailing_label_comma_before_a_clause_parses() {
+        let sql = "GRAPH NEIGHBORS IN 'c' OF 'x' LABEL 'a', DIRECTION out";
+        let result = try_parse(sql).expect("graph DSL");
+        assert!(result.is_ok(), "a trailing comma must parse: {result:?}");
+    }
+
+    /// A comma between two clauses is skipped as it was before commas were tokens.
+    #[test]
+    fn a_stray_comma_between_clauses_parses() {
+        let sql = "GRAPH NEIGHBORS IN 'c', OF 'x', DIRECTION out";
+        let result = try_parse(sql).expect("graph DSL");
+        assert!(result.is_ok(), "a stray comma must parse: {result:?}");
+    }
 }
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/tokenizer.rs b/nodedb-sql/src/ddl_ast/graph_parse/tokenizer.rs
index 2a2d57683..65c38fbc2 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/tokenizer.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/tokenizer.rs
@@ -14,6 +14,8 @@ pub(super) enum Tok<'a> {
     Object(&'a str),
     /// Bracket-balanced `[...]` content, brackets excluded.
     List(&'a str),
+    /// A `,` separator.
+    Comma,
 }
 
 /// `sql` with every comment replaced by one space, so no comment becomes a
@@ -42,16 +44,21 @@ pub(super) fn blank_comments(sql: &str) -> Cow<'_, str> {
 
 /// Split graph DSL text into tokens.
 ///
-/// `,`, `;`, `(` and `)` separate tokens and produce none, so `LABEL 'a', 'b'`
-/// and `LABEL ('a', 'b')` read the same. A stray `]` is a word token, so the
-/// clause parser reports it.
+/// `,` produces a `Comma` token. `;`, `(` and `)` separate tokens and produce
+/// none, so `LABEL 'a', 'b'` and `LABEL ('a', 'b')` read the same. A stray `]`
+/// is a word token, so the clause parser reports it.
 pub(super) fn tokenize(sql: &str) -> Vec<Tok<'_>> {
     let bytes = sql.as_bytes();
     let mut out = Vec::new();
     let mut i = 0;
     while i < bytes.len() {
         let b = bytes[i];
-        if b.is_ascii_whitespace() || b == b',' || b == b';' || b == b'(' || b == b')' {
+        if b == b',' {
+            out.push(Tok::Comma);
+            i += 1;
+            continue;
+        }
+        if b.is_ascii_whitespace() || b == b';' || b == b'(' || b == b')' {
             i += 1;
             continue;
         }
diff --git a/nodedb-sql/src/ddl_ast/graph_parse/variants.rs b/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
index 58c49ead5..ed8af8d92 100644
--- a/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
+++ b/nodedb-sql/src/ddl_ast/graph_parse/variants.rs
@@ -115,6 +115,7 @@ fn parse_edge_batch(
     let mut fields: Vec<String> = Vec::new();
     for t in c.rest() {
         match t {
+            Tok::Comma => {}
             Tok::Quoted(s) | Tok::Ident(s) => fields.push(s.clone().into_owned()),
             Tok::Word(w) => {
                 if w.eq_ignore_ascii_case("PROPERTIES") {
diff --git a/nodedb/tests/wire/cases/graph_label_list_separator.rs b/nodedb/tests/wire/cases/graph_label_list_separator.rs
new file mode 100644
index 000000000..76bdbb114
--- /dev/null
+++ b/nodedb/tests/wire/cases/graph_label_list_separator.rs
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! A `LABEL` list needs a comma between its items on every graph walk.
+
+use crate::harness::TestServer;
+
+async fn seed(server: &TestServer, collection: &str) {
+    server
+        .exec(&format!("CREATE COLLECTION {collection}"))
+        .await
+        .unwrap();
+    for (dst, label) in [("p", "a"), ("q", "b"), ("r", "c")] {
+        server
+            .exec(&format!(
+                "GRAPH INSERT EDGE IN '{collection}' FROM 'x' TO '{dst}' TYPE '{label}'"
+            ))
+            .await
+            .unwrap();
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_label_list_with_commas_keeps_both_labels() {
+    let server = TestServer::start().await;
+    seed(&server, "lls_ok").await;
+    let rows = server
+        .query_text("GRAPH NEIGHBORS IN 'lls_ok' OF 'x' LABEL 'a', 'b' DIRECTION out")
+        .await
+        .unwrap();
+    let blob = rows.join("");
+    assert!(blob.contains("\"p\"") && blob.contains("\"q\"") && !blob.contains("\"r\""));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_label_list_without_a_comma_is_refused_on_the_wire() {
+    let server = TestServer::start().await;
+    seed(&server, "lls_bad").await;
+    for sql in [
+        "GRAPH NEIGHBORS IN 'lls_bad' OF 'x' LABEL 'a' 'b' DIRECTION out",
+        "GRAPH TRAVERSE IN 'lls_bad' FROM 'x' DEPTH 1 LABEL 'a' 'b'",
+    ] {
+        let result = server.query_text(sql).await;
+        assert!(
+            result.is_err(),
+            "`{sql}` must be refused, got rows {result:?}"
+        );
+    }
+}
diff --git a/nodedb/tests/wire/cases/mod.rs b/nodedb/tests/wire/cases/mod.rs
index e7c2e7069..4aedd9b44 100644
--- a/nodedb/tests/wire/cases/mod.rs
+++ b/nodedb/tests/wire/cases/mod.rs
@@ -128,6 +128,7 @@ mod graph_dsl_batch_edges_random;
 mod graph_dsl_handlers;
 mod graph_dsl_label_sets;
 mod graph_edge_predicate;
+mod graph_label_list_separator;
 mod graph_match_authorization;
 mod graph_neighbors_entries;
 mod graph_rag_fusion;

From 5c97b086a235652e5f4089e2c7f9471bd25865bc Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:57:35 +0800
Subject: [PATCH 21/24] fix(metadata): end the drains a failed DDL commit
 started

reserve_buffered starts a drain for each altered descriptor. When a later step
failed, the error arm only released the preparation lease, so the drains stayed
open until a restart. The error arm now ends every drain the reserve started,
before it releases the lease.
---
 .../server/shared/session/ddl_flush.rs        | 106 +++++++++++++++++-
 1 file changed, 103 insertions(+), 3 deletions(-)

diff --git a/nodedb/src/control/server/shared/session/ddl_flush.rs b/nodedb/src/control/server/shared/session/ddl_flush.rs
index 58c1589f9..bb28e6ee4 100644
--- a/nodedb/src/control/server/shared/session/ddl_flush.rs
+++ b/nodedb/src/control/server/shared/session/ddl_flush.rs
@@ -13,7 +13,7 @@
 
 use std::sync::Arc;
 
-use nodedb_cluster::{MetadataEntry, PendingDdlObject, encode_entry};
+use nodedb_cluster::{DescriptorId, DrainOwner, MetadataEntry, PendingDdlObject, encode_entry};
 
 use crate::control::catalog_entry::{self, CatalogEntry};
 use crate::control::constraint_install::{ConstraintTarget, constraint_targets};
@@ -196,6 +196,7 @@ async fn propose_pending_buffered<'a>(
     let lease =
         crate::control::metadata_proposer::acquire_ddl_prepare_lease_async(state, handle.as_ref())
             .await?;
+    let mut started_drains = Vec::new();
     let reserved = reserve_buffered(
         state,
         sessions,
@@ -203,6 +204,7 @@ async fn propose_pending_buffered<'a>(
         handle.as_ref(),
         lease.token(),
         buffered,
+        &mut started_drains,
     )
     .await;
     match reserved {
@@ -218,12 +220,31 @@ async fn propose_pending_buffered<'a>(
             constraint_targets,
         }),
         Err(error) => {
+            end_started_drains(state, started_drains).await;
             lease.release().await;
             Err(error)
         }
     }
 }
 
+/// End each drain a failed reserve started. The drain has no expiry, so only
+/// this propose clears it. The propose reaches the log even when its apply
+/// wait passes the statement deadline. An error is logged and the next drain
+/// still ends.
+async fn end_started_drains(state: &SharedState, started: Vec<DescriptorId>) {
+    for id in started {
+        if let Err(error) =
+            crate::control::lease::end_drain_async(state, id.clone(), DrainOwner::Ddl).await
+        {
+            tracing::warn!(
+                descriptor = ?id,
+                %error,
+                "DDL drain end failed after a failed reserve"
+            );
+        }
+    }
+}
+
 /// What [`reserve_buffered`] reserved.
 struct Reserved {
     log_index: u64,
@@ -234,7 +255,8 @@ struct Reserved {
 
 /// Drain, stamp, and reserve `buffered` under the preparation lease `token`.
 /// Returns the reservation's log index, its reserved objects, and the
-/// collections whose constraint version it changes.
+/// collections whose constraint version it changes. Pushes each descriptor
+/// whose drain started onto `started_drains`, also when the reserve fails.
 async fn reserve_buffered(
     state: &SharedState,
     sessions: &SessionStore,
@@ -242,6 +264,7 @@ async fn reserve_buffered(
     handle: &dyn MetadataRaftHandle,
     token: u64,
     buffered: DdlBuffer,
+    started_drains: &mut Vec<DescriptorId>,
 ) -> crate::Result<Reserved> {
     // Checked under the preparation lease, which every DDL takes: no other
     // role or user change commits between this check and the finalize, so
@@ -264,12 +287,13 @@ async fn reserve_buffered(
                 sessions.own_lease_hold_count(session_id, &descriptor_id, prior_version);
             crate::control::lease::drain_for_ddl_async(
                 state,
-                descriptor_id,
+                descriptor_id.clone(),
                 prior_version,
                 crate::control::metadata_proposer::DEFAULT_DRAIN_TIMEOUT,
                 own_holds,
             )
             .await?;
+            started_drains.push(descriptor_id);
         }
     }
 
@@ -829,4 +853,80 @@ mod tests {
         assert_eq!(surviving.modification_hlc, later.modification_hlc);
         cluster.shutdown().await;
     }
+
+    /// A reserve that fails after it drained a descriptor ends that drain and
+    /// releases the preparation lease.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn a_failed_reserve_does_not_leave_a_drain_open() {
+        use nodedb_cluster::{DescriptorId, DescriptorKind};
+
+        let cluster = test_one_node::boot().await;
+        let state = &cluster.state;
+        let first = StoredSequence::new(0, 7, "first_seq".into(), "alice".into());
+        assert!(
+            buffer_and_commit(state, vec![CatalogEntry::PutSequence(Box::new(first))]).await,
+            "the seed commit must not abort"
+        );
+
+        // A sequence row no decoder reads. The drain lookup treats an
+        // unreadable row as version 0 and starts no drain for it, but the
+        // stamp reads the row with `?` and fails.
+        let catalog = state.credentials.catalog();
+        let mut tables = catalog
+            .begin_replicated_read()
+            .expect("begin replicated read")
+            .dump()
+            .expect("dump replicated tables");
+        let (_, rows) = tables
+            .iter_mut()
+            .find(|(label, _)| label.as_str() == "sequences")
+            .expect("sequences table is replicated");
+        rows.push((b"0:7:broken_seq".to_vec(), vec![0xc1]));
+        catalog
+            .replace_replicated_tables(&tables)
+            .expect("install the unreadable row");
+        assert_eq!(
+            state.lease_drain.count_active(),
+            0,
+            "no drain is open before the batch"
+        );
+
+        let (sessions, session_id) = test_session();
+        let refused = conn_scope::scoped(async {
+            ddl_buffer::activate();
+            for name in ["first_seq", "broken_seq"] {
+                let stored = StoredSequence::new(0, 7, name.into(), "alice".into());
+                assert!(ddl_buffer::try_buffer(CatalogEntry::PutSequence(Box::new(
+                    stored
+                ))));
+            }
+            begin_commit(state, &sessions, session_id).await.is_err()
+        })
+        .await;
+
+        assert!(
+            refused,
+            "the stamp of the unreadable row must fail the reserve"
+        );
+        let id = DescriptorId::new(0, 7, DescriptorKind::Sequence, "first_seq".to_string());
+        assert!(
+            !state.lease_drain.is_draining(&id, 1),
+            "the drain of first_seq must end with the failed reserve"
+        );
+        assert_eq!(
+            state.lease_drain.count_active(),
+            0,
+            "a failed reserve must leave no drain open"
+        );
+        assert!(
+            state
+                .metadata_ddl
+                .owner
+                .lock()
+                .expect("owner lock")
+                .is_none(),
+            "a failed reserve must release the preparation lease"
+        );
+        cluster.shutdown().await;
+    }
 }

From 00ba6051a40777adb53238e2787d25f1c43351e2 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 22:42:55 +0800
Subject: [PATCH 22/24] test(graph): a batch counts each edge once in SHOW
 GRAPH STATS

Distinct edges, a repeated edge, a self-loop, and a batch against the same
edges inserted one by one.
---
 nodedb/tests/wire/cases/graph_batch_stats.rs | 108 +++++++++++++++++++
 nodedb/tests/wire/cases/mod.rs               |   1 +
 2 files changed, 109 insertions(+)
 create mode 100644 nodedb/tests/wire/cases/graph_batch_stats.rs

diff --git a/nodedb/tests/wire/cases/graph_batch_stats.rs b/nodedb/tests/wire/cases/graph_batch_stats.rs
new file mode 100644
index 000000000..21ac6bf70
--- /dev/null
+++ b/nodedb/tests/wire/cases/graph_batch_stats.rs
@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! `SHOW GRAPH STATS` must count a batch write exactly like the equivalent
+//! single edge writes: each distinct edge once, each endpoint node once.
+
+use crate::harness::TestServer;
+
+const BATCH_EDGES: &str = "('a','b','l'),('b','c','l'),('c','d','l')";
+
+/// Read `(node_count, edge_count)` for `collection` from compact
+/// `SHOW GRAPH STATS`. A collection with no edges may return no row, which
+/// reads as `(0, 0)`.
+async fn counts(srv: &TestServer, collection: &str) -> (i64, i64) {
+    let rows = srv
+        .query_rows(&format!("SHOW GRAPH STATS '{collection}'"))
+        .await
+        .unwrap_or_else(|e| panic!("stats read for {collection} failed: {e:?}"));
+    rows.iter()
+        .find(|r| r[0] == collection)
+        .map(|r| {
+            (
+                r[1].parse::<i64>().expect("node_count is integer"),
+                r[2].parse::<i64>().expect("edge_count is integer"),
+            )
+        })
+        .unwrap_or((0, 0))
+}
+
+/// One batch of three distinct edges counts three edges and four nodes. One
+/// batch delete of the same three brings the edge count back to zero.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_batch_insert_counts_each_edge_once() {
+    let srv = TestServer::start().await;
+    srv.exec("CREATE COLLECTION g_bs_insert").await.unwrap();
+    srv.exec(&format!(
+        "GRAPH INSERT EDGES IN 'g_bs_insert' VALUES {BATCH_EDGES}"
+    ))
+    .await
+    .unwrap();
+
+    let (nodes, edges) = counts(&srv, "g_bs_insert").await;
+    assert_eq!(edges, 3, "edge_count after the batch insert");
+    assert_eq!(nodes, 4, "node_count after the batch insert");
+
+    srv.exec(&format!(
+        "GRAPH DELETE EDGES IN 'g_bs_insert' VALUES {BATCH_EDGES}"
+    ))
+    .await
+    .unwrap();
+
+    let (_, edges) = counts(&srv, "g_bs_insert").await;
+    assert_eq!(edges, 0, "edge_count after the batch delete");
+}
+
+/// The same triple twice in one batch is one edge.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_repeated_edge_in_a_batch_counts_once() {
+    let srv = TestServer::start().await;
+    srv.exec("CREATE COLLECTION g_bs_repeat").await.unwrap();
+    srv.exec(
+        "GRAPH INSERT EDGES IN 'g_bs_repeat' VALUES \
+         ('a','b','l'),('a','b','l'),('b','c','l')",
+    )
+    .await
+    .unwrap();
+
+    let (_, edges) = counts(&srv, "g_bs_repeat").await;
+    assert_eq!(edges, 2, "a repeated triple is one edge");
+}
+
+/// A self-loop is one edge on one node.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_self_loop_in_a_batch_counts_one_node() {
+    let srv = TestServer::start().await;
+    srv.exec("CREATE COLLECTION g_bs_loop").await.unwrap();
+    srv.exec("GRAPH INSERT EDGES IN 'g_bs_loop' VALUES ('x','x','l')")
+        .await
+        .unwrap();
+
+    let (nodes, edges) = counts(&srv, "g_bs_loop").await;
+    assert_eq!(edges, 1, "edge_count of a self-loop");
+    assert_eq!(nodes, 1, "node_count of a self-loop");
+}
+
+/// A batch and three single inserts of the same edges give equal stats.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_batch_matches_single_edge_inserts() {
+    let srv = TestServer::start().await;
+    srv.exec("CREATE COLLECTION g_bs_batch").await.unwrap();
+    srv.exec("CREATE COLLECTION g_bs_single").await.unwrap();
+    srv.exec(&format!(
+        "GRAPH INSERT EDGES IN 'g_bs_batch' VALUES {BATCH_EDGES}"
+    ))
+    .await
+    .unwrap();
+    for (from, to) in [("a", "b"), ("b", "c"), ("c", "d")] {
+        srv.exec(&format!(
+            "GRAPH INSERT EDGE IN 'g_bs_single' FROM '{from}' TO '{to}' TYPE 'l'"
+        ))
+        .await
+        .unwrap();
+    }
+
+    let batch = counts(&srv, "g_bs_batch").await;
+    let single = counts(&srv, "g_bs_single").await;
+    assert_eq!(batch, single, "batch stats must equal single-insert stats");
+    assert_eq!(batch, (4, 3), "(node_count, edge_count)");
+}
diff --git a/nodedb/tests/wire/cases/mod.rs b/nodedb/tests/wire/cases/mod.rs
index 4aedd9b44..989e0cf85 100644
--- a/nodedb/tests/wire/cases/mod.rs
+++ b/nodedb/tests/wire/cases/mod.rs
@@ -118,6 +118,7 @@ mod function_security_e2e;
 mod graph_analytics_authorization;
 mod graph_batch_native;
 mod graph_batch_rls;
+mod graph_batch_stats;
 mod graph_crdt_delete_edges;
 mod graph_ddl_create_graph_index;
 mod graph_drop_hides_edges;

From 2f9e9edd4c72107416a81b1751424624b6c27c90 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Fri, 23 Oct 2026 22:43:32 +0800
Subject: [PATCH 23/24] test(client): a restricted native client's denied batch
 edge write answers authorization denied

The batch delete with one denied edge is refused as a whole and deletes
nothing. A batch of allowed edges deletes them.
---
 .../wire/cases/graph_batch_native_rls.rs      | 191 ++++++++++++++++++
 nodedb/tests/wire/cases/mod.rs                |   1 +
 2 files changed, 192 insertions(+)
 create mode 100644 nodedb/tests/wire/cases/graph_batch_native_rls.rs

diff --git a/nodedb/tests/wire/cases/graph_batch_native_rls.rs b/nodedb/tests/wire/cases/graph_batch_native_rls.rs
new file mode 100644
index 000000000..50e5f6562
--- /dev/null
+++ b/nodedb/tests/wire/cases/graph_batch_native_rls.rs
@@ -0,0 +1,191 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! The native client's batch delete under a row-level-security write policy.
+//!
+//! A restricted principal connects over the native protocol with a password. A
+//! batch holding one denied edge is refused as a whole with the
+//! authorization-denied error code and deletes nothing. A batch of only allowed
+//! edges lands. Edge state is read through the superuser pgwire connection.
+//!
+//! The endpoints here are co-resident on one vShard, so a refusal can only come
+//! from policy, never from cross-shard routing.
+
+use nodedb_client::NativeClient;
+use nodedb_types::error::ErrorCode;
+use nodedb_types::id::VShardId;
+use nodedb_types::protocol::AuthMethod;
+
+use crate::harness::TestServer;
+
+const PASSWORD: &str = "graph-batch-native-rls-probe-secret-9";
+const ROLE: &str = "readwrite";
+
+/// Endpoints chosen so both hash to one vShard.
+const EDGE_SRC: &str = "a";
+const EDGE_DST: &str = "xy";
+
+#[test]
+fn native_batch_endpoints_are_co_resident() {
+    assert_eq!(
+        VShardId::from_key(EDGE_SRC.as_bytes()),
+        VShardId::from_key(EDGE_DST.as_bytes()),
+        "the native batch RLS tests must exercise the SINGLE-SHARD path; \
+         rename the endpoints until the two hashes agree again"
+    );
+}
+
+async fn create_user(server: &TestServer, user: &str) {
+    server
+        .exec(&format!("CREATE USER {user} PASSWORD '{PASSWORD}'"))
+        .await
+        .unwrap_or_else(|e| panic!("create user {user}: {e}"));
+    server
+        .exec(&format!("GRANT ROLE {ROLE} TO {user}"))
+        .await
+        .unwrap_or_else(|e| panic!("grant {ROLE} to {user}: {e}"));
+}
+
+async fn write_policy(server: &TestServer, policy: &str, collection: &str) {
+    server
+        .exec(&format!(
+            "CREATE RLS POLICY {policy} ON {collection} FOR WRITE \
+             USING (owner = $auth.username)"
+        ))
+        .await
+        .unwrap_or_else(|e| panic!("create write policy {policy}: {e}"));
+}
+
+/// True when an edge with `label` leaves `EDGE_SRC` in the `out` direction.
+///
+/// `GRAPH NEIGHBORS` returns a JSON array per row, and an absent edge answers
+/// with an empty array rather than no row: parse the array, never test the raw
+/// text, or "present" is reported for everything.
+///
+/// A read error or an unparsable row panics. Returning `false` for either would
+/// make the negative assertions below unfalsifiable — they would pass when the
+/// read path broke, which is the opposite of what they pin.
+async fn has_labeled_edge(server: &TestServer, collection: &str, label: &str) -> bool {
+    let rows = server
+        .query_text(&format!(
+            "GRAPH NEIGHBORS IN '{collection}' OF '{EDGE_SRC}' DIRECTION out LABEL '{label}'"
+        ))
+        .await
+        .unwrap_or_else(|e| panic!("neighbors read for label {label} failed: {e:?}"));
+    rows.iter().any(|row| {
+        serde_json::from_str::<serde_json::Value>(row)
+            .unwrap_or_else(|e| panic!("neighbors row is not JSON: {row}: {e}"))
+            .as_array()
+            .unwrap_or_else(|| panic!("neighbors row is not a JSON array: {row}"))
+            .iter()
+            .any(|v| v.get("label").and_then(|l| l.as_str()) == Some(label))
+    })
+}
+
+/// Seed one edge per `(label, owner)` pair between the co-resident endpoints.
+async fn seed_owned_edges(server: &TestServer, collection: &str, edges: &[(&str, &str)]) {
+    for (label, owner) in edges {
+        server
+            .exec(&format!(
+                "GRAPH INSERT EDGE IN '{collection}' FROM '{EDGE_SRC}' TO '{EDGE_DST}' \
+                 TYPE '{label}' PROPERTIES '{{\"owner\":\"{owner}\"}}'"
+            ))
+            .await
+            .unwrap_or_else(|e| panic!("seed {label}: {e}"));
+        assert!(has_labeled_edge(server, collection, label).await);
+    }
+}
+
+/// A native client logged in as `user` with a password.
+fn native_client_as(server: &TestServer, user: &str) -> NativeClient {
+    NativeClient::connect_as(
+        &format!("127.0.0.1:{}", server.native_port),
+        AuthMethod::Password {
+            username: user.to_string(),
+            password: PASSWORD.to_string(),
+        },
+    )
+}
+
+/// A native batch delete holding one denied edge is refused as a whole. The
+/// error carries `ErrorCode::AUTHORIZATION_DENIED` and no edge is deleted, the
+/// allowed one included.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_native_batch_delete_with_a_denied_edge_is_refused_and_deletes_nothing() {
+    let server = TestServer::start().await;
+    let user = "g_native_rls_delete_user";
+    let collection = "g_native_rls_delete";
+    server
+        .exec(&format!("CREATE COLLECTION {collection}"))
+        .await
+        .expect("create edge collection");
+    create_user(&server, user).await;
+    write_policy(&server, "g_native_rls_delete_policy", collection).await;
+    seed_owned_edges(
+        &server,
+        collection,
+        &[("owns1", user), ("steals", "someone-else")],
+    )
+    .await;
+
+    let client = native_client_as(&server, user);
+    let err = client
+        .batch_graph_delete_edges(
+            collection,
+            &[
+                (EDGE_SRC, EDGE_DST, "owns1"),
+                (EDGE_SRC, EDGE_DST, "steals"),
+            ],
+        )
+        .await
+        .expect_err("the denied edge must make the native batch report an error");
+    assert_eq!(
+        err.code(),
+        ErrorCode::AUTHORIZATION_DENIED,
+        "native batch refusal code: {err}"
+    );
+    assert!(err.is_auth_denied(), "native batch refusal kind: {err}");
+
+    for label in ["owns1", "steals"] {
+        assert!(
+            has_labeled_edge(&server, collection, label).await,
+            "edge {label} must survive: a refused native batch deletes nothing"
+        );
+    }
+}
+
+/// A native batch of only conforming edges is admitted and deletes them. An
+/// edge outside the batch survives.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_native_batch_delete_of_only_allowed_edges_deletes_them() {
+    let server = TestServer::start().await;
+    let user = "g_native_rls_delete_ok_user";
+    let collection = "g_native_rls_delete_ok";
+    server
+        .exec(&format!("CREATE COLLECTION {collection}"))
+        .await
+        .expect("create edge collection");
+    create_user(&server, user).await;
+    write_policy(&server, "g_native_rls_delete_ok_policy", collection).await;
+    seed_owned_edges(
+        &server,
+        collection,
+        &[("owns1", user), ("owns2", user), ("steals", "someone-else")],
+    )
+    .await;
+
+    let client = native_client_as(&server, user);
+    client
+        .batch_graph_delete_edges(
+            collection,
+            &[(EDGE_SRC, EDGE_DST, "owns1"), (EDGE_SRC, EDGE_DST, "owns2")],
+        )
+        .await
+        .expect("a native batch of conforming edges must be admitted");
+
+    assert!(!has_labeled_edge(&server, collection, "owns1").await);
+    assert!(!has_labeled_edge(&server, collection, "owns2").await);
+    assert!(
+        has_labeled_edge(&server, collection, "steals").await,
+        "an edge outside the batch must survive"
+    );
+}
diff --git a/nodedb/tests/wire/cases/mod.rs b/nodedb/tests/wire/cases/mod.rs
index 989e0cf85..60cbf4fda 100644
--- a/nodedb/tests/wire/cases/mod.rs
+++ b/nodedb/tests/wire/cases/mod.rs
@@ -117,6 +117,7 @@ mod fts_read_body_format;
 mod function_security_e2e;
 mod graph_analytics_authorization;
 mod graph_batch_native;
+mod graph_batch_native_rls;
 mod graph_batch_rls;
 mod graph_batch_stats;
 mod graph_crdt_delete_edges;

From 6cf43c22214a5ac9d6ce90e43b8ac7291c95fc17 Mon Sep 17 00:00:00 2001
From: EnRaiha <15997552+EnRaiha@users.noreply.github.com>
Date: Sat, 24 Oct 2026 00:07:02 +0800
Subject: [PATCH 24/24] fix(metadata): cancel the pending DDL record of a
 failed commit

A reserve that fails after its pending record applied left the record in the
catalog until a restart. The error arm now proposes the cancel first, then ends
the drains the reserve started, then releases the lease. A failpoint after the
pending propose lets a test force the failure.
---
 .../server/shared/session/ddl_flush.rs        | 80 ++++++++++++++-----
 .../shared/session/ddl_flush_cleanup.rs       | 52 ++++++++++++
 .../src/control/server/shared/session/mod.rs  |  1 +
 3 files changed, 111 insertions(+), 22 deletions(-)
 create mode 100644 nodedb/src/control/server/shared/session/ddl_flush_cleanup.rs

diff --git a/nodedb/src/control/server/shared/session/ddl_flush.rs b/nodedb/src/control/server/shared/session/ddl_flush.rs
index bb28e6ee4..13bb5e7dc 100644
--- a/nodedb/src/control/server/shared/session/ddl_flush.rs
+++ b/nodedb/src/control/server/shared/session/ddl_flush.rs
@@ -13,7 +13,7 @@
 
 use std::sync::Arc;
 
-use nodedb_cluster::{DescriptorId, DrainOwner, MetadataEntry, PendingDdlObject, encode_entry};
+use nodedb_cluster::{DescriptorId, MetadataEntry, PendingDdlObject, encode_entry};
 
 use crate::control::catalog_entry::{self, CatalogEntry};
 use crate::control::constraint_install::{ConstraintTarget, constraint_targets};
@@ -23,6 +23,7 @@ use crate::control::state::SharedState;
 
 use super::connection::SessionId;
 use super::ddl_buffer::{DdlBuffer, take};
+use super::ddl_flush_cleanup::cleanup_failed_reserve;
 use super::store::SessionStore;
 
 /// What COMMIT must do with this connection's buffered DDL before any
@@ -196,13 +197,14 @@ async fn propose_pending_buffered<'a>(
     let lease =
         crate::control::metadata_proposer::acquire_ddl_prepare_lease_async(state, handle.as_ref())
             .await?;
+    let token = lease.token();
     let mut started_drains = Vec::new();
     let reserved = reserve_buffered(
         state,
         sessions,
         session_id,
         handle.as_ref(),
-        lease.token(),
+        token,
         buffered,
         &mut started_drains,
     )
@@ -213,38 +215,20 @@ async fn propose_pending_buffered<'a>(
             objects,
             constraint_targets,
         }) => Ok(PendingDdlHandle {
-            token: lease.token(),
+            token,
             log_index,
             lease,
             objects,
             constraint_targets,
         }),
         Err(error) => {
-            end_started_drains(state, started_drains).await;
+            cleanup_failed_reserve(state, handle.as_ref(), token, started_drains).await;
             lease.release().await;
             Err(error)
         }
     }
 }
 
-/// End each drain a failed reserve started. The drain has no expiry, so only
-/// this propose clears it. The propose reaches the log even when its apply
-/// wait passes the statement deadline. An error is logged and the next drain
-/// still ends.
-async fn end_started_drains(state: &SharedState, started: Vec<DescriptorId>) {
-    for id in started {
-        if let Err(error) =
-            crate::control::lease::end_drain_async(state, id.clone(), DrainOwner::Ddl).await
-        {
-            tracing::warn!(
-                descriptor = ?id,
-                %error,
-                "DDL drain end failed after a failed reserve"
-            );
-        }
-    }
-}
-
 /// What [`reserve_buffered`] reserved.
 struct Reserved {
     log_index: u64,
@@ -334,6 +318,11 @@ async fn reserve_buffered(
         proposed_at: state.hlc_clock.now(),
     };
     let log_index = propose_and_await(state, handle, &pending).await?;
+    crate::fail_point_err!(
+        crate::fail_point::FailScope::Node(state.node_id),
+        "ddl_flush::after_pending_propose",
+        |detail| crate::Error::Internal { detail }
+    );
     // The propose reserves only while `token` owns the lease. A lease the
     // metadata leader reclaimed meanwhile left no record.
     if !state.pending_ddl.contains(token) {
@@ -929,4 +918,51 @@ mod tests {
         );
         cluster.shutdown().await;
     }
+
+    /// A reserve that fails after its pending record applied cancels the record.
+    #[cfg(feature = "failpoints")]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn a_failed_reserve_after_the_propose_cancels_the_record() {
+        use nodedb_types::fail_point::{FailAction, FailGuard};
+
+        let cluster = test_one_node::boot().await;
+        let state = &cluster.state;
+        let _fail = FailGuard::for_node(
+            state.node_id,
+            "ddl_flush::after_pending_propose",
+            FailAction::Fail("injected".into()),
+        );
+
+        let (sessions, session_id) = test_session();
+        let refused = conn_scope::scoped(async {
+            ddl_buffer::activate();
+            let stored = StoredSequence::new(0, 7, "orders_seq".into(), "alice".into());
+            assert!(ddl_buffer::try_buffer(CatalogEntry::PutSequence(Box::new(
+                stored
+            ))));
+            begin_commit(state, &sessions, session_id).await.is_err()
+        })
+        .await;
+
+        assert!(refused, "the injected error must fail the reserve");
+        assert!(
+            state
+                .credentials
+                .catalog()
+                .load_pending_ddl()
+                .expect("load pending records")
+                .is_empty(),
+            "a failed reserve must cancel the pending record it applied"
+        );
+        assert!(
+            state
+                .metadata_ddl
+                .owner
+                .lock()
+                .expect("owner lock")
+                .is_none(),
+            "a failed reserve must release the preparation lease"
+        );
+        cluster.shutdown().await;
+    }
 }
diff --git a/nodedb/src/control/server/shared/session/ddl_flush_cleanup.rs b/nodedb/src/control/server/shared/session/ddl_flush_cleanup.rs
new file mode 100644
index 000000000..5c1900c39
--- /dev/null
+++ b/nodedb/src/control/server/shared/session/ddl_flush_cleanup.rs
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Cleanup after a failed reserve in `ddl_flush`.
+
+use nodedb_cluster::{DescriptorId, DrainOwner, MetadataEntry};
+
+use crate::control::metadata_proposer::MetadataRaftHandle;
+use crate::control::state::SharedState;
+
+use super::ddl_flush::propose_and_await;
+
+/// Undo what a failed reserve left behind. Cancel the pending record of
+/// `token`, then end each drain in `started_drains`.
+///
+/// Always propose the cancel. After an apply wait timeout the record can still
+/// be pending locally. The cancel is idempotent for a token with no record and
+/// needs no lease ownership. An error is logged and the rest of the cleanup
+/// still runs. The caller releases the lease afterwards.
+pub(super) async fn cleanup_failed_reserve(
+    state: &SharedState,
+    handle: &dyn MetadataRaftHandle,
+    token: u64,
+    started_drains: Vec<DescriptorId>,
+) {
+    let cancel = MetadataEntry::DdlPendingCancel { token };
+    if let Err(error) = propose_and_await(state, handle, &cancel).await {
+        tracing::warn!(
+            token,
+            %error,
+            "pending DDL cancel failed after a failed reserve"
+        );
+    }
+    end_started_drains(state, started_drains).await;
+}
+
+/// End each drain a failed reserve started. The drain has no expiry, so only
+/// this propose clears it. The propose reaches the log even when its apply
+/// wait passes the statement deadline. An error is logged and the next drain
+/// still ends.
+async fn end_started_drains(state: &SharedState, started: Vec<DescriptorId>) {
+    for id in started {
+        if let Err(error) =
+            crate::control::lease::end_drain_async(state, id.clone(), DrainOwner::Ddl).await
+        {
+            tracing::warn!(
+                descriptor = ?id,
+                %error,
+                "DDL drain end failed after a failed reserve"
+            );
+        }
+    }
+}
diff --git a/nodedb/src/control/server/shared/session/mod.rs b/nodedb/src/control/server/shared/session/mod.rs
index d3bbbf8f2..ae3afe123 100644
--- a/nodedb/src/control/server/shared/session/mod.rs
+++ b/nodedb/src/control/server/shared/session/mod.rs
@@ -15,6 +15,7 @@ pub mod ddl_buffer;
 mod ddl_compensate;
 pub mod ddl_effect;
 mod ddl_flush;
+mod ddl_flush_cleanup;
 pub mod ddl_rollback;
 pub mod deadline;
 pub mod ephemeral_sequence;