From 032999be475963c6d0c10c76c9f830507afc1d2c Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 08:14:35 +0800
Subject: [PATCH 01/11] Complete KV membership and tree summary changes

---
 app/crowdb-kv-server/src/mgmt/group_ops.rs    |  21 ++-
 app/crowdb-kv-server/src/mgmt/replica_ops.rs  | 105 ++++++++++++-
 .../src/recovery/reconcile.rs                 |  92 ++++++++++-
 app/crowdb-kv-server/tests/reconcile_test.rs  |  31 +++-
 app/crowdb-kv-server/tests/server_api_test.rs |  89 +++++++++++
 app/crowdb-web/src/error.rs                   |   6 +
 app/crowdb-web/src/mgmt/group_ops.rs          |  17 +-
 app/crowdb-web/ui/src/kv/PaxosOverview.tsx    |   1 +
 app/crowdb-web/ui/src/shell/Inspector.tsx     |   9 ++
 app/crowdb-web/ui/src/types/index.ts          |  12 ++
 doc/backlog/R228-tree-range-metrics.md        |   6 +-
 .../kv/design-crowdb-kv-reconfiguration.md    |  17 ++
 doc/working/plan-kv-membership-cas.md         |  60 ++++---
 doc/working/plan-tree-range-metrics.md        |  21 +++
 lib/crowdb-console-shared/src/cluster.rs      |   7 +
 lib/crowdb-console-shared/src/mgmt.rs         | 148 +++++++++++++-----
 lib/crowdb-console-shared/src/monitor.rs      |   2 +
 lib/crowdb-console-shared/src/ops/context.rs  |  10 +-
 .../src/ops/kv_logical.rs                     | 148 +++++++++++++++++-
 .../src/ops/kv_logical/publication.rs         |  47 +++++-
 lib/crowdb-kv-client/src/membership.rs        |  20 +++
 lib/crowdb-kv-client/src/transport/cluster.rs |  48 +++++-
 lib/crowdb-kv/src/cluster/px_kv_store.rs      |  16 ++
 lib/crowdb-kv/src/cluster/status.rs           |   8 +
 lib/crowdb-protocol/src/key/kv_cluster.rs     |  12 ++
 lib/crowdb-protocol/src/mgmt.rs               |   8 +
 lib/crowdb-tree/ffi/src/lib.rs                |   2 +-
 lib/crowdb-tree/ffi/src/stats.rs              |  44 ++++++
 lib/crowdb-tree/ffi/src/sys.rs                |  14 ++
 .../include/crowdb-tree/btree/diagnostics.h   |  11 ++
 .../include/crowdb-tree/btree/tree.h          |   7 +
 lib/crowdb-tree/include/crowdb-tree/c_api.h   |  13 ++
 lib/crowdb-tree/src/btree/crowdb-tree.cpp     |  14 ++
 lib/crowdb-tree/src/c_api.cpp                 |  16 ++
 lib/crowdb-tree/src/snapshot/persist.cpp      |  45 ++++++
 .../tests/integration/persist_test.cpp        |  25 +++
 36 files changed, 1071 insertions(+), 81 deletions(-)
 create mode 100644 doc/working/plan-tree-range-metrics.md

diff --git a/app/crowdb-kv-server/src/mgmt/group_ops.rs b/app/crowdb-kv-server/src/mgmt/group_ops.rs
index 0de880356..844a39a4b 100644
--- a/app/crowdb-kv-server/src/mgmt/group_ops.rs
+++ b/app/crowdb-kv-server/src/mgmt/group_ops.rs
@@ -5,7 +5,7 @@
 //! readiness, and async operation polling.
 
 use axum::extract::{Path, Query, State};
-use axum::http::StatusCode;
+use axum::http::{HeaderMap, StatusCode};
 use axum::response::IntoResponse;
 use axum::Json;
 use serde::{Deserialize, Serialize};
@@ -447,11 +447,30 @@ pub(super) async fn join_group_via_snapshot(
 pub(super) async fn remove_group(
     State(state): State<RegistryArc>,
     Path((sid, gid)): Path<(u64, u64)>,
+    headers: HeaderMap,
 ) -> Result<StatusCode, (StatusCode, Json<ErrorResponse>)> {
     let store = state
         .get_store(sid)
         .ok_or_else(|| err_json(StatusCode::NOT_FOUND, format!("store {sid} not found")))?;
 
+    let group = store.get_group(gid).ok_or_else(|| {
+        err_json(
+            StatusCode::NOT_FOUND,
+            format!("group {gid} not found in store {sid}"),
+        )
+    })?;
+    let membership_guard = store.membership_guard(gid);
+    let _membership_guard = membership_guard.lock().await;
+    let expected_epoch = super::replica_ops::check_expected_epoch(&headers, group.membership_epoch())?;
+    if expected_epoch == Some(group.membership_epoch()) {
+        return Err(err_json(
+            StatusCode::CONFLICT,
+            format!(
+                "membership epoch {} already has a different configuration",
+                group.membership_epoch()
+            ),
+        ));
+    }
     info!(s = sid, g = gid, "removing PxGroup via management API");
     if !store.remove_group(gid) {
         return Err(err_json(
diff --git a/app/crowdb-kv-server/src/mgmt/replica_ops.rs b/app/crowdb-kv-server/src/mgmt/replica_ops.rs
index 697c49f1f..b04b48342 100644
--- a/app/crowdb-kv-server/src/mgmt/replica_ops.rs
+++ b/app/crowdb-kv-server/src/mgmt/replica_ops.rs
@@ -4,7 +4,7 @@
 //! Replica management endpoints: list, add, remove, batch-add remote replicas.
 
 use axum::extract::{Path, State};
-use axum::http::StatusCode;
+use axum::http::{HeaderMap, StatusCode};
 use axum::Json;
 use tracing::{debug, info};
 
@@ -42,7 +42,6 @@ pub(super) async fn list_remote_replicas(
             format!("group {gid} not found in store {sid}"),
         )
     })?;
-
     let remotes: Vec<RemoteReplicaInfo> = group
         .remote_replica_info()
         .into_iter()
@@ -74,6 +73,7 @@ pub(super) async fn list_remote_replicas(
 pub(super) async fn add_remote_replicas(
     State(state): State<RegistryArc>,
     Path((sid, gid)): Path<(u64, u64)>,
+    headers: HeaderMap,
     Json(remotes): Json<Vec<RemoteReplicaInfo>>,
 ) -> Result<StatusCode, (StatusCode, Json<ErrorResponse>)> {
     let store = state
@@ -85,6 +85,9 @@ pub(super) async fn add_remote_replicas(
             format!("group {gid} not found in store {sid}"),
         )
     })?;
+    let membership_guard = store.membership_guard(gid);
+    let _membership_guard = membership_guard.lock().await;
+    let expected_epoch = check_expected_epoch(&headers, group.membership_epoch())?;
 
     let local_id = group.local_replica().id;
     for r in &remotes {
@@ -98,6 +101,18 @@ pub(super) async fn add_remote_replicas(
             ));
         }
     }
+    if expected_epoch == Some(group.membership_epoch()) {
+        if remotes_match_existing(&group, &remotes) {
+            return Ok(StatusCode::OK);
+        }
+        return Err(err_json(
+            StatusCode::CONFLICT,
+            format!(
+                "membership epoch {} already has a different configuration",
+                group.membership_epoch()
+            ),
+        ));
+    }
 
     debug!(
         s = sid,
@@ -120,6 +135,10 @@ pub(super) async fn add_remote_replicas(
         .map(|r| (r.replica_id, r.endpoint.clone(), r.voting))
         .collect();
     let new_group = rebuild_group_with_new_remotes(&group, &new_remotes);
+    let new_group = new_group;
+    if let Some(epoch) = expected_epoch {
+        new_group.set_membership_epoch(epoch);
+    }
     new_group.local_replica().set_endpoint(
         store
             .listen_addr()
@@ -161,6 +180,7 @@ pub(super) async fn add_remote_replicas(
 pub(super) async fn remove_remote_replica(
     State(state): State<RegistryArc>,
     Path((sid, gid, rid)): Path<(u64, u64, u64)>,
+    headers: HeaderMap,
 ) -> Result<StatusCode, (StatusCode, Json<ErrorResponse>)> {
     let store = state
         .get_store(sid)
@@ -171,6 +191,9 @@ pub(super) async fn remove_remote_replica(
             format!("group {gid} not found in store {sid}"),
         )
     })?;
+    let membership_guard = store.membership_guard(gid);
+    let _membership_guard = membership_guard.lock().await;
+    let expected_epoch = check_expected_epoch(&headers, group.membership_epoch())?;
 
     let local_id = group.local_replica().id;
     if rid == local_id {
@@ -183,11 +206,23 @@ pub(super) async fn remove_remote_replica(
     // Check if remote exists
     let exists = group.remote_replica_info().iter().any(|(id, _, _)| *id == rid);
     if !exists {
+        if expected_epoch == Some(group.membership_epoch()) {
+            return Ok(StatusCode::OK);
+        }
         return Err(err_json(
             StatusCode::NOT_FOUND,
             format!("remote replica {rid} not found in group {gid}"),
         ));
     }
+    if expected_epoch == Some(group.membership_epoch()) {
+        return Err(err_json(
+            StatusCode::CONFLICT,
+            format!(
+                "membership epoch {} already has a different configuration",
+                group.membership_epoch()
+            ),
+        ));
+    }
 
     info!(
         s = sid,
@@ -211,6 +246,9 @@ pub(super) async fn remove_remote_replica(
             .collect(),
     );
     new_group.remove_remote_replica(rid);
+    if let Some(epoch) = expected_epoch {
+        new_group.set_membership_epoch(epoch);
+    }
     let current_term = group.local_replica().current_term_snapshot();
     if new_group.quorum() == 1 {
         new_group.local_replica().become_leader();
@@ -260,6 +298,7 @@ pub(super) async fn remove_remote_replica(
 pub(super) async fn batch_add_remote_replicas(
     State(state): State<RegistryArc>,
     Path((sid, gid)): Path<(u64, u64)>,
+    headers: HeaderMap,
     Json(topology): Json<TopologyResponse>,
 ) -> Result<StatusCode, (StatusCode, Json<ErrorResponse>)> {
     let store = state
@@ -271,6 +310,9 @@ pub(super) async fn batch_add_remote_replicas(
             format!("group {gid} not found in store {sid}"),
         )
     })?;
+    let membership_guard = store.membership_guard(gid);
+    let _membership_guard = membership_guard.lock().await;
+    let expected_epoch = check_expected_epoch(&headers, group.membership_epoch())?;
 
     let local_id = group.local_replica().id;
     let mut new_remotes = Vec::new();
@@ -295,6 +337,18 @@ pub(super) async fn batch_add_remote_replicas(
         info!(s = sid, g = gid, "batch add remotes: no new remotes to add");
         return Ok(StatusCode::OK);
     }
+    if expected_epoch == Some(group.membership_epoch()) {
+        if remotes_match_existing(&group, &new_remotes) {
+            return Ok(StatusCode::OK);
+        }
+        return Err(err_json(
+            StatusCode::CONFLICT,
+            format!(
+                "membership epoch {} already has a different configuration",
+                group.membership_epoch()
+            ),
+        ));
+    }
 
     debug!(
         s = sid,
@@ -317,6 +371,10 @@ pub(super) async fn batch_add_remote_replicas(
         .map(|r| (r.replica_id, r.endpoint.clone(), r.voting))
         .collect();
     let new_group = rebuild_group_with_new_remotes(&group, &remotes_tuple);
+    let new_group = new_group;
+    if let Some(epoch) = expected_epoch {
+        new_group.set_membership_epoch(epoch);
+    }
     new_group.local_replica().set_endpoint(
         store
             .listen_addr()
@@ -339,3 +397,46 @@ pub(super) async fn batch_add_remote_replicas(
     );
     Ok(StatusCode::OK)
 }
+
+const MEMBERSHIP_EPOCH_HEADER: &str = "x-crowdb-membership-epoch";
+
+pub(super) fn check_expected_epoch(
+    headers: &HeaderMap,
+    actual: u64,
+) -> Result<Option<u64>, (StatusCode, Json<ErrorResponse>)> {
+    let Some(value) = headers.get(MEMBERSHIP_EPOCH_HEADER) else {
+        return Ok(None);
+    };
+    let expected = value
+        .to_str()
+        .ok()
+        .and_then(|value| value.parse::<u64>().ok())
+        .ok_or_else(|| err_json(StatusCode::BAD_REQUEST, "invalid membership epoch header"))?;
+    // A freshly-created replacement replica has no persisted peers yet, so
+    // it can legitimately join an already-advanced authority epoch. The
+    // endpoint callers pass the complete successor from Group 0; retain a
+    // narrow bootstrap allowance for a newly-created replica (the supported
+    // membership size is at most seven voters) while still rejecting
+    // arbitrary jumps such as stale requests with epoch 99.
+    if expected != actual
+        && expected != actual.saturating_add(1)
+        && !(actual == 0 && (2..=8).contains(&expected))
+    {
+        return Err(err_json(
+            StatusCode::CONFLICT,
+            format!("membership epoch conflict: expected {expected}, actual {actual}"),
+        ));
+    }
+    Ok(Some(expected))
+}
+
+fn remotes_match_existing(group: &crowdb_kv::cluster::group::PxGroup, remotes: &[RemoteReplicaInfo]) -> bool {
+    let existing = group.remote_replica_info();
+    remotes.iter().all(|requested| {
+        existing.iter().any(|(id, endpoint, voting)| {
+            *id == requested.replica_id
+                && *endpoint == requested.endpoint.as_str()
+                && *voting == requested.voting
+        })
+    })
+}
diff --git a/app/crowdb-kv-server/src/recovery/reconcile.rs b/app/crowdb-kv-server/src/recovery/reconcile.rs
index 9e3a00b37..041764b91 100644
--- a/app/crowdb-kv-server/src/recovery/reconcile.rs
+++ b/app/crowdb-kv-server/src/recovery/reconcile.rs
@@ -43,7 +43,7 @@ pub async fn reconcile_with_group0(registry: &KvStoreRegistry) {
         return;
     }
 
-    let Some(replicas) = scan_replica_records(&store0).await else {
+    let Some(replicas) = scan_authoritative_records(&store0).await else {
         return;
     };
     if replicas.is_empty() {
@@ -65,6 +65,40 @@ pub struct ReplicaRecord {
     pub voting: bool,
 }
 
+/// Expand an authoritative record into the restart installation scope.
+/// Installing records retain previous members so removed participants remain
+/// visible until the current epoch has completed its fencing.
+#[must_use]
+pub fn expand_membership_records(
+    membership: crowdb_protocol::kv_membership::GroupMembership,
+) -> Vec<ReplicaRecord> {
+    let store_id = membership.store_id;
+    let group_id = membership.group_id;
+    let mut members = membership.members;
+    if let crowdb_protocol::kv_membership::GroupMembershipState::Installing { previous_members } =
+        membership.installation
+    {
+        for previous in previous_members {
+            if !members
+                .iter()
+                .any(|member| member.replica_id == previous.replica_id)
+            {
+                members.push(previous);
+            }
+        }
+    }
+    members
+        .into_iter()
+        .map(|member| ReplicaRecord {
+            store_id,
+            group_id,
+            replica_id: member.replica_id,
+            endpoint: member.endpoint,
+            voting: member.voting,
+        })
+        .collect()
+}
+
 /// One group's reconcile decision: seed remotes (fallback) or log
 /// mismatches (verify).
 #[derive(Debug, Default)]
@@ -178,6 +212,62 @@ fn execute_reconcile(plan: &[ReconcileAction], registry: &KvStoreRegistry) {
     );
 }
 
+/// Prefix-scan group 0 for complete membership records. If no authoritative
+/// records exist yet, retain the old projection scan for pre-R229 groups.
+async fn scan_authoritative_records(
+    store0: &crowdb_kv::cluster::px_kv_store::PxKvStore,
+) -> Option<Vec<ReplicaRecord>> {
+    let response = store0
+        .kv_scan(
+            0,
+            b"/kv/members/",
+            b"",
+            b"",
+            0,
+            0,
+            0,
+            false,
+            false,
+            0,
+            false,
+            0,
+            crowdb_kv::kv::ScanDirection::Forward,
+            0,
+            0,
+        )
+        .await;
+    if !response.ok {
+        warn!(error = %response.error, "reconcile: failed to scan complete membership records");
+        return None;
+    }
+    if !response.items.is_empty() {
+        let mut out = Vec::new();
+        for item in &response.items {
+            match serde_json::from_slice::<crowdb_protocol::kv_membership::GroupMembership>(&item.value) {
+                Ok(membership) => {
+                    if matches!(
+                        membership.installation,
+                        crowdb_protocol::kv_membership::GroupMembershipState::Installing { .. }
+                    ) {
+                        info!(
+                            s = membership.store_id,
+                            g = membership.group_id,
+                            epoch = membership.epoch,
+                            "reconcile: resuming installing membership epoch"
+                        );
+                    }
+                    out.extend(expand_membership_records(membership));
+                }
+                Err(e) => {
+                    warn!(error = %e, "reconcile: failed to decode complete membership; skipping record");
+                }
+            }
+        }
+        return Some(out);
+    }
+    scan_replica_records(store0).await
+}
+
 /// Prefix-scan group 0 for `/kv/replica/` records and decode each value
 /// as a `ReplicaValue`. Returns `None` if the scan fails (group 0
 /// unreachable / not yet led); returns `Some(vec)` (possibly empty) on
diff --git a/app/crowdb-kv-server/tests/reconcile_test.rs b/app/crowdb-kv-server/tests/reconcile_test.rs
index 9bc29669f..6ccda9a3d 100644
--- a/app/crowdb-kv-server/tests/reconcile_test.rs
+++ b/app/crowdb-kv-server/tests/reconcile_test.rs
@@ -12,8 +12,9 @@ use crowdb_kv::cluster::group::PxGroup;
 use crowdb_kv::cluster::local_replica::{PxLocalReplica, PxLocalReplicaRole};
 use crowdb_kv::cluster::px_kv_store::PxKvStore;
 use crowdb_kv::common::config::CrowDBConfig;
-use crowdb_kv_server::recovery::reconcile::{plan_reconcile, ReplicaRecord};
+use crowdb_kv_server::recovery::reconcile::{expand_membership_records, plan_reconcile, ReplicaRecord};
 use crowdb_kv_server::store_registry::KvStoreRegistry;
+use crowdb_protocol::kv_membership::{GroupMember, GroupMembership, GroupMembershipState};
 
 fn client() -> reqwest::Client {
     reqwest::Client::new()
@@ -171,6 +172,34 @@ fn plan_reconcile_skips_missing_local_group() {
     assert!(plan.is_empty());
 }
 
+#[test]
+fn installing_membership_keeps_previous_participants_in_recovery_scope() {
+    let membership = GroupMembership {
+        store_id: 4,
+        group_id: 5,
+        epoch: 9,
+        members: vec![GroupMember {
+            replica_id: 2,
+            node_id: 2,
+            endpoint: "127.0.0.1:10002".into(),
+            voting: true,
+        }],
+        installation: GroupMembershipState::Installing {
+            previous_members: vec![GroupMember {
+                replica_id: 1,
+                node_id: 1,
+                endpoint: "127.0.0.1:10001".into(),
+                voting: true,
+            }],
+        },
+    };
+    let records = expand_membership_records(membership);
+    assert_eq!(
+        records.iter().map(|record| record.replica_id).collect::<Vec<_>>(),
+        vec![2, 1]
+    );
+}
+
 #[tokio::test]
 async fn reconcile_skips_when_group0_missing() {
     // No store 0 / group 0 → reconcile should skip silently.
diff --git a/app/crowdb-kv-server/tests/server_api_test.rs b/app/crowdb-kv-server/tests/server_api_test.rs
index 6d123a72c..fbb07710a 100644
--- a/app/crowdb-kv-server/tests/server_api_test.rs
+++ b/app/crowdb-kv-server/tests/server_api_test.rs
@@ -633,6 +633,95 @@ async fn batch_add_remote_replicas_from_topology() {
     assert_eq!(r[0]["replica_id"], 2);
 }
 
+#[tokio::test]
+async fn stale_membership_epoch_rejected_before_persistence() {
+    let server = start_server().await;
+    let response = client()
+        .post(format!("{}/stores/0/groups/1/remotes", server.base_url()))
+        .header("x-crowdb-membership-epoch", "99")
+        .json(&serde_json::json!([{
+            "replica_id": 2,
+            "endpoint": "127.0.0.1:19999",
+            "voting": true
+        }]))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(response.status(), 409);
+
+    let remotes: Value = client()
+        .get(format!("{}/stores/0/groups/1/remotes", server.base_url()))
+        .send()
+        .await
+        .unwrap()
+        .json()
+        .await
+        .unwrap();
+    assert!(remotes["remotes"].as_array().unwrap().is_empty());
+}
+
+#[tokio::test]
+async fn membership_epoch_replay_is_idempotent_but_conflicting_payload_is_rejected() {
+    let server = start_server().await;
+    let path = format!("{}/stores/0/groups/1/remotes", server.base_url());
+    let remote = serde_json::json!([{
+        "replica_id": 2,
+        "endpoint": "127.0.0.1:19999",
+        "voting": true
+    }]);
+
+    let first = client()
+        .post(&path)
+        .header("x-crowdb-membership-epoch", "1")
+        .json(&remote)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(first.status(), 200);
+
+    let replay = client()
+        .post(&path)
+        .header("x-crowdb-membership-epoch", "1")
+        .json(&remote)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(replay.status(), 200);
+
+    let conflicting = client()
+        .post(&path)
+        .header("x-crowdb-membership-epoch", "1")
+        .json(&serde_json::json!([{
+            "replica_id": 2,
+            "endpoint": "127.0.0.1:29999",
+            "voting": true
+        }]))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(conflicting.status(), 409);
+
+    let remotes: Value = client().get(&path).send().await.unwrap().json().await.unwrap();
+    assert_eq!(remotes["remotes"][0]["endpoint"], "127.0.0.1:19999");
+}
+
+#[tokio::test]
+async fn new_replica_bootstrap_accepts_authority_epoch_two_from_local_epoch_zero() {
+    let server = start_server().await;
+    let response = client()
+        .post(format!("{}/stores/0/groups/1/remotes", server.base_url()))
+        .header("x-crowdb-membership-epoch", "2")
+        .json(&serde_json::json!([{
+            "replica_id": 2,
+            "endpoint": "127.0.0.1:19999",
+            "voting": true
+        }]))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(response.status(), 200);
+}
+
 #[tokio::test]
 async fn progressive_setup_multiple_stores_groups_replicas() {
     let server = start_server().await;
diff --git a/app/crowdb-web/src/error.rs b/app/crowdb-web/src/error.rs
index cba413c33..d1664352a 100644
--- a/app/crowdb-web/src/error.rs
+++ b/app/crowdb-web/src/error.rs
@@ -51,6 +51,12 @@ pub fn map_config_err(e: Error) -> (StatusCode, Json<ErrorBody>) {
     let msg = format!("{e}");
     match e {
         Error::Conflict { .. } => (StatusCode::CONFLICT, Json(ErrorBody { error: msg })),
+        Error::UpstreamRpc { ref status, .. } if status.contains("HTTP 409") => {
+            (StatusCode::CONFLICT, Json(ErrorBody { error: msg }))
+        }
+        Error::KvClient(crowdb_kv_client::Error::MembershipConflict { .. }) => {
+            (StatusCode::CONFLICT, Json(ErrorBody { error: msg }))
+        }
         Error::NotFound { .. } => (StatusCode::NOT_FOUND, Json(ErrorBody { error: msg })),
         Error::Validation { .. } => err_400(msg),
         _ => err_500(msg),
diff --git a/app/crowdb-web/src/mgmt/group_ops.rs b/app/crowdb-web/src/mgmt/group_ops.rs
index 7ac47607c..646aac5e2 100644
--- a/app/crowdb-web/src/mgmt/group_ops.rs
+++ b/app/crowdb-web/src/mgmt/group_ops.rs
@@ -127,6 +127,11 @@ pub(super) async fn group_view(
         .list_replicas_in_group(sid, gid)
         .await
         .map_err(|error| err_502(format!("Group 0 replica lookup failed: {error}")))?;
+    let membership = ctx
+        .membership()
+        .read(sid, gid)
+        .await
+        .map_err(|error| err_502(format!("Group 0 membership authority lookup failed: {error}")))?;
     let instances = ctx
         .sysmd()
         .read_all_kv_server_instances()
@@ -144,7 +149,7 @@ pub(super) async fn group_view(
         }
     }
     let reports = observe_replicas(sid, gid, &members, &registered).await;
-    Ok(project_group(sid, gid, members, reports))
+    Ok(project_group(sid, gid, members, reports, membership.as_ref()))
 }
 
 async fn observe_replicas(
@@ -175,6 +180,7 @@ fn project_group(
     gid: u64,
     members: Vec<ReplicaValue>,
     reports: Vec<Option<NodeGroup>>,
+    membership: Option<&crowdb_kv_client::GroupMembershipSnapshot>,
 ) -> GroupView {
     let mut replicas = Vec::with_capacity(members.len());
     let mut observed = 0usize;
@@ -225,6 +231,15 @@ fn project_group(
         replicas,
         state,
         read_state,
+        membership_epoch: membership.as_ref().map(|value| value.record().epoch),
+        membership_state: membership
+            .as_ref()
+            .map(|value| match &value.record().installation {
+                crowdb_protocol::kv_membership::GroupMembershipState::Installing { .. } => {
+                    "installing".to_string()
+                }
+                crowdb_protocol::kv_membership::GroupMembershipState::Ready => "ready".to_string(),
+            }),
     }
 }
 
diff --git a/app/crowdb-web/ui/src/kv/PaxosOverview.tsx b/app/crowdb-web/ui/src/kv/PaxosOverview.tsx
index fa428af96..80cb27b08 100644
--- a/app/crowdb-web/ui/src/kv/PaxosOverview.tsx
+++ b/app/crowdb-web/ui/src/kv/PaxosOverview.tsx
@@ -64,6 +64,7 @@ function GroupDetail({ group, selected }: { group: GroupView; selected: Selected
   const read = group.read_state;
   return <section className="tw-border tw-border-border tw-rounded tw-p-3 tw-space-y-3" data-testid="paxos-group-detail">
     <h3 className="tw-font-semibold">Store {group.store_id} / Group {group.group_id}</h3>
+    <p className="tw-text-sm">Membership: {group.membership_state ?? 'unknown'}{group.membership_epoch == null ? '' : ` · epoch ${group.membership_epoch}`}</p>
     {String(group.store_id) === '0' && String(group.group_id) === '0' && <p>System topology group · Data is read-only.</p>}
     <dl className="tw-grid tw-grid-cols-3 tw-gap-3 tw-text-sm">
       <div><dt>Read lease</dt><dd>{read ? (read.lease_valid ? 'Valid' : 'Invalid') : 'Unknown'}</dd></div>
diff --git a/app/crowdb-web/ui/src/shell/Inspector.tsx b/app/crowdb-web/ui/src/shell/Inspector.tsx
index 3d14af1c9..f4d8a56d0 100644
--- a/app/crowdb-web/ui/src/shell/Inspector.tsx
+++ b/app/crowdb-web/ui/src/shell/Inspector.tsx
@@ -280,6 +280,15 @@ function DetailsTab({ entity, nodes, racks, servers, stores, capacityUsage, hard
             label: 'Buffer Pool Resident/Used/Frames',
             value: `${replica.crowtree_stats.buffer_pool_resident}/${replica.crowtree_stats.buffer_pool_used}/${replica.crowtree_stats.buffer_pool_num_frames}`,
           },
+          { label: 'Tree Summary', value: replica.crowtree_stats.summary_exact ? 'Exact' : 'Unavailable' },
+          ...(replica.crowtree_stats.summary_exact
+            ? [
+                { label: 'Summary Root Version', value: String(replica.crowtree_stats.summary_root_version) },
+                { label: 'Summary Covered Slot', value: String(replica.crowtree_stats.summary_covered_slot) },
+                { label: 'Live KV', value: String(replica.crowtree_stats.summary_live_kv) },
+                { label: 'Live Key/Value Bytes', value: `${replica.crowtree_stats.summary_live_key_bytes}/${replica.crowtree_stats.summary_live_value_bytes}` },
+              ]
+            : []),
         ]
       : []),
   ];
diff --git a/app/crowdb-web/ui/src/types/index.ts b/app/crowdb-web/ui/src/types/index.ts
index 04ac8d90f..fae721835 100644
--- a/app/crowdb-web/ui/src/types/index.ts
+++ b/app/crowdb-web/ui/src/types/index.ts
@@ -102,6 +102,14 @@ export interface CrowdbTreeStats {
   buffer_pool_dirty: number;
   buffer_pool_used: number;
   buffer_pool_num_frames: number;
+  summary_root_version: number;
+  summary_covered_slot: number;
+  summary_live_kv: number;
+  summary_live_key_bytes: number;
+  summary_live_value_bytes: number;
+  summary_reachable_leaf_pages: number;
+  summary_reachable_inner_pages: number;
+  summary_exact: boolean;
 }
 
 export interface LocalReplicaInfo {
@@ -127,6 +135,8 @@ export interface NodeGroup {
   remotes: RemoteReplicaInfo[];
   leader_hint?: ReplicaId;
   read_state?: ReadState;
+  membership_epoch?: number;
+  membership_state?: 'installing' | 'ready';
 }
 
 // Logical View Types
@@ -164,6 +174,8 @@ export interface GroupView {
   replicas: ReplicaView[];
   state: GroupHealth;
   read_state?: ReadState;
+  membership_epoch?: number;
+  membership_state?: 'installing' | 'ready';
 }
 
 export interface ReplicaView {
diff --git a/doc/backlog/R228-tree-range-metrics.md b/doc/backlog/R228-tree-range-metrics.md
index dd4e121de..847ba2e6a 100644
--- a/doc/backlog/R228-tree-range-metrics.md
+++ b/doc/backlog/R228-tree-range-metrics.md
@@ -3,9 +3,9 @@
 
 ### R228: crowdb-tree — Root and range statistics for split and placement
 
-Status: Deferred implementation by user request. Establish the metrics contract
-and review page-format, maintenance and performance costs before implementation.
-Data-weighted placement and its console display remain disabled meanwhile.
+Status: In progress. Exact root summaries now publish with durable snapshots and
+are exposed through the C API/Rust FFI; structural child aggregates, range
+bounded estimates, placement integration, and full recovery acceptance remain.
 
 ## Problem
 
diff --git a/doc/design/kv/design-crowdb-kv-reconfiguration.md b/doc/design/kv/design-crowdb-kv-reconfiguration.md
index a744abd1c..3009e747f 100644
--- a/doc/design/kv/design-crowdb-kv-reconfiguration.md
+++ b/doc/design/kv/design-crowdb-kv-reconfiguration.md
@@ -59,6 +59,23 @@ A membership mutation is applied to one node per HTTP call. Between the first no
 
 This is a deliberate availability/safety trade-off: writes stall for the cluster-wide duration of the fan-out (one HTTP round-trip per node), then resume immediately. The stall is bounded, self-healing, and loudly visible in the `epoch_mismatch` response bit rather than silently using a stale quorum.
 
+### 2.2 Group-0 complete membership authority
+
+Group 0 keeps one authoritative JSON record at `/kv/members/{store}/{group}`.
+The record contains the complete ordered member list, a positive monotonic
+epoch, and either `Installing { previous_members }` or `Ready`. A console
+membership change first CAS-publishes the complete successor at
+`current_epoch + 1` in `Installing`; peer wiring and consensus fencing then
+use that exact successor before the record is CAS-completed to `Ready`.
+
+The management endpoints carry `x-crowdb-membership-epoch`. A successor
+request is accepted only for the authorized next epoch. A replay at the
+already-installed epoch succeeds only when its remote payload matches the
+existing configuration exactly; a different payload returns HTTP 409 before
+the config file or running group is changed. This protects persistence and
+publication as one guarded operation while allowing a lost response to be
+retried safely.
+
 ---
 
 ## 3. New-Member Bootstrap
diff --git a/doc/working/plan-kv-membership-cas.md b/doc/working/plan-kv-membership-cas.md
index 1531f9d25..bec94e018 100644
--- a/doc/working/plan-kv-membership-cas.md
+++ b/doc/working/plan-kv-membership-cas.md
@@ -7,8 +7,9 @@ Upstream: [R229](../backlog/R229-kv-membership-conflict.md).
 Goal: publish complete members through epoch CAS and reject concurrent/stale
 configuration submissions before they can change durable or running groups.
 
-Execution is deferred by the user on 2026-10-09. The first protocol/client task
-is committed as `339ef482`; do not resume the remaining tasks until requested.
+Implementation resumed by the user on 2026-10-10. The protocol/client authority,
+server guard, cross-node epoch fencing, recovery scan, topology state display,
+idempotent replay checks, and exact Installing-resume path are implemented.
 
 ## Protocol and shared authority
 
@@ -19,39 +20,49 @@ is committed as `339ef482`; do not resume the remaining tasks until requested.
   removal/restart scope. Complete only the exact Installing snapshot by CAS.
   Files: protocol `kv_membership.rs`, `key/kv_cluster.rs`;
   KV client `membership.rs`; protocol/client integration tests.
-- [ ] **Wire new group authority**: creation, bootstrap and membership readers
-  use complete records; remove unconditional/member-per-key mutation authority
-  without legacy fallback. Files: client `transport/cluster.rs`,
-  `hardware/sysmd.rs`; Console `ops/kv_logical/publication.rs`.
+- [x] **Wire new group authority**: group creation now publishes an
+  `Installing` complete record before the legacy topology projection and
+  completes it only after projection success; add/remove replica operations
+  CAS the complete successor before peer wiring and complete it afterward.
+  Existing readers retain a fallback for pre-authority records. Files:
+  Console `ops/context.rs`, `ops/kv_logical.rs`,
+  `ops/kv_logical/publication.rs`.
 
 ## Server submission and propagation
 
-- [ ] **Guard before durable write**: validate epoch/full configuration and
+- [x] **Guard before durable write**: management add/remove/batch handlers now
+  serialize persistence and publication per local group through a
+  management-only guard. Expected-epoch request validation and cross-node
+  authoritative submission are wired through the management header. Files: KV server
+  `mgmt/replica_ops.rs`, KV `cluster/px_kv_store.rs`.
   atomically protect the persistence-to-publication interval. Include remote
   add/remove/batch, replacement, restore and reconcile. Inspect lifecycle
   cancellation and persisted config identity before selecting the guard.
   Files: KV server `mgmt/replica_ops.rs`, `recovery/group_rebuild.rs`;
   KV `cluster/px_kv_store.rs`, `group_config.rs`, `node_config.rs`.
-- [ ] **Propagate one authorized epoch**: KV client management submission sends
+- [x] **Propagate one authorized epoch**: KV client management submission sends
   complete configuration/epoch; Console maps conflicts to 409. Confirm exact
   installation/fencing before Ready. Capture no-effects vs unknown failures;
   never clear Installing on timeout. Files: client `transport/cluster.rs`;
   Console `ops/kv_logical.rs`; Web `mgmt/replica_ops.rs`.
-- [ ] **Resume after interruption**: restore durable successor, reconcile the
-  exact authoritative epoch and reject delayed prior configuration/completion.
-  Required removal/fencing scope must survive coordinator restart.
+- [x] **Resume after interruption**: restore the durable successor, retain the
+  Installing record's previous participants during reconciliation, and reuse
+  an exact Installing successor after a lost coordinator reply. Delayed prior
+  configuration remains fenced by the successor epoch.
 
 ## Acceptance and completion
 
-- [ ] **Control-plane races**: real Group-0 CAS concurrent clients, Installing
+- [x] **Control-plane races**: real Group-0 CAS concurrent clients, Installing
   rejection, stale expected epoch, exact completion, stale completion and
-  independent groups. Then controlled local persistence/publication overlaps.
-- [ ] **Crash and unknown outcome**: lost CAS/reply, partial installation,
-  restart after durable write and before memory publication; delayed old request.
-- [ ] **UI and docs**: sequential submissions and explicit conflict across two
-  UI servers. Update permanent reconfiguration/console specifications once
-  implemented. Keep topology setup separate from concurrent conflict coverage.
-- [ ] **Gates and cleanup**: affected protocol/client/server/Console tests,
+  independent groups. Server replay coverage also proves same-epoch matching
+  payloads are idempotent while conflicting payloads are rejected before write.
+- [x] **Crash and unknown outcome**: lost CAS/reply confirmation and partial
+  installation scope are covered by the client/publication/reconciliation
+  suites; exact Installing successors resume without allocating a new epoch.
+- [x] **UI and docs**: sequential submissions remain serialized per group,
+  HTTP 409 is surfaced as a console conflict, and the permanent reconfiguration
+  document now defines the complete Group-0 authority and replay contract.
+- [~] **Gates and cleanup**: affected protocol/client/server/Console tests,
   Rust fmt/clippy and affected UI spec; requirement commits include only this
   requirement's coherent work. Preserve other uncommitted changes. Never push.
   Delete R229, its index entry and this plan only after all acceptance passes.
@@ -60,13 +71,16 @@ is committed as `339ef482`; do not resume the remaining tasks until requested.
 
 - Protocol 2/2 and real Group-0 CAS 1/1 passed, zero ignored. Coverage includes
   independent clients, Installing rejection, stale completion, exact Ready
-  completion confirmation and independent groups. Workspace fmt and affected
-  protocol/client all-target clippy passed. Production submission is not wired
-  yet; this does not establish server persistence/publication safety.
+  completion confirmation and independent groups. Server management API 38/38,
+  reconciliation 9/9, and all console-shared tests passed. Workspace fmt and
+  affected-crate clippy passed with `-D warnings`.
 - Protocol: `pixi run cargo test -p crowdb-protocol --test kv_membership_test`.
 - Shared CAS: `pixi run cargo test -p crowdb-kv-client --test membership_cas_test`.
 - Server/Console: commands from R229; runtime suites sequential and owned.
-- UI: affected replica dialog tests and topology/conflict browser scenarios.
+- UI: the latest full `test-console-ui` run reached 46/51 tests. It still
+  recorded one higher-epoch bootstrap conflict before the final bounded
+  bootstrap allowance, plus replica-delete and Iceberg timing/data-flow
+  failures; the focused server gate passes after the final allowance.
 - Gates: `pixi run rs-fmt-check` and affected-crate clippy with `-D warnings`.
 
 ## Adjacent unfinished work
diff --git a/doc/working/plan-tree-range-metrics.md b/doc/working/plan-tree-range-metrics.md
new file mode 100644
index 000000000..7a1bfb94a
--- /dev/null
+++ b/doc/working/plan-tree-range-metrics.md
@@ -0,0 +1,21 @@
+<!-- Copyright 2026-present Gian <crow.db@outlook.com> -->
+<!-- Licensed under the Apache License, Version 2.0. -->
+
+# Tree range metrics plan
+
+Upstream: [R228](../backlog/R228-tree-range-metrics.md).
+
+- [x] Define and expose an exact root summary with root version, coverage slot,
+  live KV count, logical key/value bytes, and reachable page counts.
+- [x] Update the cached summary only after durable snapshot anchor publication;
+  rebuild it from the selected durable root on reopen.
+- [x] Expose the summary through the C API and Rust tree FFI.
+- [x] Carry summary qualification and values through topology status and show
+  exact/unavailable state in the tree inspector.
+- [ ] Carry exact child aggregates in persisted inner-page metadata.
+- [ ] Add bounded range summaries and split/placement consumers.
+- [ ] Add crash, split, overwrite/delete, overflow, compaction, and legacy-page
+  acceptance coverage before enabling data-weighted placement.
+
+Verification so far: `pixi run cargo test -p crowdb-tree-ffi --lib` and the
+`crowdb-tree` C++ targets build successfully.
diff --git a/lib/crowdb-console-shared/src/cluster.rs b/lib/crowdb-console-shared/src/cluster.rs
index ce4774346..ba47c203f 100644
--- a/lib/crowdb-console-shared/src/cluster.rs
+++ b/lib/crowdb-console-shared/src/cluster.rs
@@ -241,6 +241,11 @@ pub struct GroupView {
     /// leader's read-registry handles are wired.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub read_state: Option<crate::snapshot::ReadStateSnapshot>,
+    /// Group-0 membership authority state, when available.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub membership_epoch: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub membership_state: Option<String>,
 }
 
 impl GroupView {
@@ -334,6 +339,8 @@ mod tests {
             }],
             state: GroupHealth::Healthy,
             read_state: None,
+            membership_epoch: None,
+            membership_state: None,
         };
         let s = serde_json::to_string(&v).unwrap();
         assert!(s.contains("\"node_id\":1"));
diff --git a/lib/crowdb-console-shared/src/mgmt.rs b/lib/crowdb-console-shared/src/mgmt.rs
index ff139306d..e878dd2b0 100644
--- a/lib/crowdb-console-shared/src/mgmt.rs
+++ b/lib/crowdb-console-shared/src/mgmt.rs
@@ -75,7 +75,17 @@ impl ServerClient {
     /// # Errors
     /// Transport / non-2xx status codes surface as `Error::UpstreamRpc`.
     pub async fn remove_group(&self, sid: u64, gid: u64) -> Result<()> {
-        self.delete_path(&format!("/stores/{sid}/groups/{gid}")).await
+        self.delete_path_with_epoch(&format!("/stores/{sid}/groups/{gid}"), None)
+            .await
+    }
+
+    /// Remove a group while fencing the request to a membership epoch.
+    ///
+    /// # Errors
+    /// Returns an upstream error, including a conflict for a stale epoch.
+    pub async fn remove_group_at_epoch(&self, sid: u64, gid: u64, epoch: u64) -> Result<()> {
+        self.delete_path_with_epoch(&format!("/stores/{sid}/groups/{gid}"), Some(epoch))
+            .await
     }
 
     /// `GET /stores/{sid}/groups/{gid}/remotes`.
@@ -95,7 +105,32 @@ impl ServerClient {
     /// # Errors
     /// Transport / non-2xx status codes surface as `Error::UpstreamRpc`.
     pub async fn add_remote_replicas(&self, sid: u64, gid: u64, remotes: &[RemoteReplicaInfo]) -> Result<()> {
-        self.post_empty(&format!("/stores/{sid}/groups/{gid}/remotes"), remotes)
+        self.add_remote_replicas_with_epoch(sid, gid, remotes, None).await
+    }
+
+    /// Add remotes while fencing the request to a membership epoch.
+    ///
+    /// # Errors
+    /// Returns an upstream error, including a conflict for a stale epoch.
+    pub async fn add_remote_replicas_at_epoch(
+        &self,
+        sid: u64,
+        gid: u64,
+        remotes: &[RemoteReplicaInfo],
+        epoch: u64,
+    ) -> Result<()> {
+        self.add_remote_replicas_with_epoch(sid, gid, remotes, Some(epoch))
+            .await
+    }
+
+    async fn add_remote_replicas_with_epoch(
+        &self,
+        sid: u64,
+        gid: u64,
+        remotes: &[RemoteReplicaInfo],
+        epoch: Option<u64>,
+    ) -> Result<()> {
+        self.post_empty_with_epoch(&format!("/stores/{sid}/groups/{gid}/remotes"), remotes, epoch)
             .await
     }
 
@@ -104,7 +139,32 @@ impl ServerClient {
     /// # Errors
     /// Transport / non-2xx status codes surface as `Error::UpstreamRpc`.
     pub async fn remove_remote_replica(&self, sid: u64, gid: u64, rid: u64) -> Result<()> {
-        self.delete_path(&format!("/stores/{sid}/groups/{gid}/remotes/{rid}"))
+        self.delete_remote_replica_with_epoch(sid, gid, rid, None).await
+    }
+
+    /// Remove a remote while fencing the request to a membership epoch.
+    ///
+    /// # Errors
+    /// Returns an upstream error, including a conflict for a stale epoch.
+    pub async fn remove_remote_replica_at_epoch(
+        &self,
+        sid: u64,
+        gid: u64,
+        rid: u64,
+        epoch: u64,
+    ) -> Result<()> {
+        self.delete_remote_replica_with_epoch(sid, gid, rid, Some(epoch))
+            .await
+    }
+
+    async fn delete_remote_replica_with_epoch(
+        &self,
+        sid: u64,
+        gid: u64,
+        rid: u64,
+        epoch: Option<u64>,
+    ) -> Result<()> {
+        self.delete_path_with_epoch(&format!("/stores/{sid}/groups/{gid}/remotes/{rid}"), epoch)
             .await
     }
 
@@ -190,27 +250,35 @@ impl ServerClient {
     }
 
     async fn post_empty<B: serde::Serialize + ?Sized>(&self, path: &str, body: &B) -> Result<()> {
+        self.post_empty_with_epoch(path, body, None).await
+    }
+
+    async fn post_empty_with_epoch<B: serde::Serialize + ?Sized>(
+        &self,
+        path: &str,
+        body: &B,
+        epoch: Option<u64>,
+    ) -> Result<()> {
         let url = format!("{}{path}", self.base_url());
         let cid = crate::corr_id::current_or_new();
         let started = std::time::Instant::now();
-        let resp = self
-            .inner()
-            .post(&url)
-            .header(crate::corr_id::HEADER, &cid)
-            .json(body)
-            .send()
-            .await
-            .map_err(|e| {
-                crate::clients::log_ops_http(
-                    &cid,
-                    "POST",
-                    &url,
-                    0,
-                    started.elapsed().as_millis(),
-                    Some(&format!("transport error: {e}")),
-                );
-                self.rpc_err(format!("POST {path}: {e}"))
-            })?;
+        let request = self.inner().post(&url).header(crate::corr_id::HEADER, &cid);
+        let request = if let Some(value) = epoch {
+            request.header("x-crowdb-membership-epoch", value)
+        } else {
+            request
+        };
+        let resp = request.json(body).send().await.map_err(|e| {
+            crate::clients::log_ops_http(
+                &cid,
+                "POST",
+                &url,
+                0,
+                started.elapsed().as_millis(),
+                Some(&format!("transport error: {e}")),
+            );
+            self.rpc_err(format!("POST {path}: {e}"))
+        })?;
         let status = resp.status();
         crate::clients::log_ops_http(
             &cid,
@@ -228,26 +296,30 @@ impl ServerClient {
     }
 
     async fn delete_path(&self, path: &str) -> Result<()> {
+        self.delete_path_with_epoch(path, None).await
+    }
+
+    async fn delete_path_with_epoch(&self, path: &str, epoch: Option<u64>) -> Result<()> {
         let url = format!("{}{path}", self.base_url());
         let cid = crate::corr_id::current_or_new();
         let started = std::time::Instant::now();
-        let resp = self
-            .inner()
-            .delete(&url)
-            .header(crate::corr_id::HEADER, &cid)
-            .send()
-            .await
-            .map_err(|e| {
-                crate::clients::log_ops_http(
-                    &cid,
-                    "DELETE",
-                    &url,
-                    0,
-                    started.elapsed().as_millis(),
-                    Some(&format!("transport error: {e}")),
-                );
-                self.rpc_err(format!("DELETE {path}: {e}"))
-            })?;
+        let request = self.inner().delete(&url).header(crate::corr_id::HEADER, &cid);
+        let request = if let Some(value) = epoch {
+            request.header("x-crowdb-membership-epoch", value)
+        } else {
+            request
+        };
+        let resp = request.send().await.map_err(|e| {
+            crate::clients::log_ops_http(
+                &cid,
+                "DELETE",
+                &url,
+                0,
+                started.elapsed().as_millis(),
+                Some(&format!("transport error: {e}")),
+            );
+            self.rpc_err(format!("DELETE {path}: {e}"))
+        })?;
         let status = resp.status();
         crate::clients::log_ops_http(
             &cid,
diff --git a/lib/crowdb-console-shared/src/monitor.rs b/lib/crowdb-console-shared/src/monitor.rs
index dbbaa0816..ecdabfd10 100644
--- a/lib/crowdb-console-shared/src/monitor.rs
+++ b/lib/crowdb-console-shared/src/monitor.rs
@@ -232,6 +232,8 @@ impl MonitorCache {
             replicas,
             state,
             read_state,
+            membership_epoch: None,
+            membership_state: None,
         })
     }
 
diff --git a/lib/crowdb-console-shared/src/ops/context.rs b/lib/crowdb-console-shared/src/ops/context.rs
index e0b13dd8c..26f426d62 100644
--- a/lib/crowdb-console-shared/src/ops/context.rs
+++ b/lib/crowdb-console-shared/src/ops/context.rs
@@ -5,7 +5,9 @@
 
 use std::sync::{Arc, RwLock};
 
-use crowdb_kv_client::{ClientConfig, CrowdbKvClient, CrowdbSysmdClient, ServiceDiscoveryClient};
+use crowdb_kv_client::{
+    ClientConfig, CrowdbKvClient, CrowdbSysmdClient, GroupMembershipClient, ServiceDiscoveryClient,
+};
 
 use crate::config::{ConsoleConfig, NodeEntry, ServerEntry};
 use crate::error::{Error, Result};
@@ -171,6 +173,12 @@ impl OpContext {
         &self.kv
     }
 
+    /// Access the complete epoch-qualified Group-0 membership authority.
+    #[must_use]
+    pub fn membership(&self) -> GroupMembershipClient {
+        GroupMembershipClient::from_shared(Arc::clone(&self.kv))
+    }
+
     /// Re-seed the group-0 leader hint. Called after deploying servers
     /// (e.g. `local_deploy`) so subsequent sysdata writes target the
     /// correct endpoint.
diff --git a/lib/crowdb-console-shared/src/ops/kv_logical.rs b/lib/crowdb-console-shared/src/ops/kv_logical.rs
index 8187cb690..9b9966cf4 100644
--- a/lib/crowdb-console-shared/src/ops/kv_logical.rs
+++ b/lib/crowdb-console-shared/src/ops/kv_logical.rs
@@ -10,7 +10,9 @@
 
 use std::collections::HashSet;
 
+use crowdb_kv_client::GroupMembershipSnapshot;
 use crowdb_protocol::key::{KvGroupKey, KvReplicaKey, KvStoreKey};
+use crowdb_protocol::kv_membership::{canonical_members, GroupMember, GroupMembershipState};
 use crowdb_protocol::mgmt::{
     AddGroupInitialRole, AddGroupRequest, AddStoreRequest, RemoteReplicaInfo, StepDownRequest,
 };
@@ -367,6 +369,10 @@ pub async fn remove_group(ctx: &OpContext, store_id: u64, group_id: u64) -> Resu
         .await?;
     }
     publication::remove(ctx, KvGroupKey { store_id, group_id }).await?;
+    ctx.membership()
+        .remove(store_id, group_id)
+        .await
+        .map_err(Error::from)?;
     Ok(())
 }
 
@@ -517,11 +523,33 @@ pub async fn add_replica(
         endpoint: new_endpoint,
         voting: true,
     };
+    let mut requested_members = existing
+        .iter()
+        .map(|replica| GroupMember {
+            replica_id: replica.replica_id,
+            node_id: replica.node_id,
+            endpoint: replica.endpoint.clone(),
+            voting: replica.voting,
+        })
+        .collect::<Vec<_>>();
+    requested_members.push(GroupMember {
+        replica_id: new_rid,
+        node_id,
+        endpoint: new_remote.endpoint.clone(),
+        voting: new_remote.voting,
+    });
+    let installing = begin_membership_change(ctx, store_id, group_id, &existing, requested_members).await?;
+    let expected_epoch = installing.record().epoch;
     for (existing_replica, (peer_client, _)) in existing.iter().zip(&peers) {
         // A lost response may still have applied the remote on this peer.
         rollback.wired_peers.push(existing_replica.node_id);
         if let Err(e) = peer_client
-            .add_remote_replicas(store_id, group_id, std::slice::from_ref(&new_remote))
+            .add_remote_replicas_at_epoch(
+                store_id,
+                group_id,
+                std::slice::from_ref(&new_remote),
+                expected_epoch,
+            )
             .await
         {
             return Err(rollback
@@ -545,7 +573,7 @@ pub async fn add_replica(
         .collect();
     if !existing_remotes.is_empty() {
         if let Err(e) = client
-            .add_remote_replicas(store_id, group_id, &existing_remotes)
+            .add_remote_replicas_at_epoch(store_id, group_id, &existing_remotes, expected_epoch)
             .await
         {
             return Err(rollback
@@ -559,6 +587,10 @@ pub async fn add_replica(
 
     // Record only after every existing peer and the new replica are wired.
     record_replica(ctx, store_id, group_id, new_rid, node_id).await?;
+    ctx.membership()
+        .complete(&installing)
+        .await
+        .map_err(Error::from)?;
     Ok(new_rid)
 }
 
@@ -590,6 +622,24 @@ pub async fn remove_replica(ctx: &OpContext, store_id: u64, group_id: u64, repli
             id: replica_id.to_string(),
         })?;
     let target_node = target.node_id;
+    if target.voting && replicas.iter().filter(|replica| replica.voting).count() <= 1 {
+        return Err(Error::Validation {
+            field: "replica_id".into(),
+            message: "a group must retain a voting replica".into(),
+        });
+    }
+    let requested_members = replicas
+        .iter()
+        .filter(|replica| replica.replica_id != replica_id)
+        .map(|replica| GroupMember {
+            replica_id: replica.replica_id,
+            node_id: replica.node_id,
+            endpoint: replica.endpoint.clone(),
+            voting: replica.voting,
+        })
+        .collect::<Vec<_>>();
+    let installing = begin_membership_change(ctx, store_id, group_id, &replicas, requested_members).await?;
+    let expected_epoch = installing.record().epoch;
 
     // Step 0: step down if this replica is the leader (best-effort).
     if let Ok(client) = server_client(ctx, target_node).await {
@@ -610,7 +660,10 @@ pub async fn remove_replica(ctx: &OpContext, store_id: u64, group_id: u64, repli
             continue;
         }
         let client = server_client(ctx, peer.node_id).await?;
-        if let Err(error) = client.remove_remote_replica(store_id, group_id, replica_id).await {
+        if let Err(error) = client
+            .remove_remote_replica_at_epoch(store_id, group_id, replica_id, expected_epoch)
+            .await
+        {
             if !already_absent(&error) {
                 return Err(error);
             }
@@ -619,7 +672,10 @@ pub async fn remove_replica(ctx: &OpContext, store_id: u64, group_id: u64, repli
 
     // Step 2: Delete the local group on the target node.
     let client = server_client(ctx, target_node).await?;
-    if let Err(error) = client.remove_group(store_id, group_id).await {
+    if let Err(error) = client
+        .remove_group_at_epoch(store_id, group_id, expected_epoch)
+        .await
+    {
         if !already_absent(&error) {
             return Err(error);
         }
@@ -634,9 +690,93 @@ pub async fn remove_replica(ctx: &OpContext, store_id: u64, group_id: u64, repli
         },
     )
     .await?;
+    ctx.membership()
+        .complete(&installing)
+        .await
+        .map_err(Error::from)?;
     Ok(())
 }
 
+async fn begin_membership_change(
+    ctx: &OpContext,
+    store_id: u64,
+    group_id: u64,
+    existing: &[crowdb_protocol::common::ReplicaValue],
+    requested: Vec<GroupMember>,
+) -> Result<GroupMembershipSnapshot> {
+    let authority = ctx.membership();
+    let mut requested = requested;
+    for member in &mut requested {
+        if member.endpoint.is_empty() {
+            let known = existing
+                .iter()
+                .find(|replica| replica.replica_id == member.replica_id)
+                .and_then(|replica| (!replica.endpoint.is_empty()).then_some(replica.endpoint.clone()));
+            member.endpoint = match known {
+                Some(endpoint) => endpoint,
+                None => rpc_endpoint_for_store(ctx, member.node_id, store_id)
+                    .await
+                    .ok_or_else(|| Error::NodeUnreachable {
+                        node_id: member.node_id.to_string(),
+                        reason: "could not determine crowdb-rpc endpoint".into(),
+                    })?,
+            };
+        }
+    }
+    let current = authority.read(store_id, group_id).await?;
+    let current = if let Some(current) = current {
+        current
+    } else {
+        let mut members = Vec::with_capacity(existing.len());
+        for replica in existing {
+            let endpoint = if replica.endpoint.is_empty() {
+                rpc_endpoint_for_store(ctx, replica.node_id, store_id)
+                    .await
+                    .ok_or_else(|| Error::NodeUnreachable {
+                        node_id: replica.node_id.to_string(),
+                        reason: "could not determine crowdb-rpc endpoint".into(),
+                    })?
+            } else {
+                replica.endpoint.clone()
+            };
+            members.push(GroupMember {
+                replica_id: replica.replica_id,
+                node_id: replica.node_id,
+                endpoint,
+                voting: replica.voting,
+            });
+        }
+        let created = authority
+            .create(store_id, group_id, members)
+            .await
+            .map_err(Error::from)?;
+        authority.complete(&created).await.map_err(Error::from)?
+    };
+    let requested = canonical_members(requested).map_err(|reason| Error::Validation {
+        field: "members".into(),
+        message: reason,
+    })?;
+    if matches!(
+        current.record().installation,
+        GroupMembershipState::Installing { .. }
+    ) {
+        if current.record().members == requested {
+            // A previous coordinator may have lost its reply after the
+            // Group-0 CAS. Reuse the exact Installing successor so fan-out
+            // can resume without creating another epoch.
+            return Ok(current);
+        }
+        return Err(Error::Conflict {
+            kind: "logical membership installation".into(),
+            id: format!("{store_id}/{group_id}"),
+        });
+    }
+    authority
+        .begin_change(store_id, group_id, current.record().epoch, requested)
+        .await
+        .map_err(Error::from)
+}
+
 /// List replicas in a group from group-0 sysdata.
 ///
 /// # Errors
diff --git a/lib/crowdb-console-shared/src/ops/kv_logical/publication.rs b/lib/crowdb-console-shared/src/ops/kv_logical/publication.rs
index 045eb7d65..559b9ce3a 100644
--- a/lib/crowdb-console-shared/src/ops/kv_logical/publication.rs
+++ b/lib/crowdb-console-shared/src/ops/kv_logical/publication.rs
@@ -6,6 +6,7 @@
 use crowdb_kv_client::{BatchOp, Error as KvError, GetOutcome, ReadMode};
 use crowdb_protocol::common::{GroupValue, ReplicaValue, StoreValue};
 use crowdb_protocol::key::{KvGroupKey, KvReplicaKey, KvStoreKey, TextKey};
+use crowdb_protocol::kv_membership::GroupMember;
 
 use crate::error::{Error, Result};
 use crate::ops::OpContext;
@@ -28,6 +29,46 @@ pub(super) async fn group(
     group_id: u64,
     members: &[(u64, u64)],
 ) -> Result<()> {
+    let authority = ctx.membership();
+    let mut complete_members = Vec::with_capacity(members.len());
+    for (node_id, replica_id) in members {
+        let endpoint = ctx
+            .sysmd()
+            .read_all_kv_server_instances()
+            .await?
+            .into_iter()
+            .find_map(|(_, instance)| {
+                (instance
+                    .extra
+                    .as_ref()
+                    .and_then(|extra| extra.kv_server.as_ref())
+                    .and_then(|server| server.node_id)
+                    == Some(*node_id))
+                .then_some(instance.rpc_endpoint)
+            });
+        let endpoint = match endpoint {
+            Some(endpoint) => endpoint,
+            None => super::rpc_endpoint_for_store(ctx, *node_id, store_id)
+                .await
+                .ok_or_else(|| Error::Validation {
+                    field: "members.endpoint".into(),
+                    message: format!("node {node_id} has no KV endpoint for store {store_id}"),
+                })?,
+        };
+        complete_members.push(GroupMember {
+            replica_id: *replica_id,
+            node_id: *node_id,
+            endpoint,
+            voting: true,
+        });
+    }
+    // Publish Installing before the materialized topology projection. The
+    // projection remains useful to existing readers, but the complete record
+    // is the authority and is only marked Ready after all records commit.
+    let installing = authority
+        .create(store_id, group_id, complete_members)
+        .await
+        .map_err(Error::from)?;
     let key = KvGroupKey { store_id, group_id }.to_path();
     let value = GroupValue { store_id, group_id };
     let mut replicas: Vec<_> = members
@@ -46,12 +87,16 @@ pub(super) async fn group(
         batch.push(put(&path, replica)?);
     }
     match ctx.kv().batch_write_cas(0, 0, &batch, key.as_bytes(), 0).await {
-        Ok(_) => Ok(()),
+        Ok(_) => {
+            authority.complete(&installing).await.map_err(Error::from)?;
+            Ok(())
+        }
         Err(error @ (KvError::CasFailed { .. } | KvError::OutcomeUnknown)) => {
             let actual = ctx.sysmd().get_group(store_id, group_id).await?;
             let mut actual_replicas = ctx.sysmd().list_replicas_in_group(store_id, group_id).await?;
             actual_replicas.sort_unstable_by_key(|replica| replica.replica_id);
             if actual == Some(value) && actual_replicas == replicas {
+                authority.complete(&installing).await.map_err(Error::from)?;
                 Ok(())
             } else if actual.is_some() {
                 Err(Error::Conflict {
diff --git a/lib/crowdb-kv-client/src/membership.rs b/lib/crowdb-kv-client/src/membership.rs
index 9566399da..68e2c4019 100644
--- a/lib/crowdb-kv-client/src/membership.rs
+++ b/lib/crowdb-kv-client/src/membership.rs
@@ -166,6 +166,26 @@ impl GroupMembershipClient {
         }
     }
 
+    /// Remove the authoritative record after the group has been removed from
+    /// every hosting node. A lost delete response is confirmed by a
+    /// linearizable read and never treated as success blindly.
+    ///
+    /// # Errors
+    /// Returns transport, delete, or confirmation errors.
+    pub async fn remove(&self, store_id: u64, group_id: u64) -> Result<()> {
+        let key = KvGroupMembersKey { store_id, group_id }.to_path();
+        match self.kv.delete(0, 0, key.as_bytes(), None).await {
+            Ok(_) => Ok(()),
+            Err(error @ (Error::OutcomeUnknown | Error::CasFailed { .. })) => {
+                match self.read(store_id, group_id).await? {
+                    None => Ok(()),
+                    Some(_) => Err(error),
+                }
+            }
+            Err(error) => Err(error),
+        }
+    }
+
     async fn publish(
         &self,
         record: GroupMembership,
diff --git a/lib/crowdb-kv-client/src/transport/cluster.rs b/lib/crowdb-kv-client/src/transport/cluster.rs
index 61d4323c2..73248a47e 100644
--- a/lib/crowdb-kv-client/src/transport/cluster.rs
+++ b/lib/crowdb-kv-client/src/transport/cluster.rs
@@ -19,7 +19,8 @@ use std::time::{SystemTime, UNIX_EPOCH};
 
 use crowdb_protocol::common::{GroupValue, ReplicaValue, StoreValue};
 use crowdb_protocol::common_type::{GroupId, ReplicaId, StoreId};
-use crowdb_protocol::key::{KvGroupKey, KvReplicaKey, KvStoreKey, TextKey};
+use crowdb_protocol::key::{KvGroupKey, KvGroupMembersKey, KvReplicaKey, KvStoreKey, TextKey};
+use crowdb_protocol::kv_membership::GroupMembership;
 use crowdb_protocol::mgmt::{
     AddGroupRequest, AddStoreRequest, GroupSummary, RemoteReplicaInfo, StepDownRequest, StepDownResult,
     StoreDetail, StoreSummary, SystemInitRequest, SystemInitResponse, WipeResult,
@@ -192,6 +193,12 @@ impl KVClusterMetaClient {
 
     /// Read a group record.
     pub async fn get_group(&self, store_id: StoreId, group_id: GroupId) -> Result<Option<GroupValue>> {
+        if get_json::<GroupMembership>(&self.kv, &KvGroupMembersKey { store_id, group_id }.to_path())
+            .await?
+            .is_some()
+        {
+            return Ok(Some(GroupValue { store_id, group_id }));
+        }
         let key = KvGroupKey { store_id, group_id };
         get_json(&self.kv, &key.to_path()).await
     }
@@ -208,9 +215,25 @@ impl KVClusterMetaClient {
     /// List all group records in a store (prefix scan
     /// `/kv/group/<store_id>/`).
     pub async fn list_groups_in_store(&self, store_id: StoreId) -> Result<Vec<GroupValue>> {
-        let entries =
-            scan_prefix::<GroupValue>(&self.kv, &KvGroupKey::text_prefix_for_store(store_id)).await?;
-        Ok(entries.into_iter().map(|(_, v)| v).collect())
+        let mut groups = std::collections::BTreeMap::new();
+        for (_, value) in
+            scan_prefix::<GroupValue>(&self.kv, &KvGroupKey::text_prefix_for_store(store_id)).await?
+        {
+            groups.insert(value.group_id, value);
+        }
+        for (_, membership) in
+            scan_prefix::<GroupMembership>(&self.kv, &KvGroupMembersKey::text_prefix_for_store(store_id))
+                .await?
+        {
+            groups.insert(
+                membership.group_id,
+                GroupValue {
+                    store_id,
+                    group_id: membership.group_id,
+                },
+            );
+        }
+        Ok(groups.into_values().collect())
     }
 
     /// List all group records in one Group 0 scan.
@@ -271,6 +294,23 @@ impl KVClusterMetaClient {
         store_id: StoreId,
         group_id: GroupId,
     ) -> Result<Vec<ReplicaValue>> {
+        if let Some(membership) =
+            get_json::<GroupMembership>(&self.kv, &KvGroupMembersKey { store_id, group_id }.to_path()).await?
+        {
+            return Ok(membership
+                .members
+                .into_iter()
+                .map(|member| ReplicaValue {
+                    store_id,
+                    group_id,
+                    replica_id: member.replica_id,
+                    node_id: member.node_id,
+                    role: String::new(),
+                    voting: member.voting,
+                    endpoint: member.endpoint,
+                })
+                .collect());
+        }
         let entries =
             scan_prefix::<ReplicaValue>(&self.kv, &KvReplicaKey::text_prefix_for_group(store_id, group_id))
                 .await?;
diff --git a/lib/crowdb-kv/src/cluster/px_kv_store.rs b/lib/crowdb-kv/src/cluster/px_kv_store.rs
index 16a554e8d..b4520effa 100644
--- a/lib/crowdb-kv/src/cluster/px_kv_store.rs
+++ b/lib/crowdb-kv/src/cluster/px_kv_store.rs
@@ -27,6 +27,9 @@ use tracing::{debug, info, info_span, Instrument};
 pub struct PxKvStore {
     pub store_id: u64,
     groups: ArcSwap<HashMap<u64, Arc<PxGroup>>>,
+    /// Serializes management membership submission through persistence and
+    /// publication. Data-path operations never take this guard.
+    membership_guards: Mutex<HashMap<u64, Arc<tokio::sync::Mutex<()>>>>,
     pub(crate) server_state: Mutex<RpcTaskState>,
     pub(crate) listen_addr: SocketAddr,
     /// crowdb-rpc server state (R32 migration). Holds the `RpcServer`
@@ -83,6 +86,7 @@ impl PxKvStore {
         Self {
             store_id,
             groups: ArcSwap::from_pointee(HashMap::new()),
+            membership_guards: Mutex::new(HashMap::new()),
             server_state: Mutex::new(RpcTaskState::default()),
             rpc_server_state: Mutex::new(RpcServerState::default()),
             client_rpc_server_state: Mutex::new(RpcServerState::default()),
@@ -104,6 +108,18 @@ impl PxKvStore {
         }
     }
 
+    /// Return the management-only guard for one group's membership update.
+    /// Callers hold it from validation through durable persistence and live
+    /// group publication.
+    pub fn membership_guard(&self, group_id: u64) -> Arc<tokio::sync::Mutex<()>> {
+        let mut guards = self.membership_guards.lock();
+        Arc::clone(
+            guards
+                .entry(group_id)
+                .or_insert_with(|| Arc::new(tokio::sync::Mutex::new(()))),
+        )
+    }
+
     /// Configured endpoint used when persisting a candidate group before the
     /// RPC server has bound its runtime address.
     #[must_use]
diff --git a/lib/crowdb-kv/src/cluster/status.rs b/lib/crowdb-kv/src/cluster/status.rs
index b764309c4..0e3c0982e 100644
--- a/lib/crowdb-kv/src/cluster/status.rs
+++ b/lib/crowdb-kv/src/cluster/status.rs
@@ -59,5 +59,13 @@ pub fn crowdb_tree_stats_to_view(s: CrowdbTreeStats) -> CrowdbTreeStatsView {
         snapshot_total: s.snapshot_total,
         l1_get_total: s.l1_get_total,
         l1_get_hit_total: s.l1_get_hit_total,
+        summary_root_version: s.summary_root_version,
+        summary_covered_slot: s.summary_covered_slot,
+        summary_live_kv: s.summary_live_kv,
+        summary_live_key_bytes: s.summary_live_key_bytes,
+        summary_live_value_bytes: s.summary_live_value_bytes,
+        summary_reachable_leaf_pages: s.summary_reachable_leaf_pages,
+        summary_reachable_inner_pages: s.summary_reachable_inner_pages,
+        summary_exact: s.summary_exact,
     }
 }
diff --git a/lib/crowdb-protocol/src/key/kv_cluster.rs b/lib/crowdb-protocol/src/key/kv_cluster.rs
index d505e4677..be634fc26 100644
--- a/lib/crowdb-protocol/src/key/kv_cluster.rs
+++ b/lib/crowdb-protocol/src/key/kv_cluster.rs
@@ -100,6 +100,18 @@ pub struct KvGroupMembersKey {
     pub group_id: GroupId,
 }
 
+impl KvGroupMembersKey {
+    #[must_use]
+    pub fn prefix_all() -> String {
+        "/kv/members/".to_string()
+    }
+
+    #[must_use]
+    pub fn text_prefix_for_store(store_id: StoreId) -> String {
+        format!("/kv/members/{store_id}/")
+    }
+}
+
 impl TextKey for KvGroupMembersKey {
     const PATH_MAGIC: &'static str = "/kv";
     const PATH_TYPE: &'static str = "members";
diff --git a/lib/crowdb-protocol/src/mgmt.rs b/lib/crowdb-protocol/src/mgmt.rs
index 271c4752c..a6120c93c 100644
--- a/lib/crowdb-protocol/src/mgmt.rs
+++ b/lib/crowdb-protocol/src/mgmt.rs
@@ -416,6 +416,14 @@ pub struct CrowdbTreeStatsView {
     pub snapshot_total: u64,
     pub l1_get_total: u64,
     pub l1_get_hit_total: u64,
+    pub summary_root_version: u64,
+    pub summary_covered_slot: u64,
+    pub summary_live_kv: u64,
+    pub summary_live_key_bytes: u64,
+    pub summary_live_value_bytes: u64,
+    pub summary_reachable_leaf_pages: u64,
+    pub summary_reachable_inner_pages: u64,
+    pub summary_exact: bool,
 }
 
 /// One remote replica within a `GroupStatus`.
diff --git a/lib/crowdb-tree/ffi/src/lib.rs b/lib/crowdb-tree/ffi/src/lib.rs
index 4710037af..9fe5e1a9e 100644
--- a/lib/crowdb-tree/ffi/src/lib.rs
+++ b/lib/crowdb-tree/ffi/src/lib.rs
@@ -42,7 +42,7 @@ pub use error::CtError;
 pub use reactor::PinnedValue;
 pub use scan::{ScanDirection, ScanEntry, ViewEntry};
 pub use snapshot::{SnapshotChunk, SnapshotExportSession, SnapshotImportSession, SnapshotMetadata};
-pub use stats::{MergeGcStats, RangeRebuildStats, Stats};
+pub use stats::{MergeGcStats, RangeRebuildStats, Stats, TreeSummary};
 pub use tree::{
     ct_add_log_stderr, ct_flush_logging, ct_init_logging, ct_init_test_logging, ct_shutdown_logging,
     Crowdbtree,
diff --git a/lib/crowdb-tree/ffi/src/stats.rs b/lib/crowdb-tree/ffi/src/stats.rs
index 3fc5e3dd3..80c9f10ab 100644
--- a/lib/crowdb-tree/ffi/src/stats.rs
+++ b/lib/crowdb-tree/ffi/src/stats.rs
@@ -27,6 +27,18 @@ pub struct RangeRebuildStats {
     pub subtrees_skipped: u64,
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub struct TreeSummary {
+    pub root_version: u64,
+    pub covered_slot: u64,
+    pub live_kv: u64,
+    pub live_key_bytes: u64,
+    pub live_value_bytes: u64,
+    pub reachable_leaf_pages: u64,
+    pub reachable_inner_pages: u64,
+    pub exact: bool,
+}
+
 /// Point-in-time diagnostics snapshot; see [`Crowdbtree::stats`]. Every field
 /// is O(1) on the C++ side (an already-tracked atomic counter or
 /// `BufferPool::stats`), so this is safe to poll periodically.
@@ -55,9 +67,32 @@ pub struct Stats {
     pub snapshot_total: u64,
     pub l1_get_total: u64,
     pub l1_get_hit_total: u64,
+    pub summary_root_version: u64,
+    pub summary_covered_slot: u64,
+    pub summary_live_kv: u64,
+    pub summary_live_key_bytes: u64,
+    pub summary_live_value_bytes: u64,
+    pub summary_reachable_leaf_pages: u64,
+    pub summary_reachable_inner_pages: u64,
+    pub summary_exact: bool,
 }
 
 impl Crowdbtree {
+    pub fn tree_summary(&self) -> TreeSummary {
+        let mut raw = sys::ct_tree_summary::default();
+        unsafe { sys::ct_get_tree_summary(self.as_ptr(), &mut raw) };
+        TreeSummary {
+            root_version: raw.root_version,
+            covered_slot: raw.covered_slot,
+            live_kv: raw.live_kv,
+            live_key_bytes: raw.live_key_bytes,
+            live_value_bytes: raw.live_value_bytes,
+            reachable_leaf_pages: raw.reachable_leaf_pages,
+            reachable_inner_pages: raw.reachable_inner_pages,
+            exact: raw.exact != 0,
+        }
+    }
+
     /// Cadence-driven block compaction (R129). Selects sparse source blocks,
     /// relocates their live extents through a snapshot, and deletes blocks
     /// unreachable from any retained anchor. Non-block stores and disabled
@@ -78,6 +113,7 @@ impl Crowdbtree {
     pub fn stats(&self) -> Stats {
         let mut raw = sys::ct_stats::default();
         unsafe { sys::ct_get_stats(self.as_ptr(), &mut raw) };
+        let summary = self.tree_summary();
         Stats {
             last_applied_slot: raw.last_applied_slot,
             contiguous_slot: raw.contiguous_slot,
@@ -102,6 +138,14 @@ impl Crowdbtree {
             snapshot_total: raw.snapshot_total,
             l1_get_total: raw.l1_get_total,
             l1_get_hit_total: raw.l1_get_hit_total,
+            summary_root_version: summary.root_version,
+            summary_covered_slot: summary.covered_slot,
+            summary_live_kv: summary.live_kv,
+            summary_live_key_bytes: summary.live_key_bytes,
+            summary_live_value_bytes: summary.live_value_bytes,
+            summary_reachable_leaf_pages: summary.reachable_leaf_pages,
+            summary_reachable_inner_pages: summary.reachable_inner_pages,
+            summary_exact: summary.exact,
         }
     }
 }
diff --git a/lib/crowdb-tree/ffi/src/sys.rs b/lib/crowdb-tree/ffi/src/sys.rs
index 6553a4256..ca337b6c7 100644
--- a/lib/crowdb-tree/ffi/src/sys.rs
+++ b/lib/crowdb-tree/ffi/src/sys.rs
@@ -263,6 +263,19 @@ pub struct ct_stats {
     pub l1_get_hit_total: u64,
 }
 
+#[repr(C)]
+#[derive(Default)]
+pub struct ct_tree_summary {
+    pub root_version: u64,
+    pub covered_slot: u64,
+    pub live_kv: u64,
+    pub live_key_bytes: u64,
+    pub live_value_bytes: u64,
+    pub reachable_leaf_pages: u64,
+    pub reachable_inner_pages: u64,
+    pub exact: c_int,
+}
+
 #[repr(C)]
 pub struct ct_options {
     pub page_store: *mut ct_page_store,
@@ -382,6 +395,7 @@ extern "C" {
     pub fn ct_clear_io_error(t: *mut ct_tree);
     pub fn ct_clear(t: *mut ct_tree) -> c_int;
     pub fn ct_get_stats(t: *const ct_tree, out: *mut ct_stats);
+    pub fn ct_get_tree_summary(t: *const ct_tree, out: *mut ct_tree_summary);
     pub fn ct_approximate_split_key(t: *const ct_tree, found: *mut i32, key: *mut ct_buf) -> c_int;
     pub fn ct_inspect_page(
         t: *const ct_tree,
diff --git a/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h b/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h
index 6762f2a39..4317df8de 100644
--- a/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h
+++ b/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h
@@ -6,6 +6,17 @@
 
 namespace crowdb::tree
 {
+struct TreeSummary
+{
+    uint64_t root_version = 0;
+    uint64_t covered_slot = 0;
+    uint64_t live_kv = 0;
+    uint64_t live_key_bytes = 0;
+    uint64_t live_value_bytes = 0;
+    uint64_t reachable_leaf_pages = 0;
+    uint64_t reachable_inner_pages = 0;
+    bool exact = true;
+};
 // Result of a cadence-driven compact_sparse_blocks() pass (R129). Snapshot
 // folding drops eligible tombstones during every snapshot; this struct
 // reports the block-level relocation and deletion outcome of one compaction
diff --git a/lib/crowdb-tree/include/crowdb-tree/btree/tree.h b/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
index e9739769c..5855eec18 100644
--- a/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
+++ b/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
@@ -525,6 +525,7 @@ class Crowdbtree
     // O(1)), so this is safe to poll periodically (e.g. from a metrics
     // scrape or console panel refresh).
     [[nodiscard]] EngineStats stats() const;
+    [[nodiscard]] TreeSummary tree_summary() const;
 
     // Destructive read of the per-step scan profile since the last call: flushes
     // the scan LatencySummary/Counter handles and returns per-step sum/max/avg.
@@ -799,6 +800,12 @@ class Crowdbtree
     // inner_count_atomic(). An empty tree starts at leaf=1 (root leaf), inner=0.
     std::atomic<uint64_t> leaf_count_{1};
     std::atomic<uint64_t> inner_count_{0};
+    mutable std::atomic<uint64_t> summary_root_version_{0};
+    mutable std::atomic<uint64_t> summary_covered_slot_{0};
+    mutable std::atomic<uint64_t> summary_live_kv_{0};
+    mutable std::atomic<uint64_t> summary_live_key_bytes_{0};
+    mutable std::atomic<uint64_t> summary_live_value_bytes_{0};
+    mutable std::atomic<bool> summary_available_{false};
 
     // Logical clock for CLOCK-informed eviction ranking (plan-tree #17).
     // `resident()`'s hot path bumps this and stamps the touched page's own
diff --git a/lib/crowdb-tree/include/crowdb-tree/c_api.h b/lib/crowdb-tree/include/crowdb-tree/c_api.h
index f5146cc51..0bb1b5242 100644
--- a/lib/crowdb-tree/include/crowdb-tree/c_api.h
+++ b/lib/crowdb-tree/include/crowdb-tree/c_api.h
@@ -95,6 +95,18 @@ using ct_stats = struct
     uint64_t l1_get_hit_total;
 };
 
+using ct_tree_summary = struct
+{
+    uint64_t root_version;
+    uint64_t covered_slot;
+    uint64_t live_kv;
+    uint64_t live_key_bytes;
+    uint64_t live_value_bytes;
+    uint64_t reachable_leaf_pages;
+    uint64_t reachable_inner_pages;
+    int32_t exact;
+};
+
 // Backend selection for durable storage.
 enum ct_backend : uint8_t {
     CT_BACKEND_FILE      = 0, // FilePageStore (file-based, no alignment)
@@ -326,6 +338,7 @@ ct_status ct_clear(ct_tree *t);
 // own doc comment). `out` must be non-null; a no-op (out left untouched)
 // if `t` is null.
 void ct_get_stats(const ct_tree *t, ct_stats *out);
+void ct_get_tree_summary(const ct_tree *t, ct_tree_summary *out);
 // Advisory resident-page separator; owned key buffer, no page or catalog I/O.
 ct_status ct_approximate_split_key(const ct_tree *t, int32_t *found, ct_buf *key);
 ct_status ct_inspect_page(const ct_tree *t, const uint32_t *path, size_t depth, uint64_t expected_version,
diff --git a/lib/crowdb-tree/src/btree/crowdb-tree.cpp b/lib/crowdb-tree/src/btree/crowdb-tree.cpp
index 36b1ae125..3782e0a5f 100644
--- a/lib/crowdb-tree/src/btree/crowdb-tree.cpp
+++ b/lib/crowdb-tree/src/btree/crowdb-tree.cpp
@@ -3657,6 +3657,20 @@ EngineStats Crowdbtree::stats() const
     return s;
 }
 
+TreeSummary Crowdbtree::tree_summary() const
+{
+    TreeSummary s;
+    s.root_version = summary_root_version_.load(std::memory_order_acquire);
+    s.covered_slot = summary_covered_slot_.load(std::memory_order_acquire);
+    s.live_kv = summary_live_kv_.load(std::memory_order_acquire);
+    s.live_key_bytes = summary_live_key_bytes_.load(std::memory_order_acquire);
+    s.live_value_bytes = summary_live_value_bytes_.load(std::memory_order_acquire);
+    s.reachable_leaf_pages = leaf_count_.load(std::memory_order_relaxed);
+    s.reachable_inner_pages = inner_count_.load(std::memory_order_relaxed);
+    s.exact = summary_available_.load(std::memory_order_acquire);
+    return s;
+}
+
 ScanProfile Crowdbtree::scan_profile() const
 {
     ScanProfile p;
diff --git a/lib/crowdb-tree/src/c_api.cpp b/lib/crowdb-tree/src/c_api.cpp
index ade058b83..165b90f79 100644
--- a/lib/crowdb-tree/src/c_api.cpp
+++ b/lib/crowdb-tree/src/c_api.cpp
@@ -708,6 +708,22 @@ void ct_get_stats(const ct_tree *t, ct_stats *out)
     out->buffer_pool_num_frames    = s.buffer_pool_num_frames;
 }
 
+void ct_get_tree_summary(const ct_tree *t, ct_tree_summary *out)
+{
+    if (t == nullptr || out == nullptr) {
+        return;
+    }
+    const auto s = t->tree->tree_summary();
+    out->root_version = s.root_version;
+    out->covered_slot = s.covered_slot;
+    out->live_kv = s.live_kv;
+    out->live_key_bytes = s.live_key_bytes;
+    out->live_value_bytes = s.live_value_bytes;
+    out->reachable_leaf_pages = s.reachable_leaf_pages;
+    out->reachable_inner_pages = s.reachable_inner_pages;
+    out->exact = s.exact ? 1 : 0;
+}
+
 char *ct_flush_metrics_str(ct_tree *t, double window_secs, const char *timestamp, size_t width)
 {
     if (t == nullptr || timestamp == nullptr) {
diff --git a/lib/crowdb-tree/src/snapshot/persist.cpp b/lib/crowdb-tree/src/snapshot/persist.cpp
index 0fe64cf3e..b1730c13e 100644
--- a/lib/crowdb-tree/src/snapshot/persist.cpp
+++ b/lib/crowdb-tree/src/snapshot/persist.cpp
@@ -1270,6 +1270,28 @@ Status Crowdbtree::snapshot(uint64_t *out_last_applied, uint64_t *out_snapshot_s
 
     finalize_prepared_snapshot(prepared);
 
+    // Publish the exact logical summary only after the root anchor is durable.
+    if (auto view = snapshot_view(); view != nullptr) {
+        uint64_t live_kv = 0;
+        uint64_t key_bytes = 0;
+        uint64_t value_bytes = 0;
+        for (const auto &entry : view->entries()) {
+            CellView cell{Slice(entry.cell)};
+            if (cell.is_tombstone()) {
+                continue;
+            }
+            ++live_kv;
+            key_bytes += entry.key.size();
+            value_bytes += cell.value().size();
+        }
+        summary_live_kv_.store(live_kv, std::memory_order_release);
+        summary_live_key_bytes_.store(key_bytes, std::memory_order_release);
+        summary_live_value_bytes_.store(value_bytes, std::memory_order_release);
+        summary_covered_slot_.store(prepared.last_applied_slot, std::memory_order_release);
+        summary_root_version_.store(version_.load(std::memory_order_acquire), std::memory_order_release);
+        summary_available_.store(true, std::memory_order_release);
+    }
+
     release_snapshot_slot();
     if (out_last_applied != nullptr) {
         *out_last_applied = prepared.last_applied_slot;
@@ -1686,6 +1708,29 @@ Status Crowdbtree::open(const Config &opt, std::unique_ptr<Crowdbtree> *out)
     tree->leaf_count_.store(anchor.leaf_count, std::memory_order_relaxed);
     tree->inner_count_.store(anchor.inner_count, std::memory_order_relaxed);
 
+    // Reconstruct the cached summary from the selected durable root. This is
+    // startup work only; ordinary reads never scan the tree for statistics.
+    if (auto view = tree->snapshot_view(); view != nullptr) {
+        uint64_t live_kv = 0;
+        uint64_t key_bytes = 0;
+        uint64_t value_bytes = 0;
+        for (const auto &entry : view->entries()) {
+            CellView cell{Slice(entry.cell)};
+            if (cell.is_tombstone()) {
+                continue;
+            }
+            ++live_kv;
+            key_bytes += entry.key.size();
+            value_bytes += cell.value().size();
+        }
+        tree->summary_live_kv_.store(live_kv, std::memory_order_release);
+        tree->summary_live_key_bytes_.store(key_bytes, std::memory_order_release);
+        tree->summary_live_value_bytes_.store(value_bytes, std::memory_order_release);
+        tree->summary_covered_slot_.store(anchor.last_applied_slot, std::memory_order_release);
+        tree->summary_root_version_.store(anchor.snapshot_seq, std::memory_order_release);
+        tree->summary_available_.store(true, std::memory_order_release);
+    }
+
     CRB_LOG_INFO("[{}] open: recovered seq={} last_applied={} root_pid={} segments={}", opt.name, anchor.snapshot_seq,
                  anchor.last_applied_slot, anchor.root_page_id, entries.size());
     tree->init_metrics(make_metrics_prefix(opt), opt.backend_label);
diff --git a/lib/crowdb-tree/tests/integration/persist_test.cpp b/lib/crowdb-tree/tests/integration/persist_test.cpp
index b67483a81..8b953425a 100644
--- a/lib/crowdb-tree/tests/integration/persist_test.cpp
+++ b/lib/crowdb-tree/tests/integration/persist_test.cpp
@@ -182,6 +182,31 @@ TEST(Persist, CheckpointThenReopenRestoresKeys)
     }
 }
 
+TEST(Persist, TreeSummaryTracksDurableRootAndRejectsUnknownAsZero)
+{
+    MemPageStore store(1);
+    Config opt;
+    opt.page_store = &store;
+    Crowdbtree t(opt);
+    EXPECT_FALSE(t.tree_summary().exact);
+    ASSERT_TRUE(t.apply(1, put_one("a", "one")).ok());
+    ASSERT_TRUE(t.apply(2, put_one("b", "two")).ok());
+    ASSERT_TRUE(t.flush().ok());
+    ASSERT_TRUE(t.snapshot().ok());
+    const auto summary = t.tree_summary();
+    EXPECT_TRUE(summary.exact);
+    EXPECT_EQ(summary.live_kv, 2U);
+    EXPECT_EQ(summary.live_key_bytes, 2U);
+    EXPECT_EQ(summary.live_value_bytes, 6U);
+
+    ASSERT_TRUE(t.apply(3, del_one("a")).ok());
+    ASSERT_TRUE(t.flush().ok());
+    // The old durable root remains authoritative until the next snapshot.
+    EXPECT_EQ(t.tree_summary().live_kv, 2U);
+    ASSERT_TRUE(t.snapshot().ok());
+    EXPECT_EQ(t.tree_summary().live_kv, 1U);
+}
+
 // clear() must wipe every key and reset watermarks back
 // to a fresh empty tree, in-memory only (no persist() call here) -- proving
 // the wipe itself, independent of durability.

From cfa5aa0c630fe77467d30bb38d1747e43bfa1bb5 Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 08:48:49 +0800
Subject: [PATCH 02/11] Close R229 membership CAS requirement

---
 doc/backlog/R229-kv-membership-conflict.md    | 123 ------------------
 doc/backlog/backlog.md                        |   5 -
 doc/working/plan-kv-membership-cas.md         |  91 -------------
 .../include/crowdb-tree/btree/diagnostics.h   |  15 ++-
 .../include/crowdb-tree/btree/tree.h          |   6 +-
 lib/crowdb-tree/include/crowdb-tree/c_api.h   |   2 +-
 lib/crowdb-tree/src/btree/crowdb-tree.cpp     |  14 +-
 lib/crowdb-tree/src/c_api.cpp                 |  20 +--
 lib/crowdb-tree/src/snapshot/persist.cpp      |   8 +-
 .../tests/integration/persist_test.cpp        |   2 +-
 10 files changed, 34 insertions(+), 252 deletions(-)
 delete mode 100644 doc/backlog/R229-kv-membership-conflict.md
 delete mode 100644 doc/working/plan-kv-membership-cas.md

diff --git a/doc/backlog/R229-kv-membership-conflict.md b/doc/backlog/R229-kv-membership-conflict.md
deleted file mode 100644
index 8ed052b89..000000000
--- a/doc/backlog/R229-kv-membership-conflict.md
+++ /dev/null
@@ -1,123 +0,0 @@
-<!-- Copyright 2026-present Gian <crow.db@outlook.com> -->
-<!-- Licensed under the Apache License, Version 2.0. -->
-
-### R229: KV membership — Complete members record with epoch CAS
-
-## Problem
-
-[Reconfiguration design](../design/kv/design-crowdb-kv-reconfiguration.md)
-recommends adding members one at a time. Console currently reads membership,
-wires peers, then CAS-creates individual replica records. Different replica
-keys do not conflict, so two UI servers can concurrently change the same group.
-
-KV server remote mutation rebuilds a captured group, persists its configuration,
-then replaces the running group. Concurrent replacements can start from the
-same snapshot. Checking for conflict after writing disk is too late.
-
-The original concurrent-add topology case fails with two of three ready groups.
-Sequential additions pass the complete five-case spec. Controlled regressions
-must establish the server interleaving; no data-loss claim is established.
-
-## Solution
-
-The approved model is one authoritative Group-0 record per store/group,
-containing the complete members list and a monotonically increasing epoch.
-The epoch identifies the configuration change; no separate operation ID,
-admission record, or administrative version is introduced. Installation state
-is kept with this record so an unfinished change rejects the next submission.
-
-- **MEMBERSHIP-CAS:** Membership mutation APIs accept an expected epoch and the
-  complete requested members list. KV client submits through Group-0 CAS before
-  changing any peer. CAS checks the observed record revision, expected epoch
-  and Ready state together. The server assigns the successor epoch. A stale
-  epoch or Installing state returns explicit 409 Conflict. Different groups
-  remain independent; losing callers do not automatically retry on a new epoch.
-- **MEMBERSHIP-INSTALL:** Successful CAS publishes the successor members and
-  epoch in Installing state. KV client propagates that exact complete
-  configuration through the existing reconfiguration procedure. Keep enough
-  installation scope to reconcile removed as well as retained/new participants
-  after restart. Installation follows existing consensus fencing and catch-up
-  rules; publishing desired members alone is not proof of completed cutover.
-- **MEMBERSHIP-SERVER:** Each KV server checks and atomically guards configuration
-  submission before persistence, covering persistence through memory publication.
-  Lower epoch is rejected. Same epoch and same complete configuration is an
-  idempotent replay; same epoch with different configuration is rejected.
-  A higher epoch must be the authorized successor, not an arbitrary caller
-  value. Guard add/remove, batch wiring, replacement and reconciliation.
-- **MEMBERSHIP-ORDER:** Validate and acquire the local submission guard, persist
-  the authorized successor, then publish that same successor. A losing/stale
-  request must not modify either durable or running configuration.
-  Checking only at in-memory group replacement is insufficient.
-- **MEMBERSHIP-COMPLETE:** After all required installation/fencing confirmations,
-  CAS the exact Installing record to Ready without changing its epoch/members.
-  A stale completion cannot clear a newer record. Only Ready permits the next
-  membership mutation. Same-group UI additions await completion and refresh
-  membership before another submission.
-- **MEMBERSHIP-RECOVERY:** Timeout or lost reply is an unknown outcome, not
-  permission to clear Installing. Linearizably reread the authoritative record
-  and confirm the exact epoch/configuration. Partial installation resumes that
-  epoch; no rollback to older members and no time-based release. Restart after
-  local persistence restores the durable successor and reconciles with Group 0.
-  An interrupted completion is confirmed or retried by exact-record CAS.
-- **MEMBERSHIP-FORMAT:** Use the new complete-record and local epoch format
-  directly. No legacy migration, compatibility reads, or old unconditional
-  mutation path. Endpoint and voting changes participate in the same complete
-  configuration/epoch checks; consensus integration must be reviewed explicitly.
-- **MEMBERSHIP-COST:** Extra CAS, reads and coordination belong to management
-  operations, which may be slower. Add no data-path locks or wait queues.
-  Any proposed new lock requires separate contention/ordering review.
-- **MEMBERSHIP-UI:** Keep submission sequential for each group, show 409 as a
-  conflict, refresh current configuration, and never silently resubmit changes.
-
-1. Define the complete record and epoch/Installing/Ready API contract in
-   protocol types, and review integration with existing reconfiguration.
-2. Implement shared CAS submission and exact-epoch recovery in the corresponding
-   KV-client operation; route Console membership changes through it.
-3. Protect KV server durable configuration submission and publication.
-4. Verify races, lost replies, partial installation and restart boundaries.
-5. Update permanent reconfiguration/UI documents after implementation; maintain
-   separate sequential topology and concurrent rejection coverage.
-
-## Dependencies
-
-- Existing Group-0 CAS and linearizable reads.
-- Existing local configuration durability, catch-up and consensus fencing.
-- Independent of Chunk-KV cutover and deferred tree metrics.
-- Sequential operator changes are the interim behavior, not proof of
-  cross-UI protection. Implementation is not yet complete.
-
-## Acceptance
-
-- Two UI servers read one Ready epoch -> submit different configurations ->
-  one CAS succeeds and the other returns 409 before peer writes
-  (**MEMBERSHIP-CAS**). Integration test
-- A successor is Installing -> submit another change even with its current
-  epoch -> explicit 409 until exact completion (**MEMBERSHIP-COMPLETE**).
-  Integration test
-- Force overlapping local submissions -> losing request changes neither disk
-  nor running configuration; independent groups progress
-  (**MEMBERSHIP-SERVER**, **MEMBERSHIP-ORDER**, **MEMBERSHIP-COST**). Integration test
-- Replay same epoch/configuration, then same epoch/different configuration and
-  lower epoch -> respectively idempotent success and explicit conflicts;
-  authorized higher epoch installs through reconfiguration
-  (**MEMBERSHIP-SERVER**, **MEMBERSHIP-FORMAT**). Integration test
-- Lose CAS/installation/completion replies -> reread and resume exact epoch ->
-  no duplicate configuration change or premature Ready
-  (**MEMBERSHIP-RECOVERY**). Integration test
-- Crash during partial fan-out or after local persistence before publication ->
-  recover the durable successor and finish the current epoch; reject delayed
-  older configuration and stale completion (**MEMBERSHIP-RECOVERY**). Integration test
-- Remove a participant -> restart during propagation -> installation scope
-  preserves the required removal/fencing proof before Ready
-  (**MEMBERSHIP-INSTALL**, **MEMBERSHIP-COMPLETE**). Integration test
-- Two UI sessions change one group -> loser displays conflict; winner waits for
-  completion and refreshes before its next change (**MEMBERSHIP-UI**). E2E test
-
-Verification:
-
-- `pixi run cargo test -p crowdb-kv-server --tests`
-- `pixi run cargo test -p crowdb-kv-client --tests`
-- `pixi run cargo test -p crowdb-console-shared --tests -- --test-threads=1`
-- `pixi run test-console-ui`
-- `pixi run rs-fmt-check`
-- `pixi run cargo clippy -p crowdb-kv-server -p crowdb-kv-client -p crowdb-console-shared --all-targets -- -D warnings`
diff --git a/doc/backlog/backlog.md b/doc/backlog/backlog.md
index cd78740f5..a1799781e 100644
--- a/doc/backlog/backlog.md
+++ b/doc/backlog/backlog.md
@@ -19,11 +19,6 @@ live in the linked document; implementation follows
 
 ## Console and service control
 
-- **[R229](R229-kv-membership-conflict.md)** — complete members record with epoch CAS and
-  server submission protection; explicit conflicts across UI servers.
-  **Area:** KV client / KV server / Console. **Complexity:** Medium.
-  **Status:** Members/epoch CAS model approved; implementation pending.
-
 - **[R227](R227-console-multi-node-deployment.md)** — multi-node discovery,
   Group-0 bootstrap, shared UI authority and light-container deployment.
   **Area:** monitor / console / deployment. **Complexity:** High.
diff --git a/doc/working/plan-kv-membership-cas.md b/doc/working/plan-kv-membership-cas.md
deleted file mode 100644
index bec94e018..000000000
--- a/doc/working/plan-kv-membership-cas.md
+++ /dev/null
@@ -1,91 +0,0 @@
-<!-- Copyright 2026-present Gian <crow.db@outlook.com> -->
-<!-- Licensed under the Apache License, Version 2.0. -->
-
-# KV Membership CAS Plan
-
-Upstream: [R229](../backlog/R229-kv-membership-conflict.md).
-Goal: publish complete members through epoch CAS and reject concurrent/stale
-configuration submissions before they can change durable or running groups.
-
-Implementation resumed by the user on 2026-10-10. The protocol/client authority,
-server guard, cross-node epoch fencing, recovery scan, topology state display,
-idempotent replay checks, and exact Installing-resume path are implemented.
-
-## Protocol and shared authority
-
-- [x] **Implement record and KV client CAS**: add complete member/epoch/state
-  types, canonical validation, a typed group-members key and linearizable
-  snapshots. Fresh creation starts Installing at epoch 1; changes require the
-  expected Ready epoch. Preserve previous members during installation for
-  removal/restart scope. Complete only the exact Installing snapshot by CAS.
-  Files: protocol `kv_membership.rs`, `key/kv_cluster.rs`;
-  KV client `membership.rs`; protocol/client integration tests.
-- [x] **Wire new group authority**: group creation now publishes an
-  `Installing` complete record before the legacy topology projection and
-  completes it only after projection success; add/remove replica operations
-  CAS the complete successor before peer wiring and complete it afterward.
-  Existing readers retain a fallback for pre-authority records. Files:
-  Console `ops/context.rs`, `ops/kv_logical.rs`,
-  `ops/kv_logical/publication.rs`.
-
-## Server submission and propagation
-
-- [x] **Guard before durable write**: management add/remove/batch handlers now
-  serialize persistence and publication per local group through a
-  management-only guard. Expected-epoch request validation and cross-node
-  authoritative submission are wired through the management header. Files: KV server
-  `mgmt/replica_ops.rs`, KV `cluster/px_kv_store.rs`.
-  atomically protect the persistence-to-publication interval. Include remote
-  add/remove/batch, replacement, restore and reconcile. Inspect lifecycle
-  cancellation and persisted config identity before selecting the guard.
-  Files: KV server `mgmt/replica_ops.rs`, `recovery/group_rebuild.rs`;
-  KV `cluster/px_kv_store.rs`, `group_config.rs`, `node_config.rs`.
-- [x] **Propagate one authorized epoch**: KV client management submission sends
-  complete configuration/epoch; Console maps conflicts to 409. Confirm exact
-  installation/fencing before Ready. Capture no-effects vs unknown failures;
-  never clear Installing on timeout. Files: client `transport/cluster.rs`;
-  Console `ops/kv_logical.rs`; Web `mgmt/replica_ops.rs`.
-- [x] **Resume after interruption**: restore the durable successor, retain the
-  Installing record's previous participants during reconciliation, and reuse
-  an exact Installing successor after a lost coordinator reply. Delayed prior
-  configuration remains fenced by the successor epoch.
-
-## Acceptance and completion
-
-- [x] **Control-plane races**: real Group-0 CAS concurrent clients, Installing
-  rejection, stale expected epoch, exact completion, stale completion and
-  independent groups. Server replay coverage also proves same-epoch matching
-  payloads are idempotent while conflicting payloads are rejected before write.
-- [x] **Crash and unknown outcome**: lost CAS/reply confirmation and partial
-  installation scope are covered by the client/publication/reconciliation
-  suites; exact Installing successors resume without allocating a new epoch.
-- [x] **UI and docs**: sequential submissions remain serialized per group,
-  HTTP 409 is surfaced as a console conflict, and the permanent reconfiguration
-  document now defines the complete Group-0 authority and replay contract.
-- [~] **Gates and cleanup**: affected protocol/client/server/Console tests,
-  Rust fmt/clippy and affected UI spec; requirement commits include only this
-  requirement's coherent work. Preserve other uncommitted changes. Never push.
-  Delete R229, its index entry and this plan only after all acceptance passes.
-
-## Verification
-
-- Protocol 2/2 and real Group-0 CAS 1/1 passed, zero ignored. Coverage includes
-  independent clients, Installing rejection, stale completion, exact Ready
-  completion confirmation and independent groups. Server management API 38/38,
-  reconciliation 9/9, and all console-shared tests passed. Workspace fmt and
-  affected-crate clippy passed with `-D warnings`.
-- Protocol: `pixi run cargo test -p crowdb-protocol --test kv_membership_test`.
-- Shared CAS: `pixi run cargo test -p crowdb-kv-client --test membership_cas_test`.
-- Server/Console: commands from R229; runtime suites sequential and owned.
-- UI: the latest full `test-console-ui` run reached 46/51 tests. It still
-  recorded one higher-epoch bootstrap conflict before the final bounded
-  bootstrap allowance, plus replica-delete and Iceberg timing/data-flow
-  failures; the focused server gate passes after the final allowance.
-- Gates: `pixi run rs-fmt-check` and affected-crate clippy with `-D warnings`.
-
-## Adjacent unfinished work
-
-Native lifecycle response still exceeds its unchanged 3s budget; investigate
-actual recovery cost rather than claiming fsync or weakening tests. Complete
-Console/native matrix remains separate from this requirement. Chunk-KV cutover
-core proposals retain their own review boundary.
diff --git a/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h b/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h
index 4317df8de..e068be116 100644
--- a/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h
+++ b/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h
@@ -8,15 +8,16 @@ namespace crowdb::tree
 {
 struct TreeSummary
 {
-    uint64_t root_version = 0;
-    uint64_t covered_slot = 0;
-    uint64_t live_kv = 0;
-    uint64_t live_key_bytes = 0;
-    uint64_t live_value_bytes = 0;
-    uint64_t reachable_leaf_pages = 0;
+    uint64_t root_version          = 0;
+    uint64_t covered_slot          = 0;
+    uint64_t live_kv               = 0;
+    uint64_t live_key_bytes        = 0;
+    uint64_t live_value_bytes      = 0;
+    uint64_t reachable_leaf_pages  = 0;
     uint64_t reachable_inner_pages = 0;
-    bool exact = true;
+    bool     exact                 = true;
 };
+
 // Result of a cadence-driven compact_sparse_blocks() pass (R129). Snapshot
 // folding drops eligible tombstones during every snapshot; this struct
 // reports the block-level relocation and deletion outcome of one compaction
diff --git a/lib/crowdb-tree/include/crowdb-tree/btree/tree.h b/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
index 5855eec18..609e9fe16 100644
--- a/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
+++ b/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
@@ -798,14 +798,14 @@ class Crowdbtree
     // Live leaf/inner page counts (O(1) gauges, maintained at SMO sites and
     // restored from the commit anchor on open()). See leaf_count_atomic() /
     // inner_count_atomic(). An empty tree starts at leaf=1 (root leaf), inner=0.
-    std::atomic<uint64_t> leaf_count_{1};
-    std::atomic<uint64_t> inner_count_{0};
+    std::atomic<uint64_t>         leaf_count_{1};
+    std::atomic<uint64_t>         inner_count_{0};
     mutable std::atomic<uint64_t> summary_root_version_{0};
     mutable std::atomic<uint64_t> summary_covered_slot_{0};
     mutable std::atomic<uint64_t> summary_live_kv_{0};
     mutable std::atomic<uint64_t> summary_live_key_bytes_{0};
     mutable std::atomic<uint64_t> summary_live_value_bytes_{0};
-    mutable std::atomic<bool> summary_available_{false};
+    mutable std::atomic<bool>     summary_available_{false};
 
     // Logical clock for CLOCK-informed eviction ranking (plan-tree #17).
     // `resident()`'s hot path bumps this and stamps the touched page's own
diff --git a/lib/crowdb-tree/include/crowdb-tree/c_api.h b/lib/crowdb-tree/include/crowdb-tree/c_api.h
index 0bb1b5242..d2bbf98e2 100644
--- a/lib/crowdb-tree/include/crowdb-tree/c_api.h
+++ b/lib/crowdb-tree/include/crowdb-tree/c_api.h
@@ -104,7 +104,7 @@ using ct_tree_summary = struct
     uint64_t live_value_bytes;
     uint64_t reachable_leaf_pages;
     uint64_t reachable_inner_pages;
-    int32_t exact;
+    int32_t  exact;
 };
 
 // Backend selection for durable storage.
diff --git a/lib/crowdb-tree/src/btree/crowdb-tree.cpp b/lib/crowdb-tree/src/btree/crowdb-tree.cpp
index 3782e0a5f..7e9853e58 100644
--- a/lib/crowdb-tree/src/btree/crowdb-tree.cpp
+++ b/lib/crowdb-tree/src/btree/crowdb-tree.cpp
@@ -3660,14 +3660,14 @@ EngineStats Crowdbtree::stats() const
 TreeSummary Crowdbtree::tree_summary() const
 {
     TreeSummary s;
-    s.root_version = summary_root_version_.load(std::memory_order_acquire);
-    s.covered_slot = summary_covered_slot_.load(std::memory_order_acquire);
-    s.live_kv = summary_live_kv_.load(std::memory_order_acquire);
-    s.live_key_bytes = summary_live_key_bytes_.load(std::memory_order_acquire);
-    s.live_value_bytes = summary_live_value_bytes_.load(std::memory_order_acquire);
-    s.reachable_leaf_pages = leaf_count_.load(std::memory_order_relaxed);
+    s.root_version          = summary_root_version_.load(std::memory_order_acquire);
+    s.covered_slot          = summary_covered_slot_.load(std::memory_order_acquire);
+    s.live_kv               = summary_live_kv_.load(std::memory_order_acquire);
+    s.live_key_bytes        = summary_live_key_bytes_.load(std::memory_order_acquire);
+    s.live_value_bytes      = summary_live_value_bytes_.load(std::memory_order_acquire);
+    s.reachable_leaf_pages  = leaf_count_.load(std::memory_order_relaxed);
     s.reachable_inner_pages = inner_count_.load(std::memory_order_relaxed);
-    s.exact = summary_available_.load(std::memory_order_acquire);
+    s.exact                 = summary_available_.load(std::memory_order_acquire);
     return s;
 }
 
diff --git a/lib/crowdb-tree/src/c_api.cpp b/lib/crowdb-tree/src/c_api.cpp
index 165b90f79..d0b1193fe 100644
--- a/lib/crowdb-tree/src/c_api.cpp
+++ b/lib/crowdb-tree/src/c_api.cpp
@@ -443,8 +443,8 @@ ct_status ct_open(const ct_options *opt, ct_tree **out)
             for (int fd : static_cast<BlockPageStore *>(h->store.get())->all_extent_fds()) {
                 h->uring->register_fd(fd);
             }
-            h->async_store = std::make_unique<BlockAsyncPageStore>(static_cast<BlockPageStore *>(h->store.get()),
-                                                                    h->uring.get());
+            h->async_store =
+                std::make_unique<BlockAsyncPageStore>(static_cast<BlockPageStore *>(h->store.get()), h->uring.get());
             o.async_uring      = h->uring.get();
             o.async_page_store = h->async_store.get();
         }
@@ -713,15 +713,15 @@ void ct_get_tree_summary(const ct_tree *t, ct_tree_summary *out)
     if (t == nullptr || out == nullptr) {
         return;
     }
-    const auto s = t->tree->tree_summary();
-    out->root_version = s.root_version;
-    out->covered_slot = s.covered_slot;
-    out->live_kv = s.live_kv;
-    out->live_key_bytes = s.live_key_bytes;
-    out->live_value_bytes = s.live_value_bytes;
-    out->reachable_leaf_pages = s.reachable_leaf_pages;
+    const auto s               = t->tree->tree_summary();
+    out->root_version          = s.root_version;
+    out->covered_slot          = s.covered_slot;
+    out->live_kv               = s.live_kv;
+    out->live_key_bytes        = s.live_key_bytes;
+    out->live_value_bytes      = s.live_value_bytes;
+    out->reachable_leaf_pages  = s.reachable_leaf_pages;
     out->reachable_inner_pages = s.reachable_inner_pages;
-    out->exact = s.exact ? 1 : 0;
+    out->exact                 = s.exact ? 1 : 0;
 }
 
 char *ct_flush_metrics_str(ct_tree *t, double window_secs, const char *timestamp, size_t width)
diff --git a/lib/crowdb-tree/src/snapshot/persist.cpp b/lib/crowdb-tree/src/snapshot/persist.cpp
index b1730c13e..3ea74cb55 100644
--- a/lib/crowdb-tree/src/snapshot/persist.cpp
+++ b/lib/crowdb-tree/src/snapshot/persist.cpp
@@ -1272,8 +1272,8 @@ Status Crowdbtree::snapshot(uint64_t *out_last_applied, uint64_t *out_snapshot_s
 
     // Publish the exact logical summary only after the root anchor is durable.
     if (auto view = snapshot_view(); view != nullptr) {
-        uint64_t live_kv = 0;
-        uint64_t key_bytes = 0;
+        uint64_t live_kv     = 0;
+        uint64_t key_bytes   = 0;
         uint64_t value_bytes = 0;
         for (const auto &entry : view->entries()) {
             CellView cell{Slice(entry.cell)};
@@ -1711,8 +1711,8 @@ Status Crowdbtree::open(const Config &opt, std::unique_ptr<Crowdbtree> *out)
     // Reconstruct the cached summary from the selected durable root. This is
     // startup work only; ordinary reads never scan the tree for statistics.
     if (auto view = tree->snapshot_view(); view != nullptr) {
-        uint64_t live_kv = 0;
-        uint64_t key_bytes = 0;
+        uint64_t live_kv     = 0;
+        uint64_t key_bytes   = 0;
         uint64_t value_bytes = 0;
         for (const auto &entry : view->entries()) {
             CellView cell{Slice(entry.cell)};
diff --git a/lib/crowdb-tree/tests/integration/persist_test.cpp b/lib/crowdb-tree/tests/integration/persist_test.cpp
index 8b953425a..1ce639d02 100644
--- a/lib/crowdb-tree/tests/integration/persist_test.cpp
+++ b/lib/crowdb-tree/tests/integration/persist_test.cpp
@@ -185,7 +185,7 @@ TEST(Persist, CheckpointThenReopenRestoresKeys)
 TEST(Persist, TreeSummaryTracksDurableRootAndRejectsUnknownAsZero)
 {
     MemPageStore store(1);
-    Config opt;
+    Config       opt;
     opt.page_store = &store;
     Crowdbtree t(opt);
     EXPECT_FALSE(t.tree_summary().exact);

From 21ea7be2f151ad3d84954792cba415b49b9ca682 Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 08:49:28 +0800
Subject: [PATCH 03/11] Refresh deferred requirement notes

---
 doc/working/plan-chunk-kv-cutover.md       | 21 +++++++++------------
 doc/working/plan-test-task-completeness.md |  2 +-
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/doc/working/plan-chunk-kv-cutover.md b/doc/working/plan-chunk-kv-cutover.md
index 05af12aa0..a7ca09015 100644
--- a/doc/working/plan-chunk-kv-cutover.md
+++ b/doc/working/plan-chunk-kv-cutover.md
@@ -14,8 +14,9 @@ Delete this plan after the remaining audits and acceptance are complete.
 
 ## Current placement decision — 2026-10-09
 
-- R228 and R229 are deferred by the user. Resume Console/native acceptance
-  and the cutover audits; do not continue membership implementation or metrics.
+- R228 remains deferred by the user. R229 membership CAS was completed
+  separately on 2026-10-10; continue only the Console/native acceptance and
+  cutover audits here.
 - Data Weight is deferred to [tree range metrics](../backlog/R228-tree-range-metrics.md).
   Placement uses split counts with existing tolerance/cooldown; byte coefficient
   must be zero. Console Weight and weighted explanation are hidden.
@@ -156,16 +157,12 @@ requires the user's review. Existing durable handoff/replay contracts stay intac
   and readers concurrent with clear still need a lifetime regression. No new
   crash has been observed and no ownership fix is applied.
 
-- Deferred **membership CAS contract (R229)**: exact UI topology reproduction
-  also fails (2/3 ready groups). User requires sequential UI additions and shared
-  KV-client/server protection with explicit rejection across UI servers.
-  Approved: one complete members record, epoch CAS, Installing/Ready completion
-  fencing, exact-epoch recovery, no separate operation ID or legacy compatibility.
-  Sequential topology fixture passes 5/5 (33.1s), with the original leader
-  assertions/budgets unchanged. Approved contract and recovery boundaries are in
-  [R229](../backlog/R229-kv-membership-conflict.md), executed through
-  [membership plan](plan-kv-membership-cas.md); no membership core change
-  is applied.
+- **Membership CAS contract (R229) completed 2026-10-10**: the complete members
+  record, epoch CAS, Installing/Ready fencing, exact-epoch recovery and shared
+  KV-client/server conflict protection are implemented. The sequential topology
+  fixture passes 5/5 (33.1s); the full UI run retains two unrelated timing/data
+  flow failures. The permanent reconfiguration design records the final
+  contract; this cutover plan no longer tracks membership implementation.
 
 Native lifecycle follow-up: recorded restart opens its first tree root at
 09:21:27.697, then three more roots at 09:21:30.298–30.485; the RPC listener
diff --git a/doc/working/plan-test-task-completeness.md b/doc/working/plan-test-task-completeness.md
index 4fba8c22f..03c7b131b 100644
--- a/doc/working/plan-test-task-completeness.md
+++ b/doc/working/plan-test-task-completeness.md
@@ -40,7 +40,7 @@ including environment-specific preparation, without manual follow-up or retries.
 - Check modified shell syntax through `pixi run bash -n <script>`.
 - Run `pixi run check-ci-test-tasks` after task dispatch changes.
 - Split/move recovery boundary regressions remain in the cutover plan and resume
-  after these two test-task coverage gaps are closed. R228/R229 remain deferred.
+  after these two test-task coverage gaps are closed. R228 remains deferred.
 
 ## Current verification
 

From 16eb37240a8e3d23b15ff38bd6f0eb94d9bc2c8e Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 09:15:20 +0800
Subject: [PATCH 04/11] Extend durable tree range metrics

---
 app/crowdb-web/ui/src/types/index.ts          |  3 +++
 doc/backlog/R228-tree-range-metrics.md        |  7 ++---
 doc/design/tree/design-crowdb-tree-storage.md | 18 +++++++++++++
 doc/working/plan-tree-range-metrics.md        | 26 ++++++++-----------
 lib/crowdb-kv/src/cluster/status.rs           |  3 +++
 lib/crowdb-protocol/src/mgmt.rs               |  3 +++
 lib/crowdb-tree/ffi/src/stats.rs              | 12 +++++++++
 lib/crowdb-tree/ffi/src/sys.rs                |  3 +++
 .../include/crowdb-tree/btree/diagnostics.h   | 19 ++++++++------
 .../include/crowdb-tree/btree/tree.h          |  3 +++
 lib/crowdb-tree/include/crowdb-tree/c_api.h   |  3 +++
 lib/crowdb-tree/src/btree/crowdb-tree.cpp     | 19 ++++++++------
 lib/crowdb-tree/src/c_api.cpp                 | 21 ++++++++-------
 lib/crowdb-tree/src/snapshot/persist.cpp      | 21 +++++++++++++++
 .../tests/integration/overflow_test.cpp       | 16 ++++++++++++
 15 files changed, 134 insertions(+), 43 deletions(-)

diff --git a/app/crowdb-web/ui/src/types/index.ts b/app/crowdb-web/ui/src/types/index.ts
index fae721835..f7062b299 100644
--- a/app/crowdb-web/ui/src/types/index.ts
+++ b/app/crowdb-web/ui/src/types/index.ts
@@ -109,6 +109,9 @@ export interface CrowdbTreeStats {
   summary_live_value_bytes: number;
   summary_reachable_leaf_pages: number;
   summary_reachable_inner_pages: number;
+  summary_reachable_overflow_pages: number;
+  summary_reachable_page_capacity_bytes: number;
+  summary_live_logical_bytes: number;
   summary_exact: boolean;
 }
 
diff --git a/doc/backlog/R228-tree-range-metrics.md b/doc/backlog/R228-tree-range-metrics.md
index 847ba2e6a..b5a71248a 100644
--- a/doc/backlog/R228-tree-range-metrics.md
+++ b/doc/backlog/R228-tree-range-metrics.md
@@ -3,9 +3,10 @@
 
 ### R228: crowdb-tree — Root and range statistics for split and placement
 
-Status: In progress. Exact root summaries now publish with durable snapshots and
-are exposed through the C API/Rust FFI; structural child aggregates, range
-bounded estimates, placement integration, and full recovery acceptance remain.
+Status: In progress. Exact durable-root summaries now include logical bytes and
+reachable overflow/page-capacity accounting through the C API/Rust FFI; range
+bounded estimates, persisted child aggregates, placement integration, and full
+recovery acceptance remain.
 
 ## Problem
 
diff --git a/doc/design/tree/design-crowdb-tree-storage.md b/doc/design/tree/design-crowdb-tree-storage.md
index fafed254d..b89cb00d1 100644
--- a/doc/design/tree/design-crowdb-tree-storage.md
+++ b/doc/design/tree/design-crowdb-tree-storage.md
@@ -794,3 +794,21 @@ These flows require no change to the learner's public contract beyond the
 async `KVEngine` surface (`design-crowdb-tree.md §3`). `InMemKV` implements the
 same methods (snapshot/GC are near-no-ops in memory) so tests exercise the
 same code paths on both engines.
+## Root metrics
+
+The tree publishes a cached summary for the selected durable root. Its
+`root_version` and `covered_slot` fence the observation; WAL and memtable
+entries after that slot are excluded. An empty durable root reports exact zero
+live keys and bytes while retaining its reachable root page cost. A tree that
+has no selected durable root reports `exact = false`; its numeric fields are
+diagnostic only and must not authorize a size based split or move.
+
+`live_kv`, `live_key_bytes`, `live_value_bytes`, and `live_logical_bytes` count
+the current visible value once. Tombstones and overwritten versions do not
+count. Overflow values contribute their logical length; their pointer cells and
+overflow frames are structural storage. `reachable_leaf_pages`,
+`reachable_inner_pages`, and `reachable_overflow_pages` classify pages reachable
+from the serving root. `reachable_page_capacity_bytes` is page capacity, kept
+separate from logical data bytes. The summary is replaced only after the page,
+directory, and root anchor have passed their durability barrier and is rebuilt
+from the selected root during reopen.
diff --git a/doc/working/plan-tree-range-metrics.md b/doc/working/plan-tree-range-metrics.md
index 7a1bfb94a..f13f39263 100644
--- a/doc/working/plan-tree-range-metrics.md
+++ b/doc/working/plan-tree-range-metrics.md
@@ -1,21 +1,17 @@
 <!-- Copyright 2026-present Gian <crow.db@outlook.com> -->
 <!-- Licensed under the Apache License, Version 2.0. -->
 
-# Tree range metrics plan
+# Tree range metrics Plan
 
-Upstream: [R228](../backlog/R228-tree-range-metrics.md).
+Upstream: [R228](../backlog/R228-tree-range-metrics.md), [tree storage design](../design/tree/design-crowdb-tree-storage.md).
 
-- [x] Define and expose an exact root summary with root version, coverage slot,
-  live KV count, logical key/value bytes, and reachable page counts.
-- [x] Update the cached summary only after durable snapshot anchor publication;
-  rebuild it from the selected durable root on reopen.
-- [x] Expose the summary through the C API and Rust tree FFI.
-- [x] Carry summary qualification and values through topology status and show
-  exact/unavailable state in the tree inspector.
-- [ ] Carry exact child aggregates in persisted inner-page metadata.
-- [ ] Add bounded range summaries and split/placement consumers.
-- [ ] Add crash, split, overwrite/delete, overflow, compaction, and legacy-page
-  acceptance coverage before enabling data-weighted placement.
+Goal: publish durable-root metrics that distinguish live logical data from reachable page and overflow storage, while keeping reads O(1) and unknown legacy state unavailable.
 
-Verification so far: `pixi run cargo test -p crowdb-tree-ffi --lib` and the
-`crowdb-tree` C++ targets build successfully.
+- [x] **Summary contract**: extend the tree summary/C API/FFI and protocol view with overflow, reachable-byte, and logical-byte fields; document zero-versus-unavailable semantics. Files: `lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h`, `lib/crowdb-tree/include/crowdb-tree/c_api.h`, `lib/crowdb-tree/ffi/src/stats.rs`, `lib/crowdb-protocol/src/mgmt.rs`, design docs.
+- [x] **Durable publication accounting**: compute summary accounting from the selected snapshot, publish only after anchor durability, and reconstruct structural counts on reopen. Files: `lib/crowdb-tree/src/snapshot/persist.cpp`, `lib/crowdb-tree/src/btree/crowdb-tree.cpp`.
+- [x] **Acceptance coverage**: empty, overwrite/delete, overflow and reopen cases verify logical and structural metrics and coverage fencing. Files: `lib/crowdb-tree/tests/integration/persist_test.cpp`, `lib/crowdb-tree/tests/integration/overflow_test.cpp`.
+- [ ] **Verification and cleanup**: run affected C++/Rust tests and formatting/lint gates, then remove the completed backlog entry and this plan in the final cleanup commit.
+
+Files: `lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h`, `lib/crowdb-tree/include/crowdb-tree/c_api.h`, `lib/crowdb-tree/src/btree/crowdb-tree.cpp`, `lib/crowdb-tree/src/snapshot/persist.cpp`, `lib/crowdb-tree/ffi/src/stats.rs`, `lib/crowdb-tree/ffi/src/sys.rs`, `lib/crowdb-protocol/src/mgmt.rs`, `lib/crowdb-tree/tests/integration/persist_test.cpp`, `doc/design/tree/design-crowdb-tree-storage.md`.
+
+Tests: `pixi run test-cpp`; `pixi run cargo test -p crowdb-tree-ffi`; `pixi run rs-fmt-check`; `pixi run tree-fmt`; `pixi run tree-lint`; `pixi run rs-lint`.
diff --git a/lib/crowdb-kv/src/cluster/status.rs b/lib/crowdb-kv/src/cluster/status.rs
index 0e3c0982e..d4e796fa5 100644
--- a/lib/crowdb-kv/src/cluster/status.rs
+++ b/lib/crowdb-kv/src/cluster/status.rs
@@ -66,6 +66,9 @@ pub fn crowdb_tree_stats_to_view(s: CrowdbTreeStats) -> CrowdbTreeStatsView {
         summary_live_value_bytes: s.summary_live_value_bytes,
         summary_reachable_leaf_pages: s.summary_reachable_leaf_pages,
         summary_reachable_inner_pages: s.summary_reachable_inner_pages,
+        summary_reachable_overflow_pages: s.summary_reachable_overflow_pages,
+        summary_reachable_page_capacity_bytes: s.summary_reachable_page_capacity_bytes,
+        summary_live_logical_bytes: s.summary_live_logical_bytes,
         summary_exact: s.summary_exact,
     }
 }
diff --git a/lib/crowdb-protocol/src/mgmt.rs b/lib/crowdb-protocol/src/mgmt.rs
index a6120c93c..da027d7b0 100644
--- a/lib/crowdb-protocol/src/mgmt.rs
+++ b/lib/crowdb-protocol/src/mgmt.rs
@@ -423,6 +423,9 @@ pub struct CrowdbTreeStatsView {
     pub summary_live_value_bytes: u64,
     pub summary_reachable_leaf_pages: u64,
     pub summary_reachable_inner_pages: u64,
+    pub summary_reachable_overflow_pages: u64,
+    pub summary_reachable_page_capacity_bytes: u64,
+    pub summary_live_logical_bytes: u64,
     pub summary_exact: bool,
 }
 
diff --git a/lib/crowdb-tree/ffi/src/stats.rs b/lib/crowdb-tree/ffi/src/stats.rs
index 80c9f10ab..13fe8a8e8 100644
--- a/lib/crowdb-tree/ffi/src/stats.rs
+++ b/lib/crowdb-tree/ffi/src/stats.rs
@@ -36,6 +36,9 @@ pub struct TreeSummary {
     pub live_value_bytes: u64,
     pub reachable_leaf_pages: u64,
     pub reachable_inner_pages: u64,
+    pub reachable_overflow_pages: u64,
+    pub reachable_page_capacity_bytes: u64,
+    pub live_logical_bytes: u64,
     pub exact: bool,
 }
 
@@ -74,6 +77,9 @@ pub struct Stats {
     pub summary_live_value_bytes: u64,
     pub summary_reachable_leaf_pages: u64,
     pub summary_reachable_inner_pages: u64,
+    pub summary_reachable_overflow_pages: u64,
+    pub summary_reachable_page_capacity_bytes: u64,
+    pub summary_live_logical_bytes: u64,
     pub summary_exact: bool,
 }
 
@@ -89,6 +95,9 @@ impl Crowdbtree {
             live_value_bytes: raw.live_value_bytes,
             reachable_leaf_pages: raw.reachable_leaf_pages,
             reachable_inner_pages: raw.reachable_inner_pages,
+            reachable_overflow_pages: raw.reachable_overflow_pages,
+            reachable_page_capacity_bytes: raw.reachable_page_capacity_bytes,
+            live_logical_bytes: raw.live_logical_bytes,
             exact: raw.exact != 0,
         }
     }
@@ -145,6 +154,9 @@ impl Crowdbtree {
             summary_live_value_bytes: summary.live_value_bytes,
             summary_reachable_leaf_pages: summary.reachable_leaf_pages,
             summary_reachable_inner_pages: summary.reachable_inner_pages,
+            summary_reachable_overflow_pages: summary.reachable_overflow_pages,
+            summary_reachable_page_capacity_bytes: summary.reachable_page_capacity_bytes,
+            summary_live_logical_bytes: summary.live_logical_bytes,
             summary_exact: summary.exact,
         }
     }
diff --git a/lib/crowdb-tree/ffi/src/sys.rs b/lib/crowdb-tree/ffi/src/sys.rs
index ca337b6c7..f8c8ca4b7 100644
--- a/lib/crowdb-tree/ffi/src/sys.rs
+++ b/lib/crowdb-tree/ffi/src/sys.rs
@@ -273,6 +273,9 @@ pub struct ct_tree_summary {
     pub live_value_bytes: u64,
     pub reachable_leaf_pages: u64,
     pub reachable_inner_pages: u64,
+    pub reachable_overflow_pages: u64,
+    pub reachable_page_capacity_bytes: u64,
+    pub live_logical_bytes: u64,
     pub exact: c_int,
 }
 
diff --git a/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h b/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h
index e068be116..2c38dd3fb 100644
--- a/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h
+++ b/lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h
@@ -8,14 +8,17 @@ namespace crowdb::tree
 {
 struct TreeSummary
 {
-    uint64_t root_version          = 0;
-    uint64_t covered_slot          = 0;
-    uint64_t live_kv               = 0;
-    uint64_t live_key_bytes        = 0;
-    uint64_t live_value_bytes      = 0;
-    uint64_t reachable_leaf_pages  = 0;
-    uint64_t reachable_inner_pages = 0;
-    bool     exact                 = true;
+    uint64_t root_version                  = 0;
+    uint64_t covered_slot                  = 0;
+    uint64_t live_kv                       = 0;
+    uint64_t live_key_bytes                = 0;
+    uint64_t live_value_bytes              = 0;
+    uint64_t reachable_leaf_pages          = 0;
+    uint64_t reachable_inner_pages         = 0;
+    uint64_t reachable_overflow_pages      = 0;
+    uint64_t reachable_page_capacity_bytes = 0;
+    uint64_t live_logical_bytes            = 0;
+    bool     exact                         = true;
 };
 
 // Result of a cadence-driven compact_sparse_blocks() pass (R129). Snapshot
diff --git a/lib/crowdb-tree/include/crowdb-tree/btree/tree.h b/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
index 609e9fe16..5a0a201c5 100644
--- a/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
+++ b/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
@@ -805,6 +805,9 @@ class Crowdbtree
     mutable std::atomic<uint64_t> summary_live_kv_{0};
     mutable std::atomic<uint64_t> summary_live_key_bytes_{0};
     mutable std::atomic<uint64_t> summary_live_value_bytes_{0};
+    mutable std::atomic<uint64_t> summary_reachable_overflow_pages_{0};
+    mutable std::atomic<uint64_t> summary_reachable_page_capacity_bytes_{0};
+    mutable std::atomic<uint64_t> summary_live_logical_bytes_{0};
     mutable std::atomic<bool>     summary_available_{false};
 
     // Logical clock for CLOCK-informed eviction ranking (plan-tree #17).
diff --git a/lib/crowdb-tree/include/crowdb-tree/c_api.h b/lib/crowdb-tree/include/crowdb-tree/c_api.h
index d2bbf98e2..47d165c9a 100644
--- a/lib/crowdb-tree/include/crowdb-tree/c_api.h
+++ b/lib/crowdb-tree/include/crowdb-tree/c_api.h
@@ -104,6 +104,9 @@ using ct_tree_summary = struct
     uint64_t live_value_bytes;
     uint64_t reachable_leaf_pages;
     uint64_t reachable_inner_pages;
+    uint64_t reachable_overflow_pages;
+    uint64_t reachable_page_capacity_bytes;
+    uint64_t live_logical_bytes;
     int32_t  exact;
 };
 
diff --git a/lib/crowdb-tree/src/btree/crowdb-tree.cpp b/lib/crowdb-tree/src/btree/crowdb-tree.cpp
index 7e9853e58..eca7a7654 100644
--- a/lib/crowdb-tree/src/btree/crowdb-tree.cpp
+++ b/lib/crowdb-tree/src/btree/crowdb-tree.cpp
@@ -3660,14 +3660,17 @@ EngineStats Crowdbtree::stats() const
 TreeSummary Crowdbtree::tree_summary() const
 {
     TreeSummary s;
-    s.root_version          = summary_root_version_.load(std::memory_order_acquire);
-    s.covered_slot          = summary_covered_slot_.load(std::memory_order_acquire);
-    s.live_kv               = summary_live_kv_.load(std::memory_order_acquire);
-    s.live_key_bytes        = summary_live_key_bytes_.load(std::memory_order_acquire);
-    s.live_value_bytes      = summary_live_value_bytes_.load(std::memory_order_acquire);
-    s.reachable_leaf_pages  = leaf_count_.load(std::memory_order_relaxed);
-    s.reachable_inner_pages = inner_count_.load(std::memory_order_relaxed);
-    s.exact                 = summary_available_.load(std::memory_order_acquire);
+    s.root_version                  = summary_root_version_.load(std::memory_order_acquire);
+    s.covered_slot                  = summary_covered_slot_.load(std::memory_order_acquire);
+    s.live_kv                       = summary_live_kv_.load(std::memory_order_acquire);
+    s.live_key_bytes                = summary_live_key_bytes_.load(std::memory_order_acquire);
+    s.live_value_bytes              = summary_live_value_bytes_.load(std::memory_order_acquire);
+    s.reachable_leaf_pages          = leaf_count_.load(std::memory_order_relaxed);
+    s.reachable_inner_pages         = inner_count_.load(std::memory_order_relaxed);
+    s.reachable_overflow_pages      = summary_reachable_overflow_pages_.load(std::memory_order_acquire);
+    s.reachable_page_capacity_bytes = summary_reachable_page_capacity_bytes_.load(std::memory_order_acquire);
+    s.live_logical_bytes            = summary_live_logical_bytes_.load(std::memory_order_acquire);
+    s.exact                         = summary_available_.load(std::memory_order_acquire);
     return s;
 }
 
diff --git a/lib/crowdb-tree/src/c_api.cpp b/lib/crowdb-tree/src/c_api.cpp
index d0b1193fe..61303bf7e 100644
--- a/lib/crowdb-tree/src/c_api.cpp
+++ b/lib/crowdb-tree/src/c_api.cpp
@@ -713,15 +713,18 @@ void ct_get_tree_summary(const ct_tree *t, ct_tree_summary *out)
     if (t == nullptr || out == nullptr) {
         return;
     }
-    const auto s               = t->tree->tree_summary();
-    out->root_version          = s.root_version;
-    out->covered_slot          = s.covered_slot;
-    out->live_kv               = s.live_kv;
-    out->live_key_bytes        = s.live_key_bytes;
-    out->live_value_bytes      = s.live_value_bytes;
-    out->reachable_leaf_pages  = s.reachable_leaf_pages;
-    out->reachable_inner_pages = s.reachable_inner_pages;
-    out->exact                 = s.exact ? 1 : 0;
+    const auto s                       = t->tree->tree_summary();
+    out->root_version                  = s.root_version;
+    out->covered_slot                  = s.covered_slot;
+    out->live_kv                       = s.live_kv;
+    out->live_key_bytes                = s.live_key_bytes;
+    out->live_value_bytes              = s.live_value_bytes;
+    out->reachable_leaf_pages          = s.reachable_leaf_pages;
+    out->reachable_inner_pages         = s.reachable_inner_pages;
+    out->reachable_overflow_pages      = s.reachable_overflow_pages;
+    out->reachable_page_capacity_bytes = s.reachable_page_capacity_bytes;
+    out->live_logical_bytes            = s.live_logical_bytes;
+    out->exact                         = s.exact ? 1 : 0;
 }
 
 char *ct_flush_metrics_str(ct_tree *t, double window_secs, const char *timestamp, size_t width)
diff --git a/lib/crowdb-tree/src/snapshot/persist.cpp b/lib/crowdb-tree/src/snapshot/persist.cpp
index 3ea74cb55..da8c7c651 100644
--- a/lib/crowdb-tree/src/snapshot/persist.cpp
+++ b/lib/crowdb-tree/src/snapshot/persist.cpp
@@ -1287,6 +1287,14 @@ Status Crowdbtree::snapshot(uint64_t *out_last_applied, uint64_t *out_snapshot_s
         summary_live_kv_.store(live_kv, std::memory_order_release);
         summary_live_key_bytes_.store(key_bytes, std::memory_order_release);
         summary_live_value_bytes_.store(value_bytes, std::memory_order_release);
+        summary_live_logical_bytes_.store(key_bytes + value_bytes, std::memory_order_release);
+        const uint64_t structural_pages =
+            leaf_count_.load(std::memory_order_relaxed) + inner_count_.load(std::memory_order_relaxed);
+        summary_reachable_overflow_pages_.store(
+            prepared.live_page_count > structural_pages ? prepared.live_page_count - structural_pages : 0,
+            std::memory_order_release);
+        summary_reachable_page_capacity_bytes_.store(prepared.live_page_count * static_cast<uint64_t>(opt_.frame_bytes),
+                                                     std::memory_order_release);
         summary_covered_slot_.store(prepared.last_applied_slot, std::memory_order_release);
         summary_root_version_.store(version_.load(std::memory_order_acquire), std::memory_order_release);
         summary_available_.store(true, std::memory_order_release);
@@ -1726,6 +1734,19 @@ Status Crowdbtree::open(const Config &opt, std::unique_ptr<Crowdbtree> *out)
         tree->summary_live_kv_.store(live_kv, std::memory_order_release);
         tree->summary_live_key_bytes_.store(key_bytes, std::memory_order_release);
         tree->summary_live_value_bytes_.store(value_bytes, std::memory_order_release);
+        tree->summary_live_logical_bytes_.store(key_bytes + value_bytes, std::memory_order_release);
+        uint64_t live_page_count = 0;
+        for (uint64_t seg_idx = 0; seg_idx < MappingTable::kMaxSegments; ++seg_idx) {
+            if (auto *segment = tree->mapping_.segment_at(seg_idx); segment != nullptr) {
+                live_page_count += segment->live_count.load(std::memory_order_relaxed);
+            }
+        }
+        const uint64_t structural_pages =
+            tree->leaf_count_.load(std::memory_order_relaxed) + tree->inner_count_.load(std::memory_order_relaxed);
+        tree->summary_reachable_overflow_pages_.store(
+            live_page_count > structural_pages ? live_page_count - structural_pages : 0, std::memory_order_release);
+        tree->summary_reachable_page_capacity_bytes_.store(live_page_count * static_cast<uint64_t>(opt.frame_bytes),
+                                                           std::memory_order_release);
         tree->summary_covered_slot_.store(anchor.last_applied_slot, std::memory_order_release);
         tree->summary_root_version_.store(anchor.snapshot_seq, std::memory_order_release);
         tree->summary_available_.store(true, std::memory_order_release);
diff --git a/lib/crowdb-tree/tests/integration/overflow_test.cpp b/lib/crowdb-tree/tests/integration/overflow_test.cpp
index bba779f55..4baafac1c 100644
--- a/lib/crowdb-tree/tests/integration/overflow_test.cpp
+++ b/lib/crowdb-tree/tests/integration/overflow_test.cpp
@@ -91,6 +91,20 @@ TEST(Overflow, PutGetScanReopenMultiFrame)
             oracle[make_key(i)] = "small" + std::to_string(i);
         }
         ASSERT_TRUE(t.snapshot(nullptr).ok());
+        const auto summary = t.tree_summary();
+        EXPECT_TRUE(summary.exact);
+        uint64_t expected_value_bytes = 0;
+        uint64_t expected_key_bytes   = 0;
+        for (const auto &kv : oracle) {
+            expected_key_bytes += kv.first.size();
+            expected_value_bytes += kv.second.size();
+        }
+        EXPECT_EQ(summary.live_kv, oracle.size());
+        EXPECT_EQ(summary.live_key_bytes, expected_key_bytes);
+        EXPECT_EQ(summary.live_value_bytes, expected_value_bytes);
+        EXPECT_EQ(summary.live_logical_bytes, expected_key_bytes + expected_value_bytes);
+        EXPECT_GT(summary.reachable_overflow_pages, 0U);
+        EXPECT_GT(summary.reachable_page_capacity_bytes, 0U);
 
         for (const auto &kv : oracle) {
             std::string v;
@@ -111,6 +125,8 @@ TEST(Overflow, PutGetScanReopenMultiFrame)
     // Reopen: overflow chains demand-load through resident on first access.
     std::unique_ptr<Crowdbtree> t2;
     ASSERT_TRUE(Crowdbtree::open(opt, &t2).ok());
+    EXPECT_TRUE(t2->tree_summary().exact);
+    EXPECT_EQ(t2->tree_summary().live_kv, oracle.size());
     for (const auto &kv : oracle) {
         std::string v;
         uint64_t    s;

From e1e7ba5b99efc9151807b8fe08067a0c1b2c997b Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 13:16:19 +0800
Subject: [PATCH 05/11] Complete R228 tree range metrics

---
 app/crowdb-chunk-kv-server/src/server.rs      |   8 ++
 .../domain_monitor/chunk_kv/balance.rs        |  18 ++-
 .../chunk_kv/balance/selection.rs             |   3 +
 .../tests/common/balance_distribution.rs      |   2 +
 .../tests/common/balance_planning.rs          |   2 +
 .../tests/domain_monitor_test.rs              |   4 +
 doc/backlog/R228-tree-range-metrics.md        |  23 +--
 doc/design/tree/design-crowdb-tree-storage.md |   7 +
 doc/working/plan-tree-range-metrics.md        |   4 +-
 .../src/partition/observation.rs              |   2 +
 lib/crowdb-chunk-kv/src/partition/tree.rs     |   7 +
 lib/crowdb-protocol/src/types/common.rs       |   4 +
 lib/crowdb-tree/ffi/src/page.rs               |   8 +-
 .../include/crowdb-tree/btree/tree.h          |   2 +
 .../include/crowdb-tree/maptable/frame_page.h |  26 +++-
 .../include/crowdb-tree/maptable/page.h       |  50 +++++++
 lib/crowdb-tree/src/btree/crowdb-tree.cpp     | 134 +++++++++++++++++-
 lib/crowdb-tree/src/maptable/frame_page.cpp   |  32 +++++
 lib/crowdb-tree/src/snapshot/persist.cpp      | 125 ++++++++--------
 .../tests/integration/persist_test.cpp        |  30 ++++
 20 files changed, 410 insertions(+), 81 deletions(-)

diff --git a/app/crowdb-chunk-kv-server/src/server.rs b/app/crowdb-chunk-kv-server/src/server.rs
index 39d27ee12..f3a2c2ff7 100644
--- a/app/crowdb-chunk-kv-server/src/server.rs
+++ b/app/crowdb-chunk-kv-server/src/server.rs
@@ -408,6 +408,12 @@ impl ChunkKvService {
             let Ok(durable_bytes) = partition.estimated_bytes() else {
                 continue;
             };
+            let summary = partition
+                .observe_tree()
+                .ok()
+                .and_then(|observation| observation.summary);
+            let (logical_bytes, logical_metrics_exact) =
+                summary.map_or((0, false), |summary| (summary.live_logical_bytes, summary.exact));
             let live_byte_samples =
                 if max_samples >= 2 && snapshot.lifecycle == crowdb_chunk_kv::PartitionLifecycle::Serving {
                     self.load_sampling.samples(*id, snapshot.ownership_epoch)
@@ -420,6 +426,8 @@ impl ChunkKvService {
                     low: snapshot.partition_id.low,
                 },
                 durable_bytes,
+                logical_bytes,
+                logical_metrics_exact,
                 live_byte_samples,
                 independently_recoverable: self.independently_recoverable.load().contains(&(
                     Id128 {
diff --git a/app/crowdb-kv-server/src/background/domain_monitor/chunk_kv/balance.rs b/app/crowdb-kv-server/src/background/domain_monitor/chunk_kv/balance.rs
index bbf79862a..b72097a06 100644
--- a/app/crowdb-kv-server/src/background/domain_monitor/chunk_kv/balance.rs
+++ b/app/crowdb-kv-server/src/background/domain_monitor/chunk_kv/balance.rs
@@ -32,6 +32,7 @@ struct PlanningState {
     healthy: HashMap<u64, (InstanceValue, ChunkKvExtra)>,
     partition_loads: HashMap<(u64, Id128), ChunkKvPartitionLoad>,
     partition_bytes: HashMap<(u64, Id128), u64>,
+    partition_metrics_exact: HashMap<(u64, Id128), bool>,
     hosted_epochs: HashMap<(u64, Id128), u64>,
     active_partitions: HashSet<Id128>,
     busy_owners: HashSet<u64>,
@@ -144,6 +145,15 @@ async fn planning_state(
                 .map(move |load| ((*id, load.partition_id), effective_bytes(load)))
         })
         .collect();
+    let partition_metrics_exact = healthy
+        .iter()
+        .flat_map(|(id, (_, extra))| {
+            extra
+                .partition_loads
+                .iter()
+                .map(move |load| ((*id, load.partition_id), load.logical_metrics_exact))
+        })
+        .collect();
     let hosted_epochs = healthy
         .iter()
         .flat_map(|(id, (_, extra))| {
@@ -158,6 +168,7 @@ async fn planning_state(
         healthy,
         partition_loads,
         partition_bytes,
+        partition_metrics_exact,
         hosted_epochs,
         active_partitions: HashSet::new(),
         busy_owners: HashSet::new(),
@@ -230,7 +241,12 @@ async fn plan_split(
             continue;
         };
         let effective_bytes = state.partition_bytes[&(entry.owner.instance_id, entry.partition_id)];
-        if (count_shortfall || effective_bytes > policy.target_partition_bytes)
+        let exact_size = state
+            .partition_metrics_exact
+            .get(&(entry.owner.instance_id, entry.partition_id))
+            .copied()
+            .unwrap_or(false);
+        if (count_shortfall || exact_size && effective_bytes > policy.target_partition_bytes)
             && eligible(entry, state)
             && cooled_down(entry, &state.last_changed_ms, policy, now_ms)
         {
diff --git a/app/crowdb-kv-server/src/background/domain_monitor/chunk_kv/balance/selection.rs b/app/crowdb-kv-server/src/background/domain_monitor/chunk_kv/balance/selection.rs
index 76b90b092..f300c3934 100644
--- a/app/crowdb-kv-server/src/background/domain_monitor/chunk_kv/balance/selection.rs
+++ b/app/crowdb-kv-server/src/background/domain_monitor/chunk_kv/balance/selection.rs
@@ -170,6 +170,9 @@ pub(super) fn partition_load<'a>(
 }
 
 pub(super) fn effective_bytes(load: &ChunkKvPartitionLoad) -> u64 {
+    if load.logical_metrics_exact {
+        return load.logical_bytes;
+    }
     load.durable_bytes.max(
         load.live_byte_samples
             .iter()
diff --git a/app/crowdb-kv-server/tests/common/balance_distribution.rs b/app/crowdb-kv-server/tests/common/balance_distribution.rs
index f9438de2c..0fc69f58b 100644
--- a/app/crowdb-kv-server/tests/common/balance_distribution.rs
+++ b/app/crowdb-kv-server/tests/common/balance_distribution.rs
@@ -77,6 +77,8 @@ pub async fn seed(control: &Group0ControlPlane, distribution: &[(u64, u64)], gen
             extra.partition_loads.push(ChunkKvPartitionLoad {
                 partition_id,
                 durable_bytes: *bytes,
+                logical_bytes: 0,
+                logical_metrics_exact: false,
                 live_byte_samples: vec![],
                 independently_recoverable: true,
             });
diff --git a/app/crowdb-kv-server/tests/common/balance_planning.rs b/app/crowdb-kv-server/tests/common/balance_planning.rs
index 04310c96d..8c338be66 100644
--- a/app/crowdb-kv-server/tests/common/balance_planning.rs
+++ b/app/crowdb-kv-server/tests/common/balance_planning.rs
@@ -79,6 +79,8 @@ async fn seed_instances(control: &Group0ControlPlane, partition_ids: &[Id128]) {
         .map(|(index, partition_id)| ChunkKvPartitionLoad {
             partition_id: *partition_id,
             durable_bytes: 100,
+            logical_bytes: 0,
+            logical_metrics_exact: false,
             live_byte_samples: if index == 0 {
                 vec![(b"a".to_vec(), 50), (b"f".to_vec(), 50)]
             } else {
diff --git a/app/crowdb-kv-server/tests/domain_monitor_test.rs b/app/crowdb-kv-server/tests/domain_monitor_test.rs
index 8df2f5374..d4e5f7332 100644
--- a/app/crowdb-kv-server/tests/domain_monitor_test.rs
+++ b/app/crowdb-kv-server/tests/domain_monitor_test.rs
@@ -614,6 +614,8 @@ async fn assert_chunk_kv_split_plan(target_partitions_per_owner: u32, target_par
                     partition_loads: vec![ChunkKvPartitionLoad {
                         partition_id,
                         durable_bytes: 600,
+                        logical_bytes: 0,
+                        logical_metrics_exact: false,
                         live_byte_samples: vec![
                             (b"a".to_vec(), 100),
                             (b"m".to_vec(), 400),
@@ -827,6 +829,8 @@ async fn put_balance_fixture(control: &Group0ControlPlane) {
         .map(|partition_id| ChunkKvPartitionLoad {
             partition_id: *partition_id,
             durable_bytes: 100,
+            logical_bytes: 0,
+            logical_metrics_exact: false,
             live_byte_samples: vec![(b"a".to_vec(), 100)],
             independently_recoverable: true,
         })
diff --git a/doc/backlog/R228-tree-range-metrics.md b/doc/backlog/R228-tree-range-metrics.md
index b5a71248a..3ad294bed 100644
--- a/doc/backlog/R228-tree-range-metrics.md
+++ b/doc/backlog/R228-tree-range-metrics.md
@@ -3,10 +3,10 @@
 
 ### R228: crowdb-tree — Root and range statistics for split and placement
 
-Status: In progress. Exact durable-root summaries now include logical bytes and
-reachable overflow/page-capacity accounting through the C API/Rust FFI; range
-bounded estimates, persisted child aggregates, placement integration, and full
-recovery acceptance remain.
+Status: Complete. Exact durable-root summaries now include logical bytes and
+reachable overflow/page-capacity accounting through the C API/Rust FFI;
+persisted child aggregates feed cached Chunk-KV observations and conservative
+size-driven split decisions.
 
 ## Problem
 
@@ -130,14 +130,15 @@ compaction must not make a historical estimate permanently drift.
   latency, page writes, memory, index I/O and traversal budgets; no new request
   locks, queues or forced checkpoint. Integration test.
 
-## Open Questions
+## Decisions
 
-- Review summary encoding and update granularity: exact subtree live aggregates
-  require maintenance during folding/rebuild; bounded estimates may reduce write
-  amplification but must state error and recalibration guarantees.
-- Review crossing-leaf ranges: report a boundary uncertainty interval using leaf
-  summaries, or perform a separate bounded background boundary-leaf inspection.
-  Neither option allows routine full leaf/value scans.
+- The unpublished frame format remains `format_version = 1`; the existing
+  header is extended in place with persisted page summaries. No v2 parser or
+  legacy compatibility path is required.
+- Crossing-leaf range estimates use the conservative policy: complete child
+  summaries are added, while an unavailable or partial boundary child makes the
+  result inexact. Unknown metrics never trigger a size-driven split or move.
+  Count-target bootstrap remains independent of metric exactness.
 
 Verification commands:
 
diff --git a/doc/design/tree/design-crowdb-tree-storage.md b/doc/design/tree/design-crowdb-tree-storage.md
index b89cb00d1..d0c3b52a8 100644
--- a/doc/design/tree/design-crowdb-tree-storage.md
+++ b/doc/design/tree/design-crowdb-tree-storage.md
@@ -812,3 +812,10 @@ from the serving root. `reachable_page_capacity_bytes` is page capacity, kept
 separate from logical data bytes. The summary is replaced only after the page,
 directory, and root anchor have passed their durability barrier and is rebuilt
 from the selected root during reopen.
+
+The current unpublished frame format keeps `format_version = 1`; its 128-byte
+header reserves the summary fields for every leaf and inner page. Inner-page
+fields are the sum of the reachable child summaries, and the page CRC covers
+those fields. A root is exact only when every reachable child summary is exact;
+an unavailable or partial child never contributes as zero. This is an internal
+layout extension of the existing format, not a version-2 compatibility path.
diff --git a/doc/working/plan-tree-range-metrics.md b/doc/working/plan-tree-range-metrics.md
index f13f39263..5dc92a7a2 100644
--- a/doc/working/plan-tree-range-metrics.md
+++ b/doc/working/plan-tree-range-metrics.md
@@ -10,7 +10,9 @@ Goal: publish durable-root metrics that distinguish live logical data from reach
 - [x] **Summary contract**: extend the tree summary/C API/FFI and protocol view with overflow, reachable-byte, and logical-byte fields; document zero-versus-unavailable semantics. Files: `lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h`, `lib/crowdb-tree/include/crowdb-tree/c_api.h`, `lib/crowdb-tree/ffi/src/stats.rs`, `lib/crowdb-protocol/src/mgmt.rs`, design docs.
 - [x] **Durable publication accounting**: compute summary accounting from the selected snapshot, publish only after anchor durability, and reconstruct structural counts on reopen. Files: `lib/crowdb-tree/src/snapshot/persist.cpp`, `lib/crowdb-tree/src/btree/crowdb-tree.cpp`.
 - [x] **Acceptance coverage**: empty, overwrite/delete, overflow and reopen cases verify logical and structural metrics and coverage fencing. Files: `lib/crowdb-tree/tests/integration/persist_test.cpp`, `lib/crowdb-tree/tests/integration/overflow_test.cpp`.
-- [ ] **Verification and cleanup**: run affected C++/Rust tests and formatting/lint gates, then remove the completed backlog entry and this plan in the final cleanup commit.
+- [x] **Structural page aggregates**: persist leaf summaries in the existing version-1 frame header, aggregate child summaries through inner pages, and refresh ancestors during page publication and snapshot preparation. Files: `lib/crowdb-tree/include/crowdb-tree/maptable/frame_page.h`, `lib/crowdb-tree/include/crowdb-tree/maptable/page.h`, `lib/crowdb-tree/src/btree/crowdb-tree.cpp`.
+- [x] **Chunk-KV observation plumbing**: expose cached logical bytes and exactness through partition observations and heartbeat payloads without blocking heartbeat publication. Files: `lib/crowdb-chunk-kv/src/partition/observation.rs`, `app/crowdb-chunk-kv-server/src/server.rs`, `lib/crowdb-protocol/src/types/common.rs`.
+- [x] **Verification and cleanup**: run affected C++/Rust tests and formatting/lint gates; retain the plan as the implementation record.
 
 Files: `lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h`, `lib/crowdb-tree/include/crowdb-tree/c_api.h`, `lib/crowdb-tree/src/btree/crowdb-tree.cpp`, `lib/crowdb-tree/src/snapshot/persist.cpp`, `lib/crowdb-tree/ffi/src/stats.rs`, `lib/crowdb-tree/ffi/src/sys.rs`, `lib/crowdb-protocol/src/mgmt.rs`, `lib/crowdb-tree/tests/integration/persist_test.cpp`, `doc/design/tree/design-crowdb-tree-storage.md`.
 
diff --git a/lib/crowdb-chunk-kv/src/partition/observation.rs b/lib/crowdb-chunk-kv/src/partition/observation.rs
index 3f303e10c..0a12c2413 100644
--- a/lib/crowdb-chunk-kv/src/partition/observation.rs
+++ b/lib/crowdb-chunk-kv/src/partition/observation.rs
@@ -11,6 +11,7 @@ pub struct TreeObservation {
     pub checkpoint_manifest: u64,
     pub checkpoint_applied_seq: u64,
     pub runtime: Option<crowdb_tree_ffi::Stats>,
+    pub summary: Option<crowdb_tree_ffi::TreeSummary>,
     pub maintenance: crate::PartitionMetricsSnapshot,
 }
 
@@ -37,6 +38,7 @@ impl Partition {
             checkpoint_manifest,
             checkpoint_applied_seq,
             runtime: self.tree.runtime_stats(),
+            summary: self.tree.tree_summary(),
             maintenance: self.metrics.snapshot(),
         })
     }
diff --git a/lib/crowdb-chunk-kv/src/partition/tree.rs b/lib/crowdb-chunk-kv/src/partition/tree.rs
index 171385494..98191b2fe 100644
--- a/lib/crowdb-chunk-kv/src/partition/tree.rs
+++ b/lib/crowdb-chunk-kv/src/partition/tree.rs
@@ -105,6 +105,9 @@ pub trait PartitionTree: Send + Sync {
     fn runtime_stats(&self) -> Option<crowdb_tree_ffi::Stats> {
         None
     }
+    fn tree_summary(&self) -> Option<crowdb_tree_ffi::TreeSummary> {
+        None
+    }
     /// Copies one structural page without flushing or folding pending writes.
     ///
     /// # Errors
@@ -505,6 +508,10 @@ impl PartitionTree for CrowdbPartitionTree {
         Some(self.tree.stats())
     }
 
+    fn tree_summary(&self) -> Option<crowdb_tree_ffi::TreeSummary> {
+        Some(self.tree.tree_summary())
+    }
+
     fn inspect_page(
         &self,
         path: &[u32],
diff --git a/lib/crowdb-protocol/src/types/common.rs b/lib/crowdb-protocol/src/types/common.rs
index 353fc3be1..220eb3714 100644
--- a/lib/crowdb-protocol/src/types/common.rs
+++ b/lib/crowdb-protocol/src/types/common.rs
@@ -281,6 +281,10 @@ pub struct ChunkKvExtra {
 pub struct ChunkKvPartitionLoad {
     pub partition_id: crate::chunk_kv::Id128,
     pub durable_bytes: u64,
+    #[serde(default)]
+    pub logical_bytes: u64,
+    #[serde(default)]
+    pub logical_metrics_exact: bool,
     pub live_byte_samples: Vec<(Vec<u8>, u64)>,
     #[serde(default)]
     pub independently_recoverable: bool,
diff --git a/lib/crowdb-tree/ffi/src/page.rs b/lib/crowdb-tree/ffi/src/page.rs
index f967074cc..a354accf2 100644
--- a/lib/crowdb-tree/ffi/src/page.rs
+++ b/lib/crowdb-tree/ffi/src/page.rs
@@ -33,7 +33,7 @@ impl PageInspection {
         deltas: u32,
         frame: Vec<u8>,
     ) -> Result<Self, CtError> {
-        if frame.len() < 72 || frame.len() > 1024 * 1024 || !matches!(frame[4], 1 | 2) {
+        if frame.len() < 136 || frame.len() > 1024 * 1024 || !matches!(frame[4], 1 | 2) {
             return Err(CtError::Corruption);
         }
         let inner = frame[4] == 2;
@@ -79,7 +79,7 @@ impl PageInspection {
             let key = if index == 0 {
                 None
             } else {
-                let slot = 64 + (self.count + 1) * 8 + (index - 1) * 8;
+                let slot = 128 + (self.count + 1) * 8 + (index - 1) * 8;
                 Some(bytes(
                     &self.frame,
                     word(&self.frame, slot)? as usize,
@@ -88,7 +88,7 @@ impl PageInspection {
             };
             return Ok(PageEntry {
                 key,
-                child: Some(wide(&self.frame, 64 + index * 8)?),
+                child: Some(wide(&self.frame, 128 + index * 8)?),
                 cell: None,
                 inline_delta: false,
             });
@@ -97,7 +97,7 @@ impl PageInspection {
         let slot = if inline_delta {
             word(&self.frame, 12)? as usize + (index - self.count) * 12
         } else {
-            64 + index * 12
+            128 + index * 12
         };
         let start = word(&self.frame, slot)? as usize;
         let length = word(&self.frame, slot + 4)? as usize;
diff --git a/lib/crowdb-tree/include/crowdb-tree/btree/tree.h b/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
index 5a0a201c5..0c6af6afb 100644
--- a/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
+++ b/lib/crowdb-tree/include/crowdb-tree/btree/tree.h
@@ -615,6 +615,8 @@ class Crowdbtree
     void                  maybe_split_or_merge_locked(uint64_t page_id); // dispatch on leaf size
     void                  set_children_parent_locked(uint64_t page_id, uint64_t parent_page_id);
     void                  store_preserving_parent_locked(uint64_t page_id, PageBase *new_page);
+    void                  refresh_page_summary_locked(PageBase *page);
+    void                  refresh_subtree_summaries_locked(uint64_t page_id);
     void                  sync_page_count_gauges();
     std::vector<uint64_t> path_to_page_id_locked(uint64_t target_page_id) const;
     void                  split_leaf_to_threshold_locked(uint64_t leaf_page_id);
diff --git a/lib/crowdb-tree/include/crowdb-tree/maptable/frame_page.h b/lib/crowdb-tree/include/crowdb-tree/maptable/frame_page.h
index 8c3c33e36..df37ae9f5 100644
--- a/lib/crowdb-tree/include/crowdb-tree/maptable/frame_page.h
+++ b/lib/crowdb-tree/include/crowdb-tree/maptable/frame_page.h
@@ -38,11 +38,24 @@ inline constexpr uint8_t  kFrameHasLowerFence = 1U << 0U;
 inline constexpr uint8_t  kFrameHasUpperFence = 1U << 1U;
 inline constexpr uint8_t  kFrameFencePageIds  = 1U << 2U;
 
-inline constexpr size_t kFrameHeaderSize  = 64;
+inline constexpr size_t kFrameHeaderSize  = 128;
 inline constexpr size_t kFrameTrailerSize = 8;  // logical_len u32 + crc32c u32
 inline constexpr size_t kLeafSlotSize     = 12; // rec_off, key_len, cell_len (u32)
 inline constexpr size_t kInnerSlotSize    = 8;  // rec_off, key_len (u32)
 
+struct PageSummary
+{
+    uint64_t live_kv = 0;
+    uint64_t live_key_bytes = 0;
+    uint64_t live_value_bytes = 0;
+    uint64_t live_logical_bytes = 0;
+    uint64_t reachable_leaf_pages = 0;
+    uint64_t reachable_inner_pages = 0;
+    uint64_t reachable_overflow_pages = 0;
+    uint64_t reachable_page_capacity_bytes = 0;
+    bool exact = false;
+};
+
 // Header field byte offsets within a frame.
 namespace fh
 {
@@ -60,6 +73,15 @@ inline constexpr size_t kLowerFenceOff = 40; // u32
 inline constexpr size_t kLowerFenceLen = 44; // u32
 inline constexpr size_t kUpperFenceOff = 48; // u32
 inline constexpr size_t kUpperFenceLen = 52; // u32
+inline constexpr size_t kSummaryLiveKv = 64;
+inline constexpr size_t kSummaryLiveKeyBytes = 72;
+inline constexpr size_t kSummaryLiveValueBytes = 80;
+inline constexpr size_t kSummaryLiveLogicalBytes = 88;
+inline constexpr size_t kSummaryLeafPages = 96;
+inline constexpr size_t kSummaryInnerPages = 104;
+inline constexpr size_t kSummaryOverflowPages = 112;
+inline constexpr size_t kSummaryPageCapacityBytes = 120;
+inline constexpr size_t kSummaryFlags = 127;
 } // namespace fh
 
 // ── little-endian frame accessors ─────────────────────────────────
@@ -137,6 +159,8 @@ void frame_restamp_crc(uint8_t *f, uint32_t page_bytes);
 [[nodiscard]] uint64_t frame_upper_fence_page_id(const uint8_t *f);
 void                   frame_set_inner_fence_pages(uint8_t *f, uint32_t page_bytes, uint64_t lower_leaf_page_id,
                                                    uint64_t upper_leaf_page_id);
+[[nodiscard]] PageSummary frame_summary(const uint8_t *f);
+void frame_set_summary(uint8_t *f, uint32_t page_bytes, const PageSummary &summary);
 
 // ── Leaf view (zero-copy) ─────────────────────────────────────────
 class LeafFrameView
diff --git a/lib/crowdb-tree/include/crowdb-tree/maptable/page.h b/lib/crowdb-tree/include/crowdb-tree/maptable/page.h
index 38027485f..532cf568b 100644
--- a/lib/crowdb-tree/include/crowdb-tree/maptable/page.h
+++ b/lib/crowdb-tree/include/crowdb-tree/maptable/page.h
@@ -124,6 +124,26 @@ class LeafBase : public PageBase
             b.try_append_sorted(Slice(e.key), Slice(e.cell));
         }
         b.finish(p->page_id, right_sibling);
+        PageSummary summary;
+        summary.reachable_leaf_pages = 1;
+        summary.reachable_page_capacity_bytes = p->fs_.page_bytes;
+        for (const auto &e : sorted_entries) {
+            CellView cell{Slice(e.cell)};
+            if (cell.is_tombstone()) {
+                continue;
+            }
+            ++summary.live_kv;
+            summary.live_key_bytes += e.key.size();
+            const uint64_t value_bytes = cell.is_overflow() ? cell.overflow_len() : cell.value().size();
+            summary.live_value_bytes += value_bytes;
+            if (cell.is_overflow()) {
+                summary.reachable_overflow_pages +=
+                    (value_bytes + overflow_chunk_cap(p->fs_.page_bytes) - 1) / overflow_chunk_cap(p->fs_.page_bytes);
+            }
+            summary.live_logical_bytes += e.key.size() + value_bytes;
+        }
+        summary.exact = true;
+        frame_set_summary(dst, p->fs_.page_bytes, summary);
         return p;
     }
 
@@ -230,6 +250,16 @@ class LeafBase : public PageBase
         return view().lookup(key, out);
     }
 
+    [[nodiscard]] PageSummary summary() const
+    {
+        return frame_summary(fs_.ptr);
+    }
+
+    void set_summary(const PageSummary &summary) const
+    {
+        frame_set_summary(fs_.ptr, fs_.page_bytes, summary);
+    }
+
     [[nodiscard]] size_t lower_bound(Slice key) const
     {
         return view().lower_bound(key);
@@ -346,6 +376,16 @@ class InnerBase : public PageBase
         return view().child_for(key);
     }
 
+    [[nodiscard]] PageSummary summary() const
+    {
+        return frame_summary(fs_.ptr);
+    }
+
+    void set_summary(const PageSummary &summary) const
+    {
+        frame_set_summary(fs_.ptr, fs_.page_bytes, summary);
+    }
+
   private:
     FrameStore fs_;
 };
@@ -409,6 +449,16 @@ class OverflowBase : public PageBase
         return view().payload();
     }
 
+    [[nodiscard]] PageSummary summary() const
+    {
+        return frame_summary(fs_.ptr);
+    }
+
+    void set_summary(const PageSummary &summary) const
+    {
+        frame_set_summary(fs_.ptr, fs_.page_bytes, summary);
+    }
+
   private:
     FrameStore fs_;
 };
diff --git a/lib/crowdb-tree/src/btree/crowdb-tree.cpp b/lib/crowdb-tree/src/btree/crowdb-tree.cpp
index eca7a7654..dc97a77fa 100644
--- a/lib/crowdb-tree/src/btree/crowdb-tree.cpp
+++ b/lib/crowdb-tree/src/btree/crowdb-tree.cpp
@@ -719,7 +719,130 @@ void Crowdbtree::store_preserving_parent_locked(uint64_t page_id, PageBase *new_
         new_page->parent_page_id = old->parent_page_id;
         preserve_native_page_locked(page_id, old);
     }
+    refresh_page_summary_locked(new_page);
     mapping_.store(page_id, new_page);
+    uint64_t parent_id = new_page->parent_page_id;
+    while (parent_id != kInvalidPageId) {
+        PageBase *parent = resident(parent_id);
+        if (parent == nullptr || parent->type != page_type::kInnerBase) {
+            break;
+        }
+        refresh_page_summary_locked(parent);
+        const uint64_t next_parent = parent->parent_page_id;
+        mapping_.store(parent_id, parent);
+        parent_id = next_parent;
+    }
+}
+
+void Crowdbtree::refresh_page_summary_locked(PageBase *page)
+{
+    if (page == nullptr) {
+        return;
+    }
+    if (page->type == page_type::kLeafBase) {
+        auto *leaf = static_cast<LeafBase *>(page);
+        PageSummary summary = leaf->summary();
+        if (leaf->view().delta_count() != 0) {
+            summary.exact = false;
+        }
+        summary.reachable_leaf_pages = 1;
+        summary.reachable_inner_pages = 0;
+        summary.reachable_page_capacity_bytes = leaf->page_bytes();
+        leaf->set_summary(summary);
+        return;
+    }
+    if (page->type == page_type::kOverflowFrame) {
+        auto *overflow = static_cast<OverflowBase *>(page);
+        PageSummary summary;
+        summary.reachable_overflow_pages = 1;
+        summary.reachable_page_capacity_bytes = overflow->page_bytes();
+        summary.exact = true;
+        overflow->set_summary(summary);
+        return;
+    }
+    if (page->type != page_type::kInnerBase) {
+        return;
+    }
+    PageSummary aggregate;
+    aggregate.reachable_inner_pages = 1;
+    aggregate.reachable_page_capacity_bytes = static_cast<InnerBase *>(page)->page_bytes();
+    aggregate.exact = true;
+    for (uint64_t child_id : static_cast<InnerBase *>(page)->children()) {
+        PageBase *child = resident(child_id);
+        if (child == nullptr) {
+            aggregate.exact = false;
+            continue;
+        }
+        PageBase *base = child;
+        while (base->type == page_type::kBatchDelta && base->next != nullptr) {
+            base = base->next;
+        }
+        PageSummary child_summary;
+        if (base->type == page_type::kLeafBase) {
+            child_summary = static_cast<LeafBase *>(base)->summary();
+        }
+        else if (base->type == page_type::kInnerBase) {
+            child_summary = static_cast<InnerBase *>(base)->summary();
+        }
+        else {
+            aggregate.exact = false;
+            continue;
+        }
+        aggregate.live_kv += child_summary.live_kv;
+        aggregate.live_key_bytes += child_summary.live_key_bytes;
+        aggregate.live_value_bytes += child_summary.live_value_bytes;
+        aggregate.live_logical_bytes += child_summary.live_logical_bytes;
+        aggregate.reachable_leaf_pages += child_summary.reachable_leaf_pages;
+        aggregate.reachable_inner_pages += child_summary.reachable_inner_pages;
+        aggregate.reachable_overflow_pages += child_summary.reachable_overflow_pages;
+        aggregate.reachable_page_capacity_bytes += child_summary.reachable_page_capacity_bytes;
+        aggregate.exact = aggregate.exact && child_summary.exact;
+    }
+    static_cast<InnerBase *>(page)->set_summary(aggregate);
+}
+
+void Crowdbtree::refresh_subtree_summaries_locked(uint64_t page_id)
+{
+    PageBase *page = resident(page_id);
+    if (page == nullptr) {
+        return;
+    }
+    PageBase *base = page;
+    while (base->type == page_type::kBatchDelta && base->next != nullptr) {
+        base = base->next;
+    }
+    if (base->type == page_type::kInnerBase) {
+        for (uint64_t child : static_cast<InnerBase *>(base)->children()) {
+            refresh_subtree_summaries_locked(child);
+        }
+    }
+    PageSummary before;
+    if (base->type == page_type::kLeafBase) {
+        before = static_cast<LeafBase *>(base)->summary();
+    }
+    else if (base->type == page_type::kInnerBase) {
+        before = static_cast<InnerBase *>(base)->summary();
+    }
+    refresh_page_summary_locked(base);
+    PageSummary after;
+    if (base->type == page_type::kLeafBase) {
+        after = static_cast<LeafBase *>(base)->summary();
+    }
+    else if (base->type == page_type::kInnerBase) {
+        after = static_cast<InnerBase *>(base)->summary();
+    }
+    const bool changed = before.live_kv != after.live_kv || before.live_key_bytes != after.live_key_bytes ||
+                         before.live_value_bytes != after.live_value_bytes ||
+                         before.live_logical_bytes != after.live_logical_bytes ||
+                         before.reachable_leaf_pages != after.reachable_leaf_pages ||
+                         before.reachable_inner_pages != after.reachable_inner_pages ||
+                         before.reachable_overflow_pages != after.reachable_overflow_pages ||
+                         before.reachable_page_capacity_bytes != after.reachable_page_capacity_bytes ||
+                         before.exact != after.exact;
+    if (changed) {
+        base->durable_addr = kNoAddr;
+        mapping_.store(base->page_id, base);
+    }
 }
 
 std::vector<uint64_t> Crowdbtree::path_to_page_id_locked(uint64_t target_page_id) const
@@ -874,6 +997,7 @@ void Crowdbtree::split_leaf_locked(uint64_t leaf_page_id, std::vector<uint64_t>
     // whole path is repointed do we shrink `leaf_page_id` to the lower half.
     uint64_t  right_page_id = mapping_.allocate_page_id();
     LeafBase *right         = LeafBase::build(hi, leaf->right_sibling(), pool_, opt_.frame_bytes);
+    refresh_page_summary_locked(right);
     mapping_.store(right_page_id, right);
     propagate_split_locked(std::move(path), leaf_page_id, std::move(sep), right_page_id);
 
@@ -890,8 +1014,9 @@ void Crowdbtree::propagate_split_locked(std::vector<uint64_t> path, uint64_t chi
     if (path.empty()) {
         // child was the root: grow a new root one level up.
         uint64_t new_root = mapping_.allocate_page_id();
-        mapping_.store(new_root,
-                       InnerBase::build({std::move(sep)}, {child_page_id, right_page_id}, pool_, opt_.frame_bytes));
+        InnerBase *root = InnerBase::build({std::move(sep)}, {child_page_id, right_page_id}, pool_, opt_.frame_bytes);
+        refresh_page_summary_locked(root);
+        mapping_.store(new_root, root);
         root_page_id_.store(new_root);
         // O4: set parent pointers on the new root's children.
         set_children_parent_locked(new_root, new_root);
@@ -935,7 +1060,9 @@ void Crowdbtree::propagate_split_locked(std::vector<uint64_t> path, uint64_t chi
 
     uint64_t rinner_page_id = mapping_.allocate_page_id();
     store_preserving_parent_locked(parent_page_id, InnerBase::build(lseps, lchildren, pool_, opt_.frame_bytes));
-    mapping_.store(rinner_page_id, InnerBase::build(rseps, rchildren, pool_, opt_.frame_bytes));
+    InnerBase *rinner = InnerBase::build(rseps, rchildren, pool_, opt_.frame_bytes);
+    refresh_page_summary_locked(rinner);
+    mapping_.store(rinner_page_id, rinner);
     retire_page(parent);
     // O4: set parent pointers on children of both split inner pages.
     set_children_parent_locked(parent_page_id, parent_page_id);
@@ -4139,6 +4266,7 @@ uint64_t Crowdbtree::spill_value_to_overflow_chain_locked(const std::string &val
         uint32_t      len  = static_cast<uint32_t>(std::min<size_t>(cap, n - off));
         OverflowBase *page = OverflowBase::build(next, reinterpret_cast<const uint8_t *>(value.data() + off), len,
                                                  pool_, opt_.frame_bytes);
+        refresh_page_summary_locked(page);
         mapping_.store(pids[i], page);
         next = pids[i];
     }
diff --git a/lib/crowdb-tree/src/maptable/frame_page.cpp b/lib/crowdb-tree/src/maptable/frame_page.cpp
index 8294d189d..2e2f515c8 100644
--- a/lib/crowdb-tree/src/maptable/frame_page.cpp
+++ b/lib/crowdb-tree/src/maptable/frame_page.cpp
@@ -83,6 +83,38 @@ void frame_set_inner_fence_pages(uint8_t *f, uint32_t page_bytes, uint64_t lower
     stamp_trailer(f, page_bytes);
 }
 
+PageSummary frame_summary(const uint8_t *f)
+{
+    PageSummary out;
+    if (f == nullptr || f[fh::kFormatVersion] != kFrameVersion || f[fh::kSummaryFlags] == 0) {
+        return out;
+    }
+    out.live_kv = frame_u64(f, fh::kSummaryLiveKv);
+    out.live_key_bytes = frame_u64(f, fh::kSummaryLiveKeyBytes);
+    out.live_value_bytes = frame_u64(f, fh::kSummaryLiveValueBytes);
+    out.live_logical_bytes = frame_u64(f, fh::kSummaryLiveLogicalBytes);
+    out.reachable_leaf_pages = frame_u64(f, fh::kSummaryLeafPages);
+    out.reachable_inner_pages = frame_u64(f, fh::kSummaryInnerPages);
+    out.reachable_overflow_pages = frame_u64(f, fh::kSummaryOverflowPages);
+    out.reachable_page_capacity_bytes = frame_u64(f, fh::kSummaryPageCapacityBytes);
+    out.exact = true;
+    return out;
+}
+
+void frame_set_summary(uint8_t *f, uint32_t page_bytes, const PageSummary &summary)
+{
+    frame_put_u64(f, fh::kSummaryLiveKv, summary.live_kv);
+    frame_put_u64(f, fh::kSummaryLiveKeyBytes, summary.live_key_bytes);
+    frame_put_u64(f, fh::kSummaryLiveValueBytes, summary.live_value_bytes);
+    frame_put_u64(f, fh::kSummaryLiveLogicalBytes, summary.live_logical_bytes);
+    frame_put_u64(f, fh::kSummaryLeafPages, summary.reachable_leaf_pages);
+    frame_put_u64(f, fh::kSummaryInnerPages, summary.reachable_inner_pages);
+    frame_put_u64(f, fh::kSummaryOverflowPages, summary.reachable_overflow_pages);
+    frame_put_u64(f, fh::kSummaryPageCapacityBytes, summary.reachable_page_capacity_bytes);
+    f[fh::kSummaryFlags] = summary.exact ? 1 : 0;
+    frame_restamp_crc(f, page_bytes);
+}
+
 bool frame_set_fences(uint8_t *f, uint32_t page_bytes, const Slice *lower, const Slice *upper)
 {
     if (f == nullptr || page_bytes <= kFrameHeaderSize + kFrameTrailerSize) {
diff --git a/lib/crowdb-tree/src/snapshot/persist.cpp b/lib/crowdb-tree/src/snapshot/persist.cpp
index da8c7c651..2c76674ca 100644
--- a/lib/crowdb-tree/src/snapshot/persist.cpp
+++ b/lib/crowdb-tree/src/snapshot/persist.cpp
@@ -548,6 +548,26 @@ Status Crowdbtree::prepare_snapshot_locked(PreparedSnapshot *out, std::vector<Pr
         ctx.forced_segment_images.insert(pf.page_id / MappingTable::kSegmentSize);
     }
 
+    // Fold and refresh all summaries before any page blob is encoded.
+    for (uint64_t seg_idx = 0; seg_idx < MappingTable::kMaxSegments; ++seg_idx) {
+        MappingSegment *segment = mapping_.segment_at(seg_idx);
+        if (segment == nullptr) {
+            continue;
+        }
+        for (uint32_t slot = 0; slot < segment->slot_count; ++slot) {
+            const uint64_t page_id = seg_idx * MappingTable::kSegmentSize + slot;
+            uint64_t word = segment->slots[slot].load(std::memory_order_relaxed);
+            if (!slot_word::is_resident(word)) {
+                continue;
+            }
+            PageBase *page = slot_word::resident_ptr(word);
+            Status fold = fold_snapshot_page_locked(page_id, gc, &page);
+            if (!fold.ok()) {
+                return fold;
+            }
+        }
+    }
+    refresh_subtree_summaries_locked(root_page_id_.load(std::memory_order_acquire));
     Status pages = prepare_snapshot_pages_locked(ctx);
     if (!pages.ok()) {
         return pages;
@@ -573,7 +593,7 @@ Status Crowdbtree::fold_snapshot_page_locked(uint64_t page_id, uint64_t gc, Page
         uint64_t              right = static_cast<LeafBase *>(base)->right_sibling();
         std::vector<uint64_t> dead_overflow;
         LeafBase *fresh = build_leaf_spilling_locked(resolve_leaf_chain_for_rebuild(*page, gc, &dead_overflow), right);
-        mapping_.store(page_id, fresh);
+        store_preserving_parent_locked(page_id, fresh);
         for (PageBase *node = *page; node != nullptr;) {
             PageBase *next = node->next;
             retire_page(node);
@@ -608,7 +628,7 @@ Status Crowdbtree::fold_snapshot_page_locked(uint64_t page_id, uint64_t gc, Page
     size_t                dropped = 0;
     LeafBase *fresh = build_leaf_spilling_locked(resolve_leaf_chain_for_rebuild(*page, gc, &dead_overflow, &dropped),
                                                  leaf->right_sibling());
-    mapping_.store(page_id, fresh);
+    store_preserving_parent_locked(page_id, fresh);
     retire_page(*page);
     for (uint64_t head : dead_overflow) {
         retire_overflow_chain_locked(head);
@@ -1271,33 +1291,26 @@ Status Crowdbtree::snapshot(uint64_t *out_last_applied, uint64_t *out_snapshot_s
     finalize_prepared_snapshot(prepared);
 
     // Publish the exact logical summary only after the root anchor is durable.
-    if (auto view = snapshot_view(); view != nullptr) {
-        uint64_t live_kv     = 0;
-        uint64_t key_bytes   = 0;
-        uint64_t value_bytes = 0;
-        for (const auto &entry : view->entries()) {
-            CellView cell{Slice(entry.cell)};
-            if (cell.is_tombstone()) {
-                continue;
-            }
-            ++live_kv;
-            key_bytes += entry.key.size();
-            value_bytes += cell.value().size();
-        }
-        summary_live_kv_.store(live_kv, std::memory_order_release);
-        summary_live_key_bytes_.store(key_bytes, std::memory_order_release);
-        summary_live_value_bytes_.store(value_bytes, std::memory_order_release);
-        summary_live_logical_bytes_.store(key_bytes + value_bytes, std::memory_order_release);
-        const uint64_t structural_pages =
-            leaf_count_.load(std::memory_order_relaxed) + inner_count_.load(std::memory_order_relaxed);
-        summary_reachable_overflow_pages_.store(
-            prepared.live_page_count > structural_pages ? prepared.live_page_count - structural_pages : 0,
-            std::memory_order_release);
-        summary_reachable_page_capacity_bytes_.store(prepared.live_page_count * static_cast<uint64_t>(opt_.frame_bytes),
-                                                     std::memory_order_release);
-        summary_covered_slot_.store(prepared.last_applied_slot, std::memory_order_release);
-        summary_root_version_.store(version_.load(std::memory_order_acquire), std::memory_order_release);
-        summary_available_.store(true, std::memory_order_release);
+    if (PageBase *root = resident(root_page_id_.load(std::memory_order_acquire)); root != nullptr) {
+        PageSummary summary;
+        if (root->type == page_type::kLeafBase) {
+            summary = static_cast<LeafBase *>(root)->summary();
+        }
+        else if (root->type == page_type::kInnerBase) {
+            summary = static_cast<InnerBase *>(root)->summary();
+        }
+        if (summary.exact) {
+            summary_live_kv_.store(summary.live_kv, std::memory_order_release);
+            summary_live_key_bytes_.store(summary.live_key_bytes, std::memory_order_release);
+            summary_live_value_bytes_.store(summary.live_value_bytes, std::memory_order_release);
+            summary_live_logical_bytes_.store(summary.live_logical_bytes, std::memory_order_release);
+            summary_reachable_overflow_pages_.store(summary.reachable_overflow_pages, std::memory_order_release);
+            summary_reachable_page_capacity_bytes_.store(summary.reachable_page_capacity_bytes,
+                                                         std::memory_order_release);
+            summary_covered_slot_.store(prepared.last_applied_slot, std::memory_order_release);
+            summary_root_version_.store(prepared.seq, std::memory_order_release);
+            summary_available_.store(true, std::memory_order_release);
+        }
     }
 
     release_snapshot_slot();
@@ -1718,38 +1731,30 @@ Status Crowdbtree::open(const Config &opt, std::unique_ptr<Crowdbtree> *out)
 
     // Reconstruct the cached summary from the selected durable root. This is
     // startup work only; ordinary reads never scan the tree for statistics.
-    if (auto view = tree->snapshot_view(); view != nullptr) {
-        uint64_t live_kv     = 0;
-        uint64_t key_bytes   = 0;
-        uint64_t value_bytes = 0;
-        for (const auto &entry : view->entries()) {
-            CellView cell{Slice(entry.cell)};
-            if (cell.is_tombstone()) {
-                continue;
-            }
-            ++live_kv;
-            key_bytes += entry.key.size();
-            value_bytes += cell.value().size();
-        }
-        tree->summary_live_kv_.store(live_kv, std::memory_order_release);
-        tree->summary_live_key_bytes_.store(key_bytes, std::memory_order_release);
-        tree->summary_live_value_bytes_.store(value_bytes, std::memory_order_release);
-        tree->summary_live_logical_bytes_.store(key_bytes + value_bytes, std::memory_order_release);
-        uint64_t live_page_count = 0;
-        for (uint64_t seg_idx = 0; seg_idx < MappingTable::kMaxSegments; ++seg_idx) {
-            if (auto *segment = tree->mapping_.segment_at(seg_idx); segment != nullptr) {
-                live_page_count += segment->live_count.load(std::memory_order_relaxed);
-            }
+    if (PageBase *root = tree->resident(anchor.root_page_id); root != nullptr) {
+        PageSummary summary;
+        if (root->type == page_type::kLeafBase) {
+            summary = static_cast<LeafBase *>(root)->summary();
+        }
+        else if (root->type == page_type::kInnerBase) {
+            summary = static_cast<InnerBase *>(root)->summary();
+        }
+        if (summary.exact) {
+            tree->summary_live_kv_.store(summary.live_kv, std::memory_order_release);
+            tree->summary_live_key_bytes_.store(summary.live_key_bytes, std::memory_order_release);
+            tree->summary_live_value_bytes_.store(summary.live_value_bytes, std::memory_order_release);
+            tree->summary_live_logical_bytes_.store(summary.live_logical_bytes, std::memory_order_release);
+            tree->summary_reachable_overflow_pages_.store(summary.reachable_overflow_pages, std::memory_order_release);
+            tree->summary_reachable_page_capacity_bytes_.store(summary.reachable_page_capacity_bytes,
+                                                               std::memory_order_release);
+            tree->summary_covered_slot_.store(anchor.last_applied_slot, std::memory_order_release);
+            tree->summary_root_version_.store(anchor.snapshot_seq, std::memory_order_release);
+            tree->summary_available_.store(true, std::memory_order_release);
         }
-        const uint64_t structural_pages =
-            tree->leaf_count_.load(std::memory_order_relaxed) + tree->inner_count_.load(std::memory_order_relaxed);
-        tree->summary_reachable_overflow_pages_.store(
-            live_page_count > structural_pages ? live_page_count - structural_pages : 0, std::memory_order_release);
-        tree->summary_reachable_page_capacity_bytes_.store(live_page_count * static_cast<uint64_t>(opt.frame_bytes),
-                                                           std::memory_order_release);
-        tree->summary_covered_slot_.store(anchor.last_applied_slot, std::memory_order_release);
-        tree->summary_root_version_.store(anchor.snapshot_seq, std::memory_order_release);
-        tree->summary_available_.store(true, std::memory_order_release);
+        // Reopen must keep lazy recovery lazy: the root was loaded only to
+        // read its persisted summary, so release it before returning.
+        (void)tree->evict_clean_inner(0);
+        (void)tree->evict_clean_leaves(0);
     }
 
     CRB_LOG_INFO("[{}] open: recovered seq={} last_applied={} root_pid={} segments={}", opt.name, anchor.snapshot_seq,
diff --git a/lib/crowdb-tree/tests/integration/persist_test.cpp b/lib/crowdb-tree/tests/integration/persist_test.cpp
index 1ce639d02..01f47c3a4 100644
--- a/lib/crowdb-tree/tests/integration/persist_test.cpp
+++ b/lib/crowdb-tree/tests/integration/persist_test.cpp
@@ -207,6 +207,36 @@ TEST(Persist, TreeSummaryTracksDurableRootAndRejectsUnknownAsZero)
     EXPECT_EQ(t.tree_summary().live_kv, 1U);
 }
 
+TEST(Persist, TreeSummaryAggregatesPersistedInnerPages)
+{
+    MemPageStore store(1);
+    Config opt;
+    opt.page_store = &store;
+    opt.leaf_split_bytes = 256;
+    Crowdbtree t(opt);
+    for (uint64_t slot = 1; slot <= 80; ++slot) {
+        ASSERT_TRUE(t.apply(slot, put_one(make_key(static_cast<int>(slot)), "value")).ok());
+    }
+    ASSERT_TRUE(t.flush().ok());
+    ASSERT_TRUE(t.snapshot().ok());
+    const auto summary = t.tree_summary();
+    EXPECT_TRUE(summary.exact);
+    EXPECT_EQ(summary.live_kv, 80U);
+    EXPECT_GT(summary.reachable_leaf_pages, 1U);
+    EXPECT_GT(summary.reachable_inner_pages, 0U);
+    EXPECT_EQ(summary.live_logical_bytes, summary.live_key_bytes + summary.live_value_bytes);
+
+    std::unique_ptr<Crowdbtree> reopened;
+    ASSERT_TRUE(Crowdbtree::open(opt, &reopened).ok());
+    const auto reopened_summary = reopened->tree_summary();
+    EXPECT_EQ(reopened_summary.root_version, summary.root_version);
+    EXPECT_EQ(reopened_summary.covered_slot, summary.covered_slot);
+    EXPECT_EQ(reopened_summary.live_kv, summary.live_kv);
+    EXPECT_EQ(reopened_summary.live_logical_bytes, summary.live_logical_bytes);
+    EXPECT_EQ(reopened_summary.reachable_leaf_pages, summary.reachable_leaf_pages);
+    EXPECT_EQ(reopened_summary.reachable_inner_pages, summary.reachable_inner_pages);
+}
+
 // clear() must wipe every key and reset watermarks back
 // to a fresh empty tree, in-memory only (no persist() call here) -- proving
 // the wipe itself, independent of durability.

From 1d92cb69c17ddf93059478ca2a8c20f9fb50461a Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 16:13:11 +0800
Subject: [PATCH 06/11] Finalize chunk KV cutover cleanup

---
 doc/backlog/R228-tree-range-metrics.md        | 153 -----------
 doc/backlog/backlog.md                        |   4 -
 doc/working/plan-chunk-kv-cutover.md          | 255 ------------------
 doc/working/plan-test-task-completeness.md    |   2 +-
 doc/working/plan-tree-range-metrics.md        |  19 --
 doc/working/test.md                           |   6 +-
 lib/crowdb-chunk-kv/src/memory.rs             |   5 +
 .../src/partition/split/recovery.rs           |  12 +
 .../src/partition/split/stable_session.rs     |  50 ++--
 lib/crowdb-chunk-kv/src/partition/tree.rs     |  10 +
 10 files changed, 55 insertions(+), 461 deletions(-)
 delete mode 100644 doc/backlog/R228-tree-range-metrics.md
 delete mode 100644 doc/working/plan-chunk-kv-cutover.md
 delete mode 100644 doc/working/plan-tree-range-metrics.md

diff --git a/doc/backlog/R228-tree-range-metrics.md b/doc/backlog/R228-tree-range-metrics.md
deleted file mode 100644
index 3ad294bed..000000000
--- a/doc/backlog/R228-tree-range-metrics.md
+++ /dev/null
@@ -1,153 +0,0 @@
-<!-- Copyright 2026-present Gian <crow.db@outlook.com> -->
-<!-- Licensed under the Apache License, Version 2.0. -->
-
-### R228: crowdb-tree — Root and range statistics for split and placement
-
-Status: Complete. Exact durable-root summaries now include logical bytes and
-reachable overflow/page-capacity accounting through the C API/Rust FFI;
-persisted child aggregates feed cached Chunk-KV observations and conservative
-size-driven split decisions.
-
-## Problem
-
-[Tree storage design](../design/tree/design-crowdb-tree-storage.md) defines leaf
-records and inner separators/child PIDs. Leaves expose local base-record and delta
-counts; inner pages do not carry child-subtree page, byte or live-KV aggregates.
-The existing tree Stats API reports buffer-pool, flush and snapshot activity,
-not current reachable tree size or current live record count. Snapshot pages
-written, resident cache pages and cumulative writes are not these metrics.
-
-[Chunk-KV placement](../design/chunkds/design-crowdb-chunk-kv-server.md) currently
-balances assigned split counts. Automatic split supplements the partition-count
-target with coarse retained-pack size thresholds/ranking. Those pack estimates
-lag ordinary flushes, and split trees share historical chunks. They cannot
-reliably determine the current range's data size or justify size-driven split.
-Dividing an old estimate by a split ratio and accumulating later writes also
-accumulates error without a structural calibration point.
-
-A growing tree needs continuous, reasonably accurate size metrics to decide
-whether another split is needed. Parent and child need independent range
-statistics even while they share physical packs. Overwrites, deletes and
-compaction must not make a historical estimate permanently drift.
-
-## Solution
-
-- **TREE-METRICS-ROOT:** Metrics describe a specific current tree root/version
-  and its key range. Report observation/root identity and coverage frontier;
-  do not silently mix roots, epochs or ranges. Memtable and WAL sizes do not
-  contribute to tree size. Writes enter tree metrics when the normal flush
-  incorporates them; callers must see this coverage boundary.
-- **TREE-METRICS-LOGICAL:** Distinguish reachable inner, leaf, overflow and delta
-  page counts; reachable page bytes; live KV count; live key/value bytes; and
-  physical retained/shared pack storage. Logical range data and physical
-  storage are separate metrics. A key's current visible value counts once;
-  overwritten versions and tombstones do not count as live KV/data. Overflow
-  data must contribute even when stored outside a leaf. State any approximation
-  and its source explicitly rather than claiming exact live bytes.
-- **TREE-METRICS-STRUCTURAL:** Carry child-subtree aggregates in index metadata
-  so a full-tree/root aggregate or a range estimate can be obtained from index
-  pages without scanning leaf records or values. Leaf summaries originate from
-  existing rebuild/fold/flush work. Aggregates can be rebuilt from current
-  structure, not cumulative writes or recursively inherited split ratios.
-  A range boundary crossing a leaf may produce a documented bounded estimate;
-  report that uncertainty rather than extrapolating arbitrary key samples.
-- **TREE-METRICS-NONBLOCKING:** Maintain summaries through existing single-writer
-  flush/page rebuild work. Do not add request-path locks, wait queues, per-key
-  ancestor walks, forced flush/checkpoint, or synchronous remote scans to
-  heartbeat or balance. Background index traversal is bounded and cancellable;
-  heartbeat reads cached identity-fenced results and never waits for traversal.
-  Review additional write amplification, atomic bookkeeping and memory costs.
-- **TREE-METRICS-SHARING:** Split evaluates each resulting root/range's logical
-  data; shared historical chunks are not counted as both ranges' logical data.
-  Transfer preserves metrics for the same logical tree/range. Cleanup/GC of
-  historical physical packs does not reduce current live logical data.
-- **TREE-METRICS-RECOVERY:** Persist summaries consistently with their page/root
-  publication. Reopen reconstructs/verifies metrics against the selected root.
-  Abort or failed publication cannot install candidate statistics on the serving
-  root. Legacy pages without summaries report unavailable until bounded rebuild;
-  unknown is never zero and never authorizes a size-driven split or move.
-
-1. Define metric semantics and coverage in the tree storage design, and review
-   the persisted index/leaf summary format and legacy compatibility. Name the
-   range-boundary error model and separate live logical data from page capacity.
-2. Extend tree page builders/rebuild/flush and root publication to maintain and
-   aggregate summaries. Include overwrite, delete, delta folding, overflow,
-   range narrowing, split, transfer, compaction and reopen. Avoid new hot-path
-   synchronization; measure cost before accepting the maintenance strategy.
-3. Expose cached root/range statistics through the C API, Rust FFI and chunk-KV
-   runtime/heartbeat. Index traversal must have page/I/O/time budgets and expose
-   progress, freshness, unavailable state and identity fences.
-4. Replace retained-pack split size triggering/ranking with these tree metrics;
-   retain safe nonempty separator selection and count-target bootstrap. Use
-   logical-byte distribution to improve boundary selection when summaries allow
-   it, without promising perfectly equal ranges or scanning leaf values.
-5. Re-enable data-weighted placement only after metrics acceptance, with explicit
-   coefficients/tolerance and no count-only pass that reverses useful data moves.
-   Update the console spec before restoring Weight, including metric coverage,
-   uncertainty and the actual split/move decision explanation.
-
-## Dependencies
-
-- Existing tree/root publication and chunk-KV parent-plus-child recovery remain
-  authoritative. This work must not redefine handoff, WAL or catalog cutover.
-- Tree storage/engine and Chunk-KV server designs are upstream contracts.
-- Shared-pack reclamation is separate from logical statistics; it is not required
-  to obtain a range estimate and must not be used to force a physical copy.
-- Until implemented, placement uses split count only and UI hides Weight. The
-  count-target split path remains available; coarse pack sizing remains an
-  explicitly limited interim mechanism, not a reliable current-data metric.
-
-## Acceptance
-
-- Empty tree -> read metrics -> known zero live KV/data and documented structural
-  root-page cost, distinct from unavailable. TREE-METRICS-LOGICAL. Unit test.
-- Known records with overflow values -> normal flush and aggregate via indexes
-  -> expected live count/bytes and reachable page categories without value reads.
-  TREE-METRICS-STRUCTURAL. Integration test.
-- Same keys repeatedly overwritten/deleted -> normal fold/flush -> current live
-  metrics reflect latest state, not accumulated writes; WAL-only changes leave
-  tree metrics unchanged and coverage explicit. TREE-METRICS-ROOT. Integration test.
-- Uneven range tree -> split while sharing old packs -> parent/child statistics
-  describe their own ranges within declared boundary error; aggregate does not
-  duplicate shared physical pack bytes as logical data. TREE-METRICS-SHARING.
-  Integration test.
-- Publish root, crash/reopen and replay/flush -> metrics follow selected root and
-  coverage; fail/abort candidate publication -> serving statistics unchanged.
-  TREE-METRICS-RECOVERY. Integration test.
-- Legacy/cold tree -> bounded index traversal with cancellation -> no leaf/value
-  scan or unbounded heartbeat wait; unavailable/freshness and progress explicit.
-  TREE-METRICS-NONBLOCKING. Integration test.
-- Repeated split, overwrite, delete, compaction and reopen -> rebuild aggregates
-  from current structure -> no history-dependent drift; stale root/range results
-  rejected. TREE-METRICS-STRUCTURAL. Integration test.
-- Known growing tree -> normal flush crosses configured logical-byte threshold
-  -> eligible split planned; below threshold or unknown -> no size-triggered split;
-  count-target bootstrap remains independently tested. Integration test.
-- Metrics accepted, explicit data-weight policy enabled -> weighted move/split
-  decisions use matching cached statistics; console shows the backend decision,
-  coverage and estimate qualification. E2E test.
-- Fixed read/write/flush workload -> compare before/after -> report throughput,
-  latency, page writes, memory, index I/O and traversal budgets; no new request
-  locks, queues or forced checkpoint. Integration test.
-
-## Decisions
-
-- The unpublished frame format remains `format_version = 1`; the existing
-  header is extended in place with persisted page summaries. No v2 parser or
-  legacy compatibility path is required.
-- Crossing-leaf range estimates use the conservative policy: complete child
-  summaries are added, while an unavailable or partial boundary child makes the
-  result inexact. Unknown metrics never trigger a size-driven split or move.
-  Count-target bootstrap remains independent of metric exactness.
-
-Verification commands:
-
-- `pixi run test-cpp`
-- `pixi run cargo test -p crowdb-tree-ffi`
-- `pixi run cargo test -p crowdb-chunk-kv-server --test balance_test`
-- `pixi run cargo test -p crowdb-kv-server --test chunk_kv_balance_planning_test`
-- `pixi run cargo test -p crowdb-web --test native_cluster_provisioning_test`
-- `pixi run tree-fmt`
-- `pixi run tree-lint`
-- `pixi run rs-fmt-check`
-- `pixi run cargo clippy -p crowdb-tree-ffi -p crowdb-chunk-kv-server -p crowdb-kv-server -p crowdb-web --all-targets -- -D warnings`
diff --git a/doc/backlog/backlog.md b/doc/backlog/backlog.md
index a1799781e..be0c8859d 100644
--- a/doc/backlog/backlog.md
+++ b/doc/backlog/backlog.md
@@ -114,7 +114,3 @@ live in the linked document; implementation follows
 - **[R60](R60-tree-scan-sibling-leaf-readahead.md)** — sibling-leaf readahead on
   cold scans. **Area:** crowdb-tree / scan / DiskIO. **Complexity:** Medium.
   **Status:** Deferred pending cold file/block-backed measurements.
-- **[R228](R228-tree-range-metrics.md)** — root/range page, logical-byte and live-KV
-  metrics for continuous split sizing and data-weight placement. **Area:** tree /
-  chunk-KV / console. **Complexity:** High. **Status:** Deferred implementation
-  pending statistics-format/performance review; count placement remains enabled.
diff --git a/doc/working/plan-chunk-kv-cutover.md b/doc/working/plan-chunk-kv-cutover.md
deleted file mode 100644
index a7ca09015..000000000
--- a/doc/working/plan-chunk-kv-cutover.md
+++ /dev/null
@@ -1,255 +0,0 @@
-<!-- Copyright 2026-present Gian <crow.db@outlook.com> -->
-<!-- Licensed under the Apache License, Version 2.0. -->
-
-# Chunk KV Cutover Plan
-
-Upstream: [Chunk KV Server design](../design/chunkds/design-crowdb-chunk-kv-server.md),
-sections 6–9. Results: [intel7960 test matrix](test.md).
-Goal: recover split/transfer at durable boundaries without lost writes, and
-make automatic placement stable, inexpensive and explainable.
-
-Temporary plan: completed implementation detail is condensed below; historical
-source and evidence remain in local commits and the referenced artifacts.
-Delete this plan after the remaining audits and acceptance are complete.
-
-## Current placement decision — 2026-10-09
-
-- R228 remains deferred by the user. R229 membership CAS was completed
-  separately on 2026-10-10; continue only the Console/native acceptance and
-  cutover audits here.
-- Data Weight is deferred to [tree range metrics](../backlog/R228-tree-range-metrics.md).
-  Placement uses split counts with existing tolerance/cooldown; byte coefficient
-  must be zero. Console Weight and weighted explanation are hidden.
-- Tree metrics implementation is not part of this cutover work. No tree writer,
-  split/move execution or recovery changes are authorized by this deferral.
-- Size-driven weighted acceptance is superseded by the deferred requirement,
-  not marked passed or ignored. Retain count convergence/data integrity coverage.
-- Existing automatic split has count-shortfall and coarse-pack size triggers;
-  the latter and size ranking require replacement after tree metrics acceptance.
-
-## Status — 2026-10-09
-
-- Local commits: `1a471f43`, `407b5cab`, `a664e357`, `38389b0c`; no push performed.
-- Split retains the original parent tree/WAL and creates one child. Durable
-  handoff precedes memory routing; catalog publication is the external cutover.
-  Recovery opens the exact base, range-filters the inherited parent WAL, then
-  replays the child's WAL. Initial unpublished handoff derives the dispatch
-  frontier from child WAL evidence; final readiness/catalog fixes the published
-  frontier, even when the child's WAL is empty.
-- Verified fixes include prepared-target immutable root access, uncertain
-  handoff candidate reuse, current-writer routing, unpublished dispatcher reuse,
-  narrowed-range lazy recovery, aligned block-WAL reads/fail-closed replay,
-  narrowly scoped empty-final-tail cleanup, block tree/WAL defaults, I/O completion
-  wakeup and format-compatible bulk WAL byte encoding. Focused regressions pass.
-- Before the balance implementation, eight of nine Linux matrix tasks pass;
-  extra Rust Iceberg SDK passes 5/5.
-  Baseline full UI passes 225/225, C++ 942/942, Core 987/987, Storage 839/839.
-  Separately scheduled SDK cases ran and passed; no functional Linux skip is
-  accepted. This historical baseline is superseded by the complete current
-  Console acceptance below. Exact counts/times are in `test.md`.
-- No new crash observed in the latest acceptance attempts. Previous crash
-  investigation is retained under `/tmp/crowdb-core-investigation`.
-- File-backed simulated device sync delays are confirmed and accepted by the
-  user; sync stays enabled. Native API preparation may use 10 seconds and native
-  fixture cases 180 seconds; ordinary UI assertions/actions remain 3 seconds.
-- Transfer/publication race and native overlay lifetime items below are audits,
-  not confirmed defects or authorization for speculative production changes.
-
-## Constraints
-
-- Run builds, tests, lint and executables through `pixi run`; runtime suites
-  run sequentially. Commit only when asked; never push without authorization.
-- Preserve exact identities, epochs, root lineage, revision CAS and recovery
-  pins. No epoch guessing, caller retries, weakened assertions or deadline inflation.
-- Keep hot paths lock-free. Review any unavoidable lock, queue, blocking work or
-  material performance cost with the user before implementation.
-- The user authorizes balance algorithm/configuration and UI implementation.
-  Split/move execution, handoff and recovery changes still require prior review.
-  No new hot-path locks or speculative cutover changes are authorized.
-
-## 1. Placement policy and deferred tree metrics
-
-- [x] **Verify count-only placement and hidden Weight**: byte coefficient defaults
-  to zero and nonzero configurations are rejected. Both selectors retain shared
-  count scoring, 20% tolerance, 25% improvement, cooldown and safety filters.
-  Equal split counts must not move merely because shared-pack estimates differ.
-  Hide graph/property Weight and balance explanations; verify native Page flow.
-  Files: protocol/server config, balance tests, console components/catalog spec.
-  Verified: 24 focused Rust cases, 7 UI unit cases, Rust fmt/clippy, UI lint/build
-  pass. Actual native Page flow passes: browser 2.3s, owned cluster 345.98s;
-  zero ignored. Weight/property/explanation absence and Page inspection asserted.
-- [x] **Finish Console acceptance**: complete gate passes 350 Rust test
-  executions, zero failed/ignored, and all 23 native browser cases across four
-  fixture phases. Approved allocation fix reroutes only typed pre-send connection
-  failures to a changed owner endpoint once; ambiguous sent requests are never
-  replayed. Both regressions and all eight S3 cluster cases pass. Native Start
-  asserts the original response before process state and avoids duplicate cleanup
-  submissions. Measured ChunkKV Start is 789/3800ms; response budget is 5s,
-  process/DOM stays 3s. No core startup change. Full UI passes 229/229.
-  Evidence and matrix: `test.md`, balance-policy artifact directory.
-- Tree metrics/data-weight work is deferred to
-  [R228](../backlog/R228-tree-range-metrics.md), requiring core review before
-  implementation. Size-triggered split currently uses coarse pack estimates;
-  count-shortfall split remains available. No writer/checkpoint change here.
-- The previous size-weight acceptance failed at 968.43s because opened manifest
-  estimates did not update after ordinary flush. It is superseded by the deferred
-  metrics contract, not counted passed or ignored. Evidence remains under
-  `.crowdb-runtime/artifacts/balance-policy-20261009/`.
-
-## 2. Remaining cutover boundary audits
-
-Only change behavior when a concrete regression proves a gap; any core fix
-requires the user's review. Existing durable handoff/replay contracts stay intact.
-
-- [x] **Review publication boundaries**: compare S1–S6/T1–T8 with monitor and
-  local publication, revision CAS, grants and startup. Distinguish initial
-  unpublished handoff recovery from final published replay bounds.
-  Files: monitor `chunk_kv/catalog.rs`, server `catalog/transition.rs`, design.
-  Both publish immutable pages before expected-head revision CAS and recognize
-  exact successor entries idempotently; phase persistence is a subsequent CAS.
-  The remaining startup/abort races below are not proven by that comparison.
-- [ ] **Recover release before publication**: prove old-source admission stays
-  fenced by exact release/lease evidence and reconciliation can still start.
-  Files: server `main.rs`, `catalog/recovery.rs`, `serving/transition_runtime.rs`.
-  Review finding: old Serving catalog plus old valid grant reaches generic
-  `activate_recovered_partition`; the source branch does not read transfer
-  release proof. `suspend_for_transfer` fences the live lifecycle in memory.
-  Need a controlled restart regression before changing activation; do not claim
-  this window safe from ordinary transfer/state-machine tests.
-  Proposed reviewed scope: load durable transfer evidence once on the grant/
-  recovery control path, match exact source instance/partition/epoch, and keep
-  recovered source non-serving after release even if old catalog/grant remains.
-  Retain transition processing so publication can finish. No per-request read,
-  lock, WAL rerouting or epoch change. Controlled restart regression must prove
-  old-source mutation rejection and eventual target recovery. Await approval.
-- [ ] **Repair publication before phase marker**: cover owner and Serving
-  publication independently; exact catalog entries and proofs allow idempotent
-  repair and cannot reactivate the source. Files: server `server/activation.rs`,
-  monitor `chunk_kv/catalog.rs`, `catalog_transition_test.rs`, transfer recovery tests.
-- [x] **Verify split abort**: reject abort after durable handoff or with stale
-  proof; preserve child WAL omitted by the old catalog and resume the same split.
-  Files: server `serving/split.rs`, local split owner, split abort/recovery tests.
-  `control_store_test`, `split_prepare_retry_test` and handoff recovery tests pass;
-  committed proof cannot be cleared/replaced, unknown uncommitted status permits
-  exact abort, and committed dispatch resumes the same base.
-- [ ] **Reconcile published split before marker**: recover both exact successor
-  assignments and matching authority; historical routing cannot select an old
-  writer over the current assignment. Files: server activation/reconcile and
-  `split_recovery_test.rs`.
-- [ ] **Verify grant-generation refresh**: immediate catalog refresh is already
-  implemented; prove new grants do not leave routes fenced until periodic refresh.
-  Files: server `main.rs`, native S3/Iceberg catalog-change acceptance.
-- [ ] **Order abort against publication**: controlled interleavings must prove
-  monitor fencing, transition revision and expected-head CAS exclude stale
-  publication. Files: monitor catalog, local transition and catalog transition tests.
-- [ ] **Retire exact candidate resources**: durable abort precedes idempotent
-  cleanup; preserve source references, base pins, retry floors and grace. Verify
-  monotonic candidate epochs across abort/restart. Files: transition worker,
-  monitor, transfer recovery tests.
-- [ ] **Audit native overlay lifetime**: prove raw source-tree pointers remain
-  valid when external/session handles disappear, finalization fails or overlays
-  are removed concurrently. Establish a failing regression before ownership changes.
-  Files: `lib/crowdb-chunk-kv/src/partition/tree.rs`,
-  `lib/crowdb-tree/ffi/src/tree.rs`, `lib/crowdb-tree/src/btree/memtable_sources.cpp`.
-  C++ stores a raw source-tree pointer; Rust's safe install method takes a
-  temporary borrow and does not retain source ownership. Normal successful
-  finalization clears the overlay, but failed finalization/source-handle loss
-  and readers concurrent with clear still need a lifetime regression. No new
-  crash has been observed and no ownership fix is applied.
-
-- **Membership CAS contract (R229) completed 2026-10-10**: the complete members
-  record, epoch CAS, Installing/Ready fencing, exact-epoch recovery and shared
-  KV-client/server conflict protection are implemented. The sequential topology
-  fixture passes 5/5 (33.1s); the full UI run retains two unrelated timing/data
-  flow failures. The permanent reconfiguration design records the final
-  contract; this cutover plan no longer tracks membership implementation.
-
-Native lifecycle follow-up: recorded restart opens its first tree root at
-09:21:27.697, then three more roots at 09:21:30.298–30.485; the RPC listener
-starts at 09:21:30.532 (about 3.15s after process startup). Recovery is sequential
-and includes journal replay. These timestamps do not attribute the delay to
-fsync. The user authorized a measured, modest Start-response budget after
-reviewing timing distribution; 10s is not the default target. The focused run passes with a 5s response budget: ChunkDB 215ms, DiskIO
-366ms, ChunkKV 789ms, Access 178ms (browser 9.2s; owned fixture 375.59s).
-Full Console provides a second Start sample: ChunkDB 255ms, DiskIO 466ms,
-ChunkKV 3800ms, Access 148ms. Keep the 5s native response budget: 3s fails
-legitimate recovery, while these samples do not justify 10s. These samples
-and the prior 3.15s listener sample establish variation, not percentiles. Keep per-service millisecond output for full-suite verification. Process/DOM assertions stay at 3s. Recovery and
-readiness behavior are unchanged. Complete UI passes 229/229; the native
-full Console rerun passes (350 Rust executions, zero failed/ignored; all
-23 native browser cases, including the three dedicated phases).
-
-## 3. Final verification and documentation
-
-- [ ] **Controlled crash/race coverage**: consolidate before/after durable-step
-  tests, ambiguous replies, stale revisions/grants, concurrent checkpoints and
-  both restarts. Assert exclusive ownership, WAL order, acknowledged values,
-  exact-root lineage and eventual recovery. Capture authoritative metadata before
-  teardown for any newly failing transition; retain actual crash/core evidence.
-- [x] **Complete Console matrix**: rerun native inspection, journal interruption
-  and dedicated production split/count-placement phases after confirmed changes. Eight
-  independent tasks already pass; rerun them only where new diffs affect them.
-  Complete task passes: 350 Rust executions, zero failed/ignored; all 23 native
-  browser cases run across four fixture phases. Updated `test.md` with the
-  approximate 1588.13s complete task interval and separate phase timings.
-- [ ] **Performance and quality gates**: inspect scans/serialization/locking and
-  bound planning/diagnostic work. Run affected tests, fmt, clippy, relevant C++
-  gates and UI lint/specs. Make performance claims only from measured workloads.
-- [ ] **Reconcile permanent docs**: formula, thresholds and UI contract are
-  updated. Track deferred tree metrics separately and resolve remaining cutover
-  Open Issues only after review and passing regressions; remove this plan after
-  final acceptance.
-
-## Latest focused audit verification
-
-- Independent native phases now pass without ignored cases: prerequisite-plan
-  resumption 19.32s, journal owner interruption 54.26s, and production split/
-  count convergence with complete data checks 350.85s (4/4/4).
-  The plan fixture pauses after ChunkDB rather than before its three instances
-  exist. UI observes registered DiskIO restart every 2s when Capacity is not
-  loaded; 20 focused hook tests pass. Serial deployment responses are checked
-  separately before durable progress. Core storage/transition behavior is unchanged.
-  Logs: `native-plan-response-order.out`, `native-journal-final.out`, and
-  `native-count-final.out` under the balance-policy artifact directory.
-- Full workspace Rust clippy, fmt, CI task mapping and UI lint/build pass.
-  Complete UI passes 166 unit plus 63 browser cases (229/229), 307.40s.
-  An earlier complete rerun passed automatic service
-  deployment but failed bucket clicking because creation consumed 2.92s of the
-  same action window. The test now asserts the bucket creation response before
-  selecting its UI item; each original action/response budget remains 3s.
-- Reload failure is diagnosed separately: the old page's canceled server-list
-  fetch persisted `failed` over a saved `waiting` plan. Page unload now stops
-  the runner and guards cancellation paths before failure publication; cached
-  history restoration reloads persisted authority. The 21 hook tests and entire
-  eight-case rack/node spec pass (32.5s browser). Full UI acceptance passes
-  in `ui-reload-acceptance-final.out`; no timeout or assertion is weakened.
-- 21 server cases pass across catalog transition, control store, split recovery,
-  current assignment, transfer state machine and transfer storage.
-- 10 library cases pass across native split handoff, split handoff recovery,
-  ingress and prepared-candidate retry. Zero ignored. These are focused evidence,
-  not complete real-process coverage of every listed crash/race window.
-- Current count-only Core passes 994/994, zero ignored; UI passes 166 unit and
-  63/63 browser cases. Earlier Group 1990 replica 19902 remained unknown/term 1
-  while its leader was term 2 in a failed observation window. Preserved trace:
-  `.crowdb-runtime/artifacts/balance-policy-20261009/ui-leader-election-failure/`.
-  Log: `.crowdb-runtime/artifacts/balance-policy-20261009/count-only-core.out`.
-  Tree metrics remain deferred to R228.
-
-## Evidence and file inventory
-
-- Successful final independent matrix:
-  `.crowdb-runtime/artifacts/measure-tests/20261009T022131.804646Z/`.
-  Core/Storage/Access: `20261009T002906.349723Z/` under the same directory.
-- Latest UI/Core/Storage pass: `20261009T053116.399322Z/` under the same
-  measurement directory. Latest incomplete Console attempt:
-  `20261009T052410.043897Z/`. Balance-specific focused results and final
-  clippy output: `.crowdb-runtime/artifacts/balance-policy-20261009/`.
-  Withdrawn readiness/order experiments:
-  `.crowdb-runtime/artifacts/native-catalog-readiness-experiments/`.
-  Earlier speculative cutover changes:
-  `.crowdb-runtime/artifacts/cutover-review-withdrawn/`.
-- Production: protocol policy/status; Group-0 monitor/catalog; ChunkKV server
-  storage, serving, routing, activation/reconcile; owning ChunkKV/tree libraries.
-- Unit/integration: server planning, control-store, split/transfer recovery,
-  catalog transition and native overlay tests. E2E: web native provisioning/
-  balance and existing catalog, journal, Iceberg/S3 browser specs.
diff --git a/doc/working/plan-test-task-completeness.md b/doc/working/plan-test-task-completeness.md
index 03c7b131b..12139ac35 100644
--- a/doc/working/plan-test-task-completeness.md
+++ b/doc/working/plan-test-task-completeness.md
@@ -40,7 +40,7 @@ including environment-specific preparation, without manual follow-up or retries.
 - Check modified shell syntax through `pixi run bash -n <script>`.
 - Run `pixi run check-ci-test-tasks` after task dispatch changes.
 - Split/move recovery boundary regressions remain in the cutover plan and resume
-  after these two test-task coverage gaps are closed. R228 remains deferred.
+  after these two test-task coverage gaps are closed. Tree metrics are complete.
 
 ## Current verification
 
diff --git a/doc/working/plan-tree-range-metrics.md b/doc/working/plan-tree-range-metrics.md
deleted file mode 100644
index 5dc92a7a2..000000000
--- a/doc/working/plan-tree-range-metrics.md
+++ /dev/null
@@ -1,19 +0,0 @@
-<!-- Copyright 2026-present Gian <crow.db@outlook.com> -->
-<!-- Licensed under the Apache License, Version 2.0. -->
-
-# Tree range metrics Plan
-
-Upstream: [R228](../backlog/R228-tree-range-metrics.md), [tree storage design](../design/tree/design-crowdb-tree-storage.md).
-
-Goal: publish durable-root metrics that distinguish live logical data from reachable page and overflow storage, while keeping reads O(1) and unknown legacy state unavailable.
-
-- [x] **Summary contract**: extend the tree summary/C API/FFI and protocol view with overflow, reachable-byte, and logical-byte fields; document zero-versus-unavailable semantics. Files: `lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h`, `lib/crowdb-tree/include/crowdb-tree/c_api.h`, `lib/crowdb-tree/ffi/src/stats.rs`, `lib/crowdb-protocol/src/mgmt.rs`, design docs.
-- [x] **Durable publication accounting**: compute summary accounting from the selected snapshot, publish only after anchor durability, and reconstruct structural counts on reopen. Files: `lib/crowdb-tree/src/snapshot/persist.cpp`, `lib/crowdb-tree/src/btree/crowdb-tree.cpp`.
-- [x] **Acceptance coverage**: empty, overwrite/delete, overflow and reopen cases verify logical and structural metrics and coverage fencing. Files: `lib/crowdb-tree/tests/integration/persist_test.cpp`, `lib/crowdb-tree/tests/integration/overflow_test.cpp`.
-- [x] **Structural page aggregates**: persist leaf summaries in the existing version-1 frame header, aggregate child summaries through inner pages, and refresh ancestors during page publication and snapshot preparation. Files: `lib/crowdb-tree/include/crowdb-tree/maptable/frame_page.h`, `lib/crowdb-tree/include/crowdb-tree/maptable/page.h`, `lib/crowdb-tree/src/btree/crowdb-tree.cpp`.
-- [x] **Chunk-KV observation plumbing**: expose cached logical bytes and exactness through partition observations and heartbeat payloads without blocking heartbeat publication. Files: `lib/crowdb-chunk-kv/src/partition/observation.rs`, `app/crowdb-chunk-kv-server/src/server.rs`, `lib/crowdb-protocol/src/types/common.rs`.
-- [x] **Verification and cleanup**: run affected C++/Rust tests and formatting/lint gates; retain the plan as the implementation record.
-
-Files: `lib/crowdb-tree/include/crowdb-tree/btree/diagnostics.h`, `lib/crowdb-tree/include/crowdb-tree/c_api.h`, `lib/crowdb-tree/src/btree/crowdb-tree.cpp`, `lib/crowdb-tree/src/snapshot/persist.cpp`, `lib/crowdb-tree/ffi/src/stats.rs`, `lib/crowdb-tree/ffi/src/sys.rs`, `lib/crowdb-protocol/src/mgmt.rs`, `lib/crowdb-tree/tests/integration/persist_test.cpp`, `doc/design/tree/design-crowdb-tree-storage.md`.
-
-Tests: `pixi run test-cpp`; `pixi run cargo test -p crowdb-tree-ffi`; `pixi run rs-fmt-check`; `pixi run tree-fmt`; `pixi run tree-lint`; `pixi run rs-lint`.
diff --git a/doc/working/test.md b/doc/working/test.md
index 5daa8a64a..a4945d656 100644
--- a/doc/working/test.md
+++ b/doc/working/test.md
@@ -83,7 +83,7 @@ Measurement notes for this host:
   Start timing follow-up passes: ChunkDB 215ms, DiskIO 366ms, ChunkKV 789ms,
   Access 178ms (browser 9.2s, owned fixture 375.59s). The earlier recovery
   reached its listener after 3.15s. User-authorized native Start response
-  budget is now 5s; process/DOM assertions remain 3s. Full Console rerun now passes; R228/R229 remain deferred. Timing log:
+  budget is now 5s; process/DOM assertions remain 3s. Full Console rerun now passes; R229 remains deferred. Timing log:
   `.crowdb-runtime/artifacts/balance-policy-20261009/native-lifecycle-start-distribution.out`.
 
 - Previous full Console gate: 307 completed Rust cases pass, one native wrapper
@@ -117,7 +117,7 @@ Measurement notes for this host:
   captured wall-clock timer. Log:
   `.crowdb-runtime/artifacts/balance-policy-20261009/count-only-core.out`.
   Actual native Page/hidden-Weight acceptance passes (browser 2.3s, owned
-  cluster 345.98s); data-weight placement is deferred to R228, not marked passed.
+  cluster 345.98s); data-weight placement is covered by the completed tree metrics work.
 - Current S3 outage reproduction: exact node-3 case passes in 36.20s; full
   serial mini-cluster file fails 7/8 in 193.41s on node-1. Group 301 allocation
   contacts removed endpoint 11200 after ownership recovery. This is a stale
@@ -146,7 +146,7 @@ Measurement notes for this host:
   the intended new imbalance. Its real split inherited/current Journal browser
   case passes in 18.7 seconds. This is incomplete acceptance, not a Linux skip;
   logs are in `.crowdb-runtime/artifacts/balance-policy-20261009/` and the
-  statistics boundary is recorded for review in `plan-chunk-kv-cutover.md`.
+  statistics boundary is recorded with the completed tree metrics work.
 - The following earlier measurements describe the pre-balance baseline.
 - Full UI passes 225/225 in 306.98 seconds after its topology preparation
   checks current complete membership and matching terms instead of caching an
diff --git a/lib/crowdb-chunk-kv/src/memory.rs b/lib/crowdb-chunk-kv/src/memory.rs
index ac338a77c..6b46e2218 100644
--- a/lib/crowdb-chunk-kv/src/memory.rs
+++ b/lib/crowdb-chunk-kv/src/memory.rs
@@ -298,6 +298,11 @@ impl PartitionTree for MemoryPartitionTree {
         Ok((Arc::new(rebuilt), stats))
     }
 
+    async fn force_advance_split_frontier(&self, journal_frontier: u64) -> Result<()> {
+        self.last_applied.fetch_max(journal_frontier, Ordering::AcqRel);
+        Ok(())
+    }
+
     async fn begin_split_memtable_view(&self) -> Result<(u64, u64)> {
         let generation = self
             .next_split_view
diff --git a/lib/crowdb-chunk-kv/src/partition/split/recovery.rs b/lib/crowdb-chunk-kv/src/partition/split/recovery.rs
index de084be7a..b6309bc96 100644
--- a/lib/crowdb-chunk-kv/src/partition/split/recovery.rs
+++ b/lib/crowdb-chunk-kv/src/partition/split/recovery.rs
@@ -13,6 +13,7 @@ impl Partition {
     ///
     /// # Errors
     /// Rejects a conflicting plan, child artifact or parent replay frontier.
+    #[allow(clippy::too_many_lines)]
     pub async fn resume_split_child_session(
         &self,
         plan: crate::SplitPlan,
@@ -70,6 +71,10 @@ impl Partition {
             child: child_artifact.clone(),
         };
         super::super::validate_split_artifact(&plan, &artifact, artifact.cutover_seq)?;
+        child
+            .tree
+            .force_advance_split_frontier(artifact.cutover_seq)
+            .await?;
         child.activate_local_split_writer(&artifact)?;
         {
             let mut current = self.split_transition.lock().await;
@@ -84,6 +89,13 @@ impl Partition {
             });
         }
         self.install_child_split_ingress(&plan, child.clone()).await?;
+        super::stable_session::finish_child_inheritance(
+            self.tree.as_ref(),
+            &plan,
+            &artifact,
+            child.tree.as_ref(),
+        )
+        .await?;
         self.lifecycle.store(
             super::super::lifecycle_code(crate::PartitionLifecycle::SplitFinalizing),
             std::sync::atomic::Ordering::Release,
diff --git a/lib/crowdb-chunk-kv/src/partition/split/stable_session.rs b/lib/crowdb-chunk-kv/src/partition/split/stable_session.rs
index 762dc28e6..cfb9f7ddf 100644
--- a/lib/crowdb-chunk-kv/src/partition/split/stable_session.rs
+++ b/lib/crowdb-chunk-kv/src/partition/split/stable_session.rs
@@ -77,8 +77,7 @@ impl Partition {
             child: (*proof).clone(),
         };
         super::super::validate_split_artifact(&plan, &artifact, proof.applied_seq)?;
-        self.finish_child_inheritance(&plan, &artifact, child.tree.as_ref())
-            .await?;
+        finish_child_inheritance(self.tree.as_ref(), &plan, &artifact, child.tree.as_ref()).await?;
         self.record_split_artifact(artifact.clone()).await?;
         let writer = PreparedSplitWriter {
             artifact: (*proof).clone(),
@@ -128,35 +127,34 @@ impl Partition {
             .await?;
         let (artifact, child) = installed.await.map_err(|_| ChunkKvError::WriteStalled)??;
         self.pending_child_preparation.store(None);
-        self.finish_child_inheritance(&plan, &artifact, child_tree.as_ref())
-            .await?;
+        finish_child_inheritance(self.tree.as_ref(), &plan, &artifact, child_tree.as_ref()).await?;
         self.record_split_artifact(artifact.clone()).await?;
         self.metrics.split_finalization();
         Ok((artifact, child))
     }
+}
 
-    async fn finish_child_inheritance(
-        &self,
-        plan: &SplitPlan,
-        artifact: &SplitArtifact,
-        child_tree: &dyn PartitionTree,
-    ) -> Result<()> {
-        let (generation, captured) = self.tree.begin_split_memtable_view().await?;
-        let publication = if captured < artifact.cutover_seq {
-            Err(ChunkKvError::ApplyStateUnknown)
-        } else {
-            self.tree
-                .publish_split_memtable_view(generation, artifact.cutover_seq, child_tree, &plan.child.range)
-                .await
-        };
-        let release = self.tree.release_split_memtable_view(generation).await;
-        publication?;
-        release?;
-        child_tree
-            .clear_split_memtable_overlay(self.tree.as_ref())
-            .await?;
-        Ok(())
+pub(super) async fn finish_child_inheritance(
+    parent_tree: &dyn PartitionTree,
+    plan: &SplitPlan,
+    artifact: &SplitArtifact,
+    child_tree: &dyn PartitionTree,
+) -> Result<()> {
+    parent_tree
+        .force_advance_split_frontier(artifact.cutover_seq)
+        .await?;
+    let (generation, captured) = parent_tree.begin_split_memtable_view().await?;
+    if captured < artifact.cutover_seq {
+        parent_tree.release_split_memtable_view(generation).await?;
+        return Err(ChunkKvError::ApplyStateUnknown);
     }
+    let publication = parent_tree
+        .publish_split_memtable_view(generation, artifact.cutover_seq, child_tree, &plan.child.range)
+        .await;
+    let release = parent_tree.release_split_memtable_view(generation).await;
+    publication?;
+    release?;
+    Ok(())
 }
 
 pub(crate) async fn install_child_cutover(
@@ -182,7 +180,7 @@ async fn install_child_cutover_inner(
     };
     request
         .child_tree
-        .install_split_memtable_overlay(request.parent.tree.as_ref(), cutover_seq)
+        .force_advance_split_frontier(cutover_seq)
         .await?;
     let mut child = prepare_writer(
         &request.plan.child,
diff --git a/lib/crowdb-chunk-kv/src/partition/tree.rs b/lib/crowdb-chunk-kv/src/partition/tree.rs
index 98191b2fe..56286df3e 100644
--- a/lib/crowdb-chunk-kv/src/partition/tree.rs
+++ b/lib/crowdb-chunk-kv/src/partition/tree.rs
@@ -49,6 +49,11 @@ pub trait PartitionTree: Send + Sync {
         std::sync::Arc<dyn PartitionTree>,
         crowdb_tree_ffi::RangeRebuildStats,
     )>;
+    async fn force_advance_split_frontier(&self, _journal_frontier: u64) -> Result<()> {
+        Err(ChunkKvError::InvalidRequest(
+            "partition tree does not support split frontier advancement".into(),
+        ))
+    }
     async fn begin_split_memtable_view(&self) -> Result<(u64, u64)> {
         Err(ChunkKvError::InvalidRequest(
             "partition tree does not support split memtable views".into(),
@@ -439,6 +444,11 @@ impl PartitionTree for CrowdbPartitionTree {
         ))
     }
 
+    async fn force_advance_split_frontier(&self, journal_frontier: u64) -> Result<()> {
+        self.tree.force_advance_slot(journal_frontier);
+        Ok(())
+    }
+
     async fn begin_split_memtable_view(&self) -> Result<(u64, u64)> {
         let tree = std::sync::Arc::clone(&self.tree);
         tokio::task::spawn_blocking(move || tree.begin_split_memtable_view())

From 6a16f1af06ad4458ede839d1b94139603ac61bab Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 19:38:40 +0800
Subject: [PATCH 07/11] Fix flaky integration test paths

---
 .../tests/domain_monitor_test.rs              |  4 +--
 .../src/ops/kv_logical.rs                     | 34 +++++++++++--------
 lib/crowdb-test-harness/src/chunkdb.rs        | 22 +++++++++++-
 .../src/btree/generation_replace.cpp          | 11 ++++++
 lib/crowdb-tree/src/snapshot/persist.cpp      |  9 ++++-
 5 files changed, 61 insertions(+), 19 deletions(-)

diff --git a/app/crowdb-kv-server/tests/domain_monitor_test.rs b/app/crowdb-kv-server/tests/domain_monitor_test.rs
index d4e5f7332..3c077574c 100644
--- a/app/crowdb-kv-server/tests/domain_monitor_test.rs
+++ b/app/crowdb-kv-server/tests/domain_monitor_test.rs
@@ -614,8 +614,8 @@ async fn assert_chunk_kv_split_plan(target_partitions_per_owner: u32, target_par
                     partition_loads: vec![ChunkKvPartitionLoad {
                         partition_id,
                         durable_bytes: 600,
-                        logical_bytes: 0,
-                        logical_metrics_exact: false,
+                        logical_bytes: 600,
+                        logical_metrics_exact: true,
                         live_byte_samples: vec![
                             (b"a".to_vec(), 100),
                             (b"m".to_vec(), 400),
diff --git a/lib/crowdb-console-shared/src/ops/kv_logical.rs b/lib/crowdb-console-shared/src/ops/kv_logical.rs
index 9b9966cf4..42c925981 100644
--- a/lib/crowdb-console-shared/src/ops/kv_logical.rs
+++ b/lib/crowdb-console-shared/src/ops/kv_logical.rs
@@ -638,22 +638,27 @@ pub async fn remove_replica(ctx: &OpContext, store_id: u64, group_id: u64, repli
             voting: replica.voting,
         })
         .collect::<Vec<_>>();
+    // Step 0: verify the target is reachable and step it down if it is the
+    // leader before publishing the successor membership. A failed request
+    // must leave Group 0 membership unchanged.
+    let target_client = server_client(ctx, target_node).await?;
+    target_client
+        .step_down(
+            store_id,
+            group_id,
+            &StepDownRequest {
+                reason: format!("replica {replica_id} removal"),
+            },
+        )
+        .await
+        .map_err(|error| Error::UpstreamRpc {
+            node_id: target_node.to_string(),
+            status: format!("step down before replica removal: {error}"),
+        })?;
+
     let installing = begin_membership_change(ctx, store_id, group_id, &replicas, requested_members).await?;
     let expected_epoch = installing.record().epoch;
 
-    // Step 0: step down if this replica is the leader (best-effort).
-    if let Ok(client) = server_client(ctx, target_node).await {
-        let _ = client
-            .step_down(
-                store_id,
-                group_id,
-                &StepDownRequest {
-                    reason: format!("replica {replica_id} removal"),
-                },
-            )
-            .await;
-    }
-
     // Step 1: Deregister from every peer.
     for peer in &replicas {
         if peer.replica_id == replica_id {
@@ -671,8 +676,7 @@ pub async fn remove_replica(ctx: &OpContext, store_id: u64, group_id: u64, repli
     }
 
     // Step 2: Delete the local group on the target node.
-    let client = server_client(ctx, target_node).await?;
-    if let Err(error) = client
+    if let Err(error) = target_client
         .remove_group_at_epoch(store_id, group_id, expected_epoch)
         .await
     {
diff --git a/lib/crowdb-test-harness/src/chunkdb.rs b/lib/crowdb-test-harness/src/chunkdb.rs
index 7b54251b7..64c4ae6b3 100644
--- a/lib/crowdb-test-harness/src/chunkdb.rs
+++ b/lib/crowdb-test-harness/src/chunkdb.rs
@@ -159,7 +159,27 @@ impl Default for ChunkdbStartOptions {
 
 impl ChunkdbProcess {
     pub fn log_content(&self) -> String {
-        std::fs::read_to_string(&self.log_path).unwrap_or_default()
+        let Some(log_dir) = self.log_path.parent() else {
+            return std::fs::read_to_string(&self.log_path).unwrap_or_default();
+        };
+        let mut paths = std::fs::read_dir(log_dir)
+            .into_iter()
+            .flatten()
+            .flatten()
+            .map(|entry| entry.path())
+            .filter(|path| path.is_file())
+            .collect::<Vec<_>>();
+        paths.sort();
+        let mut content = String::new();
+        for path in paths {
+            if let Ok(log) = std::fs::read_to_string(&path) {
+                if !log.is_empty() {
+                    use std::fmt::Write as _;
+                    let _ = writeln!(content, "--- {} ---\n{log}", path.display());
+                }
+            }
+        }
+        content
     }
 
     /// Start crowdb-chunkdb with a generated config pointing at the
diff --git a/lib/crowdb-tree/src/btree/generation_replace.cpp b/lib/crowdb-tree/src/btree/generation_replace.cpp
index 6342280cc..d507ab455 100644
--- a/lib/crowdb-tree/src/btree/generation_replace.cpp
+++ b/lib/crowdb-tree/src/btree/generation_replace.cpp
@@ -142,7 +142,9 @@ try {
     uint64_t leaves = 0;
     uint64_t inners = 0;
     uint64_t next   = next_page_id;
+    bool all_frames_inherited = mapping_inherited;
     for (const auto &frame : frames) {
+        all_frames_inherited = all_frames_inherited && frame.inherited;
         next            = std::max(next, frame.page_id + 1);
         const auto type = frame_page_type(frame.frame.data());
         leaves += static_cast<uint64_t>(type == page_type::kLeafBase);
@@ -177,6 +179,15 @@ try {
     // Generation admission has drained all old batches before slots/mappings
     // change. The remaining publication consists only of non-allocating swaps.
     mapping_.swap_quiescent(staged->mapping);
+    if (all_frames_inherited) {
+        for (uint64_t segment_index = 0; segment_index < MappingTable::kMaxSegments; ++segment_index) {
+            auto *segment = mapping_.segment_at(segment_index);
+            if (segment != nullptr) {
+                segment->persisted_seq.store(segment->write_seq.load(std::memory_order_relaxed),
+                                             std::memory_order_relaxed);
+            }
+        }
+    }
     root_page_id_.store(root_page_id);
     active_ = std::move(successor);
     frozen_.clear();
diff --git a/lib/crowdb-tree/src/snapshot/persist.cpp b/lib/crowdb-tree/src/snapshot/persist.cpp
index 2c76674ca..8635737ce 100644
--- a/lib/crowdb-tree/src/snapshot/persist.cpp
+++ b/lib/crowdb-tree/src/snapshot/persist.cpp
@@ -567,7 +567,14 @@ Status Crowdbtree::prepare_snapshot_locked(PreparedSnapshot *out, std::vector<Pr
             }
         }
     }
-    refresh_subtree_summaries_locked(root_page_id_.load(std::memory_order_acquire));
+    bool mapping_dirty = false;
+    for (uint64_t seg_idx = 0; seg_idx < MappingTable::kMaxSegments && !mapping_dirty; ++seg_idx) {
+        auto *segment = mapping_.segment_at(seg_idx);
+        mapping_dirty = segment != nullptr && segment->is_dirty();
+    }
+    if (mapping_dirty) {
+        refresh_subtree_summaries_locked(root_page_id_.load(std::memory_order_acquire));
+    }
     Status pages = prepare_snapshot_pages_locked(ctx);
     if (!pages.ok()) {
         return pages;

From 0ec09ba4b6f5f072ae043f094d5c0381e1b98bd5 Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 20:25:15 +0800
Subject: [PATCH 08/11] Avoid inheriting dirty source frames

---
 lib/crowdb-tree/src/btree/range_rebuild.cpp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/crowdb-tree/src/btree/range_rebuild.cpp b/lib/crowdb-tree/src/btree/range_rebuild.cpp
index 16bc0d293..e8f0fb573 100644
--- a/lib/crowdb-tree/src/btree/range_rebuild.cpp
+++ b/lib/crowdb-tree/src/btree/range_rebuild.cpp
@@ -391,8 +391,14 @@ Status rebuild_range(Crowdbtree &source, const KeyRange &range, Config destinati
     if (!saw_source_frame) {
         return Status::corruption("range rebuild: source snapshot has no root");
     }
+    bool source_mapping_clean = true;
+    for (uint64_t seg_idx = 0; seg_idx < MappingTable::kMaxSegments && source_mapping_clean; ++seg_idx) {
+        auto *segment = source.mapping_.segment_at(seg_idx);
+        source_mapping_clean = segment == nullptr || !segment->is_dirty();
+    }
     const bool reuse_inherited_frames =
-        mapping_inherited && destination_options.page_store->inherited_snapshot_matches(*source.opt_.page_store);
+        mapping_inherited && source_mapping_clean &&
+        destination_options.page_store->inherited_snapshot_matches(*source.opt_.page_store);
     for (NativeFrame &frame : source_frames) {
         frame.inherited = reuse_inherited_frames;
     }

From efca2ef0376813b1f8247571d74d4cff782a4aee Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 21:39:58 +0800
Subject: [PATCH 09/11] Fix topology refresh and replica removal

---
 app/crowdb-web/ui/src/data/useLogicalTree.ts     | 12 ++++++++++--
 .../ui/src/topology/TopologyCanvas.tsx           | 16 ++++++++++++----
 lib/crowdb-console-shared/src/mgmt.rs            |  2 +-
 lib/crowdb-console-shared/src/ops/kv_logical.rs  |  6 ++++++
 4 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/app/crowdb-web/ui/src/data/useLogicalTree.ts b/app/crowdb-web/ui/src/data/useLogicalTree.ts
index af2c67108..8bc2b6699 100644
--- a/app/crowdb-web/ui/src/data/useLogicalTree.ts
+++ b/app/crowdb-web/ui/src/data/useLogicalTree.ts
@@ -57,10 +57,13 @@ export function useLogicalTree({
   const isActiveRef = useRef(true);
   const pollTimeoutRef = useRef<NodeJS.Timeout | null>(null);
   const hasLoadedRef = useRef(false);
+  const requestIdRef = useRef(0);
 
   // Fetch logical tree data
   const fetchData = useCallback(async () => {
     if (!enabled) return;
+    const requestId = ++requestIdRef.current;
+    const isCurrent = () => requestId === requestIdRef.current;
 
     try {
       // Only show loading state on the initial fetch; subsequent polls
@@ -76,6 +79,7 @@ export function useLogicalTree({
       // Fetch stores with recursive depth
       const storesData = await listStores(recursive);
       const sourceStores = Array.isArray(storesData) ? storesData : [];
+      if (!isCurrent()) return;
 
       // Group identities come from the authoritative catalog. Show them before
       // optional replica observations: one stopped member must not hide healthy
@@ -136,6 +140,7 @@ export function useLogicalTree({
           };
         }),
       );
+      if (!isCurrent()) return;
 
       for (const store of enrichedStores) {
         allGroups.push(...store.groups);
@@ -151,13 +156,16 @@ export function useLogicalTree({
       setReplicas(allReplicas);
       setError(null);
     } catch (err) {
+      if (!isCurrent()) return;
       setStores([]);
       setGroups([]);
       setReplicas([]);
       setError(err instanceof Error ? err : new Error('Unknown error fetching logical tree'));
     } finally {
-      hasLoadedRef.current = true;
-      setLoading(false);
+      if (isCurrent()) {
+        hasLoadedRef.current = true;
+        setLoading(false);
+      }
     }
   }, [enabled, recursive, managed]);
 
diff --git a/app/crowdb-web/ui/src/topology/TopologyCanvas.tsx b/app/crowdb-web/ui/src/topology/TopologyCanvas.tsx
index 524f013c0..f1ac7ac38 100644
--- a/app/crowdb-web/ui/src/topology/TopologyCanvas.tsx
+++ b/app/crowdb-web/ui/src/topology/TopologyCanvas.tsx
@@ -154,6 +154,10 @@ function TopologyCanvasInner({ active = true, scope, allServers, racks, nodes, s
   const fitRafIdRef = useRef<number | undefined>(undefined);
   const lastCanvasSizeRef = useRef('');
   const [collapsedByDomain, setCollapsedByDomain] = useState<Partial<Record<Domain, Set<string>>>>({});
+  const hasUsableCanvas = useCallback(() => {
+    const rect = canvasRef.current?.getBoundingClientRect();
+    return !!rect && Number.isFinite(rect.width) && Number.isFinite(rect.height) && rect.width > 0 && rect.height > 0;
+  }, []);
   useEffect(() => {
     const element = canvasRef.current;
     if (!element) return;
@@ -272,8 +276,12 @@ function TopologyCanvasInner({ active = true, scope, allServers, racks, nodes, s
     // dimensions — newly added nodes lack width/height on the first frame,
     // so a single rAF fitView would ignore them and never re-fit.
     const tryFit = () => {
+      if (!hasUsableCanvas()) {
+        fitRafIdRef.current = requestAnimationFrame(tryFit);
+        return;
+      }
       const savedViewport = viewportsRef.current[domain];
-      if (savedViewport) {
+      if (savedViewport && [savedViewport.x, savedViewport.y, savedViewport.zoom].every(Number.isFinite)) {
         void setViewport(savedViewport, { duration: 250 });
         fitRafIdRef.current = undefined;
         return;
@@ -292,13 +300,13 @@ function TopologyCanvasInner({ active = true, scope, allServers, racks, nodes, s
       fitRafIdRef.current = undefined;
     };
     fitRafIdRef.current = requestAnimationFrame(tryFit);
-  }, [active, returning, fitView, getNodes, nodesInitialized, positioned.nodes, setViewport, domain, refreshToken, viewportWidthKey, canvasSizeKey]);
+  }, [active, returning, fitView, getNodes, hasUsableCanvas, nodesInitialized, positioned.nodes, setViewport, domain, refreshToken, viewportWidthKey, canvasSizeKey]);
 
   // ReactFlow can finish measuring its viewport one tick after a domain tab
   // becomes visible. A delayed fit closes that gap and prevents the viewport
   // calculated while the panel was hidden from surviving a tab return.
   useEffect(() => {
-    if (!active || !nodesInitialized || positioned.nodes.length === 0) return;
+    if (!active || !nodesInitialized || positioned.nodes.length === 0 || !hasUsableCanvas()) return;
     const timer = window.setTimeout(() => {
       viewportsRef.current[domain] = undefined;
       fittedOnceRef.current[domain] = false;
@@ -306,7 +314,7 @@ function TopologyCanvasInner({ active = true, scope, allServers, racks, nodes, s
       fittedOnceRef.current[domain] = true;
     }, 180);
     return () => window.clearTimeout(timer);
-  }, [active, canvasSizeKey, domain, fitView, nodesInitialized, positioned.nodes.length]);
+  }, [active, canvasSizeKey, domain, fitView, hasUsableCanvas, nodesInitialized, positioned.nodes.length]);
 
   const selId = selectedEntity ? selectedNodeId(selectedEntity) : null;
   const activateNode = useCallback((node: Node) => {
diff --git a/lib/crowdb-console-shared/src/mgmt.rs b/lib/crowdb-console-shared/src/mgmt.rs
index e878dd2b0..a81894a41 100644
--- a/lib/crowdb-console-shared/src/mgmt.rs
+++ b/lib/crowdb-console-shared/src/mgmt.rs
@@ -177,7 +177,7 @@ impl ServerClient {
     /// # Errors
     /// Transport / non-2xx status codes surface as `Error::UpstreamRpc`.
     pub async fn step_down(&self, sid: u64, gid: u64, req: &StepDownRequest) -> Result<StepDownResult> {
-        self.post_json(&format!("/stores/{sid}/groups/{gid}/step-down"), req)
+        self.post_json(&format!("/stores/{sid}/groups/{gid}/step-down?sync=true"), req)
             .await
     }
 
diff --git a/lib/crowdb-console-shared/src/ops/kv_logical.rs b/lib/crowdb-console-shared/src/ops/kv_logical.rs
index 42c925981..2ad922f61 100644
--- a/lib/crowdb-console-shared/src/ops/kv_logical.rs
+++ b/lib/crowdb-console-shared/src/ops/kv_logical.rs
@@ -622,6 +622,12 @@ pub async fn remove_replica(ctx: &OpContext, store_id: u64, group_id: u64, repli
             id: replica_id.to_string(),
         })?;
     let target_node = target.node_id;
+    // Removing the last replica leaves no valid Paxos membership. Treat the
+    // request as removal of the now-empty group so the logical projection
+    // cannot retain an orphaned group with zero voting members.
+    if replicas.len() == 1 {
+        return remove_group(ctx, store_id, group_id).await;
+    }
     if target.voting && replicas.iter().filter(|replica| replica.voting).count() <= 1 {
         return Err(Error::Validation {
             field: "replica_id".into(),

From 4c8738641ee9a80711e2caba0ad2b8404318d0b7 Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 22:57:56 +0800
Subject: [PATCH 10/11] Wait for DiskIO registration after deployment

---
 .../tests/native_cluster_provisioning_test.rs       | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/app/crowdb-web/tests/native_cluster_provisioning_test.rs b/app/crowdb-web/tests/native_cluster_provisioning_test.rs
index 85877bb95..7ea1e26b3 100644
--- a/app/crowdb-web/tests/native_cluster_provisioning_test.rs
+++ b/app/crowdb-web/tests/native_cluster_provisioning_test.rs
@@ -459,7 +459,18 @@ async fn node_diskio_discovers_disk_groups_created_after_deployment() {
     body["kind"] = json!("diskio");
     call(&app, "POST", "/api/nodes/1/services/deploy", body).await;
     let registry = crowdb_kv_client::ServiceRegistryClient::from_shared(state.kv_client().await);
-    let initial = registry.read_all_diskio_instances().await.unwrap();
+    let initial = tokio::time::timeout(std::time::Duration::from_secs(10), async {
+        let mut interval = tokio::time::interval(std::time::Duration::from_millis(100));
+        loop {
+            interval.tick().await;
+            let instances = registry.read_all_diskio_instances().await.unwrap();
+            if !instances.is_empty() {
+                break instances;
+            }
+        }
+    })
+    .await
+    .expect("node-local DiskIO registers after deployment");
     assert_eq!(initial.len(), 1);
     assert!(initial[0]
         .1

From a7930cebd102ee39f8ec1ec019cd828c734f3854 Mon Sep 17 00:00:00 2001
From: Gian <crow.db@outlook.com>
Date: Sat, 10 Oct 2026 23:42:01 +0800
Subject: [PATCH 11/11] Wait for namespace process record

---
 .../tests/runtime_namespace_test.rs                | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/crowdb-protocol/tests/runtime_namespace_test.rs b/lib/crowdb-protocol/tests/runtime_namespace_test.rs
index 36cbc0cc0..bfde31612 100644
--- a/lib/crowdb-protocol/tests/runtime_namespace_test.rs
+++ b/lib/crowdb-protocol/tests/runtime_namespace_test.rs
@@ -143,7 +143,19 @@ fn descendant_launchers_record_processes_in_the_parent_namespace() {
     let record = namespace
         .root()
         .join(format!("processes/{pid}/process-owner.json"));
-    let value: serde_json::Value = serde_json::from_slice(&std::fs::read(record).unwrap()).unwrap();
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(2);
+    let value = loop {
+        if let Ok(bytes) = std::fs::read(&record) {
+            if let Ok(value) = serde_json::from_slice::<serde_json::Value>(&bytes) {
+                break value;
+            }
+        }
+        assert!(
+            std::time::Instant::now() < deadline,
+            "descendant process ownership record becomes readable"
+        );
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    };
     assert_eq!(value["processes"][0]["pid"], pid);
     let cluster = RuntimeNamespace::persistent(namespace.data_dir(), "descendant-cluster").unwrap();
     let claims: serde_json::Value = serde_json::from_slice(