diff --git a/apps/demo/e2e/data-search.spec.ts b/apps/demo/e2e/data-search.spec.ts
index 73dd70d..b326524 100644
--- a/apps/demo/e2e/data-search.spec.ts
+++ b/apps/demo/e2e/data-search.spec.ts
@@ -230,3 +230,57 @@ test('csv drop: a 50-row edges fixture derives nodes and swaps the dataset', asy
   await expect(page.locator(SEARCH_OPTION).first()).toBeVisible({ timeout: 10_000 });
   await expect(page.locator(SEARCH_LABEL).first()).toHaveText(/^c17/);
 });
+
+test('a newer data-mode choice supersedes an in-flight CSV preparation', async ({
+  page,
+}, testInfo) => {
+  // Make the otherwise-small fixture deterministically asynchronous. Orbit's
+  // CSV lane consumes File.stream(), so delaying its first chunk leaves time
+  // for the user to choose another mode before preparation resolves.
+  await page.addInitScript(() => {
+    const state = window as typeof window & { __orbitCsvStreamFinished?: boolean };
+    state.__orbitCsvStreamFinished = false;
+    const originalStream = Blob.prototype.stream;
+    Blob.prototype.stream = function (this: Blob): ReadableStream<Uint8Array> {
+      const original = originalStream.call(this);
+      // Do not delay unrelated Blob consumers used while the app boots.
+      if (!(this instanceof File) || this.name !== 'superseded.csv') return original;
+      const reader = original.getReader();
+      return new ReadableStream<Uint8Array>({
+        async pull(controller) {
+          await new Promise<void>((resolve) => {
+            setTimeout(resolve, 500);
+          });
+          const next = await reader.read();
+          if (next.done) {
+            state.__orbitCsvStreamFinished = true;
+            controller.close();
+          } else controller.enqueue(next.value);
+        },
+        cancel(reason) {
+          return reader.cancel(reason);
+        },
+      });
+    };
+  });
+
+  const fixture = testInfo.outputPath('superseded.csv');
+  writeFileSync(fixture, 'source,target,weight\na,b,1\nb,c,2\n', 'utf8');
+  await gotoReady(page);
+
+  await page.setInputFiles('[data-testid="csv-file-input"]', fixture);
+  await page.getByTestId('semantic-mode').click();
+  await expect(page.getByTestId('m5-panel')).toBeVisible({ timeout: 15_000 });
+
+  // Wait for EOF rather than a wall-clock approximation, then give the
+  // preparation promise and React commit a chance to drain. Its completion
+  // must not replace the newer semantic mode or publish a CSV summary.
+  await page.waitForFunction(
+    () =>
+      (window as typeof window & { __orbitCsvStreamFinished?: boolean })
+        .__orbitCsvStreamFinished === true,
+  );
+  await page.waitForTimeout(250);
+  await expect(page.getByTestId('m5-panel')).toBeVisible();
+  await expect(page.getByTestId('csv-summary')).toHaveCount(0);
+});
diff --git a/apps/demo/e2e/ingestion.spec.ts b/apps/demo/e2e/ingestion.spec.ts
index 7295db0..9588181 100644
--- a/apps/demo/e2e/ingestion.spec.ts
+++ b/apps/demo/e2e/ingestion.spec.ts
@@ -134,3 +134,23 @@ test('stream feed → live meter → commit → isolate via context menu → res
   await expect(page.locator(SCOPE_STATUS)).toHaveText('full', { timeout: 10_000 });
   await expect(page.locator(NODE_COUNT)).toHaveText(fmt(STREAM_NODES));
 });
+
+test('leaving an active stream run cannot resurrect its cleared progress meter', async ({ page }) => {
+  // Enough batches to guarantee a paint/yield between the first progress
+  // receipt and completion; the test cancels immediately after that paint.
+  await page.goto('/?rows=200000');
+  await page.waitForSelector(READY_DOT, { timeout: 60_000 });
+  await page.getByTestId('stream-feed').click();
+  await expect(page.locator(METER)).toHaveAttribute('data-phase', 'streaming', {
+    timeout: 15_000,
+  });
+
+  await page.getByTestId('semantic-mode').click();
+  await expect(page.getByTestId('m5-panel')).toBeVisible({ timeout: 15_000 });
+  await expect(page.locator(METER)).toHaveCount(0);
+
+  // The abandoned driver emits its terminal `aborted` receipt at the next
+  // batch boundary. It must remain private to that obsolete run.
+  await page.waitForTimeout(500);
+  await expect(page.locator(METER)).toHaveCount(0);
+});
diff --git a/apps/demo/e2e/overlay-a11y.spec.ts b/apps/demo/e2e/overlay-a11y.spec.ts
index 8997656..6f3b377 100644
--- a/apps/demo/e2e/overlay-a11y.spec.ts
+++ b/apps/demo/e2e/overlay-a11y.spec.ts
@@ -132,9 +132,19 @@ test('navigator: Tab to toggle, open, arrow through items, Enter focuses a node'
 }) => {
   await gotoReady(page);
 
-  // The collapsible navigator toggle is the page's first tabbable element.
-  await page.keyboard.press('Tab');
   const toggle = page.locator(NAV_TOGGLE);
+  // Labels are legitimate keyboard controls and precede the overlay children
+  // in Graph's DOM. Prove the toggle is reachable by sequential keyboard
+  // navigation without coupling this test to the current number of labels.
+  let reachedToggle = false;
+  for (let tabs = 0; tabs < 64; tabs++) {
+    await page.keyboard.press('Tab');
+    if (await toggle.evaluate((element) => element === document.activeElement)) {
+      reachedToggle = true;
+      break;
+    }
+  }
+  expect(reachedToggle, 'Tab should reach the navigator toggle').toBe(true);
   await expect(toggle).toBeFocused();
   await expect(toggle).toHaveAttribute('aria-expanded', 'false');
 
diff --git a/apps/demo/package.json b/apps/demo/package.json
index 29f8c87..dfadf63 100644
--- a/apps/demo/package.json
+++ b/apps/demo/package.json
@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "vite build",
+    "build": "vite build && node ../../scripts/check-workspace-worker-asset.mjs",
     "preview": "vite preview",
     "typecheck": "tsc --noEmit",
     "test": "echo \"demo has no unit tests\" && exit 0",
diff --git a/apps/demo/src/App.tsx b/apps/demo/src/App.tsx
index d9b32e2..ce50d28 100644
--- a/apps/demo/src/App.tsx
+++ b/apps/demo/src/App.tsx
@@ -614,6 +614,10 @@ export function App() {
   /** Last unavailable activation ("<label>: <reason>") — sticky. */
   const [searchNote, setSearchNote] = useState<string | null>(null);
   const [csvError, setCsvError] = useState<string | null>(null);
+  /** Invalidates an in-flight CSV preparation when a newer data-mode action
+   * wins. Preparation intentionally runs before the graph mode changes. */
+  const csvLoadEpochRef = useRef(0);
+  const csvBusyRef = useRef(false);
 
   // --- M5 semantic-exploration state (see semantic.tsx) ---
   const [m5Grouping, setM5Grouping] = useState<M5Grouping>('none');
@@ -830,6 +834,7 @@ export function App() {
 
   // --- declarative data updates ---
   const regenerate = useCallback(() => {
+    csvLoadEpochRef.current += 1;
     setGen((g) => {
       const seed = nextSeed(g.seed);
       // New datasetKey → full reset (positions, per-dataset state).
@@ -847,6 +852,7 @@ export function App() {
   }, [resetOmnigraphState]);
 
   const addNodes = useCallback(() => {
+    csvLoadEpochRef.current += 1;
     // Same datasetKey, bumped sourceRevision, strict superset snapshot →
     // exercises the incremental diff + position preservation.
     setMode(DECLARATIVE);
@@ -860,6 +866,7 @@ export function App() {
   // purpose:'replace' is rejected while a declarative source drives, so
   // the session begins against a fresh, never-declarative instance.
   const streamFeed = useCallback(() => {
+    csvLoadEpochRef.current += 1;
     setSelection([]);
     setPendingIsolate(false);
     setDragNote(null);
@@ -881,7 +888,11 @@ export function App() {
       nodeShare: readStreamNodeShare(),
       family: readStreamFamily(),
       shouldCancel: () => cancelled,
-      onProgress: setMeter, // driver-throttled — receipts arrive far faster
+      // The driver emits a terminal aborted receipt during cleanup. Never let
+      // that old run repopulate a meter cleared by a mode/run switch.
+      onProgress: (progress) => {
+        if (!cancelled) setMeter(progress);
+      },
     }).catch((err: unknown) => {
       if (!cancelled) setError(err instanceof Error ? err.message : String(err));
     });
@@ -895,6 +906,7 @@ export function App() {
   // `purpose:'replace'` session, which may not race a declarative source,
   // so each load targets a fresh instance (`key` change).
   const loadOmnigraph = useCallback(() => {
+    csvLoadEpochRef.current += 1;
     setSelection([]);
     setPendingIsolate(false);
     setDragNote(null);
@@ -953,14 +965,15 @@ export function App() {
   // mode change remounts <Graph> (`key`) — the previous mode may have been a
   // replace-session stream, and a fresh instance takes the declarative
   // prepared snapshot without racing it.
-  const csvBusyRef = useRef(false);
   const onCsvFile = useCallback(
     (file: File) => {
       if (csvBusyRef.current) return; // one prepare at a time
       csvBusyRef.current = true;
+      const requestEpoch = ++csvLoadEpochRef.current;
       setCsvError(null);
       loadCsvEdgesFile(file)
         .then((result) => {
+          if (csvLoadEpochRef.current !== requestEpoch) return;
           setSelection([]);
           setPendingIsolate(false);
           setDragNote(null);
@@ -972,6 +985,7 @@ export function App() {
           setMode((m) => ({ kind: 'csv', runId: m.kind === 'csv' ? m.runId + 1 : 1, result }));
         })
         .catch((err: unknown) => {
+          if (csvLoadEpochRef.current !== requestEpoch) return;
           setCsvError(err instanceof Error ? err.message : String(err));
         })
         .finally(() => {
@@ -987,6 +1001,7 @@ export function App() {
   // this mode run a FIXED layout while the others stay on force.
   const enterSemantic = useCallback(
     (layout: M5Layout) => {
+      csvLoadEpochRef.current += 1;
       setSelection([]);
       setPendingIsolate(false);
       setDragNote(null);
@@ -1060,6 +1075,7 @@ export function App() {
 
   const m5OnLayoutChange = useCallback(
     (layout: M5Layout) => {
+      csvLoadEpochRef.current += 1;
       setMode((m) =>
         m.kind === 'semantic' && m.layout !== layout
           ? { kind: 'semantic', runId: m.runId + 1, layout }
diff --git a/packages/core/src/columnar.ts b/packages/core/src/columnar.ts
index 266b7e7..1069001 100644
--- a/packages/core/src/columnar.ts
+++ b/packages/core/src/columnar.ts
@@ -77,6 +77,16 @@ function checkStringColumn(
     out.push({ where, problem: 'not-a-string-column', detail: 'expected {kind:"string", dictionary, codes}' });
     return;
   }
+  for (let d = 0; d < col.dictionary.length; d++) {
+    if (typeof col.dictionary[d] !== 'string') {
+      out.push({
+        where,
+        problem: 'not-a-string-column',
+        detail: `dictionary entry ${d} is not a string`,
+      });
+      return;
+    }
+  }
   if (col.codes.length !== rows) {
     const detached = col.codes.length === 0 && col.codes.buffer.byteLength === 0;
     out.push({
diff --git a/packages/core/src/columnarValidate.ts b/packages/core/src/columnarValidate.ts
index 5522345..f12227b 100644
--- a/packages/core/src/columnarValidate.ts
+++ b/packages/core/src/columnarValidate.ts
@@ -11,9 +11,11 @@
  * STRING, which survives.
  * - duplicate edge ids drop, first wins ('duplicate-edge-id', warning).
  * - self-loops are RETAINED with 'self-loop-retained' (info).
- * - invalid-node / invalid-edge / dangling-edge cannot occur here: ids come
- * from a structurally validated dictionary column and endpoints are
- * in-bounds indices by prior validation (validateColumnarStructure).
+ * - invalid-node / invalid-edge rows with NUL-reserved ids drop here;
+ * dangling edges can then arise when an endpoint names a dropped invalid
+ * node. Other structural corruption cannot occur because ids come from a
+ * structurally validated dictionary column and endpoints are in-bounds
+ * indices by prior validation (validateColumnarStructure).
  *
  * Duplicates hide in TWO encodings: two rows sharing a code, and two
  * DISTINCT dictionary entries holding equal strings. Both are handled by
@@ -95,6 +97,7 @@ export function acceptColumnar(
   const edgeRows = snapshot.edges.length;
 
   const duplicateNode: Tally = { count: 0, samples: [] };
+  const invalidEdge: Tally = { count: 0, samples: [] };
   const duplicateEdge: Tally = { count: 0, samples: [] };
   const selfLoop: Tally = { count: 0, samples: [] };
   const invalidNode: Tally = { count: 0, samples: [] };
@@ -137,18 +140,21 @@ export function acceptColumnar(
 
   // --- Edges: first occurrence per canonical edge id wins; self-loops kept. -
   const edgeCanonical = canonicalizeDictionary(edgeIds.dictionary);
+  const nulEdgeDict = new Uint8Array(edgeIds.dictionary.length);
+  for (let d = 0; d < edgeIds.dictionary.length; d++) {
+    if (edgeIds.dictionary[d]!.includes('\u0000')) nulEdgeDict[d] = 1;
+  }
   const keepEdges = new Uint8Array(edgeRows);
   const seenEdgeByCanonical = new Uint8Array(edgeIds.dictionary.length);
   const { source, target } = snapshot.edges;
   const linksOut = new Uint32Array(edgeRows * 2); // trimmed after the scan
   let acceptedEdgeCount = 0;
   for (let e = 0; e < edgeRows; e++) {
-    const canonical = edgeCanonical[edgeIds.codes[e]!]!;
-    if (seenEdgeByCanonical[canonical] !== 0) {
-      record(duplicateEdge, edgeIds.dictionary[edgeIds.codes[e]!]!);
+    if (nulEdgeDict[edgeIds.codes[e]!] !== 0) {
+      record(invalidEdge, `[${e}]`);
       continue;
     }
-    seenEdgeByCanonical[canonical] = 1;
+    const canonical = edgeCanonical[edgeIds.codes[e]!]!;
     const s = nodeAcceptedIndex[source[e]!]!;
     const t = nodeAcceptedIndex[target[e]!]!;
     if (s === -1 || t === -1) {
@@ -160,6 +166,16 @@ export function acceptColumnar(
       );
       continue;
     }
+    // Object-lane order is endpoint admission BEFORE final-id dedupe: a
+    // dangling record never occupies its edge id, so a later endpoint-valid
+    // record with the same id remains eligible. NUL-invalid node rows make
+    // that distinction observable in the otherwise structurally sound
+    // columnar lane.
+    if (seenEdgeByCanonical[canonical] !== 0) {
+      record(duplicateEdge, edgeIds.dictionary[edgeIds.codes[e]!]!);
+      continue;
+    }
+    seenEdgeByCanonical[canonical] = 1;
     if (s === t) {
       // Same ACCEPTED node = same id string (the object lane compares
       // source/target strings) — retained, reported.
@@ -188,6 +204,13 @@ export function acceptColumnar(
     duplicateNode,
     `${duplicateNode.count} duplicate node id(s) dropped (first occurrence wins)`,
   );
+  pushDiagnostic(
+    diagnostics,
+    'invalid-edge',
+    'error',
+    invalidEdge,
+    `${invalidEdge.count} edge row(s) dropped: missing or non-string source/target, or NUL-containing explicit id`,
+  );
   pushDiagnostic(
     diagnostics,
     'dangling-edge-endpoint',
diff --git a/packages/core/src/ingestion.ts b/packages/core/src/ingestion.ts
index 2e0ec77..7461cc4 100644
--- a/packages/core/src/ingestion.ts
+++ b/packages/core/src/ingestion.ts
@@ -222,7 +222,11 @@ export function stageBatch<N, E>(
   for (let i = 0; i < rawNodes.length; i++) {
     const row = rawNodes[i];
     const id = typeof row === 'object' && row !== null ? (row as { id?: unknown }).id : undefined;
-    if (typeof id !== 'string') {
+    if (typeof id !== 'string' || id.includes('\u0000')) {
+      // U+0000 is reserved by the scene-key codec for collapsed-group
+      // super-nodes. Streaming ingestion must enforce the same namespace
+      // boundary as declarative snapshot validation; otherwise an overlay
+      // row can collide with a synthetic scene row during group rewrite.
       recordRow(tallies.invalidNodes, `[${batch.sequence}:${i}]`);
       continue;
     }
@@ -248,6 +252,12 @@ export function stageBatch<N, E>(
       recordRow(tallies.invalidEdges, typeof edge.id === 'string' ? edge.id : `[${batch.sequence}:${i}]`);
       continue;
     }
+    if (typeof edge.id === 'string' && edge.id.includes('\u0000')) {
+      // Explicit edge ids occupy the same rendered id lane as internal
+      // meta-edge scene keys, whose reserved namespace begins with U+0000.
+      recordRow(tallies.invalidEdges, `[${batch.sequence}:${i}]`);
+      continue;
+    }
     const hasExplicitId = typeof edge.id === 'string';
     let id: string;
     if (hasExplicitId) {
@@ -511,7 +521,7 @@ export function sessionCommitDiagnostics(
     'invalid-node',
     'error',
     tallies.invalidNodes,
-    `${tallies.invalidNodes.count} ingested node row(s) dropped: missing or non-string id`,
+    `${tallies.invalidNodes.count} ingested node row(s) dropped: missing, non-string, or NUL-containing id`,
   );
   push(
     'duplicate-node-id',
@@ -523,7 +533,7 @@ export function sessionCommitDiagnostics(
     'invalid-edge',
     'error',
     tallies.invalidEdges,
-    `${tallies.invalidEdges.count} ingested edge row(s) dropped: missing or non-string source/target`,
+    `${tallies.invalidEdges.count} ingested edge row(s) dropped: missing or non-string source/target, or NUL-containing explicit id`,
   );
   push(
     'duplicate-edge-id',
diff --git a/packages/core/src/instance.ts b/packages/core/src/instance.ts
index 15ed453..87eda0e 100644
--- a/packages/core/src/instance.ts
+++ b/packages/core/src/instance.ts
@@ -3953,7 +3953,7 @@ export function createGraphInstance<N = Record<string, unknown>, E = Record<stri
             simRestarted = true;
           }
         }
-        eng.commit(commit);
+        commitToEngine(eng, commit);
         revisions.appliedRender = eng.appliedRevision();
         const facade = session !== null ? session.edgePicking : null;
         if (facade !== null) {
@@ -9874,47 +9874,48 @@ export function createGraphInstance<N = Record<string, unknown>, E = Record<stri
   }
 
   /** styling capture: Scales that are data by construction. */
-  function serializableScaleOf(
+  function serializableScaleOf<T extends string | number>(
     channel: 'nodeColor' | 'nodeSize',
-    value: unknown,
-  ): SerializableScale | undefined {
+    value: Accessor<GraphNode<N>, T> | Scale<T, N> | undefined,
+  ): SerializableScale<T> | undefined {
     if (value === undefined) return undefined;
     if (typeof value === 'function') {
       warnViewStateDrop(channel, 'accessor functions do not serialize');
       return undefined;
     }
     if (!isScaleValue(value)) return undefined; // constants are app defaults, not captured
-    if (value.kind === 'sequential') {
+    const scale = value as Scale<T, N>;
+    if (scale.kind === 'sequential') {
       return {
         kind: 'sequential',
-        metric: value.metric,
-        range: value.range as readonly string[] | readonly number[],
+        metric: scale.metric,
+        range: scale.range,
         // The numeric-array domain form is data; a DomainPolicy is app
         // behavior config and stays with the app.
-        ...(Array.isArray(value.domain) ? { domain: value.domain as readonly number[] } : {}),
-      };
+        ...(Array.isArray(scale.domain)
+          ? { domain: scale.domain as readonly [number, number] }
+          : {}),
+      } as SerializableScale<T>;
     }
-    if (value.kind === 'diverging') {
+    if (scale.kind === 'diverging') {
       return {
         kind: 'diverging',
-        metric: value.metric,
-        range: value.range as readonly string[] | readonly number[],
-        mid: value.mid,
-      };
+        metric: scale.metric,
+        range: scale.range,
+        mid: scale.mid,
+      } as SerializableScale<T>;
     }
     // categorical: only the field-descriptor `by` form is data.
-    if (typeof value.by !== 'string') {
+    if (typeof scale.by !== 'string') {
       warnViewStateDrop(channel, "a function-`by` categorical scale does not serialize");
       return undefined;
     }
     return {
       kind: 'categorical',
-      by: value.by,
-      ...(value.palette !== undefined
-        ? { palette: value.palette as readonly string[] | readonly number[] }
-        : {}),
-      ...(value.domain !== undefined ? { domain: value.domain } : {}),
-    };
+      by: scale.by,
+      ...(scale.palette !== undefined ? { palette: scale.palette } : {}),
+      ...(scale.domain !== undefined ? { domain: scale.domain } : {}),
+    } as SerializableScale<T>;
   }
 
   /** Named-theme capture: only 'light'/'dark' serialize (custom GraphTheme
@@ -10336,7 +10337,7 @@ export function createGraphInstance<N = Record<string, unknown>, E = Record<stri
                   ...prevState.revisions,
                   render: prevState.revisions.render + 1,
                 };
-                eng.commit({
+                commitToEngine(eng, {
                   revision: nextRevisions.render,
                   structure: {
                     pointCount: scene.count,
@@ -10344,6 +10345,7 @@ export function createGraphInstance<N = Record<string, unknown>, E = Record<stri
                     links: scene.links,
                   },
                 });
+                nextRevisions.appliedRender = eng.appliedRevision();
                 eng.pause();
                 const patch: Partial<GraphStoreState> = { revisions: nextRevisions };
                 if (prevState.simulationRunning) patch.simulationRunning = false;
diff --git a/packages/core/src/validate.ts b/packages/core/src/validate.ts
index d7fc585..d7c8637 100644
--- a/packages/core/src/validate.ts
+++ b/packages/core/src/validate.ts
@@ -111,6 +111,13 @@ export function validateSnapshot<N = Record<string, unknown>, E = Record<string,
       record(invalidEdge, typeof edge.id === 'string' ? edge.id : `[${i}]`);
       continue;
     }
+    if (typeof edge.id === 'string' && edge.id.includes('\u0000')) {
+      // U+0000 prefixes the internal meta-edge scene-key codec. Physical
+      // edge ids share the rendered edge-id lane with those synthetic rows,
+      // so an explicit caller id in that namespace could alias a meta-edge.
+      record(invalidEdge, `[${i}]`);
+      continue;
+    }
     if (!nodeIndex.has(source)) {
       record(danglingEdge, source);
       continue;
@@ -170,7 +177,7 @@ export function validateSnapshot<N = Record<string, unknown>, E = Record<string,
     'invalid-edge',
     'error',
     invalidEdge,
-    `${invalidEdge.count} edge row(s) dropped: missing or non-string source/target`,
+    `${invalidEdge.count} edge row(s) dropped: missing or non-string source/target, or NUL-containing explicit id`,
   );
   pushDiagnostic(
     diagnostics,
diff --git a/packages/core/src/viewState.ts b/packages/core/src/viewState.ts
index 2f5381a..889930f 100644
--- a/packages/core/src/viewState.ts
+++ b/packages/core/src/viewState.ts
@@ -60,26 +60,37 @@ export interface ViewLayoutSpec {
   kind: 'force' | 'fixed';
 }
 
-/** Scale subset that is data by construction (no functions). */
-export type SerializableScale =
+type SerializableScaleFor<T extends string | number> =
   | {
-      kind: 'sequential' | 'diverging';
+      kind: 'sequential';
       metric: string;
-      range: readonly string[] | readonly number[];
-      domain?: readonly number[];
-      mid?: number;
+      range: readonly [T, T];
+      domain?: readonly [number, number];
+    }
+  | {
+      kind: 'diverging';
+      metric: string;
+      range: readonly [T, T, T];
+      mid: number;
     }
   | {
       kind: 'categorical';
       /** Field-descriptor form only — a function `by` is omitted upstream. */
       by: string;
-      palette?: readonly string[] | readonly number[];
+      palette?: readonly T[];
       domain?: readonly string[];
     };
 
+/** Scale subset that is data by construction (no functions). `T` is bound
+ * by the styling channel: CSS strings for nodeColor, finite numbers for
+ * nodeSize. Tuple arity mirrors the runtime Scale<T> contract exactly. The
+ * conditional preserves homogeneous value collections when `T` is a union. */
+export type SerializableScale<T extends string | number = string | number> =
+  T extends unknown ? SerializableScaleFor<T> : never;
+
 export interface ViewStyling {
-  nodeColor?: SerializableScale;
-  nodeSize?: SerializableScale;
+  nodeColor?: SerializableScale<string>;
+  nodeSize?: SerializableScale<number>;
   showLinks?: boolean;
   edgeArrows?: boolean;
   /** Named themes only; a custom GraphTheme object is omitted upstream. */
@@ -195,6 +206,7 @@ const isBool = (v: unknown): v is boolean => typeof v === 'boolean';
 const isObj = (v: unknown): v is Record<string, unknown> =>
   typeof v === 'object' && v !== null && !Array.isArray(v);
 const isStrArray = (v: unknown): v is string[] => Array.isArray(v) && v.every(isStr);
+const isNumArray = (v: unknown): v is number[] => Array.isArray(v) && v.every(isNum);
 
 function validateBrush(v: unknown, at: string, problems: string[]): void {
   if (!isObj(v)) {
@@ -215,18 +227,51 @@ function validateBrush(v: unknown, at: string, problems: string[]): void {
   problems.push(`${at}: unknown brush kind`);
 }
 
-function validateScale(v: unknown, at: string, problems: string[]): void {
+function validateScale(
+  v: unknown,
+  at: string,
+  valueKind: 'string' | 'number',
+  problems: string[],
+): void {
   if (!isObj(v)) {
     problems.push(`${at}: not an object`);
     return;
   }
-  if (v['kind'] === 'sequential' || v['kind'] === 'diverging') {
+  const isValueArray = valueKind === 'string' ? isStrArray : isNumArray;
+  const valueLabel = valueKind === 'string' ? 'string' : 'finite number';
+  if (v['kind'] === 'sequential') {
     if (!isStr(v['metric'])) problems.push(`${at}: metric must be a string`);
-    if (!Array.isArray(v['range'])) problems.push(`${at}: range must be an array`);
+    if (!isValueArray(v['range']) || v['range'].length !== 2) {
+      problems.push(`${at}: sequential range must be a [${valueLabel}, ${valueLabel}] tuple`);
+    }
+    if (
+      v['domain'] !== undefined &&
+      (!isNumArray(v['domain']) || v['domain'].length !== 2)
+    ) {
+      problems.push(`${at}: sequential domain must be a [min, max] finite-number tuple`);
+    }
+    return;
+  }
+  if (v['kind'] === 'diverging') {
+    if (!isStr(v['metric'])) problems.push(`${at}: metric must be a string`);
+    if (!isValueArray(v['range']) || v['range'].length !== 3) {
+      problems.push(
+        `${at}: diverging range must be a [${valueLabel}, ${valueLabel}, ${valueLabel}] tuple`,
+      );
+    }
+    if (!isNum(v['mid'])) {
+      problems.push(`${at}: diverging mid must be a finite number`);
+    }
     return;
   }
   if (v['kind'] === 'categorical') {
     if (!isStr(v['by'])) problems.push(`${at}: categorical 'by' must be a field string`);
+    if (v['domain'] !== undefined && !isStrArray(v['domain'])) {
+      problems.push(`${at}: categorical domain must be a string[]`);
+    }
+    if (v['palette'] !== undefined && !isValueArray(v['palette'])) {
+      problems.push(`${at}: categorical palette must be a ${valueLabel}[]`);
+    }
     return;
   }
   problems.push(`${at}: unknown scale kind`);
@@ -378,10 +423,10 @@ export function validateViewState(raw: unknown): ViewStateVerdict {
       problems.push('styling: must be an object');
     } else {
       if (styling['nodeColor'] !== undefined) {
-        validateScale(styling['nodeColor'], 'styling.nodeColor', problems);
+        validateScale(styling['nodeColor'], 'styling.nodeColor', 'string', problems);
       }
       if (styling['nodeSize'] !== undefined) {
-        validateScale(styling['nodeSize'], 'styling.nodeSize', problems);
+        validateScale(styling['nodeSize'], 'styling.nodeSize', 'number', problems);
       }
       for (const flag of ['showLinks', 'edgeArrows'] as const) {
         if (styling[flag] !== undefined && !isBool(styling[flag])) {
diff --git a/packages/core/src/worker/entry.js b/packages/core/src/worker/entry.js
new file mode 100644
index 0000000..3ac3a21
--- /dev/null
+++ b/packages/core/src/worker/entry.js
@@ -0,0 +1,6 @@
+// Shared bootstrap for workspace Vite builds and the published worker asset.
+// The implementation stays in TypeScript so the real thread and test double
+// continue to share the same runtime/codec.
+import { installWorkerEntry } from './entry.ts';
+
+installWorkerEntry(self);
diff --git a/packages/core/src/worker/entry.ts b/packages/core/src/worker/entry.ts
index e9e3094..43bd0d6 100644
--- a/packages/core/src/worker/entry.ts
+++ b/packages/core/src/worker/entry.ts
@@ -8,13 +8,17 @@
 import { EnvelopeSequencer } from '../workerProtocol';
 import { handleWorkerRequest } from './runtime';
 
-const sequencer = new EnvelopeSequencer();
-const scope = self as unknown as {
+export interface WorkerEntryScope {
   onmessage: ((ev: MessageEvent) => void) | null;
   postMessage: (message: unknown, transfer: Transferable[]) => void;
-};
+}
 
-scope.onmessage = (ev: MessageEvent) => {
-  const { reply, transfers } = handleWorkerRequest(ev.data, sequencer);
-  scope.postMessage(reply, [...transfers]);
-};
+/** Install the thread glue. The .js bootstrap calls this in both workspace
+ * Vite builds and the self-contained published worker bundle. */
+export function installWorkerEntry(scope: WorkerEntryScope): void {
+  const sequencer = new EnvelopeSequencer();
+  scope.onmessage = (ev: MessageEvent) => {
+    const { reply, transfers } = handleWorkerRequest(ev.data, sequencer);
+    scope.postMessage(reply, [...transfers]);
+  };
+}
diff --git a/packages/core/src/worker/lane.ts b/packages/core/src/worker/lane.ts
index 8c55803..311b26a 100644
--- a/packages/core/src/worker/lane.ts
+++ b/packages/core/src/worker/lane.ts
@@ -12,6 +12,7 @@
 
 import { EnvelopeSequencer, RequestLedger } from '../workerProtocol';
 import type { RequestClass, WorkerEntity, WorkerEnvelope } from '../workerProtocol';
+import { createDefaultWorker } from '../workerAsset';
 
 export interface WorkerTransport {
   post(envelope: WorkerEnvelope, transfers: readonly ArrayBuffer[]): void;
@@ -29,12 +30,6 @@ export type WorkerFactoryOption =
   | { create: () => Worker }
   | undefined;
 
-function defaultWorkerUrl(): URL {
-  // Resolves next to the built module (dist/worker/entry.js). Bundlers that
-  // rewrite `new URL(..., import.meta.url)` keep this working in app builds.
-  return new URL('./worker/entry.js', import.meta.url);
-}
-
 function transportFromWorker(worker: Worker): WorkerTransport {
   return {
     post: (envelope, transfers) => worker.postMessage(envelope, [...transfers]),
@@ -101,10 +96,9 @@ export class WorkerLane {
         const worker =
           factory !== undefined && 'create' in factory
             ? factory.create()
-            : new Worker(
-                factory !== undefined && 'url' in factory ? factory.url : defaultWorkerUrl(),
-                { type: 'module' },
-              );
+            : factory !== undefined && 'url' in factory
+              ? new Worker(factory.url, { type: 'module' })
+              : createDefaultWorker();
         transport = transportFromWorker(worker);
       }
       transport.onReply((reply) => this.settle(reply));
diff --git a/packages/core/src/workerAsset.ts b/packages/core/src/workerAsset.ts
new file mode 100644
index 0000000..1c5ee20
--- /dev/null
+++ b/packages/core/src/workerAsset.ts
@@ -0,0 +1,12 @@
+/**
+ * Construct the built-in module worker from a package-root-relative asset.
+ *
+ * This file deliberately lives at src/ root: workspace consumers resolve
+ * package exports to src/index.ts, while published consumers execute the
+ * bundled dist/index.js. In both layouts `./worker/entry.js` is therefore
+ * adjacent at the same relative path, and Vite can statically discover the
+ * direct Worker(new URL(...)) expression in workspace builds.
+ */
+export function createDefaultWorker(): Worker {
+  return new Worker(new URL('./worker/entry.js', import.meta.url), { type: 'module' });
+}
diff --git a/packages/core/test/clusters.test.ts b/packages/core/test/clusters.test.ts
index 3bc061d..7fdaeca 100644
--- a/packages/core/test/clusters.test.ts
+++ b/packages/core/test/clusters.test.ts
@@ -306,6 +306,39 @@ describe('capability gating', () => {
     expect(commit.structure!.pointCount).toBe(5);
     expect(commit.config!.cluster!.pointClusters).toHaveLength(5);
   });
+
+  it('scope history keeps pointClusters aligned across isolate undo/redo (I2)', async () => {
+    const { instance, engine } = await rig({ capabilities: { clusterForce: true } });
+    instance.applyHostUpdate({ data: teamSnap(), clusters: { by: BY } });
+    instance.selectNodes(['a', 'c']);
+    instance.isolateSelection();
+
+    expect(instance.undo()).toBe(true);
+    const restored = engine.lastCommit!;
+    expect(restored.structure!.pointCount).toBe(4);
+    expect(Array.from(restored.config!.cluster!.pointClusters)).toEqual([0, 0, 1, NaN]);
+
+    expect(instance.redo()).toBe(true);
+    const isolated = engine.lastCommit!;
+    expect(isolated.structure!.pointCount).toBe(2);
+    expect(Array.from(isolated.config!.cluster!.pointClusters)).toEqual([0, 1]);
+  });
+
+  it('fold history keeps pointClusters aligned across undo/redo (I2)', async () => {
+    const { instance, engine } = await rig({ capabilities: { clusterForce: true } });
+    instance.applyHostUpdate({ data: teamSnap(), clusters: { by: BY } });
+    instance.foldNode('a', { memberIds: ['b'] });
+
+    expect(instance.undo()).toBe(true);
+    const restored = engine.lastCommit!;
+    expect(restored.structure!.pointCount).toBe(4);
+    expect(Array.from(restored.config!.cluster!.pointClusters)).toEqual([0, 0, 1, NaN]);
+
+    expect(instance.redo()).toBe(true);
+    const folded = engine.lastCommit!;
+    expect(folded.structure!.pointCount).toBe(3);
+    expect(Array.from(folded.config!.cluster!.pointClusters)).toEqual([0, 1, NaN]);
+  });
 });
 
 describe('stage-4 dirty discipline', () => {
diff --git a/packages/core/test/columnar-ingest.test.ts b/packages/core/test/columnar-ingest.test.ts
index 551d128..15badf9 100644
--- a/packages/core/test/columnar-ingest.test.ts
+++ b/packages/core/test/columnar-ingest.test.ts
@@ -109,6 +109,30 @@ describe('structural validation (reject WHOLE, O(cols+rows))', () => {
       'bad-column-kind',
     );
   });
+
+  it('rejects non-string dictionary entries before main or worker admission', () => {
+    for (const mutate of [
+      (snapshot: Fixture) => {
+        (snapshot.nodes.ids.dictionary as unknown[])[1] = 42;
+      },
+      (snapshot: Fixture) => {
+        (snapshot.edges.ids.dictionary as unknown[])[0] = { id: 'e1' };
+      },
+      (snapshot: Fixture) => {
+        const cluster = snapshot.nodes.columns!.cluster!;
+        if (cluster.kind === 'string') (cluster.dictionary as unknown[])[0] = null;
+      },
+    ]) {
+      const snapshot = fixture();
+      mutate(snapshot);
+      expect(validateColumnarStructure(snapshot)).toContainEqual(
+        expect.objectContaining({
+          problem: 'not-a-string-column',
+          detail: expect.stringContaining('dictionary entry'),
+        }),
+      );
+    }
+  });
 });
 
 describe('ingestion through the instance (the shared pipeline)', () => {
@@ -162,6 +186,22 @@ describe('ingestion through the instance (the shared pipeline)', () => {
     expect(instance.getSceneNodeIds()).toEqual(['a', 'b', 'c']);
   });
 
+  it('rejects a non-string id dictionary WHOLE instead of materializing non-string ids', async () => {
+    const { instance } = await rig();
+    instance.applyHostUpdate({ data: snap(1, ['keep'], []) });
+    const bad = fixture();
+    (bad.nodes.ids.dictionary as unknown[])[0] = 7;
+
+    instance.applyHostUpdate({ data: bad });
+
+    expect(instance.getSceneNodeIds()).toEqual(['keep']);
+    expect(
+      instance.store
+        .getState()
+        .diagnostics.find((diag) => diag.code === 'invalid-columnar-snapshot')?.message,
+    ).toContain('dictionary entry 0 is not a string');
+  });
+
   it('duplicate ids and self-loops flow through the OBJECT-lane rules (one place)', async () => {
     const { instance } = await rig();
     const dup = fixture();
diff --git a/packages/core/test/columnar-validate.test.ts b/packages/core/test/columnar-validate.test.ts
index cd430a4..5922678 100644
--- a/packages/core/test/columnar-validate.test.ts
+++ b/packages/core/test/columnar-validate.test.ts
@@ -125,6 +125,51 @@ describe('columnar-native acceptance vs the object-lane oracle', () => {
     ]);
   });
 
+  it('NUL-reserved explicit edge ids drop identically in native and object lanes', () => {
+    const snapshot = col();
+    (snapshot.edges.ids as { dictionary: readonly string[] }).dictionary = [
+      '\u0000["meta-edge","a","b"]',
+      'safe',
+    ];
+
+    expectOracleAgreement(snapshot);
+    const native = acceptColumnar(snapshot);
+    expect(native.acceptedEdgeCount).toBe(1);
+    expect(native.diagnostics).toContainEqual(
+      expect.objectContaining({ code: 'invalid-edge', count: 1, sampleIds: ['[0]'] }),
+    );
+  });
+
+  it('a dangling edge does not reserve its id ahead of a later valid edge', () => {
+    const snapshot = col({
+      nodes: {
+        ids: {
+          kind: 'string',
+          dictionary: ['bad\u0000node', 'b', 'c'],
+          codes: Uint32Array.of(0, 1, 2),
+        },
+        columns: {},
+        length: 3,
+      },
+      edges: {
+        ids: { kind: 'string', dictionary: ['same'], codes: Uint32Array.of(0, 0) },
+        source: Uint32Array.of(0, 1),
+        target: Uint32Array.of(1, 2),
+        columns: {},
+        length: 2,
+      },
+    });
+
+    expectOracleAgreement(snapshot);
+    const native = acceptColumnar(snapshot);
+    expect(native.acceptedEdgeCount).toBe(1);
+    expect([...native.keepEdges]).toEqual([0, 1]);
+    expect(native.diagnostics.map((diag) => diag.code)).toEqual([
+      'invalid-node',
+      'dangling-edge-endpoint',
+    ]);
+  });
+
   it('a duplicate-row COLLAPSE creating a self-loop matches the object lane', () => {
     // Edge (row0 → row2) where row 2 duplicates row 0's id: both lanes see
     // source string == target string → retained self-loop.
diff --git a/packages/core/test/ingestion.test.ts b/packages/core/test/ingestion.test.ts
index 658658e..1c6f4e4 100644
--- a/packages/core/test/ingestion.test.ts
+++ b/packages/core/test/ingestion.test.ts
@@ -90,6 +90,51 @@ describe('estimateBatchBytes', () => {
 });
 
 describe('stageBatch synthesized edge identities', () => {
+  it('rejects NUL-containing node ids reserved for synthetic group scene keys', () => {
+    const contribution = newContribution<NAttrs, EAttrs>('overlay');
+    const tallies = newStagingTallies();
+    let order = 0;
+
+    const result = stageBatch(
+      contribution,
+      batch(0, 'b0', {
+        nodes: [
+          { id: '\0["group","g"]', attrs: { label: 'collision' } },
+          { id: 'safe', attrs: { label: 'safe' } },
+        ],
+      }),
+      tallies,
+      () => order++,
+    );
+
+    expect(result).toEqual({ admittedNodes: 1, admittedEdges: 0 });
+    expect(contribution.nodes.map(({ node }) => node.id)).toEqual(['safe']);
+    expect(contribution.nodeIds).toEqual(new Set(['safe']));
+    expect(tallies.invalidNodes).toEqual({ count: 1, samples: ['[0:0]'] });
+  });
+
+  it('rejects explicit edge ids reserved for synthetic meta-edge scene keys', () => {
+    const contribution = newContribution<NAttrs, EAttrs>('overlay');
+    const tallies = newStagingTallies();
+    let order = 0;
+
+    const result = stageBatch(
+      contribution,
+      batch(0, 'b0', {
+        edges: [
+          { id: '\u0000["meta-edge","a","b"]', source: 'a', target: 'b' },
+          { id: 'safe', source: 'a', target: 'b' },
+        ],
+      }),
+      tallies,
+      () => order++,
+    );
+
+    expect(result).toEqual({ admittedNodes: 0, admittedEdges: 1 });
+    expect(contribution.edges.map(({ edge }) => edge.id)).toEqual(['safe']);
+    expect(tallies.invalidEdges).toEqual({ count: 1, samples: ['[0:0]'] });
+  });
+
   it('keeps delimiter- and NUL-bearing endpoint tuples distinct', () => {
     const contribution = newContribution<NAttrs, EAttrs>('overlay');
     const tallies = newStagingTallies();
diff --git a/packages/core/test/validate.test.ts b/packages/core/test/validate.test.ts
index 54cec73..c650b28 100644
--- a/packages/core/test/validate.test.ts
+++ b/packages/core/test/validate.test.ts
@@ -86,6 +86,23 @@ describe('validateSnapshot — edges', () => {
     expect(d).toMatchObject({ severity: 'error', count: 5 });
   });
 
+  it('drops explicit edge ids in the reserved NUL meta-edge namespace', () => {
+    const reserved = '\u0000["meta-edge","a","b"]';
+    const result = validateSnapshot(
+      snap(ab, [
+        { id: reserved, source: 'a', target: 'b' },
+        { id: 'safe', source: 'a', target: 'b' },
+      ]),
+    );
+
+    expect(result.edges.map((edge) => edge.id)).toEqual(['safe']);
+    expect(diag(result.diagnostics, 'invalid-edge')).toMatchObject({
+      severity: 'error',
+      count: 1,
+      sampleIds: ['[0]'],
+    });
+  });
+
   it('drops edges whose endpoint is not in the accepted node set', () => {
     const result = validateSnapshot(
       snap(ab, [
diff --git a/packages/core/test/view-state.test.ts b/packages/core/test/view-state.test.ts
index b9cf6db..6d7c294 100644
--- a/packages/core/test/view-state.test.ts
+++ b/packages/core/test/view-state.test.ts
@@ -15,9 +15,32 @@ import {
   validateViewState,
   VIEW_STATE_VERSION,
 } from '../src/viewState';
-import type { GraphViewState } from '../src/viewState';
+import type { GraphViewState, SerializableScale, ViewStyling } from '../src/viewState';
 import { container, makeInstance, snap } from './helpers';
 
+// Compile-time witnesses for the public default generic. Its value union must
+// distribute over whole scales, rather than permit mixed value collections.
+const _defaultStringScale: SerializableScale = {
+  kind: 'sequential',
+  metric: 'degree',
+  range: ['#000', '#fff'],
+};
+const _defaultNumberScale: SerializableScale = {
+  kind: 'categorical',
+  by: 'type',
+  palette: [2, 4],
+};
+// @ts-expect-error a serializable scale cannot mix string and number tuple values
+const _mixedDefaultTuple: SerializableScale = { kind: 'sequential', metric: 'degree', range: ['#000', 4] };
+// @ts-expect-error a serializable scale cannot mix string and number palette values
+const _mixedDefaultPalette: SerializableScale = { kind: 'categorical', by: 'type', palette: ['#000', 4] };
+const _channelScales: ViewStyling = {
+  nodeColor: _defaultStringScale,
+  nodeSize: _defaultNumberScale,
+};
+// @ts-expect-error nodeColor remains a string-valued styling channel
+const _wrongColorChannel: ViewStyling = { nodeColor: _defaultNumberScale };
+
 // ---------------------------------------------------------------------------
 // Canonical JSON
 // ---------------------------------------------------------------------------
@@ -113,6 +136,98 @@ describe('validateViewState', () => {
     expect(validateViewState(bad).ok).toBe(false);
   });
 
+  it('rejects malformed categorical scale domains and palettes', () => {
+    const verdicts = [
+      validateViewState({
+        ...MINIMAL,
+        styling: { nodeColor: { kind: 'categorical', by: 'type', domain: 'type' } },
+      }),
+      validateViewState({
+        ...MINIMAL,
+        styling: { nodeColor: { kind: 'categorical', by: 'type', domain: ['ok', 1] } },
+      }),
+      validateViewState({
+        ...MINIMAL,
+        styling: { nodeColor: { kind: 'categorical', by: 'type', palette: '#f00' } },
+      }),
+      validateViewState({
+        ...MINIMAL,
+        styling: { nodeSize: { kind: 'categorical', by: 'type', palette: [1, '2'] } },
+      }),
+      validateViewState({
+        ...MINIMAL,
+        styling: { nodeSize: { kind: 'categorical', by: 'type', palette: [1, Infinity] } },
+      }),
+    ];
+    for (const verdict of verdicts) {
+      expect(verdict.ok).toBe(false);
+      if (!verdict.ok) expect(verdict.code).toBe('invalid-view-state');
+    }
+
+    expect(
+      validateViewState({
+        ...MINIMAL,
+        styling: {
+          nodeColor: {
+            kind: 'categorical',
+            by: 'type',
+            domain: ['a', 'b'],
+            palette: ['#f00', '#0f0'],
+          },
+          nodeSize: { kind: 'categorical', by: 'type', palette: [2, 4] },
+        },
+      }).ok,
+    ).toBe(true);
+  });
+
+  it('rejects malformed or channel-incompatible numeric scale tuples', () => {
+    const sizeScales = [
+      { kind: 'sequential', metric: 'degree', range: ['#000', 7] },
+      { kind: 'sequential', metric: 'degree', range: [1, Number.NaN] },
+      { kind: 'sequential', metric: 'degree', range: [1] },
+      { kind: 'sequential', metric: 'degree', range: [1, 2, 3] },
+      { kind: 'sequential', metric: 'degree', range: [1, 2], domain: [0] },
+      { kind: 'sequential', metric: 'degree', range: [1, 2], domain: [0, 'high'] },
+      { kind: 'diverging', metric: 'risk', range: [1, 2, 3] },
+      { kind: 'diverging', metric: 'risk', range: [1, 2], mid: 0 },
+      { kind: 'diverging', metric: 'risk', range: [1, 2, 3, 4], mid: 0 },
+      { kind: 'diverging', metric: 'risk', range: [1, 2, 3], mid: Infinity },
+    ];
+    for (const nodeSize of sizeScales) {
+      const verdict = validateViewState({ ...MINIMAL, styling: { nodeSize } });
+      expect(verdict.ok).toBe(false);
+      if (!verdict.ok) {
+        expect(verdict.code).toBe('invalid-view-state');
+        expect(verdict.problems.join('; ')).toContain('styling.nodeSize');
+      }
+    }
+
+    for (const nodeColor of [
+      { kind: 'sequential', metric: 'degree', range: [1, 2] },
+      { kind: 'diverging', metric: 'risk', range: ['#00f', '#fff', {}], mid: 0 },
+      { kind: 'categorical', by: 'type', palette: [1, 2] },
+    ]) {
+      const verdict = validateViewState({ ...MINIMAL, styling: { nodeColor } });
+      expect(verdict.ok).toBe(false);
+      if (!verdict.ok) expect(verdict.problems.join('; ')).toContain('styling.nodeColor');
+    }
+
+    expect(
+      validateViewState({
+        ...MINIMAL,
+        styling: {
+          nodeColor: {
+            kind: 'diverging',
+            metric: 'risk',
+            range: ['#00f', '#fff', '#f00'],
+            domain: [-1, 1],
+            mid: 0,
+          },
+        },
+      }).ok,
+    ).toBe(true);
+  });
+
   it('folds validate as [anchor, memberIds] tuples', () => {
     expect(validateViewState({ ...MINIMAL, folds: [['hub', ['a', 'b']]] }).ok).toBe(true);
     expect(validateViewState({ ...MINIMAL, folds: [['hub']] }).ok).toBe(false);
@@ -380,7 +495,36 @@ describe('setViewState', () => {
     const idxA = 0; // 'a' is slot 0 in this fixture
     expect(commit.structure!.positions[2 * idxA]).toBeCloseTo(posA[0], 5);
     // …and the sim is paused (fixed-equivalent freeze).
-    expect(b.instance.store.getState().simulationRunning).toBe(false);
+    const store = b.instance.store.getState();
+    expect(store.simulationRunning).toBe(false);
+    expect(store.revisions.appliedRender).toBe(store.revisions.render);
+    expect(store.revisions.appliedRender).toBe(commit.revision);
+  });
+
+  it('rejects malformed scale shapes through setViewState without applying any lane', async () => {
+    const h = await ready();
+    const before = h.instance.getRevisions();
+    const beforeView = h.instance.getViewState();
+    const beforeCommits = h.engine.commits.length;
+    const malformed = [
+      { nodeColor: { kind: 'categorical', by: 'type', domain: [1] } },
+      { nodeColor: { kind: 'sequential', metric: 'degree', range: [1, 2] } },
+      { nodeSize: { kind: 'sequential', metric: 'degree', range: [2] } },
+      { nodeSize: { kind: 'sequential', metric: 'degree', range: [2, 8], domain: {} } },
+      { nodeSize: { kind: 'diverging', metric: 'degree', range: [2, 4, 8] } },
+    ];
+
+    for (const styling of malformed) {
+      const result = await h.instance.setViewState({ ...beforeView, styling });
+      expect(result.status).toBe('rejected');
+      if (result.status === 'rejected') {
+        expect(result.code).toBe('invalid-view-state');
+        expect(result.problems.join('; ')).toContain('styling.node');
+      }
+      expect(h.instance.getRevisions()).toEqual(before);
+      expect(h.instance.getViewState()).toEqual(beforeView);
+      expect(h.engine.commits).toHaveLength(beforeCommits);
+    }
   });
 });
 
diff --git a/packages/core/test/worker-admission.test.ts b/packages/core/test/worker-admission.test.ts
index c84f1f0..1373ffe 100644
--- a/packages/core/test/worker-admission.test.ts
+++ b/packages/core/test/worker-admission.test.ts
@@ -79,6 +79,47 @@ async function rig(over: Partial<CreateGraphInstanceOptions<NAttrs, EAttrs>> = {
 const flush = () => new Promise((r) => setTimeout(r, 0));
 
 describe('async admission (execution: auto + a live lane)', () => {
+  it('rejects non-string entries in every dictionary before worker encoding', async () => {
+    const create = vi.fn(workerFromDouble);
+    const { instance } = await rig({ execution: 'worker', workerFactory: { create } });
+    instance.applyHostUpdate({ data: snap(1, ['keep'], []) });
+
+    const mutations: Array<(snapshot: ColumnarGraphSnapshot<NAttrs, EAttrs>) => void> = [
+      (snapshot) => {
+        (snapshot.nodes.ids.dictionary as unknown[])[0] = 123;
+      },
+      (snapshot) => {
+        (snapshot.edges.ids.dictionary as unknown[])[0] = { id: 'e1' };
+      },
+      (snapshot) => {
+        snapshot.nodes.columns = {
+          ...snapshot.nodes.columns,
+          label: {
+            kind: 'string',
+            dictionary: ['ok', null] as unknown as string[],
+            codes: Uint32Array.of(0, 1, 0, 1),
+          },
+        };
+      },
+    ];
+
+    for (const mutate of mutations) {
+      const bad = columnarFixture();
+      mutate(bad);
+      instance.applyHostUpdate({ data: bad });
+      expect(instance.getSceneNodeIds()).toEqual(['keep']);
+      expect(
+        instance.store
+          .getState()
+          .diagnostics.find((diag) => diag.code === 'invalid-columnar-snapshot')?.message,
+      ).toContain('dictionary entry');
+    }
+
+    await flush();
+    expect(instance.getSceneNodeIds()).toEqual(['keep']);
+    expect(create).not.toHaveBeenCalled();
+  });
+
   it('lands IDENTICAL to the sync twin — after the flush, not before', async () => {
     const sync = await rig(); // execution 'main' default
     sync.instance.applyHostUpdate({ data: columnarFixture() });
diff --git a/packages/core/tsup.config.ts b/packages/core/tsup.config.ts
index 1b01ef0..d587646 100644
--- a/packages/core/tsup.config.ts
+++ b/packages/core/tsup.config.ts
@@ -21,7 +21,7 @@ export default defineConfig([
   // `../chunk-*.js` import breaks for consumers relying on the inline
   // default. pack-smoke gates the no-imports shape.
   {
-    entry: { 'worker/entry': 'src/worker/entry.ts' },
+    entry: { 'worker/entry': 'src/worker/entry.js' },
     format: ['esm'],
     dts: false,
     sourcemap: true,
diff --git a/packages/data/src/arrow.ts b/packages/data/src/arrow.ts
index bbed123..c653682 100644
--- a/packages/data/src/arrow.ts
+++ b/packages/data/src/arrow.ts
@@ -122,7 +122,14 @@ async function arrowRowTable(
         for (let j = 0; j < columns.length; j++) {
           const value = vectors[j]?.get(i);
           if (value === null || value === undefined) continue; // arrow null → absent
-          row[columns[j]!] = normalizeArrowValue(value);
+          // Arrow schemas may legally contain a `__proto__` column. Plain
+          // assignment would invoke the legacy prototype setter and lose it.
+          Object.defineProperty(row, columns[j]!, {
+            value: normalizeArrowValue(value),
+            enumerable: true,
+            writable: true,
+            configurable: true,
+          });
         }
         yield row;
       }
diff --git a/packages/data/src/artifact.ts b/packages/data/src/artifact.ts
index d8c5d9c..f6c8e9e 100644
--- a/packages/data/src/artifact.ts
+++ b/packages/data/src/artifact.ts
@@ -15,10 +15,10 @@
  * - no expected fingerprint → full structural revalidation via
  * `validatePreparedEnvelope`.
  *
- * JSON transport caveat (documented): snapshot attrs must be JSON-safe
- * `bigint` throws (native JSON.stringify behavior) and `Date` flattens to an
- * ISO string. Prepared lanes that normalize values (arrow.ts/parquet.ts)
- * already produce JSON-safe attrs.
+ * Serialization accepts only lossless JSON data. Unsupported values (for
+ * example non-finite numbers, bigint, undefined, Date/class instances,
+ * sparse arrays, accessors, and cycles) throw with their artifact path rather
+ * than being silently replaced, omitted, or flattened by JSON.stringify.
  */
 
 import type { GraphSnapshot } from '@modernrelay/orbit-core';
@@ -45,6 +45,16 @@ export function serializePrepared(prepared: PreparedGraph<unknown, unknown>): Ui
     snapshot,
     summaries: prepared.summaries,
   };
+  assertJsonSafe(envelope, 'artifact');
+  if (
+    (typeof snapshot.sourceRevision !== 'string' &&
+      typeof snapshot.sourceRevision !== 'number') ||
+    (typeof snapshot.sourceRevision === 'number' && !Number.isFinite(snapshot.sourceRevision))
+  ) {
+    throw new TypeError(
+      'serializePrepared: snapshot.sourceRevision must be a string or finite number',
+    );
+  }
   return new TextEncoder().encode(JSON.stringify(envelope));
 }
 
@@ -109,8 +119,14 @@ export function validatePreparedEnvelope(envelope: Partial<PreparedArtifactEnvel
   if (typeof snapshot.datasetKey !== 'string' || snapshot.datasetKey === '') {
     throw new TypeError('loadPrepared: snapshot.datasetKey must be a non-empty string');
   }
-  if (typeof snapshot.sourceRevision !== 'string' && typeof snapshot.sourceRevision !== 'number') {
-    throw new TypeError('loadPrepared: snapshot.sourceRevision must be a string or number');
+  if (
+    (typeof snapshot.sourceRevision !== 'string' &&
+      typeof snapshot.sourceRevision !== 'number') ||
+    (typeof snapshot.sourceRevision === 'number' && !Number.isFinite(snapshot.sourceRevision))
+  ) {
+    throw new TypeError(
+      'loadPrepared: snapshot.sourceRevision must be a string or finite number',
+    );
   }
   if (envelope.datasetKey !== snapshot.datasetKey) {
     throw new TypeError('loadPrepared: envelope datasetKey disagrees with its snapshot');
@@ -181,3 +197,69 @@ export function validatePreparedEnvelope(envelope: Partial<PreparedArtifactEnvel
  * 'validate')). Not part of the public index.
  */
 export const _internals = { validate: validatePreparedEnvelope };
+
+function jsonSafetyError(path: string, reason: string): never {
+  throw new TypeError(`serializePrepared: ${path} is not JSON-safe (${reason})`);
+}
+
+/**
+ * JSON.stringify is intentionally lossy for several JavaScript values. Walk
+ * data first so an artifact either round-trips its data shape or does not get
+ * emitted. The active-object set detects cycles while still allowing the same
+ * acyclic object to be referenced from more than one place.
+ */
+function assertJsonSafe(value: unknown, path: string, active = new Set<object>()): void {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return;
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value)) jsonSafetyError(path, 'non-finite number');
+    return;
+  }
+  if (typeof value !== 'object') {
+    jsonSafetyError(path, `${typeof value} value`);
+  }
+
+  if (active.has(value)) jsonSafetyError(path, 'cyclic reference');
+  active.add(value);
+  try {
+    if (Array.isArray(value)) {
+      const expectedKeys = new Set<string>();
+      for (let i = 0; i < value.length; i++) {
+        const key = String(i);
+        expectedKeys.add(key);
+        if (!Object.prototype.hasOwnProperty.call(value, key)) {
+          jsonSafetyError(`${path}[${i}]`, 'sparse array hole');
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (descriptor === undefined || !('value' in descriptor)) {
+          jsonSafetyError(`${path}[${i}]`, 'accessor property');
+        }
+        assertJsonSafe(descriptor.value, `${path}[${i}]`, active);
+      }
+      for (const key of Reflect.ownKeys(value)) {
+        if (key === 'length' || (typeof key === 'string' && expectedKeys.has(key))) continue;
+        jsonSafetyError(path, `array property ${String(key)} would be omitted`);
+      }
+      return;
+    }
+
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      jsonSafetyError(path, 'non-plain object');
+    }
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key === 'symbol') {
+        jsonSafetyError(path, `symbol-keyed property ${String(key)} would be omitted`);
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === undefined || !descriptor.enumerable) {
+        jsonSafetyError(`${path}[${JSON.stringify(key)}]`, 'non-enumerable property');
+      }
+      if (!('value' in descriptor)) {
+        jsonSafetyError(`${path}[${JSON.stringify(key)}]`, 'accessor property');
+      }
+      assertJsonSafe(descriptor.value, `${path}[${JSON.stringify(key)}]`, active);
+    }
+  } finally {
+    active.delete(value);
+  }
+}
diff --git a/packages/data/src/builder.ts b/packages/data/src/builder.ts
index 15a6672..648d86c 100644
--- a/packages/data/src/builder.ts
+++ b/packages/data/src/builder.ts
@@ -52,97 +52,132 @@ export interface BuildArgs {
 
 export async function buildPrepared(args: BuildArgs): Promise<PreparedGraph> {
   const { nodeTable, edgeTable, mapping, format, options } = args;
-  validateOptions(options);
-  validateMapping({
-    mapping,
-    nodeColumns: nodeTable === null ? null : nodeTable.columns,
-    edgeColumns: edgeTable.columns,
-    deriveNodes: nodeTable === null,
-  });
-  const nodeSummarizer = new TableSummarizer();
-  const edgeSummarizer = new TableSummarizer();
+  let failed = false;
+  try {
+    validateOptions(options);
+    validateMapping({
+      mapping,
+      nodeColumns: nodeTable === null ? null : nodeTable.columns,
+      edgeColumns: edgeTable.columns,
+      deriveNodes: nodeTable === null,
+    });
+    const nodeSummarizer = new TableSummarizer();
+    const edgeSummarizer = new TableSummarizer();
 
-  // --- edges (first, so deriveNodes sees endpoint order) ------------------
-  const edgeIdentity = new Set<string>(
-    [mapping.edges.id, mapping.edges.source, mapping.edges.target].filter(
-      (c): c is string => c !== undefined,
-    ),
-  );
-  const edgeAttrPick = attrPicker(edgeTable.columns, edgeIdentity, mapping.edges.includeFields);
-  if (edgeTable.columns !== null) {
-    edgeSummarizer.seed(edgeAttrPick.seedColumns);
-    for (const column of edgeAttrPick.seedColumns) edgeAttrPick.admitted.add(column);
-  }
-  const edges: GraphEdge[] = [];
-  const endpointOrder = new Set<string>();
-  let edgeOrdinal = 0;
-  for await (const row of edgeTable.rows) {
-    const source = identityString(row[mapping.edges.source], 'edge source', edgeOrdinal, mapping.edges.source);
-    const target = identityString(row[mapping.edges.target], 'edge target', edgeOrdinal, mapping.edges.target);
-    const edge: GraphEdge = { source, target };
-    if (mapping.edges.id !== undefined) {
-      const raw = row[mapping.edges.id];
-      if (raw !== undefined && raw !== null) {
-        edge.id = identityString(raw, 'edge id', edgeOrdinal, mapping.edges.id);
+    // --- edges (first, so deriveNodes sees endpoint order) ----------------
+    const edgeIdentity = new Set<string>(
+      [mapping.edges.id, mapping.edges.source, mapping.edges.target].filter(
+        (c): c is string => c !== undefined,
+      ),
+    );
+    const edgeAttrPick = attrPicker(edgeTable.columns, edgeIdentity, mapping.edges.includeFields);
+    if (edgeTable.columns !== null) {
+      edgeSummarizer.seed(edgeAttrPick.seedColumns);
+      for (const column of edgeAttrPick.seedColumns) edgeAttrPick.admitted.add(column);
+    }
+    const edges: GraphEdge[] = [];
+    const endpointOrder = new Set<string>();
+    let edgeOrdinal = 0;
+    for await (const row of edgeTable.rows) {
+      const source = identityString(
+        row[mapping.edges.source],
+        'edge source',
+        edgeOrdinal,
+        mapping.edges.source,
+        true,
+      );
+      const target = identityString(
+        row[mapping.edges.target],
+        'edge target',
+        edgeOrdinal,
+        mapping.edges.target,
+        true,
+      );
+      const edge: GraphEdge = { source, target };
+      if (mapping.edges.id !== undefined) {
+        const raw = row[mapping.edges.id];
+        if (raw !== undefined && raw !== null) {
+          edge.id = identityString(raw, 'edge id', edgeOrdinal, mapping.edges.id, true);
+        }
+      }
+      const attrs = edgeAttrPick.pick(row);
+      if (attrs !== undefined) edge.attrs = attrs;
+      edgeSummarizer.addRow(attrs);
+      edges.push(edge);
+      if (nodeTable === null) {
+        endpointOrder.add(source);
+        endpointOrder.add(target);
       }
+      edgeOrdinal++;
     }
-    const attrs = edgeAttrPick.pick(row);
-    if (attrs !== undefined) edge.attrs = attrs;
-    edgeSummarizer.addRow(attrs);
-    edges.push(edge);
+
+    // --- nodes -------------------------------------------------------------
+    const nodes: GraphNode[] = [];
+    let nodeAdmitted: ReadonlySet<string> = new Set<string>();
     if (nodeTable === null) {
-      endpointOrder.add(source);
-      endpointOrder.add(target);
+      // deriveNodes: ids only, first-occurrence order over edge endpoints.
+      for (const id of endpointOrder) nodes.push({ id });
+    } else {
+      const nodeMapping = mapping.nodes!; // validated above
+      const nodeIdentity = new Set<string>([nodeMapping.id]);
+      const nodeAttrPick = attrPicker(nodeTable.columns, nodeIdentity, nodeMapping.includeFields);
+      nodeAdmitted = nodeAttrPick.admitted;
+      if (nodeTable.columns !== null) {
+        nodeSummarizer.seed(nodeAttrPick.seedColumns);
+        for (const column of nodeAttrPick.seedColumns) nodeAttrPick.admitted.add(column);
+      }
+      let nodeOrdinal = 0;
+      for await (const row of nodeTable.rows) {
+        const id = identityString(row[nodeMapping.id], 'node id', nodeOrdinal, nodeMapping.id, true);
+        const node: GraphNode = { id };
+        const attrs = nodeAttrPick.pick(row);
+        if (attrs !== undefined) node.attrs = attrs;
+        nodeSummarizer.addRow(attrs);
+        nodes.push(node);
+        nodeOrdinal++;
+      }
     }
-    edgeOrdinal++;
-  }
 
-  // --- nodes ---------------------------------------------------------------
-  const nodes: GraphNode[] = [];
-  let nodeAdmitted: ReadonlySet<string> = new Set<string>();
-  if (nodeTable === null) {
-    // deriveNodes: ids only, first-occurrence order over edge endpoints.
-    for (const id of endpointOrder) nodes.push({ id });
-  } else {
-    const nodeMapping = mapping.nodes!; // validated above
-    const nodeIdentity = new Set<string>([nodeMapping.id]);
-    const nodeAttrPick = attrPicker(nodeTable.columns, nodeIdentity, nodeMapping.includeFields);
-    nodeAdmitted = nodeAttrPick.admitted;
-    if (nodeTable.columns !== null) {
-      nodeSummarizer.seed(nodeAttrPick.seedColumns);
-      for (const column of nodeAttrPick.seedColumns) nodeAttrPick.admitted.add(column);
-    }
-    let nodeOrdinal = 0;
-    for await (const row of nodeTable.rows) {
-      const id = identityString(row[nodeMapping.id], 'node id', nodeOrdinal, nodeMapping.id);
-      const node: GraphNode = { id };
-      const attrs = nodeAttrPick.pick(row);
-      if (attrs !== undefined) node.attrs = attrs;
-      nodeSummarizer.addRow(attrs);
-      nodes.push(node);
-      nodeOrdinal++;
+    // Fingerprint AFTER materialization (I4): the admitted union is only
+    // known once every row has streamed through. computeMappingFingerprint
+    // sorts the lists, so field DISCOVERY order can never move it.
+    const mappingFingerprint = computeMappingFingerprint(mapping, format, {
+      nodes: [...nodeAdmitted],
+      edges: [...edgeAttrPick.admitted],
+    });
+
+    const snapshot: GraphSnapshot = {
+      datasetKey: options.datasetKey,
+      sourceRevision: options.sourceRevision,
+      nodes,
+      edges,
+    };
+    return {
+      snapshot,
+      summaries: { nodes: nodeSummarizer.finalize(), edges: edgeSummarizer.finalize() },
+      mappingFingerprint,
+    };
+  } catch (cause) {
+    failed = true;
+    throw cause;
+  } finally {
+    // Column discovery peeks async sources before validation. Always release
+    // both tables so mapping errors, an error in either materialization pass,
+    // and successful exhaustion all settle caller-owned iterators. Both
+    // closes run even if one rejects. A teardown failure is surfaced after a
+    // successful build, but must never replace the useful validation/read
+    // failure already escaping the try block.
+    const closes = await Promise.allSettled([
+      Promise.resolve().then(() => edgeTable.close?.()),
+      Promise.resolve().then(() => nodeTable?.close?.()),
+    ]);
+    if (!failed) {
+      const rejected = closes.find(
+        (result): result is PromiseRejectedResult => result.status === 'rejected',
+      );
+      if (rejected !== undefined) throw rejected.reason;
     }
   }
-
-  // Fingerprint AFTER materialization (I4): the admitted union is only known
-  // once every row has streamed through. computeMappingFingerprint sorts the
-  // lists, so field DISCOVERY order can never move the fingerprint.
-  const mappingFingerprint = computeMappingFingerprint(mapping, format, {
-    nodes: [...nodeAdmitted],
-    edges: [...edgeAttrPick.admitted],
-  });
-
-  const snapshot: GraphSnapshot = {
-    datasetKey: options.datasetKey,
-    sourceRevision: options.sourceRevision,
-    nodes,
-    edges,
-  };
-  return {
-    snapshot,
-    summaries: { nodes: nodeSummarizer.finalize(), edges: edgeSummarizer.finalize() },
-    mappingFingerprint,
-  };
 }
 
 function validateOptions(options: GraphPrepareOptions): void {
@@ -150,8 +185,13 @@ function validateOptions(options: GraphPrepareOptions): void {
     throw new TypeError('prepareGraphData: options.datasetKey must be a non-empty string');
   }
   const rev = options.sourceRevision;
-  if (typeof rev !== 'string' && typeof rev !== 'number') {
-    throw new TypeError('prepareGraphData: options.sourceRevision must be a string or number');
+  if (
+    (typeof rev !== 'string' && typeof rev !== 'number') ||
+    (typeof rev === 'number' && !Number.isFinite(rev))
+  ) {
+    throw new TypeError(
+      'prepareGraphData: options.sourceRevision must be a string or finite number',
+    );
   }
 }
 
@@ -160,6 +200,7 @@ function identityString(
   role: string,
   ordinal: number,
   column: string,
+  rejectNul = false,
 ): string {
   if (typeof value === 'string') {
     if (value === '') {
@@ -167,6 +208,12 @@ function identityString(
         `prepareGraphData: ${role} in column ${JSON.stringify(column)} is empty at row ${ordinal}`,
       );
     }
+    if (rejectNul && value.includes('\u0000')) {
+      throw new TypeError(
+        `prepareGraphData: ${role} in column ${JSON.stringify(column)} contains reserved NUL ` +
+          `at row ${ordinal}`,
+      );
+    }
     return value;
   }
   if (typeof value === 'number' && Number.isFinite(value)) return String(value);
diff --git a/packages/data/src/csv.ts b/packages/data/src/csv.ts
index 53ede96..d655828 100644
--- a/packages/data/src/csv.ts
+++ b/packages/data/src/csv.ts
@@ -137,59 +137,74 @@ export async function csvTable(
   const columns = [...head.value];
 
   const rows = (async function* (): AsyncGenerator<Readonly<Record<string, unknown>>> {
-    // Pass 1: retain up to SAMPLE_ROWS records and decide column numericness.
-    const sample: (readonly string[])[] = [];
-    let sampleDone = false;
-    while (sample.length < SAMPLE_ROWS) {
-      const next = await iterator.next();
-      if (next.done) {
-        sampleDone = true;
-        break;
-      }
-      sample.push(next.value);
-    }
-    const numeric = columns.map((name, index) => {
-      if (identityColumns.has(name)) return false;
-      let nonEmpty = 0;
-      for (const record of sample) {
-        const cell = record[index];
-        if (cell === undefined || cell === '') continue;
-        nonEmpty++;
-        if (coerceNumeric(cell) === null) return false;
+    try {
+      // Pass 1: retain up to SAMPLE_ROWS records and decide column numericness.
+      const sample: (readonly string[])[] = [];
+      let sampleDone = false;
+      while (sample.length < SAMPLE_ROWS) {
+        const next = await iterator.next();
+        if (next.done) {
+          sampleDone = true;
+          break;
+        }
+        sample.push(next.value);
       }
-      return nonEmpty > 0;
-    });
+      const numeric = columns.map((name, index) => {
+        if (identityColumns.has(name)) return false;
+        let nonEmpty = 0;
+        for (const record of sample) {
+          const cell = record[index];
+          if (cell === undefined || cell === '') continue;
+          nonEmpty++;
+          if (coerceNumeric(cell) === null) return false;
+        }
+        return nonEmpty > 0;
+      });
 
-    const toRow = (record: readonly string[]): Readonly<Record<string, unknown>> => {
-      const row: Record<string, unknown> = {};
-      for (let i = 0; i < columns.length; i++) {
-        const cell = record[i];
-        if (cell === undefined || cell === '') continue; // empty cell → absent key
-        const name = columns[i]!;
-        if (numeric[i]) {
-          const value = coerceNumeric(cell);
+      const toRow = (record: readonly string[]): Readonly<Record<string, unknown>> => {
+        const row: Record<string, unknown> = {};
+        for (let i = 0; i < columns.length; i++) {
+          const cell = record[i];
+          if (cell === undefined || cell === '') continue; // empty cell → absent key
+          const name = columns[i]!;
+          const value = numeric[i] ? coerceNumeric(cell) : cell;
           if (value === null) continue; // post-sample outlier in a numeric column
-          row[name] = value;
-        } else {
-          row[name] = cell;
+          // A literal `__proto__` header must be data, never the legacy
+          // Object.prototype setter.
+          Object.defineProperty(row, name, {
+            value,
+            enumerable: true,
+            writable: true,
+            configurable: true,
+          });
         }
-      }
-      return row;
-    };
+        return row;
+      };
 
-    // Pass 2: replay the sample, then keep streaming.
-    for (const record of sample) {
-      yield toRow(record);
-    }
-    if (!sampleDone) {
-      while (true) {
-        throwIfAborted(signal);
-        const next = await iterator.next();
-        if (next.done) break;
-        yield toRow(next.value);
+      // Pass 2: replay the sample, then keep streaming.
+      for (const record of sample) {
+        yield toRow(record);
       }
+      if (!sampleDone) {
+        while (true) {
+          throwIfAborted(signal);
+          const next = await iterator.next();
+          if (next.done) break;
+          yield toRow(next.value);
+        }
+      }
+    } finally {
+      // `rows` manually drives the record iterator. Forward early return so
+      // mapping/materialization failures close the caller's byte source.
+      await iterator.return(undefined);
     }
   })();
 
-  return { columns, rows };
+  return {
+    columns,
+    rows,
+    close: async () => {
+      await iterator.return(undefined);
+    },
+  };
 }
diff --git a/packages/data/src/parquet.ts b/packages/data/src/parquet.ts
index 2211fd1..1022dcc 100644
--- a/packages/data/src/parquet.ts
+++ b/packages/data/src/parquet.ts
@@ -110,7 +110,13 @@ async function parquetRowTable(
         for (const key of Object.keys(raw)) {
           const value = raw[key];
           if (value === null || value === undefined) continue; // parquet null → absent
-          row[key] = normalizeParquetValue(value);
+          // Preserve a literal `__proto__` schema column as own data.
+          Object.defineProperty(row, key, {
+            value: normalizeParquetValue(value),
+            enumerable: true,
+            writable: true,
+            configurable: true,
+          });
         }
         yield row;
       }
diff --git a/packages/data/src/prepare.ts b/packages/data/src/prepare.ts
index dbeafab..00e729c 100644
--- a/packages/data/src/prepare.ts
+++ b/packages/data/src/prepare.ts
@@ -77,24 +77,36 @@ export async function prepareGraphData<
   const lanes = { csv: false, rows: false };
   const edgeTable = await resolveTabular(input.edges, options, edgeIdentity, 'edge', lanes);
   let nodeTable: RowTable | null = null;
-  if (!deriveNodes) {
-    if (!('nodes' in input) || input.nodes === undefined) {
-      throw new TypeError(
-        'prepareGraphData: input must supply nodes, set deriveNodes: true, or use a document',
-      );
+  try {
+    if (!deriveNodes) {
+      if (!('nodes' in input) || input.nodes === undefined) {
+        throw new TypeError(
+          'prepareGraphData: input must supply nodes, set deriveNodes: true, or use a document',
+        );
+      }
+      const nodeIdentity = new Set(mapping.nodes === undefined ? [] : [mapping.nodes.id]);
+      nodeTable = await resolveTabular(input.nodes, options, nodeIdentity, 'node', lanes);
     }
-    const nodeIdentity = new Set(mapping.nodes === undefined ? [] : [mapping.nodes.id]);
-    nodeTable = await resolveTabular(input.nodes, options, nodeIdentity, 'node', lanes);
-  }
 
-  const resolvedFormat = format ?? (lanes.csv ? 'csv' : 'rows');
-  return (await buildPrepared({
-    nodeTable,
-    edgeTable,
-    mapping,
-    format: resolvedFormat,
-    options,
-  })) as PreparedGraph<N, E>;
+    const resolvedFormat = format ?? (lanes.csv ? 'csv' : 'rows');
+    return (await buildPrepared({
+      nodeTable,
+      edgeTable,
+      mapping,
+      format: resolvedFormat,
+      options,
+    })) as PreparedGraph<N, E>;
+  } catch (cause) {
+    // The edge lane is opened first. If node-lane resolution fails before
+    // buildPrepared takes ownership, release every already-peeked iterator.
+    // Cleanup is best-effort on this failure path: run every close, but keep
+    // the resolution error as the rejection callers receive.
+    await Promise.allSettled([
+      Promise.resolve().then(() => edgeTable.close?.()),
+      Promise.resolve().then(() => nodeTable?.close?.()),
+    ]);
+    throw cause;
+  }
 }
 
 async function resolveTabular(
diff --git a/packages/data/src/rowTable.ts b/packages/data/src/rowTable.ts
index c546f32..7c57968 100644
--- a/packages/data/src/rowTable.ts
+++ b/packages/data/src/rowTable.ts
@@ -19,6 +19,12 @@ export interface RowTable {
   /** Discovered columns, or null when the source has no rows at all. */
   readonly columns: readonly string[] | null;
   readonly rows: AsyncIterable<Readonly<Record<string, unknown>>>;
+  /**
+   * Release a source whose column-discovery peek opened an iterator before
+   * materialization began. Implementations must be safe to close after
+   * normal exhaustion and more than once.
+   */
+  readonly close?: () => Promise<void>;
 }
 
 export const EMPTY_ROW_TABLE: RowTable = {
diff --git a/packages/data/src/rows.ts b/packages/data/src/rows.ts
index ebfec7f..30d82d4 100644
--- a/packages/data/src/rows.ts
+++ b/packages/data/src/rows.ts
@@ -19,8 +19,13 @@ export async function rowsTable(
   if (!isPlainRowObject(first)) {
     // Close the underlying source before reporting: the replay
     // generator was never started, so ITS return would skip the finally
-    // close reaches the source iterator directly.
-    await close();
+    // close reaches the source iterator directly. A hostile teardown must
+    // not replace the more useful row-shape validation failure below.
+    try {
+      await close();
+    } catch {
+      // best-effort cleanup on an already-failed admission path
+    }
     throw new TypeError(
       `prepareGraphData: ${role} row sources must yield plain row objects ` +
         `(got ${first === null ? 'null' : typeof first})`,
@@ -29,6 +34,7 @@ export async function rowsTable(
   const columns = Object.keys(first);
   return {
     columns,
+    close,
     rows: (async function* () {
       let index = 0;
       for await (const row of rest) {
diff --git a/packages/data/src/sources.ts b/packages/data/src/sources.ts
index d6b68a0..9bd3dea 100644
--- a/packages/data/src/sources.ts
+++ b/packages/data/src/sources.ts
@@ -30,6 +30,56 @@ export function isAsyncIterable(value: unknown): value is AsyncIterable<unknown>
   );
 }
 
+/**
+ * Iterator teardown is caller-owned protocol, not necessarily an idempotent
+ * async-generator method. Memoize the first close so nested replay/adapter
+ * wrappers can all settle without invoking an arbitrary `return()` twice.
+ */
+function iteratorCloseOnce<T>(iterator: AsyncIterator<T>): () => Promise<void> {
+  let closePromise: Promise<void> | undefined;
+  return () => {
+    closePromise ??= (async () => {
+      await iterator.return?.();
+    })();
+    return closePromise;
+  };
+}
+
+/**
+ * Drive an arbitrary async iterator behind an async-generator boundary that
+ * guarantees `return()` on early exit *and* when `next()` rejects. Native
+ * `for await` does not close an iterator whose own `next()` rejects.
+ */
+async function* closingIterable<T>(source: AsyncIterable<T>): AsyncGenerator<T> {
+  const iterator = source[Symbol.asyncIterator]();
+  const close = iteratorCloseOnce(iterator);
+  let exhausted = false;
+  let failed = false;
+  try {
+    while (true) {
+      const next = await iterator.next();
+      if (next.done) {
+        exhausted = true;
+        return;
+      }
+      yield next.value;
+    }
+  } catch (cause) {
+    failed = true;
+    throw cause;
+  } finally {
+    if (!exhausted) {
+      try {
+        await close();
+      } catch (closeCause) {
+        // A failed read/consumer operation is the useful outcome. Teardown
+        // failure is surfaced only when there is no earlier failure to mask.
+        if (!failed) throw closeCause;
+      }
+    }
+  }
+}
+
 /** An async iterable with its first element already consumed and re-yielded.
  * `done` distinguishes a completed source from one whose first yield was
  * `undefined`; conflating them silently discarded the whole source instead
@@ -46,31 +96,54 @@ export async function peekAsyncIterable(
   close: () => Promise<void>;
 }> {
   const iterator = source[Symbol.asyncIterator]();
-  const head = await iterator.next();
+  const close = iteratorCloseOnce(iterator);
+  let head: IteratorResult<unknown>;
+  try {
+    head = await iterator.next();
+  } catch (cause) {
+    try {
+      await close();
+    } catch {
+      // Preserve the iterator's read failure; teardown is best-effort here.
+    }
+    throw cause;
+  }
   const first = head.done ? undefined : head.value;
   async function* replay(): AsyncGenerator<unknown> {
+    let exhausted = head.done === true;
+    let failed = false;
     try {
       if (!head.done) yield head.value;
       // Delegate to the original iterator (not the iterable) so nothing is lost.
       while (true) {
         const next = await iterator.next();
-        if (next.done) return;
+        if (next.done) {
+          exhausted = true;
+          return;
+        }
         yield next.value;
       }
+    } catch (cause) {
+      failed = true;
+      throw cause;
     } finally {
       // Early exit or a downstream throw must close the source;
       // file handles, network bodies, and generator finally-blocks hang off
-      // return. Forwarded unconditionally; a completed iterator no-ops.
-      await iterator.return?.();
+      // return. A rejected next() also needs explicit teardown.
+      if (!exhausted) {
+        try {
+          await close();
+        } catch (closeCause) {
+          if (!failed) throw closeCause;
+        }
+      }
     }
   }
   return {
     first,
     done: head.done === true,
     rest: replay(),
-    close: async () => {
-      await iterator.return?.();
-    },
+    close,
   };
 }
 
@@ -90,14 +163,14 @@ export function byteChunks(
     return (async function* () {
       // Blob.stream is a web ReadableStream; async-iterable in Node ≥18.
       const stream = source.stream() as unknown as AsyncIterable<Uint8Array>;
-      for await (const chunk of stream) {
+      for await (const chunk of closingIterable(stream)) {
         throwIfAborted(signal);
         yield chunk;
       }
     })();
   }
   return (async function* () {
-    for await (const chunk of source) {
+    for await (const chunk of closingIterable(source)) {
       throwIfAborted(signal);
       if (!(chunk instanceof Uint8Array)) {
         throw new TypeError(
@@ -145,7 +218,7 @@ export function rowStream(
   }
   if (isAsyncIterable(source)) {
     return (async function* () {
-      for await (const row of source) {
+      for await (const row of closingIterable(source)) {
         throwIfAborted(signal);
         yield row;
       }
diff --git a/packages/data/test/arrow.test.ts b/packages/data/test/arrow.test.ts
index c93d666..63f94e5 100644
--- a/packages/data/test/arrow.test.ts
+++ b/packages/data/test/arrow.test.ts
@@ -119,6 +119,38 @@ describe('prepareArrowGraphData', () => {
     expect(prepared.summaries.nodes['views']).toMatchObject({ min: 10, max: 20 });
   });
 
+  it('preserves an Arrow schema column literally named __proto__ as own data', async () => {
+    const table = (
+      columns: ReadonlyArray<readonly [string, unknown]>,
+    ): ArrowTableLike => ({
+      numRows: 1,
+      schema: { fields: columns.map(([name]) => ({ name })) },
+      getChild: (name) => {
+        const entry = columns.find(([column]) => column === name);
+        return entry === undefined ? null : { get: () => entry[1] };
+      },
+    });
+    const nodes = table([
+      ['id', 'a'],
+      ['__proto__', { evil: true }],
+    ]);
+    const edges = table([
+      ['source', 'a'],
+      ['target', 'a'],
+    ]);
+
+    const prepared = await prepareArrowGraphData(
+      { nodes, edges },
+      { nodes: { id: 'id' }, edges: { source: 'source', target: 'target' } },
+      PARITY_OPTIONS,
+    );
+    const attrs = prepared.snapshot.nodes[0]!.attrs as Record<string, unknown>;
+    expect(Object.prototype.hasOwnProperty.call(attrs, '__proto__')).toBe(true);
+    expect(attrs['__proto__']).toEqual({ evil: true });
+    expect((attrs as { evil?: unknown }).evil).toBeUndefined();
+    expect(Object.getPrototypeOf(attrs)).toBe(Object.prototype);
+  });
+
   it('reports a clear install hint when apache-arrow is absent', async () => {
     _internals.importArrow = () =>
       Promise.reject(
diff --git a/packages/data/test/mapping-validation.test.ts b/packages/data/test/mapping-validation.test.ts
index ac5dc27..0fb9ca2 100644
--- a/packages/data/test/mapping-validation.test.ts
+++ b/packages/data/test/mapping-validation.test.ts
@@ -84,6 +84,17 @@ describe('mapping validation', () => {
     ).rejects.toThrow();
   });
 
+  it('rejects non-finite numeric source revisions before creating a lossy artifact', async () => {
+    for (const sourceRevision of [NaN, Infinity, -Infinity]) {
+      await expect(
+        prepareGraphData({ nodes: [], edges: [] }, PARITY_MAPPING, {
+          ...PARITY_OPTIONS,
+          sourceRevision,
+        }),
+      ).rejects.toThrow(/sourceRevision must be a string or finite number/);
+    }
+  });
+
   it('throws with the row ordinal when an identity value is unusable', async () => {
     await expect(
       prepareGraphData(
@@ -93,4 +104,49 @@ describe('mapping validation', () => {
       ),
     ).rejects.toThrow(/node id in column "id" is missing or unusable at row 1/);
   });
+
+  it('rejects NUL-containing node ids, edge ids, and endpoints reserved by orbit-core', async () => {
+    await expect(
+      prepareGraphData(
+        { nodes: [{ id: 'safe' }, { id: '\0["group","g"]' }], edges: [] },
+        PARITY_MAPPING,
+        PARITY_OPTIONS,
+      ),
+    ).rejects.toThrow(/node id in column "id" contains reserved NUL at row 1/);
+
+    await expect(
+      prepareGraphData(
+        {
+          nodes: [{ id: 'safe' }],
+          edges: [{ id: 'e', source: 'safe', target: 'bad\0endpoint' }],
+        },
+        PARITY_MAPPING,
+        PARITY_OPTIONS,
+      ),
+    ).rejects.toThrow(/edge target in column "target" contains reserved NUL at row 0/);
+
+    await expect(
+      prepareGraphData(
+        {
+          nodes: [{ id: 'safe' }],
+          edges: [{ id: '\0["meta-edge","safe","safe"]', source: 'safe', target: 'safe' }],
+        },
+        PARITY_MAPPING,
+        PARITY_OPTIONS,
+      ),
+    ).rejects.toThrow(/edge id in column "id" contains reserved NUL at row 0/);
+  });
+
+  it('rejects a NUL endpoint before deriveNodes can synthesize a reserved node id', async () => {
+    await expect(
+      prepareGraphData(
+        {
+          edges: [{ source: '\0["group","g"]', target: 'safe' }],
+          deriveNodes: true,
+        },
+        { edges: { source: 'source', target: 'target' } },
+        PARITY_OPTIONS,
+      ),
+    ).rejects.toThrow(/edge source in column "source" contains reserved NUL at row 0/);
+  });
 });
diff --git a/packages/data/test/parquet.test.ts b/packages/data/test/parquet.test.ts
index 75d39fa..4139516 100644
--- a/packages/data/test/parquet.test.ts
+++ b/packages/data/test/parquet.test.ts
@@ -64,6 +64,26 @@ describe('prepareParquetGraphData', () => {
     expect(prepared.snapshot.edges).toEqual(PARITY_EXPECTED_SNAPSHOT.edges);
   });
 
+  it('preserves a Parquet schema column literally named __proto__ as own data', async () => {
+    const raw = JSON.parse(
+      '{"source":"a","target":"b","__proto__":{"evil":true}}',
+    ) as Record<string, unknown>;
+    _internals.importHyparquet = async () => ({
+      parquetReadObjects: async () => [raw],
+    });
+
+    const prepared = await prepareParquetGraphData(
+      { edges: new ArrayBuffer(0), deriveNodes: true },
+      { edges: { source: 'source', target: 'target' } },
+      PARITY_OPTIONS,
+    );
+    const attrs = prepared.snapshot.edges[0]!.attrs as Record<string, unknown>;
+    expect(Object.prototype.hasOwnProperty.call(attrs, '__proto__')).toBe(true);
+    expect(attrs['__proto__']).toEqual({ evil: true });
+    expect((attrs as { evil?: unknown }).evil).toBeUndefined();
+    expect(Object.getPrototypeOf(attrs)).toBe(Object.prototype);
+  });
+
   it('reports a clear install hint when hyparquet is absent', async () => {
     _internals.importHyparquet = () =>
       Promise.reject(
diff --git a/packages/data/test/review-fixes.test.ts b/packages/data/test/review-fixes.test.ts
index b883a11..d6d1315 100644
--- a/packages/data/test/review-fixes.test.ts
+++ b/packages/data/test/review-fixes.test.ts
@@ -89,6 +89,275 @@ describe("'__proto__' keys land as own properties", () => {
     expect((attrs as { evil?: unknown }).evil).toBeUndefined(); // prototype NOT swapped
     expect(Object.getPrototypeOf(attrs)).toBe(Object.prototype);
   });
+
+  it('preserves a CSV header literally named __proto__', async () => {
+    const enc = new TextEncoder();
+    const prepared = await prepareGraphData(
+      {
+        nodes: enc.encode('id,__proto__\na,safe\n').buffer as ArrayBuffer,
+        edges: enc.encode('source,target\na,a\n').buffer as ArrayBuffer,
+      },
+      NODE_MAPPING,
+      { ...PARITY_OPTIONS, format: 'csv' },
+    );
+    const attrs = prepared.snapshot.nodes[0]!.attrs as Record<string, unknown>;
+    expect(Object.prototype.hasOwnProperty.call(attrs, '__proto__')).toBe(true);
+    expect(attrs['__proto__']).toBe('safe');
+    expect(Object.getPrototypeOf(attrs)).toBe(Object.prototype);
+  });
+});
+
+describe('async source cleanup across preparation failures', () => {
+  function hostileIterator<T>(
+    values: readonly T[],
+    state: { returns: number },
+    options: {
+      rejectAfterValues?: boolean;
+      rejectReturn?: boolean;
+      rejectSecondReturn?: boolean;
+    } = {},
+  ): AsyncIterable<T> {
+    let index = 0;
+    const iterator: AsyncIterableIterator<T> = {
+      [Symbol.asyncIterator]() {
+        return this;
+      },
+      async next() {
+        if (index < values.length) return { done: false as const, value: values[index++]! };
+        if (options.rejectAfterValues) throw new Error('source next failed');
+        return { done: true as const, value: undefined };
+      },
+      async return() {
+        state.returns++;
+        if (options.rejectReturn || (options.rejectSecondReturn && state.returns > 1)) {
+          throw new Error('source return failed');
+        }
+        return { done: true as const, value: undefined };
+      },
+    };
+    return iterator;
+  }
+
+  function tracked<T>(values: readonly T[], state: { closed: boolean }): AsyncIterable<T> {
+    return (async function* () {
+      try {
+        for (const value of values) yield value;
+      } finally {
+        state.closed = true;
+      }
+    })();
+  }
+
+  it('closes both row sources when mapping validation fails after column peeks', async () => {
+    const nodes = { closed: false };
+    const edges = { closed: false };
+    await expect(
+      prepareGraphData(
+        {
+          nodes: tracked([{ wrong: 'a' }, { wrong: 'b' }], nodes),
+          edges: tracked(
+            [
+              { source: 'a', target: 'b' },
+              { source: 'b', target: 'a' },
+            ],
+            edges,
+          ),
+        },
+        NODE_MAPPING,
+        PARITY_OPTIONS,
+      ),
+    ).rejects.toThrow(/node id column "id" not found/);
+    expect(nodes.closed).toBe(true);
+    expect(edges.closed).toBe(true);
+  });
+
+  it('closes the failing edge row source and the unopened node materialization', async () => {
+    const nodes = { closed: false };
+    const edges = { closed: false };
+    await expect(
+      prepareGraphData(
+        {
+          nodes: tracked([{ id: 'a' }, { id: 'b' }], nodes),
+          edges: tracked(
+            [
+              { source: null, target: 'a' },
+              { source: 'a', target: 'b' },
+            ],
+            edges,
+          ),
+        },
+        NODE_MAPPING,
+        PARITY_OPTIONS,
+      ),
+    ).rejects.toThrow(/edge source.*row 0/);
+    expect(nodes.closed).toBe(true);
+    expect(edges.closed).toBe(true);
+  });
+
+  function trackedCsv(text: string, state: { closed: boolean }): AsyncIterable<Uint8Array> {
+    return (async function* () {
+      try {
+        yield new TextEncoder().encode(text);
+        yield new Uint8Array(); // keep the source suspended until its consumer advances
+      } finally {
+        state.closed = true;
+      }
+    })();
+  }
+
+  it('closes both CSV byte sources when header-based mapping validation fails', async () => {
+    const nodes = { closed: false };
+    const edges = { closed: false };
+    await expect(
+      prepareGraphData(
+        {
+          nodes: trackedCsv('wrong\na\n', nodes),
+          edges: trackedCsv('source,target\na,a\n', edges),
+        },
+        NODE_MAPPING,
+        { ...PARITY_OPTIONS, format: 'csv' },
+      ),
+    ).rejects.toThrow(/node id column "id" not found/);
+    expect(nodes.closed).toBe(true);
+    expect(edges.closed).toBe(true);
+  });
+
+  it('closes sampled CSV sources when the first materialized identity is invalid', async () => {
+    const nodes = { closed: false };
+    const edges = { closed: false };
+    // Keep csvTable in its 1,000-row sample replay when the builder rejects
+    // row zero; the private csvRecords iterator must still receive return().
+    const invalidEdges = `source,target\n${',a\n'.repeat(1000)}`;
+    await expect(
+      prepareGraphData(
+        {
+          nodes: trackedCsv('id\na\n', nodes),
+          edges: trackedCsv(invalidEdges, edges),
+        },
+        NODE_MAPPING,
+        { ...PARITY_OPTIONS, format: 'csv' },
+      ),
+    ).rejects.toThrow(/edge source.*row 0/);
+    expect(nodes.closed).toBe(true);
+    expect(edges.closed).toBe(true);
+  });
+
+  it('closes a row iterator when next() rejects during materialization', async () => {
+    const state = { returns: 0 };
+    await expect(
+      prepareGraphData(
+        {
+          nodes: [{ id: 'a' }],
+          edges: hostileIterator([{ source: 'a', target: 'a' }], state, {
+            rejectAfterValues: true,
+            rejectReturn: true,
+          }),
+        },
+        NODE_MAPPING,
+        { ...PARITY_OPTIONS, format: 'rows' },
+      ),
+    ).rejects.toThrow(/source next failed/); // builder cleanup must not replace the read failure
+    expect(state.returns).toBe(1);
+  });
+
+  it('keeps a node-resolution failure when closing the already-open edge lane also rejects', async () => {
+    const nodes = { returns: 0 };
+    const edges = { returns: 0 };
+    await expect(
+      prepareGraphData(
+        {
+          nodes: hostileIterator([], nodes, {
+            rejectAfterValues: true,
+            rejectReturn: true,
+          }),
+          edges: hostileIterator([{ source: 'a', target: 'a' }], edges, {
+            rejectReturn: true,
+          }),
+        },
+        NODE_MAPPING,
+        PARITY_OPTIONS,
+      ),
+    ).rejects.toThrow(/source next failed/);
+    expect(nodes.returns).toBe(1);
+    expect(edges.returns).toBe(1);
+  });
+
+  it('closes the original iterator when inference fails on its first next()', async () => {
+    const state = { returns: 0 };
+    await expect(
+      prepareGraphData(
+        {
+          nodes: [{ id: 'a' }],
+          edges: hostileIterator([], state, {
+            rejectAfterValues: true,
+            rejectReturn: true,
+          }),
+        },
+        NODE_MAPPING,
+        PARITY_OPTIONS,
+      ),
+    ).rejects.toThrow(/source next failed/); // teardown failure must not mask the read failure
+    expect(state.returns).toBe(1);
+  });
+
+  it('keeps invalid-first-row diagnostics when explicit and inferred source teardown rejects', async () => {
+    for (const format of ['rows', undefined] as const) {
+      const state = { returns: 0 };
+      await expect(
+        prepareGraphData(
+          {
+            nodes: hostileIterator([42], state, { rejectReturn: true }),
+            edges: [],
+          },
+          NODE_MAPPING,
+          { ...PARITY_OPTIONS, ...(format === undefined ? {} : { format }) },
+        ),
+      ).rejects.toThrow(/plain row objects.*got number/s);
+      expect(state.returns).toBe(1);
+    }
+  });
+
+  it('closes a CSV byte iterator when its first next() rejects', async () => {
+    const state = { returns: 0 };
+    const nodes = new TextEncoder().encode('id\na\n').buffer as ArrayBuffer;
+    await expect(
+      prepareGraphData(
+        {
+          nodes,
+          edges: hostileIterator<Uint8Array>([], state, { rejectAfterValues: true }),
+        },
+        NODE_MAPPING,
+        { ...PARITY_OPTIONS, format: 'csv' },
+      ),
+    ).rejects.toThrow(/source next failed/);
+    expect(state.returns).toBe(1);
+  });
+
+  it('never calls an arbitrary return() twice across builder and caller cleanup', async () => {
+    const nodes = { returns: 0 };
+    const edges = { returns: 0 };
+    await expect(
+      prepareGraphData(
+        {
+          nodes: hostileIterator([{ wrong: 'a' }, { wrong: 'b' }], nodes, {
+            rejectSecondReturn: true,
+          }),
+          edges: hostileIterator(
+            [
+              { source: 'a', target: 'b' },
+              { source: 'b', target: 'a' },
+            ],
+            edges,
+            { rejectSecondReturn: true },
+          ),
+        },
+        NODE_MAPPING,
+        { ...PARITY_OPTIONS, format: 'rows' },
+      ),
+    ).rejects.toThrow(/node id column "id" not found/);
+    expect(nodes.returns).toBe(1);
+    expect(edges.returns).toBe(1);
+  });
 });
 
 describe('deep BigInt normalization in the Arrow/Parquet shared utility', () => {
@@ -117,4 +386,42 @@ describe('serializePrepared stays JSON-safe with prepared attrs', () => {
     );
     expect(() => serializePrepared(prepared)).not.toThrow();
   });
+
+  it('rejects lossy values instead of silently replacing or omitting them', async () => {
+    const make = () =>
+      prepareGraphData(
+        { nodes: [{ id: 'a', nested: { value: 1 } }], edges: [] },
+        NODE_MAPPING,
+        PARITY_OPTIONS,
+      );
+
+    for (const value of [NaN, Infinity, -Infinity]) {
+      const prepared = await make();
+      (prepared.snapshot.nodes[0]!.attrs as { nested: { value: unknown } }).nested.value = value;
+      expect(() => serializePrepared(prepared)).toThrow(/not JSON-safe \(non-finite number\)/);
+    }
+
+    const withNonFiniteRevision = await make();
+    withNonFiniteRevision.snapshot.sourceRevision = Infinity;
+    expect(() => serializePrepared(withNonFiniteRevision)).toThrow(
+      /sourceRevision.*not JSON-safe \(non-finite number\)/,
+    );
+
+    for (const sourceRevision of [null, true, {}, []]) {
+      const prepared = await make();
+      Object.assign(prepared.snapshot, { sourceRevision });
+      expect(() => serializePrepared(prepared)).toThrow(
+        /sourceRevision must be a string or finite number/,
+      );
+    }
+
+    const withUndefined = await make();
+    (withUndefined.snapshot.nodes[0]!.attrs as { nested: { value: unknown } }).nested.value =
+      undefined;
+    expect(() => serializePrepared(withUndefined)).toThrow(/not JSON-safe \(undefined value\)/);
+
+    const withDate = await make();
+    (withDate.snapshot.nodes[0]!.attrs as { nested: { value: unknown } }).nested.value = new Date();
+    expect(() => serializePrepared(withDate)).toThrow(/not JSON-safe \(non-plain object\)/);
+  });
 });
diff --git a/packages/engine-cosmos/src/CosmosEngine.ts b/packages/engine-cosmos/src/CosmosEngine.ts
index e154197..b39bcb2 100644
--- a/packages/engine-cosmos/src/CosmosEngine.ts
+++ b/packages/engine-cosmos/src/CosmosEngine.ts
@@ -829,45 +829,61 @@ export class CosmosEngine implements GraphEngine {
    * later explicit directive (including `false`) replaces it.
    */
   private queueCommit(update: EngineCommit): void {
+    // EngineCommit's caller-owned array views expire when commit() returns.
+    // A pre-mount/lost-context commit outlives that boundary, so snapshot the
+    // complete payload before either retaining it directly or folding it into
+    // an earlier pending commit. ImageBitmap handles are intentionally kept by
+    // reference; only their caller-owned container objects are copied.
+    const ownedUpdate = cloneCommitForQueue(update);
     const previous = this.pendingCommit;
     if (previous === null) {
-      this.pendingCommit = update;
+      this.pendingCommit = ownedUpdate;
       return;
     }
 
-    const merged: EngineCommit = { revision: update.revision };
+    const merged: EngineCommit = { revision: ownedUpdate.revision };
 
-    const structure = update.structure ?? previous.structure;
+    const structure = ownedUpdate.structure ?? previous.structure;
     if (structure !== undefined) merged.structure = structure;
 
-    if (previous.buffers !== undefined || update.buffers !== undefined) {
-      merged.buffers = { ...previous.buffers, ...update.buffers };
+    if (previous.buffers !== undefined || ownedUpdate.buffers !== undefined) {
+      merged.buffers = { ...previous.buffers, ...ownedUpdate.buffers };
     }
 
-    if (previous.config !== undefined || update.config !== undefined) {
-      const config = { ...previous.config, ...update.config };
+    if (
+      previous.bufferPatches !== undefined ||
+      ownedUpdate.bufferPatches !== undefined
+    ) {
+      merged.bufferPatches = {
+        ...previous.bufferPatches,
+        ...ownedUpdate.bufferPatches,
+      };
+    }
+
+    if (previous.config !== undefined || ownedUpdate.config !== undefined) {
+      const config = { ...previous.config, ...ownedUpdate.config };
       if (
         previous.config?.simulation !== undefined ||
-        update.config?.simulation !== undefined
+        ownedUpdate.config?.simulation !== undefined
       ) {
         config.simulation = {
           ...previous.config?.simulation,
-          ...update.config?.simulation,
+          ...ownedUpdate.config?.simulation,
         };
       }
       merged.config = config;
     }
 
-    if (previous.resources !== undefined || update.resources !== undefined) {
-      merged.resources = mergeResources(previous.resources, update.resources);
+    if (previous.resources !== undefined || ownedUpdate.resources !== undefined) {
+      merged.resources = mergeResources(previous.resources, ownedUpdate.resources);
     }
 
     // Contract: `restart: false` and an ABSENT restart are
     // equivalent no-ops ("false/absent = keep state") — so neither cancels a
     // pending queued restart directive; only a new {alpha} replaces it.
     const restart =
-      update.restart !== undefined && update.restart !== false
-        ? update.restart
+      ownedUpdate.restart !== undefined && ownedUpdate.restart !== false
+        ? ownedUpdate.restart
         : previous.restart;
     if (restart !== undefined) merged.restart = restart;
 
@@ -1376,6 +1392,118 @@ export class CosmosEngine implements GraphEngine {
   }
 }
 
+/**
+ * Takes ownership of every mutable container in a commit that may be retained
+ * past `commit()`'s synchronous lifetime. Typed arrays are copied by value;
+ * nested records/lists are copied so callers cannot replace an owned array or
+ * atlas operation after enqueue. ImageBitmap itself is an opaque resource
+ * handle and deliberately remains shared.
+ */
+function cloneCommitForQueue(update: EngineCommit): EngineCommit {
+  const owned: EngineCommit = { revision: update.revision };
+
+  if (update.structure !== undefined) {
+    owned.structure = {
+      pointCount: update.structure.pointCount,
+      positions: update.structure.positions.slice(),
+      links: update.structure.links.slice(),
+    };
+  }
+
+  if (update.buffers !== undefined) {
+    const buffers: NonNullable<EngineCommit['buffers']> = {};
+    if (update.buffers.pointColor !== undefined) {
+      buffers.pointColor = update.buffers.pointColor.slice();
+    }
+    if (update.buffers.pointSize !== undefined) {
+      buffers.pointSize = update.buffers.pointSize.slice();
+    }
+    if (update.buffers.linkColor !== undefined) {
+      buffers.linkColor = update.buffers.linkColor.slice();
+    }
+    if (update.buffers.linkWidth !== undefined) {
+      buffers.linkWidth = update.buffers.linkWidth.slice();
+    }
+    owned.buffers = buffers;
+  }
+
+  if (update.bufferPatches !== undefined) {
+    const patches: NonNullable<EngineCommit['bufferPatches']> = {};
+    if (update.bufferPatches.pointColor !== undefined) {
+      patches.pointColor = update.bufferPatches.pointColor.map(({ start, data }) => ({
+        start,
+        data: data.slice(),
+      }));
+    }
+    if (update.bufferPatches.pointSize !== undefined) {
+      patches.pointSize = update.bufferPatches.pointSize.map(({ start, data }) => ({
+        start,
+        data: data.slice(),
+      }));
+    }
+    if (update.bufferPatches.linkColor !== undefined) {
+      patches.linkColor = update.bufferPatches.linkColor.map(({ start, data }) => ({
+        start,
+        data: data.slice(),
+      }));
+    }
+    if (update.bufferPatches.linkWidth !== undefined) {
+      patches.linkWidth = update.bufferPatches.linkWidth.map(({ start, data }) => ({
+        start,
+        data: data.slice(),
+      }));
+    }
+    owned.bufferPatches = patches;
+  }
+
+  if (update.config !== undefined) {
+    const config: NonNullable<EngineCommit['config']> = { ...update.config };
+    if (update.config.simulation !== undefined) {
+      config.simulation = { ...update.config.simulation };
+    }
+    if (update.config.cluster !== undefined) {
+      config.cluster =
+        update.config.cluster === null
+          ? null
+          : {
+              ...update.config.cluster,
+              pointClusters: update.config.cluster.pointClusters.slice(),
+              ...(update.config.cluster.centers === undefined
+                ? {}
+                : { centers: update.config.cluster.centers.slice() }),
+            };
+    }
+    owned.config = config;
+  }
+
+  if (update.resources !== undefined) {
+    const resources: EngineResources = {};
+    if (update.resources.imageAtlas !== undefined) {
+      const imageAtlas: NonNullable<EngineResources['imageAtlas']> = {};
+      if (update.resources.imageAtlas.upserts !== undefined) {
+        imageAtlas.upserts = update.resources.imageAtlas.upserts.map(({ slot, bitmap }) => ({
+          slot,
+          bitmap,
+        }));
+      }
+      if (update.resources.imageAtlas.removeSlots !== undefined) {
+        imageAtlas.removeSlots = Array.from(update.resources.imageAtlas.removeSlots);
+      }
+      resources.imageAtlas = imageAtlas;
+    }
+    if (update.resources.pointImageIndex !== undefined) {
+      resources.pointImageIndex = update.resources.pointImageIndex.slice();
+    }
+    owned.resources = resources;
+  }
+
+  if (update.restart !== undefined) {
+    owned.restart = update.restart === false ? false : { alpha: update.restart.alpha };
+  }
+
+  return owned;
+}
+
 /**
  * Per-channel merge for queued resources (pre-mount / context-lost):
  * upserts union per slot (latest bitmap wins), a later remove drops an
diff --git a/packages/engine-cosmos/test/cosmos-engine.test.ts b/packages/engine-cosmos/test/cosmos-engine.test.ts
index 8a3bb1c..d72968f 100644
--- a/packages/engine-cosmos/test/cosmos-engine.test.ts
+++ b/packages/engine-cosmos/test/cosmos-engine.test.ts
@@ -4,7 +4,11 @@
  * config and method calls in order so batching/ordering can be asserted.
  */
 import { afterEach, describe, expect, it, vi } from 'vitest';
-import type { EngineDiagnostic, EngineHostEvents } from '@modernrelay/orbit-core/engine';
+import type {
+  EngineCommit,
+  EngineDiagnostic,
+  EngineHostEvents,
+} from '@modernrelay/orbit-core/engine';
 import { CosmosEngine } from '../src/CosmosEngine';
 import type { CosmosEngineOptions } from '../src/CosmosEngine';
 
@@ -937,6 +941,125 @@ describe('CosmosEngine', () => {
     expect(withoutRestart.appliedRevision()).toBe(4);
   });
 
+  it('owns every array in an initial queued commit before commit() returns', async () => {
+    const positions = new Float32Array([10, 20, 30, 40]);
+    const links = new Uint32Array([0, 1]);
+    const pointColor = new Float32Array([1, 0, 0, 1, 0, 1, 0, 1]);
+    const pointSize = new Float32Array([3, 4]);
+    const linkColor = new Float32Array([0, 0, 1, 1]);
+    const patchData = new Float32Array([7]);
+    const pointClusters = new Float32Array([0, 1]);
+    const centers = new Float32Array([5, 6, 7, 8]);
+    const pointImageIndex = new Float32Array([0, 1]);
+    const engine = new CosmosEngine();
+
+    engine.commit({
+      revision: 1,
+      structure: { pointCount: 2, positions, links },
+      buffers: { pointColor, pointSize, linkColor },
+      bufferPatches: { linkWidth: [{ start: 0, data: patchData }] },
+      config: { cluster: { pointClusters, centers, strength: 0.5 } },
+      resources: { pointImageIndex },
+    });
+
+    // The patch channel is unsupported by cosmos and therefore is not
+    // applied, but it still crosses the same queued ownership boundary.
+    const pending = (
+      engine as unknown as { pendingCommit: EngineCommit | null }
+    ).pendingCommit!;
+    expect(pending.bufferPatches!.linkWidth![0]!.data).not.toBe(patchData);
+
+    positions.fill(99);
+    links.set([1, 0]);
+    pointColor.fill(0.25);
+    pointSize.fill(99);
+    linkColor.fill(0.25);
+    patchData.fill(99);
+    pointClusters.fill(9);
+    centers.fill(99);
+    pointImageIndex.fill(-1);
+
+    const container = document.createElement('div');
+    await engine.mount(container, makeEvents());
+    const graph = h.constructed[h.constructed.length - 1]!;
+
+    expect(Array.from(graph.calls.find((c) => c.method === 'setPointPositions')!.args[0] as Float32Array))
+      .toEqual([10, 20, 30, 40]);
+    expect(Array.from(graph.calls.find((c) => c.method === 'setLinks')!.args[0] as Float32Array))
+      .toEqual([0, 1]);
+    expect(Array.from(graph.calls.find((c) => c.method === 'setPointColors')!.args[0] as Float32Array))
+      .toEqual([1, 0, 0, 1, 0, 1, 0, 1]);
+    expect(Array.from(graph.calls.find((c) => c.method === 'setPointSizes')!.args[0] as Float32Array))
+      .toEqual([3, 4]);
+    expect(Array.from(graph.calls.find((c) => c.method === 'setLinkColors')!.args[0] as Float32Array))
+      .toEqual([0, 0, 1, 1]);
+    expect(graph.calls.find((c) => c.method === 'setPointClusters')!.args[0])
+      .toEqual([0, 1]);
+    expect(graph.calls.find((c) => c.method === 'setClusterPositions')!.args[0])
+      .toEqual([5, 6, 7, 8]);
+    expect(Array.from(graph.calls.find((c) => c.method === 'setPointImageIndices')!.args[0] as Float32Array))
+      .toEqual([0, 1]);
+  });
+
+  it('merges only owned array snapshots across queued commits', async () => {
+    const positions = new Float32Array([1, 2, 3, 4]);
+    const links = new Uint32Array([0, 1]);
+    const pointColor = new Float32Array([1, 0, 0, 1, 0, 1, 0, 1]);
+    const pointColorPatch = new Float32Array([0.5]);
+    const engine = new CosmosEngine();
+
+    engine.commit({
+      revision: 1,
+      structure: { pointCount: 2, positions, links },
+      buffers: { pointColor },
+      bufferPatches: { pointSize: [{ start: 0, data: pointColorPatch }] },
+    });
+    positions.fill(90);
+    links.fill(1);
+    pointColor.fill(0.25);
+    pointColorPatch.fill(90);
+
+    const pointSize = new Float32Array([8, 9]);
+    const linkWidthPatch = new Float32Array([2]);
+    const pointClusters = new Float32Array([1, 0]);
+    const pointImageIndex = new Float32Array([1, 0]);
+    engine.commit({
+      revision: 2,
+      buffers: { pointSize },
+      bufferPatches: { linkWidth: [{ start: 0, data: linkWidthPatch }] },
+      config: { cluster: { pointClusters } },
+      resources: { pointImageIndex },
+    });
+    pointSize.fill(90);
+    linkWidthPatch.fill(90);
+    pointClusters.fill(9);
+    pointImageIndex.fill(-1);
+
+    const pending = (
+      engine as unknown as { pendingCommit: EngineCommit | null }
+    ).pendingCommit!;
+    expect(Array.from(pending.bufferPatches!.pointSize![0]!.data)).toEqual([0.5]);
+    expect(Array.from(pending.bufferPatches!.linkWidth![0]!.data)).toEqual([2]);
+
+    const container = document.createElement('div');
+    await engine.mount(container, makeEvents());
+    const graph = h.constructed[h.constructed.length - 1]!;
+
+    expect(Array.from(graph.calls.find((c) => c.method === 'setPointPositions')!.args[0] as Float32Array))
+      .toEqual([1, 2, 3, 4]);
+    expect(Array.from(graph.calls.find((c) => c.method === 'setLinks')!.args[0] as Float32Array))
+      .toEqual([0, 1]);
+    expect(Array.from(graph.calls.find((c) => c.method === 'setPointColors')!.args[0] as Float32Array))
+      .toEqual([1, 0, 0, 1, 0, 1, 0, 1]);
+    expect(Array.from(graph.calls.find((c) => c.method === 'setPointSizes')!.args[0] as Float32Array))
+      .toEqual([8, 9]);
+    expect(graph.calls.find((c) => c.method === 'setPointClusters')!.args[0])
+      .toEqual([1, 0]);
+    expect(Array.from(graph.calls.find((c) => c.method === 'setPointImageIndices')!.args[0] as Float32Array))
+      .toEqual([1, 0]);
+    expect(engine.appliedRevision()).toBe(2);
+  });
+
   it('appliedRevision tracks the last rendered commit', async () => {
     const { engine, graph } = await mounted();
     expect(engine.appliedRevision()).toBeNull();
@@ -1547,7 +1670,8 @@ describe('CosmosEngine styling channels', () => {
 
     const indexCalls = recreated.calls.filter((c) => c.method === 'setPointImageIndices');
     expect(indexCalls).toHaveLength(1);
-    expect(indexCalls[0]!.args[0]).toBe(idxB); // latest pointImageIndex
+    expect(indexCalls[0]!.args[0]).not.toBe(idxB); // queued resources are owned snapshots
+    expect(Array.from(indexCalls[0]!.args[0] as Float32Array)).toEqual([0, -1]);
 
     expect(recreated.calls.filter((c) => c.method === 'render')).toHaveLength(1);
     expect(engine.appliedRevision()).toBe(6);
diff --git a/packages/omnigraph/src/codegen.ts b/packages/omnigraph/src/codegen.ts
index b7afcfc..261f339 100644
--- a/packages/omnigraph/src/codegen.ts
+++ b/packages/omnigraph/src/codegen.ts
@@ -159,6 +159,16 @@ function emitPropsInterface(
     lines.push('  id: string;');
   }
   for (const prop of properties) {
+    if (prop.name === 'id') {
+      // Export normalization requires `data.id` to be a string regardless of
+      // a schema declaration. Emitting the declared wire scalar here (for
+      // example I64 -> number) would make generated attrs unsound.
+      lines.push(
+        `  /** Physical Omnigraph id — normalized as a required string regardless of its schema wire type. */`,
+      );
+      lines.push('  id: string;');
+      continue;
+    }
     // Every schema property emits normally — including one named `type`: the
     // adapter's discriminator lives at the namespaced ORBIT_TYPE_KEY, so
     // there is nothing to shadow.
diff --git a/packages/omnigraph/src/loader.ts b/packages/omnigraph/src/loader.ts
index 2042702..02bd4e6 100644
--- a/packages/omnigraph/src/loader.ts
+++ b/packages/omnigraph/src/loader.ts
@@ -196,8 +196,13 @@ interface AttemptRetry {
 export function createOmnigraphSource(options: OmnigraphSourceOptions): OmnigraphSource {
   const graphId = options.graphId;
   const branch = options.branch ?? 'main';
-  const batchSize = Math.max(1, Math.floor(options.batchSize ?? DEFAULT_BATCH_SIZE));
-  const maxPendingBytes = options.maxPendingBytes ?? DEFAULT_MAX_PENDING_BYTES;
+  const batchSize =
+    options.batchSize === undefined ? DEFAULT_BATCH_SIZE : options.batchSize;
+  if (!Number.isSafeInteger(batchSize) || batchSize <= 0) {
+    throw new TypeError('createOmnigraphSource: batchSize must be a positive safe integer');
+  }
+  const maxPendingBytes =
+    options.maxPendingBytes === undefined ? DEFAULT_MAX_PENDING_BYTES : options.maxPendingBytes;
   if (!Number.isSafeInteger(maxPendingBytes) || maxPendingBytes <= 0) {
     throw new TypeError(
       'createOmnigraphSource: maxPendingBytes must be a positive safe integer',
diff --git a/packages/omnigraph/src/pgSchema.ts b/packages/omnigraph/src/pgSchema.ts
index 35dab12..1f5d30c 100644
--- a/packages/omnigraph/src/pgSchema.ts
+++ b/packages/omnigraph/src/pgSchema.ts
@@ -174,51 +174,26 @@ function findBlockEnd(src: string, openIdx: number): number {
   return n;
 }
 
-/** Split a block body into statements at newlines that sit outside parens/brackets/strings. */
-function splitStatements(body: string): string[] {
-  const out: string[] = [];
-  let depth = 0;
-  let current = '';
-  let i = 0;
-  const n = body.length;
-  while (i < n) {
-    const ch = body.charAt(i);
-    if (ch === '"') {
-      current += ch;
-      i++;
-      while (i < n) {
-        const c = body.charAt(i);
-        current += c;
-        i++;
-        if (c === '\\' && i < n) {
-          current += body.charAt(i);
-          i++;
-        } else if (c === '"') break;
-      }
-      continue;
-    }
-    if (ch === '(' || ch === '[') depth++;
-    else if (ch === ')' || ch === ']') depth = Math.max(0, depth - 1);
-    if (ch === '\n' && depth === 0) {
-      out.push(current);
-      current = '';
-    } else {
-      current += ch;
-    }
-    i++;
-  }
-  out.push(current);
-  return out.map((s) => s.trim()).filter((s) => s.length > 0);
-}
-
 interface RawAnnotation {
   name: string;
   args?: string;
   raw: string;
 }
 
+const BODY_CONSTRAINT_NAMES: ReadonlySet<string> = new Set([
+  'key',
+  'unique',
+  'index',
+  'range',
+  'check',
+]);
+
 /** Scan a run of `@ident` / `@ident(...)` annotations starting at `start`. */
-function scanAnnotations(src: string, start: number): { anns: RawAnnotation[]; end: number } {
+function scanAnnotations(
+  src: string,
+  start: number,
+  stopBeforeBodyConstraint = false,
+): { anns: RawAnnotation[]; end: number } {
   const anns: RawAnnotation[] = [];
   let i = start;
   const n = src.length;
@@ -226,14 +201,23 @@ function scanAnnotations(src: string, start: number): { anns: RawAnnotation[]; e
     let j = i;
     while (j < n && /\s/.test(src.charAt(j))) j++;
     if (src.charAt(j) !== '@') break;
-    const m = /^@([A-Za-z_]\w*)/.exec(src.slice(j));
+    // `annotation` and `body_constraint` spell the sigil and name as
+    // separate Pest sequence terms (`"@" ~ ident`), so implicit whitespace
+    // is legal here too (`@ key`, `@ rename_from (...)`).
+    const m = /^@\s*([A-Za-z_]\w*)/.exec(src.slice(j));
     if (!m || m[1] === undefined) break;
     const name = m[1];
     let end = j + m[0].length;
     let args: string | undefined;
-    if (src.charAt(end) === '(') {
+    // Pest inserts the silent WHITESPACE rule around `~`, so all schema
+    // annotations permit whitespace between their name and argument list
+    // (`@card (1..1)`, `@embed ("body")`, ...). Keep that whitespace in the
+    // preserved raw spelling while using the actual `(` as the parse cursor.
+    let open = end;
+    while (open < n && /\s/.test(src.charAt(open))) open++;
+    if (src.charAt(open) === '(') {
       let depth = 0;
-      let k = end;
+      let k = open;
       while (k < n) {
         const ch = src.charAt(k);
         if (ch === '"') {
@@ -256,9 +240,15 @@ function scanAnnotations(src: string, start: number): { anns: RawAnnotation[]; e
         }
         k++;
       }
-      args = src.slice(end + 1, k - 1);
+      args = src.slice(open + 1, k - 1);
       end = k;
     }
+    // In a property declaration these call-shaped keywords begin the next
+    // `body_constraint`; the Pest annotation rule explicitly excludes them.
+    // Bare `@key`/`@unique`/`@index` remain valid property annotations.
+    if (stopBeforeBodyConstraint && args !== undefined && BODY_CONSTRAINT_NAMES.has(name)) {
+      break;
+    }
     const entry: RawAnnotation = { name, raw: src.slice(j, end) };
     if (args !== undefined) entry.args = args;
     anns.push(entry);
@@ -322,20 +312,32 @@ function parseTypeRef(text: string): { type: PgType; optional: boolean; end: num
       i += m[0].length;
     } else {
       const close = text.indexOf(']', i);
-      const end = close === -1 ? n : close + 1;
+      const nextLine = text.indexOf('\n', i);
+      let end = close === -1 ? n : close + 1;
+      if (nextLine !== -1 && nextLine < end) end = nextLine;
       type = { kind: 'unknown', raw: text.slice(i, end).trim() };
       i = end;
     }
   } else {
     const m = /^([A-Za-z_]\w*)/.exec(text.slice(i));
     if (!m || m[1] === undefined) {
-      return { type: { kind: 'unknown', raw: text.trim() }, optional: false, end: n };
+      const nextLine = text.indexOf('\n', i);
+      const end = nextLine === -1 ? n : nextLine;
+      return {
+        type: { kind: 'unknown', raw: text.slice(i, end).trim() },
+        optional: false,
+        end,
+      };
     }
     const ident = m[1];
     i += m[0].length;
-    if ((ident === 'enum' || ident === 'Vector') && text.charAt(i) === '(') {
+    // As with annotations, the server grammar's silent WHITESPACE rule makes
+    // `Vector (3)` and `enum (a, b)` equivalent to their compact spellings.
+    let open = i;
+    while (open < n && /\s/.test(text.charAt(open))) open++;
+    if ((ident === 'enum' || ident === 'Vector') && text.charAt(open) === '(') {
       let depth = 0;
-      let k = i;
+      let k = open;
       while (k < n) {
         const ch = text.charAt(k);
         if (ch === '(') depth++;
@@ -348,7 +350,7 @@ function parseTypeRef(text: string): { type: PgType; optional: boolean; end: num
         }
         k++;
       }
-      const inner = text.slice(i + 1, k - 1);
+      const inner = text.slice(open + 1, k - 1);
       i = k;
       if (ident === 'enum') {
         const values = splitArgs(inner).map((v) => v.replace(/^"(.*)"$/s, '$1'));
@@ -366,6 +368,9 @@ function parseTypeRef(text: string): { type: PgType; optional: boolean; end: num
     }
   }
   let optional = false;
+  // `type_ref = { core_type ~ "?"? }`: implicit whitespace also applies
+  // before the optional marker (`String ?`, `[String] ?`, `Vector (3) ?`).
+  while (i < n && /\s/.test(text.charAt(i))) i++;
   if (text.charAt(i) === '?') {
     optional = true;
     i++;
@@ -376,41 +381,47 @@ function parseTypeRef(text: string): { type: PgType; optional: boolean; end: num
 function parseBody(body: string): MutableTypeBody {
   const properties: PgProperty[] = [];
   const constraints: string[] = [];
-  for (const stmt of splitStatements(body)) {
-    if (stmt.startsWith('@')) {
-      const { anns } = scanAnnotations(stmt, 0);
+  // Pest's implicit WHITESPACE includes newlines, so a newline is not a
+  // statement delimiter: `String\n?`, `Vector\n(3)`, and same-line adjacent
+  // declarations are all legal. Consume the body as one token stream.
+  let cursor = body.trimStart();
+  while (cursor !== '') {
+    if (cursor.startsWith('@')) {
+      const { anns, end } = scanAnnotations(cursor, 0);
+      if (anns.length === 0 || end === 0) break;
       for (const a of anns) constraints.push(a.raw);
+      cursor = cursor.slice(end).trimStart();
       continue;
     }
-    // A statement may carry SEVERAL whitespace-separated properties
-    // (`id: String when: DateTime`); a single parse would keep only the first
-    // and silently drop the rest. Loop until the trailer
-    // stops looking like another property head; junk trailers stay
-    // tolerant-skipped as before.
-    let cursor = stmt;
-    for (;;) {
-      const head = /^([A-Za-z_]\w*)\s*:\s*/.exec(cursor);
-      if (!head || head[1] === undefined) break; // tolerant: skip unrecognized statements
-      const name = head[1];
-      const rest = cursor.slice(head[0].length);
-      const { type, optional, end } = parseTypeRef(rest);
-      const { anns, end: annsEnd } = scanAnnotations(rest, end);
-      properties.push({
-        name,
-        type,
-        optional,
-        key: anns.some((a) => a.name === 'key'),
-        unique: anns.some((a) => a.name === 'unique'),
-        index: anns.some((a) => a.name === 'index'),
-        annotations: anns.map((a) => a.raw),
-      });
-      cursor = rest.slice(annsEnd).trimStart();
-      if (cursor === '') break;
+
+    const head = /^([A-Za-z_]\w*)\s*:\s*/.exec(cursor);
+    if (!head || head[1] === undefined) {
+      // Tolerant recovery: discard only the malformed physical line, then
+      // resume. Valid declarations do not need newlines, but this preserves
+      // the historical ability to salvage later lines after unknown syntax.
+      const nextLine = cursor.indexOf('\n');
+      if (nextLine === -1) break;
+      cursor = cursor.slice(nextLine + 1).trimStart();
+      continue;
     }
+    const name = head[1];
+    const rest = cursor.slice(head[0].length);
+    const { type, optional, end } = parseTypeRef(rest);
+    const { anns, end: annsEnd } = scanAnnotations(rest, end, true);
+    properties.push({
+      name,
+      type,
+      optional,
+      key: anns.some((a) => a.name === 'key'),
+      unique: anns.some((a) => a.name === 'unique'),
+      index: anns.some((a) => a.name === 'index'),
+      annotations: anns.map((a) => a.raw),
+    });
+    cursor = rest.slice(annsEnd).trimStart();
   }
   // Body-level @key(a, b) / @unique(a) / @index(a) constraints flag the named properties.
   for (const raw of constraints) {
-    const m = /^@(key|unique|index)\((.*)\)$/s.exec(raw);
+    const m = /^@\s*(key|unique|index)\s*\((.*)\)$/s.exec(raw);
     if (!m || m[1] === undefined || m[2] === undefined) continue;
     const flag = m[1] as 'key' | 'unique' | 'index';
     for (const propName of splitArgs(m[2])) {
diff --git a/packages/omnigraph/src/types.ts b/packages/omnigraph/src/types.ts
index 9b9e289..bb038a8 100644
--- a/packages/omnigraph/src/types.ts
+++ b/packages/omnigraph/src/types.ts
@@ -58,7 +58,7 @@ export interface OmnigraphSourceOptions {
    * field (wire form `type_names`). Omit to export every table.
    */
   typeNames?: readonly string[];
-  /** Export lines per `IngestBatch` append. Default 2000. */
+  /** Export lines per `IngestBatch` append. Must be a positive safe integer. Default 2000. */
   batchSize?: number;
   /**
    * Whole-load byte budget for the atomic replace. Because atomic staging
diff --git a/packages/omnigraph/test/codegen.test.ts b/packages/omnigraph/test/codegen.test.ts
index 4bbc71c..f839272 100644
--- a/packages/omnigraph/test/codegen.test.ts
+++ b/packages/omnigraph/test/codegen.test.ts
@@ -276,6 +276,23 @@ node Odd {
     expect(out).toContain("| ({ 'orbit:type': 'Odd' } & OddProps);");
   });
 
+  it('types every physical id as a required string regardless of its schema wire type', () => {
+    const out = generateTypesFromPgSource(`
+node NumericId {
+    id: I64 @key
+}
+edge OptionalNumericId: NumericId -> NumericId {
+    id: U64?
+}
+`);
+    const node = interfaceBody(out, 'NumericIdProps');
+    const edge = interfaceBody(out, 'OptionalNumericIdEdgeProps');
+    expect(node.match(/^ {2}id: string;$/gm)).toHaveLength(1);
+    expect(edge.match(/^ {2}id: string;$/gm)).toHaveLength(1);
+    expect(node).not.toContain('id: number');
+    expect(edge).not.toContain('id: number | null');
+  });
+
   it('collapses to never-unions and an empty TypeMap for an empty schema', () => {
     const out = generateTypes({ interfaces: [], nodes: [], edges: [] });
     expect(out).toContain('export type NodeAttrs = never;');
diff --git a/packages/omnigraph/test/loader.test.ts b/packages/omnigraph/test/loader.test.ts
index 4be7845..14156d5 100644
--- a/packages/omnigraph/test/loader.test.ts
+++ b/packages/omnigraph/test/loader.test.ts
@@ -220,6 +220,32 @@ const exportCalls = (calls: RecordedRequest[]): RecordedRequest[] =>
 // Tests
 // ---------------------------------------------------------------------------
 
+describe('source option validation', () => {
+  it('rejects batchSize values that cannot define a finite batch boundary', () => {
+    for (const batchSize of [
+      NaN,
+      Infinity,
+      -Infinity,
+      0,
+      -1,
+      1.5,
+      Number.MAX_VALUE,
+      null as unknown as number,
+    ]) {
+      expect(() => harness(recordedRoutes(), { batchSize })).toThrow(
+        /batchSize must be a positive safe integer/,
+      );
+    }
+    expect(() => harness(recordedRoutes(), { batchSize: 1 })).not.toThrow();
+  });
+
+  it('rejects non-numeric maxPendingBytes instead of treating null as the default', () => {
+    expect(() =>
+      harness(recordedRoutes(), { maxPendingBytes: null as unknown as number }),
+    ).toThrow(/maxPendingBytes must be a positive safe integer/);
+  });
+});
+
 describe('partial-export identity includes typeNames', () => {
   it('same head, different typeNames → DIFFERENT datasetKey and sourceRevision; order canonicalizes', async () => {
     const runLoad = async (typeNames?: readonly string[]) => {
diff --git a/packages/omnigraph/test/pg-schema.test.ts b/packages/omnigraph/test/pg-schema.test.ts
index 83d8c8c..b252611 100644
--- a/packages/omnigraph/test/pg-schema.test.ts
+++ b/packages/omnigraph/test/pg-schema.test.ts
@@ -245,6 +245,21 @@ describe('parsePgSchema grammar coverage beyond the fixture', () => {
     });
   });
 
+  it('recovers after a malformed type without swallowing later physical lines', () => {
+    const schema = parsePgSchema(`
+      node Recover {
+        broken: ???
+        broken_list: [???
+        good: String
+      }
+    `);
+    expect(node(schema, 'Recover').properties.map((p) => p.name)).toEqual([
+      'broken',
+      'broken_list',
+      'good',
+    ]);
+  });
+
   it('applies body-level @key(...) constraints to the named properties', () => {
     const schema = parsePgSchema(`
       node Composite {
@@ -258,6 +273,53 @@ describe('parsePgSchema grammar coverage beyond the fixture', () => {
     expect(composite?.properties.find((p) => p.name === 'num')?.key).toBe(true);
     expect(composite?.constraints).toEqual(['@key(region, num)']);
   });
+
+  it('matches the server grammar when whitespace separates delimiters', () => {
+    const schema = parsePgSchema(`
+      node Spaced @ rename_from ("Legacy") {
+        id: String
+          ? @ key
+        embedding: Vector
+          ( 3 ) ? @embed
+          ("id")
+        status: enum (active, archived)
+        tags: [String] ?
+        shard: I64
+        @ key
+          (shard)
+      }
+      edge Related: Spaced -> Spaced @card ( 1..1 ) @ custom ("kept")
+    `);
+
+    const spaced = node(schema, 'Spaced');
+    expect(spaced.properties.find((p) => p.name === 'id')).toMatchObject({
+      type: 'String',
+      optional: true,
+      key: true,
+    });
+    const embedding = spaced.properties.find((p) => p.name === 'embedding');
+    expect(embedding).toMatchObject({
+      type: { kind: 'vector', dim: 3 },
+      optional: true,
+    });
+    expect(embedding?.annotations).toHaveLength(1);
+    expect(embedding?.annotations[0]).toMatch(/^@embed\s+\("id"\)$/);
+    expect(spaced.properties.find((p) => p.name === 'status')?.type).toEqual({
+      kind: 'enum',
+      values: ['active', 'archived'],
+    });
+    expect(spaced.properties.find((p) => p.name === 'tags')).toMatchObject({
+      type: { kind: 'list', element: 'String' },
+      optional: true,
+    });
+    expect(spaced.properties.find((p) => p.name === 'shard')?.key).toBe(true);
+    expect(spaced.constraints).toHaveLength(1);
+    expect(spaced.constraints[0]).toMatch(/^@ key\s+\(shard\)$/);
+
+    const related = edge(schema, 'Related');
+    expect(related.card).toBe('1..1');
+    expect(related.annotations).toEqual(['@card ( 1..1 )', '@ custom ("kept")']);
+  });
 });
 
 describe('edgeEndpointTypes', () => {
@@ -353,4 +415,31 @@ describe('head annotations and same-line properties', () => {
     expect(props[0]!.key).toBe(true);
     expect(props[2]!.optional).toBe(true);
   });
+
+  it('spaced annotation sigils do not strand later same-line properties', () => {
+    const schema = parsePgSchema(
+      'node N @ rename_from ("OldN") {\n' +
+        '  id: String @ key when: DateTime @ index score: F64 ?\n' +
+        '}\n',
+    );
+    const props = schema.nodes[0]!.properties;
+    expect(props.map((p) => p.name)).toEqual(['id', 'when', 'score']);
+    expect(props[0]!.key).toBe(true);
+    expect(props[1]!.index).toBe(true);
+    expect(props[2]!.optional).toBe(true);
+  });
+
+  it('separates interleaved body constraints from same-line property annotations', () => {
+    const schema = parsePgSchema(
+      'node N {\n' +
+        '  @ index (a) a: String b: String @ key (a, b) c: I32 @ unique (c) d: Bool\n' +
+        '}\n',
+    );
+    const n = schema.nodes[0]!;
+    expect(n.properties.map((p) => p.name)).toEqual(['a', 'b', 'c', 'd']);
+    expect(n.properties.find((p) => p.name === 'a')).toMatchObject({ key: true, index: true });
+    expect(n.properties.find((p) => p.name === 'b')?.key).toBe(true);
+    expect(n.properties.find((p) => p.name === 'c')?.unique).toBe(true);
+    expect(n.constraints).toEqual(['@ index (a)', '@ key (a, b)', '@ unique (c)']);
+  });
 });
diff --git a/packages/react/src/LabelLayer.tsx b/packages/react/src/LabelLayer.tsx
index 98dd06f..915b68c 100644
--- a/packages/react/src/LabelLayer.tsx
+++ b/packages/react/src/LabelLayer.tsx
@@ -10,13 +10,22 @@
  * the SAME set → imperative `style.transform` writes through refs keyed by
  * id. No React re-render per tick (M0: the label lane is pure CPU O(k)).
  *
- * The layer is pointer-inert; label divs opt back in and drive the
- * click-selection path through the same public mutators (replace on plain
- * click and toggle on meta/shift).
+ * The layer is pointer-inert; built-in label divs opt back in as focusable
+ * buttons and drive the same public selection mutators by click or Enter/Space
+ * (replace normally, toggle with meta/shift). Custom renderers own their
+ * content's focus semantics, avoiding a button-role wrapper around a native
+ * interactive control. Node labels expose their context action through
+ * right-click plus ContextMenu/Shift+F10.
  */
 
 import { useEffect, useLayoutEffect, useRef, useState } from 'react';
-import type { CSSProperties, MouseEvent as ReactMouseEvent, ReactElement, ReactNode } from 'react';
+import type {
+  CSSProperties,
+  KeyboardEvent as ReactKeyboardEvent,
+  MouseEvent as ReactMouseEvent,
+  ReactElement,
+  ReactNode,
+} from 'react';
 import type { GraphNode, LabelPlacement, NodeId } from '@modernrelay/orbit-core';
 import { useAmbientGraphInstance } from './GraphProvider';
 import { overlaySurface, overlayLayerStyle } from './components/shared';
@@ -71,6 +80,7 @@ export function LabelLayer(props: LabelLayerProps): ReactElement {
   /** Freshest known screen position per candidate — written by BOTH channels
    * so a candidate re-render never snaps back to a stale x/y. */
   const positionsRef = useRef(new Map<string, readonly [number, number]>());
+  const layerRef = useRef<HTMLDivElement | null>(null);
 
   // Candidate SET changes: throttled re-rank → React re-render of the content.
   useEffect(() => {
@@ -109,9 +119,8 @@ export function LabelLayer(props: LabelLayerProps): ReactElement {
 
   // Click-selection semantics through the public mutators:
   // plain click replaces the node selection; meta/shift click toggles the id.
-  const onLabelClick = (id: NodeId, e: ReactMouseEvent<HTMLDivElement>): void => {
-    e.stopPropagation();
-    if (e.metaKey || e.shiftKey) {
+  const selectLabel = (id: NodeId, additive: boolean): void => {
+    if (additive) {
       const cur = instance.store.getState().selection.nodeIds;
       instance.setSelection(cur.includes(id) ? cur.filter((x) => x !== id) : [...cur, id]);
       return;
@@ -119,6 +128,11 @@ export function LabelLayer(props: LabelLayerProps): ReactElement {
     instance.setSelection([id]);
   };
 
+  const onLabelClick = (id: NodeId, e: ReactMouseEvent<HTMLDivElement>): void => {
+    e.stopPropagation();
+    selectLabel(id, e.metaKey || e.shiftKey);
+  };
+
   // a cluster label resolves to its MEMBER node ids through the
   // core mutator — clusters never enter the group selection namespace.
   const onClusterLabelClick = (key: string, e: ReactMouseEvent<HTMLDivElement>): void => {
@@ -126,13 +140,50 @@ export function LabelLayer(props: LabelLayerProps): ReactElement {
     instance.selectCluster(key, { additive: e.metaKey || e.shiftKey });
   };
 
+  const onLabelKeyDown = (
+    p: LabelPlacement,
+    e: ReactKeyboardEvent<HTMLDivElement>,
+  ): void => {
+    // Native button activation does not exist for a div with role="button",
+    // and keyboard-triggered `contextmenu` coordinates vary by browser. Give
+    // node labels (including native controls supplied by a custom renderer)
+    // an explicit ContextMenu / Shift+F10 path, anchored at the label's center
+    // in the same container-relative coordinate system as a pointer-triggered
+    // menu.
+    if (
+      p.kind !== 'cluster' &&
+      (e.key === 'ContextMenu' || (e.key === 'F10' && e.shiftKey))
+    ) {
+      e.preventDefault();
+      e.stopPropagation();
+      const layerRect = layerRef.current?.getBoundingClientRect();
+      if (layerRect === undefined) return;
+      const labelRect = e.currentTarget.getBoundingClientRect();
+      instance.requestNodeContextMenu(p.id, [
+        labelRect.left + labelRect.width / 2 - layerRect.left,
+        labelRect.top + labelRect.height / 2 - layerRect.top,
+      ]);
+      return;
+    }
+    // An escape-hatch renderer may supply its own focusable control. Its
+    // Enter keydown can synthesize a click that already bubbles through the
+    // label's click path, so handling the bubbled keydown here as well would
+    // activate the label twice.
+    if (e.target !== e.currentTarget) return;
+    if (e.key !== 'Enter' && e.key !== ' ') return;
+    e.preventDefault();
+    e.stopPropagation();
+    const additive = e.metaKey || e.shiftKey;
+    if (p.kind === 'cluster') instance.selectCluster(p.id, { additive });
+    else selectLabel(p.id, additive);
+  };
+
   // Right-click routes into the SAME typed 'contextMenu' channel the canvas
   // gesture feeds. Label divs are pointerEvents:'auto' (click-to-focus), so
   // without this the gesture dies here and the browser's native menu opens
   // on exactly the nodes prominent enough to carry labels. Coordinates are
   // container-relative CSS px (the layer fills the container), matching the
   // payload contract the canvas path uses.
-  const layerRef = useRef<HTMLDivElement | null>(null);
   const onLabelContextMenu = (id: NodeId, e: ReactMouseEvent<HTMLDivElement>): void => {
     e.preventDefault();
     e.stopPropagation();
@@ -154,17 +205,29 @@ export function LabelLayer(props: LabelLayerProps): ReactElement {
           ? [props.labelClassName, props.clusterLabelClassName].filter(Boolean).join(' ') ||
             undefined
           : props.labelClassName;
+        const hasCustomRenderer = isCluster
+          ? props.renderClusterLabel !== undefined
+          : props.renderNodeLabel !== undefined;
         return (
           <div
             key={key}
             {...(isCluster ? { 'data-orbit-cluster-label': p.id } : { 'data-orbit-label': p.id })}
             className={className}
+            {...(!hasCustomRenderer
+              ? {
+                  role: 'button',
+                  tabIndex: 0,
+                  'aria-label': p.text,
+                  ...(!isCluster ? { 'aria-haspopup': 'menu' as const } : {}),
+                }
+              : {})}
             style={{ ...LABEL_BASE_STYLE, transform: transformOf(x, y) }}
             ref={(el) => {
               if (el === null) elementsRef.current.delete(key);
               else elementsRef.current.set(key, el);
             }}
             onClick={(e) => (isCluster ? onClusterLabelClick(p.id, e) : onLabelClick(p.id, e))}
+            onKeyDown={(e) => onLabelKeyDown(p, e)}
             // Cluster labels keep the browser menu for now: their click
             // already selects members, and no cluster menu target exists.
             onContextMenu={isCluster ? undefined : (e) => onLabelContextMenu(p.id, e)}
diff --git a/packages/react/src/components/Minimap/index.tsx b/packages/react/src/components/Minimap/index.tsx
index 320d05e..7cad039 100644
--- a/packages/react/src/components/Minimap/index.tsx
+++ b/packages/react/src/components/Minimap/index.tsx
@@ -117,7 +117,9 @@ export function GraphMinimap(props: GraphMinimapProps): ReactElement {
   const rootRef = useRef<HTMLDivElement | null>(null);
   const canvasRef = useRef<HTMLCanvasElement | null>(null);
   const rectRef = useRef<HTMLDivElement | null>(null);
-  const draggingRef = useRef(false);
+  /** Pointer that owns the current pan gesture. Other simultaneous pointers
+   * cannot move or terminate it. */
+  const draggingPointerRef = useRef<number | null>(null);
   const declaredSceneRef = useRef<DeclaredSceneCache>({ ids: [], scene: null });
   /** mask lane for `getVisible`, recomputed once per refresh tick. */
   const visibleRef = useRef<{ ids: readonly NodeId[]; set: ReadonlySet<NodeId> | null }>({
@@ -272,8 +274,10 @@ export function GraphMinimap(props: GraphMinimapProps): ReactElement {
   };
 
   const onPointerDown = (e: ReactPointerEvent<HTMLCanvasElement>): void => {
+    const owner = draggingPointerRef.current;
+    if (owner !== null && owner !== e.pointerId) return;
     e.preventDefault();
-    draggingRef.current = true;
+    draggingPointerRef.current = e.pointerId;
     try {
       e.currentTarget.setPointerCapture(e.pointerId);
     } catch {
@@ -283,12 +287,13 @@ export function GraphMinimap(props: GraphMinimapProps): ReactElement {
   };
 
   const onPointerMove = (e: ReactPointerEvent<HTMLCanvasElement>): void => {
-    if (!draggingRef.current) return;
+    if (draggingPointerRef.current !== e.pointerId) return;
     panTo(e);
   };
 
-  const endDrag = (): void => {
-    draggingRef.current = false;
+  const endDrag = (e: ReactPointerEvent<HTMLCanvasElement>): void => {
+    if (draggingPointerRef.current !== e.pointerId) return;
+    draggingPointerRef.current = null;
   };
 
   return (
@@ -323,6 +328,8 @@ export function GraphMinimap(props: GraphMinimapProps): ReactElement {
         onPointerDown={onPointerDown}
         onPointerMove={onPointerMove}
         onPointerUp={endDrag}
+        onPointerCancel={endDrag}
+        onLostPointerCapture={endDrag}
         onPointerLeave={endDrag}
       />
       <div ref={rectRef} data-orbit-minimap-viewport="" style={RECT_STYLE} />
diff --git a/packages/react/src/components/Navigator/index.tsx b/packages/react/src/components/Navigator/index.tsx
index f466f9c..f7b34d8 100644
--- a/packages/react/src/components/Navigator/index.tsx
+++ b/packages/react/src/components/Navigator/index.tsx
@@ -76,6 +76,7 @@ import type {
   SearchResult,
   SelectionState,
 } from '@modernrelay/orbit-core';
+import { getSearchResultUnavailableCallback } from '../../hooks';
 import { useResolvedInstance } from '../shared';
 import type { AnyGraphInstance } from '../../GraphProvider';
 
@@ -476,7 +477,12 @@ export function GraphNavigator(props: GraphNavigatorProps): ReactElement {
   const activate = (row: NavRow): void => {
     if (row.listKey === 'search') {
       const result = searchResults.find((r) => r.id === row.nodeId);
-      if (result !== undefined) instance.activateSearchResult(result);
+      if (result !== undefined) {
+        const activation = instance.activateSearchResult(result);
+        if (activation.status === 'unavailable') {
+          getSearchResultUnavailableCallback(instance)?.(result, activation.reason);
+        }
+      }
       return;
     }
     const neighbors = instance.focusNode(row.nodeId);
diff --git a/packages/react/src/components/Tooltip/index.tsx b/packages/react/src/components/Tooltip/index.tsx
index fde2d9c..1098e35 100644
--- a/packages/react/src/components/Tooltip/index.tsx
+++ b/packages/react/src/components/Tooltip/index.tsx
@@ -192,12 +192,15 @@ export function GraphTooltip(props: GraphTooltipProps): ReactElement {
     [],
   );
 
-  // Delay lane: arm on hover, cancel/hide immediately on unhover.
+  // Delay lane: arm on hover, cancel/hide immediately on unhover OR target
+  // replacement. Keeping the previous card mounted while a new target's
+  // timer runs presents stale content for an item that is no longer hovered.
   useEffect(() => {
     if (hoverKey === null) {
       setVisibleKey(null);
       return undefined;
     }
+    setVisibleKey((current) => (current === hoverKey ? current : null));
     const timer = setTimeout(() => {
       setVisibleKey(hoverKey);
     }, delayMs);
@@ -251,7 +254,10 @@ export function GraphTooltip(props: GraphTooltipProps): ReactElement {
     if (visibleKey !== null) position(decodeHover(visibleKey).id);
   }, [visibleKey, position]);
 
-  const target = visibleKey === null ? null : decodeHover(visibleKey);
+  // Render-gate synchronously as well as clearing state in the effect: on the
+  // first commit for a replacement hover, effects have not run yet and
+  // `visibleKey` still names the previous target.
+  const target = visibleKey === null || visibleKey !== hoverKey ? null : decodeHover(visibleKey);
   const node =
     target?.kind === 'node'
       ? (instance.getNode(target.id) as GraphNode<any> | undefined)
diff --git a/packages/react/test/label-layer.test.tsx b/packages/react/test/label-layer.test.tsx
index ad7ec53..448e399 100644
--- a/packages/react/test/label-layer.test.tsx
+++ b/packages/react/test/label-layer.test.tsx
@@ -218,6 +218,27 @@ describe('<LabelLayer>', () => {
     expect(mock.setSelection).toHaveBeenLastCalledWith(['a']);
   });
 
+  it('node labels are named keyboard buttons with click-equivalent activation', () => {
+    const mock = createLabelsMock([placement('a', 'Alpha'), placement('b', 'Beta')]);
+    const { container } = render(
+      <GraphProvider instance={mock.instance}>
+        <LabelLayer />
+      </GraphProvider>,
+    );
+    const a = container.querySelector('[data-orbit-label="a"]')!;
+    const b = container.querySelector('[data-orbit-label="b"]')!;
+
+    expect(a.getAttribute('role')).toBe('button');
+    expect(a.getAttribute('tabindex')).toBe('0');
+    expect(a.getAttribute('aria-label')).toBe('Alpha');
+    expect(a.getAttribute('aria-haspopup')).toBe('menu');
+
+    fireEvent.keyDown(a, { key: 'Enter' });
+    expect(mock.setSelection).toHaveBeenLastCalledWith(['a']);
+    fireEvent.keyDown(b, { key: ' ', shiftKey: true });
+    expect(mock.setSelection).toHaveBeenLastCalledWith(['a', 'b']);
+  });
+
   it('label right-click routes into the typed context-menu channel, not the browser menu', () => {
     const mock = createLabelsMock([placement('a', 'Alpha')]);
     const { container } = render(
@@ -239,6 +260,125 @@ describe('<LabelLayer>', () => {
     expect(screen).toEqual([40, 25]);
   });
 
+  it.each([
+    ['ContextMenu', false],
+    ['F10', true],
+  ])(
+    '%s opens the node context action from the keyboard at the label center',
+    (key, shiftKey) => {
+      const mock = createLabelsMock([placement('a', 'Alpha')]);
+      const { container } = render(
+        <GraphProvider instance={mock.instance}>
+          <LabelLayer />
+        </GraphProvider>,
+      );
+      const layer = container.querySelector('[data-orbit-label-layer]') as HTMLDivElement;
+      const a = container.querySelector('[data-orbit-label="a"]') as HTMLDivElement;
+      vi.spyOn(layer, 'getBoundingClientRect').mockReturnValue({
+        x: 10,
+        y: 20,
+        left: 10,
+        top: 20,
+        right: 210,
+        bottom: 120,
+        width: 200,
+        height: 100,
+        toJSON: () => ({}),
+      });
+      vi.spyOn(a, 'getBoundingClientRect').mockReturnValue({
+        x: 30,
+        y: 50,
+        left: 30,
+        top: 50,
+        right: 70,
+        bottom: 70,
+        width: 40,
+        height: 20,
+        toJSON: () => ({}),
+      });
+
+      const allowed = fireEvent.keyDown(a, { key, shiftKey });
+
+      expect(allowed, 'the browser context-menu default must be suppressed').toBe(false);
+      expect(mock.requestNodeContextMenu).toHaveBeenCalledTimes(1);
+      expect(mock.requestNodeContextMenu).toHaveBeenCalledWith('a', [40, 40]);
+      expect(mock.setSelection).not.toHaveBeenCalled();
+    },
+  );
+
+  it('does not double-activate when a custom focusable child synthesizes a click', () => {
+    const mock = createLabelsMock([placement('a', 'Alpha')]);
+    const { container, getByRole, getAllByRole } = render(
+      <GraphProvider instance={mock.instance}>
+        <LabelLayer renderNodeLabel={() => <button type="button">custom action</button>} />
+      </GraphProvider>,
+    );
+    const wrapper = container.querySelector('[data-orbit-label="a"]')!;
+    const child = getByRole('button', { name: 'custom action' });
+
+    // The escape hatch owns its semantics: there must not be a second,
+    // button-role focus stop wrapped around the native button.
+    expect(wrapper.getAttribute('role')).toBeNull();
+    expect(wrapper.getAttribute('tabindex')).toBeNull();
+    expect(wrapper.getAttribute('aria-label')).toBeNull();
+    expect(wrapper.getAttribute('aria-haspopup')).toBeNull();
+    expect(getAllByRole('button')).toEqual([child]);
+
+    // Browser sequence for Enter on a native child button: keydown followed
+    // by its synthesized click. Only the click may reach label activation.
+    fireEvent.keyDown(child, { key: 'Enter' });
+    fireEvent.click(child);
+
+    expect(mock.setSelection).toHaveBeenCalledTimes(1);
+    expect(mock.setSelection).toHaveBeenCalledWith(['a']);
+  });
+
+  it.each([
+    ['ContextMenu', false],
+    ['F10', true],
+  ])(
+    'custom node control keeps the explicit %s context-menu keyboard path',
+    (key, shiftKey) => {
+      const mock = createLabelsMock([placement('a', 'Alpha')]);
+      const { container, getByRole } = render(
+        <GraphProvider instance={mock.instance}>
+          <LabelLayer renderNodeLabel={() => <button type="button">custom action</button>} />
+        </GraphProvider>,
+      );
+      const layer = container.querySelector('[data-orbit-label-layer]') as HTMLDivElement;
+      const wrapper = container.querySelector('[data-orbit-label="a"]') as HTMLDivElement;
+      const child = getByRole('button', { name: 'custom action' });
+      vi.spyOn(layer, 'getBoundingClientRect').mockReturnValue({
+        x: 10,
+        y: 20,
+        left: 10,
+        top: 20,
+        right: 210,
+        bottom: 120,
+        width: 200,
+        height: 100,
+        toJSON: () => ({}),
+      });
+      vi.spyOn(wrapper, 'getBoundingClientRect').mockReturnValue({
+        x: 30,
+        y: 50,
+        left: 30,
+        top: 50,
+        right: 70,
+        bottom: 70,
+        width: 40,
+        height: 20,
+        toJSON: () => ({}),
+      });
+
+      const allowed = fireEvent.keyDown(child, { key, shiftKey });
+
+      expect(allowed, 'the browser context-menu default must be suppressed').toBe(false);
+      expect(mock.requestNodeContextMenu).toHaveBeenCalledWith('a', [40, 40]);
+      expect(mock.setSelection).not.toHaveBeenCalled();
+    },
+  );
+
   it('cluster-label right-click stays native: no context-menu call, no preventDefault', () => {
     const mock = createLabelsMock([]);
     const { container } = render(
@@ -387,6 +527,25 @@ describe('<LabelLayer> cluster placements', () => {
     expect(mock.selectCluster).toHaveBeenLastCalledWith('red', { additive: true });
   });
 
+  it('cluster labels expose the same named keyboard-button contract', () => {
+    const mock = createLabelsMock([clusterPlacement('red', 'Red cluster')]);
+    const { container } = render(
+      <GraphProvider instance={mock.instance}>
+        <LabelLayer />
+      </GraphProvider>,
+    );
+    const el = container.querySelector('[data-orbit-cluster-label="red"]')!;
+
+    expect(el.getAttribute('role')).toBe('button');
+    expect(el.getAttribute('tabindex')).toBe('0');
+    expect(el.getAttribute('aria-label')).toBe('Red cluster');
+    expect(el.hasAttribute('aria-haspopup')).toBe(false);
+    fireEvent.keyDown(el, { key: 'Enter' });
+    expect(mock.selectCluster).toHaveBeenLastCalledWith('red', { additive: false });
+    fireEvent.keyDown(el, { key: ' ', metaKey: true });
+    expect(mock.selectCluster).toHaveBeenLastCalledWith('red', { additive: true });
+  });
+
   it('clusterLabelClassName and renderClusterLabel apply only to cluster labels', () => {
     const mock = createLabelsMock([
       clusterPlacement('red', 'red'),
@@ -410,6 +569,13 @@ describe('<LabelLayer> cluster placements', () => {
     expect(cluster.classList.contains('lbl')).toBe(true);
     expect(cluster.classList.contains('cluster-lbl')).toBe(true);
     expect(node.classList.contains('cluster-lbl')).toBe(false);
+    expect(cluster.getAttribute('role')).toBeNull();
+    expect(cluster.getAttribute('tabindex')).toBeNull();
+    expect(cluster.getAttribute('aria-label')).toBeNull();
+    // The node has no custom renderer and retains the built-in keyboard
+    // button contract.
+    expect(node.getAttribute('role')).toBe('button');
+    expect(node.getAttribute('tabindex')).toBe('0');
     expect(cluster.querySelector('[data-testid="cluster-custom"]')!.textContent).toBe('red:a+b');
     expect(node.textContent).toBe('Alpha');
   });
diff --git a/packages/react/test/minimap.test.tsx b/packages/react/test/minimap.test.tsx
index e8d427d..9384ddf 100644
--- a/packages/react/test/minimap.test.tsx
+++ b/packages/react/test/minimap.test.tsx
@@ -199,10 +199,17 @@ describe('<GraphMinimap> viewport rectangle lane', () => {
 /** jsdom has no PointerEvent: dispatch MouseEvents with pointer TYPES (the
  * same native event names React's onPointer* handlers listen for), which
  * carry real clientX/clientY. */
-function firePointer(el: Element, type: string, x: number, y: number): void {
+function firePointer(el: Element, type: string, x: number, y: number, pointerId = 1): void {
+  const event = new MouseEvent(type, {
+    bubbles: true,
+    cancelable: true,
+    clientX: x,
+    clientY: y,
+  });
+  Object.defineProperty(event, 'pointerId', { value: pointerId });
   fireEvent(
     el,
-    new MouseEvent(type, { bubbles: true, cancelable: true, clientX: x, clientY: y }),
+    event,
   );
 }
 
@@ -238,4 +245,35 @@ describe('<GraphMinimap> click/drag pan', () => {
     firePointer(canvas, 'pointermove', 20, 20);
     expect(setViewportSpy).toHaveBeenCalledTimes(3); // no pan after release
   });
+
+  it.each(['pointercancel', 'lostpointercapture'])(
+    '%s terminates the owning drag',
+    async (terminalEvent) => {
+      const { instance, canvas } = await setup(40);
+      const setViewportSpy = vi.spyOn(instance, 'setViewport');
+
+      firePointer(canvas, 'pointerdown', 10, 10, 7);
+      firePointer(canvas, terminalEvent, 10, 10, 7);
+      firePointer(canvas, 'pointermove', 20, 20, 7);
+
+      expect(setViewportSpy).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it('only the pointer that started a drag may move or terminate it', async () => {
+    const { instance, canvas } = await setup(40);
+    const setViewportSpy = vi.spyOn(instance, 'setViewport');
+
+    firePointer(canvas, 'pointerdown', 10, 10, 7);
+    firePointer(canvas, 'pointermove', 20, 20, 8); // unrelated move
+    firePointer(canvas, 'pointerup', 20, 20, 8); // unrelated release
+    firePointer(canvas, 'pointerdown', 20, 20, 8); // cannot steal ownership
+    expect(setViewportSpy).toHaveBeenCalledTimes(1);
+
+    firePointer(canvas, 'pointermove', 14, 14, 7);
+    expect(setViewportSpy).toHaveBeenCalledTimes(2);
+    firePointer(canvas, 'pointerup', 14, 14, 7);
+    firePointer(canvas, 'pointermove', 18, 18, 7);
+    expect(setViewportSpy).toHaveBeenCalledTimes(2);
+  });
 });
diff --git a/packages/react/test/navigator.test.tsx b/packages/react/test/navigator.test.tsx
index b16b98c..fa1a09e 100644
--- a/packages/react/test/navigator.test.tsx
+++ b/packages/react/test/navigator.test.tsx
@@ -17,6 +17,7 @@ import type { AccessibilityConfig, GraphInstance, GraphSnapshot } from '@modernr
 import { FakeEngine } from '@modernrelay/orbit-core/testing';
 import { GraphProvider } from '../src/GraphProvider';
 import { GraphNavigator } from '../src/components/Navigator/index';
+import { setSearchResultUnavailableCallback } from '../src/hooks';
 
 // --- fixtures -------------------------------------------------------------
 
@@ -393,6 +394,27 @@ describe('<GraphNavigator> search results section', () => {
     expect(view.container.querySelector('[aria-label^="Focused node"]')).toBeNull();
   });
 
+  it('forwards unavailable search activation to the Graph-level callback channel', async () => {
+    const { view, instance } = await setup({
+      snapshot: chainSnapshot(10),
+      accessibility: { navigatorWindow: 5 },
+    });
+    await act(async () => {
+      await instance.search('n3', { limit: 5 });
+    });
+    const onUnavailable = vi.fn();
+    setSearchResultUnavailableCallback(instance, onUnavailable);
+    act(() => {
+      instance.applyHostUpdate({ subgraph: { seedIds: ['n0'], hops: 0 } });
+    });
+
+    fireEvent.keyDown(listbox(view), { key: 'Enter' });
+
+    expect(onUnavailable).toHaveBeenCalledTimes(1);
+    expect(onUnavailable.mock.calls[0]![0]).toMatchObject({ id: 'n3' });
+    expect(onUnavailable.mock.calls[0]![1]).toBe('out-of-scope');
+  });
+
   it('search rows render the service label as a text node (hostile labels literal)', async () => {
     const payload = '<script>alert(1)</script>';
     const { view, instance } = await setup({
diff --git a/packages/react/test/tooltip.test.tsx b/packages/react/test/tooltip.test.tsx
index 4b11bfd..5f6fc09 100644
--- a/packages/react/test/tooltip.test.tsx
+++ b/packages/react/test/tooltip.test.tsx
@@ -144,6 +144,32 @@ describe('<GraphTooltip> delay & visibility', () => {
     expect(card(view)!.textContent).toBe('b'); // no attrs → id title only
   });
 
+  it('hides the previous target while the replacement target waits out its delay', async () => {
+    vi.useFakeTimers();
+    const { engine, view } = await setup();
+    act(() => {
+      engine.injectPointHover(0);
+    });
+    act(() => {
+      vi.advanceTimersByTime(150);
+    });
+    expect(card(view)!.textContent).toContain('Alpha');
+
+    act(() => {
+      engine.injectPointHover(1);
+    });
+    expect(card(view)).toBeNull(); // Alpha is no longer hovered: hide now
+
+    act(() => {
+      vi.advanceTimersByTime(149);
+    });
+    expect(card(view)).toBeNull();
+    act(() => {
+      vi.advanceTimersByTime(1);
+    });
+    expect(card(view)!.textContent).toBe('b');
+  });
+
   it('follows the pointer while visible (untracked id → cursor lane)', async () => {
     vi.useFakeTimers();
     const { engine, view } = await setup();
diff --git a/scripts/check-workspace-worker-asset.mjs b/scripts/check-workspace-worker-asset.mjs
new file mode 100644
index 0000000..6db05a7
--- /dev/null
+++ b/scripts/check-workspace-worker-asset.mjs
@@ -0,0 +1,29 @@
+import { readdir, readFile, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const assetsDir = path.join(scriptDir, '..', 'apps', 'demo', 'dist', 'assets');
+const candidates = (await readdir(assetsDir)).filter(
+  (name) => /^entry-[\w-]+\.js$/.test(name),
+);
+
+let workerAsset = null;
+for (const name of candidates) {
+  const file = path.join(assetsDir, name);
+  const [info, source] = await Promise.all([stat(file), readFile(file, 'utf8')]);
+  if (info.size >= 1_000 && source.includes('derive-columnar')) {
+    workerAsset = { name, size: info.size };
+    break;
+  }
+}
+
+if (workerAsset === null) {
+  throw new Error(
+    'workspace worker smoke: Vite emitted no non-empty default worker asset containing derive-columnar',
+  );
+}
+
+console.log(
+  `workspace worker smoke: ${workerAsset.name} (${workerAsset.size} bytes)`,
+);