@@ -48,7 +48,7 @@ require (

 	github.com/google/uuid v1.6.0

 	github.com/gorilla/mux v1.8.1

 	github.com/hashicorp/go-immutable-radix/v2 v2.1.0

-	github.com/hashicorp/go-memdb v1.3.2

+	github.com/hashicorp/go-memdb v1.3.5

 	github.com/hashicorp/memberlist v0.4.0

 	github.com/hashicorp/serf v0.8.5

 	github.com/ishidawataru/sctp v0.0.0-20250829011129-4b890084db30

@@ -296,13 +296,12 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY

 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=

 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=

 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=

-github.com/hashicorp/go-immutable-radix v1.3.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=

 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=

 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=

 github.com/hashicorp/go-immutable-radix/v2 v2.1.0 h1:CUW5RYIcysz+D3B+l1mDeXrQ7fUvGGCwJfdASSzbrfo=

 github.com/hashicorp/go-immutable-radix/v2 v2.1.0/go.mod h1:hgdqLXA4f6NIjRVisM1TJ9aOJVNRqKZj+xDGF6m7PBw=

-github.com/hashicorp/go-memdb v1.3.2 h1:RBKHOsnSszpU6vxq80LzC2BaQjuuvoyaQbkLTf7V7g8=

-github.com/hashicorp/go-memdb v1.3.2/go.mod h1:Mluclgwib3R93Hk5fxEfiRhB+6Dar64wWh71LpNSe3g=

+github.com/hashicorp/go-memdb v1.3.5 h1:b3taDMxCBCBVgyRrS1AZVHO14ubMYZB++QpNhBg+Nyo=

+github.com/hashicorp/go-memdb v1.3.5/go.mod h1:8IVKKBkVe+fxFgdFOYxzQQNjz+sWCyHCdIC/+5+Vy1Y=

 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=

 github.com/hashicorp/go-msgpack v0.5.5 h1:i9R9JSrqIz0QVLz3sz+i3YJdT7TTSLcfLLzJi9aZTuI=

 github.com/hashicorp/go-msgpack v0.5.5/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=

new file mode 100644

@@ -0,0 +1,13 @@

+# Each line is a file pattern followed by one or more owners.

+# More on CODEOWNERS files: https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners

+

+# Default owner

+* @hashicorp/team-ip-compliance @hashicorp/raft-force

+

+# Add override rules below. Each line is a file/folder pattern followed by one or more owners.

+# Being an owner means those groups or individuals will be added as reviewers to PRs affecting

+# those areas of the code.

+# Examples:

+# /docs/  @docs-team

+# *.js    @js-team

+# *.go    @go-team

@@ -1,3 +1,5 @@

+Copyright (c) 2015 HashiCorp, Inc.

+

 Mozilla Public License, version 2.0

 1. Definitions

@@ -1,3 +1,6 @@

+// Copyright (c) HashiCorp, Inc.

+// SPDX-License-Identifier: MPL-2.0

+

 package memdb

 // Changes describes a set of mutations to memDB tables performed during a

@@ -1,3 +1,6 @@

+// Copyright (c) HashiCorp, Inc.

+// SPDX-License-Identifier: MPL-2.0

+

 package memdb

 // FilterFunc is a function that takes the results of an iterator and returns

@@ -1,3 +1,6 @@

+// Copyright (c) HashiCorp, Inc.

+// SPDX-License-Identifier: MPL-2.0

+

 package memdb

 import (

@@ -5,8 +8,8 @@ import (

 	"encoding/hex"

 	"errors"

 	"fmt"

-	"math/bits"

 	"reflect"

+	"strconv"

 	"strings"

 )

@@ -308,8 +311,7 @@ func (i *IntFieldIndex) FromObject(obj interface{}) (bool, []byte, error) {

 	// Get the value and encode it

 	val := fv.Int()

-	buf := make([]byte, size)

-	binary.PutVarint(buf, val)

+	buf := encodeInt(val, size)

 	return true, buf, nil

 }

@@ -331,26 +333,50 @@ func (i *IntFieldIndex) FromArgs(args ...interface{}) ([]byte, error) {

 	}

 	val := v.Int()

-	buf := make([]byte, size)

-	binary.PutVarint(buf, val)

+	buf := encodeInt(val, size)

 	return buf, nil

 }

+func encodeInt(val int64, size int) []byte {

+	buf := make([]byte, size)

+

+	// This bit flips the sign bit on any sized signed twos-complement integer,

+	// which when truncated to a uint of the same size will bias the value such

+	// that the maximum negative int becomes 0, and the maximum positive int

+	// becomes the maximum positive uint.

+	scaled := val ^ int64(-1<<(size*8-1))

+

+	switch size {

+	case 1:

+		buf[0] = uint8(scaled)

+	case 2:

+		binary.BigEndian.PutUint16(buf, uint16(scaled))

+	case 4:

+		binary.BigEndian.PutUint32(buf, uint32(scaled))

+	case 8:

+		binary.BigEndian.PutUint64(buf, uint64(scaled))

+	default:

+		panic(fmt.Sprintf("unsupported int size parameter: %d", size))

+	}

+

+	return buf

+}

+

 // IsIntType returns whether the passed type is a type of int and the number

 // of bytes needed to encode the type.

 func IsIntType(k reflect.Kind) (size int, okay bool) {

 	switch k {

 	case reflect.Int:

-		return binary.MaxVarintLen64, true

+		return strconv.IntSize / 8, true

 	case reflect.Int8:

-		return 2, true

+		return 1, true

 	case reflect.Int16:

-		return binary.MaxVarintLen16, true

+		return 2, true

 	case reflect.Int32:

-		return binary.MaxVarintLen32, true

+		return 4, true

 	case reflect.Int64:

-		return binary.MaxVarintLen64, true

+		return 8, true

 	default:

 		return 0, false

 	}

@@ -420,6 +446,8 @@ func encodeUInt(val uint64, size int) []byte {

 		binary.BigEndian.PutUint32(buf, uint32(val))

 	case 8:

 		binary.BigEndian.PutUint64(buf, val)

+	default:

+		panic(fmt.Sprintf("unsupported uint size parameter: %d", size))

 	}

 	return buf

@@ -430,7 +458,7 @@ func encodeUInt(val uint64, size int) []byte {

 func IsUintType(k reflect.Kind) (size int, okay bool) {

 	switch k {

 	case reflect.Uint:

-		return bits.UintSize / 8, true

+		return strconv.IntSize / 8, true

 	case reflect.Uint8:

 		return 1, true

 	case reflect.Uint16:

@@ -767,8 +795,6 @@ type CompoundMultiIndex struct {

 func (c *CompoundMultiIndex) FromObject(raw interface{}) (bool, [][]byte, error) {

 	// At each entry, builder is storing the results from the next index

 	builder := make([][][]byte, 0, len(c.Indexes))

-	// Start with something higher to avoid resizing if possible

-	out := make([][]byte, 0, len(c.Indexes)^3)

 forloop:

 	// This loop goes through each indexer and adds the value(s) provided to the next

@@ -810,6 +836,9 @@ forloop:

 		}

 	}

+	// Start with something higher to avoid resizing if possible

+	out := make([][]byte, 0, len(c.Indexes)^3)

+

 	// We are walking through the builder slice essentially in a depth-first fashion,

 	// building the prefix and leaves as we go. If AllowMissing is false, we only insert

 	// these full paths to leaves. Otherwise, we also insert each prefix along the way.

@@ -818,10 +847,16 @@ forloop:

 	// field specified as "abc", it is valid to call FromArgs with just "abc".

 	var walkVals func([]byte, int)

 	walkVals = func(currPrefix []byte, depth int) {

+		if depth >= len(builder) {

+			return

+		}

+

 		if depth == len(builder)-1 {

 			// These are the "leaves", so append directly

 			for _, v := range builder[depth] {

-				out = append(out, append(currPrefix, v...))

+				outcome := make([]byte, len(currPrefix))

+				copy(outcome, currPrefix)

+				out = append(out, append(outcome, v...))

 			}

 			return

 		}

@@ -1,3 +1,6 @@

+// Copyright (c) HashiCorp, Inc.

+// SPDX-License-Identifier: MPL-2.0

+

 // Package memdb provides an in-memory database that supports transactions

 // and MVCC.

 package memdb

@@ -52,6 +55,14 @@ func NewMemDB(schema *DBSchema) (*MemDB, error) {

 	return db, nil

 }

+// DBSchema returns schema in use for introspection.

+//

+// The method is intended for *read-only* debugging use cases,

+// returned schema should *never be modified in-place*.

+func (db *MemDB) DBSchema() *DBSchema {

+	return db.schema

+}

+

 // getRoot is used to do an atomic load of the root pointer

 func (db *MemDB) getRoot() *iradix.Tree {

 	root := (*iradix.Tree)(atomic.LoadPointer(&db.root))

@@ -1,3 +1,6 @@

+// Copyright (c) HashiCorp, Inc.

+// SPDX-License-Identifier: MPL-2.0

+

 package memdb

 import "fmt"

@@ -1,3 +1,6 @@

+// Copyright (c) HashiCorp, Inc.

+// SPDX-License-Identifier: MPL-2.0

+

 package memdb

 import (

@@ -102,7 +105,8 @@ func (txn *Txn) writableIndex(table, index string) *iradix.Txn {

 }

 // Abort is used to cancel this transaction.

-// This is a noop for read transactions.

+// This is a noop for read transactions,

+// already aborted or commited transactions.

 func (txn *Txn) Abort() {

 	// Noop for a read transaction

 	if !txn.write {

@@ -124,7 +128,8 @@ func (txn *Txn) Abort() {

 }

 // Commit is used to finalize this transaction.

-// This is a noop for read transactions.

+// This is a noop for read transactions,

+// already aborted or committed transactions.

 func (txn *Txn) Commit() {

 	// Noop for a read transaction

 	if !txn.write {

@@ -321,7 +326,7 @@ func (txn *Txn) Delete(table string, obj interface{}) error {

 		return fmt.Errorf("object missing primary index")

 	}

-	// Lookup the object by ID first, check fi we should continue

+	// Lookup the object by ID first, check if we should continue

 	idTxn := txn.writableIndex(table, id)

 	existing, ok := idTxn.Get(idVal)

 	if !ok {

@@ -513,7 +518,19 @@ func (txn *Txn) DeleteAll(table, index string, args ...interface{}) (int, error)

 }

 // FirstWatch is used to return the first matching object for

-// the given constraints on the index along with the watch channel

+// the given constraints on the index along with the watch channel.

+//

+// Note that all values read in the transaction form a consistent snapshot

+// from the time when the transaction was created.

+//

+// The watch channel is closed when a subsequent write transaction

+// has updated the result of the query. Since each read transaction

+// operates on an isolated snapshot, a new read transaction must be

+// started to observe the changes that have been made.

+//

+// If the value of index ends with "_prefix", FirstWatch will perform a prefix

+// match instead of full match on the index. The registered indexer must implement

+// PrefixIndexer, otherwise an error is returned.

 func (txn *Txn) FirstWatch(table, index string, args ...interface{}) (<-chan struct{}, interface{}, error) {

 	// Get the index value

 	indexSchema, val, err := txn.getIndexValue(table, index, args...)

@@ -541,7 +558,19 @@ func (txn *Txn) FirstWatch(table, index string, args ...interface{}) (<-chan str

 }

 // LastWatch is used to return the last matching object for

-// the given constraints on the index along with the watch channel

+// the given constraints on the index along with the watch channel.

+//

+// Note that all values read in the transaction form a consistent snapshot

+// from the time when the transaction was created.

+//

+// The watch channel is closed when a subsequent write transaction

+// has updated the result of the query. Since each read transaction

+// operates on an isolated snapshot, a new read transaction must be

+// started to observe the changes that have been made.

+//

+// If the value of index ends with "_prefix", LastWatch will perform a prefix

+// match instead of full match on the index. The registered indexer must implement

+// PrefixIndexer, otherwise an error is returned.

 func (txn *Txn) LastWatch(table, index string, args ...interface{}) (<-chan struct{}, interface{}, error) {

 	// Get the index value

 	indexSchema, val, err := txn.getIndexValue(table, index, args...)

@@ -569,14 +598,20 @@ func (txn *Txn) LastWatch(table, index string, args ...interface{}) (<-chan stru

 }

 // First is used to return the first matching object for

-// the given constraints on the index

+// the given constraints on the index.

+//

+// Note that all values read in the transaction form a consistent snapshot

+// from the time when the transaction was created.

 func (txn *Txn) First(table, index string, args ...interface{}) (interface{}, error) {

 	_, val, err := txn.FirstWatch(table, index, args...)

 	return val, err

 }

 // Last is used to return the last matching object for

-// the given constraints on the index

+// the given constraints on the index.

+//

+// Note that all values read in the transaction form a consistent snapshot

+// from the time when the transaction was created.

 func (txn *Txn) Last(table, index string, args ...interface{}) (interface{}, error) {

 	_, val, err := txn.LastWatch(table, index, args...)

 	return val, err

@@ -589,6 +624,9 @@ func (txn *Txn) Last(table, index string, args ...interface{}) (interface{}, err

 // null and fail to find a leaf node). This should only be used where the prefix

 // given is capable of matching indexed entries directly, which typically only

 // applies to a custom indexer. See the unit test for an example.

+//

+// Note that all values read in the transaction form a consistent snapshot

+// from the time when the transaction was created.

 func (txn *Txn) LongestPrefix(table, index string, args ...interface{}) (interface{}, error) {

 	// Enforce that this only works on prefix indexes.

 	if !strings.HasSuffix(index, "_prefix") {

@@ -725,6 +763,7 @@ func (txn *Txn) Get(table, index string, args ...interface{}) (ResultIterator, e

 // The returned ResultIterator's Next() will return the next Previous value.

 //

 // See the documentation on Get for details on arguments.

+//

 // See the documentation for ResultIterator to understand the behaviour of the

 // returned ResultIterator.

 func (txn *Txn) GetReverse(table, index string, args ...interface{}) (ResultIterator, error) {

@@ -751,6 +790,10 @@ func (txn *Txn) GetReverse(table, index string, args ...interface{}) (ResultIter

 // iterator since the radix tree doesn't efficiently allow watching on lower

 // bound changes. The WatchCh returned will be nill and so will block forever.

 //

+// If the value of index ends with "_prefix", LowerBound will perform a prefix match instead of

+// a full match on the index. The registered index must implement PrefixIndexer,

+// otherwise an error is returned.

+//

 // See the documentation for ResultIterator to understand the behaviour of the

 // returned ResultIterator.

 func (txn *Txn) LowerBound(table, index string, args ...interface{}) (ResultIterator, error) {

@@ -1,3 +1,6 @@

+// Copyright (c) HashiCorp, Inc.

+// SPDX-License-Identifier: MPL-2.0

+

 package memdb

 import (

@@ -5,7 +8,8 @@ import (

 	"time"

 )

-// WatchSet is a collection of watch channels.

+// WatchSet is a collection of watch channels. The zero value is not usable.

+// Use NewWatchSet to create a WatchSet.

 type WatchSet map[<-chan struct{}]struct{}

 // NewWatchSet constructs a new watch set.

@@ -31,7 +35,7 @@ func (w WatchSet) Add(watchCh <-chan struct{}) {

 // not by much.

 //

 // This is useful if you want to track individual items up to some limit, after

-// which you watch a higher-level channel (usually a channel from start start of

+// which you watch a higher-level channel (usually a channel from start of

 // an iterator higher up in the radix tree) that will watch a superset of items.

 func (w WatchSet) AddWithLimit(softLimit int, watchCh <-chan struct{}, altCh <-chan struct{}) {

 	// This is safe for a nil WatchSet so we don't need to check that here.

@@ -42,8 +46,9 @@ func (w WatchSet) AddWithLimit(softLimit int, watchCh <-chan struct{}, altCh <-c

 	}

 }

-// Watch is used to wait for either the watch set to trigger or a timeout.

-// Returns true on timeout.

+// Watch blocks until one of the channels in the watch set is closed, or

+// timeoutCh sends a value.

+// Returns true if timeoutCh is what caused Watch to unblock.

 func (w WatchSet) Watch(timeoutCh <-chan time.Time) bool {

 	if w == nil {

 		return false

@@ -64,9 +69,11 @@ func (w WatchSet) Watch(timeoutCh <-chan time.Time) bool {

 	return w.WatchCtx(ctx) == context.Canceled

 }

-// WatchCtx is used to wait for either the watch set to trigger or for the

-// context to be cancelled. Watch with a timeout channel can be mimicked by

-// creating a context with a deadline. WatchCtx should be preferred over Watch.

+// WatchCtx blocks until one of the channels in the watch set is closed, or

+// ctx is done (cancelled or exceeds the deadline). WatchCtx returns an error

+// if the ctx causes it to unblock, otherwise returns nil.

+//

+// WatchCtx should be preferred over Watch.

 func (w WatchSet) WatchCtx(ctx context.Context) error {

 	if w == nil {

 		return nil

@@ -87,10 +94,14 @@ func (w WatchSet) WatchCtx(ctx context.Context) error {

 // watchMany is used if there are many watchers.

 func (w WatchSet) watchMany(ctx context.Context) error {

+	// Cancel all watcher goroutines when return.

+	watcherCtx, cancel := context.WithCancel(ctx)

+	defer cancel()

+

 	// Set up a goroutine for each watcher.

 	triggerCh := make(chan struct{}, 1)

 	watcher := func(chunk []<-chan struct{}) {

-		if err := watchFew(ctx, chunk); err == nil {

+		if err := watchFew(watcherCtx, chunk); err == nil {

 			select {

 			case triggerCh <- struct{}{}:

 			default:

@@ -128,7 +139,7 @@ func (w WatchSet) watchMany(ctx context.Context) error {

 	}

 }

-// WatchCh returns a channel that is used to wait for either the watch set to trigger

+// WatchCh returns a channel that is used to wait for any channel of the watch set to trigger

 // or for the context to be cancelled. WatchCh creates a new goroutine each call, so

 // callers may need to cache the returned channel to avoid creating extra goroutines.

 func (w WatchSet) WatchCh(ctx context.Context) <-chan error {

@@ -1,3 +1,6 @@

+// Copyright (c) HashiCorp, Inc.

+// SPDX-License-Identifier: MPL-2.0

+

 package memdb

 //go:generate sh -c "go run watch-gen/main.go >watch_few.go"

@@ -686,8 +686,8 @@ github.com/hashicorp/go-immutable-radix

 # github.com/hashicorp/go-immutable-radix/v2 v2.1.0

 ## explicit; go 1.18

 github.com/hashicorp/go-immutable-radix/v2

-# github.com/hashicorp/go-memdb v1.3.2

-## explicit; go 1.12

+# github.com/hashicorp/go-memdb v1.3.5

+## explicit; go 1.13

 github.com/hashicorp/go-memdb

 # github.com/hashicorp/go-msgpack v0.5.5

 ## explicit