From 4b5d9cb40f2ba344ec286e44f94e3ae1b5bc1e86 Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Wed, 30 Sep 2026 16:07:41 -0700
Subject: [PATCH 01/11] Import foundationdb-rs workspace under bindings/rust

Source: https://github.com/foundationdb-rs/foundationdb-rs, upstream main snapshot dated September 25, 2026. Preserve the upstream crates, tests, examples, history logs, and dual MIT/Apache-2.0 licenses. Omit repository-specific hosted automation and agent configuration.
---
 bindings/rust/.cargo/config.toml              |   14 +
 bindings/rust/.gitignore                      |   11 +
 bindings/rust/CONTRIBUTING.md                 |  185 ++
 bindings/rust/Cargo.lock                      | 1106 +++++++
 bindings/rust/Cargo.toml                      |   17 +
 bindings/rust/LICENSE-APACHE                  |  202 ++
 bindings/rust/LICENSE-MIT                     |   20 +
 bindings/rust/README.md                       |   48 +
 bindings/rust/assets/logo-400x400.png         |  Bin 0 -> 44113 bytes
 bindings/rust/flake.lock                      |   66 +
 bindings/rust/flake.nix                       |   67 +
 .../foundationdb-bindingtester/Cargo.toml     |   32 +
 .../rust/foundationdb-bindingtester/README.md |   14 +
 .../foundationdb-bindingtester/src/main.rs    | 2799 ++++++++++++++++
 bindings/rust/foundationdb-gen/CHANGELOG.md   |  162 +
 bindings/rust/foundationdb-gen/Cargo.toml     |   46 +
 bindings/rust/foundationdb-gen/README.md      |   19 +
 .../foundationdb-gen/include/510/fdb.options  |  251 ++
 .../foundationdb-gen/include/510/version.txt  |    1 +
 .../foundationdb-gen/include/520/fdb.options  |  267 ++
 .../foundationdb-gen/include/520/version.txt  |    1 +
 .../foundationdb-gen/include/600/fdb.options  |  270 ++
 .../foundationdb-gen/include/600/version.txt  |    1 +
 .../foundationdb-gen/include/610/fdb.options  |  295 ++
 .../foundationdb-gen/include/610/version.txt  |    1 +
 .../foundationdb-gen/include/620/fdb.options  |  333 ++
 .../foundationdb-gen/include/620/version.txt  |    1 +
 .../foundationdb-gen/include/630/fdb.options  |  354 ++
 .../foundationdb-gen/include/630/version.txt  |    1 +
 .../foundationdb-gen/include/700/fdb.options  |  371 +++
 .../foundationdb-gen/include/700/version.txt  |    1 +
 .../foundationdb-gen/include/710/fdb.options  |  382 +++
 .../foundationdb-gen/include/710/version.txt  |    1 +
 .../foundationdb-gen/include/730/fdb.options  |  432 +++
 .../foundationdb-gen/include/730/version.txt  |    1 +
 .../foundationdb-gen/include/740/fdb.options  |  439 +++
 .../foundationdb-gen/include/740/version.txt  |    1 +
 .../src/bin/foundationdb-options-gen.rs       |    7 +
 bindings/rust/foundationdb-gen/src/lib.rs     |  429 +++
 .../rust/foundationdb-macros/CHANGELOG.md     |   60 +
 bindings/rust/foundationdb-macros/Cargo.toml  |   28 +
 bindings/rust/foundationdb-macros/README.md   |    3 +
 bindings/rust/foundationdb-macros/src/lib.rs  |  245 ++
 .../rust/foundationdb-profiling/Cargo.toml    |   33 +
 .../rust/foundationdb-profiling/README.md     |   12 +
 .../examples/top_keys.rs                      |  120 +
 .../foundationdb-profiling/src/aggregate.rs   |  606 ++++
 .../rust/foundationdb-profiling/src/decode.rs |  943 ++++++
 .../rust/foundationdb-profiling/src/event.rs  |  258 ++
 .../rust/foundationdb-profiling/src/lib.rs    |  159 +
 .../rust/foundationdb-profiling/src/reader.rs | 1664 ++++++++++
 .../tests/decode_all.rs                       |  542 ++++
 .../tests/fixtures/commit_7_4.bin             |  Bin 0 -> 614 bytes
 .../tests/fixtures/commit_error_7_4.bin       |  Bin 0 -> 312 bytes
 .../foundationdb-profiling/tests/read_page.rs |  336 ++
 .../Cargo.toml                                |   22 +
 .../foundationdb-recipes-simulation/README.md |   94 +
 .../src/leader_election/mod.rs                |   13 +
 .../src/leader_election/types.rs              |   86 +
 .../src/leader_election/workload.rs           | 2835 +++++++++++++++++
 .../src/lib.rs                                |   13 +
 .../test_poll_leader_election.toml            |   42 +
 .../Cargo.toml                                |   39 +
 .../foundationdb-simulation-tracing/README.md |  104 +
 .../examples/tracing_demo/lib.rs              |  136 +
 .../tracing_demo/test_tracing_demo.toml       |    9 +
 .../src/lib.rs                                |  540 ++++
 .../rust/foundationdb-simulation/CHANGELOG.md |   88 +
 .../rust/foundationdb-simulation/Cargo.toml   |   57 +
 .../rust/foundationdb-simulation/README.md    |  326 ++
 .../rust/foundationdb-simulation/build.rs     |   81 +
 .../foundationdb-simulation/docs/fdb_rt.md    |  284 ++
 .../examples/atomic/Dockerfile                |   37 +
 .../examples/atomic/lib.rs                    |  309 ++
 .../examples/atomic/test_file_73.toml         |   36 +
 .../examples/atomic/test_file_74.toml         |   37 +
 .../examples/noop/lib.rs                      |  124 +
 .../examples/noop/test_file.toml              |   10 +
 .../examples/shared/lib.rs                    |   78 +
 .../examples/shared/test_file.toml            |    9 +
 .../src/CppWorkload.cpp                       |  227 ++
 .../foundationdb-simulation/src/bindings.rs   |  510 +++
 .../rust/foundationdb-simulation/src/env.rs   |  172 +
 .../foundationdb-simulation/src/fdb_rt.rs     |   85 +
 .../src/headers/CWorkload.h                   |  160 +
 .../src/headers/CppWorkload.h                 |  110 +
 .../rust/foundationdb-simulation/src/lib.rs   |  314 ++
 bindings/rust/foundationdb-sys/CHANGELOG.md   |  198 ++
 bindings/rust/foundationdb-sys/Cargo.toml     |   50 +
 bindings/rust/foundationdb-sys/README.md      |   19 +
 bindings/rust/foundationdb-sys/build.rs       |  142 +
 .../rust/foundationdb-sys/include/510/fdb_c.h |  316 ++
 .../include/510/fdb_c_options.g.h             |  341 ++
 .../foundationdb-sys/include/510/version.txt  |    1 +
 .../rust/foundationdb-sys/include/520/fdb_c.h |  316 ++
 .../include/520/fdb_c_options.g.h             |  344 ++
 .../foundationdb-sys/include/520/version.txt  |    1 +
 .../rust/foundationdb-sys/include/600/fdb_c.h |  316 ++
 .../include/600/fdb_c_options.g.h             |  344 ++
 .../foundationdb-sys/include/600/version.txt  |    1 +
 .../rust/foundationdb-sys/include/610/fdb_c.h |  336 ++
 .../include/610/fdb_c_options.g.h             |  377 +++
 .../foundationdb-sys/include/610/version.txt  |    1 +
 .../rust/foundationdb-sys/include/620/fdb_c.h |  350 ++
 .../include/620/fdb_c_options.g.h             |  421 +++
 .../foundationdb-sys/include/620/version.txt  |    1 +
 .../rust/foundationdb-sys/include/630/fdb_c.h |  374 +++
 .../include/630/fdb_c_options.g.h             |  457 +++
 .../foundationdb-sys/include/630/version.txt  |    1 +
 .../rust/foundationdb-sys/include/700/fdb_c.h |  434 +++
 .../include/700/fdb_c_options.g.h             |  485 +++
 .../foundationdb-sys/include/700/version.txt  |    1 +
 .../rust/foundationdb-sys/include/710/fdb_c.h |  576 ++++
 .../include/710/fdb_c_options.g.h             |  533 ++++
 .../include/710/fdb_c_types.h                 |   47 +
 .../foundationdb-sys/include/710/version.txt  |    1 +
 .../rust/foundationdb-sys/include/730/fdb_c.h |  813 +++++
 .../include/730/fdb_c_apiversion.g.h          |   41 +
 .../include/730/fdb_c_options.g.h             |  613 ++++
 .../foundationdb-sys/include/730/fdb_c_shim.h |   47 +
 .../include/730/fdb_c_types.h                 |   47 +
 .../foundationdb-sys/include/730/version.txt  |    1 +
 .../rust/foundationdb-sys/include/740/fdb_c.h |  805 +++++
 .../include/740/fdb_c_apiversion.g.h          |   41 +
 .../include/740/fdb_c_options.g.h             |  625 ++++
 .../include/740/fdb_c_types.h                 |   47 +
 .../foundationdb-sys/include/740/version.txt  |    1 +
 bindings/rust/foundationdb-sys/src/lib.rs     |  250 ++
 bindings/rust/foundationdb-tuple/CHANGELOG.md |   44 +
 bindings/rust/foundationdb-tuple/Cargo.toml   |   36 +
 bindings/rust/foundationdb-tuple/README.md    |    3 +
 .../rust/foundationdb-tuple/src/element.rs    |  230 ++
 bindings/rust/foundationdb-tuple/src/lib.rs   |  697 ++++
 bindings/rust/foundationdb-tuple/src/pack.rs  | 1106 +++++++
 .../rust/foundationdb-tuple/src/subspace.rs   |  320 ++
 .../foundationdb-tuple/src/versionstamp.rs    |   62 +
 bindings/rust/foundationdb/CHANGELOG.md       |  625 ++++
 bindings/rust/foundationdb/Cargo.toml         |   80 +
 bindings/rust/foundationdb/README.md          |  178 ++
 bindings/rust/foundationdb/build.rs           |   18 +
 bindings/rust/foundationdb/examples/README.md |    1 +
 .../examples/atomic-op-counter.rs             |   88 +
 .../examples/blob-with-manifest.rs            |  409 +++
 bindings/rust/foundationdb/examples/blob.rs   |  100 +
 .../foundationdb/examples/budgeted_scan.rs    |  260 ++
 .../foundationdb/examples/class-scheduling.rs |  408 +++
 .../examples/conflict_reporting.rs            |  200 ++
 .../rust/foundationdb/examples/hello-world.rs |   49 +
 .../foundationdb/examples/instrumented.rs     |  125 +
 .../foundationdb/examples/key_selectors.rs    |  432 +++
 .../rust/foundationdb/examples/micro-queue.rs |  190 ++
 .../foundationdb/examples/multi_version.rs    |  101 +
 .../foundationdb/examples/simple-index.rs     |  220 ++
 .../foundationdb/examples/versionstamp.rs     |  148 +
 bindings/rust/foundationdb/src/api.rs         |  507 +++
 bindings/rust/foundationdb/src/budget.rs      |  682 ++++
 bindings/rust/foundationdb/src/cluster.rs     |  105 +
 bindings/rust/foundationdb/src/database.rs    |  654 ++++
 .../src/directory/directory_layer.rs          |  800 +++++
 .../src/directory/directory_partition.rs      |  247 ++
 .../src/directory/directory_subspace.rs       |  242 ++
 .../rust/foundationdb/src/directory/error.rs  |  103 +
 .../rust/foundationdb/src/directory/mod.rs    |  389 +++
 .../rust/foundationdb/src/directory/node.rs   |   70 +
 bindings/rust/foundationdb/src/env.rs         |  373 +++
 bindings/rust/foundationdb/src/error.rs       |  337 ++
 bindings/rust/foundationdb/src/fdb_keys.rs    |  181 ++
 bindings/rust/foundationdb/src/future.rs      |  518 +++
 bindings/rust/foundationdb/src/keyselector.rs |  107 +
 bindings/rust/foundationdb/src/lib.rs         |  151 +
 .../foundationdb/src/mapped_key_values.rs     |  271 ++
 bindings/rust/foundationdb/src/metrics.rs     |  614 ++++
 bindings/rust/foundationdb/src/options.rs     |    1 +
 .../src/recipes/leader_election/algorithm.rs  |  427 +++
 .../src/recipes/leader_election/errors.rs     |  150 +
 .../src/recipes/leader_election/keys.rs       |   36 +
 .../src/recipes/leader_election/mod.rs        |  326 ++
 .../src/recipes/leader_election/types.rs      |  549 ++++
 bindings/rust/foundationdb/src/recipes/mod.rs |   38 +
 .../src/recipes/ranked_register/algorithm.rs  |  305 ++
 .../src/recipes/ranked_register/errors.rs     |   88 +
 .../src/recipes/ranked_register/keys.rs       |   53 +
 .../src/recipes/ranked_register/mod.rs        |  283 ++
 .../src/recipes/ranked_register/types.rs      |  158 +
 bindings/rust/foundationdb/src/runner.rs      |  856 +++++
 bindings/rust/foundationdb/src/timekeeper.rs  |  102 +
 bindings/rust/foundationdb/src/transaction.rs | 2045 ++++++++++++
 .../rust/foundationdb/src/tuple_ext/hca.rs    |  239 ++
 .../rust/foundationdb/src/tuple_ext/mod.rs    |    2 +
 .../foundationdb/src/tuple_ext/subspace.rs    |   22 +
 bindings/rust/foundationdb/tests/api.rs       |   46 +
 bindings/rust/foundationdb/tests/api_ub.rs    |   22 +
 bindings/rust/foundationdb/tests/atomic.rs    |   61 +
 bindings/rust/foundationdb/tests/budget.rs    |  507 +++
 .../rust/foundationdb/tests/common/mod.rs     |   20 +
 .../foundationdb/tests/conflict_ranges.rs     |  218 ++
 bindings/rust/foundationdb/tests/database.rs  |   36 +
 bindings/rust/foundationdb/tests/directory.rs |   81 +
 bindings/rust/foundationdb/tests/error.rs     |  127 +
 bindings/rust/foundationdb/tests/future.rs    |   58 +
 bindings/rust/foundationdb/tests/get.rs       |  380 +++
 bindings/rust/foundationdb/tests/hca.rs       |   95 +
 .../tests/leader_election_ranked_register.rs  | 1264 ++++++++
 bindings/rust/foundationdb/tests/metrics.rs   |  603 ++++
 bindings/rust/foundationdb/tests/range.rs     |  500 +++
 .../foundationdb/tests/ranked_register.rs     |  507 +++
 bindings/rust/foundationdb/tests/run_retry.rs |  280 ++
 .../rust/foundationdb/tests/runner_hooks.rs   |  640 ++++
 .../rust/foundationdb/tests/timekeeper.rs     |   57 +
 bindings/rust/foundationdb/tests/tokio.rs     |  206 ++
 bindings/rust/foundationdb/tests/trace.rs     |   91 +
 bindings/rust/foundationdb/tests/tuple.rs     |  363 +++
 bindings/rust/foundationdb/tests/watch.rs     |   50 +
 bindings/rust/rust-toolchain.toml             |   11 +
 bindings/rust/scripts/run_bindingtester.sh    |   40 +
 .../scripts/run_leader_election_simulation.sh |   61 +
 bindings/rust/scripts/setup_bindingtester.sh  |   35 +
 .../rust/scripts/simulation_entrypoint.sh     |   23 +
 218 files changed, 55302 insertions(+)
 create mode 100644 bindings/rust/.cargo/config.toml
 create mode 100644 bindings/rust/.gitignore
 create mode 100644 bindings/rust/CONTRIBUTING.md
 create mode 100644 bindings/rust/Cargo.lock
 create mode 100644 bindings/rust/Cargo.toml
 create mode 100644 bindings/rust/LICENSE-APACHE
 create mode 100644 bindings/rust/LICENSE-MIT
 create mode 100644 bindings/rust/README.md
 create mode 100644 bindings/rust/assets/logo-400x400.png
 create mode 100644 bindings/rust/flake.lock
 create mode 100644 bindings/rust/flake.nix
 create mode 100644 bindings/rust/foundationdb-bindingtester/Cargo.toml
 create mode 100644 bindings/rust/foundationdb-bindingtester/README.md
 create mode 100644 bindings/rust/foundationdb-bindingtester/src/main.rs
 create mode 100644 bindings/rust/foundationdb-gen/CHANGELOG.md
 create mode 100644 bindings/rust/foundationdb-gen/Cargo.toml
 create mode 100644 bindings/rust/foundationdb-gen/README.md
 create mode 100644 bindings/rust/foundationdb-gen/include/510/fdb.options
 create mode 100644 bindings/rust/foundationdb-gen/include/510/version.txt
 create mode 100644 bindings/rust/foundationdb-gen/include/520/fdb.options
 create mode 100644 bindings/rust/foundationdb-gen/include/520/version.txt
 create mode 100644 bindings/rust/foundationdb-gen/include/600/fdb.options
 create mode 100644 bindings/rust/foundationdb-gen/include/600/version.txt
 create mode 100644 bindings/rust/foundationdb-gen/include/610/fdb.options
 create mode 100644 bindings/rust/foundationdb-gen/include/610/version.txt
 create mode 100644 bindings/rust/foundationdb-gen/include/620/fdb.options
 create mode 100644 bindings/rust/foundationdb-gen/include/620/version.txt
 create mode 100644 bindings/rust/foundationdb-gen/include/630/fdb.options
 create mode 100644 bindings/rust/foundationdb-gen/include/630/version.txt
 create mode 100644 bindings/rust/foundationdb-gen/include/700/fdb.options
 create mode 100644 bindings/rust/foundationdb-gen/include/700/version.txt
 create mode 100644 bindings/rust/foundationdb-gen/include/710/fdb.options
 create mode 100644 bindings/rust/foundationdb-gen/include/710/version.txt
 create mode 100644 bindings/rust/foundationdb-gen/include/730/fdb.options
 create mode 100644 bindings/rust/foundationdb-gen/include/730/version.txt
 create mode 100644 bindings/rust/foundationdb-gen/include/740/fdb.options
 create mode 100644 bindings/rust/foundationdb-gen/include/740/version.txt
 create mode 100644 bindings/rust/foundationdb-gen/src/bin/foundationdb-options-gen.rs
 create mode 100644 bindings/rust/foundationdb-gen/src/lib.rs
 create mode 100644 bindings/rust/foundationdb-macros/CHANGELOG.md
 create mode 100644 bindings/rust/foundationdb-macros/Cargo.toml
 create mode 100644 bindings/rust/foundationdb-macros/README.md
 create mode 100644 bindings/rust/foundationdb-macros/src/lib.rs
 create mode 100644 bindings/rust/foundationdb-profiling/Cargo.toml
 create mode 100644 bindings/rust/foundationdb-profiling/README.md
 create mode 100644 bindings/rust/foundationdb-profiling/examples/top_keys.rs
 create mode 100644 bindings/rust/foundationdb-profiling/src/aggregate.rs
 create mode 100644 bindings/rust/foundationdb-profiling/src/decode.rs
 create mode 100644 bindings/rust/foundationdb-profiling/src/event.rs
 create mode 100644 bindings/rust/foundationdb-profiling/src/lib.rs
 create mode 100644 bindings/rust/foundationdb-profiling/src/reader.rs
 create mode 100644 bindings/rust/foundationdb-profiling/tests/decode_all.rs
 create mode 100644 bindings/rust/foundationdb-profiling/tests/fixtures/commit_7_4.bin
 create mode 100644 bindings/rust/foundationdb-profiling/tests/fixtures/commit_error_7_4.bin
 create mode 100644 bindings/rust/foundationdb-profiling/tests/read_page.rs
 create mode 100644 bindings/rust/foundationdb-recipes-simulation/Cargo.toml
 create mode 100644 bindings/rust/foundationdb-recipes-simulation/README.md
 create mode 100644 bindings/rust/foundationdb-recipes-simulation/src/leader_election/mod.rs
 create mode 100644 bindings/rust/foundationdb-recipes-simulation/src/leader_election/types.rs
 create mode 100644 bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs
 create mode 100644 bindings/rust/foundationdb-recipes-simulation/src/lib.rs
 create mode 100644 bindings/rust/foundationdb-recipes-simulation/test_poll_leader_election.toml
 create mode 100644 bindings/rust/foundationdb-simulation-tracing/Cargo.toml
 create mode 100644 bindings/rust/foundationdb-simulation-tracing/README.md
 create mode 100644 bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs
 create mode 100644 bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/test_tracing_demo.toml
 create mode 100644 bindings/rust/foundationdb-simulation-tracing/src/lib.rs
 create mode 100644 bindings/rust/foundationdb-simulation/CHANGELOG.md
 create mode 100644 bindings/rust/foundationdb-simulation/Cargo.toml
 create mode 100644 bindings/rust/foundationdb-simulation/README.md
 create mode 100644 bindings/rust/foundationdb-simulation/build.rs
 create mode 100644 bindings/rust/foundationdb-simulation/docs/fdb_rt.md
 create mode 100644 bindings/rust/foundationdb-simulation/examples/atomic/Dockerfile
 create mode 100644 bindings/rust/foundationdb-simulation/examples/atomic/lib.rs
 create mode 100644 bindings/rust/foundationdb-simulation/examples/atomic/test_file_73.toml
 create mode 100644 bindings/rust/foundationdb-simulation/examples/atomic/test_file_74.toml
 create mode 100644 bindings/rust/foundationdb-simulation/examples/noop/lib.rs
 create mode 100644 bindings/rust/foundationdb-simulation/examples/noop/test_file.toml
 create mode 100644 bindings/rust/foundationdb-simulation/examples/shared/lib.rs
 create mode 100644 bindings/rust/foundationdb-simulation/examples/shared/test_file.toml
 create mode 100644 bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
 create mode 100644 bindings/rust/foundationdb-simulation/src/bindings.rs
 create mode 100644 bindings/rust/foundationdb-simulation/src/env.rs
 create mode 100644 bindings/rust/foundationdb-simulation/src/fdb_rt.rs
 create mode 100644 bindings/rust/foundationdb-simulation/src/headers/CWorkload.h
 create mode 100644 bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h
 create mode 100644 bindings/rust/foundationdb-simulation/src/lib.rs
 create mode 100644 bindings/rust/foundationdb-sys/CHANGELOG.md
 create mode 100644 bindings/rust/foundationdb-sys/Cargo.toml
 create mode 100644 bindings/rust/foundationdb-sys/README.md
 create mode 100644 bindings/rust/foundationdb-sys/build.rs
 create mode 100644 bindings/rust/foundationdb-sys/include/510/fdb_c.h
 create mode 100644 bindings/rust/foundationdb-sys/include/510/fdb_c_options.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/510/version.txt
 create mode 100644 bindings/rust/foundationdb-sys/include/520/fdb_c.h
 create mode 100644 bindings/rust/foundationdb-sys/include/520/fdb_c_options.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/520/version.txt
 create mode 100644 bindings/rust/foundationdb-sys/include/600/fdb_c.h
 create mode 100644 bindings/rust/foundationdb-sys/include/600/fdb_c_options.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/600/version.txt
 create mode 100644 bindings/rust/foundationdb-sys/include/610/fdb_c.h
 create mode 100644 bindings/rust/foundationdb-sys/include/610/fdb_c_options.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/610/version.txt
 create mode 100644 bindings/rust/foundationdb-sys/include/620/fdb_c.h
 create mode 100644 bindings/rust/foundationdb-sys/include/620/fdb_c_options.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/620/version.txt
 create mode 100644 bindings/rust/foundationdb-sys/include/630/fdb_c.h
 create mode 100644 bindings/rust/foundationdb-sys/include/630/fdb_c_options.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/630/version.txt
 create mode 100644 bindings/rust/foundationdb-sys/include/700/fdb_c.h
 create mode 100644 bindings/rust/foundationdb-sys/include/700/fdb_c_options.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/700/version.txt
 create mode 100644 bindings/rust/foundationdb-sys/include/710/fdb_c.h
 create mode 100644 bindings/rust/foundationdb-sys/include/710/fdb_c_options.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/710/fdb_c_types.h
 create mode 100644 bindings/rust/foundationdb-sys/include/710/version.txt
 create mode 100644 bindings/rust/foundationdb-sys/include/730/fdb_c.h
 create mode 100644 bindings/rust/foundationdb-sys/include/730/fdb_c_apiversion.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/730/fdb_c_options.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/730/fdb_c_shim.h
 create mode 100644 bindings/rust/foundationdb-sys/include/730/fdb_c_types.h
 create mode 100644 bindings/rust/foundationdb-sys/include/730/version.txt
 create mode 100644 bindings/rust/foundationdb-sys/include/740/fdb_c.h
 create mode 100644 bindings/rust/foundationdb-sys/include/740/fdb_c_apiversion.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/740/fdb_c_options.g.h
 create mode 100644 bindings/rust/foundationdb-sys/include/740/fdb_c_types.h
 create mode 100644 bindings/rust/foundationdb-sys/include/740/version.txt
 create mode 100644 bindings/rust/foundationdb-sys/src/lib.rs
 create mode 100644 bindings/rust/foundationdb-tuple/CHANGELOG.md
 create mode 100644 bindings/rust/foundationdb-tuple/Cargo.toml
 create mode 100644 bindings/rust/foundationdb-tuple/README.md
 create mode 100644 bindings/rust/foundationdb-tuple/src/element.rs
 create mode 100644 bindings/rust/foundationdb-tuple/src/lib.rs
 create mode 100644 bindings/rust/foundationdb-tuple/src/pack.rs
 create mode 100644 bindings/rust/foundationdb-tuple/src/subspace.rs
 create mode 100644 bindings/rust/foundationdb-tuple/src/versionstamp.rs
 create mode 100644 bindings/rust/foundationdb/CHANGELOG.md
 create mode 100644 bindings/rust/foundationdb/Cargo.toml
 create mode 100644 bindings/rust/foundationdb/README.md
 create mode 100644 bindings/rust/foundationdb/build.rs
 create mode 100644 bindings/rust/foundationdb/examples/README.md
 create mode 100644 bindings/rust/foundationdb/examples/atomic-op-counter.rs
 create mode 100644 bindings/rust/foundationdb/examples/blob-with-manifest.rs
 create mode 100644 bindings/rust/foundationdb/examples/blob.rs
 create mode 100644 bindings/rust/foundationdb/examples/budgeted_scan.rs
 create mode 100644 bindings/rust/foundationdb/examples/class-scheduling.rs
 create mode 100644 bindings/rust/foundationdb/examples/conflict_reporting.rs
 create mode 100644 bindings/rust/foundationdb/examples/hello-world.rs
 create mode 100644 bindings/rust/foundationdb/examples/instrumented.rs
 create mode 100644 bindings/rust/foundationdb/examples/key_selectors.rs
 create mode 100644 bindings/rust/foundationdb/examples/micro-queue.rs
 create mode 100644 bindings/rust/foundationdb/examples/multi_version.rs
 create mode 100644 bindings/rust/foundationdb/examples/simple-index.rs
 create mode 100644 bindings/rust/foundationdb/examples/versionstamp.rs
 create mode 100644 bindings/rust/foundationdb/src/api.rs
 create mode 100644 bindings/rust/foundationdb/src/budget.rs
 create mode 100644 bindings/rust/foundationdb/src/cluster.rs
 create mode 100644 bindings/rust/foundationdb/src/database.rs
 create mode 100644 bindings/rust/foundationdb/src/directory/directory_layer.rs
 create mode 100644 bindings/rust/foundationdb/src/directory/directory_partition.rs
 create mode 100644 bindings/rust/foundationdb/src/directory/directory_subspace.rs
 create mode 100644 bindings/rust/foundationdb/src/directory/error.rs
 create mode 100644 bindings/rust/foundationdb/src/directory/mod.rs
 create mode 100644 bindings/rust/foundationdb/src/directory/node.rs
 create mode 100644 bindings/rust/foundationdb/src/env.rs
 create mode 100644 bindings/rust/foundationdb/src/error.rs
 create mode 100644 bindings/rust/foundationdb/src/fdb_keys.rs
 create mode 100644 bindings/rust/foundationdb/src/future.rs
 create mode 100644 bindings/rust/foundationdb/src/keyselector.rs
 create mode 100644 bindings/rust/foundationdb/src/lib.rs
 create mode 100644 bindings/rust/foundationdb/src/mapped_key_values.rs
 create mode 100644 bindings/rust/foundationdb/src/metrics.rs
 create mode 100644 bindings/rust/foundationdb/src/options.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/leader_election/algorithm.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/leader_election/errors.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/leader_election/keys.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/leader_election/mod.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/leader_election/types.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/mod.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/ranked_register/algorithm.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/ranked_register/errors.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/ranked_register/keys.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/ranked_register/mod.rs
 create mode 100644 bindings/rust/foundationdb/src/recipes/ranked_register/types.rs
 create mode 100644 bindings/rust/foundationdb/src/runner.rs
 create mode 100644 bindings/rust/foundationdb/src/timekeeper.rs
 create mode 100644 bindings/rust/foundationdb/src/transaction.rs
 create mode 100644 bindings/rust/foundationdb/src/tuple_ext/hca.rs
 create mode 100644 bindings/rust/foundationdb/src/tuple_ext/mod.rs
 create mode 100644 bindings/rust/foundationdb/src/tuple_ext/subspace.rs
 create mode 100644 bindings/rust/foundationdb/tests/api.rs
 create mode 100644 bindings/rust/foundationdb/tests/api_ub.rs
 create mode 100644 bindings/rust/foundationdb/tests/atomic.rs
 create mode 100644 bindings/rust/foundationdb/tests/budget.rs
 create mode 100644 bindings/rust/foundationdb/tests/common/mod.rs
 create mode 100644 bindings/rust/foundationdb/tests/conflict_ranges.rs
 create mode 100644 bindings/rust/foundationdb/tests/database.rs
 create mode 100644 bindings/rust/foundationdb/tests/directory.rs
 create mode 100644 bindings/rust/foundationdb/tests/error.rs
 create mode 100644 bindings/rust/foundationdb/tests/future.rs
 create mode 100644 bindings/rust/foundationdb/tests/get.rs
 create mode 100644 bindings/rust/foundationdb/tests/hca.rs
 create mode 100644 bindings/rust/foundationdb/tests/leader_election_ranked_register.rs
 create mode 100644 bindings/rust/foundationdb/tests/metrics.rs
 create mode 100644 bindings/rust/foundationdb/tests/range.rs
 create mode 100644 bindings/rust/foundationdb/tests/ranked_register.rs
 create mode 100644 bindings/rust/foundationdb/tests/run_retry.rs
 create mode 100644 bindings/rust/foundationdb/tests/runner_hooks.rs
 create mode 100644 bindings/rust/foundationdb/tests/timekeeper.rs
 create mode 100644 bindings/rust/foundationdb/tests/tokio.rs
 create mode 100644 bindings/rust/foundationdb/tests/trace.rs
 create mode 100644 bindings/rust/foundationdb/tests/tuple.rs
 create mode 100644 bindings/rust/foundationdb/tests/watch.rs
 create mode 100644 bindings/rust/rust-toolchain.toml
 create mode 100755 bindings/rust/scripts/run_bindingtester.sh
 create mode 100755 bindings/rust/scripts/run_leader_election_simulation.sh
 create mode 100755 bindings/rust/scripts/setup_bindingtester.sh
 create mode 100755 bindings/rust/scripts/simulation_entrypoint.sh

diff --git a/bindings/rust/.cargo/config.toml b/bindings/rust/.cargo/config.toml
new file mode 100644
index 00000000000..17885922741
--- /dev/null
+++ b/bindings/rust/.cargo/config.toml
@@ -0,0 +1,14 @@
+[alias]
+# Common development aliases for contributors
+
+# Build/test/check with latest FDB version (7.4) using embedded headers
+# These work with Nix or when FDB headers are available
+build-fdb-latest = "build -p foundationdb --features embedded-fdb-include,fdb-7_4"
+test-fdb-latest = "test -p foundationdb --features embedded-fdb-include,fdb-7_4"
+check-fdb-latest = "check -p foundationdb --features embedded-fdb-include,fdb-7_4"
+clippy-fdb-latest = "clippy -p foundationdb --features embedded-fdb-include,fdb-7_4"
+doc-fdb-latest = "doc -p foundationdb --features embedded-fdb-include,fdb-7_4"
+
+# Lint the whole workspace (all targets and features) and deny warnings.
+# Used by CI; run it before pushing.
+clippy-all = "clippy --all-targets --no-default-features --features num-bigint,embedded-fdb-include,fdb-7_4,trace -- -D warnings"
diff --git a/bindings/rust/.gitignore b/bindings/rust/.gitignore
new file mode 100644
index 00000000000..400d85a06dc
--- /dev/null
+++ b/bindings/rust/.gitignore
@@ -0,0 +1,11 @@
+/target
+**/*.rs.bk
+*.swp
+
+.vscode
+.direnv
+.idea
+
+# Files generated by the simulation
+simfdb
+trace.*.json
\ No newline at end of file
diff --git a/bindings/rust/CONTRIBUTING.md b/bindings/rust/CONTRIBUTING.md
new file mode 100644
index 00000000000..b81b8dd1a92
--- /dev/null
+++ b/bindings/rust/CONTRIBUTING.md
@@ -0,0 +1,185 @@
+# Contributing to FoundationDB Rust
+
+Thank you for your interest in contributing to the FoundationDB Rust client! This guide will help you get started.
+
+## Getting Started
+
+### Prerequisites
+
+You'll need:
+- Rust 1.85.1 or later
+- FoundationDB client libraries (for runtime, not required for compilation with our setup)
+
+### Quick Development Setup
+
+We provide cargo aliases that use embedded headers, so you can compile without having FoundationDB installed:
+
+```shell
+# Build/test/check with latest FDB version (7.4)
+cargo build-fdb-latest
+cargo test-fdb-latest
+cargo check-fdb-latest
+cargo clippy-fdb-latest
+```
+
+These commands will build the `foundationdb` crate with embedded headers for FDB 7.4.
+
+### Running a Local FoundationDB Cluster
+
+The easiest way to run a local FDB cluster for testing:
+
+```shell
+# Start a single-node cluster in Docker
+docker run -p 4500:4500 --name fdb -it --rm -d foundationdb/foundationdb:7.4.3
+docker exec fdb fdbcli --exec "configure new single memory"
+```
+
+## Development with Nix
+
+If you use Nix, we provide a `flake.nix` for a complete development environment:
+
+```shell
+# Enter the development shell
+nix develop
+
+# The shell includes all necessary dependencies and tools
+```
+
+For NixOS users, add this to your `configuration.nix` for the FDB cluster file:
+
+```nix
+{
+  environment.etc."foundationdb/fdb.cluster" = {
+    mode = "0555";
+    text = ''
+      docker:docker@127.0.0.1:4500
+    '';
+  };
+}
+```
+
+## Project Structure
+
+- `foundationdb/` - High-level Rust client API
+- `foundationdb-sys/` - Low-level C API bindings
+- `foundationdb-gen/` - Code generator for FDB options and types
+- `foundationdb-tuple/` - Tuple layer implementation
+- `foundationdb-macros/` - Procedural macros
+- `foundationdb-bindingtester/` - Official binding tester implementation
+- `foundationdb-simulation/` - Simulation testing framework
+
+## Testing
+
+### Unit Tests
+
+Run tests for the main crate:
+```shell
+cargo test-fdb-latest
+```
+
+### Binding Tester
+
+We use the official FoundationDB binding tester to ensure correctness:
+
+```shell
+# Build the binding tester
+cargo build -p bindingtester
+
+# Setup the binding tester environment (downloads FDB source and configures Python bindings)
+./scripts/setup_bindingtester.sh target/debug/bindingtester
+
+# Run the binding tester suite (requires FDB cluster running)
+./scripts/run_bindingtester.sh
+
+# Run with more iterations (e.g., 100 iterations)
+./scripts/run_bindingtester.sh 100
+```
+
+The binding tester runs automatically in CI when a PR has the `correctness` label.
+
+### Leader-election simulation campaigns
+
+The leader-election simulator runs a smoke campaign of 1 worker x 10 seeds on
+ordinary pull requests and pushes to `main`. Changes to the leader-election or
+RankedRegister recipes, simulation code, the simulation runner, or this
+workflow automatically run an extended campaign of 4 workers x 50 seeds.
+
+The full campaign runs nightly at 02:00 UTC, when manually dispatched, and on
+pull requests carrying the `leader-election-correctness` label. It uses 4
+workers x 200 seeds. Apply that label when a change needs the full
+correctness campaign before the nightly run.
+
+## Code Style
+
+- Run `cargo fmt` before committing
+- Run `cargo clippy-fdb-latest` to check for common issues
+- Follow Rust naming conventions and idioms
+
+## Submitting Changes
+
+1. Fork the repository
+2. Create a feature branch (`git checkout -b feature/amazing-feature`)
+3. Make your changes
+4. Ensure tests pass (`cargo test-fdb-latest`)
+5. Run clippy (`cargo clippy-fdb-latest`)
+6. Format your code (`cargo fmt`)
+7. Commit your changes with a semantic commit message (see below)
+8. Push to your fork
+9. Open a Pull Request
+
+### Commit Message Convention
+
+We follow [Conventional Commits](https://www.conventionalcommits.org/) to generate clean changelogs:
+
+```
+<type>(<scope>): <subject>
+
+<body>
+
+<footer>
+```
+
+**Types:**
+- `feat`: New feature
+- `fix`: Bug fix
+- `docs`: Documentation changes
+- `style`: Code style changes (formatting, missing semicolons, etc.)
+- `refactor`: Code changes that neither fix bugs nor add features
+- `perf`: Performance improvements
+- `test`: Adding or updating tests
+- `build`: Changes to build system or dependencies
+- `ci`: CI/CD configuration changes
+- `chore`: Other changes that don't modify src or test files
+
+**Examples:**
+```
+feat(tuple): add support for nested tuples
+
+fix(transaction): handle network errors in retry loop
+
+docs: update binding tester instructions
+
+chore(deps): bump foundationdb-sys to 0.9.2
+```
+
+### Pull Request Guidelines
+
+- Provide a clear description of the changes
+- Include tests for new functionality
+- Update documentation as needed
+- Ensure CI passes
+- For significant changes, consider opening an issue first to discuss
+
+## Correctness
+
+This project prioritizes correctness. We run extensive binding tests to ensure compatibility with the official FoundationDB bindings. The binding tester runs thousands of test seeds regularly in CI.
+
+## Getting Help
+
+- Join our [Discord server](https://discord.gg/zkgtbtFfWY)
+- Open an issue on [GitHub](https://github.com/foundationdb-rs/foundationdb-rs/issues)
+- Check existing issues and pull requests
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the same dual license as the project (MIT/Apache-2.0).
diff --git a/bindings/rust/Cargo.lock b/bindings/rust/Cargo.lock
new file mode 100644
index 00000000000..f47ce5f71b7
--- /dev/null
+++ b/bindings/rust/Cargo.lock
@@ -0,0 +1,1106 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "bindgen"
+version = "0.73.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "787ef8ef523575546b106a58213d6e6b06198a05c2f757258c68a74273670cfa"
+dependencies = [
+ "bitflags",
+ "cexpr",
+ "clang-sys",
+ "log",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "bindingtester"
+version = "0.9.0"
+dependencies = [
+ "async-trait",
+ "env_logger",
+ "foundationdb",
+ "foundationdb-sys",
+ "futures",
+ "log",
+ "num-bigint",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "bytesize"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7354288c522e7e980fafd2075d63d1285794c3a6a16cdd492f189ea406e5f18b"
+
+[[package]]
+name = "cc"
+version = "1.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "005ec2760ca554fae18df7a11195552ec576cd665632a881bc011d5bb2fd4d80"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "rand_core",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "157a8ba7b480713b56f4c09fd13fc3e0a22a5dfab8097ba61cbc5feef950788a"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+]
+
+[[package]]
+name = "env_filter"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "900d271a03799a1ee8d1ca9b19893b48ca674a9284fefcfb85f05e74ed314217"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de671bd27a75a797dc9ae289ba1e77276e75e2026408aab65185384e2d5cd3f6"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "log",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
+
+[[package]]
+name = "foundationdb"
+version = "0.11.0"
+dependencies = [
+ "async-recursion",
+ "async-trait",
+ "byteorder",
+ "bytesize",
+ "data-encoding",
+ "foundationdb-gen",
+ "foundationdb-macros",
+ "foundationdb-sys",
+ "foundationdb-tuple",
+ "futures",
+ "futures-util",
+ "lazy_static",
+ "libc",
+ "num-bigint",
+ "rand",
+ "sha2",
+ "static_assertions",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+ "uuid",
+]
+
+[[package]]
+name = "foundationdb-gen"
+version = "0.11.0"
+dependencies = [
+ "xml-rs",
+]
+
+[[package]]
+name = "foundationdb-macros"
+version = "0.4.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+ "try_map",
+]
+
+[[package]]
+name = "foundationdb-profiling"
+version = "0.1.0"
+dependencies = [
+ "foundationdb",
+ "futures-core",
+ "futures-util",
+ "thiserror",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "foundationdb-recipes-simulation"
+version = "0.1.0"
+dependencies = [
+ "foundationdb",
+ "foundationdb-simulation",
+ "futures",
+]
+
+[[package]]
+name = "foundationdb-simulation"
+version = "0.3.0"
+dependencies = [
+ "bindgen",
+ "cc",
+ "foundationdb",
+ "foundationdb-sys",
+ "futures-util",
+]
+
+[[package]]
+name = "foundationdb-simulation-tracing"
+version = "0.1.0"
+dependencies = [
+ "foundationdb",
+ "foundationdb-simulation",
+ "tracing",
+ "tracing-core",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "foundationdb-sys"
+version = "0.11.0"
+dependencies = [
+ "bindgen",
+ "libc",
+]
+
+[[package]]
+name = "foundationdb-tuple"
+version = "0.11.0"
+dependencies = [
+ "memchr",
+ "num-bigint",
+ "uuid",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "rand_core",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "js-sys"
+version = "0.3.105"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "mio"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "prettyplease"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0"
+dependencies = [
+ "proc-macro2",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "nu-ansi-term",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try_map"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb1626d07cb5c1bb2cf17d94c0be4852e8a7c02b041acec9a8c5bdda99f9d580"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
+dependencies = [
+ "getrandom",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "xml"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f45bb2c13fec6a6cb4c0f76a7e94839e110a14ec803ec2940777a94c347bc52"
+
+[[package]]
+name = "xml-rs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3a56132a0d6ecbe77352edc10232f788fc4ceefefff4cab784a98e0e16b6b51"
+dependencies = [
+ "xml",
+]
diff --git a/bindings/rust/Cargo.toml b/bindings/rust/Cargo.toml
new file mode 100644
index 00000000000..da26b3a126e
--- /dev/null
+++ b/bindings/rust/Cargo.toml
@@ -0,0 +1,17 @@
+[workspace]
+resolver = "2"
+members = [
+    "foundationdb",
+    "foundationdb-tuple",
+    "foundationdb-sys",
+    "foundationdb-gen",
+    "foundationdb-bindingtester",
+    "foundationdb-macros",
+    "foundationdb-profiling",
+    "foundationdb-simulation",
+    "foundationdb-simulation-tracing",
+    "foundationdb-recipes-simulation",
+]
+
+[profile.release]
+debug = true
diff --git a/bindings/rust/LICENSE-APACHE b/bindings/rust/LICENSE-APACHE
new file mode 100644
index 00000000000..8f71f43fee3
--- /dev/null
+++ b/bindings/rust/LICENSE-APACHE
@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
diff --git a/bindings/rust/LICENSE-MIT b/bindings/rust/LICENSE-MIT
new file mode 100644
index 00000000000..b497b098ee8
--- /dev/null
+++ b/bindings/rust/LICENSE-MIT
@@ -0,0 +1,20 @@
+Copyright (c) 2015 The trust-dns Developers
+Copyright (c) 2017 Google LLC.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/bindings/rust/README.md b/bindings/rust/README.md
new file mode 100644
index 00000000000..dd069decd10
--- /dev/null
+++ b/bindings/rust/README.md
@@ -0,0 +1,48 @@
+[![Discord](https://img.shields.io/discord/925467557903884349)](https://discord.gg/zkgtbtFfWY)
+[![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/foundationdb-rs/foundationdb-rs/ci.yml?branch=main)](https://github.com/foundationdb-rs/foundationdb-rs/actions)
+[![dependency status](https://deps.rs/repo/github/foundationdb-rs/foundationdb-rs/status.svg)](https://deps.rs/repo/github/foundationdb-rs/foundationdb-rs)
+[![Codecov](https://img.shields.io/codecov/c/github/foundationdb-rs/foundationdb-rs)](https://codecov.io/gh/foundationdb-rs/foundationdb-rs)
+![Rustc 1.85.1+](https://img.shields.io/badge/rustc-1.85.1+-lightgrey)
+
+# FoundationDB Rust Client
+
+The repo consists of multiple crates:
+
+| Library                                            | Status                                                                                                                                                                                                          | Description                                                 |
+|----------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------|
+| [**foundationdb**](foundationdb/README.md)         | [![Crates.io](https://img.shields.io/crates/v/foundationdb)](https://crates.io/crates/foundationdb) [![foundationdb](https://docs.rs/foundationdb/badge.svg)](https://docs.rs/foundationdb)                     | High level FoundationDB client API                          |
+| [**foundationdb-sys**](foundationdb-sys/README.md) | [![Crates.io](https://img.shields.io/crates/v/foundationdb-sys)](https://crates.io/crates/foundationdb-sys) [![foundationdb-sys](https://docs.rs/foundationdb-sys/badge.svg)](https://docs.rs/foundationdb-sys) | C API bindings for FoundationDB                             |
+| **foundationdb-gen**                               | n/a                                                                                                                                                                                                             | Code generator for common options and types of FoundationDB |
+
+The current version requires rustc 1.85.1+ to work.
+The previous version (0.3) is still maintained and is available within the 0.3 branch.
+
+You can access the `main` branch documentation [here](https://foundationdb-rs.github.io/foundationdb-rs/foundationdb/index.html).
+
+## Supported platforms
+
+Supported platforms are listed on the [foundationdb's README](foundationdb/README.md).
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and guidelines.
+
+## Correctness
+
+Special care has been set up to be sure that the crate is correct, like official bindings. Every hour, we are running thousands of seeds on the [BindingTester](https://github.com/apple/foundationdb/blob/master/bindings/bindingtester/spec/bindingApiTester.md).
+
+## License
+
+Licensed under either of
+
+- Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
+- MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the Apache-2.0
+license, shall be dual licensed as above, without any additional terms or
+conditions.
diff --git a/bindings/rust/assets/logo-400x400.png b/bindings/rust/assets/logo-400x400.png
new file mode 100644
index 0000000000000000000000000000000000000000..2d3f03b632df870710302c9e41d3ae7474d339a3
GIT binary patch
literal 44113
zcmeEtRa6{N(`_IS+$FfXySo!CxVyW%yE_DTf;+(n2p)8h0E08g0D<5HCwKCF|9!kK
z_xWF|r`Jq(ukJqQRPEZet0w-lsyrGp5%Rlt@6Z$#WHjErgGu}MLHqzc5;n*;^X?tR
zJ4G2uEx*FE{>MP0RsW;4zY9q?iZrs=l?u+CUw_1Jq;IJfdTojVm8<BtxR>%&eHXb!
zGf#@E=`$6mV16b9gH@H<bmTj&)!{ySJHm9w3(I1U4&WkpZ2m3;zPOz?_QHo@8)wao
zT}%K^sU%C`ezF!`1mA~7P#{K7d>az?pWg|Ce!aA#f~ER*BpNXe`g0ziiUN9tlwn*L
z^dO=$<^P`i-%0piOZfkEhfB=zj<-+Bm;<UZ5^!Kj88{g~Tud0Os8~!aOt88HoD3$J
zl#E1_JPa15q#q&{3>F#u|MNlyhnrZQQm>J3A28hB-@J>K16O!2fu=hBLP$YX7;Veq
zh{IdZJ47MGlrtg>tu>BdJnugG@qR>O(ZR*D%S|4ikhZ7yL&x|Q>*2sq{b36JcepKr
zl*RmzZ69)wtftEOG8|<D6az#!q+qV*!!Qcq;NZ21L$tf+9+s_Lw9N5pVEJ|#lJ|SM
zn}~zV&DN#+ys2rX<e4$P;(j8WsFH1w5sBja?+d^h@sNqheIgo&xQJ|aC)KMT0VZ}m
z)_NE4doI14y}*8ioU#OBQNsKpav%c@U?IKx##I$`NqQ-IV@ryRcF#gk&NwXhZz966
zkmC|#v0zen&2;48gUr^#eH%AO$V$u~Zb_&u+W|!dhZWp62d>&Zy~xb#QJr-Xq&19g
z!?&@ELpMF8#`Am+yl#%+-!H$`QK-hZ;6b77^1B^!+<UYenB+vM{db;xBn7$VR^_8*
ziY3&tB_lYFsIR}!C+Hx4_1!-va#jWV5V^@37H*ZDtf|b`b;H9zrH-WzrN8LZu+f5L
z(`vq4T0?Pi`2EO%1P>Y6?B}dlDex}1{d}Yl!BsVzkPTGHMOMq1n%)3;ph+^&j^ScP
zO$K@ja8DrED(Q8Jx-=0tSE_1eg?)eT4ok^NruZ#`ndL99wn>1}5GEKCY8ucfut@o3
zhd4bUttk)IKsfJq0~yd1>C@*$R>HsP6MUl(1#_hN66W0!%&rpT>46n|((kKu9v&>>
z9qZkyk!h_*N8ycBD&%FruJ*}`yZAtv_yk1Oe=i+LBM?`i=#`A{Q(XY`JqcqXaT*oZ
zDIg(@NkVN!&y_4gP}XCZQdGTKT+^DTYYwY^wDnAco_p!#x?P)%#Q{R1In;svlY=bv
zgn5B=<x<Q5&MNX`mXaOZh4IgtKS$B_Ns7m))zFiHu}r1gVUv`Vmr9z`W*9Z#6%6My
zBee$XMg3J=RToM;31*fFI;RSA>$vjsY!8+S0Q$L>7VC%kXg3n^HgVI5dJHzm$wztD
zJ9hqViScnSI@HjpgpttlNUfD3r}twFQ31{HxdFBUhoA6Ajv^#jLssDkw_k9JilP>P
zm0b)d=f8kHMIpJ7Gq>K&s&1;xBCqU>O8$B}$Zd>L7(t0>g-460!Lg>MG$OG^9yh3O
z>OGM6@H-U+>_3ayjYC%W#!RxR^+|n1U5s}3aun^u4eg?TftUJHrsoOJ|Mq}CQGuzM
z_{&W1?Sbf1B3b{VP;ESK#y;(n=P5~^(SFe|sR#cjWnGm!9YUPFIt!YHrXdt!j1E5I
z-{v`eh(BCK|2?M^ggNYxZwn{0A@E5PHYI7t2`f!(x=Q?LzCiQ#;Es+`5kKj!ggdo0
zNr~%%+wX(iob=zyD*pDl_+h4r3D>L486I*|7WW=FrQFMvPnGJeSlb$<SzOzQpJD{x
zzWis(G9-8msPqhYr<_P-DJZ%KXS9zedv5VdfgXe{B2S)V{r;|*X*4KlGt#|wEO-XH
zWtE-@#f3^cAfni7JXK|F!9ru3gP)|^EG%gSoRiOZNwyl4KXU9W%||Mrqu~FKe{r10
z=G7C=^4FBgOM@TeB+yfV9J%!imW%;6^Euk#VFKZVSV++{xanGCi}1>KI%FF9DqN?~
z^H10LZ?Ly|VxoCO@7IW86Zz=r97(2GJ-saQTY;yA1^0PP`SUtOHiHRD9J)$y2VMC8
z?97aThfR!)jA`-mqmFQ1j}CNwK(LWtq}L<7$e!9b(w0$q;6~SmaTadzl)ZJB9K}{l
z!@!CJQ<fQ*k~PeDaVn{YOF4~PS&W?dc}Mdg)@{a3^RsoP5>^3aUGp_wq<bPNioxIi
z@p5Wh%x2E<(WsaKBZ+{vc~|=<Pm`thlU)InP(z-&CLUhM!RSXT*hb3nTA?qF^uyf#
z1fev~gM0lv1pZ-FR1u9G+vb^6JTSS?S`RSHr3>^dBId<eM=rn_A&Fmv6QwB&lTix0
z_^thT?apYJYJwGV^FNMCX(+rfo5XV2GD7kLggT;=?4_EH{v;9L*-J?v$CE#NCA&hL
z_0Cm$$Xcvg|HEcUGk0z?w}`%NrJnV-&o<v$#?xz&U5oW04up_j`5kDMn)zkjr3Uq!
zNFbV^Zy)gRF=V1BSd=}z9SK`g#B7yTryw~uD7HS69L>$R|8-{mV@VuyuPj9n{Wflz
zeM}?rNuk4S_-3Ns%TtvBi?v{-XBBQY{YCoR#w{+%6P;)beLczK<{mi^=w`D5QSCp;
zj*{BzWt;M~caq=yM!TTpl~>pFoqlPya9$2(!IX+(Ap#C7t(p8kPm@7!Yk3Z2hGF#N
zhj|o|v8o93tMn8*DO3_V%4j3e_#&;gZCPr@U1+?o;FE{5M!U_*ax-abJvaL>v(`xa
zU2NA8Lv8H=RHHJ~+`<ByxHrau-FG32cF>zXeQ+FrP*L2c{tI*rR0w%C6=AvRbgC2-
z6R<ERtwA`$PiROAORyL;m>I=@$sSY)Po#co*_F_U<tfQz*29Tad@8$ct5|c}?nnj-
zE&Hu9E*Tl0Hq#v*&w@$<*umsuBgr@9;I<ZnWPIT0&Yt&+w}~fK+Ozz>P>)NLi5Q2d
z;F-H82h-CpDe>~f>T#8pB3SmA^;kv9LKz1rAw=*?Kr5^aU_qm6%hNtp7O$_W*G1UZ
zIyc)(c+g#EK6YPQk(|pwzQb=btY;n@$l)Wl_ciKpZXwS&rZGnJnzoe%T>l?lfr|#C
z?u&)_5y=1gabnzs+amj9vZtzf<oaYb&@}SnA`?ZKUoOX&oeT^`2yVY-RRpt*r0)j{
z!jh~*PG~?WZt$$^p8GM1DnIUex$x-E*7U$)=|M}|K{>jtkQ^lor_S95MyR+TZq^ns
zIcysLh#bcwwN3tC9HXF^t#s!`X!{xl*WMDM37auTsIH)IGCfFpBQ_a9rT&wKo)XUh
z3)^3o>lB-qJFz9D#9iQv;o*Gs62N&jv#&O<X$Y{?E6M4k>cpohgvM=1^!jDtCZNKs
zW`5JmM%U{$$gv~GYjH>XKZx@gYCa}15>@26VKSK~{qUqnj{cR2Y?Bs6RtuEssH2sL
z@e!@X<&0?O?LjeIe6d`-Dau*`LY>2{OP+<jI{U+1GmO+UrxLsbIeU(Hh%zmLSnZ+<
zEd9v7Uu4jq@v*RA9#x>B0MYclsSgJ){RSWWD6P@)K}4Gh6``IxxN#F!8pk@|hO9QC
zym@y?_i_*xW-XWHulK-8Mb~HOR#yF)THB3?Op$>i-i%IH4L!iKDlkN#f?(2*Wa=kD
zk=}uwOUnIRV_MOlZhgl98gw}Ysj|;gBllaSpQicI3;D{}O&8X?3I3GuM2*HNSz0%{
z{4W2vE)BJ*fe+{U5+qAz)v$vVloabQzbyk>KF5|obOp3(xH)PS@v<gm4>l2)DEbA*
zB%0<Vn&d(UR9&|@%Nir-dL$(>(t~OH1(#&S&HPdEoMMn2Q4N)nY;647IVNiBt(&rE
zRPVXW`4|>Y$WHF!=#~q(N-sqbstxdA9`pY(z2@*hJj~xjWp>Uqs7eMZ%L{cF7x+p^
z2fv^we$~KO{hK)i?<-)iD(t{c&sCK>R~yw<^h0|BjM9QDuQ)v(Vk{wRGc>3@5OT*q
zoL_N?_7II|vQ=dA$~9=GSRMHXdW5IWv3m%DP6n#-rAb6fe>qHfbHmcTbT^hl0=h%m
zZ@U;NBnenRcLSVobl+m3J{^R%nHk35ymuG=IV!fIJ`&F3@?Q4i_DnOEnYQ9l(4Jt4
z)=(fK9NdRCj$BT@wCIp&Jy$k@Jpu#Cbd~@tPX&C@0H6erhK}TmFTu<z;Z!qszOlKL
z)0h1<LNSp(iF2Fe)B2WUUis-&&PdW#ulnw9I=0TN6b6Z5L3sbLdiA>~O58<RhYMTl
zvKhiv2*(JnZJirc-)O0}tr_xSW*QR%w%`#zJp~rn4hswAsXbg@eJP#Lczi<vFCR7o
zk?a{L#dWbHszc3ZLSN)bSg4VtY#)<|9&9=NKg@9>Q|aZ`qLA$oSamDOj}f7>D!GM6
zMkd^Om1ub3TUD4s+soVktPNJ09D$M}$<}5Ema5-k?tAxz$jlz>;5DXNfZ}I*lmxGZ
zLA9&yP#8s7mfKGOp80Qu$aL@sni0fQ<wW2HE6L0s0ya@WSWi`@{0#3^Ar$71Nrkas
z##EU4Pk%vF)Rs4eGwfIGH`Zc3Mi3oRd}=%+Ja{~DE@@_sF+5~MDhgA=f9}ca284}}
zDr>bjUO9No@BQ7b6T5NhCekNm+Nmm1e>~-o0WZ5lI1mEUljs&Dn4*W(OFwH_Zg)*=
zF2K}#RwrJqtjCO5V6`oRt~UH5%f@Z-g=LFSMHj#KCao|+6~#i(IUoN9J+g<0S|^WM
zCmyHAe|yHr^6VEZ|7x<l#z<UT<2fBgfwVpq#cwDF5{an^3<4l@{xaEq8fh$95-2rz
z#>bsSE}bVq%P!rsBh}O9&<zLbiiD^GW+!rf-If?w)!6yu)1wF-PrF5?pEvsOw<_Ri
zQIlgq=mwN&27Y8jf0p2BEk}nN-JqZtN8zMw+;wb>o5;93o&;64n^<ZEJ1m|toUjp5
z#>1mDFTx+s2BIGPLWMXaK~@CvOm{&KXemVlQ}VVpk4{6Dl*dK2$2Oi8dKsmcD&mS}
z;5*P$z6&Rnb>^$jzt`V$x>NeSb*GL1-#)t^G%{4iFH(KMD@6tt?`kMXPBFbM=tnef
z{#NZo;=I4tkyRMe7=Z_Gjiw~FStI50L9F{Tq`Tw${E47k1NMjxD@f#+*J<8^U?u?7
z>MmwenmY+MfWZ7vv+X!NNethMI<@udVg3qcS<J$NXIm+C1g^c*jI6U`E3$9CjA*eN
zzhZZW?^08SQFrsGC50n*RxM{nqdUmp$gOi!jc!%ot_RZ2s|Wjqb6XK)xVK+kvsXtn
z^plmu*(a@LypJ+y$BCe}JhJ{H9b{1EGub_s5f#NSwc08B@y8v`klHXOCz+*U`&&)2
z;v;akSW~rI1cdj{KC5~mSyC08;u)Q|s)wshkBLIQg4gg&cNG{6@4*j_++&g-hY*k%
zT7l{~wA=`CZw;lC`Xx=wzb7Cnd=?_^&{30-{bZ|6K{8GhOo+9Bm<cvzqrk#|z!-#<
zt?4e7Xx>_r1Wc?FLK6}ZO>kp7vtGMcdv6{+BQpX5f_S$W88it#%>$>PUCo<JGi1m3
zy%3Sb|DzM5QDj3~G0iTbO0G8wDCK{vq+yUOA&``%B!YWoqy8%qw(*=6_4RR0zD|#t
zM=@*DcKjGk4$3-OayHiQCpWy?vn=jsx3Kc`IszGt?hJ-D42Hau*A31PHRtYqeyK%e
zje7`b05X=N^3+z^5~w_&Zgsu9?w1R=h4q?TrFnNq-<4xstmuxYSkbjpH6SSY_5n6F
zkrv&$N-(`|vU*jw$C!Jy3^^+}`FDNkp7V%;|6x9BLS2W4(g}OPhnEeg0C@SMZ8;<^
z5GQRGXbCzF?k<h!1KK@MwY@0Vw^K~6s#<C|<zhCQod>w;QidvBfe)DICm;eo0pa^N
zw5rhjRyBuka#@h)gqzEL<wq4uEHp#%jgiy!wX0Q-@0xTJNY>Y?jcBb2;~Asavz8G-
z^TZ4!Zt!k?`iQJ>E}0m|Xq#evO5=fkQm*#5(#CAj)^3r~-JuxEF*{S!@ujlmyIR9W
zkXJ}LN}>$_fYbA4(*W4O&H6!1H>1ldWg>G=nE-`g>WOi6{N&bM892)dk4+U718k!7
zOYMC&9*>;5;4BTl0mebJzOqvSSIbUxUESRok{~ymJl}-r!j><BS^5?<?K8WhT<>w}
zZ>?7ZJ;<KuDf8|Wtc)`JONtd0@Ob0R)}7nWcrh~+V!H^<Kxg#|`2BL-Ot(4#o{jz)
z;ZC62>JvtR%7nWrXG$s4e7n%FJ@Wu15^VSazirB5-w1456;pNhV^~y`-dokI6LLcc
z)K?~@qPyss0lIp-i-6f8jpU4_^`v8X!SqHKsq%~V9iM*^(U)Y{wrqM2-77?=C7RXb
z&as@Bzi0?J$c!*cc-`Ia)=tsMi&$^Ibc`-s`J*SZbBnmZRfro_iJO)+>wSf8U3NI_
zB70x3B8wT7?awQzvg>hxTAipW(UgtHfLa+VBLzndVJ0dS;vWvsL{KzZsMdnDr6$fV
z95FaPOvLPh+GSY*|Fp7NBqLMoDnboVs&J5f0>T(JdW9!oVaOEDui@rVxAwA#rmk+f
z0Uxk>@H1~R6clH8=kFgH_HI<T(k5s9g-XpL!%nE?&L>7PqA2~@&gaT0G0ej>-K2VW
zdRJy;AG(-77sjYHkHp$KtJ<szaOqfBIVCT|6H%`TRS2e*MNE8Ns1BX_8ahQQs!yNJ
zzGU5q#m=y(IUo38QC5Y@khX}CTdTqSws6{PVAQQ?)U0X7tZ9+J2vp*EJX<TLCJWNV
zYBX?YOhP7pDvY_q{S_YeEr7ht?;FjuArU;kPJpNYOuV(q1Dohq1(m0&EI;H7*|?)J
zM=7i>Wh6H>^hJFYS2^z7SZU4q9DPfQ_L<K<=@pOG+k-8tK60MzWGwyHvwr@%vfD<V
z!pRR5&i@Sb#onLqQ$Ts@F!d~iWWsnV;BIAwprMO$+<1cLYji)MV{XPgF&=}m@XOvN
zm8$`FQW86dz`*$TQ6cHP{51@+P4K;S8M`BTqtyy^I`_WFqHNAjts<*dRUo0Wn9cIZ
zv^JEbcrpx*+xdipuQo`g=R8=1r?DKrjI4;nwoj9^=@cCHuQg7)j!5&77}+)C(XX93
z`xzom#2CrbOm35CUz@>KcI^_UHkKaG35~J<4-$|urx!pf*hPqiok?HY=vZ=@q<W8+
z3Yxji@>c&=+v+?X4>Pr=<aKFZsp!?8#5~!cq7jR1o8AOJ*Zd1nS(}Ejm-zK+hEr^$
zB3%jBr%p!6M0CS=MErIT6wzc3mX1<0m~O2YHSsS0qZwp+k3^CVe1UvZ$Y=BHffu6w
z%;oQW94I*kQX*g0K5m!94n#b9s+lb1tloYU{cz*`!PEM`IvSUVPa@8WvzUPJL^E5n
zo4LB@Mhqc2Tf;DY4l{ti=SRT`$plv-$+RHJoIUyx5A_$|=kc$h!{*<wkJ*WU)Oo(i
zc%mAb2|u%_#H`O(G6iMV9aK^ZIH|_@=%y<~3Htpn9M`8qE;_YK6f07#Dx8m*6(K6^
z7Dtu-NqDnKt#3g^=Jhk?(}20bC#P&BPqJxMki5mGZqn749!TE(XDtO0U?M=CeCOH(
zD)yEgn81(TGc$CkdSb>UukeZt#_a1Lj!7|MsP*_wO=yY@@Zo8KQR{@{1a!hrgbEGA
z;tk1M@$sQ)krhwh=x3YgA>}+6$D)w>Pih07F7#7>62|&1R0$tpw~JtZaoIdX$2F^Y
z7m0ssiyOSp7QD|FiQ_HThW8}iGtzp-a#3PxeRd;c3&G`|;<zBZsKyR5#Vf5eABxTs
zGGfo8c?}%H+n&l1OxFirg0QKpa|p;xZAO{6HN1|ebxtPNDsT8E0ZLRCIL!HTS5^yg
z>k^;K@IrtmBDeTup$-*cG6fIHmiv+Tn3+p!^X+YA8cvo9&1*O~hzb-`t)&WO^sX{i
z9J=OiPT|xz|50s^Y(Gx!)Oc8qoq0CnDE3NM@GIcVraIxL`AC^yFhjjXda^%|f)C7j
z`iv(s7_rDl#LiH^3^LHXufSe1;O*EQPR3T=u66(AkarJc^WgD}4Ogo^dG$(pyTaqP
z30nL*Xtx6R^Pz%w55A-+LZ0O!vyi7JDV*_mS~_$Es%Y9WXzsUYAJ%Atb34Y7pz&pe
z%k>bSVOu?@6Ryj#g@nefg1c2}aB{&$!}Z&qBWJEc;6#k)jaYSamS3nt3RK4?nVsQ)
zDn_3NW<C#0Ni?ahdnnk5TIeh9i6NZ0m%O>pmcoz760i`lGiFDRj;_EimfS?l`5jSW
zrX_2J@$-xG)lX7=osv9mQeW1wOHfuDV9bz)pFo@(Ws=@cB$;fup35U5H+_HFY0<fk
zo8D`ikCmM=AU<eTbpHC9Ac7kgCIS(u6E3-MCMYA1svf3ZMT?@YNz-VQYK^(#_`)+I
z<W`To2CNSXY8@4h)<;hbp8HYFPe@i`Ezmb?H!%Ep$fm_?Sh8PGcIsNu26u87z3Xq%
z+H=tyV}^c?)=Je*8)4^+U2;VaZ;ByGVQ%+`;R+9Vkzu*t#Gy`FrEx{iPPr`4w>6}5
zKc5!XQLoup&w}A!?Mx~cwb(B~{8Nylr?nngRR~1DffY&!EqPqIH7*I!0V!`udu}jt
zo(W}1N*7T|0h_eh>bF*rZiY=A<}H6Ianf1_t#23}?fjUj$f8%qr#VnpUjWB9%-Dnz
zJd6<04=7}j{y9T{>CbZzJ(uj6L-<dso@LsW+~pq*T}6M<7`$9TA?P~y#t%iIh2Ahw
zU}{2r-RUcJ?o@()VsF%>^$b(D0SZK=$QWwptmrB;TwDX+FGpde^Q>bUxv0m4s59B9
zHS@Ot@<ONSQ{7PYUi3?R*Ztuv<t8_TD|eY>ZX_MB2Q{3_QDk{;&%znyn}tW&HvUgW
z%=TZrxoPm|PDac_oA@X(fvXSeNzyPFUn?ZBmq94#VB?0^Sf#N>bq}W%k!8$GUbFE?
z6lS+y`Lk;DN`*7o0yd5AJbmL}<-GJ(Z8>g7k|`a6$z{U1K-5FLVBfy|)Fe%R0x3P;
zdUQvuw4hUk$N7L8^!I|XlGAI~M@To4wSX(WiVDN0Yc~c{aDRM#!%uH%38KRRq9C9>
zz7sSxO{Gfh3zNARKV4TgGuBiA=W4r!;Dz}2%t2NC$m%LWBGUuAkfMECl9+4n_ME^)
z>zd;wT{p!eBd9$*L~VJPq2ifWB1-#@NkBogVXC!Z_DVVXAMHzGzv}Gx4#iv}15U*U
zHz&EDBW@8SNe+Ti5p#beD1xl_ncGQaEZ>@fh#N`f*$n(2OoFA;CEA&4>Pim?DD@|z
zdUe8u*$N9HOG=D)LA8z~MY#|+o0O3is@Mi?=(4=;AqxJYvc3*zVJZ~lHLEp~d47+Z
z8g%M5QKh^1EBIRgLE{J+0?WP%A&h+hrTKA_@1kC>*(gn(I!#1De3^2*??m(GKaqPV
z%gQYU{H^TJ5VbBc2V2h5uqwi2!mZU&rz}PtT0b}Oar%WucpAwu&+^e5{pd6aR~fOK
zeLt<xO+n8_)@eq=%XZe1%Jq|QAiWAfHG8Tc4>y}MVF6e<d1Ot9zR^3Sq<4&cj>RKH
zhtshjGN7pRMOS+5uJ%#P<w3)7MsU&2EZ(b6o@tb7WM|fG{EIY$P`je6c<kTl|Jw^N
z<2tul%KKCMikEh^`hamIayXpJt*Mf*<j()EMjrK}{?ml*@iZGJRM@>0;SpY>hQ;Qi
zGB6bpd*i1ht8&-qI5QlqrqwU733V<C68BrD6FX0zd%8WsjT9__`i$H5zMV_*J@+b6
zu@x&O=Bgw53NEzb=wKk+G)v4g1C#65n}@am3dc;L+i{zhAs-YPFq`S!&NbS+>`4zM
zN;X0B+K)q%C(z*(9%*Kke3Q#IEi~LK+9aW;vk~AD17bNQtJhDJYFCS&X3TvsuMxTZ
zI9p^Luz0{35HWavfF~-L6Eba6xyzN`>@Hwv;pG%>iGvd4*BQZ!rmK@&-CmV+q&dV>
z6m1A!ur*!x2pdZ;zpsphp7(ueKK(ZyQFQgGfIxDLoV@fF|05Q+i%G|T*8sZAq)4pg
z>ZP`xmf6hE_*j|h=O$F;_qxB#SRaD?pk#QMB-qlIV6KrXm)m4gqRHhP#JZdd8`MQg
z<68jQSeI|(RBL?{4CwSr86QLtWuEN&Ex1O3U;APc-W@omvm1V3@70EJ(DC@#&KIdu
z1l1S1CfK`h#hkD)70XdDn2BlxAu|%;J`UXjBl*`v2qQv7#0au@jm&gaO|QGVTxxqv
zZpLme3K@KH6Y@E~bLlo`eKi9Tu_%Z5qfTa9-q-VzYd^GdED&VJ)c7+P1?8K_F$y%W
zv#tnwf1P_iawwc>@~{iaTZqSlVuDTGZ<*-gc&2{+*Z}}~T{X{1p_<UqlI5dKm)xAK
zzy)W%C&8r7zbfGTD3$z#t>DuM+BU0lW>4GHp=|17FX4#E*Z~J$%I6+O`JmhK4nQeU
z#8*u+F&B<p_2=BlL9Lcre&ly6940!XEs?>$Sb<8%@ek>QCXkMw-4CGdpO-D}ZnYW{
z;}t1t`h8j7s!(U1-8vcsyq)7Qfb4EO{L}LfEU!3;sCuWU_@prj`2!6OT4Hwx%AAtJ
z*NO+T0_j$g=`-@Cu4868oQ3MBRzXkgY{6fYTvsTw-4(5%x;~-gA~)U^N}K=Ak1G2S
ztX9w`f?=0eJ6DBXGdPRsqcx3}{0M%FY=3Ug$h+Ns%s+9tr&uY`p#TJygfNj|J1R{{
zywcf_NZ_h*6Jz%W7FcEpeMg651roAfofuf*9OaUgs0+#r+Mmj@99Wc)XKw)b7z~9N
zKaHq~SY^Bm&VvX%78c^G(^Ia{V9PsF)!I!fD$Vqz|H$Q0?@yzuXsOsSo^ljwqJA`M
z!Hg=7m>`>`&vrkV1l=Bq#L(l#0v%$wPm`3hpxT4Q!7bGUcOoFvCR<at?!a}qrvu%S
zSMO#fw2zU%y!=^=-E0@BZrAVLEgyC-QZ1T^?4y#{s&VevCP7qLTg%5XRWC-3<GpS_
z7d&9&ULbFIauzcAL_K)lg#!a4TDl$6d?C`&I=3)ZP0ZK-C@6ZQ2QNUp2%{J5cx(IX
z)`m2|qe&1HiD|}!fuvL*nU2HOPgnw@#A#(8!%_l{fJXj|KXM1jdZV8CxnB+Fu;@|L
zVUVgn$XB5qol8pa@!-2)r<sm?@Wk6Ld?@72hh6j&=7+2FuQhaKAj5FSg7J@9fQzlW
zo;N}J224PEB`*ZK#(2DxOf+#gXg@xBcXzv>m*|^)pk~1<JqJM?wGYDXp_xF8rEXkI
zmdNUO?Z$&k`}9hbF^N`UkKYjbK(g=A03QTC741S+mTW}r+FNOK`hNCGSMzflc*!%7
zgv`{IgLw3SJ7L>h78q5|?pRm3SWWuGMK&ThRt5mpSpQ2sFPC^fsLp!wa8DFO!@pe(
z3t5%~7V3u)Yis@@=DUst$B)m;Sqmi>Y>nT$!@O37`3(^<Mf2rIN@feKPCLF#6#G8Z
zZ)?5`UKrVWEz)%%cSW8G)|(CSlYPo<xxaMt`gSu0|8>4Iu@3%jb}CMF8rL8Ru?NhH
zEN0_~Q*7uBR)uF{m$*vVn;j;ZNVp-HW%q=NZEg$J0=6c95Bxm8eKLjlK$m=nN9im`
zL&tP`fOk^pI#uDxM8Iq@o;vEWAer6>yI9lUfD{_+F002wgKyA`_#>DS_8PH5eMr*z
zJueSrKJaza7Vz{p=_YcO?TX&j=wJc?c;lLJ^Z<0-DsR?1vh_^!1=n#QSfQ1)8C!1E
zS~?EW;_g2aOVO~}BU>{?xWRf7-!Fh&k~luLw}v-kai=6GC`IT;ejL4@b>^MoFFAeB
z`*D1Z-ObKIlt5+sn<Prijav<(G+|CzJkv<^G-_z?OnNKc_DthV>XC7X_Zs-6yr-}D
zYR34LNCk{|ad|4#-KV>NOnfdLN9r%yfqqZ$A(AxsW?wg4`1{|>ap9Mf@TC_;-*oZ#
zBJji&$=~3hh$hpyn<b_Eo6bkT#&?wot*|^tlvC9r4{Op5pMqxBw7&bu5@52?O-(63
za=g~Ad7atM9xh^hrSIMdZN3gKXT#XylR!_Jz8O24qM>*u=`Tp0U)#kd8|1kN)JuxF
zzA)vwGa)JA0P}}p<0JCSv-39@DAMHy`?PeNolOqhN49aG^*JfH11!0Hu*O(f)M-<T
z%QMUSzjw3#ZztkGbL3vDkAHU9Z?@*J#p75nw<1>`{y1g=7VWRt(Tny&Loc{vkog~$
ze_J;(<xYSa_yQ}L;qIG=etEkMmxkJzZ|%kGq}bg7<zSEswugleStqPdDMHA#=<V_T
zNYspbZXmbid=#)~<V@p6nj4B>Y$g3h@-(qR_~12m7WyOG&($M2RlGjEuePVn%EzbS
zmyN01H~xyc*;Ji-ev&%k=<|Baw9CQ;nS>8BO1mErZh0<82A|~zo}cthP5_fi#!G-r
z?@aOIfg$p08^62c=@;;h+V#;1@FCW;;rbjcw{G}o-7lXuzgSD9AjKZ<Q9sKyX1bH+
z&ubifIZlEiLAaN9`w`uls6K2{!(-t<>#!Pd#!Vowz}zwA?FG3%8u>)AKxUz${n&lp
zLlKYnmH3nOzMu+~?FTBk5tYWCv?_jV<27RR=uMFKfID_8XEUd^1YD)4j0Bmv@_a=M
zImsO!5b=9x@ZgkhuP$h(7UcW6{T?mn)wSV9$~VvTzTxKgHmymV@!=ys%UgHz5Av~)
z$&zs~NT_f~%(hgXnhrQ4#xVDYd0{ivtZ!GA*eRGOb75pBLr#^pyZR5+Ur!?Z4}fwi
z3s}KA@B#sf@C+#_%~D6zo+BOG7Q`<k9-31ZUug%Zv2zNv&VY^LGsm!9)fz8Pykm!x
zAO?i^uT^GI5jyH(-iM!c&AH1{V_h6%_0Aje!8}IEKDYzV+6NMGap{j3GVoUFBig&M
z2yH?1KCvHhtpAKNor!cSPlVI@yuOkE$&Da~Anax@;ALR5DWqh;Jw{xq5FAP-Aic_d
z<bR*BXR&28Z9U`31|R*-{OFs`u0Jx+eWA&ct?e|zmiVUMCK_Jlw<jl=lXjriWsNxz
z;VLI(2O<2?YEX!K#c28-YX82kf*Q-BVGW1CVftLdQb8kk8o#B*6Y^V(%|IjTlPjyX
z9_v@YLe-EC%n305KLsmj&@6>4*9!AWsH@WrUX^UKU(JGG)dtkfeX;*knwui~jNz$y
zuZ#G%e3EaN^0bewHZ|Pq@r%}daxzh6xfyoU^*iafc}aXbeYq=Gx;=0Ra>JQho+-K{
zne8*sjIVUhLf?Zh9h+TtG4yV&zr@w}NuG~R$RR+$yZd`!^$}+p-)RHSr#<f!6(bv-
zz{H9kVSv9+afzuhHGg%t0e7($K?ZVtl>^aPDT`hgE?k%D?Ok^A(W-s&TI<^RJ*?au
zR%RBzF~m;=;~)Y<{J8L-hyT2#zHjai+?m2qlL=_;w56|keEUu4d5O1JrQybC6`7qZ
z_vmod<;G!^b>JT3=yAx=|7~{H)~ndyFw*|Vh8sLlAiESsgSSMfi_t_)kAT4X*BBSS
ztg?HZi3+)*1QT21Y<*q4x`){@L+@O`{&i|*B8g~lLFO2jyoa?MoesfN7C|Rd62v*i
zgYSJ$z)k7SeCi@DhDv!2v0%oRXahsUPv4mP`ROSeo@Jq^Bfpe1t;-qvV%pC=!M}v!
zq_zzDa_z^}<kx1{%Ibn%T*L^%i!Cy4>E8g&5uC*jy;V-2TzQ)u7lOxD*{`>nxPu0#
z_kbEWFL!El3;aF9%{pL_swrkbz3~u<44ALW&N%2`MYLwFjo2DM2PVUB4M=vNAoU|<
zQ>EbMsrxZ}6~F(n>GCSNKzY;Pa5x|M`}=#tuXz)Q1%P}qRR#i|1Jn0Qce~FCI;rqf
z1W`Fqiu;-%uRt&mAu%6uvBFPTj?JMRE3R62)D!6mp`(CTqXYY9UiJl}?;O`&CtGFH
z<Dje2mr)}DN5N}sv+W2DL4EbZzI)SvMgPnkQ}Kxla+d3nV#c>1s{|9rc+<`69<z}n
z9-Ny*0=2IlncEX%V`E57Ne+|t%bdo4Y+gRy-toT54{$Aq@{+F@x96Uou>^T^%&B>z
zkPsI@K%*q|4b~}o%t^`(92VJxolK1u*axCXVc#GM2EG%H`R}p$a}NF}V80GPS<L7H
z&$P=a0nB5nc)?-MC|c)zLmR8Hx#7A^;G$(9b|<Y_Ac>E+wEV}jq>+@U)*_^_rfzxp
zO&eFh%)kQ^(1-of!XhOn!}r1F-rGdLEj*`}?P_Gm{;hhyOTp^P<Cyaptu=b7ApyH}
zGzDWL^`IV6=4wm*u1<1VR6i>5`B}#fDi*J_#gLVOHTEDlZM0_Dj<oSu{=BrH98={)
zz7FWcGt|E3HNCIv`;KQMm@U6_laB#kZ!8KYbUtstV9WC?Wz9+HI}VZ`6PnsBNMylq
zfAZT%CL`zz&#JFHs*exCY7g<BQIUU0l*ryL&N=dSpi-=61l};V_4~>Vyw}WpImKD^
zcP^jW=%PHzC5|HQ)#q~psFM06qVqN<oCa3i3LD6-=DMb+mvBg5@MT_!eRemWb)Ng(
zYaG5eD>Nw3{(WQ3UR8M$44wH{I()*}1}-OUf~nP68klLiqPvLVOt;v0I&=FB!6n@F
zP`XXW#TUQc`AyZ_DVME_g_N);^94C10JQMLfH~g006`N$dm$Gu0QVf=`P{O!iT02G
z@rou@EFe`(C3Od3@yC9W_pJ{*Q(*9+!xhFM>%&HeZo<9wXDQ2TIL)o}Cg#4rd0Shw
z#fl9#jX$xQNeT~^BdZ^m{9-}_Z>i#)vQ1fr^%2;F<dh*DYri@nd69#H!;&3*zXD20
zmuq^Z;0vUUGmo9)5<dVV4Ypjf3VVCk21$!nHbfSNIkdD`&hfu!uy%4r;dDHU!sWvw
zl!d{CXkIpEhfNcOfbzg!o9u-ww0&so{4#|z$b>V{g|QPzkw9dd6yNj?p3W84&lIxP
z(oL*w1M)=sY5!Dx0TCCNhpwUxkPc4Oi{?CB?aIDcKy#=}KJu*?V4=-}2jPBRR4^x<
zF5DEiD#^mDaX3!3<L)x9i}Ah?5&LBeiFh|-slJu^3WsJi^R(NqMIv$Gt|>*wV(^vz
z2Qgzav!Jm!#UXQw3vL0V5nD4m<frR(9x8)@wF&H`3PnRq;0L8Pk9kdw_&_KJl7^zu
z#LIO)^^fr=^0#IT8$ZsFWaC<EpQ;s5UPBABx~1;0jjmBEa}x;X2D&LTI5H<DC~hK7
z6-SM1S58CsP3J_y!b)eSCg8CHZ1(Dpk2b3+1CQ&rFK^+VFVk=JFVC6KC}FhyOu{BG
zOV{mhW-^ozkzb*ntQjY#tlCF5h2*NAt&Tb&xqNCze{6_U7kyi0lNndb-oid<%k!5p
zSH6St=O1m9xQ}>g-x-<T>+-(T+~BhNZtdosWB2WmsZALB&<FkT85&Tv4D2&g<M$e!
z;oZ)=B!X=hwMNk4E}Q+%{VF%JKiO?#IBYBLn_Z2;vT*gp!%hO2^zCiFK|q+h{N<=0
zvgv%qKf$&jtPZI#bgRP0)%W|XLo6Ll_t&KPQJ|AgQ=6)}dVft|oz`jer@?-&SV}#y
zrJvJGTy91LAu(HHKI0U*sr$o89&d`(M?xXzQ7aBjzGB5W9^OCJ^{5bIxrF(GyW{pC
zZpj|A@zq-hWnMTammSul1gh#TM)^)abmxXh=0cy}SauS&%+xHhQ)Hr3qOQn<usdRG
z|5>>jzy>`}h9+s5iY%eu{#b#@$G7k7+-D8vel6#xNap9W_~)}YL6J4%!xOz^+YH`6
z^q<Zy3c=Bl{Qh50iNuvn_Dj6+9@}%rOv%L5UT(3;=e`pHNhHi)y3eH6Hs)L8Tfi#(
z!u1Q1PNF1<d#AJIVCSo&K)iIcY%6uFD`KhZWq%4dV5l#QdU#mSFthP0XtiGoij2Mu
zbKBk1o<#{q7{k#0t1;Pguk)YrnY-<5mUeD^bNRaA6s=^aL;q%s{jHel%sAFb^Ws8M
z{Ap;83{(`e#R$rD^B1$e(NIgy*;4}i<eg<kXujEs%y~QyzX=+=VG%#?8y^&Y6MS9a
z8U*}y*UuBnB4*pH;qA{FFUIcsG*-WBQQ>x}jR(Xy9iAP#6v3GAbk7=J8aM2q2DW~f
zVeIZi&-CPQSGro7#M@?RauXRG2A^?NKt&6+Tn9i|JeNGQb@2v0culC*z2G29DfR1&
zQ@zFW9wn>=CX9b2r=mHY%&Roa<KRxg(bw~Wv*hNydCeIcHGrIa`S@Ja$Xw-YlU1Ja
zB-h3gUguZGWZ|EriW@<y3_M7ye$2*fffzz(qQ@;4rNDOM{8yw|&x%W}y1CFLeT%@h
zsezE3U{T&bK8<bn-%0xZo(r*)bkAN)*giy_7XUnVv3E`Zqv98XvxA~O1w&`ZgAbeF
z1Y40TK{JDb5^AGPEtr)}Av{~suOoAj-j}Phu4f<pNe$y-SFrY1xe@EX4y?cbZfBhP
zzLi)ojU(!=Vonnpf+K^sn9t(Zyu4QZ=}eA#nuvhD+I~%aGjAZG=e_zf6_$d6*aN1%
zjPdtddEaJLBsX!D&(8Q((m6VX&5@aXy!}OjTjrJ!97KXkhqv{T`&*HLwDkax=Fys8
z-j?f3`*X5?aq8@q$F=7Gjxeyk|Ko${PQUa^#NG&(6<(os6`Vf|H60(@tTXMY1pG!V
z+_M_r;7YNplu;)a^sc>Y^0;4+nqgO0DLpHO5j5KYdHu6$ZN36|1^ap~>C$<$a_!8h
zwyOl44yZ?@F^OW4@M99&J05Y+ZsdMw9RLw$8?BxKbY>Q!|986Y2Jq86F}Sr2EA_h%
zZG=_86sK=xEtjwcUM98TGAO;Sm0O=1HWNBBn|6Beweql~sZnd!Mn%OEI8U`ilrz=&
zN=S{?;Y^`VWNW{bTIXmo^7JfeLu3bIhb+QYlZ_NX$%{m9ujicCB&oUe?=CFx?bZ5C
zz&o6r>?KS5*HhG>NI-b8RI(}Si2n{rVb{0#zE}&5_e@jDnY`kG9G9FzTA0hI!OjA&
z6-bZCkr;ytJXGufr~9v_qcL6PBE-a`Gz+5ninrpwNRAGh3eHa1TInJ43(oCO#>=l`
zY1#l?fN0SxF4B0ez6{6lXN7F)J@eu0K8sn{gp_lNgXQ0Cebe@Sxq%w_qKx~=XTPKA
z`%YixPOXcNp+j#3ZK0@D2l<RTo+V_13iPZ(gHnRGR@Xu=Q3rE!4}fyO>p_5bN*T&&
zP#YXS2S0*Ru6Zu6GZF8ISSe9{uSPc(XM9S+!a8C?eNuFJ8zhfIS3oM1uv;TSjlKE$
zi+AGwnth73tzZW4vnsUrNP3O;iOaEaVj9|u8;|&dTA4e<<!uo+P1X}MnuM^3)pZhA
zAZ=xcU92#a$vE~$Yu9?TaQw(?^tW8DqwaA$jj_+&!`ZK^WQ9s&9Aw2@;1+57Nu2+g
z3PZ8taB;Vd?ToE_&a@`Nud}3{GsS1GTfehUAd#Y)HfC+>P}5{%g!4-&kMN6I)+-N-
z{EsH$K;~w(>-{$+XnZQkoN2h(_7*TrJ@_o*i6}d*)K9^0J{4M_t&{FhKR#u+%(3;5
z&%uI+uBg?>?q%mNvj1xG9W9t5`GU5)Sm`_bE`l-s&aYxf-nqAsg`@&!8L=$p#`}#g
zP947$LB(2<;m|Ua_vr6ZhVt?4O5&)|2**6HwW4cK_U&4_*MsX0L#yavi|;$1d&f@N
zQxUBCOReEer!yrTKepDnn^rEMPc|sjE&d3d<<jDagxz-soXy{KxwQ(srf=nbxtrWT
zRb^Cd9=4TS-sUP}$KIqk{$ZepJJnV2tU<)B4XY`H_&2Ya`8l6=N0~rxeACZ}MLI<F
zYT*!>J|Qv520}Q=;sI?YD618E6;y*e5QCy#6cRiQi4qnb6g8Hy=zuurP;R4EB?ZHY
zpd>$I>Do0>tj9ppxYx>U9<^61Q&g?t-T9TI_?Nq1-GsIL`hje5{Nq`&y-;ru6fVxr
zS0FC@3O~e2@BQmG4r{wdQnG+4-=;gWMl$1t`T}@_BORJkKtj(r%z!kb-La;PpwqiV
zz<O{zxflL}yU2toX`ixC``iS#+bs9j;VOh3XCA7j@Gydn`6H~&tuEy8@xj1G*tP}I
zM+5k%syJudv^kQUU-_15zFUAM&JtrqXBleqCn>)5P8m&^q%eWAPd|?pWB}PR$y<um
z=EBfqWx~0W-l=o!bVwy~TC<gC=h$e!RxjH)SgbEF*k_da?4+r!xo`X}cjPU1dVnqU
zbxRC5jtiU!F1~2EvREZz_h!HTbdSnD=$@yGZnRs1v3Vd4;GJ%5=N-58t}yb$TB04S
zn@P!blj+r%IwQDux-5VMdS_ij|Npc0J>MlomvL#+-(xz~)A4e0mdRCR+uZMr4qA5@
zGD?=LpDWeg`Bvn%-;`;`{~|Fktj1-C6bJ2Vb7XwlkAb>TN{k$Nw0!P+{R6|TE)Who
z|L6!}#Fd296(}8*seunPH)`XUmDnlb@_JVVtI(n4!CPY4{#)74YgB~VWRgo*)6t8D
z=`1<NzsWKFsQ1W^O>CsSbpw!<dw4I*er;=9lBUmt5JmhzUS_(W@$n_vTF<wg-G8Ve
z^*(t$?VE0Lsy{(G0P*G0EG0+i$iHgIS{K!4+{lM^OYZS}tMMe50L2wkInKlOK+fFu
zl58#LchQfEB|p@XdTKJgnGGw*_^8W)#vge9{MT0Pfi=+)axde(=c3G)>EgtfYF{Xo
zLMdSxv1Qww=cq7Oj26tgw7!>E{_L_0@Bv$+H^pB#lJMWk7wn(wW;^iYeF-x}$A$2U
z59%Gt_@wOT$)?z@5RkHS3+PyKoGz58-|AJNc5_zOzl&!i5V7=hddWv>j<Klz?&-{z
zo!I^e)dnS?jJTSSqK=Xxlo&CtXXG34;Bi@)lM*(`rXe}OprRu(;#orAnZmNNhWJS<
zbr})3gS3`tBg5N=*7%R_?6pJn82t@|gX4M3y8_{0+LVJVV`tB<S@E0WAR|TncUo8&
z!EO*{TJ=6#p9aR;(^jhYsB>|0L96i2SuxlULHtO#NcTbg7gH!_05nnYkL+p+>u?e}
z$l=_cEXT>Stx_)ELQ&?u6<>e%Ymc#yQ)!kO#Jq2(lfA~ueUv+pc~$Sd&EDW9(*6S+
zkCy_eCt=DR4GdLZFuYVe5b144uf4+Cp4+lP%S>$5&P_ylN+v?-hqju<W|`_rbjDI9
z%gado8CThvTw<)Iq<9uOdKih+7b^}1z|%Ag2N=Oy*$$g;5Idfov)w3L6!mXSdjWhh
z`$I#cT}iuV?y++oL+)|^p6$Z@HRc)#4Y?<pU=Ofbjif^9A{;kD&=HOGcILk}Z!*OQ
zf`+}1Pr08iO96d0{LiX&-|JjsT(%pA*We2<=2UNN-195)gp-tKIP>+PjRc;RHII{(
zBf@#7Sy_b67Y;ZMj)-v|S&YGyfg8cmPzJpx17Ep-aJ@~nlO#$8+s1y<&VSOz{ku)n
zx?T7yXonYAUxYuHABYMk!w*lROcDvZY%u;TPYh>ed$#Z~jZ_iH!%@Wpg`&Vf-seEk
zVijF~v5sMsEB!x%?$JAmJG&TxE|*&%!H|nPmYq|!%OiQ0%P#UckJ~e%9$Ic0FBr`e
z-fHD#69Ixn^?ZZnF|-K^ztZ~M?1I;t;_KGnX3p@h&>o<ph#24((eY;OhqXLt>kW&?
z!B3Ld(2#835MJ3y`%Ys2;=BSI0EVYh%blTW#__OpSWhe0-@gLL3P0bk6}O!zI2Qjl
z*?l&KS7jBUgDo%cPh-bU%fVo4W2d6%%lv0ds~u_#KIpk}<F2DYA=T6SlTj0YDnDkC
zHQzXu%x+u7Z*8HRo#gMYjfwziKY~hf!H@4(A0>~DUM7h@K9UDEUH=W%+iR>h%LXT4
z@Z)W|7g*{V*tGF_(BTa`-+XEW3)KJo&DC_lYty{kam4{`!R_YgL)SfW2=ejFJ6oIn
z39wP@-WMo+9Y-&iZ{PgJXDc0Ypbk~M9IFI#>>c}>k8Ik*X0B_H<JL7KgnCt0@BTnz
z2libI!nFW0qB*=81qIQ~jq%E5#d{T)ljD#exP$oIz4%J3^y<a&&g$J0ljGx9ddn(U
zH~Ga)nKR`+k)oz{Zu@p&lf&q9Cia2WsV<X}{lit)%c51b%aO>;m&39|z}t;|h!4)3
zcD`ms4u^l1n|{7L-WX8=7gz#+P`z<=eV5?3c4JRMN8RkNfLTAXf${rbBYHiU(#Y8i
z;(;drEm?`Ez+H2^v?8SDtJYXU2_v70Gdaeqrb^&jlkC8b;G-YSLTKVY*VwPkon2xq
zNihK}A@nV_h@RhA`4-XlI<PJWY~ZkM?4fU9vk7a?FI2C6VYu>YlacQomRcjY{=dBd
zZ(hkqINB!1ELXo*Kl&eb5Qezz(uoT_5QZ+?6E+8X#dbBVS=Cpy{TAXlDu`bIkB_@$
zv`5M>H}9%XOpK%a8F?6R)e%G>Q}$bP+K_u>8#sE0yu)uSXTB(g>P{#!V-V@ay-|^f
z_+xcum6f8(?#>+-6ECVI=nsuiv1*T#T7Xw2c<r1PIwVH2AC?ppfq_|hY4h6Ffx63C
z@YNzh8bdP2mB1zU98%6$D1He?wjGdirqWwzhja~2;Ye#2pVi+a`(;<}C5S5e(R~Os
zx%WH2BVvCW;ev`X;J~ZXpys~s^{tvO_4~4K=a~gTZlr8FGZ(WwmpzVeM#v`5-niaD
zg{2YzEZCcZoY@=RCdW~UN63PE;rPW79n1o>MND_}6;b&H%|R|_mDBa@?=={CCt=4%
zx8djU`;$0fNErIl`(dO$jHh>x7BHNFEJAy#X>Q(YMG>z>)6i5BwPYsmSHWkIPV6+5
z=4uDtuMx(l&IwOB#)IsD&UFN97C#AQ;3zQohPBC(58>@tA|(f%MMMV{+h@#|#(^~x
zvmBqVTdtAXh0K?3mMzQmcKJcBWcK1#NF-gS3Rrt3#=jJQ?<0Jcs0|`FJnR8c0mqK~
zYM<$v$+~}#ze*Q}F5eI$i0QkcJ^_$7QA0|;aOh`X&(@Bhe@;CR`^HDf(g^sDVviOW
zABO1cE{-sh6R)Txk#$}3_V=vcH^^wY<IVZ|7v|ikj5LW5{>gsEdq_X;xQ^?WP0kOR
z*q@F&X_Kv_iNIAE5-!*+jrO)SRupAj^NF?N1O*T}!?uR)z}25i0~h4ag@W8nY-TNo
zb~pZFmX@=2Hh%<9*Bl#d8^5CPPF<Lu*tGtXspG+PR^h@APtq3f3qqn1`4C=H8IZ~v
z9%KN#)WnGchZ7VD#;J<(WE{UogzXt`&9wf*)>edEn*kc+DGAzC+|5n@kqc)r%%bou
zjV?OR5F1~*gHJYBvz%js9?>d=vx9Seag5uEEkT}oi`1saH4aaMKBw29dsKhcdhEGd
zZhZt;TxY$%!e-(SRur;e-~HZBtCW*QVJuali5U^8Ih#Uvfd^}xNEm@jk^(2uQVFwS
zNQ5%g=Tl0*fFyNX_k8GJPwdxi{KbCh{SpbI@~uxI;kTsRu!5UnA?vT=w_GE-4!6IL
zA;+7XRselYxC{fXH>6P>i2A4(y}}=c@u(SvZ<<4P+i~8cj<M%xkR`auESX$QDw_%;
zy9@fY1+`8dnWj~>rvAjUKw`b#))eNia!m}|z>YcNms@b8pD$|5SJEk7aM@3X`C6hL
zoGq&KWAJx?oQ2u%XBq5Z3-=&Iny0>a`ZUZKgtneo+G5BEcHHA%Iz+1jAep`0=@L%d
zrGQoirphuNj|z;6f<oXz?fgCpl58la;JURhfNFuHoy7Tx!Qd?SvAG*5ueH%b1gk<N
z;dtMMYO8S+bqO2zvALRKm7W4o#;i$=@($)Iklm}c^2zKiI8C#>^*gCmS$_`gA3ipB
zKKHNHG0dcadj3GZCLh2wDRB96)i@a7-LmluyD_Z6ZhRosDY*h;=h<DAj6;&5Bp_Jm
zy~pkUq3N2V<NBg?o1`%&wr$&<*hXVFjg7`mCbn%gRy%QH+iA?ke)D^8y|wQB^WM3$
z&&Id+`Sw0ASPzC|H8C*xa%9ZEa_c>sM>c@bU4bw`8JKXzJ>~I&K~nLtVnVBIP%ECZ
zfXKS)8Mer(n4Q*6M~uh{slL_5Wa>#r4ns3E%nkGdZ;9btn0V}<*iC6Zk^L0BB?BdZ
zbU0>H4(PAuNaSP>I`et5zdzN>b8O=mar0Z&na0T|M|PmSW7G_2w)EOxRyUT?2_^9u
z-=cS3A+0#o(3*2hh}rP$n`vcn+8`lA`|ajKN6$Vt0dyLZE>9SsGngep#tWY|)MF2?
z4gu;Z<+PawBq=N_NgHfq3PoTV3g>cIO#zp5fKNmVgTXHWH6zLi^+W~pe*CZ{P?{xe
zkH~OPu>{ZF(_q-8dvZcPSDSPe;!U!G_wN20wLO;{dB?X7&E6A<UdR%nIBNvj;gIEu
zkh^&-M&bVwgpB8^HgG$EHJTNXbQb=>u=q%tpgc<h^#7!O!D*F?=dP~zaBA@_Y4jF$
z6a+i!bf3I)X5Gs*@|SwT@MXA9gY@^wNHxJr)mTAjtl{wJ8k&8un8@Cpt)y;oPrSE)
zwmY*xrh)9Zk3CetiwkW`DGi6;dvc1{a{_*lAI7eT2VgTITwW?7l0^V%jLxQ$Z^olg
zy^ipF-DtxC7%Ya-6HQkm_!+pJ+<%5h#5IJPQ49yB5VBSr{@M8{VR3>VV~Kc`s<1<Z
zc``;WjZAtL=!#U*#Wh>PrWY6ka`_;`^?AvpL}8zzOy0*P`9p;Jx&)is!2-OOh(=55
zrui+UyKT3NbGY`?{B9qSfeb^}bXrMw^xux$-L*2sUY;1!9J>Q&xJD1jhe~k^F5bHr
z)_1f0OLme7LKG!l<h<*O)2a%e1#?*<Y1$vMw5^%NLeP<mGtiywHeG-d5Gt{q)^ahp
zcIqMd+@{g00L{K7kHU6_%HnJt4RcWmAKxP+-r+ESO2&+d%7=1>a5HBx?<fw>wTs(c
zrpqFfiz*ixZGY9beb#tLFoGJuY*$h|dTctaH9?0=C|rZxWfmy4AoV8a_5qp!;fqu;
zc(6uL#<B^#4QR?y`UtpFP?f+1og*6lY>a)n7n#kma~t}Tm~)|&L}LGe8j<LW|MDnj
z+%FMLOF`95(sylRYSHzyldnLvKA|>#z|Bd4WffYJM6EE(m~;&`ko)JBxPMC3Xz@cT
zKc6aJn#^?rbcUHh`}<>g=fx4o6y!}UV0%wf=i03xJZ(iaSB%1*+EDs4`dUIp$1-k<
zyAEN1=(tLzTzmj8kW-)lDw>2CrO>>^l_%TfPiJ@yL#UQC9;}Ru#Jmk2TVMi4;>=(8
zii4kArwCa^h=QerWUZq=pL`{39%m5nUGHip3*I6DGJ?|;;ytJ>1ZPOU7I7Y5#8Xk$
zUSAL5#G~`<cCudV^e$|vhBw4J_h|<illK?o{z+8H(i+XmrE79*aI9RwXR1eHsZ2+r
zMHDwU$|Je@qaUP&79*zdQ==a|BTI5cM-Neu?77D!cHq2@--JB{L=6R|53HZTj%!$G
z#vcb!@s6is;o!D8m%e@aPMCUhpySw@%*Og@10FGx#*j9+E^LPTMzi8aO?*x^N%M7<
zU1GSyPt^1{m^Q?bEYdh~x8MpGHF!!&ObPNI1k~^1Fgp)N)1{K>H1I{}>})6gq7IHB
z5ez18z5$Mby&($;T+WTnIi+>5F1gSa9TY?G`p_~T4UNFSyeU5}WQXxR!><EBy!A;@
zIe%hBt&LfzP)%|I5bVCCEUB3pQ>H2IqM_59o2KA%(n!5a67lUKxL|3e55Mx?cxzLL
z3}Uj&@WB=5%Yjl#4+!jg<%@L4hc|v}-G7_Mf2cyt2q~#)E`g1u0$pEtXV@EJ!m}TC
zqr;dXlJC}Xn{WXo>1b0j4hJy8iz-9^!bj66CtrtBFyw0qZ{Eykp(v@TS$?6Wpp1|f
zPqg)u=;U)oC1Ytf-ka))Ot#LZDJ#>8C}jH71#9XGE!3p)H?K|L@fb68z1tRdsa<5(
z<ps{r@RgmhCypsqf7JbFlI?fOiA~99*GMYQNF*bdTd)d`^4H@Fc>D{tl{zv#7Ux-o
zSa$fvA#1MjxZgrwyJ<Q8v76!NsIg7q?z~VVe)NoHsF`5}lmfw+nWr&VZy4<2&UJ7}
zMh%cKv@&E>_cQ%kJA!Q4hE{VgI&y<nI3C|jlU1#VmLXi-@{87@Di(^?LNQ#}vKbqu
z71EUrp_5Xvfz~mPkfdvg9i=Lq=BaAkuNVI-iI(Vx9-fPUW3p=A^KF64m)B|P&T-@2
zI+M(<v@dly969F}K(jjkEWypltip`t9V07alb>u;%P;ivz(&}>%}B{#z{?pX31Uu9
zXFOJmn(5=hNOLZtDS%;oR|x6qRyocNLQJ+%XtkNFk}MLOTG3LnZQsxf!2=A(;(R?G
z4I9lw2DI_`r(jb@3Rp0M9bYg`qBy&GT4VVVXoneQ`nniXO1xD<q4O_zD38TW%E1?i
zOEnXuD!)MaeBHf>s>1#2?PZ5`E&Op1>Ac3LB6`f|MYkyc7wLkY+Oz+&3vmmR6L%tI
zOA>QS^7%Q{@Y>+(E{+RNYoh%n#qfe`Jnw*CzG9gQ^#q}>*<2CkE(hcWmvppL_~sLZ
zq@YLg8d^<C3{;2Aw71ymDjM~A<y{k8cu^@x^<Xxi@QqP#8e|QtG%b<hPRhGhF?pah
z*0kp_62Ev=O9GrjbxHf#E*M}a>=aAcY_hKCG^Jx#(kOBGM>?$(dFIuoRi{B}ak7~p
z5^y~n0)XPjqicTIOqoOoqC0`6y_v_0;Q7^&h?4`7(~`a9`u&4)9ZRLvO1KM7t>~}a
zUAr^^LddWRv(otiL~CIM-o+*pN#c&d+WmIlku=!RE106K>c9A~#lYL}LE}Nc`~!10
z(v9NF;vW>of<v6KlusE~Gfp9S2RvZ$iwuD{KIA^_UGi?)<WEDWuJKAt=E>7AL4E=D
zub7c#cx3VfjZ{VSRSh^<$Uf6h;)&a{Tw~Evl6W%C=~l{I8mfuX8r<NKQ1}zc+se;7
z{3iS4Y*rXY(?yYqnG<5(pIUkPlS}>iHf{HH0$EG9dp$e;T%)G9-#3nH4PsbxBN4kZ
zIdL`pT9Jvb&Slc!MUoHRcT5`f7NfioiNpFzB~ULgib*kyX&NLr;^!I3q?6%hoxzo^
z*knLGTARGfjuB{_OI5ENtwTLnoph2acUR#&L^FBRUaKnSgGGSP4$#`&Y2Po$4u~XA
z$XJS&jt(Uwz5H~XbQRfTB;K@cX5|^JGr}ruE)8_AWO94aQ(qskoa8XR#G>`*%(3vH
zXq-mgjSNROUsb8>B>N!8f>o8WWY;z>Qo!w?ZcesO5AwmjznAhVCm)9<{qi_R2)%v}
zMB(jxaB4AU)#(^}DlAW9^qXK>RaH=S=F}S`w&;Kxxep(?uax+;4c{R4ulW}@Fy8zJ
zQF*?DXQZN>rZsJcq;|y!u9c%4h(9}cd}ZHyl19{30qpEuwA>RzjbeJ%h%w?w&7j<X
z`l-<uj|4|%7UDidLenndK`c@IK);1{X@=skg7KWC9fbYqLI_~v@3r^CjI0YPg3o|4
z!Hf1v4KV{rf6^4CgDyY`KENGi(Zf-VEvc%L<y{?5N46D!&XVb?lZBhOC42sx0xcMP
zrB3*ICl=awcC;5ik&7j~^_zM&Ag$|<o>jd`M{~5o#$8RyN&CE3zl$t!OsO)C*Yk)w
zlI^zN1At#0WLU4L93>IXC{e{JW#$a>CWIbufs^wXD|vC_;1%zray+oWrQ$cu!#wCT
z$y=)!x{K0Yah2b_7R?^m>sH(CPQ%5h*T?U1vcGMRd__o6BUk<<p5!m#=+IILAORMs
z;EnQ&BoZmPNT$&$))mLatS@x0(j)u30ac|WQ(J7z3^nFWxrrAoix~i#ZZS-Njxw48
z{jeVKW%f@~OW-$OidR!txK`P!_C<q9?0A2}CTGzxo)p)_`Ck$`!X5Df2W$4D&RlF;
zEAp+)af&){NIXxY_fMl&$cYS5&%s!2`B*BtT*z)=K<6-^E2D)M7e|l4v51jZg7Jbn
zF21Q`Vn{Sztsq6j1p5HtS8-J5p7Pi?!eeeW0bAs;-zDC`CEjqrbl5P5bxvUPl1lUv
z=>%&AKMyAyCMlG#TgFWTUpy5gX@fvL06BwR%$RFz%AdjTVx|Rc2c|V-=_mAk69R0`
zv-xPC$>nj_L@Gg`e_O8a*SeDJpojKj$i3PYGFFnHN0Zt#Z6w!Poyg@0hfgh8;{948
zFImzNAtlMXM0S(=X0iM-@{hs7$DKonppqriLN<fSH`F3RF<OIsqB7|~Q_hpo!rQ&c
zpI}8K)y*>lOBSS=t{hD`+XLDOaf7xM0kV=;73c4TT&DjDBz&w_+Et?x8J71Nia?VI
zrymcGrA+0J#TZt;r;}Nhsu-M&J25Ln#SFKuW2JZ|^bW(InJWgJpP5B<C8l=`7^6Ih
zOk^*uFD-W`S9+aDctw!9^`9y+sGME??q~_x68<{53g_vZd;6J@w|A;E{>^Z|!XmLb
zDy$9_2ME3IC27$`S<)o|`FFqv)I>cDvSuo=PF{c(cBzl#I6Vp33^tp<*dHndQ;ZGr
z;^rEOEHw2Vum;eDo=Om0!Z)y4#s@{I?=di@$D9b>i94ek-~e~w39obUVC{5xy~(_V
zLDu}LVSpT{8Wqh}bZM)b6mT}hrN8SNEEYd3fB+A}7>+(yyhQ<sgC{`WkoQ8R2>-)n
zD-(=a0fYLfOVg{Ekfb(p`<?CAMm@?^bGdK(@3ryLhsCDX1Qf&9LsXVEz5z=X(XrfI
zCU>6Zg7z>XU%{1lk|v`N3vUaKZp2Z?OsdgfZwxN#)*B&-qOAQ8sd{RD#XAWZgz+sH
zJ!2z044of}O8~tK@dJgBePF;WF|>sM^tdNn#w7{Gny^?|bAp2`TIM84(>k;T5W2)0
zR_^|}*d6CU&LfXi1eRs@lzkTXb$}v$<{1Y+njvT>x(*M)DVBjod&VqRf*bvW16eOx
z7Ee}#o@+|g)Y1p5iCCB^Ez7G=79LF^O9GHfPVB>d{c)m2mmp>f(|Xs>skF@;*0qIl
zos8Sraa;&nce~IyyD)+%i!{c=(`@6<iNyP}p`krQx-I}mF5sXGnnGtEF?nAd=w>^f
zT;reB#tz`V#ZOYqGC+s>+$JAglBgz;LWL1G1)_`U48Fwx-iU=0a%>3bDTf)Bk5hPt
z#+1M_cBA9qzUUdAStkmQNXUW=WiyCmLmkSmlx4#KdvR5KVzIM?e;$2Z42=iI83%m6
z(BMDDMPG<xD8Ob|j~FKl|A{18JvyPT?i6ZW6`H}!hHtX~_a{F(NB80>0!FTlAe9ou
z$~tevLCr0?a3*aod?L1_WoEH3WYXJyd*X)5^{EX(0=<Vb#{jpFF2jqJA^8Vc!(EoY
zW;)nohDuB>9*KK+6vKs}z0fD+kp{^>uo;)(4sD8M2G}4eUHSzCIpqy`$1E3#Hu)q*
zi6$%>xugzNj3M?J`+WwgREsvnEG%-3XpsK8tdBG6O>WOVpP=5hgLz?d*kGMiT1Qs<
zvfdOm3p$3uPKAZEGe2YWn4T@`p^Nnw##}hPovK|59cG0R9~?QQeINad%VV;&HM#Ke
z7`OT;lG$$m|D4h_>QE>-*jb7Ui&tigg0e9iPgZCrF`D$!sWf5dDWiOP*)WPw(#-a4
z(*i-=NZ^J#^9eRcXoC^hhqFu?Tzh_X8x*j<mi=_DkXqwg6l?F-)vmcZrmlmJl&i($
z#+yXhlDu<5F|nzTRsy0HPcy*#XVW{(9P68;k#O-fNlnA4(7>e5fOae*V+}H@=rNU3
zB1?frQhoF)vf*o$0?h(-vg2zXazdh?2kfZFZR4+%Q8QV%u^eJUhwlfoyRa-<y8Wqx
z3x*wqNsPRjE`vi1EUa~Amd+@QXYMr(yba?s;}SYuHYyhv7^9w^`OY?YR7OpRa<cYZ
z8F<OM2`JL~?gFL?E=If7#-n66@~|0Qawd7KbP{<Nrg+r#9zbM!H8YH@W$BQ{lZHJ>
z5=<D1#YY;zF6IG+CwT~q{G}U3=ui01p+EoCMYK7;guJwiuTIJPQsW8|>UB59mrh!-
zxU@76Ec}*`73_#dbukj&_j$AElnUluU`*cC%A~C{q_Z7QC7Xe(6j6H3_P)XAl}<9)
zr=ArGXLpIAaw{{SovS6tdI#X=eZtQp=jaZBSn^PJFp0|sF_TM6)5yv%bsgd{h^Re@
zOr)LZ(*+csg35CUFV?0mzg7)Dc_1ZRA~be<ZuRV!^>3)fHm(hZYkg4d?#TQqqAk;V
zC|TF`{V;3yp=0%(U58HrqA_Nb)$!Dm`Z!$#x+mXEquN3YJ>m4?JzRQ1AectZ6*cJq
zG4X;u>C!RPTRBxKeNyO#i{%(r6T@FXj+&qn?TBitoUM&&JgoN<?sIsC!7lC<Y|&ee
zx)6vV>XKn2O!eL?xJ3T*tRXpvAtJ<(&*CJR8ax|aG-ySAiqh@#E)Hhl2=&f{M<^<j
zq}8dBgteGb>~zn*k?Gh`>DbZ8+EMGAQ0bgl_0Frb`u;$+7Ok8G$mM;CO3Js8tH@LD
zL2oRV`4R{*ngwcjFjdt4F1*~JcvCl`?ZqehdvW!%x00^#ku=B!(WZw)#=E4`6N;sU
zK?+YuO^5}jOHlX7!91}i4f}q>@WL;@TKLlS#-H?hPgbGhC6(afr68t!?5%qV<?<oM
zZ`}TyKtk$+dUtL3SJ4M@X|%v!3waxcJ1l$Z!vWfSV;uuVqllg;V>#|j4NHS(mbAz5
z#vCQ$96gYWVkg%&DO23V)-g;o0Rn5u&I8oEg@=g`Ug`k2K9(4~w&RR5#om=zHv$jQ
z!$%_Wpo95Qr&9}g(D}@0(tty}VuWHAr9_ni^-68>*`k~a{kUrtl^g>-36RmWWSCIH
zIlv;UCZ9RT@bBXf{a957h%fWfZw&JWBdDSL1FRCj7gF%FVUM_W52Ep$neIFj%*ObR
zx{d9(n-n79070kWOyx428rX8?{e-}zShXw}prvsX5p#*cb!ePMUa4Uev%dV#7rDll
z(FQc#awTiQv7B#)`*s#ldt_roe<9kqZD!5Sm}~i;I3nua49_>mRPr5nCUpdz9nh|A
zzI4wbUcwb1lYgnxD9}T%s`ro{cz{E>#Xpj+=-2=82jDmVxt?g=+f4^%_#VD*O-O8~
zpWAS6ebACn#OiPOM$ON3*UIWF2qqnRaWG4)&K*?8MJgq6G4i)qc^OG`Yl;QLX4<Im
zmcf_#P*Qb<1KrR-bSOz@gjA&#pb{ktWR9h|DZ_;P4)suPN1%&%)0`$`8lz5`3b|x7
z=y-9|<9NI+BJ=yDb>sYC6WjpZT!%V{p9Nh)ff*tB>@JxKCF$sba$*mcAMrcrEQ#&L
z-?XU*J+Z<Q4wwvMTJmJU;b#iDW_!pb^{}WW_<`ZBAjM%ay~)pz@V?&}p}UXLw0uZA
zHlrLrKbe%olD4rm_)qDa>5i*mMD6!(+>0(f@ivDwefo;$HT06QV@F@kTK;$QH`GkH
z`~Dc_D-Se3tRF5~p&Ho$1pnqSF*NOOa^=_GC*Y^-^ARsmelt#7O$VgLtvx?Z#3*5j
zxPbn12n%`YES~3kX0rIWD`R>mH5QfC;SfuAIY+T@bf9i-k9nF5aOnxad6w9J23yFJ
ztLKU*MZcBsQI>d<yJA{w(n`3v8eRE!(SV&q`XyaYsXDllHi~Sx`za+FRzyZX7KH#e
z#6j(NS@L1p0GbIxw3`+TqsA}({V(PyXn{(QV5+;9C8k+J)ecOk#>=9g{t^_b6-R<{
z;?^Fpr=5mNN;S5iQl#UytLQG#DM{8(54xBwf=Objq*&iaMQB<s0R`mCua?0dZ+^nR
z7da4o8TEJ?b@?La`Yh)hLuJ<qNgKbCBKZ?DG1{7Rl;<eqkh)}=Bk8PuJtTNxd_AcY
zUcXxpAo@OkGcx?<P#1*eyDg>*km_NGmBt1CxFxH~=+ZpWj)iqpJ91XnZeFD>3HciK
zd4eL1By_!98E5wgtdvLv6V#>0uQ|Bw-UO)Eixt>_XI*SaS!K^|Sh<ewJ%jPA>#49h
zmT|p>iP_Ow%~>=i`bF=I$f9y>ieib3f3U}*=8|Gb7#MH=!{Oo6$}HK9u%v~zbord7
z?T>woOmFJW$T;8eX~1}@Nu4Z>WwLUUY)qb;MlQ%A0c1f+Ho7TW24m}yJ8u@J86hL1
z$icTzoTL`4%GrT^AV68PR;6K@SCV`ZloH2~IViA#I?~wh*QMy;97*IG`K9g?fBa{h
z_7}a~W9<E7J8KAn2%DtA>9FenGVGa6k)(Br9AF&6y-vT7e@RGpelTG6^0>RPkd9n3
zaFY)ys%Y2{t43ue;5ylLnv*=k(^AvHnyyKs6(@$(iu<fZ>MX{FZBYxG^@AXmhferP
zA4w>HEZA2TtuL@8k5sfbL5up*HT6cg?kc5GqRJw(CwTB45eHYNdD(c1LKX>$IM;9=
zsR4+{wuMe%-jko=8(dPWGve~gFCV^R@`i!xSrbDccBVg%4YxC7-1$q!9wO)nHSr83
z`5;;DX0*s_0o$amU!_VRQd&Jn;!D~NIt55GL@GR@ONI_Mfieo>{p4iHWa2tV05C<e
zs(|b@ctf4;kW#{GIZu>pQH<9vg&Z#qYV;4B=|Lh#b13~*Ua7Ptm2fVxw0YUGu54r-
z+~Y})rn3nqPhRKDuAniY3B!{*>&%{LYC^PzpO2r$a$nl-gX9tODt2_Tvl{}Z`-|b;
zx;H-y_M6QbVuC@QCUKKQVssJXy*lEt?{WfkS+PZ7(gvttn0@l#Xi~kK;-k;S+w8$b
zun4lRGgVJJ*z?XkEdZHnv}#-pLNHznxlp>kNgvdj?@pNh<Ebn(R^MDd@sykD6_9aB
z9=pb{FFo~itQ~ATh_)VQ`1jkMx;5rlOtx-QZ{n8+uEwiPZJcjM7S}^0E;&6VzOcZ5
z$m}ZWnY2+tl1*spJjW#t>KTU!QQpgrrkd)0AbqIH2k~bbaXdZL5w{}?e)2i$ZgN-B
zL&vLR3$(-&wb6ALy@#k|w=6VB8oA;j8bd6}<O<g@B0PX$%^MSA@LzewMHZSdr$xrG
zG6kE^)49~1l~+`AbjtW__rep_%cKw7jMDH8aDM`}(V-k^M;Hr<%x|nMC;+hQUuDA=
zVXA9d46-pj0|RSHLjRu&kRhGO09aH+GbC)R579M3^=ar%gDudGVEA%BdS%8aq>faV
z8*t&*9JZEMw_64$-|?p<X6($j-OHbzk%z=0tS1ON9!GmwP}g{UP@1qyPjy|g%o=2&
zA{uoeg0bOG1rf{Lmyvc>#e+BWSsrQRdQ~z=!G0G~Y@&x^$;7e_)wGrpA~5Be<BY2P
zNg5|b1Hb=R=d46VDXA;-E{PUI5;dvEhOjSt+ScG8$&Vx?Tp~)g${Vv^!=Nly*TBv*
zr&3m(52=0O4^E7G@-zeO%o;VP%sf$IHnf-?7M;9DKi9eR#+>(_zdmPj5E*27nO%|@
z5V+r?MI-*@nfOQ2iO%bi&4S!)s~aBsa3rf)gH~zArzEym+`>e_P=zC-A$ep)Ub5p_
zVKWnNf@qf$%HKK>5yiH92S>s1c|}DRUus6uid2_ks2UB*zw^p#7277YP^%e{b`3Dp
z1VyJ|V*P3JIJ6vfq<!=Fpzbh>epOREuPrN^sO8m0l2~VJZ9wb6<Er0RK)0hXm-<4+
zr4+U)_nSq>^Qa42bnA*bX{9=DCbhrC6O;wsTLOmB&^j#rI1&9X!{JZ#j-vQ^0KHy-
zULILy9(iJy%WdN{u2~Q-#1(>Sc0Y40J|wl6LXtNSwYq3W9S4qps7ax@V9eQ?F8Q~^
z=LnCRIb8e4{xxP`*RyxG`oXy)offl8g(Sef4e_mNxtSaVR_k*!=Wi1!za{aFfAE%M
zMaQA@Z0PRrdW2H_tUg7@;?rO-z?Q>DH#`#7^t!KD2{%?Bhq|a}#55%`wuo*9hbfvR
z4~Ihtzwep^&YheNe|qrF+C!R6c-l_N%S{K~<8dd<CoV!hqWy4!Cg9zR-aA`lU*-Wd
zz#=e#@mx@kWuZaJ&a$x_0z_z$gpI~M-ILVTmH$2S%o6*T2*3i}Vdau3B*aVrl1U0b
zO{Q+68_ddh6|)$nq8Wizf<);Cu_!1BioaAKQBofgCCO-_9Nmni)8ndK*;8mM#1jzR
z8P=UHvkg0)aUr$Tl1>3R=R1zAg;5E~m7kC#z)TiJfe2!O#=l*B>2-jm>#uDgulpT1
z7Xe+QhqCA-b)mR|+Z*JCP*svS7XpBP+vG|=S!X`$X{%|?_%9*T4(1BDSMSx?nwZ6q
zS!#)ES!!y@EKxw(8rXYbo5c-&Qr5D>Cf5uvfu*=|K@`Om+KDBOGY9~wrLfO)w`2t9
znphSTYU=niA96ZH?wn;0W*DXTec!*>anTWndS>rDaXg;-ZhKLKH>U1gif_qvd^Zo}
zmyGM2i1#@v;}teq49`SHFs%7wa<Q2_xEn@R#66r@kMGH6*FUTKOO~YFCbv|kuPX`f
zdkKzua3|Z=Q!eREsjEOU3ZWQMEJPc|7YC2=kZi-nBRVqK792H_I0n{b-;v&_sn1M7
zFiRa`7dq@us2%b}(~180J1U8xhe89T_FY1D)GnC`tDMFc#_`y@H^~f}m+waGKJ^3L
ztwb#<U_y4njzOMlBGhmDA9Gxv@vn+G#4^a|E0)X_|F{vnSl{1NePQ5Mvv@Lw>t6jd
zD{FcYFgEo~h1=O*j$cRM-l?M}Wo!ekV_jp|auX*_ftkspwfWbkOnh@TQ9AsKmB6#y
z%Cb^ba{{t0h^anbk)CYc{Ne{d6_26m@p_EicvK2?zrD^`naqk-NP1n0y;j5BC<hGg
zBm>b9M;m^3O}3_GEagZ8wixbLLNIad`u^sh1k%kxQsXM|)y3bKmgL6YL(hp->0^YX
zvSH5&+!&@y#rjx;A{>?6bcv^>+v!V&HGd^IOP;bD`CD!r^_SQW<ww~QlDy0>Pu1E6
z>$>TQr>8#RfC(z9^ulW4&9F;X3%-aGLzR*$k+5~bC-~)elB}(0yLF<-Vo4;jHC5?~
zR%LIsk+ErE7N(M;JabhSJF#lNcymfEI=ptE(-Hq@Biyd+A($0}KrspGKChw_LgMeP
zx#ohR>+R`~1>DDw6=oEIOtI!^`lTg(AO6PVLSzyJ*=-#3)ivE3<)-!>^{q%*BVn}c
zPqVuCXpc#^@Aq3qfeTixj=UIR9>9}F(WjUuK!2hZy(Z2s-s-a**K$qX?c%EL%$O^(
zVTdlnPy<W3@ehgqEGX8M5rOgn$|9YDqj*Y=tIW<jy}n%wVN#S-$^_O|bm|nb7TC)x
zGLjaP=HTGVsYcJFkW=Unk7l{+vNc6J4`x`A)GA>bw;U%f+FY5kcB|s=d>4G_IGn%<
zxHA-fLOVOOI~+D_b*5z`E;S_Aa>}d^8tiq1^zvD>`v6_<K;$T(V?qvw2e=~XOtnOL
zqC}#v5R@`1MrOq+Z4^U^w&Avi?&vFeRUXmSaGlCf^6=t)Mb^E{k~DM|O_qTZN`5>)
zfP&%55^MXXJSJPCZT7yu2R3%=dwlLRRtWwOUuFDuhA9<>eSw)A^|OT%v=)x=Z%re&
z6fN_ughFMFkRtyW9+>A(M*(h1Q9SruDrJq7+?rZ``Neq-+{BuxHlj^7<_ez|@Di|S
zBq9L;63FOgKLBqq_+(N5YJn{(9{P0%&n1x4i4A#eZKnhJ>en#AgCqX#;nZT|LA~$e
zIU_UHCEjjg$dx={H}9v?=qr+wMj!(Z+>R`{1D8A(A^Xt3@3$xFv8)CQ(p^M)=!;ql
zQgAR@cn--X$jNcR@p#+?rtw5<r%4vvQb3fVta&WbkT`O>>lbWps>onnG*w!O3_yT|
zg&G~<(kFH9e?dcq;=Hd0!pQnSLpVD?3h?zulIf+S&X*wDPHb52ElB`8exHUkc?tca
zJ9AawnIuS_6YN|0`H$wK4ZN{!aNjv<Q-D3GsCRD+A?Y{kQa6z0pd}=awdm07=kR3y
zZv)GPyLoy;zOIY1ZgQ~3U5;?3e@tB}ej$Us*Z%fsBOFbM1pG4U?CG4k2W=NSRh{)f
zppUGU!Sl!ASY)x#$?rc?HZeNah1J8AVfFdLYyP{FELkLUX*$GxmdiA+bKKXCtKaNx
zGjYh6H2jEQ0-p5uto!LrEYE^+TAXJMGUAj3N-?E`;zm>Z4mWZC99zU%=$Aw~Xp@Yb
z<w}M|=+2_hGDIn2;RQ0>iP#gQ3Vl31gd!WTRK%@nP9jp#wk%Dk)i`Le$XG$F8RLZ}
z9NC3^ZS0mpxtkew{59!#CxZf}`K#Xavd);yiL<ZI@;Tl)T!gTk^_lEWrd~3fIqAe_
z9jo$fx*gdlewbUptS^FT?t7QkjlLE<{?;J?9ZCwG9Fqqs0o_O@l1_7safW;BCNcna
zMzE&y*60uE2YPDPSK{kyr995Q;Yb#6QPG7w@;pX=OC;<;uvnkf`S2(0iaBK0EQ&Y*
zls~UBb2B~SIR*k9r=>LiF1N<wHq`@;7%WT8Mbr7J+Xu9UrR!vHy0RehPQ19F-q`pL
ztcP1iD%R&C=i5*x@82iyqcgD0gmQty)TtQ8RBppFPf?r-xdtFvzjq!e<5sr_WLSh(
z9D=RhEl?>U<sT~xjB_nDu1oV!tBbN{i)3d6YM9X&*ewc|XUj32z7SnfxnKZBMz~iW
zmyYmswc`4(Gi(FKMQ9J`WrLj1M*NS&WW|2k+CmF(kv|Ye{t|<K?q{PiK+G#}^wu-o
zy<w*bB8isjcZrOY!}Eb*x6l!!(yR%vm_fsM6Uq{|;fQ8Y-Xa4#Rn_59S)fb8Fcb9R
zqvSv2A%B(SnO!9C$G*eE#{T(9;9LrFEDStzXR6LglsGF+2QoTo0O5tHZ5CO8^bE+-
z)urf9(1d9JWfqq7)SPWFU+h%|zcux}Yo%QclbHA%<qW8D;k$A|a;mHwd}UFhrPv|@
z!|o;do&XV)k2^Yxqk7yb^%s$gkR^icnV#+ClS9v`mg~J?g7!Zela_giEY3PkjV~rY
zoA01}nQzYTm_PzWgT<M7;vA)r0wn-nW_a%wLxDa`AA@FrkU|fUeF}g3WiX^DW4=1^
zf-~Dt0<xn!L!Yd*KEz#@z*m68ft<0`EWWtwWa&d@iY~I)4@lO?Ap>DL4Q`fHRmGDf
z>Jq*1FXiVqa#R}!|0oJq<w}J2ckmVdcyJLWY(>3367gzLUjG4yUD#A9LnW1sUkO7v
zJrK23!-}tI5nQDxg@#m`#uHg|SA4qbS6>`QhG(RsmJ07eCB_vC8SkBZBsUJkAw(@<
zst%<vl}IE*r^ZA1T_I0L(pf3M>1@+U&@1wtgP$k}9!)9%b>gQGAQUm?^E3QjKmhHe
z&MMss&OxP%SDS`n8Ph3o$-(s?m#7=LZ}t5gON@|Fg7d#io!TC*IPDq=)=1@qKtP}C
zEd0Fo1y~VeV~1yi8bri#uTI2HArE5PsX$}IEG+H{Y8^h9y9P4UGN;;PVWg)=#Smm{
zC0{pMZV>z>8d9aUqi`{4T_u$QDP}{tBc?o?8VCycl8yMU2|ms#xWB$OB08WEZAagc
zx*qrV>ISIrk1Z}WIG8hzof$FFUr>8Wl2)F=$*r<UMQ^BNaRSS**jLx+EPzd3Zqh*4
zP#|Q_)-`m*ZEXC(&hYH?z~|6+o)TR0`Np-PZ1%TdqjBUTFDDV7I2rA>09KISV(7Iu
zW~8?yf;kz>KE;;yd(XCMufZeHhxVh;7Nb}6Wo<xcV9#Ij_qltl%)Wq-YC~V$2Ozbl
zutCCMt#TeKW>L_ac!hdcO*6iNqeGsH?+-_#@}<Wfe^Weoqz*e(bjq)T^a8M1R{Pc#
zs*(kvV)r3L;wZ;-=%?1jDs%4a)k62&<KiTANBRRJXaf;z@l;HA-WOY@2m^osIv)r4
z7@J-P;El#P8i(k2$`Akkt;flhgsWUa(!;Iq9r^s#C4BY2FS7>nd4)%z*Iv6-X`~ST
zl2>RC@a@AEh)4KLRH+@S7M#9+*B{tv063{&lV{q{4e=>4n!>}0qY^yfpY}!1);^vm
z?@nvBp&7-%V;5H8J)7%w$7gbKf~z}m#5E-8?BMkfWcuLIg{O-J@E24ChCB=|xJ5LY
zSt3j2!~e0J9fhUaZP%0be>FzBY92P|81x4*UT#b+^m=IfthO(&3?%K!;NbE$kIW2F
zSi{8__E@ZSjk?@%Zed#Vs?d~6VV>I?nz}?2KFvJy9<yD<{XoZ=rw}*${`opR1Mm+f
zC^nxP$2;RxiWVf<(;BP=k0+BOko|+OTaf?z0%uO+iM!Q$Lnh~U?_}4TRwv^bp5E?z
z=w8jAx%F7z{sx1Y{feC!KT<w$aMxcEzxM2S_j>GYJ=L8{Cw)9H<E;0@*?0ek$#MjZ
z9ZcTtN#3>Vu3Q8i65tVBlPNSE{W~K)ALxTsUz_lFS%y927ug12?A*d*SPZ%gPGP4q
zI=m<!NQFhl;4MRoqG1|n?EK@0p!rvYKbRg^)5LzN!As4-$nk!{-8|d#wKv|&_Fj9U
zU4!$pyt5a29J@?7;rF{ad3jn@%6>XHN$39vr+xJJ%{kt)r-k!jDY&%WmS1$3^|&Dz
zKt%fFeR9X_T!IewLM0M#-v&bgND7-saD~)?by@)E{9+0>;^G8@*LYWXxc=%w9riX=
zYTFp;6K(Hxlt@Xl;1N3*J*^@PcW0Z~tKwZ*OMtLGmOaBzr<;vVp<X!7LPbA#r0b}m
z^h;i~c1NH!YoJeYP`-%XP+Yc$OXi*=&ejWh`lA%|teY%h)IH0A0Bi=MH1PJA>B_@p
zBHy^6pNvC#fjOAE7nM=@${a8vg=#@mqhgPx>;}bdnTANwu?i1K=oorE)_AP8IwLq2
zQ(d1|U97NE*_)k2HIUFiCXCj0n<N<8=Vm?u{LP5f89lAhoH3{_W#2@<GA)m;v?e?@
zeS<q(*@P@<+f#WF?<4J+!mGwR=WE}B%5@yK%D>!&1kl?YZO2*LRI}Y)*ZTE#z+&J0
zh~!#?S1Ht{eW;J#&oegb>e~u!uR-KY6jSuVub3`JHm}CKSj}ZO=yB;$+1JT{k;4vD
z1+vbDKaDU&*-iRJc)#to*OoS?ym=i=@0Ggvn+u|k?L88{Jrb8+g=q;snyK+y*KZ83
zoZdT4uA=dc-Lrfh56ouW@A<v*RPQSOu7He{&jU8ci!b*?y%J~CjF3Wih(N7H<cg^E
zKZAcpSXRLoCwY&9l5`o!>L@;e;exl-PXW4_Lse9TNwa+6m(j5LBe<)T&{)W)Q9@qz
z!W~@k$nCBBmL#+M`0$A%q?3Rcd8sm{+q9OVJ1tjS4ftfk&G!JVZyTuzC`(`@buiDY
z4<qu#9OJpzE#F+SLCa1uauv07LoN)uejgY#L63ZTPx!!oK3<elAv3R?It+c{A6OQr
z;*8T!#dPW~gZ3M3O$`ke9@jNck}yR{Myldt?#t3ZJjpbi|Mj!QeZ0LTsM6jbLw$ZI
z1#CsLmX(pS^=tl>z-nKIv$`OQ(*cfu&f^CwR*JJn0KN6$`N3KDMoxBHa`TOci`8bt
zILqUYW<=3lhc&nyqlR48zkS0xh^;O`-xv?;y>kQgUQlu0|54&>YK)>?o|1hW13bG?
z1J@C!w4*e(FUZwOw9)3tl_T!5AX63Bx-)tp(e=uHr+6~RZ}Zd%#;huRw`3svOm3!7
zGRz;*@8N)!Uo;TSdO0h@+ko|O{n0R|oQ){tel8>F>+h6qI}F6CjI6Jt^TCK#SVSge
zwZU^pXzH476TlErM4pd(ga6Fd&;4%9ulY#n;Pr$O=UdHA)r)@nd6e>nUtu=6uS5!y
zOn>|Y;n9%#pUhexiB7hkrjk*(Gka0w1$3cY%*xBA&$RMf-BEuRkDLQzPe)9W<luAJ
zszAPU5UN(&DrIIap3iM!i$bb^pU@}4RX5}J_9Ssmhid5}Z&c|PRIkLNg@QqJ;QSuZ
zu>Csb2rc_;{@2Le=3XH#F<9zPS+T+RV1~W1FKZbct-*8u7&FzEfBkf?RWw){vbA61
zn^+vMeQL?c(&<kr!YRXYXDh7;2?e8;;k0nJG{jXtDN*fnbM!BQ$6slz4!Aiu>+|Mr
z2r_!gf;hF8IQ^BN%WJ=x&URYSU~@a4tkNhOERCeN-zm~pnaZ1D&ml5qS_%G&eO0$Q
zxU|$3r?<vB+ldVp&S~*s+|s?F+A`{i3N+aJEBcK@J@B1Z`}K)md#f)uU({$QfAiwk
z-42<GCOD0RE_E=f8y)=;^>;fh0EJ(MqfR>c2!bmgEeT#vv#j|~(~NRFT!oVzHoEU$
zF5{@;O~d=l_mD9h;;5Fh<Qlj+Hx|LMU~Ma$Ru1!p-)h2PjaQ`$temwK!J)7IiW7{M
zG7v4qIXlQP*ev|J$$9lX!wq<gGX?IcjiLP`(LDpz1toK6YQ&Z1un?Dn4DPp0s2t|N
zwz4Yi_Kt)f@+z;gTVOlxe7vxjVCZY28WAYdR`pxLL%^P>xS5fiw~e|$g&j3TkKF=Z
z$%@g{rF^0bn6?C?hb<pfAKPZam?f=U_eqFuK$xZf5_*um3j|>7AZ#DrZKX|@$%(Z;
z<6xIE>_w33vRH6!6pR6<hC^*Qd!@ORcwA5?9#`zInpc{jZY!(5+^)|AL77hzU{`uO
zGZ!^X4Mf5sAYBb*VMDlW7`I}Z7Uzccgrb2Zk=4qd%x`NGnXPD$35bH$YnwX?U%tB<
zzh~#9f6#m#4NPXO^$EGT**vJO{`!~DoAqDrtM%h$(J=7oy4c|q2X-(e)9y%H`krm&
zII8ue+5^)m`bzDWs{r#ir6KZVHqR<HpB^#(t6VLW>r(EnOs#1!{Znql0}*on*SB=n
zy@#3QKD5i{=jBj##LsTuGlsYfavSrZIKQPjeDp8X<{Jds<g`8W_o`npe5LowL~>xg
zxqCg7d*9-1KS~g6pV66Afe_H^CVGIR3_`{S<xB3U@4mD<TN%I7(7u*#!gF$0gDLSY
zCNdam$%T8%#vBAO85P=0;4|F^L50~t91{YcvWzFMBvcm2Fu&|a7P8F;9~FN7Ef*_I
z_6H_Nu?ExB7B&b*42hDkg_QT1fsgk);T#fUD0v%q92qF{i~Bf3g;kn3MRR!KsG9-t
z91=lMhLt@AolUEWJ;uJ~GFj{xIh!!-!4@VWVTJ=>I;BXU3|pI{xgjSr?C*F}D(9H?
z?;0?H748BXV_z)m{`u~@mH~g@LiOudmbG`MGG5}f3|UoGtljO{mP=7~5P?!gtB4!J
zk3ge4yu;e349E{YEux?iFPcXV9&82ZfFi}oK3v}BBJS{HC__`d+X$C}+DS-WC5M(n
zoiBkk4DFlCYj5LC=hm&?SetdeALev_^Xo7n{5r7(ezNCD_S;~+-r}@{sq1~=cl31<
z4fJdLGSww1^pkNM!s5LqBbpD@S&asQc#o&?B)Q%q?<L>Rk2p^XVX?=u@oNkCz-*M?
z(+&uyxfq#Xvp|(&k_9nlo9qZuq?@xAuMqks{=?W2e<4zOFMfMnNp$l+54PHd)hqa{
zV$)dqRu2q^T18eH6Dx7zIR~&{rWGjmSX_|>gU`M87yT&=&4xbiApPk;)cik-nz_m^
zF<hZL><F^m^%~Ku{G}Db;ZjwZ#=4_F!31S1Fi%R1cBcB`%;mT#uG*Wje(n<ne*P0k
zLVC0q1$%K~sApb2;|*%VA+A9H8x8^n{}CdXUeB@qoW5uO$?<y2OVU0c3m8C1L}2m|
zHSgcO_dzJwrF;+F@1{%=Ubpv1dLI1=Ph0thf(&x8h#{Yz-;;hFKe>-jR-50S=v)2O
za(%9yQ0!{Svpu!TRMQ;v?;HII++)3_`_q?nv*d6Pypa9mvuV|<*N|Di@#xvxaiaHL
zdqs^A_|Btn`5sBwle&Jbh#Tnb4}aN3p0^1nxH`zzLW8ZZmB__gy)*I0i(C!YJ0XB6
zs=K0iCb9rPp%_ZW@tK0I$V#49;@AZMhMpmc{F+GyigFKTB`(&AVo_F)`;{PX_h|Nx
ziV<A}@%jV%66khWX7-jYrh*y{=ZekT>^%j)$>Pe6%!QoiA>La+Sx=|G#K1no&7M2i
zk@ITLPPs#i>Zp9pY}CBHZ3aMH31gr!eu;T`I1g4<W<Il!H|3mjKv}fM=3=WY$ejDP
zCP#N>rZ3KEjkW0P_}jQQ?So{C#VgL5aJU>!{bgVw0vZ1ck;d`4Lp&`=3(e*I<lK+E
zeivj6p1}aqg6TGYqwlaL^WB7R<TQ3htyE`av~)(%e_>XH^d+w{zu0`-jH8#J59ZTe
zPv&k}LBdJ-;pM@9!R0XB#c}5IWXt*Ce?X$;1bVXf*l4oLlJVpF1WvD|Z}#QE_k*tL
zyuV$%LVx;<A3lA!-fWG$t+*QY?f3`$+x{Hz;Q)Q#*5%zq)anMlD9Aw8`!a8~APG5>
zRNH7I$iQ7(f@UTZOA>5PHAC4%ptL?*-LTIG#jjRBLurHw!x5kEjs9mSKf*0WEEJ9c
z<ERnF#ZFBy8EFj?e9&&-Pl~)_Lcs*$A~cKI9NtFM$xB*zbiAs+Q;ItIpqi$IXlMv8
zr3;cngO#lgcnQnr2&@hloP3NiId4`o)3*A@!2woSZr5S2G`*1HOmNqm;=XU(BC6=b
zt3Vw;<ONC<7Ke}uiLu%d1u?ZBPfms7iO|!>?$Q$>2I~5<b1wd5cU2<fT;g)JG8J}p
zY}os_Dd{gdoYDxhw(~0IL_E#x?2OKQS{QF#aIsQDX+~n?6RuCeuNJj>W?tjx{P6F!
zS)1gSzI1k+>B`Y~#IeTh{oT>J#J6-GUJ=KzJj7qUxt~M$^`JZ3c*mf1Df6LEP}k{!
z#c^44cvW`o@vS-pNcxL2wV_3UZjT^H*oXoRcV21&zp4<do}zXlwvPansY^S_!79;g
zdj^mQbML87a{bo|>9)&(h>Wt5Swf~9rv)O;YPRPYi#BPZxm{IZM22DjNqpikUii#t
z|38nKoLKnE2_~EETL{EF)Z!GZ&zif*%E;SNmIy$bi-v^=apL&PL{5(t>0$lqkm%Mc
zhKg343KW6^-(93|*y>Aj#i#dg3zRv5d#7CQPq9;j8jk~f$Oy=9Pnu<0>VM{6Y0Ccc
z{@Z3%M|kzd2ofd6$8b=h!s6z1uT{mK)Lmkc$Z4f1TRxGat1*A>^ilq>#kAhs98Up5
zE7CKV%g>0EZFc4#i{b!v+p<TceKV5+f7pJ}$}!fQz?V+Vv1QyF5AMlH?u)oV6ge2H
zZgqY?VfORC!-4n+lwR+-vDce8)~oYu<9$)bfQ)Y6{Bm})R?Jzo{?DrYMbI)1&NdFz
z&;J{^ETvCjV~K!_5GihEwefAVrf0SyN`9eM{-%cZi!6a&`nn-$S9{mbM;xMBVJCLl
z#`aiqHwMM^*66Yt$o$;M3PlDxb(yVp5WL}Jr^Z=c^UX|N4dp)+XRM2^^sd6<V5M$~
zo4k0(Vf&31K{_r+P4`ba($*efShjbkv(SOqZSe!@8Rt=-^*;nT_<nRYXFQ6lk7G@r
zcUIHez>mI0cIx`@(I=FgG@YqR`xCy>f;_n}lpO74n~Kkbe6<aE8aMWtKg+U0i)3hU
z7hUX(vC9v%*gFcMA*xV@v%uL?k#@|ZcEiQl7me?oIzC=)qW%8a3O7Y|bRVfzILC5r
za78BQyrVUNf9all>u1lOhX5y9_a=DrL9Lu&&5f9E36~>+kRIaG0lh5LPMHx^$o$@o
zDV?S6-wtcW|G^?iFmW?z5hqLAU!($!+M__R#|D7e1{ZE$wXF`?AmBGw&-;8_e{Qsf
zI~Oe3fX`4RnIv0t+nfavniV#r@l6|3X*$2NE}Y(;QMy)K?Mw2~qSK#M8k*W~*0Z%6
ziVSvp^DQWf%<IFrh?{%%Us(TH^vlHu|Neh2z#}E-chKgPu!EZ-{0?1rXfb(c|8BxH
z-|0bHrt$LlE!e7z08vCOaDLqOG)qo*Ndnx7Q&xk$WG<nmz;$Tl(}U1zRd&G3-cpcg
z`=w=kq~1y<pjMS~)h^Sr+On)R3;&DO?k0VWN!IzNIS055W8KMH2)bPP0|7ZmAI`}!
zJOw&o4TuHk2rrNb&h!lo&99ek>t$B0GmJS90bs8IS^1D*`|*EADqp+joWm)$;Q%X@
z<LHq9C4M@ZW8oG4H`kqUk2}Qxfjwz+hcBgjNq*CSp~g0Bfg<y}=CF#<nq4RhL8iLq
z@Nrnzlg#FrkOpN^Mx*O{jW^9T9{oP)O7`*1uiwJ;$^bC!?+qyWrFWW()hriyssZEl
z#sr$8JP)JsJvuz}RcyZMZApmHhG?2&{j@7$4c3#x2;9I|XnPmg9EFB(7)r<hMz}C$
z;SG+r+W-D?8-zWWdXel}+3(I5CBnD}vG<69X0a%1cs6Jpl{JKUAQH<AlVIm*sYo0R
zn}EQj!~CUg@Xf+-g4mxnVHuNtET~fz^DWLkskwx+ma04>e?>Xdbqon)dLon(_exp6
zZ>2_oxc;8hfc8@?L_|lvgQW{xB#-|J5Nctd(-VCd;%c=bf;%BIu%5twyq%vS^?6$P
ze+4k0*h_!X5(XiQ-Hw;XNsyVN4@V~NsMSOpeNV7^w9juxmrg``T2I>z6uFMtais~P
zyATjM3H%7_H`H)9?6P8h7tN91MoZoWIq#9u!tdkNLp&-O2+}w6XJM~>8#L6nH!2+(
z9Hf>{*zNh}@gJ6mxda||ARm@8{+oW&!d3QKJ;l|FoO#jtBqu~{|2>X>2vg+h2E*Z<
zfq1%429o4z5K6+^R;$|%$CoYPv%5AP5exLZ^@iJeJAJ&z5TPe0O2a}8Qj6SPT?kv`
zP6-6OtUeVd59MATy>Hw?K4b{ev<!JQX||Zi??um#zvIRKFksiW$l6U8VaQ{};bmj-
zIPf}exQzSuL}eg@QXg~0hA*uk%sO`Ck1LqqGFdIfJ=6nI(a%9tSUgh6r+b-V;U-eq
zZl^I%4%5xo)wEX2M_vGMIe8c*`+EdgXtDI^cUlSEVIRmV<iyCzc7=W%t#LxS+0P#~
zPhZoW^JMvc!|!N-B(~dR<A=8VoFSbL*8;W(`%Z<GDuPw_p`VLDr~^N;t+rvO#CyA~
z7|U@<@Wjci4A3<mL^csDK>h2H2cLHUe5;q;OE38!c%e>2|7)x0j}wJzzQg>(Ibyv%
zCu*n!A!P$}1`~M3r4Ryym$5neh%@iwFo2*FFWMXsc^qVTS-s!g?a5zUvD*M+#-l-0
z4>SAS@4d0N*j$c?=J`@33!XSvY=Dg>fH>isXs^kC-}xLt0cupf+QUbDhDWpDf?|)5
z$aR33jey5RPLRkFa+X^9qh{8Z;tPR<2q*MJkj23c;Ev*Td^!AYB~D4B#lk<<yl4Tg
zOyxqcVs$qpM2XP+D+p5f_ZtIctwY^1BIF(lI*O2|#o%RQaKFDn1{FZGA`l1_WmHv1
zP6~zijDV6X^$XF|=umhhUAwP;Jh&-2Ps}H%0n&B#kO6Z4JST{cnZGT_>hE+nO3d?I
z5_)9|+`$A$VD$-c2)Uo;{NIP9iH#G16A6wmu@8O`5ElXk2+%B^`Dj6hu~yL>IL@(m
z!f}6pYhCz<$XH{PCVa$}mFdq@F5g6#f6pfi#ry$~*$zaDgIg*ie$V>3;BxQI>avve
z*P+!vq(<w5SDY+DmsU6^7ARz|k5#o}IuapvR(UTK8XNCmSP;@Lq1(v7lq@#xu{ejM
zj0$xu35XOr@pQGJsPK6nF7|<c7o8|O`F&bZvn(m45#h~45ac_R2~X%x66yp~!bWp}
z7gZ>zY<`l}WV&QRd}#QA(f74Ec=D?vuINjQmymV}WGlhECOKBDW>co@lk5Unkt7h8
zKlrmzsIboumI5VFu2p{L8N2^!@2Vc!3YtBo!QI{6o#L*gP_$@pD=F^oE`ef2iWVpo
zE$;3`ilw+y+=5%a^nUm8{t5TI?89bvY<GS$lXG?p6r(i?s6`M=4nQ06zRO<>Tk;Pg
z(_O7(ilfBg*YujiA5G!y)w0L`$u4rApQvl81MshY5#^u#&<nY2y0qugJ({kN%VD0b
z#=wO65637!k4Q$gmul?+hoWh^mCmcn3G({vj@c-=_$cv;B3#hd+g|uiO+5Lin%~pN
z5*KgXs51T`S2pSXS4;JF_Wcr`P0DJsx1uXpT-e^X-(MotSSW6>0I#{I$Lnp7=GY`h
zSH>6K1OYxijomU!2b<GK`&Y(3bql#I3rPN<22nS&`c#rF6Hrz9H6+f1z3cX}5IA5<
z!@*C5pBF*id`!VCvvFgpyitNognCMU9b@Qpgf5_xNv}&u3>fKAOXv={)a!*@AC`nm
zE32&>OkdYKpO`CYVWjHoyY)^PjWpr>e5iY2c&Lt}P7LM@__n!oMVN#_M``tbb02k+
zVB@BExIt*1p?bCc(i^&Jd|GBgfHH%y)l*S!F-;${skNm^LGf0IGqXp8B{elhhA@Jm
zyx`~%w!W4%tgN*b{Itl($he7`IlsVegjbG~B9EJ{<J4e6OjKc@NIM$kGFrG$(b%L1
z(yMILHh!Mp3e{%2mXU2GQb9#SYdwo+Oa|4rFRo@yoq-o8PHk%z7Z<;Now$AW3p8Ec
zvfUfC-Sa(j$M*RlbA|iTa_?up*XGUZb{))X;tvSdr|B)&A!y;eXXQ5YH)y;syz$30
za>snVklSN(U`W~^g%Z2Od8IKfyRNRdpZ+1_izgDiVN@_q5HZ$P!^<>^H7!q%Q7cEk
z2bnl9ZE24OG7Br(vkjK%73sUN{i#44C{43C-*dy%5RK*d4E9NAo~nL6*gq$c19(s&
z0nzazrqipowoV_Y(gM&K^g9#fKsYkul{&**Uqc2FT$ETs|Jb4<;=X)+lPZ%oBn8yL
z*?j*U<xV4{zQ^(;=hG`q^H)PPz9{-qwK)3UY>UCdG@aU$#p`VWm@4CXHpr#BmgbkD
zm<EB^&-#Ch&Xxig8A<55OH{rG%z`4y?n@vHPC$8mzcR!6YU<9}AGpn3n4Pm6axY8b
zo$p2-w801IA0qCsY*hXjB(+@O4^(p~on4p2sPV|wq(S#{yr@-|+^M%uppQ<Eo{SOH
z?10Qq7r9$l;j5<I@-rG+rOMt#q;lRZ*iCfU1U+Q560lqVe$zR^uZ8mLF!oBsO-uwk
z#9`O{km*1@fcdAfZr8zz*Q9BtF@MyB%#R$wTAr|xF_-t24rmW7ndX`fqR2HrhC&+1
zuhf1hS{iX#Ha1RIRw=zZL>l-e=v9&_<T{$TpROHkx^!8c5ldh5QI2DD7L?G0>w2L0
zk7tiV-vN6JyzW8(8pSwXdo^iYxuPkY`<$*z$l-~wwg)9$gmyAJfJXZ~dpNiLurNJF
zl}j$6Y5Ks^{8B5y^qM)&*PkSVSJTOh1GkKuGq0Z6<JyK-vs*@l4w1R{g_yv+DWuuO
zzWK{<1X`S)?`htyi`mcn>2AoM0`dMtp)1tXD4Ar7r502v^krLKnd!uJf!^Z6?9sM9
zWYWnRhYxs?;FdL()Nx#t%i(KNq$C?f100#QAnEi{RVG;w&ypB3{jCf5%V6-sK{Dy+
zfIg;vxlM2(`UXNGuJ{Mwvj_N94f{Mk;p^L_;QAHdK8@K%^>#n>y?pYBhKy?`ZSU#T
z6c2C)sGc~4p4%2uyOF-GQ>XAIS78ZdjjxvxK~UNR@6je}piYbjAXsU?#Qtb7W1!n*
zv=q*SLoku$Ox$mAy|1b&Tzv?Re8?XoAwi=^`>EO?Qssjx@3`>RQa>a`G`L;;MnA}5
z|7PYO`rx4UTi-ZL>LXKJ2Rhqjwp4kfipr#N{+t|RNoJ9m5&XrtQTeAO=zi*l2p`8f
z&%KPty9dnjBNb#eK=~1?z2%={GyKNLKFJa;FTYOud(@#CKP)0!3$fOuX0Aga<K0bp
zTKxPNGL7#>v>}c{b!c+8dK?H;JroF&h)D#18O#F09<Cp21J^&KhYO-{ip?B|w{)iH
z*|;#m8?xBdksqY|2%kUD$ZC&ylXjd6BA3|Fegq;ve0*OBz7c#VwJC5mLVf^6G8zi-
zUJD|Z+S0NKp*-tM(Xs8CjF_crPtvgo4TBykMZ={)lLcm%h8DkAxb#`w-wGq!*Yol2
zV#0^`B-BjRZe1`suqmjh$!ZJxzK50?T&YhgbvG_@*GL;Z6EW8WVtIDdax?&Gn=Y{I
zLR&O;nL=5UYV*_8X-^Om`tW6rI4iO9<S8OPjI7L2wYbkpt+d_KGE4cQzi||gb2aYn
zjo?C=&#E%B+9E*V^*YKVt>48+SiE5x`t*oj+#HaU({wWYhXu#-7rc8fwublg;x*~*
z-K&Ik?wyPiGc=h0vR1;fmq}g1y4M_tSt5wC`IB^1oiX<I-o(1)aYjE7=6Iap%x9ry
z9^7pQSyPwWmz6uuPOM%mql&LH2DeU}fS+;PwM}IRB2GCZDFJ<1Z3`iPDmUrz@Ks37
zL(jc8Ugb51Y*)QL>ZrwEwEvoKld2*Vf{%c-po{Q*GsGd@-9h9QMy*l474nvvwYd~C
zPX~LmQ!iICT|#qoG1xR#*DaK3dg|OGs7WlcK%qGWUk+6P-6?{Wo#I&3?T!EpaUx<#
z2yBo^j>c=EDiHm1%UxT2Tf4=HdtK}ldR_|)^s(qHqs8hOF*fV%2N1m5u!uPS1MxzY
z`xx!G8xshX99F;kg&@{?o|r-ql#lI!gA=IFIo*%Q!1FD2`>W*+)jGuksqdPRFk4N)
zMt)&rv1^11iQF4D5Ad2=wz$WF-+&NuwErZ+CdQ9vJVfEx77~?jDhjKJ2Zta*#OZ!a
zc?it{v4wZGMo4o@5MOPzx&Dz-+#3BSqL1L&F-SGXpPTjc<@bNOK<Tg=iC?t_ZxZ3h
zR+$aM_izmE)zNc&GYEqCD6HDVG5do0YSNL?xmzV!#Tpf$gdj!|O8V-HIr7xet9WYO
ztcXr^u~%Ob5z0`eJo^9wV!o+5?|A#?^kgGJE5Mkh_{Qahum$zi+`W7#_1ce~jN}>9
ziH+A!nDI9qD%+^C)XJz8xQr@=90y%GcMz0K*B^SO29?KutTvx8$-VLGrbd3oRBZQA
zcw!9HVPM#Pv8a2)=ez7wsTAUj)bgQc1^G)t$RdKl5<(YNM*-=)B+9@iNAdHHTGwxZ
zs$EDMoD1`{*mVY#n^mEKPb#AZl{T4oOP$ZUF2_0zQo%$<!QM<urY+PH!ChpFJS(wK
z=au-P+lKFVXU;A@x7fK$Fy~zHwrC@Cycz9teM}9*zsZ7-+{b+z>!3P}VQ(1G@cJVI
zyOa+l6HG;M^Qe2^p5#<%a#m;hX@zwEg%`b5`Nk`-&i$ER84*po4Pd#Pz50+CQh%*{
z_^JURfTE{ynM2ofzmu>l8XX+znNa0k=ASCCvZVk)$g2WP@hxO1-=dowczJ|$cWlGB
zB(8-T3H|KVdd=AG5<d9-yzSg|iS=^cbk{)Cdbq(LyvF$UgPt!`zU+J=xA}VV{DW2l
zT1^KMCCd|;BNtIpbS+(RPK-}M;a1DofKGE7)I6^p-5}BR+iuplDk?uZoqbh=OeC!$
z`YTk~{6jO$kH1%q=#o~e8Ix-Vm~pX*kNS(v8^ftLJT^obL_onMjyDl_3(^Hu!fsC=
zs-s$-?S^IDm0ew^*Kj}-2|BAF$b{Xq;??^rY#usR2_!wCRV52<K-sq#j7Aw<<>mu7
zAh^M^Qf2dMm|zy=;9xZBFh+6iF`|y}y3_0ZVEfVtL734HURyj}+Nu&AZkXC<$-jNj
zRLME@>RI1;4FK8znc0*A3q4N#qJkVP-3T`z-|#56G|I2UIWk!mk&ZsDjf7>!K(02T
zKo^pt%Lbs2YMhzrvM88omQkS##l;&OjB3l9*GBbd(!z0Ki<u<9U=w+X{BLiJ1h%5&
zfsbvBUu3}!p)P*dS>+97{}L;i1GlFvBAzd0oS$~GD{BCR@w?4XN?cna;^#0Dy1QS+
zlWcze#h5~wZM1L-u@*X*XrU3f$+!x3>A3Za->z(E+*D{46ttf%)C9M`qj*ptDWYO)
z<L2y@4YLQ1a>xy!N9-@2ODGE@eJ{aHCd|Ezxt-J3XN7kmqD90QIOOHXz-3jz4;z*^
zChtEqDB<xO{6|UE-<ZRb>N=#lI3#jI7QN__!$145BE4&eC=?*4K#3eqE!5o^86hK=
z%n1lCUY4K~1Gdj(293b=P%&u9S6p2L@bx!Se#V%!_%oN;mguL_tTkP7o_s}0ov3`W
zy`6l0>a6AW!kM5HKGXbm8cwo8cD+#k`sh}+`x=G!n}Z4}V?;8lY`3;0b;EG2_Uq@R
z7uMhx?uO<j)<BL?WV8rPB-?t`<f!bn#5CM6{8gp5sC2k&DnxLPc9)LQRw7?^#l?id
zh$}~A{q%S{r@fD6so7G3TT7}?dN+l`8mKl3SAZr`qqu$wt_rFJ2jH3KS?%$L@9nzw
zPZ>lyU0K7M*z-KsZxOg{s+(Kkn966iKA!mf89AhR9a)>52bjCJ0*a9?_V921`bnKS
z6D-DdF}qu{3IoV=N{?7o<Xpzk*F}TR2}+#V4F5@2`0)`dMKXi7Fg@AZnI|{kj4Ai&
z#b4rnCw1Ch&^)1aVyh6dio?);2>%01(ZRI8i1#UFlk@s%lS!Z@Y0{)!A)XwqHZC0i
zY<QZzcio@fm2Mplko%4tKZx1ypss+?n@=paoN;7w<G(F}t*WX@&D2NQU;UBud-%97
zg|qAZGFhV1z`#HY*VGD)Z~2uTEkLVvJx^uHBLzN7T+wW_J>@1H@^eiQ0!~gOIVN%q
zqD8`Hvz4J{TSA5@!HFxuY+M{Vc$X}DKN?{tEliirBQ@*~A>|UquVsdvWEs?Xt(!-r
z3I{fT6?w(|xU}zcLI#i7sSbVg-aT=cG*B6AI(0ro;q1c&nJ$!<%&@z(;a8O{%?Mj>
zo$}9q15SksqhhGgMzHfS4wn~~;C>@hw$&+vOqF$Yt(D0X31U+5dr|@0%tT6m+g}+~
z1KYiPxpa=6`7z)|zrzh%UI9(;(;<TrZWTkfIo;L}EndN`%S7V9PX8A5#e*tPP<_Sm
zNR2ju?-Rv=De8+Cm3nusZ1L|qP91sqaLDC1EF2v=11p0)yCAx6J6D@BJomK`aK&U?
zel=#0ga4iaE8&dk5PBiZFiwo+&I1UZadHfd!Bg?~Z--nC*!P+I&#oIXn?k+P#xaHq
zQt{ilg|p!w#`C|Et!h&?QN)S?h4K!$>~Z6`;Vvp(Me}VTX#;^L^%6E1{l=)k)?x32
z@uF7>r>R=1@Zsf;+Y)*hz3Y`vv6`a~ekSh9%F*_roSkFQi~$V*<bfq{$*k}C_Q&BQ
zDyi{QKS_6THB=TlpI_RyzdzPwLfvr0;Y>J;uD0qm8XKyd2*<_$oGcLY7&)?oj&an)
z5RW8_tbabAbDVQEYvxOLT<*vKZS;gnjSKL8V5S4mBjL#5rZe4;X2yZIDv0n=3*W|h
zcM~pfMVh~ponJlE9L1*GzlL5k*iQkAgsLrZmpyeGN3MNr>lYoflBmR)D<sH?A2PzE
zwa?!S*|@g+(WFUOmT`r%bjZ4P>!g6%yS}KD9{-hN>14UN{W*Y`%ZSm4x~V0BCFYp>
z!L}`jcp{l@Lu9i2-5N1oo7(c{bD}Vdx`v&=a|c!@aIzeHgDS2S2F7_%MfPV$q`Ct+
zmJI7{3p;^6X%0F%1WI7)lV%B0C@m@;P{IH7d^&F0zSeRO{rFGaYXatX=j{@D-jSN<
z_>txYzswDG%$9_c5U1Rws@<;tZGHL0EGs-FK(M<<2Fwzd3pdsZ?Xe8GOhVCpo-U%A
zlaOZnv%N0SUyeZW|Mek}t(%?ck!eC`t3w0<o+P`I7#cQI#TT5YW<aG9Xt+*kHWI%o
z9YD@ybZU?Z#$%k;RfQM@kc*JKo+q+sZBF@e!nu<hw$vmjl70=|0uItPjeoaNbs3xM
zQnCGKixfGRoc7MLz}@tUwXd1*fkIp)6cz@BXy6mhwi9Q<D^E11wj@izOZ^3ksMfgN
ze9WZuW{Ka~xGHqGe0RxVkd<BX?N#!$e9`KwDrPi%RJ<lqF%RC#n9pYD__h?0<CcwB
z{W~NoHn*qr((Or7S**^!r``Mma>?{aZ|Kj(F>-aDav$<iH4y3g@KehPqKNoDH`QxC
z9@;n`7|>UyCja=UkwDCXX2$hu8Btku#w`<3?wm2|-t=crJFdd;<`=4Q<N|p}_0<Ur
zIh?qcOD<9riXR69fawFz<D$(~O2Yab&RVZEnVQJ9tz=Bv(}fc8XD5c=TmUmfJUS#c
zHi`4{ndU-PIMRLT?Z4BM_QaqAfbbVgDST`sT@g|}DK{f2UUN(_=+|#x$Xbre#0om)
zR9#K%6Tqn{o!k50{iJ3Cu&pXBN2}FT*2LM#k{RR)48VR4DDmZH_l5C9@O}>eLrOAS
zTv9H3Krzd}h)e&;-dJ4la*!4(I9GY_0+xPyawDFri`bRM*H5y?>i;2aC8>@1viJ0|
z`gT3f2@ZP}p-%m*ixHaqsfAX27&#eotfd8~q`UrcXIO!xZ*A+66PR|U%t`b1jgYad
zTFQC)H<t|*P-WkM3vH5;Z(4gLNdi7?)&Ss$<vK=_!>NW*7$DsL_=fkGoZA|H#!A%v
zyL7o^v29j6vHm9--m7?vmWnt1mmFkW*#iab@kopjGDfIe?quAP7WVlhE9k;$_jhGC
zN56nCj{;GBqnLhVQ;Q2Tl~+}V|8Os@qKpK2<t;DwZ*$n4DYf$+j+6OFTexg@a_ff&
zXjOVqJB+yWM`rj>;n21Og)-l!$D`wZt<Ke#M@VsG#@m9wLRn(zT|gil+2VdLe#C4U
zAMtUPNKkr>eR}s5;vCU*Of{-0nIo!ymGtHiky&?$5fB%B+&y}q?FU1~y43jEgCY%m
zV%nQ!B1nccmoetg`gkYIH2?VLIV}ZEzhit~9%*4jCyqbaRFqhw!DD($-$Y5;KP@<=
zJoxeG0WDexjS*>ZmT&5wd`aNM;mf<P_8`X#zpBNy{LA$qjTv7Iv*35F6!ZTA06w2Q
zjPK+7GyU>kle|v{@bYJTV91F_-B=`x`kf(*k#ch9?ORoOqsfwyo4>51whj&{2}C6p
zf~crgue~6R&9FB|5~l8tvzgwVJlj36C#f>mP-K}qtb*6@$t^s<rVPHEy)7b3yFQQF
zrx)zW&St^X`OXHLOXRJKQ)7$~KxHZ@Y0}zI?S)Yknkr^LK3TPzIq7n~#kC%0{%YSe
z`3{+kwwn`se{L^kXU8w>S>7lMG|cwlG4Tz`g#F4Yuq2ohVc0OYx*f+U!BzUj%L<c{
z1Ge&Y>LGA#3)V$_ysXI&=R}Kp9)c{GF|Dh=?e^<EGv<{<K~V8@X64!RrZmQ|$aC|9
z_;aOh*oyYuusY^zzgV+%Jd(lMd!s1fNSmMTX|*ELAFAPWYgR^*r4tK%lQg?BS}}LM
z`Jaw#qb{CL&H}I4Wxo_A%kC*eEr@Of@AY(UPcJNOxpnGgX8Luk#qn#1bvE<aR0i7s
zGYE4j-ZR5Zxux5Y%jwIx*|#7LOtKRsU-8mg{QNlaQhnPbXx0}@oY?54#%g>)zK5~i
zN7KIG*{^_QwNKOUqDR^9d4ZWZ$Uoq3C?n!oplKNW^EjHBZ@|cy;zA4aEQ#2fR`_v9
z;3|<g2=Yd0%&aTP7qhil;Fy}u1SL^mFtf_GpAZZ=E4zK?A#GuGuL}V|Pf5GSR#tpu
zGyFLXl4W9Q3xsUG?Oa5huA(7mCcDlQ%Schq4(~q0BisCsnfI&ddct~L&c9$(Q@Fdd
zp{~#HeYW9`ZokSI_1779A;^Oy*315UurPnh1@zgaixsPX*ea4=Z34v#5Nkq3b0?zu
zXcASQdOTCR+xPAQe$f{0?uF={#8fK{hypM2bes6=SEcST(<irV&f5>X|J+Bo#UKu2
zB7<(n){Bz(!!V1)+ns<t)n@6}2<jAPxWTFK>uQ8VeFWrp1!0jz`BS`nqg|cD7!2RQ
zD035*U-+jD>EW8$6$oPhe<qX5BD4A;t+1c>nSsllROyB&!botnn_uXcwFv*DuU5Gg
zx$T2~##op;bxnG>bJxzxgP8BH-Ol^R7p9k61IjZP);9#W4@}swFj+90Aq^{Yj`0tc
zS~|gcxrhi|8^3^>7EL`5sylUsVv{Uj5USsF4J!73idtK!{$3U}s$chJ!nUOjT(7d0
z)@p1&CGuD&O))hsX8iK0LrLT%MKy2yw^%gYU*Ra&%DxrynoCq^*2`DvGw1FLzri38
z{)JtMN9r$|H=PqWKn~L|Aw5fHa>aitLK-$SH=#W9w)yblRxxZ9Bq-MVj9_;|29|a&
ztXQdm25)RGS6kgYrERtwlRDU<R;6{6%jr*m{ZX7dwtmD;ZnND!Yvyft3Cf9>@?go&
zV@72x_Kq7fM7jsM|8P0oTa;^_Tg#6%gVy^4<e{9fN#p9y{-Z`C7vWjY&qMEvH-pBw
zcpmDx{0uoRowTU`LD`oH=58Z|ravS^V#Oe5ceC<@Td97gzc5q$z|#!TEslC%Kba{d
zyKWr#nNeiRCBcchU+BUsHsL+`vCn&BnjgzNMt4f<5*&B;?RxY)Sl4InYeKo3P_38z
zvzbep#|{ne_nl+ACP;Pyt6k0e1Fy95t6a;E?o34F;aL26QlofX-~)N{`pJclZ<$7m
zwL1L{0s_X0s)DR;ev0Q|1jJ3SY?a=xRAW%km1qgH5G{L>zp>6)A_Fbx7e10cVNj>$
zF*2rpZAHpGY26~i;o*BIwz&c$Wj3WQW4;T{8)6FI1Z|pvpiG(Wff*eG+mFW7WZZ|)
z&N<Dq>yAx$8is0|pd^{#t^BCh+bC>y>C?djd#VI+SbKy`x$P6*%08MfvzMq<4|Mr6
zx13O{!-e~5A(yFrs_QzODjxh$4x}%Byk`O945Ld!Sd6|PE`O7;#j=c<ZOI&rX0WRB
z-Xx_Aa%SNc5-xDqMePQ!*Lt81R6e{|-#0k@O@iK;=KWO&>=JdBIDr0_9S|m!SU2O$
z&5wK^$u*K&b=PvAuE(p_XExK`1&(>hRqk2e(>k-Ao>i$E(|1KKZ+`rN#;e}B=sI5|
z;S<lrN`BzIT(fUiu*Lq_ta$}JsSC_&g5?VhO6_UA2`}8#*qwQkZDB3ZADo#q+}qt1
zb9kvO^5KEVchNqVXcty@)=h4?V<DVlQeD_qfet>Kdc2}qUro5hy6|0dfhQF3Kk$I<
zX83HABB$3r`78WA6Fp_#hhuS1*_}GIfhpsB=olET4>udXK3u*zTeZ#{3468H9{Q<@
zd5AQwjNhb1XOZxoh042k9#H))t@B^6KPMTcNvIz0#!S7D*uT0Dcz)Lgxjo8cy6><R
z_c$q<qS1h-W_lZ7g#-+%PU>;%LyyJQ+n()FsqtigpYGuBy6(GIS5$4)`85HSsw&92
zgL}JpUa_C<Q|v++4a&&QXr?r!86<vsD$x7n$$QFDPj(h4u5QtN2B$x7`Td4i+%81d
z#FDn%2<JmUr^?Q8Qo$|oN{Mc`G(Ou}>)=sc#oKrw`&*!Y&J_Pn@K1tFTfXkk&%fU8
z1is|0OOwP^-q!)?oq>PZ!F90<i<S`HISp_JA+_`dMCeZO(z0x-Y<^e=F&=gvb6fpG
zum4%>ztcxb<6q2kCAU5T%f>dO>!aZJdM`+u=~^R*8r&~8SyM^{kTMM_+E>;nS_N|b
zTROXz1e3cv8^Pjciq{^*hK3@jeu2?u5YyX*;n+8@9jILbhG3rY7=|EqS>6vMc(x-p
zfL+;K)v@%qu50ahB_F8gVya6v*#-Sv^m^1y8M1JAbGze<JugtCDG3bkE0G@ZelHpE
z^nP7YcJJ1{qDl^05^wMLQR!b(S+4MVaaII+KP=L@txD+lCGm1Fv-n|>R9D@~A~iR2
zz}ryt@?g)*6UgFUigSJc@_Bm=5|kF;t*I^A2anYY-(o&sYaJ=X;RJ3$4gCLNo>h=a
zWr-MgkfGmp{kSs->27r?Lnhf9D6){HXD2pGsz7m)al8b~IT~)<cyq!Y1zH$qlWH@w
z$y4fX*GE*_3Fh6mwD=Mu1?Mpy3d_4bSRVM6QRNLv<eR|8IV4Ooua|ArIF)_=*)jfi
z!7Ur!He%xPs^8ZQ-vE&cZ~a|O!(@&&OvN&Au@kb6;B~#FrmsH!AvIZKLe(uTtjf;C
zZ$0`u+eq)=5OU$q?f#2cFNuoy%jD-{2G;zsu<Uwq7_O!&IPgvba-DKLFO`4h?Cf~M
zH_AW>qke&VHC=VPvfqE3Sk#v;q`=!PtE0m@0nS#ND$qgZxye}h2@hs}2RnOBp&A@^
zYSPe-GMb)SnvTdZ=%T%|;{}&ey32!^xTaVn5|i%|+0O)cNU*F=%F=%8rFB*lXc_u<
zL0R!*&n_Ctzf_bjOU%NA^r(~LDB^5Um}xPq$PUudSL}8I(0y<9v(&Z?IUUJxMv9b3
zGe`=BN$1Nkn^Dkfqa2<w?V*JX+vsaKOC#*OHyWI4b*dTsk?>fPo}M>HotOLYq>*F%
zlkmO7r2drSK=mf(BgAhFGD6{N793Y`K(4D{^^^H8a9tp1PRU(fGLBimx84$v%{@12
zGzpXJB5sco*vY@_l9^XpGzPbKB46Le(wOP|o8Ge4;FoE0*qMQA<oE64JQ2XzdO?Z_
zcHZCQ#uMtr#|tP8<?cl*i-UY}G;*Xj{LYYW-`MY-654kz)|@xLsOSzm*KRu9OmxZF
z;1N(v*fu9Gx9YhM0ZEL{yYHs!p>V8<bFY8R9zQx4n_H$|^vNjgQ{aP*ju5M;FKdAt
zo4TR}H99jWIT$6CX<hQ!etN88w$TdWf*dZ(bNI|u<LKePN)+@GG(Gm65zg(_h6qN2
z+M`dJ3eYfR$}0ESOZrA~E6CvoA-AqR{n1zHQOH!co1mC@;?Hy*UF+Z*yvg-RYqiq{
zUs<lR&0rW+H0-it#2e~Ff-PJ_(mj>2^sh3BHs#LyQq&#&F)goo&1+{_KQE=z<gav~
z&Vm%|SlThns5D~llX2Y2@|RDeevEfSPzZ=5F39;s*}26O<UK6I6-@I_deo@si!NCw
zChhxZy}0zlC#!htqeq^O@Iw2a$Yf_7m4D8*<1yybM{-g^+?)9pKi^LSN`kpa5-_$+
zs_TvLs(?c9wMtJ(eRBKUQ>Czzy~h^W=U<)Th}n}7HcFlw=&SSRxMskW*!tUgWUg^m
z<*1RQ;(^&j<kE~B#1#yo2aQ$3D>Mq=g56C0wv`Po9MdZESRcY)?-bTfI7M1vN@+HB
ztk9eb$|RUZe0?+jqE4-67JYXrPsJ>=DA2f#D3b&DEg4>}@Pn5PYg|)QKHhvB9JAv0
zr1yTCPze-2{S4g@u?~bPP8&0mI8?X@`-)AzvzApIqPPUB!Y`-n>(wZhJ&=n8;G_O7
zwh#3A0;T;s(-oIdCJ#w+Z&s$W!^co(9^ROX;}dy$s2>@ZU~_OSVG)@O`?*pt()f{W
z@?D(L9)P%EhvwO6=snQ%tw53}P^T5;h8@lp+;{j<R)I~<Jo-s&ay1(yPPisUy13X`
zfl^&tAPY;4AyvY!Qc1Zyw;LNdJhadYq7f4hE`An81}j7izsYy8%Er(V+-Ih5THDis
z^Ib+OVf`xby7QHU5A~4$L*zU$LE8dxZYLMHA%Wq@=jV%Msqys32|GHx$mPl$ny~j$
zF1ZUqclXKcjc_CRG1}IT9u(@5P#mUn<HK{*pQQsRjT|Exm64D*ZvBJS`jOo4Xjvj~
z^2NN{?X*ENm%j@^&1Y`she{>!1pn&m;F89BOUQ&-Jy#1y_F(_^aS<rYRQ9o*sN=W2
z%)%25GLYKvy(GF2SI77|tj;W6hXL!KTFa|gPnN3Q<c{25_sjnHX3Q<D$^#jOp}qy}
z>}O~3R=DhGuj<4{@X+4>P2-NEhp$TN_ck|dq<aD;-`VxsST)kDgTTLxi+4c2@8${$
ztC`QkE+mpVZajKkA7rH#xn7Do$_VtPm3rP2eP5Q+Kd@wl2V}Gex_h}wzq?I!+en=@
zQW{UILv~%g{G|88d3%hrGZRxmcJ$CDQrDR;_+W;dGevdZ*kc<l#O=%Rf>Q1`t?)QI
z0^J_e6><Ei{FY$kEYR742Zhp3R$Y<I4f_daz3Y*L^6rsC<mI=tR<<i82?YiHo+0z(
zm5DDrV+hkE@(V=idUQnRcRt#E&UvZQ61ksaho|RnNwQ+hRcHZ)+V4s=2={V(4{l*m
zuY+HNlDe+x(UWKtqN{-iMR=0%<tU2_po8Py|2O}K3Swa>cnzhmK!s}=2=GT$QA43x
H&OGctoOJw6

literal 0
HcmV?d00001

diff --git a/bindings/rust/flake.lock b/bindings/rust/flake.lock
new file mode 100644
index 00000000000..5212e7c3453
--- /dev/null
+++ b/bindings/rust/flake.lock
@@ -0,0 +1,66 @@
+{
+  "nodes": {
+    "fdb-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782312007,
+        "narHash": "sha256-DFr5o8fjyldBE0T3kgyeFVCBnZ/LD0OAEVycFeC0kJ0=",
+        "owner": "foundationdb-rs",
+        "repo": "overlay",
+        "rev": "d25f5f89b413efa1b04c0966623042f830409960",
+        "type": "github"
+      },
+      "original": {
+        "owner": "foundationdb-rs",
+        "repo": "overlay",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1789370336,
+        "narHash": "sha256-obwZbWHP7htCIoq2Z0g/uTMcEgN6yqcMNIcOMe6P2qI=",
+        "rev": "c7def046b9a883d46974757852106483d741586f",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1073483.c7def046b9a8/nixexprs.tar.zst"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.zst"
+      }
+    },
+    "root": {
+      "inputs": {
+        "fdb-overlay": "fdb-overlay",
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789457514,
+        "narHash": "sha256-Aggle++fTyAifBy+QBPxjM+obO5iepKW/8MDxQtgGvI=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "89e99bf0778a8f2cd18c9360c3f19c1ee47fc739",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/bindings/rust/flake.nix b/bindings/rust/flake.nix
new file mode 100644
index 00000000000..87b3389e7dd
--- /dev/null
+++ b/bindings/rust/flake.nix
@@ -0,0 +1,67 @@
+{
+  description = "A dev environment for the crate foundationdb-rs";
+  inputs = {
+    nixpkgs.url = "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.zst";
+    rust-overlay.url = "github:oxalica/rust-overlay";
+    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
+    fdb-overlay.url = "github:foundationdb-rs/overlay";
+    fdb-overlay.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs = all@{ self, nixpkgs, fdb-overlay, rust-overlay, ... }: {
+    # Utilized by `nix develop`
+    devShells.x86_64-linux.default =
+      let
+        overlays = [ (import rust-overlay) fdb-overlay.overlays.default ];
+        pkgs = import nixpkgs {
+          inherit overlays;
+          system = "x86_64-linux";
+        };
+        # Toolchain pinned to the workspace MSRV via ./rust-toolchain.toml
+        rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
+      in
+      with pkgs;
+      mkShell {
+        buildInputs = [
+          # bindgen part
+          clang
+          llvmPackages.libclang
+          llvmPackages.libcxxClang
+          pkg-config
+
+          # Rust part
+          cargo-expand
+          cargo-edit
+          cargo-msrv
+          # uncomment when https://github.com/NixOS/nixpkgs/issues/354058 is fixed
+          # cargo-llvm-cov
+          cargo-audit
+          rustToolchain
+
+          git-cliff
+          release-plz
+
+          # FDB part
+          fdbserver74
+          libfdb74
+
+          # bindingTester part
+          python3
+          virtualenv
+        ];
+
+        # https://github.com/NixOS/nixpkgs/issues/52447#issuecomment-853429315
+        BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion clang}/include";
+        LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+
+        FDB_CLIENT_LIB_PATH = "${libfdb74}/include";
+        LD_LIBRARY_PATH = "${libfdb74}/include";
+
+        # To import with Intellij IDEA
+        RUST_TOOLCHAIN_PATH = "${rustToolchain}/bin";
+        RUST_SRC_PATH = "${rustToolchain}/lib/rustlib/src/rust/library";
+
+        RUST_BACKTRACE = "1";
+      };
+  };
+}
diff --git a/bindings/rust/foundationdb-bindingtester/Cargo.toml b/bindings/rust/foundationdb-bindingtester/Cargo.toml
new file mode 100644
index 00000000000..b81cef22a05
--- /dev/null
+++ b/bindings/rust/foundationdb-bindingtester/Cargo.toml
@@ -0,0 +1,32 @@
+[package]
+name = "bindingtester"
+version = "0.9.0"
+authors = [
+    "Benjamin Fry <benjaminfry@me.com>",
+    "Vincent Rouillé <vincent@clikengo.com>",
+    "Pierre Zemb <contact@pierrezemb.fr>"
+]
+edition = "2024"
+rust-version = "1.85.1"
+publish = false
+
+description = """
+Bindings to the C api for FoundationDB
+"""
+
+repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+
+readme = "README.md"
+keywords = ["foundationdb", "kv"]
+categories = ["database"]
+
+license = "MIT/Apache-2.0"
+
+[dependencies]
+env_logger = { version = "0.11.10", default-features = false, features = ["auto-color", "regex"] }
+foundationdb = { path = "../foundationdb", features = ["uuid", "num-bigint", "fdb-7_4", "embedded-fdb-include"], default-features = false }
+foundationdb-sys = { version = "0.11.0", path = "../foundationdb-sys", features = ["embedded-fdb-include", "fdb-7_4"], default-features = false }
+futures = "0.3.32"
+log = "0.4.33"
+num-bigint = "0.5.1"
+async-trait = "0.1.89"
diff --git a/bindings/rust/foundationdb-bindingtester/README.md b/bindings/rust/foundationdb-bindingtester/README.md
new file mode 100644
index 00000000000..2a89756f131
--- /dev/null
+++ b/bindings/rust/foundationdb-bindingtester/README.md
@@ -0,0 +1,14 @@
+Rust FoundationDB bindingtester
+===============================
+
+This exe implements the official FoundationDB bindingtester protocol.
+
+By running `./bindingtester.py ${this_executable}`, you can test how the rust foundationdb bindings behave.
+
+The following configurations are tested and should pass without any issue:
+
+```
+./bindingtester.py --test-name scripted
+./bindingtester.py --num-ops 1000 --test-name api --api-version 610
+./bindingtester.py --num-ops 1000 --concurrency 5 --test-name api --api-version 610
+```
diff --git a/bindings/rust/foundationdb-bindingtester/src/main.rs b/bindings/rust/foundationdb-bindingtester/src/main.rs
new file mode 100644
index 00000000000..3016b34c300
--- /dev/null
+++ b/bindings/rust/foundationdb-bindingtester/src/main.rs
@@ -0,0 +1,2799 @@
+#[macro_use]
+extern crate log;
+
+use foundationdb as fdb;
+use foundationdb_sys as fdb_sys;
+
+use std::borrow::Cow;
+use std::collections::HashMap;
+use std::convert::TryFrom;
+use std::io::Write;
+use std::mem::transmute;
+use std::pin::Pin;
+use std::sync::Arc;
+use std::thread;
+
+use fdb::options::{ConflictRangeType, DatabaseOption, TransactionOption};
+use fdb::tuple::{Bytes, Element, Subspace, TuplePack, pack, pack_into, unpack};
+use fdb::*;
+use futures::future;
+use futures::prelude::*;
+use num_bigint::BigInt;
+
+static WAITED_FOR_EMPTY: Element = Element::Bytes(Bytes(Cow::Borrowed(b"WAITED_FOR_EMPTY")));
+static RESULT_NOT_PRESENT: Element = Element::Bytes(Bytes(Cow::Borrowed(b"RESULT_NOT_PRESENT")));
+static GOT_READ_VERSION: Element = Element::Bytes(Bytes(Cow::Borrowed(b"GOT_READ_VERSION")));
+static GOT_COMMITTED_VERSION: Element =
+    Element::Bytes(Bytes(Cow::Borrowed(b"GOT_COMMITTED_VERSION")));
+
+static ERROR_NONE: Element = Element::Bytes(Bytes(Cow::Borrowed(b"ERROR: NONE")));
+static ERROR_MULTIPLE: Element = Element::Bytes(Bytes(Cow::Borrowed(b"ERROR: MULTIPLE")));
+static OK: Element = Element::Bytes(Bytes(Cow::Borrowed(b"OK")));
+static ERROR_DIRECTORY: Element = Element::Bytes(Bytes(Cow::Borrowed(b"DIRECTORY_ERROR")));
+static ESTIMATE_RANGE_RESPONSE: Element =
+    Element::Bytes(Bytes(Cow::Borrowed(b"GOT_ESTIMATED_RANGE_SIZE")));
+static GOT_APPROXIMATE_SIZE_RESPONSE: Element =
+    Element::Bytes(Bytes(Cow::Borrowed(b"GOT_APPROXIMATE_SIZE")));
+static GET_RANGE_SPLIT_POINTS_RESPONSE: Element =
+    Element::Bytes(Bytes(Cow::Borrowed(b"GOT_RANGE_SPLIT_POINTS")));
+
+use crate::fdb::options::{MutationType, StreamingMode};
+
+use foundationdb::directory::DirectoryError;
+use foundationdb::directory::DirectoryLayer;
+use foundationdb::directory::{Directory, DirectoryOutput};
+use foundationdb::tuple::{PackResult, TupleUnpack};
+
+use tuple::VersionstampOffset;
+
+fn mutation_from_str(s: &str) -> MutationType {
+    match s {
+        "ADD" => MutationType::Add,
+        "AND" => MutationType::And,
+        "BIT_AND" => MutationType::BitAnd,
+        "OR" => MutationType::Or,
+        "BIT_OR" => MutationType::BitOr,
+        "XOR" => MutationType::Xor,
+        "BIT_XOR" => MutationType::BitXor,
+        "APPEND_IF_FITS" => MutationType::AppendIfFits,
+        "MAX" => MutationType::Max,
+        "MIN" => MutationType::Min,
+        "SET_VERSIONSTAMPED_KEY" => MutationType::SetVersionstampedKey,
+        "SET_VERSIONSTAMPED_VALUE" => MutationType::SetVersionstampedValue,
+        "BYTE_MIN" => MutationType::ByteMin,
+        "BYTE_MAX" => MutationType::ByteMax,
+        "COMPARE_AND_CLEAR" => MutationType::CompareAndClear,
+        _ => unimplemented!("mutation_from_str({})", s),
+    }
+}
+
+pub fn streaming_from_value(val: i32) -> StreamingMode {
+    match val {
+        fdb_sys::FDBStreamingMode_FDB_STREAMING_MODE_WANT_ALL => StreamingMode::WantAll,
+        fdb_sys::FDBStreamingMode_FDB_STREAMING_MODE_ITERATOR => StreamingMode::Iterator,
+        fdb_sys::FDBStreamingMode_FDB_STREAMING_MODE_EXACT => StreamingMode::Exact,
+        fdb_sys::FDBStreamingMode_FDB_STREAMING_MODE_SMALL => StreamingMode::Small,
+        fdb_sys::FDBStreamingMode_FDB_STREAMING_MODE_MEDIUM => StreamingMode::Medium,
+        fdb_sys::FDBStreamingMode_FDB_STREAMING_MODE_LARGE => StreamingMode::Large,
+        fdb_sys::FDBStreamingMode_FDB_STREAMING_MODE_SERIAL => StreamingMode::Serial,
+        _ => unimplemented!("streaming_from_value({})", val),
+    }
+}
+
+struct Instr {
+    code: InstrCode,
+    database: bool,
+    snapshot: bool,
+    starts_with: bool,
+    selector: bool,
+}
+
+impl std::fmt::Debug for Instr {
+    fn fmt(&self, fmt: &mut std::fmt::Formatter) -> std::fmt::Result {
+        write!(fmt, "[{:?}", self.code)?;
+        if self.database {
+            write!(fmt, " db")?;
+        }
+        if self.snapshot {
+            write!(fmt, " snapshot")?;
+        }
+        if self.starts_with {
+            write!(fmt, " starts_with")?;
+        }
+        if self.selector {
+            write!(fmt, " selector")?;
+        }
+        write!(fmt, "]")
+    }
+}
+
+#[derive(Debug)]
+enum DirectoryStackItem {
+    Directory(DirectoryLayer),
+    DirectoryOutput(DirectoryOutput),
+    Subspace(Subspace),
+    Null,
+}
+
+impl Instr {
+    fn pop_database(&mut self) -> bool {
+        if self.database {
+            self.database = false;
+            true
+        } else {
+            false
+        }
+    }
+    fn pop_snapshot(&mut self) -> bool {
+        if self.snapshot {
+            self.snapshot = false;
+            true
+        } else {
+            false
+        }
+    }
+    fn pop_starts_with(&mut self) -> bool {
+        if self.starts_with {
+            self.starts_with = false;
+            true
+        } else {
+            false
+        }
+    }
+    fn pop_selector(&mut self) -> bool {
+        if self.selector {
+            self.selector = false;
+            true
+        } else {
+            false
+        }
+    }
+
+    fn has_flags(&self) -> bool {
+        self.database || self.snapshot || self.starts_with || self.selector
+    }
+}
+
+#[derive(Debug)]
+enum InstrCode {
+    // data operations
+    Push(Element<'static>),
+    Dup,
+    EmptyStack,
+    Swap,
+    Pop,
+    Sub,
+    Concat,
+    LogStack,
+
+    // foundationdb operations
+    NewTransaction,
+    UseTransaction,
+    OnError,
+    Get,
+    GetKey,
+    GetRange,
+    GetReadVersion,
+    GetVersionstamp,
+    Set,
+    SetReadVersion,
+    Clear,
+    ClearRange,
+    AtomicOp,
+    ReadConflictRange,
+    WriteConflictRange,
+    ReadConflictKey,
+    WriteConflictKey,
+    DisableWriteConflict,
+    Commit,
+    Reset,
+    Cancel,
+    GetCommittedVersion,
+    GetApproximateSize,
+    WaitFuture,
+    GetEstimatedRangeSize,
+    GetRangeSplitPoints,
+
+    TuplePack,
+    TuplePackWithVersionstamp,
+    TupleUnpack,
+    TupleRange,
+    TupleSort,
+    EncodeFloat,
+    EncodeDouble,
+    DecodeFloat,
+    DecodeDouble,
+
+    // Thread Operations
+    StartThread,
+    WaitEmpty,
+
+    // misc
+    UnitTests,
+
+    // Directory/Subspace/Layer Creation
+    DirectoryCreateSubspace,
+    DirectoryCreateLayer,
+    DirectoryCreateOrOpen,
+    DirectoryCreate,
+    DirectoryOpen,
+
+    // Directory Management
+    DirectoryChange,
+    DirectorySetErrorIndex,
+
+    // Directory Operations
+    DirectoryMove,
+    DirectoryMoveTo,
+    DirectoryRemove,
+    DirectoryRemoveIfExists,
+    DirectoryList,
+    DirectoryExists,
+
+    // Subspace operation
+    DirectoryPackKey,
+    DirectoryUnpackKey,
+    DirectoryRange,
+    DirectoryContains,
+    DirectoryOpenSubspace,
+
+    // Directory Logging
+    DirectoryLogSubspace,
+    DirectoryLogDirectory,
+
+    // Other
+    DirectoryStripPrefix,
+}
+
+fn has_opt<'a>(cmd: &'a str, opt: &'static str) -> (&'a str, bool) {
+    if cmd.ends_with(opt) {
+        (&cmd[0..(cmd.len() - opt.len())], true)
+    } else {
+        (cmd, false)
+    }
+}
+
+impl Instr {
+    fn from(data: &[u8]) -> Self {
+        use crate::InstrCode::*;
+
+        let data = Bytes::from(data);
+        trace!("inst {data:?}");
+        let tup: Vec<Element> = unpack(&data).unwrap();
+        let cmd = tup[0].as_str().unwrap();
+
+        let (cmd, database) = has_opt(cmd, "_DATABASE");
+        let (cmd, snapshot) = has_opt(cmd, "_SNAPSHOT");
+        let (cmd, starts_with) = has_opt(cmd, "_STARTS_WITH");
+        let (cmd, selector) = has_opt(cmd, "_SELECTOR");
+
+        let code = match cmd {
+            "PUSH" => Push(tup[1].clone().into_owned()),
+            "DUP" => Dup,
+            "EMPTY_STACK" => EmptyStack,
+            "SWAP" => Swap,
+            "POP" => Pop,
+            "SUB" => Sub,
+            "CONCAT" => Concat,
+            "LOG_STACK" => LogStack,
+
+            "NEW_TRANSACTION" => NewTransaction,
+            "USE_TRANSACTION" => UseTransaction,
+            "ON_ERROR" => OnError,
+            "GET" => Get,
+            "GET_KEY" => GetKey,
+            "GET_RANGE" => GetRange,
+            "GET_READ_VERSION" => GetReadVersion,
+            "GET_VERSIONSTAMP" => GetVersionstamp,
+
+            "SET" => Set,
+            "SET_READ_VERSION" => SetReadVersion,
+            "CLEAR" => Clear,
+            "CLEAR_RANGE" => ClearRange,
+            "ATOMIC_OP" => AtomicOp,
+            "READ_CONFLICT_RANGE" => ReadConflictRange,
+            "WRITE_CONFLICT_RANGE" => WriteConflictRange,
+            "READ_CONFLICT_KEY" => ReadConflictKey,
+            "WRITE_CONFLICT_KEY" => WriteConflictKey,
+            "DISABLE_WRITE_CONFLICT" => DisableWriteConflict,
+            "COMMIT" => Commit,
+            "RESET" => Reset,
+            "CANCEL" => Cancel,
+            "GET_COMMITTED_VERSION" => GetCommittedVersion,
+            "GET_APPROXIMATE_SIZE" => GetApproximateSize,
+            "WAIT_FUTURE" => WaitFuture,
+            "GET_ESTIMATED_RANGE_SIZE" => GetEstimatedRangeSize,
+            "GET_RANGE_SPLIT_POINTS" => GetRangeSplitPoints,
+
+            "TUPLE_PACK" => TuplePack,
+            "TUPLE_PACK_WITH_VERSIONSTAMP" => TuplePackWithVersionstamp,
+            "TUPLE_UNPACK" => TupleUnpack,
+            "TUPLE_RANGE" => TupleRange,
+            "TUPLE_SORT" => TupleSort,
+            "ENCODE_FLOAT" => EncodeFloat,
+            "ENCODE_DOUBLE" => EncodeDouble,
+            "DECODE_FLOAT" => DecodeFloat,
+            "DECODE_DOUBLE" => DecodeDouble,
+
+            "START_THREAD" => StartThread,
+            "WAIT_EMPTY" => WaitEmpty,
+
+            "UNIT_TESTS" => UnitTests,
+
+            "DIRECTORY_CREATE_SUBSPACE" => DirectoryCreateSubspace,
+            "DIRECTORY_CREATE_LAYER" => DirectoryCreateLayer,
+            "DIRECTORY_CREATE_OR_OPEN" => DirectoryCreateOrOpen,
+            "DIRECTORY_CREATE" => DirectoryCreate,
+            "DIRECTORY_OPEN" => DirectoryOpen,
+
+            "DIRECTORY_CHANGE" => DirectoryChange,
+            "DIRECTORY_SET_ERROR_INDEX" => DirectorySetErrorIndex,
+
+            "DIRECTORY_MOVE" => DirectoryMove,
+            "DIRECTORY_MOVE_TO" => DirectoryMoveTo,
+            "DIRECTORY_REMOVE" => DirectoryRemove,
+            "DIRECTORY_REMOVE_IF_EXISTS" => DirectoryRemoveIfExists,
+            "DIRECTORY_LIST" => DirectoryList,
+            "DIRECTORY_EXISTS" => DirectoryExists,
+
+            "DIRECTORY_PACK_KEY" => DirectoryPackKey,
+            "DIRECTORY_UNPACK_KEY" => DirectoryUnpackKey,
+            "DIRECTORY_RANGE" => DirectoryRange,
+            "DIRECTORY_CONTAINS" => DirectoryContains,
+            "DIRECTORY_OPEN_SUBSPACE" => DirectoryOpenSubspace,
+
+            "DIRECTORY_LOG_SUBSPACE" => DirectoryLogSubspace,
+            "DIRECTORY_LOG_DIRECTORY" => DirectoryLogDirectory,
+
+            "DIRECTORY_STRIP_PREFIX" => DirectoryStripPrefix,
+
+            name => unimplemented!("inimplemented instr: {}", name),
+        };
+        Instr {
+            code,
+            database,
+            snapshot,
+            starts_with,
+            selector,
+        }
+    }
+}
+
+struct StackResult {
+    state: Option<(Bytes<'static>, TransactionState)>,
+    data: FdbResult<Element<'static>>,
+}
+impl From<FdbError> for StackResult {
+    fn from(err: FdbError) -> Self {
+        StackResult {
+            state: None,
+            data: Err(err),
+        }
+    }
+}
+impl From<Element<'static>> for StackResult {
+    fn from(data: Element<'static>) -> Self {
+        StackResult {
+            state: None,
+            data: Ok(data),
+        }
+    }
+}
+
+impl From<FdbResult<Element<'static>>> for StackResult {
+    fn from(data: FdbResult<Element<'static>>) -> Self {
+        StackResult { state: None, data }
+    }
+}
+
+type StackFuture = Pin<Box<dyn Future<Output = StackResult>>>;
+struct StackItem {
+    number: usize,
+    data: Option<Element<'static>>,
+    fut: Option<(usize, StackFuture)>,
+}
+
+impl StackItem {
+    async fn await_fut(&mut self) -> Option<(Bytes<'static>, TransactionState)> {
+        let mut ret = None;
+        if let Some((_id, fut)) = self.fut.take() {
+            let StackResult { state, mut data } = fut.await;
+
+            if let Some((name, state)) = state {
+                trace!("{name:?} = {state:?}");
+                match state {
+                    TransactionState::TransactionCommitError(e) => {
+                        let err = FdbError::from_code(e.code());
+                        ret = Some((name, TransactionState::TransactionCommitError(e)));
+                        data = Err(err);
+                    }
+                    state => {
+                        ret = Some((name, state));
+                    }
+                }
+            }
+
+            let data = data.unwrap_or_else(|err| {
+                trace!("ERROR {err:?}");
+                let packed = pack(&(
+                    Bytes::from(b"ERROR".as_ref()),
+                    Bytes::from(format!("{}", err.code()).into_bytes()),
+                ));
+                Element::Bytes(packed.into())
+            });
+
+            self.data = Some(data);
+        }
+        ret
+    }
+}
+
+impl Clone for StackItem {
+    fn clone(&self) -> Self {
+        if self.fut.is_some() {
+            panic!("cannot clone future stack item");
+        }
+        Self {
+            number: self.number,
+            data: self.data.clone(),
+            fut: None,
+        }
+    }
+}
+
+impl std::fmt::Debug for StackItem {
+    fn fmt(&self, fmt: &mut std::fmt::Formatter) -> std::fmt::Result {
+        write!(fmt, "[item num={}, data={:?}]", self.number, self.data)
+    }
+}
+
+fn range(prefix: Bytes) -> (Bytes<'static>, Bytes<'static>) {
+    let begin = prefix.clone().into_owned();
+    let end = strinc(prefix).into_owned();
+
+    (begin.into(), end.into())
+}
+
+enum TransactionState {
+    Transaction(Transaction),
+    TransactionCancelled(TransactionCancelled),
+    TransactionCommitted(TransactionCommitted),
+    TransactionCommitError(TransactionCommitError),
+    Pending(usize),
+    Dead,
+}
+impl std::fmt::Debug for TransactionState {
+    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+        use TransactionState as S;
+
+        match self {
+            S::Transaction(..) => "Transaction",
+            S::TransactionCancelled(..) => "TransactionCancelled",
+            S::TransactionCommitted(..) => "TransactionCommitted",
+            S::TransactionCommitError(..) => "TransactionCommitError",
+            S::Pending(..) => "Pending",
+            S::Dead => "Dead",
+        }
+        .fmt(f)
+    }
+}
+
+impl TransactionState {
+    fn reset(&mut self) {
+        use TransactionState as S;
+        *self = match std::mem::replace(self, S::Dead) {
+            S::TransactionCommitted(c) => S::Transaction(c.reset()),
+            S::TransactionCommitError(c) => S::Transaction(c.reset()),
+            c => c,
+        }
+    }
+
+    fn as_mut(&mut self) -> &mut Transaction {
+        use TransactionState as S;
+
+        self.reset();
+        match *self {
+            S::Transaction(ref mut tr) => tr,
+            S::TransactionCancelled(ref mut tr) => unsafe {
+                // rust binding prevent accessing cancelled transaction
+                &mut *(tr as *mut TransactionCancelled as *mut Transaction)
+            },
+            _ => panic!("transaction is owned by a future that is still not done"),
+        }
+    }
+
+    fn take(&mut self, id: usize) -> Transaction {
+        use TransactionState as S;
+
+        self.reset();
+        match std::mem::replace(self, S::Dead) {
+            S::Transaction(tr) => {
+                *self = S::Pending(id);
+                tr
+            }
+            S::TransactionCancelled(tr) => {
+                *self = S::Pending(id);
+                unsafe {
+                    // rust binding prevent accessing cancelled transaction
+                    transmute::<TransactionCancelled, Transaction>(tr)
+                }
+            }
+            _ => panic!("transaction is owned by a future that is still not done"),
+        }
+    }
+}
+
+struct StackMachine {
+    prefix: Bytes<'static>,
+
+    // A global transaction map from byte string to Transactions. This map is shared by all tester
+    // 'threads'.
+    transactions: HashMap<Bytes<'static>, TransactionState>,
+
+    // A stack of data items of mixed types and their associated metadata. At a minimum, each item
+    // should be stored with the 0-based instruction number which resulted in it being put onto the
+    // stack. Your stack must support push and pop operations. It may be helpful if it supports
+    // random access, clear and a peek operation. The stack is initialized to be empty.
+    stack: Vec<StackItem>,
+
+    // A current FDB transaction name (stored as a byte string). The transaction name should be
+    // initialized to the prefix that instructions are being read from.
+    cur_transaction: Bytes<'static>,
+
+    // A last seen FDB version, which is a 64-bit integer.
+    last_version: i64,
+
+    threads: Vec<thread::JoinHandle<()>>,
+
+    trx_counter: usize,
+
+    directory_stack: Vec<DirectoryStackItem>,
+    directory_index: usize,
+    error_index: usize,
+}
+
+fn strinc(key: Bytes) -> Bytes {
+    let mut key = key.into_owned();
+    for i in (0..key.len()).rev() {
+        if key[i] != 0xff {
+            key[i] += 1;
+            return Bytes::from(key);
+        } else {
+            // stripping key from trailing 0xFF bytes
+            key.remove(i);
+        }
+    }
+    panic!("failed to strinc");
+}
+
+impl StackMachine {
+    fn new(db: &Database, prefix: Bytes<'static>) -> Self {
+        let cur_transaction = prefix.clone();
+        let mut transactions = HashMap::new();
+        transactions.insert(
+            cur_transaction.clone(),
+            TransactionState::Transaction(db.create_trx().unwrap()),
+        );
+
+        Self {
+            prefix,
+            transactions,
+            stack: Vec::new(),
+            cur_transaction,
+            last_version: 0,
+            threads: Vec::new(),
+            trx_counter: 0,
+
+            directory_stack: vec![DirectoryStackItem::Directory(DirectoryLayer::default())],
+            directory_index: 0,
+            error_index: 0,
+        }
+    }
+
+    fn next_trx_id(&mut self) -> usize {
+        self.trx_counter += 1;
+        self.trx_counter
+    }
+
+    async fn fetch_instr(&self, trx: &Transaction) -> FdbResult<Vec<Instr>> {
+        let opt = RangeOption::from(&Subspace::from(&self.prefix));
+        debug!("opt = {opt:?}");
+        let instrs = Vec::new();
+        trx.get_ranges(opt, false)
+            .try_fold(instrs, |mut instrs, res| {
+                for kv in res.iter() {
+                    let instr = Instr::from(kv.value());
+                    instrs.push(instr);
+                }
+                future::ok(instrs)
+            })
+            .await
+    }
+
+    async fn pop(&mut self) -> StackItem {
+        let mut item = self.stack.pop().expect("stack empty");
+        if let Some((name, state)) = item.await_fut().await {
+            self.transactions.insert(name, state);
+        }
+        item
+    }
+
+    async fn maybe_pop(&mut self) -> Option<StackItem> {
+        let mut item = self.stack.pop()?;
+        if let Some((name, state)) = item.await_fut().await {
+            self.transactions.insert(name, state);
+        }
+        Some(item)
+    }
+
+    async fn pop_i64(&mut self) -> i64 {
+        let element = self.pop_element().await;
+        match element {
+            Element::Int(v) => v,
+            _ => panic!("i64 was expected, found {element:?}"),
+        }
+    }
+
+    async fn pop_i32(&mut self) -> i32 {
+        i32::try_from(self.pop_i64().await).expect("i64 to fit in i32")
+    }
+
+    async fn pop_usize(&mut self) -> usize {
+        usize::try_from(self.pop_i64().await).expect("i64 to fit in usize")
+    }
+
+    async fn pop_str(&mut self) -> String {
+        let element = self.pop_element().await;
+        match element {
+            Element::String(v) => v.into_owned(),
+            _ => panic!("string was expected, found {element:?}"),
+        }
+    }
+
+    async fn pop_bytes(&mut self) -> Bytes<'static> {
+        let element = self.pop_element().await;
+        match element {
+            Element::Bytes(v) => v,
+            // checking nested bytes in a Tuple as well
+            Element::Tuple(elements) => match elements.first() {
+                Some(Element::Bytes(b)) => b.clone(),
+                _ => panic!("bytes were expected, found a Tuple with no Bytes in it"),
+            },
+            _ => panic!("bytes were expected, found {element:?}"),
+        }
+    }
+
+    async fn pop_optional_bytes(&mut self) -> Option<Vec<u8>> {
+        let element = self.pop_element().await;
+        match element {
+            Element::Bytes(v) => Some(v.to_vec()),
+            _ => None,
+        }
+    }
+
+    async fn pop_string_tuple(&mut self, count: usize) -> Vec<Vec<String>> {
+        let mut result = vec![];
+
+        if count == 0 {
+            result.push(vec![]);
+        } else {
+            for _i in 0..count {
+                let mut sub_result = vec![];
+                let vec_size = self.pop_i64().await;
+                for _j in 0..vec_size {
+                    sub_result.push(self.pop_str().await);
+                }
+                result.push(sub_result);
+            }
+        }
+        result
+    }
+
+    async fn pop_element(&mut self) -> Element<'static> {
+        let item = self.pop().await;
+        if let Some(data) = item.data {
+            return data;
+        }
+        panic!("no data");
+    }
+
+    async fn pop_selector(&mut self) -> KeySelector<'static> {
+        let key: Bytes = self.pop_bytes().await;
+        let or_equal: i32 = i32::try_from(self.pop_i64().await).unwrap();
+        let offset: i32 = i32::try_from(self.pop_i64().await).unwrap();
+
+        KeySelector::new(key.0, or_equal != 0, offset)
+    }
+
+    fn push(&mut self, number: usize, data: Element<'static>) {
+        self.stack.push(StackItem {
+            number,
+            data: Some(data),
+            fut: None,
+        });
+    }
+
+    fn push_fut(&mut self, number: usize, id: usize, fut: StackFuture) {
+        let item = StackItem {
+            number,
+            data: None,
+            fut: Some((id, fut)),
+        };
+        self.stack.push(item);
+    }
+
+    fn push_res(&mut self, number: usize, res: FdbResult<()>, ok_str: &[u8]) {
+        match res {
+            Ok(..) => self.push(number, Element::Bytes(ok_str.to_vec().into())),
+            Err(err) => self.push_err(number, err),
+        }
+    }
+
+    fn push_directory_err(&mut self, code: &InstrCode, number: usize, err: DirectoryError) {
+        debug!("[{number}] DIRECTORY_ERROR during {code:?}: {err:?}");
+        self.push(number, Element::Tuple(vec![ERROR_DIRECTORY.clone()]));
+
+        if matches!(
+            code,
+            InstrCode::DirectoryCreateSubspace
+                | InstrCode::DirectoryCreateOrOpen
+                | InstrCode::DirectoryCreateLayer
+                | InstrCode::DirectoryCreate
+                | InstrCode::DirectoryOpen
+                | InstrCode::DirectoryMove
+                | InstrCode::DirectoryMoveTo
+                | InstrCode::DirectoryOpenSubspace
+        ) {
+            debug!(
+                "pushed NULL in the directory_stack at index {} because of the error",
+                self.directory_stack.len()
+            );
+            self.directory_stack.push(DirectoryStackItem::Null);
+        }
+    }
+
+    fn push_err(&mut self, number: usize, err: FdbError) {
+        trace!("ERROR {err:?}");
+        let packed = pack(&Element::Tuple(vec![
+            Element::Bytes(Bytes::from(b"ERROR".as_ref())),
+            Element::Bytes(Bytes::from(format!("{}", err.code()).into_bytes())),
+        ]));
+        self.push(number, Element::Bytes(packed.into()));
+    }
+
+    fn check<T>(&mut self, number: usize, r: FdbResult<T>) -> Result<T, ()> {
+        match r {
+            Ok(v) => Ok(v),
+            Err(err) => {
+                self.push_err(number, err);
+                Err(())
+            }
+        }
+    }
+
+    #[allow(clippy::cognitive_complexity)]
+    async fn run_step(
+        &mut self,
+        db: Arc<Database>,
+        number: usize,
+        mut instr: Instr,
+    ) -> Result<(), ()> {
+        use crate::InstrCode::*;
+
+        let is_db = instr.pop_database();
+
+        let mut mutation = false;
+        let mut pending = false;
+
+        let (mut trx, trx_name) = if is_db {
+            (
+                TransactionState::Transaction(self.check(number, db.create_trx())?),
+                None,
+            )
+        } else {
+            let mut trx = self
+                .transactions
+                .remove(&self.cur_transaction) // some instr requires transaction ownership
+                .expect("failed to find trx");
+            if let TransactionState::Pending(id) = trx {
+                let stack_item = self.stack.iter_mut().find(|s| match s.fut {
+                    Some((trx_id, ..)) => trx_id == id,
+                    _ => false,
+                });
+                if let Some(stack_item) = stack_item {
+                    if let Some((name, state)) = stack_item.await_fut().await {
+                        assert_eq!(name, self.cur_transaction);
+                        trx = state;
+                    }
+                }
+            }
+            (trx, Some(&self.cur_transaction))
+        };
+
+        match instr.code {
+            // Pushes the provided item onto the stack.
+            Push(ref element) => {
+                debug!("push {element:?}");
+                self.push(number, element.clone())
+            }
+            // Duplicates the top item on the stack. The instruction number for
+            // the duplicate item should be the same as the original.
+            Dup => {
+                let top = self.pop().await;
+                debug!("dup {top:?}");
+                self.stack.push(top.clone());
+                self.stack.push(top);
+            }
+            // Discards all items in the stack.
+            EmptyStack => {
+                debug!("empty_stack");
+                self.stack.clear()
+            }
+            // Pops the top item off of the stack as INDEX.
+            // Swaps the items in the stack at depth 0 and depth INDEX.
+            // Does not modify the instruction numbers of the swapped items.
+            Swap => {
+                let depth: usize = self.pop_usize().await;
+                assert!(
+                    depth < self.stack.len(),
+                    "swap index invalid {} >= {}",
+                    depth,
+                    self.stack.len()
+                );
+                let depth_0 = self.stack.len() - 1;
+                let depth = depth_0 - depth;
+                debug!("swap {depth_0} {depth}");
+                self.stack.swap(depth_0, depth);
+            }
+            // Pops and discards the top item on the stack.
+            Pop => {
+                debug!("pop");
+                self.pop().await;
+            }
+            // Pops the top two items off of the stack as A and B and then
+            // pushes the difference (A-B) onto the stack.
+            // A and B may be assumed to be integers.
+            Sub => {
+                let a = self.pop_element().await;
+                let b = self.pop_element().await;
+                debug!("sub {a:?} - {b:?}");
+                let c = match (a, b) {
+                    // checking for possible overflow
+                    (Element::Int(a), Element::Int(b)) => match a.checked_sub(b) {
+                        None => Element::BigInt(BigInt::from(a) - BigInt::from(b)),
+                        Some(c) => Element::Int(c),
+                    },
+                    (Element::Float(a), Element::Float(b)) => Element::Float(a - b),
+                    (Element::Double(a), Element::Double(b)) => Element::Double(a - b),
+                    (Element::BigInt(a), Element::BigInt(b)) => Element::BigInt(a - b),
+                    (Element::Int(a), Element::BigInt(b)) => Element::BigInt(a - b),
+                    (Element::BigInt(a), Element::Int(b)) => Element::BigInt(a - b),
+                    (a, b) => panic!("sub between invalid elements {a:?} {b:?}"),
+                };
+                self.push(number, c);
+            }
+            // Pops the top two items off the stack as A and B and then pushes
+            // the concatenation of A and B onto the stack. A and B can be
+            // assumed to be of the same type and will be either byte strings or
+            // unicode strings.
+            Concat => {
+                let a = self.pop_element().await;
+                let b = self.pop_element().await;
+                debug!("concat {a:?} {b:?}");
+                let c = match (a, b) {
+                    (Element::String(a), Element::String(b)) => {
+                        Element::String(format!("{a}{b}").into())
+                    }
+                    (Element::Bytes(a), Element::Bytes(b)) => {
+                        let mut bytes = Vec::new();
+                        bytes.extend_from_slice(&a);
+                        bytes.extend_from_slice(&b);
+                        Element::Bytes(bytes.into())
+                    }
+                    (a, b) => panic!("concat between invalid elements {a:?} {b:?}"),
+                };
+                self.push(number, c);
+            }
+            // Pops the top item off the stack as PREFIX. Using a new
+            // transaction with normal retry logic, inserts a key-value pair
+            // into the database for each item in the stack of the form:
+            //
+            // PREFIX + tuple.pack((stackIndex, instructionNumber)) = tuple.pack((item,))
+            //
+            // where stackIndex is the current index of the item in the stack.
+            // The oldest item in the stack should have stackIndex 0.
+            //
+            // If the byte string created by tuple packing the item exceeds 40000 bytes,
+            // then the value should be truncated to the first 40000 bytes of the packed
+            // tuple.
+            //
+            // When finished, the stack should be empty. Note that because the stack may be
+            // large, it may be necessary to commit the transaction every so often (e.g.
+            // after every 100 sets) to avoid past_version errors.
+            LogStack => {
+                let prefix: Bytes = self.pop_bytes().await;
+                let mut stack_idx = self.stack.len();
+                let trx_id = self.next_trx_id();
+                let mut t = trx.take(trx_id);
+                let mut n = 0;
+                while let Some(stack_item) = self.maybe_pop().await {
+                    stack_idx -= 1;
+                    let mut key = prefix.clone().into_owned();
+                    stack_idx.pack_into_vec(&mut key);
+                    stack_item.number.pack_into_vec(&mut key);
+
+                    let value = pack(&stack_item.data.unwrap());
+                    t.set(&key, &value[..value.len().min(40000)]);
+                    n += 1;
+                    if n == 100 {
+                        t = t.commit().await.unwrap().reset();
+                        n = 0;
+                    }
+                }
+                t = t.commit().await.unwrap().reset();
+                trx = TransactionState::Transaction(t);
+            }
+
+            // Creates a new transaction and stores it in the global transaction map
+            // under the currently used transaction name.
+            NewTransaction => {
+                let name = self.cur_transaction.clone();
+                debug!("create_trx {name:?}");
+
+                let trx = self.check(number, db.create_trx())?;
+                trx.set_option(fdb::options::TransactionOption::DebugTransactionIdentifier(
+                    "RUST".to_string(),
+                ))
+                .unwrap();
+                trx.set_option(fdb::options::TransactionOption::LogTransaction)
+                    .unwrap();
+                self.transactions
+                    .insert(name, TransactionState::Transaction(trx));
+            }
+
+            // Pop the top item off of the stack as TRANSACTION_NAME. Begin using the
+            // transaction stored at TRANSACTION_NAME in the transaction map for future
+            // operations. If no entry exists in the map for the given name, a new
+            // transaction should be inserted.
+            UseTransaction => {
+                let name: Bytes = self.pop_bytes().await;
+                debug!("use_transaction {name:?}");
+                if !is_db {
+                    // Popping the name may have resolved a pending future and restored the
+                    // current transaction already. Keep that newer state if it exists.
+                    self.transactions
+                        .entry(self.cur_transaction.clone())
+                        .or_insert_with(|| std::mem::replace(&mut trx, TransactionState::Dead));
+                }
+                if !self.transactions.contains_key(&name) {
+                    let trx = self.check(number, db.create_trx())?;
+                    self.transactions
+                        .insert(name.clone(), TransactionState::Transaction(trx));
+                }
+                self.cur_transaction = name;
+            }
+            // Pops the top item off of the stack as ERROR_CODE. Passes ERROR_CODE in a
+            // language-appropriate way to the on_error method of current transaction
+            // object and blocks on the future. If on_error re-raises the error, bubbles
+            // the error out as indicated above. May optionally push a future onto the
+            // stack.
+            OnError => {
+                let trx_name = trx_name.cloned();
+                let error_code: i32 = self.pop_i32().await;
+                let error = FdbError::from_code(error_code);
+                debug!("on_error {error:?}");
+                let trx_id = self.next_trx_id();
+                let f = trx
+                    .take(trx_id)
+                    .on_error(error)
+                    .map(|res| match res {
+                        Ok(trx) => StackResult {
+                            state: trx_name.map(|n| (n, TransactionState::Transaction(trx))),
+                            data: Ok(RESULT_NOT_PRESENT.clone().into_owned()),
+                        },
+                        Err(err) => StackResult::from(err),
+                    })
+                    .boxed_local();
+                self.push_fut(number, 0, f);
+                pending = true;
+            }
+
+            // Pops the top item off of the stack as KEY and then looks up KEY in the
+            // database using the get() method. May optionally push a future onto the
+            // stack.
+            Get => {
+                let key: Bytes = self.pop_bytes().await;
+                debug!("get {key:?}");
+                let f = trx
+                    .as_mut()
+                    .get(&key, instr.pop_snapshot())
+                    .map_ok(|v| match v {
+                        Some(v) => Element::Bytes(v.to_vec().into()),
+                        None => RESULT_NOT_PRESENT.clone().into_owned(),
+                    })
+                    .map(StackResult::from)
+                    .boxed_local();
+                self.push_fut(number, 0, f);
+                pending = true;
+            }
+
+            // Pops the top four items off of the stack as KEY, OR_EQUAL, OFFSET, PREFIX
+            // and then constructs a key selector. This key selector is then resolved
+            // using the get_key() method to yield RESULT. If RESULT starts with PREFIX,
+            // then RESULT is pushed onto the stack. Otherwise, if RESULT < PREFIX, PREFIX
+            // is pushed onto the stack. If RESULT > PREFIX, then strinc(PREFIX) is pushed
+            // onto the stack. May optionally push a future onto the stack.
+            GetKey => {
+                let selector = self.pop_selector().await;
+                let prefix: Bytes = self.pop_bytes().await;
+                debug!("get_key {selector:?}, prefix = {prefix:?}");
+
+                let f = trx
+                    .as_mut()
+                    .get_key(&selector, instr.pop_snapshot())
+                    .map_ok(|key| {
+                        let key = Bytes::from(key.as_ref());
+                        let bytes = if key.starts_with(&prefix) {
+                            key
+                        } else if key < prefix {
+                            prefix
+                        } else {
+                            assert!(key > prefix);
+                            strinc(prefix)
+                        };
+                        Element::Bytes(bytes.to_vec().into())
+                    })
+                    .map(StackResult::from)
+                    .boxed_local();
+                self.push_fut(number, 0, f);
+                pending = true;
+            }
+
+            // Pops the top five items off of the stack as BEGIN_KEY, END_KEY, LIMIT,
+            // REVERSE and STREAMING_MODE. Performs a range read in a language-appropriate
+            // way using these parameters. The resulting range of n key-value pairs are
+            // packed into a tuple as [k1,v1,k2,v2,...,kn,vn], and this single packed value
+            // is pushed onto the stack.
+            //
+            // _STARTS_WITH:
+            //
+            // Pops the top four items off of the stack as PREFIX, LIMIT, REVERSE and
+            // STREAMING_MODE. Performs a prefix range read in a language-appropriate way
+            // using these parameters. Output is pushed onto the stack as with GET_RANGE.
+            //
+            // _SELECTOR:
+            //
+            // Pops the top ten items off of the stack as BEGIN_KEY, BEGIN_OR_EQUAL,
+            // BEGIN_OFFSET, END_KEY, END_OR_EQUAL, END_OFFSET, LIMIT, REVERSE,
+            // STREAMING_MODE, and PREFIX. Constructs key selectors BEGIN and END from
+            // the first six parameters, and then performs a range read in a language-
+            // appropriate way using BEGIN, END, LIMIT, REVERSE and STREAMING_MODE. Output
+            // is pushed onto the stack as with GET_RANGE, excluding any keys that do not
+            // begin with PREFIX.
+            GetRange => {
+                let selector = instr.pop_selector();
+                let starts_with = instr.pop_starts_with();
+                let snapshot = instr.pop_snapshot();
+
+                let (begin, end) = if starts_with {
+                    let begin: Bytes = self.pop_bytes().await;
+                    let end = strinc(begin.clone());
+                    (
+                        KeySelector::first_greater_or_equal(begin.0),
+                        KeySelector::first_greater_or_equal(end.0),
+                    )
+                } else if selector {
+                    let begin = self.pop_selector().await;
+                    let end = self.pop_selector().await;
+                    (begin, end)
+                } else {
+                    let begin: Bytes = self.pop_bytes().await;
+                    let end: Bytes = self.pop_bytes().await;
+                    (
+                        KeySelector::first_greater_or_equal(begin.0),
+                        KeySelector::first_greater_or_equal(end.0),
+                    )
+                };
+
+                let limit: i64 = self.pop_i64().await;
+                let reverse: i64 = self.pop_i64().await;
+                let streaming_mode: i32 = self.pop_i32().await;
+                let mode = streaming_from_value(streaming_mode);
+                debug!(
+                    "get_range begin={:?}\n, begin={:?}\n, end={:?}\n,end={:?}\n, limit={:?}, rev={:?}, mode={:?}",
+                    begin,
+                    unpack::<Element>(begin.key()),
+                    end,
+                    unpack::<Element>(end.key()),
+                    limit,
+                    reverse,
+                    mode
+                );
+
+                let prefix: Option<Bytes> = if selector {
+                    Some(self.pop_bytes().await)
+                } else {
+                    None
+                };
+                let opt = RangeOption {
+                    begin,
+                    end,
+                    mode,
+                    limit: if limit > 0 {
+                        Some(limit as usize)
+                    } else {
+                        None
+                    },
+                    reverse: reverse != 0,
+                    ..RangeOption::default()
+                };
+
+                let res = trx
+                    .as_mut()
+                    .get_ranges(opt, snapshot)
+                    .try_fold(Vec::new(), move |mut out, kvs| {
+                        for kv in kvs.iter() {
+                            let key = kv.key();
+                            let value = kv.value();
+                            debug!(" - {:?} {:?}", Bytes::from(key), Bytes::from(value));
+                            if let Some(ref prefix) = prefix {
+                                if !key.starts_with(prefix) {
+                                    continue;
+                                }
+                            }
+                            pack_into(&Bytes::from(key), &mut out);
+                            pack_into(&Bytes::from(value), &mut out);
+                        }
+                        future::ok(out)
+                    })
+                    .map_ok(|data| Element::Bytes(data.into()))
+                    .await;
+                match res {
+                    Err(err) => self.push_err(number, err),
+                    Ok(element) => self.push(number, element),
+                }
+            }
+
+            // Gets the current read version and stores it in the internal stack machine
+            // state as the last seen version. Pushed the string "GOT_READ_VERSION" onto
+            // the stack.
+            GetReadVersion => {
+                let _snapshot = instr.pop_snapshot();
+                let version = trx.as_mut().get_read_version().await;
+                match version {
+                    Ok(version) => {
+                        self.last_version = version;
+                        self.push(number, GOT_READ_VERSION.clone().into_owned());
+                    }
+                    Err(err) => self.push_err(number, err),
+                }
+            }
+
+            // Calls get_versionstamp and pushes the resulting future onto the stack.
+            GetVersionstamp => {
+                let f = trx
+                    .as_mut()
+                    .get_versionstamp()
+                    .map_ok(|v| Element::Bytes(v.to_vec().into()))
+                    .map(StackResult::from)
+                    .boxed_local();
+                self.push_fut(number, 0, f);
+                pending = true;
+            }
+
+            // Pops the top two items off of the stack as KEY and VALUE. Sets KEY to have
+            // the value VALUE. A SET_DATABASE call may optionally push a future onto the
+            // stack.
+            Set => {
+                let key: Bytes = self.pop_bytes().await;
+                let value: Bytes = self.pop_bytes().await;
+                debug!("set {key:?} {value:?}");
+                trx.as_mut().set(&key, &value);
+                mutation = true;
+            }
+
+            // Sets the current transaction read version to the internal state machine last
+            // seen version.
+            SetReadVersion => {
+                debug!("set_read_version {:?}", self.last_version);
+                trx.as_mut().set_read_version(self.last_version);
+            }
+
+            // Pops the top item off of the stack as KEY and then clears KEY from the
+            // database. A CLEAR_DATABASE call may optionally push a future onto the stack.
+            Clear => {
+                let key: Bytes = self.pop_bytes().await;
+                debug!("clear {key:?}");
+                trx.as_mut().clear(&key);
+                mutation = true;
+            }
+
+            // CLEAR_RANGE
+            // Pops the top two items off of the stack as BEGIN_KEY and END_KEY. Clears the
+            // range of keys from BEGIN_KEY to END_KEY in the database. A
+            // CLEAR_RANGE_DATABASE call may optionally push a future onto the stack.
+            //
+            // CLEAR_RANGE_STARTS_WITH
+            // Pops the top item off of the stack as PREFIX and then clears all keys from
+            // the database that begin with PREFIX. A CLEAR_RANGE_STARTS_WITH_DATABASE call
+            // may optionally push a future onto the stack.
+            ClearRange => {
+                let starts_with = instr.pop_starts_with();
+                let (begin, end) = if starts_with {
+                    let prefix = self.pop_bytes().await;
+                    range(prefix)
+                } else {
+                    let begin: Bytes = self.pop_bytes().await;
+                    let end: Bytes = self.pop_bytes().await;
+                    (begin, end)
+                };
+                debug!("clear_range {begin:?} {end:?}");
+                trx.as_mut().clear_range(&begin, &end);
+                mutation = true;
+            }
+
+            // Pops the top three items off of the stack as OPTYPE, KEY, and VALUE.
+            // Performs the atomic operation described by OPTYPE upon KEY with VALUE. An
+            // ATOMIC_OP_DATABASE call may optionally push a future onto the stack.
+            AtomicOp => {
+                let optype: String = self.pop_str().await;
+                let key: Bytes = self.pop_bytes().await;
+                let value: Bytes = self.pop_bytes().await;
+                debug!("atomic_op {key:?} {value:?} {optype:?}");
+
+                let op = mutation_from_str(&optype);
+                trx.as_mut().atomic_op(&key, &value, op);
+                mutation = true;
+            }
+
+            // Pops the top two items off of the stack as BEGIN_KEY and END_KEY. Adds a
+            // read conflict range or write conflict range from BEGIN_KEY to END_KEY.
+            // Pushes the byte string "SET_CONFLICT_RANGE" onto the stack.
+            ReadConflictRange => {
+                let begin: Bytes = self.pop_bytes().await;
+                let end: Bytes = self.pop_bytes().await;
+                debug!("read_conflict_range {begin:?} {end:?}");
+                self.push_res(
+                    number,
+                    trx.as_mut()
+                        .add_conflict_range(&begin, &end, ConflictRangeType::Read),
+                    b"SET_CONFLICT_RANGE",
+                );
+            }
+            WriteConflictRange => {
+                let begin: Bytes = self.pop_bytes().await;
+                let end: Bytes = self.pop_bytes().await;
+                debug!("write_conflict_range {begin:?} {end:?}");
+                self.push_res(
+                    number,
+                    trx.as_mut()
+                        .add_conflict_range(&begin, &end, ConflictRangeType::Write),
+                    b"SET_CONFLICT_RANGE",
+                );
+            }
+            // Pops the top item off of the stack as KEY. Adds KEY as a read conflict key
+            // or write conflict key. Pushes the byte string "SET_CONFLICT_KEY" onto the
+            // stack.
+            ReadConflictKey => {
+                let begin: Bytes = self.pop_bytes().await;
+                let mut end = begin.clone().into_owned();
+                end.push(0);
+                debug!("read_conflict_key {begin:?} {end:?}");
+                self.push_res(
+                    number,
+                    trx.as_mut()
+                        .add_conflict_range(&begin, &end, ConflictRangeType::Read),
+                    b"SET_CONFLICT_KEY",
+                );
+            }
+            WriteConflictKey => {
+                let begin: Bytes = self.pop_bytes().await;
+                let mut end = begin.clone().into_owned();
+                end.push(0);
+                debug!("write_conflict_key {begin:?} {end:?}");
+                self.push_res(
+                    number,
+                    trx.as_mut()
+                        .add_conflict_range(&begin, &end, ConflictRangeType::Write),
+                    b"SET_CONFLICT_KEY",
+                );
+            }
+            // Sets the NEXT_WRITE_NO_WRITE_CONFLICT_RANGE transaction option on the
+            // current transaction. Does not modify the stack.
+            DisableWriteConflict => {
+                debug!("disable_write_conflict");
+                self.check(
+                    number,
+                    trx.as_mut()
+                        .set_option(TransactionOption::NextWriteNoWriteConflictRange),
+                )?
+            }
+            // Commits the current transaction (with no retry behavior). May optionally
+            // push a future onto the stack.
+            Commit => {
+                debug!("commit");
+                let trx_name = trx_name.cloned();
+                let trx_id = self.next_trx_id();
+                let f = trx
+                    .take(trx_id)
+                    .commit()
+                    .map(|r| match r {
+                        Ok(c) => StackResult {
+                            state: trx_name.map(|n| (n, TransactionState::TransactionCommitted(c))),
+                            data: Ok(RESULT_NOT_PRESENT.clone().into_owned()),
+                        },
+                        Err(c) => {
+                            let err = FdbError::from_code(c.code());
+                            StackResult {
+                                state: trx_name
+                                    .map(|n| (n, TransactionState::TransactionCommitError(c))),
+                                data: Err(err),
+                            }
+                        }
+                    })
+                    .boxed_local();
+                self.push_fut(number, trx_id, f);
+                pending = true;
+            }
+            // Resets the current transaction.
+            Reset => {
+                debug!("reset");
+                trx.as_mut().reset();
+            }
+            // Cancels the current transaction.
+            Cancel => {
+                debug!("cancel");
+                let cancelled = trx.take(0).cancel();
+                trx = TransactionState::TransactionCancelled(cancelled);
+            }
+
+            // Gets the committed version from the current transaction and stores it in the
+            // internal stack machine state as the last seen version. Pushes the byte
+            // string "GOT_COMMITTED_VERSION" onto the stack.
+            GetCommittedVersion => {
+                debug!("committed_version");
+                if let TransactionState::TransactionCommitted(t) = &trx {
+                    let last_version = t
+                        .committed_version()
+                        .expect("failed to get committed version");
+                    self.last_version = last_version;
+                    self.push(number, GOT_COMMITTED_VERSION.clone().into_owned());
+                } else {
+                    warn!("committed_version() called on a non commited transaction");
+                    self.last_version = -1;
+                    self.push(number, GOT_COMMITTED_VERSION.clone().into_owned());
+                }
+            }
+
+            // Calls get_approximate_size and pushes the byte string "GOT_APPROXIMATE_SIZE"
+            // onto the stack. Note bindings may issue GET_RANGE calls with different
+            // limits, so these bindings can obtain different sizes back.
+            GetApproximateSize => {
+                debug!("get_approximate_size");
+                match trx.as_mut().get_approximate_size().await {
+                    Ok(_) => self.push(number, GOT_APPROXIMATE_SIZE_RESPONSE.clone().into_owned()),
+                    Err(error) => self.push_err(number, error),
+                }
+            }
+
+            GetRangeSplitPoints => {
+                debug!("get_range_split_points");
+                let begin: Bytes = self.pop_bytes().await;
+                let end: Bytes = self.pop_bytes().await;
+                let chunk_size = self.pop_i64().await;
+
+                match trx
+                    .as_mut()
+                    .get_range_split_points(&begin, &end, chunk_size)
+                    .await
+                {
+                    Ok(_) => {
+                        self.push(number, GET_RANGE_SPLIT_POINTS_RESPONSE.clone().into_owned())
+                    }
+                    Err(error) => self.push_err(number, error),
+                }
+            }
+
+            // Pops the top item off the stack and pushes it back on. If the top item on
+            // the stack is a future, this will have the side effect of waiting on the
+            // result of the future and pushing the result on the stack. Does not change
+            // the instruction number of the item.
+            WaitFuture => {
+                debug!("wait_future");
+                let item = self.pop().await;
+                self.stack.push(item);
+            }
+
+            // Pops the top two items off of the stack as BEGIN_KEY and END_KEY to
+            // construct a key range. Then call the `getEstimatedRangeSize` API of
+            // the language binding. Make sure the API returns without error. Finally
+            // push the string "GOT_ESTIMATED_RANGE_SIZE" onto the stack.
+            GetEstimatedRangeSize => {
+                debug!("get estimated range size");
+                let begin = self.pop_bytes().await;
+                let end = self.pop_bytes().await;
+
+                match trx
+                    .as_mut()
+                    .get_estimated_range_size_bytes(&begin, &end)
+                    .await
+                {
+                    Ok(estimate) => {
+                        debug!("got an estimate of {estimate} bytes");
+                        self.push(number, ESTIMATE_RANGE_RESPONSE.clone().into_owned());
+                    }
+                    Err(error) => {
+                        self.push_err(number, error);
+                    }
+                };
+            }
+
+            // Pops the top item off of the stack as N. Pops the next N items off of the
+            // stack and packs them as the tuple [item0,item1,...,itemN], and then pushes
+            // this single packed value onto the stack.
+            TuplePack => {
+                let n: usize = self.pop_usize().await;
+                debug!("tuple_pack {n}");
+                let mut buf = Vec::new();
+                for _ in 0..n {
+                    let element: Element = self.pop_element().await;
+                    debug!(" - {element:?}");
+                    buf.push(element);
+                }
+                let tuple = Element::Tuple(buf);
+                self.push(number, Element::Bytes(pack(&tuple).into()));
+            }
+
+            // Pops the top item off of the stack as a byte string prefix. Pops the next item
+            // off of the stack as N. Pops the next N items off of the stack and packs them
+            // as the tuple [item0,item1,...,itemN], with the provided prefix and tries to
+            // append the position of the first incomplete versionstamp as if the byte
+            // string were to be used as a key in a SET_VERSIONSTAMP_KEY atomic op. If there
+            // are no incomplete versionstamp instances, then this pushes the literal byte
+            // string 'ERROR: NONE' to the stack. If there is more than one, then this pushes
+            // the literal byte string 'ERROR: MULTIPLE'. If there is exactly one, then it pushes
+            // the literal byte string 'OK' and then pushes the packed tuple. (Languages that
+            // do not contain a 'Versionstamp' tuple-type do not have to implement this
+            // operation.)
+            TuplePackWithVersionstamp => {
+                let prefix = self.pop_bytes().await;
+                let n: usize = self.pop_usize().await;
+                debug!("tuple_pack_with_versionstamp {prefix:?} {n}");
+                let mut buf = Vec::new();
+                for _ in 0..n {
+                    let element: Element = self.pop_element().await;
+                    debug!(" - {element:?}");
+                    buf.push(element);
+                }
+
+                let tuple = Element::Tuple(buf.clone());
+                let i = tuple.count_incomplete_versionstamp();
+                let mut vec = prefix.into_owned();
+                let offset = buf.pack_into_vec_with_versionstamp(&mut vec);
+                match offset {
+                    VersionstampOffset::None { size: _ } => {
+                        assert_eq!(i, 0);
+                        self.push(number, ERROR_NONE.clone().into_owned());
+                    }
+                    VersionstampOffset::OneIncomplete { offset: _ } => {
+                        assert_eq!(i, 1);
+                        let data = Element::Bytes(vec.into());
+                        self.push(number, OK.clone().into_owned());
+                        self.push(number, data);
+                    }
+                    VersionstampOffset::MultipleIncomplete => {
+                        assert!(i > 1);
+                        self.push(number, ERROR_MULTIPLE.clone().into_owned());
+                    }
+                }
+            }
+
+            // Pops the top item off of the stack as PACKED, and then unpacks PACKED into a
+            // tuple. For each element of the tuple, packs it as a new tuple and pushes it
+            // onto the stack.
+            TupleUnpack => {
+                let data = self.pop_bytes().await;
+                debug!("tuple_unpack {data:?}");
+                let data: Vec<Element> = unpack(&data).unwrap();
+                for element in data {
+                    debug!(" - {element:?}");
+                    self.push(number, Element::Bytes(pack(&(element,)).into()));
+                }
+            }
+            // Pops the top item off of the stack as N. Pops the next N items off of the
+            // stack, and passes these items as a tuple (or array, or language-appropriate
+            // structure) to the tuple range method. Pushes the begin and end elements of
+            // the returned range onto the stack.
+            TupleRange => {
+                let n: usize = self.pop_usize().await;
+                debug!("tuple_range {n:?}");
+                let mut tup = Vec::new();
+                for _ in 0..n {
+                    let element = self.pop_element().await;
+                    tup.push(element);
+                }
+
+                let subspace = Subspace::from(tup);
+                let (start, end) = subspace.range();
+                self.push(number, Element::Bytes(start.into()));
+                self.push(number, Element::Bytes(end.into()));
+            }
+
+            // Pops the top item off of the stack as N. Pops the next N items off of the
+            // stack as packed tuples (i.e., byte strings), unpacks them, sorts the tuples,
+            // repacks them into byte strings, and then pushes these packed tuples onto
+            // the stack so that the final top of the stack now has the greatest
+            // element. If the binding has some kind of tuple comparison function, it should
+            // use that to sort. Otherwise, it should sort them lexicographically by
+            // their byte representation. The choice of function should not affect final sort order.
+            TupleSort => {
+                let n: usize = self.pop_usize().await;
+                debug!("tuple_sort {n:?}");
+                let mut tup = Vec::<Element>::new();
+                for _ in 0..n {
+                    let packed = self.pop_bytes().await;
+                    let element: Element = unpack(&packed).unwrap();
+                    debug!("- {element:?}");
+                    tup.push(element.into_owned());
+                }
+                tup.sort();
+                debug!("tuple_sorted");
+                for element in tup {
+                    debug!("- {element:?}");
+                    self.push(number, Element::Bytes(pack(&element).into()));
+                }
+            }
+
+            // Pops the top item off of the stack. This will be a byte-string of length 4
+            // containing the IEEE 754 encoding of a float in big-endian order.
+            // This is then converted into a float and pushed onto the stack.
+            EncodeFloat => {
+                let bytes = self.pop_bytes().await;
+                debug!("encode_float {bytes:?}");
+                let mut arr = [0; 4];
+                arr.copy_from_slice(&bytes);
+                let f = f32::from_bits(u32::from_be_bytes(arr));
+                self.push(number, Element::Float(f));
+            }
+            // Pops the top item off of the stack. This will be a byte-string of length 8
+            // containing the IEEE 754 encoding of a double in big-endian order.
+            // This is then converted into a double and pushed onto the stack.
+            EncodeDouble => {
+                let bytes = self.pop_bytes().await;
+                debug!("encode_double {bytes:?}");
+                let mut arr = [0; 8];
+                arr.copy_from_slice(&bytes);
+                let f = f64::from_bits(u64::from_be_bytes(arr));
+                self.push(number, Element::Double(f));
+            }
+            // Pops the top item off of the stack. This will be a single-precision float.
+            // This is converted into a (4 byte) byte-string of its IEEE 754 representation
+            // in big-endian order, and pushed onto the stack.
+            DecodeFloat => {
+                let f: f32 = match self.pop_element().await {
+                    Element::Float(v) => v,
+                    element => panic!("float was expected, found {element:?}"),
+                };
+                debug!("decode_float {f}");
+                self.push(
+                    number,
+                    Element::Bytes(f.to_bits().to_be_bytes().to_vec().into()),
+                );
+            }
+            // Pops the top item off of the stack. This will be a double-precision float.
+            // This is converted into a (8 byte) byte-string its IEEE 754 representation
+            // in big-endian order, and pushed onto the stack.
+            DecodeDouble => {
+                let f: f64 = match self.pop_element().await {
+                    Element::Double(v) => v,
+                    element => panic!("double was expected, found {element:?}"),
+                };
+                debug!("decode_double {f}");
+                self.push(
+                    number,
+                    Element::Bytes(f.to_bits().to_be_bytes().to_vec().into()),
+                );
+            }
+
+            // Pops the top item off of the stack as PREFIX. Creates a new stack machine
+            // instance operating on the same database as the current stack machine, but
+            // operating on PREFIX. The new stack machine should have independent internal
+            // state. The new stack machine should begin executing instructions concurrent
+            // with the current stack machine through a language-appropriate mechanism.
+            StartThread => {
+                let prefix = self.pop_bytes().await;
+                debug!("start_thread {prefix:?}");
+                let db = db.clone();
+                self.threads.push(
+                    thread::Builder::new()
+                        .name(format!("{prefix:?}"))
+                        .spawn(move || {
+                            let mut sm = StackMachine::new(&db, prefix.clone());
+                            futures::executor::block_on(sm.run(db)).unwrap();
+                            sm.join();
+                            debug!("thread {prefix:?} exit");
+                        })
+                        .unwrap(),
+                );
+            }
+
+            // Pops the top item off of the stack as PREFIX. Blocks execution until the
+            // range with prefix PREFIX is not present in the database. This should be
+            // implemented as a polling loop inside of a language- and binding-appropriate
+            // retryable construct which synthesizes FoundationDB error 1020 when the range
+            // is not empty. Pushes the string "WAITED_FOR_EMPTY" onto the stack when
+            // complete.
+            WaitEmpty => {
+                let prefix = self.pop_bytes().await;
+                debug!("wait_empty {prefix:?}");
+                let (begin, end) = range(prefix);
+
+                async fn wait_for_empty(
+                    trx: &Transaction,
+                    begin: &[u8],
+                    end: &[u8],
+                ) -> FdbResult<()> {
+                    let range = trx
+                        .get_range(&RangeOption::from((begin, end)), 1, false)
+                        .await?;
+
+                    debug!("wait_empty {:?} range {}", Bytes::from(begin), range.len());
+                    if !range.is_empty() {
+                        return Err(FdbError::from_code(1020));
+                    }
+                    Ok(())
+                }
+                let r = db
+                    .transact_boxed_local(
+                        (begin, end),
+                        |trx, (begin, end)| wait_for_empty(trx, begin, end).boxed_local(),
+                        TransactOption::default(),
+                    )
+                    .await;
+                self.check(number, r)?;
+                self.push(number, WAITED_FOR_EMPTY.clone().into_owned());
+            }
+
+            UnitTests => {
+                async fn unit_test(db: &fdb::Database, tr: &mut fdb::Transaction) -> FdbResult<()> {
+                    db.set_option(DatabaseOption::LocationCacheSize(100_001))?;
+                    db.set_option(DatabaseOption::MaxWatches(100_001))?;
+                    db.set_option(DatabaseOption::DatacenterId("dc_id".to_string()))?;
+                    db.set_option(DatabaseOption::MachineId("machine_id".to_string()))?;
+                    db.set_option(DatabaseOption::TransactionTimeout(100_000))?;
+                    db.set_option(DatabaseOption::TransactionTimeout(0))?;
+                    db.set_option(DatabaseOption::TransactionTimeout(0))?;
+                    db.set_option(DatabaseOption::TransactionMaxRetryDelay(100))?;
+                    db.set_option(DatabaseOption::TransactionRetryLimit(10))?;
+                    db.set_option(DatabaseOption::TransactionRetryLimit(-1))?;
+                    db.set_option(DatabaseOption::SnapshotRywEnable)?;
+                    db.set_option(DatabaseOption::SnapshotRywDisable)?;
+
+                    tr.set_option(TransactionOption::PrioritySystemImmediate)?;
+                    tr.set_option(TransactionOption::PriorityBatch)?;
+                    tr.set_option(TransactionOption::CausalReadRisky)?;
+                    tr.set_option(TransactionOption::CausalWriteRisky)?;
+                    tr.set_option(TransactionOption::ReadYourWritesDisable)?;
+                    tr.set_option(TransactionOption::ReadSystemKeys)?;
+                    tr.set_option(TransactionOption::AccessSystemKeys)?;
+                    tr.set_option(TransactionOption::Timeout(60 * 1000))?;
+                    tr.set_option(TransactionOption::RetryLimit(50))?;
+                    tr.set_option(TransactionOption::MaxRetryDelay(100))?;
+                    tr.set_option(TransactionOption::UsedDuringCommitProtectionDisable)?;
+                    tr.set_option(TransactionOption::DebugTransactionIdentifier(
+                        "my_transaction".to_string(),
+                    ))?;
+                    tr.set_option(TransactionOption::LogTransaction)?;
+                    tr.set_option(TransactionOption::ReadLockAware)?;
+                    tr.set_option(TransactionOption::LockAware)?;
+
+                    tr.get(b"\xff", false).await?;
+
+                    Ok(())
+                }
+                let r = unit_test(&db, trx.as_mut()).await;
+                self.check(number, r)?;
+
+                // TODO
+                // test_cancellation(db)
+                // test_retry_limits(db)
+                // test_db_retry_limits(db)
+                // test_timeouts(db)
+                // test_db_timeouts(db)
+                // test_combinations(db)
+                // test_locality(db)
+                // test_predicates()
+            }
+
+            // Pop 1 tuple off the stack as [path]. Pop 1 additional item as [raw_prefix].
+            // Create a subspace with path as the prefix tuple and the specified
+            // raw_prefix. Append it to the directory list.
+            DirectoryCreateSubspace => {
+                let tuple_prefix = self.pop_string_tuple(1).await;
+                let raw_prefix = self.pop_bytes().await;
+                let subspace = Subspace::from_bytes(raw_prefix.into_owned())
+                    .subspace(tuple_prefix.first().unwrap());
+                debug!(
+                    "pushing a new subspace {:?} at index {}",
+                    subspace,
+                    self.directory_stack.len()
+                );
+                self.directory_stack
+                    .push(DirectoryStackItem::Subspace(subspace));
+            }
+
+            // Pop 3 items off the stack as [index1, index2, allow_manual_prefixes]. Let
+            // node_subspace be the object in the directory list at index1 and
+            // content_subspace be the object in the directory list at index2. Create a new
+            // directory layer with the specified node_subspace and content_subspace. If
+            // allow_manual_prefixes is 1, then enable manual prefixes on the directory
+            // layer. Append the resulting directory layer to the directory list.
+            //
+            // If either of the two specified subspaces are null, then do not create a
+            // directory layer and instead push null onto the directory list.
+            DirectoryCreateLayer => {
+                let index_node_subspace = self.pop_usize().await;
+                let index_content_subspace = self.pop_usize().await;
+                let allow_manual_prefixes = self.pop_i64().await == 1;
+
+                let node_subspace = self.directory_stack.get(index_node_subspace);
+                let content_subspace = self.directory_stack.get(index_content_subspace);
+
+                match (node_subspace, content_subspace) {
+                    (Some(node_subspace), Some(content_subspace)) => {
+                        let node_subspace = match node_subspace {
+                            DirectoryStackItem::Subspace(s) => s.to_owned(),
+                            _ => panic!("expecting subspace"),
+                        };
+
+                        let content_subspace = match content_subspace {
+                            DirectoryStackItem::Subspace(s) => s.to_owned(),
+                            _ => panic!("expecting subspace"),
+                        };
+
+                        debug!("pushed a directory at index {}", self.directory_stack.len());
+
+                        self.directory_stack.push(DirectoryStackItem::Directory(
+                            DirectoryLayer::new(
+                                node_subspace,
+                                content_subspace,
+                                allow_manual_prefixes,
+                            ),
+                        ));
+                    }
+                    (node_subspace, content_subspace) => {
+                        error!(
+                            "pushing null on the directory list: {}, {}",
+                            node_subspace.is_some(),
+                            content_subspace.is_some()
+                        );
+                        self.directory_stack.push(DirectoryStackItem::Null);
+                    }
+                }
+            }
+
+            // Pop 1 tuple off the stack as [path]. Pop 2 additional items as
+            // [layer, prefix]. create a directory with the specified path, layer,
+            // and prefix. If either of layer or prefix is null, use the default value for
+            // that parameter (layer='', prefix=null).
+            DirectoryCreate => {
+                let path = self.pop_string_tuple(1).await;
+                let layer = self.pop_optional_bytes().await;
+                let prefix = self.pop_optional_bytes().await;
+
+                let directory = self
+                    .get_current_directory()
+                    .expect("could not find a directory");
+
+                let local_trx = db.create_trx().unwrap();
+                let txn = match is_db {
+                    true => &local_trx,
+                    false => match trx {
+                        TransactionState::Transaction(ref t) => t,
+                        _ => {
+                            panic!("could not find an active transaction");
+                        }
+                    },
+                };
+
+                debug!(
+                    "creating path {:?} with layer {:?} and prefix {:?} using directory at index {}",
+                    path.first().unwrap(),
+                    layer,
+                    prefix,
+                    self.directory_index,
+                );
+
+                match directory
+                    .create(
+                        txn,
+                        path.first().unwrap(),
+                        prefix.as_deref(),
+                        layer.as_deref(),
+                    )
+                    .await
+                {
+                    Ok(directory_subspace) => {
+                        debug!(
+                            "pushing DirectoryOutput at index {}",
+                            self.directory_stack.len()
+                        );
+                        self.directory_stack
+                            .push(DirectoryStackItem::DirectoryOutput(directory_subspace));
+                        if is_db {
+                            debug!("commiting local trx");
+                            local_trx.commit().await.expect("could not commit");
+                        }
+                    }
+                    Err(e) => {
+                        self.push_directory_err(&instr.code, number, e);
+                    }
+                };
+            }
+
+            // Pop 1 tuple off the stack as [path]. Pop 1 additional item as [layer]. Open
+            // a directory with the specified path and layer. If layer is null, use the
+            // default value (layer='').
+            DirectoryOpen => {
+                let path = self.pop_string_tuple(1).await;
+                let bytes_layer = self.pop_bytes().await;
+
+                let layer = if bytes_layer.is_empty() {
+                    None
+                } else {
+                    Some(bytes_layer.to_vec())
+                };
+
+                let directory = self
+                    .get_current_directory()
+                    .expect("could not find a directory");
+
+                let local_trx = db.create_trx().unwrap();
+                let txn = match is_db {
+                    true => &local_trx,
+                    false => match trx {
+                        TransactionState::Transaction(ref t) => t,
+                        _ => {
+                            panic!("could not find an active transaction");
+                        }
+                    },
+                };
+
+                debug!(
+                    "opening path {:?} with layer {:?} with index {}",
+                    path.first().unwrap(),
+                    layer,
+                    self.directory_index
+                );
+
+                match directory
+                    .open(txn, path.first().unwrap(), layer.as_deref())
+                    .await
+                {
+                    Ok(directory_subspace) => {
+                        debug!(
+                            "pushing newly opened DirectoryOutput at index {}",
+                            self.directory_stack.len()
+                        );
+                        self.directory_stack
+                            .push(DirectoryStackItem::DirectoryOutput(directory_subspace));
+
+                        if is_db {
+                            debug!("commiting local trx");
+                            local_trx.commit().await.expect("could not commit");
+                        }
+                    }
+                    Err(e) => {
+                        self.push_directory_err(&instr.code, number, e);
+                    }
+                };
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 tuple off the stack as [path]. Pop 1 additional item as [layer]. Open
+            // a directory with the specified path and layer. If layer is null, use the
+            // default value (layer='').
+            DirectoryCreateOrOpen => {
+                let path = self.pop_string_tuple(1).await;
+                let bytes_layer = self.pop_bytes().await;
+
+                let layer = if bytes_layer.is_empty() {
+                    None
+                } else {
+                    Some(bytes_layer.to_vec())
+                };
+
+                let directory = self
+                    .get_current_directory()
+                    .expect("could not find a directory");
+
+                let local_trx = db.create_trx().unwrap();
+                let txn = match is_db {
+                    true => &local_trx,
+                    false => match trx {
+                        TransactionState::Transaction(ref t) => t,
+                        _ => {
+                            panic!("could not find an active transaction");
+                        }
+                    },
+                };
+
+                debug!(
+                    "create_or_open path {:?} with layer {:?} with index {}",
+                    path.first().unwrap(),
+                    layer,
+                    self.directory_index
+                );
+                match directory
+                    .create_or_open(txn, path.first().unwrap(), None, layer.as_deref())
+                    .await
+                {
+                    Ok(directory_subspace) => {
+                        debug!(
+                            "pushing created_or_opened {:?} at index {}",
+                            directory_subspace,
+                            self.directory_stack.len()
+                        );
+                        self.directory_stack
+                            .push(DirectoryStackItem::DirectoryOutput(directory_subspace));
+                        if is_db {
+                            debug!("commiting local trx");
+                            local_trx.commit().await.expect("could not commit");
+                        }
+                    }
+                    Err(e) => self.push_directory_err(&instr.code, number, e),
+                };
+            }
+
+            // Pop the top item off the stack as [index]. Set the current directory list
+            // index to index. In the event that the directory at this new index is null
+            // (as the result of a previous error), set the directory list index to the
+            // error index.
+            DirectoryChange => {
+                self.directory_index = self.pop_usize().await;
+                debug!("setting directory_index to {}", self.directory_index);
+                match self.directory_stack.get(self.directory_index) {
+                    None => {
+                        self.directory_index = self.error_index;
+                        debug!(
+                            "setting directory_index to error index {}: no directory found",
+                            self.directory_index
+                        );
+                    }
+                    Some(d) => {
+                        if let DirectoryStackItem::Null = d {
+                            self.directory_index = self.error_index;
+                            debug!(
+                                "setting directory_index to error index {}: because it is Null",
+                                self.directory_index
+                            );
+                        }
+                    }
+                }
+            }
+
+            // Pop the top item off the stack as [error_index]. Set the current error index
+            // to error_index.
+            DirectorySetErrorIndex => {
+                self.error_index = self.pop_usize().await;
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 2 tuples off the stack as [old_path, new_path]. Call move with the
+            // specified old_path and new_path. Append the result onto the directory list.
+            DirectoryMove => {
+                let paths = self.pop_string_tuple(2).await;
+
+                let directory = self
+                    .get_current_directory()
+                    .expect("could not find a directory");
+
+                let local_trx = db.create_trx().unwrap();
+                let txn = match is_db {
+                    true => &local_trx,
+                    false => match trx {
+                        TransactionState::Transaction(ref t) => t,
+                        _ => {
+                            panic!("could not find an active transaction");
+                        }
+                    },
+                };
+
+                debug!(
+                    "moving {:?} to {:?} using directory at index {}",
+                    paths.first().unwrap(),
+                    paths.get(1).unwrap(),
+                    self.directory_index
+                );
+
+                match directory
+                    .move_to(txn, paths.first().unwrap(), paths.get(1).unwrap())
+                    .await
+                {
+                    Ok(s) => {
+                        debug!(
+                            "pushing moved directory {:?} at index {}",
+                            s,
+                            self.directory_stack.len()
+                        );
+                        self.directory_stack
+                            .push(DirectoryStackItem::DirectoryOutput(s));
+                        if is_db {
+                            debug!("commiting local trx");
+                            local_trx.commit().await.expect("could not commit");
+                        }
+                    }
+                    Err(e) => {
+                        self.push_directory_err(&instr.code, number, e);
+                    }
+                };
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 tuple off the stack as [new_absolute_path]. Call moveTo with the
+            // specified new_absolute_path. Append the result onto the directory list.
+            DirectoryMoveTo => {
+                let paths = self.pop_string_tuple(1).await;
+
+                let directory = self
+                    .get_current_directory()
+                    .expect("could not find a directory");
+
+                let local_trx = db.create_trx().unwrap();
+                let txn = match is_db {
+                    true => &local_trx,
+                    false => match trx {
+                        TransactionState::Transaction(ref t) => t,
+                        _ => {
+                            panic!("could not find an active transaction");
+                        }
+                    },
+                };
+
+                debug!("moving directory {:?} to {:?}", self.directory_index, paths);
+
+                match directory
+                    .move_directory(txn, paths.first().expect("popped tuple has no item"))
+                    .await
+                {
+                    Ok(s) => {
+                        debug!(
+                            "pushing moved directory {:?} at index {}",
+                            s,
+                            self.directory_stack.len()
+                        );
+                        self.directory_stack
+                            .push(DirectoryStackItem::DirectoryOutput(s));
+                        if is_db {
+                            debug!("commiting local trx");
+                            local_trx.commit().await.expect("could not commit");
+                        }
+                    }
+                    Err(e) => {
+                        self.push_directory_err(&instr.code, number, e);
+                    }
+                };
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 item off the stack as [count] (either 0 or 1). If count is 1, pop 1
+            // tuple off the stack as [path]. Call remove_if_exits, passing it path if one
+            // was popped.
+            DirectoryRemove => {
+                let count = self.pop_usize().await;
+                let paths = self.pop_string_tuple(count).await;
+
+                let directory = self
+                    .get_current_directory()
+                    .expect("could not find a directory");
+
+                let local_trx = db.create_trx().unwrap();
+                let txn = match is_db {
+                    true => &local_trx,
+                    false => match trx {
+                        TransactionState::Transaction(ref t) => t,
+                        _ => {
+                            panic!("could not find an active transaction");
+                        }
+                    },
+                };
+
+                let paths = paths.first().expect("could not retrieve a path");
+                debug!(
+                    "removing path {:?} using directory at index {}",
+                    paths, self.directory_index
+                );
+                match directory.remove(txn, paths).await {
+                    Ok(deleted) => {
+                        if !deleted {
+                            self.push_directory_err(
+                                &instr.code,
+                                number,
+                                DirectoryError::Other(String::from("directory does not exists")),
+                            );
+                        } else if is_db {
+                            local_trx.commit().await.expect("could not commit");
+                        }
+                    }
+                    Err(e) => {
+                        self.push_directory_err(&instr.code, number, e);
+                    }
+                }
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 item off the stack as [count] (either 0 or 1). If count is 1, pop 1
+            // tuple off the stack as [path]. Call remove_if_exits, passing it path if one
+            // was popped.
+            DirectoryRemoveIfExists => {
+                let count = self.pop_usize().await;
+                let paths = self.pop_string_tuple(count).await;
+
+                let directory = self
+                    .get_current_directory()
+                    .expect("could not find a directory");
+
+                let local_trx = db.create_trx().unwrap();
+                let txn = match is_db {
+                    true => &local_trx,
+                    false => match trx {
+                        TransactionState::Transaction(ref t) => t,
+                        _ => {
+                            panic!("could not find an active transaction");
+                        }
+                    },
+                };
+
+                let paths = paths.first().expect("could not retrieve a path");
+                match directory.remove_if_exists(txn, paths).await {
+                    Ok(_) => {
+                        if is_db {
+                            local_trx.commit().await.expect("could not commit");
+                        }
+                    }
+                    Err(err) => self.push_directory_err(&instr.code, number, err),
+                };
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 item off the stack as [count] (either 0 or 1). If count is 1, pop 1
+            // tuple off the stack as [path]. Call list, passing it path if one was popped.
+            // Pack the resulting list of directories using the tuple layer and push the
+            // packed string onto the stack.
+            DirectoryList => {
+                let count = self.pop_usize().await;
+                let paths = match count {
+                    1 => {
+                        let paths = self.pop_string_tuple(count).await;
+                        paths.first().expect("could not retrieve a path").clone()
+                    }
+                    0 => vec![],
+                    _ => panic!(),
+                };
+
+                let directory = self
+                    .get_current_directory()
+                    .expect("could not find a directory");
+
+                let local_trx = db
+                    .create_trx()
+                    .expect("could not create a local transaction");
+                let txn = match is_db {
+                    true => &local_trx,
+                    false => match trx {
+                        TransactionState::Transaction(ref t) => t,
+                        _ => {
+                            panic!("could not find an active transaction");
+                        }
+                    },
+                };
+
+                match directory.list(txn, &paths).await {
+                    Ok(children) => {
+                        let mut elements: Vec<Element> = vec![];
+                        debug!(
+                            "found {} items under path {:?} with directory at index {}:",
+                            children.len(),
+                            paths,
+                            self.directory_index
+                        );
+                        for child in children {
+                            debug!("\t - {}", child);
+                            let element = Element::String(Cow::from(child));
+                            elements.push(element);
+                        }
+                        let tuple = Element::Tuple(elements);
+                        self.push(number, Element::Bytes(Bytes::from(tuple.pack_to_vec())));
+                        if is_db {
+                            debug!("commiting local trx");
+                            local_trx.commit().await.expect("could not commit");
+                        }
+                    }
+                    Err(e) => {
+                        self.push_directory_err(&instr.code, number, e);
+                    }
+                };
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 item off the stack as [count] (either 0 or 1). If count is 1, pop 1
+            // tuple off the stack as [path]. Call exists, passing it path if one
+            // was popped. Push 1 onto the stack if the path exists and 0 if it does not.
+            DirectoryExists => {
+                let count = self.pop_usize().await;
+
+                let paths = self.pop_string_tuple(count).await;
+
+                let directory = self
+                    .get_current_directory()
+                    .expect("could not find a directory");
+
+                let local_trx = db.create_trx().unwrap();
+                let txn = match is_db {
+                    true => &local_trx,
+                    false => match trx {
+                        TransactionState::Transaction(ref t) => t,
+                        _ => {
+                            panic!("could not find an active transaction");
+                        }
+                    },
+                };
+
+                let paths = paths.first().expect("could not retrieve a path");
+                match directory.exists(txn, paths).await {
+                    Ok(exists) => {
+                        self.push(number, Element::Int(i64::from(exists)));
+                        if is_db {
+                            debug!("commiting local trx");
+                            local_trx.commit().await.expect("could not commit");
+                        }
+                    }
+                    Err(e) => {
+                        self.push_directory_err(&instr.code, number, e);
+                    }
+                };
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 tuple off the stack as [key_tuple]. Pack key_tuple and push the result
+            // onto the stack.
+            DirectoryPackKey => {
+                let n: usize = self.pop_usize().await;
+                debug!("DirectoryPackKey {n}");
+                let mut buf = Vec::with_capacity(n);
+                for _ in 0..n {
+                    let element: Element = self.pop_element().await;
+                    debug!(" - {element:?}");
+                    buf.push(element);
+                }
+
+                let tuple = Element::Tuple(buf);
+
+                match self.pack_with_current_subspace(&tuple) {
+                    None => self.push_directory_err(
+                        &instr.code,
+                        number,
+                        DirectoryError::Other(String::from("cannot pack with current item")),
+                    ),
+                    Some(bytes) => {
+                        self.push(number, Element::Bytes(bytes.into()));
+                    }
+                }
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 item off the stack as [key]. Unpack key and push the resulting tuple
+            // onto the stack one item at a time.
+            DirectoryUnpackKey => {
+                let data = self.pop_bytes().await;
+                let data = data.to_vec();
+                debug!("directory_unpack {data:?}");
+                match self.unpack_with_current_subspace(&data) {
+                    None => self.push_directory_err(
+                        &instr.code,
+                        number,
+                        DirectoryError::Other(String::from(
+                            "Cannot unpack with Directory Partition",
+                        )),
+                    ),
+                    Some(packed) => {
+                        let data: Vec<Element> = packed.unwrap();
+                        for element in data {
+                            debug!(" - {element:?}");
+                            self.push(number, Element::Tuple(vec![element.into_owned()]));
+                        }
+                    }
+                }
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 tuple off the stack as [tuple]. Create a range using tuple and push
+            // range.begin and range.end onto the stack.
+            DirectoryRange => {
+                let n: usize = self.pop_usize().await;
+                let mut buf = Vec::with_capacity(n);
+                for _ in 0..n {
+                    let element: Element = self.pop_element().await;
+                    debug!(" - {element:?}");
+                    buf.push(element);
+                }
+
+                match self.get_current_directory_item() {
+                    Some(DirectoryStackItem::DirectoryOutput(
+                        DirectoryOutput::DirectoryPartition(_d),
+                    )) => {
+                        self.push_directory_err(
+                            &instr.code,
+                            number,
+                            DirectoryError::Other(String::from(
+                                "operation not allowed on directoryPartition",
+                            )),
+                        );
+                    }
+                    _ => {
+                        let tuple = Element::Tuple(buf);
+                        match self.subspace_with_current_item(&tuple) {
+                            None => {
+                                self.push_directory_err(
+                                    &instr.code,
+                                    number,
+                                    DirectoryError::Other(String::from(
+                                        "operation not allowed on directoryPartition",
+                                    )),
+                                );
+                            }
+                            Some(subspace) => {
+                                let (begin_range, end_range) = subspace.range();
+                                self.push(number, Element::Bytes(begin_range.into()));
+                                self.push(number, Element::Bytes(end_range.into()));
+                            }
+                        }
+                    }
+                }
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 item off the stack as [key]. Check if the current directory contains
+            // the specified key. Push 1 if it does and 0 if it doesn't.
+            DirectoryContains => {
+                let raw_prefix = self.pop_bytes().await;
+                let maybe_contains = match self.get_current_directory_item() {
+                    None => None,
+                    Some(DirectoryStackItem::Subspace(s)) => Some(s.is_start_of(&raw_prefix)),
+                    Some(DirectoryStackItem::DirectoryOutput(
+                        DirectoryOutput::DirectorySubspace(s),
+                    )) => Some(s.is_start_of(&raw_prefix)),
+                    _ => None,
+                };
+                match maybe_contains {
+                    None => self.push_directory_err(
+                        &instr.code,
+                        number,
+                        DirectoryError::Other(String::from("cannot perform contains")),
+                    ),
+                    Some(bool) => self.push(number, Element::Int(bool as i64)),
+                }
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 tuple off the stack as [tuple]. Open the subspace of the current
+            // directory specified by tuple and push it onto the directory list.
+            DirectoryOpenSubspace => {
+                let n: usize = self.pop_usize().await;
+                debug!("DirectoryRange {n}");
+                let mut buf = Vec::with_capacity(n);
+                for _ in 0..n {
+                    let element: Element = self.pop_element().await;
+                    debug!(" - {element:?}");
+                    buf.push(element);
+                }
+
+                let tuple = Element::Tuple(buf);
+                match self.subspace_with_current_item(&tuple) {
+                    None => self.push_directory_err(
+                        &instr.code,
+                        number,
+                        DirectoryError::Other(String::from("Cannot subspace with current item")),
+                    ),
+                    Some(s) => self.directory_stack.push(DirectoryStackItem::Subspace(s)),
+                }
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 item off the stack as [prefix]. Let key equal
+            // prefix + tuple.pack([dir_index]). Set key to be the result of calling
+            // directory.key() in the current transaction.
+            DirectoryLogSubspace => {
+                debug!(
+                    "logging subspace {}/{}",
+                    self.directory_index,
+                    self.directory_stack.len()
+                );
+                let raw_prefix = self.pop_bytes().await;
+                let txn = match trx {
+                    TransactionState::Transaction(ref t) => t,
+                    _ => {
+                        panic!("could not find an active transaction");
+                    }
+                };
+                let key = Subspace::from_bytes(raw_prefix.into_owned()).pack(&self.directory_index);
+
+                match self.directory_stack.get(self.directory_index) {
+                    None => panic!("nothing in the stack"),
+                    Some(DirectoryStackItem::Null) => panic!("Directory is NULL"),
+                    Some(DirectoryStackItem::Directory(_)) => {
+                        panic!("trying to get a subspace, got a Directory")
+                    }
+                    Some(DirectoryStackItem::DirectoryOutput(
+                        DirectoryOutput::DirectorySubspace(d),
+                    )) => {
+                        txn.set(&key, d.bytes());
+                        debug!(
+                            "logging subspace [{}] {:?}={:?}",
+                            self.directory_index,
+                            unpack::<Vec<Element>>(&key).unwrap(),
+                            d.bytes(),
+                        );
+                    }
+                    Some(DirectoryStackItem::DirectoryOutput(
+                        DirectoryOutput::DirectoryPartition(_),
+                    )) => {
+                        self.push_directory_err(
+                            &instr.code,
+                            number,
+                            DirectoryError::Other(String::from(
+                                "cannot get key for the root of a directory partition",
+                            )),
+                        );
+                    }
+                    Some(DirectoryStackItem::Subspace(s)) => {
+                        txn.set(&key, s.bytes());
+                        debug!(
+                            "logging subspace [{}] {:?}={:?}",
+                            self.directory_index,
+                            unpack::<Vec<Element>>(&key).unwrap(),
+                            s.bytes(),
+                        );
+                    }
+                };
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 item off the stack as [raw_prefix]. Create a subspace log_subspace
+            // with path (dir_index) and the specified raw_prefix. Set:
+            //
+            // tr[log_subspace[u'path']] = the tuple packed path of the directory.
+            //
+            // tr[log_subspace[u'layer']] = the tuple packed layer of the directory.
+            //
+            // tr[log_subspace[u'exists']] = the packed tuple containing a 1 if the
+            // directory exists and 0 if it doesn't.
+            //
+            // tr[log_subspace[u'children']] the tuple packed list of children of the
+            // directory.
+            //
+            // Where log_subspace[u<str>] is the subspace packed tuple containing only the
+            // single specified unicode string <str>.
+            DirectoryLogDirectory => {
+                debug!("logging directory {}", self.directory_index);
+                let directory = self
+                    .get_current_directory()
+                    .expect("could not find a directory");
+
+                let txn = match trx {
+                    TransactionState::Transaction(ref t) => t,
+                    _ => {
+                        panic!("could not find an active transaction");
+                    }
+                };
+
+                let raw_prefix = self.pop_bytes().await;
+                let subspace =
+                    Subspace::from_bytes(raw_prefix.into_owned()).subspace(&self.directory_index);
+
+                let key_path = subspace.pack(&"path");
+                let value_path = pack(&self.get_path_for_current_directory().unwrap());
+
+                let key_layer = subspace.pack(&"layer");
+                let value_layer = pack(&self.get_layer_for_current_directory().unwrap());
+
+                let exists = directory
+                    .exists(txn, &[])
+                    .await
+                    .expect("could not list directory");
+
+                let key_exists = subspace.pack(&"exists");
+                let value_exists = pack(&Element::Tuple(vec![Element::Int(exists.into())]));
+
+                let children = if exists {
+                    directory.list(txn, &[]).await.unwrap()
+                } else {
+                    vec![]
+                };
+
+                let tuple_children = Element::Tuple(
+                    children
+                        .iter()
+                        .map(|s| Element::String(Cow::Owned(s.clone())))
+                        .collect(),
+                );
+
+                let key_children = subspace.pack(&"children");
+                let value_children = pack(&tuple_children);
+
+                txn.set(&key_path, &value_path);
+                debug!(
+                    "[{}] {:?}={:?}",
+                    self.directory_index,
+                    unpack::<Vec<Element>>(&key_path).unwrap(),
+                    unpack::<Vec<Element>>(&value_path).unwrap(),
+                );
+                txn.set(&key_layer, &value_layer);
+                debug!(
+                    "[{}] {:?}={:?}",
+                    self.directory_index,
+                    unpack::<Vec<Element>>(&key_layer).unwrap(),
+                    unpack::<Vec<Element>>(&value_layer).unwrap(),
+                );
+                txn.set(&key_exists, &value_exists);
+                debug!(
+                    "[{}] {:?}={:?}",
+                    self.directory_index,
+                    unpack::<Vec<Element>>(&key_exists).unwrap(),
+                    unpack::<Vec<Element>>(&value_exists).unwrap(),
+                );
+                txn.set(&key_children, &value_children);
+                debug!(
+                    "[{}] {:?}={:?}",
+                    self.directory_index,
+                    unpack::<Vec<Element>>(&key_children).unwrap(),
+                    unpack::<Vec<Element>>(&value_children).unwrap(),
+                );
+            }
+
+            // Use the current directory for this operation.
+            //
+            // Pop 1 item off the stack as [byte_array]. Call .key() on the current
+            // subspace and store the result as [prefix]. Throw an error if the popped
+            // array does not start with prefix. Otherwise, remove the prefix from the
+            // popped array and push the result onto the stack.
+            DirectoryStripPrefix => match self.pop_optional_bytes().await {
+                None => {
+                    self.push_directory_err(
+                        &instr.code,
+                        number,
+                        DirectoryError::Other(String::from("bad input on bytes")),
+                    );
+                }
+                Some(raw_prefix) => match self.get_bytes_for_current_directory() {
+                    None => self.push_directory_err(
+                        &instr.code,
+                        number,
+                        DirectoryError::Version(String::from(
+                            "cannot get bytes for DirectoryPartition",
+                        )),
+                    ),
+                    Some(ssb) => {
+                        if !raw_prefix.to_vec().starts_with(&ssb) {
+                            self.push_directory_err(
+                                &instr.code,
+                                number,
+                                DirectoryError::Version(String::from(
+                                    "String does not start with raw prefix",
+                                )),
+                            );
+                        } else {
+                            self.push(
+                                number,
+                                Element::Bytes(Bytes::from(raw_prefix[ssb.len()..].to_owned())),
+                            );
+                        }
+                    }
+                },
+            },
+        }
+
+        if is_db && pending {
+            let item = self.pop().await;
+            self.stack.push(item);
+        }
+
+        if is_db && mutation {
+            let r = trx.take(0).commit().await.map_err(|e| e.into());
+            self.check(number, r)?;
+            self.push(number, RESULT_NOT_PRESENT.clone().into_owned());
+        } else if !self.transactions.contains_key(&self.cur_transaction) {
+            self.transactions.insert(self.cur_transaction.clone(), trx);
+        }
+
+        if instr.has_flags() {
+            panic!("flag not handled for instr: {instr:?}");
+        }
+
+        Ok(())
+    }
+
+    async fn run(&mut self, db: Arc<Database>) -> FdbResult<()> {
+        info!("Fetching instructions...");
+        let instrs = self.fetch_instr(&db.create_trx()?).await?;
+        info!("{} instructions found", instrs.len());
+
+        for (i, instr) in instrs.into_iter().enumerate() {
+            trace!("{}/{}, {:?}", i, self.stack.len(), instr);
+            let _ = self.run_step(db.clone(), i, instr).await;
+        }
+
+        Ok(())
+    }
+
+    fn join(&mut self) {
+        for handle in self.threads.drain(0..) {
+            handle.join().expect("joined thread to not panic");
+        }
+    }
+
+    fn get_current_directory_item(&mut self) -> Option<&DirectoryStackItem> {
+        self.directory_stack.get(self.directory_index)
+    }
+
+    fn get_current_directory(&mut self) -> Option<Box<dyn Directory>> {
+        match self.get_current_directory_item() {
+            None => None,
+            Some(directory_or_subspace) => match directory_or_subspace {
+                DirectoryStackItem::Directory(d) => Some(Box::new(d.clone())),
+                DirectoryStackItem::DirectoryOutput(d) => Some(Box::new((*d).clone())),
+                _ => None,
+            },
+        }
+    }
+
+    fn pack_with_current_subspace<T: TuplePack>(&self, v: &T) -> Option<Vec<u8>> {
+        match self.directory_stack.get(self.directory_index) {
+            None => None,
+            Some(directory_or_subspace) => match directory_or_subspace {
+                DirectoryStackItem::DirectoryOutput(DirectoryOutput::DirectorySubspace(d)) => {
+                    Some(d.pack(v))
+                }
+                DirectoryStackItem::Subspace(d) => Some(d.pack(v)),
+                _ => None,
+            },
+        }
+    }
+
+    // It can return a None if it is a DirectoryPartition
+    fn unpack_with_current_subspace<'de, T: TupleUnpack<'de>>(
+        &self,
+        key: &'de [u8],
+    ) -> Option<PackResult<T>> {
+        match self.directory_stack.get(self.directory_index) {
+            None => None,
+            Some(directory_or_subspace) => match directory_or_subspace {
+                DirectoryStackItem::DirectoryOutput(d) => match d {
+                    DirectoryOutput::DirectorySubspace(directory_subspace) => {
+                        Some(directory_subspace.unpack(key))
+                    }
+                    DirectoryOutput::DirectoryPartition(_) => None,
+                },
+                DirectoryStackItem::Subspace(d) => Some(d.unpack(key)),
+                _ => None,
+            },
+        }
+    }
+
+    // It can return a None if it is a DirectoryPartition
+    fn subspace_with_current_item<T: TuplePack>(&self, t: &T) -> Option<Subspace> {
+        match self.directory_stack.get(self.directory_index) {
+            None => None,
+            Some(directory_or_subspace) => match directory_or_subspace {
+                DirectoryStackItem::DirectoryOutput(d) => match d {
+                    DirectoryOutput::DirectorySubspace(s) => Some(s.subspace(t)),
+                    DirectoryOutput::DirectoryPartition(_) => None,
+                },
+                DirectoryStackItem::Subspace(d) => Some(d.subspace(t)),
+                _ => None,
+            },
+        }
+    }
+
+    fn get_path_for_current_directory(&self) -> Option<&[String]> {
+        match self.directory_stack.get(self.directory_index) {
+            None => None,
+            Some(directory_or_subspace) => match directory_or_subspace {
+                DirectoryStackItem::Directory(d) => Some(d.get_path()),
+                DirectoryStackItem::DirectoryOutput(d) => Some(d.get_path()),
+                _ => None,
+            },
+        }
+    }
+
+    fn get_layer_for_current_directory(&self) -> Option<&[u8]> {
+        match self.directory_stack.get(self.directory_index) {
+            None => None,
+            Some(directory_or_subspace) => match directory_or_subspace {
+                DirectoryStackItem::DirectoryOutput(d) => Some(d.get_layer()),
+                DirectoryStackItem::Directory(_) => Some(&[]),
+                _ => None,
+            },
+        }
+    }
+
+    fn get_bytes_for_current_directory(&self) -> Option<Vec<u8>> {
+        match self.directory_stack.get(self.directory_index) {
+            None => None,
+            Some(directory_or_subspace) => match directory_or_subspace {
+                DirectoryStackItem::DirectoryOutput(d) => match d {
+                    DirectoryOutput::DirectorySubspace(s) => Some(Vec::from(s.bytes())),
+                    DirectoryOutput::DirectoryPartition(_) => None,
+                },
+                DirectoryStackItem::Subspace(subspace) => Some(Vec::from(subspace.bytes())),
+                _ => None,
+            },
+        }
+    }
+}
+
+fn main() {
+    let now = std::time::Instant::now();
+    env_logger::Builder::from_default_env()
+        .format(move |buf, record| {
+            let current_thread = thread::current();
+            let thread_name = current_thread.name().unwrap_or("?");
+            writeln!(
+                buf,
+                "{} {} {} - {}",
+                (std::time::Instant::now() - now).as_millis(),
+                thread_name,
+                record.level(),
+                record.args()
+            )
+        })
+        .format_timestamp_millis()
+        .target(env_logger::Target::Stdout)
+        .init();
+
+    let args = std::env::args().collect::<Vec<_>>();
+    let prefix = &args[1];
+
+    let cluster_path = if args.len() > 3 {
+        Some(args[3].as_str())
+    } else {
+        None
+    };
+
+    let api_version = args[2].parse::<i32>().expect("failed to parse api version");
+
+    info!("Starting rust bindingtester with api_version {api_version}");
+    api::FdbApiBuilder::default()
+        .set_runtime_version(api_version)
+        .build()
+        .expect("failed to initialize FoundationDB API")
+        .boot()
+        .expect("failed to start the FoundationDB network");
+
+    let db = Arc::new(
+        futures::executor::block_on(fdb::Database::new_compat(cluster_path))
+            .expect("failed to get database"),
+    );
+
+    let mut sm = StackMachine::new(&db, Bytes::from(prefix.to_owned().into_bytes()));
+    futures::executor::block_on(sm.run(db)).unwrap();
+    sm.join();
+
+    info!("Closing...");
+
+    info!("Done.");
+}
diff --git a/bindings/rust/foundationdb-gen/CHANGELOG.md b/bindings/rust/foundationdb-gen/CHANGELOG.md
new file mode 100644
index 00000000000..4bb4b01fad1
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/CHANGELOG.md
@@ -0,0 +1,162 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.11.0] - 2026-06-24
+
+### <!-- 1 -->🚀 Features
+
+- Feat: migrate workspace to Rust 2024 edition (#255)
+
+### <!-- 8 -->⚙️ Miscellaneous
+
+- Chore: align nix toolchain with CI stable (Rust 1.96) and fix 1.96 clippy lints
+
+[0.11.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.10.0..0.11.0
+
+
+## [0.10.0] - 2025-10-24
+
+### <!-- 0 -->⚠️ BREAKING CHANGES
+
+- Feat: add compile errors for missing version features
+
+### <!-- 1 -->🚀 Features
+
+- Add support 7.4
+
+### <!-- 8 -->⚙️ Miscellaneous
+
+- Bump MSRV to 1.82
+- Clippy --fix
+- Bump msrv to 1.85
+
+[0.10.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.9.2..0.10.0
+
+
+## [0.9.2] - 2025-01-06
+
+### <!-- 3 -->🆙 Bump
+
+- Bump xml-rs from 0.8.22 to 0.8.24
+
+[0.9.2]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.9.1..0.9.2
+
+## [0.9.1] - 2024-10-08
+
+### <!-- 3 -->🆙 Bump
+
+- Bump MSRV to 1.71.1
+- Bump all dependencies and setup dependabot
+
+### <!-- 4 -->⚙️ Other changes
+
+- Generate CHANGELOG per crate
+
+[0.9.1]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.9.0..0.9.1
+
+## [0.9.0] - 2024-03-15
+
+### <!-- 0 -->🚀 added
+
+- Add support for 730
+- Bump fdb crate to 0.9.0 and sim to 0.2.0
+
+### <!-- 3 -->🆙 Bump
+
+- Chore: bump rust to 1.57
+- Bump msrv
+- Bump crates version
+- Bump msrv for bindgen and env_logger
+- Bump dependencies
+
+### <!-- 4 -->⚙️ Other changes
+
+- Build on docs.rs with the required features
+- Prepare release
+- Derive `Default` for `FdbOptionTy`.
+- Cargo fmt
+- Removing default fdb version
+
+## [0.7.0] - 2022-07-11
+
+### <!-- 0 -->🚀 added
+
+- Add support for api 630
+- Bump crate version, maintainers and documentation
+- Bump rust edition to 2021
+- Add support for api 700
+- Initial commit to support fdb 7.1
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Fix integer cast possible undefined behavior
+- Fix missing import
+- Fix build for 620
+- Fix options.rs generation with bindings 610/620
+- Fix build with API 620
+- Fix Cargo.toml repository links
+- Fix #170: protect boot from undefined behavior
+- Cargo clippy fixes
+- Include fdb.options for 630
+
+### <!-- 2 -->🚜 Refactor
+
+- Remove Inflector dependency
+- Remove failure dependency
+- Remove clikengo link in Cargo.toml
+
+### <!-- 3 -->🆙 Bump
+
+- Bump version to 0.4.1
+- Bump version to 5.0.1
+- Bump deps
+
+### <!-- 4 -->⚙️ Other changes
+
+- Core: auto-generate all code at build time
+- Cleanup the fdb version features from primary crate (#99)
+- Rust edition 2018
+- Async/await: complete rewrite of foundationdb
+- Renamed foundationdb_sys import from fdb to fdb_sys for clarity
+- Cleanup dependencies and rename Error as FdbError
+- Embed 6.2.10 fdb_c.h and fdb.options
+- Embed all supported version includes
+- Default to locally available foundationdb include
+- Move include inside crate folders
+- Foundationdb-gen/sys README
+- Cargo.toml badges & docs.rs metadata
+- Use `#[non_exhaustive]` on RangeOption and generated enums
+- Update fdb 620 includes to 6.2.20
+- Update fdb 610 includes to 6.1.13
+- Default to foundation 620 api
+- Removing reference to master branch
+- Prepare for 0.7.0
+
+## [0.3.0] - 2018-11-16
+
+### <!-- 0 -->🚀 added
+
+- Add `Transaction::atomic_op`, #15
+- Add `Transaction::get_range`, #14
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Fix stable compilation error
+
+### <!-- 4 -->⚙️ Other changes
+
+- Generate options types from fdb.options
+- Use consts from sys crate
+- Allow the association of other errors to FdbError
+- Prepare 0.3 release
+
+[unreleased]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.9.0..HEAD
+[0.9.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.7.0..v0.9.0
+[0.7.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.3.0..v0.7.0
+[0.3.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.2..v0.3.0
+
+<!-- generated by git-cliff -->
diff --git a/bindings/rust/foundationdb-gen/Cargo.toml b/bindings/rust/foundationdb-gen/Cargo.toml
new file mode 100644
index 00000000000..47a95bcdc08
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/Cargo.toml
@@ -0,0 +1,46 @@
+[package]
+name = "foundationdb-gen"
+version = "0.11.0"
+authors = [
+    "Jihyun Yu <yjh0502@gmail.com>",
+    "Vincent Rouillé <vincent@clikengo.com>",
+    "Pierre Zemb <contact@pierrezemb.fr>"
+]
+edition = "2024"
+rust-version = "1.85.1"
+
+description = """
+Binding generation helper for FoundationDB.
+"""
+
+documentation = "https://docs.rs/foundationdb"
+repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+license = "MIT/Apache-2.0"
+
+readme = "README.md"
+keywords = ["foundationdb", "kv"]
+categories = ["database"]
+
+[package.metadata.docs.rs]
+features = ["embedded-fdb-include", "fdb-7_4"]
+
+[badges]
+codecov = { repository = "foundationdb-rs/foundationdb-rs", branch = "main", service = "github" }
+
+[features]
+default = []
+# Use the locally embedded foundationdb fdb.options file
+embedded-fdb-include = []
+fdb-5_1 = []
+fdb-5_2 = []
+fdb-6_0 = []
+fdb-6_1 = []
+fdb-6_2 = []
+fdb-6_3 = []
+fdb-7_0 = []
+fdb-7_1 = []
+fdb-7_3 = []
+fdb-7_4 = []
+
+[dependencies]
+xml-rs = "1.0.0"
diff --git a/bindings/rust/foundationdb-gen/README.md b/bindings/rust/foundationdb-gen/README.md
new file mode 100644
index 00000000000..019bac6d8ee
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/README.md
@@ -0,0 +1,19 @@
+# FoundationDB generator
+
+This is a helper for generating the FoundationDB bindings used by the [foundationdb](https://crates.io/crates/foundationdb) crate.
+
+## License
+
+Licensed under either of
+
+- Apache License, Version 2.0, ([LICENSE-APACHE](../LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
+- MIT license ([LICENSE-MIT](../LICENSE-MIT) or http://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the Apache-2.0
+license, shall be dual licensed as above, without any additional terms or
+conditions.
diff --git a/bindings/rust/foundationdb-gen/include/510/fdb.options b/bindings/rust/foundationdb-gen/include/510/fdb.options
new file mode 100644
index 00000000000..9f283337ac2
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/510/fdb.options
@@ -0,0 +1,251 @@
+<?xml version="1.0"?>
+
+<!--
+
+This file should not be edited outside of FoundationDB and is provided as reference for bindings writers.
+
+An <Option> looks like:
+
+  <Option name="" code=""
+          paramType="" paramOptional="true" paramDescription=""
+          description="" />
+
+name should be lowercase with underscores, except where capitalization should be somewhat
+ preserved. Individual bindings may convert everything to lowercase, everything to uppercase,
+ or title-capitalize words (but when doing so must preserve other capitalization).
+
+For example, "TLS_key_bytes" may be translated to:
+ - tls_key_bytes
+ - TLS_KEY_BYTE
+ - TLSKeyBytes
+
+If paramType is not present, the option takes no parameter. Otherwise it must be "String", 
+ "Int" or "Bytes". These will be parsed according to the C API spec.
+
+If paramType is set, paramDescription must be present and describe the parameter.
+If paramOptional is set to any value, the parameter is optional, otherwise required.
+description is not currently required but encouraged.
+
+-->
+
+<Options>
+  <Scope name="NetworkOption">
+    <Option name="local_address"  code="10" 
+            paramType="String" paramDescription="IP:PORT" 
+            description="Deprecated"/>
+    <Option name="cluster_file" code="20"
+            paramType="String" paramDescription="path to cluster file"
+            description="Deprecated"/>
+    <Option name="trace_enable" code="30"
+            paramType="String" paramDescription="path to output directory (or NULL for current working directory)"
+            description="Enables trace output to a file in a directory of the clients choosing"/>
+    <Option name="trace_roll_size" code="31"
+            paramType="Int" paramDescription="max size of a single trace output file"
+            description="Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes."/>
+    <Option name="trace_max_logs_size" code="32"
+            paramType="Int" paramDescription="max total size of trace files"
+            description="Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time."/>
+    <Option name="trace_log_group" code="33"
+            paramType="String" paramDescription="value of the logGroup attribute"
+            description="Sets the 'logGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'."/>
+    <Option name="knob" code="40"
+            paramType="String" paramDescription="knob_name=knob_value"
+            description="Set internal tuning or debugging knobs"/>
+    <Option name="TLS_plugin" code="41"
+            paramType="String" paramDescription="file path or linker-resolved name"
+            description="Set the TLS plugin to load. This option, if used, must be set before any other TLS options" />
+    <Option name="TLS_cert_bytes" code="42"
+            paramType="Bytes" paramDescription="certificates"
+            description="Set the certificate chain" />
+    <Option name="TLS_cert_path" code="43"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate chain" />
+    <Option name="TLS_key_bytes" code="45"
+            paramType="Bytes" paramDescription="key"
+            description="Set the private key corresponding to your own certificate" />
+    <Option name="TLS_key_path" code="46"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the private key corresponding to your own certificate" />
+    <Option name="TLS_verify_peers" code="47"
+            paramType="Bytes" paramDescription="verification pattern"
+            description="Set the peer certificate field verification criteria" />
+    <Option name="Buggify_enable" code="48"
+            description="" />
+    <Option name="Buggify_disable" code="49"
+            description="" />
+    <Option name="Buggify_section_activated_probability" code="50"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed." />
+    <Option name="Buggify_section_fired_probability" code="51"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active BUGGIFY section being fired" />
+    <Option name="disable_multi_version_client_api" code="60"
+            description="Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network." />
+    <Option name="callbacks_on_external_threads" code="61"
+            description="If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time." />
+    <Option name="external_client_library" code="62"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="external_client_directory" code="63"
+            paramType="String" paramDescription="path to directory containing client libraries"
+            description="Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="disable_local_client" code="64"
+            description="Prevents connections through the local client, allowing only connections through externally loaded client libraries. Intended primarily for testing." />
+    <Option name="disable_client_statistics_logging" code="70"
+            description="Disables logging of client statistics, such as sampled transaction activity." />
+    <Option name="enable_slow_task_profiling" code="71"
+            description="Enables debugging feature to perform slow task profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production." />
+    <Option name="supported_client_versions" code="1000"
+            paramType="String" paramDescription="[release version],[source version],[protocol version];..."
+            description="This option is set automatically to communicate the list of supported clients to the active client."
+            hidden="true" />
+    <Option name="external_client" code="1001"
+            description="This option is set automatically on all clients loaded externally using the multi-version API." 
+            hidden="true" />
+    <Option name="external_client_transport_id" code="1002"
+            description="This option tells a child on a multiversion client what transport ID to use."
+            paramType="Int" paramDescription="Transport ID for the child connection"
+            hidden="true" />
+  </Scope>
+
+  <Scope name="DatabaseOption">
+    <Option name="location_cache_size" code="10"
+            paramType="Int" paramDescription="Max location cache entries"
+            description="Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000." />
+    <Option name="max_watches" code="20"
+            paramType="Int" paramDescription="Max outstanding watches"
+            description="Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000." />
+    <Option name="machine_id" code="21"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing." />
+    <Option name="datacenter_id" code="22"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing." />
+  </Scope>
+  
+  <Scope name="TransactionOption">
+    <Option name="causal_write_risky" code="10"
+            description="The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault"/>
+    <Option name="causal_read_risky" code="20"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a fault or partition"/>
+    <Option name="causal_read_disable" code="21" />
+    <Option name="next_write_no_write_conflict_range" code="30"
+            description="The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on." />
+    <Option name="commit_on_first_proxy" code="40"
+            description="Committing this transaction will bypass the normal load balancing across proxies and go directly to the specifically nominated 'first proxy'." />
+    <Option name="check_writes_enable" code="50" />
+    <Option name="read_your_writes_disable" code="51"
+            description="Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction."/>
+    <Option name="read_ahead_disable" code="52"
+            description="Disables read-ahead caching for range reads. Under normal operation, a transaction will read extra rows from the database into cache if range reads are used to page through a series of data one row at a time (i.e. if a range read with a one row limit is followed by another one row range read starting immediately after the result of the first)." />
+    <Option name="durability_datacenter" code="110" />
+    <Option name="durability_risky" code="120" />
+    <Option name="durability_dev_null_is_web_scale" code="130" />
+    <Option name="priority_system_immediate" code="200"
+            description="Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools" />
+    <Option name="priority_batch" code="201"
+            description="Specifies that this transaction should be treated as low priority and that default priority transactions should be processed first. Useful for doing batch work simultaneously with latency-sensitive work" />
+    <Option name="initialize_new_database" code="300"
+            description="This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only." />
+    <Option name="access_system_keys" code="301"
+            description="Allows this transaction to read and modify system keys (those that start with the byte 0xFF)"/>
+    <Option name="read_system_keys" code="302"
+            description="Allows this transaction to read system keys (those that start with the byte 0xFF)"/>
+    <Option name="debug_dump" code="400" />
+    <Option name="debug_retry_logging" code="401" paramType="String" paramDescription="Optional transaction name" />
+    <Option name="transaction_logging_enable" code="402" paramType="String" paramDescription="String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters."
+            description="Enables tracing for this transaction and logs results to the client trace logs. Client trace logging must be enabled to get log output." />
+    <Option name="timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Like all transaction options, a timeout must be reset after a call to onError. This behavior allows the user to make the timeout dynamic." />
+    <Option name="retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to onError will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Like all transaction options, the retry limit must be reset after a call to onError. This behavior allows the user to make the retry limit dynamic." />
+    <Option name="max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to onError if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. Like all transaction options, the maximum retry delay must be reset after a call to onError. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay."/>
+    <Option name="snapshot_ryw_enable" code="600"
+            description="Snapshot read operations will see the results of writes done in the same transaction." />
+    <Option name="snapshot_ryw_disable" code="601"
+            description="Snapshot read operations will not see the results of writes done in the same transaction." />
+    <Option name="lock_aware" code="700"
+            description="The transaction can read and write to locked databases, and is resposible for checking that it took the lock."/>
+    <Option name="used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."/>
+    <Option name="read_lock_aware" code="702"
+            description="The transaction can read from locked databases."/>
+  </Scope>
+
+  <!-- The enumeration values matter - do not change them without
+       looking at fdb_c.cpp -->
+  <Scope name="StreamingMode">
+    <Option name="want_all" code="-2"
+            description="Client intends to consume the entire range and would like it all transferred as early as possible." />
+    <Option name="iterator" code="-1"
+            description="The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency." />
+    <Option name="exact" code="0"
+            description="Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used." />
+    <Option name="small" code="1"
+            description="Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early." />
+    <Option name="medium" code="2"
+            description="Infrequently used. Transfer data in batches sized in between small and large." />
+    <Option name="large" code="3"
+            description="Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode." />
+    <Option name="serial" code="4"
+            description="Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted." />
+  </Scope>
+
+  <Scope name="MutationType">
+    <Option name="add" code="2" 
+            paramType="Bytes" paramDescription="addend"
+            description="Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow."/>
+    <Option name="and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Deprecated"/>
+    <Option name="bit_and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Deprecated"/>
+    <Option name="bit_or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Deprecated"/>
+    <Option name="bit_xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="max" code="12"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database."/>
+    <Option name="min" code="13"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database."/>
+    <Option name="set_versionstamped_key" code="14"
+            paramType="Bytes" paramDescription="value to which to set the transformed key"
+            description="Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database. The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time versionstamps are compatible with the Tuple layer only in the Java and Python bindings. Note that this implies versionstamped keys may not be used with the Subspace and Directory layers except in those languages." />
+    <Option name="set_versionstamped_value" code="15"
+            paramType="Bytes" paramDescription="value to versionstamp and set"
+            description="Transforms ``param`` using a versionstamp for the transaction. Sets ``key`` in the database to the transformed parameter. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database. The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time versionstamped values are not compatible with the Tuple layer." />
+    <Option name="byte_min" code="16"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database."/>
+    <Option name="byte_max" code="17"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database."/>
+  </Scope>
+
+  <Scope name="ConflictRangeType">
+    <Option name="read" code="0" description="Used to add a read conflict range"/>
+    <Option name="write" code="1" description="Used to add a write conflict range"/>
+  </Scope>
+
+  <Scope name="ErrorPredicate">
+    <Option name="retryable" code="50000" description="Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error."/>
+    <Option name="maybe_committed" code="50001" description="Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify."/>
+    <Option name="retryable_not_committed" code="50002" description="Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried."/>
+  </Scope>
+
+</Options>
diff --git a/bindings/rust/foundationdb-gen/include/510/version.txt b/bindings/rust/foundationdb-gen/include/510/version.txt
new file mode 100644
index 00000000000..693ad745af3
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/510/version.txt
@@ -0,0 +1 @@
+5.1.7
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-gen/include/520/fdb.options b/bindings/rust/foundationdb-gen/include/520/fdb.options
new file mode 100644
index 00000000000..467e0a1adcb
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/520/fdb.options
@@ -0,0 +1,267 @@
+<?xml version="1.0"?>
+
+<!--
+
+This file should not be edited outside of FoundationDB and is provided as reference for bindings writers.
+
+An <Option> looks like:
+
+  <Option name="" code=""
+          paramType="" paramOptional="true" paramDescription=""
+          description="" />
+
+name should be lowercase with underscores, except where capitalization should be somewhat
+ preserved. Individual bindings may convert everything to lowercase, everything to uppercase,
+ or title-capitalize words (but when doing so must preserve other capitalization).
+
+For example, "TLS_key_bytes" may be translated to:
+ - tls_key_bytes
+ - TLS_KEY_BYTE
+ - TLSKeyBytes
+
+If paramType is not present, the option takes no parameter. Otherwise it must be "String", 
+ "Int" or "Bytes". These will be parsed according to the C API spec.
+
+If paramType is set, paramDescription must be present and describe the parameter.
+If paramOptional is set to any value, the parameter is optional, otherwise required.
+description is not currently required but encouraged.
+
+-->
+
+<Options>
+  <Scope name="NetworkOption">
+    <Option name="local_address"  code="10" 
+            paramType="String" paramDescription="IP:PORT" 
+            description="Deprecated"/>
+    <Option name="cluster_file" code="20"
+            paramType="String" paramDescription="path to cluster file"
+            description="Deprecated"/>
+    <Option name="trace_enable" code="30"
+            paramType="String" paramDescription="path to output directory (or NULL for current working directory)"
+            description="Enables trace output to a file in a directory of the clients choosing"/>
+    <Option name="trace_roll_size" code="31"
+            paramType="Int" paramDescription="max size of a single trace output file"
+            description="Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes."/>
+    <Option name="trace_max_logs_size" code="32"
+            paramType="Int" paramDescription="max total size of trace files"
+            description="Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time."/>
+    <Option name="trace_log_group" code="33"
+            paramType="String" paramDescription="value of the logGroup attribute"
+            description="Sets the 'logGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'."/>
+    <Option name="knob" code="40"
+            paramType="String" paramDescription="knob_name=knob_value"
+            description="Set internal tuning or debugging knobs"/>
+    <Option name="TLS_plugin" code="41"
+            paramType="String" paramDescription="file path or linker-resolved name"
+            description="Set the TLS plugin to load. This option, if used, must be set before any other TLS options" />
+    <Option name="TLS_cert_bytes" code="42"
+            paramType="Bytes" paramDescription="certificates"
+            description="Set the certificate chain" />
+    <Option name="TLS_cert_path" code="43"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate chain" />
+    <Option name="TLS_key_bytes" code="45"
+            paramType="Bytes" paramDescription="key"
+            description="Set the private key corresponding to your own certificate" />
+    <Option name="TLS_key_path" code="46"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the private key corresponding to your own certificate" />
+    <Option name="TLS_verify_peers" code="47"
+            paramType="Bytes" paramDescription="verification pattern"
+            description="Set the peer certificate field verification criteria" />
+    <Option name="Buggify_enable" code="48"
+            description="" />
+    <Option name="Buggify_disable" code="49"
+            description="" />
+    <Option name="Buggify_section_activated_probability" code="50"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed." />
+    <Option name="Buggify_section_fired_probability" code="51"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active BUGGIFY section being fired" />
+    <Option name="TLS_ca_bytes" code="52"
+            paramType="Bytes" paramDescription="ca bundle"
+            description="Set the ca bundle" />
+    <Option name="TLS_ca_path" code="53"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate authority bundle" />
+    <Option name="TLS_password" code="54"
+            paramType="String" paramDescription="key passphrase"
+            description="Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used." />
+    <Option name="disable_multi_version_client_api" code="60"
+            description="Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network." />
+    <Option name="callbacks_on_external_threads" code="61"
+            description="If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time." />
+    <Option name="external_client_library" code="62"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="external_client_directory" code="63"
+            paramType="String" paramDescription="path to directory containing client libraries"
+            description="Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="disable_local_client" code="64"
+            description="Prevents connections through the local client, allowing only connections through externally loaded client libraries. Intended primarily for testing." />
+    <Option name="disable_client_statistics_logging" code="70"
+            description="Disables logging of client statistics, such as sampled transaction activity." />
+    <Option name="enable_slow_task_profiling" code="71"
+            description="Enables debugging feature to perform slow task profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production." />
+    <Option name="supported_client_versions" code="1000"
+            paramType="String" paramDescription="[release version],[source version],[protocol version];..."
+            description="This option is set automatically to communicate the list of supported clients to the active client."
+            hidden="true" />
+    <Option name="external_client" code="1001"
+            description="This option is set automatically on all clients loaded externally using the multi-version API." 
+            hidden="true" />
+    <Option name="external_client_transport_id" code="1002"
+            description="This option tells a child on a multiversion client what transport ID to use."
+            paramType="Int" paramDescription="Transport ID for the child connection"
+            hidden="true" />
+  </Scope>
+
+  <Scope name="DatabaseOption">
+    <Option name="location_cache_size" code="10"
+            paramType="Int" paramDescription="Max location cache entries"
+            description="Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000." />
+    <Option name="max_watches" code="20"
+            paramType="Int" paramDescription="Max outstanding watches"
+            description="Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000." />
+    <Option name="machine_id" code="21"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing." />
+    <Option name="datacenter_id" code="22"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing." />
+  </Scope>
+  
+  <Scope name="TransactionOption">
+    <Option name="causal_write_risky" code="10"
+            description="The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault"/>
+    <Option name="causal_read_risky" code="20"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a fault or partition"/>
+    <Option name="causal_read_disable" code="21" />
+    <Option name="next_write_no_write_conflict_range" code="30"
+            description="The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on." />
+    <Option name="commit_on_first_proxy" code="40"
+            description="Committing this transaction will bypass the normal load balancing across proxies and go directly to the specifically nominated 'first proxy'."
+            hidden="true" />
+    <Option name="check_writes_enable" code="50"
+            hidden="true" />
+    <Option name="read_your_writes_disable" code="51"
+            description="Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction."/>
+    <Option name="read_ahead_disable" code="52"
+            description="Deprecated" />
+    <Option name="durability_datacenter" code="110" />
+    <Option name="durability_risky" code="120" />
+    <Option name="durability_dev_null_is_web_scale" code="130"
+            description="Deprecated"/>
+    <Option name="priority_system_immediate" code="200"
+            description="Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools" />
+    <Option name="priority_batch" code="201"
+            description="Specifies that this transaction should be treated as low priority and that default priority transactions should be processed first. Useful for doing batch work simultaneously with latency-sensitive work" />
+    <Option name="initialize_new_database" code="300"
+            description="This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only." />
+    <Option name="access_system_keys" code="301"
+            description="Allows this transaction to read and modify system keys (those that start with the byte 0xFF)"/>
+    <Option name="read_system_keys" code="302"
+            description="Allows this transaction to read system keys (those that start with the byte 0xFF)"/>
+    <Option name="debug_dump" code="400" 
+            hidden="true" />
+    <Option name="debug_retry_logging" code="401" paramType="String" paramDescription="Optional transaction name" />
+    <Option name="transaction_logging_enable" code="402" paramType="String" paramDescription="String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters."
+            description="Enables tracing for this transaction and logs results to the client trace logs. Client trace logging must be enabled to get log output." />
+    <Option name="timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Like all transaction options, a timeout must be reset after a call to onError. This behavior allows the user to make the timeout dynamic." />
+    <Option name="retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to onError will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Like all transaction options, the retry limit must be reset after a call to onError. This behavior allows the user to make the retry limit dynamic." />
+    <Option name="max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to onError if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. Like all transaction options, the maximum retry delay must be reset after a call to onError. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay."/>
+    <Option name="snapshot_ryw_enable" code="600"
+            description="Snapshot read operations will see the results of writes done in the same transaction." />
+    <Option name="snapshot_ryw_disable" code="601"
+            description="Snapshot read operations will not see the results of writes done in the same transaction." />
+    <Option name="lock_aware" code="700"
+            description="The transaction can read and write to locked databases, and is resposible for checking that it took the lock."/>
+    <Option name="used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."/>
+    <Option name="read_lock_aware" code="702"
+            description="The transaction can read from locked databases."/>
+  </Scope>
+
+  <!-- The enumeration values matter - do not change them without
+       looking at fdb_c.cpp -->
+  <Scope name="StreamingMode">
+    <Option name="want_all" code="-2"
+            description="Client intends to consume the entire range and would like it all transferred as early as possible." />
+    <Option name="iterator" code="-1"
+            description="The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency." />
+    <Option name="exact" code="0"
+            description="Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used." />
+    <Option name="small" code="1"
+            description="Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early." />
+    <Option name="medium" code="2"
+            description="Infrequently used. Transfer data in batches sized in between small and large." />
+    <Option name="large" code="3"
+            description="Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode." />
+    <Option name="serial" code="4"
+            description="Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted." />
+  </Scope>
+
+  <Scope name="MutationType">
+    <Option name="add" code="2" 
+            paramType="Bytes" paramDescription="addend"
+            description="Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow."/>
+    <Option name="and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Deprecated"/>
+    <Option name="bit_and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Deprecated"/>
+    <Option name="bit_or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Deprecated"/>
+    <Option name="bit_xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="append_if_fits" code="9"
+            paramType="Bytes" paramDescription="value to append to the database value"
+            description="Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size."/>
+    <Option name="max" code="12"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database."/>
+    <Option name="min" code="13"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database."/>
+    <Option name="set_versionstamped_key" code="14"
+            paramType="Bytes" paramDescription="value to which to set the transformed key"
+            description="Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java and Python bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes." />
+    <Option name="set_versionstamped_value" code="15"
+            paramType="Bytes" paramDescription="value to versionstamp and set"
+            description="Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java and Python bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset." />
+    <Option name="byte_min" code="16"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database."/>
+    <Option name="byte_max" code="17"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database."/>
+  </Scope>
+
+  <Scope name="ConflictRangeType">
+    <Option name="read" code="0" description="Used to add a read conflict range"/>
+    <Option name="write" code="1" description="Used to add a write conflict range"/>
+  </Scope>
+
+  <Scope name="ErrorPredicate">
+    <Option name="retryable" code="50000" description="Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error."/>
+    <Option name="maybe_committed" code="50001" description="Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify."/>
+    <Option name="retryable_not_committed" code="50002" description="Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried."/>
+  </Scope>
+
+</Options>
diff --git a/bindings/rust/foundationdb-gen/include/520/version.txt b/bindings/rust/foundationdb-gen/include/520/version.txt
new file mode 100644
index 00000000000..e60200b54f4
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/520/version.txt
@@ -0,0 +1 @@
+5.2.5
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-gen/include/600/fdb.options b/bindings/rust/foundationdb-gen/include/600/fdb.options
new file mode 100644
index 00000000000..89b07c125a1
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/600/fdb.options
@@ -0,0 +1,270 @@
+<?xml version="1.0"?>
+
+<!--
+
+This file should not be edited outside of FoundationDB and is provided as reference for bindings writers.
+
+An <Option> looks like:
+
+  <Option name="" code=""
+          paramType="" paramOptional="true" paramDescription=""
+          description="" />
+
+name should be lowercase with underscores, except where capitalization should be somewhat
+ preserved. Individual bindings may convert everything to lowercase, everything to uppercase,
+ or title-capitalize words (but when doing so must preserve other capitalization).
+
+For example, "TLS_key_bytes" may be translated to:
+ - tls_key_bytes
+ - TLS_KEY_BYTE
+ - TLSKeyBytes
+
+If paramType is not present, the option takes no parameter. Otherwise it must be "String", 
+ "Int" or "Bytes". These will be parsed according to the C API spec.
+
+If paramType is set, paramDescription must be present and describe the parameter.
+If paramOptional is set to any value, the parameter is optional, otherwise required.
+description is not currently required but encouraged.
+
+-->
+
+<Options>
+  <Scope name="NetworkOption">
+    <Option name="local_address"  code="10" 
+            paramType="String" paramDescription="IP:PORT" 
+            description="Deprecated"/>
+    <Option name="cluster_file" code="20"
+            paramType="String" paramDescription="path to cluster file"
+            description="Deprecated"/>
+    <Option name="trace_enable" code="30"
+            paramType="String" paramDescription="path to output directory (or NULL for current working directory)"
+            description="Enables trace output to a file in a directory of the clients choosing"/>
+    <Option name="trace_roll_size" code="31"
+            paramType="Int" paramDescription="max size of a single trace output file"
+            description="Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes."/>
+    <Option name="trace_max_logs_size" code="32"
+            paramType="Int" paramDescription="max total size of trace files"
+            description="Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time."/>
+    <Option name="trace_log_group" code="33"
+            paramType="String" paramDescription="value of the LogGroup attribute"
+            description="Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'."/>
+    <Option name="knob" code="40"
+            paramType="String" paramDescription="knob_name=knob_value"
+            description="Set internal tuning or debugging knobs"/>
+    <Option name="TLS_plugin" code="41"
+            paramType="String" paramDescription="file path or linker-resolved name"
+            description="Deprecated" />
+    <Option name="TLS_cert_bytes" code="42"
+            paramType="Bytes" paramDescription="certificates"
+            description="Set the certificate chain" />
+    <Option name="TLS_cert_path" code="43"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate chain" />
+    <Option name="TLS_key_bytes" code="45"
+            paramType="Bytes" paramDescription="key"
+            description="Set the private key corresponding to your own certificate" />
+    <Option name="TLS_key_path" code="46"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the private key corresponding to your own certificate" />
+    <Option name="TLS_verify_peers" code="47"
+            paramType="Bytes" paramDescription="verification pattern"
+            description="Set the peer certificate field verification criteria" />
+    <Option name="Buggify_enable" code="48"
+            description="" />
+    <Option name="Buggify_disable" code="49"
+            description="" />
+    <Option name="Buggify_section_activated_probability" code="50"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed." />
+    <Option name="Buggify_section_fired_probability" code="51"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active BUGGIFY section being fired" />
+    <Option name="TLS_ca_bytes" code="52"
+            paramType="Bytes" paramDescription="ca bundle"
+            description="Set the ca bundle" />
+    <Option name="TLS_ca_path" code="53"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate authority bundle" />
+    <Option name="TLS_password" code="54"
+            paramType="String" paramDescription="key passphrase"
+            description="Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used." />
+    <Option name="disable_multi_version_client_api" code="60"
+            description="Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network." />
+    <Option name="callbacks_on_external_threads" code="61"
+            description="If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time." />
+    <Option name="external_client_library" code="62"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="external_client_directory" code="63"
+            paramType="String" paramDescription="path to directory containing client libraries"
+            description="Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="disable_local_client" code="64"
+            description="Prevents connections through the local client, allowing only connections through externally loaded client libraries. Intended primarily for testing." />
+    <Option name="disable_client_statistics_logging" code="70"
+            description="Disables logging of client statistics, such as sampled transaction activity." />
+    <Option name="enable_slow_task_profiling" code="71"
+            description="Enables debugging feature to perform slow task profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production." />
+    <Option name="supported_client_versions" code="1000"
+            paramType="String" paramDescription="[release version],[source version],[protocol version];..."
+            description="This option is set automatically to communicate the list of supported clients to the active client."
+            hidden="true" />
+    <Option name="external_client" code="1001"
+            description="This option is set automatically on all clients loaded externally using the multi-version API." 
+            hidden="true" />
+    <Option name="external_client_transport_id" code="1002"
+            description="This option tells a child on a multiversion client what transport ID to use."
+            paramType="Int" paramDescription="Transport ID for the child connection"
+            hidden="true" />
+  </Scope>
+
+  <Scope name="DatabaseOption">
+    <Option name="location_cache_size" code="10"
+            paramType="Int" paramDescription="Max location cache entries"
+            description="Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000." />
+    <Option name="max_watches" code="20"
+            paramType="Int" paramDescription="Max outstanding watches"
+            description="Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000." />
+    <Option name="machine_id" code="21"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing." />
+    <Option name="datacenter_id" code="22"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing." />
+  </Scope>
+  
+  <Scope name="TransactionOption">
+    <Option name="causal_write_risky" code="10"
+            description="The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault"/>
+    <Option name="causal_read_risky" code="20"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a fault or partition"/>
+    <Option name="causal_read_disable" code="21" />
+    <Option name="next_write_no_write_conflict_range" code="30"
+            description="The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on." />
+    <Option name="commit_on_first_proxy" code="40"
+            description="Committing this transaction will bypass the normal load balancing across proxies and go directly to the specifically nominated 'first proxy'."
+            hidden="true" />
+    <Option name="check_writes_enable" code="50"
+            hidden="true" />
+    <Option name="read_your_writes_disable" code="51"
+            description="Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction."/>
+    <Option name="read_ahead_disable" code="52"
+            description="Deprecated" />
+    <Option name="durability_datacenter" code="110" />
+    <Option name="durability_risky" code="120" />
+    <Option name="durability_dev_null_is_web_scale" code="130"
+            description="Deprecated"/>
+    <Option name="priority_system_immediate" code="200"
+            description="Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools" />
+    <Option name="priority_batch" code="201"
+            description="Specifies that this transaction should be treated as low priority and that default priority transactions should be processed first. Useful for doing batch work simultaneously with latency-sensitive work" />
+    <Option name="initialize_new_database" code="300"
+            description="This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only." />
+    <Option name="access_system_keys" code="301"
+            description="Allows this transaction to read and modify system keys (those that start with the byte 0xFF)"/>
+    <Option name="read_system_keys" code="302"
+            description="Allows this transaction to read system keys (those that start with the byte 0xFF)"/>
+    <Option name="debug_dump" code="400" 
+            hidden="true" />
+    <Option name="debug_retry_logging" code="401" paramType="String" paramDescription="Optional transaction name" />
+    <Option name="transaction_logging_enable" code="402" paramType="String" paramDescription="String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters."
+            description="Enables tracing for this transaction and logs results to the client trace logs. Client trace logging must be enabled to get log output." />
+    <Option name="timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Like all transaction options, a timeout must be reset after a call to onError. This behavior allows the user to make the timeout dynamic." />
+    <Option name="retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to onError will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Like all transaction options, the retry limit must be reset after a call to onError. This behavior allows the user to make the retry limit dynamic." />
+    <Option name="max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to onError if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. Like all transaction options, the maximum retry delay must be reset after a call to onError. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay."/>
+    <Option name="snapshot_ryw_enable" code="600"
+            description="Snapshot read operations will see the results of writes done in the same transaction." />
+    <Option name="snapshot_ryw_disable" code="601"
+            description="Snapshot read operations will not see the results of writes done in the same transaction." />
+    <Option name="lock_aware" code="700"
+            description="The transaction can read and write to locked databases, and is resposible for checking that it took the lock."/>
+    <Option name="used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."/>
+    <Option name="read_lock_aware" code="702"
+            description="The transaction can read from locked databases."/>
+    <Option name="first_in_batch" code="710"
+            description="No other transactions will be applied before this transaction within the same commit version."
+            hidden="true" />
+  </Scope>
+
+  <!-- The enumeration values matter - do not change them without
+       looking at fdb_c.cpp -->
+  <Scope name="StreamingMode">
+    <Option name="want_all" code="-2"
+            description="Client intends to consume the entire range and would like it all transferred as early as possible." />
+    <Option name="iterator" code="-1"
+            description="The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency." />
+    <Option name="exact" code="0"
+            description="Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used." />
+    <Option name="small" code="1"
+            description="Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early." />
+    <Option name="medium" code="2"
+            description="Infrequently used. Transfer data in batches sized in between small and large." />
+    <Option name="large" code="3"
+            description="Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode." />
+    <Option name="serial" code="4"
+            description="Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted." />
+  </Scope>
+
+  <Scope name="MutationType">
+    <Option name="add" code="2" 
+            paramType="Bytes" paramDescription="addend"
+            description="Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow."/>
+    <Option name="and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Deprecated"/>
+    <Option name="bit_and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Deprecated"/>
+    <Option name="bit_or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Deprecated"/>
+    <Option name="bit_xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="append_if_fits" code="9"
+            paramType="Bytes" paramDescription="value to append to the database value"
+            description="Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size."/>
+    <Option name="max" code="12"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database."/>
+    <Option name="min" code="13"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database."/>
+    <Option name="set_versionstamped_key" code="14"
+            paramType="Bytes" paramDescription="value to which to set the transformed key"
+            description="Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java and Python bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes." />
+    <Option name="set_versionstamped_value" code="15"
+            paramType="Bytes" paramDescription="value to versionstamp and set"
+            description="Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java and Python bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset." />
+    <Option name="byte_min" code="16"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database."/>
+    <Option name="byte_max" code="17"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database."/>
+  </Scope>
+
+  <Scope name="ConflictRangeType">
+    <Option name="read" code="0" description="Used to add a read conflict range"/>
+    <Option name="write" code="1" description="Used to add a write conflict range"/>
+  </Scope>
+
+  <Scope name="ErrorPredicate">
+    <Option name="retryable" code="50000" description="Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error."/>
+    <Option name="maybe_committed" code="50001" description="Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify."/>
+    <Option name="retryable_not_committed" code="50002" description="Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried."/>
+  </Scope>
+
+</Options>
diff --git a/bindings/rust/foundationdb-gen/include/600/version.txt b/bindings/rust/foundationdb-gen/include/600/version.txt
new file mode 100644
index 00000000000..e23d7a6e234
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/600/version.txt
@@ -0,0 +1 @@
+6.0.18
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-gen/include/610/fdb.options b/bindings/rust/foundationdb-gen/include/610/fdb.options
new file mode 100644
index 00000000000..cba06df111b
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/610/fdb.options
@@ -0,0 +1,295 @@
+<?xml version="1.0"?>
+
+<!--
+
+This file should not be edited outside of FoundationDB and is provided as reference for bindings writers.
+
+An <Option> looks like:
+
+  <Option name="" code=""
+          paramType="" paramOptional="true" paramDescription=""
+          description="" />
+
+name should be lowercase with underscores, except where capitalization should be somewhat
+ preserved. Individual bindings may convert everything to lowercase, everything to uppercase,
+ or title-capitalize words (but when doing so must preserve other capitalization).
+
+For example, "TLS_key_bytes" may be translated to:
+ - tls_key_bytes
+ - TLS_KEY_BYTE
+ - TLSKeyBytes
+
+If paramType is not present, the option takes no parameter. Otherwise it must be "String", 
+ "Int" or "Bytes". These will be parsed according to the C API spec.
+
+If paramType is set, paramDescription must be present and describe the parameter.
+If paramOptional is set to any value, the parameter is optional, otherwise required.
+description is not currently required but encouraged.
+
+-->
+
+<Options>
+  <Scope name="NetworkOption">
+    <Option name="local_address"  code="10" 
+            paramType="String" paramDescription="IP:PORT" 
+            description="Deprecated"/>
+    <Option name="cluster_file" code="20"
+            paramType="String" paramDescription="path to cluster file"
+            description="Deprecated"/>
+    <Option name="trace_enable" code="30"
+            paramType="String" paramDescription="path to output directory (or NULL for current working directory)"
+            description="Enables trace output to a file in a directory of the clients choosing"/>
+    <Option name="trace_roll_size" code="31"
+            paramType="Int" paramDescription="max size of a single trace output file"
+            description="Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes."/>
+    <Option name="trace_max_logs_size" code="32"
+            paramType="Int" paramDescription="max total size of trace files"
+            description="Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time."/>
+    <Option name="trace_log_group" code="33"
+            paramType="String" paramDescription="value of the LogGroup attribute"
+            description="Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'."/>
+    <Option name="trace_format" code="34"
+            paramType="String" paramDescription="Format of trace files"
+            description="Select the format of the log files. xml (the default) and json are supported."/>
+    <Option name="knob" code="40"
+            paramType="String" paramDescription="knob_name=knob_value"
+            description="Set internal tuning or debugging knobs"/>
+    <Option name="TLS_plugin" code="41"
+            paramType="String" paramDescription="file path or linker-resolved name"
+            description="Deprecated" />
+    <Option name="TLS_cert_bytes" code="42"
+            paramType="Bytes" paramDescription="certificates"
+            description="Set the certificate chain" />
+    <Option name="TLS_cert_path" code="43"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate chain" />
+    <Option name="TLS_key_bytes" code="45"
+            paramType="Bytes" paramDescription="key"
+            description="Set the private key corresponding to your own certificate" />
+    <Option name="TLS_key_path" code="46"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the private key corresponding to your own certificate" />
+    <Option name="TLS_verify_peers" code="47"
+            paramType="Bytes" paramDescription="verification pattern"
+            description="Set the peer certificate field verification criteria" />
+    <Option name="Buggify_enable" code="48"
+            description="" />
+    <Option name="Buggify_disable" code="49"
+            description="" />
+    <Option name="Buggify_section_activated_probability" code="50"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed." />
+    <Option name="Buggify_section_fired_probability" code="51"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active BUGGIFY section being fired" />
+    <Option name="TLS_ca_bytes" code="52"
+            paramType="Bytes" paramDescription="ca bundle"
+            description="Set the ca bundle" />
+    <Option name="TLS_ca_path" code="53"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate authority bundle" />
+    <Option name="TLS_password" code="54"
+            paramType="String" paramDescription="key passphrase"
+            description="Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used." />
+    <Option name="disable_multi_version_client_api" code="60"
+            description="Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network." />
+    <Option name="callbacks_on_external_threads" code="61"
+            description="If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time." />
+    <Option name="external_client_library" code="62"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="external_client_directory" code="63"
+            paramType="String" paramDescription="path to directory containing client libraries"
+            description="Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="disable_local_client" code="64"
+            description="Prevents connections through the local client, allowing only connections through externally loaded client libraries. Intended primarily for testing." />
+    <Option name="disable_client_statistics_logging" code="70"
+            description="Disables logging of client statistics, such as sampled transaction activity." />
+    <Option name="enable_slow_task_profiling" code="71"
+            description="Enables debugging feature to perform slow task profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production." />
+    <Option name="supported_client_versions" code="1000"
+            paramType="String" paramDescription="[release version],[source version],[protocol version];..."
+            description="This option is set automatically to communicate the list of supported clients to the active client."
+            hidden="true" />
+    <Option name="external_client" code="1001"
+            description="This option is set automatically on all clients loaded externally using the multi-version API." 
+            hidden="true" />
+    <Option name="external_client_transport_id" code="1002"
+            description="This option tells a child on a multiversion client what transport ID to use."
+            paramType="Int" paramDescription="Transport ID for the child connection"
+            hidden="true" />
+  </Scope>
+
+  <Scope name="DatabaseOption">
+    <Option name="location_cache_size" code="10"
+            paramType="Int" paramDescription="Max location cache entries"
+            description="Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000." />
+    <Option name="max_watches" code="20"
+            paramType="Int" paramDescription="Max outstanding watches"
+            description="Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000." />
+    <Option name="machine_id" code="21"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing." />
+    <Option name="datacenter_id" code="22"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing." />
+    <Option name="transaction_timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher." />
+    <Option name="transaction_retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a timeout in milliseconds which, when elapsed, will cause a transaction automatically to be cancelled. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information." />
+    <Option name="transaction_max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information." />
+    <Option name="snapshot_ryw_enable" code="26"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="27"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+  </Scope>
+  
+  <Scope name="TransactionOption">
+    <Option name="causal_write_risky" code="10"
+            description="The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault"/>
+    <Option name="causal_read_risky" code="20"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a fault or partition"/>
+    <Option name="causal_read_disable" code="21" />
+    <Option name="next_write_no_write_conflict_range" code="30"
+            description="The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on." />
+    <Option name="commit_on_first_proxy" code="40"
+            description="Committing this transaction will bypass the normal load balancing across proxies and go directly to the specifically nominated 'first proxy'."
+            hidden="true" />
+    <Option name="check_writes_enable" code="50"
+            hidden="true" />
+    <Option name="read_your_writes_disable" code="51"
+            description="Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction."/>
+    <Option name="read_ahead_disable" code="52"
+            description="Deprecated" />
+    <Option name="durability_datacenter" code="110" />
+    <Option name="durability_risky" code="120" />
+    <Option name="durability_dev_null_is_web_scale" code="130"
+            description="Deprecated"/>
+    <Option name="priority_system_immediate" code="200"
+            description="Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools" />
+    <Option name="priority_batch" code="201"
+            description="Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work" />
+    <Option name="initialize_new_database" code="300"
+            description="This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only." />
+    <Option name="access_system_keys" code="301"
+            description="Allows this transaction to read and modify system keys (those that start with the byte 0xFF)"/>
+    <Option name="read_system_keys" code="302"
+            description="Allows this transaction to read system keys (those that start with the byte 0xFF)"/>
+    <Option name="debug_dump" code="400" 
+            hidden="true" />
+    <Option name="debug_retry_logging" code="401" paramType="String" paramDescription="Optional transaction name" />
+    <Option name="transaction_logging_enable" code="402" paramType="String" paramDescription="String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters."
+            description="Deprecated" />
+    <Option name="debug_transaction_identifier" code="403" paramType="String" paramDescription="String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters."
+            description="Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled." />
+    <Option name="log_transaction" code="404"
+            description="Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled and to get log output." />
+    <Option name="timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option." />
+    <Option name="retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option." />
+    <Option name="max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."/>
+    <Option name="snapshot_ryw_enable" code="600"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="601"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="lock_aware" code="700"
+            description="The transaction can read and write to locked databases, and is resposible for checking that it took the lock."/>
+    <Option name="used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."/>
+    <Option name="read_lock_aware" code="702"
+            description="The transaction can read from locked databases."/>
+    <Option name="first_in_batch" code="710"
+            description="No other transactions will be applied before this transaction within the same commit version."
+            hidden="true" />
+    <Option name="use_provisional_proxies" code="711"
+            description="This option should only be used by tools which change the database configuration." />
+  </Scope>
+
+  <!-- The enumeration values matter - do not change them without
+       looking at fdb_c.cpp -->
+  <Scope name="StreamingMode">
+    <Option name="want_all" code="-2"
+            description="Client intends to consume the entire range and would like it all transferred as early as possible." />
+    <Option name="iterator" code="-1"
+            description="The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency." />
+    <Option name="exact" code="0"
+            description="Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used." />
+    <Option name="small" code="1"
+            description="Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early." />
+    <Option name="medium" code="2"
+            description="Infrequently used. Transfer data in batches sized in between small and large." />
+    <Option name="large" code="3"
+            description="Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode." />
+    <Option name="serial" code="4"
+            description="Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted." />
+  </Scope>
+
+  <Scope name="MutationType">
+    <Option name="add" code="2" 
+            paramType="Bytes" paramDescription="addend"
+            description="Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow."/>
+    <Option name="and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Deprecated"/>
+    <Option name="bit_and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Deprecated"/>
+    <Option name="bit_or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Deprecated"/>
+    <Option name="bit_xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="append_if_fits" code="9"
+            paramType="Bytes" paramDescription="value to append to the database value"
+            description="Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size."/>
+    <Option name="max" code="12"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database."/>
+    <Option name="min" code="13"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database."/>
+    <Option name="set_versionstamped_key" code="14"
+            paramType="Bytes" paramDescription="value to which to set the transformed key"
+            description="Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes." />
+    <Option name="set_versionstamped_value" code="15"
+            paramType="Bytes" paramDescription="value to versionstamp and set"
+            description="Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset." />
+    <Option name="byte_min" code="16"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database."/>
+    <Option name="byte_max" code="17"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database."/>
+    <Option name="compare_and_clear" code="20"
+            paramType="Bytes" paramDescription="Value to compare with"
+            description="Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared."/>
+  </Scope>
+
+  <Scope name="ConflictRangeType">
+    <Option name="read" code="0" description="Used to add a read conflict range"/>
+    <Option name="write" code="1" description="Used to add a write conflict range"/>
+  </Scope>
+
+  <Scope name="ErrorPredicate">
+    <Option name="retryable" code="50000" description="Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error."/>
+    <Option name="maybe_committed" code="50001" description="Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify."/>
+    <Option name="retryable_not_committed" code="50002" description="Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried."/>
+  </Scope>
+
+</Options>
diff --git a/bindings/rust/foundationdb-gen/include/610/version.txt b/bindings/rust/foundationdb-gen/include/610/version.txt
new file mode 100644
index 00000000000..4b5ef77d17c
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/610/version.txt
@@ -0,0 +1 @@
+6.1.13
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-gen/include/620/fdb.options b/bindings/rust/foundationdb-gen/include/620/fdb.options
new file mode 100644
index 00000000000..2308132734f
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/620/fdb.options
@@ -0,0 +1,333 @@
+<?xml version="1.0"?>
+
+<!--
+
+This file should not be edited outside of FoundationDB and is provided as reference for bindings writers.
+
+An <Option> looks like:
+
+  <Option name="" code=""
+          paramType="" paramOptional="true" paramDescription=""
+          description="" />
+
+name should be lowercase with underscores, except where capitalization should be somewhat
+ preserved. Individual bindings may convert everything to lowercase, everything to uppercase,
+ or title-capitalize words (but when doing so must preserve other capitalization).
+
+For example, "TLS_key_bytes" may be translated to:
+ - tls_key_bytes
+ - TLS_KEY_BYTE
+ - TLSKeyBytes
+
+If paramType is not present, the option takes no parameter. Otherwise it must be "String", 
+ "Int" or "Bytes". These will be parsed according to the C API spec.
+
+If paramType is set, paramDescription must be present and describe the parameter.
+If paramOptional is set to any value, the parameter is optional, otherwise required.
+description is not currently required but encouraged.
+
+-->
+
+<Options>
+  <Scope name="NetworkOption">
+    <Option name="local_address"  code="10" 
+            paramType="String" paramDescription="IP:PORT" 
+            description="Deprecated"/>
+    <Option name="cluster_file" code="20"
+            paramType="String" paramDescription="path to cluster file"
+            description="Deprecated"/>
+    <Option name="trace_enable" code="30"
+            paramType="String" paramDescription="path to output directory (or NULL for current working directory)"
+            description="Enables trace output to a file in a directory of the clients choosing"/>
+    <Option name="trace_roll_size" code="31"
+            paramType="Int" paramDescription="max size of a single trace output file"
+            description="Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes."/>
+    <Option name="trace_max_logs_size" code="32"
+            paramType="Int" paramDescription="max total size of trace files"
+            description="Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time."/>
+    <Option name="trace_log_group" code="33"
+            paramType="String" paramDescription="value of the LogGroup attribute"
+            description="Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'."/>
+    <Option name="trace_format" code="34"
+            paramType="String" paramDescription="Format of trace files"
+            description="Select the format of the log files. xml (the default) and json are supported."/>
+    <Option name="knob" code="40"
+            paramType="String" paramDescription="knob_name=knob_value"
+            description="Set internal tuning or debugging knobs"/>
+    <Option name="TLS_plugin" code="41"
+            paramType="String" paramDescription="file path or linker-resolved name"
+            description="Deprecated" />
+    <Option name="TLS_cert_bytes" code="42"
+            paramType="Bytes" paramDescription="certificates"
+            description="Set the certificate chain" />
+    <Option name="TLS_cert_path" code="43"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate chain" />
+    <Option name="TLS_key_bytes" code="45"
+            paramType="Bytes" paramDescription="key"
+            description="Set the private key corresponding to your own certificate" />
+    <Option name="TLS_key_path" code="46"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the private key corresponding to your own certificate" />
+    <Option name="TLS_verify_peers" code="47"
+            paramType="Bytes" paramDescription="verification pattern"
+            description="Set the peer certificate field verification criteria" />
+    <Option name="Buggify_enable" code="48"
+            description="" />
+    <Option name="Buggify_disable" code="49"
+            description="" />
+    <Option name="Buggify_section_activated_probability" code="50"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed." />
+    <Option name="Buggify_section_fired_probability" code="51"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active BUGGIFY section being fired" />
+    <Option name="TLS_ca_bytes" code="52"
+            paramType="Bytes" paramDescription="ca bundle"
+            description="Set the ca bundle" />
+    <Option name="TLS_ca_path" code="53"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate authority bundle" />
+    <Option name="TLS_password" code="54"
+            paramType="String" paramDescription="key passphrase"
+            description="Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used." />
+    <Option name="disable_multi_version_client_api" code="60"
+            description="Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network." />
+    <Option name="callbacks_on_external_threads" code="61"
+            description="If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time." />
+    <Option name="external_client_library" code="62"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="external_client_directory" code="63"
+            paramType="String" paramDescription="path to directory containing client libraries"
+            description="Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="disable_local_client" code="64"
+            description="Prevents connections through the local client, allowing only connections through externally loaded client libraries. Intended primarily for testing." />
+    <Option name="disable_client_statistics_logging" code="70"
+            description="Disables logging of client statistics, such as sampled transaction activity." />
+    <Option name="enable_slow_task_profiling" code="71"
+            description="Enables debugging feature to perform slow task profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production." />
+    <Option name="client_buggify_enable" code="80"
+            description="Enable client buggify - will make requests randomly fail (intended for client testing)" />
+    <Option name="client_buggify_disable" code="81"
+            description="Disable client buggify" />
+    <Option name="client_buggify_section_activated_probability" code="82"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a CLIENT_BUGGIFY section being active for the current execution." />
+    <Option name="client_buggify_section_fired_probability" code="83"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated" />
+    <Option name="supported_client_versions" code="1000"
+            paramType="String" paramDescription="[release version],[source version],[protocol version];..."
+            description="This option is set automatically to communicate the list of supported clients to the active client."
+            hidden="true" />
+    <Option name="external_client" code="1001"
+            description="This option is set automatically on all clients loaded externally using the multi-version API." 
+            hidden="true" />
+    <Option name="external_client_transport_id" code="1002"
+            description="This option tells a child on a multiversion client what transport ID to use."
+            paramType="Int" paramDescription="Transport ID for the child connection"
+            hidden="true" />
+  </Scope>
+
+  <Scope name="DatabaseOption">
+    <Option name="location_cache_size" code="10"
+            paramType="Int" paramDescription="Max location cache entries"
+            description="Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000." />
+    <Option name="max_watches" code="20"
+            paramType="Int" paramDescription="Max outstanding watches"
+            description="Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000." />
+    <Option name="machine_id" code="21"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing." />
+    <Option name="datacenter_id" code="22"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing." />
+    <!-- The snapshot RYW options act like defaults for the equivalent transaction options, but database defaults cannot have cumulative effects from multiple calls.
+         Thus, we don't use the defaultFor annotation on these options. -->
+    <Option name="snapshot_ryw_enable" code="26"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="27"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="405"/>
+    <Option name="transaction_timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher." 
+            defaultFor="500"/>
+    <Option name="transaction_retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="501"/>
+    <Option name="transaction_max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information."
+            defaultFor="502"/>
+    <Option name="transaction_size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="503"/>
+    <Option name="transaction_causal_read_risky" code="504"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."
+            defaultFor="20"/>
+    <Option name="transaction_include_port_in_address" code="505"
+            description="Addresses returned by get_addresses_for_key include the port when enabled. This will be enabled by default in api version 630, and this option will be deprecated."
+            defaultFor="23"/>
+  </Scope>
+  
+  <Scope name="TransactionOption">
+    <Option name="causal_write_risky" code="10"
+            description="The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault"/>
+    <Option name="causal_read_risky" code="20"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."/>
+    <Option name="causal_read_disable" code="21" />
+    <Option name="include_port_in_address" code="23"
+            description="Addresses returned by get_addresses_for_key include the port when enabled. This will be enabled by default in api version 630, and this option will be deprecated." />
+    <Option name="next_write_no_write_conflict_range" code="30"
+            description="The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on." />
+    <Option name="commit_on_first_proxy" code="40"
+            description="Committing this transaction will bypass the normal load balancing across proxies and go directly to the specifically nominated 'first proxy'."
+            hidden="true" />
+    <Option name="check_writes_enable" code="50"
+            hidden="true" />
+    <Option name="read_your_writes_disable" code="51"
+            description="Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction."/>
+    <Option name="read_ahead_disable" code="52"
+            description="Deprecated" />
+    <Option name="durability_datacenter" code="110" />
+    <Option name="durability_risky" code="120" />
+    <Option name="durability_dev_null_is_web_scale" code="130"
+            description="Deprecated"/>
+    <Option name="priority_system_immediate" code="200"
+            description="Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools" />
+    <Option name="priority_batch" code="201"
+            description="Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work" />
+    <Option name="initialize_new_database" code="300"
+            description="This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only." />
+    <Option name="access_system_keys" code="301"
+            description="Allows this transaction to read and modify system keys (those that start with the byte 0xFF)"/>
+    <Option name="read_system_keys" code="302"
+            description="Allows this transaction to read system keys (those that start with the byte 0xFF)"/>
+    <Option name="debug_dump" code="400" 
+            hidden="true" />
+    <Option name="debug_retry_logging" code="401" paramType="String" paramDescription="Optional transaction name" />
+    <Option name="transaction_logging_enable" code="402" paramType="String" paramDescription="String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters."
+            description="Deprecated" />
+    <Option name="debug_transaction_identifier" code="403" paramType="String" paramDescription="String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters."
+            description="Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled." />
+    <Option name="log_transaction" code="404"
+            description="Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation." />
+    <Option name="timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true" />
+    <Option name="retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option." 
+            persistent="true"/>
+    <Option name="max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true"/>
+    <Option name="size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit." />
+    <Option name="snapshot_ryw_enable" code="600"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="601"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="lock_aware" code="700"
+            description="The transaction can read and write to locked databases, and is responsible for checking that it took the lock."/>
+    <Option name="used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."/>
+    <Option name="read_lock_aware" code="702"
+            description="The transaction can read from locked databases."/>
+    <Option name="first_in_batch" code="710"
+            description="No other transactions will be applied before this transaction within the same commit version."
+            hidden="true" />
+    <Option name="use_provisional_proxies" code="711"
+            description="This option should only be used by tools which change the database configuration." />
+  </Scope>
+
+  <!-- The enumeration values matter - do not change them without
+       looking at fdb_c.cpp -->
+  <Scope name="StreamingMode">
+    <Option name="want_all" code="-2"
+            description="Client intends to consume the entire range and would like it all transferred as early as possible." />
+    <Option name="iterator" code="-1"
+            description="The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL``" />
+    <Option name="exact" code="0"
+            description="Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used." />
+    <Option name="small" code="1"
+            description="Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early." />
+    <Option name="medium" code="2"
+            description="Infrequently used. Transfer data in batches sized in between small and large." />
+    <Option name="large" code="3"
+            description="Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode." />
+    <Option name="serial" code="4"
+            description="Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted." />
+  </Scope>
+
+  <Scope name="MutationType">
+    <Option name="add" code="2" 
+            paramType="Bytes" paramDescription="addend"
+            description="Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow."/>
+    <Option name="and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Deprecated"/>
+    <Option name="bit_and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Deprecated"/>
+    <Option name="bit_or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Deprecated"/>
+    <Option name="bit_xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="append_if_fits" code="9"
+            paramType="Bytes" paramDescription="value to append to the database value"
+            description="Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size."/>
+    <Option name="max" code="12"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database."/>
+    <Option name="min" code="13"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database."/>
+    <Option name="set_versionstamped_key" code="14"
+            paramType="Bytes" paramDescription="value to which to set the transformed key"
+            description="Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes." />
+    <Option name="set_versionstamped_value" code="15"
+            paramType="Bytes" paramDescription="value to versionstamp and set"
+            description="Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset." />
+    <Option name="byte_min" code="16"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database."/>
+    <Option name="byte_max" code="17"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database."/>
+    <Option name="compare_and_clear" code="20"
+            paramType="Bytes" paramDescription="Value to compare with"
+            description="Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared."/>
+  </Scope>
+
+  <Scope name="ConflictRangeType">
+    <Option name="read" code="0" description="Used to add a read conflict range"/>
+    <Option name="write" code="1" description="Used to add a write conflict range"/>
+  </Scope>
+
+  <Scope name="ErrorPredicate">
+    <Option name="retryable" code="50000" description="Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error."/>
+    <Option name="maybe_committed" code="50001" description="Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify."/>
+    <Option name="retryable_not_committed" code="50002" description="Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried."/>
+  </Scope>
+
+</Options>
diff --git a/bindings/rust/foundationdb-gen/include/620/version.txt b/bindings/rust/foundationdb-gen/include/620/version.txt
new file mode 100644
index 00000000000..1a87478a3f4
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/620/version.txt
@@ -0,0 +1 @@
+6.2.20
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-gen/include/630/fdb.options b/bindings/rust/foundationdb-gen/include/630/fdb.options
new file mode 100644
index 00000000000..837a2f27c86
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/630/fdb.options
@@ -0,0 +1,354 @@
+<?xml version="1.0"?>
+
+<!--
+
+This file should not be edited outside of FoundationDB and is provided as reference for bindings writers.
+
+An <Option> looks like:
+
+  <Option name="" code=""
+          paramType="" paramOptional="true" paramDescription=""
+          description="" />
+
+name should be lowercase with underscores, except where capitalization should be somewhat
+ preserved. Individual bindings may convert everything to lowercase, everything to uppercase,
+ or title-capitalize words (but when doing so must preserve other capitalization).
+
+For example, "TLS_key_bytes" may be translated to:
+ - tls_key_bytes
+ - TLS_KEY_BYTE
+ - TLSKeyBytes
+
+If paramType is not present, the option takes no parameter. Otherwise it must be "String", 
+ "Int" or "Bytes". These will be parsed according to the C API spec.
+
+If paramType is set, paramDescription must be present and describe the parameter.
+If paramOptional is set to any value, the parameter is optional, otherwise required.
+description is not currently required but encouraged.
+
+-->
+
+<Options>
+  <Scope name="NetworkOption">
+    <Option name="local_address"  code="10" 
+            paramType="String" paramDescription="IP:PORT" 
+            description="Deprecated"/>
+    <Option name="cluster_file" code="20"
+            paramType="String" paramDescription="path to cluster file"
+            description="Deprecated"/>
+    <Option name="trace_enable" code="30"
+            paramType="String" paramDescription="path to output directory (or NULL for current working directory)"
+            description="Enables trace output to a file in a directory of the clients choosing"/>
+    <Option name="trace_roll_size" code="31"
+            paramType="Int" paramDescription="max size of a single trace output file"
+            description="Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes."/>
+    <Option name="trace_max_logs_size" code="32"
+            paramType="Int" paramDescription="max total size of trace files"
+            description="Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time."/>
+    <Option name="trace_log_group" code="33"
+            paramType="String" paramDescription="value of the LogGroup attribute"
+            description="Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'."/>
+    <Option name="trace_format" code="34"
+            paramType="String" paramDescription="Format of trace files"
+            description="Select the format of the log files. xml (the default) and json are supported."/>
+    <Option name="trace_clock_source" code="35"
+            paramType="String" paramDescription="Trace clock source"
+            description="Select clock source for trace files. now (the default) or realtime are supported." />
+    <Option name="trace_file_identifier" code="36"
+            paramType="String" paramDescription="The identifier that will be part of all trace file names"
+            description="Once provided, this string will be used to replace the port/PID in the log file names." />
+    <Option name="knob" code="40"
+            paramType="String" paramDescription="knob_name=knob_value"
+            description="Set internal tuning or debugging knobs"/>
+    <Option name="TLS_plugin" code="41"
+            paramType="String" paramDescription="file path or linker-resolved name"
+            description="Deprecated" />
+    <Option name="TLS_cert_bytes" code="42"
+            paramType="Bytes" paramDescription="certificates"
+            description="Set the certificate chain" />
+    <Option name="TLS_cert_path" code="43"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate chain" />
+    <Option name="TLS_key_bytes" code="45"
+            paramType="Bytes" paramDescription="key"
+            description="Set the private key corresponding to your own certificate" />
+    <Option name="TLS_key_path" code="46"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the private key corresponding to your own certificate" />
+    <Option name="TLS_verify_peers" code="47"
+            paramType="Bytes" paramDescription="verification pattern"
+            description="Set the peer certificate field verification criteria" />
+    <Option name="Buggify_enable" code="48"
+            description="" />
+    <Option name="Buggify_disable" code="49"
+            description="" />
+    <Option name="Buggify_section_activated_probability" code="50"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed." />
+    <Option name="Buggify_section_fired_probability" code="51"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active BUGGIFY section being fired" />
+    <Option name="TLS_ca_bytes" code="52"
+            paramType="Bytes" paramDescription="ca bundle"
+            description="Set the ca bundle" />
+    <Option name="TLS_ca_path" code="53"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate authority bundle" />
+    <Option name="TLS_password" code="54"
+            paramType="String" paramDescription="key passphrase"
+            description="Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used." />
+    <Option name="disable_multi_version_client_api" code="60"
+            description="Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network." />
+    <Option name="callbacks_on_external_threads" code="61"
+            description="If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time." />
+    <Option name="external_client_library" code="62"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="external_client_directory" code="63"
+            paramType="String" paramDescription="path to directory containing client libraries"
+            description="Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="disable_local_client" code="64"
+            description="Prevents connections through the local client, allowing only connections through externally loaded client libraries." />
+    <Option name="client_threads_per_version" code="65"
+            paramType="Int" paramDescription="Number of client threads to be spawned.  Each cluster will be serviced by a single client thread."
+            description="Spawns multiple worker threads for each version of the client that is loaded.  Setting this to a number greater than one implies disable_local_client." />
+    <Option name="disable_client_statistics_logging" code="70"
+            description="Disables logging of client statistics, such as sampled transaction activity." />
+    <Option name="enable_slow_task_profiling" code="71"
+            description="Deprecated" />
+    <Option name="enable_run_loop_profiling" code="71"
+            description="Enables debugging feature to perform run loop profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production." />
+    <Option name="client_buggify_enable" code="80"
+            description="Enable client buggify - will make requests randomly fail (intended for client testing)" />
+    <Option name="client_buggify_disable" code="81"
+            description="Disable client buggify" />
+    <Option name="client_buggify_section_activated_probability" code="82"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a CLIENT_BUGGIFY section being active for the current execution." />
+    <Option name="client_buggify_section_fired_probability" code="83"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated" />
+    <Option name="supported_client_versions" code="1000"
+            paramType="String" paramDescription="[release version],[source version],[protocol version];..."
+            description="This option is set automatically to communicate the list of supported clients to the active client."
+            hidden="true" />
+    <Option name="external_client" code="1001"
+            description="This option is set automatically on all clients loaded externally using the multi-version API." 
+            hidden="true" />
+    <Option name="external_client_transport_id" code="1002"
+            description="This option tells a child on a multiversion client what transport ID to use."
+            paramType="Int" paramDescription="Transport ID for the child connection"
+            hidden="true" />
+  </Scope>
+
+  <Scope name="DatabaseOption">
+    <Option name="location_cache_size" code="10"
+            paramType="Int" paramDescription="Max location cache entries"
+            description="Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000." />
+    <Option name="max_watches" code="20"
+            paramType="Int" paramDescription="Max outstanding watches"
+            description="Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000." />
+    <Option name="machine_id" code="21"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing." />
+    <Option name="datacenter_id" code="22"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing." />
+    <!-- The snapshot RYW options act like defaults for the equivalent transaction options, but database defaults cannot have cumulative effects from multiple calls.
+         Thus, we don't use the defaultFor annotation on these options. -->
+    <Option name="snapshot_ryw_enable" code="26"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="27"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="405"/>
+    <Option name="transaction_timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher." 
+            defaultFor="500"/>
+    <Option name="transaction_retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="501"/>
+    <Option name="transaction_max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information."
+            defaultFor="502"/>
+    <Option name="transaction_size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="503"/>
+    <Option name="transaction_causal_read_risky" code="504"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."
+            defaultFor="20"/>
+    <Option name="transaction_include_port_in_address" code="505"
+            description="Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect."
+            defaultFor="23"/>
+  </Scope>
+  
+  <Scope name="TransactionOption">
+    <Option name="causal_write_risky" code="10"
+            description="The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault"/>
+    <Option name="causal_read_risky" code="20"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."/>
+    <Option name="causal_read_disable" code="21" />
+    <Option name="include_port_in_address" code="23"
+            description="Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect." />
+    <Option name="next_write_no_write_conflict_range" code="30"
+            description="The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on." />
+    <Option name="commit_on_first_proxy" code="40"
+            description="Committing this transaction will bypass the normal load balancing across proxies and go directly to the specifically nominated 'first proxy'."
+            hidden="true" />
+    <Option name="check_writes_enable" code="50"
+            hidden="true" />
+    <Option name="read_your_writes_disable" code="51"
+            description="Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction."/>
+    <Option name="read_ahead_disable" code="52"
+            description="Deprecated" />
+    <Option name="durability_datacenter" code="110" />
+    <Option name="durability_risky" code="120" />
+    <Option name="durability_dev_null_is_web_scale" code="130"
+            description="Deprecated"/>
+    <Option name="priority_system_immediate" code="200"
+            description="Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools" />
+    <Option name="priority_batch" code="201"
+            description="Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work" />
+    <Option name="initialize_new_database" code="300"
+            description="This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only." />
+    <Option name="access_system_keys" code="301"
+            description="Allows this transaction to read and modify system keys (those that start with the byte 0xFF)"/>
+    <Option name="read_system_keys" code="302"
+            description="Allows this transaction to read system keys (those that start with the byte 0xFF)"/>
+    <Option name="debug_dump" code="400" 
+            hidden="true" />
+    <Option name="debug_retry_logging" code="401" paramType="String" paramDescription="Optional transaction name" />
+    <Option name="transaction_logging_enable" code="402" paramType="String" paramDescription="String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters."
+            description="Deprecated" />
+    <Option name="debug_transaction_identifier" code="403" paramType="String" paramDescription="String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters."
+            description="Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled." />
+    <Option name="log_transaction" code="404"
+            description="Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation." />
+    <Option name="server_request_tracing" code="406"
+	    description="Sets an identifier for server tracing of this transaction. When committed, this identifier triggers logging when each part of the transaction authority encounters it, which is helpful in diagnosing slowness in misbehaving clusters. The identifier is randomly generated. When there is also a debug_transaction_identifier, both IDs are logged together." />
+    <Option name="timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true" />
+    <Option name="retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option." 
+            persistent="true"/>
+    <Option name="max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true"/>
+    <Option name="size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit." />
+    <Option name="snapshot_ryw_enable" code="600"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="601"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="lock_aware" code="700"
+            description="The transaction can read and write to locked databases, and is responsible for checking that it took the lock."/>
+    <Option name="used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."/>
+    <Option name="read_lock_aware" code="702"
+            description="The transaction can read from locked databases."/>
+    <Option name="first_in_batch" code="710"
+            description="No other transactions will be applied before this transaction within the same commit version."
+            hidden="true" />
+    <Option name="use_provisional_proxies" code="711"
+            description="This option should only be used by tools which change the database configuration." />
+    <Option name="report_conflicting_keys" code="712"
+            description="The transaction can retrieve keys that are conflicting with other transactions." />
+    <Option name="special_key_space_relaxed" code="713"
+            description="By default, the special key space will only allow users to read from exactly one module (a subspace in the special key space). Use this option to allow reading from zero or more modules. Users who set this option should be prepared for new modules, which may have different behaviors than the modules they're currently reading. For example, a new module might block or return an error." />
+    <Option name="tag" code="800" paramType="String" paramDescription="String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters."
+            description="Adds a tag to the transaction that can be used to apply manual targeted throttling. At most 5 tags can be set on a transaction." />
+    <Option name="auto_throttle_tag" code="801" paramType="String" paramDescription="String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters."
+            description="Adds a tag to the transaction that can be used to apply manual or automatic targeted throttling. At most 5 tags can be set on a transaction." />
+  </Scope>
+
+  <!-- The enumeration values matter - do not change them without
+       looking at fdb_c.cpp -->
+  <Scope name="StreamingMode">
+    <Option name="want_all" code="-2"
+            description="Client intends to consume the entire range and would like it all transferred as early as possible." />
+    <Option name="iterator" code="-1"
+            description="The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL``" />
+    <Option name="exact" code="0"
+            description="Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used." />
+    <Option name="small" code="1"
+            description="Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early." />
+    <Option name="medium" code="2"
+            description="Infrequently used. Transfer data in batches sized in between small and large." />
+    <Option name="large" code="3"
+            description="Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode." />
+    <Option name="serial" code="4"
+            description="Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted." />
+  </Scope>
+
+  <Scope name="MutationType">
+    <Option name="add" code="2" 
+            paramType="Bytes" paramDescription="addend"
+            description="Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow."/>
+    <Option name="and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Deprecated"/>
+    <Option name="bit_and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Deprecated"/>
+    <Option name="bit_or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Deprecated"/>
+    <Option name="bit_xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="append_if_fits" code="9"
+            paramType="Bytes" paramDescription="value to append to the database value"
+            description="Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size."/>
+    <Option name="max" code="12"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database."/>
+    <Option name="min" code="13"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database."/>
+    <Option name="set_versionstamped_key" code="14"
+            paramType="Bytes" paramDescription="value to which to set the transformed key"
+            description="Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes." />
+    <Option name="set_versionstamped_value" code="15"
+            paramType="Bytes" paramDescription="value to versionstamp and set"
+            description="Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset." />
+    <Option name="byte_min" code="16"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database."/>
+    <Option name="byte_max" code="17"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database."/>
+    <Option name="compare_and_clear" code="20"
+            paramType="Bytes" paramDescription="Value to compare with"
+            description="Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared."/>
+  </Scope>
+
+  <Scope name="ConflictRangeType">
+    <Option name="read" code="0" description="Used to add a read conflict range"/>
+    <Option name="write" code="1" description="Used to add a write conflict range"/>
+  </Scope>
+
+  <Scope name="ErrorPredicate">
+    <Option name="retryable" code="50000" description="Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error."/>
+    <Option name="maybe_committed" code="50001" description="Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify."/>
+    <Option name="retryable_not_committed" code="50002" description="Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried."/>
+  </Scope>
+
+</Options>
diff --git a/bindings/rust/foundationdb-gen/include/630/version.txt b/bindings/rust/foundationdb-gen/include/630/version.txt
new file mode 100644
index 00000000000..2712a2c0a05
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/630/version.txt
@@ -0,0 +1 @@
+6.3.12
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-gen/include/700/fdb.options b/bindings/rust/foundationdb-gen/include/700/fdb.options
new file mode 100644
index 00000000000..7eb035bb96e
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/700/fdb.options
@@ -0,0 +1,371 @@
+<?xml version="1.0"?>
+
+<!--
+
+This file should not be edited outside of FoundationDB and is provided as reference for bindings writers.
+
+An <Option> looks like:
+
+  <Option name="" code=""
+          paramType="" paramOptional="true" paramDescription=""
+          description="" />
+
+name should be lowercase with underscores, except where capitalization should be somewhat
+ preserved. Individual bindings may convert everything to lowercase, everything to uppercase,
+ or title-capitalize words (but when doing so must preserve other capitalization).
+
+For example, "TLS_key_bytes" may be translated to:
+ - tls_key_bytes
+ - TLS_KEY_BYTE
+ - TLSKeyBytes
+
+If paramType is not present, the option takes no parameter. Otherwise it must be "String", 
+ "Int" or "Bytes". These will be parsed according to the C API spec.
+
+If paramType is set, paramDescription must be present and describe the parameter.
+If paramOptional is set to any value, the parameter is optional, otherwise required.
+description is not currently required but encouraged.
+
+-->
+
+<Options>
+  <Scope name="NetworkOption">
+    <Option name="local_address"  code="10" 
+            paramType="String" paramDescription="IP:PORT" 
+            description="Deprecated"/>
+    <Option name="cluster_file" code="20"
+            paramType="String" paramDescription="path to cluster file"
+            description="Deprecated"/>
+    <Option name="trace_enable" code="30"
+            paramType="String" paramDescription="path to output directory (or NULL for current working directory)"
+            description="Enables trace output to a file in a directory of the clients choosing"/>
+    <Option name="trace_roll_size" code="31"
+            paramType="Int" paramDescription="max size of a single trace output file"
+            description="Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes."/>
+    <Option name="trace_max_logs_size" code="32"
+            paramType="Int" paramDescription="max total size of trace files"
+            description="Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time."/>
+    <Option name="trace_log_group" code="33"
+            paramType="String" paramDescription="value of the LogGroup attribute"
+            description="Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'."/>
+    <Option name="trace_format" code="34"
+            paramType="String" paramDescription="Format of trace files"
+            description="Select the format of the log files. xml (the default) and json are supported."/>
+    <Option name="trace_clock_source" code="35"
+            paramType="String" paramDescription="Trace clock source"
+            description="Select clock source for trace files. now (the default) or realtime are supported." />
+    <Option name="trace_file_identifier" code="36"
+            paramType="String" paramDescription="The identifier that will be part of all trace file names"
+            description="Once provided, this string will be used to replace the port/PID in the log file names." />
+    <Option name="trace_partial_file_suffix" code="39"
+            paramType="String" paramDescription="Append this suffix to partially written log files. When a log file is complete, it is renamed to remove the suffix. No separator is added between the file and the suffix. If you want to add a file extension, you should include the separator - e.g. '.tmp' instead of 'tmp' to add the 'tmp' extension."
+            description="" />
+    <Option name="knob" code="40"
+            paramType="String" paramDescription="knob_name=knob_value"
+            description="Set internal tuning or debugging knobs"/>
+    <Option name="TLS_plugin" code="41"
+            paramType="String" paramDescription="file path or linker-resolved name"
+            description="Deprecated" />
+    <Option name="TLS_cert_bytes" code="42"
+            paramType="Bytes" paramDescription="certificates"
+            description="Set the certificate chain" />
+    <Option name="TLS_cert_path" code="43"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate chain" />
+    <Option name="TLS_key_bytes" code="45"
+            paramType="Bytes" paramDescription="key"
+            description="Set the private key corresponding to your own certificate" />
+    <Option name="TLS_key_path" code="46"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the private key corresponding to your own certificate" />
+    <Option name="TLS_verify_peers" code="47"
+            paramType="Bytes" paramDescription="verification pattern"
+            description="Set the peer certificate field verification criteria" />
+    <Option name="Buggify_enable" code="48"
+            description="" />
+    <Option name="Buggify_disable" code="49"
+            description="" />
+    <Option name="Buggify_section_activated_probability" code="50"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed." />
+    <Option name="Buggify_section_fired_probability" code="51"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active BUGGIFY section being fired" />
+    <Option name="TLS_ca_bytes" code="52"
+            paramType="Bytes" paramDescription="ca bundle"
+            description="Set the ca bundle" />
+    <Option name="TLS_ca_path" code="53"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate authority bundle" />
+    <Option name="TLS_password" code="54"
+            paramType="String" paramDescription="key passphrase"
+            description="Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used." />
+    <Option name="disable_multi_version_client_api" code="60"
+            description="Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network." />
+    <Option name="callbacks_on_external_threads" code="61"
+            description="If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time." />
+    <Option name="external_client_library" code="62"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="external_client_directory" code="63"
+            paramType="String" paramDescription="path to directory containing client libraries"
+            description="Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="disable_local_client" code="64"
+            description="Prevents connections through the local client, allowing only connections through externally loaded client libraries." />
+    <Option name="client_threads_per_version" code="65"
+            paramType="Int" paramDescription="Number of client threads to be spawned.  Each cluster will be serviced by a single client thread."
+            description="Spawns multiple worker threads for each version of the client that is loaded.  Setting this to a number greater than one implies disable_local_client." />
+    <Option name="disable_client_statistics_logging" code="70"
+            description="Disables logging of client statistics, such as sampled transaction activity." />
+    <Option name="enable_slow_task_profiling" code="71"
+            description="Deprecated" />
+    <Option name="enable_run_loop_profiling" code="71"
+            description="Enables debugging feature to perform run loop profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production." />
+    <Option name="client_buggify_enable" code="80"
+            description="Enable client buggify - will make requests randomly fail (intended for client testing)" />
+    <Option name="client_buggify_disable" code="81"
+            description="Disable client buggify" />
+    <Option name="client_buggify_section_activated_probability" code="82"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a CLIENT_BUGGIFY section being active for the current execution." />
+    <Option name="client_buggify_section_fired_probability" code="83"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated" />
+    <Option name="distributed_client_tracer" code="90"
+            paramType="String" paramDescription="Distributed tracer type. Choose from none, log_file, or network_lossy"
+            description="Set a tracer to run on the client. Should be set to the same value as the tracer set on the server." />
+    <Option name="supported_client_versions" code="1000"
+            paramType="String" paramDescription="[release version],[source version],[protocol version];..."
+            description="This option is set automatically to communicate the list of supported clients to the active client."
+            hidden="true" />
+    <Option name="external_client" code="1001"
+            description="This option is set automatically on all clients loaded externally using the multi-version API." 
+            hidden="true" />
+    <Option name="external_client_transport_id" code="1002"
+            description="This option tells a child on a multiversion client what transport ID to use."
+            paramType="Int" paramDescription="Transport ID for the child connection"
+            hidden="true" />
+  </Scope>
+
+  <Scope name="DatabaseOption">
+    <Option name="location_cache_size" code="10"
+            paramType="Int" paramDescription="Max location cache entries"
+            description="Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000." />
+    <Option name="max_watches" code="20"
+            paramType="Int" paramDescription="Max outstanding watches"
+            description="Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000." />
+    <Option name="machine_id" code="21"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing." />
+    <Option name="datacenter_id" code="22"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing." />
+    <!-- The snapshot RYW options act like defaults for the equivalent transaction options, but database defaults cannot have cumulative effects from multiple calls.
+         Thus, we don't use the defaultFor annotation on these options. -->
+    <Option name="snapshot_ryw_enable" code="26"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="27"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="405"/>
+    <Option name="transaction_timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher." 
+            defaultFor="500"/>
+    <Option name="transaction_retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="501"/>
+    <Option name="transaction_max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information."
+            defaultFor="502"/>
+    <Option name="transaction_size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="503"/>
+    <Option name="transaction_causal_read_risky" code="504"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."
+            defaultFor="20"/>
+    <Option name="transaction_include_port_in_address" code="505"
+            description="Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect."
+            defaultFor="23"/>
+    <Option name="transaction_bypass_unreadable" code="700"
+            description="Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. This sets the ``bypass_unreadable`` option of each transaction created by this database. See the transaction option description for more information."
+            defaultFor="1100"/>
+  </Scope>
+  
+  <Scope name="TransactionOption">
+    <Option name="causal_write_risky" code="10"
+            description="The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault"/>
+    <Option name="causal_read_risky" code="20"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."/>
+    <Option name="causal_read_disable" code="21" />
+    <Option name="include_port_in_address" code="23"
+            description="Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect." />
+    <Option name="next_write_no_write_conflict_range" code="30"
+            description="The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on." />
+    <Option name="commit_on_first_proxy" code="40"
+            description="Committing this transaction will bypass the normal load balancing across commit proxies and go directly to the specifically nominated 'first commit proxy'."
+            hidden="true" />
+    <Option name="check_writes_enable" code="50"
+            hidden="true" />
+    <Option name="read_your_writes_disable" code="51"
+            description="Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction. It is an error to set this option after performing any reads or writes on the transaction."/>
+    <Option name="read_ahead_disable" code="52"
+            description="Deprecated" />
+    <Option name="durability_datacenter" code="110" />
+    <Option name="durability_risky" code="120" />
+    <Option name="durability_dev_null_is_web_scale" code="130"
+            description="Deprecated"/>
+    <Option name="priority_system_immediate" code="200"
+            description="Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools" />
+    <Option name="priority_batch" code="201"
+            description="Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work" />
+    <Option name="initialize_new_database" code="300"
+            description="This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only." />
+    <Option name="access_system_keys" code="301"
+            description="Allows this transaction to read and modify system keys (those that start with the byte 0xFF)"/>
+    <Option name="read_system_keys" code="302"
+            description="Allows this transaction to read system keys (those that start with the byte 0xFF)"/>
+    <Option name="debug_dump" code="400" 
+            hidden="true" />
+    <Option name="debug_retry_logging" code="401" paramType="String" paramDescription="Optional transaction name" />
+    <Option name="transaction_logging_enable" code="402" paramType="String" paramDescription="String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters."
+            description="Deprecated" />
+    <Option name="debug_transaction_identifier" code="403" paramType="String" paramDescription="String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters."
+            description="Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled." />
+    <Option name="log_transaction" code="404"
+            description="Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation." />
+    <Option name="server_request_tracing" code="406"
+	    description="Sets an identifier for server tracing of this transaction. When committed, this identifier triggers logging when each part of the transaction authority encounters it, which is helpful in diagnosing slowness in misbehaving clusters. The identifier is randomly generated. When there is also a debug_transaction_identifier, both IDs are logged together." />
+    <Option name="timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true" />
+    <Option name="retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option." 
+            persistent="true"/>
+    <Option name="max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true"/>
+    <Option name="size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit." />
+    <Option name="snapshot_ryw_enable" code="600"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="601"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="lock_aware" code="700"
+            description="The transaction can read and write to locked databases, and is responsible for checking that it took the lock."/>
+    <Option name="used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."/>
+    <Option name="read_lock_aware" code="702"
+            description="The transaction can read from locked databases."/>
+    <Option name="first_in_batch" code="710"
+            description="No other transactions will be applied before this transaction within the same commit version."
+            hidden="true" />
+    <Option name="use_provisional_proxies" code="711"
+            description="This option should only be used by tools which change the database configuration." />
+    <Option name="report_conflicting_keys" code="712"
+            description="The transaction can retrieve keys that are conflicting with other transactions." />
+    <Option name="special_key_space_relaxed" code="713"
+            description="By default, the special key space will only allow users to read from exactly one module (a subspace in the special key space). Use this option to allow reading from zero or more modules. Users who set this option should be prepared for new modules, which may have different behaviors than the modules they're currently reading. For example, a new module might block or return an error." />
+    <Option name="special_key_space_enable_writes" code="714"
+            description="By default, users are not allowed to write to special keys. Enable this option will implicitly enable all options required to achieve the configuration change." />        
+    <Option name="tag" code="800" paramType="String" paramDescription="String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters."
+            description="Adds a tag to the transaction that can be used to apply manual targeted throttling. At most 5 tags can be set on a transaction." />
+    <Option name="auto_throttle_tag" code="801" paramType="String" paramDescription="String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters."
+            description="Adds a tag to the transaction that can be used to apply manual or automatic targeted throttling. At most 5 tags can be set on a transaction." />
+    <Option name="span_parent" code="900" paramType="Bytes" paramDescription="A byte string of length 16 used to associate the span of this transaction with a parent"
+            description="Adds a parent to the Span of this transaction. Used for transaction tracing. A span can be identified with any 16 bytes"/>
+    <Option name="expensive_clear_cost_estimation_enable" code="1000"
+                description="Asks storage servers for how many bytes a clear key range contains. Otherwise uses the location cache to roughly estimate this." />
+    <Option name="bypass_unreadable" code="1100"
+                description="Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. These reads will view versionstamp operations as if they were set operations that did not fill in the versionstamp." />            
+  </Scope>
+
+  <!-- The enumeration values matter - do not change them without
+       looking at fdb_c.cpp -->
+  <Scope name="StreamingMode">
+    <Option name="want_all" code="-2"
+            description="Client intends to consume the entire range and would like it all transferred as early as possible." />
+    <Option name="iterator" code="-1"
+            description="The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL``" />
+    <Option name="exact" code="0"
+            description="Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used." />
+    <Option name="small" code="1"
+            description="Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early." />
+    <Option name="medium" code="2"
+            description="Infrequently used. Transfer data in batches sized in between small and large." />
+    <Option name="large" code="3"
+            description="Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode." />
+    <Option name="serial" code="4"
+            description="Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted." />
+  </Scope>
+
+  <Scope name="MutationType">
+    <Option name="add" code="2" 
+            paramType="Bytes" paramDescription="addend"
+            description="Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow."/>
+    <Option name="and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Deprecated"/>
+    <Option name="bit_and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Deprecated"/>
+    <Option name="bit_or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Deprecated"/>
+    <Option name="bit_xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="append_if_fits" code="9"
+            paramType="Bytes" paramDescription="value to append to the database value"
+            description="Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size."/>
+    <Option name="max" code="12"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database."/>
+    <Option name="min" code="13"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database."/>
+    <Option name="set_versionstamped_key" code="14"
+            paramType="Bytes" paramDescription="value to which to set the transformed key"
+            description="Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes." />
+    <Option name="set_versionstamped_value" code="15"
+            paramType="Bytes" paramDescription="value to versionstamp and set"
+            description="Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset." />
+    <Option name="byte_min" code="16"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database."/>
+    <Option name="byte_max" code="17"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database."/>
+    <Option name="compare_and_clear" code="20"
+            paramType="Bytes" paramDescription="Value to compare with"
+            description="Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared."/>
+  </Scope>
+
+  <Scope name="ConflictRangeType">
+    <Option name="read" code="0" description="Used to add a read conflict range"/>
+    <Option name="write" code="1" description="Used to add a write conflict range"/>
+  </Scope>
+
+  <Scope name="ErrorPredicate">
+    <Option name="retryable" code="50000" description="Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error."/>
+    <Option name="maybe_committed" code="50001" description="Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify."/>
+    <Option name="retryable_not_committed" code="50002" description="Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried."/>
+  </Scope>
+
+</Options>
diff --git a/bindings/rust/foundationdb-gen/include/700/version.txt b/bindings/rust/foundationdb-gen/include/700/version.txt
new file mode 100644
index 00000000000..4122521804f
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/700/version.txt
@@ -0,0 +1 @@
+7.0.0
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-gen/include/710/fdb.options b/bindings/rust/foundationdb-gen/include/710/fdb.options
new file mode 100644
index 00000000000..9f2f9e52f93
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/710/fdb.options
@@ -0,0 +1,382 @@
+<?xml version="1.0"?>
+
+<!--
+
+This file should not be edited outside of FoundationDB and is provided as reference for bindings writers.
+
+An <Option> looks like:
+
+  <Option name="" code=""
+          paramType="" paramOptional="true" paramDescription=""
+          description="" />
+
+name should be lowercase with underscores, except where capitalization should be somewhat
+ preserved. Individual bindings may convert everything to lowercase, everything to uppercase,
+ or title-capitalize words (but when doing so must preserve other capitalization).
+
+For example, "TLS_key_bytes" may be translated to:
+ - tls_key_bytes
+ - TLS_KEY_BYTE
+ - TLSKeyBytes
+
+If paramType is not present, the option takes no parameter. Otherwise it must be "String", 
+ "Int" or "Bytes". These will be parsed according to the C API spec.
+
+If paramType is set, paramDescription must be present and describe the parameter.
+If paramOptional is set to any value, the parameter is optional, otherwise required.
+description is not currently required but encouraged.
+
+-->
+
+<Options>
+  <Scope name="NetworkOption">
+    <Option name="local_address"  code="10" 
+            paramType="String" paramDescription="IP:PORT" 
+            description="Deprecated"/>
+    <Option name="cluster_file" code="20"
+            paramType="String" paramDescription="path to cluster file"
+            description="Deprecated"/>
+    <Option name="trace_enable" code="30"
+            paramType="String" paramDescription="path to output directory (or NULL for current working directory)"
+            description="Enables trace output to a file in a directory of the clients choosing"/>
+    <Option name="trace_roll_size" code="31"
+            paramType="Int" paramDescription="max size of a single trace output file"
+            description="Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes."/>
+    <Option name="trace_max_logs_size" code="32"
+            paramType="Int" paramDescription="max total size of trace files"
+            description="Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time."/>
+    <Option name="trace_log_group" code="33"
+            paramType="String" paramDescription="value of the LogGroup attribute"
+            description="Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'."/>
+    <Option name="trace_format" code="34"
+            paramType="String" paramDescription="Format of trace files"
+            description="Select the format of the log files. xml (the default) and json are supported."/>
+    <Option name="trace_clock_source" code="35"
+            paramType="String" paramDescription="Trace clock source"
+            description="Select clock source for trace files. now (the default) or realtime are supported." />
+    <Option name="trace_file_identifier" code="36"
+            paramType="String" paramDescription="The identifier that will be part of all trace file names"
+            description="Once provided, this string will be used to replace the port/PID in the log file names." />
+    <Option name="trace_partial_file_suffix" code="39"
+            paramType="String" paramDescription="Append this suffix to partially written log files. When a log file is complete, it is renamed to remove the suffix. No separator is added between the file and the suffix. If you want to add a file extension, you should include the separator - e.g. '.tmp' instead of 'tmp' to add the 'tmp' extension."
+            description="Set file suffix for partially written log files." />
+    <Option name="knob" code="40"
+            paramType="String" paramDescription="knob_name=knob_value"
+            description="Set internal tuning or debugging knobs"/>
+    <Option name="TLS_plugin" code="41"
+            paramType="String" paramDescription="file path or linker-resolved name"
+            description="Deprecated" />
+    <Option name="TLS_cert_bytes" code="42"
+            paramType="Bytes" paramDescription="certificates"
+            description="Set the certificate chain" />
+    <Option name="TLS_cert_path" code="43"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate chain" />
+    <Option name="TLS_key_bytes" code="45"
+            paramType="Bytes" paramDescription="key"
+            description="Set the private key corresponding to your own certificate" />
+    <Option name="TLS_key_path" code="46"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the private key corresponding to your own certificate" />
+    <Option name="TLS_verify_peers" code="47"
+            paramType="Bytes" paramDescription="verification pattern"
+            description="Set the peer certificate field verification criteria" />
+    <Option name="Buggify_enable" code="48"
+            description="" />
+    <Option name="Buggify_disable" code="49"
+            description="" />
+    <Option name="Buggify_section_activated_probability" code="50"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed." />
+    <Option name="Buggify_section_fired_probability" code="51"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active BUGGIFY section being fired" />
+    <Option name="TLS_ca_bytes" code="52"
+            paramType="Bytes" paramDescription="ca bundle"
+            description="Set the ca bundle" />
+    <Option name="TLS_ca_path" code="53"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate authority bundle" />
+    <Option name="TLS_password" code="54"
+            paramType="String" paramDescription="key passphrase"
+            description="Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used." />
+    <Option name="disable_multi_version_client_api" code="60"
+            description="Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network." />
+    <Option name="callbacks_on_external_threads" code="61"
+            description="If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time." />
+    <Option name="external_client_library" code="62"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="external_client_directory" code="63"
+            paramType="String" paramDescription="path to directory containing client libraries"
+            description="Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="disable_local_client" code="64"
+            description="Prevents connections through the local client, allowing only connections through externally loaded client libraries." />
+    <Option name="client_threads_per_version" code="65"
+            paramType="Int" paramDescription="Number of client threads to be spawned.  Each cluster will be serviced by a single client thread."
+            description="Spawns multiple worker threads for each version of the client that is loaded.  Setting this to a number greater than one implies disable_local_client." />
+    <Option name="disable_client_statistics_logging" code="70"
+            description="Disables logging of client statistics, such as sampled transaction activity." />
+    <Option name="enable_slow_task_profiling" code="71"
+            description="Deprecated" />
+    <Option name="enable_run_loop_profiling" code="71"
+            description="Enables debugging feature to perform run loop profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production." />
+    <Option name="client_buggify_enable" code="80"
+            description="Enable client buggify - will make requests randomly fail (intended for client testing)" />
+    <Option name="client_buggify_disable" code="81"
+            description="Disable client buggify" />
+    <Option name="client_buggify_section_activated_probability" code="82"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a CLIENT_BUGGIFY section being active for the current execution." />
+    <Option name="client_buggify_section_fired_probability" code="83"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated" />
+    <Option name="distributed_client_tracer" code="90"
+            paramType="String" paramDescription="Distributed tracer type. Choose from none, log_file, or network_lossy"
+            description="Set a tracer to run on the client. Should be set to the same value as the tracer set on the server." />
+    <Option name="supported_client_versions" code="1000"
+            paramType="String" paramDescription="[release version],[source version],[protocol version];..."
+            description="This option is set automatically to communicate the list of supported clients to the active client."
+            hidden="true" />
+    <Option name="external_client" code="1001"
+            description="This option is set automatically on all clients loaded externally using the multi-version API." 
+            hidden="true" />
+    <Option name="external_client_transport_id" code="1002"
+            description="This option tells a child on a multiversion client what transport ID to use."
+            paramType="Int" paramDescription="Transport ID for the child connection"
+            hidden="true" />
+  </Scope>
+
+  <Scope name="DatabaseOption">
+    <Option name="location_cache_size" code="10"
+            paramType="Int" paramDescription="Max location cache entries"
+            description="Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000." />
+    <Option name="max_watches" code="20"
+            paramType="Int" paramDescription="Max outstanding watches"
+            description="Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000." />
+    <Option name="machine_id" code="21"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing." />
+    <Option name="datacenter_id" code="22"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing." />
+    <!-- The snapshot RYW options act like defaults for the equivalent transaction options, but database defaults cannot have cumulative effects from multiple calls.
+         Thus, we don't use the defaultFor annotation on these options. -->
+    <Option name="snapshot_ryw_enable" code="26"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="27"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="405"/>
+    <Option name="transaction_timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher." 
+            defaultFor="500"/>
+    <Option name="transaction_retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="501"/>
+    <Option name="transaction_max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information."
+            defaultFor="502"/>
+    <Option name="transaction_size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="503"/>
+    <Option name="transaction_causal_read_risky" code="504"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."
+            defaultFor="20"/>
+    <Option name="transaction_include_port_in_address" code="505"
+            description="Deprecated. Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect."
+            defaultFor="23"/>
+    <Option name="transaction_bypass_unreadable" code="700"
+            description="Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. This sets the ``bypass_unreadable`` option of each transaction created by this database. See the transaction option description for more information."
+            defaultFor="1100"/>
+    <Option name="use_config_database" code="800"
+            description="Use configuration database." />
+    <Option name="test_causal_read_risky" code="900"
+            description="An integer between 0 and 100 (default is 0) expressing the probability that a client will verify it can't read stale data whenever it detects a recovery." />
+  </Scope>
+  
+  <Scope name="TransactionOption">
+    <Option name="causal_write_risky" code="10"
+            description="The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault"/>
+    <Option name="causal_read_risky" code="20"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."/>
+    <Option name="causal_read_disable" code="21" />
+    <Option name="include_port_in_address" code="23"
+            description="Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect." />
+    <Option name="next_write_no_write_conflict_range" code="30"
+            description="The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on." />
+    <Option name="commit_on_first_proxy" code="40"
+            description="Committing this transaction will bypass the normal load balancing across commit proxies and go directly to the specifically nominated 'first commit proxy'."
+            hidden="true" />
+    <Option name="check_writes_enable" code="50"
+            hidden="true" />
+    <Option name="read_your_writes_disable" code="51"
+            description="Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction. It is an error to set this option after performing any reads or writes on the transaction."/>
+    <Option name="read_ahead_disable" code="52"
+            description="Deprecated" />
+    <Option name="durability_datacenter" code="110" />
+    <Option name="durability_risky" code="120" />
+    <Option name="durability_dev_null_is_web_scale" code="130"
+            description="Deprecated"/>
+    <Option name="priority_system_immediate" code="200"
+            description="Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools" />
+    <Option name="priority_batch" code="201"
+            description="Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work" />
+    <Option name="initialize_new_database" code="300"
+            description="This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only." />
+    <Option name="access_system_keys" code="301"
+            description="Allows this transaction to read and modify system keys (those that start with the byte 0xFF). Implies raw_access."/>
+    <Option name="read_system_keys" code="302"
+            description="Allows this transaction to read system keys (those that start with the byte 0xFF). Implies raw_access."/>
+    <Option name="raw_access" code="303"
+            description="Allows this transaction to access the raw key-space when tenant mode is on."/>
+    <Option name="debug_dump" code="400" 
+            hidden="true" />
+    <Option name="debug_retry_logging" code="401" paramType="String" paramDescription="Optional transaction name" />
+    <Option name="transaction_logging_enable" code="402" paramType="String" paramDescription="String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters."
+            description="Deprecated" />
+    <Option name="debug_transaction_identifier" code="403" paramType="String" paramDescription="String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters."
+            description="Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled." />
+    <Option name="log_transaction" code="404"
+            description="Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation." />
+    <Option name="server_request_tracing" code="406"
+	    description="Sets an identifier for server tracing of this transaction. When committed, this identifier triggers logging when each part of the transaction authority encounters it, which is helpful in diagnosing slowness in misbehaving clusters. The identifier is randomly generated. When there is also a debug_transaction_identifier, both IDs are logged together." />
+    <Option name="timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true" />
+    <Option name="retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option." 
+            persistent="true"/>
+    <Option name="max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true"/>
+    <Option name="size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit." />
+    <Option name="snapshot_ryw_enable" code="600"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="601"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="lock_aware" code="700"
+            description="The transaction can read and write to locked databases, and is responsible for checking that it took the lock."/>
+    <Option name="used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."/>
+    <Option name="read_lock_aware" code="702"
+            description="The transaction can read from locked databases."/>
+    <Option name="first_in_batch" code="710"
+            description="No other transactions will be applied before this transaction within the same commit version."
+            hidden="true" />
+    <Option name="use_provisional_proxies" code="711"
+            description="This option should only be used by tools which change the database configuration." />
+    <Option name="report_conflicting_keys" code="712"
+            description="The transaction can retrieve keys that are conflicting with other transactions." />
+    <Option name="special_key_space_relaxed" code="713"
+            description="By default, the special key space will only allow users to read from exactly one module (a subspace in the special key space). Use this option to allow reading from zero or more modules. Users who set this option should be prepared for new modules, which may have different behaviors than the modules they're currently reading. For example, a new module might block or return an error." />
+    <Option name="special_key_space_enable_writes" code="714"
+            description="By default, users are not allowed to write to special keys. Enable this option will implicitly enable all options required to achieve the configuration change." />        
+    <Option name="tag" code="800" paramType="String" paramDescription="String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters."
+            description="Adds a tag to the transaction that can be used to apply manual targeted throttling. At most 5 tags can be set on a transaction." />
+    <Option name="auto_throttle_tag" code="801" paramType="String" paramDescription="String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters."
+            description="Adds a tag to the transaction that can be used to apply manual or automatic targeted throttling. At most 5 tags can be set on a transaction." />
+    <Option name="span_parent" code="900" paramType="Bytes" paramDescription="A byte string of length 16 used to associate the span of this transaction with a parent"
+            description="Adds a parent to the Span of this transaction. Used for transaction tracing. A span can be identified with any 16 bytes"/>
+    <Option name="expensive_clear_cost_estimation_enable" code="1000"
+                description="Asks storage servers for how many bytes a clear key range contains. Otherwise uses the location cache to roughly estimate this." />
+    <Option name="bypass_unreadable" code="1100"
+                description="Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. These reads will view versionstamp operations as if they were set operations that did not fill in the versionstamp." />            
+    <Option name="use_grv_cache" code="1101"
+            description="Allows this transaction to use cached GRV from the database context. Defaults to off. Upon first usage, starts a background updater to periodically update the cache to avoid stale read versions." />
+    <Option name="skip_grv_cache" code="1102"
+            description="Specifically instruct this transaction to NOT use cached GRV. Primarily used for the read version cache's background updater to avoid attempting to read a cached entry in specific situations."
+            hidden="true"/>
+  </Scope>
+
+  <!-- The enumeration values matter - do not change them without
+       looking at fdb_c.cpp -->
+  <Scope name="StreamingMode">
+    <Option name="want_all" code="-2"
+            description="Client intends to consume the entire range and would like it all transferred as early as possible." />
+    <Option name="iterator" code="-1"
+            description="The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL``" />
+    <Option name="exact" code="0"
+            description="Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used." />
+    <Option name="small" code="1"
+            description="Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early." />
+    <Option name="medium" code="2"
+            description="Infrequently used. Transfer data in batches sized in between small and large." />
+    <Option name="large" code="3"
+            description="Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode." />
+    <Option name="serial" code="4"
+            description="Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted." />
+  </Scope>
+
+  <Scope name="MutationType">
+    <Option name="add" code="2" 
+            paramType="Bytes" paramDescription="addend"
+            description="Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow."/>
+    <Option name="and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Deprecated"/>
+    <Option name="bit_and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Deprecated"/>
+    <Option name="bit_or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Deprecated"/>
+    <Option name="bit_xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="append_if_fits" code="9"
+            paramType="Bytes" paramDescription="value to append to the database value"
+            description="Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size."/>
+    <Option name="max" code="12"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database."/>
+    <Option name="min" code="13"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database."/>
+    <Option name="set_versionstamped_key" code="14"
+            paramType="Bytes" paramDescription="value to which to set the transformed key"
+            description="Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes." />
+    <Option name="set_versionstamped_value" code="15"
+            paramType="Bytes" paramDescription="value to versionstamp and set"
+            description="Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset." />
+    <Option name="byte_min" code="16"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database."/>
+    <Option name="byte_max" code="17"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database."/>
+    <Option name="compare_and_clear" code="20"
+            paramType="Bytes" paramDescription="Value to compare with"
+            description="Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared."/>
+  </Scope>
+
+  <Scope name="ConflictRangeType">
+    <Option name="read" code="0" description="Used to add a read conflict range"/>
+    <Option name="write" code="1" description="Used to add a write conflict range"/>
+  </Scope>
+
+  <Scope name="ErrorPredicate">
+    <Option name="retryable" code="50000" description="Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error."/>
+    <Option name="maybe_committed" code="50001" description="Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify."/>
+    <Option name="retryable_not_committed" code="50002" description="Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried."/>
+  </Scope>
+
+</Options>
diff --git a/bindings/rust/foundationdb-gen/include/710/version.txt b/bindings/rust/foundationdb-gen/include/710/version.txt
new file mode 100644
index 00000000000..a52e7a4eb7e
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/710/version.txt
@@ -0,0 +1 @@
+7.1.5
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-gen/include/730/fdb.options b/bindings/rust/foundationdb-gen/include/730/fdb.options
new file mode 100644
index 00000000000..787b1d27cf2
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/730/fdb.options
@@ -0,0 +1,432 @@
+<?xml version="1.0"?>
+
+<!--
+
+This file should not be edited outside of FoundationDB and is provided as reference for bindings writers.
+
+An <Option> looks like:
+
+  <Option name="" code=""
+          paramType="" paramOptional="true" paramDescription=""
+          description="" />
+
+name should be lowercase with underscores, except where capitalization should be somewhat
+ preserved. Individual bindings may convert everything to lowercase, everything to uppercase,
+ or title-capitalize words (but when doing so must preserve other capitalization).
+
+For example, "TLS_key_bytes" may be translated to:
+ - tls_key_bytes
+ - TLS_KEY_BYTE
+ - TLSKeyBytes
+
+If paramType is not present, the option takes no parameter. Otherwise it must be "String", 
+ "Int" or "Bytes". These will be parsed according to the C API spec.
+
+If paramType is set, paramDescription must be present and describe the parameter.
+If paramOptional is set to any value, the parameter is optional, otherwise required.
+description is not currently required but encouraged.
+
+-->
+
+<Options>
+  <Scope name="NetworkOption">
+    <Option name="local_address"  code="10" 
+            paramType="String" paramDescription="IP:PORT" 
+            description="Deprecated"/>
+    <Option name="cluster_file" code="20"
+            paramType="String" paramDescription="path to cluster file"
+            description="Deprecated"/>
+    <Option name="trace_enable" code="30"
+            paramType="String" paramDescription="path to output directory (or NULL for current working directory)"
+            description="Enables trace output to a file in a directory of the clients choosing"/>
+    <Option name="trace_roll_size" code="31"
+            paramType="Int" paramDescription="max size of a single trace output file"
+            description="Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes."/>
+    <Option name="trace_max_logs_size" code="32"
+            paramType="Int" paramDescription="max total size of trace files"
+            description="Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time."/>
+    <Option name="trace_log_group" code="33"
+            paramType="String" paramDescription="value of the LogGroup attribute"
+            description="Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'."/>
+    <Option name="trace_format" code="34"
+            paramType="String" paramDescription="Format of trace files"
+            description="Select the format of the log files. xml (the default) and json are supported."/>
+    <Option name="trace_clock_source" code="35"
+            paramType="String" paramDescription="Trace clock source"
+            description="Select clock source for trace files. now (the default) or realtime are supported." />
+    <Option name="trace_file_identifier" code="36"
+            paramType="String" paramDescription="The identifier that will be part of all trace file names"
+            description="Once provided, this string will be used to replace the port/PID in the log file names." />
+    <Option name="trace_share_among_client_threads" code="37"
+            description="Use the same base trace file name for all client threads as it did before version 7.2. The current default behavior is to use distinct trace file names for client threads by including their version and thread index." />
+    <Option name="trace_initialize_on_setup" code="38"
+            description="Initialize trace files on network setup, determine the local IP later. Otherwise tracing is initialized when opening the first database." />
+    <Option name="trace_partial_file_suffix" code="39"
+            paramType="String" paramDescription="Append this suffix to partially written log files. When a log file is complete, it is renamed to remove the suffix. No separator is added between the file and the suffix. If you want to add a file extension, you should include the separator - e.g. '.tmp' instead of 'tmp' to add the 'tmp' extension."
+            description="Set file suffix for partially written log files." />
+    <Option name="knob" code="40"
+            paramType="String" paramDescription="knob_name=knob_value"
+            description="Set internal tuning or debugging knobs"/>
+    <Option name="TLS_plugin" code="41"
+            paramType="String" paramDescription="file path or linker-resolved name"
+            description="Deprecated" />
+    <Option name="TLS_cert_bytes" code="42"
+            paramType="Bytes" paramDescription="certificates"
+            description="Set the certificate chain" />
+    <Option name="TLS_cert_path" code="43"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate chain" />
+    <Option name="TLS_key_bytes" code="45"
+            paramType="Bytes" paramDescription="key"
+            description="Set the private key corresponding to your own certificate" />
+    <Option name="TLS_key_path" code="46"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the private key corresponding to your own certificate" />
+    <Option name="TLS_verify_peers" code="47"
+            paramType="Bytes" paramDescription="verification pattern"
+            description="Set the peer certificate field verification criteria" />
+    <Option name="Buggify_enable" code="48"
+            description="" />
+    <Option name="Buggify_disable" code="49"
+            description="" />
+    <Option name="Buggify_section_activated_probability" code="50"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed." />
+    <Option name="Buggify_section_fired_probability" code="51"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active BUGGIFY section being fired" />
+    <Option name="TLS_ca_bytes" code="52"
+            paramType="Bytes" paramDescription="ca bundle"
+            description="Set the ca bundle" />
+    <Option name="TLS_ca_path" code="53"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate authority bundle" />
+    <Option name="TLS_password" code="54"
+            paramType="String" paramDescription="key passphrase"
+            description="Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used." />
+    <Option name="disable_multi_version_client_api" code="60"
+            description="Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network." />
+    <Option name="callbacks_on_external_threads" code="61"
+            description="If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time." />
+    <Option name="external_client_library" code="62"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="external_client_directory" code="63"
+            paramType="String" paramDescription="path to directory containing client libraries"
+            description="Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="disable_local_client" code="64"
+            description="Prevents connections through the local client, allowing only connections through externally loaded client libraries." />
+    <Option name="client_threads_per_version" code="65"
+            paramType="Int" paramDescription="Number of client threads to be spawned.  Each cluster will be serviced by a single client thread."
+            description="Spawns multiple worker threads for each version of the client that is loaded.  Setting this to a number greater than one implies disable_local_client." />
+    <Option name="future_version_client_library" code="66"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library to be used with a future version protocol. This option can be used testing purposes only!" />
+    <Option name="retain_client_library_copies" code="67"
+            description="Retain temporary external client library copies that are created for enabling multi-threading." />
+    <Option name="ignore_external_client_failures" code="68"
+            description="Ignore the failure to initialize some of the external clients" />
+    <Option name="fail_incompatible_client" code="69"
+            description="Fail with an error if there is no client matching the server version the client is connecting to" />
+    <Option name="disable_client_statistics_logging" code="70"
+            description="Disables logging of client statistics, such as sampled transaction activity." />
+    <Option name="enable_slow_task_profiling" code="71"
+            description="Deprecated" />
+    <Option name="enable_run_loop_profiling" code="71"
+            description="Enables debugging feature to perform run loop profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production." />
+    <Option name="disable_client_bypass" code="72"
+            description="Prevents the multi-version client API from being disabled, even if no external clients are configured. This option is required to use GRV caching."/>
+    <Option name="client_buggify_enable" code="80"
+            description="Enable client buggify - will make requests randomly fail (intended for client testing)" />
+    <Option name="client_buggify_disable" code="81"
+            description="Disable client buggify" />
+    <Option name="client_buggify_section_activated_probability" code="82"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a CLIENT_BUGGIFY section being active for the current execution." />
+    <Option name="client_buggify_section_fired_probability" code="83"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated" />
+    <Option name="distributed_client_tracer" code="90"
+            paramType="String" paramDescription="Distributed tracer type. Choose from none, log_file, or network_lossy"
+            description="Set a tracer to run on the client. Should be set to the same value as the tracer set on the server." />
+    <Option name="client_tmp_dir" code="91"
+            paramType="String" paramDescription="Client directory for temporary files. "
+            description="Sets the directory for storing temporary files created by FDB client, such as temporary copies of client libraries. Defaults to /tmp" />
+    <Option name="supported_client_versions" code="1000"
+            paramType="String" paramDescription="[release version],[source version],[protocol version];..."
+            description="This option is set automatically to communicate the list of supported clients to the active client."
+            hidden="true" />
+    <Option name="external_client" code="1001"
+            description="This option is set automatically on all clients loaded externally using the multi-version API." 
+            hidden="true" />
+    <Option name="external_client_transport_id" code="1002"
+            description="This option tells a child on a multiversion client what transport ID to use."
+            paramType="Int" paramDescription="Transport ID for the child connection"
+            hidden="true" />
+  </Scope>
+
+  <Scope name="DatabaseOption">
+    <Option name="location_cache_size" code="10"
+            paramType="Int" paramDescription="Max location cache entries"
+            description="Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000." />
+    <Option name="max_watches" code="20"
+            paramType="Int" paramDescription="Max outstanding watches"
+            description="Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000." />
+    <Option name="machine_id" code="21"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing." />
+    <Option name="datacenter_id" code="22"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing." />
+    <!-- The snapshot RYW options act like defaults for the equivalent transaction options, but database defaults cannot have cumulative effects from multiple calls.
+         Thus, we don't use the defaultFor annotation on these options. -->
+    <Option name="snapshot_ryw_enable" code="26"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="27"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="405"/>
+    <Option name="transaction_timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher." 
+            defaultFor="500"/>
+    <Option name="transaction_retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="501"/>
+    <Option name="transaction_max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information."
+            defaultFor="502"/>
+    <Option name="transaction_size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="503"/>
+    <Option name="transaction_causal_read_risky" code="504"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."
+            defaultFor="20"/>
+    <Option name="transaction_include_port_in_address" code="505"
+            description="Deprecated. Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect."
+            defaultFor="23"/>
+    <Option name="transaction_automatic_idempotency" code="506"
+            description="Set a random idempotency id for all transactions. See the transaction option description for more information. This feature is in development and not ready for general use." 
+            defaultFor="505" />
+    <Option name="transaction_bypass_unreadable" code="700"
+            description="Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. This sets the ``bypass_unreadable`` option of each transaction created by this database. See the transaction option description for more information."
+            defaultFor="1100"/>
+    <Option name="transaction_used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."
+            defaultFor="701"/>/>
+    <Option name="transaction_report_conflicting_keys" code="702"
+            description="Enables conflicting key reporting on all transactions, allowing them to retrieve the keys that are conflicting with other transactions."
+            defaultFor="712"/>/>
+    <Option name="use_config_database" code="800"
+            description="Use configuration database." />
+    <Option name="test_causal_read_risky" code="900"
+            paramType="Int" paramDescription="integer between 0 and 100 expressing the probability a client will verify it can't read stale data"
+            description="Enables verification of causal read risky by checking whether clients are able to read stale data when they detect a recovery, and logging an error if so." />
+  </Scope>
+  
+  <Scope name="TransactionOption">
+    <Option name="causal_write_risky" code="10"
+            description="The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault"/>
+    <Option name="causal_read_risky" code="20"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."/>
+    <Option name="causal_read_disable" code="21" />
+    <Option name="include_port_in_address" code="23"
+            description="Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect." />
+    <Option name="next_write_no_write_conflict_range" code="30"
+            description="The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on." />
+    <Option name="commit_on_first_proxy" code="40"
+            description="Committing this transaction will bypass the normal load balancing across commit proxies and go directly to the specifically nominated 'first commit proxy'."
+            hidden="true" />
+    <Option name="check_writes_enable" code="50"
+            hidden="true" />
+    <Option name="read_your_writes_disable" code="51"
+            description="Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction. It is an error to set this option after performing any reads or writes on the transaction."/>
+    <Option name="read_ahead_disable" code="52"
+            description="Deprecated" />
+    <Option name="read_server_side_cache_enable" code="507"
+            description="Storage server should cache disk blocks needed for subsequent read requests in this transaction.  This is the default behavior."/>
+    <Option name="read_server_side_cache_disable" code="508"
+            description="Storage server should not cache disk blocks needed for subsequent read requests in this transaction.  This can be used to avoid cache pollution for reads not expected to be repeated."/>
+    <Option name="read_priority_normal" code="509"
+            description="Use normal read priority for subsequent read requests in this transaction.  This is the default read priority."/>
+    <Option name="read_priority_low" code="510"
+            description="Use low read priority for subsequent read requests in this transaction."/>
+    <Option name="read_priority_high" code="511"
+            description="Use high read priority for subsequent read requests in this transaction."/>
+    <Option name="durability_datacenter" code="110" />
+    <Option name="durability_risky" code="120" />
+    <Option name="durability_dev_null_is_web_scale" code="130"
+            description="Deprecated"/>
+    <Option name="priority_system_immediate" code="200"
+            description="Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools" />
+    <Option name="priority_batch" code="201"
+            description="Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work" />
+    <Option name="initialize_new_database" code="300"
+            description="This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only." />
+    <Option name="access_system_keys" code="301"
+            description="Allows this transaction to read and modify system keys (those that start with the byte 0xFF). Implies raw_access."/>
+    <Option name="read_system_keys" code="302"
+            description="Allows this transaction to read system keys (those that start with the byte 0xFF). Implies raw_access."/>
+    <Option name="raw_access" code="303"
+            description="Allows this transaction to access the raw key-space when tenant mode is on."/>
+    <Option name="bypass_storage_quota" code="304"
+            description="Allows this transaction to bypass storage quota enforcement. Should only be used for transactions that directly or indirectly decrease the size of the tenant group's data."/>
+    <Option name="debug_dump" code="400" 
+            hidden="true" />
+    <Option name="debug_retry_logging" code="401" paramType="String" paramDescription="Optional transaction name" />
+    <Option name="transaction_logging_enable" code="402" paramType="String" paramDescription="String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters."
+            description="Deprecated" />
+    <Option name="debug_transaction_identifier" code="403" paramType="String" paramDescription="String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters."
+            description="Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled." />
+    <Option name="log_transaction" code="404"
+            description="Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation." />
+    <Option name="server_request_tracing" code="406"
+	    description="Sets an identifier for server tracing of this transaction. When committed, this identifier triggers logging when each part of the transaction authority encounters it, which is helpful in diagnosing slowness in misbehaving clusters. The identifier is randomly generated. When there is also a debug_transaction_identifier, both IDs are logged together." />
+    <Option name="timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true" />
+    <Option name="retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option." 
+            persistent="true"/>
+    <Option name="max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true"/>
+    <Option name="size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit." />
+    <Option name="idempotency_id" code="504"
+            paramType="String" paramDescription="Unique ID"
+            description="Associate this transaction with this ID for the purpose of checking whether or not this transaction has already committed. Must be at least 16 bytes and less than 256 bytes. This feature is in development and not ready for general use. Unless the automatic_idempotency option is set after this option, the client will not automatically attempt to remove this id from the cluster after a successful commit."
+            hidden="true" />
+    <Option name="automatic_idempotency" code="505"
+            description="Automatically assign a random 16 byte idempotency id for this transaction. Prevents commits from failing with ``commit_unknown_result``. WARNING: If you are also using the multiversion client or transaction timeouts, if either cluster_version_changed or transaction_timed_out was thrown during a commit, then that commit may have already succeeded or may succeed in the future. This feature is in development and not ready for general use." />
+    <Option name="snapshot_ryw_enable" code="600"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="601"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="lock_aware" code="700"
+            description="The transaction can read and write to locked databases, and is responsible for checking that it took the lock."/>
+    <Option name="used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."/>
+    <Option name="read_lock_aware" code="702"
+            description="The transaction can read from locked databases."/>
+    <Option name="first_in_batch" code="710"
+            description="No other transactions will be applied before this transaction within the same commit version."
+            hidden="true" />
+    <Option name="use_provisional_proxies" code="711"
+            description="This option should only be used by tools which change the database configuration." />
+    <Option name="report_conflicting_keys" code="712"
+            description="The transaction can retrieve keys that are conflicting with other transactions." />
+    <Option name="special_key_space_relaxed" code="713"
+            description="By default, the special key space will only allow users to read from exactly one module (a subspace in the special key space). Use this option to allow reading from zero or more modules. Users who set this option should be prepared for new modules, which may have different behaviors than the modules they're currently reading. For example, a new module might block or return an error." />
+    <Option name="special_key_space_enable_writes" code="714"
+            description="By default, users are not allowed to write to special keys. Enable this option will implicitly enable all options required to achieve the configuration change." />        
+    <Option name="tag" code="800" paramType="String" paramDescription="String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters."
+            description="Adds a tag to the transaction that can be used to apply manual targeted throttling. At most 5 tags can be set on a transaction." />
+    <Option name="auto_throttle_tag" code="801" paramType="String" paramDescription="String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters."
+            description="Adds a tag to the transaction that can be used to apply manual or automatic targeted throttling. At most 5 tags can be set on a transaction." />
+    <Option name="span_parent" code="900" paramType="Bytes" paramDescription="A byte string of length 16 used to associate the span of this transaction with a parent"
+            description="Adds a parent to the Span of this transaction. Used for transaction tracing. A span can be identified with any 16 bytes"/>
+    <Option name="expensive_clear_cost_estimation_enable" code="1000"
+                description="Asks storage servers for how many bytes a clear key range contains. Otherwise uses the location cache to roughly estimate this." />
+    <Option name="bypass_unreadable" code="1100"
+                description="Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. These reads will view versionstamp operations as if they were set operations that did not fill in the versionstamp." />            
+    <Option name="use_grv_cache" code="1101"
+            description="Allows this transaction to use cached GRV from the database context. Defaults to off. Upon first usage, starts a background updater to periodically update the cache to avoid stale read versions. The disable_client_bypass option must also be set." />
+    <Option name="skip_grv_cache" code="1102"
+            description="Specifically instruct this transaction to NOT use cached GRV. Primarily used for the read version cache's background updater to avoid attempting to read a cached entry in specific situations."
+            hidden="true"/>
+    <Option name="authorization_token" code="2000"
+            description="Attach given authorization token to the transaction such that subsequent tenant-aware requests are authorized"
+            paramType="String" paramDescription="A JSON Web Token authorized to access data belonging to one or more tenants, indicated by 'tenants' claim of the token's payload."
+            persistent="true" sensitive="true"/>
+  </Scope>
+
+  <!-- The enumeration values matter - do not change them without
+       looking at fdb_c.cpp -->
+  <Scope name="StreamingMode">
+    <Option name="want_all" code="-2"
+            description="Client intends to consume the entire range and would like it all transferred as early as possible." />
+    <Option name="iterator" code="-1"
+            description="The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL``" />
+    <Option name="exact" code="0"
+            description="Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used." />
+    <Option name="small" code="1"
+            description="Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early." />
+    <Option name="medium" code="2"
+            description="Infrequently used. Transfer data in batches sized in between small and large." />
+    <Option name="large" code="3"
+            description="Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode." />
+    <Option name="serial" code="4"
+            description="Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted." />
+  </Scope>
+
+  <Scope name="MutationType">
+    <Option name="add" code="2" 
+            paramType="Bytes" paramDescription="addend"
+            description="Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow."/>
+    <Option name="and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Deprecated"/>
+    <Option name="bit_and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Deprecated"/>
+    <Option name="bit_or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Deprecated"/>
+    <Option name="bit_xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="append_if_fits" code="9"
+            paramType="Bytes" paramDescription="value to append to the database value"
+            description="Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size."/>
+    <Option name="max" code="12"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database."/>
+    <Option name="min" code="13"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database."/>
+    <Option name="set_versionstamped_key" code="14"
+            paramType="Bytes" paramDescription="value to which to set the transformed key"
+            description="Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes." />
+    <Option name="set_versionstamped_value" code="15"
+            paramType="Bytes" paramDescription="value to versionstamp and set"
+            description="Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset." />
+    <Option name="byte_min" code="16"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database."/>
+    <Option name="byte_max" code="17"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database."/>
+    <Option name="compare_and_clear" code="20"
+            paramType="Bytes" paramDescription="Value to compare with"
+            description="Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared."/>
+  </Scope>
+
+  <Scope name="ConflictRangeType">
+    <Option name="read" code="0" description="Used to add a read conflict range"/>
+    <Option name="write" code="1" description="Used to add a write conflict range"/>
+  </Scope>
+
+  <Scope name="ErrorPredicate">
+    <Option name="retryable" code="50000" description="Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error."/>
+    <Option name="maybe_committed" code="50001" description="Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify."/>
+    <Option name="retryable_not_committed" code="50002" description="Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried."/>
+  </Scope>
+
+</Options>
diff --git a/bindings/rust/foundationdb-gen/include/730/version.txt b/bindings/rust/foundationdb-gen/include/730/version.txt
new file mode 100644
index 00000000000..aec35f3a894
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/730/version.txt
@@ -0,0 +1 @@
+7.3.27
diff --git a/bindings/rust/foundationdb-gen/include/740/fdb.options b/bindings/rust/foundationdb-gen/include/740/fdb.options
new file mode 100644
index 00000000000..72462ce327e
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/740/fdb.options
@@ -0,0 +1,439 @@
+<?xml version="1.0"?>
+
+<!--
+
+This file should not be edited outside of FoundationDB and is provided as reference for bindings writers.
+
+An <Option> looks like:
+
+  <Option name="" code=""
+          paramType="" paramOptional="true" paramDescription=""
+          description="" />
+
+name should be lowercase with underscores, except where capitalization should be somewhat
+ preserved. Individual bindings may convert everything to lowercase, everything to uppercase,
+ or title-capitalize words (but when doing so must preserve other capitalization).
+
+For example, "TLS_key_bytes" may be translated to:
+ - tls_key_bytes
+ - TLS_KEY_BYTE
+ - TLSKeyBytes
+
+If paramType is not present, the option takes no parameter. Otherwise it must be "String", 
+ "Int" or "Bytes". These will be parsed according to the C API spec.
+
+If paramType is set, paramDescription must be present and describe the parameter.
+If paramOptional is set to any value, the parameter is optional, otherwise required.
+description is not currently required but encouraged.
+
+-->
+
+<Options>
+  <Scope name="NetworkOption">
+    <Option name="local_address"  code="10" 
+            paramType="String" paramDescription="IP:PORT" 
+            description="Deprecated"/>
+    <Option name="cluster_file" code="20"
+            paramType="String" paramDescription="path to cluster file"
+            description="Deprecated"/>
+    <Option name="trace_enable" code="30"
+            paramType="String" paramDescription="path to output directory (or NULL for current working directory)"
+            description="Enables trace output to a file in a directory of the clients choosing"/>
+    <Option name="trace_roll_size" code="31"
+            paramType="Int" paramDescription="max size of a single trace output file"
+            description="Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes."/>
+    <Option name="trace_max_logs_size" code="32"
+            paramType="Int" paramDescription="max total size of trace files"
+            description="Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time."/>
+    <Option name="trace_log_group" code="33"
+            paramType="String" paramDescription="value of the LogGroup attribute"
+            description="Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'."/>
+    <Option name="trace_format" code="34"
+            paramType="String" paramDescription="Format of trace files"
+            description="Select the format of the log files. xml (the default) and json are supported."/>
+    <Option name="trace_clock_source" code="35"
+            paramType="String" paramDescription="Trace clock source"
+            description="Select clock source for trace files. now (the default) or realtime are supported." />
+    <Option name="trace_file_identifier" code="36"
+            paramType="String" paramDescription="The identifier that will be part of all trace file names"
+            description="Once provided, this string will be used to replace the port/PID in the log file names." />
+    <Option name="trace_share_among_client_threads" code="37"
+            description="Use the same base trace file name for all client threads as it did before version 7.2. The current default behavior is to use distinct trace file names for client threads by including their version and thread index." />
+    <Option name="trace_initialize_on_setup" code="38"
+            description="Initialize trace files on network setup, determine the local IP later. Otherwise tracing is initialized when opening the first database." />
+    <Option name="trace_partial_file_suffix" code="39"
+            paramType="String" paramDescription="Append this suffix to partially written log files. When a log file is complete, it is renamed to remove the suffix. No separator is added between the file and the suffix. If you want to add a file extension, you should include the separator - e.g. '.tmp' instead of 'tmp' to add the 'tmp' extension."
+            description="Set file suffix for partially written log files." />
+    <Option name="knob" code="40"
+            paramType="String" paramDescription="knob_name=knob_value"
+            description="Set internal tuning or debugging knobs"/>
+    <Option name="TLS_plugin" code="41"
+            paramType="String" paramDescription="file path or linker-resolved name"
+            description="Deprecated" />
+    <Option name="TLS_cert_bytes" code="42"
+            paramType="Bytes" paramDescription="certificates"
+            description="Set the certificate chain" />
+    <Option name="TLS_cert_path" code="43"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate chain" />
+    <Option name="TLS_key_bytes" code="45"
+            paramType="Bytes" paramDescription="key"
+            description="Set the private key corresponding to your own certificate" />
+    <Option name="TLS_key_path" code="46"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the private key corresponding to your own certificate" />
+    <Option name="TLS_verify_peers" code="47"
+            paramType="Bytes" paramDescription="verification pattern"
+            description="Set the peer certificate field verification criteria" />
+    <Option name="Buggify_enable" code="48"
+            description="" />
+    <Option name="Buggify_disable" code="49"
+            description="" />
+    <Option name="Buggify_section_activated_probability" code="50"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed." />
+    <Option name="Buggify_section_fired_probability" code="51"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active BUGGIFY section being fired" />
+    <Option name="TLS_ca_bytes" code="52"
+            paramType="Bytes" paramDescription="ca bundle"
+            description="Set the ca bundle" />
+    <Option name="TLS_ca_path" code="53"
+            paramType="String" paramDescription="file path"
+            description="Set the file from which to load the certificate authority bundle" />
+    <Option name="TLS_password" code="54"
+            paramType="String" paramDescription="key passphrase"
+            description="Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used." />
+    <Option name="TLS_disable_plaintext_connection" code="55"
+            description="Prevent client from connecting to a non-TLS endpoint by throwing network connection failed error." />
+    <Option name="disable_multi_version_client_api" code="60"
+            description="Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network." />
+    <Option name="callbacks_on_external_threads" code="61"
+            description="If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time." />
+    <Option name="external_client_library" code="62"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="external_client_directory" code="63"
+            paramType="String" paramDescription="path to directory containing client libraries"
+            description="Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network." />
+    <Option name="disable_local_client" code="64"
+            description="Prevents connections through the local client, allowing only connections through externally loaded client libraries." />
+    <Option name="client_threads_per_version" code="65"
+            paramType="Int" paramDescription="Number of client threads to be spawned.  Each cluster will be serviced by a single client thread."
+            description="Spawns multiple worker threads for each version of the client that is loaded.  Setting this to a number greater than one implies disable_local_client." />
+    <Option name="future_version_client_library" code="66"
+            paramType="String" paramDescription="path to client library"
+            description="Adds an external client library to be used with a future version protocol. This option can be used testing purposes only!" />
+    <Option name="retain_client_library_copies" code="67"
+            description="Retain temporary external client library copies that are created for enabling multi-threading." />
+    <Option name="ignore_external_client_failures" code="68"
+            description="Ignore the failure to initialize some of the external clients" />
+    <Option name="fail_incompatible_client" code="69"
+            description="Fail with an error if there is no client matching the server version the client is connecting to" />
+    <Option name="disable_client_statistics_logging" code="70"
+            description="Disables logging of client statistics, such as sampled transaction activity." />
+    <Option name="enable_slow_task_profiling" code="71"
+            description="Deprecated" />
+    <Option name="enable_run_loop_profiling" code="71"
+            description="Enables debugging feature to perform run loop profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production." />
+    <Option name="disable_client_bypass" code="72"
+            description="Prevents the multi-version client API from being disabled, even if no external clients are configured. This option is required to use GRV caching."/>
+    <Option name="client_buggify_enable" code="80"
+            description="Enable client buggify - will make requests randomly fail (intended for client testing)" />
+    <Option name="client_buggify_disable" code="81"
+            description="Disable client buggify" />
+    <Option name="client_buggify_section_activated_probability" code="82"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of a CLIENT_BUGGIFY section being active for the current execution." />
+    <Option name="client_buggify_section_fired_probability" code="83"
+            paramType="Int" paramDescription="probability expressed as a percentage between 0 and 100"
+            description="Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated" />
+    <Option name="distributed_client_tracer" code="90"
+            paramType="String" paramDescription="Distributed tracer type. Choose from none, log_file, or network_lossy"
+            description="Set a tracer to run on the client. Should be set to the same value as the tracer set on the server." />
+    <Option name="client_tmp_dir" code="91"
+            paramType="String" paramDescription="Client directory for temporary files. "
+            description="Sets the directory for storing temporary files created by FDB client, such as temporary copies of client libraries. Defaults to /tmp" />
+    <Option name="supported_client_versions" code="1000"
+            paramType="String" paramDescription="[release version],[source version],[protocol version];..."
+            description="This option is set automatically to communicate the list of supported clients to the active client."
+            hidden="true" />
+    <Option name="external_client" code="1001"
+            description="This option is set automatically on all clients loaded externally using the multi-version API." 
+            hidden="true" />
+    <Option name="external_client_transport_id" code="1002"
+            description="This option tells a child on a multiversion client what transport ID to use."
+            paramType="Int" paramDescription="Transport ID for the child connection"
+            hidden="true" />
+  </Scope>
+
+  <Scope name="DatabaseOption">
+    <Option name="location_cache_size" code="10"
+            paramType="Int" paramDescription="Max location cache entries"
+            description="Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000." />
+    <Option name="max_watches" code="20"
+            paramType="Int" paramDescription="Max outstanding watches"
+            description="Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000." />
+    <Option name="machine_id" code="21"
+            paramType="String" paramDescription="Hexadecimal ID"
+            description="Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing." />
+    <Option name="datacenter_id" code="22"
+            paramType="String" paramDescription="A string identifier for the datacenter"
+            description="Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing." />
+    <!-- The snapshot RYW options act like defaults for the equivalent transaction options, but database defaults cannot have cumulative effects from multiple calls.
+         Thus, we don't use the defaultFor annotation on these options. -->
+    <Option name="snapshot_ryw_enable" code="26"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="27"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="405"/>
+    <Option name="transaction_timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher." 
+            defaultFor="500"/>
+    <Option name="transaction_retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="501"/>
+    <Option name="transaction_max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information."
+            defaultFor="502"/>
+    <Option name="transaction_size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information." 
+            defaultFor="503"/>
+    <Option name="transaction_causal_read_risky" code="504"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."
+            defaultFor="20"/>
+    <Option name="transaction_include_port_in_address" code="505"
+            description="Deprecated. Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect."
+            defaultFor="23"/>
+    <Option name="transaction_automatic_idempotency" code="506"
+            description="Set a random idempotency id for all transactions. See the transaction option description for more information. This feature is in development and not ready for general use." 
+            defaultFor="505" />
+    <Option name="transaction_bypass_unreadable" code="700"
+            description="Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. This sets the ``bypass_unreadable`` option of each transaction created by this database. See the transaction option description for more information."
+            defaultFor="1100"/>
+    <Option name="transaction_used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."
+            defaultFor="701"/>/>
+    <Option name="transaction_report_conflicting_keys" code="702"
+            description="Enables conflicting key reporting on all transactions, allowing them to retrieve the keys that are conflicting with other transactions."
+            defaultFor="712"/>/>
+    <Option name="use_config_database" code="800"
+            description="Use configuration database." />
+    <Option name="test_causal_read_risky" code="900"
+            paramType="Int" paramDescription="integer between 0 and 100 expressing the probability a client will verify it can't read stale data"
+            description="Enables verification of causal read risky by checking whether clients are able to read stale data when they detect a recovery, and logging an error if so." />
+  </Scope>
+  
+  <Scope name="TransactionOption">
+    <Option name="causal_write_risky" code="10"
+            description="The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault"/>
+    <Option name="causal_read_risky" code="20"
+            description="The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock."/>
+    <Option name="causal_read_disable" code="21" />
+    <Option name="include_port_in_address" code="23"
+            description="Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect." />
+    <Option name="next_write_no_write_conflict_range" code="30"
+            description="The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on." />
+    <Option name="commit_on_first_proxy" code="40"
+            description="Committing this transaction will bypass the normal load balancing across commit proxies and go directly to the specifically nominated 'first commit proxy'."
+            hidden="true" />
+    <Option name="check_writes_enable" code="50"
+            hidden="true" />
+    <Option name="read_your_writes_disable" code="51"
+            description="Reads performed by a transaction will not see any prior mutations that occurred in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction. It is an error to set this option after performing any reads or writes on the transaction."/>
+    <Option name="read_ahead_disable" code="52"
+            description="Deprecated" />
+    <Option name="read_server_side_cache_enable" code="507"
+            description="Storage server should cache disk blocks needed for subsequent read requests in this transaction.  This is the default behavior."/>
+    <Option name="read_server_side_cache_disable" code="508"
+            description="Storage server should not cache disk blocks needed for subsequent read requests in this transaction.  This can be used to avoid cache pollution for reads not expected to be repeated."/>
+    <Option name="read_priority_normal" code="509"
+            description="Use normal read priority for subsequent read requests in this transaction.  This is the default read priority."/>
+    <Option name="read_priority_low" code="510"
+            description="Use low read priority for subsequent read requests in this transaction."/>
+    <Option name="read_priority_high" code="511"
+            description="Use high read priority for subsequent read requests in this transaction."/>
+    <Option name="durability_datacenter" code="110" />
+    <Option name="durability_risky" code="120" />
+    <Option name="durability_dev_null_is_web_scale" code="130"
+            description="Deprecated"/>
+    <Option name="priority_system_immediate" code="200"
+            description="Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools" />
+    <Option name="priority_batch" code="201"
+            description="Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work" />
+    <Option name="initialize_new_database" code="300"
+            description="This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only." />
+    <Option name="access_system_keys" code="301"
+            description="Allows this transaction to read and modify system keys (those that start with the byte 0xFF). Implies raw_access."/>
+    <Option name="read_system_keys" code="302"
+            description="Allows this transaction to read system keys (those that start with the byte 0xFF). Implies raw_access."/>
+    <Option name="raw_access" code="303"
+            description="Allows this transaction to access the raw key-space when tenant mode is on."/>
+    <Option name="bypass_storage_quota" code="304"
+            description="Allows this transaction to bypass storage quota enforcement. Should only be used for transactions that directly or indirectly decrease the size of the tenant group's data."/>
+    <Option name="debug_dump" code="400" 
+            hidden="true" />
+    <Option name="debug_retry_logging" code="401" paramType="String" paramDescription="Optional transaction name" />
+    <Option name="transaction_logging_enable" code="402" paramType="String" paramDescription="String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters."
+            description="Deprecated" />
+    <Option name="debug_transaction_identifier" code="403" paramType="String" paramDescription="String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters."
+            description="Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled." />
+    <Option name="log_transaction" code="404"
+            description="Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output." />
+    <Option name="transaction_logging_max_field_length" code="405" paramType="Int" paramDescription="Maximum length of escaped key and value fields."
+            description="Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation." />
+    <Option name="server_request_tracing" code="406"
+	    description="Sets an identifier for server tracing of this transaction. When committed, this identifier triggers logging when each part of the transaction authority encounters it, which is helpful in diagnosing slowness in misbehaving clusters. The identifier is randomly generated. When there is also a debug_transaction_identifier, both IDs are logged together." />
+    <Option name="timeout" code="500"
+            paramType="Int" paramDescription="value in milliseconds of timeout"
+            description="Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true" />
+    <Option name="retry_limit" code="501"
+            paramType="Int" paramDescription="number of times to retry"
+            description="Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option." 
+            persistent="true"/>
+    <Option name="max_retry_delay" code="502"
+            paramType="Int" paramDescription="value in milliseconds of maximum delay"
+            description="Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option."
+            persistent="true"/>
+    <Option name="size_limit" code="503"
+            paramType="Int" paramDescription="value in bytes"
+            description="Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit." />
+    <Option name="idempotency_id" code="504"
+            paramType="String" paramDescription="Unique ID"
+            description="Associate this transaction with this ID for the purpose of checking whether or not this transaction has already committed. Must be at least 16 bytes and less than 256 bytes. This feature is in development and not ready for general use. Unless the automatic_idempotency option is set after this option, the client will not automatically attempt to remove this id from the cluster after a successful commit."
+            hidden="true" />
+    <Option name="automatic_idempotency" code="505"
+            description="Automatically assign a random 16 byte idempotency id for this transaction. Prevents commits from failing with ``commit_unknown_result``. WARNING: If you are also using the multiversion client or transaction timeouts, if either cluster_version_changed or transaction_timed_out was thrown during a commit, then that commit may have already succeeded or may succeed in the future. This feature is in development and not ready for general use." />
+    <Option name="snapshot_ryw_enable" code="600"
+            description="Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior." />
+    <Option name="snapshot_ryw_disable" code="601"
+            description="Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300." />
+    <Option name="lock_aware" code="700"
+            description="The transaction can read and write to locked databases, and is responsible for checking that it took the lock."/>
+    <Option name="used_during_commit_protection_disable" code="701"
+            description="By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail."/>
+    <Option name="read_lock_aware" code="702"
+            description="The transaction can read from locked databases."/>
+    <Option name="first_in_batch" code="710"
+            description="No other transactions will be applied before this transaction within the same commit version."
+            hidden="true" />
+    <Option name="use_provisional_proxies" code="711"
+            description="This option should only be used by tools which change the database configuration." />
+    <Option name="report_conflicting_keys" code="712"
+            description="The transaction can retrieve keys that are conflicting with other transactions." />
+    <Option name="special_key_space_relaxed" code="713"
+            description="By default, the special key space will only allow users to read from exactly one module (a subspace in the special key space). Use this option to allow reading from zero or more modules. Users who set this option should be prepared for new modules, which may have different behaviors than the modules they're currently reading. For example, a new module might block or return an error." />
+    <Option name="special_key_space_enable_writes" code="714"
+            description="By default, users are not allowed to write to special keys. Enable this option will implicitly enable all options required to achieve the configuration change." />        
+    <Option name="tag" code="800" paramType="String" paramDescription="String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters."
+            description="Adds a tag to the transaction that can be used to apply manual targeted throttling. At most 5 tags can be set on a transaction." />
+    <Option name="auto_throttle_tag" code="801" paramType="String" paramDescription="String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters."
+            description="Adds a tag to the transaction that can be used to apply manual or automatic targeted throttling. At most 5 tags can be set on a transaction." />
+    <Option name="span_parent" code="900" paramType="Bytes" paramDescription="A serialized binary byte string of length 33 used to associate the span of this transaction with a parent"
+            description="Adds a parent to the Span of this transaction. Used for transaction tracing. A span can be identified with a 33 bytes serialized binary format which consists of: 8 bytes protocol version, e.g. ``0x0FDB00B073000000LL`` in little-endian format, 16 bytes trace id, 8 bytes span id, 1 byte set to 1 if sampling is enabled"/>
+    <Option name="expensive_clear_cost_estimation_enable" code="1000"
+                description="Asks storage servers for how many bytes a clear key range contains. Otherwise uses the location cache to roughly estimate this." />
+    <Option name="bypass_unreadable" code="1100"
+                description="Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. These reads will view versionstamp operations as if they were set operations that did not fill in the versionstamp." />            
+    <Option name="use_grv_cache" code="1101"
+            description="Allows this transaction to use cached GRV from the database context. Defaults to off. Upon first usage, starts a background updater to periodically update the cache to avoid stale read versions. The disable_client_bypass option must also be set." />
+    <Option name="skip_grv_cache" code="1102"
+            description="Specifically instruct this transaction to NOT use cached GRV. Primarily used for the read version cache's background updater to avoid attempting to read a cached entry in specific situations."
+            hidden="true"/>
+    <Option name="authorization_token" code="2000"
+            description="Attach given authorization token to the transaction such that subsequent tenant-aware requests are authorized"
+            paramType="String" paramDescription="A JSON Web Token authorized to access data belonging to one or more tenants, indicated by 'tenants' claim of the token's payload."
+            persistent="true" sensitive="true"/>
+    <Option name="enable_replica_consistency_check" code="4000"
+            description="Enables replica consistency check, which compares the results returned by storage server replicas (as many as specified by consistency_check_required_replicas option) for a given read request, in client-side load balancer." />
+    <Option name="consistency_check_required_replicas" code="4001"
+            paramType="Int" paramDescription="Number of storage replicas over which the load balancer consistency check is done."
+            description="Specifies the number of storage server replica results that the load balancer needs to compare when enable_replica_consistency_check option is set."/>
+  </Scope>
+
+  <!-- The enumeration values matter - do not change them without
+       looking at fdb_c.cpp -->
+  <Scope name="StreamingMode">
+    <Option name="want_all" code="-2"
+            description="Client intends to consume the entire range and would like it all transferred as early as possible." />
+    <Option name="iterator" code="-1"
+            description="The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL``" />
+    <Option name="exact" code="0"
+            description="Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used." />
+    <Option name="small" code="1"
+            description="Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early." />
+    <Option name="medium" code="2"
+            description="Infrequently used. Transfer data in batches sized in between small and large." />
+    <Option name="large" code="3"
+            description="Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode." />
+    <Option name="serial" code="4"
+            description="Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted." />
+  </Scope>
+
+  <Scope name="MutationType">
+    <Option name="add" code="2" 
+            paramType="Bytes" paramDescription="addend"
+            description="Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow."/>
+    <Option name="and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Deprecated"/>
+    <Option name="bit_and" code="6"
+            paramType="Bytes" paramDescription="value with which to perform bitwise and"
+            description="Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Deprecated"/>
+    <Option name="bit_or" code="7"
+            paramType="Bytes" paramDescription="value with which to perform bitwise or"
+            description="Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Deprecated"/>
+    <Option name="bit_xor" code="8"
+            paramType="Bytes" paramDescription="value with which to perform bitwise xor"
+            description="Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``."/>
+    <Option name="append_if_fits" code="9"
+            paramType="Bytes" paramDescription="value to append to the database value"
+            description="Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size."/>
+    <Option name="max" code="12"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database."/>
+    <Option name="min" code="13"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database."/>
+    <Option name="set_versionstamped_key" code="14"
+            paramType="Bytes" paramDescription="value to which to set the transformed key"
+            description="Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes." />
+    <Option name="set_versionstamped_value" code="15"
+            paramType="Bytes" paramDescription="value to versionstamp and set"
+            description="Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset." />
+    <Option name="byte_min" code="16"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database."/>
+    <Option name="byte_max" code="17"
+            paramType="Bytes" paramDescription="value to check against database value"
+            description="Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database."/>
+    <Option name="compare_and_clear" code="20"
+            paramType="Bytes" paramDescription="Value to compare with"
+            description="Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared."/>
+  </Scope>
+
+  <Scope name="ConflictRangeType">
+    <Option name="read" code="0" description="Used to add a read conflict range"/>
+    <Option name="write" code="1" description="Used to add a write conflict range"/>
+  </Scope>
+
+  <Scope name="ErrorPredicate">
+    <Option name="retryable" code="50000" description="Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error."/>
+    <Option name="maybe_committed" code="50001" description="Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify."/>
+    <Option name="retryable_not_committed" code="50002" description="Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried."/>
+  </Scope>
+
+</Options>
diff --git a/bindings/rust/foundationdb-gen/include/740/version.txt b/bindings/rust/foundationdb-gen/include/740/version.txt
new file mode 100644
index 00000000000..815da58b7a9
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/include/740/version.txt
@@ -0,0 +1 @@
+7.4.1
diff --git a/bindings/rust/foundationdb-gen/src/bin/foundationdb-options-gen.rs b/bindings/rust/foundationdb-gen/src/bin/foundationdb-options-gen.rs
new file mode 100644
index 00000000000..381cf63164d
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/src/bin/foundationdb-options-gen.rs
@@ -0,0 +1,7 @@
+extern crate foundationdb_gen;
+
+fn main() {
+    let mut code = String::new();
+    foundationdb_gen::emit(&mut code).expect("couldn't generate options.rs code!");
+    println!("{code}");
+}
diff --git a/bindings/rust/foundationdb-gen/src/lib.rs b/bindings/rust/foundationdb-gen/src/lib.rs
new file mode 100644
index 00000000000..4bcde344edb
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/src/lib.rs
@@ -0,0 +1,429 @@
+extern crate xml;
+
+use std::fmt;
+use xml::attribute::OwnedAttribute;
+use xml::reader::{EventReader, XmlEvent};
+
+const TAB1: &str = "    ";
+const TAB2: &str = "        ";
+const TAB3: &str = "            ";
+const TAB4: &str = "                ";
+
+#[derive(Debug)]
+struct FdbScope {
+    name: String,
+    options: Vec<FdbOption>,
+}
+impl FdbScope {
+    fn gen_ty<W: fmt::Write>(&self, w: &mut W) -> fmt::Result {
+        let with_ty = self.with_ty();
+
+        if with_ty {
+            writeln!(w, "#[derive(Clone, Debug)]")?;
+        } else {
+            writeln!(w, "#[derive(Clone, Copy, Debug)]")?;
+        }
+        writeln!(w, "#[non_exhaustive]")?;
+        writeln!(w, "pub enum {name} {{", name = self.name)?;
+
+        let with_ty = self.with_ty();
+        for option in self.options.iter() {
+            option.gen_ty(w, with_ty)?;
+        }
+        writeln!(w, "}}")
+    }
+
+    fn gen_impl<W: fmt::Write>(&self, w: &mut W) -> fmt::Result {
+        writeln!(w, "impl {name} {{", name = self.name)?;
+        self.gen_code(w)?;
+        self.gen_apply(w)?;
+        writeln!(w, "}}")
+    }
+
+    fn gen_code<W: fmt::Write>(&self, w: &mut W) -> fmt::Result {
+        writeln!(
+            w,
+            "{t}pub fn code(&self) -> fdb_sys::FDB{name} {{",
+            t = TAB1,
+            name = self.name,
+        )?;
+        writeln!(w, "{TAB2}match *self {{")?;
+
+        let enum_prefix = self.c_enum_prefix();
+        let with_ty = self.with_ty();
+
+        for option in self.options.iter() {
+            writeln!(
+                w,
+                "{t}{scope}::{name}{param} => fdb_sys::{enum_prefix}{code},",
+                t = TAB3,
+                scope = self.name,
+                name = option.name,
+                param = if let (true, Some(..)) = (with_ty, option.get_ty()) {
+                    "(..)"
+                } else {
+                    ""
+                },
+                enum_prefix = enum_prefix,
+                code = option.c_name,
+            )?;
+        }
+
+        writeln!(w, "{TAB2}}}")?;
+        writeln!(w, "{TAB1}}}")
+    }
+
+    fn gen_apply<W: fmt::Write>(&self, w: &mut W) -> fmt::Result {
+        let fn_name = match self.apply_fn_name() {
+            Some(name) => name,
+            _ => return Ok(()),
+        };
+
+        let first_arg = match self.apply_arg_name() {
+            Some(name) => format!(", target: *mut fdb_sys::{name}"),
+            None => String::new(),
+        };
+
+        writeln!(
+            w,
+            "{TAB1}pub unsafe fn apply(&self{first_arg}) -> FdbResult<()> {{"
+        )?;
+        writeln!(w, "{TAB2}let code = self.code();")?;
+        writeln!(w, "{TAB2}let err = unsafe {{ match *self {{")?;
+
+        let args = if first_arg.is_empty() {
+            "code"
+        } else {
+            "target, code"
+        };
+
+        for option in self.options.iter() {
+            write!(w, "{}{}::{}", TAB3, self.name, option.name)?;
+            match option.param_type {
+                FdbOptionTy::Empty => {
+                    writeln!(w, " => fdb_sys::{fn_name}({args}, std::ptr::null(), 0),")?;
+                }
+                FdbOptionTy::Int => {
+                    writeln!(w, "(v) => {{")?;
+                    writeln!(w, "{TAB4}let data: [u8;8] = i64::to_ne_bytes(v as i64);",)?;
+                    writeln!(
+                        w,
+                        "{TAB4}fdb_sys::{fn_name}({args}, data.as_ptr() as *const u8, 8)"
+                    )?;
+                    writeln!(w, "{TAB3}}}")?;
+                }
+                FdbOptionTy::Bytes => {
+                    writeln!(w, "(ref v) => {{")?;
+                    writeln!(
+                        w,
+                        "{TAB4}fdb_sys::{fn_name}({args}, v.as_ptr() as *const u8, \
+                         i32::try_from(v.len()).expect(\"len to fit in i32\"))\n"
+                    )?;
+                    writeln!(w, "{TAB3}}}")?;
+                }
+                FdbOptionTy::Str => {
+                    writeln!(w, "(ref v) => {{")?;
+                    writeln!(
+                        w,
+                        "{TAB4}fdb_sys::{fn_name}({args}, v.as_ptr() as *const u8, \
+                         i32::try_from(v.len()).expect(\"len to fit in i32\"))\n"
+                    )?;
+                    writeln!(w, "{TAB3}}}")?;
+                }
+            }
+        }
+
+        writeln!(w, "{TAB2}}} }};")?;
+        writeln!(
+            w,
+            "{TAB2}if err != 0 {{ Err(FdbError::from_code(err)) }} else {{ Ok(()) }}",
+        )?;
+        writeln!(w, "{TAB1}}}")
+    }
+
+    fn with_ty(&self) -> bool {
+        self.apply_fn_name().is_some()
+    }
+
+    fn c_enum_prefix(&self) -> &'static str {
+        match self.name.as_str() {
+            "NetworkOption" => "FDBNetworkOption_FDB_NET_OPTION_",
+            "ClusterOption" => "FDBClusterOption_FDB_CLUSTER_OPTION_",
+            "DatabaseOption" => "FDBDatabaseOption_FDB_DB_OPTION_",
+            "TransactionOption" => "FDBTransactionOption_FDB_TR_OPTION_",
+            "StreamingMode" => "FDBStreamingMode_FDB_STREAMING_MODE_",
+            "MutationType" => "FDBMutationType_FDB_MUTATION_TYPE_",
+            "ConflictRangeType" => "FDBConflictRangeType_FDB_CONFLICT_RANGE_TYPE_",
+            "ErrorPredicate" => "FDBErrorPredicate_FDB_ERROR_PREDICATE_",
+            ty => panic!("unknown Scope name: `{ty}`"),
+        }
+    }
+
+    fn apply_arg_name(&self) -> Option<&'static str> {
+        let s = match self.name.as_str() {
+            "ClusterOption" => "FDBCluster",
+            "DatabaseOption" => "FDBDatabase",
+            "TransactionOption" => "FDBTransaction",
+            _ => return None,
+        };
+        Some(s)
+    }
+
+    fn apply_fn_name(&self) -> Option<&'static str> {
+        let s = match self.name.as_str() {
+            "NetworkOption" => "fdb_network_set_option",
+            "ClusterOption" => "fdb_cluster_set_option",
+            "DatabaseOption" => "fdb_database_set_option",
+            "TransactionOption" => "fdb_transaction_set_option",
+            _ => return None,
+        };
+        Some(s)
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default)]
+enum FdbOptionTy {
+    #[default]
+    Empty,
+    Int,
+    Str,
+    Bytes,
+}
+
+#[derive(Default, Debug)]
+struct FdbOption {
+    name: String,
+    c_name: String,
+    code: i32,
+    param_type: FdbOptionTy,
+    param_description: String,
+    description: String,
+    hidden: bool,
+    default_for: Option<i32>,
+    persistent: bool,
+    sensitive: bool,
+}
+
+impl FdbOption {
+    fn gen_ty<W: fmt::Write>(&self, w: &mut W, with_ty: bool) -> fmt::Result {
+        if !self.param_description.is_empty() {
+            writeln!(w, "{t}/// {desc}", t = TAB1, desc = self.param_description)?;
+            writeln!(w, "{TAB1}///")?;
+        }
+        if !self.description.is_empty() {
+            writeln!(w, "{t}/// {desc}", t = TAB1, desc = self.description)?;
+        }
+
+        if let (true, Some(ty)) = (with_ty, self.get_ty()) {
+            writeln!(w, "{t}{name}({ty}),", t = TAB1, name = self.name, ty = ty)?;
+        } else {
+            writeln!(w, "{t}{name},", t = TAB1, name = self.name)?;
+        }
+        Ok(())
+    }
+
+    fn get_ty(&self) -> Option<&'static str> {
+        match self.param_type {
+            FdbOptionTy::Int => Some("i32"),
+            FdbOptionTy::Str => Some("String"),
+            FdbOptionTy::Bytes => Some("Vec<u8>"),
+            FdbOptionTy::Empty => None,
+        }
+    }
+}
+
+fn to_rs_enum_name(v: &str) -> String {
+    let mut is_start_of_word = true;
+    v.chars()
+        .filter_map(|c| {
+            if c == '_' {
+                is_start_of_word = true;
+                None
+            } else if is_start_of_word {
+                is_start_of_word = false;
+                Some(c.to_ascii_uppercase())
+            } else {
+                Some(c)
+            }
+        })
+        .collect()
+}
+
+impl From<Vec<OwnedAttribute>> for FdbOption {
+    fn from(attrs: Vec<OwnedAttribute>) -> Self {
+        let mut opt = Self::default();
+        for attr in attrs {
+            let v = attr.value;
+            match attr.name.local_name.as_str() {
+                "name" => {
+                    opt.name = to_rs_enum_name(v.as_str());
+                    opt.c_name = v.to_uppercase();
+                }
+                "code" => {
+                    opt.code = v.parse().expect("code to be a i32");
+                }
+                "paramType" => {
+                    opt.param_type = match v.as_str() {
+                        "Int" => FdbOptionTy::Int,
+                        "String" => FdbOptionTy::Str,
+                        "Bytes" => FdbOptionTy::Bytes,
+                        "" => FdbOptionTy::Empty,
+                        ty => panic!("unexpected param_type: {ty}"),
+                    };
+                }
+                "paramDescription" => {
+                    opt.param_description = v;
+                }
+                "description" => {
+                    opt.description = v;
+                }
+                "hidden" => match v.as_str() {
+                    "true" => opt.hidden = true,
+                    "false" => opt.hidden = false,
+                    _ => panic!("unexpected boolean value in 'hidden': {v}"),
+                },
+                "defaultFor" => {
+                    opt.default_for = Some(v.parse().expect("defaultFor to be a i32"));
+                }
+                "persistent" => match v.as_str() {
+                    "true" => opt.persistent = true,
+                    "false" => opt.persistent = false,
+                    _ => panic!("unexpected boolean value in 'persistent': {v}"),
+                },
+                "sensitive" => match v.as_str() {
+                    "true" => opt.sensitive = true,
+                    "false" => opt.sensitive = false,
+                    _ => panic!("unexpected boolean value in 'sensitive': {v}"),
+                },
+                attr => {
+                    panic!("unexpected option attribute: {attr}");
+                }
+            }
+        }
+        opt
+    }
+}
+
+fn on_scope<I>(parser: &mut I) -> Vec<FdbOption>
+where
+    I: Iterator<Item = xml::reader::Result<XmlEvent>>,
+{
+    let mut options = Vec::new();
+    for e in parser {
+        let e = e.unwrap();
+        match e {
+            XmlEvent::StartElement {
+                name, attributes, ..
+            } => {
+                assert_eq!(name.local_name, "Option", "unexpected token");
+
+                let option = FdbOption::from(attributes.clone());
+                if !option.hidden {
+                    options.push(option);
+                }
+            }
+            XmlEvent::EndElement { name, .. } if name.local_name == "Scope" => {
+                return options;
+            }
+            _ => {}
+        }
+    }
+
+    panic!("unexpected end of token");
+}
+
+#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "linux"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("/usr/include/foundationdb/fdb.options");
+
+#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "macos"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("/usr/local/include/foundationdb/fdb.options");
+
+#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "windows"))]
+const OPTIONS_DATA: &[u8] =
+    include_bytes!("C:/Program Files/foundationdb/include/foundationdb/fdb.options");
+
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-5_1"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("../include/510/fdb.options");
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-5_2"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("../include/520/fdb.options");
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_0"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("../include/600/fdb.options");
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_1"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("../include/610/fdb.options");
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_2"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("../include/620/fdb.options");
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_3"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("../include/630/fdb.options");
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_0"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("../include/700/fdb.options");
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_1"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("../include/710/fdb.options");
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_3"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("../include/730/fdb.options");
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_4"))]
+const OPTIONS_DATA: &[u8] = include_bytes!("../include/740/fdb.options");
+
+// Compile error when no version feature is specified
+#[cfg(not(any(
+    feature = "fdb-5_1",
+    feature = "fdb-5_2",
+    feature = "fdb-6_0",
+    feature = "fdb-6_1",
+    feature = "fdb-6_2",
+    feature = "fdb-6_3",
+    feature = "fdb-7_0",
+    feature = "fdb-7_1",
+    feature = "fdb-7_3",
+    feature = "fdb-7_4",
+)))]
+compile_error!(
+    "foundationdb-gen requires a version feature to be specified.\n\
+     \n\
+     Available version features: fdb-5_1, fdb-5_2, fdb-6_0, fdb-6_1, fdb-6_2, fdb-6_3, fdb-7_0, fdb-7_1, fdb-7_3, fdb-7_4\n\
+     \n\
+     Examples:\n\
+     - With embedded include: features = [\"embedded-fdb-include\", \"fdb-7_4\"]\n\
+     - With system install: features = [\"fdb-7_4\"]"
+);
+
+pub fn emit(w: &mut impl fmt::Write) -> fmt::Result {
+    let mut reader = OPTIONS_DATA;
+    let parser = EventReader::new(&mut reader);
+    let mut iter = parser.into_iter();
+    let mut scopes = Vec::new();
+
+    while let Some(e) = iter.next() {
+        match e.unwrap() {
+            XmlEvent::StartElement {
+                name, attributes, ..
+            } => {
+                if name.local_name == "Scope" {
+                    let scope_name = attributes
+                        .into_iter()
+                        .find(|attr| attr.name.local_name == "name")
+                        .unwrap();
+
+                    let options = on_scope(&mut iter);
+                    scopes.push(FdbScope {
+                        name: scope_name.value,
+                        options,
+                    });
+                }
+            }
+            XmlEvent::EndElement { .. } => {
+                //
+            }
+            _ => {}
+        }
+    }
+
+    writeln!(w, "use std::convert::TryFrom;")?;
+    writeln!(w, "use crate::{{FdbError, FdbResult}};")?;
+    writeln!(w, "use foundationdb_sys as fdb_sys;")?;
+    for scope in scopes.iter() {
+        scope.gen_ty(w)?;
+        scope.gen_impl(w)?;
+    }
+
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb-macros/CHANGELOG.md b/bindings/rust/foundationdb-macros/CHANGELOG.md
new file mode 100644
index 00000000000..b27d78d9f5e
--- /dev/null
+++ b/bindings/rust/foundationdb-macros/CHANGELOG.md
@@ -0,0 +1,60 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.4.0] - 2026-06-24
+
+### <!-- 1 -->🚀 Features
+
+- Feat: migrate workspace to Rust 2024 edition (#255)
+
+### <!-- 6 -->🧪 Testing
+
+- Fix and run version mapping tests
+
+[0.4.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.3.3..0.4.0
+
+
+## [0.3.3] - 2025-10-24
+
+### <!-- 1 -->🚀 Features
+
+- Add support 7.4
+
+### <!-- 8 -->⚙️ Miscellaneous
+
+- Bump MSRV to 1.82
+- Bump msrv to 1.85
+
+### <!-- 9 -->📦 Other Changes
+
+- Update workload bindings
+
+[0.3.3]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.3.2..0.3.3
+
+
+## [0.3.2] - 2025-01-06
+
+### <!-- 3 -->🆙 Bump
+
+- Bump proc-macro2 from 1.0.89 to 1.0.92
+- Bump syn from 2.0.85 to 2.0.87
+- Bump proc-macro2 from 1.0.87 to 1.0.89
+- Bump syn from 2.0.82 to 2.0.85
+- Bump syn from 2.0.79 to 2.0.82
+- Bump proc-macro2 from 1.0.86 to 1.0.87
+
+[0.3.2]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.3.1..0.3.2
+
+## [0.3.1] - 2024-10-08
+
+### <!-- 3 -->🆙 Bump
+
+- Bump MSRV to 1.71.1
+- Bump all dependencies and setup dependabot
+
+[0.3.1]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.3.0..0.3.1
+
diff --git a/bindings/rust/foundationdb-macros/Cargo.toml b/bindings/rust/foundationdb-macros/Cargo.toml
new file mode 100644
index 00000000000..351174f3b48
--- /dev/null
+++ b/bindings/rust/foundationdb-macros/Cargo.toml
@@ -0,0 +1,28 @@
+[package]
+name = "foundationdb-macros"
+version = "0.4.0"
+authors = [
+    "Pierre Zemb <contact@pierrezemb.fr>"
+]
+edition = "2024"
+rust-version = "1.85.1"
+
+description = """
+Macro definitions used to maintain the FoundationDB's crate
+"""
+
+documentation = "https://docs.rs/foundationdb"
+repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+license = "MIT/Apache-2.0"
+
+readme = "README.md"
+keywords = ["foundationdb", "proc-macro"]
+
+[lib]
+proc-macro = true
+
+[dependencies]
+syn = { version = "3.0.2", features = ["full"] }
+proc-macro2 = "1.0.106"
+try_map = "0.3.1"
+quote = "1.0.46"
diff --git a/bindings/rust/foundationdb-macros/README.md b/bindings/rust/foundationdb-macros/README.md
new file mode 100644
index 00000000000..c900519d165
--- /dev/null
+++ b/bindings/rust/foundationdb-macros/README.md
@@ -0,0 +1,3 @@
+# FoundationDB-macros
+
+This crate is holding a few macros used to maintain the crate.
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-macros/src/lib.rs b/bindings/rust/foundationdb-macros/src/lib.rs
new file mode 100644
index 00000000000..bf9a8feb247
--- /dev/null
+++ b/bindings/rust/foundationdb-macros/src/lib.rs
@@ -0,0 +1,245 @@
+//! Macro definitions used to maintain the crate
+use proc_macro::TokenStream;
+use quote::quote;
+use std::collections::HashMap;
+use syn::__private::TokenStream2;
+use syn::parse::Parser;
+use syn::{Item, LitInt};
+use try_map::FallibleMapExt;
+
+/// Allow to compute the range of supported api versions for a functionality.
+///
+/// This macro came out from the frustration of bumping fdb's version, where
+/// we are spending most of our time searching for things like:
+/// `#[cfg(any(feature = "fdb-5_1", feature = "fdb-5_2", feature = "fdb-6_0"))]`
+/// and adding the new version manually.
+///
+/// Thanks to the macro, we can now specify a `minimum` and an optional `max` version, and
+/// generate the right list of any. Not specifying a `max` allow easy bump to a new version.
+///
+/// `#[cfg_api_versions(min = 510, max = 600)]` will be translated to:
+/// `#[cfg(any(feature = "fdb-5_1", feature = "fdb-5_2", feature = "fdb-6_0"))]`
+#[proc_macro_attribute]
+pub fn cfg_api_versions(args: TokenStream, input: TokenStream) -> TokenStream {
+    let args = proc_macro2::TokenStream::from(args);
+    let input = proc_macro2::TokenStream::from(input);
+    cfg_api_versions_impl(args, input).into()
+}
+
+fn cfg_api_versions_impl(
+    args: proc_macro2::TokenStream,
+    input: proc_macro2::TokenStream,
+) -> proc_macro2::TokenStream {
+    let mut min: Option<LitInt> = None;
+    let mut max: Option<LitInt> = None;
+    let version_parser = syn::meta::parser(|meta| {
+        if meta.path.is_ident("min") {
+            min = Some(meta.value()?.parse()?);
+            Ok(())
+        } else if meta.path.is_ident("max") {
+            max = Some(meta.value()?.parse()?);
+            Ok(())
+        } else {
+            Err(meta.error("unsupported cfg_api_versions property"))
+        }
+    });
+
+    Parser::parse2(version_parser, args).expect("Unable to parse attribute cfg_api_versions");
+
+    let input: Item = syn::parse2(input).expect("Unable to parse input");
+
+    let minimum_version = min
+        .expect("min property must be provided")
+        .base10_parse::<i32>()
+        .expect("Unable to parse min version");
+    let maximum_version = max
+        .try_map(|x| x.base10_parse::<i32>())
+        .expect("Unable to parse max version");
+    generate_feature_range(&input, minimum_version, maximum_version)
+}
+
+fn generate_feature_range(
+    input: &Item,
+    minimum_version: i32,
+    maximum_version: Option<i32>,
+) -> proc_macro2::TokenStream {
+    let allowed_fdb_versions: Vec<TokenStream2> =
+        get_supported_feature_range(minimum_version, maximum_version)
+            .iter()
+            .map(|fdb_version| quote!(feature = #fdb_version))
+            .collect();
+
+    quote!(
+        #[cfg(any(#(#allowed_fdb_versions),*))]
+        #input
+    )
+}
+
+/// Given a range of version, this function will generate the appropriate macro text.
+fn get_supported_feature_range(minimum_version: i32, maximum_version: Option<i32>) -> Vec<String> {
+    let mut values: Vec<String> = get_version_mapping()
+        .iter()
+        .filter(|(_, version)| match maximum_version {
+            None => minimum_version <= **version,
+            Some(maximum) => minimum_version <= **version && version <= &&maximum,
+        })
+        .map(|(feature, _)| feature.to_owned())
+        .collect();
+    values.sort();
+
+    values
+}
+
+// TODO: Should we import something like lazy_static?
+fn get_version_mapping() -> HashMap<String, i32> {
+    let mut version_mapping = HashMap::with_capacity(9);
+    version_mapping.insert("fdb-7_4".into(), 740);
+    version_mapping.insert("fdb-7_3".into(), 730);
+    version_mapping.insert("fdb-7_1".into(), 710);
+    version_mapping.insert("fdb-7_0".into(), 700);
+    version_mapping.insert("fdb-6_3".into(), 630);
+    version_mapping.insert("fdb-6_2".into(), 620);
+    version_mapping.insert("fdb-6_1".into(), 610);
+    version_mapping.insert("fdb-6_0".into(), 600);
+    version_mapping.insert("fdb-5_2".into(), 520);
+    version_mapping.insert("fdb-5_1".into(), 510);
+    version_mapping.insert("fdb-5_0".into(), 500);
+    version_mapping
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::cfg_api_versions_impl;
+    use crate::get_supported_feature_range;
+    use proc_macro2::TokenStream;
+    use quote::quote;
+
+    #[test]
+    fn test_create_supported_list() {
+        let v = get_supported_feature_range(700, None);
+        assert_eq!(v.len(), 4);
+        assert!(v.contains(&String::from("fdb-7_0")));
+        assert!(v.contains(&String::from("fdb-7_1")));
+        assert!(v.contains(&String::from("fdb-7_3")));
+        assert!(v.contains(&String::from("fdb-7_4")));
+
+        let v = get_supported_feature_range(600, Some(700));
+        assert_eq!(v.len(), 5);
+        assert!(v.contains(&String::from("fdb-7_0")));
+        assert!(v.contains(&String::from("fdb-6_3")));
+        assert!(v.contains(&String::from("fdb-6_2")));
+        assert!(v.contains(&String::from("fdb-6_1")));
+        assert!(v.contains(&String::from("fdb-6_0")));
+
+        let v = get_supported_feature_range(500, Some(610));
+        assert_eq!(v.len(), 5);
+        assert!(v.contains(&String::from("fdb-6_1")));
+        assert!(v.contains(&String::from("fdb-6_0")));
+        assert!(v.contains(&String::from("fdb-5_2")));
+        assert!(v.contains(&String::from("fdb-5_1")));
+        assert!(v.contains(&String::from("fdb-5_0")));
+
+        let v = get_supported_feature_range(500, None);
+        assert_eq!(v.len(), 11);
+        assert!(v.contains(&String::from("fdb-7_4")));
+        assert!(v.contains(&String::from("fdb-7_3")));
+        assert!(v.contains(&String::from("fdb-7_1")));
+        assert!(v.contains(&String::from("fdb-7_0")));
+        assert!(v.contains(&String::from("fdb-6_3")));
+        assert!(v.contains(&String::from("fdb-6_2")));
+        assert!(v.contains(&String::from("fdb-6_1")));
+        assert!(v.contains(&String::from("fdb-6_0")));
+        assert!(v.contains(&String::from("fdb-5_2")));
+        assert!(v.contains(&String::from("fdb-5_1")));
+        assert!(v.contains(&String::from("fdb-5_0")));
+    }
+
+    fn test_cfg_versions(expected_versions: TokenStream, attrs: TokenStream) {
+        let input = quote! {
+            fn ma_fonction() {}
+        };
+
+        let expected = quote! {
+            #[cfg(any(#expected_versions))]
+            fn ma_fonction() {}
+        };
+
+        let result = cfg_api_versions_impl(attrs, input);
+        assert_eq!(result.to_string(), expected.to_string())
+    }
+
+    #[test]
+    fn test_min_700_no_max_version() {
+        let data = quote!(
+            feature = "fdb-7_0",
+            feature = "fdb-7_1",
+            feature = "fdb-7_3",
+            feature = "fdb-7_4"
+        );
+
+        let attrs = quote!(min = 700);
+
+        test_cfg_versions(data, attrs)
+    }
+
+    #[test]
+    fn test_min_600_max_700() {
+        let expected_versions = quote!(
+            feature = "fdb-6_0",
+            feature = "fdb-6_1",
+            feature = "fdb-6_2",
+            feature = "fdb-6_3",
+            feature = "fdb-7_0"
+        );
+
+        let attrs = quote!(min = 600, max = 700);
+
+        test_cfg_versions(expected_versions, attrs)
+    }
+
+    #[test]
+    fn test_min_500_max_610() {
+        let expected_versions = quote!(
+            feature = "fdb-5_0",
+            feature = "fdb-5_1",
+            feature = "fdb-5_2",
+            feature = "fdb-6_0",
+            feature = "fdb-6_1"
+        );
+
+        let attrs = quote!(min = 500, max = 610);
+
+        test_cfg_versions(expected_versions, attrs)
+    }
+
+    #[test]
+    fn test_min_500_no_max() {
+        let expected_versions = quote!(
+            feature = "fdb-5_0",
+            feature = "fdb-5_1",
+            feature = "fdb-5_2",
+            feature = "fdb-6_0",
+            feature = "fdb-6_1",
+            feature = "fdb-6_2",
+            feature = "fdb-6_3",
+            feature = "fdb-7_0",
+            feature = "fdb-7_1",
+            feature = "fdb-7_3",
+            feature = "fdb-7_4"
+        );
+
+        let attrs = quote!(min = 500);
+
+        test_cfg_versions(expected_versions, attrs)
+    }
+
+    #[test]
+    #[should_panic]
+    fn test_no_min_version() {
+        let expected_versions = quote!(feature = "fdb-5_0",);
+
+        let attrs = quote!(max = 500);
+
+        test_cfg_versions(expected_versions, attrs)
+    }
+}
diff --git a/bindings/rust/foundationdb-profiling/Cargo.toml b/bindings/rust/foundationdb-profiling/Cargo.toml
new file mode 100644
index 00000000000..b7f239d8afd
--- /dev/null
+++ b/bindings/rust/foundationdb-profiling/Cargo.toml
@@ -0,0 +1,33 @@
+[package]
+name = "foundationdb-profiling"
+version = "0.1.0"
+authors = [
+    "Pierre Zemb <contact@pierrezemb.fr>"
+]
+edition = "2024"
+rust-version = "1.85.1"
+
+description = """
+Read and decode FoundationDB client transaction profiling data
+"""
+
+documentation = "https://docs.rs/foundationdb-profiling"
+repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+license = "MIT/Apache-2.0"
+
+readme = "README.md"
+keywords = ["foundationdb", "profiling"]
+categories = ["database", "development-tools::profiling"]
+
+[badges]
+codecov = { repository = "foundationdb-rs/foundationdb-rs", branch = "main", service = "github" }
+
+[dependencies]
+futures-core = "0.3.32"
+thiserror = "2.0.18"
+tracing = "0.1.44"
+
+[dev-dependencies]
+foundationdb = { version = "0.11.0", path = "../foundationdb", default-features = false, features = ["fdb-7_4", "embedded-fdb-include"] }
+futures-util = "0.3.32"
+tokio = { version = "1.52.3", features = ["macros", "rt-multi-thread", "time"] }
diff --git a/bindings/rust/foundationdb-profiling/README.md b/bindings/rust/foundationdb-profiling/README.md
new file mode 100644
index 00000000000..b25f908be5e
--- /dev/null
+++ b/bindings/rust/foundationdb-profiling/README.md
@@ -0,0 +1,12 @@
+# FoundationDB-profiling
+
+Read and decode FoundationDB client transaction profiling data
+(`\xff\x02/fdbClientInfo/client_latency/`) from your own application.
+
+The crate does no I/O and does not depend on the `foundationdb` crate: you read the
+range given by `ProfileScanner::range` with your own FoundationDB bindings, and
+`ProfileScanner::read_page` reassembles and decodes the records into typed events,
+returning a cursor to resume from. `Aggregator` counts the hottest keys and ranges.
+
+See the [documentation](https://docs.rs/foundationdb-profiling) and
+[`examples/top_keys.rs`](examples/top_keys.rs).
diff --git a/bindings/rust/foundationdb-profiling/examples/top_keys.rs b/bindings/rust/foundationdb-profiling/examples/top_keys.rs
new file mode 100644
index 00000000000..cc5a627768a
--- /dev/null
+++ b/bindings/rust/foundationdb-profiling/examples/top_keys.rs
@@ -0,0 +1,120 @@
+//! Reads the whole client profiling keyspace and prints the hottest keys, ranges and
+//! write hot spots, the way an application embedding this crate would.
+//!
+//! Enable client profiling on the cluster first, for instance for 1% of transactions:
+//!
+//! ```text
+//! fdbcli --exec "profile client set 0.01 default"
+//! ```
+//!
+//! Then, once the client has served some traffic and flushed its samples, run this
+//! example against the same cluster (optionally pass a cluster file as the first
+//! argument, otherwise the default one is used):
+//!
+//! ```text
+//! cargo run -p foundationdb-profiling --example top_keys
+//! ```
+
+use foundationdb::options::TransactionOption;
+use foundationdb::tuple::Bytes;
+use foundationdb::{ClientBudget, Database, FdbBindingError, KeySelector, RangeOption};
+use foundationdb_profiling::{Aggregator, Cursor, ProfileScanner, SkipReason};
+use futures_util::TryStreamExt;
+use std::time::Duration;
+
+const TOP_N: usize = 10;
+const BUCKET_COUNT: usize = 10;
+
+#[tokio::main]
+async fn main() {
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+
+    let cluster_file = std::env::args().nth(1);
+    let db = Database::new(cluster_file.as_deref()).expect("failed to open database");
+
+    let mut cursor = Cursor::beginning();
+    let scanner = ProfileScanner::new();
+    let mut aggregator = Aggregator::default();
+    let mut read = 0usize;
+    let (mut decode_errors, mut broken_chunks) = (0usize, 0usize);
+
+    loop {
+        let page = db
+            .run(|trx, _maybe_committed| {
+                let scanner = scanner.clone();
+                let cursor = cursor.clone();
+                async move {
+                    // This crate never sets transaction options itself: that is the
+                    // caller's job, see the crate docs.
+                    trx.set_option(TransactionOption::ReadSystemKeys)?;
+                    // Every page is bounded by this budget, checked after every row.
+                    trx.set_client_budget(ClientBudget {
+                        time_limit: Some(Duration::from_secs(2)),
+                        ..ClientBudget::default()
+                    });
+                    let range = scanner.range(&cursor);
+                    let opt = RangeOption::from((
+                        KeySelector::first_greater_or_equal(range.begin.as_slice()),
+                        KeySelector::first_greater_or_equal(range.end.as_slice()),
+                    ));
+                    let rows = trx
+                        .get_ranges_keyvalues(opt, true)
+                        .map_ok(|kv| (kv.key().to_vec(), kv.value().to_vec()));
+                    let page = scanner
+                        .read_page(&cursor, rows, || trx.check_client_budget().is_err())
+                        .await
+                        .map_err(|err| err.into_error(FdbBindingError::new_custom_error))?;
+                    Ok::<_, FdbBindingError>(page)
+                }
+            })
+            .await
+            .expect("failed to read a page of profiling data");
+
+        read += page.transactions.len();
+        for tx in &page.transactions {
+            aggregator.record(tx);
+        }
+        for skipped in &page.skipped {
+            match skipped.reason {
+                SkipReason::Decode(_) => decode_errors += 1,
+                SkipReason::BrokenChunks => broken_chunks += 1,
+                _ => {}
+            }
+        }
+
+        cursor = page.next;
+        if page.exhausted {
+            break;
+        }
+    }
+
+    println!("transactions read: {read}");
+    println!(
+        "transactions skipped: {} ({decode_errors} decode error(s), {broken_chunks} broken chunk(s))",
+        decode_errors + broken_chunks
+    );
+
+    println!("\ntop {TOP_N} read keys:");
+    for (key, count) in aggregator.reads().top_keys(TOP_N) {
+        println!("  {count:>8}  {}", Bytes::from(key));
+    }
+
+    println!("\ntop {TOP_N} read ranges:");
+    for (range, count) in aggregator.reads().top_ranges(TOP_N) {
+        println!(
+            "  {count:>8}  {} .. {}",
+            Bytes::from(range.begin),
+            Bytes::from(range.end)
+        );
+    }
+
+    println!("\ntop {TOP_N} written keys:");
+    for (key, count) in aggregator.writes().top_keys(TOP_N) {
+        println!("  {count:>8}  {}", Bytes::from(key));
+    }
+
+    println!("\n{BUCKET_COUNT} read buckets:");
+    for bucket in aggregator.reads().buckets(BUCKET_COUNT) {
+        println!("  {:>8}  {}", bucket.count, Bytes::from(bucket.start));
+    }
+}
diff --git a/bindings/rust/foundationdb-profiling/src/aggregate.rs b/bindings/rust/foundationdb-profiling/src/aggregate.rs
new file mode 100644
index 00000000000..43c41bb6137
--- /dev/null
+++ b/bindings/rust/foundationdb-profiling/src/aggregate.rs
@@ -0,0 +1,606 @@
+//! Aggregated read/write counts over profiled transactions.
+//!
+//! [`Aggregator`] mirrors the Python `transaction_profiling_analyzer.py` `ReadCounter` /
+//! `WriteCounter`: it counts which keys and ranges transactions read and wrote, so a
+//! caller can find hot keys or split the keyspace into buckets of approximately equal
+//! traffic. It does not resolve shard addresses (`ShardFinder` in the Python tool): that
+//! is a separate, caller-side concern.
+
+use crate::event::{Event, KeyRange, Mutation};
+use crate::reader::ProfiledTransaction;
+use std::collections::BTreeMap;
+use tracing::instrument;
+
+/// `MutationRef::Type` codes that write a single key (`param1`): the plain and atomic
+/// mutations a client can send in a commit
+/// (`fdbclient/include/fdbclient/CommitTransaction.h`). Deliberately an allowlist, not a
+/// range check: `MutationRef::Type` also has codes a client commit never carries
+/// (`DebugKeyRange`, `DebugKey`, `NoOp`, `AvailableForReuse`, the `Reserved_For_*` codes,
+/// `Encrypted`), and `SetVersionstampedKey`, whose `param1` holds an unfilled versionstamp
+/// placeholder rather than the real key, so it is left out on purpose.
+const SINGLE_KEY_WRITE_TYPES: [u8; 14] = [
+    Mutation::SET_VALUE,
+    Mutation::ADD_VALUE,
+    Mutation::AND,
+    Mutation::OR,
+    Mutation::XOR,
+    Mutation::APPEND_IF_FITS,
+    Mutation::MAX,
+    Mutation::MIN,
+    Mutation::SET_VERSIONSTAMPED_VALUE,
+    Mutation::BYTE_MIN,
+    Mutation::BYTE_MAX,
+    Mutation::MIN_V2,
+    Mutation::AND_V2,
+    Mutation::COMPARE_AND_CLEAR,
+];
+
+/// Counts keys and ranges read and written by recorded transactions.
+///
+/// Only successful operations are counted: `Get`/`GetRange`/`Commit` events, never
+/// `GetError`/`GetRangeError`/`CommitError`. This mirrors the Python `ReadCounter` and
+/// `WriteCounter`, which only ever process `transaction_info.gets`, `.get_ranges` and
+/// `.commit`, and never the `error_*` lists, since a failed operation never touched the
+/// key or range it targeted. See [`Aggregator::writes`] for which mutation types count as
+/// writes.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct Aggregator {
+    reads: KeyCounts,
+    writes: KeyCounts,
+}
+
+impl Aggregator {
+    /// Records every event of one profiled transaction.
+    #[instrument(level = "debug", skip_all, fields(events = tx.events.len()))]
+    pub fn record(&mut self, tx: &ProfiledTransaction) {
+        for event in &tx.events {
+            self.record_event(event);
+        }
+    }
+
+    /// Records one event.
+    ///
+    /// See the [`Aggregator`] docs for which events and mutation types count.
+    #[instrument(level = "trace", skip_all)]
+    pub fn record_event(&mut self, event: &Event) {
+        match event {
+            Event::Get(get) => self.reads.insert_key(&get.key),
+            Event::GetRange(get_range) => self.reads.insert_range(get_range.range.clone()),
+            Event::Commit(commit) => {
+                for mutation in &commit.request.mutations {
+                    if mutation.mutation_type == Mutation::CLEAR_RANGE {
+                        self.writes.insert_range(KeyRange {
+                            begin: mutation.param1.clone(),
+                            end: mutation.param2.clone(),
+                        });
+                    } else if SINGLE_KEY_WRITE_TYPES.contains(&mutation.mutation_type) {
+                        self.writes.insert_key(&mutation.param1);
+                    }
+                }
+            }
+            Event::GetVersion(_)
+            | Event::GetError(_)
+            | Event::GetRangeError(_)
+            | Event::CommitError(_) => {}
+        }
+    }
+
+    /// Keys and ranges read by `Get` and `GetRange` events.
+    #[instrument(level = "trace", skip_all)]
+    pub fn reads(&self) -> &KeyCounts {
+        &self.reads
+    }
+
+    /// Keys and ranges written by the mutations of successful `Commit` events.
+    ///
+    /// A `ClearRange` mutation counts as a range write, `param1` to `param2`. An allowlist
+    /// of client write mutation types counts as a single-key write by `param1`:
+    /// `SetValue`, `AddValue`, and the atomic ops `And`, `Or`, `Xor`, `AppendIfFits`,
+    /// `Max`, `Min`, `SetVersionstampedValue`, `ByteMin`, `ByteMax`, `MinV2`, `AndV2` and
+    /// `CompareAndClear`. Everything else is ignored: `SetVersionstampedKey` (its
+    /// `param1` holds an unfilled versionstamp placeholder, not the real key), the
+    /// server-only debug/reserved mutation types, and unknown codes.
+    ///
+    /// This is wider than the Python `WriteCounter`, which only counts `SetValue` and
+    /// `AddValue` and drops every other mutation type, including `ClearRange`.
+    #[instrument(level = "trace", skip_all)]
+    pub fn writes(&self) -> &KeyCounts {
+        &self.writes
+    }
+}
+
+/// Per-key and per-range hit counts, as returned by [`Aggregator::reads`] and
+/// [`Aggregator::writes`].
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct KeyCounts {
+    keys: BTreeMap<Vec<u8>, u64>,
+    ranges: BTreeMap<KeyRange, u64>,
+}
+
+impl KeyCounts {
+    fn insert_key(&mut self, key: &[u8]) {
+        *self.keys.entry(key.to_vec()).or_insert(0) += 1;
+    }
+
+    fn insert_range(&mut self, range: KeyRange) {
+        *self.ranges.entry(range).or_insert(0) += 1;
+    }
+
+    /// Total number of recorded hits, single keys and ranges combined.
+    #[instrument(level = "trace", skip(self))]
+    pub fn total(&self) -> u64 {
+        let key_total: u64 = self.keys.values().sum();
+        let range_total: u64 = self.ranges.values().sum();
+        key_total + range_total
+    }
+
+    /// The `n` most frequently hit single keys, descending by count, ties broken by key
+    /// ascending.
+    #[instrument(level = "trace", skip(self))]
+    pub fn top_keys(&self, n: usize) -> Vec<(Vec<u8>, u64)> {
+        let mut entries: Vec<(Vec<u8>, u64)> =
+            self.keys.iter().map(|(k, v)| (k.clone(), *v)).collect();
+        entries.sort_by(|a, b| b.1.cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
+        entries.truncate(n);
+        entries
+    }
+
+    /// The `n` most frequently hit ranges, descending by count, ties broken by range
+    /// ascending (begin, then end).
+    #[instrument(level = "trace", skip(self))]
+    pub fn top_ranges(&self, n: usize) -> Vec<(KeyRange, u64)> {
+        let mut entries: Vec<(KeyRange, u64)> =
+            self.ranges.iter().map(|(k, v)| (k.clone(), *v)).collect();
+        entries.sort_by(|a, b| b.1.cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
+        entries.truncate(n);
+        entries
+    }
+
+    /// Splits the keyspace into up to `n` buckets of approximately equal hit count, like
+    /// `ReadCounter.get_range_boundaries` / `WriteCounter.get_range_boundaries` in the
+    /// Python tool (minus its `ShardFinder` address resolution, and the "intersecting"
+    /// count it additionally reports for ranges that span a bucket boundary, which is a
+    /// display-only detail this crate does not expose).
+    ///
+    /// A bucket's range is `[bucket.start, next_bucket.start)`; the last bucket extends to
+    /// the end of the keyspace. Returns fewer than `n` buckets when there are fewer than
+    /// `n` distinct starting positions, and an empty vector for `n == 0` or an empty
+    /// counter.
+    #[instrument(level = "trace", skip(self))]
+    pub fn buckets(&self, n: usize) -> Vec<Bucket> {
+        if n == 0 {
+            return Vec::new();
+        }
+
+        // Every recorded key or range contributes one hit at its starting position: a
+        // single key at itself, a range at its begin. This is exactly the Python
+        // `opened_this_range` counter, which is what decides where boundaries fall.
+        let mut starts: BTreeMap<&[u8], u64> = BTreeMap::new();
+        for (key, count) in &self.keys {
+            *starts.entry(key.as_slice()).or_insert(0) += count;
+        }
+        for (range, count) in &self.ranges {
+            *starts.entry(range.begin.as_slice()).or_insert(0) += count;
+        }
+
+        let total: u64 = starts.values().sum();
+        if total == 0 {
+            return Vec::new();
+        }
+
+        // Floored at 1: when `n` exceeds the amount of distinct traffic, the Python
+        // tool's `range_size` (an integer division) truncates to 0, which then cuts a
+        // boundary before any key is ever assigned to it. Flooring instead yields one
+        // bucket per distinct starting position, the sensible reading of "n buckets" when
+        // there is less traffic than that to split.
+        let bucket_size = (total / n as u64).max(1);
+
+        let mut out = Vec::new();
+        let mut current_start: Option<Vec<u8>> = None;
+        let mut current_count: u64 = 0;
+        for (&start, &count) in &starts {
+            // Once one more bucket would reach `n`, stop cutting: the last bucket absorbs
+            // whatever remains, so `buckets` never returns more than `n` of them.
+            if current_count >= bucket_size && out.len() + 1 < n {
+                if let Some(start) = current_start.take() {
+                    out.push(Bucket {
+                        start,
+                        count: current_count,
+                    });
+                }
+                current_count = 0;
+            }
+            current_count += count;
+            if current_start.is_none() {
+                current_start = Some(start.to_vec());
+            }
+        }
+        if current_count > 0 {
+            if let Some(start) = current_start {
+                out.push(Bucket {
+                    start,
+                    count: current_count,
+                });
+            }
+        }
+        out
+    }
+}
+
+/// One boundary of an approximately equal-count keyspace split, from [`KeyCounts::buckets`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Bucket {
+    /// Inclusive start of the bucket. The bucket extends to the next bucket's `start`, or
+    /// to the end of the keyspace for the last bucket.
+    pub start: Vec<u8>,
+    /// Number of read or write hits starting in this bucket.
+    pub count: u64,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::event::{
+        Commit, CommitError, CommitRequest, EventHeader, Get, GetError, GetRange, GetRangeError,
+        GetVersion, Mutation,
+    };
+
+    fn header() -> EventHeader {
+        EventHeader {
+            start_timestamp: 0.0,
+            dc_id: Vec::new(),
+            tenant: None,
+        }
+    }
+
+    fn get(key: &[u8]) -> Event {
+        Event::Get(Get {
+            header: header(),
+            latency: 0.0,
+            value_size: 0,
+            key: key.to_vec(),
+        })
+    }
+
+    fn get_range(begin: &[u8], end: &[u8]) -> Event {
+        Event::GetRange(GetRange {
+            header: header(),
+            latency: 0.0,
+            range_size: 0,
+            range: KeyRange {
+                begin: begin.to_vec(),
+                end: end.to_vec(),
+            },
+        })
+    }
+
+    fn get_error(key: &[u8]) -> Event {
+        Event::GetError(GetError {
+            header: header(),
+            error_code: 1009,
+            key: key.to_vec(),
+        })
+    }
+
+    fn get_range_error(begin: &[u8], end: &[u8]) -> Event {
+        Event::GetRangeError(GetRangeError {
+            header: header(),
+            error_code: 1009,
+            range: KeyRange {
+                begin: begin.to_vec(),
+                end: end.to_vec(),
+            },
+        })
+    }
+
+    fn commit_request(mutations: Vec<Mutation>) -> CommitRequest {
+        CommitRequest {
+            read_conflict_ranges: Vec::new(),
+            write_conflict_ranges: Vec::new(),
+            mutations,
+            read_snapshot: 0,
+            report_conflicting_keys: false,
+            lock_aware: false,
+            span_context: None,
+        }
+    }
+
+    fn commit(mutations: Vec<Mutation>) -> Event {
+        Event::Commit(Commit {
+            header: header(),
+            latency: 0.0,
+            num_mutations: mutations.len() as i32,
+            commit_bytes: 0,
+            commit_version: 0,
+            request: commit_request(mutations),
+        })
+    }
+
+    fn commit_error(mutations: Vec<Mutation>) -> Event {
+        Event::CommitError(CommitError {
+            header: header(),
+            error_code: 1020,
+            request: commit_request(mutations),
+        })
+    }
+
+    fn mutation(mutation_type: u8, param1: &[u8], param2: &[u8]) -> Mutation {
+        Mutation {
+            mutation_type,
+            param1: param1.to_vec(),
+            param2: param2.to_vec(),
+        }
+    }
+
+    /// A code in the `MutationRef::Type` range that is not a client write op: server-only
+    /// debug mutation, not in the allowlist.
+    const NO_OP: u8 = 5;
+    /// Past `Encrypted` (23), the last type the C++ client defines.
+    const UNKNOWN_MUTATION_TYPE: u8 = 250;
+
+    #[test]
+    fn reads_and_writes_are_split_and_only_successes_count() {
+        let mut agg = Aggregator::default();
+        for event in [
+            get(b"a"),
+            get_range(b"b", b"c"),
+            get_error(b"ignored"),
+            get_range_error(b"ig", b"nored"),
+            Event::GetVersion(GetVersion {
+                header: header(),
+                latency: 0.0,
+                priority: 0,
+                read_version: 0,
+            }),
+            commit(vec![mutation(Mutation::SET_VALUE, b"w", b"v")]),
+            commit_error(vec![mutation(Mutation::SET_VALUE, b"ignored-write", b"v")]),
+        ] {
+            agg.record_event(&event);
+        }
+
+        assert_eq!(agg.reads().total(), 2);
+        assert_eq!(agg.reads().top_keys(10), vec![(b"a".to_vec(), 1)]);
+        assert_eq!(
+            agg.reads().top_ranges(10),
+            vec![(
+                KeyRange {
+                    begin: b"b".to_vec(),
+                    end: b"c".to_vec()
+                },
+                1
+            )]
+        );
+        assert_eq!(agg.writes().total(), 1);
+        assert_eq!(agg.writes().top_keys(10), vec![(b"w".to_vec(), 1)]);
+        assert!(agg.writes().top_ranges(10).is_empty());
+    }
+
+    #[test]
+    fn record_loops_record_event_over_transaction_events() {
+        let mut agg = Aggregator::default();
+        let tx = ProfiledTransaction {
+            version: 1,
+            versionstamp: [0u8; 10],
+            id: [0u8; 16],
+            protocol_version: crate::event::ProtocolVersion::V7_4,
+            events: vec![get(b"a"), get(b"a"), commit(vec![])],
+        };
+        agg.record(&tx);
+        assert_eq!(agg.reads().top_keys(10), vec![(b"a".to_vec(), 2)]);
+        assert_eq!(agg.writes().total(), 0);
+    }
+
+    #[test]
+    fn write_mutation_types() {
+        let mut agg = Aggregator::default();
+        agg.record_event(&commit(vec![
+            mutation(Mutation::SET_VALUE, b"set", b"v"),
+            mutation(Mutation::ADD_VALUE, b"add", b"1"),
+            // Every other known atomic op counts too, not just SetValue/AddValue: wider
+            // than the Python WriteCounter.
+            mutation(Mutation::AND, b"anded", b"mask"),
+            mutation(Mutation::SET_VERSIONSTAMPED_VALUE, b"svv", b"v"),
+            mutation(Mutation::CLEAR_RANGE, b"c", b"c\x00"),
+            // Placeholder key (unfilled versionstamp): never counted.
+            mutation(Mutation::SET_VERSIONSTAMPED_KEY, b"placeholder", b"v"),
+            // In the MutationRef::Type range but not a client write op: not in the
+            // allowlist, ignored.
+            mutation(NO_OP, b"noop", b"v"),
+            // Past the last mutation type the C++ client defines: ignored.
+            mutation(UNKNOWN_MUTATION_TYPE, b"future", b"v"),
+        ]));
+
+        let writes = agg.writes();
+        assert_eq!(writes.total(), 5);
+        assert_eq!(
+            writes.top_keys(10),
+            vec![
+                (b"add".to_vec(), 1),
+                (b"anded".to_vec(), 1),
+                (b"set".to_vec(), 1),
+                (b"svv".to_vec(), 1),
+            ]
+        );
+        assert_eq!(
+            writes.top_ranges(10),
+            vec![(
+                KeyRange {
+                    begin: b"c".to_vec(),
+                    end: b"c\x00".to_vec()
+                },
+                1
+            )]
+        );
+    }
+
+    #[test]
+    fn top_keys_orders_by_count_then_key_ascending() {
+        let mut counts = KeyCounts::default();
+        for (key, hits) in [(b"z" as &[u8], 3), (b"a", 3), (b"m", 5), (b"b", 1)] {
+            for _ in 0..hits {
+                counts.insert_key(key);
+            }
+        }
+        assert_eq!(
+            counts.top_keys(10),
+            vec![
+                (b"m".to_vec(), 5),
+                (b"a".to_vec(), 3),
+                (b"z".to_vec(), 3),
+                (b"b".to_vec(), 1),
+            ]
+        );
+        assert_eq!(counts.top_keys(0), Vec::new());
+        assert_eq!(counts.top_keys(2).len(), 2);
+    }
+
+    #[test]
+    fn top_ranges_orders_by_count_then_range_ascending() {
+        let mut counts = KeyCounts::default();
+        let r = |b: &[u8], e: &[u8]| KeyRange {
+            begin: b.to_vec(),
+            end: e.to_vec(),
+        };
+        for (range, hits) in [(r(b"y", b"z"), 2), (r(b"a", b"b"), 2), (r(b"m", b"n"), 4)] {
+            for _ in 0..hits {
+                counts.insert_range(range.clone());
+            }
+        }
+        assert_eq!(
+            counts.top_ranges(10),
+            vec![(r(b"m", b"n"), 4), (r(b"a", b"b"), 2), (r(b"y", b"z"), 2)]
+        );
+    }
+
+    #[test]
+    fn buckets_empty_counter_is_empty() {
+        let counts = KeyCounts::default();
+        assert_eq!(counts.buckets(4), Vec::new());
+        assert_eq!(counts.buckets(0), Vec::new());
+    }
+
+    #[test]
+    fn buckets_n_zero_is_empty_even_with_data() {
+        let mut counts = KeyCounts::default();
+        counts.insert_key(b"a");
+        assert_eq!(counts.buckets(0), Vec::new());
+    }
+
+    #[test]
+    fn buckets_split_approximately_evenly() {
+        let mut counts = KeyCounts::default();
+        // 8 hits spread over 4 distinct keys, split into 2 buckets of ~4.
+        for key in [b"a" as &[u8], b"b", b"c", b"d"] {
+            counts.insert_key(key);
+            counts.insert_key(key);
+        }
+        let buckets = counts.buckets(2);
+        assert_eq!(
+            buckets,
+            vec![
+                Bucket {
+                    start: b"a".to_vec(),
+                    count: 4
+                },
+                Bucket {
+                    start: b"c".to_vec(),
+                    count: 4
+                },
+            ]
+        );
+        let total: u64 = buckets.iter().map(|b| b.count).sum();
+        assert_eq!(total, counts.total());
+    }
+
+    #[test]
+    fn buckets_n_larger_than_distinct_keys_yields_one_bucket_per_key() {
+        let mut counts = KeyCounts::default();
+        counts.insert_key(b"a");
+        counts.insert_key(b"b");
+        counts.insert_key(b"c");
+
+        let buckets = counts.buckets(10);
+        assert_eq!(
+            buckets,
+            vec![
+                Bucket {
+                    start: b"a".to_vec(),
+                    count: 1
+                },
+                Bucket {
+                    start: b"b".to_vec(),
+                    count: 1
+                },
+                Bucket {
+                    start: b"c".to_vec(),
+                    count: 1
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn buckets_never_returns_more_than_n() {
+        // 10 keys with 1 hit each: bucket_size = 10 / 3 = 3, which would cut a 4th bucket
+        // (3, 3, 3, 1) if the last one didn't absorb the remainder instead.
+        let mut counts = KeyCounts::default();
+        for key in [
+            b"a" as &[u8],
+            b"b",
+            b"c",
+            b"d",
+            b"e",
+            b"f",
+            b"g",
+            b"h",
+            b"i",
+            b"j",
+        ] {
+            counts.insert_key(key);
+        }
+        let buckets = counts.buckets(3);
+        assert_eq!(
+            buckets,
+            vec![
+                Bucket {
+                    start: b"a".to_vec(),
+                    count: 3
+                },
+                Bucket {
+                    start: b"d".to_vec(),
+                    count: 3
+                },
+                Bucket {
+                    start: b"g".to_vec(),
+                    count: 4
+                },
+            ]
+        );
+        let total: u64 = buckets.iter().map(|b| b.count).sum();
+        assert_eq!(total, counts.total());
+    }
+
+    #[test]
+    fn buckets_range_contributes_at_its_begin() {
+        let mut counts = KeyCounts::default();
+        counts.insert_range(KeyRange {
+            begin: b"a".to_vec(),
+            end: b"z".to_vec(),
+        });
+        counts.insert_key(b"m");
+        let buckets = counts.buckets(2);
+        assert_eq!(
+            buckets,
+            vec![
+                Bucket {
+                    start: b"a".to_vec(),
+                    count: 1
+                },
+                Bucket {
+                    start: b"m".to_vec(),
+                    count: 1
+                },
+            ]
+        );
+    }
+}
diff --git a/bindings/rust/foundationdb-profiling/src/decode.rs b/bindings/rust/foundationdb-profiling/src/decode.rs
new file mode 100644
index 00000000000..3cd59a323e3
--- /dev/null
+++ b/bindings/rust/foundationdb-profiling/src/decode.rs
@@ -0,0 +1,943 @@
+//! Decoding of reassembled profiling blobs into typed [`Event`]s.
+//!
+//! A blob is what the C++ client writes with `BinaryWriter(IncludeVersion())` for one sampled
+//! transaction: a little-endian `u64` protocol version followed by events serialized back to
+//! back. Each event starts with its `EventType` as a little-endian `i32`, then the shared
+//! `Event` fields and the event-specific ones. Byte strings are a little-endian `u32` length
+//! followed by the bytes, `Optional<T>` is a presence byte followed by `T`, vectors are a
+//! little-endian `u32` count followed by the elements.
+//!
+//! Reference: `fdbclient/include/fdbclient/ClientLogEvents.h` and `CommitTransactionRef` /
+//! `MutationRef::serialize` in `fdbclient/include/fdbclient/CommitTransaction.h`.
+
+use crate::event::{
+    Commit, CommitError, CommitRequest, Event, EventHeader, Get, GetError, GetRange, GetRangeError,
+    GetVersion, KeyRange, Mutation, ProtocolVersion, SpanContext,
+};
+use tracing::instrument;
+
+/// Errors returned by [`decode_events`].
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+#[non_exhaustive]
+pub enum DecodeError {
+    /// The blob ended before a field could be read.
+    #[error("unexpected end of blob at offset {offset}: needed {needed} bytes, {remaining} left")]
+    UnexpectedEof {
+        /// Offset in the blob where the read started.
+        offset: usize,
+        /// Number of bytes the read needed.
+        needed: usize,
+        /// Number of bytes left in the blob.
+        remaining: usize,
+    },
+    /// The blob was written with a protocol version this crate does not decode.
+    #[error("unsupported protocol version {0:#018x}")]
+    UnsupportedProtocolVersion(u64),
+    /// An event carries a type code unknown to this crate.
+    #[error("unknown event type {0}")]
+    UnknownEventType(i32),
+    /// A conflict range uses the single-key encoding with a begin key not ending in `\x00`.
+    #[error("malformed key range at offset {offset}")]
+    MalformedKeyRange {
+        /// Offset in the blob where the key range starts.
+        offset: usize,
+    },
+    /// A mutation's checksum suffix could not be removed (`param2` shorter than the
+    /// checksum, and accumulative checksum index when present).
+    #[error("malformed mutation at offset {offset}")]
+    MalformedMutation {
+        /// Offset in the blob where the mutation starts.
+        offset: usize,
+    },
+}
+
+const EVENT_GET_VERSION: i32 = 0;
+const EVENT_GET: i32 = 1;
+const EVENT_GET_RANGE: i32 = 2;
+const EVENT_COMMIT: i32 = 3;
+const EVENT_ERROR_GET: i32 = 4;
+const EVENT_ERROR_GET_RANGE: i32 = 5;
+const EVENT_ERROR_COMMIT: i32 = 6;
+
+const CHECKSUM_FLAG_MASK: u8 = 0x80;
+const ACCUMULATIVE_CHECKSUM_INDEX_FLAG_MASK: u8 = 0x40;
+const CHECKSUM_LEN: usize = 4;
+const ACCUMULATIVE_CHECKSUM_INDEX_LEN: usize = 2;
+
+/// Minimum encoded size of a key range (two empty byte strings).
+const MIN_KEY_RANGE_LEN: usize = 8;
+/// Minimum encoded size of a mutation (type byte plus two empty byte strings).
+const MIN_MUTATION_LEN: usize = 9;
+
+/// Decodes one reassembled profiling blob (all chunks of one sampled transaction,
+/// concatenated) into its protocol version and events, in write order.
+///
+/// Only blobs written by 7.1 to 7.4 clients are supported. Never panics on malformed input,
+/// and allocations are bounded by the blob length.
+#[instrument(level = "trace", skip_all, fields(blob_len = blob.len()))]
+pub fn decode_events(blob: &[u8]) -> Result<(ProtocolVersion, Vec<Event>), DecodeError> {
+    let mut reader = Reader::new(blob);
+    let version = ProtocolVersion(reader.u64()?);
+    if !is_supported(version) {
+        return Err(DecodeError::UnsupportedProtocolVersion(version.0));
+    }
+    let mut events = Vec::new();
+    while !reader.is_empty() {
+        events.push(reader.event(version)?);
+    }
+    Ok((version, events))
+}
+
+fn is_supported(version: ProtocolVersion) -> bool {
+    matches!(
+        version,
+        ProtocolVersion::V7_1
+            | ProtocolVersion::V7_2
+            | ProtocolVersion::V7_3
+            | ProtocolVersion::V7_4
+    )
+}
+
+/// 7.2 switched the commit span context from `Optional<UID>` to `Optional<SpanContext>`
+/// (`hasOTELSpanContext`).
+fn has_otel_span_context(version: ProtocolVersion) -> bool {
+    version.0 >= ProtocolVersion::V7_2.0
+}
+
+struct Reader<'a> {
+    buf: &'a [u8],
+    pos: usize,
+}
+
+impl<'a> Reader<'a> {
+    fn new(buf: &'a [u8]) -> Self {
+        Reader { buf, pos: 0 }
+    }
+
+    fn remaining(&self) -> usize {
+        self.buf.len() - self.pos
+    }
+
+    fn is_empty(&self) -> bool {
+        self.remaining() == 0
+    }
+
+    fn take(&mut self, n: usize) -> Result<&'a [u8], DecodeError> {
+        match self.buf.get(self.pos..).and_then(|rest| rest.get(..n)) {
+            Some(bytes) => {
+                self.pos += n;
+                Ok(bytes)
+            }
+            None => Err(DecodeError::UnexpectedEof {
+                offset: self.pos,
+                needed: n,
+                remaining: self.remaining(),
+            }),
+        }
+    }
+
+    fn array<const N: usize>(&mut self) -> Result<[u8; N], DecodeError> {
+        let mut out = [0u8; N];
+        out.copy_from_slice(self.take(N)?);
+        Ok(out)
+    }
+
+    fn u8(&mut self) -> Result<u8, DecodeError> {
+        Ok(self.array::<1>()?[0])
+    }
+
+    fn bool(&mut self) -> Result<bool, DecodeError> {
+        Ok(self.u8()? != 0)
+    }
+
+    fn u32(&mut self) -> Result<u32, DecodeError> {
+        Ok(u32::from_le_bytes(self.array()?))
+    }
+
+    fn i32(&mut self) -> Result<i32, DecodeError> {
+        Ok(i32::from_le_bytes(self.array()?))
+    }
+
+    fn u64(&mut self) -> Result<u64, DecodeError> {
+        Ok(u64::from_le_bytes(self.array()?))
+    }
+
+    fn i64(&mut self) -> Result<i64, DecodeError> {
+        Ok(i64::from_le_bytes(self.array()?))
+    }
+
+    fn f64(&mut self) -> Result<f64, DecodeError> {
+        Ok(f64::from_le_bytes(self.array()?))
+    }
+
+    /// Length-prefixed byte string. The length is checked against the remaining bytes
+    /// before anything is allocated.
+    fn bytes(&mut self) -> Result<Vec<u8>, DecodeError> {
+        let len = self.u32()? as usize;
+        Ok(self.take(len)?.to_vec())
+    }
+
+    fn key_range(&mut self) -> Result<KeyRange, DecodeError> {
+        Ok(KeyRange {
+            begin: self.bytes()?,
+            end: self.bytes()?,
+        })
+    }
+
+    /// Count-prefixed vector. The initial capacity is capped by what the remaining bytes can
+    /// hold, so a garbage count cannot trigger a huge allocation.
+    fn vec<T>(
+        &mut self,
+        min_elem_len: usize,
+        mut elem: impl FnMut(&mut Self) -> Result<T, DecodeError>,
+    ) -> Result<Vec<T>, DecodeError> {
+        let count = self.u32()? as usize;
+        let mut out = Vec::with_capacity(count.min(self.remaining() / min_elem_len));
+        for _ in 0..count {
+            out.push(elem(self)?);
+        }
+        Ok(out)
+    }
+
+    fn header(&mut self) -> Result<EventHeader, DecodeError> {
+        let start_timestamp = self.f64()?;
+        let dc_id = self.bytes()?;
+        let tenant = if self.bool()? {
+            Some(self.bytes()?)
+        } else {
+            None
+        };
+        Ok(EventHeader {
+            start_timestamp,
+            dc_id,
+            tenant,
+        })
+    }
+
+    fn event(&mut self, version: ProtocolVersion) -> Result<Event, DecodeError> {
+        let event_type = self.i32()?;
+        if !(EVENT_GET_VERSION..=EVENT_ERROR_COMMIT).contains(&event_type) {
+            return Err(DecodeError::UnknownEventType(event_type));
+        }
+        let header = self.header()?;
+        let event = match event_type {
+            EVENT_GET_VERSION => Event::GetVersion(GetVersion {
+                header,
+                latency: self.f64()?,
+                priority: self.u32()?,
+                read_version: self.i64()?,
+            }),
+            EVENT_GET => Event::Get(Get {
+                header,
+                latency: self.f64()?,
+                value_size: self.i32()?,
+                key: self.bytes()?,
+            }),
+            EVENT_GET_RANGE => Event::GetRange(GetRange {
+                header,
+                latency: self.f64()?,
+                range_size: self.i32()?,
+                range: self.key_range()?,
+            }),
+            EVENT_COMMIT => Event::Commit(Commit {
+                header,
+                latency: self.f64()?,
+                num_mutations: self.i32()?,
+                commit_bytes: self.i32()?,
+                commit_version: self.i64()?,
+                request: self.commit_request(version)?,
+            }),
+            EVENT_ERROR_GET => Event::GetError(GetError {
+                header,
+                error_code: self.i32()?,
+                key: self.bytes()?,
+            }),
+            EVENT_ERROR_GET_RANGE => Event::GetRangeError(GetRangeError {
+                header,
+                error_code: self.i32()?,
+                range: self.key_range()?,
+            }),
+            EVENT_ERROR_COMMIT => Event::CommitError(CommitError {
+                header,
+                error_code: self.i32()?,
+                request: self.commit_request(version)?,
+            }),
+            other => return Err(DecodeError::UnknownEventType(other)),
+        };
+        Ok(event)
+    }
+
+    /// A serialized `KeyRangeRef`. Mirrors its deserializer: the single-key range
+    /// `[k, k\x00)` is written as `(k\x00, "")` and expanded back here.
+    fn conflict_range(&mut self) -> Result<KeyRange, DecodeError> {
+        let offset = self.pos;
+        let mut range = self.key_range()?;
+        if range.end.is_empty() && !range.begin.is_empty() {
+            if range.begin.last() != Some(&0) {
+                return Err(DecodeError::MalformedKeyRange { offset });
+            }
+            range.end = range.begin.clone();
+            range.begin.pop();
+        }
+        Ok(range)
+    }
+
+    fn commit_request(&mut self, version: ProtocolVersion) -> Result<CommitRequest, DecodeError> {
+        let read_conflict_ranges = self.vec(MIN_KEY_RANGE_LEN, Self::conflict_range)?;
+        let write_conflict_ranges = self.vec(MIN_KEY_RANGE_LEN, Self::conflict_range)?;
+        let mutations = self.vec(MIN_MUTATION_LEN, Self::mutation)?;
+        let read_snapshot = self.i64()?;
+        let report_conflicting_keys = self.bool()?;
+        let lock_aware = self.bool()?;
+        let span_context = if self.bool()? {
+            Some(self.span_context(version)?)
+        } else {
+            None
+        };
+        Ok(CommitRequest {
+            read_conflict_ranges,
+            write_conflict_ranges,
+            mutations,
+            read_snapshot,
+            report_conflicting_keys,
+            lock_aware,
+            span_context,
+        })
+    }
+
+    fn span_context(&mut self, version: ProtocolVersion) -> Result<SpanContext, DecodeError> {
+        let trace_id = [self.u64()?, self.u64()?];
+        if has_otel_span_context(version) {
+            Ok(SpanContext {
+                trace_id,
+                span_id: self.u64()?,
+                flags: self.u8()?,
+            })
+        } else {
+            Ok(SpanContext {
+                trace_id,
+                span_id: 0,
+                flags: 0,
+            })
+        }
+    }
+
+    /// Mirrors the deserializing branch of `MutationRef::serialize`.
+    fn mutation(&mut self) -> Result<Mutation, DecodeError> {
+        let offset = self.pos;
+        let mut mutation_type = self.u8()?;
+        let mut param1 = self.bytes()?;
+        let mut param2 = self.bytes()?;
+        let malformed = DecodeError::MalformedMutation { offset };
+
+        if mutation_type & CHECKSUM_FLAG_MASK != 0 {
+            let mut suffix = CHECKSUM_LEN;
+            if mutation_type & ACCUMULATIVE_CHECKSUM_INDEX_FLAG_MASK != 0 {
+                suffix += ACCUMULATIVE_CHECKSUM_INDEX_LEN;
+            }
+            let len = param2.len().checked_sub(suffix).ok_or(malformed)?;
+            param2.truncate(len);
+            mutation_type &= !(CHECKSUM_FLAG_MASK | ACCUMULATIVE_CHECKSUM_INDEX_FLAG_MASK);
+        }
+
+        // A single-key clear `[k, k\x00)` is written as `(ClearRange, k\x00, "")`. Like the
+        // C++ deserializer, a `param1` not ending in `\x00` is only traced as an error, not
+        // treated as fatal: the mutation is still expanded, dropping its last byte.
+        if mutation_type == Mutation::CLEAR_RANGE && param2.is_empty() && !param1.is_empty() {
+            if param1.last() != Some(&0) {
+                tracing::warn!(
+                    offset,
+                    param1 = ?param1,
+                    "single-key clear range mutation with param1 not ending in \\x00"
+                );
+            }
+            param2 = param1.clone();
+            param1.pop();
+        }
+
+        Ok(Mutation {
+            mutation_type,
+            param1,
+            param2,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const P: &[u8] = b"fdbrs_prof_fixture/";
+
+    fn key(suffix: &[u8]) -> Vec<u8> {
+        [P, suffix].concat()
+    }
+
+    /// Minimal writer following the C++ `BinaryWriter` layout, to build test blobs.
+    #[derive(Default)]
+    struct W(Vec<u8>);
+
+    impl W {
+        fn version(v: ProtocolVersion) -> Self {
+            let mut w = W::default();
+            w.u64(v.0);
+            w
+        }
+        fn u8(&mut self, v: u8) -> &mut Self {
+            self.0.push(v);
+            self
+        }
+        fn u32(&mut self, v: u32) -> &mut Self {
+            self.0.extend_from_slice(&v.to_le_bytes());
+            self
+        }
+        fn i32(&mut self, v: i32) -> &mut Self {
+            self.0.extend_from_slice(&v.to_le_bytes());
+            self
+        }
+        fn u64(&mut self, v: u64) -> &mut Self {
+            self.0.extend_from_slice(&v.to_le_bytes());
+            self
+        }
+        fn i64(&mut self, v: i64) -> &mut Self {
+            self.0.extend_from_slice(&v.to_le_bytes());
+            self
+        }
+        fn f64(&mut self, v: f64) -> &mut Self {
+            self.0.extend_from_slice(&v.to_le_bytes());
+            self
+        }
+        fn bytes(&mut self, v: &[u8]) -> &mut Self {
+            self.u32(v.len() as u32);
+            self.0.extend_from_slice(v);
+            self
+        }
+        fn header(
+            &mut self,
+            event_type: i32,
+            ts: f64,
+            dc: &[u8],
+            tenant: Option<&[u8]>,
+        ) -> &mut Self {
+            self.i32(event_type).f64(ts).bytes(dc);
+            match tenant {
+                Some(t) => self.u8(1).bytes(t),
+                None => self.u8(0),
+            }
+        }
+        /// Commit request body with one read range, one write range, one set mutation.
+        fn commit_request(&mut self, span: Option<&[u8]>) -> &mut Self {
+            self.u32(1).bytes(&key(b"r")).bytes(&key(b"s"));
+            self.u32(1).bytes(&key(b"w")).bytes(&key(b"x"));
+            self.u32(1).u8(0).bytes(&key(b"k")).bytes(b"v");
+            self.i64(42).u8(1).u8(0);
+            match span {
+                Some(s) => {
+                    self.u8(1);
+                    self.0.extend_from_slice(s);
+                    self
+                }
+                None => self.u8(0),
+            }
+        }
+    }
+
+    fn header(ts: f64) -> EventHeader {
+        EventHeader {
+            start_timestamp: ts,
+            dc_id: Vec::new(),
+            tenant: None,
+        }
+    }
+
+    fn expected_request(span_context: Option<SpanContext>) -> CommitRequest {
+        CommitRequest {
+            read_conflict_ranges: vec![KeyRange {
+                begin: key(b"r"),
+                end: key(b"s"),
+            }],
+            write_conflict_ranges: vec![KeyRange {
+                begin: key(b"w"),
+                end: key(b"x"),
+            }],
+            mutations: vec![Mutation {
+                mutation_type: 0,
+                param1: key(b"k"),
+                param2: b"v".to_vec(),
+            }],
+            read_snapshot: 42,
+            report_conflicting_keys: true,
+            lock_aware: false,
+            span_context,
+        }
+    }
+
+    /// One blob with every event type, in type order.
+    fn all_events_blob() -> Vec<u8> {
+        let mut w = W::version(ProtocolVersion::V7_4);
+        w.header(0, 1.0, b"dc1", Some(b"tenant"))
+            .f64(0.5)
+            .u32(2)
+            .i64(100);
+        w.header(1, 2.0, b"", None)
+            .f64(0.25)
+            .i32(7)
+            .bytes(&key(b"a"));
+        w.header(2, 3.0, b"", None)
+            .f64(0.125)
+            .i32(99)
+            .bytes(&key(b"a"))
+            .bytes(&key(b"z"));
+        w.header(3, 4.0, b"", None)
+            .f64(1.5)
+            .i32(1)
+            .i32(30)
+            .i64(200)
+            .commit_request(None);
+        w.header(4, 5.0, b"", None).i32(1007).bytes(&key(b"g"));
+        w.header(5, 6.0, b"", None)
+            .i32(1009)
+            .bytes(&key(b"b"))
+            .bytes(&key(b"e"));
+        w.header(6, 7.0, b"", None).i32(1020).commit_request(None);
+        w.0
+    }
+
+    #[test]
+    fn decodes_every_event_type() {
+        let (version, events) = decode_events(&all_events_blob()).unwrap();
+        assert_eq!(version, ProtocolVersion::V7_4);
+        assert_eq!(
+            events,
+            vec![
+                Event::GetVersion(GetVersion {
+                    header: EventHeader {
+                        start_timestamp: 1.0,
+                        dc_id: b"dc1".to_vec(),
+                        tenant: Some(b"tenant".to_vec()),
+                    },
+                    latency: 0.5,
+                    priority: 2,
+                    read_version: 100,
+                }),
+                Event::Get(Get {
+                    header: header(2.0),
+                    latency: 0.25,
+                    value_size: 7,
+                    key: key(b"a"),
+                }),
+                Event::GetRange(GetRange {
+                    header: header(3.0),
+                    latency: 0.125,
+                    range_size: 99,
+                    range: KeyRange {
+                        begin: key(b"a"),
+                        end: key(b"z"),
+                    },
+                }),
+                Event::Commit(Commit {
+                    header: header(4.0),
+                    latency: 1.5,
+                    num_mutations: 1,
+                    commit_bytes: 30,
+                    commit_version: 200,
+                    request: expected_request(None),
+                }),
+                Event::GetError(GetError {
+                    header: header(5.0),
+                    error_code: 1007,
+                    key: key(b"g"),
+                }),
+                Event::GetRangeError(GetRangeError {
+                    header: header(6.0),
+                    error_code: 1009,
+                    range: KeyRange {
+                        begin: key(b"b"),
+                        end: key(b"e"),
+                    },
+                }),
+                Event::CommitError(CommitError {
+                    header: header(7.0),
+                    error_code: 1020,
+                    request: expected_request(None),
+                }),
+            ]
+        );
+        assert_eq!(events[3].header().start_timestamp, 4.0);
+    }
+
+    #[test]
+    fn span_context_is_uid_in_7_1_and_otel_from_7_2() {
+        let mut uid = Vec::new();
+        uid.extend_from_slice(&1u64.to_le_bytes());
+        uid.extend_from_slice(&2u64.to_le_bytes());
+        let mut otel = uid.clone();
+        otel.extend_from_slice(&3u64.to_le_bytes());
+        otel.push(1);
+
+        let cases = [
+            (ProtocolVersion::V7_1, &uid, 0, 0),
+            (ProtocolVersion::V7_2, &otel, 3, 1),
+            (ProtocolVersion::V7_3, &otel, 3, 1),
+            (ProtocolVersion::V7_4, &otel, 3, 1),
+        ];
+        for (version, span, span_id, flags) in cases {
+            let mut w = W::version(version);
+            w.header(6, 1.0, b"", None)
+                .i32(1020)
+                .commit_request(Some(span));
+            let (_, events) = decode_events(&w.0).unwrap();
+            let expected = Some(SpanContext {
+                trace_id: [1, 2],
+                span_id,
+                flags,
+            });
+            assert_eq!(
+                events,
+                vec![Event::CommitError(CommitError {
+                    header: header(1.0),
+                    error_code: 1020,
+                    request: expected_request(expected),
+                })],
+                "{version:?}"
+            );
+        }
+    }
+
+    /// Commit event whose request carries the given raw conflict range and mutation bytes.
+    fn commit_with(range: &[u8], mutation: &[u8]) -> Vec<u8> {
+        let mut w = W::version(ProtocolVersion::V7_4);
+        w.header(3, 1.0, b"", None).f64(0.0).i32(1).i32(1).i64(1);
+        w.u32(0).u32(1);
+        w.0.extend_from_slice(range);
+        w.u32(1);
+        w.0.extend_from_slice(mutation);
+        w.i64(0).u8(0).u8(0).u8(0);
+        w.0
+    }
+
+    fn commit_request_of(blob: &[u8]) -> Result<CommitRequest, DecodeError> {
+        match decode_events(blob)?.1.pop() {
+            Some(Event::Commit(c)) => Ok(c.request),
+            other => panic!("unexpected {other:?}"),
+        }
+    }
+
+    fn range_bytes(begin: &[u8], end: &[u8]) -> Vec<u8> {
+        let mut w = W::default();
+        w.bytes(begin).bytes(end);
+        w.0
+    }
+
+    fn mutation_bytes(t: u8, p1: &[u8], p2: &[u8]) -> Vec<u8> {
+        let mut w = W::default();
+        w.u8(t).bytes(p1).bytes(p2);
+        w.0
+    }
+
+    #[test]
+    fn expands_single_key_encodings() {
+        let k0 = key(b"k\x00");
+        let req = commit_request_of(&commit_with(
+            &range_bytes(&k0, b""),
+            &mutation_bytes(1, &k0, b""),
+        ))
+        .unwrap();
+        let single = KeyRange {
+            begin: key(b"k"),
+            end: k0.clone(),
+        };
+        assert_eq!(req.write_conflict_ranges, vec![single]);
+        assert_eq!(
+            req.mutations,
+            vec![Mutation {
+                mutation_type: 1,
+                param1: key(b"k"),
+                param2: k0,
+            }]
+        );
+    }
+
+    #[test]
+    fn strips_mutation_checksums() {
+        let range = range_bytes(b"a", b"b");
+        let expected = Mutation {
+            mutation_type: 0,
+            param1: key(b"k"),
+            param2: b"value".to_vec(),
+        };
+        // checksum only
+        let m = mutation_bytes(0x80, &key(b"k"), b"value\x01\x02\x03\x04");
+        let req = commit_request_of(&commit_with(&range, &m)).unwrap();
+        assert_eq!(req.mutations, vec![expected.clone()]);
+        // checksum + accumulative checksum index
+        let m = mutation_bytes(0xC0, &key(b"k"), b"value\x01\x02\x03\x04\x05\x06");
+        let req = commit_request_of(&commit_with(&range, &m)).unwrap();
+        assert_eq!(req.mutations, vec![expected]);
+        // single-key clear with checksum: param2 is empty plus the checksum
+        let k0 = key(b"k\x00");
+        let m = mutation_bytes(0x81, &k0, b"\x01\x02\x03\x04");
+        let req = commit_request_of(&commit_with(&range, &m)).unwrap();
+        assert_eq!(
+            req.mutations,
+            vec![Mutation {
+                mutation_type: 1,
+                param1: key(b"k"),
+                param2: k0,
+            }]
+        );
+    }
+
+    #[test]
+    fn rejects_malformed_ranges_and_mutations() {
+        let good_range = range_bytes(b"a", b"b");
+        let err = commit_request_of(&commit_with(
+            &range_bytes(b"k", b""),
+            &mutation_bytes(0, b"k", b"v"),
+        ));
+        assert!(matches!(err, Err(DecodeError::MalformedKeyRange { .. })));
+        let err = commit_request_of(&commit_with(
+            &good_range,
+            &mutation_bytes(0x80, b"k", b"abc"),
+        ));
+        assert!(matches!(err, Err(DecodeError::MalformedMutation { .. })));
+        let err = commit_request_of(&commit_with(
+            &good_range,
+            &mutation_bytes(0xC0, b"k", b"abcde"),
+        ));
+        assert!(matches!(err, Err(DecodeError::MalformedMutation { .. })));
+    }
+
+    /// Mirrors `MutationRef::serialize`: a single-key clear whose `param1` does not end in
+    /// `\x00` is only traced as an error server-side, not treated as fatal. The mutation is
+    /// still expanded, same as a well-formed single-key clear.
+    #[test]
+    fn expands_single_key_clear_with_bad_param1_instead_of_erroring() {
+        let good_range = range_bytes(b"a", b"b");
+        let req =
+            commit_request_of(&commit_with(&good_range, &mutation_bytes(1, b"k", b""))).unwrap();
+        assert_eq!(
+            req.mutations,
+            vec![Mutation {
+                mutation_type: 1,
+                param1: Vec::new(),
+                param2: b"k".to_vec(),
+            }]
+        );
+    }
+
+    #[test]
+    fn rejects_unsupported_versions_and_unknown_events() {
+        for v in [
+            0x0FDB_00B0_6301_0001u64, // 6.3
+            0x0FDB_00B0_7001_0001,    // 7.0
+            0x0FDB_00B0_7500_0000,    // unknown future
+            0,
+        ] {
+            assert_eq!(
+                decode_events(&v.to_le_bytes()),
+                Err(DecodeError::UnsupportedProtocolVersion(v))
+            );
+        }
+        let mut w = W::version(ProtocolVersion::V7_4);
+        w.i32(7);
+        assert_eq!(decode_events(&w.0), Err(DecodeError::UnknownEventType(7)));
+        let mut w = W::version(ProtocolVersion::V7_4);
+        w.i32(-1);
+        assert_eq!(decode_events(&w.0), Err(DecodeError::UnknownEventType(-1)));
+    }
+
+    #[test]
+    fn empty_event_list_is_ok() {
+        let blob = ProtocolVersion::V7_1.0.to_le_bytes();
+        assert_eq!(
+            decode_events(&blob),
+            Ok((ProtocolVersion::V7_1, Vec::new()))
+        );
+    }
+
+    #[test]
+    fn every_truncation_errors_without_panic() {
+        let blob = all_events_blob();
+        let (_, full) = decode_events(&blob).unwrap();
+        for len in 0..blob.len() {
+            match decode_events(&blob[..len]) {
+                Ok((_, events)) => assert!(events.len() < full.len(), "len {len}"),
+                Err(DecodeError::UnexpectedEof {
+                    offset,
+                    needed,
+                    remaining,
+                }) => {
+                    assert!(offset <= len && remaining < needed, "len {len}");
+                }
+                Err(e) => panic!("len {len}: unexpected {e:?}"),
+            }
+        }
+    }
+
+    #[test]
+    fn huge_lengths_and_counts_do_not_allocate() {
+        // a key length of u32::MAX
+        let mut w = W::version(ProtocolVersion::V7_4);
+        w.header(1, 1.0, b"", None).f64(0.0).i32(0).u32(u32::MAX);
+        assert!(matches!(
+            decode_events(&w.0),
+            Err(DecodeError::UnexpectedEof { needed, .. }) if needed == u32::MAX as usize
+        ));
+        // conflict range and mutation counts of u32::MAX
+        for prefix_vectors in 0..3 {
+            let mut w = W::version(ProtocolVersion::V7_4);
+            w.header(6, 1.0, b"", None).i32(1020);
+            for _ in 0..prefix_vectors {
+                w.u32(0);
+            }
+            w.u32(u32::MAX).bytes(b"a").bytes(b"b");
+            assert!(matches!(
+                decode_events(&w.0),
+                Err(DecodeError::UnexpectedEof { .. })
+            ));
+        }
+    }
+
+    #[test]
+    fn random_garbage_never_panics() {
+        // xorshift64, deterministic
+        let mut state = 0x9E37_79B9_7F4A_7C15u64;
+        let mut next = move || {
+            state ^= state << 13;
+            state ^= state >> 7;
+            state ^= state << 17;
+            state
+        };
+        let valid = all_events_blob();
+        for i in 0..20_000 {
+            let blob = if i % 2 == 0 {
+                // pure garbage after a valid version
+                let mut blob = ProtocolVersion::V7_4.0.to_le_bytes().to_vec();
+                let len = (next() % 256) as usize;
+                blob.extend((0..len).map(|_| next() as u8));
+                blob
+            } else {
+                // a valid blob with a few corrupted bytes
+                let mut blob = valid.clone();
+                for _ in 0..(1 + next() % 4) {
+                    let pos = 8 + (next() as usize) % (blob.len() - 8);
+                    blob[pos] = next() as u8;
+                }
+                blob
+            };
+            let _ = decode_events(&blob);
+        }
+    }
+
+    const COMMIT_FIXTURE: &[u8] = include_bytes!("../tests/fixtures/commit_7_4.bin");
+    const COMMIT_ERROR_FIXTURE: &[u8] = include_bytes!("../tests/fixtures/commit_error_7_4.bin");
+
+    /// Captured from a 7.4.6 cluster: get, get_range, then set/clear/clear_range/atomic add
+    /// in one committed transaction.
+    #[test]
+    fn decodes_real_commit_fixture() {
+        let (version, events) = decode_events(COMMIT_FIXTURE).unwrap();
+        assert_eq!(version, ProtocolVersion::V7_4);
+        assert_eq!(events.len(), 4);
+        for e in &events {
+            assert!(e.header().dc_id.is_empty());
+            assert_eq!(e.header().tenant, None);
+            assert!(e.header().start_timestamp > 1.7e9);
+        }
+        let Event::GetVersion(grv) = &events[0] else {
+            panic!("{:?}", events[0])
+        };
+        assert_eq!((grv.priority, grv.read_version), (0, 228403251085));
+        let Event::Get(get) = &events[1] else {
+            panic!("{:?}", events[1])
+        };
+        assert_eq!(
+            (get.key.as_slice(), get.value_size),
+            (key(b"a").as_slice(), 0)
+        );
+        let Event::GetRange(range) = &events[2] else {
+            panic!("{:?}", events[2])
+        };
+        assert_eq!(
+            range.range,
+            KeyRange {
+                begin: key(b"a\x00"),
+                end: key(b"z"),
+            }
+        );
+        let Event::Commit(commit) = &events[3] else {
+            panic!("{:?}", events[3])
+        };
+        assert_eq!(commit.num_mutations, 5);
+        assert_eq!(commit.commit_bytes, 415);
+        assert_eq!(commit.commit_version, 228403870263);
+        let req = &commit.request;
+        assert_eq!(req.read_snapshot, 228403251085);
+        assert!(!req.report_conflicting_keys && !req.lock_aware);
+        assert_eq!(req.span_context, None);
+        let r = |b: &[u8], e: &[u8]| KeyRange {
+            begin: key(b),
+            end: key(e),
+        };
+        assert_eq!(req.read_conflict_ranges, vec![r(b"a", b"z")]);
+        assert_eq!(
+            req.write_conflict_ranges,
+            vec![r(b"a", b"a\x00"), r(b"b", b"b\x00"), r(b"c", b"d")]
+        );
+        let m = |t: u8, p1: Vec<u8>, p2: Vec<u8>| Mutation {
+            mutation_type: t,
+            param1: p1,
+            param2: p2,
+        };
+        assert_eq!(
+            req.mutations,
+            vec![
+                m(1, key(b"b"), key(b"b\x00")),
+                m(1, key(b"c"), key(b"counter")),
+                m(1, key(b"counter\x00"), key(b"d")),
+                m(0, key(b"a"), b"value-a".to_vec()),
+                // the add on a key cleared in the same transaction is folded into a set
+                m(0, key(b"counter"), 1i64.to_le_bytes().to_vec()),
+            ]
+        );
+    }
+
+    /// Captured from a 7.4.6 cluster: a transaction that read a key another transaction
+    /// then wrote, failing its commit with `not_committed`.
+    #[test]
+    fn decodes_real_commit_error_fixture() {
+        let (version, events) = decode_events(COMMIT_ERROR_FIXTURE).unwrap();
+        assert_eq!(version, ProtocolVersion::V7_4);
+        assert_eq!(events.len(), 3);
+        assert!(matches!(events[0], Event::GetVersion(_)));
+        let Event::Get(get) = &events[1] else {
+            panic!("{:?}", events[1])
+        };
+        assert_eq!(get.key, key(b"conflict"));
+        let Event::CommitError(err) = &events[2] else {
+            panic!("{:?}", events[2])
+        };
+        assert_eq!(err.error_code, 1020);
+        let req = &err.request;
+        assert_eq!(
+            req.read_conflict_ranges[0],
+            KeyRange {
+                begin: key(b"conflict"),
+                end: key(b"conflict\x00"),
+            }
+        );
+        assert!(req.write_conflict_ranges.contains(&KeyRange {
+            begin: key(b"other"),
+            end: key(b"other\x00"),
+        }));
+        assert_eq!(
+            req.mutations,
+            vec![Mutation {
+                mutation_type: 0,
+                param1: key(b"other"),
+                param2: b"y".to_vec(),
+            }]
+        );
+    }
+}
diff --git a/bindings/rust/foundationdb-profiling/src/event.rs b/bindings/rust/foundationdb-profiling/src/event.rs
new file mode 100644
index 00000000000..898e9a610c0
--- /dev/null
+++ b/bindings/rust/foundationdb-profiling/src/event.rs
@@ -0,0 +1,258 @@
+//! Typed client profiling events.
+//!
+//! These types mirror the `FdbClientLogEvents` structures written by the FoundationDB
+//! C++ client (`fdbclient/include/fdbclient/ClientLogEvents.h`) for protocol versions
+//! 7.1 and later. They are produced by [`crate::decode_events`].
+
+/// FoundationDB protocol version stored at the start of every profiling blob.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct ProtocolVersion(pub u64);
+
+impl ProtocolVersion {
+    /// Protocol version written by 7.1 clients.
+    pub const V7_1: ProtocolVersion = ProtocolVersion(0x0FDB_00B0_7101_0000);
+    /// Protocol version written by 7.2 clients.
+    pub const V7_2: ProtocolVersion = ProtocolVersion(0x0FDB_00B0_7200_0000);
+    /// Protocol version written by 7.3 clients.
+    pub const V7_3: ProtocolVersion = ProtocolVersion(0x0FDB_00B0_7300_0000);
+    /// Protocol version written by 7.4 clients.
+    pub const V7_4: ProtocolVersion = ProtocolVersion(0x0FDB_00B0_7400_0000);
+}
+
+/// A key range `[begin, end)`.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct KeyRange {
+    /// Inclusive start key.
+    pub begin: Vec<u8>,
+    /// Exclusive end key.
+    pub end: Vec<u8>,
+}
+
+/// Fields shared by every event (`FdbClientLogEvents::Event`).
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct EventHeader {
+    /// Client-side start time of the operation, in seconds since the unix epoch.
+    pub start_timestamp: f64,
+    /// Datacenter id of the client, empty when unset.
+    pub dc_id: Vec<u8>,
+    /// Tenant name, when the operation ran in a tenant.
+    pub tenant: Option<Vec<u8>>,
+}
+
+/// One profiling event of a sampled transaction.
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub enum Event {
+    /// Read version acquisition (`GET_VERSION_LATENCY`).
+    GetVersion(GetVersion),
+    /// Point read (`GET_LATENCY`).
+    Get(Get),
+    /// Range read (`GET_RANGE_LATENCY`).
+    GetRange(GetRange),
+    /// Successful commit (`COMMIT_LATENCY`).
+    Commit(Commit),
+    /// Failed point read (`ERROR_GET`).
+    GetError(GetError),
+    /// Failed range read (`ERROR_GET_RANGE`).
+    GetRangeError(GetRangeError),
+    /// Failed commit (`ERROR_COMMIT`).
+    CommitError(CommitError),
+}
+
+impl Event {
+    /// Returns the header shared by all event kinds.
+    #[tracing::instrument(level = "trace", skip_all)]
+    pub fn header(&self) -> &EventHeader {
+        match self {
+            Event::GetVersion(e) => &e.header,
+            Event::Get(e) => &e.header,
+            Event::GetRange(e) => &e.header,
+            Event::Commit(e) => &e.header,
+            Event::GetError(e) => &e.header,
+            Event::GetRangeError(e) => &e.header,
+            Event::CommitError(e) => &e.header,
+        }
+    }
+}
+
+/// Read version acquisition (`EventGetVersion_V3`).
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct GetVersion {
+    /// Common event fields.
+    pub header: EventHeader,
+    /// Latency in seconds.
+    pub latency: f64,
+    /// `TransactionPriorityType`: 0 default, 1 batch, 2 immediate.
+    pub priority: u32,
+    /// The read version obtained.
+    pub read_version: i64,
+}
+
+/// Point read (`EventGet`).
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct Get {
+    /// Common event fields.
+    pub header: EventHeader,
+    /// Latency in seconds.
+    pub latency: f64,
+    /// Size in bytes of the returned value.
+    pub value_size: i32,
+    /// The key read.
+    pub key: Vec<u8>,
+}
+
+/// Range read (`EventGetRange`).
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct GetRange {
+    /// Common event fields.
+    pub header: EventHeader,
+    /// Latency in seconds.
+    pub latency: f64,
+    /// Size in bytes of the returned key-values.
+    pub range_size: i32,
+    /// The range read.
+    pub range: KeyRange,
+}
+
+/// Successful commit (`EventCommit_V2`).
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct Commit {
+    /// Common event fields.
+    pub header: EventHeader,
+    /// Latency in seconds.
+    pub latency: f64,
+    /// Number of mutations.
+    pub num_mutations: i32,
+    /// Size in bytes of the commit.
+    pub commit_bytes: i32,
+    /// Version at which the transaction committed.
+    pub commit_version: i64,
+    /// The commit request sent to the proxies.
+    pub request: CommitRequest,
+}
+
+/// Failed point read (`EventGetError`).
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct GetError {
+    /// Common event fields.
+    pub header: EventHeader,
+    /// FoundationDB error code.
+    pub error_code: i32,
+    /// The key read.
+    pub key: Vec<u8>,
+}
+
+/// Failed range read (`EventGetRangeError`).
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct GetRangeError {
+    /// Common event fields.
+    pub header: EventHeader,
+    /// FoundationDB error code.
+    pub error_code: i32,
+    /// The range read.
+    pub range: KeyRange,
+}
+
+/// Failed commit (`EventCommitError`).
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct CommitError {
+    /// Common event fields.
+    pub header: EventHeader,
+    /// FoundationDB error code (e.g. 1020 `not_committed` on conflict).
+    pub error_code: i32,
+    /// The commit request sent to the proxies.
+    pub request: CommitRequest,
+}
+
+/// The serialized part of a `CommitTransactionRequest` (its `CommitTransactionRef`).
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct CommitRequest {
+    /// Read conflict ranges.
+    pub read_conflict_ranges: Vec<KeyRange>,
+    /// Write conflict ranges.
+    pub write_conflict_ranges: Vec<KeyRange>,
+    /// Mutations, in commit order.
+    pub mutations: Vec<Mutation>,
+    /// Read version the transaction used for conflict detection.
+    pub read_snapshot: i64,
+    /// Whether the client asked for conflicting keys to be reported.
+    pub report_conflicting_keys: bool,
+    /// Whether the transaction was lock aware.
+    pub lock_aware: bool,
+    /// Tracing span context attached to the commit, if any.
+    pub span_context: Option<SpanContext>,
+}
+
+/// A mutation (`MutationRef`), normalized like the C++ deserializer does.
+///
+/// The optional mutation checksum and accumulative checksum index (7.4+, only when the
+/// client enables them) are stripped from `param2` and their flag bits cleared from
+/// `mutation_type`. A single-key clear, which the wire encodes compactly, is expanded back
+/// to `ClearRange(key, key + \x00)`.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct Mutation {
+    /// `MutationRef::Type` code (0 SetValue, 1 ClearRange, 2 AddValue, ...).
+    pub mutation_type: u8,
+    /// Key, or range begin for ClearRange.
+    pub param1: Vec<u8>,
+    /// Value/operand, or range end for ClearRange.
+    pub param2: Vec<u8>,
+}
+
+impl Mutation {
+    /// `MutationRef::Type::SetValue`.
+    pub const SET_VALUE: u8 = 0;
+    /// `MutationRef::Type::ClearRange`.
+    pub const CLEAR_RANGE: u8 = 1;
+    /// `MutationRef::Type::AddValue`.
+    pub const ADD_VALUE: u8 = 2;
+    /// `MutationRef::Type::And`.
+    pub const AND: u8 = 6;
+    /// `MutationRef::Type::Or`.
+    pub const OR: u8 = 7;
+    /// `MutationRef::Type::Xor`.
+    pub const XOR: u8 = 8;
+    /// `MutationRef::Type::AppendIfFits`.
+    pub const APPEND_IF_FITS: u8 = 9;
+    /// `MutationRef::Type::Max`.
+    pub const MAX: u8 = 12;
+    /// `MutationRef::Type::Min`.
+    pub const MIN: u8 = 13;
+    /// `MutationRef::Type::SetVersionstampedKey`.
+    pub const SET_VERSIONSTAMPED_KEY: u8 = 14;
+    /// `MutationRef::Type::SetVersionstampedValue`.
+    pub const SET_VERSIONSTAMPED_VALUE: u8 = 15;
+    /// `MutationRef::Type::ByteMin`.
+    pub const BYTE_MIN: u8 = 16;
+    /// `MutationRef::Type::ByteMax`.
+    pub const BYTE_MAX: u8 = 17;
+    /// `MutationRef::Type::MinV2`.
+    pub const MIN_V2: u8 = 18;
+    /// `MutationRef::Type::AndV2`.
+    pub const AND_V2: u8 = 19;
+    /// `MutationRef::Type::CompareAndClear`.
+    pub const COMPARE_AND_CLEAR: u8 = 20;
+}
+
+/// Tracing span context attached to a commit (`SpanContext`).
+///
+/// Protocol 7.1 only carries a 16 byte trace id (`Optional<UID>`): `span_id` and `flags`
+/// are then 0, as in the C++ deserializer. 7.2+ carries all three fields.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct SpanContext {
+    /// Trace id, as the two 64-bit halves of a `UID` (`first`, `second`).
+    pub trace_id: [u64; 2],
+    /// Span id.
+    pub span_id: u64,
+    /// `TraceFlags` (bit 0: sampled).
+    pub flags: u8,
+}
diff --git a/bindings/rust/foundationdb-profiling/src/lib.rs b/bindings/rust/foundationdb-profiling/src/lib.rs
new file mode 100644
index 00000000000..6a0fe80ce7d
--- /dev/null
+++ b/bindings/rust/foundationdb-profiling/src/lib.rs
@@ -0,0 +1,159 @@
+//! Read FoundationDB client transaction profiling data.
+//!
+//! When client profiling is enabled (`fdbcli> profile client set <rate> <size limit>`),
+//! every FoundationDB client samples transactions at the given rate and records their
+//! operations (read version, gets, range reads, commits and their errors). Every
+//! `CSI_STATUS_DELAY` (10 seconds by default) the client flushes the recorded
+//! transactions into the system keyspace under [`PROFILE_PREFIX`]
+//! (`\xff\x02/fdbClientInfo/client_latency/`), split in chunks keyed by versionstamp and
+//! transaction id. See the [transaction profiler documentation].
+//!
+//! This crate turns that keyspace into typed [`Event`]s. It does no I/O and depends on no
+//! version of the FoundationDB bindings: the application reads the rows with its own
+//! client, in its own transaction and retry loop, and hands them to
+//! [`ProfileScanner::read_page`], which reassembles and decodes the chunks of one page,
+//! decides where the page stops, and returns a resumable [`Cursor`]. Only records
+//! written by 7.1+ clients are decoded (see [`decode_events`]).
+//!
+//! # Example
+//!
+//! With the `foundationdb` crate:
+//!
+//! ```no_run
+//! use foundationdb::options::TransactionOption;
+//! use foundationdb::{ClientBudget, Database, FdbBindingError, KeySelector, RangeOption};
+//! use foundationdb_profiling::{Cursor, Page, ProfileScanner};
+//! use futures_util::TryStreamExt;
+//! use std::time::Duration;
+//!
+//! # async fn example(db: &Database) -> Result<(), FdbBindingError> {
+//! let scanner = ProfileScanner::new();
+//! let cursor = Cursor::beginning();
+//! let page: Page = db
+//!     .run(|trx, _| {
+//!         let scanner = scanner.clone();
+//!         let cursor = cursor.clone();
+//!         async move {
+//!             // Options are the caller's job: this crate never sets any.
+//!             trx.set_option(TransactionOption::ReadSystemKeys)?;
+//!             // Bound every page, well under the 5 second transaction lifetime.
+//!             trx.set_client_budget(ClientBudget {
+//!                 time_limit: Some(Duration::from_secs(2)),
+//!                 ..ClientBudget::default()
+//!             });
+//!             let range = scanner.range(&cursor);
+//!             let opt = RangeOption::from((
+//!                 KeySelector::first_greater_or_equal(range.begin.as_slice()),
+//!                 KeySelector::first_greater_or_equal(range.end.as_slice()),
+//!             ));
+//!             let rows = trx
+//!                 .get_ranges_keyvalues(opt, true)
+//!                 .map_ok(|kv| (kv.key().to_vec(), kv.value().to_vec()));
+//!             let page = scanner
+//!                 .read_page(&cursor, rows, || trx.check_client_budget().is_err())
+//!                 .await
+//!                 // FoundationDB errors go back to the retry loop, other errors are
+//!                 // boxed as a custom error.
+//!                 .map_err(|err| err.into_error(FdbBindingError::new_custom_error))?;
+//!             Ok::<_, FdbBindingError>(page)
+//!         }
+//!     })
+//!     .await?;
+//! for tx in &page.transactions {
+//!     println!("{} {:?}: {} events", tx.version, tx.id, tx.events.len());
+//! }
+//! // Persist `page.next.as_bytes()` to resume from there later.
+//! # Ok(())
+//! # }
+//! ```
+//!
+//! See `examples/top_keys.rs` for a runnable end-to-end example that pages through the
+//! whole keyspace and prints the hottest keys, ranges and write hot spots.
+//!
+//! # The caller's contract
+//!
+//! For each page, the caller reads exactly [`ProfileScanner::range`] of the page's
+//! cursor: forward, with snapshot reads and no row limit, both ends as
+//! `first_greater_or_equal` key selectors, and gives [`ProfileScanner::read_page`] the
+//! rows as a [`Stream`](futures_core::Stream) of `Result<(key, value), E>`. A row
+//! outside that range or out of key order fails the page with
+//! [`ScanError::InvalidRows`], and a stream error comes back as [`ScanError::Source`] so
+//! the caller can hand it to its retry loop.
+//!
+//! On that transaction:
+//!
+//! - `TransactionOption::ReadSystemKeys` (or its equivalent) is required, the data lives
+//!   in the system keyspace.
+//! - `TransactionOption::ReadLockAware` is required if the cluster may be locked (for
+//!   instance a DR secondary).
+//!
+//! # Bounding a page: the stop check
+//!
+//! The `should_stop` closure given to [`ProfileScanner::read_page`] is required, and is
+//! the only place where the caller bounds a page: a transaction budget as above, a row
+//! count, anything. [`ProfileScanner::read_page`] calls it after every row and stops as
+//! soon as it returns `true`; otherwise the page reads to the end of its range. Without
+//! a real bound, a large range can outlive the transaction and hit
+//! `transaction_too_old`. Base the check on a caller-pluggable clock rather than the
+//! wall clock when the code must be reproducible, for instance under simulation.
+//!
+//! # Paging and tailing
+//!
+//! [`Page::next`] is always a valid place to resume from, and [`Page::exhausted`] tells
+//! whether the page reached the end of its range (`false` when the stop check stopped
+//! it). To read a range in several transactions, loop on [`ProfileScanner::read_page`]
+//! with `cursor = page.next` until [`Page::exhausted`]: every transaction is returned
+//! once over the sequence of pages, even when the client wrote its chunks in two commits
+//! with other records in between, and even when a page stops between them: the next
+//! page resumes at the first chunk of the oldest incomplete record. A record is lost
+//! (reported as [`SkipReason::BrokenChunks`]) only when the stop check does not let a
+//! single page read from its cursor to the end of the records that overlap it (in
+//! practice, a single record cannot be read from the cursor before the caller says
+//! stop): the records still incomplete at that stop are broken, and the page still
+//! advances.
+//!
+//! To tail the keyspace, persist `page.next` ([`Cursor::as_bytes`] /
+//! [`Cursor::from_bytes`]) and keep polling from it: an exhausted page's cursor picks up
+//! the records flushed after it, including the second half of a record split across two
+//! commits. [`Cursor::at_version`] starts at a commit version, and
+//! [`ProfileScanner::end_version`] bounds a page by one. A transaction whose chunks
+//! straddle `end_version` is not returned by that bounded read, the cursor stays on its
+//! first chunk.
+//!
+//! Note that the version of a record is the one at which the client flushed it, some time
+//! after the profiled transaction ran.
+//!
+//! # When profiling data is flushed
+//!
+//! The C++ client records a sampled transaction's events when its native transaction is
+//! destroyed. With the `foundationdb` Rust bindings, that happens when the `Transaction`
+//! (or the `RetryableTransaction` of a `Database::run` closure) is dropped. In particular a
+//! `TransactionCommitError` owns the transaction and keeps it alive until the error is
+//! dropped (or recovered with `on_error`), so holding on to such errors delays the
+//! profiling data of the failed transaction. The data then reaches the keyspace at the
+//! client's next flush, up to `CSI_STATUS_DELAY` later.
+//!
+//! # Aggregation
+//!
+//! [`Aggregator`] counts the keys and ranges read and written by the transactions of one
+//! or more pages, like the Python `transaction_profiling_analyzer`.
+//!
+//! [transaction profiler documentation]: https://apple.github.io/foundationdb/transaction-profiler-analyzer.html
+
+#![warn(missing_docs)]
+
+mod aggregate;
+mod decode;
+mod event;
+mod reader;
+
+pub use aggregate::{Aggregator, Bucket, KeyCounts};
+pub use decode::{DecodeError, decode_events};
+pub use event::{
+    Commit, CommitError, CommitRequest, Event, EventHeader, Get, GetError, GetRange, GetRangeError,
+    GetVersion, KeyRange, Mutation, ProtocolVersion, SpanContext,
+};
+pub use reader::{
+    Cursor, InvalidCursor, PROFILE_PREFIX, Page, ProfileScanner, ProfiledTransaction, ScanError,
+    ScanRange, SkipReason, Skipped,
+};
diff --git a/bindings/rust/foundationdb-profiling/src/reader.rs b/bindings/rust/foundationdb-profiling/src/reader.rs
new file mode 100644
index 00000000000..ca4d4d15d77
--- /dev/null
+++ b/bindings/rust/foundationdb-profiling/src/reader.rs
@@ -0,0 +1,1664 @@
+//! Paged, resumable reading of the client profiling keyspace.
+//!
+//! Every sampled transaction is stored as one or more chunks under
+//! `\xff\x02/fdbClientInfo/client_latency/`. A chunk key is laid out as:
+//!
+//! ```text
+//! PREFIX | versionstamp (10) | '/' | transaction id (16) | '/' | chunk (4, BE) | total (4, BE) | '/' | user id ...
+//! ```
+//!
+//! [`ProfileScanner::read_page`] consumes the rows of [`ProfileScanner::range`], read by
+//! the caller, reassembles the chunks of each transaction, decodes them with
+//! [`decode_events`] and returns a [`Page`] with a [`Cursor`] to resume from.
+
+use crate::decode::{DecodeError, decode_events};
+use crate::event::{Event, ProtocolVersion};
+use futures_core::Stream;
+use std::collections::HashMap;
+use std::future::poll_fn;
+use std::pin::pin;
+use tracing::instrument;
+
+/// Prefix of the client profiling keyspace.
+///
+/// Defined by the [C++ client](https://github.com/apple/foundationdb/blob/main/contrib/transaction_profiling_analyzer/transaction_profiling_analyzer.py#L421).
+pub const PROFILE_PREFIX: &[u8; 32] = b"\xff\x02/fdbClientInfo/client_latency/";
+
+/// Exclusive end of the client profiling keyspace (`strinc(PROFILE_PREFIX)`).
+const PROFILE_END: &[u8; 32] = b"\xff\x02/fdbClientInfo/client_latency0";
+
+const VERSIONSTAMP_LEN: usize = 10;
+const ID_LEN: usize = 16;
+const VERSIONSTAMP_START: usize = PROFILE_PREFIX.len();
+const VERSIONSTAMP_END: usize = VERSIONSTAMP_START + VERSIONSTAMP_LEN;
+const ID_START: usize = VERSIONSTAMP_END + 1;
+const ID_END: usize = ID_START + ID_LEN;
+const CHUNK_START: usize = ID_END + 1;
+const TOTAL_START: usize = CHUNK_START + 4;
+/// Shortest chunk key the [`Assembler`] can parse: everything up to the total chunk
+/// count.
+const MIN_KEY_LEN: usize = TOTAL_START + 4;
+
+/// Opaque, resumable and persistable position in the profiling keyspace: the key the next
+/// page starts reading from.
+///
+/// Persist it with [`Cursor::as_bytes`] and restore it with [`Cursor::from_bytes`] to
+/// resume reading later, for instance to tail the keyspace.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct Cursor {
+    /// Inclusive begin key of the next read, starts with [`PROFILE_PREFIX`].
+    key: Vec<u8>,
+}
+
+/// Bytes given to [`Cursor::from_bytes`] are not a serialized [`Cursor`].
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+#[error("invalid profiling cursor")]
+pub struct InvalidCursor;
+
+impl Cursor {
+    /// Cursor at the beginning of the profiling keyspace.
+    #[instrument(level = "trace")]
+    pub fn beginning() -> Self {
+        Cursor {
+            key: PROFILE_PREFIX.to_vec(),
+        }
+    }
+
+    /// Cursor at the first record with a commit version greater than or equal to
+    /// `version`.
+    ///
+    /// The version is the one at which the profiling record was written by the client,
+    /// which is some time (up to the client's flush interval) after the profiled
+    /// transaction ran. Negative versions are treated as 0.
+    #[instrument(level = "trace")]
+    pub fn at_version(version: i64) -> Self {
+        Cursor {
+            key: version_key(version),
+        }
+    }
+
+    /// Serialized form of the cursor, to persist it.
+    #[instrument(level = "trace", skip_all)]
+    pub fn as_bytes(&self) -> &[u8] {
+        &self.key
+    }
+
+    /// Restores a cursor persisted with [`Cursor::as_bytes`].
+    ///
+    /// # Errors
+    ///
+    /// Returns [`InvalidCursor`] when `bytes` is not a serialized cursor.
+    #[instrument(level = "trace", skip_all, fields(len = bytes.len()))]
+    pub fn from_bytes(bytes: Vec<u8>) -> Result<Self, InvalidCursor> {
+        if bytes.starts_with(PROFILE_PREFIX) {
+            Ok(Cursor { key: bytes })
+        } else {
+            Err(InvalidCursor)
+        }
+    }
+
+    /// Inclusive begin key of the next read.
+    fn key(&self) -> &[u8] {
+        &self.key
+    }
+}
+
+/// `PROFILE_PREFIX | version (8, BE) | \x00\x00`: the first key of that version.
+fn version_key(version: i64) -> Vec<u8> {
+    let mut key = PROFILE_PREFIX.to_vec();
+    key.extend_from_slice(&version.max(0).to_be_bytes());
+    key.extend_from_slice(b"\x00\x00");
+    key
+}
+
+/// The key right after `key`.
+fn key_after(key: &[u8]) -> Vec<u8> {
+    [key, b"\x00"].concat()
+}
+
+/// Builds pages of profiling data from the rows its caller reads.
+///
+/// Holds no connection and does no I/O: the caller reads [`range`](Self::range) with its
+/// own FoundationDB client and hands the rows to [`read_page`](Self::read_page).
+#[derive(Debug, Clone, Default)]
+pub struct ProfileScanner {
+    end_version: Option<i64>,
+}
+
+/// The key range the caller must read for one page, see [`ProfileScanner::range`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ScanRange {
+    /// Inclusive begin key.
+    pub begin: Vec<u8>,
+    /// Exclusive end key.
+    pub end: Vec<u8>,
+}
+
+/// Error of [`ProfileScanner::read_page`].
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum ScanError<E> {
+    /// The row stream failed. Map it back to the caller's error, for instance to the
+    /// `FdbError` of a range read so that the caller's retry loop handles it.
+    #[error(transparent)]
+    Source(E),
+    /// The stream yielded a row outside [`ProfileScanner::range`], or a key not strictly
+    /// greater than the previous one: the caller did not read the range as required.
+    #[error("profiling row {key:?} is outside the scanned range or not after the previous row")]
+    InvalidRows {
+        /// Key of the offending row.
+        key: Vec<u8>,
+    },
+}
+
+impl<E> ScanError<E> {
+    /// Converts this error into the caller's error type: a stream error through `From`,
+    /// any other error boxed and passed to `custom`.
+    ///
+    /// The boxed error does not depend on `E`: it is a [`ScanError<std::convert::Infallible>`]
+    /// carrying the same variant data.
+    ///
+    /// With fdb-rs: `.map_err(|e| e.into_error(FdbBindingError::new_custom_error))?`, so a
+    /// failed range read reaches `db.run` as the original `FdbError` and is retried.
+    #[instrument(level = "trace", skip_all)]
+    pub fn into_error<T: From<E>>(
+        self,
+        custom: impl FnOnce(Box<dyn std::error::Error + Send + Sync>) -> T,
+    ) -> T {
+        match self {
+            ScanError::Source(err) => T::from(err),
+            ScanError::InvalidRows { key } => {
+                custom(Box::new(
+                    ScanError::<std::convert::Infallible>::InvalidRows { key },
+                ))
+            }
+        }
+    }
+}
+
+impl ProfileScanner {
+    /// A scanner with no [`end_version`](Self::end_version).
+    #[must_use]
+    #[instrument(level = "trace")]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Exclusive upper bound on the record commit version read by a page. Unset (the
+    /// default) reads to the end of the keyspace.
+    #[must_use]
+    #[instrument(level = "trace", skip_all)]
+    pub fn end_version(self, version: i64) -> Self {
+        ProfileScanner {
+            end_version: Some(version),
+        }
+    }
+
+    /// The key range the caller must read for the page starting at `cursor`, and give to
+    /// [`read_page`](Self::read_page): forward, with snapshot reads and no row limit,
+    /// from `begin` (inclusive) to `end` (exclusive), both as `first_greater_or_equal`
+    /// key selectors. The range is empty when `cursor` is at or past
+    /// [`end_version`](Self::end_version).
+    #[instrument(level = "trace", skip_all)]
+    pub fn range(&self, cursor: &Cursor) -> ScanRange {
+        let begin = cursor.key().to_vec();
+        let end = match self.end_version {
+            Some(version) => version_key(version),
+            None => PROFILE_END.to_vec(),
+        };
+        // never an inverted range
+        let end = end.max(begin.clone());
+        ScanRange { begin, end }
+    }
+}
+
+/// One sampled transaction, reassembled and decoded.
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct ProfiledTransaction {
+    /// Commit version of the profiling record (the first 8 bytes of `versionstamp`).
+    pub version: i64,
+    /// Versionstamp of the first chunk of the profiling record. The client can write the
+    /// chunks of one transaction in several commits, the later ones then carry greater
+    /// versionstamps.
+    pub versionstamp: [u8; 10],
+    /// Transaction id chosen by the client that sampled the transaction.
+    pub id: [u8; 16],
+    /// Protocol version of the client that wrote the record.
+    pub protocol_version: ProtocolVersion,
+    /// Events of the transaction, in the order the client recorded them.
+    pub events: Vec<Event>,
+}
+
+/// A transaction that could not be returned.
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct Skipped {
+    /// Versionstamp of the first chunk read of the profiling record.
+    pub versionstamp: [u8; 10],
+    /// Transaction id chosen by the client that sampled the transaction.
+    pub id: [u8; 16],
+    /// Why it was skipped.
+    pub reason: SkipReason,
+}
+
+/// Why a transaction was [`Skipped`].
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub enum SkipReason {
+    /// All chunks were read but the reassembled blob did not decode.
+    Decode(DecodeError),
+    /// Chunks are missing, out of order or inconsistent, or the page was stopped before
+    /// they were all read, so the blob could not be reassembled.
+    BrokenChunks,
+}
+
+/// Result of [`ProfileScanner::read_page`].
+#[derive(Debug, Clone, PartialEq)]
+#[non_exhaustive]
+pub struct Page {
+    /// Decoded transactions, in the order they completed (the key of their last chunk).
+    pub transactions: Vec<ProfiledTransaction>,
+    /// Transactions that could not be returned, in the order they were detected.
+    pub skipped: Vec<Skipped>,
+    /// Where to resume. Always valid, also to tail the keyspace once `exhausted`.
+    pub next: Cursor,
+    /// Whether the row stream ended, that is the end of the range (`end_version` or the
+    /// end of the keyspace) was reached. `false` when the caller's stop check stopped
+    /// the page.
+    pub exhausted: bool,
+}
+
+impl ProfileScanner {
+    /// Builds one page of profiled transactions from `rows`, the rows of
+    /// [`range(cursor)`](Self::range) read by the caller, stopping when `should_stop`
+    /// says so.
+    ///
+    /// `rows` must yield exactly the key-value pairs of [`range(cursor)`](Self::range),
+    /// read forward, with snapshot reads and no row limit: every row inside the range,
+    /// in strictly increasing key order. A row outside the range or out of order fails
+    /// the page with [`ScanError::InvalidRows`]; an error of the stream fails it with
+    /// [`ScanError::Source`]. The stream ending means the end of the range was reached,
+    /// and the page is [`exhausted`](Page::exhausted).
+    ///
+    /// `should_stop` is where the caller bounds the page (a transaction budget, a row
+    /// count, anything): it is called after every row, and the page stops as soon as it
+    /// returns `true`, without polling `rows` again. Then:
+    ///
+    /// - With no transaction pending (all the chunks read so far belong to complete or
+    ///   broken transactions), [`Page::next`] points right after the last row.
+    /// - Otherwise [`Page::next`] points at the first chunk of the oldest pending
+    ///   transaction, before every transaction the page completed after it, which the
+    ///   page drops and the next one reads again. Such a transaction is returned whole
+    ///   by a later page, even when its chunks were written in two commits with other
+    ///   rows in between.
+    /// - When that position is `cursor` itself (a single transaction cannot be read from
+    ///   `cursor` before the caller says stop), the pending transactions are reported as
+    ///   [`SkipReason::BrokenChunks`] and [`Page::next`] points right after the last
+    ///   row, so every stopped page advances the cursor.
+    ///
+    /// Each transaction is returned once over a sequence of pages that each resume from
+    /// the previous [`Page::next`]; one is lost only in the last case above. The client
+    /// may write the chunks of one transaction in two consecutive commits (when a flush
+    /// exceeds the transaction size limit), with rows of other transactions in between.
+    /// When the range ends while such a transaction is still incomplete (its second
+    /// commit is not written yet, or lies beyond [`end_version`](Self::end_version)),
+    /// [`Page::next`] also points at its first chunk: a bounded read never returns such
+    /// a transaction, an unbounded read from that cursor does once it is complete.
+    ///
+    /// A chunk whose earlier chunks are missing is reported as
+    /// [`SkipReason::BrokenChunks`], once per transaction id and page, including chunks
+    /// of a transaction that began before the cursor the scan started from
+    /// ([`Cursor::beginning`], [`Cursor::at_version`]). A transaction that fails to
+    /// decode is reported in [`Page::skipped`] and does not fail the page.
+    ///
+    /// # Errors
+    ///
+    /// [`ScanError::Source`] with the stream's error, [`ScanError::InvalidRows`] when the
+    /// rows do not follow the contract above.
+    #[instrument(
+        level = "debug",
+        skip_all,
+        fields(
+            end_version = ?self.end_version,
+            rows,
+            transactions,
+            skipped,
+            exhausted,
+        )
+    )]
+    pub async fn read_page<S, K, V, E>(
+        &self,
+        cursor: &Cursor,
+        rows: S,
+        mut should_stop: impl FnMut() -> bool,
+    ) -> Result<Page, ScanError<E>>
+    where
+        S: Stream<Item = Result<(K, V), E>>,
+        K: AsRef<[u8]>,
+        V: AsRef<[u8]>,
+    {
+        let range = self.range(cursor);
+        let mut assembler = Assembler::new(cursor);
+        let mut rows = pin!(rows);
+        let mut read = 0usize;
+        let page = loop {
+            let Some(row) = poll_fn(|cx| rows.as_mut().poll_next(cx)).await else {
+                break assembler.finish(false);
+            };
+            let (key, value) = row.map_err(ScanError::Source)?;
+            let key = key.as_ref();
+            let in_order = assembler.last_key.as_deref().is_none_or(|last| key > last);
+            if key < range.begin.as_slice() || key >= range.end.as_slice() || !in_order {
+                return Err(ScanError::InvalidRows { key: key.to_vec() });
+            }
+            assembler.push(key, value.as_ref());
+            read += 1;
+            if should_stop() {
+                break assembler.finish(true);
+            }
+        };
+
+        let span = tracing::Span::current();
+        span.record("rows", read);
+        span.record("transactions", page.transactions.len());
+        span.record("skipped", page.skipped.len());
+        span.record("exhausted", page.exhausted);
+        Ok(page)
+    }
+}
+
+fn version_of(versionstamp: &[u8; 10]) -> i64 {
+    let mut version = [0u8; 8];
+    version.copy_from_slice(&versionstamp[..8]);
+    i64::from_be_bytes(version)
+}
+
+/// The fields of a chunk key.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct ChunkKey {
+    versionstamp: [u8; 10],
+    id: [u8; 16],
+    chunk: u32,
+    total: u32,
+}
+
+impl ChunkKey {
+    /// Parses a chunk key by offsets, ignoring what follows the total chunk count.
+    /// Returns `None` for a key that is too short or has misplaced separators.
+    fn parse(key: &[u8]) -> Option<Self> {
+        if key.len() < MIN_KEY_LEN
+            || !key.starts_with(PROFILE_PREFIX)
+            || key[VERSIONSTAMP_END] != b'/'
+            || key[ID_END] != b'/'
+        {
+            return None;
+        }
+        let mut versionstamp = [0u8; VERSIONSTAMP_LEN];
+        versionstamp.copy_from_slice(&key[VERSIONSTAMP_START..VERSIONSTAMP_END]);
+        let mut id = [0u8; ID_LEN];
+        id.copy_from_slice(&key[ID_START..ID_END]);
+        let be = |start: usize| {
+            let mut n = [0u8; 4];
+            n.copy_from_slice(&key[start..start + 4]);
+            u32::from_be_bytes(n)
+        };
+        Some(ChunkKey {
+            versionstamp,
+            id,
+            chunk: be(CHUNK_START),
+            total: be(TOTAL_START),
+        })
+    }
+}
+
+/// A reassembly outcome of the [`Assembler`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Assembled {
+    /// Every chunk of a transaction, concatenated.
+    Complete {
+        versionstamp: [u8; 10],
+        id: [u8; 16],
+        blob: Vec<u8>,
+    },
+    /// A transaction whose chunks could not be reassembled.
+    Broken {
+        versionstamp: [u8; 10],
+        id: [u8; 16],
+    },
+}
+
+/// An [`Assembled`] outcome with the keys of the rows it was made of.
+#[derive(Debug)]
+struct Output {
+    /// Key of the first row of the transaction read by this page.
+    first_key: Vec<u8>,
+    /// Key of the last row of the transaction read by this page: the one that produced
+    /// the outcome, or a later chunk of a broken transaction.
+    last_key: Vec<u8>,
+    assembled: Assembled,
+}
+
+/// A multi-chunk transaction being reassembled.
+#[derive(Debug)]
+struct Partial {
+    /// Key of its first chunk.
+    first_key: Vec<u8>,
+    id: [u8; 16],
+    /// Versionstamp of its first chunk.
+    versionstamp: [u8; 10],
+    /// Versionstamp of its last chunk so far.
+    last_versionstamp: [u8; 10],
+    total: u32,
+    next_chunk: u32,
+    /// Concatenated chunk values so far. Grows by the actual chunk lengths only, never by
+    /// the untrusted total chunk count.
+    blob: Vec<u8>,
+}
+
+/// Builds one [`Page`] from the rows of its range, fed in key order. Pure, no I/O:
+/// [`ProfileScanner::read_page`] feeds it the caller's rows and tells it where it stopped.
+///
+/// A multi-chunk transaction starts at chunk 1 and its chunks come in order 1..=total,
+/// with the same id and total and non-decreasing versionstamps: the client may write them
+/// in two commits, so rows of other transactions can sit in between. Anything else
+/// drops the partial buffer and reports the transaction as [`Assembled::Broken`], once
+/// per id until a new chunk 1 of that id.
+#[derive(Debug)]
+struct Assembler {
+    /// Where the page started.
+    start: Cursor,
+    /// Pending transactions by id.
+    partials: HashMap<[u8; 16], Partial>,
+    /// Ids reported as broken, with the index of their report in `outputs`, so that their
+    /// remaining chunks are consumed silently. A new chunk 1 of the id removes it.
+    broken: HashMap<[u8; 16], usize>,
+    /// Outcomes, in the order they were produced.
+    outputs: Vec<Output>,
+    /// Last row fed.
+    last_key: Option<Vec<u8>>,
+}
+
+impl Assembler {
+    fn new(start: &Cursor) -> Self {
+        Assembler {
+            start: start.clone(),
+            partials: HashMap::new(),
+            broken: HashMap::new(),
+            outputs: Vec::new(),
+            last_key: None,
+        }
+    }
+
+    /// Feeds one row.
+    fn push(&mut self, key: &[u8], value: &[u8]) {
+        self.last_key = Some(key.to_vec());
+        match ChunkKey::parse(key) {
+            Some(parsed) => self.process(parsed, key, value),
+            None => tracing::warn!(key = ?key, "ignoring unparseable profiling key"),
+        }
+    }
+
+    /// Processes a parsed row.
+    fn process(&mut self, parsed: ChunkKey, key: &[u8], value: &[u8]) {
+        if let Some(mut partial) = self.partials.remove(&parsed.id) {
+            if parsed.total == partial.total
+                && parsed.chunk == partial.next_chunk
+                && parsed.versionstamp >= partial.last_versionstamp
+            {
+                partial.blob.extend_from_slice(value);
+                if parsed.chunk == partial.total {
+                    self.outputs.push(Output {
+                        first_key: partial.first_key,
+                        last_key: key.to_vec(),
+                        assembled: Assembled::Complete {
+                            versionstamp: partial.versionstamp,
+                            id: parsed.id,
+                            blob: partial.blob,
+                        },
+                    });
+                    return;
+                }
+                // chunk < total, so this cannot overflow
+                partial.next_chunk += 1;
+                partial.last_versionstamp = parsed.versionstamp;
+                self.partials.insert(parsed.id, partial);
+                return;
+            }
+            self.report_broken(partial.first_key, partial.versionstamp, parsed.id, key);
+        }
+
+        if parsed.chunk == 1 && parsed.total >= 1 {
+            // a new transaction under this id, its chunks are no longer those of a broken one
+            self.broken.remove(&parsed.id);
+        }
+        if parsed.chunk == 1 && parsed.total == 1 {
+            self.outputs.push(Output {
+                first_key: key.to_vec(),
+                last_key: key.to_vec(),
+                assembled: Assembled::Complete {
+                    versionstamp: parsed.versionstamp,
+                    id: parsed.id,
+                    blob: value.to_vec(),
+                },
+            });
+            return;
+        }
+        if parsed.chunk == 1 && parsed.total > 1 {
+            self.partials.insert(
+                parsed.id,
+                Partial {
+                    first_key: key.to_vec(),
+                    id: parsed.id,
+                    versionstamp: parsed.versionstamp,
+                    last_versionstamp: parsed.versionstamp,
+                    total: parsed.total,
+                    next_chunk: 2,
+                    blob: value.to_vec(),
+                },
+            );
+        } else {
+            self.report_broken(key.to_vec(), parsed.versionstamp, parsed.id, key);
+        }
+    }
+
+    /// Reports `id` as broken, unless it already is: then `key` becomes the last row of
+    /// that report.
+    fn report_broken(
+        &mut self,
+        first_key: Vec<u8>,
+        versionstamp: [u8; 10],
+        id: [u8; 16],
+        key: &[u8],
+    ) {
+        if let Some(&index) = self.broken.get(&id) {
+            if let Some(output) = self.outputs.get_mut(index) {
+                output.last_key = key.to_vec();
+            }
+            return;
+        }
+        self.broken.insert(id, self.outputs.len());
+        self.outputs.push(Output {
+            first_key,
+            last_key: key.to_vec(),
+            assembled: Assembled::Broken { versionstamp, id },
+        });
+    }
+
+    /// Where the next page resumes to read again the transaction whose first chunk is at
+    /// `cut`: lowers `cut` to the first key of every outcome whose last row is at or after
+    /// it, up to a fixed point. Returns the cut and the indexes of those outcomes, which
+    /// the next page reports instead.
+    fn cut(&self, mut cut: Vec<u8>) -> (Vec<u8>, Vec<usize>) {
+        let mut by_last: Vec<usize> = (0..self.outputs.len()).collect();
+        by_last.sort_by(|&a, &b| self.outputs[b].last_key.cmp(&self.outputs[a].last_key));
+        let mut dropped = Vec::new();
+        for index in by_last {
+            let output = &self.outputs[index];
+            if output.last_key < cut {
+                break;
+            }
+            dropped.push(index);
+            if output.first_key < cut {
+                cut = output.first_key.clone();
+            }
+        }
+        (cut, dropped)
+    }
+
+    /// Builds the page. `stopped` tells whether the caller's check stopped it right after
+    /// its last row, rather than the end of its range.
+    ///
+    /// Pending transactions are left to the next page: it resumes at the
+    /// [`cut`](Self::cut) before them and reads them again. When the page was stopped and
+    /// that cut would not advance past the cursor, it resumes after the last row and
+    /// breaks them instead. With nothing pending, it resumes after the last row.
+    fn finish(mut self, stopped: bool) -> Page {
+        let mut pending: Vec<Partial> = std::mem::take(&mut self.partials).into_values().collect();
+        pending.sort_by(|a, b| a.first_key.cmp(&b.first_key));
+        let after_last = match &self.last_key {
+            Some(last) => key_after(last),
+            None => self.start.key().to_vec(),
+        };
+
+        let mut kept = vec![true; self.outputs.len()];
+        let cut = match pending.first() {
+            None => None,
+            Some(oldest) => {
+                let (cut, dropped) = self.cut(oldest.first_key.clone());
+                if stopped && cut.as_slice() <= self.start.key() {
+                    // a cut at the cursor would not progress: break the pending ones
+                    None
+                } else {
+                    for &index in &dropped {
+                        kept[index] = false;
+                    }
+                    tracing::debug!(
+                        pending = pending.len(),
+                        left_to_next_page = dropped.len(),
+                        stopped,
+                        "page ended with incomplete transactions"
+                    );
+                    Some(cut)
+                }
+            }
+        };
+        let next = match cut {
+            Some(cut) => cut,
+            None => {
+                // the page resumes after its last row: what is still pending cannot be
+                // reassembled (with no cut, only a stopped page has pending ones)
+                for partial in pending {
+                    tracing::debug!("breaking incomplete transaction at a stop");
+                    self.outputs.push(Output {
+                        last_key: partial.first_key.clone(),
+                        first_key: partial.first_key,
+                        assembled: Assembled::Broken {
+                            versionstamp: partial.versionstamp,
+                            id: partial.id,
+                        },
+                    });
+                    kept.push(true);
+                }
+                after_last
+            }
+        };
+
+        let mut transactions = Vec::new();
+        let mut skipped = Vec::new();
+        for (output, kept) in self.outputs.into_iter().zip(kept) {
+            if !kept {
+                continue;
+            }
+            match output.assembled {
+                Assembled::Complete {
+                    versionstamp,
+                    id,
+                    blob,
+                } => match decode_events(&blob) {
+                    Ok((protocol_version, events)) => transactions.push(ProfiledTransaction {
+                        version: version_of(&versionstamp),
+                        versionstamp,
+                        id,
+                        protocol_version,
+                        events,
+                    }),
+                    Err(err) => {
+                        tracing::debug!(error = %err, "skipping undecodable transaction");
+                        skipped.push(Skipped {
+                            versionstamp,
+                            id,
+                            reason: SkipReason::Decode(err),
+                        })
+                    }
+                },
+                Assembled::Broken { versionstamp, id } => {
+                    tracing::debug!("skipping transaction with broken chunks");
+                    skipped.push(Skipped {
+                        versionstamp,
+                        id,
+                        reason: SkipReason::BrokenChunks,
+                    })
+                }
+            }
+        }
+
+        Page {
+            transactions,
+            skipped,
+            next: Cursor { key: next },
+            exhausted: !stopped,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use futures_util::{FutureExt, StreamExt, stream};
+    use std::cell::Cell;
+    use std::collections::BTreeSet;
+    use std::convert::Infallible;
+    use std::io;
+
+    fn vs(version: u64, batch: u16) -> [u8; 10] {
+        let mut out = [0u8; 10];
+        out[..8].copy_from_slice(&version.to_be_bytes());
+        out[8..].copy_from_slice(&batch.to_be_bytes());
+        out
+    }
+
+    fn id(n: u8) -> [u8; 16] {
+        [b'0' + n; 16]
+    }
+
+    fn key(versionstamp: [u8; 10], id: [u8; 16], chunk: u32, total: u32) -> Vec<u8> {
+        let mut key = PROFILE_PREFIX.to_vec();
+        key.extend_from_slice(&versionstamp);
+        key.push(b'/');
+        key.extend_from_slice(&id);
+        key.push(b'/');
+        key.extend_from_slice(&chunk.to_be_bytes());
+        key.extend_from_slice(&total.to_be_bytes());
+        key.extend_from_slice(b"/user-id");
+        key
+    }
+
+    type Row = (Vec<u8>, Vec<u8>);
+    type Rows = Vec<Row>;
+
+    /// Feeds all rows from the beginning, returns the outcomes and the first key of the
+    /// oldest pending transaction.
+    fn reassemble(rows: &[(Vec<u8>, Vec<u8>)]) -> (Vec<Assembled>, Option<Vec<u8>>) {
+        let mut assembler = Assembler::new(&Cursor::beginning());
+        for (k, v) in rows {
+            assembler.push(k, v);
+        }
+        let pending = assembler
+            .partials
+            .values()
+            .map(|p| p.first_key.clone())
+            .min();
+        let out = assembler.outputs.into_iter().map(|o| o.assembled).collect();
+        (out, pending)
+    }
+
+    fn complete(versionstamp: [u8; 10], id: [u8; 16], blob: &[u8]) -> Assembled {
+        Assembled::Complete {
+            versionstamp,
+            id,
+            blob: blob.to_vec(),
+        }
+    }
+
+    fn broken(versionstamp: [u8; 10], id: [u8; 16]) -> Assembled {
+        Assembled::Broken { versionstamp, id }
+    }
+
+    fn never() -> impl FnMut() -> bool {
+        || false
+    }
+
+    fn always() -> impl FnMut() -> bool {
+        || true
+    }
+
+    /// Stops at every `k`-th check.
+    fn every(k: usize) -> impl FnMut() -> bool {
+        let mut checks = 0;
+        move || {
+            checks += 1;
+            checks % k == 0
+        }
+    }
+
+    /// Stops after the `n`-th row of the page.
+    fn after(n: usize) -> impl FnMut() -> bool {
+        let mut checks = 0;
+        move || {
+            checks += 1;
+            checks >= n
+        }
+    }
+
+    /// Stops pseudo-randomly, about once every `m` checks, with a state shared by every
+    /// page so that consecutive pages stop at different rows.
+    fn random(state: &Cell<u64>, m: u64) -> impl FnMut() -> bool + '_ {
+        move || {
+            let next = state
+                .get()
+                .wrapping_mul(6_364_136_223_846_793_005)
+                .wrapping_add(1_442_695_040_888_963_407);
+            state.set(next);
+            (next >> 33) % m == 0
+        }
+    }
+
+    /// Runs `read_page` over `rows`, which must be ready (no I/O in these tests).
+    fn read<E>(
+        scanner: &ProfileScanner,
+        cursor: &Cursor,
+        rows: Vec<Result<Row, E>>,
+        should_stop: impl FnMut() -> bool,
+    ) -> Result<Page, ScanError<E>> {
+        scanner
+            .read_page(cursor, stream::iter(rows), should_stop)
+            .now_or_never()
+            .expect("a ready stream completes the page in one poll")
+    }
+
+    /// Runs one page over the sorted `rows`, feeding the ones of its range like a caller
+    /// honoring the contract of `read_page`.
+    fn run_page(rows: &Rows, cursor: &Cursor, should_stop: impl FnMut() -> bool) -> Page {
+        let scanner = ProfileScanner::new();
+        let range = scanner.range(cursor);
+        let rows = rows
+            .iter()
+            .filter(|(k, _)| *k >= range.begin && *k < range.end)
+            .cloned()
+            .map(Ok::<_, Infallible>)
+            .collect();
+        match read(&scanner, cursor, rows, should_stop) {
+            Ok(page) => page,
+            Err(err) => panic!("{err}"),
+        }
+    }
+
+    /// Runs pages until exhausted, each with a fresh stop check, returns every reported
+    /// transaction and skip.
+    fn run_pages<C: FnMut() -> bool>(
+        rows: &Rows,
+        mut should_stop: impl FnMut() -> C,
+    ) -> (Vec<ProfiledTransaction>, Vec<Skipped>) {
+        let mut cursor = Cursor::beginning();
+        let (mut txs, mut skipped) = (Vec::new(), Vec::new());
+        for _ in 0..10_000 {
+            let page = run_page(rows, &cursor, should_stop());
+            txs.extend(page.transactions);
+            skipped.extend(page.skipped);
+            let next = Cursor::from_bytes(page.next.as_bytes().to_vec()).unwrap();
+            assert_eq!(next, page.next);
+            if page.exhausted {
+                return (txs, skipped);
+            }
+            assert!(next.key() > cursor.key(), "no progress");
+            cursor = next;
+        }
+        panic!("pages never exhausted");
+    }
+
+    /// A valid blob with no event, split in `n` chunks.
+    fn blob_chunks(n: usize) -> Vec<Vec<u8>> {
+        let blob = ProtocolVersion::V7_4.0.to_le_bytes();
+        let size = blob.len().div_ceil(n);
+        let mut chunks: Vec<Vec<u8>> = blob.chunks(size).map(<[u8]>::to_vec).collect();
+        chunks.resize(n, Vec::new());
+        chunks
+    }
+
+    /// Rows of a transaction whose chunks are spread over the given versionstamps.
+    fn txn(id_n: u8, stamps: &[[u8; 10]]) -> Rows {
+        let total = stamps.len() as u32;
+        blob_chunks(stamps.len())
+            .into_iter()
+            .zip(stamps)
+            .enumerate()
+            .map(|(i, (chunk, stamp))| (key(*stamp, id(id_n), i as u32 + 1, total), chunk))
+            .collect()
+    }
+
+    fn txn_ids(txs: &[ProfiledTransaction]) -> Vec<[u8; 16]> {
+        txs.iter().map(|t| t.id).collect()
+    }
+
+    fn skipped_ids(skipped: &[Skipped]) -> Vec<[u8; 16]> {
+        skipped.iter().map(|s| s.id).collect()
+    }
+
+    #[test]
+    fn parses_real_key_layout() {
+        let k = key(vs(7, 1), id(1), 2, 3);
+        assert_eq!(
+            ChunkKey::parse(&k),
+            Some(ChunkKey {
+                versionstamp: vs(7, 1),
+                id: id(1),
+                chunk: 2,
+                total: 3,
+            })
+        );
+        // the tail after the chunk fields is ignored, and may be absent
+        assert!(ChunkKey::parse(&k[..MIN_KEY_LEN]).is_some());
+        for len in 0..MIN_KEY_LEN {
+            assert_eq!(ChunkKey::parse(&k[..len]), None, "len {len}");
+        }
+        let mut bad = k.clone();
+        bad[VERSIONSTAMP_END] = b'x';
+        assert_eq!(ChunkKey::parse(&bad), None);
+    }
+
+    #[test]
+    fn single_and_multi_chunk() {
+        let (out, pending) = reassemble(&[
+            (key(vs(1, 0), id(1), 1, 1), b"one".to_vec()),
+            (key(vs(1, 0), id(2), 1, 3), b"ab".to_vec()),
+            (key(vs(1, 0), id(2), 2, 3), b"cd".to_vec()),
+            (key(vs(1, 0), id(2), 3, 3), b"e".to_vec()),
+        ]);
+        assert_eq!(
+            out,
+            vec![
+                complete(vs(1, 0), id(1), b"one"),
+                complete(vs(1, 0), id(2), b"abcde")
+            ]
+        );
+        assert_eq!(pending, None);
+    }
+
+    #[test]
+    fn straddling_transaction_with_other_rows_in_between() {
+        // id 1 has chunks 1-2 in the first commit and chunk 3 in the second one, with
+        // rows of other transactions of both commits in between.
+        let (out, pending) = reassemble(&[
+            (key(vs(1, 0), id(1), 1, 3), b"a".to_vec()),
+            (key(vs(1, 0), id(1), 2, 3), b"b".to_vec()),
+            (key(vs(1, 0), id(2), 1, 1), b"B".to_vec()),
+            (key(vs(2, 0), id(0), 1, 1), b"Z".to_vec()),
+            (key(vs(2, 0), id(1), 3, 3), b"c".to_vec()),
+            (key(vs(2, 0), id(3), 1, 1), b"D".to_vec()),
+        ]);
+        assert_eq!(
+            out,
+            vec![
+                complete(vs(1, 0), id(2), b"B"),
+                complete(vs(2, 0), id(0), b"Z"),
+                complete(vs(1, 0), id(1), b"abc"),
+                complete(vs(2, 0), id(3), b"D"),
+            ]
+        );
+        assert_eq!(pending, None);
+    }
+
+    #[test]
+    fn straddler_with_many_rows_in_between_completes() {
+        let mut rows: Rows = vec![(key(vs(1, 0), id(1), 1, 2), b"a".to_vec())];
+        for batch in 1..=5000 {
+            rows.push((key(vs(1, batch), id(2), 1, 1), vec![0; 100]));
+        }
+        rows.push((key(vs(2, 0), id(1), 2, 2), b"b".to_vec()));
+        let (out, pending) = reassemble(&rows);
+        assert_eq!(out.len(), 5001);
+        assert!(out.iter().all(|o| matches!(o, Assembled::Complete { .. })));
+        assert_eq!(out.last(), Some(&complete(vs(1, 0), id(1), b"ab")));
+        assert_eq!(pending, None);
+    }
+
+    #[test]
+    fn interleaved_transactions_both_complete() {
+        let (out, _) = reassemble(&[
+            (key(vs(1, 0), id(1), 1, 2), b"a".to_vec()),
+            (key(vs(1, 0), id(2), 1, 2), b"x".to_vec()),
+            (key(vs(2, 0), id(1), 2, 2), b"b".to_vec()),
+            (key(vs(2, 0), id(2), 2, 2), b"y".to_vec()),
+        ]);
+        assert_eq!(
+            out,
+            vec![
+                complete(vs(1, 0), id(1), b"ab"),
+                complete(vs(1, 0), id(2), b"xy")
+            ]
+        );
+    }
+
+    #[test]
+    fn missing_chunk_is_broken_once() {
+        let (out, pending) = reassemble(&[
+            (key(vs(1, 0), id(1), 1, 4), b"a".to_vec()),
+            (key(vs(1, 0), id(1), 2, 4), b"b".to_vec()),
+            (key(vs(1, 0), id(1), 4, 4), b"d".to_vec()),
+            (key(vs(1, 0), id(2), 1, 1), b"B".to_vec()),
+        ]);
+        assert_eq!(
+            out,
+            vec![broken(vs(1, 0), id(1)), complete(vs(1, 0), id(2), b"B")]
+        );
+        assert_eq!(pending, None);
+    }
+
+    #[test]
+    fn orphan_chunks_are_broken_once() {
+        let (out, _) = reassemble(&[
+            (key(vs(1, 0), id(1), 2, 3), b"b".to_vec()),
+            (key(vs(1, 0), id(1), 3, 3), b"c".to_vec()),
+            (key(vs(1, 0), id(2), 1, 1), b"B".to_vec()),
+        ]);
+        assert_eq!(
+            out,
+            vec![broken(vs(1, 0), id(1)), complete(vs(1, 0), id(2), b"B")]
+        );
+    }
+
+    #[test]
+    fn out_of_order_or_inconsistent_chunks_are_broken() {
+        let (out, _) = reassemble(&[
+            (key(vs(1, 0), id(1), 1, 3), b"a".to_vec()),
+            (key(vs(1, 0), id(1), 3, 3), b"c".to_vec()),
+            (key(vs(1, 0), id(1), 2, 3), b"b".to_vec()),
+        ]);
+        assert_eq!(out, vec![broken(vs(1, 0), id(1))]);
+        // other total
+        let (out, _) = reassemble(&[
+            (key(vs(1, 0), id(1), 1, 2), b"a".to_vec()),
+            (key(vs(1, 0), id(1), 2, 3), b"b".to_vec()),
+        ]);
+        assert_eq!(out, vec![broken(vs(1, 0), id(1))]);
+        // decreasing versionstamp (only possible with rows fed out of key order)
+        let (out, _) = reassemble(&[
+            (key(vs(2, 0), id(1), 1, 2), b"a".to_vec()),
+            (key(vs(1, 0), id(1), 2, 2), b"b".to_vec()),
+        ]);
+        assert_eq!(out, vec![broken(vs(2, 0), id(1))]);
+    }
+
+    #[test]
+    fn chunk_one_restarts_a_pending_transaction() {
+        let (out, _) = reassemble(&[
+            (key(vs(1, 0), id(1), 1, 2), b"a".to_vec()),
+            (key(vs(2, 0), id(1), 1, 2), b"x".to_vec()),
+            (key(vs(2, 0), id(1), 2, 2), b"y".to_vec()),
+        ]);
+        assert_eq!(
+            out,
+            vec![broken(vs(1, 0), id(1)), complete(vs(2, 0), id(1), b"xy")]
+        );
+    }
+
+    #[test]
+    fn nonsense_chunk_numbers_are_broken() {
+        for (chunk, total) in [(0, 0), (0, 1), (1, 0), (2, 1), (u32::MAX, u32::MAX)] {
+            let (out, _) = reassemble(&[(key(vs(1, 0), id(1), chunk, total), b"a".to_vec())]);
+            assert_eq!(out, vec![broken(vs(1, 0), id(1))], "{chunk}/{total}");
+        }
+        // a huge total does not allocate for it
+        let k = key(vs(1, 0), id(1), 1, u32::MAX);
+        let (out, pending) = reassemble(&[(k.clone(), b"a".to_vec())]);
+        assert_eq!(out, vec![]);
+        assert_eq!(pending, Some(k));
+    }
+
+    #[test]
+    fn reused_id_that_breaks_again_is_reported_again() {
+        let (out, pending) = reassemble(&[
+            (key(vs(1, 0), id(1), 1, 3), b"a".to_vec()),
+            (key(vs(1, 0), id(1), 3, 3), b"c".to_vec()),
+            (key(vs(2, 0), id(1), 1, 3), b"a".to_vec()),
+            (key(vs(2, 0), id(1), 3, 3), b"c".to_vec()),
+            (key(vs(3, 0), id(1), 1, 1), b"x".to_vec()),
+            (key(vs(4, 0), id(1), 2, 2), b"y".to_vec()),
+        ]);
+        assert_eq!(
+            out,
+            vec![
+                broken(vs(1, 0), id(1)),
+                broken(vs(2, 0), id(1)),
+                complete(vs(3, 0), id(1), b"x"),
+                broken(vs(4, 0), id(1)),
+            ]
+        );
+        assert_eq!(pending, None);
+    }
+
+    #[test]
+    fn unparseable_keys_are_consumed_without_output() {
+        let short = [PROFILE_PREFIX.as_slice(), b"short"].concat();
+        let (out, pending) = reassemble(&[(short, b"x".to_vec())]);
+        assert_eq!(out, vec![]);
+        assert_eq!(pending, None);
+    }
+
+    #[test]
+    fn should_stop_is_called_after_every_row_and_stops_reading() {
+        let v1 = vs(1, 0);
+        let mut rows: Rows = txn(1, &[v1, v1, v1]);
+        rows.extend(txn(2, &[v1]));
+        rows.sort();
+        let mut checks = 0;
+        let page = run_page(&rows, &Cursor::beginning(), || {
+            checks += 1;
+            false
+        });
+        assert_eq!(checks, rows.len());
+        assert!(page.exhausted);
+
+        // the page stops at the first `true`, without reading further
+        let polled = Cell::new(0);
+        let stream = stream::iter(rows.clone()).map(|row| {
+            polled.set(polled.get() + 1);
+            Ok::<_, Infallible>(row)
+        });
+        let page = ProfileScanner::new()
+            .read_page(&Cursor::beginning(), stream, after(3))
+            .now_or_never()
+            .unwrap()
+            .unwrap();
+        assert_eq!(polled.get(), 3);
+        assert!(!page.exhausted);
+        assert_eq!(txn_ids(&page.transactions), vec![id(1)]);
+        assert_eq!(page.next.key(), key_after(&rows[2].0).as_slice());
+    }
+
+    #[test]
+    fn stop_with_nothing_pending_resumes_after_the_row() {
+        let mut rows: Rows = Vec::new();
+        for n in 0..3u8 {
+            rows.extend(txn(n, &[vs(1, 0)]));
+        }
+        rows.sort();
+        let page = run_page(&rows, &Cursor::beginning(), after(2));
+        assert!(!page.exhausted);
+        assert_eq!(txn_ids(&page.transactions), vec![id(0), id(1)]);
+        assert_eq!(page.next.key(), key_after(&rows[1].0).as_slice());
+    }
+
+    #[test]
+    fn stop_while_straddler_is_pending_cuts_before_it() {
+        let (v1, v2) = (vs(1, 0), vs(2, 0));
+        let mut rows: Rows = txn(0, &[v1]);
+        rows.extend(txn(1, &[v1, v2]));
+        rows.extend(txn(2, &[v1]));
+        rows.extend(txn(3, &[v2]));
+        rows.sort();
+        // id 0, id 1 chunk 1, id 2, id 1 chunk 2, id 3: stop right after id 2
+        let page = run_page(&rows, &Cursor::beginning(), after(3));
+        assert!(!page.exhausted);
+        // id 2 completed after id 1's first chunk: left to the next page
+        assert_eq!(txn_ids(&page.transactions), vec![id(0)]);
+        assert!(page.skipped.is_empty());
+        assert_eq!(page.next.key(), rows[1].0.as_slice());
+
+        // the next page returns the straddler whole, and id 2 once
+        let page = run_page(&rows, &page.next, never());
+        assert!(page.exhausted);
+        assert_eq!(txn_ids(&page.transactions), vec![id(2), id(1), id(3)]);
+        assert!(page.skipped.is_empty());
+    }
+
+    #[test]
+    fn stop_at_the_cursor_with_a_pending_record_breaks_it_and_progresses() {
+        let (v1, v2) = (vs(1, 0), vs(2, 0));
+        let mut rows: Rows = txn(1, &[v1, v2]);
+        rows.extend(txn(2, &[v1]));
+        rows.extend(txn(3, &[v2]));
+        rows.sort();
+        // id 1 chunk 1, id 2, id 1 chunk 2, id 3
+        let cursor = Cursor::from_bytes(rows[0].0.clone()).unwrap();
+        for stop in [1, 2] {
+            let page = run_page(&rows, &cursor, after(stop));
+            assert!(!page.exhausted);
+            assert_eq!(txn_ids(&page.transactions), &[id(2)][..stop - 1]);
+            assert_eq!(skipped_ids(&page.skipped), vec![id(1)]);
+            assert_eq!(page.skipped[0].reason, SkipReason::BrokenChunks);
+            assert_eq!(page.skipped[0].versionstamp, v1);
+            assert_eq!(page.next.key(), key_after(&rows[stop - 1].0).as_slice());
+        }
+
+        // the rest of id 1 shows up again as broken on the next page
+        let page = run_page(
+            &rows,
+            &Cursor::from_bytes(key_after(&rows[1].0)).unwrap(),
+            never(),
+        );
+        assert!(page.exhausted);
+        assert_eq!(txn_ids(&page.transactions), vec![id(3)]);
+        assert_eq!(skipped_ids(&page.skipped), vec![id(1)]);
+        assert_eq!(page.skipped[0].versionstamp, v2);
+    }
+
+    #[test]
+    fn lost_chunk_is_read_again_then_broken_when_stopped_at_the_cursor() {
+        let v1 = vs(1, 0);
+        // id 1 never gets its third chunk
+        let mut rows: Rows = txn(1, &[v1, v1, v1]);
+        rows.truncate(2);
+        rows.extend(txn(2, &[v1, v1, v1]));
+        rows.sort();
+        // the stop leaves id 1 pending: the page resumes at it to read it again
+        let page = run_page(&rows, &Cursor::beginning(), after(2));
+        assert!(!page.exhausted);
+        assert!(page.transactions.is_empty());
+        assert!(page.skipped.is_empty());
+        assert_eq!(page.next.key(), rows[0].0.as_slice());
+
+        // from there, the cut would not advance: id 1 is broken and the page moves on
+        let page = run_page(&rows, &page.next, after(2));
+        assert!(!page.exhausted);
+        assert!(page.transactions.is_empty());
+        assert_eq!(skipped_ids(&page.skipped), vec![id(1)]);
+        assert_eq!(page.next.key(), key_after(&rows[1].0).as_slice());
+
+        let page = run_page(&rows, &page.next, never());
+        assert!(page.exhausted);
+        assert_eq!(txn_ids(&page.transactions), vec![id(2)]);
+
+        // at the end of the range, the page resumes at the pending transaction
+        let lost: Rows = rows[..2].to_vec();
+        let page = run_page(&lost, &Cursor::beginning(), never());
+        assert!(page.exhausted);
+        assert!(page.skipped.is_empty());
+        assert_eq!(page.next.key(), lost[0].0.as_slice());
+    }
+
+    /// id 0 (one chunk), then id 1 (three contiguous chunks), then id 2 (one chunk).
+    fn big_record_rows() -> Rows {
+        let v1 = vs(1, 0);
+        let mut rows: Rows = txn(0, &[v1]);
+        rows.extend(txn(1, &[v1, v1, v1]));
+        rows.extend(txn(2, &[v1]));
+        rows.sort();
+        rows
+    }
+
+    #[test]
+    fn big_record_interrupted_by_a_stop_is_returned_whole_by_next_page() {
+        let rows = big_record_rows();
+        // stopped on id 1's first or second chunk
+        for stop in [2, 3] {
+            let page = run_page(&rows, &Cursor::beginning(), after(stop));
+            assert!(!page.exhausted);
+            assert_eq!(txn_ids(&page.transactions), vec![id(0)], "stop {stop}");
+            assert!(page.skipped.is_empty(), "stop {stop}");
+            assert_eq!(page.next.key(), rows[1].0.as_slice(), "stop {stop}");
+
+            let page = run_page(&rows, &page.next, never());
+            assert!(page.exhausted);
+            assert_eq!(txn_ids(&page.transactions), vec![id(1), id(2)]);
+            assert!(page.skipped.is_empty());
+        }
+    }
+
+    #[test]
+    fn stop_before_one_record_is_read_from_the_cursor_breaks_it_and_progresses() {
+        let rows = big_record_rows();
+        let cursor = Cursor::from_bytes(rows[1].0.clone()).unwrap();
+        let page = run_page(&rows, &cursor, always());
+        assert!(!page.exhausted);
+        assert!(page.transactions.is_empty());
+        assert_eq!(skipped_ids(&page.skipped), vec![id(1)]);
+        assert_eq!(page.next.key(), key_after(&rows[1].0).as_slice());
+
+        // its remaining chunks are reported again, by each page that reads them
+        let page = run_page(&rows, &page.next, always());
+        assert_eq!(page.next.key(), key_after(&rows[2].0).as_slice());
+        assert_eq!(skipped_ids(&page.skipped), vec![id(1)]);
+        let (txs, skipped) = run_pages(&rows, always);
+        assert_eq!(txn_ids(&txs), vec![id(0), id(2)]);
+        assert_eq!(skipped_ids(&skipped), vec![id(1); 3]);
+    }
+
+    #[test]
+    fn end_of_range_with_pending_straddler_cuts_before_it() {
+        let (v1, v2, v3) = (vs(1, 0), vs(2, 0), vs(3, 0));
+        let mut rows: Rows = Vec::new();
+        rows.extend(txn(0, &[v1])); // Z, before everything
+        rows.extend(txn(1, &[v1, v2])); // T1, starts before P, completes after it
+        rows.extend(txn(2, &[v1, v3])); // P, its second commit is not written yet
+        rows.extend(txn(3, &[v1])); // A, between P's chunk 1 and T1's chunk 2
+        rows.extend(txn(4, &[v2])); // C, after everything
+        rows.sort();
+        let t1_first = rows[1].0.clone();
+        let written: Rows = rows
+            .iter()
+            .filter(|(k, _)| k[VERSIONSTAMP_START..] < v3[..])
+            .cloned()
+            .collect();
+
+        let page = run_page(&written, &Cursor::beginning(), never());
+        assert!(page.exhausted);
+        // T1 completes after P's first chunk: dropped with everything after it, and the
+        // cut goes back to T1's first chunk
+        assert_eq!(txn_ids(&page.transactions), vec![id(0)]);
+        assert!(page.skipped.is_empty());
+        assert_eq!(page.next.key(), t1_first.as_slice());
+
+        // once P's second commit is written, the next page returns the rest once
+        let next = run_page(&rows, &page.next, never());
+        assert!(next.exhausted);
+        let mut got = txn_ids(&next.transactions);
+        got.sort();
+        assert_eq!(got, vec![id(1), id(2), id(3), id(4)]);
+        assert!(next.skipped.is_empty());
+
+        // a bounded read that never sees P's second commit keeps the same cursor
+        let again = run_page(&written, &page.next, never());
+        assert!(again.exhausted);
+        assert!(again.transactions.is_empty());
+        assert_eq!(again.next, page.next);
+
+        // same through end_version, and with a stop on T1's second chunk
+        let scanner = ProfileScanner::new().end_version(3);
+        let bounded = |cursor: &Cursor, should_stop: &mut dyn FnMut() -> bool| {
+            let range = scanner.range(cursor);
+            let rows = rows
+                .iter()
+                .filter(|(k, _)| *k >= range.begin && *k < range.end)
+                .cloned()
+                .map(Ok::<_, Infallible>)
+                .collect();
+            read(&scanner, cursor, rows, should_stop).unwrap()
+        };
+        let page = bounded(&Cursor::beginning(), &mut never());
+        assert_eq!(txn_ids(&page.transactions), vec![id(0)]);
+        assert_eq!(page.next.key(), t1_first.as_slice());
+        let stop_on_t1 = written
+            .iter()
+            .position(|(k, _)| k[ID_START..ID_END] == id(1) && k[VERSIONSTAMP_START..] >= v2[..])
+            .unwrap()
+            + 1;
+        let page = bounded(&Cursor::beginning(), &mut after(stop_on_t1));
+        assert!(!page.exhausted);
+        assert_eq!(txn_ids(&page.transactions), vec![id(0)]);
+        assert_eq!(page.next.key(), t1_first.as_slice());
+    }
+
+    #[test]
+    fn end_of_range_cut_also_drops_broken_reports_read_again() {
+        let (v1, v2) = (vs(1, 0), vs(2, 0));
+        let mut rows: Rows = Vec::new();
+        rows.extend(txn(1, &[v1, v2])); // pending at the end of the range
+        rows.push((key(v1, id(2), 2, 3), Vec::new())); // orphan chunks of id 2
+        rows.push((key(v2, id(2), 3, 3), Vec::new()));
+        rows.sort();
+        let written: Rows = rows
+            .iter()
+            .filter(|(k, _)| !(k[VERSIONSTAMP_START..] >= v2[..] && k[ID_START..ID_END] == id(1)))
+            .cloned()
+            .collect();
+        let page = run_page(&written, &Cursor::beginning(), never());
+        // id 2's report is left to the next page, which reads its chunks again
+        assert!(page.skipped.is_empty());
+        assert_eq!(page.next.key(), rows[0].0.as_slice());
+        let page = run_page(&rows, &page.next, never());
+        assert_eq!(txn_ids(&page.transactions), vec![id(1)]);
+        assert_eq!(skipped_ids(&page.skipped), vec![id(2)]);
+    }
+
+    /// Checks that `txs` and `skipped` hold every id of `all` once: returned at most once,
+    /// otherwise reported broken.
+    fn assert_each_once(
+        all: &BTreeSet<[u8; 16]>,
+        (txs, skipped): (Vec<ProfiledTransaction>, Vec<Skipped>),
+        context: &str,
+    ) -> BTreeSet<[u8; 16]> {
+        let returned: BTreeSet<_> = txn_ids(&txs).into_iter().collect();
+        assert_eq!(returned.len(), txs.len(), "twice: {context}");
+        assert!(
+            skipped.iter().all(|s| s.reason == SkipReason::BrokenChunks),
+            "{context}"
+        );
+        let broken: BTreeSet<_> = skipped_ids(&skipped).into_iter().collect();
+        // lost only by being broken by a stop
+        assert!(returned.is_disjoint(&broken), "{context}");
+        assert_eq!(
+            &returned.union(&broken).copied().collect::<BTreeSet<_>>(),
+            all,
+            "{context}"
+        );
+        broken
+    }
+
+    #[test]
+    fn paging_returns_every_transaction_at_most_once() {
+        let (v1, v2, v3) = (vs(1, 0), vs(2, 0), vs(3, 0));
+        let mut rows: Rows = Vec::new();
+        rows.extend(txn(1, &[v1, v1, v2]));
+        rows.extend(txn(2, &[v1]));
+        rows.extend(txn(3, &[v1, v2]));
+        rows.extend(txn(4, &[v2]));
+        rows.extend(txn(5, &[v2, v2]));
+        rows.extend(txn(6, &[v2, v3, v3]));
+        rows.extend(txn(7, &[v3]));
+        rows.extend(txn(8, &[v3, v3, v3]));
+        rows.extend(txn(9, &[v3]));
+        rows.sort();
+        let all: BTreeSet<[u8; 16]> = (1..=9).map(id).collect();
+
+        let (txs, skipped) = run_pages(&rows, never);
+        assert!(skipped.is_empty());
+        assert_eq!(txs.len(), all.len());
+        assert_eq!(txn_ids(&txs).into_iter().collect::<BTreeSet<_>>(), all);
+
+        for k in 1..=rows.len() {
+            assert_each_once(&all, run_pages(&rows, || every(k)), &format!("every {k}"));
+            let broken =
+                assert_each_once(&all, run_pages(&rows, || after(k)), &format!("after {k}"));
+            if k == rows.len() {
+                // a page long enough to read everything from any cursor loses nothing
+                assert!(broken.is_empty());
+            }
+        }
+        for m in 2..=6 {
+            for seed in 0..50 {
+                let state = Cell::new(seed);
+                assert_each_once(
+                    &all,
+                    run_pages(&rows, || random(&state, m)),
+                    &format!("random m {m} seed {seed}"),
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn paging_single_chunk_transactions_returns_each_exactly_once() {
+        let mut rows: Rows = Vec::new();
+        for n in 0..9u8 {
+            rows.extend(txn(n, &[vs(u64::from(n / 3), 0)]));
+        }
+        rows.sort();
+        let expected: Vec<_> = (0..9).map(id).collect();
+        for k in 1..=5 {
+            let (txs, skipped) = run_pages(&rows, || every(k));
+            assert!(skipped.is_empty(), "every {k}");
+            let mut got = txn_ids(&txs);
+            got.sort();
+            assert_eq!(got, expected, "every {k}");
+        }
+        for seed in 0..50 {
+            let state = Cell::new(seed);
+            let (txs, skipped) = run_pages(&rows, || random(&state, 3));
+            assert!(skipped.is_empty(), "seed {seed}");
+            let mut got = txn_ids(&txs);
+            got.sort();
+            assert_eq!(got, expected, "seed {seed}");
+        }
+    }
+
+    #[test]
+    fn invalid_rows_are_rejected() {
+        let scanner = ProfileScanner::new();
+        let (a, b) = (key(vs(1, 0), id(1), 1, 1), key(vs(2, 0), id(2), 1, 1));
+        let ok = |k: &Vec<u8>| Ok::<_, Infallible>((k.clone(), Vec::new()));
+        let invalid = |result: Result<Page, ScanError<Infallible>>| match result {
+            Err(ScanError::InvalidRows { key }) => key,
+            other => panic!("{other:?}"),
+        };
+        // out of order, and a repeated key
+        let rows = vec![ok(&b), ok(&a)];
+        assert_eq!(
+            invalid(read(&scanner, &Cursor::beginning(), rows, never())),
+            a
+        );
+        let rows = vec![ok(&a), ok(&a)];
+        assert_eq!(
+            invalid(read(&scanner, &Cursor::beginning(), rows, never())),
+            a
+        );
+        // before the cursor
+        let rows = vec![ok(&a)];
+        assert_eq!(
+            invalid(read(&scanner, &Cursor::at_version(2), rows, never())),
+            a
+        );
+        // at or past end_version, and outside the keyspace
+        let rows = vec![ok(&a), ok(&b)];
+        let bounded = scanner.clone().end_version(2);
+        assert_eq!(
+            invalid(read(&bounded, &Cursor::beginning(), rows, never())),
+            b
+        );
+        let rows = vec![ok(&PROFILE_END.to_vec())];
+        assert_eq!(
+            invalid(read(&scanner, &Cursor::beginning(), rows, never())),
+            PROFILE_END.to_vec()
+        );
+        let outside = b"\xff\x02/other".to_vec();
+        let rows = vec![ok(&outside)];
+        assert_eq!(
+            invalid(read(&scanner, &Cursor::beginning(), rows, never())),
+            outside
+        );
+    }
+
+    #[test]
+    fn source_error_is_propagated() {
+        let rows = vec![
+            Ok((key(vs(1, 0), id(1), 1, 1), Vec::new())),
+            Err("boom"),
+            Ok((key(vs(2, 0), id(2), 1, 1), Vec::new())),
+        ];
+        match read(&ProfileScanner::new(), &Cursor::beginning(), rows, never()) {
+            Err(ScanError::Source("boom")) => {}
+            other => panic!("{other:?}"),
+        }
+    }
+
+    /// A caller's error type, the way `FdbBindingError` looks from `into_error`'s point of
+    /// view: a `From` impl for the stream's error, and a catch-all for anything boxed.
+    #[derive(Debug)]
+    enum TargetError {
+        Source(io::Error),
+        Custom(Box<dyn std::error::Error + Send + Sync>),
+    }
+
+    impl From<io::Error> for TargetError {
+        fn from(err: io::Error) -> Self {
+            TargetError::Source(err)
+        }
+    }
+
+    #[test]
+    fn into_error_maps_source_through_from() {
+        let err: ScanError<io::Error> = ScanError::Source(io::Error::other("boom"));
+        match err.into_error(TargetError::Custom) {
+            TargetError::Source(err) => assert_eq!(err.to_string(), "boom"),
+            other => panic!("{other:?}"),
+        }
+    }
+
+    #[test]
+    fn into_error_boxes_invalid_rows_for_custom() {
+        let key = b"row-key".to_vec();
+        let err: ScanError<io::Error> = ScanError::InvalidRows { key: key.clone() };
+        match err.into_error(TargetError::Custom) {
+            TargetError::Custom(boxed) => {
+                // the message is preserved, with the key readable in it
+                assert_eq!(
+                    boxed.to_string(),
+                    format!(
+                        "profiling row {key:?} is outside the scanned range or not after the previous row"
+                    )
+                );
+                // and the original variant, still carrying the key, downcasts out of it
+                match boxed
+                    .downcast_ref::<ScanError<Infallible>>()
+                    .expect("boxed error downcasts to ScanError<Infallible>")
+                {
+                    ScanError::InvalidRows { key: got } => assert_eq!(got, &key),
+                    other => panic!("{other:?}"),
+                }
+            }
+            other => panic!("{other:?}"),
+        }
+    }
+
+    #[test]
+    fn range_is_the_cursor_to_end_version_and_never_inverted() {
+        let scanner = ProfileScanner::new();
+        let cursor = Cursor::at_version(5);
+        assert_eq!(
+            scanner.range(&cursor),
+            ScanRange {
+                begin: cursor.as_bytes().to_vec(),
+                end: PROFILE_END.to_vec(),
+            }
+        );
+        let bounded = scanner.end_version(7);
+        assert_eq!(bounded.range(&cursor).end, Cursor::at_version(7).as_bytes());
+        // at or past end_version, the range is empty and the page keeps the cursor
+        for version in [7, 9] {
+            let cursor = Cursor::at_version(version);
+            let range = bounded.range(&cursor);
+            assert_eq!(range.begin, cursor.as_bytes());
+            assert_eq!(range.end, range.begin);
+            let page = read(
+                &bounded,
+                &cursor,
+                Vec::<Result<_, Infallible>>::new(),
+                always(),
+            )
+            .unwrap();
+            assert!(page.exhausted);
+            assert_eq!(page.next, cursor);
+        }
+    }
+
+    #[test]
+    fn empty_range_keeps_the_cursor() {
+        let cursor = Cursor::at_version(42);
+        let page = run_page(&Vec::new(), &cursor, always());
+        assert!(page.exhausted);
+        assert_eq!(page.next, cursor);
+    }
+
+    #[test]
+    fn page_decodes_and_reports_skips() {
+        let valid = ProtocolVersion::V7_4.0.to_le_bytes().to_vec();
+        let rows: Rows = vec![
+            (key(vs(5, 0), id(1), 1, 1), valid),
+            (key(vs(5, 0), id(2), 2, 2), Vec::new()),
+            (key(vs(5, 0), id(3), 1, 1), b"garbage".to_vec()),
+        ];
+        let page = run_page(&rows, &Cursor::beginning(), never());
+        assert_eq!(
+            page.transactions,
+            vec![ProfiledTransaction {
+                version: 5,
+                versionstamp: vs(5, 0),
+                id: id(1),
+                protocol_version: ProtocolVersion::V7_4,
+                events: vec![],
+            }]
+        );
+        assert_eq!(page.skipped.len(), 2);
+        assert_eq!(page.skipped[0].reason, SkipReason::BrokenChunks);
+        assert!(matches!(page.skipped[1].reason, SkipReason::Decode(_)));
+        assert_eq!(page.next.key(), key_after(&rows[2].0).as_slice());
+        assert!(page.exhausted);
+    }
+
+    #[test]
+    fn cursor_round_trip_and_validation() {
+        let a = key(vs(1, 0), id(1), 1, 2);
+        for cursor in [
+            Cursor::beginning(),
+            Cursor::at_version(0),
+            Cursor::at_version(123_456),
+            Cursor::from_bytes(a.clone()).unwrap(),
+        ] {
+            assert_eq!(
+                Cursor::from_bytes(cursor.as_bytes().to_vec()),
+                Ok(cursor.clone())
+            );
+        }
+        assert_eq!(Cursor::beginning().as_bytes(), PROFILE_PREFIX);
+        assert_eq!(Cursor::at_version(-5), Cursor::at_version(0));
+        let v7 = [PROFILE_PREFIX.as_slice(), &7i64.to_be_bytes(), b"\x00\x00"].concat();
+        assert_eq!(Cursor::at_version(7).as_bytes(), v7.as_slice());
+
+        let garbage: Vec<Vec<u8>> = vec![
+            Vec::new(),
+            b"nope".to_vec(),
+            PROFILE_PREFIX[..PROFILE_PREFIX.len() - 1].to_vec(),
+            b"\xff\xff".to_vec(),
+            // the former two-key format
+            [&[1u8, 0, 0, 0, 32][..], PROFILE_PREFIX, PROFILE_PREFIX].concat(),
+        ];
+        for bytes in garbage {
+            assert_eq!(
+                Cursor::from_bytes(bytes.clone()),
+                Err(InvalidCursor),
+                "{bytes:?}"
+            );
+        }
+    }
+}
diff --git a/bindings/rust/foundationdb-profiling/tests/decode_all.rs b/bindings/rust/foundationdb-profiling/tests/decode_all.rs
new file mode 100644
index 00000000000..36e203b50a5
--- /dev/null
+++ b/bindings/rust/foundationdb-profiling/tests/decode_all.rs
@@ -0,0 +1,542 @@
+//! Decodes every transaction currently in the client profiling keyspace, as a check that
+//! the decoder handles real client-written data, not just the fixtures and the small
+//! scenarios `read_page.rs` writes itself.
+//!
+//! The C++ client only flushes sampled transactions every `CSI_STATUS_DELAY` (10 seconds
+//! by default) and drops whatever is still queued at process exit, so a short `cargo test
+//! -p foundationdb` run is not a dependable source of profiling data on its own. This test
+//! therefore generates its own varied traffic (gets, a range read, a plain set, a clear, a
+//! clear range, several atomic ops, a commit conflict, and a best-effort read error) under
+//! a unique key prefix before decoding, so it always has something of its own to find. It
+//! enables client profiling itself (and restores the previous setting) when it finds it
+//! disabled, the way `read_page.rs` does, so it also works against a fresh local cluster.
+//! On CI, `.github/workflows/profiling.yml` already enables profiling cluster-wide and
+//! runs the `foundationdb` crate's test suite first as extra background traffic. It is
+//! `#[ignore]`d so that a plain `cargo test -p foundationdb-profiling` does not depend on a
+//! live cluster.
+
+use foundationdb::options::{MutationType, TransactionOption};
+use foundationdb::tuple::pack;
+use foundationdb::{ClientBudget, Database, FdbBindingError, KeySelector, RangeOption};
+use foundationdb_profiling::{
+    Aggregator, Cursor, Event, Mutation, Page, ProfileScanner, ProfiledTransaction, SkipReason,
+};
+use futures_util::{FutureExt, TryStreamExt};
+use std::collections::BTreeMap;
+use std::panic::AssertUnwindSafe;
+use std::time::{Duration, SystemTime};
+
+/// Upper bound on the number of pages read, so a bug that never exhausts the range fails
+/// fast instead of hanging.
+const MAX_PAGES: usize = 100_000;
+/// How long to wait, and how many times, for our own traffic to be flushed and show up in
+/// a page starting at the version read before we wrote anything.
+const MARKER_POLL_INTERVAL: Duration = Duration::from_secs(2);
+const MARKER_POLL_ATTEMPTS: usize = 30;
+
+const SAMPLE_RATE_KEY: &[u8] =
+    b"\xff\xff/global_config/config/fdb_client_info/client_txn_sample_rate";
+const SIZE_LIMIT_KEY: &[u8] =
+    b"\xff\xff/global_config/config/fdb_client_info/client_txn_size_limit";
+
+#[tokio::test]
+#[ignore = "needs a live cluster, see profiling.yml"]
+async fn decode_all_client_latency_transactions() {
+    let db = Database::default().expect("database");
+    let nanos = SystemTime::now()
+        .duration_since(SystemTime::UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    let prefix = format!("fdbrs_profiling_decode_all/{}_{nanos}/", std::process::id()).into_bytes();
+
+    let previous = read_profiling_config(&db).await;
+    let restore_profiling = previous.0.is_none();
+    if restore_profiling {
+        set_profiling_config(&db, Some(pack(&1.0f64)), Some(pack(&-1i64))).await;
+        // The client picks up a global config change asynchronously; give it a moment
+        // before generating traffic, so the very first transaction is not sampled out.
+        tokio::time::sleep(MARKER_POLL_INTERVAL).await;
+    }
+
+    let result = AssertUnwindSafe(run(&db, prefix.clone()))
+        .catch_unwind()
+        .await;
+
+    if restore_profiling {
+        set_profiling_config(&db, previous.0, previous.1).await;
+    }
+    cleanup(&db, &prefix).await;
+
+    if let Err(panic) = result {
+        std::panic::resume_unwind(panic);
+    }
+}
+
+/// Generates the test's own traffic, waits for it to show up, then decodes and checks the
+/// whole profiling keyspace.
+async fn run(db: &Database, prefix: Vec<u8>) {
+    let start = read_version(db).await;
+    let markers = generate_traffic(db, prefix).await;
+    wait_for_markers(db, start, &markers.prefix).await;
+    scan_and_assert(db, &markers).await;
+}
+
+/// Unique keys and ranges used to positively identify our own traffic among everything
+/// else that may be in the profiling keyspace (other tests, other CI traffic).
+struct Markers {
+    prefix: Vec<u8>,
+    hit_key: Vec<u8>,
+    miss_key: Vec<u8>,
+    range: (Vec<u8>, Vec<u8>),
+    set_key: Vec<u8>,
+    clear_key: Vec<u8>,
+    clear_range: (Vec<u8>, Vec<u8>),
+    add_key: Vec<u8>,
+    max_key: Vec<u8>,
+    byte_min_key: Vec<u8>,
+    versionstamp_key: Vec<u8>,
+    conflict_key: Vec<u8>,
+    too_old_key: Vec<u8>,
+}
+
+impl Markers {
+    fn new(prefix: Vec<u8>) -> Self {
+        let key = |name: &str| [prefix.as_slice(), name.as_bytes()].concat();
+        Markers {
+            hit_key: key("hit"),
+            miss_key: key("miss"),
+            range: (key("range/"), key("range0")),
+            set_key: key("set"),
+            clear_key: key("clear"),
+            clear_range: (key("clear_range/"), key("clear_range0")),
+            add_key: key("add"),
+            max_key: key("max"),
+            byte_min_key: key("byte_min"),
+            versionstamp_key: key("versionstamp"),
+            conflict_key: key("conflict"),
+            too_old_key: key("too_old"),
+            prefix,
+        }
+    }
+
+    /// Marks off which of our own scenarios a decoded event belongs to.
+    fn record(&self, event: &Event, found: &mut Found) {
+        match event {
+            Event::Get(g) if g.key == self.hit_key => found.hit = true,
+            Event::Get(g) if g.key == self.miss_key => found.miss = true,
+            Event::GetRange(gr)
+                if gr.range.begin == self.range.0 && gr.range.end == self.range.1 =>
+            {
+                found.range = true;
+            }
+            Event::GetError(e) if e.key == self.too_old_key && e.error_code == 1007 => {
+                found.too_old = true;
+            }
+            Event::Commit(c) => {
+                for mutation in &c.request.mutations {
+                    self.record_mutation(mutation, found);
+                }
+            }
+            Event::CommitError(c) if c.error_code == 1020 => {
+                if c.request
+                    .mutations
+                    .iter()
+                    .any(|m| m.param1 == self.conflict_key)
+                {
+                    found.conflict = true;
+                }
+            }
+            _ => {}
+        }
+    }
+
+    fn record_mutation(&self, m: &Mutation, found: &mut Found) {
+        if m.mutation_type == Mutation::SET_VALUE && m.param1 == self.set_key {
+            found.set = true;
+        } else if m.mutation_type == Mutation::CLEAR_RANGE && m.param1 == self.clear_key {
+            found.clear = true;
+        } else if m.mutation_type == Mutation::CLEAR_RANGE
+            && m.param1 == self.clear_range.0
+            && m.param2 == self.clear_range.1
+        {
+            found.clear_range = true;
+        } else if m.mutation_type == Mutation::ADD_VALUE && m.param1 == self.add_key {
+            found.add = true;
+        } else if m.mutation_type == Mutation::MAX && m.param1 == self.max_key {
+            found.max = true;
+        } else if m.mutation_type == Mutation::BYTE_MIN && m.param1 == self.byte_min_key {
+            found.byte_min = true;
+        } else if m.mutation_type == Mutation::SET_VERSIONSTAMPED_VALUE
+            && m.param1 == self.versionstamp_key
+        {
+            found.versionstamp = true;
+        }
+    }
+}
+
+/// Which of the marker scenarios have been seen decoded so far.
+#[derive(Default)]
+struct Found {
+    hit: bool,
+    miss: bool,
+    range: bool,
+    set: bool,
+    clear: bool,
+    clear_range: bool,
+    add: bool,
+    max: bool,
+    byte_min: bool,
+    versionstamp: bool,
+    conflict: bool,
+    /// Best-effort: a freshly started cluster may still have version 1 inside its MVCC
+    /// window, in which case the read never errors. Never asserted on its own.
+    too_old: bool,
+}
+
+impl Found {
+    /// Names of the scenarios (other than the best-effort read error) not yet observed.
+    fn missing(&self) -> Vec<&'static str> {
+        let checks: [(&str, bool); 11] = [
+            ("get (hit)", self.hit),
+            ("get (miss)", self.miss),
+            ("get_range", self.range),
+            ("set", self.set),
+            ("clear", self.clear),
+            ("clear_range", self.clear_range),
+            ("atomic add", self.add),
+            ("atomic max", self.max),
+            ("atomic byte_min", self.byte_min),
+            ("atomic set_versionstamped_value", self.versionstamp),
+            ("commit conflict", self.conflict),
+        ];
+        checks
+            .into_iter()
+            .filter(|(_, ok)| !ok)
+            .map(|(name, _)| name)
+            .collect()
+    }
+}
+
+/// Writes the test's own traffic: gets (hit and miss), a range read, a plain set, a clear,
+/// a clear range, atomic add/max/byte_min/set_versionstamped_value, one commit conflict,
+/// and a best-effort read error. Every transaction is dropped as soon as it is done with
+/// (committed, or explicitly dropped for read-only ones), since the C++ client only
+/// records a sampled transaction's events when its native transaction is destroyed.
+async fn generate_traffic(db: &Database, prefix: Vec<u8>) -> Markers {
+    let m = Markers::new(prefix);
+
+    // get: hit and miss.
+    let trx = db.create_trx().expect("trx");
+    trx.set(&m.hit_key, b"present");
+    trx.commit().await.expect("commit hit seed");
+
+    let trx = db.create_trx().expect("trx");
+    trx.get(&m.hit_key, false).await.expect("get hit");
+    drop(trx);
+
+    let trx = db.create_trx().expect("trx");
+    let miss = trx.get(&m.miss_key, false).await.expect("get miss");
+    assert!(miss.is_none(), "miss key unexpectedly present");
+    drop(trx);
+
+    // get_range.
+    let trx = db.create_trx().expect("trx");
+    trx.set(&[m.range.0.as_slice(), b"x"].concat(), b"v");
+    trx.commit().await.expect("commit range seed");
+
+    let trx = db.create_trx().expect("trx");
+    let range = RangeOption::from((m.range.0.clone(), m.range.1.clone()));
+    trx.get_range(&range, 1, false).await.expect("get_range");
+    drop(trx);
+
+    // set.
+    let trx = db.create_trx().expect("trx");
+    trx.set(&m.set_key, b"set-value");
+    trx.commit().await.expect("commit set");
+
+    // clear (single key).
+    let trx = db.create_trx().expect("trx");
+    trx.set(&m.clear_key, b"to-clear");
+    trx.commit().await.expect("commit clear seed");
+    let trx = db.create_trx().expect("trx");
+    trx.clear(&m.clear_key);
+    trx.commit().await.expect("commit clear");
+
+    // clear_range.
+    let trx = db.create_trx().expect("trx");
+    trx.set(&m.clear_range.0, b"v");
+    trx.commit().await.expect("commit clear_range seed");
+    let trx = db.create_trx().expect("trx");
+    trx.clear_range(&m.clear_range.0, &m.clear_range.1);
+    trx.commit().await.expect("commit clear_range");
+
+    // atomic ops.
+    let trx = db.create_trx().expect("trx");
+    trx.atomic_op(&m.add_key, &1i64.to_le_bytes(), MutationType::Add);
+    trx.commit().await.expect("commit add");
+
+    let trx = db.create_trx().expect("trx");
+    trx.atomic_op(&m.max_key, &1i64.to_le_bytes(), MutationType::Max);
+    trx.commit().await.expect("commit max");
+
+    let trx = db.create_trx().expect("trx");
+    trx.atomic_op(&m.byte_min_key, b"m", MutationType::ByteMin);
+    trx.commit().await.expect("commit byte_min");
+
+    let trx = db.create_trx().expect("trx");
+    // Versionstamp placeholder (10 zero bytes) plus the little-endian offset (0) pointing
+    // at it: any valid transform works, this test does not read the value back.
+    let mut versionstamped_value = vec![0u8; 10];
+    versionstamped_value.extend_from_slice(&0i32.to_le_bytes());
+    trx.atomic_op(
+        &m.versionstamp_key,
+        &versionstamped_value,
+        MutationType::SetVersionstampedValue,
+    );
+    trx.commit().await.expect("commit versionstamped value");
+
+    // One commit conflict: the reader reads the key, the writer commits a change to it
+    // first, then the reader's own commit fails with not_committed (1020).
+    let reader = db.create_trx().expect("trx");
+    reader
+        .get(&m.conflict_key, false)
+        .await
+        .expect("get conflict key");
+    let writer = db.create_trx().expect("trx");
+    writer.set(&m.conflict_key, b"writer");
+    writer.commit().await.expect("commit writer");
+    reader.set(&m.conflict_key, b"reader");
+    let conflict_result = reader.commit().await;
+    match &conflict_result {
+        Err(e) if e.code() == 1020 => {}
+        other => panic!("expected a commit conflict (error 1020), got {other:?}"),
+    }
+    drop(conflict_result);
+
+    // Best-effort read error: a read version far enough in the past to have left the MVCC
+    // window gives transaction_too_old (1007). Not asserted here: on a cluster started
+    // just for this test run, version 1 may still be inside the window.
+    let trx = db.create_trx().expect("trx");
+    trx.set_read_version(1);
+    let _ = trx.get(&m.too_old_key, false).await;
+    drop(trx);
+
+    m
+}
+
+/// Polls `read_page` from `start` until a transaction touching `prefix` shows up, or gives
+/// up after [`MARKER_POLL_ATTEMPTS`]. The scan that follows checks the actual outcome.
+async fn wait_for_markers(db: &Database, start: i64, prefix: &[u8]) {
+    let cursor = Cursor::at_version(start);
+    for attempt in 0..MARKER_POLL_ATTEMPTS {
+        let page = read_one_page(db, &cursor).await;
+        if page
+            .transactions
+            .iter()
+            .any(|tx| transaction_touches_prefix(tx, prefix))
+        {
+            return;
+        }
+        if attempt + 1 < MARKER_POLL_ATTEMPTS {
+            tokio::time::sleep(MARKER_POLL_INTERVAL).await;
+        }
+    }
+}
+
+fn transaction_touches_prefix(tx: &ProfiledTransaction, prefix: &[u8]) -> bool {
+    tx.events
+        .iter()
+        .any(|event| transaction_touches_prefix_event(event, prefix))
+}
+
+fn transaction_touches_prefix_event(event: &Event, prefix: &[u8]) -> bool {
+    match event {
+        Event::Get(g) => g.key.starts_with(prefix),
+        Event::GetRange(gr) => {
+            gr.range.begin.starts_with(prefix) || gr.range.end.starts_with(prefix)
+        }
+        Event::GetError(e) => e.key.starts_with(prefix),
+        Event::GetRangeError(e) => {
+            e.range.begin.starts_with(prefix) || e.range.end.starts_with(prefix)
+        }
+        Event::Commit(c) => c
+            .request
+            .mutations
+            .iter()
+            .any(|m| m.param1.starts_with(prefix)),
+        Event::CommitError(c) => c
+            .request
+            .mutations
+            .iter()
+            .any(|m| m.param1.starts_with(prefix)),
+        Event::GetVersion(_) => false,
+        _ => false,
+    }
+}
+
+/// Decodes the whole profiling keyspace and checks it: no decode errors, and every one of
+/// our own marker scenarios (other than the best-effort read error) was decoded.
+async fn scan_and_assert(db: &Database, markers: &Markers) {
+    let mut cursor = Cursor::beginning();
+    let mut aggregator = Aggregator::default();
+    let mut total_transactions = 0usize;
+    let mut event_counts: BTreeMap<&'static str, usize> = BTreeMap::new();
+    let mut decode_errors = Vec::new();
+    let mut broken_chunks = 0usize;
+    let mut found = Found::default();
+
+    for _ in 0..MAX_PAGES {
+        let page = read_one_page(db, &cursor).await;
+
+        for tx in &page.transactions {
+            total_transactions += 1;
+            for event in &tx.events {
+                *event_counts.entry(event_name(event)).or_insert(0) += 1;
+                markers.record(event, &mut found);
+            }
+            aggregator.record(tx);
+        }
+        for skipped in &page.skipped {
+            match &skipped.reason {
+                SkipReason::Decode(err) => {
+                    decode_errors.push((skipped.versionstamp, skipped.id, err.clone()));
+                }
+                SkipReason::BrokenChunks => {
+                    broken_chunks += 1;
+                    println!(
+                        "broken chunks: versionstamp={:?} id={:?}",
+                        skipped.versionstamp, skipped.id
+                    );
+                }
+                _ => {}
+            }
+        }
+
+        cursor = page.next;
+        if page.exhausted {
+            break;
+        }
+    }
+
+    println!("transactions decoded: {total_transactions}");
+    println!("broken chunks skipped: {broken_chunks}");
+    println!("event counts:");
+    for (name, count) in &event_counts {
+        println!("  {name}: {count}");
+    }
+    println!("reads total: {}", aggregator.reads().total());
+    println!("writes total: {}", aggregator.writes().total());
+
+    if !decode_errors.is_empty() {
+        for (versionstamp, id, err) in &decode_errors {
+            println!("decode error: versionstamp={versionstamp:?} id={id:?} error={err}");
+        }
+        panic!(
+            "{} transaction(s) failed to decode, see printed ids/errors above",
+            decode_errors.len()
+        );
+    }
+    assert!(
+        total_transactions >= 1,
+        "no transactions were read; is client profiling enabled and has the cluster served traffic?"
+    );
+
+    let missing = found.missing();
+    assert!(
+        missing.is_empty(),
+        "marker transaction(s) were not decoded: {missing:?}"
+    );
+    if !found.too_old {
+        println!("note: the best-effort transaction_too_old marker was not observed, skipping it");
+    }
+}
+
+/// Reads one page bounded by a 2 second time budget, like the crate docs example.
+async fn read_one_page(db: &Database, cursor: &Cursor) -> Page {
+    let scanner = ProfileScanner::new();
+    db.run(|trx, _| {
+        let scanner = scanner.clone();
+        let cursor = cursor.clone();
+        async move {
+            trx.set_option(TransactionOption::ReadSystemKeys)?;
+            trx.set_client_budget(ClientBudget {
+                time_limit: Some(Duration::from_secs(2)),
+                ..ClientBudget::default()
+            });
+            let range = scanner.range(&cursor);
+            let opt = RangeOption::from((
+                KeySelector::first_greater_or_equal(range.begin.as_slice()),
+                KeySelector::first_greater_or_equal(range.end.as_slice()),
+            ));
+            let rows = trx
+                .get_ranges_keyvalues(opt, true)
+                .map_ok(|kv| (kv.key().to_vec(), kv.value().to_vec()));
+            let page = scanner
+                .read_page(&cursor, rows, || trx.check_client_budget().is_err())
+                .await
+                .map_err(|err| err.into_error(FdbBindingError::new_custom_error))?;
+            Ok::<_, FdbBindingError>(page)
+        }
+    })
+    .await
+    .expect("read_page")
+}
+
+async fn read_version(db: &Database) -> i64 {
+    let trx = db.create_trx().expect("trx");
+    trx.get_read_version().await.expect("read version")
+}
+
+async fn read_profiling_config(db: &Database) -> (Option<Vec<u8>>, Option<Vec<u8>>) {
+    db.run(|trx, _| async move {
+        let rate = trx.get(SAMPLE_RATE_KEY, false).await?.map(|v| v.to_vec());
+        let size = trx.get(SIZE_LIMIT_KEY, false).await?.map(|v| v.to_vec());
+        Ok::<_, FdbBindingError>((rate, size))
+    })
+    .await
+    .expect("read profiling config")
+}
+
+/// Writes the global profiling configuration, `None` meaning `default` (what
+/// `fdbcli> profile client set default default` writes).
+async fn set_profiling_config(db: &Database, rate: Option<Vec<u8>>, size: Option<Vec<u8>>) {
+    let rate = rate.unwrap_or_else(|| pack(&f64::INFINITY));
+    let size = size.unwrap_or_else(|| pack(&-1i64));
+    db.run(|trx, _| {
+        let (rate, size) = (rate.clone(), size.clone());
+        async move {
+            trx.set_option(TransactionOption::SpecialKeySpaceEnableWrites)?;
+            trx.set(SAMPLE_RATE_KEY, &rate);
+            trx.set(SIZE_LIMIT_KEY, &size);
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await
+    .expect("set profiling config");
+}
+
+async fn cleanup(db: &Database, prefix: &[u8]) {
+    let end = [prefix, b"\xff".as_slice()].concat();
+    db.run(|trx, _| {
+        let (begin, end) = (prefix.to_vec(), end.clone());
+        async move {
+            trx.clear_range(&begin, &end);
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await
+    .expect("cleanup");
+}
+
+fn event_name(event: &Event) -> &'static str {
+    match event {
+        Event::GetVersion(_) => "GetVersion",
+        Event::Get(_) => "Get",
+        Event::GetRange(_) => "GetRange",
+        Event::Commit(_) => "Commit",
+        Event::GetError(_) => "GetError",
+        Event::GetRangeError(_) => "GetRangeError",
+        Event::CommitError(_) => "CommitError",
+        _ => "Unknown",
+    }
+}
diff --git a/bindings/rust/foundationdb-profiling/tests/fixtures/commit_7_4.bin b/bindings/rust/foundationdb-profiling/tests/fixtures/commit_7_4.bin
new file mode 100644
index 0000000000000000000000000000000000000000..366b66e092401b0734e86484c48a85b3e24c018a
GIT binary patch
literal 614
zcmZQzU?|zZaGRe22!hLW?)j{}<p^R!zyW)E5Tlp<sjexIW(4BXjp&MWGr@{PfRbq`
zNkzr+1x5L3@oAYAC8b5F`iV?H@&4`TntrH&HHqTT#DK%JDrTStuDxic9Vn==X9Y^k
z2RhKa>K)vzI1EX|Ar3Yir;C8*GvJU+0?FZWaxxCvQa~<d#A_lW4z0;jK&@E9Iyt{I
ruOzjIQ5vr_E{CSzl1O9+npc*XQ<|!q$bjE!4v?RK7zALc2FL^epF6B=

literal 0
HcmV?d00001

diff --git a/bindings/rust/foundationdb-profiling/tests/fixtures/commit_error_7_4.bin b/bindings/rust/foundationdb-profiling/tests/fixtures/commit_error_7_4.bin
new file mode 100644
index 0000000000000000000000000000000000000000..6a799e6c1a68472aef6222a01c44b5e8a761233d
GIT binary patch
literal 312
zcmZQzU?|zZaGRe22r4HieDqm+%MrwefE8NyAVz~~v5_f|W(4AMlhGA@5C<!g21=%-
zBo!6M7Zl~E#iwOfl#~{w>L=&trR8KMm#_h)izO5h7W`pmU|<3Y%HY=rlx1KL1LFVs
z!Or@IO&uNEHQ&G4`bvz=Ghu%LSQcc8BoJe<J-;L)wFs;TzY!pxF-YJs1Eio577jo*
E035+n!T<mO

literal 0
HcmV?d00001

diff --git a/bindings/rust/foundationdb-profiling/tests/read_page.rs b/bindings/rust/foundationdb-profiling/tests/read_page.rs
new file mode 100644
index 00000000000..e25df873c49
--- /dev/null
+++ b/bindings/rust/foundationdb-profiling/tests/read_page.rs
@@ -0,0 +1,336 @@
+//! Integration tests of `ProfileScanner::read_page` against a live cluster.
+//!
+//! The test enables client profiling for the whole cluster (sample rate 1.0, like
+//! `fdbcli> profile client set 1.0 default`), writes a few transactions, waits for the
+//! client to flush them, reads them back, then restores the previous profiling settings
+//! and clears the keys it wrote. Everything runs in a single test so that no other test
+//! can switch profiling off under it.
+
+use foundationdb::options::TransactionOption;
+use foundationdb::tuple::pack;
+use foundationdb::{ClientBudget, Database, FdbBindingError, KeySelector, RangeOption};
+use foundationdb_profiling::{
+    Cursor, Event, Page, ProfileScanner, ProfiledTransaction, SkipReason,
+};
+use futures_util::{FutureExt, TryStreamExt};
+use std::collections::BTreeSet;
+use std::panic::AssertUnwindSafe;
+use std::time::{Duration, SystemTime};
+
+const SAMPLE_RATE_KEY: &[u8] =
+    b"\xff\xff/global_config/config/fdb_client_info/client_txn_sample_rate";
+const SIZE_LIMIT_KEY: &[u8] =
+    b"\xff\xff/global_config/config/fdb_client_info/client_txn_size_limit";
+
+/// Number of profiled transactions written by the test.
+const TXNS: usize = 5;
+/// Value size of each write, so the records span several range read batches.
+const VALUE_LEN: usize = 2048;
+
+type Id = ([u8; 10], [u8; 16]);
+
+#[tokio::test]
+async fn read_page_against_live_cluster() {
+    let db = Database::default().expect("database");
+    let nanos = SystemTime::now()
+        .duration_since(SystemTime::UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    let prefix = format!("fdbrs_profiling_test/{}_{nanos}/", std::process::id()).into_bytes();
+
+    let previous = read_profiling_config(&db).await;
+    set_profiling_config(&db, Some(pack(&1.0f64)), Some(pack(&-1i64))).await;
+
+    let result = AssertUnwindSafe(scenarios(&db, &prefix))
+        .catch_unwind()
+        .await;
+
+    set_profiling_config(&db, previous.0, previous.1).await;
+    let end = [prefix.as_slice(), b"\xff"].concat();
+    db.run(|trx, _| {
+        let (begin, end) = (prefix.clone(), end.clone());
+        async move {
+            trx.clear_range(&begin, &end);
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await
+    .expect("cleanup");
+
+    if let Err(panic) = result {
+        std::panic::resume_unwind(panic);
+    }
+}
+
+async fn scenarios(db: &Database, prefix: &[u8]) {
+    let start = read_version(db).await;
+    let ours = write_and_wait(db, prefix, start).await;
+    let max_version = ours.iter().map(|t| t.version).max().unwrap();
+    let end_version = max_version + 1;
+
+    // decoded contents of our transactions
+    for (i, tx) in ours.iter().enumerate() {
+        let key = test_key(prefix, i);
+        assert!(
+            matches!(tx.events.first(), Some(Event::GetVersion(_))),
+            "{tx:?}"
+        );
+        assert!(
+            tx.events
+                .iter()
+                .any(|e| matches!(e, Event::Get(g) if g.key == key))
+        );
+        let commit = tx
+            .events
+            .iter()
+            .find_map(|e| match e {
+                Event::Commit(c) => Some(c),
+                _ => None,
+            })
+            .expect("commit event");
+        assert_eq!(commit.request.mutations.len(), 1);
+        assert_eq!(commit.request.mutations[0].mutation_type, 0);
+        assert_eq!(commit.request.mutations[0].param1, key);
+        assert_eq!(commit.request.mutations[0].param2.len(), VALUE_LEN);
+    }
+
+    // one big page over a fixed window
+    let window_cursor = Cursor::at_version(start);
+    let window_scanner = ProfileScanner::new().end_version(end_version);
+    let full = page(db, &window_scanner, &window_cursor, Stop::Time).await;
+    assert!(full.exhausted);
+    let all = ids(&full.transactions);
+    for tx in &ours {
+        assert!(all.contains(&(tx.versionstamp, tx.id)));
+    }
+    assert!(full.transactions.iter().all(|t| t.version < end_version));
+
+    // pagination through the caller's budget: a tiny, deterministic byte budget is
+    // exceeded as soon as the first batch is read, so every page stops after its first
+    // row; and through a row count
+    let byte_budget = Stop::Budget(ClientBudget {
+        max_bytes_read: Some(1),
+        ..ClientBudget::default()
+    });
+    for stop in [byte_budget, Stop::Rows(2), Stop::Rows(3)] {
+        paginate(db, &window_scanner, &window_cursor, stop, &all, &ours).await;
+    }
+
+    // end_version is exclusive, at_version inclusive
+    let mut versions: Vec<i64> = ours.iter().map(|t| t.version).collect();
+    versions.sort();
+    let split = versions[versions.len() / 2];
+    let before = page(
+        db,
+        &window_scanner.clone().end_version(split),
+        &window_cursor,
+        Stop::Time,
+    )
+    .await;
+    assert!(before.exhausted);
+    assert!(before.transactions.iter().all(|t| t.version < split));
+    let after = page(db, &window_scanner, &Cursor::at_version(split), Stop::Time).await;
+    assert!(after.transactions.iter().all(|t| t.version >= split));
+    let mut both = ids(&before.transactions);
+    both.extend(ids(&after.transactions));
+    assert_eq!(both, all);
+    for tx in &ours {
+        let in_before = before.transactions.iter().any(|t| t.id == tx.id);
+        assert_eq!(in_before, tx.version < split);
+    }
+}
+
+fn test_key(prefix: &[u8], i: usize) -> Vec<u8> {
+    [prefix, format!("{i}").as_bytes()].concat()
+}
+
+/// Writes the test transactions and waits until all of them are flushed, rewriting the
+/// ones not seen yet (the new sample rate reaches the client asynchronously).
+async fn write_and_wait(db: &Database, prefix: &[u8], start: i64) -> Vec<ProfiledTransaction> {
+    let mut found: Vec<Option<ProfiledTransaction>> = vec![None; TXNS];
+    for _round in 0..6 {
+        for (i, slot) in found.iter().enumerate() {
+            if slot.is_none() {
+                let key = test_key(prefix, i);
+                db.run(|trx, _| {
+                    let key = key.clone();
+                    async move {
+                        trx.get(&key, false).await?;
+                        trx.set(&key, &[b'v'; VALUE_LEN]);
+                        Ok::<_, FdbBindingError>(())
+                    }
+                })
+                .await
+                .expect("write");
+            }
+        }
+        // the client flushes every CSI_STATUS_DELAY (10s)
+        for _ in 0..15 {
+            tokio::time::sleep(Duration::from_secs(1)).await;
+            let cursor = Cursor::at_version(start);
+            let scanner = ProfileScanner::new();
+            let p = page(db, &scanner, &cursor, Stop::Time).await;
+            for tx in p.transactions {
+                for (i, slot) in found.iter_mut().enumerate() {
+                    let key = test_key(prefix, i);
+                    let ours = tx
+                        .events
+                        .iter()
+                        .any(|e| matches!(e, Event::Get(g) if g.key == key));
+                    if ours && slot.is_none() {
+                        *slot = Some(tx.clone());
+                    }
+                }
+            }
+            if found.iter().all(Option::is_some) {
+                return found.into_iter().flatten().collect();
+            }
+        }
+    }
+    panic!("profiling data was not flushed: {found:?}");
+}
+
+/// How the caller bounds a page.
+#[derive(Debug, Clone)]
+enum Stop {
+    /// A 2 second time budget, like the crate docs example.
+    Time,
+    /// This client budget.
+    Budget(ClientBudget),
+    /// This many rows.
+    Rows(usize),
+}
+
+/// Reads one page in one `db.run`, the way the crate docs describe it.
+async fn page(db: &Database, scanner: &ProfileScanner, cursor: &Cursor, stop: Stop) -> Page {
+    db.run(|trx, _| {
+        let scanner = scanner.clone();
+        let cursor = cursor.clone();
+        let stop = stop.clone();
+        async move {
+            trx.set_option(TransactionOption::ReadSystemKeys)?;
+            let (budget, max_rows) = match stop {
+                Stop::Time => (
+                    ClientBudget {
+                        time_limit: Some(Duration::from_secs(2)),
+                        ..ClientBudget::default()
+                    },
+                    None,
+                ),
+                Stop::Budget(budget) => (budget, None),
+                Stop::Rows(rows) => (ClientBudget::default(), Some(rows)),
+            };
+            trx.set_client_budget(budget);
+            let range = scanner.range(&cursor);
+            let opt = RangeOption::from((
+                KeySelector::first_greater_or_equal(range.begin.as_slice()),
+                KeySelector::first_greater_or_equal(range.end.as_slice()),
+            ));
+            let rows = trx
+                .get_ranges_keyvalues(opt, true)
+                .map_ok(|kv| (kv.key().to_vec(), kv.value().to_vec()));
+            let mut read = 0;
+            let should_stop = || {
+                read += 1;
+                trx.check_client_budget().is_err() || max_rows.is_some_and(|max| read >= max)
+            };
+            let page = scanner
+                .read_page(&cursor, rows, should_stop)
+                .await
+                .map_err(|err| err.into_error(FdbBindingError::new_custom_error))?;
+            Ok::<_, FdbBindingError>(page)
+        }
+    })
+    .await
+    .expect("read_page")
+}
+
+/// Pages through the window with `stop` until exhausted, and checks that the pages
+/// return every transaction of `all` once: at most once each, all of ours (single row
+/// records) exactly once, and any other one missing only by being reported broken.
+async fn paginate(
+    db: &Database,
+    scanner: &ProfileScanner,
+    start: &Cursor,
+    stop: Stop,
+    all: &BTreeSet<Id>,
+    ours: &[ProfiledTransaction],
+) {
+    let mut cursor = start.clone();
+    let mut returned = Vec::new();
+    let mut broken = BTreeSet::new();
+    let mut stops = 0;
+    let mut exhausted = false;
+    for _ in 0..10_000 {
+        let p = page(db, scanner, &cursor, stop.clone()).await;
+        returned.extend(p.transactions);
+        for skipped in p.skipped {
+            assert_eq!(skipped.reason, SkipReason::BrokenChunks, "{stop:?}");
+            broken.insert(skipped.id);
+        }
+        // round trip through the persisted form
+        let restored = Cursor::from_bytes(p.next.as_bytes().to_vec()).expect("valid cursor");
+        assert_eq!(restored, p.next);
+        if p.exhausted {
+            exhausted = true;
+            break;
+        }
+        assert!(
+            restored.as_bytes() > cursor.as_bytes(),
+            "no progress {stop:?}"
+        );
+        cursor = restored;
+        stops += 1;
+    }
+    assert!(exhausted, "pages never exhausted {stop:?}");
+    assert!(stops > 0, "the window fits in one page {stop:?}");
+    let got = ids(&returned);
+    assert_eq!(got.len(), returned.len(), "returned twice {stop:?}");
+    for tx in ours {
+        assert!(got.contains(&(tx.versionstamp, tx.id)), "{stop:?}");
+    }
+    for id in all.difference(&got) {
+        assert!(
+            broken.contains(&id.1),
+            "{id:?} lost without a report {stop:?}"
+        );
+    }
+    assert!(got.is_subset(all), "{stop:?}");
+}
+
+fn ids(txs: &[ProfiledTransaction]) -> BTreeSet<Id> {
+    txs.iter().map(|t| (t.versionstamp, t.id)).collect()
+}
+
+async fn read_version(db: &Database) -> i64 {
+    let trx = db.create_trx().expect("trx");
+    trx.get_read_version().await.expect("read version")
+}
+
+async fn read_profiling_config(db: &Database) -> (Option<Vec<u8>>, Option<Vec<u8>>) {
+    db.run(|trx, _| async move {
+        let rate = trx.get(SAMPLE_RATE_KEY, false).await?.map(|v| v.to_vec());
+        let size = trx.get(SIZE_LIMIT_KEY, false).await?.map(|v| v.to_vec());
+        Ok::<_, FdbBindingError>((rate, size))
+    })
+    .await
+    .expect("read profiling config")
+}
+
+/// Writes the global profiling configuration, `None` meaning `default` (what
+/// `fdbcli> profile client set default default` writes).
+async fn set_profiling_config(db: &Database, rate: Option<Vec<u8>>, size: Option<Vec<u8>>) {
+    let rate = rate.unwrap_or_else(|| pack(&f64::INFINITY));
+    let size = size.unwrap_or_else(|| pack(&-1i64));
+    db.run(|trx, _| {
+        let (rate, size) = (rate.clone(), size.clone());
+        async move {
+            trx.set_option(TransactionOption::SpecialKeySpaceEnableWrites)?;
+            trx.set(SAMPLE_RATE_KEY, &rate);
+            trx.set(SIZE_LIMIT_KEY, &size);
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await
+    .expect("set profiling config");
+}
diff --git a/bindings/rust/foundationdb-recipes-simulation/Cargo.toml b/bindings/rust/foundationdb-recipes-simulation/Cargo.toml
new file mode 100644
index 00000000000..d72a13191f9
--- /dev/null
+++ b/bindings/rust/foundationdb-recipes-simulation/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "foundationdb-recipes-simulation"
+version = "0.1.0"
+edition = "2024"
+publish = false
+description = "Simulation workloads for FoundationDB recipes"
+license = "MIT OR Apache-2.0"
+
+[dependencies]
+foundationdb = { path = "../foundationdb", default-features = false, features = ["recipes", "fdb-7_4", "uuid"] }
+foundationdb-simulation = { path = "../foundationdb-simulation", features = ["fdb-7_4"] }
+futures = "0.3"
+
+[features]
+default = ["embedded-fdb-include"]
+embedded-fdb-include = [
+    "foundationdb/embedded-fdb-include",
+    "foundationdb-simulation/embedded-fdb-include",
+]
+
+[lib]
+crate-type = ["cdylib"]
diff --git a/bindings/rust/foundationdb-recipes-simulation/README.md b/bindings/rust/foundationdb-recipes-simulation/README.md
new file mode 100644
index 00000000000..3916d134e30
--- /dev/null
+++ b/bindings/rust/foundationdb-recipes-simulation/README.md
@@ -0,0 +1,94 @@
+# FoundationDB recipes simulation
+
+This crate runs deterministic FoundationDB simulator workloads for recipes.
+Its leader-election workload exercises the poll-based `LeaderElection` recipe
+composed with `RankedRegister` fencing.
+
+## Running
+
+```bash
+./scripts/run_leader_election_simulation.sh
+./scripts/run_leader_election_simulation.sh 50
+```
+
+The script builds the release workload and runs the one canonical polling
+configuration. Its argument is the total number of runs, so `50` means exactly
+50 runs. Each run prints a generated 32-bit seed and writes to an isolated
+trace directory. Passing directories are deleted; a failing directory is kept
+and the script prints an exact reproduction command. To reproduce a seed
+directly:
+
+```bash
+fdbserver -r simulation \
+  -f foundationdb-recipes-simulation/test_poll_leader_election.toml \
+  -b on --trace-format json -L target/traces --logsize 1GiB --seed <SEED>
+```
+
+## CI campaigns
+
+CI runs 1 worker x 10 seeds for ordinary pull requests and pushes to `main`.
+Changes to the leader-election or RankedRegister recipes, simulation code, or
+the runner use 4 workers x 50 seeds. The nightly and manually dispatched
+campaigns, plus pull requests labelled `leader-election-correctness`, use 4
+workers x 200 seeds. Failed runs retain their trace directory as a workflow
+artifact.
+
+## Leader-election workload
+
+One serializable durable key contains a monotonic revision, optional owner, and
+persisted lease duration. Revisions never decrease. Clients use heterogeneous
+configured durations, but followers wait only the duration persisted with their
+exact unchanged observation.
+
+Each client deterministically selects one swarm profile from the workload RNG:
+standard (40 operations, 2-second lease base), contention (160 operations,
+1-second lease base), or suspicion (80 operations, 3-second lease base).
+`operationCount` and `suspicionSecs` remain optional workload overrides for
+focused runs; the canonical configuration leaves both unset so clients use the
+swarm defaults. Setup traces and metrics report the selected profile and the
+effective operation count and lease base. The `swarm_profile` metric maps
+standard, contention, and suspicion to 0, 1, and 2 respectively.
+
+Each `db.run` attempt obtains `attempt_started_at` from simulated monotonic time
+as its first action, then sets `AutomaticIdempotency` and calls `poll`. After a
+successful outer run, follower observations are adopted with a fresh simulated
+time. Failed poll and resign paths discard local state and rotate to a fresh
+caller incarnation. Time is never persisted or used to order commits.
+
+Clients autonomously select a weighted mix of normal polls and adversarial
+resigns, observers, stale-token actions, pauses, duration changes, delayed
+post-commit local-state adoption, and local incarnation loss. A deterministic
+swarm bitset enables optional operation families. The delayed-adoption family
+selects sub-lease, exact-lease, and over-lease simulated delays from the
+workload RNG before `db.run`. It delays only a new or reset follower
+observation, using its persisted lease duration, after a successful run and
+before calling `PollResult::into_next_state`. Every leader poll co-commits
+`RankedRegister::read(rank)`, protected `write(rank, payload)`, and its
+operation log entry. Leadership alone is not authority.
+
+The completion phase biases execution toward boundary, stale-token,
+duration-reset, fencing, and delayed-adoption coverage that a short autonomous
+run might otherwise miss. Delayed-adoption metrics report successful delays in
+each of the three duration classes. Replay requires an over-lease delayed
+observation followed by a poll before that observation's adoption-based expiry.
+
+## Commit-order oracle
+
+Every simulated poll, resign, observer, and stale write is co-logged in its
+transaction. Log keys begin with an incomplete versionstamp, so the final range
+is ordered by actual commit order. Entries include durable prior/current state,
+caller local input, attempt time, configured duration, transition, fencing
+write evidence, and payload identity.
+
+During `check`, client 0 reads the entire operation log, public election state,
+and ranked-register write rank and value in one transaction at one read version.
+It replays from revision zero, no owner, and no protected value. The oracle
+enforces commit order, unique logical operations, exact local-state adoption,
+and public snapshot agreement. It tracks observed coverage for:
+
+- before, exact, and after persisted-duration expiry, including foreign takeover;
+- stale renewal, stale renewal after rank advance, exact resignation, delayed
+  stale resignation, and stale resignation after takeover;
+- follower reset after a renewal changes persisted duration;
+- rejected rank-zero and post-advance stale writes; and
+- a same-transaction fenced protected write for every leader poll.
diff --git a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/mod.rs b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/mod.rs
new file mode 100644
index 00000000000..1ff689fb409
--- /dev/null
+++ b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/mod.rs
@@ -0,0 +1,13 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Deterministic simulation of poll-based, fenced leader election.
+
+mod types;
+mod workload;
+
+pub use workload::LeaderElectionWorkload;
diff --git a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/types.rs b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/types.rs
new file mode 100644
index 00000000000..72025f4b491
--- /dev/null
+++ b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/types.rs
@@ -0,0 +1,86 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Commit-log types for the leader-lease simulation.
+
+use std::time::Duration;
+
+use foundationdb::tuple::Versionstamp;
+
+pub(crate) const OP_POLL: i64 = 0;
+pub(crate) const OP_RESIGN: i64 = 1;
+pub(crate) const OP_OBSERVE: i64 = 2;
+pub(crate) const OP_STALE_WRITE: i64 = 3;
+
+pub(crate) const LOCAL_UNKNOWN: i64 = 0;
+pub(crate) const LOCAL_OBSERVATION: i64 = 1;
+pub(crate) const LOCAL_LEADERSHIP: i64 = 2;
+
+pub(crate) const TRANSITION_ACQUIRED: i64 = 0;
+pub(crate) const TRANSITION_RENEWED: i64 = 1;
+pub(crate) const TRANSITION_TOOK_OVER: i64 = 2;
+pub(crate) const TRANSITION_REACQUIRED: i64 = 3;
+pub(crate) const TRANSITION_FOLLOWED: i64 = 4;
+pub(crate) const TRANSITION_NONE: i64 = 5;
+
+/// One durable election state exposed by the recipe's public API.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub(crate) struct DurableState {
+    pub(crate) rank: u64,
+    pub(crate) owner: Option<String>,
+    pub(crate) lease_duration: Option<Duration>,
+}
+
+/// Caller-owned state supplied to an operation, represented without recipe
+/// private fields so commit-order replay can independently validate it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum LocalInput {
+    Unknown,
+    Observation {
+        owner: String,
+        rank: u64,
+        lease_duration: Duration,
+        observed_at: Duration,
+    },
+    Leadership {
+        participant: String,
+        rank: u64,
+        lease_duration: Duration,
+        renewed_at: Duration,
+    },
+}
+
+/// One versionstamp-ordered simulation operation.
+#[derive(Debug)]
+pub(crate) struct LogEntry {
+    pub(crate) versionstamp: Versionstamp,
+    pub(crate) client_id: i32,
+    pub(crate) incarnation: u64,
+    pub(crate) op_num: u64,
+    pub(crate) kind: i64,
+    pub(crate) actor: String,
+    pub(crate) prior: DurableState,
+    pub(crate) current: DurableState,
+    pub(crate) local_input: LocalInput,
+    pub(crate) tracks_local_state: bool,
+    pub(crate) attempt_started_at: Duration,
+    pub(crate) configured_lease_duration: Duration,
+    pub(crate) planned_adoption_delay: Option<Duration>,
+    pub(crate) transition: i64,
+    pub(crate) result: bool,
+    pub(crate) requested_write_rank: u64,
+    pub(crate) observed_write_rank: u64,
+    pub(crate) observed_value: Option<Vec<u8>>,
+    pub(crate) protected_write_committed: bool,
+    pub(crate) payload: Vec<u8>,
+}
+
+pub(crate) struct Snapshot {
+    pub(crate) election: DurableState,
+    pub(crate) protected_rank: u64,
+    pub(crate) protected_value: Option<Vec<u8>>,
+}
diff --git a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs
new file mode 100644
index 00000000000..8dc1e8f151c
--- /dev/null
+++ b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs
@@ -0,0 +1,2835 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Deterministic workload and independent commit-order oracle for leader leases.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    time::Duration,
+};
+
+use foundationdb::{
+    FdbBindingError, RangeOption,
+    options::{MutationType, TransactionOption},
+    recipes::{
+        leader_election::{
+            ElectionState, LeaderElection, Leadership, LocalState, ParticipantId, PollOutcome,
+            PollTransition,
+        },
+        ranked_register::{Rank, RankedRegister, RankedRegisterError},
+    },
+    tuple::{Subspace, Versionstamp, pack, unpack},
+};
+use foundationdb_simulation::{
+    Metric, Metrics, RustWorkload, Severity, SimDatabase, SingleRustWorkload, WorkloadContext,
+    details,
+};
+use futures::TryStreamExt;
+
+use super::types::{
+    DurableState, LOCAL_LEADERSHIP, LOCAL_OBSERVATION, LOCAL_UNKNOWN, LocalInput, LogEntry,
+    OP_OBSERVE, OP_POLL, OP_RESIGN, OP_STALE_WRITE, Snapshot, TRANSITION_ACQUIRED,
+    TRANSITION_FOLLOWED, TRANSITION_NONE, TRANSITION_REACQUIRED, TRANSITION_RENEWED,
+    TRANSITION_TOOK_OVER,
+};
+
+const OPTIONAL_RESIGN: u32 = 1;
+const OPTIONAL_OBSERVER: u32 = 2;
+const OPTIONAL_PAUSE: u32 = 4;
+const OPTIONAL_DELAYED_ADOPTION: u32 = 8;
+const RACE_PARTICIPANT_PREFIX: &str = "race\0";
+
+// `complete_witnesses` deterministically drives these paths after the swarm finishes.
+const FORCED_WITNESS_COUNT: usize = 9;
+// The remaining paths depend on earlier swarm state or simulated timing.
+const PROBABILISTIC_WITNESS_COUNT: usize = 7;
+// `WorkloadContext::now()` crosses the simulator's f64 boundary. Preserve the replay's exact
+// state eligibility checks while accepting its demonstrated one-nanosecond round-trip loss.
+const SIMULATED_TIME_ROUND_TRIP_TOLERANCE: Duration = Duration::from_nanos(1);
+// The deterministic completion tail must renew before its lease can expire under any simulator
+// time jump. Its one-second renewal reaches `Duration::MAX` while remaining strictly larger.
+const COMPLETION_RENEWAL_BASE_LEASE_DURATION: Duration = Duration::new(u64::MAX - 1, 999_999_999);
+
+#[derive(Clone, Copy)]
+enum SwarmProfile {
+    Standard,
+    Contention,
+    Suspicion,
+}
+
+impl SwarmProfile {
+    fn from_random(random: u32) -> Self {
+        match random % 3 {
+            0 => Self::Standard,
+            1 => Self::Contention,
+            _ => Self::Suspicion,
+        }
+    }
+
+    fn name(self) -> &'static str {
+        match self {
+            Self::Standard => "standard",
+            Self::Contention => "contention",
+            Self::Suspicion => "suspicion",
+        }
+    }
+
+    fn metric_value(self) -> f64 {
+        match self {
+            Self::Standard => 0.0,
+            Self::Contention => 1.0,
+            Self::Suspicion => 2.0,
+        }
+    }
+
+    fn operation_count(self) -> usize {
+        match self {
+            Self::Standard => 40,
+            Self::Contention => 160,
+            Self::Suspicion => 80,
+        }
+    }
+
+    fn lease_base_secs(self) -> u64 {
+        match self {
+            Self::Standard => 2,
+            Self::Contention => 1,
+            Self::Suspicion => 3,
+        }
+    }
+}
+
+pub struct LeaderElectionWorkload {
+    context: WorkloadContext,
+    client_id: i32,
+    profile: SwarmProfile,
+    operation_count: usize,
+    lease_base_secs: u64,
+    lease_duration: Duration,
+    election_subspace: Subspace,
+    register_subspace: Subspace,
+    log_subspace: Subspace,
+    completion_ready_subspace: Subspace,
+    race_subspace: Subspace,
+    participant: ParticipantId,
+    incarnation: u64,
+    local_state: LocalState,
+    last_leadership: Option<Leadership>,
+    stale_leadership: Option<Leadership>,
+    stale_rank: Option<Rank>,
+    zero_stale_write_completed: bool,
+    stale_actions_completed: bool,
+    expiry_pause_completed: bool,
+    normal_weight: u32,
+    adversarial_weight: u32,
+    op_num: u64,
+    swarm: u32,
+    poll_count: u64,
+    leader_count: u64,
+    run_errors: u64,
+    delayed_adoption_count: u64,
+    delayed_adoption_sub_lease_count: u64,
+    delayed_adoption_exact_lease_count: u64,
+    delayed_adoption_over_lease_count: u64,
+    completion_run_errors: u64,
+    coordinated_race_completed: bool,
+    coordinated_race_contenders: usize,
+}
+
+impl SingleRustWorkload for LeaderElectionWorkload {
+    fn new(_name: String, context: WorkloadContext) -> Self {
+        let client_id = context.client_id();
+        let profile = SwarmProfile::from_random(context.rnd());
+        let operation_count = context
+            .get_option("operationCount")
+            .unwrap_or(profile.operation_count());
+        let lease_base_secs = context
+            .get_option("suspicionSecs")
+            .unwrap_or(profile.lease_base_secs());
+        let lease_duration = Duration::from_secs(lease_base_secs + u64::from(context.rnd() % 3));
+        debug_assert!(ParticipantId::new("").is_err());
+        let process_id = context.get_process_id();
+        let participant_text = match context.rnd() % 4 {
+            0 => format!("participant-{client_id}-{process_id}"),
+            1 => format!("participant\0{client_id}-{process_id}"),
+            2 => format!("participant-λ-{client_id}-{process_id}"),
+            _ => format!("participant-{client_id}-{process_id}-{}", "x".repeat(128)),
+        };
+        let participant =
+            ParticipantId::new(participant_text).expect("generated participant IDs are non-empty");
+
+        Self {
+            client_id,
+            profile,
+            operation_count,
+            lease_base_secs,
+            lease_duration,
+            election_subspace: Subspace::all().subspace(&("leader-lease",)),
+            register_subspace: Subspace::all().subspace(&("leader-lease-register",)),
+            log_subspace: Subspace::all().subspace(&("leader-lease-log",)),
+            completion_ready_subspace: Subspace::all()
+                .subspace(&("leader-lease-completion-ready",)),
+            race_subspace: Subspace::all().subspace(&("leader-lease-race",)),
+            participant,
+            incarnation: 0,
+            local_state: LocalState::unknown(),
+            last_leadership: None,
+            stale_leadership: None,
+            stale_rank: None,
+            zero_stale_write_completed: false,
+            stale_actions_completed: false,
+            expiry_pause_completed: false,
+            normal_weight: 50 + context.rnd() % 21,
+            adversarial_weight: 20 + context.rnd() % 21,
+            op_num: 0,
+            swarm: context.rnd(),
+            poll_count: 0,
+            leader_count: 0,
+            run_errors: 0,
+            delayed_adoption_count: 0,
+            delayed_adoption_sub_lease_count: 0,
+            delayed_adoption_exact_lease_count: 0,
+            delayed_adoption_over_lease_count: 0,
+            completion_run_errors: 0,
+            coordinated_race_completed: false,
+            coordinated_race_contenders: 0,
+            context,
+        }
+    }
+}
+
+impl RustWorkload for LeaderElectionWorkload {
+    async fn setup(&mut self, _db: SimDatabase) {
+        self.context.trace(
+            Severity::Info,
+            "LeaderLeaseSetup",
+            details![
+                "Layer" => "Rust",
+                "Client" => self.client_id,
+                "Profile" => self.profile.name(),
+                "OperationCount" => self.operation_count,
+                "LeaseBaseSecs" => self.lease_base_secs,
+                "LeaseSecs" => self.lease_duration.as_secs(),
+                "Protocol" => "poll-lease-fenced-ranked-register"
+            ],
+        );
+    }
+
+    async fn start(&mut self, db: SimDatabase) {
+        let register = RankedRegister::new(self.register_subspace.clone());
+
+        for round in 0..self.operation_count {
+            let operation_weight = self.context.rnd() % 100;
+            let duration_change = operation_weight
+                >= self.normal_weight + 4 * self.adversarial_weight / 5
+                && operation_weight < self.normal_weight + self.adversarial_weight;
+            let election = LeaderElection::new(
+                self.election_subspace.clone(),
+                if duration_change {
+                    self.lease_duration_for_round(round)
+                } else {
+                    self.lease_duration
+                },
+            )
+            .expect("generated lease duration is non-zero");
+            let run_normal_poll =
+                round == 0 || operation_weight < self.normal_weight || duration_change;
+            let mut forced_expiry_pause = false;
+
+            if run_normal_poll {
+                self.poll_count += 1;
+                let op_num = self.next_op_num();
+                let adoption_delay = self.random_adoption_delay();
+                let poll = run_poll(
+                    &db,
+                    election.clone(),
+                    register.clone(),
+                    self.log_subspace.clone(),
+                    self.participant.clone(),
+                    self.local_state.clone(),
+                    true,
+                    &self.context,
+                    self.client_id,
+                    self.incarnation,
+                    op_num,
+                    adoption_delay,
+                )
+                .await;
+
+                let mut exercise_zero_stale_write = false;
+                match poll {
+                    Ok(poll) => {
+                        if let Some(delay) = poll.adoption_delay {
+                            self.record_delayed_adoption(delay);
+                        }
+                        self.local_state = poll.next_state;
+                        if let Some(leadership) = poll.leadership {
+                            if let Some(previous) = self
+                                .last_leadership
+                                .as_ref()
+                                .filter(|previous| previous.rank() < leadership.rank())
+                                .cloned()
+                            {
+                                self.stale_rank = Some(previous.rank());
+                                self.stale_leadership = Some(previous);
+                            }
+                            self.last_leadership = Some(leadership);
+                            self.leader_count += 1;
+                            forced_expiry_pause = !self.expiry_pause_completed;
+                            exercise_zero_stale_write = !self.zero_stale_write_completed;
+                        }
+                    }
+                    Err(error) => {
+                        self.run_diagnostic("PollRunFailed", op_num, error);
+                        self.replace_incarnation("poll-error");
+                    }
+                }
+
+                if exercise_zero_stale_write {
+                    let stale_write_op = self.next_op_num();
+                    match run_stale_write(
+                        &db,
+                        election.clone(),
+                        register.clone(),
+                        self.log_subspace.clone(),
+                        self.participant.as_str().to_owned(),
+                        Rank::ZERO,
+                        simulated_now(&self.context),
+                        self.client_id,
+                        self.incarnation,
+                        stale_write_op,
+                    )
+                    .await
+                    {
+                        Ok(true) => self.protocol_error(
+                            "ZeroRankStaleWriteCommitted",
+                            stale_write_op,
+                            "a rank-zero ranked-register write committed after leadership began",
+                        ),
+                        Ok(false) => self.zero_stale_write_completed = true,
+                        Err(error) => {
+                            self.run_diagnostic("ZeroRankStaleWriteFailed", stale_write_op, error)
+                        }
+                    }
+                }
+            }
+
+            if self.swarm & OPTIONAL_OBSERVER != 0
+                && operation_weight >= self.normal_weight
+                && operation_weight < self.normal_weight + self.adversarial_weight / 3
+            {
+                let op_num = self.next_op_num();
+                if let Err(error) = run_observer(
+                    &db,
+                    election.clone(),
+                    self.log_subspace.clone(),
+                    self.participant.as_str().to_owned(),
+                    self.lease_duration,
+                    simulated_now(&self.context),
+                    self.client_id,
+                    self.incarnation,
+                    op_num,
+                )
+                .await
+                {
+                    self.run_diagnostic("ObserverRunFailed", op_num, error);
+                }
+            }
+
+            if self.swarm & OPTIONAL_RESIGN != 0
+                && operation_weight >= self.normal_weight + self.adversarial_weight / 3
+                && operation_weight < self.normal_weight + 2 * self.adversarial_weight / 3
+            {
+                if let Some(leadership) = self.local_state.leadership().cloned() {
+                    let op_num = self.next_op_num();
+                    match run_resign(
+                        &db,
+                        election.clone(),
+                        self.log_subspace.clone(),
+                        leadership,
+                        simulated_now(&self.context),
+                        self.client_id,
+                        self.incarnation,
+                        true,
+                        op_num,
+                    )
+                    .await
+                    {
+                        Ok(true) => {
+                            self.local_state = LocalState::unknown();
+                            self.force_foreign_takeover(
+                                &db,
+                                &register,
+                                election.lease_duration(),
+                                (self.swarm & OPTIONAL_DELAYED_ADOPTION != 0)
+                                    .then_some(AdoptionDelay::Longer),
+                            )
+                            .await;
+                        }
+                        Ok(false) => {}
+                        Err(error) => {
+                            self.run_diagnostic("ResignRunFailed", op_num, error);
+                            self.replace_incarnation("resign-error");
+                        }
+                    }
+                }
+            }
+
+            if operation_weight >= self.normal_weight + 2 * self.adversarial_weight / 3
+                && operation_weight < self.normal_weight + 4 * self.adversarial_weight / 5
+                && !self.stale_actions_completed
+            {
+                if let (Some(stale_leadership), Some(stale_rank)) =
+                    (self.stale_leadership.clone(), self.stale_rank)
+                {
+                    self.exercise_stale_tokens(&db, &register, stale_leadership, stale_rank)
+                        .await;
+                }
+            }
+
+            if operation_weight >= self.normal_weight + self.adversarial_weight {
+                self.replace_incarnation("dropped");
+                self.context.trace(
+                    Severity::Info,
+                    "LeaderLeaseLostLocalState",
+                    details!["Client" => self.client_id, "Round" => round],
+                );
+            }
+
+            if round % 3 == 0 {
+                if let Err(error) =
+                    continuous_snapshot_check(&db, election.clone(), register.clone()).await
+                {
+                    if error.get_fdb_error().is_some() {
+                        self.run_diagnostic("ContinuousSnapshotFailed", self.op_num, error);
+                    } else {
+                        self.protocol_error(
+                            "ContinuousSnapshotInvariantFailed",
+                            self.op_num,
+                            "one-transaction public snapshot violated structural invariants",
+                        );
+                    }
+                }
+            }
+
+            let boundary_pause = forced_expiry_pause
+                || (self.swarm & OPTIONAL_PAUSE != 0
+                    && operation_weight >= self.normal_weight + 4 * self.adversarial_weight / 5
+                    && operation_weight < self.normal_weight + self.adversarial_weight);
+            if boundary_pause {
+                if forced_expiry_pause {
+                    self.expiry_pause_completed = true;
+                }
+                let target = match &self.local_state {
+                    LocalState::Observation(observation) => observation
+                        .first_observed_at()
+                        .saturating_add(observation.lease_duration())
+                        .saturating_add(Duration::from_millis(1)),
+                    LocalState::Leadership(leadership) => leadership
+                        .last_renewed_at()
+                        .saturating_add(leadership.lease_duration())
+                        .saturating_add(Duration::from_millis(1)),
+                    LocalState::Unknown => {
+                        simulated_now(&self.context).saturating_add(Duration::from_millis(1))
+                    }
+                };
+                delay_until(&self.context, target).await;
+                continue;
+            }
+            delay_until(&self.context, self.inter_round_target(round)).await;
+        }
+
+        self.write_completion_ready_marker(&db).await;
+        self.wait_for_completion_ready_markers(&db).await;
+        self.coordinated_takeover_race(&db, &register).await;
+        if self.client_id != 0 {
+            return;
+        }
+        let run_errors_before_completion = self.run_errors;
+        self.complete_witnesses(db, register).await;
+        self.completion_run_errors = self.run_errors - run_errors_before_completion;
+    }
+
+    async fn check(&mut self, db: SimDatabase) {
+        if self.client_id != 0 {
+            return;
+        }
+
+        let log_subspace = self.log_subspace.clone();
+        let election = LeaderElection::new(self.election_subspace.clone(), self.lease_duration)
+            .expect("configured lease duration is non-zero");
+        let register = RankedRegister::new(self.register_subspace.clone());
+        let result = db
+            .run(|txn, _maybe_committed| {
+                let log_subspace = log_subspace.clone();
+                let election = election.clone();
+                let register = register.clone();
+                async move {
+                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                    let read_version = txn.get_read_version().await?;
+                    let key_values: Vec<_> = txn
+                        .get_ranges_keyvalues(RangeOption::from(log_subspace.range()), false)
+                        .try_collect()
+                        .await
+                        .map_err(FdbBindingError::from)?;
+                    let mut entries = Vec::with_capacity(key_values.len());
+                    for key_value in key_values {
+                        entries.push(decode_log_entry(
+                            &log_subspace,
+                            key_value.key(),
+                            key_value.value(),
+                        )?);
+                    }
+                    let election = durable_from_public(
+                        election.state(&txn).await.map_err(FdbBindingError::from)?,
+                    );
+                    let protected = register
+                        .read(&txn, Rank::ZERO)
+                        .await
+                        .map_err(ranked_register_error)?;
+                    Ok::<_, FdbBindingError>((
+                        read_version,
+                        entries,
+                        Snapshot {
+                            election,
+                            protected_rank: protected.write_rank().as_u64(),
+                            protected_value: protected.into_value(),
+                        },
+                    ))
+                }
+            })
+            .await;
+
+        match result {
+            Ok((read_version, entries, snapshot)) => match replay(&entries, &snapshot) {
+                Ok(coverage)
+                    if (!coverage.forced_missing.is_empty() && self.completion_run_errors == 0)
+                        || !self.coordinated_race_completed
+                        || !coverage.saw_coordinated_race
+                        || coverage.coordinated_race_contenders
+                            != self.coordinated_race_contenders =>
+                {
+                    self.context.trace(
+                        Severity::Error,
+                        "LeaderLeaseForcedWitnessMissing",
+                        details![
+                            "ReadVersion" => read_version,
+                            "Entries" => entries.len(),
+                            "ForcedWitnessesObserved" => coverage.forced_observed,
+                            "ForcedWitnessesMissing" => coverage.forced_missing.join(", "),
+                            "ProbabilisticWitnessesObserved" => coverage.probabilistic_observed,
+                            "ProbabilisticWitnessesMissing" => coverage.probabilistic_missing.join(", "),
+                            "CoordinatedRaceCompleted" => self.coordinated_race_completed,
+                            "CoordinatedRaceObserved" => coverage.saw_coordinated_race,
+                            "CoordinatedRaceContenders" => coverage.coordinated_race_contenders,
+                            "ExpectedCoordinatedRaceContenders" => self.coordinated_race_contenders,
+                        ],
+                    )
+                }
+                Ok(coverage)
+                    if !coverage.forced_missing.is_empty()
+                        || !coverage.probabilistic_missing.is_empty()
+                        || !self.coordinated_race_completed =>
+                {
+                    self.context.trace(
+                        Severity::Warn,
+                        "LeaderLeaseCoverageIncomplete",
+                        details![
+                            "ReadVersion" => read_version,
+                            "Entries" => entries.len(),
+                            "CompletionRunErrors" => self.completion_run_errors,
+                            "ForcedWitnessesObserved" => coverage.forced_observed,
+                            "ForcedWitnessesMissing" => coverage.forced_missing.join(", "),
+                            "ProbabilisticWitnessesObserved" => coverage.probabilistic_observed,
+                            "ProbabilisticWitnessesMissing" => coverage.probabilistic_missing.join(", "),
+                            "CoordinatedRaceCompleted" => self.coordinated_race_completed,
+                            "CoordinatedRaceObserved" => coverage.saw_coordinated_race,
+                            "CoordinatedRaceContenders" => coverage.coordinated_race_contenders,
+                            "ExpectedCoordinatedRaceContenders" => self.coordinated_race_contenders,
+                        ],
+                    )
+                }
+                Ok(coverage) => self.context.trace(
+                    Severity::Info,
+                    "LeaderLeaseCheckPassed",
+                    details![
+                        "ReadVersion" => read_version,
+                        "Entries" => entries.len(),
+                        "ForcedWitnessesObserved" => coverage.forced_observed,
+                        "ProbabilisticWitnessesObserved" => coverage.probabilistic_observed,
+                        "CoordinatedRaceObserved" => coverage.saw_coordinated_race,
+                        "CoordinatedRaceContenders" => coverage.coordinated_race_contenders,
+                        "ExpectedCoordinatedRaceContenders" => self.coordinated_race_contenders,
+                    ],
+                ),
+                Err(error) => self.context.trace(
+                    Severity::Error,
+                    "LeaderLeaseInvariantFailed",
+                    details!["ReadVersion" => read_version, "Error" => error],
+                ),
+            },
+            Err(error) => self.context.trace(
+                Severity::Error,
+                "LeaderLeaseCheckReadFailed",
+                details!["Error" => format!("{error:?}")],
+            ),
+        }
+    }
+
+    fn get_metrics(&self, mut out: Metrics) {
+        out.extend([
+            Metric::val("swarm_profile", self.profile.metric_value()),
+            Metric::val("operation_count", self.operation_count as f64),
+            Metric::val("lease_base_secs", self.lease_base_secs as f64),
+            Metric::val("poll_count", self.poll_count as f64),
+            Metric::val("leader_count", self.leader_count as f64),
+            Metric::val("run_errors", self.run_errors as f64),
+            Metric::val("delayed_adoption_count", self.delayed_adoption_count as f64),
+            Metric::val(
+                "delayed_adoption_sub_lease_count",
+                self.delayed_adoption_sub_lease_count as f64,
+            ),
+            Metric::val(
+                "delayed_adoption_exact_lease_count",
+                self.delayed_adoption_exact_lease_count as f64,
+            ),
+            Metric::val(
+                "delayed_adoption_over_lease_count",
+                self.delayed_adoption_over_lease_count as f64,
+            ),
+            Metric::val("completion_run_errors", self.completion_run_errors as f64),
+            Metric::val(
+                "coordinated_race_completed",
+                if self.coordinated_race_completed {
+                    1.0
+                } else {
+                    0.0
+                },
+            ),
+            Metric::val(
+                "coordinated_race_contenders",
+                self.coordinated_race_contenders as f64,
+            ),
+        ]);
+    }
+
+    fn get_check_timeout(&self) -> f64 {
+        5000.0
+    }
+}
+
+impl LeaderElectionWorkload {
+    async fn write_completion_ready_marker(&mut self, db: &SimDatabase) {
+        let completion_ready_subspace = self.completion_ready_subspace.clone();
+        self.write_phase_marker(db, &completion_ready_subspace, "ready", b"ready")
+            .await;
+    }
+
+    async fn wait_for_completion_ready_markers(&mut self, db: &SimDatabase) {
+        let completion_ready_subspace = self.completion_ready_subspace.clone();
+        self.wait_for_phase_markers(db, &completion_ready_subspace, "ready")
+            .await;
+    }
+
+    async fn completion_barrier_delay(&self) {
+        if let Err(error) = self.context.delay(Duration::from_millis(1)).await {
+            self.context.trace(
+                Severity::Warn,
+                "CompletionBarrierDelayFailed",
+                details!["Client" => self.client_id, "Error" => format!("{error:?}")],
+            );
+        }
+    }
+
+    async fn write_phase_marker(
+        &mut self,
+        db: &SimDatabase,
+        marker_subspace: &Subspace,
+        phase: &str,
+        value: &[u8],
+    ) {
+        let key = marker_subspace.pack(&(phase, self.client_id));
+
+        loop {
+            let result = db
+                .run(|txn, _maybe_committed| {
+                    let key = key.clone();
+                    let value = value.to_vec();
+                    async move {
+                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                        txn.set(&key, &value);
+                        Ok::<_, FdbBindingError>(())
+                    }
+                })
+                .await;
+            match result {
+                Ok(()) => return,
+                Err(error) => self.run_diagnostic("PhaseMarkerWriteFailed", self.op_num, error),
+            }
+
+            self.completion_barrier_delay().await;
+        }
+    }
+
+    async fn wait_for_phase_markers(
+        &mut self,
+        db: &SimDatabase,
+        marker_subspace: &Subspace,
+        phase: &str,
+    ) {
+        let client_count = self.context.client_count();
+
+        loop {
+            let marker_subspace = marker_subspace.clone();
+            let phase = phase.to_owned();
+            let ready = db
+                .run(|txn, _maybe_committed| {
+                    let marker_subspace = marker_subspace.clone();
+                    let phase = phase.clone();
+                    async move {
+                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                        for client_id in 0..client_count {
+                            if txn
+                                .get(&marker_subspace.pack(&(phase.as_str(), client_id)), false)
+                                .await?
+                                .is_none()
+                            {
+                                return Ok::<_, FdbBindingError>(false);
+                            }
+                        }
+                        Ok(true)
+                    }
+                })
+                .await;
+            match ready {
+                Ok(true) => return,
+                Ok(false) => {}
+                Err(error) => self.run_diagnostic("PhaseMarkerReadFailed", self.op_num, error),
+            }
+
+            self.completion_barrier_delay().await;
+        }
+    }
+
+    async fn phase_statuses(
+        &mut self,
+        db: &SimDatabase,
+        marker_subspace: &Subspace,
+        phase: &str,
+    ) -> Vec<Vec<u8>> {
+        let client_count = self.context.client_count();
+
+        loop {
+            let marker_subspace = marker_subspace.clone();
+            let phase = phase.to_owned();
+            let statuses = db
+                .run(|txn, _maybe_committed| {
+                    let marker_subspace = marker_subspace.clone();
+                    let phase = phase.clone();
+                    async move {
+                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                        let mut statuses = Vec::with_capacity(client_count as usize);
+                        for client_id in 0..client_count {
+                            statuses.push(
+                                txn.get(&marker_subspace.pack(&(phase.as_str(), client_id)), false)
+                                    .await?
+                                    .map(|value| value.to_vec())
+                                    .unwrap_or_default(),
+                            );
+                        }
+                        Ok::<_, FdbBindingError>(statuses)
+                    }
+                })
+                .await;
+            match statuses {
+                Ok(statuses) => return statuses,
+                Err(error) => self.run_diagnostic("PhaseStatusReadFailed", self.op_num, error),
+            }
+
+            self.completion_barrier_delay().await;
+        }
+    }
+
+    async fn coordinated_takeover_race(&mut self, db: &SimDatabase, register: &RankedRegister) {
+        let race_subspace = self.race_subspace.clone();
+        self.replace_incarnation("race");
+        let initial_poll_op = self.next_op_num();
+        let initial_race_poll = run_poll(
+            db,
+            LeaderElection::new(self.election_subspace.clone(), self.lease_duration)
+                .expect("configured lease duration is non-zero"),
+            register.clone(),
+            self.log_subspace.clone(),
+            self.participant.clone(),
+            self.local_state.clone(),
+            true,
+            &self.context,
+            self.client_id,
+            self.incarnation,
+            initial_poll_op,
+            None,
+        )
+        .await;
+        let initial_poll_failed = match initial_race_poll {
+            Ok(poll) => {
+                self.local_state = poll.next_state;
+                false
+            }
+            Err(error) => {
+                self.run_diagnostic("RaceInitialPollFailed", initial_poll_op, error);
+                self.replace_incarnation("race-initial-poll-error");
+                true
+            }
+        };
+        self.write_phase_marker(db, &race_subspace, "observed", b"ready")
+            .await;
+        self.wait_for_phase_markers(db, &race_subspace, "observed")
+            .await;
+
+        let observation = self.local_state.observation().cloned();
+        if let Some(observation) = observation.as_ref() {
+            delay_until(
+                &self.context,
+                observation
+                    .first_observed_at()
+                    .saturating_add(observation.lease_duration()),
+            )
+            .await;
+        }
+        self.write_phase_marker(db, &race_subspace, "expired", b"ready")
+            .await;
+        self.wait_for_phase_markers(db, &race_subspace, "expired")
+            .await;
+
+        let status: &[u8] = if initial_poll_failed {
+            b"error"
+        } else if let Some(observation) = observation {
+            let stale_rank = observation.rank();
+            let race_poll_op = self.next_op_num();
+            let race_poll = run_poll(
+                db,
+                LeaderElection::new(self.election_subspace.clone(), self.lease_duration)
+                    .expect("configured lease duration is non-zero"),
+                register.clone(),
+                self.log_subspace.clone(),
+                self.participant.clone(),
+                self.local_state.clone(),
+                true,
+                &self.context,
+                self.client_id,
+                self.incarnation,
+                race_poll_op,
+                None,
+            )
+            .await;
+            match race_poll {
+                Ok(poll) => {
+                    self.local_state = poll.next_state;
+                    let stale_write_op = self.next_op_num();
+                    match run_stale_write(
+                        db,
+                        LeaderElection::new(self.election_subspace.clone(), self.lease_duration)
+                            .expect("configured lease duration is non-zero"),
+                        register.clone(),
+                        self.log_subspace.clone(),
+                        self.participant.as_str().to_owned(),
+                        stale_rank,
+                        simulated_now(&self.context),
+                        self.client_id,
+                        self.incarnation,
+                        stale_write_op,
+                    )
+                    .await
+                    {
+                        Ok(false) => b"contended",
+                        Ok(true) => {
+                            self.protocol_error(
+                                "RaceStaleWriteCommitted",
+                                stale_write_op,
+                                "a takeover contender committed at the predecessor rank",
+                            );
+                            b"error"
+                        }
+                        Err(error) => {
+                            self.run_diagnostic("RaceStaleWriteFailed", stale_write_op, error);
+                            b"error"
+                        }
+                    }
+                }
+                Err(error) => {
+                    self.run_diagnostic("RacePollFailed", race_poll_op, error);
+                    self.replace_incarnation("race-poll-error");
+                    b"error"
+                }
+            }
+        } else {
+            b"incumbent"
+        };
+        self.write_phase_marker(db, &race_subspace, "done", status)
+            .await;
+        self.wait_for_phase_markers(db, &race_subspace, "done")
+            .await;
+
+        if self.client_id == 0 {
+            let statuses = self.phase_statuses(db, &race_subspace, "done").await;
+            self.coordinated_race_contenders = statuses
+                .iter()
+                .filter(|status| *status == b"contended")
+                .count();
+            self.coordinated_race_completed = self.coordinated_race_contenders >= 2
+                && statuses.iter().all(|status| status != b"error");
+        }
+    }
+
+    async fn force_foreign_takeover(
+        &mut self,
+        db: &SimDatabase,
+        register: &RankedRegister,
+        follower_duration: Duration,
+        adoption_delay: Option<AdoptionDelay>,
+    ) {
+        let foreign = ParticipantId::new(format!(
+            "foreign\0λ-{}-{}-{}",
+            self.client_id,
+            self.context.get_process_id(),
+            self.incarnation,
+        ))
+        .expect("generated foreign participant is non-empty");
+        let foreign_duration = follower_duration + Duration::from_secs(2);
+        let foreign_election =
+            LeaderElection::new(self.election_subspace.clone(), foreign_duration)
+                .expect("foreign lease duration is non-zero");
+        let foreign_op = self.next_op_num();
+        let foreign_poll = run_poll(
+            db,
+            foreign_election,
+            register.clone(),
+            self.log_subspace.clone(),
+            foreign,
+            LocalState::unknown(),
+            false,
+            &self.context,
+            self.client_id,
+            self.incarnation,
+            foreign_op,
+            None,
+        )
+        .await;
+        let foreign_poll = match foreign_poll {
+            Ok(poll) => poll,
+            Err(error) => {
+                self.run_diagnostic("ForeignTakeoverPollFailed", foreign_op, error);
+                return;
+            }
+        };
+        let Some(predecessor) = foreign_poll.leadership else {
+            return;
+        };
+
+        self.local_state = LocalState::unknown();
+        let _ = self
+            .poll_once(db, register, follower_duration, adoption_delay)
+            .await;
+        let Some(observation) = self.local_state.observation().cloned() else {
+            return;
+        };
+        if observation.owner().as_str() == self.participant.as_str()
+            || observation.lease_duration() != predecessor.lease_duration()
+        {
+            return;
+        }
+        let before = observation
+            .first_observed_at()
+            .saturating_add(observation.lease_duration())
+            .saturating_sub(Duration::from_millis(1));
+        delay_until(&self.context, before).await;
+        let _ = self.poll_once(db, register, follower_duration, None).await;
+        let exact = observation
+            .first_observed_at()
+            .saturating_add(observation.lease_duration());
+        delay_until(&self.context, exact).await;
+        let takeover = self.poll_once(db, register, follower_duration, None).await;
+        if takeover.is_some_and(|leadership| leadership.rank() > predecessor.rank()) {
+            self.exercise_stale_tokens(db, register, predecessor.clone(), predecessor.rank())
+                .await;
+        }
+    }
+}
+
+impl LeaderElectionWorkload {
+    fn inter_round_target(&self, round: usize) -> Duration {
+        let (anchor, lease_duration) = match &self.local_state {
+            LocalState::Observation(observation) => (
+                observation.first_observed_at(),
+                observation.lease_duration(),
+            ),
+            LocalState::Leadership(leadership) => {
+                (leadership.last_renewed_at(), leadership.lease_duration())
+            }
+            LocalState::Unknown => (simulated_now(&self.context), self.lease_duration),
+        };
+        let offset = match (self.swarm as usize + round) % 3 {
+            0 => lease_duration / 2,
+            1 => lease_duration,
+            _ => lease_duration.saturating_add(Duration::from_millis(1)),
+        };
+        anchor.saturating_add(offset)
+    }
+
+    fn lease_duration_for_round(&self, round: usize) -> Duration {
+        self.lease_duration
+            + Duration::from_secs(u64::from((self.swarm.wrapping_add(round as u32)) % 3))
+    }
+
+    fn next_op_num(&mut self) -> u64 {
+        let op_num = self.op_num;
+        self.op_num += 1;
+        op_num
+    }
+
+    fn random_adoption_delay(&self) -> Option<AdoptionDelay> {
+        (self.swarm & OPTIONAL_DELAYED_ADOPTION != 0)
+            .then(|| AdoptionDelay::from_random(self.context.rnd()))
+    }
+
+    fn record_delayed_adoption(&mut self, delay: AdoptionDelay) {
+        self.delayed_adoption_count += 1;
+        match delay {
+            AdoptionDelay::Shorter => self.delayed_adoption_sub_lease_count += 1,
+            AdoptionDelay::Exact => self.delayed_adoption_exact_lease_count += 1,
+            AdoptionDelay::Longer => self.delayed_adoption_over_lease_count += 1,
+        }
+    }
+
+    fn run_diagnostic(&mut self, event: &str, op_num: u64, error: FdbBindingError) {
+        self.run_errors += 1;
+        self.context.trace(
+            Severity::Warn,
+            event,
+            details![
+                "Client" => self.client_id,
+                "OpNum" => op_num,
+                "Error" => format!("{error:?}"),
+                "MaybeCommitted" => error.get_fdb_error().is_some_and(|error| error.is_maybe_committed())
+            ],
+        );
+    }
+
+    fn protocol_error(&self, event: &str, op_num: u64, error: &str) {
+        self.context.trace(
+            Severity::Error,
+            event,
+            details!["Client" => self.client_id, "OpNum" => op_num, "Error" => error],
+        );
+    }
+
+    fn replace_incarnation(&mut self, label: &str) {
+        self.incarnation += 1;
+        self.participant = ParticipantId::new(format!(
+            "{label}\0λ-{}-{}-{}",
+            self.client_id,
+            self.context.get_process_id(),
+            self.incarnation,
+        ))
+        .expect("generated incarnation ID is non-empty");
+        self.local_state = LocalState::unknown();
+        self.last_leadership = None;
+        self.stale_leadership = None;
+        self.stale_rank = None;
+    }
+
+    async fn poll_once(
+        &mut self,
+        db: &SimDatabase,
+        register: &RankedRegister,
+        lease_duration: Duration,
+        adoption_delay: Option<AdoptionDelay>,
+    ) -> Option<Leadership> {
+        let election = LeaderElection::new(self.election_subspace.clone(), lease_duration)
+            .expect("completion lease duration is non-zero");
+        let op_num = self.next_op_num();
+        let result = run_poll(
+            db,
+            election,
+            register.clone(),
+            self.log_subspace.clone(),
+            self.participant.clone(),
+            self.local_state.clone(),
+            true,
+            &self.context,
+            self.client_id,
+            self.incarnation,
+            op_num,
+            adoption_delay,
+        )
+        .await;
+        match result {
+            Ok(poll) => {
+                if let Some(delay) = poll.adoption_delay {
+                    self.record_delayed_adoption(delay);
+                }
+                self.local_state = poll.next_state;
+                if let Some(leadership) = poll.leadership {
+                    if let Some(previous) = self
+                        .last_leadership
+                        .as_ref()
+                        .filter(|previous| previous.rank() < leadership.rank())
+                        .cloned()
+                    {
+                        self.stale_leadership = Some(previous.clone());
+                        self.stale_rank = Some(previous.rank());
+                    }
+                    self.last_leadership = Some(leadership.clone());
+                    Some(leadership)
+                } else {
+                    None
+                }
+            }
+            Err(error) => {
+                self.run_diagnostic("CompletionPollFailed", op_num, error);
+                self.replace_incarnation("completion-poll-error");
+                None
+            }
+        }
+    }
+
+    async fn exercise_stale_tokens(
+        &mut self,
+        db: &SimDatabase,
+        register: &RankedRegister,
+        stale_leadership: Leadership,
+        stale_rank: Rank,
+    ) {
+        let election = LeaderElection::new(self.election_subspace.clone(), self.lease_duration)
+            .expect("configured lease duration is non-zero");
+        let stale_poll_op = self.next_op_num();
+        match run_poll(
+            db,
+            election.clone(),
+            register.clone(),
+            self.log_subspace.clone(),
+            self.participant.clone(),
+            LocalState::Leadership(stale_leadership.clone()),
+            false,
+            &self.context,
+            self.client_id,
+            self.incarnation,
+            stale_poll_op,
+            None,
+        )
+        .await
+        {
+            Ok(poll) if poll.transition == PollTransition::Renewed => self.protocol_error(
+                "StaleRenewSucceeded",
+                stale_poll_op,
+                "a stale leadership token changed durable state",
+            ),
+            Ok(_) => {}
+            Err(error) => self.run_diagnostic("StaleRenewRunFailed", stale_poll_op, error),
+        }
+
+        delay_until(
+            &self.context,
+            stale_leadership
+                .last_renewed_at()
+                .saturating_add(stale_leadership.lease_duration())
+                .saturating_add(Duration::from_millis(1)),
+        )
+        .await;
+
+        let stale_resign_op = self.next_op_num();
+        match run_resign(
+            db,
+            election.clone(),
+            self.log_subspace.clone(),
+            stale_leadership,
+            simulated_now(&self.context),
+            self.client_id,
+            self.incarnation,
+            false,
+            stale_resign_op,
+        )
+        .await
+        {
+            Ok(true) => self.protocol_error(
+                "StaleResignSucceeded",
+                stale_resign_op,
+                "a stale leadership token released durable state",
+            ),
+            Ok(false) => {}
+            Err(error) => self.run_diagnostic("StaleResignRunFailed", stale_resign_op, error),
+        }
+
+        let stale_write_op = self.next_op_num();
+        match run_stale_write(
+            db,
+            election,
+            register.clone(),
+            self.log_subspace.clone(),
+            self.participant.as_str().to_owned(),
+            stale_rank,
+            simulated_now(&self.context),
+            self.client_id,
+            self.incarnation,
+            stale_write_op,
+        )
+        .await
+        {
+            Ok(true) => self.protocol_error(
+                "StaleWriteCommitted",
+                stale_write_op,
+                "a strictly stale ranked-register write committed",
+            ),
+            Ok(false) => self.stale_actions_completed = true,
+            Err(error) => self.run_diagnostic("StaleWriteRunFailed", stale_write_op, error),
+        }
+    }
+
+    async fn complete_witnesses(&mut self, db: SimDatabase, register: RankedRegister) {
+        self.replace_incarnation("replacement");
+
+        for phase in 0..3 {
+            let lease_duration = self.lease_duration_for_round(self.operation_count + phase);
+            let adoption_delay = AdoptionDelay::for_completion_phase(phase);
+            if let Some(first) = self
+                .poll_once(&db, &register, lease_duration, Some(adoption_delay))
+                .await
+            {
+                let renewal_duration =
+                    self.lease_duration_for_round(self.operation_count + phase + 1);
+                if let Some(renewed) = self
+                    .poll_once(&db, &register, renewal_duration, Some(adoption_delay))
+                    .await
+                {
+                    if first.rank() < renewed.rank() {
+                        self.exercise_stale_tokens(&db, &register, first.clone(), first.rank())
+                            .await;
+                    }
+                    let resignation_election =
+                        LeaderElection::new(self.election_subspace.clone(), renewal_duration)
+                            .expect("completion lease duration is non-zero");
+                    let resign_op = self.next_op_num();
+                    match run_resign(
+                        &db,
+                        resignation_election,
+                        self.log_subspace.clone(),
+                        renewed,
+                        simulated_now(&self.context),
+                        self.client_id,
+                        self.incarnation,
+                        true,
+                        resign_op,
+                    )
+                    .await
+                    {
+                        Ok(true) => {
+                            self.local_state = LocalState::unknown();
+                            self.force_foreign_takeover(
+                                &db,
+                                &register,
+                                renewal_duration,
+                                Some(adoption_delay),
+                            )
+                            .await;
+                        }
+                        Ok(false) => self.context.trace(
+                            Severity::Info,
+                            "ExactResignContended",
+                            details!["Client" => self.client_id, "OpNum" => resign_op],
+                        ),
+                        Err(error) => {
+                            self.run_diagnostic("ExactResignFailed", resign_op, error);
+                            self.replace_incarnation("exact-resign-error");
+                        }
+                    }
+                }
+                self.replace_incarnation("completion-reset");
+                let _ = self
+                    .poll_once(&db, &register, renewal_duration, Some(adoption_delay))
+                    .await;
+            }
+
+            if let Some(observation) = self.local_state.observation().cloned() {
+                let before_expiry = observation
+                    .first_observed_at()
+                    .saturating_add(observation.lease_duration())
+                    .saturating_sub(Duration::from_millis(1));
+                let _ = delay_until(&self.context, before_expiry).await;
+                let _ = self
+                    .poll_once(&db, &register, lease_duration, Some(adoption_delay))
+                    .await;
+                let exact_expiry = observation
+                    .first_observed_at()
+                    .saturating_add(observation.lease_duration());
+                let _ = delay_until(&self.context, exact_expiry).await;
+                let _ = self
+                    .poll_once(&db, &register, lease_duration, Some(adoption_delay))
+                    .await;
+            }
+
+            if let Some(leadership) = self.local_state.leadership().cloned() {
+                let after_expiry = leadership
+                    .last_renewed_at()
+                    .saturating_add(leadership.lease_duration())
+                    .saturating_add(Duration::from_millis(1));
+                let _ = delay_until(&self.context, after_expiry).await;
+                let _ = self
+                    .poll_once(&db, &register, lease_duration, Some(adoption_delay))
+                    .await;
+            }
+        }
+
+        let witness_lease_duration = self.lease_duration_for_round(self.operation_count + 3);
+        self.replace_incarnation("final-delayed-adoption");
+        let _ = self
+            .poll_once(
+                &db,
+                &register,
+                witness_lease_duration,
+                Some(AdoptionDelay::Longer),
+            )
+            .await;
+        if self.local_state.leadership().is_some() {
+            self.replace_incarnation("final-delayed-adoption-follower");
+            let _ = self
+                .poll_once(
+                    &db,
+                    &register,
+                    witness_lease_duration,
+                    Some(AdoptionDelay::Longer),
+                )
+                .await;
+        }
+        if self.local_state.observation().is_some() {
+            let _ = self
+                .poll_once(&db, &register, witness_lease_duration, None)
+                .await;
+        }
+
+        self.force_exact_resign_and_follower_duration_reset(&db, &register)
+            .await;
+    }
+
+    async fn force_exact_resign_and_follower_duration_reset(
+        &mut self,
+        db: &SimDatabase,
+        register: &RankedRegister,
+    ) {
+        self.replace_incarnation("final-exact-resign");
+        let lease_duration = COMPLETION_RENEWAL_BASE_LEASE_DURATION;
+        let leadership = loop {
+            if let Some(leadership) = self.poll_once(db, register, lease_duration, None).await {
+                break leadership;
+            }
+            if let Some(observation) = self.local_state.observation().cloned() {
+                delay_until(
+                    &self.context,
+                    observation
+                        .first_observed_at()
+                        .saturating_add(observation.lease_duration())
+                        .saturating_add(SIMULATED_TIME_ROUND_TRIP_TOLERANCE),
+                )
+                .await;
+            } else {
+                // `poll_once` resets to a fresh unknown incarnation on a run error. Yield before
+                // retrying that incarnation so repeated run errors cannot form a busy loop.
+                self.completion_barrier_delay().await;
+            }
+        };
+
+        let renewal_duration = leadership
+            .lease_duration()
+            .saturating_add(Duration::from_secs(1));
+        let leader_incarnation = self.incarnation;
+        let Some(renewed) = self.poll_once(db, register, renewal_duration, None).await else {
+            return;
+        };
+
+        self.replace_incarnation("final-duration-reset-follower");
+        let _ = self.poll_once(db, register, renewal_duration, None).await;
+
+        let resign_op = self.next_op_num();
+        let resignation_election =
+            LeaderElection::new(self.election_subspace.clone(), renewal_duration)
+                .expect("completion lease duration is non-zero");
+        match run_resign(
+            db,
+            resignation_election,
+            self.log_subspace.clone(),
+            renewed,
+            simulated_now(&self.context),
+            self.client_id,
+            leader_incarnation,
+            true,
+            resign_op,
+        )
+        .await
+        {
+            Ok(true) => {}
+            Ok(false) => self.protocol_error(
+                "FinalExactResignContended",
+                resign_op,
+                "the deterministic exact-resignation witness was contended",
+            ),
+            Err(error) => self.run_diagnostic("FinalExactResignFailed", resign_op, error),
+        }
+    }
+}
+
+struct PollRun {
+    next_state: LocalState,
+    leadership: Option<Leadership>,
+    transition: PollTransition,
+    adoption_delay: Option<AdoptionDelay>,
+}
+
+#[derive(Clone, Copy)]
+enum AdoptionDelay {
+    Shorter,
+    Exact,
+    Longer,
+}
+
+impl AdoptionDelay {
+    fn from_random(random: u32) -> Self {
+        match random % 3 {
+            0 => Self::Shorter,
+            1 => Self::Exact,
+            _ => Self::Longer,
+        }
+    }
+
+    fn duration(self, lease_duration: Duration) -> Duration {
+        match self {
+            Self::Shorter => lease_duration / 2,
+            Self::Exact => lease_duration,
+            Self::Longer => lease_duration.saturating_add(Duration::from_millis(1)),
+        }
+    }
+
+    fn for_completion_phase(phase: usize) -> Self {
+        [Self::Shorter, Self::Exact, Self::Longer][phase]
+    }
+}
+
+#[derive(Clone)]
+enum LocalExpectation {
+    Exact(LocalInput),
+    AdoptedObservation {
+        owner: String,
+        rank: u64,
+        lease_duration: Duration,
+        not_before: Duration,
+        planned_adoption_delay: Option<Duration>,
+    },
+}
+
+struct CoverageReport {
+    forced_observed: usize,
+    forced_missing: Vec<&'static str>,
+    probabilistic_observed: usize,
+    probabilistic_missing: Vec<&'static str>,
+    saw_coordinated_race: bool,
+    coordinated_race_contenders: usize,
+}
+
+#[derive(Default)]
+struct ReplayWitnesses {
+    saw_expiry: bool,
+    saw_foreign_takeover: bool,
+    last_takeover_rank: Option<u64>,
+    saw_before_expiry: bool,
+    saw_exact_expiry: bool,
+    saw_after_expiry: bool,
+    saw_stale_renew: bool,
+    saw_stale_renew_after_advance: bool,
+    saw_stale_resign: bool,
+    saw_delayed_stale_resign: bool,
+    saw_stale_resign_after_takeover: bool,
+    saw_exact_resign: bool,
+    saw_stale_write: bool,
+    saw_zero_rank_stale_write: bool,
+    saw_post_advance_stale_write: bool,
+    renewal_with_new_duration_rank: Option<u64>,
+    saw_follower_duration_reset: bool,
+    saw_delayed_observation_adoption: bool,
+    race_predecessor: Option<(String, u64, Duration)>,
+    race_contenders: BTreeSet<String>,
+    race_winner: Option<String>,
+    race_stale_writers: BTreeSet<String>,
+}
+
+async fn continuous_snapshot_check(
+    db: &SimDatabase,
+    election: LeaderElection,
+    register: RankedRegister,
+) -> Result<(), FdbBindingError> {
+    let snapshot = db
+        .run(|txn, _maybe_committed| {
+            let election = election.clone();
+            let register = register.clone();
+            async move {
+                txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                let election =
+                    durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
+                let protected = register
+                    .read(&txn, Rank::ZERO)
+                    .await
+                    .map_err(ranked_register_error)?;
+                Ok::<_, FdbBindingError>((
+                    election,
+                    protected.write_rank().as_u64(),
+                    protected.into_value(),
+                ))
+            }
+        })
+        .await?;
+    let (election, protected_rank, protected_value) = snapshot;
+    let valid_election = match election.rank {
+        0 => election.owner.is_none() && election.lease_duration.is_none(),
+        _ => election
+            .lease_duration
+            .is_some_and(|duration| !duration.is_zero()),
+    };
+    let valid_register =
+        protected_rank <= election.rank && (protected_rank == 0) == protected_value.is_none();
+    if valid_election && valid_register {
+        Ok(())
+    } else {
+        Err(log_error("invalid public election/register snapshot"))
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn run_poll(
+    db: &SimDatabase,
+    election: LeaderElection,
+    register: RankedRegister,
+    log_subspace: Subspace,
+    participant: ParticipantId,
+    local_state: LocalState,
+    tracks_local_state: bool,
+    context: &WorkloadContext,
+    client_id: i32,
+    incarnation: u64,
+    op_num: u64,
+    adoption_delay: Option<AdoptionDelay>,
+) -> Result<PollRun, FdbBindingError> {
+    let payload = protected_payload(participant.as_str(), op_num);
+    let configured_lease_duration = election.lease_duration();
+    let (poll, attempt_started_at, planned_adoption_delay) = db
+        .run(|txn, _maybe_committed| {
+            let election = election.clone();
+            let register = register.clone();
+            let log_subspace = log_subspace.clone();
+            let participant = participant.clone();
+            let local_state = local_state.clone();
+            let payload = payload.clone();
+            let context = context.clone();
+            async move {
+                let attempt_started_at = simulated_now(&context);
+                txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                let prior =
+                    durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
+                let local_token = local_input(&local_state);
+                let poll = election
+                    .poll(&txn, &participant, &local_state, attempt_started_at)
+                    .await
+                    .map_err(FdbBindingError::from)?;
+                let transition = transition_code(poll.outcome().transition());
+                let leader = matches!(poll.outcome(), PollOutcome::Leader { .. });
+                let (requested_write_rank, observed_write_rank, observed_value, write_committed) =
+                    if let PollOutcome::Leader { rank, .. } = poll.outcome() {
+                        let read = register
+                            .read(&txn, *rank)
+                            .await
+                            .map_err(ranked_register_error)?;
+                        let write = register
+                            .write(&txn, *rank, &payload)
+                            .await
+                            .map_err(ranked_register_error)?;
+                        (
+                            rank.as_u64(),
+                            read.write_rank().as_u64(),
+                            read.into_value(),
+                            write.is_committed(),
+                        )
+                    } else {
+                        (0, 0, None, false)
+                    };
+                let current =
+                    durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
+                let planned_adoption_delay =
+                    planned_follower_adoption_delay(&poll, &local_state, adoption_delay);
+                write_log(
+                    &txn,
+                    &log_subspace,
+                    client_id,
+                    incarnation,
+                    op_num,
+                    OP_POLL,
+                    participant.as_str(),
+                    &prior,
+                    &current,
+                    &local_token,
+                    tracks_local_state,
+                    attempt_started_at,
+                    configured_lease_duration,
+                    planned_adoption_delay,
+                    transition,
+                    leader,
+                    requested_write_rank,
+                    observed_write_rank,
+                    observed_value.as_deref(),
+                    write_committed,
+                    if leader { &payload } else { &[] },
+                );
+                Ok::<_, FdbBindingError>((poll, attempt_started_at, planned_adoption_delay))
+            }
+        })
+        .await?;
+    let adoption_delay = match (adoption_delay, planned_adoption_delay) {
+        (Some(delay), Some(duration)) => match context.delay(duration).await {
+            Ok(()) => Some(delay),
+            Err(error) => return Err(FdbBindingError::from(error)),
+        },
+        _ => None,
+    };
+    let adopted_at =
+        simulated_now(context).max(attempt_started_at.saturating_add(Duration::from_nanos(1)));
+    let transition = poll.outcome().transition();
+    let next_state = poll.into_next_state(adopted_at);
+    Ok(PollRun {
+        leadership: next_state.leadership().cloned(),
+        next_state,
+        transition,
+        adoption_delay,
+    })
+}
+
+fn planned_follower_adoption_delay(
+    poll: &foundationdb::recipes::leader_election::PollResult,
+    local_state: &LocalState,
+    adoption_delay: Option<AdoptionDelay>,
+) -> Option<Duration> {
+    let PollOutcome::Follower {
+        owner,
+        rank,
+        lease_duration,
+    } = poll.outcome()
+    else {
+        return None;
+    };
+    let is_new_or_reset = !matches!(
+        local_state,
+        LocalState::Observation(observation)
+            if observation.owner() == owner
+                && observation.rank() == *rank
+                && observation.lease_duration() == *lease_duration
+    );
+    if is_new_or_reset {
+        adoption_delay.map(|delay| delay.duration(*lease_duration))
+    } else {
+        None
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn run_resign(
+    db: &SimDatabase,
+    election: LeaderElection,
+    log_subspace: Subspace,
+    leadership: Leadership,
+    now: Duration,
+    client_id: i32,
+    incarnation: u64,
+    tracks_local_state: bool,
+    op_num: u64,
+) -> Result<bool, FdbBindingError> {
+    let configured_lease_duration = election.lease_duration();
+    db.run(|txn, _maybe_committed| {
+        let election = election.clone();
+        let log_subspace = log_subspace.clone();
+        let leadership = leadership.clone();
+        async move {
+            txn.set_option(TransactionOption::AutomaticIdempotency)?;
+            let prior =
+                durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
+            let result = election
+                .resign(&txn, &leadership)
+                .await
+                .map_err(FdbBindingError::from)?
+                .is_resigned();
+            let current =
+                durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
+            let actor = leadership.participant().as_str().to_owned();
+            let local_token = local_input(&LocalState::Leadership(leadership.clone()));
+            write_log(
+                &txn,
+                &log_subspace,
+                client_id,
+                incarnation,
+                op_num,
+                OP_RESIGN,
+                &actor,
+                &prior,
+                &current,
+                &local_token,
+                tracks_local_state,
+                now,
+                configured_lease_duration,
+                None,
+                TRANSITION_NONE,
+                result,
+                0,
+                0,
+                None,
+                false,
+                &[],
+            );
+            Ok::<_, FdbBindingError>(result)
+        }
+    })
+    .await
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn run_observer(
+    db: &SimDatabase,
+    election: LeaderElection,
+    log_subspace: Subspace,
+    actor: String,
+    configured_lease_duration: Duration,
+    now: Duration,
+    client_id: i32,
+    incarnation: u64,
+    op_num: u64,
+) -> Result<(), FdbBindingError> {
+    db.run(|txn, _maybe_committed| {
+        let election = election.clone();
+        let log_subspace = log_subspace.clone();
+        let actor = actor.clone();
+        async move {
+            txn.set_option(TransactionOption::AutomaticIdempotency)?;
+            let state =
+                durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
+            write_log(
+                &txn,
+                &log_subspace,
+                client_id,
+                incarnation,
+                op_num,
+                OP_OBSERVE,
+                &actor,
+                &state,
+                &state,
+                &LocalInput::Unknown,
+                false,
+                now,
+                configured_lease_duration,
+                None,
+                TRANSITION_NONE,
+                true,
+                0,
+                0,
+                None,
+                false,
+                &[],
+            );
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn run_stale_write(
+    db: &SimDatabase,
+    election: LeaderElection,
+    register: RankedRegister,
+    log_subspace: Subspace,
+    actor: String,
+    stale_rank: Rank,
+    now: Duration,
+    client_id: i32,
+    incarnation: u64,
+    op_num: u64,
+) -> Result<bool, FdbBindingError> {
+    let configured_lease_duration = election.lease_duration();
+    let payload = format!("stale:{actor}:{op_num}").into_bytes();
+    db.run(|txn, _maybe_committed| {
+        let election = election.clone();
+        let register = register.clone();
+        let log_subspace = log_subspace.clone();
+        let actor = actor.clone();
+        let payload = payload.clone();
+        async move {
+            txn.set_option(TransactionOption::AutomaticIdempotency)?;
+            let state =
+                durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
+            let write = register
+                .write(&txn, stale_rank, &payload)
+                .await
+                .map_err(ranked_register_error)?;
+            let readback = register
+                .read(&txn, Rank::ZERO)
+                .await
+                .map_err(ranked_register_error)?;
+            let readback_rank = readback.write_rank().as_u64();
+            let readback_value = readback.into_value();
+            write_log(
+                &txn,
+                &log_subspace,
+                client_id,
+                incarnation,
+                op_num,
+                OP_STALE_WRITE,
+                &actor,
+                &state,
+                &state,
+                &LocalInput::Unknown,
+                false,
+                now,
+                configured_lease_duration,
+                None,
+                TRANSITION_NONE,
+                write.is_committed(),
+                stale_rank.as_u64(),
+                readback_rank,
+                readback_value.as_deref(),
+                write.is_committed(),
+                &payload,
+            );
+            Ok::<_, FdbBindingError>(write.is_committed())
+        }
+    })
+    .await
+}
+
+#[allow(clippy::too_many_arguments)]
+fn write_log(
+    txn: &foundationdb::Transaction,
+    log_subspace: &Subspace,
+    client_id: i32,
+    incarnation: u64,
+    op_num: u64,
+    kind: i64,
+    actor: &str,
+    prior: &DurableState,
+    current: &DurableState,
+    local: &LocalInput,
+    tracks_local_state: bool,
+    attempt_started_at: Duration,
+    configured_lease_duration: Duration,
+    planned_adoption_delay: Option<Duration>,
+    transition: i64,
+    result: bool,
+    requested_write_rank: u64,
+    observed_write_rank: u64,
+    observed_value: Option<&[u8]>,
+    protected_write_committed: bool,
+    payload: &[u8],
+) {
+    let key = log_subspace.pack_with_versionstamp(&(
+        Versionstamp::incomplete(0),
+        client_id,
+        incarnation,
+        op_num,
+    ));
+    let value = pack(&(
+        kind,
+        actor,
+        durable_wire(prior),
+        durable_wire(current),
+        local_wire(local),
+        tracks_local_state,
+        duration_wire(attempt_started_at),
+        duration_wire(configured_lease_duration),
+        optional_duration_wire(planned_adoption_delay),
+        transition,
+        result,
+        (
+            requested_write_rank,
+            observed_write_rank,
+            observed_value.is_some(),
+            observed_value.unwrap_or(&[]),
+            protected_write_committed,
+            payload,
+        ),
+    ));
+    txn.atomic_op(&key, &value, MutationType::SetVersionstampedKey);
+}
+
+fn decode_log_entry(
+    log_subspace: &Subspace,
+    key: &[u8],
+    value: &[u8],
+) -> Result<LogEntry, FdbBindingError> {
+    let (versionstamp, client_id, incarnation, op_num): (Versionstamp, i32, u64, u64) =
+        log_subspace
+            .unpack(key)
+            .map_err(FdbBindingError::PackError)?;
+    let (
+        kind,
+        actor,
+        prior,
+        current,
+        local,
+        tracks_local_state,
+        attempt_started_at,
+        configured_lease_duration,
+        planned_adoption_delay,
+        transition,
+        result,
+        (
+            requested_write_rank,
+            observed_write_rank,
+            observed_has_value,
+            observed_value,
+            protected_write_committed,
+            payload,
+        ),
+    ): LogWire = unpack(value).map_err(FdbBindingError::PackError)?;
+    Ok(LogEntry {
+        versionstamp,
+        client_id,
+        incarnation,
+        op_num,
+        kind,
+        actor,
+        prior: durable_from_wire(prior)?,
+        current: durable_from_wire(current)?,
+        local_input: local_from_wire(local)?,
+        tracks_local_state,
+        attempt_started_at: duration_from_wire(attempt_started_at)?,
+        configured_lease_duration: duration_from_wire(configured_lease_duration)?,
+        planned_adoption_delay: optional_duration_from_wire(planned_adoption_delay)?,
+        transition,
+        result,
+        requested_write_rank,
+        observed_write_rank,
+        observed_value: optional_value(observed_has_value, observed_value)?,
+        protected_write_committed,
+        payload,
+    })
+}
+
+type DurationWire = (u64, u32);
+type OptionalDurationWire = (bool, u64, u32);
+type DurableWire = (u64, bool, String, bool, u64, u32);
+type LocalWire = (i64, bool, String, u64, bool, u64, u32, u64, u32);
+type ProtectedWire = (u64, u64, bool, Vec<u8>, bool, Vec<u8>);
+type LogWire = (
+    i64,
+    String,
+    DurableWire,
+    DurableWire,
+    LocalWire,
+    bool,
+    DurationWire,
+    DurationWire,
+    OptionalDurationWire,
+    i64,
+    bool,
+    ProtectedWire,
+);
+
+fn replay(entries: &[LogEntry], snapshot: &Snapshot) -> Result<CoverageReport, String> {
+    let mut seen = BTreeSet::new();
+    let mut local_states = BTreeMap::new();
+    let mut previous_versionstamp = None;
+    let mut election = DurableState::default();
+    let mut protected_rank = 0;
+    let mut protected_value = None;
+    let mut witnesses = ReplayWitnesses::default();
+
+    for entry in entries {
+        if !entry.versionstamp.is_complete()
+            || previous_versionstamp
+                .as_ref()
+                .is_some_and(|previous| previous >= &entry.versionstamp)
+        {
+            return Err("operation log is not strictly commit ordered".to_owned());
+        }
+        previous_versionstamp = Some(entry.versionstamp.clone());
+        if entry.actor.is_empty()
+            || !seen.insert((entry.actor.clone(), entry.incarnation, entry.op_num))
+        {
+            return Err(format!(
+                "invalid logical operation ({}, {})",
+                entry.actor, entry.op_num
+            ));
+        }
+        if entry.prior != election {
+            return Err(format!(
+                "operation ({}, {}) prior state {:?} differs from replay {:?}",
+                entry.client_id, entry.op_num, entry.prior, election
+            ));
+        }
+        if entry.configured_lease_duration.is_zero() {
+            return Err(format!(
+                "operation ({}, {}) configured zero lease",
+                entry.client_id, entry.op_num
+            ));
+        }
+        let delayed_observation = validate_local_input(entry, &local_states)?;
+
+        match entry.kind {
+            OP_POLL => replay_poll(
+                entry,
+                &mut election,
+                &mut protected_rank,
+                &mut protected_value,
+                &mut witnesses,
+                delayed_observation,
+            )?,
+            OP_RESIGN => replay_resign(entry, &mut election, &mut witnesses)?,
+            OP_OBSERVE => {
+                if entry.current != election
+                    || entry.local_input != LocalInput::Unknown
+                    || entry.transition != TRANSITION_NONE
+                    || !entry.result
+                    || has_protected_effect(entry)
+                {
+                    return Err(format!(
+                        "observer ({}, {}) changed state",
+                        entry.client_id, entry.op_num
+                    ));
+                }
+            }
+            OP_STALE_WRITE => {
+                if entry.current != election
+                    || entry.local_input != LocalInput::Unknown
+                    || entry.transition != TRANSITION_NONE
+                    || entry.result
+                    || entry.requested_write_rank >= election.rank
+                    || entry.observed_write_rank != protected_rank
+                    || entry.observed_value != protected_value
+                    || entry.protected_write_committed
+                    || entry.payload != stale_payload(&entry.actor, entry.op_num)
+                {
+                    return Err(format!(
+                        "stale write ({}, {}) was not rejected",
+                        entry.client_id, entry.op_num
+                    ));
+                }
+                witnesses.saw_stale_write = true;
+                if entry.requested_write_rank == 0 {
+                    witnesses.saw_zero_rank_stale_write = true;
+                } else {
+                    witnesses.saw_post_advance_stale_write = true;
+                }
+                record_race_stale_write(entry, &mut witnesses)?;
+            }
+            other => return Err(format!("unknown operation kind {other}")),
+        }
+        advance_local_state(entry, &election, &mut local_states)?;
+    }
+
+    if snapshot.election != election
+        || snapshot.protected_rank != protected_rank
+        || snapshot.protected_value != protected_value
+    {
+        return Err(
+            "final public election or ranked-register state differs from replay".to_owned(),
+        );
+    }
+    if protected_value.is_none() {
+        return Err("no fenced leader write committed".to_owned());
+    }
+    let mut forced_missing = Vec::new();
+    if !witnesses.saw_expiry {
+        forced_missing.push("expiry");
+    }
+    if !witnesses.saw_foreign_takeover {
+        forced_missing.push("foreign_takeover");
+    }
+    if !witnesses.saw_before_expiry {
+        forced_missing.push("before_expiry");
+    }
+    if !witnesses.saw_after_expiry {
+        forced_missing.push("after_expiry");
+    }
+    if !witnesses.saw_stale_renew {
+        forced_missing.push("stale_renew");
+    }
+    if !witnesses.saw_stale_write {
+        forced_missing.push("stale_write");
+    }
+    if !witnesses.saw_delayed_observation_adoption {
+        forced_missing.push("delayed_observation_adoption");
+    }
+    if !witnesses.saw_exact_resign {
+        forced_missing.push("exact_resign");
+    }
+    if !witnesses.saw_follower_duration_reset {
+        forced_missing.push("follower_duration_reset");
+    }
+    let mut probabilistic_missing = Vec::new();
+    if !witnesses.saw_exact_expiry {
+        probabilistic_missing.push("exact_expiry");
+    }
+    if !witnesses.saw_stale_renew_after_advance {
+        probabilistic_missing.push("stale_renew_after_advance");
+    }
+    if !witnesses.saw_stale_resign {
+        probabilistic_missing.push("stale_resign");
+    }
+    if !witnesses.saw_delayed_stale_resign {
+        probabilistic_missing.push("delayed_stale_resign");
+    }
+    if !witnesses.saw_stale_resign_after_takeover {
+        probabilistic_missing.push("stale_resign_after_takeover");
+    }
+    if !witnesses.saw_post_advance_stale_write {
+        probabilistic_missing.push("post_advance_stale_write");
+    }
+    if !witnesses.saw_zero_rank_stale_write {
+        probabilistic_missing.push("zero_rank_stale_write");
+    }
+    let saw_coordinated_race = witnesses.race_contenders.len() >= 2
+        && witnesses.race_winner.is_some()
+        && witnesses.race_stale_writers == witnesses.race_contenders;
+    Ok(CoverageReport {
+        forced_observed: FORCED_WITNESS_COUNT - forced_missing.len(),
+        forced_missing,
+        probabilistic_observed: PROBABILISTIC_WITNESS_COUNT - probabilistic_missing.len(),
+        probabilistic_missing,
+        saw_coordinated_race,
+        coordinated_race_contenders: witnesses.race_contenders.len(),
+    })
+}
+
+fn replay_poll(
+    entry: &LogEntry,
+    election: &mut DurableState,
+    protected_rank: &mut u64,
+    protected_value: &mut Option<Vec<u8>>,
+    witnesses: &mut ReplayWitnesses,
+    delayed_observation: bool,
+) -> Result<(), String> {
+    let leader = validate_reported_poll(entry, election)?;
+
+    if leader {
+        let expected_rank = election.rank.checked_add(1).ok_or("revision overflow")?;
+        let expected = DurableState {
+            rank: expected_rank,
+            owner: Some(entry.actor.clone()),
+            lease_duration: Some(entry.configured_lease_duration),
+        };
+        if entry.current != expected
+            || entry.requested_write_rank != expected_rank
+            || entry.observed_write_rank != *protected_rank
+            || entry.observed_value != *protected_value
+            || !entry.protected_write_committed
+            || entry.payload != protected_payload(&entry.actor, entry.op_num)
+        {
+            return Err(format!(
+                "leader poll ({}, {}) has invalid durable or fenced-write evidence",
+                entry.client_id, entry.op_num
+            ));
+        }
+        if matches!(
+            entry.transition,
+            TRANSITION_TOOK_OVER | TRANSITION_REACQUIRED
+        ) {
+            witnesses.saw_expiry = true;
+        }
+        if entry.transition == TRANSITION_TOOK_OVER {
+            witnesses.saw_foreign_takeover = true;
+            witnesses.last_takeover_rank = Some(expected.rank);
+        }
+        if entry.transition == TRANSITION_RENEWED
+            && election.lease_duration != expected.lease_duration
+        {
+            witnesses.renewal_with_new_duration_rank = Some(expected.rank);
+        }
+        if let LocalInput::Observation {
+            owner,
+            rank,
+            lease_duration,
+            observed_at,
+        } = &entry.local_input
+        {
+            if election.owner.as_deref() == Some(owner)
+                && election.rank == *rank
+                && election.lease_duration == Some(*lease_duration)
+            {
+                let elapsed = entry.attempt_started_at.saturating_sub(*observed_at);
+                match elapsed.cmp(lease_duration) {
+                    std::cmp::Ordering::Equal => witnesses.saw_exact_expiry = true,
+                    std::cmp::Ordering::Greater => witnesses.saw_after_expiry = true,
+                    std::cmp::Ordering::Less => {}
+                }
+            }
+        }
+        *election = expected;
+        *protected_rank = expected_rank;
+        *protected_value = Some(entry.payload.clone());
+    } else {
+        if entry.current != *election || has_protected_effect(entry) {
+            return Err(format!(
+                "follower poll ({}, {}) changed state",
+                entry.client_id, entry.op_num
+            ));
+        }
+        if let LocalInput::Observation {
+            owner,
+            rank,
+            lease_duration,
+            observed_at,
+        } = &entry.local_input
+        {
+            if election.owner.as_deref() == Some(owner)
+                && election.rank == *rank
+                && election.lease_duration == Some(*lease_duration)
+                && entry.attempt_started_at.saturating_sub(*observed_at) < *lease_duration
+            {
+                witnesses.saw_before_expiry = true;
+                if delayed_observation {
+                    witnesses.saw_delayed_observation_adoption = true;
+                }
+            }
+        }
+        if let LocalInput::Leadership {
+            participant,
+            rank,
+            lease_duration,
+            renewed_at,
+        } = &entry.local_input
+        {
+            if participant == &entry.actor {
+                witnesses.saw_stale_renew = true;
+                if election.owner.as_deref() == Some(entry.actor.as_str())
+                    && election.rank == *rank
+                    && election.lease_duration == Some(*lease_duration)
+                    && entry.attempt_started_at.saturating_sub(*renewed_at) >= *lease_duration
+                {
+                    witnesses.saw_after_expiry = true;
+                }
+                if *rank < election.rank {
+                    witnesses.saw_stale_renew_after_advance = true;
+                }
+            }
+        }
+    }
+    if !leader {
+        if let Some(changed_rank) = witnesses.renewal_with_new_duration_rank {
+            if election.rank == changed_rank
+                && matches!(
+                    &entry.local_input,
+                    LocalInput::Unknown | LocalInput::Leadership { .. }
+                )
+            {
+                witnesses.saw_follower_duration_reset = true;
+            }
+        }
+    }
+    record_race_takeover(entry, witnesses)?;
+    Ok(())
+}
+
+fn record_race_takeover(entry: &LogEntry, witnesses: &mut ReplayWitnesses) -> Result<(), String> {
+    let LocalInput::Observation {
+        owner,
+        rank,
+        lease_duration,
+        observed_at,
+    } = &entry.local_input
+    else {
+        return Ok(());
+    };
+    if !entry.actor.starts_with(RACE_PARTICIPANT_PREFIX)
+        || entry.attempt_started_at.saturating_sub(*observed_at) < *lease_duration
+    {
+        return Ok(());
+    }
+    let predecessor = (owner.clone(), *rank, *lease_duration);
+    if let Some(expected) = witnesses.race_predecessor.as_ref() {
+        if expected != &predecessor {
+            return Err("coordinated race contenders observed different predecessors".to_owned());
+        }
+    } else {
+        witnesses.race_predecessor = Some(predecessor);
+    }
+    if !witnesses.race_contenders.insert(entry.actor.clone()) {
+        return Err("coordinated race contender retried as a second logical operation".to_owned());
+    }
+    match (entry.transition, entry.result) {
+        (TRANSITION_TOOK_OVER, true) => {
+            if witnesses.race_winner.replace(entry.actor.clone()).is_some() {
+                return Err("coordinated race elected more than one winner".to_owned());
+            }
+        }
+        (TRANSITION_FOLLOWED, false) => {}
+        _ => return Err("coordinated race contender reported an invalid outcome".to_owned()),
+    }
+    Ok(())
+}
+
+fn record_race_stale_write(
+    entry: &LogEntry,
+    witnesses: &mut ReplayWitnesses,
+) -> Result<(), String> {
+    if !entry.actor.starts_with(RACE_PARTICIPANT_PREFIX) {
+        return Ok(());
+    }
+    let Some((_, predecessor_rank, _)) = witnesses.race_predecessor.as_ref() else {
+        return Err("coordinated race stale write lacks a predecessor".to_owned());
+    };
+    if entry.requested_write_rank != *predecessor_rank {
+        return Err("coordinated race stale write used the wrong rank".to_owned());
+    }
+    if !witnesses.race_stale_writers.insert(entry.actor.clone()) {
+        return Err("coordinated race contender issued multiple stale writes".to_owned());
+    }
+    Ok(())
+}
+
+fn replay_resign(
+    entry: &LogEntry,
+    election: &mut DurableState,
+    witnesses: &mut ReplayWitnesses,
+) -> Result<(), String> {
+    let LocalInput::Leadership {
+        participant,
+        rank,
+        lease_duration,
+        ..
+    } = &entry.local_input
+    else {
+        return Err(format!(
+            "resign ({}, {}) lacks leadership token",
+            entry.client_id, entry.op_num
+        ));
+    };
+    let matches = election.owner.as_deref() == Some(participant)
+        && election.rank == *rank
+        && election.lease_duration == Some(*lease_duration);
+    let expected = if matches {
+        DurableState {
+            rank: election.rank,
+            owner: None,
+            lease_duration: election.lease_duration,
+        }
+    } else {
+        election.clone()
+    };
+    if entry.transition != TRANSITION_NONE
+        || entry.result != matches
+        || entry.current != expected
+        || has_protected_effect(entry)
+    {
+        return Err(format!(
+            "resign ({}, {}) has invalid result",
+            entry.client_id, entry.op_num
+        ));
+    }
+    if !matches {
+        // An idempotent re-execution after an exact resignation is a safe no-op, like a stale
+        // resignation, so replay accepts either instead of requiring a durable change.
+        witnesses.saw_stale_resign = true;
+        if let LocalInput::Leadership {
+            renewed_at,
+            lease_duration,
+            ..
+        } = &entry.local_input
+        {
+            if entry.attempt_started_at.saturating_sub(*renewed_at) > *lease_duration {
+                witnesses.saw_delayed_stale_resign = true;
+            }
+        }
+        if witnesses
+            .last_takeover_rank
+            .is_some_and(|takeover_rank| *rank < takeover_rank)
+        {
+            witnesses.saw_stale_resign_after_takeover = true;
+        }
+    } else {
+        witnesses.saw_exact_resign = true;
+    }
+    *election = expected;
+    Ok(())
+}
+
+fn validate_local_input(
+    entry: &LogEntry,
+    local_states: &BTreeMap<(String, u64), LocalExpectation>,
+) -> Result<bool, String> {
+    if !entry.tracks_local_state {
+        return Ok(false);
+    }
+    let key = (entry.actor.clone(), entry.incarnation);
+    match local_states.get(&key) {
+        None if entry.local_input == LocalInput::Unknown => Ok(false),
+        None => Err(format!(
+            "incarnation ({}, {}) adopted local state without a prior poll",
+            entry.actor, entry.incarnation
+        )),
+        Some(LocalExpectation::Exact(expected)) if expected == &entry.local_input => Ok(false),
+        Some(LocalExpectation::AdoptedObservation {
+            owner,
+            rank,
+            lease_duration,
+            not_before,
+            planned_adoption_delay,
+        }) => match &entry.local_input {
+            LocalInput::Observation {
+                owner: actual_owner,
+                rank: actual_rank,
+                lease_duration: actual_duration,
+                observed_at,
+            } if actual_owner == owner
+                && actual_rank == rank
+                && actual_duration == lease_duration
+                && *observed_at > *not_before
+                && adopted_after_planned_delay(
+                    *observed_at,
+                    *not_before,
+                    planned_adoption_delay.unwrap_or_default(),
+                )
+                && *observed_at <= entry.attempt_started_at =>
+            {
+                Ok(planned_adoption_delay.is_some_and(|delay| delay > *lease_duration))
+            }
+            _ => Err(format!(
+                "incarnation ({}, {}) did not adopt its follower observation",
+                entry.actor, entry.incarnation
+            )),
+        },
+        Some(_) => Err(format!(
+            "incarnation ({}, {}) local state regressed or changed unexpectedly",
+            entry.actor, entry.incarnation
+        )),
+    }
+}
+
+fn adopted_after_planned_delay(
+    observed_at: Duration,
+    not_before: Duration,
+    planned_adoption_delay: Duration,
+) -> bool {
+    observed_at
+        >= not_before
+            .saturating_add(planned_adoption_delay)
+            .saturating_sub(SIMULATED_TIME_ROUND_TRIP_TOLERANCE)
+}
+
+fn advance_local_state(
+    entry: &LogEntry,
+    election: &DurableState,
+    local_states: &mut BTreeMap<(String, u64), LocalExpectation>,
+) -> Result<(), String> {
+    if !entry.tracks_local_state {
+        return Ok(());
+    }
+    let key = (entry.actor.clone(), entry.incarnation);
+    let next = match entry.kind {
+        OP_POLL if entry.result => {
+            if entry.planned_adoption_delay.is_some() {
+                return Err("leader poll planned a follower adoption delay".to_owned());
+            }
+            LocalExpectation::Exact(LocalInput::Leadership {
+                participant: entry.actor.clone(),
+                rank: election.rank,
+                lease_duration: election
+                    .lease_duration
+                    .ok_or_else(|| "leader poll lost lease duration".to_owned())?,
+                renewed_at: entry.attempt_started_at,
+            })
+        }
+        OP_POLL => match &entry.local_input {
+            LocalInput::Observation {
+                owner,
+                rank,
+                lease_duration,
+                ..
+            } if election.owner.as_deref() == Some(owner)
+                && election.rank == *rank
+                && election.lease_duration == Some(*lease_duration) =>
+            {
+                if entry.planned_adoption_delay.is_some() {
+                    return Err("preserved follower observation planned a delay".to_owned());
+                }
+                LocalExpectation::Exact(entry.local_input.clone())
+            }
+            _ => follower_observation_expectation(
+                election,
+                entry.attempt_started_at,
+                entry.planned_adoption_delay,
+            )?,
+        },
+        OP_RESIGN if entry.result => LocalExpectation::Exact(LocalInput::Unknown),
+        OP_RESIGN => LocalExpectation::Exact(entry.local_input.clone()),
+        _ => return Ok(()),
+    };
+    local_states.insert(key, next);
+    Ok(())
+}
+
+fn follower_observation_expectation(
+    election: &DurableState,
+    not_before: Duration,
+    planned_adoption_delay: Option<Duration>,
+) -> Result<LocalExpectation, String> {
+    Ok(LocalExpectation::AdoptedObservation {
+        owner: election
+            .owner
+            .clone()
+            .ok_or_else(|| "follower poll lost owner".to_owned())?,
+        rank: election.rank,
+        lease_duration: election
+            .lease_duration
+            .ok_or_else(|| "follower poll lost lease duration".to_owned())?,
+        not_before,
+        planned_adoption_delay,
+    })
+}
+
+fn validate_reported_poll(entry: &LogEntry, election: &DurableState) -> Result<bool, String> {
+    let valid = match entry.transition {
+        // A stale token may acquire a released election, but its new rank still fences the old
+        // leadership, so this is not a renewal.
+        TRANSITION_ACQUIRED => entry.result && election.owner.is_none(),
+        TRANSITION_RENEWED => {
+            if !matches!(&entry.local_input, LocalInput::Leadership { .. }) {
+                return Err(poll_transition_error(
+                    entry,
+                    "renewal lacks a leadership token",
+                ));
+            }
+            entry.result && renewal_enabled(entry, election)
+        }
+        TRANSITION_TOOK_OVER | TRANSITION_REACQUIRED => {
+            let LocalInput::Observation { owner, .. } = &entry.local_input else {
+                return Err(poll_transition_error(
+                    entry,
+                    "takeover lacks an observation",
+                ));
+            };
+            entry.result
+                && takeover_enabled(entry, election)
+                && match entry.transition {
+                    TRANSITION_TOOK_OVER => owner != &entry.actor,
+                    TRANSITION_REACQUIRED => owner == &entry.actor,
+                    _ => unreachable!(),
+                }
+        }
+        TRANSITION_FOLLOWED => {
+            !entry.result
+                && election.owner.is_some()
+                && !renewal_enabled(entry, election)
+                && !takeover_enabled(entry, election)
+        }
+        other => return Err(format!("unknown poll transition {other}")),
+    };
+    if valid {
+        Ok(entry.result)
+    } else {
+        Err(poll_transition_error(
+            entry,
+            "reported transition violates its safety preconditions",
+        ))
+    }
+}
+
+fn renewal_enabled(entry: &LogEntry, election: &DurableState) -> bool {
+    let LocalInput::Leadership {
+        participant,
+        rank,
+        lease_duration,
+        renewed_at,
+    } = &entry.local_input
+    else {
+        return false;
+    };
+    participant == &entry.actor
+        && election.owner.as_deref() == Some(entry.actor.as_str())
+        && election.rank == *rank
+        && election.lease_duration == Some(*lease_duration)
+        && entry.attempt_started_at.saturating_sub(*renewed_at) < *lease_duration
+}
+
+fn takeover_enabled(entry: &LogEntry, election: &DurableState) -> bool {
+    let LocalInput::Observation {
+        owner,
+        rank,
+        lease_duration,
+        observed_at,
+    } = &entry.local_input
+    else {
+        return false;
+    };
+    election.owner.as_deref() == Some(owner)
+        && election.rank == *rank
+        && election.lease_duration == Some(*lease_duration)
+        && entry.attempt_started_at.saturating_sub(*observed_at) >= *lease_duration
+}
+
+fn poll_transition_error(entry: &LogEntry, message: &str) -> String {
+    format!(
+        "poll ({}, {}) transition {} invalid: {message}",
+        entry.client_id, entry.op_num, entry.transition
+    )
+}
+
+fn has_protected_effect(entry: &LogEntry) -> bool {
+    entry.requested_write_rank != 0
+        || entry.observed_write_rank != 0
+        || entry.observed_value.is_some()
+        || entry.protected_write_committed
+        || !entry.payload.is_empty()
+}
+
+fn durable_from_public(state: ElectionState) -> DurableState {
+    DurableState {
+        rank: state.rank().as_u64(),
+        owner: state.owner().map(|owner| owner.as_str().to_owned()),
+        lease_duration: state.lease_duration(),
+    }
+}
+
+fn local_input(state: &LocalState) -> LocalInput {
+    match state {
+        LocalState::Unknown => LocalInput::Unknown,
+        LocalState::Observation(observation) => LocalInput::Observation {
+            owner: observation.owner().as_str().to_owned(),
+            rank: observation.rank().as_u64(),
+            lease_duration: observation.lease_duration(),
+            observed_at: observation.first_observed_at(),
+        },
+        LocalState::Leadership(leadership) => LocalInput::Leadership {
+            participant: leadership.participant().as_str().to_owned(),
+            rank: leadership.rank().as_u64(),
+            lease_duration: leadership.lease_duration(),
+            renewed_at: leadership.last_renewed_at(),
+        },
+    }
+}
+
+fn transition_code(transition: PollTransition) -> i64 {
+    match transition {
+        PollTransition::Acquired => TRANSITION_ACQUIRED,
+        PollTransition::Renewed => TRANSITION_RENEWED,
+        PollTransition::TookOver => TRANSITION_TOOK_OVER,
+        PollTransition::Reacquired => TRANSITION_REACQUIRED,
+        PollTransition::Followed => TRANSITION_FOLLOWED,
+    }
+}
+
+fn durable_wire(state: &DurableState) -> DurableWire {
+    let (has_lease_duration, lease_secs, lease_nanos) = match state.lease_duration {
+        Some(duration) => (true, duration.as_secs(), duration.subsec_nanos()),
+        None => (false, 0, 0),
+    };
+    (
+        state.rank,
+        state.owner.is_some(),
+        state.owner.as_deref().unwrap_or("").to_owned(),
+        has_lease_duration,
+        lease_secs,
+        lease_nanos,
+    )
+}
+
+fn durable_from_wire(wire: DurableWire) -> Result<DurableState, FdbBindingError> {
+    let (rank, has_owner, owner, has_lease, lease_secs, lease_nanos) = wire;
+    let owner = optional_owner(has_owner, owner)?;
+    let lease_duration = optional_duration(has_lease, lease_secs, lease_nanos)?;
+    Ok(DurableState {
+        rank,
+        owner,
+        lease_duration,
+    })
+}
+
+fn local_wire(local: &LocalInput) -> LocalWire {
+    match local {
+        LocalInput::Unknown => (LOCAL_UNKNOWN, false, String::new(), 0, false, 0, 0, 0, 0),
+        LocalInput::Observation {
+            owner,
+            rank,
+            lease_duration,
+            observed_at,
+        } => (
+            LOCAL_OBSERVATION,
+            true,
+            owner.clone(),
+            *rank,
+            true,
+            lease_duration.as_secs(),
+            lease_duration.subsec_nanos(),
+            observed_at.as_secs(),
+            observed_at.subsec_nanos(),
+        ),
+        LocalInput::Leadership {
+            participant,
+            rank,
+            lease_duration,
+            renewed_at,
+        } => (
+            LOCAL_LEADERSHIP,
+            true,
+            participant.clone(),
+            *rank,
+            true,
+            lease_duration.as_secs(),
+            lease_duration.subsec_nanos(),
+            renewed_at.as_secs(),
+            renewed_at.subsec_nanos(),
+        ),
+    }
+}
+
+fn local_from_wire(wire: LocalWire) -> Result<LocalInput, FdbBindingError> {
+    let (kind, has_actor, actor, rank, has_lease, lease_secs, lease_nanos, at_secs, at_nanos) =
+        wire;
+    let actor = optional_owner(has_actor, actor)?;
+    let lease_duration = optional_duration(has_lease, lease_secs, lease_nanos)?;
+    let at = duration_from_wire((at_secs, at_nanos))?;
+    match kind {
+        LOCAL_UNKNOWN
+            if actor.is_none() && rank == 0 && lease_duration.is_none() && at.is_zero() =>
+        {
+            Ok(LocalInput::Unknown)
+        }
+        LOCAL_OBSERVATION => Ok(LocalInput::Observation {
+            owner: actor.ok_or_else(|| log_error("observation has no owner"))?,
+            rank,
+            lease_duration: lease_duration.ok_or_else(|| log_error("observation has no lease"))?,
+            observed_at: at,
+        }),
+        LOCAL_LEADERSHIP => Ok(LocalInput::Leadership {
+            participant: actor.ok_or_else(|| log_error("leadership has no participant"))?,
+            rank,
+            lease_duration: lease_duration.ok_or_else(|| log_error("leadership has no lease"))?,
+            renewed_at: at,
+        }),
+        _ => Err(log_error("invalid caller-local input in operation log")),
+    }
+}
+
+fn duration_wire(duration: Duration) -> DurationWire {
+    (duration.as_secs(), duration.subsec_nanos())
+}
+
+fn duration_from_wire(wire: DurationWire) -> Result<Duration, FdbBindingError> {
+    if wire.1 >= 1_000_000_000 {
+        return Err(log_error("duration nanoseconds out of range"));
+    }
+    Ok(Duration::new(wire.0, wire.1))
+}
+
+fn optional_duration_wire(duration: Option<Duration>) -> OptionalDurationWire {
+    match duration {
+        Some(duration) => (true, duration.as_secs(), duration.subsec_nanos()),
+        None => (false, 0, 0),
+    }
+}
+
+fn optional_duration_from_wire(
+    wire: OptionalDurationWire,
+) -> Result<Option<Duration>, FdbBindingError> {
+    optional_duration(wire.0, wire.1, wire.2)
+}
+
+fn optional_duration(
+    present: bool,
+    secs: u64,
+    nanos: u32,
+) -> Result<Option<Duration>, FdbBindingError> {
+    if present {
+        Ok(Some(duration_from_wire((secs, nanos))?))
+    } else if secs == 0 && nanos == 0 {
+        Ok(None)
+    } else {
+        Err(log_error("absent duration has non-zero fields"))
+    }
+}
+
+fn optional_owner(present: bool, owner: String) -> Result<Option<String>, FdbBindingError> {
+    match (present, owner.is_empty()) {
+        (true, false) => Ok(Some(owner)),
+        (false, true) => Ok(None),
+        _ => Err(log_error("invalid optional owner in operation log")),
+    }
+}
+
+fn optional_value(present: bool, value: Vec<u8>) -> Result<Option<Vec<u8>>, FdbBindingError> {
+    match (present, value.is_empty()) {
+        (true, _) => Ok(Some(value)),
+        (false, true) => Ok(None),
+        (false, false) => Err(log_error("invalid optional value in operation log")),
+    }
+}
+
+fn protected_payload(actor: &str, op_num: u64) -> Vec<u8> {
+    format!("leader:{actor}:{op_num}").into_bytes()
+}
+
+fn stale_payload(actor: &str, op_num: u64) -> Vec<u8> {
+    format!("stale:{actor}:{op_num}").into_bytes()
+}
+
+async fn delay_until(context: &WorkloadContext, target: Duration) {
+    let _ = context
+        .delay(target.saturating_sub(simulated_now(context)))
+        .await;
+}
+
+fn simulated_now(context: &WorkloadContext) -> Duration {
+    Duration::from_secs_f64(context.now().max(0.0))
+}
+
+fn ranked_register_error(error: RankedRegisterError) -> FdbBindingError {
+    FdbBindingError::new_custom_error(Box::new(error))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use super::{RACE_PARTICIPANT_PREFIX, adopted_after_planned_delay};
+
+    #[test]
+    fn race_prefix_matches_replacement_incarnations() {
+        assert!("race\0λ-0-0-1".starts_with(RACE_PARTICIPANT_PREFIX));
+        assert!(!r"race\0λ-0-0-1".starts_with(RACE_PARTICIPANT_PREFIX));
+    }
+
+    #[test]
+    fn delayed_adoption_tolerates_only_one_nanosecond_round_trip_loss() {
+        let not_before = Duration::from_secs(10);
+        let delay = Duration::from_secs(2);
+
+        assert!(adopted_after_planned_delay(
+            not_before + delay - Duration::from_nanos(1),
+            not_before,
+            delay,
+        ));
+        assert!(!adopted_after_planned_delay(
+            not_before + delay - Duration::from_nanos(2),
+            not_before,
+            delay,
+        ));
+    }
+}
+
+fn log_error(message: &str) -> FdbBindingError {
+    FdbBindingError::new_custom_error(Box::new(LogError(message.to_owned())))
+}
+
+#[derive(Debug)]
+struct LogError(String);
+
+impl std::fmt::Display for LogError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(&self.0)
+    }
+}
+
+impl std::error::Error for LogError {}
diff --git a/bindings/rust/foundationdb-recipes-simulation/src/lib.rs b/bindings/rust/foundationdb-recipes-simulation/src/lib.rs
new file mode 100644
index 00000000000..207e6616f84
--- /dev/null
+++ b/bindings/rust/foundationdb-recipes-simulation/src/lib.rs
@@ -0,0 +1,13 @@
+//! Simulation workloads for FoundationDB recipes
+//!
+//! This crate provides simulation workloads to test FoundationDB recipes
+//! under chaos conditions including network partitions, process failures,
+//! and cluster reconfigurations.
+
+mod leader_election;
+
+pub use leader_election::LeaderElectionWorkload;
+
+use foundationdb_simulation::register_workload;
+
+register_workload!(LeaderElectionWorkload);
diff --git a/bindings/rust/foundationdb-recipes-simulation/test_poll_leader_election.toml b/bindings/rust/foundationdb-recipes-simulation/test_poll_leader_election.toml
new file mode 100644
index 00000000000..a6e1bbec429
--- /dev/null
+++ b/bindings/rust/foundationdb-recipes-simulation/test_poll_leader_election.toml
@@ -0,0 +1,42 @@
+# Poll-based, fenced leader-election simulation.
+#
+# Clients autonomously select standard, contention, or suspicion profiles while
+# exercising one durable (revision, optional owner, lease duration) state. Every
+# leader poll co-commits a RankedRegister read, protected write at its fencing
+# rank, and a versionstamp-ordered operation-log entry.
+
+# Production runs Redwood; the unconstrained random engine draw picked RocksDB on
+# most seeds at up to 49x the wall time of this forced choice, and never picked
+# redwood at all (measured 2026-07-31).
+[configuration]
+storageEngineType = 3
+# The simulated S3/HTTP mock adds 1-3 machines per datacenter and nothing here uses it.
+simHTTPServerEnabled = false
+
+[[test]]
+testTitle = 'PollLeaderElection'
+# Skip post-test urgent/regular checks and storage audits. The independent randomized background
+# consistency scan remains enabled.
+runConsistencyCheck = false
+
+  [[test.workload]]
+    testName = 'External'
+    useCAPI = true
+    libraryName = 'foundationdb_recipes_simulation'
+    workloadName = 'LeaderElectionWorkload'
+    libraryPath = './target/release'
+
+  [[test.workload]]
+    # Broad deterministic disruption exercises transaction retries and
+    # maybe-committed outcomes. The commit log, not issue order, is the oracle.
+    testName = 'RandomClogging'
+    testDuration = 45.0
+    swizzle = 2
+
+  [[test.workload]]
+    # Rebooted and error-recovered clients use fresh incarnations and local state.
+    testName = 'Attrition'
+    machinesToKill = 6
+    machinesToLeave = 2
+    reboot = true
+    testDuration = 45.0
diff --git a/bindings/rust/foundationdb-simulation-tracing/Cargo.toml b/bindings/rust/foundationdb-simulation-tracing/Cargo.toml
new file mode 100644
index 00000000000..f58e2a432ce
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation-tracing/Cargo.toml
@@ -0,0 +1,39 @@
+[package]
+name = "foundationdb-simulation-tracing"
+version = "0.1.0"
+authors = [
+    "Pierre Zemb <contact@pierrezemb.fr>"
+]
+edition = "2024"
+description = """
+Forward tokio-tracing events into the FoundationDB simulator trace log
+"""
+license = "MIT/Apache-2.0"
+documentation = "https://docs.rs/foundationdb-simulation-tracing"
+repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+readme = "README.md"
+keywords = ["foundationdb", "simulation", "tracing"]
+
+[package.metadata.docs.rs]
+features = ["embedded-fdb-include", "fdb-7_4"]
+
+[dependencies]
+foundationdb-simulation = { version = "0.3.0", path = "../foundationdb-simulation", default-features = false }
+tracing-core = "0.1.36"
+tracing-subscriber = { version = "0.3.23", default-features = false, features = ["registry"] }
+
+[dev-dependencies]
+tracing = "0.1.44"
+foundationdb = { path = "../foundationdb", default-features = false, features = ["trace"] }
+
+[features]
+default = ["embedded-fdb-include"]
+fdb-7_1 = ["foundationdb-simulation/fdb-7_1"]
+fdb-7_3 = ["foundationdb-simulation/fdb-7_3"]
+fdb-7_4 = ["foundationdb-simulation/fdb-7_4"]
+embedded-fdb-include = ["foundationdb-simulation/embedded-fdb-include"]
+
+[[example]]
+name = "tracing_demo"
+path = "examples/tracing_demo/lib.rs"
+crate-type = ["cdylib"]
diff --git a/bindings/rust/foundationdb-simulation-tracing/README.md b/bindings/rust/foundationdb-simulation-tracing/README.md
new file mode 100644
index 00000000000..53d3476d444
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation-tracing/README.md
@@ -0,0 +1,104 @@
+# foundationdb-simulation-tracing
+
+Forward tokio [`tracing`](https://docs.rs/tracing) events into the FoundationDB
+simulator trace log. Once installed, both your workload's own `tracing::info!`
+/ `warn!` / ... calls and the `foundationdb` SDK's internal retry-loop
+diagnostics (enabled by the SDK's `trace` feature) land in the simulator's
+`trace.*.json` files next to fdbserver's own events, instead of being lost.
+
+## Usage
+
+Call `install` from your workload factory and keep the returned guard alive by
+storing it in your workload struct. The guard unbinds the context when the
+workload is torn down, so no event can reach a freed context.
+
+```rust,ignore
+use foundationdb_simulation::{
+    RustWorkload, SimDatabase, SingleRustWorkload, WorkloadContext, register_workload,
+};
+use foundationdb_simulation_tracing::{TracingGuard, install};
+
+struct MyWorkload {
+    // keep the guard alive for the workload's lifetime
+    _tracing: TracingGuard,
+    context: WorkloadContext,
+}
+
+impl SingleRustWorkload for MyWorkload {
+    fn new(_name: String, context: WorkloadContext) -> Self {
+        let _tracing = install(&context);
+        Self { _tracing, context }
+    }
+}
+
+// impl RustWorkload for MyWorkload { ... }
+register_workload!(MyWorkload);
+```
+
+From then on, `tracing::info!(client = 0, "starting")` shows up in the trace log
+as a TraceEvent of type `RustTracingEvent`. Grep for it:
+
+```bash
+grep '"Type": *"RustTracingEvent"' target/traces/trace.*.json
+```
+
+By default, the bridge forwards `INFO`, `WARN`, and `ERROR` events. Set
+`FDB_SIM_TRACING_LEVEL=debug` (or `trace`) before the workload starts to include
+lower-level events and spans. The value is read once when the subscriber is
+installed.
+
+Each forwarded event carries `Target`, `File`, `Line`, and `Message` details
+(when present) followed by the event's own fields.
+
+## Span context
+
+The subscriber is built on `tracing-subscriber`'s `Registry`, so events fired
+inside a span carry that span's context. For an event with an enclosing span,
+the forwarded details also include:
+
+- `Span`: the name of the innermost span.
+- `SpanPath`: the span names from the root to the innermost span, joined with
+  `/` (for example `demo_transaction` or `outer/inner`).
+- the fields of every ancestor span, from root to leaf.
+
+Attach a span to an async block with the `tracing::Instrument` trait
+(`future.instrument(span)`) rather than `span.enter()`, which must not be held
+across an `.await`.
+
+Collision rule: an event's own field always wins over a span field of the same
+name. A span field is skipped when the key is already present in the details, so
+no duplicate key is produced for that case.
+
+## Severity mapping
+
+`tracing` levels map to FDB severities as follows:
+
+| `tracing` level | FDB `Severity` |
+|---|---|
+| `TRACE`, `DEBUG` | `Debug` |
+| `INFO` | `Info` |
+| `WARN` | `Warn` |
+| `ERROR` | `WarnAlways` |
+
+`ERROR` maps to `WarnAlways`, never to `Severity::Error`. In the simulator a
+`Severity::Error` event flags the whole run as failed, and a dependency's (or
+your own) `tracing::error!` must not silently kill a simulation. If you want to
+fail the run on purpose, call `context.trace(Severity::Error, ...)` directly.
+
+## Caveats
+
+- Last created workload wins: in a multi-client simulation every factory call
+  re-binds the current thread's context slot. All contexts write to the same
+  simulator trace stream, so attribution is cosmetic, and each guard only
+  clears the slot if it still holds its own binding.
+- Reserved keys: FDB capitalizes the first letter of every detail key, so a
+  field named `file`, `line`, `target`, or `message` collides with the meta
+  keys this crate prepends (and `type`, `time`, `machine`, ... collide with
+  TraceEvent's own reserved keys). Duplicate keys are kept as-is in the JSON.
+
+## Features
+
+One FDB version feature must be selected: `fdb-7_1`, `fdb-7_3`, or `fdb-7_4`.
+`embedded-fdb-include` (on by default) compiles without a local FoundationDB
+install. These simply forward to the matching `foundationdb-simulation`
+features.
diff --git a/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs b/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs
new file mode 100644
index 00000000000..74b7534d3da
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs
@@ -0,0 +1,136 @@
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use foundationdb::{FdbBindingError, FdbError, tuple::Subspace};
+use foundationdb_simulation::{
+    Metric, Metrics, RustWorkload, SimDatabase, SingleRustWorkload, WorkloadContext,
+    register_workload,
+};
+use foundationdb_simulation_tracing::{TracingGuard, install};
+use tracing::Instrument;
+
+/// Demo workload that emits `tracing` events across its phases and forces one
+/// transaction conflict, so both the workload's own events and the SDK's
+/// retry-loop events land in the simulator trace log as `RustTracingEvent`.
+pub struct TracingDemoWorkload {
+    // Keep the tracing binding alive for as long as this workload exists.
+    _tracing: TracingGuard,
+    context: WorkloadContext,
+    client_id: i32,
+    committed: bool,
+}
+
+const DEMO_KEY: &[u8] = b"tracing_demo_key";
+
+impl SingleRustWorkload for TracingDemoWorkload {
+    fn new(_name: String, context: WorkloadContext) -> Self {
+        let _tracing = install(&context);
+        Self {
+            client_id: context.client_id(),
+            _tracing,
+            context,
+            committed: false,
+        }
+    }
+}
+
+impl RustWorkload for TracingDemoWorkload {
+    async fn setup(&mut self, _db: SimDatabase) {
+        tracing::info!(client = self.client_id, phase = "setup", "workload setup");
+        tracing::debug!(
+            client = self.client_id,
+            "debug-level event for severity filtering verification"
+        );
+    }
+
+    async fn start(&mut self, db: SimDatabase) {
+        tracing::info!(client = self.client_id, phase = "start", "workload start");
+        // Only a single client drives the transactions.
+        if self.client_id != 0 {
+            return;
+        }
+
+        let client_id = self.client_id;
+        let key = Subspace::all().pack(&DEMO_KEY);
+        // Interferes exactly once, on the first attempt, to force a single
+        // `not_committed` conflict so the SDK's retry events fire deterministically.
+        let interfere = AtomicBool::new(true);
+
+        // Wrap the retry loop in a span so forwarded events (including the SDK's
+        // own retry diagnostics) carry the Span/SpanPath and the `client` field.
+        // Attached with `.instrument` rather than `span.enter()` because the
+        // future is awaited.
+        let span = tracing::info_span!("demo_transaction", client = client_id);
+        let result = db
+            .run(|trx, _maybe_committed| {
+                let key = key.clone();
+                let db = &db;
+                let interfere = &interfere;
+                async move {
+                    // Establish a read conflict range on the key.
+                    let _ = trx.get(&key, false).await.map_err(FdbBindingError::from)?;
+
+                    if interfere.swap(false, Ordering::SeqCst) {
+                        // A competing transaction commits a write to the same key,
+                        // invalidating this transaction's read on commit.
+                        let other = db.create_trx().map_err(FdbBindingError::from)?;
+                        other.set(&key, b"competing");
+                        other
+                            .commit()
+                            .await
+                            .map_err(FdbError::from)
+                            .map_err(FdbBindingError::from)?;
+                        tracing::warn!(
+                            client = client_id,
+                            key = "tracing_demo_key",
+                            "injected a competing write to force a conflict"
+                        );
+                    }
+
+                    trx.set(&key, b"value");
+                    Ok(())
+                }
+            })
+            .instrument(span)
+            .await;
+
+        match result {
+            Ok(()) => {
+                self.committed = true;
+                tracing::info!(client = self.client_id, "transaction committed after retry");
+            }
+            Err(FdbBindingError::NonRetryableFdbError(error)) => {
+                tracing::error!(
+                    client = self.client_id,
+                    error_code = error.code(),
+                    "transaction failed"
+                );
+            }
+            Err(_) => {
+                tracing::error!(client = self.client_id, "transaction failed");
+            }
+        }
+    }
+
+    async fn check(&mut self, _db: SimDatabase) {
+        if self.client_id == 0 && !self.committed {
+            // Report the failure through the workload's own context so the run
+            // is flagged; the tracing bridge never emits Severity::Error.
+            self.context.trace(
+                foundationdb_simulation::Severity::Error,
+                "TracingDemoCommitFailed",
+                &[("Client", self.client_id.to_string())],
+            );
+        }
+        tracing::info!(client = self.client_id, phase = "check", "workload check");
+    }
+
+    fn get_metrics(&self, mut out: Metrics) {
+        out.extend([Metric::val("committed", self.committed as i32 as f64)]);
+    }
+
+    fn get_check_timeout(&self) -> f64 {
+        5000.0
+    }
+}
+
+register_workload!(TracingDemoWorkload);
diff --git a/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/test_tracing_demo.toml b/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/test_tracing_demo.toml
new file mode 100644
index 00000000000..2347b21fcfc
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/test_tracing_demo.toml
@@ -0,0 +1,9 @@
+[[test]]
+testTitle = 'TracingDemoWorkload'
+
+  [[test.workload]]
+    testName = 'External'
+    useCAPI = true
+    libraryName = 'tracing_demo'
+    workloadName = 'TracingDemoWorkload'
+    libraryPath = './target/release/examples'
diff --git a/bindings/rust/foundationdb-simulation-tracing/src/lib.rs b/bindings/rust/foundationdb-simulation-tracing/src/lib.rs
new file mode 100644
index 00000000000..848c1a63421
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation-tracing/src/lib.rs
@@ -0,0 +1,540 @@
+#![warn(missing_docs)]
+#![doc = include_str!("../README.md")]
+
+use std::{
+    cell::RefCell,
+    env, fmt,
+    sync::{Once, atomic::AtomicU64},
+};
+
+use foundationdb_simulation::{Severity, WorkloadContext};
+use tracing_core::{
+    Dispatch, Event, Level, Subscriber,
+    field::{Field, Visit},
+    span::{Attributes, Id, Record},
+};
+use tracing_subscriber::{
+    Registry,
+    filter::{LevelFilter, LevelParseError},
+    layer::{Context, Layer, SubscriberExt},
+    registry::LookupSpan,
+};
+
+// The context bound to the current simulation thread. `WorkloadContext` is
+// `!Send`/`!Sync` (it wraps raw fdbserver pointers), so it never leaves the
+// thread it was installed on: events fired on any other thread find an empty
+// slot and are dropped. The slot also carries the install generation so an
+// older `TracingGuard` cannot clear a binding that a newer `install` replaced.
+thread_local! {
+    static SIM_CONTEXT: RefCell<Option<(WorkloadContext, u64)>> = const { RefCell::new(None) };
+}
+
+/// Monotonic install counter used to tell competing bindings apart.
+static GENERATION: AtomicU64 = AtomicU64::new(0);
+/// Guards the one-shot global subscriber registration.
+static INIT: Once = Once::new();
+/// Environment variable controlling the maximum level forwarded to fdbserver.
+const LEVEL_ENV: &str = "FDB_SIM_TRACING_LEVEL";
+
+/// Installs the global tracing subscriber (first call only, idempotent) and
+/// binds tracing events emitted on the current simulation thread to
+/// `context`'s trace log. Call from your workload factory
+/// (`SingleRustWorkload::new` / `RustWorkloadFactory::create`) and store the
+/// returned guard in your workload struct: when the guard drops (workload
+/// teardown), the binding is cleared, so no event can ever reach a freed
+/// context.
+///
+/// The subscriber is a [`tracing_subscriber::Registry`] with a forwarding
+/// [`tracing_subscriber::Layer`]. By default, it forwards `INFO` and above;
+/// set `FDB_SIM_TRACING_LEVEL` to `debug` or `trace` before the first call to
+/// override the level. Span context (names and fields) is captured and attached
+/// to each forwarded event.
+///
+/// If another global tracing subscriber is already installed, this prints a
+/// warning to stderr and forwarding stays disabled (events reach the
+/// pre-existing subscriber instead).
+// Not `#[instrument]`: the crate depends only on `tracing-core` /
+// `tracing-subscriber`, neither of which provides the attribute macro
+// (`#[instrument]` lives in `tracing`), and on the first call the subscriber
+// does not exist yet, so there would be nothing to record.
+#[must_use = "dropping the guard immediately unbinds the context, so tracing \
+              events would no longer be forwarded"]
+pub fn install(context: &WorkloadContext) -> TracingGuard {
+    let generation = GENERATION.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    SIM_CONTEXT.with(|slot| {
+        *slot.borrow_mut() = Some((context.clone(), generation));
+    });
+    INIT.call_once(|| {
+        let subscriber = Registry::default()
+            .with(SimLayer)
+            .with(configured_level_filter());
+        if tracing_core::dispatcher::set_global_default(Dispatch::new(subscriber)).is_err() {
+            eprintln!(
+                "foundationdb-simulation-tracing: a global tracing subscriber is already \
+                 installed; simulator trace forwarding is disabled and events will reach the \
+                 pre-existing subscriber instead"
+            );
+        }
+    });
+    TracingGuard { generation }
+}
+
+/// Reads the forwarding level once, while the global subscriber is installed.
+fn configured_level_filter() -> LevelFilter {
+    match env::var(LEVEL_ENV) {
+        Ok(value) => match parse_level_filter(Some(&value)) {
+            Ok(level) => level,
+            Err(error) => {
+                eprintln!(
+                    "foundationdb-simulation-tracing: invalid {LEVEL_ENV}={value:?} ({error}); \
+                     defaulting to info"
+                );
+                LevelFilter::INFO
+            }
+        },
+        Err(env::VarError::NotPresent) => LevelFilter::INFO,
+        Err(env::VarError::NotUnicode(value)) => {
+            eprintln!(
+                "foundationdb-simulation-tracing: invalid non-Unicode {LEVEL_ENV}={value:?}; \
+                 defaulting to info"
+            );
+            LevelFilter::INFO
+        }
+    }
+}
+
+fn parse_level_filter(value: Option<&str>) -> Result<LevelFilter, LevelParseError> {
+    value.unwrap_or("info").parse()
+}
+
+/// Clears the thread-local context slot on drop, but only if the slot still
+/// points at the context this guard was created for (a newer [`install`]
+/// wins). Keep it alive for as long as tracing events should be forwarded,
+/// typically by storing it in your workload struct.
+pub struct TracingGuard {
+    generation: u64,
+}
+
+impl Drop for TracingGuard {
+    fn drop(&mut self) {
+        SIM_CONTEXT.with(|slot| {
+            let mut slot = slot.borrow_mut();
+            if matches!(&*slot, Some((_, generation)) if *generation == self.generation) {
+                *slot = None;
+            }
+        });
+    }
+}
+
+/// Fields captured for a span, stored in its registry extensions so events
+/// fired inside the span can attach them. Keys and values are already
+/// NUL-sanitized.
+struct SpanFields(Vec<(String, String)>);
+
+/// `tracing_subscriber::Layer` that captures span fields into the registry and
+/// forwards every event to the thread-local simulation context. It holds no
+/// `WorkloadContext` (the registry owns all span state), so it stays
+/// `Send + Sync` as `Dispatch` requires.
+struct SimLayer;
+
+impl<S> Layer<S> for SimLayer
+where
+    S: Subscriber + for<'a> LookupSpan<'a>,
+{
+    fn on_new_span(&self, attrs: &Attributes<'_>, id: &Id, ctx: Context<'_, S>) {
+        let span = ctx.span(id).expect("span must exist for its id");
+        let mut visitor = DetailVisitor::default();
+        attrs.record(&mut visitor);
+        span.extensions_mut()
+            .insert(SpanFields(visitor.into_all_fields()));
+    }
+
+    fn on_record(&self, id: &Id, values: &Record<'_>, ctx: Context<'_, S>) {
+        let span = ctx.span(id).expect("span must exist for its id");
+        let mut extensions = span.extensions_mut();
+        if let Some(fields) = extensions.get_mut::<SpanFields>() {
+            let mut visitor = DetailVisitor::default();
+            values.record(&mut visitor);
+            for (key, value) in visitor.into_all_fields() {
+                if let Some(existing) = fields.0.iter_mut().find(|(k, _)| *k == key) {
+                    existing.1 = value;
+                } else {
+                    fields.0.push((key, value));
+                }
+            }
+        }
+    }
+
+    fn on_event(&self, event: &Event<'_>, ctx: Context<'_, S>) {
+        SIM_CONTEXT.with(|slot| {
+            let slot = slot.borrow();
+            let Some((context, _)) = slot.as_ref() else {
+                return;
+            };
+            let details = event_details(event, &ctx);
+            context.trace(
+                severity(event.metadata().level()),
+                "RustTracingEvent",
+                &details,
+            );
+        });
+    }
+}
+
+/// Builds the `(key, value)` details for an event: the `Target`/`File`/`Line`/
+/// `Message` meta keys, then the event's own fields, then span context (`Span`,
+/// `SpanPath`, and ancestor span fields from root to leaf). A span field is
+/// skipped when its key is already present, so an event field always wins over
+/// a span field of the same name.
+fn event_details<S>(event: &Event<'_>, ctx: &Context<'_, S>) -> Vec<(String, String)>
+where
+    S: Subscriber + for<'a> LookupSpan<'a>,
+{
+    let metadata = event.metadata();
+    let mut visitor = DetailVisitor::default();
+    event.record(&mut visitor);
+
+    let mut details: Vec<(String, String)> = Vec::with_capacity(visitor.fields.len() + 6);
+    details.push(("Target".to_owned(), sanitize(metadata.target())));
+    if let Some(file) = metadata.file() {
+        details.push(("File".to_owned(), sanitize(file)));
+    }
+    if let Some(line) = metadata.line() {
+        details.push(("Line".to_owned(), line.to_string()));
+    }
+    if let Some(message) = visitor.message {
+        details.push(("Message".to_owned(), message));
+    }
+    details.extend(visitor.fields);
+
+    if let Some(scope) = ctx.event_scope(event) {
+        // `from_root` yields the ancestors from the outermost span to the
+        // innermost, which is the order we want for both `Span` (the leaf) and
+        // `SpanPath` (root to leaf).
+        let spans: Vec<_> = scope.from_root().collect();
+        if let Some(leaf) = spans.last() {
+            details.push(("Span".to_owned(), sanitize(leaf.name())));
+        }
+        let path = spans
+            .iter()
+            .map(|span| span.name())
+            .collect::<Vec<_>>()
+            .join("/");
+        details.push(("SpanPath".to_owned(), sanitize(&path)));
+
+        // Append span fields from leaf to root, with skip-if-present, so a
+        // deeper span's field overrides a shallower one. Combined with event
+        // fields being added first, the precedence is event > innermost span >
+        // ... > root span.
+        for span in spans.iter().rev() {
+            let extensions = span.extensions();
+            if let Some(fields) = extensions.get::<SpanFields>() {
+                for (key, value) in &fields.0 {
+                    if !details.iter().any(|(existing, _)| existing == key) {
+                        details.push((key.clone(), value.clone()));
+                    }
+                }
+            }
+        }
+    }
+
+    details
+}
+
+/// Maps a `tracing` level to an FDB [`Severity`]. `ERROR` maps to
+/// [`Severity::WarnAlways`] rather than [`Severity::Error`] on purpose:
+/// `Severity::Error` flags the whole simulation as failed, and a dependency's
+/// `tracing::error!` must not kill a run. Failing a simulation stays an
+/// explicit `context.trace(Severity::Error, ...)`.
+fn severity(level: &Level) -> Severity {
+    if *level == Level::ERROR {
+        Severity::WarnAlways
+    } else if *level == Level::WARN {
+        Severity::Warn
+    } else if *level == Level::INFO {
+        Severity::Info
+    } else {
+        // TRACE and DEBUG
+        Severity::Debug
+    }
+}
+
+/// Strips NUL bytes so values survive the `CString` boundary in
+/// `WorkloadContext::trace` (a NUL would otherwise panic across `extern "C"`).
+fn sanitize(value: &str) -> String {
+    if value.contains('\0') {
+        value.chars().filter(|&c| c != '\0').collect()
+    } else {
+        value.to_owned()
+    }
+}
+
+/// Collects fields into `(key, value)` strings, pulling the field literally
+/// named `message` out separately (used for the event `Message` detail). Every
+/// key and value has NUL bytes stripped before it is stored.
+#[derive(Default)]
+struct DetailVisitor {
+    message: Option<String>,
+    fields: Vec<(String, String)>,
+}
+
+impl DetailVisitor {
+    fn push(&mut self, field: &Field, value: String) {
+        let value = sanitize(&value);
+        if field.name() == "message" {
+            self.message = Some(value);
+        } else {
+            self.fields.push((sanitize(field.name()), value));
+        }
+    }
+
+    /// Returns every captured field, folding a captured `message` back in as a
+    /// regular `message` field. Used for spans, where the `message` field (if
+    /// any) is just another field to carry.
+    fn into_all_fields(mut self) -> Vec<(String, String)> {
+        if let Some(message) = self.message {
+            self.fields.insert(0, ("message".to_owned(), message));
+        }
+        self.fields
+    }
+}
+
+impl Visit for DetailVisitor {
+    fn record_debug(&mut self, field: &Field, value: &dyn fmt::Debug) {
+        self.push(field, format!("{value:?}"));
+    }
+
+    fn record_str(&mut self, field: &Field, value: &str) {
+        self.push(field, value.to_owned());
+    }
+
+    fn record_i64(&mut self, field: &Field, value: i64) {
+        self.push(field, value.to_string());
+    }
+
+    fn record_u64(&mut self, field: &Field, value: u64) {
+        self.push(field, value.to_string());
+    }
+
+    fn record_i128(&mut self, field: &Field, value: i128) {
+        self.push(field, value.to_string());
+    }
+
+    fn record_u128(&mut self, field: &Field, value: u128) {
+        self.push(field, value.to_string());
+    }
+
+    fn record_f64(&mut self, field: &Field, value: f64) {
+        self.push(field, value.to_string());
+    }
+
+    fn record_bool(&mut self, field: &Field, value: bool) {
+        self.push(field, value.to_string());
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{Arc, Mutex};
+
+    use foundationdb_simulation::WorkloadContext;
+    use foundationdb_simulation::internals::FDBWorkloadContext;
+
+    use super::*;
+
+    /// A zeroed context is enough for guard tests: we only store it in the slot
+    /// and drop it, never calling any method that would dereference a pointer.
+    fn dummy_context() -> WorkloadContext {
+        WorkloadContext::new(unsafe { std::mem::zeroed::<FDBWorkloadContext>() })
+    }
+
+    fn slot_generation() -> Option<u64> {
+        SIM_CONTEXT.with(|slot| slot.borrow().as_ref().map(|(_, generation)| *generation))
+    }
+
+    /// Shared slot the capture layer writes the forwarded details into.
+    type CapturedSlot = Arc<Mutex<Option<Vec<(String, String)>>>>;
+
+    /// Test layer that records the details `event_details` would forward, so we
+    /// can assert on them without a live `WorkloadContext`.
+    struct CaptureLayer(CapturedSlot);
+
+    impl<S> Layer<S> for CaptureLayer
+    where
+        S: Subscriber + for<'a> LookupSpan<'a>,
+    {
+        fn on_event(&self, event: &Event<'_>, ctx: Context<'_, S>) {
+            *self.0.lock().unwrap() = Some(event_details(event, &ctx));
+        }
+    }
+
+    /// Runs `emit` under a `Registry` stacked with `SimLayer` (so span fields
+    /// are captured) and a `CaptureLayer` (so we can read the forwarded
+    /// details), returning the details of the single emitted event.
+    fn capture(emit: impl FnOnce()) -> Vec<(String, String)> {
+        capture_with_filter(LevelFilter::INFO, emit).unwrap()
+    }
+
+    fn capture_with_filter(
+        level_filter: LevelFilter,
+        emit: impl FnOnce(),
+    ) -> Option<Vec<(String, String)>> {
+        let captured = Arc::new(Mutex::new(None));
+        let subscriber = Registry::default()
+            .with(SimLayer)
+            .with(CaptureLayer(captured.clone()))
+            .with(level_filter);
+        tracing_core::dispatcher::with_default(&Dispatch::new(subscriber), emit);
+        captured.lock().unwrap().take()
+    }
+
+    fn has(details: &[(String, String)], key: &str, value: &str) -> bool {
+        details.iter().any(|(k, v)| k == key && v == value)
+    }
+
+    #[test]
+    fn severity_mapping_never_errors() {
+        assert!(matches!(severity(&Level::TRACE), Severity::Debug));
+        assert!(matches!(severity(&Level::DEBUG), Severity::Debug));
+        assert!(matches!(severity(&Level::INFO), Severity::Info));
+        assert!(matches!(severity(&Level::WARN), Severity::Warn));
+        assert!(matches!(severity(&Level::ERROR), Severity::WarnAlways));
+    }
+
+    #[test]
+    fn debug_events_are_dropped_by_default_and_enabled_by_override() {
+        let default = parse_level_filter(None).unwrap();
+        assert!(capture_with_filter(default, || tracing::debug!("filtered")).is_none());
+
+        let debug = parse_level_filter(Some("debug")).unwrap();
+        let details = capture_with_filter(debug, || tracing::debug!("forwarded")).unwrap();
+        assert!(has(&details, "Message", "forwarded"));
+    }
+
+    #[test]
+    fn debug_spans_are_dropped_by_default() {
+        let details = capture(|| {
+            let span = tracing::debug_span!("filtered_span", client = 7);
+            let _entered = span.enter();
+            tracing::info!("visible event");
+        });
+
+        assert!(!details.iter().any(|(key, _)| key == "Span"));
+        assert!(!has(&details, "client", "7"));
+    }
+
+    #[test]
+    fn sanitize_strips_nul_bytes() {
+        assert_eq!(sanitize("a\0b\0c"), "abc");
+        assert_eq!(sanitize("clean"), "clean");
+        assert_eq!(sanitize("\0"), "");
+    }
+
+    #[test]
+    fn event_splits_message_from_fields() {
+        let details = capture(|| tracing::info!(client = 3, "hello world"));
+        assert!(has(&details, "Message", "hello world"));
+        assert!(has(&details, "client", "3"));
+    }
+
+    #[test]
+    fn event_treats_explicit_message_field_as_message() {
+        let details = capture(|| tracing::info!(message = "explicit", other = 1));
+        assert!(has(&details, "Message", "explicit"));
+        assert!(has(&details, "other", "1"));
+        assert!(!details.iter().any(|(key, _)| key == "message"));
+    }
+
+    #[test]
+    fn event_strips_nul_from_keys_and_values() {
+        let details = capture(|| tracing::info!(dirty = "a\0b", "mes\0sage"));
+        assert!(has(&details, "Message", "message"));
+        assert!(has(&details, "dirty", "ab"));
+    }
+
+    #[test]
+    fn event_in_span_carries_span_context() {
+        let details = capture(|| {
+            let span = tracing::info_span!("demo_span", client = 7);
+            let _entered = span.enter();
+            tracing::info!("inside the span");
+        });
+        assert!(has(&details, "Span", "demo_span"));
+        assert!(has(&details, "SpanPath", "demo_span"));
+        assert!(has(&details, "client", "7"));
+        assert!(has(&details, "Message", "inside the span"));
+    }
+
+    #[test]
+    fn nested_spans_produce_full_path() {
+        let details = capture(|| {
+            let outer = tracing::info_span!("outer", a = 1);
+            let _outer = outer.enter();
+            let inner = tracing::info_span!("inner", b = 2);
+            let _inner = inner.enter();
+            tracing::info!("deep event");
+        });
+        assert!(has(&details, "Span", "inner"));
+        assert!(has(&details, "SpanPath", "outer/inner"));
+        assert!(has(&details, "a", "1"));
+        assert!(has(&details, "b", "2"));
+    }
+
+    #[test]
+    fn event_field_wins_over_span_field() {
+        let details = capture(|| {
+            let span = tracing::info_span!("collision", shared = "from_span");
+            let _entered = span.enter();
+            tracing::info!(shared = "from_event", "msg");
+        });
+        let shared: Vec<_> = details.iter().filter(|(key, _)| key == "shared").collect();
+        assert_eq!(shared.len(), 1, "span field must be skipped on collision");
+        assert_eq!(shared[0].1, "from_event");
+    }
+
+    #[test]
+    fn innermost_span_field_wins_over_outer() {
+        let details = capture(|| {
+            let outer = tracing::info_span!("outer", shared = "from_outer");
+            let _outer = outer.enter();
+            let inner = tracing::info_span!("inner", shared = "from_inner");
+            let _inner = inner.enter();
+            tracing::info!("event without a shared field");
+        });
+        let shared: Vec<_> = details.iter().filter(|(key, _)| key == "shared").collect();
+        assert_eq!(
+            shared.len(),
+            1,
+            "outer span field must be skipped on collision"
+        );
+        assert_eq!(shared[0].1, "from_inner");
+    }
+
+    #[test]
+    fn guard_clears_slot_on_drop() {
+        let context = dummy_context();
+        {
+            let _guard = install(&context);
+            assert!(slot_generation().is_some());
+        }
+        assert_eq!(slot_generation(), None);
+    }
+
+    #[test]
+    fn newer_install_survives_older_guard_drop() {
+        let context = dummy_context();
+        let guard_a = install(&context);
+        let gen_a = slot_generation();
+        let guard_b = install(&context);
+        let gen_b = slot_generation();
+        assert_ne!(gen_a, gen_b);
+
+        // The older guard must leave the newer binding untouched.
+        drop(guard_a);
+        assert_eq!(slot_generation(), gen_b);
+
+        // The newer guard owns the current binding and clears it.
+        drop(guard_b);
+        assert_eq!(slot_generation(), None);
+    }
+}
diff --git a/bindings/rust/foundationdb-simulation/CHANGELOG.md b/bindings/rust/foundationdb-simulation/CHANGELOG.md
new file mode 100644
index 00000000000..c9e786008e2
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/CHANGELOG.md
@@ -0,0 +1,88 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.3.0] - 2026-06-24
+
+### <!-- 1 -->🚀 Features
+
+- Feat(simulation): auto-capitalize trace detail names
+- Feat(simulation): WorkloadContext::delay takes Duration, exercised in noop
+- Feat: migrate workspace to Rust 2024 edition (#255)
+
+### <!-- 2 -->🐛 Bug Fixes
+
+- Fix(simulation): static storage for C-ABI vtables, target fdbserver 7.4.6
+
+### <!-- 9 -->📦 Other Changes
+
+- Rewrite fdb_rt to split wakeup and polling phase
+
+[0.3.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.2.3..0.3.0
+
+
+## [0.2.3] - 2025-10-24
+
+### <!-- 1 -->🚀 Features
+
+- Add support 7.4
+- Add 7.4 simulation in CI
+
+### <!-- 2 -->🐛 Bug Fixes
+
+- Remove unwrap on checks
+- Recover simulation trace public api breaking change
+- Fix(foundationdb-simulation): add docs.rs metadata to fix build
+
+### <!-- 4 -->🚜 Refactor
+
+- Remove unnecessary simulation headers
+
+### <!-- 8 -->⚙️ Miscellaneous
+
+- Clippy fixes
+
+### <!-- 9 -->📦 Other Changes
+
+- Update CI and bindingtester to 7.4
+- Some spaces and tabs doc formalization
+- Update workload bindings
+- Update README
+- Async RustWorkload
+- Tidy up foundationdb-simulation API:
+
+[0.2.3]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.2.2..0.2.3
+
+
+## [0.2.2] - 2025-01-06
+
+### <!-- 0 -->🚀 added
+
+- Add unit for now()
+
+### <!-- 3 -->🆙 Bump
+
+- Bump cc from 1.1.30 to 1.2.1
+- Bump cc from 1.1.24 to 1.1.30
+
+[0.2.2]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.2.1..0.2.2
+
+## [0.2.1] - 2024-10-08
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Fix foundationdb-simulation compilation with fdb-7_1
+
+### <!-- 3 -->🆙 Bump
+
+- Bump all dependencies and setup dependabot
+
+### <!-- 4 -->⚙️ Other changes
+
+- Use C++14 spec
+
+[0.2.1]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.2.0..0.2.1
+
diff --git a/bindings/rust/foundationdb-simulation/Cargo.toml b/bindings/rust/foundationdb-simulation/Cargo.toml
new file mode 100644
index 00000000000..4e043fe2dbf
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/Cargo.toml
@@ -0,0 +1,57 @@
+[package]
+name = "foundationdb-simulation"
+version = "0.3.0"
+authors = [
+    "Eloi DEMOLIS <eloi.demolis@clever-cloud.com>",
+    "Pierre Zemb <contact@pierrezemb.fr>"
+]
+edition = "2024"
+description = """
+Embed Rust code within FoundationDB's simulation
+"""
+license = "MIT/Apache-2.0"
+documentation = "https://docs.rs/foundationdb-simulation"
+repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+readme = "README.md"
+keywords = ["foundationdb", "simulation"]
+
+[package.metadata.docs.rs]
+features = ["embedded-fdb-include", "fdb-7_4"]
+
+[dependencies]
+foundationdb = { version = "0.11.0", path = "../foundationdb", default-features = false }
+foundationdb-sys = { version = "0.11.0", path = "../foundationdb-sys", default-features = false }
+
+[build-dependencies]
+cc = "1.2.65"
+bindgen = "0.73.2"
+
+[dev-dependencies]
+futures-util = "0.3.32"
+
+[features]
+default = ["embedded-fdb-include"]
+cpp-abi = []
+fdb-7_1 = ["foundationdb/fdb-7_1", "foundationdb-sys/fdb-7_1", "cpp-abi"]
+fdb-7_3 = ["foundationdb/fdb-7_3", "foundationdb-sys/fdb-7_3", "cpp-abi"]
+fdb-7_4 = ["foundationdb/fdb-7_4", "foundationdb-sys/fdb-7_4"]
+fdb-docker = []
+embedded-fdb-include = [
+    "foundationdb/embedded-fdb-include",
+    "foundationdb-sys/embedded-fdb-include",
+]
+
+[[example]]
+name = "atomic"
+path = "examples/atomic/lib.rs"
+crate-type = ["cdylib"]
+
+[[example]]
+name = "noop"
+path = "examples/noop/lib.rs"
+crate-type = ["cdylib"]
+
+[[example]]
+name = "shared"
+path = "examples/shared/lib.rs"
+crate-type = ["cdylib"]
diff --git a/bindings/rust/foundationdb-simulation/README.md b/bindings/rust/foundationdb-simulation/README.md
new file mode 100644
index 00000000000..d58202e9814
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/README.md
@@ -0,0 +1,326 @@
+# foundationdb-simulation
+
+This crate provides the tools to write Rust workloads that can be loaded and executed in the
+official FoundationDB simulator, allowing for rigorous and deterministic testing of Rust layers.
+
+> ⚠️ **The C API path requires fdbserver 7.4.6 or newer.** When built with `fdb-7_4` and
+> `useCAPI=true`, this crate targets the external-workload C ABI shipped in fdbserver **7.4.6**
+> (virtual tables, `api_version`, `WorkloadContext::delay`). That ABI change was not accompanied
+> by an `FDB_API_VERSION` bump, so running against 7.4.3 / 7.4.4 / 7.4.5 (older, incompatible C
+> ABI) SIGSEGVs at workload start. See
+> [issue #459](https://github.com/foundationdb-rs/foundationdb-rs/issues/459) and the version
+> compatibility note below.
+
+## How It Works
+
+FoundationDB's simulation framework includes an `ExternalWorkload` that can dynamically load a
+shared object at runtime. This shared object must expose specific symbols that the simulator calls
+to drive the workload.
+
+Originally, `ExternalWorkload` used a C++ interface. This is cumbersome because the C++ ABI is not
+stable and most languages do not interoperate with it easily. As of FoundationDB 7.4, the
+`ExternalWorkload` supports a pure C interface, which this crate targets. For backwards
+compatibility with FoundationDB 7.1 and 7.3, a C++ shim can be compiled to translate the C
+interface back to the C++ one.
+
+### For FoundationDB 7.4.6 and Newer (Recommended)
+
+- Uses a pure C API (FFI-safe).
+- **No need** to build inside the official FoundationDB Docker image.
+- Requires setting `useCAPI=true` in the test configuration file.
+- Results in faster build times and a simpler setup.
+
+> **fdbserver 7.4.6 or newer is required for the C API path** (`fdb-7_4` + `useCAPI=true`).
+> The external-workload C ABI gained virtual tables, an `api_version` field and
+> `WorkloadContext::delay` in fdbserver **7.4.6**, and this change was *not* accompanied by an
+> `FDB_API_VERSION` bump. Patch releases 7.4.3 / 7.4.4 / 7.4.5 ship the previous, incompatible C
+> ABI: loading a `fdb-7_4` workload there with `useCAPI=true` SIGSEGVs at workload start (see
+> [issue #459](https://github.com/foundationdb-rs/foundationdb-rs/issues/459)). To target 7.4.5 or
+> earlier, use a matching older crate release, or the C++ shim path below (which stays compatible
+> with the whole 7.4 series, except `WorkloadContext::delay`, which also requires 7.4.6).
+
+### For FoundationDB 7.1 and 7.3
+
+- Requires a C++ shim to bridge the C and C++ ABIs.
+- **Must** be built within the [official `foundationdb/build` Docker image](https://hub.docker.com/r/foundationdb/build)).
+- The linker must be set to `clang`.
+- Involves a more complex build process due to C++ ABI compatibility requirements.
+
+## Setup
+
+First, create a new Rust project with a library structure:
+
+```console
+.
+├── Cargo.toml
+└── src/
+    └── lib.rs
+```
+
+Next, add `foundationdb-simulation` to your `Cargo.toml` and configure your crate as `cdylib`
+as the `ExternalWorkload` expects a shared object.
+
+```toml
+[lib]
+name = "myworkload"
+crate-type = ["cdylib"]
+
+[dependencies]
+# Make sure to select the feature flag for your target FDB version.
+foundationdb-simulation = { version = "...", features = ["fdb-7_4"] } # or "fdb-7_1", "fdb-7_3"
+```
+
+## Compilation
+
+If you are targeting FoundationDB 7.1 or 7.3 (which require the C++ shim), you **must** compile
+your workload inside the official FoundationDB Docker image. Compiling outside of this environment
+will almost certainly lead to segmentation faults at runtime due to C++ ABI mismatches.
+
+Compile your workload using the standard Cargo commands. This will create a shared object in
+`./target/release/` (`./target/debug/`). The filename will be `lib<name>.so`, where `<name>` is
+the `name` you set in the `[lib]` section of your `Cargo.toml`. For example: `libmyworkload.so`.
+
+## Launching the Simulation
+
+The FoundationDB simulator is launched via the `fdbserver` binary with a TOML configuration file.
+
+```bash
+fdbserver -r simulation -f ./test_file.toml
+```
+
+Your test file must specify `testName=External` to use the `ExternalWorkload` framework.
+
+```toml
+testTitle = "MyRustTest"
+testName = "External"
+
+# The name passed to your workload factory
+workloadName = "MyWorkload" 
+
+# The path to the directory containing your .so file
+libraryPath = "./target/release/" 
+# The name of your library from Cargo.toml (without lib/.so)
+libraryName = "myworkload" 
+
+# Required for FDB 7.4+ when using the C API
+useCAPI = true
+
+# Custom options for your workload
+myCustomOption = 42
+```
+
+## Workload Definition
+
+FoundationDB workloads are defined by implementing the `RustWorkload` trait:
+
+```rust
+pub trait RustWorkload {
+    async fn setup(&mut self, db: SimDatabase);
+    async fn start(&mut self, db: SimDatabase);
+    async fn check(&mut self, db: SimDatabase);
+    fn get_metrics(&self, out: Metrics);
+    fn get_check_timeout(&self) -> f64;
+}
+```
+
+The simulator expects the shared object to expose a factory that can create workload instances.
+This crate provides two traits to define these factories.
+
+For simple use cases where a single workload implementation is defined, you can implement the
+`SingleRustWorkload` trait directly on your `RustWorkload`.
+
+```rust
+pub trait SingleRustWorkload: RustWorkload {
+    const FDB_API_VERSION: u32;
+    fn new(name: String, context: WorkloadContext) -> Self;
+}
+```
+
+Then, register your workload with the corresponding `register_workload` macro.
+
+For more complex scenarios, where multiple workload implementations exist in a single shared
+object, you can define a separate factory that implements the `RustWorkloadFactory` trait. This
+allows selecting the implementation based on the workload name provided in the test configuration.
+
+```rust
+pub trait RustWorkloadFactory {
+    const FDB_API_VERSION: u32;
+    fn create(name: String, context: WorkloadContext) -> WrappedWorkload;
+}
+```
+
+The factory must be registered with the corresponding `register_factory` macro.
+
+> **Warning:** Do not use more than one "register macro" per project.
+
+See the `atomic` and `noop` implementations in the `examples/` directory for complete working examples.
+
+## The WorkloadContext
+
+The `WorkloadContext` passed at instantiation is the primary way to interact with the simulator.
+It provides several useful methods:
+
+- `trace(severity, name, details)`: Add a log entry to the FDB trace files.
+- `now()`: Get the current simulated time as a `f64`.
+- `rnd()`: Get a deterministic 32-bit random number.
+- `shared_random_number()`: Get a deterministic 64-bit random number (the same for all clients).
+- `client_id()`: Get the ID of the current client.
+- `client_count()`: Get the total number of clients in the simulation.
+- `get_option<T>(name)`: Get a custom configuration option from the test file.
+
+### Get options
+In the simulation configuration file you can add custom parameters to your workload.
+These parameters can be read with `WorkloadContext::get_option`. This method will first try to get
+the parameter value as a raw string and then convert it in a the type of your choice.
+If the parameter doesn't exist, its value is invalid or set to null, the function returns None.
+
+Example:
+
+```rust
+impl SingleRustWorkload for MyWorkload {
+    fn new(name: String, context: WorkloadContext) -> Self {
+        let my_custom_option: usize = context
+            .get_option("myCustomOption")
+            .unwrap();
+        Self { context, name, my_custom_option }
+    }
+}
+```
+
+### Tracing
+
+Use `WorkloadContext::trace` to log messages with a given severity and a map of string "details".
+A severity of `Severity::Error` will automatically stop the `fdbserver` process. The event
+name's first character is uppercased automatically, matching FDB's convention for event types.
+
+Every call to `trace` automatically adds a `RustWorkload="1"` detail to the event (unless you
+already supplied one), so a runner can grep all Rust-origin trace lines with a single token.
+When you trace with `Severity::Error`, the crate also adds a `RustFailure="1"` detail (unless
+you already supplied one). This lets a runner parsing the `fdbserver` trace logs distinguish a
+failure detected by the Rust workload from an FDB-internal Sev40 event, which will never carry
+this field.
+
+```rust
+impl RustWorkload for MyWorkload {
+    fn setup(&mut self, db: SimDatabase) {
+        self.context.trace(
+            Severity::Info,
+            "SuccessfullySetupWorkload",
+            details![
+                "Layer" => "Rust",
+                "Phase" => "setup",
+                "Name" => self.name,
+                "CustomOption" => self.my_custom_option,
+            ],
+        );
+    }
+    ...
+}
+```
+
+### Randomness
+
+To maintain determinism, all random numbers must be sourced from the simulator.
+Use `WorkloadContext::rnd()` or `WorkloadContext::shared_random_number()` for a shared seed.
+Do not use external entropy sources like `rand::thread_rng()`.
+
+# Workload Lifecycle
+
+## Instantiation
+
+Once the `fdbserver` process is ready, it loads your shared object and calls your workload factory
+to create instances. The simulator creates a random number of "clients," and your factory will be
+called once for each client.
+
+> **Note:** Contrary to the C++ `ExternalWorkload` which has separate `create` and `init` methods,
+> the `RustWorkload` is not created until the simulator's `init` phase.
+
+The `WorkloadContext` passed to your factory should be stored in your `RustWorkload`, as it is safe
+to use across phases and will not be provided again.
+
+## The setup, start, and check Phases
+
+These three phases run sequentially. The simulation will not begin the `start` phase until all
+clients have completed the `setup` phase, and so on.
+
+Each function is `async` and runs cooperatively alonside the `fdbserver`.
+As long as your function is executing, the `fdbserver` is paused to ensure determinism.
+You **must** yield control back to the simulator for any database operations to occur.
+Do not "busy wait" for a foundationdb function to return as it will deadlock.
+
+FoundationDB Simulation runs your async code on a custom future executor that integrates with
+the `fdbserver` event loop. It effectively turns your async fn into a sequence of cooperative
+steps, allowing the `fdbserver` to drive simulation events between awaits.
+
+- All foundationdb-rs async operations are compatible with this model.
+- Avoid using arbitrary async primitives from other crates (e.g., `tokio::sleep`).
+
+## Reporting Metrics
+
+At the end of the simulation, the `get_metrics` method is called for each client.
+Implement this method to report results.
+
+```rust
+fn get_metrics(&self, out: Metrics) {
+    // val metrics are summed across all clients
+    out.push(Metric::val("total_ops", self.ops as f64));
+    // avg metrics are averaged across all clients
+    out.push(Metric::avg("avg_latency", self.latency / self.ops.max(1) as f64));
+}
+```
+
+## LLVM code coverage for external workloads
+
+`cargo llvm-cov` can collect Rust coverage from an external workload and its Rust dependencies.
+The workload writes a profile after each completed `get_metrics` callback because `fdbserver`
+exits with `_exit`, which bypasses LLVM's normal process-exit profile writer. This is enabled only
+when `cargo llvm-cov` sets `cfg(coverage)`; regular builds are unchanged.
+
+This example builds the existing atomic workload into an isolated target directory, writes a copy
+of its test configuration there, and points that copy at the instrumented shared object:
+
+Install `cargo-llvm-cov` and the `llvm-tools-preview` Rust component first. The Nix shell provides
+the LLVM tools, but does not currently provide the `cargo-llvm-cov` CLI.
+
+```bash
+nix develop
+
+export CARGO_TARGET_DIR="$PWD/target/simulation-coverage"
+export CARGO_LLVM_COV_TARGET_DIR="$CARGO_TARGET_DIR"
+source <(cargo llvm-cov show-env --sh --release)
+cargo llvm-cov clean --workspace
+
+cargo build --locked --release -p foundationdb-simulation --example atomic \
+  --features embedded-fdb-include,fdb-7_4
+
+config="$CARGO_TARGET_DIR/atomic-coverage.toml"
+sed "s#libraryPath = './target/release/examples'#libraryPath = '$CARGO_TARGET_DIR/release/examples'#" \
+  foundationdb-simulation/examples/atomic/test_file_74.toml > "$config"
+
+fdbserver -r simulation -f "$config" -b on --trace-format json
+
+cargo llvm-cov report --release --html --output-dir "$CARGO_TARGET_DIR/report"
+cargo llvm-cov report --release --lcov --output-path "$CARGO_TARGET_DIR/lcov.info"
+```
+
+Keep the `LLVM_PROFILE_FILE` set by `show-env`, including its `%m` placeholder. A custom name
+without `%m` can overwrite earlier client snapshots. This prototype flushes only completed metrics
+callbacks, so a simulation failure or timeout before that callback has no profile-write guarantee.
+
+# Common Mistakes
+
+* **Compiling C++ shim outside of the Docker.** C++ ABI is extremely environment-dependent, not
+  compiling in the exact same environment as the other half of the interface will probably result
+  in segmentation faults or mangled strings that will trigger unrecoverable errors.
+
+* **Forgetting to read all options.** Any custom option in the configuration that is not read will
+  trigger a `Workload had invalid options.` error.
+
+* **Forgetting useCAPI=true.** If the `fdbserver` used supports the C API, you still need to add
+  explicitely this option, otherwise the `ExternalWorkload` will try to load the C++ symbol.
+
+* **Using pointers or references after a phase ends.** After each phase, the simulator may move or
+  deallocate memory. Any pointers or references to FoundationDB objects become invalid. You must
+  use the fresh `&mut self` and `db` references passed to the next phase. Storing `SimDatabase`,
+  `Transaction`, or `Future` objects across phases will lead to segmentation faults or other
+  undefined behavior.
diff --git a/bindings/rust/foundationdb-simulation/build.rs b/bindings/rust/foundationdb-simulation/build.rs
new file mode 100644
index 00000000000..513e55a7a40
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/build.rs
@@ -0,0 +1,81 @@
+use std::{env, path::PathBuf};
+
+extern crate cc;
+
+fn main() {
+    println!("cargo:rustc-check-cfg=cfg(coverage)");
+
+    let bindings = bindgen::Builder::default()
+        .header("src/headers/CWorkload.h")
+        .generate()
+        .expect("generate bindings");
+
+    let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
+    bindings
+        .write_to_file(out_path.join("bindings.rs"))
+        .expect("write bindings");
+
+    let _api_version: usize;
+
+    #[cfg(feature = "fdb-7_1")]
+    {
+        _api_version = 710;
+    }
+    #[cfg(feature = "fdb-7_3")]
+    {
+        _api_version = 730;
+    }
+    #[cfg(feature = "fdb-7_4")]
+    {
+        _api_version = 740;
+    }
+
+    #[cfg(feature = "cpp-abi")]
+    {
+        if cfg!(feature = "fdb-docker") {
+            if _api_version < 730 {
+                build_with_gcc(_api_version);
+            } else {
+                // FDB 7.3+ is built with clang, so we need to do the same, including the linker
+                build_with_clang(_api_version);
+            }
+        } else {
+            // The Cpp API is not FFI safe, not compiling in the exact same environment leads to undefined behavior
+            display_build_warnings();
+            build_with_gcc(_api_version);
+        }
+    }
+}
+
+#[allow(dead_code)]
+fn display_build_warnings() {
+    println!("cargo:warning=---------------------");
+    println!("cargo:warning=------ Warning ------");
+    println!("cargo:warning=---------------------");
+    println!(
+        "cargo:warning=Building the C++ bindings without the `fdb-docker` feature will be valid from Rust's perspective but not from C++ and FoundationDB"
+    );
+    println!("cargo:warning=Please follow the instructions in the associated README");
+}
+
+#[allow(dead_code)]
+fn build_with_gcc(api_version: usize) {
+    cc::Build::new()
+        .cpp(true)
+        .std("c++14")
+        .define("FDB_API_VERSION", api_version.to_string().as_str())
+        .file("src/CppWorkload.cpp")
+        .compile("ctx");
+}
+
+#[allow(dead_code)]
+fn build_with_clang(api_version: usize) {
+    cc::Build::new()
+        .compiler("clang")
+        .cpp_set_stdlib("c++")
+        .cpp(true)
+        .std("c++14")
+        .define("FDB_API_VERSION", api_version.to_string().as_str())
+        .file("src/CppWorkload.cpp")
+        .compile("ctx");
+}
diff --git a/bindings/rust/foundationdb-simulation/docs/fdb_rt.md b/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
new file mode 100644
index 00000000000..a50856b1bde
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
@@ -0,0 +1,284 @@
+Here is an explanation of how `fdb_spawn` communicates with the simulation through the
+foundationdb-rs SDK.
+```rs
+    fdb_spawn(async move {
+        ... // code that relies on polling FdbFutures
+    }
+```
+
+The executor uses a two-phase model: **wakeup** (which queues tasks) and **polling** (which
+executes them). This separation enables proper handling of shared futures and prevents
+re-entrancy issues.
+
+## Core Data Structures
+
+A thread-local queue holds tasks that have been woken and are waiting to be polled:
+```rs
+thread_local! {
+    static TASKS: RefCell<Vec<Arc<Task>>> = const { RefCell::new(Vec::new()) };
+}
+```
+
+The `Task` struct wraps a pinned future. The `Option` allows the future to be taken out
+during polling and put back if it returns `Pending`:
+```rs
+struct Task {
+    f: UnsafeCell<Option<Pin<Box<dyn Future<Output = ()>>>>>,
+}
+```
+
+## Spawning a Task
+
+`fdb_spawn` takes in a Rust Future, wraps it in a `Task`, and immediately polls it:
+```rs
+pub(crate) fn fdb_spawn<F>(future: F)
+where
+    F: Future<Output = ()> + 'static,
+{
+    // Create a Task containing the pinned future wrapped in Option
+    let task = Arc::new(Task {
+        f: UnsafeCell::new(Some(Box::pin(future))),
+    });
+    // Immediately poll the task to start execution
+    task.poll();
+}
+```
+
+## Polling a Task
+
+`Task::poll` creates a waker from itself and polls the future:
+```rs
+impl Task {
+    fn poll(self: Arc<Self>) {
+        // Create a Waker that references this Task
+        let waker = unsafe { Waker::from_raw(self.clone().into_waker()) };
+        let cx = &mut Context::from_waker(&waker);
+        // Take the future out of the slot
+        let slot = unsafe { &mut *self.f.get() };
+        if let Some(mut f) = slot.take() {
+            // Poll the future
+            if f.as_mut().poll(cx).is_pending() {
+                // If Pending, put the future back for later polling
+                *slot = Some(f);
+            }
+            // If Ready, the future is dropped (not put back)
+        }
+    }
+}
+```
+
+## Waking a Task
+
+The key insight of this architecture: **waking a task does not poll it**. Instead, it
+queues the task for later polling:
+```rs
+impl Task {
+    // Called when Waker::wake() is invoked (consumes the waker)
+    fn wake(ptr: *const ()) {
+        let task = Self::from_ptr(ptr);
+        // Just push to the queue - don't poll yet
+        TASKS.with_borrow_mut(|tasks| tasks.push(task))
+    }
+
+    // Called when Waker::wake_by_ref() is invoked (doesn't consume the waker)
+    fn wake_by_ref(ptr: *const ()) {
+        let task = Self::from_ptr(ptr);
+        TASKS.with_borrow_mut(|tasks| tasks.push(task.clone()));
+        mem::forget(task);  // Don't decrement ref count since we cloned
+    }
+}
+```
+
+## Draining the Queue
+
+`poll_pending_tasks` drains the queue and polls all waiting tasks:
+```rs
+pub fn poll_pending_tasks() {
+    let mut tasks = TASKS.with_borrow_mut(mem::take);
+    tasks.drain(..).for_each(Task::poll);
+}
+```
+
+## FdbFuture Polling
+
+`poll()` runs the closure until encountering an `await`. The case we're interested in takes
+place when foundationdb-rs issues a call to fdbserver using the C-API through `fdb_sys`.
+Calls that return an `FDBFuture*` are wrapped into `FdbFuture` which implements poll:
+```rs
+pub(crate) struct FdbFuture<T> {
+    f: Option<FdbFutureHandle>,
+    waker: Option<Arc<AtomicWaker>>,
+    phantom: std::marker::PhantomData<T>,
+}
+
+impl<T> Future for FdbFuture<T>
+where
+    T: TryFrom<FdbFutureHandle, Error = FdbError> + Unpin,
+{
+    type Output = FdbResult<T>;
+
+    fn poll(mut self: Pin<&mut Self>, cx: &mut Context) -> Poll<FdbResult<T>> {
+        let f = self.f.as_ref().expect("cannot poll after resolve");
+        let ready = unsafe { fdb_sys::fdb_future_is_ready(f.as_ptr()) };
+        if ready == 0 {
+            // Future not ready yet - set up the callback
+            let f_ptr = f.as_ptr();
+            let mut register = false;
+            let waker = self.waker.get_or_insert_with(|| {
+                register = true;
+                Arc::new(AtomicWaker::new())
+            });
+            // Register our Task's waker into the AtomicWaker
+            // This clones the waker
+            waker.register(cx.waker());
+            if register {
+                // First poll: set up the FDB callback
+                let network_waker: Arc<AtomicWaker> = waker.clone();
+                let network_waker_ptr = Arc::into_raw(network_waker);
+                unsafe {
+                    fdb_sys::fdb_future_set_callback(
+                        f_ptr,
+                        Some(fdb_future_callback),
+                        network_waker_ptr as *mut _,
+                    );
+                }
+            }
+            Poll::Pending
+        } else {
+            // Future is ready - extract the result
+            Poll::Ready(
+                error::eval(unsafe { fdb_sys::fdb_future_get_error(f.as_ptr()) })
+                    .and_then(|()| T::try_from(self.f.take().expect("self.f.is_some()"))),
+            )
+        }
+    }
+}
+```
+
+## Initial Spawn Summary
+
+To summarize what happens when `fdb_spawn` is called:
+- `fdb_spawn` creates a `Task` wrapping the pinned future and immediately calls `task.poll()`
+- `Task::poll` creates a waker and polls the future
+- When an `FdbFuture` is polled, it:
+  - Registers our `Waker` into an `AtomicWaker` (cloning it)
+  - Sets `fdb_future_callback` as callback with the `AtomicWaker` as argument
+  - Returns `Poll::Pending`
+- `Task::poll` sees `Pending` and puts the future back in the slot
+- `fdb_spawn` returns
+
+```
+fdb_spawn
+  └─ Task::poll
+       └─ FdbFuture::poll
+            ├─ waker.register(cx.waker())  // clones our waker into AtomicWaker
+            ├─ fdb_future_set_callback     // registers callback with FDB
+            └─ returns Pending
+       └─ future put back in slot
+  └─ returns
+```
+
+After this, the future has been handed to the simulation and `fdb_spawn` returns. If your
+Workload is valid, execution is returned to the simulation. The fdbserver runs, internally
+resolving the future and, when done, notifies `FdbFutureHandle` by calling its callback.
+
+## The Callback and Executor Hook
+
+When FDB resolves a future, it calls `fdb_future_callback`. This is where the two-phase
+model comes together:
+```rs
+pub static CUSTOM_EXECUTOR_HOOK: std::sync::OnceLock<fn()> = std::sync::OnceLock::new();
+
+extern "C" fn fdb_future_callback(
+    _f: *mut fdb_sys::FDBFuture,
+    callback_parameter: *mut ::std::os::raw::c_void,
+) {
+    // Phase 1: Wakeup - resolve all wakeup chain
+    let network_waker: Arc<AtomicWaker> = unsafe { Arc::from_raw(callback_parameter as *const _) };
+    network_waker.wake();  // This calls Task::wake(), which queues the task
+
+    // Phase 2: Polling - poll all queued tasks
+    if let Some(poll_pending_tasks) = CUSTOM_EXECUTOR_HOOK.get() {
+        poll_pending_tasks();
+    }
+}
+```
+
+The simulation registers `poll_pending_tasks` as the executor hook during workload
+initialization (in `register_workload!` or `register_factory!`):
+```rs
+foundationdb::future::CUSTOM_EXECUTOR_HOOK
+    .set(foundationdb_simulation::internals::poll_pending_tasks)
+    .unwrap();
+```
+
+## Callback Execution Flow
+
+When `fdb_future_callback` is called:
+1. `network_waker.wake()` calls the waker stored in `AtomicWaker`
+2. This invokes `Task::wake()`, which pushes the task to `TASKS` queue
+3. `poll_pending_tasks()` drains the queue and polls all tasks
+4. `Task::poll` polls the future, which finds `fdb_future_is_ready` returns non-zero
+5. `FdbFuture::poll` returns `Poll::Ready` with the result
+
+```
+fdb_future_callback
+  ├─ network_waker.wake()
+  │    └─ Task::wake() -> pushes task to TASKS queue
+  └─ poll_pending_tasks()
+       └─ Task::poll
+            └─ FdbFuture::poll
+                 └─ fdb_future_is_ready == true
+                 └─ returns Ready(result)
+            └─ future continues executing...
+```
+
+## Encountering Another FdbFuture
+
+If the closure encounters another `FdbFuture`, the cycle continues:
+- `FdbFuture::poll` is called which:
+  - Registers the `Waker` (cloning it)
+  - Sets `fdb_future_callback` as callback
+  - Returns `Poll::Pending`
+- `Task::poll` puts the future back in the slot
+- Later, when FDB resolves the new future, `fdb_future_callback` is called again
+
+```
+fdb_future_callback (for first future)
+  ├─ network_waker.wake() -> queues task
+  └─ poll_pending_tasks()
+       └─ Task::poll
+            └─ FdbFuture::poll (first)
+                 └─ returns Ready
+            └─ ... more code runs ...
+            └─ FdbFuture::poll (second)
+                 ├─ waker.register()
+                 ├─ fdb_future_set_callback
+                 └─ returns Pending
+            └─ future put back in slot
+
+... later, fdbserver resolves second future ...
+
+fdb_future_callback (for second future)
+  ├─ network_waker.wake() -> queues task
+  └─ poll_pending_tasks()
+       └─ Task::poll
+            └─ ... continues from where it left off ...
+```
+
+## Completion
+
+When the task's future finishes without setting a new callback (no more `FdbFuture`s to
+await), `Task::poll` sees `Poll::Ready(())` and does not put the future back in the slot.
+The future is dropped, and when all references to the `Task` are dropped, the `Task` itself
+is freed:
+
+```
+fdb_future_callback
+  ├─ network_waker.wake() -> queues task
+  └─ poll_pending_tasks()
+       └─ Task::poll
+            └─ future.poll() returns Ready(())
+            └─ future is dropped (not put back)
+       └─ Task dropped (if no more references)
+```
diff --git a/bindings/rust/foundationdb-simulation/examples/atomic/Dockerfile b/bindings/rust/foundationdb-simulation/examples/atomic/Dockerfile
new file mode 100644
index 00000000000..2662c7cfc69
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/examples/atomic/Dockerfile
@@ -0,0 +1,37 @@
+# This Dockerfile is used to build the `atomic` example.
+# WARNING:
+# The build image is fairly large, so you need to have extra storage space on your CI
+FROM foundationdb/build:centos7-20240228040135-fc272dd89b
+ARG FDB_VERSION="7.3.27"
+ARG FDB_RS_FEATURE_VERSION="fdb-7_3"
+
+# Required to correctly build the example
+ENV RUSTC_LINKER=clang
+
+# Add source code and bump Rust version to stable
+RUN mkdir /root/fdb-rs
+COPY . /root/fdb-rs
+RUN /root/.cargo/bin/rustup update stable
+RUN /root/.cargo/bin/rustup default stable
+
+# Install libfdb
+ADD https://github.com/apple/foundationdb/releases/download/${FDB_VERSION}/foundationdb-clients-${FDB_VERSION}-1.el7.x86_64.rpm /tmp/foundationdb-clients-${FDB_VERSION}-1.el7.x86_64.rpm
+RUN rpm -i /tmp/foundationdb-clients-${FDB_VERSION}-1.el7.x86_64.rpm
+
+# Install fdbserver
+ADD https://github.com/apple/foundationdb/releases/download/${FDB_VERSION}/foundationdb-server-${FDB_VERSION}-1.el7.x86_64.rpm /tmp/foundationdb-server-${FDB_VERSION}-1.el7.x86_64.rpm
+RUN rpm -i /tmp/foundationdb-server-${FDB_VERSION}-1.el7.x86_64.rpm
+
+# Build the .so
+# The artifact will be at /root/fdb-rs/target/release/examples/libatomic.so
+RUN cd /root/fdb-rs && \
+    source /opt/rh/devtoolset-11/enable && \
+    source /root/.cargo/env && \
+    RUSTFLAGS="-C linker=clang" cargo build -p foundationdb-simulation --release --example atomic --features ${FDB_RS_FEATURE_VERSION},fdb-docker
+
+# In case you are running a seg fault, uncomment this to have the fdbserver debug
+# ADD https://github.com/apple/foundationdb/releases/download/${FDB_VERSION}/fdbserver.debug.x86_64.gz /tmp/fdbserver.debug.x86_64.gz
+# RUN gzip -d /tmp/fdbserver.debug.x86_64.gz
+
+WORKDIR /root/fdb-rs
+CMD ["/root/fdb-rs/scripts/simulation_entrypoint.sh", "20"]
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs b/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs
new file mode 100644
index 00000000000..ebda74d5191
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs
@@ -0,0 +1,309 @@
+use std::time::Duration;
+
+use foundationdb::{
+    BudgetExceeded, BudgetKind, ClientBudget, FdbBindingError, FdbResult, Transaction,
+    env::Environment,
+    options::{MutationType, TransactionOption},
+    tuple::Subspace,
+};
+use foundationdb_simulation::{
+    Metric, Metrics, RustWorkload, Severity, SimDatabase, SingleRustWorkload, WorkloadContext,
+    details, register_workload,
+};
+
+pub struct AtomicWorkload {
+    context: WorkloadContext,
+    client_id: i32,
+    counter: AtomicCounter,
+    // how many transactions will be run
+    expected_count: usize,
+    // how many transactions succeeded
+    success_count: usize,
+    // how many transactions failed
+    error_count: usize,
+    // how many maybe_committed transactions we encountered
+    maybe_committed_count: usize,
+    // how much simulated time start() took
+    elapsed: Duration,
+    // how many rows the budgeted scan read before it stopped
+    scan_iterations: usize,
+    // the limit that scan tripped on, None if it never did
+    scan_outcome: Option<BudgetExceeded>,
+}
+
+const COUNT_KEY: &[u8] = b"count";
+
+// How many rows setup() writes, and the modulus of the budgeted scan.
+const ROW_COUNT: usize = 500;
+// What one scan attempt may spend, measured with the simulator clock. A simulated
+// read costs enough that this trips after a few dozen of them, well before the
+// five seconds FoundationDB gives a transaction.
+const TIME_LIMIT: Duration = Duration::from_secs(1);
+// Ends the scan even if the budget never trips, so the workload terminates.
+const MAX_ITERATIONS: usize = 100_000;
+
+/// The counter itself, reading time from the environment it was given instead of
+/// from the machine. It never sets transaction options: that belongs to the
+/// caller.
+struct AtomicCounter {
+    env: Environment,
+    subspace: Subspace,
+}
+
+impl AtomicCounter {
+    fn new(env: Environment, subspace: Subspace) -> Self {
+        Self { env, subspace }
+    }
+
+    /// The current reading of the environment clock, simulated time here.
+    fn now(&self) -> Duration {
+        self.env.clock().monotonic()
+    }
+
+    fn key(&self) -> Vec<u8> {
+        self.subspace.pack(&COUNT_KEY)
+    }
+
+    fn increment(&self, trx: &Transaction) {
+        let buf: [u8; 8] = 1i64.to_le_bytes();
+        trx.atomic_op(&self.key(), &buf, MutationType::Add);
+    }
+
+    fn decode_count(&self, bytes: &[u8]) -> usize {
+        i64::from_le_bytes(bytes[..8].try_into().unwrap()) as usize
+    }
+
+    /// The key of one of the rows the budgeted scan walks, kept apart from the
+    /// counter key.
+    fn row_key(&self, index: usize) -> Vec<u8> {
+        self.subspace.pack(&("rows", index as i64))
+    }
+
+    /// Reads one row, returning how many bytes came back.
+    ///
+    /// The await is where simulated time passes: the simulator decides the
+    /// latency of the storage round trip, and that is what moves the clock a time
+    /// budget is measured against.
+    async fn read_row(&self, trx: &Transaction, index: usize) -> FdbResult<usize> {
+        let value = trx.get(&self.row_key(index), false).await?;
+        Ok(value.map_or(0, |bytes| bytes.len()))
+    }
+}
+
+impl SingleRustWorkload for AtomicWorkload {
+    fn new(_name: String, context: WorkloadContext) -> Self {
+        // The same struct runs in production with `Environment::default()`, in tests
+        // with `Environment::with_seed(..)` and here with the simulator's
+        // `context.environment()`: only the environment swaps.
+        let counter = AtomicCounter::new(context.environment(), Subspace::all());
+        Self {
+            client_id: context.client_id(),
+            expected_count: context.get_option("count").expect("Could not get count"),
+            context,
+            counter,
+            success_count: 0,
+            error_count: 0,
+            maybe_committed_count: 0,
+            elapsed: Duration::ZERO,
+            scan_iterations: 0,
+            scan_outcome: None,
+        }
+    }
+}
+
+impl RustWorkload for AtomicWorkload {
+    async fn setup(&mut self, db: SimDatabase) {
+        println!("rust_setup({})", self.client_id);
+        // Only use a single client
+        if self.client_id == 0 {
+            // The rows the budgeted scan of start() walks.
+            let counter = &self.counter;
+            db.run(|trx, _maybe_committed| async move {
+                for index in 0..ROW_COUNT {
+                    trx.set(&counter.row_key(index), &(index as i64).to_le_bytes());
+                }
+                Ok::<_, FdbBindingError>(())
+            })
+            .await
+            .expect("could not write the rows to scan");
+        }
+    }
+    async fn start(&mut self, db: SimDatabase) {
+        println!("rust_start({})", self.client_id);
+        let started_at = self.counter.now();
+        // Only use a single client
+        if self.client_id == 0 {
+            for _ in 0..self.expected_count {
+                let trx = db.create_trx().expect("Could not create transaction");
+
+                // Enable idempotent txn
+                trx.set_option(TransactionOption::AutomaticIdempotency)
+                    .expect("could not setup automatic idempotency");
+
+                self.counter.increment(&trx);
+
+                match trx.commit().await {
+                    Ok(_) => self.success_count += 1,
+                    Err(err) => {
+                        if err.is_maybe_committed() {
+                            self.context.trace(
+                                Severity::Warn,
+                                "Detected an maybe_committed transactions with idempotency",
+                                details![
+                                    "Layer" => "Rust",
+                                    "Client" => self.client_id
+                                ],
+                            );
+                            self.maybe_committed_count += 1;
+                        } else {
+                            self.error_count += 1;
+                        }
+                    }
+                }
+
+                self.context.trace(
+                    Severity::Info,
+                    "Successfully setup workload",
+                    details![
+                        "Layer" => "Rust",
+                        "Client" => self.client_id
+                    ],
+                );
+            }
+
+            // The budgeted scan: one long loop of reads that the client budget is
+            // meant to end. db.run wraps it because buggify injects retryable read
+            // errors, and the budget is per attempt: a retry restarts the scan with
+            // a fresh allowance, which is exactly the semantics being demonstrated.
+            let counter = &self.counter;
+            let (iterations, outcome) = db
+                .run(|trx, _maybe_committed| async move {
+                    // Measuring the attempt with the simulator clock is what makes
+                    // the moment the budget trips part of the deterministic state
+                    // of the run.
+                    trx.set_client_budget(ClientBudget {
+                        time_limit: Some(TIME_LIMIT),
+                        clock: Some(counter.env.clock().clone()),
+                        ..ClientBudget::default()
+                    });
+
+                    let mut iterations = 0;
+                    let mut outcome = None;
+                    for index in 0..MAX_ITERATIONS {
+                        // Distinct keys matter: a key already read by this attempt
+                        // comes back from the read-your-writes cache without a
+                        // simulated round trip, so the clock would never move.
+                        counter
+                            .read_row(&trx, index % ROW_COUNT)
+                            .await
+                            .map_err(FdbBindingError::from)?;
+                        iterations += 1;
+
+                        // Exceeding the budget is the expected outcome, data rather
+                        // than a transactional error, so it leaves the closure as an
+                        // Ok and db.run does not retry it.
+                        if let Err(exceeded) = trx.check_client_budget() {
+                            outcome = Some(exceeded);
+                            break;
+                        }
+                    }
+
+                    Ok::<_, FdbBindingError>((iterations, outcome))
+                })
+                .await
+                .expect("could not run the budgeted scan");
+            self.scan_iterations = iterations;
+            self.scan_outcome = outcome;
+        }
+        // Simulated time, so this is deterministic across runs of the same seed.
+        self.elapsed = self.counter.now() - started_at;
+    }
+    async fn check(&mut self, db: SimDatabase) {
+        println!("rust_check({})", self.client_id);
+        if self.client_id == 0 {
+            // even if buggify is off in checks, transactions can failed because of the randomized knob,
+            // so we need to wrap the check in a db.run
+            let counter = &self.counter;
+            let count = db
+                .run(|trx, _maybe_committed| async move {
+                    match trx.get(&counter.key(), true).await {
+                        Err(e) => Err(FdbBindingError::from(e)),
+                        Ok(None) => Ok(0),
+                        Ok(Some(byte_count)) => Ok(counter.decode_count(&byte_count)),
+                    }
+                })
+                .await
+                .expect("could not check using db.run");
+
+            if self.success_count == count {
+                self.context.trace(
+                    Severity::Info,
+                    "Atomic count match",
+                    details![
+                        "Layer" => "Rust",
+                        "Client" => self.client_id,
+                        "Expected" => self.expected_count,
+                        "Found" => count,
+                        "CommittedCount" => self.success_count,
+                        "MaybeCommitted" => self.maybe_committed_count,
+                    ],
+                );
+            } else {
+                self.context.trace(
+                    Severity::Error,
+                    "Atomic count doesn't match",
+                    details![
+                        "Layer" => "Rust",
+                        "Client" => self.client_id,
+                        "Expected" => self.expected_count,
+                        "Found" => count,
+                        "CommittedCount" => self.success_count,
+                        "MaybeCommitted" => self.maybe_committed_count,
+                    ],
+                );
+            }
+
+            // A Severity::Error trace fails the simulation, so every way the budget
+            // could have failed to do its job is reported that way.
+            let (severity, message) = match self.scan_outcome {
+                Some(BudgetExceeded { kind, used, limit })
+                    if kind == BudgetKind::Time && used >= limit =>
+                {
+                    (Severity::Info, "Client budget tripped on time as expected")
+                }
+                Some(_) => (Severity::Error, "Client budget tripped on the wrong limit"),
+                None => (Severity::Error, "Client budget never tripped"),
+            };
+
+            self.context.trace(
+                severity,
+                message,
+                details![
+                    "Layer" => "Rust",
+                    "Client" => self.client_id,
+                    "Iterations" => self.scan_iterations,
+                    "Kind" => self.scan_outcome.map_or("none".to_string(), |e| e.kind.to_string()),
+                    "Used" => self.scan_outcome.map_or(0, |e| e.used),
+                    "Limit" => self.scan_outcome.map_or(0, |e| e.limit),
+                ],
+            );
+        }
+    }
+    fn get_metrics(&self, mut out: Metrics) {
+        println!("rust_get_metrics({})", self.client_id);
+        out.extend([
+            Metric::val("expected_count", self.expected_count as f64),
+            Metric::val("success_count", self.success_count as f64),
+            Metric::val("error_count", self.error_count as f64),
+            Metric::val("elapsed_simulated_seconds", self.elapsed.as_secs_f64()),
+            Metric::val("iterations", self.scan_iterations as f64),
+            Metric::val("used_ms", self.scan_outcome.map_or(0, |e| e.used) as f64),
+        ]);
+    }
+    fn get_check_timeout(&self) -> f64 {
+        println!("rust_get_check_timeout({})", self.client_id);
+        5000.0
+    }
+}
+
+register_workload!(AtomicWorkload);
diff --git a/bindings/rust/foundationdb-simulation/examples/atomic/test_file_73.toml b/bindings/rust/foundationdb-simulation/examples/atomic/test_file_73.toml
new file mode 100644
index 00000000000..d756d798e0f
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/examples/atomic/test_file_73.toml
@@ -0,0 +1,36 @@
+[[test]]
+testTitle = 'AtomicWorkload'
+
+  [[test.workload]]
+    testName = 'External'
+    libraryName = 'atomic'
+    workloadName = 'AtomicWorkload'
+    libraryPath = './target/release/examples'
+    count = 50
+
+  [[test.workload]]
+    # Introduce network partitions
+    testName = 'RandomClogging'
+    testDuration = 30.0
+    # Unclog them in reversed order
+    swizzle = 1
+
+  [[test.workload]]
+    # Reboot processes
+    testName = 'Attrition'
+    machinesToKill = 10
+    machinesToLeave = 3
+    reboot = true
+    testDuration = 30.0
+
+  [[test.workload]]
+    # Introduce specific network partitions errors between proxies and tLogs
+    testName = 'Rollback'
+    testDuration = 30
+
+  [[test.workload]]
+    # Change configuration of the database
+    testName = 'ChangeConfig'
+    maxDelayBeforeChange = 30.0
+    # Move consensus-based processes around
+    coordinators = 'auto'
diff --git a/bindings/rust/foundationdb-simulation/examples/atomic/test_file_74.toml b/bindings/rust/foundationdb-simulation/examples/atomic/test_file_74.toml
new file mode 100644
index 00000000000..01fcffb2406
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/examples/atomic/test_file_74.toml
@@ -0,0 +1,37 @@
+[[test]]
+testTitle = 'AtomicWorkload'
+
+  [[test.workload]]
+    testName = 'External'
+    useCAPI = true
+    libraryName = 'atomic'
+    workloadName = 'AtomicWorkload'
+    libraryPath = './target/release/examples'
+    count = 50
+
+  [[test.workload]]
+    # Introduce network partitions
+    testName = 'RandomClogging'
+    testDuration = 30.0
+    # Unclog them in reversed order
+    swizzle = 1
+
+  [[test.workload]]
+    # Reboot processes
+    testName = 'Attrition'
+    machinesToKill = 10
+    machinesToLeave = 3
+    reboot = true
+    testDuration = 30.0
+
+  [[test.workload]]
+    # Introduce specific network partitions errors between proxies and tLogs
+    testName = 'Rollback'
+    testDuration = 30
+
+  [[test.workload]]
+    # Change configuration of the database
+    testName = 'ChangeConfig'
+    maxDelayBeforeChange = 30.0
+    # Move consensus-based processes around
+    coordinators = 'auto'
diff --git a/bindings/rust/foundationdb-simulation/examples/noop/lib.rs b/bindings/rust/foundationdb-simulation/examples/noop/lib.rs
new file mode 100644
index 00000000000..bff85abc5ee
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/examples/noop/lib.rs
@@ -0,0 +1,124 @@
+use std::time::Duration;
+
+use foundationdb::env::Environment;
+use foundationdb_simulation::{
+    Metric, Metrics, RustWorkload, RustWorkloadFactory, Severity, SimDatabase, WorkloadContext,
+    WrappedWorkload, register_factory,
+};
+
+/// Measures elapsed time through the environment it was given, never through the
+/// machine clock.
+struct SimulatedStopwatch {
+    env: Environment,
+}
+
+impl SimulatedStopwatch {
+    fn new(env: Environment) -> Self {
+        Self { env }
+    }
+
+    /// A reading to compare with a later one, simulated time here.
+    fn mark(&self) -> Duration {
+        self.env.clock().monotonic()
+    }
+}
+
+struct NoopWorkload {
+    name: String,
+    client_id: i32,
+    context: WorkloadContext,
+    stopwatch: SimulatedStopwatch,
+}
+
+impl RustWorkload for NoopWorkload {
+    async fn setup(&mut self, _db: SimDatabase) {
+        println!("rust_setup({}_{})", self.name, self.client_id);
+        self.context.trace(
+            Severity::Debug,
+            "Test",
+            &[("Layer", "Rust"), ("Stage", "Setup")],
+        );
+    }
+    async fn start(&mut self, _db: SimDatabase) {
+        println!("rust_start({}_{})", self.name, self.client_id);
+        self.context.trace(
+            Severity::Debug,
+            "Test",
+            &[("Layer", "Rust"), ("Stage", "Start")],
+        );
+        // Exercise WorkloadContext::delay (requires fdbserver 7.4.6+, the C API path).
+        let before = self.stopwatch.mark();
+        self.context
+            .delay(Duration::from_secs(1))
+            .await
+            .expect("delay future should resolve");
+        let after = self.stopwatch.mark();
+        // The difference is simulated time, not machine time: the simulator decides
+        // when the clock advances, so these readings are deterministic.
+        println!(
+            "clock({}_{}): before={before:?} after={after:?} difference={:?}",
+            self.name,
+            self.client_id,
+            after - before
+        );
+    }
+    async fn check(&mut self, _db: SimDatabase) {
+        println!("rust_check({}_{})", self.name, self.client_id);
+        self.context.trace(
+            Severity::Debug,
+            "Test",
+            &[("Layer", "Rust"), ("Stage", "Check")],
+        );
+    }
+    fn get_metrics(&self, mut out: Metrics) {
+        println!("rust_get_metrics({}_{})", self.name, self.client_id);
+        out.reserve(8);
+        out.push(Metric::val("test", 42));
+    }
+    fn get_check_timeout(&self) -> f64 {
+        println!("rust_get_check_timeout({}_{})", self.name, self.client_id);
+        3000.
+    }
+}
+impl NoopWorkload {
+    fn new(name: String, client_id: i32, context: WorkloadContext) -> Self {
+        // The same struct runs in production with `Environment::default()`, in tests
+        // with `Environment::with_seed(..)` and here with the simulator's
+        // `context.environment()`: only the environment swaps.
+        let stopwatch = SimulatedStopwatch::new(context.environment());
+        Self {
+            name,
+            client_id,
+            context,
+            stopwatch,
+        }
+    }
+}
+impl Drop for NoopWorkload {
+    fn drop(&mut self) {
+        println!("rust_free({}_{})", self.name, self.client_id);
+    }
+}
+
+struct NoopFactory;
+impl RustWorkloadFactory for NoopFactory {
+    fn create(name: String, context: WorkloadContext) -> WrappedWorkload {
+        let client_id = context.client_id();
+        let client_count = context.client_count();
+        println!("RustWorkloadFactory::create({name})[{client_id}/{client_count}]");
+        println!(
+            "my_c_option: {:?}",
+            context.get_option::<String>("my_c_option")
+        );
+        println!(
+            "my_c_option: {:?}",
+            context.get_option::<String>("my_c_option")
+        );
+        match name.as_str() {
+            "NoopWorkload" => NoopWorkload::new(name, client_id, context).wrap(),
+            _ => panic!("Unknown workload name: {name}"),
+        }
+    }
+}
+
+register_factory!(NoopFactory);
diff --git a/bindings/rust/foundationdb-simulation/examples/noop/test_file.toml b/bindings/rust/foundationdb-simulation/examples/noop/test_file.toml
new file mode 100644
index 00000000000..f3c06d25d2e
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/examples/noop/test_file.toml
@@ -0,0 +1,10 @@
+[[test]]
+testTitle = 'NOOP_Test'
+
+  [[test.workload]]
+    useCAPI = true
+    testName = 'External'
+    workloadName = 'NoopWorkload'
+    libraryPath = './target/release/examples'
+    libraryName = 'noop'
+    my_c_option = 'my_value'
diff --git a/bindings/rust/foundationdb-simulation/examples/shared/lib.rs b/bindings/rust/foundationdb-simulation/examples/shared/lib.rs
new file mode 100644
index 00000000000..a4b42551723
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/examples/shared/lib.rs
@@ -0,0 +1,78 @@
+use std::time::Duration;
+
+use foundationdb::env::Environment;
+use foundationdb_simulation::{
+    Metrics, RustWorkload, SimDatabase, SingleRustWorkload, WorkloadContext, register_workload,
+};
+use futures_util::FutureExt;
+
+/// Tells at which simulated time a workload phase runs, reading the environment
+/// clock instead of the machine one.
+struct PhaseClock {
+    env: Environment,
+}
+
+impl PhaseClock {
+    fn new(env: Environment) -> Self {
+        Self { env }
+    }
+
+    fn now(&self) -> Duration {
+        self.env.clock().monotonic()
+    }
+}
+
+pub struct SharedWorkload {
+    client_id: i32,
+    phase_clock: PhaseClock,
+}
+
+impl SingleRustWorkload for SharedWorkload {
+    fn new(_name: String, context: WorkloadContext) -> Self {
+        // The same struct runs in production with `Environment::default()`, in tests
+        // with `Environment::with_seed(..)` and here with the simulator's
+        // `context.environment()`: only the environment swaps.
+        Self {
+            client_id: context.client_id(),
+            phase_clock: PhaseClock::new(context.environment()),
+        }
+    }
+}
+
+impl RustWorkload for SharedWorkload {
+    async fn setup(&mut self, _db: SimDatabase) {
+        println!(
+            "rust_setup({}) at {:?}",
+            self.client_id,
+            self.phase_clock.now()
+        );
+    }
+    async fn start(&mut self, db: SimDatabase) {
+        println!(
+            "rust_start({}) at {:?}",
+            self.client_id,
+            self.phase_clock.now()
+        );
+        let trx = db.create_trx().expect("Could not create transaction");
+        let future = trx.get_read_version();
+        let shared = future.shared();
+        let version = shared.await;
+        println!("read_version({}) = {version:?}", self.client_id);
+    }
+    async fn check(&mut self, _db: SimDatabase) {
+        println!(
+            "rust_check({}) at {:?}",
+            self.client_id,
+            self.phase_clock.now()
+        );
+    }
+    fn get_metrics(&self, mut _out: Metrics) {
+        println!("rust_get_metrics({})", self.client_id);
+    }
+    fn get_check_timeout(&self) -> f64 {
+        println!("rust_get_check_timeout({})", self.client_id);
+        5000.0
+    }
+}
+
+register_workload!(SharedWorkload);
diff --git a/bindings/rust/foundationdb-simulation/examples/shared/test_file.toml b/bindings/rust/foundationdb-simulation/examples/shared/test_file.toml
new file mode 100644
index 00000000000..02bc0c07e88
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/examples/shared/test_file.toml
@@ -0,0 +1,9 @@
+[[test]]
+testTitle = 'Test_Test'
+
+  [[test.workload]]
+    useCAPI = true
+    testName = 'External'
+    workloadName = 'SharedWorkload'
+    libraryPath = './target/release/examples'
+    libraryName = 'shared'
diff --git a/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp b/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
new file mode 100644
index 00000000000..13119e38809
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
@@ -0,0 +1,227 @@
+// C++ to C bindings
+
+#include <cstring>
+#include <cstdint>
+
+#include "headers/CppWorkload.h"
+namespace capi {
+#include "headers/CWorkload.h"
+}
+
+#define WITH(C, M, ...) (C).vt->M((C).inner, ##__VA_ARGS__)
+
+namespace translator {
+extern "C" capi::FDBWorkload workloadCFactory(const char*, capi::FDBWorkloadContext);
+
+template <typename T>
+struct Wrapper {
+	T inner;
+};
+
+namespace metrics {
+void reserve(capi::OpaqueMetrics* c_metrics, int n) {
+	auto metrics = (std::vector<FDBPerfMetric>*)c_metrics;
+	metrics->reserve(metrics->size() + n);
+}
+void push(capi::OpaqueMetrics* c_metrics, capi::FDBMetric c_metric) {
+	auto metrics = (std::vector<FDBPerfMetric>*)c_metrics;
+	auto fmt = c_metric.fmt ? c_metric.fmt : "%.3g";
+	auto metric = FDBPerfMetric{
+		.name = std::string(c_metric.key),
+		.value = c_metric.val,
+		.averaged = c_metric.avg,
+		.format_code = std::string(fmt),
+	};
+	metrics->emplace_back(metric);
+}
+capi::FDBMetrics wrap(std::vector<FDBPerfMetric>* metrics) {
+	static capi::FDBMetrics::FDBMetrics_VT vt = {
+		.reserve = reserve,
+		.push = push,
+	};
+	return capi::FDBMetrics{
+		.inner = (capi::OpaqueMetrics*)metrics,
+		.vt = &vt,
+	};
+}
+} // namespace metrics
+
+namespace promise {
+void send(capi::OpaquePromise* c_promise, bool value) {
+	auto promise = (Wrapper<GenericPromise<bool>>*)c_promise;
+	promise->inner.send(value);
+}
+void free(capi::OpaquePromise* c_promise) {
+	auto promise = (Wrapper<GenericPromise<bool>>*)c_promise;
+	delete promise;
+}
+capi::FDBPromise wrap(GenericPromise<bool> promise) {
+	static capi::FDBPromise::FDBPromise_VT vt = {
+		.free = free,
+		.send = send,
+	};
+	auto wrapped = new Wrapper<GenericPromise<bool>>{ promise };
+	return capi::FDBPromise{
+		.inner = (capi::OpaquePromise*)wrapped,
+		.vt = &vt,
+	};
+}
+} // namespace promise
+
+namespace context {
+void trace(
+	capi::OpaqueWorkloadContext* c_context,
+	capi::FDBSeverity c_severity,
+	const char* name,
+	const capi::FDBStringPair* c_details,
+	int n
+) {
+	auto context = (FDBWorkloadContext*)c_context;
+	FDBSeverity severity;
+	switch (c_severity) {
+	case capi::FDBSeverity_Debug:
+		severity = FDBSeverity::Debug;
+		break;
+	case capi::FDBSeverity_Info:
+		severity = FDBSeverity::Info;
+		break;
+	case capi::FDBSeverity_Warn:
+		severity = FDBSeverity::Warn;
+		break;
+	case capi::FDBSeverity_WarnAlways:
+		severity = FDBSeverity::WarnAlways;
+		break;
+	case capi::FDBSeverity_Error:
+		severity = FDBSeverity::Error;
+		break;
+	default:
+		severity = FDBSeverity::Error;
+		break;
+	}
+	std::vector<std::pair<std::string, std::string>> details;
+	details.reserve(n);
+	for (int i = 0; i < n; i++) {
+		details.emplace_back(std::pair<std::string, std::string>(c_details[i].key, c_details[i].val));
+	}
+	context->trace(severity, name, details);
+}
+uint64_t getProcessID(capi::OpaqueWorkloadContext* c_context) {
+	auto context = (FDBWorkloadContext*)c_context;
+	return context->getProcessID();
+}
+void setProcessID(capi::OpaqueWorkloadContext* c_context, uint64_t processID) {
+	auto context = (FDBWorkloadContext*)c_context;
+	return context->setProcessID(processID);
+}
+double now(capi::OpaqueWorkloadContext* c_context) {
+	auto context = (FDBWorkloadContext*)c_context;
+	return context->now();
+}
+uint32_t rnd(capi::OpaqueWorkloadContext* c_context) {
+	auto context = (FDBWorkloadContext*)c_context;
+	return context->rnd();
+}
+capi::FDBString getOption(capi::OpaqueWorkloadContext* c_context, const char* name, const char* defaultValue) {
+	static capi::FDBString::FDBString_VT vt = {
+		.free = (void (*)(const char*))free,
+	};
+	auto context = (FDBWorkloadContext*)c_context;
+	std::string value = context->getOption(name, std::string(defaultValue));
+	size_t len = value.length() + 1;
+	char* c_value = (char*)malloc(len);
+	memcpy(c_value, value.c_str(), len);
+	return capi::FDBString{
+		.inner = c_value,
+		.vt = &vt,
+	};
+}
+int clientId(capi::OpaqueWorkloadContext* c_context) {
+	auto context = (FDBWorkloadContext*)c_context;
+	return context->clientId();
+}
+int clientCount(capi::OpaqueWorkloadContext* c_context) {
+	auto context = (FDBWorkloadContext*)c_context;
+	return context->clientCount();
+}
+int64_t sharedRandomNumber(capi::OpaqueWorkloadContext* c_context) {
+	auto context = (FDBWorkloadContext*)c_context;
+	return context->sharedRandomNumber();
+}
+FDBFuture* delay(capi::OpaqueWorkloadContext* c_context, double seconds) {
+	auto context = (FDBWorkloadContext*)c_context;
+	return context->delay(seconds);
+}
+capi::FDBWorkloadContext wrap(FDBWorkloadContext* context) {
+	static capi::FDBWorkloadContext::FDBWorkloadContext_VT vt = {
+		.trace = trace,
+		.getProcessID = getProcessID,
+		.setProcessID = setProcessID,
+		.now = now,
+		.rnd = rnd,
+		.getOption = getOption,
+		.clientId = clientId,
+		.clientCount = clientCount,
+		.sharedRandomNumber = sharedRandomNumber,
+		.delay = delay,
+	};
+	return capi::FDBWorkloadContext{
+		.api_version = FDB_API_VERSION,
+		.inner = (capi::OpaqueWorkloadContext*)context,
+		.vt = &vt,
+	};
+}
+} // namespace context
+
+class Workload : public FDBWorkload {
+private:
+	capi::FDBWorkload workload{};
+	std::string name;
+
+public:
+	Workload(const std::string& name) : name(name) {}
+	virtual ~Workload() {
+		if (this->workload.inner) WITH(this->workload, free);
+	}
+
+#if FDB_API_VERSION <= 730
+	virtual std::string description() const override {
+		return "unreachable";
+	}
+#endif
+
+	virtual bool init(FDBWorkloadContext* context) override {
+		this->workload = translator::workloadCFactory(this->name.c_str(), context::wrap(context));
+		return true;
+	}
+	virtual void setup(FDBDatabase* db, GenericPromise<bool> done) override {
+		return WITH(this->workload, setup, (capi::FDBDatabase*)db, promise::wrap(done));
+	}
+	virtual void start(FDBDatabase* db, GenericPromise<bool> done) override {
+		return WITH(this->workload, start, (capi::FDBDatabase*)db, promise::wrap(done));
+	}
+	virtual void check(FDBDatabase* db, GenericPromise<bool> done) override {
+		return WITH(this->workload, check, (capi::FDBDatabase*)db, promise::wrap(done));
+	}
+	virtual void getMetrics(std::vector<FDBPerfMetric>& out) const override {
+		return WITH(this->workload, getMetrics, metrics::wrap(&out));
+	}
+	virtual double getCheckTimeout() override {
+		return WITH(this->workload, getCheckTimeout);
+	}
+};
+} // namespace translator
+
+class CppWorkloadFactory: public FDBWorkloadFactory {
+public:
+	CppWorkloadFactory(FDBLogger* logger): FDBWorkloadFactory() {
+		logger->trace(FDBSeverity::Info, "CppWorkloadFactory", {});
+	}
+
+	virtual std::shared_ptr<FDBWorkload> create(const std::string& name) {
+		return std::make_shared<translator::Workload>(name);
+	}
+};
+
+extern "C" FDBWorkloadFactory* workloadCppFactory(FDBLogger* logger) {
+	return new CppWorkloadFactory(logger);
+}
diff --git a/bindings/rust/foundationdb-simulation/src/bindings.rs b/bindings/rust/foundationdb-simulation/src/bindings.rs
new file mode 100644
index 00000000000..785baea0099
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/src/bindings.rs
@@ -0,0 +1,510 @@
+//! Wrapper module
+//!
+//! This module defines all C and Rust structures.
+//! It also provides bindings and wrappers to map behavior from Rust to C.
+
+use std::{
+    ffi::{self, c_char},
+    str::FromStr,
+    time::Duration,
+};
+
+use foundationdb as fdb;
+
+mod raw_bindings {
+    #![allow(non_camel_case_types)]
+    #![allow(non_upper_case_globals)]
+    #![allow(non_snake_case)]
+    #![allow(dead_code)]
+    #![allow(missing_docs)]
+    include!(concat!(env!("OUT_DIR"), "/bindings.rs"));
+}
+pub use raw_bindings::{
+    FDBDatabase, FDBMetrics, FDBPromise, FDBWorkload, FDBWorkloadContext, OpaqueWorkload,
+};
+use raw_bindings::{
+    FDBMetric, FDBSeverity, FDBSeverity_FDBSeverity_Debug, FDBSeverity_FDBSeverity_Error,
+    FDBSeverity_FDBSeverity_Info, FDBSeverity_FDBSeverity_Warn, FDBSeverity_FDBSeverity_WarnAlways,
+    FDBStringPair,
+};
+
+pub use raw_bindings::FDBWorkload_FDBWorkload_VT as FDBWorkload_VT;
+pub const FDB_WORKLOAD_API_VERSION: i32 = raw_bindings::FDB_WORKLOAD_API_VERSION as i32;
+
+// -----------------------------------------------------------------------------
+// String conversions
+
+#[doc(hidden)]
+#[allow(clippy::not_unsafe_ptr_arg_deref)]
+pub fn str_from_c(c_buf: *const c_char) -> String {
+    let c_str = unsafe { ffi::CStr::from_ptr(c_buf) };
+    c_str.to_str().unwrap().to_string()
+}
+#[doc(hidden)]
+pub fn str_for_c<T>(buf: T) -> ffi::CString
+where
+    T: Into<Vec<u8>>,
+{
+    let mut buf = buf.into();
+    if buf.contains(&0) {
+        let mut escaped = Vec::with_capacity(buf.len());
+        for byte in buf {
+            if byte == 0 {
+                escaped.extend_from_slice(br"\0");
+            } else {
+                escaped.push(byte);
+            }
+        }
+        buf = escaped;
+    }
+
+    // SAFETY: Every interior NUL byte was escaped above.
+    unsafe { ffi::CString::from_vec_unchecked(buf) }
+}
+
+/// Capitalizes the first letter of a string.
+/// Used to ensure trace detail names start with a capital letter.
+/// Returns `None` if the string is empty.
+fn capitalize_first(s: &str) -> Option<String> {
+    let mut chars = s.chars();
+    chars
+        .next()
+        .map(|first| first.to_uppercase().collect::<String>() + chars.as_str())
+}
+
+/// ASCII-uppercases the first byte of a trace event name, matching FDB's convention that
+/// event types start with a capital letter. Leaves an empty name unchanged.
+fn capitalize_first_byte(mut name: Vec<u8>) -> Vec<u8> {
+    if let Some(first) = name.first_mut() {
+        first.make_ascii_uppercase();
+    }
+    name
+}
+
+/// Macro that can be used to create log "details" more easily.
+#[macro_export]
+macro_rules! details {
+    ($($k:expr_2021 => $v:expr_2021),* $(,)?) => {
+        &[
+            $((
+                &$k.to_string(), &$v.to_string()
+            )),*
+        ]
+    };
+}
+
+// -----------------------------------------------------------------------------
+// Rust Types
+
+/// Wrapper around the C FDBWorkloadContext
+pub struct WorkloadContext(FDBWorkloadContext);
+/// Wrapper around the C FDBPromise
+pub struct Promise(FDBPromise);
+/// Wrapper around the C FDBMetrics
+pub struct Metrics(FDBMetrics);
+
+/// A single metric entry
+#[derive(Clone)]
+pub struct Metric<'a> {
+    /// The name of the metric
+    pub key: &'a str,
+    /// The value of the metric
+    pub val: f64,
+    /// Indicates if the value represents an average or not
+    pub avg: bool,
+    /// C++ string formatter of the metric
+    pub fmt: Option<&'a str>,
+}
+
+/// Indicates the severity of a FoundationDB log entry
+#[derive(Clone, Copy)]
+#[repr(u32)]
+pub enum Severity {
+    /// debug
+    Debug = FDBSeverity_FDBSeverity_Debug,
+    /// info
+    Info = FDBSeverity_FDBSeverity_Info,
+    /// warn
+    Warn = FDBSeverity_FDBSeverity_Warn,
+    /// warn always
+    WarnAlways = FDBSeverity_FDBSeverity_WarnAlways,
+    /// error, this severity automatically breaks execution. `WorkloadContext::trace` also
+    /// appends a `RustFailure="1"` detail on top of the `RustWorkload="1"` detail added to
+    /// every event, so trace consumers can tell a Rust workload failure apart from an
+    /// FDB-internal Sev40 event.
+    Error = FDBSeverity_FDBSeverity_Error,
+}
+
+// -----------------------------------------------------------------------------
+// Implementations
+
+macro_rules! with {
+    ($this:expr_2021=>$method:ident($($args:expr_2021),* $(,)?)) => {
+        unsafe { (*$this.vt).$method.unwrap_unchecked()($this.inner $(, $args)*) }
+    };
+}
+
+impl Clone for WorkloadContext {
+    /// Clones the wrapper by copying the underlying `FDBWorkloadContext` POD (a
+    /// bundle of raw pointers owned by fdbserver, with no `Drop`). The clone
+    /// aliases the same fdbserver-owned context, so it is only valid for the
+    /// lifetime of the workload instance the original was handed to; once
+    /// fdbserver frees that context, every clone dangles.
+    fn clone(&self) -> Self {
+        Self(self.0)
+    }
+}
+
+/// Detail key automatically appended to `Severity::Error` trace events.
+const RUST_FAILURE_KEY: &str = "RustFailure";
+/// Detail key automatically appended to every trace event, regardless of severity.
+const RUST_WORKLOAD_KEY: &str = "RustWorkload";
+
+/// Appends a `key="1"` detail to `details_storage` unless a detail with that key (already
+/// capitalized) is present.
+fn push_marker_if_absent(details_storage: &mut Vec<(ffi::CString, ffi::CString)>, key: &str) {
+    if !details_storage
+        .iter()
+        .any(|(k, _)| k.as_bytes() == key.as_bytes())
+    {
+        details_storage.push((str_for_c(key), str_for_c("1")));
+    }
+}
+
+/// Builds the trace detail storage for [`WorkloadContext::trace`].
+///
+/// Applies `capitalize_first` to every caller-supplied key (dropping empty values), then
+/// appends a `RustWorkload="1"` detail to every event and, for [`Severity::Error`], a
+/// `RustFailure="1"` detail as well, unless the caller already supplied one under that key.
+fn prepare_trace_details<S2, S3>(
+    severity: Severity,
+    details: &[(S2, S3)],
+) -> Vec<(ffi::CString, ffi::CString)>
+where
+    S2: AsRef<str>,
+    S3: AsRef<str>,
+{
+    let mut details_storage = details
+        .iter()
+        .filter_map(|(key, val)| {
+            let val = val.as_ref();
+            if val.is_empty() {
+                return None;
+            }
+            capitalize_first(key.as_ref()).map(|k| (str_for_c(k), str_for_c(val)))
+        })
+        .collect::<Vec<_>>();
+    push_marker_if_absent(&mut details_storage, RUST_WORKLOAD_KEY);
+    if matches!(severity, Severity::Error) {
+        push_marker_if_absent(&mut details_storage, RUST_FAILURE_KEY);
+    }
+    details_storage
+}
+
+impl WorkloadContext {
+    #[doc(hidden)]
+    pub fn new(raw: FDBWorkloadContext) -> Self {
+        Self(raw)
+    }
+
+    /// Get the server FDB_WORKLOAD_API_VERSION
+    pub fn get_workload_api_version(&self) -> i32 {
+        self.0.api_version
+    }
+
+    /// Add a log entry in the FoundationDB logs.
+    ///
+    /// The event `name`'s first byte is uppercased automatically, matching FDB's convention
+    /// for event types. A `RustWorkload="1"` detail is appended to every event (unless the
+    /// caller already provided one), so trace consumers can grep all Rust-origin trace lines
+    /// with a single token. When `severity` is [`Severity::Error`], a `RustFailure="1"` detail
+    /// is appended too (same rule), so a Rust-detected failure can be told apart from an
+    /// FDB-internal Sev40 event.
+    pub fn trace<S, S2, S3>(&self, severity: Severity, name: S, details: &[(S2, S3)])
+    where
+        S: Into<Vec<u8>>,
+        S2: AsRef<str>,
+        S3: AsRef<str>,
+    {
+        let name = str_for_c(capitalize_first_byte(name.into()));
+        let details_storage = prepare_trace_details(severity, details);
+        let details = details_storage
+            .iter()
+            .map(|(key, val)| FDBStringPair {
+                key: key.as_ptr(),
+                val: val.as_ptr(),
+            })
+            .collect::<Vec<_>>();
+        with! {
+            self.0 => trace(
+                severity as FDBSeverity,
+                name.as_ptr(),
+                details.as_ptr(),
+                details.len() as i32,
+            )
+        }
+    }
+    /// Get the process id of the workload
+    pub fn get_process_id(&self) -> u64 {
+        with! { self.0 => getProcessID() }
+    }
+    /// Set the process id of the workload
+    pub fn set_process_id(&self, id: u64) {
+        with! { self.0 => setProcessID(id) }
+    }
+    /// Get the current simulated time in seconds (starts at zero)
+    pub fn now(&self) -> f64 {
+        with! { self.0 => now() }
+    }
+    /// Get a determinist 32-bit random number
+    pub fn rnd(&self) -> u32 {
+        with! { self.0 => rnd() }
+    }
+    /// Get the value of a parameter from the simulation config file
+    ///
+    /// /!\ getting an option consumes it, following call on that option will return `None`
+    pub fn get_option<T>(&self, name: &str) -> Option<T>
+    where
+        T: FromStr,
+    {
+        self.get_option_raw(name)
+            .and_then(|value| value.parse::<T>().ok())
+    }
+    fn get_option_raw(&self, name: &str) -> Option<String> {
+        let null = "";
+        let name = str_for_c(name);
+        let default_value = str_for_c(null);
+        let raw_value = with! {
+            self.0 => getOption(name.as_ptr(), default_value.as_ptr())
+        };
+        let value = str_from_c(raw_value.inner);
+        with! { raw_value => free() };
+        if value == null { None } else { Some(value) }
+    }
+    /// Get the client id of the workload
+    pub fn client_id(&self) -> i32 {
+        with! { self.0 => clientId() }
+    }
+    /// Get the client id of the workload
+    pub fn client_count(&self) -> i32 {
+        with! { self.0 => clientCount() }
+    }
+    /// Get a determinist 64-bit random number
+    pub fn shared_random_number(&self) -> i64 {
+        with! { self.0 => sharedRandomNumber() }
+    }
+    /// Return a future that will be ready after a given (simulated) duration
+    pub fn delay(
+        &self,
+        duration: Duration,
+    ) -> impl std::future::Future<Output = fdb::FdbResult<()>> + Send + Sync + 'static + use<> {
+        let f = with! { self.0 => delay(duration.as_secs_f64()) };
+        fdb::future::FdbFuture::new(f as *mut _)
+    }
+}
+
+impl Promise {
+    pub(crate) fn new(raw: FDBPromise) -> Self {
+        Self(raw)
+    }
+    /// Resolve a FoundationDB promise by setting its value to a boolean.
+    /// You can resolve a Promise only once.
+    ///
+    /// note: FoundationDB disregards the value sent, so sending `true` or `false` is equivalent
+    pub fn send(self, value: bool) {
+        with! { self.0 => send(value) };
+    }
+}
+impl Drop for Promise {
+    fn drop(&mut self) {
+        with! { self.0 => free() };
+    }
+}
+
+impl Metrics {
+    pub(crate) fn new(raw: FDBMetrics) -> Self {
+        Self(raw)
+    }
+    /// Call std::vector::reserve on the underlying C++ sink
+    pub fn reserve(&mut self, n: usize) {
+        with! { self.0 => reserve(n as i32) }
+    }
+    /// Push a [Metric] entry in the underlying C++ sink
+    pub fn push(&mut self, metric: Metric) {
+        let key_storage = str_for_c(metric.key);
+        let fmt_storage = str_for_c(metric.fmt.unwrap_or("%.3g"));
+        with! {
+            self.0 => push(FDBMetric {
+                key: key_storage.as_ptr(),
+                fmt: fmt_storage.as_ptr(),
+                val: metric.val,
+                avg: metric.avg,
+            })
+        }
+    }
+    /// Push several [Metric] entries in the underlying C++ sink
+    pub fn extend<'a, T>(&mut self, metrics: T)
+    where
+        T: IntoIterator<Item = Metric<'a>>,
+    {
+        let metrics = metrics.into_iter();
+        let (min, max) = metrics.size_hint();
+        self.reserve(max.unwrap_or(min));
+        for metric in metrics {
+            self.push(metric);
+        }
+    }
+}
+
+impl<'a> Metric<'a> {
+    /// Create a metric value entry
+    pub fn val<V>(key: &'a str, val: V) -> Self
+    where
+        V: TryInto<f64>,
+    {
+        Self {
+            key,
+            val: val.try_into().ok().expect("convertion failed"),
+            avg: false,
+            fmt: None,
+        }
+    }
+    /// Create a metric average entry
+    pub fn avg<V>(key: &'a str, val: V) -> Self
+    where
+        V: TryInto<f64>,
+    {
+        Self {
+            key,
+            val: val.try_into().ok().expect("convertion failed"),
+            avg: true,
+            fmt: None,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Severity, capitalize_first_byte, prepare_trace_details, str_for_c};
+
+    #[test]
+    fn str_for_c_escapes_interior_nul() {
+        assert_eq!(str_for_c("a\0b").to_bytes(), br"a\0b");
+    }
+
+    #[test]
+    fn error_severity_gets_rust_failure_marker() {
+        let details: &[(&str, &str)] = &[("Reason", "boom")];
+        let result = prepare_trace_details(Severity::Error, details);
+        assert!(
+            result
+                .iter()
+                .any(|(k, v)| k.as_bytes() == b"RustFailure" && v.as_bytes() == b"1")
+        );
+    }
+
+    #[test]
+    fn non_error_severity_has_no_rust_failure_marker() {
+        let details: &[(&str, &str)] = &[("Reason", "boom")];
+        let result = prepare_trace_details(Severity::Warn, details);
+        assert!(!result.iter().any(|(k, _)| k.as_bytes() == b"RustFailure"));
+    }
+
+    #[test]
+    fn caller_lowercase_rust_failure_key_is_not_duplicated() {
+        let details: &[(&str, &str)] = &[("rustFailure", "custom")];
+        let result = prepare_trace_details(Severity::Error, details);
+        let matching: Vec<_> = result
+            .iter()
+            .filter(|(k, _)| k.as_bytes() == b"RustFailure")
+            .collect();
+        assert_eq!(matching.len(), 1);
+        assert_eq!(matching[0].1.as_bytes(), b"custom");
+    }
+
+    #[test]
+    fn caller_capitalized_rust_failure_key_is_not_duplicated() {
+        let details: &[(&str, &str)] = &[("RustFailure", "custom")];
+        let result = prepare_trace_details(Severity::Error, details);
+        let matching: Vec<_> = result
+            .iter()
+            .filter(|(k, _)| k.as_bytes() == b"RustFailure")
+            .collect();
+        assert_eq!(matching.len(), 1);
+        assert_eq!(matching[0].1.as_bytes(), b"custom");
+    }
+
+    #[test]
+    fn every_severity_gets_rust_workload_marker() {
+        let details: &[(&str, &str)] = &[];
+        for severity in [
+            Severity::Debug,
+            Severity::Info,
+            Severity::Warn,
+            Severity::WarnAlways,
+            Severity::Error,
+        ] {
+            let result = prepare_trace_details(severity, details);
+            assert!(
+                result
+                    .iter()
+                    .any(|(k, v)| k.as_bytes() == b"RustWorkload" && v.as_bytes() == b"1")
+            );
+        }
+    }
+
+    #[test]
+    fn error_severity_gets_both_markers() {
+        let details: &[(&str, &str)] = &[];
+        let result = prepare_trace_details(Severity::Error, details);
+        assert!(
+            result
+                .iter()
+                .any(|(k, v)| k.as_bytes() == b"RustWorkload" && v.as_bytes() == b"1")
+        );
+        assert!(
+            result
+                .iter()
+                .any(|(k, v)| k.as_bytes() == b"RustFailure" && v.as_bytes() == b"1")
+        );
+    }
+
+    #[test]
+    fn caller_lowercase_rust_workload_key_is_not_duplicated() {
+        let details: &[(&str, &str)] = &[("rustWorkload", "custom")];
+        let result = prepare_trace_details(Severity::Info, details);
+        let matching: Vec<_> = result
+            .iter()
+            .filter(|(k, _)| k.as_bytes() == b"RustWorkload")
+            .collect();
+        assert_eq!(matching.len(), 1);
+        assert_eq!(matching[0].1.as_bytes(), b"custom");
+    }
+
+    #[test]
+    fn caller_capitalized_rust_workload_key_is_not_duplicated() {
+        let details: &[(&str, &str)] = &[("RustWorkload", "custom")];
+        let result = prepare_trace_details(Severity::Info, details);
+        let matching: Vec<_> = result
+            .iter()
+            .filter(|(k, _)| k.as_bytes() == b"RustWorkload")
+            .collect();
+        assert_eq!(matching.len(), 1);
+        assert_eq!(matching[0].1.as_bytes(), b"custom");
+    }
+
+    #[test]
+    fn capitalize_first_byte_uppercases_lowercase_first_byte() {
+        assert_eq!(capitalize_first_byte(b"event".to_vec()), b"Event".to_vec());
+    }
+
+    #[test]
+    fn capitalize_first_byte_leaves_already_capitalized_name_unchanged() {
+        assert_eq!(capitalize_first_byte(b"Event".to_vec()), b"Event".to_vec());
+    }
+
+    #[test]
+    fn capitalize_first_byte_leaves_empty_name_unchanged() {
+        assert_eq!(capitalize_first_byte(Vec::new()), Vec::new());
+    }
+}
diff --git a/bindings/rust/foundationdb-simulation/src/env.rs b/bindings/rust/foundationdb-simulation/src/env.rs
new file mode 100644
index 00000000000..9f5d448432c
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/src/env.rs
@@ -0,0 +1,172 @@
+//! Simulator-backed implementations of the [`foundationdb::env`] capabilities.
+//!
+//! A workload that reads the machine clock or draws from an ambient generator
+//! stops being reproducible, which defeats the point of running it in the
+//! simulator. [`SimClock`] and [`SimRng`] plug the simulated time and the
+//! deterministic generator of fdbserver into the [`Clock`] and [`Rng`] traits, so
+//! layer code written against an [`Environment`] replays identically from a
+//! seed.
+//!
+//! Build one from the [`WorkloadContext`] handed to your workload:
+//!
+//! ```ignore
+//! impl RustWorkload for MyWorkload {
+//!     fn new(name: String, context: WorkloadContext) -> Self {
+//!         Self {
+//!             env: context.environment(),
+//!             context,
+//!         }
+//!     }
+//! }
+//! ```
+//!
+//! # Lifetime
+//!
+//! Every type here holds a copy of the fdbserver-owned context, with the same
+//! caveat as [`WorkloadContext::clone`]: the copy aliases a context that
+//! fdbserver frees with the workload instance. Keep a [`SimClock`], a
+//! [`SimRng`], or an [`Environment`] holding them no longer than the workload
+//! that produced it. Using one afterwards dereferences a dangling pointer.
+
+use std::fmt;
+use std::sync::Arc;
+use std::time::Duration;
+
+use foundationdb::env::{Clock, Environment, Rng};
+
+use crate::bindings::WorkloadContext;
+
+/// A copy of the fdbserver-owned workload context.
+///
+/// The wrapped [`WorkloadContext`] is a bundle of raw pointers with no `Drop`,
+/// so copying it is free and dropping it does nothing. See the
+/// [module documentation](self) for how long the copy stays valid.
+struct ContextHandle(WorkloadContext);
+
+impl ContextHandle {
+    fn new(context: &WorkloadContext) -> Self {
+        Self(context.clone())
+    }
+}
+
+/// The [`Clock`] of a simulated workload, reading fdbserver's simulated time.
+///
+/// [`monotonic`](Clock::monotonic) is the simulated clock, which starts at zero
+/// and only moves when the simulator decides to advance it, so a run replays
+/// identically. [`wall`](Clock::wall) is that same reading: simulated wall time
+/// counts from the UNIX epoch at simulation start, second zero being the epoch.
+///
+/// Simulated wall time is therefore deterministic and, unlike a real machine
+/// clock, never jumps: a workload cannot exercise clock-skew handling this way.
+///
+/// See the [module documentation](self) for how long an instance stays valid.
+pub struct SimClock {
+    context: ContextHandle,
+}
+
+// SAFETY: the wrapped context is a bundle of raw pointers into fdbserver, which
+// drives every workload callback on a single thread, so the context is never
+// accessed concurrently. This is the same justification as the rest of the
+// crate's use of the raw context, see `Clone for WorkloadContext`.
+unsafe impl Send for SimClock {}
+// SAFETY: see the `Send` impl above.
+unsafe impl Sync for SimClock {}
+
+impl SimClock {
+    /// Reads simulated time from `context`.
+    pub fn new(context: &WorkloadContext) -> Self {
+        Self {
+            context: ContextHandle::new(context),
+        }
+    }
+}
+
+impl fmt::Debug for SimClock {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("SimClock")
+    }
+}
+
+impl Clock for SimClock {
+    fn monotonic(&self) -> Duration {
+        // The simulated clock starts at zero and never goes backwards, but it is
+        // an f64 crossing the FFI boundary: clamp rather than panic.
+        Duration::from_secs_f64(self.context.0.now().max(0.0))
+    }
+
+    /// Simulated wall time counts from the UNIX epoch at simulation start, so
+    /// second zero is the epoch itself: only differences and orderings carry
+    /// meaning. It never jumps, so clock-skew handling cannot be exercised here.
+    fn wall(&self) -> Duration {
+        self.monotonic()
+    }
+}
+
+/// The [`Rng`] of a simulated workload, drawing from fdbserver's deterministic
+/// generator.
+///
+/// Every draw advances the simulator's own generator, so the values are part of
+/// the run's reproducible state: the same seed replays the same sequence, and
+/// drawing more or fewer values than a previous run changes what every later
+/// consumer sees.
+///
+/// A component that needs a large volume of randomness should draw one value
+/// here and seed a local generator with it, the pattern described in
+/// [`foundationdb::env`]. That keeps the simulator's sequence short and stable.
+///
+/// See the [module documentation](self) for how long an instance stays valid.
+pub struct SimRng {
+    context: ContextHandle,
+}
+
+// SAFETY: the wrapped context is a bundle of raw pointers into fdbserver, which
+// drives every workload callback on a single thread, so the context is never
+// accessed concurrently. This is the same justification as the rest of the
+// crate's use of the raw context, see `Clone for WorkloadContext`.
+unsafe impl Send for SimRng {}
+// SAFETY: see the `Send` impl above.
+unsafe impl Sync for SimRng {}
+
+impl SimRng {
+    /// Draws from the deterministic generator of `context`.
+    pub fn new(context: &WorkloadContext) -> Self {
+        Self {
+            context: ContextHandle::new(context),
+        }
+    }
+}
+
+impl fmt::Debug for SimRng {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("SimRng")
+    }
+}
+
+impl Rng for SimRng {
+    /// Composes two 32-bit draws, so one call consumes two values of the
+    /// simulator's sequence.
+    fn next_u64(&self) -> u64 {
+        let high = self.context.0.rnd();
+        let low = self.context.0.rnd();
+        (u64::from(high) << 32) | u64::from(low)
+    }
+
+    /// One draw of the simulator's sequence, taken directly from the generator.
+    fn next_u32(&self) -> u32 {
+        self.context.0.rnd()
+    }
+}
+
+impl WorkloadContext {
+    /// The deterministic [`Environment`] of this workload: simulated time and
+    /// the simulator's generator.
+    ///
+    /// Pass it to the layers and recipes the workload exercises so that they
+    /// read time and randomness from the simulator instead of from the machine.
+    ///
+    /// The result borrows nothing, but it holds a copy of this context: see the
+    /// [module documentation](self) for how long it stays valid.
+    pub fn environment(&self) -> Environment {
+        Environment::new(Arc::new(SimClock::new(self)), Arc::new(SimRng::new(self)))
+    }
+}
diff --git a/bindings/rust/foundationdb-simulation/src/fdb_rt.rs b/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
new file mode 100644
index 00000000000..8e90a4ed5fd
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
@@ -0,0 +1,85 @@
+//! Asynchronous runtime module
+//!
+//! This module defines the `fdb_spawn` method to run to completion asynchronous tasks containing
+//! FoundationDB futures
+
+#![doc = include_str!("../docs/fdb_rt.md")]
+
+use std::{
+    cell::{RefCell, UnsafeCell},
+    future::Future,
+    mem,
+    pin::Pin,
+    sync::Arc,
+    task::{Context, RawWaker, RawWakerVTable, Waker},
+};
+
+thread_local! {
+    static TASKS: RefCell<Vec<Arc<Task>>> = const { RefCell::new(Vec::new()) };
+}
+
+struct Task {
+    f: UnsafeCell<Option<Pin<Box<dyn Future<Output = ()>>>>>,
+}
+
+impl Task {
+    const VTABLE: RawWakerVTable =
+        RawWakerVTable::new(Self::clone, Self::wake, Self::wake_by_ref, Self::drop);
+
+    fn poll(self: Arc<Self>) {
+        let waker = unsafe { Waker::from_raw(self.clone().into_waker()) };
+        let cx = &mut Context::from_waker(&waker);
+        let slot = unsafe { &mut *self.f.get() };
+        if let Some(mut f) = slot.take() {
+            if f.as_mut().poll(cx).is_pending() {
+                *slot = Some(f);
+            }
+        }
+    }
+
+    fn from_ptr(ptr: *const ()) -> Arc<Self> {
+        unsafe { Arc::from_raw(&*(ptr as *const Self)) }
+    }
+    fn into_waker(self: Arc<Self>) -> RawWaker {
+        RawWaker::new(Arc::into_raw(self) as *const (), &Self::VTABLE)
+    }
+
+    fn clone(ptr: *const ()) -> RawWaker {
+        let task = Self::from_ptr(ptr);
+        mem::forget(task.clone());
+        task.into_waker()
+    }
+    fn wake(ptr: *const ()) {
+        let task = Self::from_ptr(ptr);
+        TASKS.with_borrow_mut(|tasks| tasks.push(task))
+    }
+    fn wake_by_ref(ptr: *const ()) {
+        let task = Self::from_ptr(ptr);
+        TASKS.with_borrow_mut(|tasks| tasks.push(task.clone()));
+        mem::forget(task);
+    }
+    fn drop(ptr: *const ()) {
+        drop(Self::from_ptr(ptr))
+    }
+}
+
+/// Poll all tasks in the pending queue
+pub fn poll_pending_tasks() {
+    let mut tasks = TASKS.with_borrow_mut(mem::take);
+    tasks.drain(..).for_each(Task::poll);
+}
+
+/// Spawn an async block and resolve all contained FoundationDB futures
+pub(crate) fn fdb_spawn<F>(future: F)
+where
+    F: Future<Output = ()> + 'static,
+{
+    // The simulation executor is single-threaded, but `Waker` requires the task
+    // pointer to be usable as `Send + Sync`, so we use `Arc` (not `Rc`) to uphold the
+    // `RawWaker` safety contract even though `Task` is neither `Send` nor `Sync`.
+    #[allow(clippy::arc_with_non_send_sync)]
+    let task = Arc::new(Task {
+        f: UnsafeCell::new(Some(Box::pin(future))),
+    });
+    task.poll();
+}
diff --git a/bindings/rust/foundationdb-simulation/src/headers/CWorkload.h b/bindings/rust/foundationdb-simulation/src/headers/CWorkload.h
new file mode 100644
index 00000000000..76e8574ab28
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/src/headers/CWorkload.h
@@ -0,0 +1,160 @@
+/*
+ * CWorkload.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2026 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+#ifndef C_WORKLOAD_H
+#define C_WORKLOAD_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#define FDB_WORKLOAD_API_VERSION 1
+
+typedef struct FDB_future FDBFuture;
+typedef struct FDB_database FDBDatabase;
+
+typedef struct Opaque_promise OpaquePromise;
+typedef struct Opaque_workload OpaqueWorkload;
+typedef struct Opaque_workloadContext OpaqueWorkloadContext;
+typedef struct Opaque_metrics OpaqueMetrics;
+
+// Pure C bindings, equivalent to the C++ bindings in `CppWorkload.h`
+// documented here: https://apple.github.io/foundationdb/client-testing.html.
+
+// API changes may add pointers at the end of the virtual tables (_VT)
+// It is advised to never dereference or copy these structures, only using them through a pointer.
+
+// Log severity levels.
+// FDBSeverity_Error automatically stops the simulation.
+typedef enum FDBSeverity {
+	FDBSeverity_Debug,
+	FDBSeverity_Info,
+	FDBSeverity_Warn,
+	FDBSeverity_WarnAlways,
+	FDBSeverity_Error,
+} FDBSeverity;
+
+// Key-value pair for logging additional details.
+typedef struct FDBStringPair {
+	const char* key;
+	const char* val;
+} FDBStringPair;
+
+// Metric entry for simulation statistics.
+// Values are either averaged or summed across clients based on the `avg` flag.
+// `fmt` is used to format the value, defaults to "%.3g" if null.
+typedef struct FDBMetric {
+	const char* key;
+	const char* fmt;
+	double val;
+	bool avg;
+} FDBMetric;
+
+// Wrapper around an owned C++ `string`.
+// The `free` function must be called on `inner` before releasing the string.
+typedef struct FDBString {
+	const char* inner;
+	struct FDBString_VT {
+		void (*free)(const char* inner);
+	}* vt;
+} FDBString;
+
+// Wrapper around a borrowed C++ `vector<FDBMetric>`.
+typedef struct FDBMetrics {
+	OpaqueMetrics* inner;
+	struct FDBMetrics_VT {
+		void (*reserve)(OpaqueMetrics* inner, int n);
+		void (*push)(OpaqueMetrics* inner, FDBMetric val);
+	}* vt;
+} FDBMetrics;
+
+// Wrapper around an owned C++ `GenericPromise<bool>`.
+// Calling `send` resolves the promise (the value is meaningless).
+// Calling `free` before resolving the promise triggers a "broken promise" error.
+typedef struct FDBPromise {
+	OpaquePromise* inner;
+	struct FDBPromise_VT {
+		void (*free)(OpaquePromise* inner);
+		void (*send)(OpaquePromise* inner, bool val);
+	}* vt;
+} FDBPromise;
+
+// Wrapper around a borrowed `ExternalWorkload`'s context.
+// All pointer-based arguments are borrowed and managed by the workload.
+typedef struct FDBWorkloadContext {
+	int api_version;
+	OpaqueWorkloadContext* inner;
+	struct FDBWorkloadContext_VT {
+		// Log a message with severity and optional details.
+		// `details` is an array of key-value pairs, and `n` specifies the array size.
+		void (*trace)(OpaqueWorkloadContext* inner,
+		              FDBSeverity sev,
+		              const char* name,
+		              const FDBStringPair* details,
+		              int n);
+		uint64_t (*getProcessID)(OpaqueWorkloadContext* inner);
+		void (*setProcessID)(OpaqueWorkloadContext* inner, uint64_t processID);
+		// Return the current simulated time in seconds (starts at zero).
+		double (*now)(OpaqueWorkloadContext* inner);
+		// Return a random number (different each time and for all clients).
+		uint32_t (*rnd)(OpaqueWorkloadContext* inner);
+		// Return an option by name, returning `defaultValue` if the option is not found.
+		// Return an option, consumming it, querying it again returns the empty string.
+		FDBString (*getOption)(OpaqueWorkloadContext* inner, const char* name, const char* defaultValue);
+		int (*clientId)(OpaqueWorkloadContext* inner);
+		int (*clientCount)(OpaqueWorkloadContext* inner);
+		// Return a random seed (same each time and for all clients).
+		int64_t (*sharedRandomNumber)(OpaqueWorkloadContext* inner);
+		// Return a future that will be ready after a given time. This internally uses TaskPriority::DefaultDelay.
+		FDBFuture* (*delay)(OpaqueWorkloadContext* inner, double seconds);
+	}* vt;
+} FDBWorkloadContext;
+
+// Interface for a workload implementation in C.
+//
+// Simulation stages (setup, start, and check) are executed sequentially.
+// A stage finishes when its associated promise is resolved. If a promise
+// is not resolved or freed, the simulation hangs.
+//
+// Workload functions should not block. If an operation must wait for database interaction,
+// it should initiate the action, register a callback, and return.
+typedef struct FDBWorkload {
+	int api_version;
+	OpaqueWorkload* inner;
+	struct FDBWorkload_VT {
+		void (*free)(OpaqueWorkload* inner);
+		void (*setup)(OpaqueWorkload* inner, FDBDatabase* db, FDBPromise done);
+		void (*start)(OpaqueWorkload* inner, FDBDatabase* db, FDBPromise done);
+		void (*check)(OpaqueWorkload* inner, FDBDatabase* db, FDBPromise done);
+		void (*getMetrics)(OpaqueWorkload* inner, FDBMetrics out);
+		// The timeout in simulated seconds for the check stage
+		double (*getCheckTimeout)(OpaqueWorkload* inner);
+	}* vt;
+} FDBWorkload;
+
+// The C workload entrypoint.
+// This function must return a valid instance of the `FDBWorkload` struct.
+// A specific implementation can be chosen based on the name passed.
+// The client C workload must be allocated, initialized and passed as pointer
+// in `inner`. It is advised to store the context alongside the workload as
+// it can't be retrieved later. No function pointer can be left null.
+FDBWorkload workloadCFactory(const char* name, FDBWorkloadContext context);
+
+#endif
diff --git a/bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h b/bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h
new file mode 100644
index 00000000000..4b50edc54aa
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h
@@ -0,0 +1,110 @@
+/*
+ * CppWorkload.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2024 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+#ifndef CPP_WORKLOAD_H
+#define CPP_WORKLOAD_H
+#include <string>
+#include <vector>
+#include <functional>
+#include <memory>
+
+#ifndef DLLEXPORT
+#if defined(_MSC_VER)
+#define DLLEXPORT __declspec(dllexport)
+#elif defined(__GNUG__)
+#define DLLEXPORT __attribute__((visibility("default")))
+#else
+#error Missing symbol export
+#endif
+#endif
+
+typedef struct FDB_future FDBFuture;
+typedef struct FDB_result FDBResult;
+typedef struct FDB_database FDBDatabase;
+typedef struct FDB_transaction FDBTransaction;
+
+enum class FDBSeverity { Debug, Info, Warn, WarnAlways, Error };
+
+class FDBLogger {
+public:
+	virtual void trace(FDBSeverity sev,
+	                   const std::string& name,
+	                   const std::vector<std::pair<std::string, std::string>>& details) = 0;
+};
+
+class FDBWorkloadContext : public FDBLogger {
+public:
+	virtual uint64_t getProcessID() const = 0;
+	virtual void setProcessID(uint64_t processID) = 0;
+	virtual double now() const = 0;
+	virtual uint32_t rnd() const = 0;
+	virtual bool getOption(const std::string& name, bool defaultValue) = 0;
+	virtual long getOption(const std::string& name, long defaultValue) = 0;
+	virtual unsigned long getOption(const std::string& name, unsigned long defaultValue) = 0;
+	virtual double getOption(const std::string& name, double defaultValue) = 0;
+	virtual std::string getOption(const std::string& name, std::string defaultValue) = 0;
+	virtual int clientId() const = 0;
+	virtual int clientCount() const = 0;
+	virtual int64_t sharedRandomNumber() const = 0;
+	virtual FDBFuture* delay(double seconds) const = 0;
+};
+
+struct FDBPromise {
+	virtual ~FDBPromise() = default;
+	virtual void send(void*) = 0;
+};
+
+template <class T>
+class GenericPromise {
+	std::shared_ptr<FDBPromise> impl;
+
+public:
+	template <class Ptr>
+	explicit GenericPromise(Ptr&& impl) : impl(std::forward<Ptr>(impl)) {}
+	void send(T val) { impl->send(&val); }
+};
+
+struct FDBPerfMetric {
+	std::string name;
+	double value;
+	bool averaged;
+	std::string format_code = "%.3g";
+};
+
+class DLLEXPORT FDBWorkload {
+public:
+#if FDB_API_VERSION <= 730
+	virtual std::string description() const = 0;
+#endif
+	virtual bool init(FDBWorkloadContext* context) = 0;
+	virtual void setup(FDBDatabase* db, GenericPromise<bool> done) = 0;
+	virtual void start(FDBDatabase* db, GenericPromise<bool> done) = 0;
+	virtual void check(FDBDatabase* db, GenericPromise<bool> done) = 0;
+	virtual void getMetrics(std::vector<FDBPerfMetric>& out) const = 0;
+	virtual double getCheckTimeout() { return 3000; }
+};
+
+class DLLEXPORT FDBWorkloadFactory {
+public:
+	virtual std::shared_ptr<FDBWorkload> create(const std::string& name) = 0;
+};
+
+#endif
diff --git a/bindings/rust/foundationdb-simulation/src/lib.rs b/bindings/rust/foundationdb-simulation/src/lib.rs
new file mode 100644
index 00000000000..1c5e1c74fc7
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/src/lib.rs
@@ -0,0 +1,314 @@
+#![warn(missing_docs)]
+#![doc = include_str!("../README.md")]
+
+use std::{ptr::NonNull, sync::Arc};
+
+use foundationdb::Database;
+use foundationdb_sys::FDBDatabase as FDBDatabaseAlias;
+
+mod bindings;
+pub mod env;
+mod fdb_rt;
+
+use bindings::{
+    FDB_WORKLOAD_API_VERSION, FDBDatabase, FDBMetrics, FDBPromise, FDBWorkload, FDBWorkload_VT,
+    OpaqueWorkload, Promise,
+};
+pub use bindings::{Metric, Metrics, Severity, WorkloadContext};
+pub use env::{SimClock, SimRng};
+use fdb_rt::fdb_spawn;
+
+// -----------------------------------------------------------------------------
+// User friendly types
+
+/// Rust representation of a simulated FoundationDB database
+pub type SimDatabase = Arc<Database>;
+/// Rust representation of a FoundationDB workload
+pub type WrappedWorkload = FDBWorkload;
+
+/// Equivalent to the C++ abstract class `FDBWorkload`
+#[allow(async_fn_in_trait)]
+pub trait RustWorkload: Sized + 'static {
+    /// This method is called by the tester during the setup phase.
+    /// It should be used to populate the database.
+    ///
+    /// # Arguments
+    ///
+    /// * `db` - The simulated database.
+    async fn setup(&mut self, db: SimDatabase);
+
+    /// This method should run the actual test.
+    ///
+    /// # Arguments
+    ///
+    /// * `db` - The simulated database.
+    async fn start(&mut self, db: SimDatabase);
+
+    /// This method is called when the tester completes.
+    /// A workload should run any consistency/correctness tests during this phase.
+    ///
+    /// # Arguments
+    ///
+    /// * `db` - The simulated database.
+    async fn check(&mut self, db: SimDatabase);
+
+    /// If a workload collects metrics (like latencies or throughput numbers), these should be reported back here.
+    /// The multitester (or test orchestrator) will collect all metrics from all test clients and it will aggregate them.
+    ///
+    /// # Arguments
+    ///
+    /// * `out` - A metric sink
+    fn get_metrics(&self, out: Metrics);
+
+    /// Set the check timeout in simulated seconds for this workload.
+    fn get_check_timeout(&self) -> f64;
+
+    /// Virtual Table used by the C API
+    const VT: FDBWorkload_VT = FDBWorkload_VT {
+        setup: Some(workload_setup::<Self>),
+        start: Some(workload_start::<Self>),
+        check: Some(workload_check::<Self>),
+        getMetrics: Some(workload_get_metrics::<Self>),
+        getCheckTimeout: Some(workload_get_check_timeout::<Self>),
+        free: Some(workload_drop::<Self>),
+    };
+
+    /// Wrap the underlying Rust type so it can be passed to the C API
+    fn wrap(self) -> WrappedWorkload {
+        let inner = Box::into_raw(Box::new(self));
+        WrappedWorkload {
+            api_version: FDB_WORKLOAD_API_VERSION,
+            inner: inner as *mut _,
+            vt: &Self::VT as *const _ as *mut _,
+        }
+    }
+}
+
+/// Equivalent to the C++ abstract class `FDBWorkloadFactory`
+pub trait RustWorkloadFactory {
+    /// The runtime FDB_API_VERSION to use
+    const FDB_API_VERSION: u32 = foundationdb_sys::FDB_API_VERSION;
+    /// If the test file contains a key-value pair workloadName the value will be passed to this method (empty string otherwise).
+    /// This way, a library author can implement many workloads in one library and use the test file to chose which one to run
+    /// (or run multiple workloads either concurrently or serially).
+    fn create(name: String, context: WorkloadContext) -> WrappedWorkload;
+}
+
+/// Automatically implements a WorkloadFactory for a single workload
+pub trait SingleRustWorkload: RustWorkload {
+    /// The runtime FDB_API_VERSION to use
+    const FDB_API_VERSION: u32 = foundationdb_sys::FDB_API_VERSION;
+    /// The implicit WorkloadFactory will call this method uppon each instantiation
+    fn new(name: String, context: WorkloadContext) -> Self;
+}
+
+// -----------------------------------------------------------------------------
+// C to Rust bindings
+
+fn check_database_ref(database: SimDatabase) {
+    if Arc::strong_count(&database) != 1 || Arc::weak_count(&database) != 0 {
+        eprintln!(
+            "Reference to Database kept between phases (setup/start/check). All references should be dropped."
+        );
+        std::process::exit(1);
+    }
+    std::mem::forget(database);
+}
+
+#[cfg(coverage)]
+fn write_coverage_profile() {
+    unsafe extern "C" {
+        fn __llvm_profile_reset_counters();
+        fn __llvm_profile_write_file() -> i32;
+    }
+
+    // fdbserver exits with `_exit`, so LLVM's normal process-exit hook cannot
+    // persist a profile from this dynamically loaded workload.
+    let result = unsafe { __llvm_profile_write_file() };
+    if result == 0 {
+        // Every simulator client shares the DSO's counters. Reset only after a
+        // successful snapshot so later client callbacks add, rather than repeat,
+        // counts in LLVM_PROFILE_FILE's %m-merged profile.
+        unsafe { __llvm_profile_reset_counters() };
+    } else {
+        eprintln!("failed to write LLVM coverage profile (status {result})");
+    }
+}
+
+unsafe fn database_new(raw_database: *mut FDBDatabase) -> SimDatabase {
+    unsafe {
+        Arc::new(Database::new_from_pointer(NonNull::new_unchecked(
+            raw_database as *mut FDBDatabaseAlias,
+        )))
+    }
+}
+unsafe extern "C" fn workload_setup<W: RustWorkload + 'static>(
+    raw_workload: *mut OpaqueWorkload,
+    raw_database: *mut FDBDatabase,
+    raw_promise: FDBPromise,
+) {
+    unsafe {
+        let workload = &mut *(raw_workload as *mut W);
+        let database = database_new(raw_database);
+        let done = Promise::new(raw_promise);
+        fdb_spawn(async move {
+            workload.setup(database.clone()).await;
+            check_database_ref(database);
+            done.send(true);
+        });
+    }
+}
+unsafe extern "C" fn workload_start<W: RustWorkload + 'static>(
+    raw_workload: *mut OpaqueWorkload,
+    raw_database: *mut FDBDatabase,
+    raw_promise: FDBPromise,
+) {
+    unsafe {
+        let workload = &mut *(raw_workload as *mut W);
+        let database = database_new(raw_database);
+        let done = Promise::new(raw_promise);
+        fdb_spawn(async move {
+            workload.start(database.clone()).await;
+            check_database_ref(database);
+            done.send(true);
+        });
+    }
+}
+unsafe extern "C" fn workload_check<W: RustWorkload + 'static>(
+    raw_workload: *mut OpaqueWorkload,
+    raw_database: *mut FDBDatabase,
+    raw_promise: FDBPromise,
+) {
+    unsafe {
+        let workload = &mut *(raw_workload as *mut W);
+        let database = database_new(raw_database);
+        let done = Promise::new(raw_promise);
+        fdb_spawn(async move {
+            workload.check(database.clone()).await;
+            check_database_ref(database);
+            done.send(true);
+        });
+    }
+}
+unsafe extern "C" fn workload_get_metrics<W: RustWorkload>(
+    raw_workload: *mut OpaqueWorkload,
+    raw_metrics: FDBMetrics,
+) {
+    unsafe {
+        let workload = &*(raw_workload as *mut W);
+        let out = Metrics::new(raw_metrics);
+        workload.get_metrics(out);
+        #[cfg(coverage)]
+        write_coverage_profile();
+    }
+}
+unsafe extern "C" fn workload_get_check_timeout<W: RustWorkload>(
+    raw_workload: *mut OpaqueWorkload,
+) -> f64 {
+    unsafe {
+        let workload = &*(raw_workload as *mut W);
+        workload.get_check_timeout()
+    }
+}
+unsafe extern "C" fn workload_drop<W: RustWorkload>(raw_workload: *mut OpaqueWorkload) {
+    unsafe { drop(Box::from_raw(raw_workload as *mut W)) };
+}
+
+// -----------------------------------------------------------------------------
+// Registration hooks
+
+#[doc(hidden)]
+/// Primitives exposed for the registrations hooks, should not be used otherwise
+pub mod internals {
+    pub use crate::bindings::{FDBWorkloadContext, str_from_c};
+    pub use crate::fdb_rt::poll_pending_tasks;
+
+    #[cfg(feature = "cpp-abi")]
+    unsafe extern "C" {
+        pub fn workloadCppFactory(logger: *const u8) -> *const u8;
+    }
+
+    #[allow(non_snake_case)]
+    #[cfg(not(feature = "cpp-abi"))]
+    pub unsafe extern "C" fn workloadCppFactory(_logger: *const u8) -> *const u8 {
+        eprintln!(
+            "This Rust workload was compiled without the C++ shim adapter. To fix this, either:
+
+- Re-run the simulation with `useCAPI = true` (FoundationDB 7.4 or newer), or
+- Recompile the workload with FoundationDB versions prior to 7.4 or the `cpp-abi` feature"
+        );
+        std::process::exit(1);
+    }
+}
+
+/// Register a [RustWorkloadFactory].
+/// /!\ Should be called only once.
+#[macro_export]
+macro_rules! register_factory {
+    ($name:ident) => {
+        #[unsafe(no_mangle)]
+        extern "C" fn workloadCFactory(
+            raw_name: *const std::ffi::c_char,
+            raw_context: $crate::internals::FDBWorkloadContext,
+        ) -> $crate::WrappedWorkload {
+            use std::sync::atomic::{AtomicBool, Ordering};
+            static DONE: AtomicBool = AtomicBool::new(false);
+            if DONE
+                .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
+                .is_ok()
+            {
+                let version = <$name as $crate::RustWorkloadFactory>::FDB_API_VERSION;
+                let _ = foundationdb::api::FdbApiBuilder::default()
+                    .set_runtime_version(version as i32)
+                    .build();
+                println!("FDB API version selected: {version}");
+                foundationdb::future::CUSTOM_EXECUTOR_HOOK
+                    .set($crate::internals::poll_pending_tasks)
+                    .unwrap();
+            }
+            let name = $crate::internals::str_from_c(raw_name);
+            let context = $crate::WorkloadContext::new(raw_context);
+            <$name as $crate::RustWorkloadFactory>::create(name, context)
+        }
+        #[unsafe(no_mangle)]
+        extern "C" fn workloadFactory(logger: *const u8) -> *const u8 {
+            unsafe { $crate::internals::workloadCppFactory(logger) }
+        }
+    };
+}
+
+/// Register a [SingleRustWorkload] and creates an implicit WorkloadFactory.
+/// /!\ Should be called only once.
+#[macro_export]
+macro_rules! register_workload {
+    ($name:ident) => {
+        #[unsafe(no_mangle)]
+        extern "C" fn workloadCFactory(
+            raw_name: *const std::ffi::c_char,
+            raw_context: $crate::internals::FDBWorkloadContext,
+        ) -> $crate::WrappedWorkload {
+            use std::sync::atomic::{AtomicBool, Ordering};
+            static DONE: AtomicBool = AtomicBool::new(false);
+            if DONE
+                .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
+                .is_ok()
+            {
+                let version = <$name as $crate::SingleRustWorkload>::FDB_API_VERSION;
+                let _ = foundationdb::api::FdbApiBuilder::default()
+                    .set_runtime_version(version as i32)
+                    .build();
+                println!("FDB API version selected: {version}");
+                foundationdb::future::CUSTOM_EXECUTOR_HOOK
+                    .set($crate::internals::poll_pending_tasks)
+                    .unwrap();
+            }
+            let name = $crate::internals::str_from_c(raw_name);
+            let context = $crate::WorkloadContext::new(raw_context);
+            $crate::RustWorkload::wrap(<$name as $crate::SingleRustWorkload>::new(name, context))
+        }
+        #[unsafe(no_mangle)]
+        extern "C" fn workloadFactory(logger: *const u8) -> *const u8 {
+            unsafe { $crate::internals::workloadCppFactory(logger) }
+        }
+    };
+}
diff --git a/bindings/rust/foundationdb-sys/CHANGELOG.md b/bindings/rust/foundationdb-sys/CHANGELOG.md
new file mode 100644
index 00000000000..949d566fabd
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/CHANGELOG.md
@@ -0,0 +1,198 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.11.0] - 2026-06-24
+
+### <!-- 1 -->🚀 Features
+
+- Feat: migrate workspace to Rust 2024 edition (#255)
+
+### <!-- 2 -->🐛 Bug Fixes
+
+- Fix(sys): add /usr/local/lib to macOS linker search path
+
+[0.11.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.10.0..0.11.0
+
+
+## [0.10.0] - 2025-10-24
+
+### <!-- 0 -->⚠️ BREAKING CHANGES
+
+- Feat: add compile errors for missing version features
+
+### <!-- 1 -->🚀 Features
+
+- Add support 7.4
+
+### <!-- 8 -->⚙️ Miscellaneous
+
+- Bump MSRV to 1.82
+- Clippy --fix
+- Bump msrv to 1.85
+
+[0.10.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.9.1..0.10.0
+
+
+## [0.9.1] - 2024-10-08
+
+### <!-- 3 -->🆙 Bump
+
+- Bump MSRV to 1.71.1
+- Bump all dependencies and setup dependabot
+
+### <!-- 4 -->⚙️ Other changes
+
+- Generate CHANGELOG per crate
+
+[0.9.1]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.9.0..0.9.1
+
+## [0.9.0] - 2024-03-15
+
+### <!-- 0 -->🚀 added
+
+- Add support for 7.3
+- Bump fdb crate to 0.9.0 and sim to 0.2.0
+
+### <!-- 3 -->🆙 Bump
+
+- Bump msrv
+- Bump dependencies
+- Bump dep
+
+### <!-- 4 -->⚙️ Other changes
+
+- Chore: link against libc
+
+## [0.8.0] - 2023-06-07
+
+### <!-- 3 -->🆙 Bump
+
+- Chore: bump rust to 1.57
+- Bump msrv
+- Bump deps
+- Bump msrv for bindgen and env_logger
+- Bump dependencies
+
+### <!-- 4 -->⚙️ Other changes
+
+- Initial support for Nix
+- Build on docs.rs with the required features
+- Prepare release
+
+## [0.7.0] - 2022-07-11
+
+### <!-- 0 -->🚀 added
+
+- Add support for api 630
+- Bump crate version, maintainers and documentation
+- Bump rust edition to 2021
+- Add support for api 700
+- Implement Iterator for FdbKeys
+- Initial commit to support fdb 7.1
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Fix: nighly build by removing layout tests
+
+### <!-- 2 -->🚜 Refactor
+
+- Remove clikengo link in Cargo.toml
+
+### <!-- 3 -->🆙 Bump
+
+- Bump version to 5.0.1
+- Bump deps
+
+### <!-- 4 -->⚙️ Other changes
+
+- Removing reference to master branch
+- Prepare for 0.7.0
+
+## [0.5.0] - 2020-09-17
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Cargo.toml fix docs.rs features
+- Cargo.toml fix badges links
+- Fix Cargo.toml repository links
+- Fix #170: protect boot from undefined behavior
+- Cargo clippy fixes
+- Fix code coverage ci
+
+### <!-- 3 -->🆙 Bump
+
+- Bump version to 0.4.1
+
+### <!-- 4 -->⚙️ Other changes
+
+- Core: auto-generate all code at build time
+- Move CI to FoundationDB 5.2.5
+- Foundationdb 5.2.5 -> 6.0.15
+- Update bindgen requirement from 0.36 to 0.43
+- Upgrade rand from 0.4 to 0.6 (#104)
+- Cleanup the fdb version features from primary crate (#99)
+- Update bindgen requirement from 0.43 to 0.44
+- Update bindgen requirement from 0.44 to 0.46
+- Update bindgen requirement from 0.46 to 0.47
+- Rust edition 2018
+- Async/await: complete rewrite of foundationdb
+- Update bindgen to latest version
+- Foundationdb-sys version is now 0.4.0
+- Update bindgen requirement from 0.47 to 0.48
+- Update bindgen requirement from 0.48 to 0.49
+- Update bindgen requirement from 0.49 to 0.50
+- Update bindgen requirement from 0.50 to 0.51
+- Update Cargo.toml authors
+- Update bindgen requirement from 0.51.1 to 0.52.0
+- Embed 6.2.10 fdb_c.h and fdb.options
+- Embed all supported version includes
+- Default to locally available foundationdb include
+- Move include inside crate folders
+- Foundationdb-gen/sys README
+- Cargo.toml badges & docs.rs metadata
+- Update bindgen requirement from 0.52.0 to 0.53.2
+- Update fdb 620 includes to 6.2.20
+- Update fdb 610 includes to 6.1.13
+- Default to foundation 620 api
+- Update bindgen to 0.55.1
+
+## [0.3.0] - 2018-11-16
+
+### <!-- 0 -->🚀 added
+
+- Add some READMEs
+- Add metadata
+- Add docs link to Cargo.toml
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Fix some urls
+
+### <!-- 3 -->🆙 Bump
+
+- Bump versions
+
+### <!-- 4 -->⚙️ Other changes
+
+- Initial library create for foundationdb rust bindings
+- Initial binding generation working
+- Linux and macos in std header paths
+- Update readme and cargo.toml
+- Track bindings.rs in Git
+- Update bindings from linux bindgen
+- Prepare patch release of sys 0.1.1
+- Win64 support
+- Prepare 0.3 release
+
+[unreleased]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.9.0..HEAD
+[0.9.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.8.0..v0.9.0
+[0.8.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.7.0..v0.8.0
+[0.7.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.5.0..v0.7.0
+[0.5.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.3.0..0.5.0
+[0.3.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.2..v0.3.0
+
+<!-- generated by git-cliff -->
diff --git a/bindings/rust/foundationdb-sys/Cargo.toml b/bindings/rust/foundationdb-sys/Cargo.toml
new file mode 100644
index 00000000000..fc43986659f
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/Cargo.toml
@@ -0,0 +1,50 @@
+[package]
+name = "foundationdb-sys"
+version = "0.11.0"
+authors = [
+    "Benjamin Fry <benjaminfry@me.com>",
+    "Vincent Rouillé <vincent@clikengo.com>",
+    "Pierre Zemb <contact@pierrezemb.fr>"
+]
+edition = "2024"
+rust-version = "1.85.1"
+
+description = """
+Bindings to the C api for FoundationDB
+"""
+
+documentation = "https://docs.rs/foundationdb-sys"
+repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+
+readme = "README.md"
+keywords = ["foundationdb", "kv"]
+categories = ["database"]
+
+license = "MIT/Apache-2.0"
+
+[package.metadata.docs.rs]
+features = ["embedded-fdb-include", "fdb-7_4"]
+
+[badges]
+codecov = { repository = "foundationdb-rs/foundationdb-rs", branch = "main", service = "github" }
+
+[features]
+default = []
+# Use the locally embedded foundationdb fdb_c.h file
+embedded-fdb-include = []
+fdb-5_1 = []
+fdb-5_2 = []
+fdb-6_0 = []
+fdb-6_1 = []
+fdb-6_2 = []
+fdb-6_3 = []
+fdb-7_0 = []
+fdb-7_1 = []
+fdb-7_3 = []
+fdb-7_4 = []
+
+[dependencies]
+libc = "0.2"
+
+[build-dependencies]
+bindgen = "0.73.2"
diff --git a/bindings/rust/foundationdb-sys/README.md b/bindings/rust/foundationdb-sys/README.md
new file mode 100644
index 00000000000..6bcfaa8b907
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/README.md
@@ -0,0 +1,19 @@
+# C API bindings for FoundationDB
+
+See [foundationdb](https://crates.io/crates/foundationdb), for a safe abstraction.
+
+## License
+
+Licensed under either of
+
+- Apache License, Version 2.0, ([LICENSE-APACHE](../LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
+- MIT license ([LICENSE-MIT](../LICENSE-MIT) or http://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the Apache-2.0
+license, shall be dual licensed as above, without any additional terms or
+conditions.
diff --git a/bindings/rust/foundationdb-sys/build.rs b/bindings/rust/foundationdb-sys/build.rs
new file mode 100644
index 00000000000..c2066cb22f0
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/build.rs
@@ -0,0 +1,142 @@
+extern crate bindgen;
+
+use std::env;
+use std::path::PathBuf;
+
+#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "linux"))]
+const INCLUDE_PATH: &str = "/usr/include/foundationdb/";
+
+#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "macos"))]
+const INCLUDE_PATH: &str = "/usr/local/include/foundationdb/";
+
+#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "windows"))]
+const INCLUDE_PATH: &str = "C:/Program Files/foundationdb/include/foundationdb";
+
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-5_1"))]
+const INCLUDE_PATH: &str = "./include/510";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-5_2"))]
+const INCLUDE_PATH: &str = "./include/520";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_0"))]
+const INCLUDE_PATH: &str = "./include/600";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_1"))]
+const INCLUDE_PATH: &str = "./include/610";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_2"))]
+const INCLUDE_PATH: &str = "./include/620";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_3"))]
+const INCLUDE_PATH: &str = "./include/630";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_0"))]
+const INCLUDE_PATH: &str = "./include/700";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_1"))]
+const INCLUDE_PATH: &str = "./include/710";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_3"))]
+const INCLUDE_PATH: &str = "./include/730";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_4"))]
+const INCLUDE_PATH: &str = "./include/740";
+
+// Compile error when no version feature is specified
+#[cfg(not(any(
+    feature = "fdb-5_1",
+    feature = "fdb-5_2",
+    feature = "fdb-6_0",
+    feature = "fdb-6_1",
+    feature = "fdb-6_2",
+    feature = "fdb-6_3",
+    feature = "fdb-7_0",
+    feature = "fdb-7_1",
+    feature = "fdb-7_3",
+    feature = "fdb-7_4",
+)))]
+compile_error!(
+    "foundationdb-sys requires a version feature to be specified.\n\
+     \n\
+     Available version features: fdb-5_1, fdb-5_2, fdb-6_0, fdb-6_1, fdb-6_2, fdb-6_3, fdb-7_0, fdb-7_1, fdb-7_3, fdb-7_4\n\
+     \n\
+     Examples:\n\
+     - With embedded include: features = [\"embedded-fdb-include\", \"fdb-7_4\"]\n\
+     - With system install: features = [\"fdb-7_4\"]"
+);
+
+fn main() {
+    // Link against fdb_c.
+    println!("cargo:rustc-link-lib=fdb_c");
+
+    println!("cargo:rerun-if-env-changed=FDB_CLIENT_LIB_PATH");
+    if let Ok(lib_path) = env::var("FDB_CLIENT_LIB_PATH") {
+        println!("cargo:rustc-link-search=native={lib_path}");
+    }
+
+    // Include the link directory for macOS.
+    // Since Rust 1.91, /usr/local/lib is no longer searched automatically on macOS.
+    // See: https://github.com/rust-lang/rust/pull/131477
+    // See: https://github.com/rust-lang/rust/issues/147010
+    #[cfg(target_os = "macos")]
+    println!("cargo:rustc-link-search=/usr/local/lib");
+
+    // Include the link directory for the .lib file on windows (which will resolve to
+    // the shared library, at runtime)
+    #[cfg(target_os = "windows")]
+    println!("cargo:rustc-link-search=C:/Program Files/foundationdb/lib/foundationdb");
+
+    let out_path = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR is not defined!"));
+
+    // We need to have FDB_API_VERSION set to a constant so that bindgen will
+    // generate a const value for it. We could try to pass -DFDB_TRICKY_VERSION=510
+    // to the driver and then '#define FDB_API_VERSION FDB_TRICKY_VERSION', but
+    // bindgen isn't smart enough to resolve that from the arguments. Instead, write
+    // out a src/wrapper.h file with the chosen version instead.
+    let api_version;
+
+    #[cfg(feature = "fdb-5_1")]
+    {
+        api_version = 510;
+    }
+    #[cfg(feature = "fdb-5_2")]
+    {
+        api_version = 520;
+    }
+    #[cfg(feature = "fdb-6_0")]
+    {
+        api_version = 600;
+    }
+    #[cfg(feature = "fdb-6_1")]
+    {
+        api_version = 610;
+    }
+    #[cfg(feature = "fdb-6_2")]
+    {
+        api_version = 620;
+    }
+    #[cfg(feature = "fdb-6_3")]
+    {
+        api_version = 630;
+    }
+    #[cfg(feature = "fdb-7_0")]
+    {
+        api_version = 700;
+    }
+    #[cfg(feature = "fdb-7_1")]
+    {
+        api_version = 710;
+    }
+    #[cfg(feature = "fdb-7_3")]
+    {
+        api_version = 730;
+    }
+    #[cfg(feature = "fdb-7_4")]
+    {
+        api_version = 740;
+    }
+
+    let bindings = bindgen::Builder::default()
+        // TODO: there must be a way to get foundationdb from pkg-config...
+        .clang_arg(format!("-I{INCLUDE_PATH}"))
+        .clang_arg(format!("-D FDB_API_VERSION={api_version}"))
+        .header(format!("{INCLUDE_PATH}/fdb_c.h"))
+        .generate_comments(true)
+        .layout_tests(false)
+        .generate()
+        .expect("Unable to generate FoundationDB bindings");
+    bindings
+        .write_to_file(out_path.join("bindings.rs"))
+        .expect("Couldn't write bindings!");
+}
diff --git a/bindings/rust/foundationdb-sys/include/510/fdb_c.h b/bindings/rust/foundationdb-sys/include/510/fdb_c.h
new file mode 100644
index 00000000000..8571d59e802
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/510/fdb_c.h
@@ -0,0 +1,316 @@
+/*
+ * fdb_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_H
+#define FDB_C_H
+#pragma once
+
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#if !defined(FDB_API_VERSION)
+#error You must #define FDB_API_VERSION prior to including fdb_c.h (current version is 510)
+#elif FDB_API_VERSION < 13
+#error API version no longer supported (upgrade to 13)
+#elif FDB_API_VERSION > 510
+#error Requested API version requires a newer version of this header
+#endif
+
+#if FDB_API_VERSION >= 23 && !defined(WARN_UNUSED_RESULT)
+#ifdef __GNUG__
+#define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+#define WARN_UNUSED_RESULT
+#endif
+#else
+#define WARN_UNUSED_RESULT
+#endif
+
+// With default settings, gcc will not warn about unprototyped functions being called, so it
+// is easy to erroneously call a function which is not available at FDB_API_VERSION and then
+// get an error only at runtime.  These macros ensure a compile error in such cases, and
+// attempt to make the compile error slightly informative.
+#define This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION() [=====]
+#define FDB_REMOVED_FUNCTION This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION(0)
+
+#include <stdint.h>
+
+#include "fdb_c_options.g.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+    /* Pointers to these opaque types represent objects in the FDB API */
+    typedef struct future FDBFuture;
+    typedef struct cluster FDBCluster;
+    typedef struct database FDBDatabase;
+    typedef struct transaction FDBTransaction;
+
+    typedef int fdb_error_t;
+    typedef int fdb_bool_t;
+
+    DLLEXPORT const char*
+    fdb_get_error( fdb_error_t code );
+
+    DLLEXPORT fdb_bool_t
+    fdb_error_predicate( int predicate_test, fdb_error_t code );
+
+    #define /* fdb_error_t */ fdb_select_api_version(v) fdb_select_api_version_impl(v, FDB_API_VERSION)
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_network_set_option( FDBNetworkOption option, uint8_t const* value,
+                            int value_length );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network();
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_run_network();
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_stop_network();
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_add_network_thread_completion_hook(void (*hook)(void*), void *hook_parameter);
+
+#pragma pack(push, 4)
+    typedef struct keyvalue {
+        const void* key;
+        int key_length;
+        const void* value;
+        int value_length;
+    } FDBKeyValue;
+#pragma pack(pop)
+
+    DLLEXPORT void fdb_future_cancel( FDBFuture *f );
+
+    DLLEXPORT void fdb_future_release_memory( FDBFuture* f );
+
+    DLLEXPORT void fdb_future_destroy( FDBFuture* f );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_block_until_ready( FDBFuture* f );
+
+    DLLEXPORT fdb_bool_t fdb_future_is_ready( FDBFuture* f );
+
+    typedef void (*FDBCallback)(FDBFuture* future, void* callback_parameter);
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_set_callback( FDBFuture* f, FDBCallback callback,
+                             void* callback_parameter );
+
+#if FDB_API_VERSION >= 23
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_error( FDBFuture* f );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_version( FDBFuture* f, int64_t* out_version );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_key( FDBFuture* f, uint8_t const** out_key,
+                        int* out_key_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_cluster( FDBFuture* f, FDBCluster** out_cluster );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_database( FDBFuture* f, FDBDatabase** out_database );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_value( FDBFuture* f, fdb_bool_t *out_present,
+                          uint8_t const** out_value,
+                          int* out_value_length );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_keyvalue_array( FDBFuture* f, FDBKeyValue const** out_kv,
+                                   int* out_count, fdb_bool_t* out_more );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_string_array(FDBFuture* f,
+                            const char*** out_strings, int* out_count);
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_create_cluster( const char* cluster_file_path );
+
+    DLLEXPORT void fdb_cluster_destroy( FDBCluster* c );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_cluster_set_option( FDBCluster* c, FDBClusterOption option,
+                            uint8_t const* value, int value_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_cluster_create_database( FDBCluster* c, uint8_t const* db_name,
+                                 int db_name_length );
+
+    DLLEXPORT void fdb_database_destroy( FDBDatabase* d );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_database_set_option( FDBDatabase* d, FDBDatabaseOption option,
+                             uint8_t const* value, int value_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_database_create_transaction( FDBDatabase* d,
+                                     FDBTransaction** out_transaction );
+
+    DLLEXPORT void fdb_transaction_destroy( FDBTransaction* tr);
+
+    DLLEXPORT void fdb_transaction_cancel( FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_set_option( FDBTransaction* tr, FDBTransactionOption option,
+                                uint8_t const* value, int value_length );
+#endif
+
+    DLLEXPORT void
+    fdb_transaction_set_read_version( FDBTransaction* tr, int64_t version );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_read_version( FDBTransaction* tr );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get( FDBTransaction* tr, uint8_t const* key_name,
+                         int key_name_length, fdb_bool_t snapshot );
+#endif
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_key( FDBTransaction* tr, uint8_t const* key_name,
+                             int key_name_length, fdb_bool_t or_equal,
+                             int offset, fdb_bool_t snapshot );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_addresses_for_key(FDBTransaction* tr, uint8_t const* key_name,
+                            int key_name_length);
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, fdb_bool_t begin_or_equal, int begin_offset,
+        uint8_t const* end_key_name, int end_key_name_length,
+        fdb_bool_t end_or_equal, int end_offset, int limit, int target_bytes,
+        FDBStreamingMode mode, int iteration, fdb_bool_t snapshot,
+        fdb_bool_t reverse );
+#endif
+
+    DLLEXPORT void
+    fdb_transaction_set( FDBTransaction* tr, uint8_t const* key_name,
+                         int key_name_length, uint8_t const* value,
+                         int value_length );
+
+    DLLEXPORT void
+    fdb_transaction_atomic_op( FDBTransaction* tr, uint8_t const* key_name,
+                               int key_name_length, uint8_t const* param,
+                               int param_length, FDBMutationType operation_type );
+
+    DLLEXPORT void
+    fdb_transaction_clear( FDBTransaction* tr, uint8_t const* key_name,
+                           int key_name_length );
+
+    DLLEXPORT void fdb_transaction_clear_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, uint8_t const* end_key_name,
+        int end_key_name_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_watch( FDBTransaction *tr,
+                                                uint8_t const* key_name,
+                                                int key_name_length);
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_commit( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_get_committed_version( FDBTransaction* tr,
+                                           int64_t* out_version );
+
+	DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_versionstamp( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_on_error( FDBTransaction* tr, fdb_error_t error );
+
+    DLLEXPORT void fdb_transaction_reset( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_add_conflict_range(FDBTransaction *tr,
+                                       uint8_t const* begin_key_name,
+                                       int begin_key_name_length,
+                                       uint8_t const* end_key_name,
+                                       int end_key_name_length,
+                                       FDBConflictRangeType type);
+
+    #define FDB_KEYSEL_LAST_LESS_THAN(k, l) k, l, 0, 0
+    #define FDB_KEYSEL_LAST_LESS_OR_EQUAL(k, l) k, l, 1, 0
+    #define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
+    #define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_select_api_version_impl( int runtime_version, int header_version );
+
+    DLLEXPORT int fdb_get_max_api_version();
+    DLLEXPORT const char* fdb_get_client_version();
+
+    /* LEGACY API VERSIONS */
+
+#if FDB_API_VERSION < 23
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_error( FDBFuture* f,
+                          const char** out_description /* = NULL */ );
+
+    DLLEXPORT fdb_bool_t fdb_future_is_error( FDBFuture* f );
+#else
+	#define fdb_future_is_error(x) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(
+        FDBFuture* f, FDBKeyValue const** out_kv, int* out_count );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(
+        FDBTransaction* tr, uint8_t const* key_name, int key_name_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(
+        FDBTransaction* tr, uint8_t const* key_name, int key_name_length,
+        fdb_bool_t or_equal, int offset );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network( const char* local_address );
+
+    DLLEXPORT void fdb_transaction_set_option(
+        FDBTransaction* tr, FDBTransactionOption option );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, uint8_t const* end_key_name,
+        int end_key_name_length, int limit );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_selector(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, fdb_bool_t begin_or_equal,
+        int begin_offset, uint8_t const* end_key_name,
+        int end_key_name_length, fdb_bool_t end_or_equal, int end_offset,
+        int limit );
+#else
+	#define fdb_transaction_get_range_selector(tr,bkn,bknl,boe,bo,ekn,eknl,eoe,eo,lim) FDB_REMOVED_FUNCTION
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/510/fdb_c_options.g.h b/bindings/rust/foundationdb-sys/include/510/fdb_c_options.g.h
new file mode 100644
index 00000000000..e9882f1fe13
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/510/fdb_c_options.g.h
@@ -0,0 +1,341 @@
+#ifndef FDB_C_OPTIONS_G_H
+#define FDB_C_OPTIONS_G_H
+#pragma once
+
+/*
+ * FoundationDB C API
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+typedef enum {
+    // Deprecated
+    // Parameter: (String) IP:PORT
+    FDB_NET_OPTION_LOCAL_ADDRESS=10,
+
+    // Deprecated
+    // Parameter: (String) path to cluster file
+    FDB_NET_OPTION_CLUSTER_FILE=20,
+
+    // Enables trace output to a file in a directory of the clients choosing
+    // Parameter: (String) path to output directory (or NULL for current working directory)
+    FDB_NET_OPTION_TRACE_ENABLE=30,
+
+    // Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes.
+    // Parameter: (Int) max size of a single trace output file
+    FDB_NET_OPTION_TRACE_ROLL_SIZE=31,
+
+    // Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time.
+    // Parameter: (Int) max total size of trace files
+    FDB_NET_OPTION_TRACE_MAX_LOGS_SIZE=32,
+
+    // Sets the 'logGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'.
+    // Parameter: (String) value of the logGroup attribute
+    FDB_NET_OPTION_TRACE_LOG_GROUP=33,
+
+    // Set internal tuning or debugging knobs
+    // Parameter: (String) knob_name=knob_value
+    FDB_NET_OPTION_KNOB=40,
+
+    // Set the TLS plugin to load. This option, if used, must be set before any other TLS options
+    // Parameter: (String) file path or linker-resolved name
+    FDB_NET_OPTION_TLS_PLUGIN=41,
+
+    // Set the certificate chain
+    // Parameter: (Bytes) certificates
+    FDB_NET_OPTION_TLS_CERT_BYTES=42,
+
+    // Set the file from which to load the certificate chain
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CERT_PATH=43,
+
+    // Set the private key corresponding to your own certificate
+    // Parameter: (Bytes) key
+    FDB_NET_OPTION_TLS_KEY_BYTES=45,
+
+    // Set the file from which to load the private key corresponding to your own certificate
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_KEY_PATH=46,
+
+    // Set the peer certificate field verification criteria
+    // Parameter: (Bytes) verification pattern
+    FDB_NET_OPTION_TLS_VERIFY_PEERS=47,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_ENABLE=48,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_DISABLE=49,
+
+    // Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed.
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=50,
+
+    // Set the probability of an active BUGGIFY section being fired
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_FIRED_PROBABILITY=51,
+
+    // Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_MULTI_VERSION_CLIENT_API=60,
+
+    // If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_CALLBACKS_ON_EXTERNAL_THREADS=61,
+
+    // Adds an external client library for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to client library
+    FDB_NET_OPTION_EXTERNAL_CLIENT_LIBRARY=62,
+
+    // Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to directory containing client libraries
+    FDB_NET_OPTION_EXTERNAL_CLIENT_DIRECTORY=63,
+
+    // Prevents connections through the local client, allowing only connections through externally loaded client libraries. Intended primarily for testing.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_LOCAL_CLIENT=64,
+
+    // Disables logging of client statistics, such as sampled transaction activity.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_CLIENT_STATISTICS_LOGGING=70,
+
+    // Enables debugging feature to perform slow task profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_ENABLE_SLOW_TASK_PROFILING=71
+} FDBNetworkOption;
+
+typedef enum {
+    // This option is only a placeholder for C compatibility and should not be used
+    // Parameter: Option takes no parameter
+    FDB_CLUSTER_OPTION_DUMMY_DO_NOT_USE=-1
+} FDBClusterOption;
+
+typedef enum {
+    // Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000.
+    // Parameter: (Int) Max location cache entries
+    FDB_DB_OPTION_LOCATION_CACHE_SIZE=10,
+
+    // Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000.
+    // Parameter: (Int) Max outstanding watches
+    FDB_DB_OPTION_MAX_WATCHES=20,
+
+    // Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_MACHINE_ID=21,
+
+    // Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_DATACENTER_ID=22
+} FDBDatabaseOption;
+
+typedef enum {
+    // The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_WRITE_RISKY=10,
+
+    // The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a fault or partition
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_RISKY=20,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_DISABLE=21,
+
+    // The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_NEXT_WRITE_NO_WRITE_CONFLICT_RANGE=30,
+
+    // Committing this transaction will bypass the normal load balancing across proxies and go directly to the specifically nominated 'first proxy'.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_COMMIT_ON_FIRST_PROXY=40,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CHECK_WRITES_ENABLE=50,
+
+    // Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE=51,
+
+    // Disables read-ahead caching for range reads. Under normal operation, a transaction will read extra rows from the database into cache if range reads are used to page through a series of data one row at a time (i.e. if a range read with a one row limit is followed by another one row range read starting immediately after the result of the first).
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_AHEAD_DISABLE=52,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DATACENTER=110,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_RISKY=120,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DEV_NULL_IS_WEB_SCALE=130,
+
+    // Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_SYSTEM_IMMEDIATE=200,
+
+    // Specifies that this transaction should be treated as low priority and that default priority transactions should be processed first. Useful for doing batch work simultaneously with latency-sensitive work
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_BATCH=201,
+
+    // This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_INITIALIZE_NEW_DATABASE=300,
+
+    // Allows this transaction to read and modify system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_ACCESS_SYSTEM_KEYS=301,
+
+    // Allows this transaction to read system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_SYSTEM_KEYS=302,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DEBUG_DUMP=400,
+
+    // 
+    // Parameter: (String) Optional transaction name
+    FDB_TR_OPTION_DEBUG_RETRY_LOGGING=401,
+
+    // Enables tracing for this transaction and logs results to the client trace logs. Client trace logging must be enabled to get log output.
+    // Parameter: (String) String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters.
+    FDB_TR_OPTION_TRANSACTION_LOGGING_ENABLE=402,
+
+    // Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Like all transaction options, a timeout must be reset after a call to onError. This behavior allows the user to make the timeout dynamic.
+    // Parameter: (Int) value in milliseconds of timeout
+    FDB_TR_OPTION_TIMEOUT=500,
+
+    // Set a maximum number of retries after which additional calls to onError will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Like all transaction options, the retry limit must be reset after a call to onError. This behavior allows the user to make the retry limit dynamic.
+    // Parameter: (Int) number of times to retry
+    FDB_TR_OPTION_RETRY_LIMIT=501,
+
+    // Set the maximum amount of backoff delay incurred in the call to onError if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. Like all transaction options, the maximum retry delay must be reset after a call to onError. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay.
+    // Parameter: (Int) value in milliseconds of maximum delay
+    FDB_TR_OPTION_MAX_RETRY_DELAY=502,
+
+    // Snapshot read operations will see the results of writes done in the same transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_ENABLE=600,
+
+    // Snapshot read operations will not see the results of writes done in the same transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_DISABLE=601,
+
+    // The transaction can read and write to locked databases, and is resposible for checking that it took the lock.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_LOCK_AWARE=700,
+
+    // By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    // The transaction can read from locked databases.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_LOCK_AWARE=702
+} FDBTransactionOption;
+
+typedef enum {
+    // Client intends to consume the entire range and would like it all transferred as early as possible.
+    FDB_STREAMING_MODE_WANT_ALL=-2,
+
+    // The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency.
+    FDB_STREAMING_MODE_ITERATOR=-1,
+
+    // Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used.
+    FDB_STREAMING_MODE_EXACT=0,
+
+    // Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early.
+    FDB_STREAMING_MODE_SMALL=1,
+
+    // Infrequently used. Transfer data in batches sized in between small and large.
+    FDB_STREAMING_MODE_MEDIUM=2,
+
+    // Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode.
+    FDB_STREAMING_MODE_LARGE=3,
+
+    // Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted.
+    FDB_STREAMING_MODE_SERIAL=4
+} FDBStreamingMode;
+
+typedef enum {
+    // Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow.
+    FDB_MUTATION_TYPE_ADD=2,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_AND=6,
+
+    // Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_AND=6,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_OR=7,
+
+    // Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_OR=7,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_XOR=8,
+
+    // Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_XOR=8,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MAX=12,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MIN=13,
+
+    // Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database. The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time versionstamps are compatible with the Tuple layer only in the Java and Python bindings. Note that this implies versionstamped keys may not be used with the Subspace and Directory layers except in those languages.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_KEY=14,
+
+    // Transforms ``param`` using a versionstamp for the transaction. Sets ``key`` in the database to the transformed parameter. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database. The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time versionstamped values are not compatible with the Tuple layer.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_VALUE=15,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MIN=16,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MAX=17
+} FDBMutationType;
+
+typedef enum {
+    // Used to add a read conflict range
+    FDB_CONFLICT_RANGE_TYPE_READ=0,
+
+    // Used to add a write conflict range
+    FDB_CONFLICT_RANGE_TYPE_WRITE=1
+} FDBConflictRangeType;
+
+typedef enum {
+    // Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error.
+    FDB_ERROR_PREDICATE_RETRYABLE=50000,
+
+    // Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify.
+    FDB_ERROR_PREDICATE_MAYBE_COMMITTED=50001,
+
+    // Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried.
+    FDB_ERROR_PREDICATE_RETRYABLE_NOT_COMMITTED=50002
+} FDBErrorPredicate;
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/510/version.txt b/bindings/rust/foundationdb-sys/include/510/version.txt
new file mode 100644
index 00000000000..693ad745af3
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/510/version.txt
@@ -0,0 +1 @@
+5.1.7
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-sys/include/520/fdb_c.h b/bindings/rust/foundationdb-sys/include/520/fdb_c.h
new file mode 100644
index 00000000000..1c96c5914f0
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/520/fdb_c.h
@@ -0,0 +1,316 @@
+/*
+ * fdb_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_H
+#define FDB_C_H
+#pragma once
+
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#if !defined(FDB_API_VERSION)
+#error You must #define FDB_API_VERSION prior to including fdb_c.h (current version is 520)
+#elif FDB_API_VERSION < 13
+#error API version no longer supported (upgrade to 13)
+#elif FDB_API_VERSION > 520
+#error Requested API version requires a newer version of this header
+#endif
+
+#if FDB_API_VERSION >= 23 && !defined(WARN_UNUSED_RESULT)
+#ifdef __GNUG__
+#define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+#define WARN_UNUSED_RESULT
+#endif
+#else
+#define WARN_UNUSED_RESULT
+#endif
+
+// With default settings, gcc will not warn about unprototyped functions being called, so it
+// is easy to erroneously call a function which is not available at FDB_API_VERSION and then
+// get an error only at runtime.  These macros ensure a compile error in such cases, and
+// attempt to make the compile error slightly informative.
+#define This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION() [=====]
+#define FDB_REMOVED_FUNCTION This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION(0)
+
+#include <stdint.h>
+
+#include "fdb_c_options.g.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+    /* Pointers to these opaque types represent objects in the FDB API */
+    typedef struct future FDBFuture;
+    typedef struct cluster FDBCluster;
+    typedef struct database FDBDatabase;
+    typedef struct transaction FDBTransaction;
+
+    typedef int fdb_error_t;
+    typedef int fdb_bool_t;
+
+    DLLEXPORT const char*
+    fdb_get_error( fdb_error_t code );
+
+    DLLEXPORT fdb_bool_t
+    fdb_error_predicate( int predicate_test, fdb_error_t code );
+
+    #define /* fdb_error_t */ fdb_select_api_version(v) fdb_select_api_version_impl(v, FDB_API_VERSION)
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_network_set_option( FDBNetworkOption option, uint8_t const* value,
+                            int value_length );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network();
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_run_network();
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_stop_network();
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_add_network_thread_completion_hook(void (*hook)(void*), void *hook_parameter);
+
+#pragma pack(push, 4)
+    typedef struct keyvalue {
+        const void* key;
+        int key_length;
+        const void* value;
+        int value_length;
+    } FDBKeyValue;
+#pragma pack(pop)
+
+    DLLEXPORT void fdb_future_cancel( FDBFuture *f );
+
+    DLLEXPORT void fdb_future_release_memory( FDBFuture* f );
+
+    DLLEXPORT void fdb_future_destroy( FDBFuture* f );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_block_until_ready( FDBFuture* f );
+
+    DLLEXPORT fdb_bool_t fdb_future_is_ready( FDBFuture* f );
+
+    typedef void (*FDBCallback)(FDBFuture* future, void* callback_parameter);
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_set_callback( FDBFuture* f, FDBCallback callback,
+                             void* callback_parameter );
+
+#if FDB_API_VERSION >= 23
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_error( FDBFuture* f );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_version( FDBFuture* f, int64_t* out_version );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_key( FDBFuture* f, uint8_t const** out_key,
+                        int* out_key_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_cluster( FDBFuture* f, FDBCluster** out_cluster );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_database( FDBFuture* f, FDBDatabase** out_database );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_value( FDBFuture* f, fdb_bool_t *out_present,
+                          uint8_t const** out_value,
+                          int* out_value_length );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_keyvalue_array( FDBFuture* f, FDBKeyValue const** out_kv,
+                                   int* out_count, fdb_bool_t* out_more );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_string_array(FDBFuture* f,
+                            const char*** out_strings, int* out_count);
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_create_cluster( const char* cluster_file_path );
+
+    DLLEXPORT void fdb_cluster_destroy( FDBCluster* c );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_cluster_set_option( FDBCluster* c, FDBClusterOption option,
+                            uint8_t const* value, int value_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_cluster_create_database( FDBCluster* c, uint8_t const* db_name,
+                                 int db_name_length );
+
+    DLLEXPORT void fdb_database_destroy( FDBDatabase* d );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_database_set_option( FDBDatabase* d, FDBDatabaseOption option,
+                             uint8_t const* value, int value_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_database_create_transaction( FDBDatabase* d,
+                                     FDBTransaction** out_transaction );
+
+    DLLEXPORT void fdb_transaction_destroy( FDBTransaction* tr);
+
+    DLLEXPORT void fdb_transaction_cancel( FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_set_option( FDBTransaction* tr, FDBTransactionOption option,
+                                uint8_t const* value, int value_length );
+#endif
+
+    DLLEXPORT void
+    fdb_transaction_set_read_version( FDBTransaction* tr, int64_t version );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_read_version( FDBTransaction* tr );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get( FDBTransaction* tr, uint8_t const* key_name,
+                         int key_name_length, fdb_bool_t snapshot );
+#endif
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_key( FDBTransaction* tr, uint8_t const* key_name,
+                             int key_name_length, fdb_bool_t or_equal,
+                             int offset, fdb_bool_t snapshot );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_addresses_for_key(FDBTransaction* tr, uint8_t const* key_name,
+                            int key_name_length);
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, fdb_bool_t begin_or_equal, int begin_offset,
+        uint8_t const* end_key_name, int end_key_name_length,
+        fdb_bool_t end_or_equal, int end_offset, int limit, int target_bytes,
+        FDBStreamingMode mode, int iteration, fdb_bool_t snapshot,
+        fdb_bool_t reverse );
+#endif
+
+    DLLEXPORT void
+    fdb_transaction_set( FDBTransaction* tr, uint8_t const* key_name,
+                         int key_name_length, uint8_t const* value,
+                         int value_length );
+
+    DLLEXPORT void
+    fdb_transaction_atomic_op( FDBTransaction* tr, uint8_t const* key_name,
+                               int key_name_length, uint8_t const* param,
+                               int param_length, FDBMutationType operation_type );
+
+    DLLEXPORT void
+    fdb_transaction_clear( FDBTransaction* tr, uint8_t const* key_name,
+                           int key_name_length );
+
+    DLLEXPORT void fdb_transaction_clear_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, uint8_t const* end_key_name,
+        int end_key_name_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_watch( FDBTransaction *tr,
+                                                uint8_t const* key_name,
+                                                int key_name_length);
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_commit( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_get_committed_version( FDBTransaction* tr,
+                                           int64_t* out_version );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_versionstamp( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_on_error( FDBTransaction* tr, fdb_error_t error );
+
+    DLLEXPORT void fdb_transaction_reset( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_add_conflict_range(FDBTransaction *tr,
+                                       uint8_t const* begin_key_name,
+                                       int begin_key_name_length,
+                                       uint8_t const* end_key_name,
+                                       int end_key_name_length,
+                                       FDBConflictRangeType type);
+
+    #define FDB_KEYSEL_LAST_LESS_THAN(k, l) k, l, 0, 0
+    #define FDB_KEYSEL_LAST_LESS_OR_EQUAL(k, l) k, l, 1, 0
+    #define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
+    #define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_select_api_version_impl( int runtime_version, int header_version );
+
+    DLLEXPORT int fdb_get_max_api_version();
+    DLLEXPORT const char* fdb_get_client_version();
+
+    /* LEGACY API VERSIONS */
+
+#if FDB_API_VERSION < 23
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_error( FDBFuture* f,
+                          const char** out_description /* = NULL */ );
+
+    DLLEXPORT fdb_bool_t fdb_future_is_error( FDBFuture* f );
+#else
+    #define fdb_future_is_error(x) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(
+        FDBFuture* f, FDBKeyValue const** out_kv, int* out_count );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(
+        FDBTransaction* tr, uint8_t const* key_name, int key_name_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(
+        FDBTransaction* tr, uint8_t const* key_name, int key_name_length,
+        fdb_bool_t or_equal, int offset );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network( const char* local_address );
+
+    DLLEXPORT void fdb_transaction_set_option(
+        FDBTransaction* tr, FDBTransactionOption option );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, uint8_t const* end_key_name,
+        int end_key_name_length, int limit );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_selector(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, fdb_bool_t begin_or_equal,
+        int begin_offset, uint8_t const* end_key_name,
+        int end_key_name_length, fdb_bool_t end_or_equal, int end_offset,
+        int limit );
+#else
+    #define fdb_transaction_get_range_selector(tr,bkn,bknl,boe,bo,ekn,eknl,eoe,eo,lim) FDB_REMOVED_FUNCTION
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/520/fdb_c_options.g.h b/bindings/rust/foundationdb-sys/include/520/fdb_c_options.g.h
new file mode 100644
index 00000000000..e669926a07d
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/520/fdb_c_options.g.h
@@ -0,0 +1,344 @@
+#ifndef FDB_C_OPTIONS_G_H
+#define FDB_C_OPTIONS_G_H
+#pragma once
+
+/*
+ * FoundationDB C API
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+typedef enum {
+    // Deprecated
+    // Parameter: (String) IP:PORT
+    FDB_NET_OPTION_LOCAL_ADDRESS=10,
+
+    // Deprecated
+    // Parameter: (String) path to cluster file
+    FDB_NET_OPTION_CLUSTER_FILE=20,
+
+    // Enables trace output to a file in a directory of the clients choosing
+    // Parameter: (String) path to output directory (or NULL for current working directory)
+    FDB_NET_OPTION_TRACE_ENABLE=30,
+
+    // Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes.
+    // Parameter: (Int) max size of a single trace output file
+    FDB_NET_OPTION_TRACE_ROLL_SIZE=31,
+
+    // Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time.
+    // Parameter: (Int) max total size of trace files
+    FDB_NET_OPTION_TRACE_MAX_LOGS_SIZE=32,
+
+    // Sets the 'logGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'.
+    // Parameter: (String) value of the logGroup attribute
+    FDB_NET_OPTION_TRACE_LOG_GROUP=33,
+
+    // Set internal tuning or debugging knobs
+    // Parameter: (String) knob_name=knob_value
+    FDB_NET_OPTION_KNOB=40,
+
+    // Set the TLS plugin to load. This option, if used, must be set before any other TLS options
+    // Parameter: (String) file path or linker-resolved name
+    FDB_NET_OPTION_TLS_PLUGIN=41,
+
+    // Set the certificate chain
+    // Parameter: (Bytes) certificates
+    FDB_NET_OPTION_TLS_CERT_BYTES=42,
+
+    // Set the file from which to load the certificate chain
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CERT_PATH=43,
+
+    // Set the private key corresponding to your own certificate
+    // Parameter: (Bytes) key
+    FDB_NET_OPTION_TLS_KEY_BYTES=45,
+
+    // Set the file from which to load the private key corresponding to your own certificate
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_KEY_PATH=46,
+
+    // Set the peer certificate field verification criteria
+    // Parameter: (Bytes) verification pattern
+    FDB_NET_OPTION_TLS_VERIFY_PEERS=47,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_ENABLE=48,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_DISABLE=49,
+
+    // Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed.
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=50,
+
+    // Set the probability of an active BUGGIFY section being fired
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_FIRED_PROBABILITY=51,
+
+    // Set the ca bundle
+    // Parameter: (Bytes) ca bundle
+    FDB_NET_OPTION_TLS_CA_BYTES=52,
+
+    // Set the file from which to load the certificate authority bundle
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CA_PATH=53,
+
+    // Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used.
+    // Parameter: (String) key passphrase
+    FDB_NET_OPTION_TLS_PASSWORD=54,
+
+    // Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_MULTI_VERSION_CLIENT_API=60,
+
+    // If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_CALLBACKS_ON_EXTERNAL_THREADS=61,
+
+    // Adds an external client library for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to client library
+    FDB_NET_OPTION_EXTERNAL_CLIENT_LIBRARY=62,
+
+    // Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to directory containing client libraries
+    FDB_NET_OPTION_EXTERNAL_CLIENT_DIRECTORY=63,
+
+    // Prevents connections through the local client, allowing only connections through externally loaded client libraries. Intended primarily for testing.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_LOCAL_CLIENT=64,
+
+    // Disables logging of client statistics, such as sampled transaction activity.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_CLIENT_STATISTICS_LOGGING=70,
+
+    // Enables debugging feature to perform slow task profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_ENABLE_SLOW_TASK_PROFILING=71
+} FDBNetworkOption;
+
+typedef enum {
+    // This option is only a placeholder for C compatibility and should not be used
+    // Parameter: Option takes no parameter
+    FDB_CLUSTER_OPTION_DUMMY_DO_NOT_USE=-1
+} FDBClusterOption;
+
+typedef enum {
+    // Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000.
+    // Parameter: (Int) Max location cache entries
+    FDB_DB_OPTION_LOCATION_CACHE_SIZE=10,
+
+    // Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000.
+    // Parameter: (Int) Max outstanding watches
+    FDB_DB_OPTION_MAX_WATCHES=20,
+
+    // Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_MACHINE_ID=21,
+
+    // Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_DATACENTER_ID=22
+} FDBDatabaseOption;
+
+typedef enum {
+    // The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_WRITE_RISKY=10,
+
+    // The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a fault or partition
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_RISKY=20,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_DISABLE=21,
+
+    // The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_NEXT_WRITE_NO_WRITE_CONFLICT_RANGE=30,
+
+    // Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE=51,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_AHEAD_DISABLE=52,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DATACENTER=110,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_RISKY=120,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DEV_NULL_IS_WEB_SCALE=130,
+
+    // Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_SYSTEM_IMMEDIATE=200,
+
+    // Specifies that this transaction should be treated as low priority and that default priority transactions should be processed first. Useful for doing batch work simultaneously with latency-sensitive work
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_BATCH=201,
+
+    // This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_INITIALIZE_NEW_DATABASE=300,
+
+    // Allows this transaction to read and modify system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_ACCESS_SYSTEM_KEYS=301,
+
+    // Allows this transaction to read system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_SYSTEM_KEYS=302,
+
+    // 
+    // Parameter: (String) Optional transaction name
+    FDB_TR_OPTION_DEBUG_RETRY_LOGGING=401,
+
+    // Enables tracing for this transaction and logs results to the client trace logs. Client trace logging must be enabled to get log output.
+    // Parameter: (String) String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters.
+    FDB_TR_OPTION_TRANSACTION_LOGGING_ENABLE=402,
+
+    // Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Like all transaction options, a timeout must be reset after a call to onError. This behavior allows the user to make the timeout dynamic.
+    // Parameter: (Int) value in milliseconds of timeout
+    FDB_TR_OPTION_TIMEOUT=500,
+
+    // Set a maximum number of retries after which additional calls to onError will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Like all transaction options, the retry limit must be reset after a call to onError. This behavior allows the user to make the retry limit dynamic.
+    // Parameter: (Int) number of times to retry
+    FDB_TR_OPTION_RETRY_LIMIT=501,
+
+    // Set the maximum amount of backoff delay incurred in the call to onError if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. Like all transaction options, the maximum retry delay must be reset after a call to onError. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay.
+    // Parameter: (Int) value in milliseconds of maximum delay
+    FDB_TR_OPTION_MAX_RETRY_DELAY=502,
+
+    // Snapshot read operations will see the results of writes done in the same transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_ENABLE=600,
+
+    // Snapshot read operations will not see the results of writes done in the same transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_DISABLE=601,
+
+    // The transaction can read and write to locked databases, and is resposible for checking that it took the lock.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_LOCK_AWARE=700,
+
+    // By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    // The transaction can read from locked databases.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_LOCK_AWARE=702
+} FDBTransactionOption;
+
+typedef enum {
+    // Client intends to consume the entire range and would like it all transferred as early as possible.
+    FDB_STREAMING_MODE_WANT_ALL=-2,
+
+    // The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency.
+    FDB_STREAMING_MODE_ITERATOR=-1,
+
+    // Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used.
+    FDB_STREAMING_MODE_EXACT=0,
+
+    // Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early.
+    FDB_STREAMING_MODE_SMALL=1,
+
+    // Infrequently used. Transfer data in batches sized in between small and large.
+    FDB_STREAMING_MODE_MEDIUM=2,
+
+    // Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode.
+    FDB_STREAMING_MODE_LARGE=3,
+
+    // Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted.
+    FDB_STREAMING_MODE_SERIAL=4
+} FDBStreamingMode;
+
+typedef enum {
+    // Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow.
+    FDB_MUTATION_TYPE_ADD=2,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_AND=6,
+
+    // Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_AND=6,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_OR=7,
+
+    // Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_OR=7,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_XOR=8,
+
+    // Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_XOR=8,
+
+    // Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size.
+    FDB_MUTATION_TYPE_APPEND_IF_FITS=9,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MAX=12,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MIN=13,
+
+    // Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java and Python bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_KEY=14,
+
+    // Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java and Python bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_VALUE=15,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MIN=16,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MAX=17
+} FDBMutationType;
+
+typedef enum {
+    // Used to add a read conflict range
+    FDB_CONFLICT_RANGE_TYPE_READ=0,
+
+    // Used to add a write conflict range
+    FDB_CONFLICT_RANGE_TYPE_WRITE=1
+} FDBConflictRangeType;
+
+typedef enum {
+    // Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error.
+    FDB_ERROR_PREDICATE_RETRYABLE=50000,
+
+    // Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify.
+    FDB_ERROR_PREDICATE_MAYBE_COMMITTED=50001,
+
+    // Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried.
+    FDB_ERROR_PREDICATE_RETRYABLE_NOT_COMMITTED=50002
+} FDBErrorPredicate;
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/520/version.txt b/bindings/rust/foundationdb-sys/include/520/version.txt
new file mode 100644
index 00000000000..e60200b54f4
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/520/version.txt
@@ -0,0 +1 @@
+5.2.5
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-sys/include/600/fdb_c.h b/bindings/rust/foundationdb-sys/include/600/fdb_c.h
new file mode 100644
index 00000000000..a9e1bd20b79
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/600/fdb_c.h
@@ -0,0 +1,316 @@
+/*
+ * fdb_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_H
+#define FDB_C_H
+#pragma once
+
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#if !defined(FDB_API_VERSION)
+#error You must #define FDB_API_VERSION prior to including fdb_c.h (current version is 600)
+#elif FDB_API_VERSION < 13
+#error API version no longer supported (upgrade to 13)
+#elif FDB_API_VERSION > 600
+#error Requested API version requires a newer version of this header
+#endif
+
+#if FDB_API_VERSION >= 23 && !defined(WARN_UNUSED_RESULT)
+#ifdef __GNUG__
+#define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+#define WARN_UNUSED_RESULT
+#endif
+#else
+#define WARN_UNUSED_RESULT
+#endif
+
+// With default settings, gcc will not warn about unprototyped functions being called, so it
+// is easy to erroneously call a function which is not available at FDB_API_VERSION and then
+// get an error only at runtime.  These macros ensure a compile error in such cases, and
+// attempt to make the compile error slightly informative.
+#define This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION() [=====]
+#define FDB_REMOVED_FUNCTION This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION(0)
+
+#include <stdint.h>
+
+#include "fdb_c_options.g.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+    /* Pointers to these opaque types represent objects in the FDB API */
+    typedef struct FDB_future FDBFuture;
+    typedef struct FDB_cluster FDBCluster;
+    typedef struct FDB_database FDBDatabase;
+    typedef struct FDB_transaction FDBTransaction;
+
+    typedef int fdb_error_t;
+    typedef int fdb_bool_t;
+
+    DLLEXPORT const char*
+    fdb_get_error( fdb_error_t code );
+
+    DLLEXPORT fdb_bool_t
+    fdb_error_predicate( int predicate_test, fdb_error_t code );
+
+    #define /* fdb_error_t */ fdb_select_api_version(v) fdb_select_api_version_impl(v, FDB_API_VERSION)
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_network_set_option( FDBNetworkOption option, uint8_t const* value,
+                            int value_length );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network();
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_run_network();
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_stop_network();
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_add_network_thread_completion_hook(void (*hook)(void*), void *hook_parameter);
+
+#pragma pack(push, 4)
+    typedef struct keyvalue {
+        const void* key;
+        int key_length;
+        const void* value;
+        int value_length;
+    } FDBKeyValue;
+#pragma pack(pop)
+
+    DLLEXPORT void fdb_future_cancel( FDBFuture *f );
+
+    DLLEXPORT void fdb_future_release_memory( FDBFuture* f );
+
+    DLLEXPORT void fdb_future_destroy( FDBFuture* f );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_block_until_ready( FDBFuture* f );
+
+    DLLEXPORT fdb_bool_t fdb_future_is_ready( FDBFuture* f );
+
+    typedef void (*FDBCallback)(FDBFuture* future, void* callback_parameter);
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_set_callback( FDBFuture* f, FDBCallback callback,
+                             void* callback_parameter );
+
+#if FDB_API_VERSION >= 23
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_error( FDBFuture* f );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_version( FDBFuture* f, int64_t* out_version );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_key( FDBFuture* f, uint8_t const** out_key,
+                        int* out_key_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_cluster( FDBFuture* f, FDBCluster** out_cluster );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_database( FDBFuture* f, FDBDatabase** out_database );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_value( FDBFuture* f, fdb_bool_t *out_present,
+                          uint8_t const** out_value,
+                          int* out_value_length );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_keyvalue_array( FDBFuture* f, FDBKeyValue const** out_kv,
+                                   int* out_count, fdb_bool_t* out_more );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_string_array(FDBFuture* f,
+                            const char*** out_strings, int* out_count);
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_create_cluster( const char* cluster_file_path );
+
+    DLLEXPORT void fdb_cluster_destroy( FDBCluster* c );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_cluster_set_option( FDBCluster* c, FDBClusterOption option,
+                            uint8_t const* value, int value_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_cluster_create_database( FDBCluster* c, uint8_t const* db_name,
+                                 int db_name_length );
+
+    DLLEXPORT void fdb_database_destroy( FDBDatabase* d );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_database_set_option( FDBDatabase* d, FDBDatabaseOption option,
+                             uint8_t const* value, int value_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_database_create_transaction( FDBDatabase* d,
+                                     FDBTransaction** out_transaction );
+
+    DLLEXPORT void fdb_transaction_destroy( FDBTransaction* tr);
+
+    DLLEXPORT void fdb_transaction_cancel( FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_set_option( FDBTransaction* tr, FDBTransactionOption option,
+                                uint8_t const* value, int value_length );
+#endif
+
+    DLLEXPORT void
+    fdb_transaction_set_read_version( FDBTransaction* tr, int64_t version );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_read_version( FDBTransaction* tr );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get( FDBTransaction* tr, uint8_t const* key_name,
+                         int key_name_length, fdb_bool_t snapshot );
+#endif
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_key( FDBTransaction* tr, uint8_t const* key_name,
+                             int key_name_length, fdb_bool_t or_equal,
+                             int offset, fdb_bool_t snapshot );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_addresses_for_key(FDBTransaction* tr, uint8_t const* key_name,
+                            int key_name_length);
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, fdb_bool_t begin_or_equal, int begin_offset,
+        uint8_t const* end_key_name, int end_key_name_length,
+        fdb_bool_t end_or_equal, int end_offset, int limit, int target_bytes,
+        FDBStreamingMode mode, int iteration, fdb_bool_t snapshot,
+        fdb_bool_t reverse );
+#endif
+
+    DLLEXPORT void
+    fdb_transaction_set( FDBTransaction* tr, uint8_t const* key_name,
+                         int key_name_length, uint8_t const* value,
+                         int value_length );
+
+    DLLEXPORT void
+    fdb_transaction_atomic_op( FDBTransaction* tr, uint8_t const* key_name,
+                               int key_name_length, uint8_t const* param,
+                               int param_length, FDBMutationType operation_type );
+
+    DLLEXPORT void
+    fdb_transaction_clear( FDBTransaction* tr, uint8_t const* key_name,
+                           int key_name_length );
+
+    DLLEXPORT void fdb_transaction_clear_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, uint8_t const* end_key_name,
+        int end_key_name_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_watch( FDBTransaction *tr,
+                                                uint8_t const* key_name,
+                                                int key_name_length);
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_commit( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_get_committed_version( FDBTransaction* tr,
+                                           int64_t* out_version );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_versionstamp( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_on_error( FDBTransaction* tr, fdb_error_t error );
+
+    DLLEXPORT void fdb_transaction_reset( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_add_conflict_range(FDBTransaction *tr,
+                                       uint8_t const* begin_key_name,
+                                       int begin_key_name_length,
+                                       uint8_t const* end_key_name,
+                                       int end_key_name_length,
+                                       FDBConflictRangeType type);
+
+    #define FDB_KEYSEL_LAST_LESS_THAN(k, l) k, l, 0, 0
+    #define FDB_KEYSEL_LAST_LESS_OR_EQUAL(k, l) k, l, 1, 0
+    #define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
+    #define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_select_api_version_impl( int runtime_version, int header_version );
+
+    DLLEXPORT int fdb_get_max_api_version();
+    DLLEXPORT const char* fdb_get_client_version();
+
+    /* LEGACY API VERSIONS */
+
+#if FDB_API_VERSION < 23
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_error( FDBFuture* f,
+                          const char** out_description /* = NULL */ );
+
+    DLLEXPORT fdb_bool_t fdb_future_is_error( FDBFuture* f );
+#else
+    #define fdb_future_is_error(x) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(
+        FDBFuture* f, FDBKeyValue const** out_kv, int* out_count );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(
+        FDBTransaction* tr, uint8_t const* key_name, int key_name_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(
+        FDBTransaction* tr, uint8_t const* key_name, int key_name_length,
+        fdb_bool_t or_equal, int offset );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network( const char* local_address );
+
+    DLLEXPORT void fdb_transaction_set_option(
+        FDBTransaction* tr, FDBTransactionOption option );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, uint8_t const* end_key_name,
+        int end_key_name_length, int limit );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_selector(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, fdb_bool_t begin_or_equal,
+        int begin_offset, uint8_t const* end_key_name,
+        int end_key_name_length, fdb_bool_t end_or_equal, int end_offset,
+        int limit );
+#else
+    #define fdb_transaction_get_range_selector(tr,bkn,bknl,boe,bo,ekn,eknl,eoe,eo,lim) FDB_REMOVED_FUNCTION
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/600/fdb_c_options.g.h b/bindings/rust/foundationdb-sys/include/600/fdb_c_options.g.h
new file mode 100644
index 00000000000..d60657535cc
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/600/fdb_c_options.g.h
@@ -0,0 +1,344 @@
+#ifndef FDB_C_OPTIONS_G_H
+#define FDB_C_OPTIONS_G_H
+#pragma once
+
+/*
+ * FoundationDB C API
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+typedef enum {
+    // Deprecated
+    // Parameter: (String) IP:PORT
+    FDB_NET_OPTION_LOCAL_ADDRESS=10,
+
+    // Deprecated
+    // Parameter: (String) path to cluster file
+    FDB_NET_OPTION_CLUSTER_FILE=20,
+
+    // Enables trace output to a file in a directory of the clients choosing
+    // Parameter: (String) path to output directory (or NULL for current working directory)
+    FDB_NET_OPTION_TRACE_ENABLE=30,
+
+    // Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes.
+    // Parameter: (Int) max size of a single trace output file
+    FDB_NET_OPTION_TRACE_ROLL_SIZE=31,
+
+    // Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time.
+    // Parameter: (Int) max total size of trace files
+    FDB_NET_OPTION_TRACE_MAX_LOGS_SIZE=32,
+
+    // Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'.
+    // Parameter: (String) value of the LogGroup attribute
+    FDB_NET_OPTION_TRACE_LOG_GROUP=33,
+
+    // Set internal tuning or debugging knobs
+    // Parameter: (String) knob_name=knob_value
+    FDB_NET_OPTION_KNOB=40,
+
+    // Deprecated
+    // Parameter: (String) file path or linker-resolved name
+    FDB_NET_OPTION_TLS_PLUGIN=41,
+
+    // Set the certificate chain
+    // Parameter: (Bytes) certificates
+    FDB_NET_OPTION_TLS_CERT_BYTES=42,
+
+    // Set the file from which to load the certificate chain
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CERT_PATH=43,
+
+    // Set the private key corresponding to your own certificate
+    // Parameter: (Bytes) key
+    FDB_NET_OPTION_TLS_KEY_BYTES=45,
+
+    // Set the file from which to load the private key corresponding to your own certificate
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_KEY_PATH=46,
+
+    // Set the peer certificate field verification criteria
+    // Parameter: (Bytes) verification pattern
+    FDB_NET_OPTION_TLS_VERIFY_PEERS=47,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_ENABLE=48,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_DISABLE=49,
+
+    // Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed.
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=50,
+
+    // Set the probability of an active BUGGIFY section being fired
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_FIRED_PROBABILITY=51,
+
+    // Set the ca bundle
+    // Parameter: (Bytes) ca bundle
+    FDB_NET_OPTION_TLS_CA_BYTES=52,
+
+    // Set the file from which to load the certificate authority bundle
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CA_PATH=53,
+
+    // Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used.
+    // Parameter: (String) key passphrase
+    FDB_NET_OPTION_TLS_PASSWORD=54,
+
+    // Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_MULTI_VERSION_CLIENT_API=60,
+
+    // If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_CALLBACKS_ON_EXTERNAL_THREADS=61,
+
+    // Adds an external client library for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to client library
+    FDB_NET_OPTION_EXTERNAL_CLIENT_LIBRARY=62,
+
+    // Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to directory containing client libraries
+    FDB_NET_OPTION_EXTERNAL_CLIENT_DIRECTORY=63,
+
+    // Prevents connections through the local client, allowing only connections through externally loaded client libraries. Intended primarily for testing.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_LOCAL_CLIENT=64,
+
+    // Disables logging of client statistics, such as sampled transaction activity.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_CLIENT_STATISTICS_LOGGING=70,
+
+    // Enables debugging feature to perform slow task profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_ENABLE_SLOW_TASK_PROFILING=71
+} FDBNetworkOption;
+
+typedef enum {
+    // This option is only a placeholder for C compatibility and should not be used
+    // Parameter: Option takes no parameter
+    FDB_CLUSTER_OPTION_DUMMY_DO_NOT_USE=-1
+} FDBClusterOption;
+
+typedef enum {
+    // Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000.
+    // Parameter: (Int) Max location cache entries
+    FDB_DB_OPTION_LOCATION_CACHE_SIZE=10,
+
+    // Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000.
+    // Parameter: (Int) Max outstanding watches
+    FDB_DB_OPTION_MAX_WATCHES=20,
+
+    // Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_MACHINE_ID=21,
+
+    // Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_DATACENTER_ID=22
+} FDBDatabaseOption;
+
+typedef enum {
+    // The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_WRITE_RISKY=10,
+
+    // The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a fault or partition
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_RISKY=20,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_DISABLE=21,
+
+    // The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_NEXT_WRITE_NO_WRITE_CONFLICT_RANGE=30,
+
+    // Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE=51,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_AHEAD_DISABLE=52,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DATACENTER=110,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_RISKY=120,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DEV_NULL_IS_WEB_SCALE=130,
+
+    // Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_SYSTEM_IMMEDIATE=200,
+
+    // Specifies that this transaction should be treated as low priority and that default priority transactions should be processed first. Useful for doing batch work simultaneously with latency-sensitive work
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_BATCH=201,
+
+    // This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_INITIALIZE_NEW_DATABASE=300,
+
+    // Allows this transaction to read and modify system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_ACCESS_SYSTEM_KEYS=301,
+
+    // Allows this transaction to read system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_SYSTEM_KEYS=302,
+
+    // 
+    // Parameter: (String) Optional transaction name
+    FDB_TR_OPTION_DEBUG_RETRY_LOGGING=401,
+
+    // Enables tracing for this transaction and logs results to the client trace logs. Client trace logging must be enabled to get log output.
+    // Parameter: (String) String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters.
+    FDB_TR_OPTION_TRANSACTION_LOGGING_ENABLE=402,
+
+    // Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Like all transaction options, a timeout must be reset after a call to onError. This behavior allows the user to make the timeout dynamic.
+    // Parameter: (Int) value in milliseconds of timeout
+    FDB_TR_OPTION_TIMEOUT=500,
+
+    // Set a maximum number of retries after which additional calls to onError will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Like all transaction options, the retry limit must be reset after a call to onError. This behavior allows the user to make the retry limit dynamic.
+    // Parameter: (Int) number of times to retry
+    FDB_TR_OPTION_RETRY_LIMIT=501,
+
+    // Set the maximum amount of backoff delay incurred in the call to onError if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. Like all transaction options, the maximum retry delay must be reset after a call to onError. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay.
+    // Parameter: (Int) value in milliseconds of maximum delay
+    FDB_TR_OPTION_MAX_RETRY_DELAY=502,
+
+    // Snapshot read operations will see the results of writes done in the same transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_ENABLE=600,
+
+    // Snapshot read operations will not see the results of writes done in the same transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_DISABLE=601,
+
+    // The transaction can read and write to locked databases, and is resposible for checking that it took the lock.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_LOCK_AWARE=700,
+
+    // By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    // The transaction can read from locked databases.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_LOCK_AWARE=702
+} FDBTransactionOption;
+
+typedef enum {
+    // Client intends to consume the entire range and would like it all transferred as early as possible.
+    FDB_STREAMING_MODE_WANT_ALL=-2,
+
+    // The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency.
+    FDB_STREAMING_MODE_ITERATOR=-1,
+
+    // Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used.
+    FDB_STREAMING_MODE_EXACT=0,
+
+    // Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early.
+    FDB_STREAMING_MODE_SMALL=1,
+
+    // Infrequently used. Transfer data in batches sized in between small and large.
+    FDB_STREAMING_MODE_MEDIUM=2,
+
+    // Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode.
+    FDB_STREAMING_MODE_LARGE=3,
+
+    // Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted.
+    FDB_STREAMING_MODE_SERIAL=4
+} FDBStreamingMode;
+
+typedef enum {
+    // Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow.
+    FDB_MUTATION_TYPE_ADD=2,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_AND=6,
+
+    // Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_AND=6,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_OR=7,
+
+    // Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_OR=7,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_XOR=8,
+
+    // Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_XOR=8,
+
+    // Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size.
+    FDB_MUTATION_TYPE_APPEND_IF_FITS=9,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MAX=12,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MIN=13,
+
+    // Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java and Python bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_KEY=14,
+
+    // Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java and Python bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_VALUE=15,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MIN=16,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MAX=17
+} FDBMutationType;
+
+typedef enum {
+    // Used to add a read conflict range
+    FDB_CONFLICT_RANGE_TYPE_READ=0,
+
+    // Used to add a write conflict range
+    FDB_CONFLICT_RANGE_TYPE_WRITE=1
+} FDBConflictRangeType;
+
+typedef enum {
+    // Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error.
+    FDB_ERROR_PREDICATE_RETRYABLE=50000,
+
+    // Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify.
+    FDB_ERROR_PREDICATE_MAYBE_COMMITTED=50001,
+
+    // Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried.
+    FDB_ERROR_PREDICATE_RETRYABLE_NOT_COMMITTED=50002
+} FDBErrorPredicate;
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/600/version.txt b/bindings/rust/foundationdb-sys/include/600/version.txt
new file mode 100644
index 00000000000..e23d7a6e234
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/600/version.txt
@@ -0,0 +1 @@
+6.0.18
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-sys/include/610/fdb_c.h b/bindings/rust/foundationdb-sys/include/610/fdb_c.h
new file mode 100644
index 00000000000..5d988cec387
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/610/fdb_c.h
@@ -0,0 +1,336 @@
+/*
+ * fdb_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_H
+#define FDB_C_H
+#pragma once
+
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#if !defined(FDB_API_VERSION)
+#error You must #define FDB_API_VERSION prior to including fdb_c.h (current version is 610)
+#elif FDB_API_VERSION < 13
+#error API version no longer supported (upgrade to 13)
+#elif FDB_API_VERSION > 610
+#error Requested API version requires a newer version of this header
+#endif
+
+#if FDB_API_VERSION >= 23 && !defined(WARN_UNUSED_RESULT)
+#ifdef __GNUG__
+#define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+#define WARN_UNUSED_RESULT
+#endif
+#else
+#define WARN_UNUSED_RESULT
+#endif
+
+// With default settings, gcc will not warn about unprototyped functions being called, so it
+// is easy to erroneously call a function which is not available at FDB_API_VERSION and then
+// get an error only at runtime.  These macros ensure a compile error in such cases, and
+// attempt to make the compile error slightly informative.
+#define This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION() [=====]
+#define FDB_REMOVED_FUNCTION This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION(0)
+
+#include <stdint.h>
+
+#include "fdb_c_options.g.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+    /* Pointers to these opaque types represent objects in the FDB API */
+    typedef struct FDB_future FDBFuture;
+    typedef struct FDB_database FDBDatabase;
+    typedef struct FDB_transaction FDBTransaction;
+
+    typedef int fdb_error_t;
+    typedef int fdb_bool_t;
+
+    DLLEXPORT const char*
+    fdb_get_error( fdb_error_t code );
+
+    DLLEXPORT fdb_bool_t
+    fdb_error_predicate( int predicate_test, fdb_error_t code );
+
+    #define /* fdb_error_t */ fdb_select_api_version(v) fdb_select_api_version_impl(v, FDB_API_VERSION)
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_network_set_option( FDBNetworkOption option, uint8_t const* value,
+                            int value_length );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network();
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_run_network();
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_stop_network();
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_add_network_thread_completion_hook(void (*hook)(void*), void *hook_parameter);
+
+#pragma pack(push, 4)
+    typedef struct keyvalue {
+        const void* key;
+        int key_length;
+        const void* value;
+        int value_length;
+    } FDBKeyValue;
+#pragma pack(pop)
+
+    DLLEXPORT void fdb_future_cancel( FDBFuture* f );
+
+    DLLEXPORT void fdb_future_release_memory( FDBFuture* f );
+
+    DLLEXPORT void fdb_future_destroy( FDBFuture* f );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_block_until_ready( FDBFuture* f );
+
+    DLLEXPORT fdb_bool_t fdb_future_is_ready( FDBFuture* f );
+
+    typedef void (*FDBCallback)(FDBFuture* future, void* callback_parameter);
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_set_callback( FDBFuture* f, FDBCallback callback,
+                             void* callback_parameter );
+
+#if FDB_API_VERSION >= 23
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_error( FDBFuture* f );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_version( FDBFuture* f, int64_t* out_version );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_key( FDBFuture* f, uint8_t const** out_key,
+                        int* out_key_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_value( FDBFuture* f, fdb_bool_t *out_present,
+                          uint8_t const** out_value,
+                          int* out_value_length );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_keyvalue_array( FDBFuture* f, FDBKeyValue const** out_kv,
+                                   int* out_count, fdb_bool_t* out_more );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_string_array(FDBFuture* f,
+                            const char*** out_strings, int* out_count);
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_create_database( const char* cluster_file_path, FDBDatabase** out_database );
+
+    DLLEXPORT void fdb_database_destroy( FDBDatabase* d );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_database_set_option( FDBDatabase* d, FDBDatabaseOption option,
+                             uint8_t const* value, int value_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_database_create_transaction( FDBDatabase* d,
+                                     FDBTransaction** out_transaction );
+
+    DLLEXPORT void fdb_transaction_destroy( FDBTransaction* tr);
+
+    DLLEXPORT void fdb_transaction_cancel( FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_set_option( FDBTransaction* tr, FDBTransactionOption option,
+                                uint8_t const* value, int value_length );
+#endif
+
+    DLLEXPORT void
+    fdb_transaction_set_read_version( FDBTransaction* tr, int64_t version );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_read_version( FDBTransaction* tr );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get( FDBTransaction* tr, uint8_t const* key_name,
+                         int key_name_length, fdb_bool_t snapshot );
+#endif
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_key( FDBTransaction* tr, uint8_t const* key_name,
+                             int key_name_length, fdb_bool_t or_equal,
+                             int offset, fdb_bool_t snapshot );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_addresses_for_key(FDBTransaction* tr, uint8_t const* key_name,
+                            int key_name_length);
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, fdb_bool_t begin_or_equal, int begin_offset,
+        uint8_t const* end_key_name, int end_key_name_length,
+        fdb_bool_t end_or_equal, int end_offset, int limit, int target_bytes,
+        FDBStreamingMode mode, int iteration, fdb_bool_t snapshot,
+        fdb_bool_t reverse );
+#endif
+
+    DLLEXPORT void
+    fdb_transaction_set( FDBTransaction* tr, uint8_t const* key_name,
+                         int key_name_length, uint8_t const* value,
+                         int value_length );
+
+    DLLEXPORT void
+    fdb_transaction_atomic_op( FDBTransaction* tr, uint8_t const* key_name,
+                               int key_name_length, uint8_t const* param,
+                               int param_length, FDBMutationType operation_type );
+
+    DLLEXPORT void
+    fdb_transaction_clear( FDBTransaction* tr, uint8_t const* key_name,
+                           int key_name_length );
+
+    DLLEXPORT void fdb_transaction_clear_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, uint8_t const* end_key_name,
+        int end_key_name_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_watch( FDBTransaction *tr,
+                                                uint8_t const* key_name,
+                                                int key_name_length);
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_commit( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_get_committed_version( FDBTransaction* tr,
+                                           int64_t* out_version );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_versionstamp( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_on_error( FDBTransaction* tr, fdb_error_t error );
+
+    DLLEXPORT void fdb_transaction_reset( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_add_conflict_range(FDBTransaction *tr,
+                                       uint8_t const* begin_key_name,
+                                       int begin_key_name_length,
+                                       uint8_t const* end_key_name,
+                                       int end_key_name_length,
+                                       FDBConflictRangeType type);
+
+    #define FDB_KEYSEL_LAST_LESS_THAN(k, l) k, l, 0, 0
+    #define FDB_KEYSEL_LAST_LESS_OR_EQUAL(k, l) k, l, 1, 0
+    #define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
+    #define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_select_api_version_impl( int runtime_version, int header_version );
+
+    DLLEXPORT int fdb_get_max_api_version();
+    DLLEXPORT const char* fdb_get_client_version();
+
+    /* LEGACY API VERSIONS */
+
+#if FDB_API_VERSION < 610 || defined FDB_INCLUDE_LEGACY_TYPES
+    typedef struct FDB_cluster FDBCluster;
+
+    typedef enum {
+        // This option is only a placeholder for C compatibility and should not be used
+        FDB_CLUSTER_OPTION_DUMMY_DO_NOT_USE=-1
+    } FDBClusterOption;
+#endif
+
+#if FDB_API_VERSION < 610
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_cluster( FDBFuture* f, FDBCluster** out_cluster );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_database( FDBFuture* f, FDBDatabase** out_database );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_create_cluster( const char* cluster_file_path );
+
+    DLLEXPORT void fdb_cluster_destroy( FDBCluster* c );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_cluster_set_option( FDBCluster* c, FDBClusterOption option,
+                            uint8_t const* value, int value_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_cluster_create_database( FDBCluster* c, uint8_t const* db_name,
+                                 int db_name_length );
+#else
+    #define fdb_future_get_cluster(f, oc) FDB_REMOVED_FUNCTION
+    #define fdb_future_get_database(f, od) FDB_REMOVED_FUNCTION
+    #define fdb_create_cluster(cfp) FDB_REMOVED_FUNCTION
+    #define fdb_cluster_destroy(c) FDB_REMOVED_FUNCTION
+    #define fdb_cluster_set_option(c, o, v, vl) FDB_REMOVED_FUNCTION
+    #define fdb_cluster_create_database(c, dn, dnl) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 23
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_error( FDBFuture* f,
+                          const char** out_description /* = NULL */ );
+
+    DLLEXPORT fdb_bool_t fdb_future_is_error( FDBFuture* f );
+#else
+    #define fdb_future_is_error(x) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(
+        FDBFuture* f, FDBKeyValue const** out_kv, int* out_count );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(
+        FDBTransaction* tr, uint8_t const* key_name, int key_name_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(
+        FDBTransaction* tr, uint8_t const* key_name, int key_name_length,
+        fdb_bool_t or_equal, int offset );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network( const char* local_address );
+
+    DLLEXPORT void fdb_transaction_set_option(
+        FDBTransaction* tr, FDBTransactionOption option );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, uint8_t const* end_key_name,
+        int end_key_name_length, int limit );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_selector(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, fdb_bool_t begin_or_equal,
+        int begin_offset, uint8_t const* end_key_name,
+        int end_key_name_length, fdb_bool_t end_or_equal, int end_offset,
+        int limit );
+#else
+    #define fdb_transaction_get_range_selector(tr,bkn,bknl,boe,bo,ekn,eknl,eoe,eo,lim) FDB_REMOVED_FUNCTION
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/610/fdb_c_options.g.h b/bindings/rust/foundationdb-sys/include/610/fdb_c_options.g.h
new file mode 100644
index 00000000000..47e43555b36
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/610/fdb_c_options.g.h
@@ -0,0 +1,377 @@
+#ifndef FDB_C_OPTIONS_G_H
+#define FDB_C_OPTIONS_G_H
+#pragma once
+
+/*
+ * FoundationDB C API
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+typedef enum {
+    // Deprecated
+    // Parameter: (String) IP:PORT
+    FDB_NET_OPTION_LOCAL_ADDRESS=10,
+
+    // Deprecated
+    // Parameter: (String) path to cluster file
+    FDB_NET_OPTION_CLUSTER_FILE=20,
+
+    // Enables trace output to a file in a directory of the clients choosing
+    // Parameter: (String) path to output directory (or NULL for current working directory)
+    FDB_NET_OPTION_TRACE_ENABLE=30,
+
+    // Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes.
+    // Parameter: (Int) max size of a single trace output file
+    FDB_NET_OPTION_TRACE_ROLL_SIZE=31,
+
+    // Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time.
+    // Parameter: (Int) max total size of trace files
+    FDB_NET_OPTION_TRACE_MAX_LOGS_SIZE=32,
+
+    // Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'.
+    // Parameter: (String) value of the LogGroup attribute
+    FDB_NET_OPTION_TRACE_LOG_GROUP=33,
+
+    // Select the format of the log files. xml (the default) and json are supported.
+    // Parameter: (String) Format of trace files
+    FDB_NET_OPTION_TRACE_FORMAT=34,
+
+    // Set internal tuning or debugging knobs
+    // Parameter: (String) knob_name=knob_value
+    FDB_NET_OPTION_KNOB=40,
+
+    // Deprecated
+    // Parameter: (String) file path or linker-resolved name
+    FDB_NET_OPTION_TLS_PLUGIN=41,
+
+    // Set the certificate chain
+    // Parameter: (Bytes) certificates
+    FDB_NET_OPTION_TLS_CERT_BYTES=42,
+
+    // Set the file from which to load the certificate chain
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CERT_PATH=43,
+
+    // Set the private key corresponding to your own certificate
+    // Parameter: (Bytes) key
+    FDB_NET_OPTION_TLS_KEY_BYTES=45,
+
+    // Set the file from which to load the private key corresponding to your own certificate
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_KEY_PATH=46,
+
+    // Set the peer certificate field verification criteria
+    // Parameter: (Bytes) verification pattern
+    FDB_NET_OPTION_TLS_VERIFY_PEERS=47,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_ENABLE=48,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_DISABLE=49,
+
+    // Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed.
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=50,
+
+    // Set the probability of an active BUGGIFY section being fired
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_FIRED_PROBABILITY=51,
+
+    // Set the ca bundle
+    // Parameter: (Bytes) ca bundle
+    FDB_NET_OPTION_TLS_CA_BYTES=52,
+
+    // Set the file from which to load the certificate authority bundle
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CA_PATH=53,
+
+    // Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used.
+    // Parameter: (String) key passphrase
+    FDB_NET_OPTION_TLS_PASSWORD=54,
+
+    // Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_MULTI_VERSION_CLIENT_API=60,
+
+    // If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_CALLBACKS_ON_EXTERNAL_THREADS=61,
+
+    // Adds an external client library for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to client library
+    FDB_NET_OPTION_EXTERNAL_CLIENT_LIBRARY=62,
+
+    // Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to directory containing client libraries
+    FDB_NET_OPTION_EXTERNAL_CLIENT_DIRECTORY=63,
+
+    // Prevents connections through the local client, allowing only connections through externally loaded client libraries. Intended primarily for testing.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_LOCAL_CLIENT=64,
+
+    // Disables logging of client statistics, such as sampled transaction activity.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_CLIENT_STATISTICS_LOGGING=70,
+
+    // Enables debugging feature to perform slow task profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_ENABLE_SLOW_TASK_PROFILING=71
+} FDBNetworkOption;
+
+typedef enum {
+    // Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000.
+    // Parameter: (Int) Max location cache entries
+    FDB_DB_OPTION_LOCATION_CACHE_SIZE=10,
+
+    // Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000.
+    // Parameter: (Int) Max outstanding watches
+    FDB_DB_OPTION_MAX_WATCHES=20,
+
+    // Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_MACHINE_ID=21,
+
+    // Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_DATACENTER_ID=22,
+
+    // Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher.
+    // Parameter: (Int) value in milliseconds of timeout
+    FDB_DB_OPTION_TRANSACTION_TIMEOUT=500,
+
+    // Set a timeout in milliseconds which, when elapsed, will cause a transaction automatically to be cancelled. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information.
+    // Parameter: (Int) number of times to retry
+    FDB_DB_OPTION_TRANSACTION_RETRY_LIMIT=501,
+
+    // Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information.
+    // Parameter: (Int) value in milliseconds of maximum delay
+    FDB_DB_OPTION_TRANSACTION_MAX_RETRY_DELAY=502,
+
+    // Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior.
+    // Parameter: Option takes no parameter
+    FDB_DB_OPTION_SNAPSHOT_RYW_ENABLE=26,
+
+    // Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300.
+    // Parameter: Option takes no parameter
+    FDB_DB_OPTION_SNAPSHOT_RYW_DISABLE=27
+} FDBDatabaseOption;
+
+typedef enum {
+    // The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_WRITE_RISKY=10,
+
+    // The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a fault or partition
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_RISKY=20,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_DISABLE=21,
+
+    // The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_NEXT_WRITE_NO_WRITE_CONFLICT_RANGE=30,
+
+    // Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE=51,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_AHEAD_DISABLE=52,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DATACENTER=110,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_RISKY=120,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DEV_NULL_IS_WEB_SCALE=130,
+
+    // Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_SYSTEM_IMMEDIATE=200,
+
+    // Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_BATCH=201,
+
+    // This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_INITIALIZE_NEW_DATABASE=300,
+
+    // Allows this transaction to read and modify system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_ACCESS_SYSTEM_KEYS=301,
+
+    // Allows this transaction to read system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_SYSTEM_KEYS=302,
+
+    // 
+    // Parameter: (String) Optional transaction name
+    FDB_TR_OPTION_DEBUG_RETRY_LOGGING=401,
+
+    // Deprecated
+    // Parameter: (String) String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters.
+    FDB_TR_OPTION_TRANSACTION_LOGGING_ENABLE=402,
+
+    // Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled.
+    // Parameter: (String) String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters.
+    FDB_TR_OPTION_DEBUG_TRANSACTION_IDENTIFIER=403,
+
+    // Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled and to get log output.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_LOG_TRANSACTION=404,
+
+    // Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option.
+    // Parameter: (Int) value in milliseconds of timeout
+    FDB_TR_OPTION_TIMEOUT=500,
+
+    // Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option.
+    // Parameter: (Int) number of times to retry
+    FDB_TR_OPTION_RETRY_LIMIT=501,
+
+    // Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option.
+    // Parameter: (Int) value in milliseconds of maximum delay
+    FDB_TR_OPTION_MAX_RETRY_DELAY=502,
+
+    // Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_ENABLE=600,
+
+    // Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_DISABLE=601,
+
+    // The transaction can read and write to locked databases, and is resposible for checking that it took the lock.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_LOCK_AWARE=700,
+
+    // By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    // The transaction can read from locked databases.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_LOCK_AWARE=702,
+
+    // This option should only be used by tools which change the database configuration.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_USE_PROVISIONAL_PROXIES=711
+} FDBTransactionOption;
+
+typedef enum {
+    // Client intends to consume the entire range and would like it all transferred as early as possible.
+    FDB_STREAMING_MODE_WANT_ALL=-2,
+
+    // The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency.
+    FDB_STREAMING_MODE_ITERATOR=-1,
+
+    // Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used.
+    FDB_STREAMING_MODE_EXACT=0,
+
+    // Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early.
+    FDB_STREAMING_MODE_SMALL=1,
+
+    // Infrequently used. Transfer data in batches sized in between small and large.
+    FDB_STREAMING_MODE_MEDIUM=2,
+
+    // Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode.
+    FDB_STREAMING_MODE_LARGE=3,
+
+    // Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted.
+    FDB_STREAMING_MODE_SERIAL=4
+} FDBStreamingMode;
+
+typedef enum {
+    // Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow.
+    FDB_MUTATION_TYPE_ADD=2,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_AND=6,
+
+    // Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_AND=6,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_OR=7,
+
+    // Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_OR=7,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_XOR=8,
+
+    // Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_XOR=8,
+
+    // Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size.
+    FDB_MUTATION_TYPE_APPEND_IF_FITS=9,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MAX=12,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MIN=13,
+
+    // Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_KEY=14,
+
+    // Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_VALUE=15,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MIN=16,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MAX=17,
+
+    // Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared.
+    FDB_MUTATION_TYPE_COMPARE_AND_CLEAR=20
+} FDBMutationType;
+
+typedef enum {
+    // Used to add a read conflict range
+    FDB_CONFLICT_RANGE_TYPE_READ=0,
+
+    // Used to add a write conflict range
+    FDB_CONFLICT_RANGE_TYPE_WRITE=1
+} FDBConflictRangeType;
+
+typedef enum {
+    // Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error.
+    FDB_ERROR_PREDICATE_RETRYABLE=50000,
+
+    // Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify.
+    FDB_ERROR_PREDICATE_MAYBE_COMMITTED=50001,
+
+    // Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried.
+    FDB_ERROR_PREDICATE_RETRYABLE_NOT_COMMITTED=50002
+} FDBErrorPredicate;
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/610/version.txt b/bindings/rust/foundationdb-sys/include/610/version.txt
new file mode 100644
index 00000000000..4b5ef77d17c
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/610/version.txt
@@ -0,0 +1 @@
+6.1.13
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-sys/include/620/fdb_c.h b/bindings/rust/foundationdb-sys/include/620/fdb_c.h
new file mode 100644
index 00000000000..5459952cf72
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/620/fdb_c.h
@@ -0,0 +1,350 @@
+/*
+ * fdb_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_H
+#define FDB_C_H
+#pragma once
+
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#if !defined(FDB_API_VERSION)
+#error You must #define FDB_API_VERSION prior to including fdb_c.h (current version is 620)
+#elif FDB_API_VERSION < 13
+#error API version no longer supported (upgrade to 13)
+#elif FDB_API_VERSION > 620
+#error Requested API version requires a newer version of this header
+#endif
+
+#if FDB_API_VERSION >= 23 && !defined(WARN_UNUSED_RESULT)
+#ifdef __GNUG__
+#define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+#define WARN_UNUSED_RESULT
+#endif
+#else
+#define WARN_UNUSED_RESULT
+#endif
+
+// With default settings, gcc will not warn about unprototyped functions being called, so it
+// is easy to erroneously call a function which is not available at FDB_API_VERSION and then
+// get an error only at runtime.  These macros ensure a compile error in such cases, and
+// attempt to make the compile error slightly informative.
+#define This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION() [=====]
+#define FDB_REMOVED_FUNCTION This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION(0)
+
+#include <stdint.h>
+
+#include "fdb_c_options.g.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+    /* Pointers to these opaque types represent objects in the FDB API */
+    typedef struct FDB_future FDBFuture;
+    typedef struct FDB_database FDBDatabase;
+    typedef struct FDB_transaction FDBTransaction;
+
+    typedef int fdb_error_t;
+    typedef int fdb_bool_t;
+
+    DLLEXPORT const char*
+    fdb_get_error( fdb_error_t code );
+
+    DLLEXPORT fdb_bool_t
+    fdb_error_predicate( int predicate_test, fdb_error_t code );
+
+    #define /* fdb_error_t */ fdb_select_api_version(v) fdb_select_api_version_impl(v, FDB_API_VERSION)
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_network_set_option( FDBNetworkOption option, uint8_t const* value,
+                            int value_length );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network();
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_run_network();
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_stop_network();
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_add_network_thread_completion_hook(void (*hook)(void*), void *hook_parameter);
+
+#pragma pack(push, 4)
+    typedef struct keyvalue {
+        const void* key;
+        int key_length;
+        const void* value;
+        int value_length;
+    } FDBKeyValue;
+#pragma pack(pop)
+
+    DLLEXPORT void fdb_future_cancel( FDBFuture* f );
+
+    DLLEXPORT void fdb_future_release_memory( FDBFuture* f );
+
+    DLLEXPORT void fdb_future_destroy( FDBFuture* f );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_block_until_ready( FDBFuture* f );
+
+    DLLEXPORT fdb_bool_t fdb_future_is_ready( FDBFuture* f );
+
+    typedef void (*FDBCallback)(FDBFuture* future, void* callback_parameter);
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_set_callback( FDBFuture* f, FDBCallback callback,
+                             void* callback_parameter );
+
+#if FDB_API_VERSION >= 23
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_error( FDBFuture* f );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_int64( FDBFuture* f, int64_t* out );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_key( FDBFuture* f, uint8_t const** out_key,
+                        int* out_key_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_value( FDBFuture* f, fdb_bool_t *out_present,
+                          uint8_t const** out_value,
+                          int* out_value_length );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_keyvalue_array( FDBFuture* f, FDBKeyValue const** out_kv,
+                                   int* out_count, fdb_bool_t* out_more );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_string_array(FDBFuture* f,
+                            const char*** out_strings, int* out_count);
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_create_database( const char* cluster_file_path, FDBDatabase** out_database );
+
+    DLLEXPORT void fdb_database_destroy( FDBDatabase* d );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_database_set_option( FDBDatabase* d, FDBDatabaseOption option,
+                             uint8_t const* value, int value_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_database_create_transaction( FDBDatabase* d,
+                                     FDBTransaction** out_transaction );
+
+    DLLEXPORT void fdb_transaction_destroy( FDBTransaction* tr);
+
+    DLLEXPORT void fdb_transaction_cancel( FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_set_option( FDBTransaction* tr, FDBTransactionOption option,
+                                uint8_t const* value, int value_length );
+#endif
+
+    DLLEXPORT void
+    fdb_transaction_set_read_version( FDBTransaction* tr, int64_t version );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_read_version( FDBTransaction* tr );
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get( FDBTransaction* tr, uint8_t const* key_name,
+                         int key_name_length, fdb_bool_t snapshot );
+#endif
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_key( FDBTransaction* tr, uint8_t const* key_name,
+                             int key_name_length, fdb_bool_t or_equal,
+                             int offset, fdb_bool_t snapshot );
+#endif
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_addresses_for_key(FDBTransaction* tr, uint8_t const* key_name,
+                            int key_name_length);
+
+#if FDB_API_VERSION >= 14
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, fdb_bool_t begin_or_equal, int begin_offset,
+        uint8_t const* end_key_name, int end_key_name_length,
+        fdb_bool_t end_or_equal, int end_offset, int limit, int target_bytes,
+        FDBStreamingMode mode, int iteration, fdb_bool_t snapshot,
+        fdb_bool_t reverse );
+#endif
+
+    DLLEXPORT void
+    fdb_transaction_set( FDBTransaction* tr, uint8_t const* key_name,
+                         int key_name_length, uint8_t const* value,
+                         int value_length );
+
+    DLLEXPORT void
+    fdb_transaction_atomic_op( FDBTransaction* tr, uint8_t const* key_name,
+                               int key_name_length, uint8_t const* param,
+                               int param_length, FDBMutationType operation_type );
+
+    DLLEXPORT void
+    fdb_transaction_clear( FDBTransaction* tr, uint8_t const* key_name,
+                           int key_name_length );
+
+    DLLEXPORT void fdb_transaction_clear_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, uint8_t const* end_key_name,
+        int end_key_name_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_watch( FDBTransaction *tr,
+                                                uint8_t const* key_name,
+                                                int key_name_length);
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_commit( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_get_committed_version( FDBTransaction* tr,
+                                           int64_t* out_version );
+
+    // This function intentionally returns an FDBFuture instead of an integer directly,
+    // so that calling this API can see the effect of previous mutations on the transaction.
+    // Specifically, mutations are applied asynchronously by the main thread. In order to
+    // see them, this call has to be serviced by the main thread too.
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_get_approximate_size(FDBTransaction* tr);
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_versionstamp( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_transaction_on_error( FDBTransaction* tr, fdb_error_t error );
+
+    DLLEXPORT void fdb_transaction_reset( FDBTransaction* tr );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_transaction_add_conflict_range(FDBTransaction *tr,
+                                       uint8_t const* begin_key_name,
+                                       int begin_key_name_length,
+                                       uint8_t const* end_key_name,
+                                       int end_key_name_length,
+                                       FDBConflictRangeType type);
+
+    #define FDB_KEYSEL_LAST_LESS_THAN(k, l) k, l, 0, 0
+    #define FDB_KEYSEL_LAST_LESS_OR_EQUAL(k, l) k, l, 1, 0
+    #define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
+    #define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_select_api_version_impl( int runtime_version, int header_version );
+
+    DLLEXPORT int fdb_get_max_api_version();
+    DLLEXPORT const char* fdb_get_client_version();
+
+    /* LEGACY API VERSIONS */
+
+#if FDB_API_VERSION < 620
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_version( FDBFuture* f, int64_t* out_version );
+#else
+    #define fdb_future_get_version(f, ov) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 610 || defined FDB_INCLUDE_LEGACY_TYPES
+    typedef struct FDB_cluster FDBCluster;
+
+    typedef enum {
+        // This option is only a placeholder for C compatibility and should not be used
+        FDB_CLUSTER_OPTION_DUMMY_DO_NOT_USE=-1
+    } FDBClusterOption;
+#endif
+
+#if FDB_API_VERSION < 610
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_cluster( FDBFuture* f, FDBCluster** out_cluster );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_database( FDBFuture* f, FDBDatabase** out_database );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_create_cluster( const char* cluster_file_path );
+
+    DLLEXPORT void fdb_cluster_destroy( FDBCluster* c );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_cluster_set_option( FDBCluster* c, FDBClusterOption option,
+                            uint8_t const* value, int value_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture*
+    fdb_cluster_create_database( FDBCluster* c, uint8_t const* db_name,
+                                 int db_name_length );
+#else
+    #define fdb_future_get_cluster(f, oc) FDB_REMOVED_FUNCTION
+    #define fdb_future_get_database(f, od) FDB_REMOVED_FUNCTION
+    #define fdb_create_cluster(cfp) FDB_REMOVED_FUNCTION
+    #define fdb_cluster_destroy(c) FDB_REMOVED_FUNCTION
+    #define fdb_cluster_set_option(c, o, v, vl) FDB_REMOVED_FUNCTION
+    #define fdb_cluster_create_database(c, dn, dnl) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 23
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t
+    fdb_future_get_error( FDBFuture* f,
+                          const char** out_description /* = NULL */ );
+
+    DLLEXPORT fdb_bool_t fdb_future_is_error( FDBFuture* f );
+#else
+    #define fdb_future_is_error(x) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 14
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(
+        FDBFuture* f, FDBKeyValue const** out_kv, int* out_count );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(
+        FDBTransaction* tr, uint8_t const* key_name, int key_name_length );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(
+        FDBTransaction* tr, uint8_t const* key_name, int key_name_length,
+        fdb_bool_t or_equal, int offset );
+
+    DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network( const char* local_address );
+
+    DLLEXPORT void fdb_transaction_set_option(
+        FDBTransaction* tr, FDBTransactionOption option );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, uint8_t const* end_key_name,
+        int end_key_name_length, int limit );
+
+    DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_selector(
+        FDBTransaction* tr, uint8_t const* begin_key_name,
+        int begin_key_name_length, fdb_bool_t begin_or_equal,
+        int begin_offset, uint8_t const* end_key_name,
+        int end_key_name_length, fdb_bool_t end_or_equal, int end_offset,
+        int limit );
+#else
+    #define fdb_transaction_get_range_selector(tr,bkn,bknl,boe,bo,ekn,eknl,eoe,eo,lim) FDB_REMOVED_FUNCTION
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/620/fdb_c_options.g.h b/bindings/rust/foundationdb-sys/include/620/fdb_c_options.g.h
new file mode 100644
index 00000000000..359d98ae441
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/620/fdb_c_options.g.h
@@ -0,0 +1,421 @@
+#ifndef FDB_C_OPTIONS_G_H
+#define FDB_C_OPTIONS_G_H
+#pragma once
+
+/*
+ * FoundationDB C API
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+typedef enum {
+    // Deprecated
+    // Parameter: (String) IP:PORT
+    FDB_NET_OPTION_LOCAL_ADDRESS=10,
+
+    // Deprecated
+    // Parameter: (String) path to cluster file
+    FDB_NET_OPTION_CLUSTER_FILE=20,
+
+    // Enables trace output to a file in a directory of the clients choosing
+    // Parameter: (String) path to output directory (or NULL for current working directory)
+    FDB_NET_OPTION_TRACE_ENABLE=30,
+
+    // Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes.
+    // Parameter: (Int) max size of a single trace output file
+    FDB_NET_OPTION_TRACE_ROLL_SIZE=31,
+
+    // Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time.
+    // Parameter: (Int) max total size of trace files
+    FDB_NET_OPTION_TRACE_MAX_LOGS_SIZE=32,
+
+    // Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'.
+    // Parameter: (String) value of the LogGroup attribute
+    FDB_NET_OPTION_TRACE_LOG_GROUP=33,
+
+    // Select the format of the log files. xml (the default) and json are supported.
+    // Parameter: (String) Format of trace files
+    FDB_NET_OPTION_TRACE_FORMAT=34,
+
+    // Set internal tuning or debugging knobs
+    // Parameter: (String) knob_name=knob_value
+    FDB_NET_OPTION_KNOB=40,
+
+    // Deprecated
+    // Parameter: (String) file path or linker-resolved name
+    FDB_NET_OPTION_TLS_PLUGIN=41,
+
+    // Set the certificate chain
+    // Parameter: (Bytes) certificates
+    FDB_NET_OPTION_TLS_CERT_BYTES=42,
+
+    // Set the file from which to load the certificate chain
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CERT_PATH=43,
+
+    // Set the private key corresponding to your own certificate
+    // Parameter: (Bytes) key
+    FDB_NET_OPTION_TLS_KEY_BYTES=45,
+
+    // Set the file from which to load the private key corresponding to your own certificate
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_KEY_PATH=46,
+
+    // Set the peer certificate field verification criteria
+    // Parameter: (Bytes) verification pattern
+    FDB_NET_OPTION_TLS_VERIFY_PEERS=47,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_ENABLE=48,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_DISABLE=49,
+
+    // Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed.
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=50,
+
+    // Set the probability of an active BUGGIFY section being fired
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_FIRED_PROBABILITY=51,
+
+    // Set the ca bundle
+    // Parameter: (Bytes) ca bundle
+    FDB_NET_OPTION_TLS_CA_BYTES=52,
+
+    // Set the file from which to load the certificate authority bundle
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CA_PATH=53,
+
+    // Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used.
+    // Parameter: (String) key passphrase
+    FDB_NET_OPTION_TLS_PASSWORD=54,
+
+    // Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_MULTI_VERSION_CLIENT_API=60,
+
+    // If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_CALLBACKS_ON_EXTERNAL_THREADS=61,
+
+    // Adds an external client library for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to client library
+    FDB_NET_OPTION_EXTERNAL_CLIENT_LIBRARY=62,
+
+    // Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to directory containing client libraries
+    FDB_NET_OPTION_EXTERNAL_CLIENT_DIRECTORY=63,
+
+    // Prevents connections through the local client, allowing only connections through externally loaded client libraries. Intended primarily for testing.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_LOCAL_CLIENT=64,
+
+    // Disables logging of client statistics, such as sampled transaction activity.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_CLIENT_STATISTICS_LOGGING=70,
+
+    // Enables debugging feature to perform slow task profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_ENABLE_SLOW_TASK_PROFILING=71,
+
+    // Enable client buggify - will make requests randomly fail (intended for client testing)
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_CLIENT_BUGGIFY_ENABLE=80,
+
+    // Disable client buggify
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_CLIENT_BUGGIFY_DISABLE=81,
+
+    // Set the probability of a CLIENT_BUGGIFY section being active for the current execution.
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=82,
+
+    // Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_FIRED_PROBABILITY=83
+} FDBNetworkOption;
+
+typedef enum {
+    // Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000.
+    // Parameter: (Int) Max location cache entries
+    FDB_DB_OPTION_LOCATION_CACHE_SIZE=10,
+
+    // Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000.
+    // Parameter: (Int) Max outstanding watches
+    FDB_DB_OPTION_MAX_WATCHES=20,
+
+    // Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_MACHINE_ID=21,
+
+    // Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_DATACENTER_ID=22,
+
+    // Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior.
+    // Parameter: Option takes no parameter
+    FDB_DB_OPTION_SNAPSHOT_RYW_ENABLE=26,
+
+    // Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300.
+    // Parameter: Option takes no parameter
+    FDB_DB_OPTION_SNAPSHOT_RYW_DISABLE=27,
+
+    // Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information.
+    // Parameter: (Int) Maximum length of escaped key and value fields.
+    FDB_DB_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    // Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher.
+    // Parameter: (Int) value in milliseconds of timeout
+    FDB_DB_OPTION_TRANSACTION_TIMEOUT=500,
+
+    // Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information.
+    // Parameter: (Int) number of times to retry
+    FDB_DB_OPTION_TRANSACTION_RETRY_LIMIT=501,
+
+    // Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information.
+    // Parameter: (Int) value in milliseconds of maximum delay
+    FDB_DB_OPTION_TRANSACTION_MAX_RETRY_DELAY=502,
+
+    // Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information.
+    // Parameter: (Int) value in bytes
+    FDB_DB_OPTION_TRANSACTION_SIZE_LIMIT=503,
+
+    // The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock.
+    // Parameter: Option takes no parameter
+    FDB_DB_OPTION_TRANSACTION_CAUSAL_READ_RISKY=504,
+
+    // Addresses returned by get_addresses_for_key include the port when enabled. This will be enabled by default in api version 630, and this option will be deprecated.
+    // Parameter: Option takes no parameter
+    FDB_DB_OPTION_TRANSACTION_INCLUDE_PORT_IN_ADDRESS=505
+} FDBDatabaseOption;
+
+typedef enum {
+    // The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_WRITE_RISKY=10,
+
+    // The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_RISKY=20,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_DISABLE=21,
+
+    // Addresses returned by get_addresses_for_key include the port when enabled. This will be enabled by default in api version 630, and this option will be deprecated.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_INCLUDE_PORT_IN_ADDRESS=23,
+
+    // The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_NEXT_WRITE_NO_WRITE_CONFLICT_RANGE=30,
+
+    // Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE=51,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_AHEAD_DISABLE=52,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DATACENTER=110,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_RISKY=120,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DEV_NULL_IS_WEB_SCALE=130,
+
+    // Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_SYSTEM_IMMEDIATE=200,
+
+    // Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_BATCH=201,
+
+    // This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_INITIALIZE_NEW_DATABASE=300,
+
+    // Allows this transaction to read and modify system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_ACCESS_SYSTEM_KEYS=301,
+
+    // Allows this transaction to read system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_SYSTEM_KEYS=302,
+
+    // 
+    // Parameter: (String) Optional transaction name
+    FDB_TR_OPTION_DEBUG_RETRY_LOGGING=401,
+
+    // Deprecated
+    // Parameter: (String) String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters.
+    FDB_TR_OPTION_TRANSACTION_LOGGING_ENABLE=402,
+
+    // Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled.
+    // Parameter: (String) String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters.
+    FDB_TR_OPTION_DEBUG_TRANSACTION_IDENTIFIER=403,
+
+    // Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_LOG_TRANSACTION=404,
+
+    // Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation.
+    // Parameter: (Int) Maximum length of escaped key and value fields.
+    FDB_TR_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    // Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option.
+    // Parameter: (Int) value in milliseconds of timeout
+    FDB_TR_OPTION_TIMEOUT=500,
+
+    // Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option.
+    // Parameter: (Int) number of times to retry
+    FDB_TR_OPTION_RETRY_LIMIT=501,
+
+    // Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option.
+    // Parameter: (Int) value in milliseconds of maximum delay
+    FDB_TR_OPTION_MAX_RETRY_DELAY=502,
+
+    // Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit.
+    // Parameter: (Int) value in bytes
+    FDB_TR_OPTION_SIZE_LIMIT=503,
+
+    // Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_ENABLE=600,
+
+    // Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_DISABLE=601,
+
+    // The transaction can read and write to locked databases, and is responsible for checking that it took the lock.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_LOCK_AWARE=700,
+
+    // By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    // The transaction can read from locked databases.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_LOCK_AWARE=702,
+
+    // This option should only be used by tools which change the database configuration.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_USE_PROVISIONAL_PROXIES=711
+} FDBTransactionOption;
+
+typedef enum {
+    // Client intends to consume the entire range and would like it all transferred as early as possible.
+    FDB_STREAMING_MODE_WANT_ALL=-2,
+
+    // The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL``
+    FDB_STREAMING_MODE_ITERATOR=-1,
+
+    // Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used.
+    FDB_STREAMING_MODE_EXACT=0,
+
+    // Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early.
+    FDB_STREAMING_MODE_SMALL=1,
+
+    // Infrequently used. Transfer data in batches sized in between small and large.
+    FDB_STREAMING_MODE_MEDIUM=2,
+
+    // Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode.
+    FDB_STREAMING_MODE_LARGE=3,
+
+    // Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted.
+    FDB_STREAMING_MODE_SERIAL=4
+} FDBStreamingMode;
+
+typedef enum {
+    // Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow.
+    FDB_MUTATION_TYPE_ADD=2,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_AND=6,
+
+    // Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_AND=6,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_OR=7,
+
+    // Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_OR=7,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_XOR=8,
+
+    // Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_XOR=8,
+
+    // Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size.
+    FDB_MUTATION_TYPE_APPEND_IF_FITS=9,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MAX=12,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MIN=13,
+
+    // Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_KEY=14,
+
+    // Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_VALUE=15,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MIN=16,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MAX=17,
+
+    // Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared.
+    FDB_MUTATION_TYPE_COMPARE_AND_CLEAR=20
+} FDBMutationType;
+
+typedef enum {
+    // Used to add a read conflict range
+    FDB_CONFLICT_RANGE_TYPE_READ=0,
+
+    // Used to add a write conflict range
+    FDB_CONFLICT_RANGE_TYPE_WRITE=1
+} FDBConflictRangeType;
+
+typedef enum {
+    // Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error.
+    FDB_ERROR_PREDICATE_RETRYABLE=50000,
+
+    // Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify.
+    FDB_ERROR_PREDICATE_MAYBE_COMMITTED=50001,
+
+    // Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried.
+    FDB_ERROR_PREDICATE_RETRYABLE_NOT_COMMITTED=50002
+} FDBErrorPredicate;
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/620/version.txt b/bindings/rust/foundationdb-sys/include/620/version.txt
new file mode 100644
index 00000000000..1a87478a3f4
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/620/version.txt
@@ -0,0 +1 @@
+6.2.20
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-sys/include/630/fdb_c.h b/bindings/rust/foundationdb-sys/include/630/fdb_c.h
new file mode 100644
index 00000000000..30177d9614d
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/630/fdb_c.h
@@ -0,0 +1,374 @@
+/*
+ * fdb_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_H
+#define FDB_C_H
+#pragma once
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#if !defined(FDB_API_VERSION)
+#error You must #define FDB_API_VERSION prior to including fdb_c.h (current version is 630)
+#elif FDB_API_VERSION < 13
+#error API version no longer supported (upgrade to 13)
+#elif FDB_API_VERSION > 630
+#error Requested API version requires a newer version of this header
+#endif
+
+#if FDB_API_VERSION >= 23 && !defined(WARN_UNUSED_RESULT)
+#ifdef __GNUG__
+#define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+#define WARN_UNUSED_RESULT
+#endif
+#else
+#define WARN_UNUSED_RESULT
+#endif
+
+// With default settings, gcc will not warn about unprototyped functions being called, so it
+// is easy to erroneously call a function which is not available at FDB_API_VERSION and then
+// get an error only at runtime.  These macros ensure a compile error in such cases, and
+// attempt to make the compile error slightly informative.
+#define This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION()                                            \
+	{ == == = }
+#define FDB_REMOVED_FUNCTION This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION(0)
+
+#include <stdint.h>
+
+#include "fdb_c_options.g.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Pointers to these opaque types represent objects in the FDB API */
+typedef struct FDB_future FDBFuture;
+typedef struct FDB_database FDBDatabase;
+typedef struct FDB_transaction FDBTransaction;
+
+typedef int fdb_error_t;
+typedef int fdb_bool_t;
+
+DLLEXPORT const char* fdb_get_error(fdb_error_t code);
+
+DLLEXPORT fdb_bool_t fdb_error_predicate(int predicate_test, fdb_error_t code);
+
+#define /* fdb_error_t */ fdb_select_api_version(v) fdb_select_api_version_impl(v, FDB_API_VERSION)
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_network_set_option(FDBNetworkOption option,
+                                                                uint8_t const* value,
+                                                                int value_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network();
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_run_network();
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_stop_network();
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_add_network_thread_completion_hook(void (*hook)(void*),
+                                                                                void* hook_parameter);
+
+#pragma pack(push, 4)
+#if FDB_API_VERSION >= 630
+typedef struct keyvalue {
+	const uint8_t* key;
+	int key_length;
+	const uint8_t* value;
+	int value_length;
+} FDBKeyValue;
+#else
+typedef struct keyvalue {
+	const void* key;
+	int key_length;
+	const void* value;
+	int value_length;
+} FDBKeyValue;
+#endif
+#pragma pack(pop)
+
+DLLEXPORT void fdb_future_cancel(FDBFuture* f);
+
+DLLEXPORT void fdb_future_release_memory(FDBFuture* f);
+
+DLLEXPORT void fdb_future_destroy(FDBFuture* f);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_block_until_ready(FDBFuture* f);
+
+DLLEXPORT fdb_bool_t fdb_future_is_ready(FDBFuture* f);
+
+typedef void (*FDBCallback)(FDBFuture* future, void* callback_parameter);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_set_callback(FDBFuture* f,
+                                                                 FDBCallback callback,
+                                                                 void* callback_parameter);
+
+#if FDB_API_VERSION >= 23
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_error(FDBFuture* f);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_int64(FDBFuture* f, int64_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_key(FDBFuture* f, uint8_t const** out_key, int* out_key_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_value(FDBFuture* f,
+                                                              fdb_bool_t* out_present,
+                                                              uint8_t const** out_value,
+                                                              int* out_value_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(FDBFuture* f,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count,
+                                                                       fdb_bool_t* out_more);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_string_array(FDBFuture* f,
+                                                                     const char*** out_strings,
+                                                                     int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_create_database(const char* cluster_file_path, FDBDatabase** out_database);
+
+DLLEXPORT void fdb_database_destroy(FDBDatabase* d);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_set_option(FDBDatabase* d,
+                                                                 FDBDatabaseOption option,
+                                                                 uint8_t const* value,
+                                                                 int value_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_create_transaction(FDBDatabase* d,
+                                                                         FDBTransaction** out_transaction);
+
+DLLEXPORT void fdb_transaction_destroy(FDBTransaction* tr);
+
+DLLEXPORT void fdb_transaction_cancel(FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_set_option(FDBTransaction* tr,
+                                                                    FDBTransactionOption option,
+                                                                    uint8_t const* value,
+                                                                    int value_length);
+#endif
+
+DLLEXPORT void fdb_transaction_set_read_version(FDBTransaction* tr, int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_read_version(FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(FDBTransaction* tr,
+                                                            uint8_t const* key_name,
+                                                            int key_name_length,
+                                                            fdb_bool_t snapshot);
+#endif
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(FDBTransaction* tr,
+                                                                uint8_t const* key_name,
+                                                                int key_name_length,
+                                                                fdb_bool_t or_equal,
+                                                                int offset,
+                                                                fdb_bool_t snapshot);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_addresses_for_key(FDBTransaction* tr,
+                                                                              uint8_t const* key_name,
+                                                                              int key_name_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(FDBTransaction* tr,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  fdb_bool_t begin_or_equal,
+                                                                  int begin_offset,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length,
+                                                                  fdb_bool_t end_or_equal,
+                                                                  int end_offset,
+                                                                  int limit,
+                                                                  int target_bytes,
+                                                                  FDBStreamingMode mode,
+                                                                  int iteration,
+                                                                  fdb_bool_t snapshot,
+                                                                  fdb_bool_t reverse);
+#endif
+
+DLLEXPORT void fdb_transaction_set(FDBTransaction* tr,
+                                   uint8_t const* key_name,
+                                   int key_name_length,
+                                   uint8_t const* value,
+                                   int value_length);
+
+DLLEXPORT void fdb_transaction_atomic_op(FDBTransaction* tr,
+                                         uint8_t const* key_name,
+                                         int key_name_length,
+                                         uint8_t const* param,
+                                         int param_length,
+                                         FDBMutationType operation_type);
+
+DLLEXPORT void fdb_transaction_clear(FDBTransaction* tr, uint8_t const* key_name, int key_name_length);
+
+DLLEXPORT void fdb_transaction_clear_range(FDBTransaction* tr,
+                                           uint8_t const* begin_key_name,
+                                           int begin_key_name_length,
+                                           uint8_t const* end_key_name,
+                                           int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_watch(FDBTransaction* tr,
+                                                              uint8_t const* key_name,
+                                                              int key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_commit(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_get_committed_version(FDBTransaction* tr,
+                                                                               int64_t* out_version);
+
+// This function intentionally returns an FDBFuture instead of an integer directly,
+// so that calling this API can see the effect of previous mutations on the transaction.
+// Specifically, mutations are applied asynchronously by the main thread. In order to
+// see them, this call has to be serviced by the main thread too.
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_approximate_size(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_versionstamp(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_on_error(FDBTransaction* tr, fdb_error_t error);
+
+DLLEXPORT void fdb_transaction_reset(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_add_conflict_range(FDBTransaction* tr,
+                                                                            uint8_t const* begin_key_name,
+                                                                            int begin_key_name_length,
+                                                                            uint8_t const* end_key_name,
+                                                                            int end_key_name_length,
+                                                                            FDBConflictRangeType type);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_estimated_range_size_bytes(FDBTransaction* tr,
+                                                                                       uint8_t const* begin_key_name,
+                                                                                       int begin_key_name_length,
+                                                                                       uint8_t const* end_key_name,
+                                                                                       int end_key_name_length);
+
+#define FDB_KEYSEL_LAST_LESS_THAN(k, l) k, l, 0, 0
+#define FDB_KEYSEL_LAST_LESS_OR_EQUAL(k, l) k, l, 1, 0
+#define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
+#define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_select_api_version_impl(int runtime_version, int header_version);
+
+DLLEXPORT int fdb_get_max_api_version();
+DLLEXPORT const char* fdb_get_client_version();
+
+/* LEGACY API VERSIONS */
+
+#if FDB_API_VERSION < 620
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_version(FDBFuture* f, int64_t* out_version);
+#else
+#define fdb_future_get_version(f, ov) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 610 || defined FDB_INCLUDE_LEGACY_TYPES
+typedef struct FDB_cluster FDBCluster;
+
+typedef enum {
+	// This option is only a placeholder for C compatibility and should not be used
+	FDB_CLUSTER_OPTION_DUMMY_DO_NOT_USE = -1
+} FDBClusterOption;
+#endif
+
+#if FDB_API_VERSION < 610
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_cluster(FDBFuture* f, FDBCluster** out_cluster);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_database(FDBFuture* f, FDBDatabase** out_database);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_create_cluster(const char* cluster_file_path);
+
+DLLEXPORT void fdb_cluster_destroy(FDBCluster* c);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_cluster_set_option(FDBCluster* c,
+                                                                FDBClusterOption option,
+                                                                uint8_t const* value,
+                                                                int value_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_cluster_create_database(FDBCluster* c,
+                                                                    uint8_t const* db_name,
+                                                                    int db_name_length);
+#else
+#define fdb_future_get_cluster(f, oc) FDB_REMOVED_FUNCTION
+#define fdb_future_get_database(f, od) FDB_REMOVED_FUNCTION
+#define fdb_create_cluster(cfp) FDB_REMOVED_FUNCTION
+#define fdb_cluster_destroy(c) FDB_REMOVED_FUNCTION
+#define fdb_cluster_set_option(c, o, v, vl) FDB_REMOVED_FUNCTION
+#define fdb_cluster_create_database(c, dn, dnl) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 23
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_error(FDBFuture* f, const char** out_description /* = NULL */);
+
+DLLEXPORT fdb_bool_t fdb_future_is_error(FDBFuture* f);
+#else
+#define fdb_future_is_error(x) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(FDBFuture* f,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(FDBTransaction* tr,
+                                                            uint8_t const* key_name,
+                                                            int key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(FDBTransaction* tr,
+                                                                uint8_t const* key_name,
+                                                                int key_name_length,
+                                                                fdb_bool_t or_equal,
+                                                                int offset);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network(const char* local_address);
+
+DLLEXPORT void fdb_transaction_set_option(FDBTransaction* tr, FDBTransactionOption option);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(FDBTransaction* tr,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length,
+                                                                  int limit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_selector(FDBTransaction* tr,
+                                                                           uint8_t const* begin_key_name,
+                                                                           int begin_key_name_length,
+                                                                           fdb_bool_t begin_or_equal,
+                                                                           int begin_offset,
+                                                                           uint8_t const* end_key_name,
+                                                                           int end_key_name_length,
+                                                                           fdb_bool_t end_or_equal,
+                                                                           int end_offset,
+                                                                           int limit);
+#else
+#define fdb_transaction_get_range_selector(tr, bkn, bknl, boe, bo, ekn, eknl, eoe, eo, lim) FDB_REMOVED_FUNCTION
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/630/fdb_c_options.g.h b/bindings/rust/foundationdb-sys/include/630/fdb_c_options.g.h
new file mode 100644
index 00000000000..93524d8649b
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/630/fdb_c_options.g.h
@@ -0,0 +1,457 @@
+#ifndef FDB_C_OPTIONS_G_H
+#define FDB_C_OPTIONS_G_H
+#pragma once
+
+/*
+ * FoundationDB C API
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+typedef enum {
+    // Deprecated
+    // Parameter: (String) IP:PORT
+    FDB_NET_OPTION_LOCAL_ADDRESS=10,
+
+    // Deprecated
+    // Parameter: (String) path to cluster file
+    FDB_NET_OPTION_CLUSTER_FILE=20,
+
+    // Enables trace output to a file in a directory of the clients choosing
+    // Parameter: (String) path to output directory (or NULL for current working directory)
+    FDB_NET_OPTION_TRACE_ENABLE=30,
+
+    // Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes.
+    // Parameter: (Int) max size of a single trace output file
+    FDB_NET_OPTION_TRACE_ROLL_SIZE=31,
+
+    // Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time.
+    // Parameter: (Int) max total size of trace files
+    FDB_NET_OPTION_TRACE_MAX_LOGS_SIZE=32,
+
+    // Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'.
+    // Parameter: (String) value of the LogGroup attribute
+    FDB_NET_OPTION_TRACE_LOG_GROUP=33,
+
+    // Select the format of the log files. xml (the default) and json are supported.
+    // Parameter: (String) Format of trace files
+    FDB_NET_OPTION_TRACE_FORMAT=34,
+
+    // Select clock source for trace files. now (the default) or realtime are supported.
+    // Parameter: (String) Trace clock source
+    FDB_NET_OPTION_TRACE_CLOCK_SOURCE=35,
+
+    // Once provided, this string will be used to replace the port/PID in the log file names.
+    // Parameter: (String) The identifier that will be part of all trace file names
+    FDB_NET_OPTION_TRACE_FILE_IDENTIFIER=36,
+
+    // Set internal tuning or debugging knobs
+    // Parameter: (String) knob_name=knob_value
+    FDB_NET_OPTION_KNOB=40,
+
+    // Deprecated
+    // Parameter: (String) file path or linker-resolved name
+    FDB_NET_OPTION_TLS_PLUGIN=41,
+
+    // Set the certificate chain
+    // Parameter: (Bytes) certificates
+    FDB_NET_OPTION_TLS_CERT_BYTES=42,
+
+    // Set the file from which to load the certificate chain
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CERT_PATH=43,
+
+    // Set the private key corresponding to your own certificate
+    // Parameter: (Bytes) key
+    FDB_NET_OPTION_TLS_KEY_BYTES=45,
+
+    // Set the file from which to load the private key corresponding to your own certificate
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_KEY_PATH=46,
+
+    // Set the peer certificate field verification criteria
+    // Parameter: (Bytes) verification pattern
+    FDB_NET_OPTION_TLS_VERIFY_PEERS=47,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_ENABLE=48,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_BUGGIFY_DISABLE=49,
+
+    // Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed.
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=50,
+
+    // Set the probability of an active BUGGIFY section being fired
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_BUGGIFY_SECTION_FIRED_PROBABILITY=51,
+
+    // Set the ca bundle
+    // Parameter: (Bytes) ca bundle
+    FDB_NET_OPTION_TLS_CA_BYTES=52,
+
+    // Set the file from which to load the certificate authority bundle
+    // Parameter: (String) file path
+    FDB_NET_OPTION_TLS_CA_PATH=53,
+
+    // Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used.
+    // Parameter: (String) key passphrase
+    FDB_NET_OPTION_TLS_PASSWORD=54,
+
+    // Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_MULTI_VERSION_CLIENT_API=60,
+
+    // If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_CALLBACKS_ON_EXTERNAL_THREADS=61,
+
+    // Adds an external client library for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to client library
+    FDB_NET_OPTION_EXTERNAL_CLIENT_LIBRARY=62,
+
+    // Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network.
+    // Parameter: (String) path to directory containing client libraries
+    FDB_NET_OPTION_EXTERNAL_CLIENT_DIRECTORY=63,
+
+    // Prevents connections through the local client, allowing only connections through externally loaded client libraries.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_LOCAL_CLIENT=64,
+
+    // Spawns multiple worker threads for each version of the client that is loaded.  Setting this to a number greater than one implies disable_local_client.
+    // Parameter: (Int) Number of client threads to be spawned.  Each cluster will be serviced by a single client thread.
+    FDB_NET_OPTION_CLIENT_THREADS_PER_VERSION=65,
+
+    // Disables logging of client statistics, such as sampled transaction activity.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_DISABLE_CLIENT_STATISTICS_LOGGING=70,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_ENABLE_SLOW_TASK_PROFILING=71,
+
+    // Enables debugging feature to perform run loop profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production.
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_ENABLE_RUN_LOOP_PROFILING=71,
+
+    // Enable client buggify - will make requests randomly fail (intended for client testing)
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_CLIENT_BUGGIFY_ENABLE=80,
+
+    // Disable client buggify
+    // Parameter: Option takes no parameter
+    FDB_NET_OPTION_CLIENT_BUGGIFY_DISABLE=81,
+
+    // Set the probability of a CLIENT_BUGGIFY section being active for the current execution.
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=82,
+
+    // Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated
+    // Parameter: (Int) probability expressed as a percentage between 0 and 100
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_FIRED_PROBABILITY=83
+} FDBNetworkOption;
+
+typedef enum {
+    // Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000.
+    // Parameter: (Int) Max location cache entries
+    FDB_DB_OPTION_LOCATION_CACHE_SIZE=10,
+
+    // Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000.
+    // Parameter: (Int) Max outstanding watches
+    FDB_DB_OPTION_MAX_WATCHES=20,
+
+    // Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_MACHINE_ID=21,
+
+    // Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing.
+    // Parameter: (String) Hexadecimal ID
+    FDB_DB_OPTION_DATACENTER_ID=22,
+
+    // Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior.
+    // Parameter: Option takes no parameter
+    FDB_DB_OPTION_SNAPSHOT_RYW_ENABLE=26,
+
+    // Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300.
+    // Parameter: Option takes no parameter
+    FDB_DB_OPTION_SNAPSHOT_RYW_DISABLE=27,
+
+    // Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information.
+    // Parameter: (Int) Maximum length of escaped key and value fields.
+    FDB_DB_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    // Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher.
+    // Parameter: (Int) value in milliseconds of timeout
+    FDB_DB_OPTION_TRANSACTION_TIMEOUT=500,
+
+    // Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information.
+    // Parameter: (Int) number of times to retry
+    FDB_DB_OPTION_TRANSACTION_RETRY_LIMIT=501,
+
+    // Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information.
+    // Parameter: (Int) value in milliseconds of maximum delay
+    FDB_DB_OPTION_TRANSACTION_MAX_RETRY_DELAY=502,
+
+    // Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information.
+    // Parameter: (Int) value in bytes
+    FDB_DB_OPTION_TRANSACTION_SIZE_LIMIT=503,
+
+    // The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock.
+    // Parameter: Option takes no parameter
+    FDB_DB_OPTION_TRANSACTION_CAUSAL_READ_RISKY=504,
+
+    // Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect.
+    // Parameter: Option takes no parameter
+    FDB_DB_OPTION_TRANSACTION_INCLUDE_PORT_IN_ADDRESS=505
+} FDBDatabaseOption;
+
+typedef enum {
+    // The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_WRITE_RISKY=10,
+
+    // The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_RISKY=20,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_CAUSAL_READ_DISABLE=21,
+
+    // Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_INCLUDE_PORT_IN_ADDRESS=23,
+
+    // The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_NEXT_WRITE_NO_WRITE_CONFLICT_RANGE=30,
+
+    // Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE=51,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_AHEAD_DISABLE=52,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DATACENTER=110,
+
+    // 
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_RISKY=120,
+
+    // Deprecated
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_DURABILITY_DEV_NULL_IS_WEB_SCALE=130,
+
+    // Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_SYSTEM_IMMEDIATE=200,
+
+    // Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_PRIORITY_BATCH=201,
+
+    // This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_INITIALIZE_NEW_DATABASE=300,
+
+    // Allows this transaction to read and modify system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_ACCESS_SYSTEM_KEYS=301,
+
+    // Allows this transaction to read system keys (those that start with the byte 0xFF)
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_SYSTEM_KEYS=302,
+
+    // 
+    // Parameter: (String) Optional transaction name
+    FDB_TR_OPTION_DEBUG_RETRY_LOGGING=401,
+
+    // Deprecated
+    // Parameter: (String) String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters.
+    FDB_TR_OPTION_TRANSACTION_LOGGING_ENABLE=402,
+
+    // Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled.
+    // Parameter: (String) String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters.
+    FDB_TR_OPTION_DEBUG_TRANSACTION_IDENTIFIER=403,
+
+    // Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_LOG_TRANSACTION=404,
+
+    // Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation.
+    // Parameter: (Int) Maximum length of escaped key and value fields.
+    FDB_TR_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    // Sets an identifier for server tracing of this transaction. When committed, this identifier triggers logging when each part of the transaction authority encounters it, which is helpful in diagnosing slowness in misbehaving clusters. The identifier is randomly generated. When there is also a debug_transaction_identifier, both IDs are logged together.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SERVER_REQUEST_TRACING=406,
+
+    // Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option.
+    // Parameter: (Int) value in milliseconds of timeout
+    FDB_TR_OPTION_TIMEOUT=500,
+
+    // Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option.
+    // Parameter: (Int) number of times to retry
+    FDB_TR_OPTION_RETRY_LIMIT=501,
+
+    // Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option.
+    // Parameter: (Int) value in milliseconds of maximum delay
+    FDB_TR_OPTION_MAX_RETRY_DELAY=502,
+
+    // Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit.
+    // Parameter: (Int) value in bytes
+    FDB_TR_OPTION_SIZE_LIMIT=503,
+
+    // Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_ENABLE=600,
+
+    // Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SNAPSHOT_RYW_DISABLE=601,
+
+    // The transaction can read and write to locked databases, and is responsible for checking that it took the lock.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_LOCK_AWARE=700,
+
+    // By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    // The transaction can read from locked databases.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_READ_LOCK_AWARE=702,
+
+    // This option should only be used by tools which change the database configuration.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_USE_PROVISIONAL_PROXIES=711,
+
+    // The transaction can retrieve keys that are conflicting with other transactions.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_REPORT_CONFLICTING_KEYS=712,
+
+    // By default, the special key space will only allow users to read from exactly one module (a subspace in the special key space). Use this option to allow reading from zero or more modules. Users who set this option should be prepared for new modules, which may have different behaviors than the modules they're currently reading. For example, a new module might block or return an error.
+    // Parameter: Option takes no parameter
+    FDB_TR_OPTION_SPECIAL_KEY_SPACE_RELAXED=713,
+
+    // Adds a tag to the transaction that can be used to apply manual targeted throttling. At most 5 tags can be set on a transaction.
+    // Parameter: (String) String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters.
+    FDB_TR_OPTION_TAG=800,
+
+    // Adds a tag to the transaction that can be used to apply manual or automatic targeted throttling. At most 5 tags can be set on a transaction.
+    // Parameter: (String) String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters.
+    FDB_TR_OPTION_AUTO_THROTTLE_TAG=801
+} FDBTransactionOption;
+
+typedef enum {
+    // Client intends to consume the entire range and would like it all transferred as early as possible.
+    FDB_STREAMING_MODE_WANT_ALL=-2,
+
+    // The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL``
+    FDB_STREAMING_MODE_ITERATOR=-1,
+
+    // Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used.
+    FDB_STREAMING_MODE_EXACT=0,
+
+    // Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early.
+    FDB_STREAMING_MODE_SMALL=1,
+
+    // Infrequently used. Transfer data in batches sized in between small and large.
+    FDB_STREAMING_MODE_MEDIUM=2,
+
+    // Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode.
+    FDB_STREAMING_MODE_LARGE=3,
+
+    // Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted.
+    FDB_STREAMING_MODE_SERIAL=4
+} FDBStreamingMode;
+
+typedef enum {
+    // Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow.
+    FDB_MUTATION_TYPE_ADD=2,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_AND=6,
+
+    // Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_AND=6,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_OR=7,
+
+    // Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_OR=7,
+
+    // Deprecated
+    FDB_MUTATION_TYPE_XOR=8,
+
+    // Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``.
+    FDB_MUTATION_TYPE_BIT_XOR=8,
+
+    // Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size.
+    FDB_MUTATION_TYPE_APPEND_IF_FITS=9,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MAX=12,
+
+    // Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_MIN=13,
+
+    // Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_KEY=14,
+
+    // Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset.
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_VALUE=15,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MIN=16,
+
+    // Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database.
+    FDB_MUTATION_TYPE_BYTE_MAX=17,
+
+    // Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared.
+    FDB_MUTATION_TYPE_COMPARE_AND_CLEAR=20
+} FDBMutationType;
+
+typedef enum {
+    // Used to add a read conflict range
+    FDB_CONFLICT_RANGE_TYPE_READ=0,
+
+    // Used to add a write conflict range
+    FDB_CONFLICT_RANGE_TYPE_WRITE=1
+} FDBConflictRangeType;
+
+typedef enum {
+    // Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error.
+    FDB_ERROR_PREDICATE_RETRYABLE=50000,
+
+    // Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify.
+    FDB_ERROR_PREDICATE_MAYBE_COMMITTED=50001,
+
+    // Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried.
+    FDB_ERROR_PREDICATE_RETRYABLE_NOT_COMMITTED=50002
+} FDBErrorPredicate;
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/630/version.txt b/bindings/rust/foundationdb-sys/include/630/version.txt
new file mode 100644
index 00000000000..8bbf9a8d7aa
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/630/version.txt
@@ -0,0 +1 @@
+6.3.16
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-sys/include/700/fdb_c.h b/bindings/rust/foundationdb-sys/include/700/fdb_c.h
new file mode 100644
index 00000000000..cdae34fde09
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/700/fdb_c.h
@@ -0,0 +1,434 @@
+/*
+ * fdb_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_H
+#define FDB_C_H
+#pragma once
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#if !defined(FDB_API_VERSION)
+#error You must #define FDB_API_VERSION prior to including fdb_c.h (current version is 700)
+#elif FDB_API_VERSION < 13
+#error API version no longer supported (upgrade to 13)
+#elif FDB_API_VERSION > 700
+#error Requested API version requires a newer version of this header
+#endif
+
+#if FDB_API_VERSION >= 23 && !defined(WARN_UNUSED_RESULT)
+#ifdef __GNUG__
+#define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+#define WARN_UNUSED_RESULT
+#endif
+#else
+#define WARN_UNUSED_RESULT
+#endif
+
+/*
+ * With default settings, gcc will not warn about unprototyped functions being
+ * called, so it is easy to erroneously call a function which is not available
+ * at FDB_API_VERSION and then get an error only at runtime.  These macros
+ * ensure a compile error in such cases, and attempt to make the compile error
+ * slightly informative.
+ */
+#define This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION()                                            \
+	{ == == = }
+#define FDB_REMOVED_FUNCTION This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION(0)
+
+#include <stdint.h>
+
+#include "fdb_c_options.g.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Pointers to these opaque types represent objects in the FDB API */
+typedef struct FDB_future FDBFuture;
+typedef struct FDB_database FDBDatabase;
+typedef struct FDB_transaction FDBTransaction;
+
+typedef int fdb_error_t;
+typedef int fdb_bool_t;
+
+DLLEXPORT const char* fdb_get_error(fdb_error_t code);
+
+DLLEXPORT fdb_bool_t fdb_error_predicate(int predicate_test, fdb_error_t code);
+
+#define /* fdb_error_t */ fdb_select_api_version(v) fdb_select_api_version_impl(v, FDB_API_VERSION)
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_network_set_option(FDBNetworkOption option,
+                                                                uint8_t const* value,
+                                                                int value_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network();
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_run_network();
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_stop_network();
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_add_network_thread_completion_hook(void (*hook)(void*),
+                                                                                void* hook_parameter);
+
+#pragma pack(push, 4)
+typedef struct key {
+	const uint8_t* key;
+	int key_length;
+} FDBKey;
+#if FDB_API_VERSION >= 700
+typedef struct keyvalue {
+	const uint8_t* key;
+	int key_length;
+	const uint8_t* value;
+	int value_length;
+} FDBKeyValue;
+#else
+typedef struct keyvalue {
+	const void* key;
+	int key_length;
+	const void* value;
+	int value_length;
+} FDBKeyValue;
+#endif
+#pragma pack(pop)
+
+DLLEXPORT void fdb_future_cancel(FDBFuture* f);
+
+DLLEXPORT void fdb_future_release_memory(FDBFuture* f);
+
+DLLEXPORT void fdb_future_destroy(FDBFuture* f);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_block_until_ready(FDBFuture* f);
+
+DLLEXPORT fdb_bool_t fdb_future_is_ready(FDBFuture* f);
+
+typedef void (*FDBCallback)(FDBFuture* future, void* callback_parameter);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_set_callback(FDBFuture* f,
+                                                                 FDBCallback callback,
+                                                                 void* callback_parameter);
+
+#if FDB_API_VERSION >= 23
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_error(FDBFuture* f);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_int64(FDBFuture* f, int64_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_uint64(FDBFuture* f, uint64_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_key(FDBFuture* f, uint8_t const** out_key, int* out_key_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_value(FDBFuture* f,
+                                                              fdb_bool_t* out_present,
+                                                              uint8_t const** out_value,
+                                                              int* out_value_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(FDBFuture* f,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count,
+                                                                       fdb_bool_t* out_more);
+#endif
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_key_array(FDBFuture* f,
+                                                                  FDBKey const** out_key_array,
+                                                                  int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_string_array(FDBFuture* f,
+                                                                     const char*** out_strings,
+                                                                     int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_create_database(const char* cluster_file_path, FDBDatabase** out_database);
+
+DLLEXPORT void fdb_database_destroy(FDBDatabase* d);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_set_option(FDBDatabase* d,
+                                                                 FDBDatabaseOption option,
+                                                                 uint8_t const* value,
+                                                                 int value_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_create_transaction(FDBDatabase* d,
+                                                                         FDBTransaction** out_transaction);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_reboot_worker(FDBDatabase* db,
+                                                                   uint8_t const* address,
+                                                                   int address_length,
+                                                                   fdb_bool_t check,
+                                                                   int duration);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_force_recovery_with_data_loss(FDBDatabase* db,
+                                                                                   uint8_t const* dcid,
+                                                                                   int dcid_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_create_snapshot(FDBDatabase* db,
+                                                                     uint8_t const* uid,
+                                                                     int uid_length,
+                                                                     uint8_t const* snap_command,
+                                                                     int snap_command_length);
+
+DLLEXPORT WARN_UNUSED_RESULT double fdb_database_get_main_thread_busyness(FDBDatabase* db);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_get_server_protocol(FDBDatabase* db, uint64_t expected_version);
+
+DLLEXPORT void fdb_transaction_destroy(FDBTransaction* tr);
+
+DLLEXPORT void fdb_transaction_cancel(FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_set_option(FDBTransaction* tr,
+                                                                    FDBTransactionOption option,
+                                                                    uint8_t const* value,
+                                                                    int value_length);
+#endif
+
+DLLEXPORT void fdb_transaction_set_read_version(FDBTransaction* tr, int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_read_version(FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(FDBTransaction* tr,
+                                                            uint8_t const* key_name,
+                                                            int key_name_length,
+                                                            fdb_bool_t snapshot);
+#endif
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(FDBTransaction* tr,
+                                                                uint8_t const* key_name,
+                                                                int key_name_length,
+                                                                fdb_bool_t or_equal,
+                                                                int offset,
+                                                                fdb_bool_t snapshot);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_addresses_for_key(FDBTransaction* tr,
+                                                                              uint8_t const* key_name,
+                                                                              int key_name_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(FDBTransaction* tr,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  fdb_bool_t begin_or_equal,
+                                                                  int begin_offset,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length,
+                                                                  fdb_bool_t end_or_equal,
+                                                                  int end_offset,
+                                                                  int limit,
+                                                                  int target_bytes,
+                                                                  FDBStreamingMode mode,
+                                                                  int iteration,
+                                                                  fdb_bool_t snapshot,
+                                                                  fdb_bool_t reverse);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_and_flat_map(FDBTransaction* tr,
+                                                                               uint8_t const* begin_key_name,
+                                                                               int begin_key_name_length,
+                                                                               fdb_bool_t begin_or_equal,
+                                                                               int begin_offset,
+                                                                               uint8_t const* end_key_name,
+                                                                               int end_key_name_length,
+                                                                               fdb_bool_t end_or_equal,
+                                                                               int end_offset,
+                                                                               uint8_t const* mapper_name,
+                                                                               int mapper_name_length,
+                                                                               int limit,
+                                                                               int target_bytes,
+                                                                               FDBStreamingMode mode,
+                                                                               int iteration,
+                                                                               fdb_bool_t snapshot,
+                                                                               fdb_bool_t reverse);
+
+DLLEXPORT void fdb_transaction_set(FDBTransaction* tr,
+                                   uint8_t const* key_name,
+                                   int key_name_length,
+                                   uint8_t const* value,
+                                   int value_length);
+
+DLLEXPORT void fdb_transaction_atomic_op(FDBTransaction* tr,
+                                         uint8_t const* key_name,
+                                         int key_name_length,
+                                         uint8_t const* param,
+                                         int param_length,
+                                         FDBMutationType operation_type);
+
+DLLEXPORT void fdb_transaction_clear(FDBTransaction* tr, uint8_t const* key_name, int key_name_length);
+
+DLLEXPORT void fdb_transaction_clear_range(FDBTransaction* tr,
+                                           uint8_t const* begin_key_name,
+                                           int begin_key_name_length,
+                                           uint8_t const* end_key_name,
+                                           int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_watch(FDBTransaction* tr,
+                                                              uint8_t const* key_name,
+                                                              int key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_commit(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_get_committed_version(FDBTransaction* tr,
+                                                                               int64_t* out_version);
+
+/*
+ * This function intentionally returns an FDBFuture instead of an integer
+ * directly, so that calling this API can see the effect of previous
+ * mutations on the transaction. Specifically, mutations are applied
+ * asynchronously by the main thread. In order to see them, this call has to
+ * be serviced by the main thread too.
+ */
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_approximate_size(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_versionstamp(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_on_error(FDBTransaction* tr, fdb_error_t error);
+
+DLLEXPORT void fdb_transaction_reset(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_add_conflict_range(FDBTransaction* tr,
+                                                                            uint8_t const* begin_key_name,
+                                                                            int begin_key_name_length,
+                                                                            uint8_t const* end_key_name,
+                                                                            int end_key_name_length,
+                                                                            FDBConflictRangeType type);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_estimated_range_size_bytes(FDBTransaction* tr,
+                                                                                       uint8_t const* begin_key_name,
+                                                                                       int begin_key_name_length,
+                                                                                       uint8_t const* end_key_name,
+                                                                                       int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_split_points(FDBTransaction* tr,
+                                                                               uint8_t const* begin_key_name,
+                                                                               int begin_key_name_length,
+                                                                               uint8_t const* end_key_name,
+                                                                               int end_key_name_length,
+                                                                               int64_t chunk_size);
+
+#define FDB_KEYSEL_LAST_LESS_THAN(k, l) k, l, 0, 0
+#define FDB_KEYSEL_LAST_LESS_OR_EQUAL(k, l) k, l, 1, 0
+#define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
+#define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_select_api_version_impl(int runtime_version, int header_version);
+
+DLLEXPORT int fdb_get_max_api_version();
+DLLEXPORT const char* fdb_get_client_version();
+
+/* LEGACY API VERSIONS */
+
+#if FDB_API_VERSION < 620
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_version(FDBFuture* f, int64_t* out_version);
+#else
+#define fdb_future_get_version(f, ov) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 610 || defined FDB_INCLUDE_LEGACY_TYPES
+typedef struct FDB_cluster FDBCluster;
+
+typedef enum {
+	/* This option is only a placeholder for C compatibility and should not be used */
+	FDB_CLUSTER_OPTION_DUMMY_DO_NOT_USE = -1
+} FDBClusterOption;
+#endif
+
+#if FDB_API_VERSION < 610
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_cluster(FDBFuture* f, FDBCluster** out_cluster);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_database(FDBFuture* f, FDBDatabase** out_database);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_create_cluster(const char* cluster_file_path);
+
+DLLEXPORT void fdb_cluster_destroy(FDBCluster* c);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_cluster_set_option(FDBCluster* c,
+                                                                FDBClusterOption option,
+                                                                uint8_t const* value,
+                                                                int value_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_cluster_create_database(FDBCluster* c,
+                                                                    uint8_t const* db_name,
+                                                                    int db_name_length);
+#else
+#define fdb_future_get_cluster(f, oc) FDB_REMOVED_FUNCTION
+#define fdb_future_get_database(f, od) FDB_REMOVED_FUNCTION
+#define fdb_create_cluster(cfp) FDB_REMOVED_FUNCTION
+#define fdb_cluster_destroy(c) FDB_REMOVED_FUNCTION
+#define fdb_cluster_set_option(c, o, v, vl) FDB_REMOVED_FUNCTION
+#define fdb_cluster_create_database(c, dn, dnl) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 23
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_error(FDBFuture* f, const char** out_description /* = NULL */);
+
+DLLEXPORT fdb_bool_t fdb_future_is_error(FDBFuture* f);
+#else
+#define fdb_future_is_error(x) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(FDBFuture* f,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(FDBTransaction* tr,
+                                                            uint8_t const* key_name,
+                                                            int key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(FDBTransaction* tr,
+                                                                uint8_t const* key_name,
+                                                                int key_name_length,
+                                                                fdb_bool_t or_equal,
+                                                                int offset);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network(const char* local_address);
+
+DLLEXPORT void fdb_transaction_set_option(FDBTransaction* tr, FDBTransactionOption option);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(FDBTransaction* tr,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length,
+                                                                  int limit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_selector(FDBTransaction* tr,
+                                                                           uint8_t const* begin_key_name,
+                                                                           int begin_key_name_length,
+                                                                           fdb_bool_t begin_or_equal,
+                                                                           int begin_offset,
+                                                                           uint8_t const* end_key_name,
+                                                                           int end_key_name_length,
+                                                                           fdb_bool_t end_or_equal,
+                                                                           int end_offset,
+                                                                           int limit);
+#else
+#define fdb_transaction_get_range_selector(tr, bkn, bknl, boe, bo, ekn, eknl, eoe, eo, lim) FDB_REMOVED_FUNCTION
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/700/fdb_c_options.g.h b/bindings/rust/foundationdb-sys/include/700/fdb_c_options.g.h
new file mode 100644
index 00000000000..5b8e89e99db
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/700/fdb_c_options.g.h
@@ -0,0 +1,485 @@
+#ifndef FDB_C_OPTIONS_G_H
+#define FDB_C_OPTIONS_G_H
+#pragma once
+
+/*
+ * FoundationDB C API
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+typedef enum {
+    /* Deprecated */
+    /* Parameter: (String) IP:PORT */
+    FDB_NET_OPTION_LOCAL_ADDRESS=10,
+
+    /* Deprecated */
+    /* Parameter: (String) path to cluster file */
+    FDB_NET_OPTION_CLUSTER_FILE=20,
+
+    /* Enables trace output to a file in a directory of the clients choosing */
+    /* Parameter: (String) path to output directory (or NULL for current working directory) */
+    FDB_NET_OPTION_TRACE_ENABLE=30,
+
+    /* Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes. */
+    /* Parameter: (Int) max size of a single trace output file */
+    FDB_NET_OPTION_TRACE_ROLL_SIZE=31,
+
+    /* Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time. */
+    /* Parameter: (Int) max total size of trace files */
+    FDB_NET_OPTION_TRACE_MAX_LOGS_SIZE=32,
+
+    /* Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'. */
+    /* Parameter: (String) value of the LogGroup attribute */
+    FDB_NET_OPTION_TRACE_LOG_GROUP=33,
+
+    /* Select the format of the log files. xml (the default) and json are supported. */
+    /* Parameter: (String) Format of trace files */
+    FDB_NET_OPTION_TRACE_FORMAT=34,
+
+    /* Select clock source for trace files. now (the default) or realtime are supported. */
+    /* Parameter: (String) Trace clock source */
+    FDB_NET_OPTION_TRACE_CLOCK_SOURCE=35,
+
+    /* Once provided, this string will be used to replace the port/PID in the log file names. */
+    /* Parameter: (String) The identifier that will be part of all trace file names */
+    FDB_NET_OPTION_TRACE_FILE_IDENTIFIER=36,
+
+    /*  */
+    /* Parameter: (String) Append this suffix to partially written log files. When a log file is complete, it is renamed to remove the suffix. No separator is added between the file and the suffix. If you want to add a file extension, you should include the separator - e.g. '.tmp' instead of 'tmp' to add the 'tmp' extension. */
+    FDB_NET_OPTION_TRACE_PARTIAL_FILE_SUFFIX=39,
+
+    /* Set internal tuning or debugging knobs */
+    /* Parameter: (String) knob_name=knob_value */
+    FDB_NET_OPTION_KNOB=40,
+
+    /* Deprecated */
+    /* Parameter: (String) file path or linker-resolved name */
+    FDB_NET_OPTION_TLS_PLUGIN=41,
+
+    /* Set the certificate chain */
+    /* Parameter: (Bytes) certificates */
+    FDB_NET_OPTION_TLS_CERT_BYTES=42,
+
+    /* Set the file from which to load the certificate chain */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_CERT_PATH=43,
+
+    /* Set the private key corresponding to your own certificate */
+    /* Parameter: (Bytes) key */
+    FDB_NET_OPTION_TLS_KEY_BYTES=45,
+
+    /* Set the file from which to load the private key corresponding to your own certificate */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_KEY_PATH=46,
+
+    /* Set the peer certificate field verification criteria */
+    /* Parameter: (Bytes) verification pattern */
+    FDB_NET_OPTION_TLS_VERIFY_PEERS=47,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_BUGGIFY_ENABLE=48,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_BUGGIFY_DISABLE=49,
+
+    /* Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed. */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=50,
+
+    /* Set the probability of an active BUGGIFY section being fired */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_BUGGIFY_SECTION_FIRED_PROBABILITY=51,
+
+    /* Set the ca bundle */
+    /* Parameter: (Bytes) ca bundle */
+    FDB_NET_OPTION_TLS_CA_BYTES=52,
+
+    /* Set the file from which to load the certificate authority bundle */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_CA_PATH=53,
+
+    /* Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used. */
+    /* Parameter: (String) key passphrase */
+    FDB_NET_OPTION_TLS_PASSWORD=54,
+
+    /* Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_MULTI_VERSION_CLIENT_API=60,
+
+    /* If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CALLBACKS_ON_EXTERNAL_THREADS=61,
+
+    /* Adds an external client library for use by the multi-version client API. Must be set before setting up the network. */
+    /* Parameter: (String) path to client library */
+    FDB_NET_OPTION_EXTERNAL_CLIENT_LIBRARY=62,
+
+    /* Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network. */
+    /* Parameter: (String) path to directory containing client libraries */
+    FDB_NET_OPTION_EXTERNAL_CLIENT_DIRECTORY=63,
+
+    /* Prevents connections through the local client, allowing only connections through externally loaded client libraries. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_LOCAL_CLIENT=64,
+
+    /* Spawns multiple worker threads for each version of the client that is loaded.  Setting this to a number greater than one implies disable_local_client. */
+    /* Parameter: (Int) Number of client threads to be spawned.  Each cluster will be serviced by a single client thread. */
+    FDB_NET_OPTION_CLIENT_THREADS_PER_VERSION=65,
+
+    /* Disables logging of client statistics, such as sampled transaction activity. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_CLIENT_STATISTICS_LOGGING=70,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_ENABLE_SLOW_TASK_PROFILING=71,
+
+    /* Enables debugging feature to perform run loop profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_ENABLE_RUN_LOOP_PROFILING=71,
+
+    /* Enable client buggify - will make requests randomly fail (intended for client testing) */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_ENABLE=80,
+
+    /* Disable client buggify */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_DISABLE=81,
+
+    /* Set the probability of a CLIENT_BUGGIFY section being active for the current execution. */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=82,
+
+    /* Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_FIRED_PROBABILITY=83,
+
+    /* Set a tracer to run on the client. Should be set to the same value as the tracer set on the server. */
+    /* Parameter: (String) Distributed tracer type. Choose from none, log_file, or network_lossy */
+    FDB_NET_OPTION_DISTRIBUTED_CLIENT_TRACER=90
+} FDBNetworkOption;
+
+typedef enum {
+    /* Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000. */
+    /* Parameter: (Int) Max location cache entries */
+    FDB_DB_OPTION_LOCATION_CACHE_SIZE=10,
+
+    /* Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000. */
+    /* Parameter: (Int) Max outstanding watches */
+    FDB_DB_OPTION_MAX_WATCHES=20,
+
+    /* Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing. */
+    /* Parameter: (String) Hexadecimal ID */
+    FDB_DB_OPTION_MACHINE_ID=21,
+
+    /* Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing. */
+    /* Parameter: (String) Hexadecimal ID */
+    FDB_DB_OPTION_DATACENTER_ID=22,
+
+    /* Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_SNAPSHOT_RYW_ENABLE=26,
+
+    /* Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_SNAPSHOT_RYW_DISABLE=27,
+
+    /* Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) Maximum length of escaped key and value fields. */
+    FDB_DB_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    /* Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher. */
+    /* Parameter: (Int) value in milliseconds of timeout */
+    FDB_DB_OPTION_TRANSACTION_TIMEOUT=500,
+
+    /* Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) number of times to retry */
+    FDB_DB_OPTION_TRANSACTION_RETRY_LIMIT=501,
+
+    /* Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) value in milliseconds of maximum delay */
+    FDB_DB_OPTION_TRANSACTION_MAX_RETRY_DELAY=502,
+
+    /* Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) value in bytes */
+    FDB_DB_OPTION_TRANSACTION_SIZE_LIMIT=503,
+
+    /* The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_CAUSAL_READ_RISKY=504,
+
+    /* Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_INCLUDE_PORT_IN_ADDRESS=505,
+
+    /* Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. This sets the ``bypass_unreadable`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_BYPASS_UNREADABLE=700
+} FDBDatabaseOption;
+
+typedef enum {
+    /* The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_WRITE_RISKY=10,
+
+    /* The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_READ_RISKY=20,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_READ_DISABLE=21,
+
+    /* Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_INCLUDE_PORT_IN_ADDRESS=23,
+
+    /* The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_NEXT_WRITE_NO_WRITE_CONFLICT_RANGE=30,
+
+    /* Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction. It is an error to set this option after performing any reads or writes on the transaction. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE=51,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_AHEAD_DISABLE=52,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_DATACENTER=110,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_RISKY=120,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_DEV_NULL_IS_WEB_SCALE=130,
+
+    /* Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_PRIORITY_SYSTEM_IMMEDIATE=200,
+
+    /* Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_PRIORITY_BATCH=201,
+
+    /* This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_INITIALIZE_NEW_DATABASE=300,
+
+    /* Allows this transaction to read and modify system keys (those that start with the byte 0xFF) */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_ACCESS_SYSTEM_KEYS=301,
+
+    /* Allows this transaction to read system keys (those that start with the byte 0xFF) */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_SYSTEM_KEYS=302,
+
+    /*  */
+    /* Parameter: (String) Optional transaction name */
+    FDB_TR_OPTION_DEBUG_RETRY_LOGGING=401,
+
+    /* Deprecated */
+    /* Parameter: (String) String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters. */
+    FDB_TR_OPTION_TRANSACTION_LOGGING_ENABLE=402,
+
+    /* Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled. */
+    /* Parameter: (String) String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters. */
+    FDB_TR_OPTION_DEBUG_TRANSACTION_IDENTIFIER=403,
+
+    /* Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_LOG_TRANSACTION=404,
+
+    /* Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation. */
+    /* Parameter: (Int) Maximum length of escaped key and value fields. */
+    FDB_TR_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    /* Sets an identifier for server tracing of this transaction. When committed, this identifier triggers logging when each part of the transaction authority encounters it, which is helpful in diagnosing slowness in misbehaving clusters. The identifier is randomly generated. When there is also a debug_transaction_identifier, both IDs are logged together. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SERVER_REQUEST_TRACING=406,
+
+    /* Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) value in milliseconds of timeout */
+    FDB_TR_OPTION_TIMEOUT=500,
+
+    /* Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) number of times to retry */
+    FDB_TR_OPTION_RETRY_LIMIT=501,
+
+    /* Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) value in milliseconds of maximum delay */
+    FDB_TR_OPTION_MAX_RETRY_DELAY=502,
+
+    /* Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit. */
+    /* Parameter: (Int) value in bytes */
+    FDB_TR_OPTION_SIZE_LIMIT=503,
+
+    /* Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SNAPSHOT_RYW_ENABLE=600,
+
+    /* Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SNAPSHOT_RYW_DISABLE=601,
+
+    /* The transaction can read and write to locked databases, and is responsible for checking that it took the lock. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_LOCK_AWARE=700,
+
+    /* By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    /* The transaction can read from locked databases. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_LOCK_AWARE=702,
+
+    /* This option should only be used by tools which change the database configuration. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USE_PROVISIONAL_PROXIES=711,
+
+    /* The transaction can retrieve keys that are conflicting with other transactions. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_REPORT_CONFLICTING_KEYS=712,
+
+    /* By default, the special key space will only allow users to read from exactly one module (a subspace in the special key space). Use this option to allow reading from zero or more modules. Users who set this option should be prepared for new modules, which may have different behaviors than the modules they're currently reading. For example, a new module might block or return an error. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SPECIAL_KEY_SPACE_RELAXED=713,
+
+    /* By default, users are not allowed to write to special keys. Enable this option will implicitly enable all options required to achieve the configuration change. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SPECIAL_KEY_SPACE_ENABLE_WRITES=714,
+
+    /* Adds a tag to the transaction that can be used to apply manual targeted throttling. At most 5 tags can be set on a transaction. */
+    /* Parameter: (String) String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters. */
+    FDB_TR_OPTION_TAG=800,
+
+    /* Adds a tag to the transaction that can be used to apply manual or automatic targeted throttling. At most 5 tags can be set on a transaction. */
+    /* Parameter: (String) String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters. */
+    FDB_TR_OPTION_AUTO_THROTTLE_TAG=801,
+
+    /* Adds a parent to the Span of this transaction. Used for transaction tracing. A span can be identified with any 16 bytes */
+    /* Parameter: (Bytes) A byte string of length 16 used to associate the span of this transaction with a parent */
+    FDB_TR_OPTION_SPAN_PARENT=900,
+
+    /* Asks storage servers for how many bytes a clear key range contains. Otherwise uses the location cache to roughly estimate this. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_EXPENSIVE_CLEAR_COST_ESTIMATION_ENABLE=1000,
+
+    /* Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. These reads will view versionstamp operations as if they were set operations that did not fill in the versionstamp. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_BYPASS_UNREADABLE=1100
+} FDBTransactionOption;
+
+typedef enum {
+    /* Client intends to consume the entire range and would like it all transferred as early as possible. */
+    FDB_STREAMING_MODE_WANT_ALL=-2,
+
+    /* The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL`` */
+    FDB_STREAMING_MODE_ITERATOR=-1,
+
+    /* Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used. */
+    FDB_STREAMING_MODE_EXACT=0,
+
+    /* Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early. */
+    FDB_STREAMING_MODE_SMALL=1,
+
+    /* Infrequently used. Transfer data in batches sized in between small and large. */
+    FDB_STREAMING_MODE_MEDIUM=2,
+
+    /* Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode. */
+    FDB_STREAMING_MODE_LARGE=3,
+
+    /* Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted. */
+    FDB_STREAMING_MODE_SERIAL=4
+} FDBStreamingMode;
+
+typedef enum {
+    /* Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow. */
+    FDB_MUTATION_TYPE_ADD=2,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_AND=6,
+
+    /* Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_AND=6,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_OR=7,
+
+    /* Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_OR=7,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_XOR=8,
+
+    /* Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_XOR=8,
+
+    /* Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size. */
+    FDB_MUTATION_TYPE_APPEND_IF_FITS=9,
+
+    /* Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_MAX=12,
+
+    /* Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_MIN=13,
+
+    /* Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes. */
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_KEY=14,
+
+    /* Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset. */
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_VALUE=15,
+
+    /* Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_BYTE_MIN=16,
+
+    /* Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_BYTE_MAX=17,
+
+    /* Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared. */
+    FDB_MUTATION_TYPE_COMPARE_AND_CLEAR=20
+} FDBMutationType;
+
+typedef enum {
+    /* Used to add a read conflict range */
+    FDB_CONFLICT_RANGE_TYPE_READ=0,
+
+    /* Used to add a write conflict range */
+    FDB_CONFLICT_RANGE_TYPE_WRITE=1
+} FDBConflictRangeType;
+
+typedef enum {
+    /* Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error. */
+    FDB_ERROR_PREDICATE_RETRYABLE=50000,
+
+    /* Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify. */
+    FDB_ERROR_PREDICATE_MAYBE_COMMITTED=50001,
+
+    /* Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried. */
+    FDB_ERROR_PREDICATE_RETRYABLE_NOT_COMMITTED=50002
+} FDBErrorPredicate;
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/700/version.txt b/bindings/rust/foundationdb-sys/include/700/version.txt
new file mode 100644
index 00000000000..4122521804f
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/700/version.txt
@@ -0,0 +1 @@
+7.0.0
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-sys/include/710/fdb_c.h b/bindings/rust/foundationdb-sys/include/710/fdb_c.h
new file mode 100644
index 00000000000..cbd90226e7b
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/710/fdb_c.h
@@ -0,0 +1,576 @@
+/*
+ * fdb_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2022 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_H
+#define FDB_C_H
+#pragma once
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#if !defined(FDB_API_VERSION)
+#error You must #define FDB_API_VERSION prior to including fdb_c.h (current version is 710)
+#elif FDB_API_VERSION < 13
+#error API version no longer supported (upgrade to 13)
+#elif FDB_API_VERSION > 710
+#error Requested API version requires a newer version of this header
+#endif
+
+#if FDB_API_VERSION >= 23 && !defined(WARN_UNUSED_RESULT)
+#ifdef __GNUG__
+#define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+#define WARN_UNUSED_RESULT
+#endif
+#else
+#define WARN_UNUSED_RESULT
+#endif
+
+/*
+ * With default settings, gcc will not warn about unprototyped functions being
+ * called, so it is easy to erroneously call a function which is not available
+ * at FDB_API_VERSION and then get an error only at runtime.  These macros
+ * ensure a compile error in such cases, and attempt to make the compile error
+ * slightly informative.
+ */
+#define This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION()                                            \
+	{ == == = }
+#define FDB_REMOVED_FUNCTION This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION(0)
+
+#include <stdint.h>
+
+#include "fdb_c_options.g.h"
+#include "fdb_c_types.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+DLLEXPORT const char* fdb_get_error(fdb_error_t code);
+
+DLLEXPORT fdb_bool_t fdb_error_predicate(int predicate_test, fdb_error_t code);
+
+#define /* fdb_error_t */ fdb_select_api_version(v) fdb_select_api_version_impl(v, FDB_API_VERSION)
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_network_set_option(FDBNetworkOption option,
+                                                                uint8_t const* value,
+                                                                int value_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network();
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_run_network();
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_stop_network();
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_add_network_thread_completion_hook(void (*hook)(void*),
+                                                                                void* hook_parameter);
+
+#pragma pack(push, 4)
+typedef struct key {
+	const uint8_t* key;
+	int key_length;
+} FDBKey;
+#if FDB_API_VERSION >= 710
+typedef struct keyvalue {
+	const uint8_t* key;
+	int key_length;
+	const uint8_t* value;
+	int value_length;
+} FDBKeyValue;
+#else
+typedef struct keyvalue {
+	const void* key;
+	int key_length;
+	const void* value;
+	int value_length;
+} FDBKeyValue;
+#endif
+
+#pragma pack(pop)
+
+/* Memory layout of KeySelectorRef. */
+typedef struct keyselector {
+	FDBKey key;
+	/* orEqual and offset have not be tested in C binding. Just a placeholder. */
+	fdb_bool_t orEqual;
+	int offset;
+} FDBKeySelector;
+
+/* Memory layout of GetRangeReqAndResultRef. */
+typedef struct getrangereqandresult {
+	FDBKeySelector begin;
+	FDBKeySelector end;
+	FDBKeyValue* data;
+	int m_size, m_capacity;
+} FDBGetRangeReqAndResult;
+
+/* Memory layout of MappedKeyValueRef.
+
+Total 112 bytes
+- key (12 bytes)
+:74:8F:8E:5F:AE:7F:00:00
+:4A:00:00:00
+- value (12 bytes)
+:70:8F:8E:5F:AE:7F:00:00
+:00:00:00:00
+- begin selector (20 bytes)
+:30:8F:8E:5F:AE:7F:00:00
+:2D:00:00:00
+:00:7F:00:00
+:01:00:00:00
+- end selector (20 bytes)
+:EC:8E:8E:5F:AE:7F:00:00
+:2D:00:00:00
+:00:2B:3C:60
+:01:00:00:00
+- vector (16 bytes)
+:74:94:8E:5F:AE:7F:00:00
+:01:00:00:00
+:01:00:00:00
+- buffer (32 bytes)
+:00:20:D1:61:00:00:00:00
+:00:00:00:00:00:00:00:00
+:00:00:00:00:00:00:00:00
+:01:00:00:00:AE:7F:00:00
+*/
+typedef struct mappedkeyvalue {
+	FDBKey key;
+	FDBKey value;
+	/* It's complicated to map a std::variant to C. For now we assume the underlying requests are always getRange and
+	 * take the shortcut. */
+	FDBGetRangeReqAndResult getRange;
+	unsigned char buffer[32];
+} FDBMappedKeyValue;
+
+#pragma pack(push, 4)
+typedef struct keyrange {
+	const uint8_t* begin_key;
+	int begin_key_length;
+	const uint8_t* end_key;
+	int end_key_length;
+} FDBKeyRange;
+#pragma pack(pop)
+
+typedef struct readgranulecontext {
+	/* User context to pass along to functions */
+	void* userContext;
+
+	/* Returns a unique id for the load. Asynchronous to support queueing multiple in parallel. */
+	int64_t (*start_load_f)(const char* filename,
+	                        int filenameLength,
+	                        int64_t offset,
+	                        int64_t length,
+	                        int64_t fullFileLength,
+	                        void* context);
+
+	/* Returns data for the load. Pass the loadId returned by start_load_f */
+	uint8_t* (*get_load_f)(int64_t loadId, void* context);
+
+	/* Frees data from load. Pass the loadId returned by start_load_f */
+	void (*free_load_f)(int64_t loadId, void* context);
+
+	/* Set this to true for testing if you don't want to read the granule files,
+	   just do the request to the blob workers */
+	fdb_bool_t debugNoMaterialize;
+
+	/* Number of granules to load in parallel */
+	int granuleParallelism;
+} FDBReadBlobGranuleContext;
+
+DLLEXPORT void fdb_future_cancel(FDBFuture* f);
+
+DLLEXPORT void fdb_future_release_memory(FDBFuture* f);
+
+DLLEXPORT void fdb_future_destroy(FDBFuture* f);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_block_until_ready(FDBFuture* f);
+
+DLLEXPORT fdb_bool_t fdb_future_is_ready(FDBFuture* f);
+
+typedef void (*FDBCallback)(FDBFuture* future, void* callback_parameter);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_set_callback(FDBFuture* f,
+                                                                 FDBCallback callback,
+                                                                 void* callback_parameter);
+
+#if FDB_API_VERSION >= 23
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_error(FDBFuture* f);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_int64(FDBFuture* f, int64_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_uint64(FDBFuture* f, uint64_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_key(FDBFuture* f, uint8_t const** out_key, int* out_key_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_value(FDBFuture* f,
+                                                              fdb_bool_t* out_present,
+                                                              uint8_t const** out_value,
+                                                              int* out_value_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(FDBFuture* f,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count,
+                                                                       fdb_bool_t* out_more);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_mappedkeyvalue_array(FDBFuture* f,
+                                                                             FDBMappedKeyValue const** out_kv,
+                                                                             int* out_count,
+                                                                             fdb_bool_t* out_more);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_key_array(FDBFuture* f,
+                                                                  FDBKey const** out_key_array,
+                                                                  int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_string_array(FDBFuture* f,
+                                                                     const char*** out_strings,
+                                                                     int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyrange_array(FDBFuture* f,
+                                                                       FDBKeyRange const** out_ranges,
+                                                                       int* out_count);
+
+/* FDBResult is a synchronous computation result, as opposed to a future that is asynchronous. */
+DLLEXPORT void fdb_result_destroy(FDBResult* r);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_result_get_keyvalue_array(FDBResult* r,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count,
+                                                                       fdb_bool_t* out_more);
+
+/* TODO: add other return types as we need them */
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_create_database(const char* cluster_file_path, FDBDatabase** out_database);
+
+DLLEXPORT void fdb_database_destroy(FDBDatabase* d);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_set_option(FDBDatabase* d,
+                                                                 FDBDatabaseOption option,
+                                                                 uint8_t const* value,
+                                                                 int value_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_open_tenant(FDBDatabase* d,
+                                                                  uint8_t const* tenant_name,
+                                                                  int tenant_name_length,
+                                                                  FDBTenant** out_tenant);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_create_transaction(FDBDatabase* d,
+                                                                         FDBTransaction** out_transaction);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_reboot_worker(FDBDatabase* db,
+                                                                   uint8_t const* address,
+                                                                   int address_length,
+                                                                   fdb_bool_t check,
+                                                                   int duration);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_force_recovery_with_data_loss(FDBDatabase* db,
+                                                                                   uint8_t const* dcid,
+                                                                                   int dcid_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_create_snapshot(FDBDatabase* db,
+                                                                     uint8_t const* uid,
+                                                                     int uid_length,
+                                                                     uint8_t const* snap_command,
+                                                                     int snap_command_length);
+
+DLLEXPORT WARN_UNUSED_RESULT double fdb_database_get_main_thread_busyness(FDBDatabase* db);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_get_server_protocol(FDBDatabase* db, uint64_t expected_version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_purge_blob_granules(FDBDatabase* db,
+                                                                         uint8_t const* begin_key_name,
+                                                                         int begin_key_name_length,
+                                                                         uint8_t const* end_key_name,
+                                                                         int end_key_name_length,
+                                                                         int64_t purge_version,
+                                                                         fdb_bool_t force);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_wait_purge_granules_complete(FDBDatabase* db,
+                                                                                  uint8_t const* purge_key_name,
+                                                                                  int purge_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_tenant_create_transaction(FDBTenant* tenant,
+                                                                       FDBTransaction** out_transaction);
+
+DLLEXPORT void fdb_tenant_destroy(FDBTenant* tenant);
+
+DLLEXPORT void fdb_transaction_destroy(FDBTransaction* tr);
+
+DLLEXPORT void fdb_transaction_cancel(FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_set_option(FDBTransaction* tr,
+                                                                    FDBTransactionOption option,
+                                                                    uint8_t const* value,
+                                                                    int value_length);
+#endif
+
+DLLEXPORT void fdb_transaction_set_read_version(FDBTransaction* tr, int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_read_version(FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(FDBTransaction* tr,
+                                                            uint8_t const* key_name,
+                                                            int key_name_length,
+                                                            fdb_bool_t snapshot);
+#endif
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(FDBTransaction* tr,
+                                                                uint8_t const* key_name,
+                                                                int key_name_length,
+                                                                fdb_bool_t or_equal,
+                                                                int offset,
+                                                                fdb_bool_t snapshot);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_addresses_for_key(FDBTransaction* tr,
+                                                                              uint8_t const* key_name,
+                                                                              int key_name_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(FDBTransaction* tr,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  fdb_bool_t begin_or_equal,
+                                                                  int begin_offset,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length,
+                                                                  fdb_bool_t end_or_equal,
+                                                                  int end_offset,
+                                                                  int limit,
+                                                                  int target_bytes,
+                                                                  FDBStreamingMode mode,
+                                                                  int iteration,
+                                                                  fdb_bool_t snapshot,
+                                                                  fdb_bool_t reverse);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_mapped_range(FDBTransaction* tr,
+                                                                         uint8_t const* begin_key_name,
+                                                                         int begin_key_name_length,
+                                                                         fdb_bool_t begin_or_equal,
+                                                                         int begin_offset,
+                                                                         uint8_t const* end_key_name,
+                                                                         int end_key_name_length,
+                                                                         fdb_bool_t end_or_equal,
+                                                                         int end_offset,
+                                                                         uint8_t const* mapper_name,
+                                                                         int mapper_name_length,
+                                                                         int limit,
+                                                                         int target_bytes,
+                                                                         FDBStreamingMode mode,
+                                                                         int iteration,
+                                                                         fdb_bool_t snapshot,
+                                                                         fdb_bool_t reverse);
+
+DLLEXPORT void fdb_transaction_set(FDBTransaction* tr,
+                                   uint8_t const* key_name,
+                                   int key_name_length,
+                                   uint8_t const* value,
+                                   int value_length);
+
+DLLEXPORT void fdb_transaction_atomic_op(FDBTransaction* tr,
+                                         uint8_t const* key_name,
+                                         int key_name_length,
+                                         uint8_t const* param,
+                                         int param_length,
+                                         FDBMutationType operation_type);
+
+DLLEXPORT void fdb_transaction_clear(FDBTransaction* tr, uint8_t const* key_name, int key_name_length);
+
+DLLEXPORT void fdb_transaction_clear_range(FDBTransaction* tr,
+                                           uint8_t const* begin_key_name,
+                                           int begin_key_name_length,
+                                           uint8_t const* end_key_name,
+                                           int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_watch(FDBTransaction* tr,
+                                                              uint8_t const* key_name,
+                                                              int key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_commit(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_get_committed_version(FDBTransaction* tr,
+                                                                               int64_t* out_version);
+
+/*
+ * This function intentionally returns an FDBFuture instead of an integer
+ * directly, so that calling this API can see the effect of previous
+ * mutations on the transaction. Specifically, mutations are applied
+ * asynchronously by the main thread. In order to see them, this call has to
+ * be serviced by the main thread too.
+ */
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_approximate_size(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_versionstamp(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_on_error(FDBTransaction* tr, fdb_error_t error);
+
+DLLEXPORT void fdb_transaction_reset(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_add_conflict_range(FDBTransaction* tr,
+                                                                            uint8_t const* begin_key_name,
+                                                                            int begin_key_name_length,
+                                                                            uint8_t const* end_key_name,
+                                                                            int end_key_name_length,
+                                                                            FDBConflictRangeType type);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_estimated_range_size_bytes(FDBTransaction* tr,
+                                                                                       uint8_t const* begin_key_name,
+                                                                                       int begin_key_name_length,
+                                                                                       uint8_t const* end_key_name,
+                                                                                       int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_split_points(FDBTransaction* tr,
+                                                                               uint8_t const* begin_key_name,
+                                                                               int begin_key_name_length,
+                                                                               uint8_t const* end_key_name,
+                                                                               int end_key_name_length,
+                                                                               int64_t chunk_size);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_blob_granule_ranges(FDBTransaction* tr,
+                                                                                uint8_t const* begin_key_name,
+                                                                                int begin_key_name_length,
+                                                                                uint8_t const* end_key_name,
+                                                                                int end_key_name_length);
+
+/* LatestVersion (-2) for readVersion means get read version from transaction
+   Separated out as optional because BG reads can support longer-lived reads than normal FDB transactions */
+DLLEXPORT WARN_UNUSED_RESULT FDBResult* fdb_transaction_read_blob_granules(FDBTransaction* tr,
+                                                                           uint8_t const* begin_key_name,
+                                                                           int begin_key_name_length,
+                                                                           uint8_t const* end_key_name,
+                                                                           int end_key_name_length,
+                                                                           int64_t beginVersion,
+                                                                           int64_t readVersion,
+                                                                           FDBReadBlobGranuleContext granuleContext);
+
+#define FDB_KEYSEL_LAST_LESS_THAN(k, l) k, l, 0, 0
+#define FDB_KEYSEL_LAST_LESS_OR_EQUAL(k, l) k, l, 1, 0
+#define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
+#define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_select_api_version_impl(int runtime_version, int header_version);
+
+DLLEXPORT int fdb_get_max_api_version();
+DLLEXPORT const char* fdb_get_client_version();
+
+/* LEGACY API VERSIONS */
+
+#if FDB_API_VERSION < 620
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_version(FDBFuture* f, int64_t* out_version);
+#else
+#define fdb_future_get_version(f, ov) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 610 || defined FDB_INCLUDE_LEGACY_TYPES
+typedef struct FDB_cluster FDBCluster;
+
+typedef enum {
+	/* This option is only a placeholder for C compatibility and should not be used */
+	FDB_CLUSTER_OPTION_DUMMY_DO_NOT_USE = -1
+} FDBClusterOption;
+#endif
+
+#if FDB_API_VERSION < 610
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_cluster(FDBFuture* f, FDBCluster** out_cluster);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_database(FDBFuture* f, FDBDatabase** out_database);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_create_cluster(const char* cluster_file_path);
+
+DLLEXPORT void fdb_cluster_destroy(FDBCluster* c);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_cluster_set_option(FDBCluster* c,
+                                                                FDBClusterOption option,
+                                                                uint8_t const* value,
+                                                                int value_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_cluster_create_database(FDBCluster* c,
+                                                                    uint8_t const* db_name,
+                                                                    int db_name_length);
+#else
+#define fdb_future_get_cluster(f, oc) FDB_REMOVED_FUNCTION
+#define fdb_future_get_database(f, od) FDB_REMOVED_FUNCTION
+#define fdb_create_cluster(cfp) FDB_REMOVED_FUNCTION
+#define fdb_cluster_destroy(c) FDB_REMOVED_FUNCTION
+#define fdb_cluster_set_option(c, o, v, vl) FDB_REMOVED_FUNCTION
+#define fdb_cluster_create_database(c, dn, dnl) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 23
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_error(FDBFuture* f, const char** out_description /* = NULL */);
+
+DLLEXPORT fdb_bool_t fdb_future_is_error(FDBFuture* f);
+#else
+#define fdb_future_is_error(x) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(FDBFuture* f,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(FDBTransaction* tr,
+                                                            uint8_t const* key_name,
+                                                            int key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(FDBTransaction* tr,
+                                                                uint8_t const* key_name,
+                                                                int key_name_length,
+                                                                fdb_bool_t or_equal,
+                                                                int offset);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network(const char* local_address);
+
+DLLEXPORT void fdb_transaction_set_option(FDBTransaction* tr, FDBTransactionOption option);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(FDBTransaction* tr,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length,
+                                                                  int limit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_selector(FDBTransaction* tr,
+                                                                           uint8_t const* begin_key_name,
+                                                                           int begin_key_name_length,
+                                                                           fdb_bool_t begin_or_equal,
+                                                                           int begin_offset,
+                                                                           uint8_t const* end_key_name,
+                                                                           int end_key_name_length,
+                                                                           fdb_bool_t end_or_equal,
+                                                                           int end_offset,
+                                                                           int limit);
+#else
+#define fdb_transaction_get_range_selector(tr, bkn, bknl, boe, bo, ekn, eknl, eoe, eo, lim) FDB_REMOVED_FUNCTION
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/710/fdb_c_options.g.h b/bindings/rust/foundationdb-sys/include/710/fdb_c_options.g.h
new file mode 100644
index 00000000000..06812ce4fa3
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/710/fdb_c_options.g.h
@@ -0,0 +1,533 @@
+#ifndef FDB_C_OPTIONS_G_H
+#define FDB_C_OPTIONS_G_H
+#pragma once
+
+/*
+ * FoundationDB C API
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+typedef enum {
+    /* Deprecated */
+    /* Parameter: (String) IP:PORT */
+    FDB_NET_OPTION_LOCAL_ADDRESS=10,
+
+    /* Deprecated */
+    /* Parameter: (String) path to cluster file */
+    FDB_NET_OPTION_CLUSTER_FILE=20,
+
+    /* Enables trace output to a file in a directory of the clients choosing */
+    /* Parameter: (String) path to output directory (or NULL for current working directory) */
+    FDB_NET_OPTION_TRACE_ENABLE=30,
+
+    /* Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes. */
+    /* Parameter: (Int) max size of a single trace output file */
+    FDB_NET_OPTION_TRACE_ROLL_SIZE=31,
+
+    /* Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time. */
+    /* Parameter: (Int) max total size of trace files */
+    FDB_NET_OPTION_TRACE_MAX_LOGS_SIZE=32,
+
+    /* Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'. */
+    /* Parameter: (String) value of the LogGroup attribute */
+    FDB_NET_OPTION_TRACE_LOG_GROUP=33,
+
+    /* Select the format of the log files. xml (the default) and json are supported. */
+    /* Parameter: (String) Format of trace files */
+    FDB_NET_OPTION_TRACE_FORMAT=34,
+
+    /* Select clock source for trace files. now (the default) or realtime are supported. */
+    /* Parameter: (String) Trace clock source */
+    FDB_NET_OPTION_TRACE_CLOCK_SOURCE=35,
+
+    /* Once provided, this string will be used to replace the port/PID in the log file names. */
+    /* Parameter: (String) The identifier that will be part of all trace file names */
+    FDB_NET_OPTION_TRACE_FILE_IDENTIFIER=36,
+
+    /* Set file suffix for partially written log files. */
+    /* Parameter: (String) Append this suffix to partially written log files. When a log file is complete, it is renamed to remove the suffix. No separator is added between the file and the suffix. If you want to add a file extension, you should include the separator - e.g. '.tmp' instead of 'tmp' to add the 'tmp' extension. */
+    FDB_NET_OPTION_TRACE_PARTIAL_FILE_SUFFIX=39,
+
+    /* Set internal tuning or debugging knobs */
+    /* Parameter: (String) knob_name=knob_value */
+    FDB_NET_OPTION_KNOB=40,
+
+    /* Deprecated */
+    /* Parameter: (String) file path or linker-resolved name */
+    FDB_NET_OPTION_TLS_PLUGIN=41,
+
+    /* Set the certificate chain */
+    /* Parameter: (Bytes) certificates */
+    FDB_NET_OPTION_TLS_CERT_BYTES=42,
+
+    /* Set the file from which to load the certificate chain */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_CERT_PATH=43,
+
+    /* Set the private key corresponding to your own certificate */
+    /* Parameter: (Bytes) key */
+    FDB_NET_OPTION_TLS_KEY_BYTES=45,
+
+    /* Set the file from which to load the private key corresponding to your own certificate */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_KEY_PATH=46,
+
+    /* Set the peer certificate field verification criteria */
+    /* Parameter: (Bytes) verification pattern */
+    FDB_NET_OPTION_TLS_VERIFY_PEERS=47,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_BUGGIFY_ENABLE=48,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_BUGGIFY_DISABLE=49,
+
+    /* Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed. */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=50,
+
+    /* Set the probability of an active BUGGIFY section being fired */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_BUGGIFY_SECTION_FIRED_PROBABILITY=51,
+
+    /* Set the ca bundle */
+    /* Parameter: (Bytes) ca bundle */
+    FDB_NET_OPTION_TLS_CA_BYTES=52,
+
+    /* Set the file from which to load the certificate authority bundle */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_CA_PATH=53,
+
+    /* Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used. */
+    /* Parameter: (String) key passphrase */
+    FDB_NET_OPTION_TLS_PASSWORD=54,
+
+    /* Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_MULTI_VERSION_CLIENT_API=60,
+
+    /* If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CALLBACKS_ON_EXTERNAL_THREADS=61,
+
+    /* Adds an external client library for use by the multi-version client API. Must be set before setting up the network. */
+    /* Parameter: (String) path to client library */
+    FDB_NET_OPTION_EXTERNAL_CLIENT_LIBRARY=62,
+
+    /* Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network. */
+    /* Parameter: (String) path to directory containing client libraries */
+    FDB_NET_OPTION_EXTERNAL_CLIENT_DIRECTORY=63,
+
+    /* Prevents connections through the local client, allowing only connections through externally loaded client libraries. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_LOCAL_CLIENT=64,
+
+    /* Spawns multiple worker threads for each version of the client that is loaded.  Setting this to a number greater than one implies disable_local_client. */
+    /* Parameter: (Int) Number of client threads to be spawned.  Each cluster will be serviced by a single client thread. */
+    FDB_NET_OPTION_CLIENT_THREADS_PER_VERSION=65,
+
+    /* Disables logging of client statistics, such as sampled transaction activity. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_CLIENT_STATISTICS_LOGGING=70,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_ENABLE_SLOW_TASK_PROFILING=71,
+
+    /* Enables debugging feature to perform run loop profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_ENABLE_RUN_LOOP_PROFILING=71,
+
+    /* Enable client buggify - will make requests randomly fail (intended for client testing) */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_ENABLE=80,
+
+    /* Disable client buggify */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_DISABLE=81,
+
+    /* Set the probability of a CLIENT_BUGGIFY section being active for the current execution. */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=82,
+
+    /* Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_FIRED_PROBABILITY=83,
+
+    /* Set a tracer to run on the client. Should be set to the same value as the tracer set on the server. */
+    /* Parameter: (String) Distributed tracer type. Choose from none, log_file, or network_lossy */
+    FDB_NET_OPTION_DISTRIBUTED_CLIENT_TRACER=90,
+
+    /* This option is set automatically to communicate the list of supported clients to the active client. */
+    /* Parameter: (String) [release version],[source version],[protocol version];... This is a hidden parameter and should not be used directly by applications.*/
+    FDB_NET_OPTION_SUPPORTED_CLIENT_VERSIONS=1000,
+
+    /* This option is set automatically on all clients loaded externally using the multi-version API. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_NET_OPTION_EXTERNAL_CLIENT=1001,
+
+    /* This option tells a child on a multiversion client what transport ID to use. */
+    /* Parameter: (Int) Transport ID for the child connection This is a hidden parameter and should not be used directly by applications.*/
+    FDB_NET_OPTION_EXTERNAL_CLIENT_TRANSPORT_ID=1002
+} FDBNetworkOption;
+
+typedef enum {
+    /* Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000. */
+    /* Parameter: (Int) Max location cache entries */
+    FDB_DB_OPTION_LOCATION_CACHE_SIZE=10,
+
+    /* Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000. */
+    /* Parameter: (Int) Max outstanding watches */
+    FDB_DB_OPTION_MAX_WATCHES=20,
+
+    /* Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing. */
+    /* Parameter: (String) Hexadecimal ID */
+    FDB_DB_OPTION_MACHINE_ID=21,
+
+    /* Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing. */
+    /* Parameter: (String) Hexadecimal ID */
+    FDB_DB_OPTION_DATACENTER_ID=22,
+
+    /* Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_SNAPSHOT_RYW_ENABLE=26,
+
+    /* Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_SNAPSHOT_RYW_DISABLE=27,
+
+    /* Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) Maximum length of escaped key and value fields. */
+    FDB_DB_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    /* Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher. */
+    /* Parameter: (Int) value in milliseconds of timeout */
+    FDB_DB_OPTION_TRANSACTION_TIMEOUT=500,
+
+    /* Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) number of times to retry */
+    FDB_DB_OPTION_TRANSACTION_RETRY_LIMIT=501,
+
+    /* Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) value in milliseconds of maximum delay */
+    FDB_DB_OPTION_TRANSACTION_MAX_RETRY_DELAY=502,
+
+    /* Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) value in bytes */
+    FDB_DB_OPTION_TRANSACTION_SIZE_LIMIT=503,
+
+    /* The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_CAUSAL_READ_RISKY=504,
+
+    /* Deprecated. Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_INCLUDE_PORT_IN_ADDRESS=505,
+
+    /* Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. This sets the ``bypass_unreadable`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_BYPASS_UNREADABLE=700,
+
+    /* Use configuration database. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_USE_CONFIG_DATABASE=800,
+
+    /* An integer between 0 and 100 (default is 0) expressing the probability that a client will verify it can't read stale data whenever it detects a recovery. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TEST_CAUSAL_READ_RISKY=900
+} FDBDatabaseOption;
+
+typedef enum {
+    /* The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_WRITE_RISKY=10,
+
+    /* The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_READ_RISKY=20,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_READ_DISABLE=21,
+
+    /* Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_INCLUDE_PORT_IN_ADDRESS=23,
+
+    /* The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_NEXT_WRITE_NO_WRITE_CONFLICT_RANGE=30,
+
+    /* Committing this transaction will bypass the normal load balancing across commit proxies and go directly to the specifically nominated 'first commit proxy'. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_COMMIT_ON_FIRST_PROXY=40,
+
+    /*  */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_CHECK_WRITES_ENABLE=50,
+
+    /* Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction. It is an error to set this option after performing any reads or writes on the transaction. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE=51,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_AHEAD_DISABLE=52,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_DATACENTER=110,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_RISKY=120,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_DEV_NULL_IS_WEB_SCALE=130,
+
+    /* Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_PRIORITY_SYSTEM_IMMEDIATE=200,
+
+    /* Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_PRIORITY_BATCH=201,
+
+    /* This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_INITIALIZE_NEW_DATABASE=300,
+
+    /* Allows this transaction to read and modify system keys (those that start with the byte 0xFF). Implies raw_access. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_ACCESS_SYSTEM_KEYS=301,
+
+    /* Allows this transaction to read system keys (those that start with the byte 0xFF). Implies raw_access. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_SYSTEM_KEYS=302,
+
+    /* Allows this transaction to access the raw key-space when tenant mode is on. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_RAW_ACCESS=303,
+
+    /*  */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_DEBUG_DUMP=400,
+
+    /*  */
+    /* Parameter: (String) Optional transaction name */
+    FDB_TR_OPTION_DEBUG_RETRY_LOGGING=401,
+
+    /* Deprecated */
+    /* Parameter: (String) String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters. */
+    FDB_TR_OPTION_TRANSACTION_LOGGING_ENABLE=402,
+
+    /* Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled. */
+    /* Parameter: (String) String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters. */
+    FDB_TR_OPTION_DEBUG_TRANSACTION_IDENTIFIER=403,
+
+    /* Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_LOG_TRANSACTION=404,
+
+    /* Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation. */
+    /* Parameter: (Int) Maximum length of escaped key and value fields. */
+    FDB_TR_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    /* Sets an identifier for server tracing of this transaction. When committed, this identifier triggers logging when each part of the transaction authority encounters it, which is helpful in diagnosing slowness in misbehaving clusters. The identifier is randomly generated. When there is also a debug_transaction_identifier, both IDs are logged together. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SERVER_REQUEST_TRACING=406,
+
+    /* Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) value in milliseconds of timeout */
+    FDB_TR_OPTION_TIMEOUT=500,
+
+    /* Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) number of times to retry */
+    FDB_TR_OPTION_RETRY_LIMIT=501,
+
+    /* Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) value in milliseconds of maximum delay */
+    FDB_TR_OPTION_MAX_RETRY_DELAY=502,
+
+    /* Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit. */
+    /* Parameter: (Int) value in bytes */
+    FDB_TR_OPTION_SIZE_LIMIT=503,
+
+    /* Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SNAPSHOT_RYW_ENABLE=600,
+
+    /* Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SNAPSHOT_RYW_DISABLE=601,
+
+    /* The transaction can read and write to locked databases, and is responsible for checking that it took the lock. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_LOCK_AWARE=700,
+
+    /* By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    /* The transaction can read from locked databases. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_LOCK_AWARE=702,
+
+    /* No other transactions will be applied before this transaction within the same commit version. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_FIRST_IN_BATCH=710,
+
+    /* This option should only be used by tools which change the database configuration. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USE_PROVISIONAL_PROXIES=711,
+
+    /* The transaction can retrieve keys that are conflicting with other transactions. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_REPORT_CONFLICTING_KEYS=712,
+
+    /* By default, the special key space will only allow users to read from exactly one module (a subspace in the special key space). Use this option to allow reading from zero or more modules. Users who set this option should be prepared for new modules, which may have different behaviors than the modules they're currently reading. For example, a new module might block or return an error. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SPECIAL_KEY_SPACE_RELAXED=713,
+
+    /* By default, users are not allowed to write to special keys. Enable this option will implicitly enable all options required to achieve the configuration change. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SPECIAL_KEY_SPACE_ENABLE_WRITES=714,
+
+    /* Adds a tag to the transaction that can be used to apply manual targeted throttling. At most 5 tags can be set on a transaction. */
+    /* Parameter: (String) String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters. */
+    FDB_TR_OPTION_TAG=800,
+
+    /* Adds a tag to the transaction that can be used to apply manual or automatic targeted throttling. At most 5 tags can be set on a transaction. */
+    /* Parameter: (String) String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters. */
+    FDB_TR_OPTION_AUTO_THROTTLE_TAG=801,
+
+    /* Adds a parent to the Span of this transaction. Used for transaction tracing. A span can be identified with any 16 bytes */
+    /* Parameter: (Bytes) A byte string of length 16 used to associate the span of this transaction with a parent */
+    FDB_TR_OPTION_SPAN_PARENT=900,
+
+    /* Asks storage servers for how many bytes a clear key range contains. Otherwise uses the location cache to roughly estimate this. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_EXPENSIVE_CLEAR_COST_ESTIMATION_ENABLE=1000,
+
+    /* Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. These reads will view versionstamp operations as if they were set operations that did not fill in the versionstamp. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_BYPASS_UNREADABLE=1100,
+
+    /* Allows this transaction to use cached GRV from the database context. Defaults to off. Upon first usage, starts a background updater to periodically update the cache to avoid stale read versions. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USE_GRV_CACHE=1101,
+
+    /* Specifically instruct this transaction to NOT use cached GRV. Primarily used for the read version cache's background updater to avoid attempting to read a cached entry in specific situations. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_SKIP_GRV_CACHE=1102
+} FDBTransactionOption;
+
+typedef enum {
+    /* Client intends to consume the entire range and would like it all transferred as early as possible. */
+    FDB_STREAMING_MODE_WANT_ALL=-2,
+
+    /* The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL`` */
+    FDB_STREAMING_MODE_ITERATOR=-1,
+
+    /* Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used. */
+    FDB_STREAMING_MODE_EXACT=0,
+
+    /* Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early. */
+    FDB_STREAMING_MODE_SMALL=1,
+
+    /* Infrequently used. Transfer data in batches sized in between small and large. */
+    FDB_STREAMING_MODE_MEDIUM=2,
+
+    /* Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode. */
+    FDB_STREAMING_MODE_LARGE=3,
+
+    /* Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted. */
+    FDB_STREAMING_MODE_SERIAL=4
+} FDBStreamingMode;
+
+typedef enum {
+    /* Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow. */
+    FDB_MUTATION_TYPE_ADD=2,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_AND=6,
+
+    /* Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_AND=6,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_OR=7,
+
+    /* Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_OR=7,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_XOR=8,
+
+    /* Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_XOR=8,
+
+    /* Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size. */
+    FDB_MUTATION_TYPE_APPEND_IF_FITS=9,
+
+    /* Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_MAX=12,
+
+    /* Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_MIN=13,
+
+    /* Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes. */
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_KEY=14,
+
+    /* Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset. */
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_VALUE=15,
+
+    /* Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_BYTE_MIN=16,
+
+    /* Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_BYTE_MAX=17,
+
+    /* Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared. */
+    FDB_MUTATION_TYPE_COMPARE_AND_CLEAR=20
+} FDBMutationType;
+
+typedef enum {
+    /* Used to add a read conflict range */
+    FDB_CONFLICT_RANGE_TYPE_READ=0,
+
+    /* Used to add a write conflict range */
+    FDB_CONFLICT_RANGE_TYPE_WRITE=1
+} FDBConflictRangeType;
+
+typedef enum {
+    /* Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error. */
+    FDB_ERROR_PREDICATE_RETRYABLE=50000,
+
+    /* Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify. */
+    FDB_ERROR_PREDICATE_MAYBE_COMMITTED=50001,
+
+    /* Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried. */
+    FDB_ERROR_PREDICATE_RETRYABLE_NOT_COMMITTED=50002
+} FDBErrorPredicate;
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/710/fdb_c_types.h b/bindings/rust/foundationdb-sys/include/710/fdb_c_types.h
new file mode 100644
index 00000000000..779e227ad5e
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/710/fdb_c_types.h
@@ -0,0 +1,47 @@
+/*
+ * fdb_c_types.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2022 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_TYPES_H
+#define FDB_C_TYPES_H
+#pragma once
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Pointers to these opaque types represent objects in the FDB API */
+typedef struct FDB_future FDBFuture;
+typedef struct FDB_result FDBResult;
+typedef struct FDB_cluster FDBCluster;
+typedef struct FDB_database FDBDatabase;
+typedef struct FDB_tenant FDBTenant;
+typedef struct FDB_transaction FDBTransaction;
+
+typedef int fdb_error_t;
+typedef int fdb_bool_t;
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/710/version.txt b/bindings/rust/foundationdb-sys/include/710/version.txt
new file mode 100644
index 00000000000..a52e7a4eb7e
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/710/version.txt
@@ -0,0 +1 @@
+7.1.5
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-sys/include/730/fdb_c.h b/bindings/rust/foundationdb-sys/include/730/fdb_c.h
new file mode 100644
index 00000000000..f13bb29a958
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/730/fdb_c.h
@@ -0,0 +1,813 @@
+/*
+ * fdb_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2022 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_H
+#define FDB_C_H
+#pragma once
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#include "fdb_c_apiversion.g.h"
+#if (defined FDB_USE_LATEST_API_VERSION)
+#define FDB_API_VERSION FDB_LATEST_API_VERSION
+#elif (defined FDB_USE_LATEST_BINDINGS_API_VERSION)
+#define FDB_API_VERSION FDB_LATEST_BINDINGS_API_VERSION
+#endif
+
+#if !defined(FDB_API_VERSION)
+#error You must #define FDB_API_VERSION prior to including fdb_c.h (the latest version is defined as FDB_LATEST_API_VERSION)
+#elif FDB_API_VERSION < 13
+#error API version no longer supported (upgrade to 13)
+#elif FDB_API_VERSION > FDB_LATEST_API_VERSION
+#error Requested API version requires a newer version of this header
+#endif
+
+#if FDB_API_VERSION >= 23 && !defined(WARN_UNUSED_RESULT)
+#ifdef __GNUG__
+#define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+#define WARN_UNUSED_RESULT
+#endif
+#else
+#define WARN_UNUSED_RESULT
+#endif
+
+/*
+ * With default settings, gcc will not warn about unprototyped functions being
+ * called, so it is easy to erroneously call a function which is not available
+ * at FDB_API_VERSION and then get an error only at runtime.  These macros
+ * ensure a compile error in such cases, and attempt to make the compile error
+ * slightly informative.
+ */
+#define This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION()                                            \
+	{ == == = }
+#define FDB_REMOVED_FUNCTION This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION(0)
+
+#include <stdint.h>
+
+#include "fdb_c_options.g.h"
+#include "fdb_c_types.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+DLLEXPORT const char* fdb_get_error(fdb_error_t code);
+
+DLLEXPORT fdb_bool_t fdb_error_predicate(int predicate_test, fdb_error_t code);
+
+#define /* fdb_error_t */ fdb_select_api_version(v) fdb_select_api_version_impl(v, FDB_API_VERSION)
+
+/*
+ * A variant of fdb_select_api_version that caps the header API version by the maximum API version
+ * supported by the client library. It is intended mainly for use in combination with the shim
+ * layer, which loads the client library dynamically.
+ */
+#define /* fdb_error_t */ fdb_select_api_version_capped(v)                                                             \
+	fdb_select_api_version_impl(                                                                                       \
+	    v, FDB_API_VERSION < fdb_get_max_api_version() ? FDB_API_VERSION : fdb_get_max_api_version())
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_network_set_option(FDBNetworkOption option,
+                                                                uint8_t const* value,
+                                                                int value_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network(void);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_run_network(void);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_stop_network(void);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_add_network_thread_completion_hook(void (*hook)(void*),
+                                                                                void* hook_parameter);
+
+#pragma pack(push, 4)
+typedef struct key {
+	const uint8_t* key;
+	int key_length;
+} FDBKey;
+#if FDB_API_VERSION >= 630
+typedef struct keyvalue {
+	const uint8_t* key;
+	int key_length;
+	const uint8_t* value;
+	int value_length;
+} FDBKeyValue;
+#else
+typedef struct keyvalue {
+	const void* key;
+	int key_length;
+	const void* value;
+	int value_length;
+} FDBKeyValue;
+#endif
+
+#pragma pack(pop)
+
+/* Memory layout of KeySelectorRef. */
+typedef struct keyselector {
+	FDBKey key;
+	/* orEqual and offset have not be tested in C binding. Just a placeholder. */
+	fdb_bool_t orEqual;
+	int offset;
+} FDBKeySelector;
+
+/* Memory layout of GetRangeReqAndResultRef. */
+typedef struct getrangereqandresult {
+	FDBKeySelector begin;
+	FDBKeySelector end;
+	FDBKeyValue* data;
+	int m_size, m_capacity;
+} FDBGetRangeReqAndResult;
+
+/* Memory layout of MappedKeyValueRef.
+
+Total 112 bytes
+- key (12 bytes)
+:74:8F:8E:5F:AE:7F:00:00
+:4A:00:00:00
+- value (12 bytes)
+:70:8F:8E:5F:AE:7F:00:00
+:00:00:00:00
+- begin selector (20 bytes)
+:30:8F:8E:5F:AE:7F:00:00
+:2D:00:00:00
+:00:7F:00:00
+:01:00:00:00
+- end selector (20 bytes)
+:EC:8E:8E:5F:AE:7F:00:00
+:2D:00:00:00
+:00:2B:3C:60
+:01:00:00:00
+- vector (16 bytes)
+:74:94:8E:5F:AE:7F:00:00
+:01:00:00:00
+:01:00:00:00
+- buffer (32 bytes)
+:00:20:D1:61:00:00:00:00
+:00:00:00:00:00:00:00:00
+:00:00:00:00:00:00:00:00
+:01:00:00:00:AE:7F:00:00
+*/
+typedef struct mappedkeyvalue {
+	FDBKey key;
+	FDBKey value;
+	/* It's complicated to map a std::variant to C. For now we assume the underlying requests are always getRange and
+	 * take the shortcut. */
+	FDBGetRangeReqAndResult getRange;
+	unsigned char buffer[32];
+} FDBMappedKeyValue;
+
+#pragma pack(push, 4)
+typedef struct keyrange {
+	const uint8_t* begin_key;
+	int begin_key_length;
+	const uint8_t* end_key;
+	int end_key_length;
+} FDBKeyRange;
+
+typedef struct granulesummary {
+	FDBKeyRange key_range;
+	int64_t snapshot_version;
+	int64_t snapshot_size;
+	int64_t delta_version;
+	int64_t delta_size;
+} FDBGranuleSummary;
+#pragma pack(pop)
+
+typedef struct readgranulecontext {
+	/* User context to pass along to functions */
+	void* userContext;
+
+	/* Returns a unique id for the load. Asynchronous to support queueing multiple in parallel. */
+	int64_t (*start_load_f)(const char* filename,
+	                        int filenameLength,
+	                        int64_t offset,
+	                        int64_t length,
+	                        int64_t fullFileLength,
+	                        void* context);
+
+	/* Returns data for the load. Pass the loadId returned by start_load_f */
+	uint8_t* (*get_load_f)(int64_t loadId, void* context);
+
+	/* Frees data from load. Pass the loadId returned by start_load_f */
+	void (*free_load_f)(int64_t loadId, void* context);
+
+	/* Set this to true for testing if you don't want to read the granule files,
+	   just do the request to the blob workers */
+	fdb_bool_t debugNoMaterialize;
+
+	/* Number of granules to load in parallel */
+	int granuleParallelism;
+} FDBReadBlobGranuleContext;
+
+typedef enum { FDB_BG_MUTATION_TYPE_SET_VALUE = 0, FDB_BG_MUTATION_TYPE_CLEAR_RANGE = 1 } FDBBGMutationType;
+
+#pragma pack(push, 4)
+
+typedef struct bgtenantprefix {
+	fdb_bool_t present;
+	FDBKey prefix;
+} FDBBGTenantPrefix;
+
+/* encryption structs correspond to similar ones in BlobGranuleCommon.h */
+typedef struct bgencryptionkey {
+	int64_t domain_id;
+	uint64_t base_key_id;
+	uint32_t base_kcv;
+	uint64_t random_salt;
+	FDBKey base_key;
+} FDBBGEncryptionKey;
+
+typedef struct bgencryptionctx {
+	fdb_bool_t present;
+	FDBBGEncryptionKey textKey;
+	uint32_t textKCV;
+	FDBBGEncryptionKey headerKey;
+	uint32_t headerKCV;
+	FDBKey iv;
+} FDBBGEncryptionCtx;
+
+typedef struct bgfilepointer {
+	const uint8_t* filename_ptr;
+	int filename_length;
+	int64_t file_offset;
+	int64_t file_length;
+	int64_t full_file_length;
+	int64_t file_version;
+	FDBBGEncryptionCtx encryption_ctx;
+} FDBBGFilePointer;
+
+typedef struct bgmutation {
+	/* FDBBGMutationType */ uint8_t type;
+	int64_t version;
+	const uint8_t* param1_ptr;
+	int param1_length;
+	const uint8_t* param2_ptr;
+	int param2_length;
+} FDBBGMutation;
+
+typedef struct bgfiledescription {
+	FDBKeyRange key_range;
+	fdb_bool_t snapshot_present;
+	FDBBGFilePointer snapshot_file_pointer;
+	int delta_file_count;
+	FDBBGFilePointer* delta_files;
+	int memory_mutation_count;
+	FDBBGMutation* memory_mutations;
+	FDBBGTenantPrefix tenant_prefix;
+} FDBBGFileDescription;
+#pragma pack(pop)
+
+DLLEXPORT void fdb_future_cancel(FDBFuture* f);
+
+DLLEXPORT void fdb_future_release_memory(FDBFuture* f);
+
+DLLEXPORT void fdb_future_destroy(FDBFuture* f);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_block_until_ready(FDBFuture* f);
+
+DLLEXPORT fdb_bool_t fdb_future_is_ready(FDBFuture* f);
+
+typedef void (*FDBCallback)(FDBFuture* future, void* callback_parameter);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_set_callback(FDBFuture* f,
+                                                                 FDBCallback callback,
+                                                                 void* callback_parameter);
+
+#if FDB_API_VERSION >= 23
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_error(FDBFuture* f);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_bool(FDBFuture* f, fdb_bool_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_int64(FDBFuture* f, int64_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_uint64(FDBFuture* f, uint64_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_double(FDBFuture* f, double* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_key(FDBFuture* f, uint8_t const** out_key, int* out_key_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_value(FDBFuture* f,
+                                                              fdb_bool_t* out_present,
+                                                              uint8_t const** out_value,
+                                                              int* out_value_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(FDBFuture* f,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count,
+                                                                       fdb_bool_t* out_more);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_mappedkeyvalue_array(FDBFuture* f,
+                                                                             FDBMappedKeyValue const** out_kv,
+                                                                             int* out_count,
+                                                                             fdb_bool_t* out_more);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_key_array(FDBFuture* f,
+                                                                  FDBKey const** out_key_array,
+                                                                  int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_string_array(FDBFuture* f,
+                                                                     const char*** out_strings,
+                                                                     int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyrange_array(FDBFuture* f,
+                                                                       FDBKeyRange const** out_ranges,
+                                                                       int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_granule_summary_array(FDBFuture* f,
+                                                                              FDBGranuleSummary const** out_summaries,
+                                                                              int* out_count);
+
+/* all for using future result from read_blob_granules_description */
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_readbg_get_descriptions(FDBFuture* f,
+                                                                            FDBBGFileDescription** out,
+                                                                            int* desc_count);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBResult* fdb_readbg_parse_snapshot_file(const uint8_t* file_data,
+                                                                       int file_len,
+                                                                       FDBBGTenantPrefix const* tenant_prefix,
+                                                                       FDBBGEncryptionCtx const* encryption_ctx);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBResult* fdb_readbg_parse_delta_file(const uint8_t* file_data,
+                                                                    int file_len,
+                                                                    FDBBGTenantPrefix const* tenant_prefix,
+                                                                    FDBBGEncryptionCtx const* encryption_ctx);
+
+/* FDBResult is a synchronous computation result, as opposed to a future that is asynchronous. */
+DLLEXPORT void fdb_result_destroy(FDBResult* r);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_result_get_keyvalue_array(FDBResult* r,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count,
+                                                                       fdb_bool_t* out_more);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_result_get_bg_mutations_array(FDBResult* r,
+                                                                           FDBBGMutation const** out_mutations,
+                                                                           int* out_count);
+
+/* TODO: add other return types as we need them */
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_create_database(const char* cluster_file_path, FDBDatabase** out_database);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_create_database_from_connection_string(const char* connection_string,
+                                                                                    FDBDatabase** out_database);
+
+DLLEXPORT void fdb_database_destroy(FDBDatabase* d);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_set_option(FDBDatabase* d,
+                                                                 FDBDatabaseOption option,
+                                                                 uint8_t const* value,
+                                                                 int value_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_open_tenant(FDBDatabase* d,
+                                                                  uint8_t const* tenant_name,
+                                                                  int tenant_name_length,
+                                                                  FDBTenant** out_tenant);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_create_transaction(FDBDatabase* d,
+                                                                         FDBTransaction** out_transaction);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_reboot_worker(FDBDatabase* db,
+                                                                   uint8_t const* address,
+                                                                   int address_length,
+                                                                   fdb_bool_t check,
+                                                                   int duration);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_force_recovery_with_data_loss(FDBDatabase* db,
+                                                                                   uint8_t const* dcid,
+                                                                                   int dcid_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_create_snapshot(FDBDatabase* db,
+                                                                     uint8_t const* uid,
+                                                                     int uid_length,
+                                                                     uint8_t const* snap_command,
+                                                                     int snap_command_length);
+
+DLLEXPORT WARN_UNUSED_RESULT double fdb_database_get_main_thread_busyness(FDBDatabase* db);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_get_server_protocol(FDBDatabase* db, uint64_t expected_version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_purge_blob_granules(FDBDatabase* db,
+                                                                         uint8_t const* begin_key_name,
+                                                                         int begin_key_name_length,
+                                                                         uint8_t const* end_key_name,
+                                                                         int end_key_name_length,
+                                                                         int64_t purge_version,
+                                                                         fdb_bool_t force);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_wait_purge_granules_complete(FDBDatabase* db,
+                                                                                  uint8_t const* purge_key_name,
+                                                                                  int purge_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_blobbify_range(FDBDatabase* db,
+                                                                    uint8_t const* begin_key_name,
+                                                                    int begin_key_name_length,
+                                                                    uint8_t const* end_key_name,
+                                                                    int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_blobbify_range_blocking(FDBDatabase* db,
+                                                                             uint8_t const* begin_key_name,
+                                                                             int begin_key_name_length,
+                                                                             uint8_t const* end_key_name,
+                                                                             int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_unblobbify_range(FDBDatabase* db,
+                                                                      uint8_t const* begin_key_name,
+                                                                      int begin_key_name_length,
+                                                                      uint8_t const* end_key_name,
+                                                                      int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_list_blobbified_ranges(FDBDatabase* db,
+                                                                            uint8_t const* begin_key_name,
+                                                                            int begin_key_name_length,
+                                                                            uint8_t const* end_key_name,
+                                                                            int end_key_name_length,
+                                                                            int rangeLimit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_verify_blob_range(FDBDatabase* db,
+                                                                       uint8_t const* begin_key_name,
+                                                                       int begin_key_name_length,
+                                                                       uint8_t const* end_key_name,
+                                                                       int end_key_name_length,
+                                                                       int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_flush_blob_range(FDBDatabase* db,
+                                                                      uint8_t const* begin_key_name,
+                                                                      int begin_key_name_length,
+                                                                      uint8_t const* end_key_name,
+                                                                      int end_key_name_length,
+                                                                      fdb_bool_t compact,
+                                                                      int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_get_client_status(FDBDatabase* db);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_tenant_create_transaction(FDBTenant* tenant,
+                                                                       FDBTransaction** out_transaction);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_purge_blob_granules(FDBTenant* db,
+                                                                       uint8_t const* begin_key_name,
+                                                                       int begin_key_name_length,
+                                                                       uint8_t const* end_key_name,
+                                                                       int end_key_name_length,
+                                                                       int64_t purge_version,
+                                                                       fdb_bool_t force);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_wait_purge_granules_complete(FDBTenant* db,
+                                                                                uint8_t const* purge_key_name,
+                                                                                int purge_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_blobbify_range(FDBTenant* tenant,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_blobbify_range_blocking(FDBTenant* tenant,
+                                                                           uint8_t const* begin_key_name,
+                                                                           int begin_key_name_length,
+                                                                           uint8_t const* end_key_name,
+                                                                           int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_unblobbify_range(FDBTenant* tenant,
+                                                                    uint8_t const* begin_key_name,
+                                                                    int begin_key_name_length,
+                                                                    uint8_t const* end_key_name,
+                                                                    int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_list_blobbified_ranges(FDBTenant* tenant,
+                                                                          uint8_t const* begin_key_name,
+                                                                          int begin_key_name_length,
+                                                                          uint8_t const* end_key_name,
+                                                                          int end_key_name_length,
+                                                                          int rangeLimit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_list_blobbified_ranges(FDBTenant* tenant,
+                                                                          uint8_t const* begin_key_name,
+                                                                          int begin_key_name_length,
+                                                                          uint8_t const* end_key_name,
+                                                                          int end_key_name_length,
+                                                                          int rangeLimit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_verify_blob_range(FDBTenant* tenant,
+                                                                     uint8_t const* begin_key_name,
+                                                                     int begin_key_name_length,
+                                                                     uint8_t const* end_key_name,
+                                                                     int end_key_name_length,
+                                                                     int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_flush_blob_range(FDBTenant* tenant,
+                                                                    uint8_t const* begin_key_name,
+                                                                    int begin_key_name_length,
+                                                                    uint8_t const* end_key_name,
+                                                                    int end_key_name_length,
+                                                                    fdb_bool_t compact,
+                                                                    int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_get_id(FDBTenant* tenant);
+
+DLLEXPORT void fdb_tenant_destroy(FDBTenant* tenant);
+
+DLLEXPORT void fdb_transaction_destroy(FDBTransaction* tr);
+
+DLLEXPORT void fdb_transaction_cancel(FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_set_option(FDBTransaction* tr,
+                                                                    FDBTransactionOption option,
+                                                                    uint8_t const* value,
+                                                                    int value_length);
+#endif
+
+DLLEXPORT void fdb_transaction_set_read_version(FDBTransaction* tr, int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_read_version(FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(FDBTransaction* tr,
+                                                            uint8_t const* key_name,
+                                                            int key_name_length,
+                                                            fdb_bool_t snapshot);
+#endif
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(FDBTransaction* tr,
+                                                                uint8_t const* key_name,
+                                                                int key_name_length,
+                                                                fdb_bool_t or_equal,
+                                                                int offset,
+                                                                fdb_bool_t snapshot);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_addresses_for_key(FDBTransaction* tr,
+                                                                              uint8_t const* key_name,
+                                                                              int key_name_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(FDBTransaction* tr,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  fdb_bool_t begin_or_equal,
+                                                                  int begin_offset,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length,
+                                                                  fdb_bool_t end_or_equal,
+                                                                  int end_offset,
+                                                                  int limit,
+                                                                  int target_bytes,
+                                                                  FDBStreamingMode mode,
+                                                                  int iteration,
+                                                                  fdb_bool_t snapshot,
+                                                                  fdb_bool_t reverse);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_mapped_range(FDBTransaction* tr,
+                                                                         uint8_t const* begin_key_name,
+                                                                         int begin_key_name_length,
+                                                                         fdb_bool_t begin_or_equal,
+                                                                         int begin_offset,
+                                                                         uint8_t const* end_key_name,
+                                                                         int end_key_name_length,
+                                                                         fdb_bool_t end_or_equal,
+                                                                         int end_offset,
+                                                                         uint8_t const* mapper_name,
+                                                                         int mapper_name_length,
+                                                                         int limit,
+                                                                         int target_bytes,
+                                                                         FDBStreamingMode mode,
+                                                                         int iteration,
+                                                                         fdb_bool_t snapshot,
+                                                                         fdb_bool_t reverse);
+
+DLLEXPORT void fdb_transaction_set(FDBTransaction* tr,
+                                   uint8_t const* key_name,
+                                   int key_name_length,
+                                   uint8_t const* value,
+                                   int value_length);
+
+DLLEXPORT void fdb_transaction_atomic_op(FDBTransaction* tr,
+                                         uint8_t const* key_name,
+                                         int key_name_length,
+                                         uint8_t const* param,
+                                         int param_length,
+                                         FDBMutationType operation_type);
+
+DLLEXPORT void fdb_transaction_clear(FDBTransaction* tr, uint8_t const* key_name, int key_name_length);
+
+DLLEXPORT void fdb_transaction_clear_range(FDBTransaction* tr,
+                                           uint8_t const* begin_key_name,
+                                           int begin_key_name_length,
+                                           uint8_t const* end_key_name,
+                                           int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_watch(FDBTransaction* tr,
+                                                              uint8_t const* key_name,
+                                                              int key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_commit(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_get_committed_version(FDBTransaction* tr,
+                                                                               int64_t* out_version);
+
+/*
+ * These functions intentionally return an FDBFuture instead of a numeric value
+ * directly, so that calling the API can see the effect of previous
+ * mutations on the transaction. Specifically, mutations are applied
+ * asynchronously by the main thread. In order to see them, this call has to
+ * be serviced by the main thread too.
+ */
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_tag_throttled_duration(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_total_cost(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_approximate_size(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_versionstamp(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_on_error(FDBTransaction* tr, fdb_error_t error);
+
+DLLEXPORT void fdb_transaction_reset(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_add_conflict_range(FDBTransaction* tr,
+                                                                            uint8_t const* begin_key_name,
+                                                                            int begin_key_name_length,
+                                                                            uint8_t const* end_key_name,
+                                                                            int end_key_name_length,
+                                                                            FDBConflictRangeType type);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_estimated_range_size_bytes(FDBTransaction* tr,
+                                                                                       uint8_t const* begin_key_name,
+                                                                                       int begin_key_name_length,
+                                                                                       uint8_t const* end_key_name,
+                                                                                       int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_split_points(FDBTransaction* tr,
+                                                                               uint8_t const* begin_key_name,
+                                                                               int begin_key_name_length,
+                                                                               uint8_t const* end_key_name,
+                                                                               int end_key_name_length,
+                                                                               int64_t chunk_size);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_blob_granule_ranges(FDBTransaction* tr,
+                                                                                uint8_t const* begin_key_name,
+                                                                                int begin_key_name_length,
+                                                                                uint8_t const* end_key_name,
+                                                                                int end_key_name_length,
+                                                                                int rangeLimit);
+
+/* LatestVersion (-2) for readVersion means get read version from transaction
+   Separated out as optional because BG reads can support longer-lived reads than normal FDB transactions */
+DLLEXPORT WARN_UNUSED_RESULT FDBResult* fdb_transaction_read_blob_granules(FDBTransaction* tr,
+                                                                           uint8_t const* begin_key_name,
+                                                                           int begin_key_name_length,
+                                                                           uint8_t const* end_key_name,
+                                                                           int end_key_name_length,
+                                                                           int64_t beginVersion,
+                                                                           int64_t readVersion,
+                                                                           FDBReadBlobGranuleContext granuleContext);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_summarize_blob_granules(FDBTransaction* tr,
+                                                                                uint8_t const* begin_key_name,
+                                                                                int begin_key_name_length,
+                                                                                uint8_t const* end_key_name,
+                                                                                int end_key_name_length,
+                                                                                int64_t summaryVersion,
+                                                                                int rangeLimit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_read_blob_granules_description(FDBTransaction* tr,
+                                                                                       uint8_t const* begin_key_name,
+                                                                                       int begin_key_name_length,
+                                                                                       uint8_t const* end_key_name,
+                                                                                       int end_key_name_length,
+                                                                                       int64_t begin_version,
+                                                                                       int64_t read_version,
+                                                                                       int64_t* read_version_out);
+
+#define FDB_KEYSEL_LAST_LESS_THAN(k, l) k, l, 0, 0
+#define FDB_KEYSEL_LAST_LESS_OR_EQUAL(k, l) k, l, 1, 0
+#define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
+#define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_select_api_version_impl(int runtime_version, int header_version);
+
+DLLEXPORT int fdb_get_max_api_version(void);
+DLLEXPORT const char* fdb_get_client_version(void);
+
+/* LEGACY API VERSIONS */
+
+#if FDB_API_VERSION < 620
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_version(FDBFuture* f, int64_t* out_version);
+#else
+#define fdb_future_get_version(f, ov) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 610 || defined FDB_INCLUDE_LEGACY_TYPES
+typedef struct FDB_cluster FDBCluster;
+
+typedef enum {
+	/* This option is only a placeholder for C compatibility and should not be used */
+	FDB_CLUSTER_OPTION_DUMMY_DO_NOT_USE = -1
+} FDBClusterOption;
+#endif
+
+#if FDB_API_VERSION < 610
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_cluster(FDBFuture* f, FDBCluster** out_cluster);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_database(FDBFuture* f, FDBDatabase** out_database);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_create_cluster(const char* cluster_file_path);
+
+DLLEXPORT void fdb_cluster_destroy(FDBCluster* c);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_cluster_set_option(FDBCluster* c,
+                                                                FDBClusterOption option,
+                                                                uint8_t const* value,
+                                                                int value_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_cluster_create_database(FDBCluster* c,
+                                                                    uint8_t const* db_name,
+                                                                    int db_name_length);
+#else
+#define fdb_future_get_cluster(f, oc) FDB_REMOVED_FUNCTION
+#define fdb_future_get_database(f, od) FDB_REMOVED_FUNCTION
+#define fdb_create_cluster(cfp) FDB_REMOVED_FUNCTION
+#define fdb_cluster_destroy(c) FDB_REMOVED_FUNCTION
+#define fdb_cluster_set_option(c, o, v, vl) FDB_REMOVED_FUNCTION
+#define fdb_cluster_create_database(c, dn, dnl) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 23
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_error(FDBFuture* f, const char** out_description /* = NULL */);
+
+DLLEXPORT fdb_bool_t fdb_future_is_error(FDBFuture* f);
+#else
+#define fdb_future_is_error(x) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(FDBFuture* f,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(FDBTransaction* tr,
+                                                            uint8_t const* key_name,
+                                                            int key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(FDBTransaction* tr,
+                                                                uint8_t const* key_name,
+                                                                int key_name_length,
+                                                                fdb_bool_t or_equal,
+                                                                int offset);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network(const char* local_address);
+
+DLLEXPORT void fdb_transaction_set_option(FDBTransaction* tr, FDBTransactionOption option);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(FDBTransaction* tr,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length,
+                                                                  int limit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_selector(FDBTransaction* tr,
+                                                                           uint8_t const* begin_key_name,
+                                                                           int begin_key_name_length,
+                                                                           fdb_bool_t begin_or_equal,
+                                                                           int begin_offset,
+                                                                           uint8_t const* end_key_name,
+                                                                           int end_key_name_length,
+                                                                           fdb_bool_t end_or_equal,
+                                                                           int end_offset,
+                                                                           int limit);
+#else
+#define fdb_transaction_get_range_selector(tr, bkn, bknl, boe, bo, ekn, eknl, eoe, eo, lim) FDB_REMOVED_FUNCTION
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/730/fdb_c_apiversion.g.h b/bindings/rust/foundationdb-sys/include/730/fdb_c_apiversion.g.h
new file mode 100644
index 00000000000..b8785014dfc
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/730/fdb_c_apiversion.g.h
@@ -0,0 +1,41 @@
+#ifndef FDB_C_APIVERSION_G_H
+#define FDB_C_APIVERSION_G_H
+#pragma once
+
+/*
+ * fdb_c_apiversion.g.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2023 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+/* The latest FDB C API version */
+#define FDB_LATEST_API_VERSION 730
+
+/* The latest FDB API version supported by bindings. It may lag behind the latest C API version */
+#define FDB_LATEST_BINDINGS_API_VERSION 730
+
+/* API version introducing client_tmp_dir option */
+#define FDB_API_VERSION_CLIENT_TMP_DIR 720
+
+/* API version introducing disable_client_bypass option */
+#define FDB_API_VERSION_DISABLE_CLIENT_BYPASS 720
+
+/* API version with multitenancy API released */
+#define FDB_API_VERSION_TENANT_API_RELEASED 720
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/730/fdb_c_options.g.h b/bindings/rust/foundationdb-sys/include/730/fdb_c_options.g.h
new file mode 100644
index 00000000000..93ea031a1aa
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/730/fdb_c_options.g.h
@@ -0,0 +1,613 @@
+#ifndef FDB_C_OPTIONS_G_H
+#define FDB_C_OPTIONS_G_H
+#pragma once
+
+/*
+ * FoundationDB C API
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+typedef enum {
+    /* Deprecated */
+    /* Parameter: (String) IP:PORT */
+    FDB_NET_OPTION_LOCAL_ADDRESS=10,
+
+    /* Deprecated */
+    /* Parameter: (String) path to cluster file */
+    FDB_NET_OPTION_CLUSTER_FILE=20,
+
+    /* Enables trace output to a file in a directory of the clients choosing */
+    /* Parameter: (String) path to output directory (or NULL for current working directory) */
+    FDB_NET_OPTION_TRACE_ENABLE=30,
+
+    /* Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes. */
+    /* Parameter: (Int) max size of a single trace output file */
+    FDB_NET_OPTION_TRACE_ROLL_SIZE=31,
+
+    /* Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time. */
+    /* Parameter: (Int) max total size of trace files */
+    FDB_NET_OPTION_TRACE_MAX_LOGS_SIZE=32,
+
+    /* Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'. */
+    /* Parameter: (String) value of the LogGroup attribute */
+    FDB_NET_OPTION_TRACE_LOG_GROUP=33,
+
+    /* Select the format of the log files. xml (the default) and json are supported. */
+    /* Parameter: (String) Format of trace files */
+    FDB_NET_OPTION_TRACE_FORMAT=34,
+
+    /* Select clock source for trace files. now (the default) or realtime are supported. */
+    /* Parameter: (String) Trace clock source */
+    FDB_NET_OPTION_TRACE_CLOCK_SOURCE=35,
+
+    /* Once provided, this string will be used to replace the port/PID in the log file names. */
+    /* Parameter: (String) The identifier that will be part of all trace file names */
+    FDB_NET_OPTION_TRACE_FILE_IDENTIFIER=36,
+
+    /* Use the same base trace file name for all client threads as it did before version 7.2. The current default behavior is to use distinct trace file names for client threads by including their version and thread index. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_TRACE_SHARE_AMONG_CLIENT_THREADS=37,
+
+    /* Initialize trace files on network setup, determine the local IP later. Otherwise tracing is initialized when opening the first database. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_TRACE_INITIALIZE_ON_SETUP=38,
+
+    /* Set file suffix for partially written log files. */
+    /* Parameter: (String) Append this suffix to partially written log files. When a log file is complete, it is renamed to remove the suffix. No separator is added between the file and the suffix. If you want to add a file extension, you should include the separator - e.g. '.tmp' instead of 'tmp' to add the 'tmp' extension. */
+    FDB_NET_OPTION_TRACE_PARTIAL_FILE_SUFFIX=39,
+
+    /* Set internal tuning or debugging knobs */
+    /* Parameter: (String) knob_name=knob_value */
+    FDB_NET_OPTION_KNOB=40,
+
+    /* Deprecated */
+    /* Parameter: (String) file path or linker-resolved name */
+    FDB_NET_OPTION_TLS_PLUGIN=41,
+
+    /* Set the certificate chain */
+    /* Parameter: (Bytes) certificates */
+    FDB_NET_OPTION_TLS_CERT_BYTES=42,
+
+    /* Set the file from which to load the certificate chain */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_CERT_PATH=43,
+
+    /* Set the private key corresponding to your own certificate */
+    /* Parameter: (Bytes) key */
+    FDB_NET_OPTION_TLS_KEY_BYTES=45,
+
+    /* Set the file from which to load the private key corresponding to your own certificate */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_KEY_PATH=46,
+
+    /* Set the peer certificate field verification criteria */
+    /* Parameter: (Bytes) verification pattern */
+    FDB_NET_OPTION_TLS_VERIFY_PEERS=47,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_BUGGIFY_ENABLE=48,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_BUGGIFY_DISABLE=49,
+
+    /* Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed. */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=50,
+
+    /* Set the probability of an active BUGGIFY section being fired */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_BUGGIFY_SECTION_FIRED_PROBABILITY=51,
+
+    /* Set the ca bundle */
+    /* Parameter: (Bytes) ca bundle */
+    FDB_NET_OPTION_TLS_CA_BYTES=52,
+
+    /* Set the file from which to load the certificate authority bundle */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_CA_PATH=53,
+
+    /* Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used. */
+    /* Parameter: (String) key passphrase */
+    FDB_NET_OPTION_TLS_PASSWORD=54,
+
+    /* Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_MULTI_VERSION_CLIENT_API=60,
+
+    /* If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CALLBACKS_ON_EXTERNAL_THREADS=61,
+
+    /* Adds an external client library for use by the multi-version client API. Must be set before setting up the network. */
+    /* Parameter: (String) path to client library */
+    FDB_NET_OPTION_EXTERNAL_CLIENT_LIBRARY=62,
+
+    /* Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network. */
+    /* Parameter: (String) path to directory containing client libraries */
+    FDB_NET_OPTION_EXTERNAL_CLIENT_DIRECTORY=63,
+
+    /* Prevents connections through the local client, allowing only connections through externally loaded client libraries. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_LOCAL_CLIENT=64,
+
+    /* Spawns multiple worker threads for each version of the client that is loaded.  Setting this to a number greater than one implies disable_local_client. */
+    /* Parameter: (Int) Number of client threads to be spawned.  Each cluster will be serviced by a single client thread. */
+    FDB_NET_OPTION_CLIENT_THREADS_PER_VERSION=65,
+
+    /* Adds an external client library to be used with a future version protocol. This option can be used testing purposes only! */
+    /* Parameter: (String) path to client library */
+    FDB_NET_OPTION_FUTURE_VERSION_CLIENT_LIBRARY=66,
+
+    /* Retain temporary external client library copies that are created for enabling multi-threading. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_RETAIN_CLIENT_LIBRARY_COPIES=67,
+
+    /* Ignore the failure to initialize some of the external clients */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_IGNORE_EXTERNAL_CLIENT_FAILURES=68,
+
+    /* Fail with an error if there is no client matching the server version the client is connecting to */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_FAIL_INCOMPATIBLE_CLIENT=69,
+
+    /* Disables logging of client statistics, such as sampled transaction activity. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_CLIENT_STATISTICS_LOGGING=70,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_ENABLE_SLOW_TASK_PROFILING=71,
+
+    /* Enables debugging feature to perform run loop profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_ENABLE_RUN_LOOP_PROFILING=71,
+
+    /* Prevents the multi-version client API from being disabled, even if no external clients are configured. This option is required to use GRV caching. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_CLIENT_BYPASS=72,
+
+    /* Enable client buggify - will make requests randomly fail (intended for client testing) */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_ENABLE=80,
+
+    /* Disable client buggify */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_DISABLE=81,
+
+    /* Set the probability of a CLIENT_BUGGIFY section being active for the current execution. */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=82,
+
+    /* Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_FIRED_PROBABILITY=83,
+
+    /* Set a tracer to run on the client. Should be set to the same value as the tracer set on the server. */
+    /* Parameter: (String) Distributed tracer type. Choose from none, log_file, or network_lossy */
+    FDB_NET_OPTION_DISTRIBUTED_CLIENT_TRACER=90,
+
+    /* Sets the directory for storing temporary files created by FDB client, such as temporary copies of client libraries. Defaults to /tmp */
+    /* Parameter: (String) Client directory for temporary files.  */
+    FDB_NET_OPTION_CLIENT_TMP_DIR=91,
+
+    /* This option is set automatically to communicate the list of supported clients to the active client. */
+    /* Parameter: (String) [release version],[source version],[protocol version];... This is a hidden parameter and should not be used directly by applications.*/
+    FDB_NET_OPTION_SUPPORTED_CLIENT_VERSIONS=1000,
+
+    /* This option is set automatically on all clients loaded externally using the multi-version API. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_NET_OPTION_EXTERNAL_CLIENT=1001,
+
+    /* This option tells a child on a multiversion client what transport ID to use. */
+    /* Parameter: (Int) Transport ID for the child connection This is a hidden parameter and should not be used directly by applications.*/
+    FDB_NET_OPTION_EXTERNAL_CLIENT_TRANSPORT_ID=1002
+} FDBNetworkOption;
+
+typedef enum {
+    /* Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000. */
+    /* Parameter: (Int) Max location cache entries */
+    FDB_DB_OPTION_LOCATION_CACHE_SIZE=10,
+
+    /* Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000. */
+    /* Parameter: (Int) Max outstanding watches */
+    FDB_DB_OPTION_MAX_WATCHES=20,
+
+    /* Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing. */
+    /* Parameter: (String) Hexadecimal ID */
+    FDB_DB_OPTION_MACHINE_ID=21,
+
+    /* Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing. */
+    /* Parameter: (String) Hexadecimal ID */
+    FDB_DB_OPTION_DATACENTER_ID=22,
+
+    /* Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_SNAPSHOT_RYW_ENABLE=26,
+
+    /* Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_SNAPSHOT_RYW_DISABLE=27,
+
+    /* Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) Maximum length of escaped key and value fields. */
+    FDB_DB_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    /* Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher. */
+    /* Parameter: (Int) value in milliseconds of timeout */
+    FDB_DB_OPTION_TRANSACTION_TIMEOUT=500,
+
+    /* Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) number of times to retry */
+    FDB_DB_OPTION_TRANSACTION_RETRY_LIMIT=501,
+
+    /* Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) value in milliseconds of maximum delay */
+    FDB_DB_OPTION_TRANSACTION_MAX_RETRY_DELAY=502,
+
+    /* Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) value in bytes */
+    FDB_DB_OPTION_TRANSACTION_SIZE_LIMIT=503,
+
+    /* The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_CAUSAL_READ_RISKY=504,
+
+    /* Deprecated. Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_INCLUDE_PORT_IN_ADDRESS=505,
+
+    /* Set a random idempotency id for all transactions. See the transaction option description for more information. This feature is in development and not ready for general use. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_AUTOMATIC_IDEMPOTENCY=506,
+
+    /* Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. This sets the ``bypass_unreadable`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_BYPASS_UNREADABLE=700,
+
+    /* By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    /* Enables conflicting key reporting on all transactions, allowing them to retrieve the keys that are conflicting with other transactions. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_REPORT_CONFLICTING_KEYS=702,
+
+    /* Use configuration database. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_USE_CONFIG_DATABASE=800,
+
+    /* Enables verification of causal read risky by checking whether clients are able to read stale data when they detect a recovery, and logging an error if so. */
+    /* Parameter: (Int) integer between 0 and 100 expressing the probability a client will verify it can't read stale data */
+    FDB_DB_OPTION_TEST_CAUSAL_READ_RISKY=900
+} FDBDatabaseOption;
+
+typedef enum {
+    /* The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_WRITE_RISKY=10,
+
+    /* The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_READ_RISKY=20,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_READ_DISABLE=21,
+
+    /* Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_INCLUDE_PORT_IN_ADDRESS=23,
+
+    /* The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_NEXT_WRITE_NO_WRITE_CONFLICT_RANGE=30,
+
+    /* Committing this transaction will bypass the normal load balancing across commit proxies and go directly to the specifically nominated 'first commit proxy'. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_COMMIT_ON_FIRST_PROXY=40,
+
+    /*  */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_CHECK_WRITES_ENABLE=50,
+
+    /* Reads performed by a transaction will not see any prior mutations that occured in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction. It is an error to set this option after performing any reads or writes on the transaction. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE=51,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_AHEAD_DISABLE=52,
+
+    /* Storage server should cache disk blocks needed for subsequent read requests in this transaction.  This is the default behavior. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_SERVER_SIDE_CACHE_ENABLE=507,
+
+    /* Storage server should not cache disk blocks needed for subsequent read requests in this transaction.  This can be used to avoid cache pollution for reads not expected to be repeated. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_SERVER_SIDE_CACHE_DISABLE=508,
+
+    /* Use normal read priority for subsequent read requests in this transaction.  This is the default read priority. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_PRIORITY_NORMAL=509,
+
+    /* Use low read priority for subsequent read requests in this transaction. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_PRIORITY_LOW=510,
+
+    /* Use high read priority for subsequent read requests in this transaction. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_PRIORITY_HIGH=511,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_DATACENTER=110,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_RISKY=120,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_DEV_NULL_IS_WEB_SCALE=130,
+
+    /* Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_PRIORITY_SYSTEM_IMMEDIATE=200,
+
+    /* Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_PRIORITY_BATCH=201,
+
+    /* This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_INITIALIZE_NEW_DATABASE=300,
+
+    /* Allows this transaction to read and modify system keys (those that start with the byte 0xFF). Implies raw_access. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_ACCESS_SYSTEM_KEYS=301,
+
+    /* Allows this transaction to read system keys (those that start with the byte 0xFF). Implies raw_access. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_SYSTEM_KEYS=302,
+
+    /* Allows this transaction to access the raw key-space when tenant mode is on. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_RAW_ACCESS=303,
+
+    /* Allows this transaction to bypass storage quota enforcement. Should only be used for transactions that directly or indirectly decrease the size of the tenant group's data. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_BYPASS_STORAGE_QUOTA=304,
+
+    /*  */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_DEBUG_DUMP=400,
+
+    /*  */
+    /* Parameter: (String) Optional transaction name */
+    FDB_TR_OPTION_DEBUG_RETRY_LOGGING=401,
+
+    /* Deprecated */
+    /* Parameter: (String) String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters. */
+    FDB_TR_OPTION_TRANSACTION_LOGGING_ENABLE=402,
+
+    /* Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled. */
+    /* Parameter: (String) String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters. */
+    FDB_TR_OPTION_DEBUG_TRANSACTION_IDENTIFIER=403,
+
+    /* Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_LOG_TRANSACTION=404,
+
+    /* Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation. */
+    /* Parameter: (Int) Maximum length of escaped key and value fields. */
+    FDB_TR_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    /* Sets an identifier for server tracing of this transaction. When committed, this identifier triggers logging when each part of the transaction authority encounters it, which is helpful in diagnosing slowness in misbehaving clusters. The identifier is randomly generated. When there is also a debug_transaction_identifier, both IDs are logged together. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SERVER_REQUEST_TRACING=406,
+
+    /* Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) value in milliseconds of timeout */
+    FDB_TR_OPTION_TIMEOUT=500,
+
+    /* Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) number of times to retry */
+    FDB_TR_OPTION_RETRY_LIMIT=501,
+
+    /* Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) value in milliseconds of maximum delay */
+    FDB_TR_OPTION_MAX_RETRY_DELAY=502,
+
+    /* Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit. */
+    /* Parameter: (Int) value in bytes */
+    FDB_TR_OPTION_SIZE_LIMIT=503,
+
+    /* Associate this transaction with this ID for the purpose of checking whether or not this transaction has already committed. Must be at least 16 bytes and less than 256 bytes. This feature is in development and not ready for general use. Unless the automatic_idempotency option is set after this option, the client will not automatically attempt to remove this id from the cluster after a successful commit. */
+    /* Parameter: (String) Unique ID This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_IDEMPOTENCY_ID=504,
+
+    /* Automatically assign a random 16 byte idempotency id for this transaction. Prevents commits from failing with ``commit_unknown_result``. WARNING: If you are also using the multiversion client or transaction timeouts, if either cluster_version_changed or transaction_timed_out was thrown during a commit, then that commit may have already succeeded or may succeed in the future. This feature is in development and not ready for general use. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_AUTOMATIC_IDEMPOTENCY=505,
+
+    /* Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SNAPSHOT_RYW_ENABLE=600,
+
+    /* Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SNAPSHOT_RYW_DISABLE=601,
+
+    /* The transaction can read and write to locked databases, and is responsible for checking that it took the lock. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_LOCK_AWARE=700,
+
+    /* By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    /* The transaction can read from locked databases. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_LOCK_AWARE=702,
+
+    /* No other transactions will be applied before this transaction within the same commit version. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_FIRST_IN_BATCH=710,
+
+    /* This option should only be used by tools which change the database configuration. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USE_PROVISIONAL_PROXIES=711,
+
+    /* The transaction can retrieve keys that are conflicting with other transactions. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_REPORT_CONFLICTING_KEYS=712,
+
+    /* By default, the special key space will only allow users to read from exactly one module (a subspace in the special key space). Use this option to allow reading from zero or more modules. Users who set this option should be prepared for new modules, which may have different behaviors than the modules they're currently reading. For example, a new module might block or return an error. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SPECIAL_KEY_SPACE_RELAXED=713,
+
+    /* By default, users are not allowed to write to special keys. Enable this option will implicitly enable all options required to achieve the configuration change. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SPECIAL_KEY_SPACE_ENABLE_WRITES=714,
+
+    /* Adds a tag to the transaction that can be used to apply manual targeted throttling. At most 5 tags can be set on a transaction. */
+    /* Parameter: (String) String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters. */
+    FDB_TR_OPTION_TAG=800,
+
+    /* Adds a tag to the transaction that can be used to apply manual or automatic targeted throttling. At most 5 tags can be set on a transaction. */
+    /* Parameter: (String) String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters. */
+    FDB_TR_OPTION_AUTO_THROTTLE_TAG=801,
+
+    /* Adds a parent to the Span of this transaction. Used for transaction tracing. A span can be identified with any 16 bytes */
+    /* Parameter: (Bytes) A byte string of length 16 used to associate the span of this transaction with a parent */
+    FDB_TR_OPTION_SPAN_PARENT=900,
+
+    /* Asks storage servers for how many bytes a clear key range contains. Otherwise uses the location cache to roughly estimate this. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_EXPENSIVE_CLEAR_COST_ESTIMATION_ENABLE=1000,
+
+    /* Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. These reads will view versionstamp operations as if they were set operations that did not fill in the versionstamp. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_BYPASS_UNREADABLE=1100,
+
+    /* Allows this transaction to use cached GRV from the database context. Defaults to off. Upon first usage, starts a background updater to periodically update the cache to avoid stale read versions. The disable_client_bypass option must also be set. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USE_GRV_CACHE=1101,
+
+    /* Specifically instruct this transaction to NOT use cached GRV. Primarily used for the read version cache's background updater to avoid attempting to read a cached entry in specific situations. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_SKIP_GRV_CACHE=1102,
+
+    /* Attach given authorization token to the transaction such that subsequent tenant-aware requests are authorized */
+    /* Parameter: (String) A JSON Web Token authorized to access data belonging to one or more tenants, indicated by 'tenants' claim of the token's payload. */
+    FDB_TR_OPTION_AUTHORIZATION_TOKEN=2000
+} FDBTransactionOption;
+
+typedef enum {
+    /* Client intends to consume the entire range and would like it all transferred as early as possible. */
+    FDB_STREAMING_MODE_WANT_ALL=-2,
+
+    /* The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL`` */
+    FDB_STREAMING_MODE_ITERATOR=-1,
+
+    /* Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used. */
+    FDB_STREAMING_MODE_EXACT=0,
+
+    /* Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early. */
+    FDB_STREAMING_MODE_SMALL=1,
+
+    /* Infrequently used. Transfer data in batches sized in between small and large. */
+    FDB_STREAMING_MODE_MEDIUM=2,
+
+    /* Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode. */
+    FDB_STREAMING_MODE_LARGE=3,
+
+    /* Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted. */
+    FDB_STREAMING_MODE_SERIAL=4
+} FDBStreamingMode;
+
+typedef enum {
+    /* Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow. */
+    FDB_MUTATION_TYPE_ADD=2,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_AND=6,
+
+    /* Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_AND=6,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_OR=7,
+
+    /* Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_OR=7,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_XOR=8,
+
+    /* Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_XOR=8,
+
+    /* Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size. */
+    FDB_MUTATION_TYPE_APPEND_IF_FITS=9,
+
+    /* Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_MAX=12,
+
+    /* Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_MIN=13,
+
+    /* Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes. */
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_KEY=14,
+
+    /* Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset. */
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_VALUE=15,
+
+    /* Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_BYTE_MIN=16,
+
+    /* Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_BYTE_MAX=17,
+
+    /* Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared. */
+    FDB_MUTATION_TYPE_COMPARE_AND_CLEAR=20
+} FDBMutationType;
+
+typedef enum {
+    /* Used to add a read conflict range */
+    FDB_CONFLICT_RANGE_TYPE_READ=0,
+
+    /* Used to add a write conflict range */
+    FDB_CONFLICT_RANGE_TYPE_WRITE=1
+} FDBConflictRangeType;
+
+typedef enum {
+    /* Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error. */
+    FDB_ERROR_PREDICATE_RETRYABLE=50000,
+
+    /* Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify. */
+    FDB_ERROR_PREDICATE_MAYBE_COMMITTED=50001,
+
+    /* Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried. */
+    FDB_ERROR_PREDICATE_RETRYABLE_NOT_COMMITTED=50002
+} FDBErrorPredicate;
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/730/fdb_c_shim.h b/bindings/rust/foundationdb-sys/include/730/fdb_c_shim.h
new file mode 100644
index 00000000000..44dfdc7348b
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/730/fdb_c_shim.h
@@ -0,0 +1,47 @@
+/*
+ * fdb_shim_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2022 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_SHIM_C_H
+#define FDB_SHIM_C_H
+#pragma once
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Specify the path of the local libfdb_c.so library to be dynamically loaded by the shim layer
+ *
+ * This enables running the same application code with different client library versions,
+ * e.g. using the latest development build for testing new features, but still using the latest
+ * stable release in production deployments.
+ *
+ * The given path overrides the environment variable FDB_LOCAL_CLIENT_LIBRARY_PATH
+ */
+DLLEXPORT void fdb_shim_set_local_client_library_path(const char* filePath);
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/730/fdb_c_types.h b/bindings/rust/foundationdb-sys/include/730/fdb_c_types.h
new file mode 100644
index 00000000000..779e227ad5e
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/730/fdb_c_types.h
@@ -0,0 +1,47 @@
+/*
+ * fdb_c_types.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2022 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_TYPES_H
+#define FDB_C_TYPES_H
+#pragma once
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Pointers to these opaque types represent objects in the FDB API */
+typedef struct FDB_future FDBFuture;
+typedef struct FDB_result FDBResult;
+typedef struct FDB_cluster FDBCluster;
+typedef struct FDB_database FDBDatabase;
+typedef struct FDB_tenant FDBTenant;
+typedef struct FDB_transaction FDBTransaction;
+
+typedef int fdb_error_t;
+typedef int fdb_bool_t;
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/730/version.txt b/bindings/rust/foundationdb-sys/include/730/version.txt
new file mode 100644
index 00000000000..aec35f3a894
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/730/version.txt
@@ -0,0 +1 @@
+7.3.27
diff --git a/bindings/rust/foundationdb-sys/include/740/fdb_c.h b/bindings/rust/foundationdb-sys/include/740/fdb_c.h
new file mode 100644
index 00000000000..c6f5a100395
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/740/fdb_c.h
@@ -0,0 +1,805 @@
+/*
+ * fdb_c.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2024 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_H
+#define FDB_C_H
+#pragma once
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#include "fdb_c_apiversion.g.h"
+#if (defined FDB_USE_LATEST_API_VERSION)
+#define FDB_API_VERSION FDB_LATEST_API_VERSION
+#elif (defined FDB_USE_LATEST_BINDINGS_API_VERSION)
+#define FDB_API_VERSION FDB_LATEST_BINDINGS_API_VERSION
+#endif
+
+#if !defined(FDB_API_VERSION)
+#error You must #define FDB_API_VERSION prior to including fdb_c.h (the latest version is defined as FDB_LATEST_API_VERSION)
+#elif FDB_API_VERSION < 13
+#error API version no longer supported (upgrade to 13)
+#elif FDB_API_VERSION > FDB_LATEST_API_VERSION
+#error Requested API version requires a newer version of this header
+#endif
+
+#if FDB_API_VERSION >= 23 && !defined(WARN_UNUSED_RESULT)
+#ifdef __GNUG__
+#define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+#define WARN_UNUSED_RESULT
+#endif
+#else
+#define WARN_UNUSED_RESULT
+#endif
+
+/*
+ * With default settings, gcc will not warn about unprototyped functions being
+ * called, so it is easy to erroneously call a function which is not available
+ * at FDB_API_VERSION and then get an error only at runtime.  These macros
+ * ensure a compile error in such cases, and attempt to make the compile error
+ * slightly informative.
+ */
+#define This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION() { == == = }
+#define FDB_REMOVED_FUNCTION This_FoundationDB_API_function_is_removed_at_this_FDB_API_VERSION(0)
+
+#include <stdint.h>
+
+#include "fdb_c_options.g.h"
+#include "fdb_c_types.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+DLLEXPORT const char* fdb_get_error(fdb_error_t code);
+
+DLLEXPORT fdb_bool_t fdb_error_predicate(int predicate_test, fdb_error_t code);
+
+#define /* fdb_error_t */ fdb_select_api_version(v) fdb_select_api_version_impl(v, FDB_API_VERSION)
+
+/*
+ * A variant of fdb_select_api_version that caps the header API version by the maximum API version
+ * supported by the client library. It is intended mainly for use in combination with the shim
+ * layer, which loads the client library dynamically.
+ */
+#define /* fdb_error_t */ fdb_select_api_version_capped(v)                                                             \
+	fdb_select_api_version_impl(                                                                                       \
+	    v, FDB_API_VERSION < fdb_get_max_api_version() ? FDB_API_VERSION : fdb_get_max_api_version())
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_network_set_option(FDBNetworkOption option,
+                                                                uint8_t const* value,
+                                                                int value_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network(void);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_run_network(void);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_stop_network(void);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_add_network_thread_completion_hook(void (*hook)(void*),
+                                                                                void* hook_parameter);
+
+#pragma pack(push, 4)
+typedef struct key {
+	const uint8_t* key;
+	int key_length;
+} FDBKey;
+#if FDB_API_VERSION >= 630
+typedef struct keyvalue {
+	const uint8_t* key;
+	int key_length;
+	const uint8_t* value;
+	int value_length;
+} FDBKeyValue;
+#else
+typedef struct keyvalue {
+	const void* key;
+	int key_length;
+	const void* value;
+	int value_length;
+} FDBKeyValue;
+#endif
+
+#pragma pack(pop)
+
+/* Memory layout of KeySelectorRef. */
+typedef struct keyselector {
+	FDBKey key;
+	/* orEqual and offset have not be tested in C binding. Just a placeholder. */
+	fdb_bool_t orEqual;
+	int offset;
+} FDBKeySelector;
+
+/* Memory layout of GetRangeReqAndResultRef. */
+typedef struct getrangereqandresult {
+	FDBKeySelector begin;
+	FDBKeySelector end;
+	FDBKeyValue* data;
+	int m_size, m_capacity;
+} FDBGetRangeReqAndResult;
+
+/* Memory layout of MappedKeyValueRef.
+
+Total 112 bytes
+- key (12 bytes)
+:74:8F:8E:5F:AE:7F:00:00
+:4A:00:00:00
+- value (12 bytes)
+:70:8F:8E:5F:AE:7F:00:00
+:00:00:00:00
+- begin selector (20 bytes)
+:30:8F:8E:5F:AE:7F:00:00
+:2D:00:00:00
+:00:7F:00:00
+:01:00:00:00
+- end selector (20 bytes)
+:EC:8E:8E:5F:AE:7F:00:00
+:2D:00:00:00
+:00:2B:3C:60
+:01:00:00:00
+- vector (16 bytes)
+:74:94:8E:5F:AE:7F:00:00
+:01:00:00:00
+:01:00:00:00
+- buffer (32 bytes)
+:00:20:D1:61:00:00:00:00
+:00:00:00:00:00:00:00:00
+:00:00:00:00:00:00:00:00
+:01:00:00:00:AE:7F:00:00
+*/
+typedef struct mappedkeyvalue {
+	FDBKey key;
+	FDBKey value;
+	/* It's complicated to map a std::variant to C. For now we assume the underlying requests are always getRange and
+	 * take the shortcut. */
+	FDBGetRangeReqAndResult getRange;
+	unsigned char buffer[32];
+} FDBMappedKeyValue;
+
+#pragma pack(push, 4)
+typedef struct keyrange {
+	const uint8_t* begin_key;
+	int begin_key_length;
+	const uint8_t* end_key;
+	int end_key_length;
+} FDBKeyRange;
+
+typedef struct granulesummary {
+	FDBKeyRange key_range;
+	int64_t snapshot_version;
+	int64_t snapshot_size;
+	int64_t delta_version;
+	int64_t delta_size;
+} FDBGranuleSummary;
+#pragma pack(pop)
+
+typedef struct readgranulecontext {
+	/* User context to pass along to functions */
+	void* userContext;
+
+	/* Returns a unique id for the load. Asynchronous to support queueing multiple in parallel. */
+	int64_t (*start_load_f)(const char* filename,
+	                        int filenameLength,
+	                        int64_t offset,
+	                        int64_t length,
+	                        int64_t fullFileLength,
+	                        void* context);
+
+	/* Returns data for the load. Pass the loadId returned by start_load_f */
+	uint8_t* (*get_load_f)(int64_t loadId, void* context);
+
+	/* Frees data from load. Pass the loadId returned by start_load_f */
+	void (*free_load_f)(int64_t loadId, void* context);
+
+	/* Set this to true for testing if you don't want to read the granule files,
+	   just do the request to the blob workers */
+	fdb_bool_t debugNoMaterialize;
+
+	/* Number of granules to load in parallel */
+	int granuleParallelism;
+} FDBReadBlobGranuleContext;
+
+typedef enum { FDB_BG_MUTATION_TYPE_SET_VALUE = 0, FDB_BG_MUTATION_TYPE_CLEAR_RANGE = 1 } FDBBGMutationType;
+
+#pragma pack(push, 4)
+
+typedef struct bgtenantprefix {
+	fdb_bool_t present;
+	FDBKey prefix;
+} FDBBGTenantPrefix;
+
+/* encryption structs correspond to similar ones in BlobGranuleCommon.h */
+typedef struct bgencryptionkey {
+	int64_t domain_id;
+	uint64_t base_key_id;
+	uint32_t base_kcv;
+	uint64_t random_salt;
+	FDBKey base_key;
+} FDBBGEncryptionKey;
+
+typedef struct bgencryptionctx {
+	fdb_bool_t present;
+	FDBBGEncryptionKey textKey;
+	uint32_t textKCV;
+	FDBBGEncryptionKey headerKey;
+	uint32_t headerKCV;
+	FDBKey iv;
+} FDBBGEncryptionCtx;
+
+typedef struct bgfilepointer {
+	const uint8_t* filename_ptr;
+	int filename_length;
+	int64_t file_offset;
+	int64_t file_length;
+	int64_t full_file_length;
+	int64_t file_version;
+	FDBBGEncryptionCtx encryption_ctx;
+} FDBBGFilePointer;
+
+typedef struct bgmutation {
+	/* FDBBGMutationType */ uint8_t type;
+	int64_t version;
+	const uint8_t* param1_ptr;
+	int param1_length;
+	const uint8_t* param2_ptr;
+	int param2_length;
+} FDBBGMutation;
+
+typedef struct bgfiledescription {
+	FDBKeyRange key_range;
+	fdb_bool_t snapshot_present;
+	FDBBGFilePointer snapshot_file_pointer;
+	int delta_file_count;
+	FDBBGFilePointer* delta_files;
+	int memory_mutation_count;
+	FDBBGMutation* memory_mutations;
+	FDBBGTenantPrefix tenant_prefix;
+} FDBBGFileDescription;
+#pragma pack(pop)
+
+DLLEXPORT void fdb_future_cancel(FDBFuture* f);
+
+DLLEXPORT void fdb_future_release_memory(FDBFuture* f);
+
+DLLEXPORT void fdb_future_destroy(FDBFuture* f);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_block_until_ready(FDBFuture* f);
+
+DLLEXPORT fdb_bool_t fdb_future_is_ready(FDBFuture* f);
+
+typedef void (*FDBCallback)(FDBFuture* future, void* callback_parameter);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_set_callback(FDBFuture* f,
+                                                                 FDBCallback callback,
+                                                                 void* callback_parameter);
+
+#if FDB_API_VERSION >= 23
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_error(FDBFuture* f);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_bool(FDBFuture* f, fdb_bool_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_int64(FDBFuture* f, int64_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_uint64(FDBFuture* f, uint64_t* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_double(FDBFuture* f, double* out);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_key(FDBFuture* f, uint8_t const** out_key, int* out_key_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_value(FDBFuture* f,
+                                                              fdb_bool_t* out_present,
+                                                              uint8_t const** out_value,
+                                                              int* out_value_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(FDBFuture* f,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count,
+                                                                       fdb_bool_t* out_more);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_mappedkeyvalue_array(FDBFuture* f,
+                                                                             FDBMappedKeyValue const** out_kv,
+                                                                             int* out_count,
+                                                                             fdb_bool_t* out_more);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_key_array(FDBFuture* f,
+                                                                  FDBKey const** out_key_array,
+                                                                  int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_string_array(FDBFuture* f,
+                                                                     const char*** out_strings,
+                                                                     int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyrange_array(FDBFuture* f,
+                                                                       FDBKeyRange const** out_ranges,
+                                                                       int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_granule_summary_array(FDBFuture* f,
+                                                                              FDBGranuleSummary const** out_summaries,
+                                                                              int* out_count);
+
+/* all for using future result from read_blob_granules_description */
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_readbg_get_descriptions(FDBFuture* f,
+                                                                            FDBBGFileDescription** out,
+                                                                            int* desc_count);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBResult* fdb_readbg_parse_snapshot_file(const uint8_t* file_data,
+                                                                       int file_len,
+                                                                       FDBBGTenantPrefix const* tenant_prefix,
+                                                                       FDBBGEncryptionCtx const* encryption_ctx);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBResult* fdb_readbg_parse_delta_file(const uint8_t* file_data,
+                                                                    int file_len,
+                                                                    FDBBGTenantPrefix const* tenant_prefix,
+                                                                    FDBBGEncryptionCtx const* encryption_ctx);
+
+/* FDBResult is a synchronous computation result, as opposed to a future that is asynchronous. */
+DLLEXPORT void fdb_result_destroy(FDBResult* r);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_result_get_keyvalue_array(FDBResult* r,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count,
+                                                                       fdb_bool_t* out_more);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_result_get_bg_mutations_array(FDBResult* r,
+                                                                           FDBBGMutation const** out_mutations,
+                                                                           int* out_count);
+
+/* TODO: add other return types as we need them */
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_create_database(const char* cluster_file_path, FDBDatabase** out_database);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_create_database_from_connection_string(const char* connection_string,
+                                                                                    FDBDatabase** out_database);
+
+DLLEXPORT void fdb_database_destroy(FDBDatabase* d);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_set_option(FDBDatabase* d,
+                                                                 FDBDatabaseOption option,
+                                                                 uint8_t const* value,
+                                                                 int value_length);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_open_tenant(FDBDatabase* d,
+                                                                  uint8_t const* tenant_name,
+                                                                  int tenant_name_length,
+                                                                  FDBTenant** out_tenant);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_database_create_transaction(FDBDatabase* d,
+                                                                         FDBTransaction** out_transaction);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_reboot_worker(FDBDatabase* db,
+                                                                   uint8_t const* address,
+                                                                   int address_length,
+                                                                   fdb_bool_t check,
+                                                                   int duration);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_force_recovery_with_data_loss(FDBDatabase* db,
+                                                                                   uint8_t const* dcid,
+                                                                                   int dcid_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_create_snapshot(FDBDatabase* db,
+                                                                     uint8_t const* uid,
+                                                                     int uid_length,
+                                                                     uint8_t const* snap_command,
+                                                                     int snap_command_length);
+
+DLLEXPORT WARN_UNUSED_RESULT double fdb_database_get_main_thread_busyness(FDBDatabase* db);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_get_server_protocol(FDBDatabase* db, uint64_t expected_version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_purge_blob_granules(FDBDatabase* db,
+                                                                         uint8_t const* begin_key_name,
+                                                                         int begin_key_name_length,
+                                                                         uint8_t const* end_key_name,
+                                                                         int end_key_name_length,
+                                                                         int64_t purge_version,
+                                                                         fdb_bool_t force);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_wait_purge_granules_complete(FDBDatabase* db,
+                                                                                  uint8_t const* purge_key_name,
+                                                                                  int purge_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_blobbify_range(FDBDatabase* db,
+                                                                    uint8_t const* begin_key_name,
+                                                                    int begin_key_name_length,
+                                                                    uint8_t const* end_key_name,
+                                                                    int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_blobbify_range_blocking(FDBDatabase* db,
+                                                                             uint8_t const* begin_key_name,
+                                                                             int begin_key_name_length,
+                                                                             uint8_t const* end_key_name,
+                                                                             int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_unblobbify_range(FDBDatabase* db,
+                                                                      uint8_t const* begin_key_name,
+                                                                      int begin_key_name_length,
+                                                                      uint8_t const* end_key_name,
+                                                                      int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_list_blobbified_ranges(FDBDatabase* db,
+                                                                            uint8_t const* begin_key_name,
+                                                                            int begin_key_name_length,
+                                                                            uint8_t const* end_key_name,
+                                                                            int end_key_name_length,
+                                                                            int rangeLimit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_verify_blob_range(FDBDatabase* db,
+                                                                       uint8_t const* begin_key_name,
+                                                                       int begin_key_name_length,
+                                                                       uint8_t const* end_key_name,
+                                                                       int end_key_name_length,
+                                                                       int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_flush_blob_range(FDBDatabase* db,
+                                                                      uint8_t const* begin_key_name,
+                                                                      int begin_key_name_length,
+                                                                      uint8_t const* end_key_name,
+                                                                      int end_key_name_length,
+                                                                      fdb_bool_t compact,
+                                                                      int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_database_get_client_status(FDBDatabase* db);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_tenant_create_transaction(FDBTenant* tenant,
+                                                                       FDBTransaction** out_transaction);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_purge_blob_granules(FDBTenant* db,
+                                                                       uint8_t const* begin_key_name,
+                                                                       int begin_key_name_length,
+                                                                       uint8_t const* end_key_name,
+                                                                       int end_key_name_length,
+                                                                       int64_t purge_version,
+                                                                       fdb_bool_t force);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_wait_purge_granules_complete(FDBTenant* db,
+                                                                                uint8_t const* purge_key_name,
+                                                                                int purge_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_blobbify_range(FDBTenant* tenant,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_blobbify_range_blocking(FDBTenant* tenant,
+                                                                           uint8_t const* begin_key_name,
+                                                                           int begin_key_name_length,
+                                                                           uint8_t const* end_key_name,
+                                                                           int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_unblobbify_range(FDBTenant* tenant,
+                                                                    uint8_t const* begin_key_name,
+                                                                    int begin_key_name_length,
+                                                                    uint8_t const* end_key_name,
+                                                                    int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_list_blobbified_ranges(FDBTenant* tenant,
+                                                                          uint8_t const* begin_key_name,
+                                                                          int begin_key_name_length,
+                                                                          uint8_t const* end_key_name,
+                                                                          int end_key_name_length,
+                                                                          int rangeLimit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_verify_blob_range(FDBTenant* tenant,
+                                                                     uint8_t const* begin_key_name,
+                                                                     int begin_key_name_length,
+                                                                     uint8_t const* end_key_name,
+                                                                     int end_key_name_length,
+                                                                     int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_flush_blob_range(FDBTenant* tenant,
+                                                                    uint8_t const* begin_key_name,
+                                                                    int begin_key_name_length,
+                                                                    uint8_t const* end_key_name,
+                                                                    int end_key_name_length,
+                                                                    fdb_bool_t compact,
+                                                                    int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_tenant_get_id(FDBTenant* tenant);
+
+DLLEXPORT void fdb_tenant_destroy(FDBTenant* tenant);
+
+DLLEXPORT void fdb_transaction_destroy(FDBTransaction* tr);
+
+DLLEXPORT void fdb_transaction_cancel(FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_set_option(FDBTransaction* tr,
+                                                                    FDBTransactionOption option,
+                                                                    uint8_t const* value,
+                                                                    int value_length);
+#endif
+
+DLLEXPORT void fdb_transaction_set_read_version(FDBTransaction* tr, int64_t version);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_read_version(FDBTransaction* tr);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(FDBTransaction* tr,
+                                                            uint8_t const* key_name,
+                                                            int key_name_length,
+                                                            fdb_bool_t snapshot);
+#endif
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(FDBTransaction* tr,
+                                                                uint8_t const* key_name,
+                                                                int key_name_length,
+                                                                fdb_bool_t or_equal,
+                                                                int offset,
+                                                                fdb_bool_t snapshot);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_addresses_for_key(FDBTransaction* tr,
+                                                                              uint8_t const* key_name,
+                                                                              int key_name_length);
+
+#if FDB_API_VERSION >= 14
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(FDBTransaction* tr,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  fdb_bool_t begin_or_equal,
+                                                                  int begin_offset,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length,
+                                                                  fdb_bool_t end_or_equal,
+                                                                  int end_offset,
+                                                                  int limit,
+                                                                  int target_bytes,
+                                                                  FDBStreamingMode mode,
+                                                                  int iteration,
+                                                                  fdb_bool_t snapshot,
+                                                                  fdb_bool_t reverse);
+#endif
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_mapped_range(FDBTransaction* tr,
+                                                                         uint8_t const* begin_key_name,
+                                                                         int begin_key_name_length,
+                                                                         fdb_bool_t begin_or_equal,
+                                                                         int begin_offset,
+                                                                         uint8_t const* end_key_name,
+                                                                         int end_key_name_length,
+                                                                         fdb_bool_t end_or_equal,
+                                                                         int end_offset,
+                                                                         uint8_t const* mapper_name,
+                                                                         int mapper_name_length,
+                                                                         int limit,
+                                                                         int target_bytes,
+                                                                         FDBStreamingMode mode,
+                                                                         int iteration,
+                                                                         fdb_bool_t snapshot,
+                                                                         fdb_bool_t reverse);
+
+DLLEXPORT void fdb_transaction_set(FDBTransaction* tr,
+                                   uint8_t const* key_name,
+                                   int key_name_length,
+                                   uint8_t const* value,
+                                   int value_length);
+
+DLLEXPORT void fdb_transaction_atomic_op(FDBTransaction* tr,
+                                         uint8_t const* key_name,
+                                         int key_name_length,
+                                         uint8_t const* param,
+                                         int param_length,
+                                         FDBMutationType operation_type);
+
+DLLEXPORT void fdb_transaction_clear(FDBTransaction* tr, uint8_t const* key_name, int key_name_length);
+
+DLLEXPORT void fdb_transaction_clear_range(FDBTransaction* tr,
+                                           uint8_t const* begin_key_name,
+                                           int begin_key_name_length,
+                                           uint8_t const* end_key_name,
+                                           int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_watch(FDBTransaction* tr,
+                                                              uint8_t const* key_name,
+                                                              int key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_commit(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_get_committed_version(FDBTransaction* tr,
+                                                                               int64_t* out_version);
+
+/*
+ * These functions intentionally return an FDBFuture instead of a numeric value
+ * directly, so that calling the API can see the effect of previous
+ * mutations on the transaction. Specifically, mutations are applied
+ * asynchronously by the main thread. In order to see them, this call has to
+ * be serviced by the main thread too.
+ */
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_tag_throttled_duration(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_total_cost(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_approximate_size(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_versionstamp(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_on_error(FDBTransaction* tr, fdb_error_t error);
+
+DLLEXPORT void fdb_transaction_reset(FDBTransaction* tr);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_transaction_add_conflict_range(FDBTransaction* tr,
+                                                                            uint8_t const* begin_key_name,
+                                                                            int begin_key_name_length,
+                                                                            uint8_t const* end_key_name,
+                                                                            int end_key_name_length,
+                                                                            FDBConflictRangeType type);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_estimated_range_size_bytes(FDBTransaction* tr,
+                                                                                       uint8_t const* begin_key_name,
+                                                                                       int begin_key_name_length,
+                                                                                       uint8_t const* end_key_name,
+                                                                                       int end_key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_split_points(FDBTransaction* tr,
+                                                                               uint8_t const* begin_key_name,
+                                                                               int begin_key_name_length,
+                                                                               uint8_t const* end_key_name,
+                                                                               int end_key_name_length,
+                                                                               int64_t chunk_size);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_blob_granule_ranges(FDBTransaction* tr,
+                                                                                uint8_t const* begin_key_name,
+                                                                                int begin_key_name_length,
+                                                                                uint8_t const* end_key_name,
+                                                                                int end_key_name_length,
+                                                                                int rangeLimit);
+
+/* LatestVersion (-2) for readVersion means get read version from transaction
+   Separated out as optional because BG reads can support longer-lived reads than normal FDB transactions */
+DLLEXPORT WARN_UNUSED_RESULT FDBResult* fdb_transaction_read_blob_granules(FDBTransaction* tr,
+                                                                           uint8_t const* begin_key_name,
+                                                                           int begin_key_name_length,
+                                                                           uint8_t const* end_key_name,
+                                                                           int end_key_name_length,
+                                                                           int64_t beginVersion,
+                                                                           int64_t readVersion,
+                                                                           FDBReadBlobGranuleContext granuleContext);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_summarize_blob_granules(FDBTransaction* tr,
+                                                                                uint8_t const* begin_key_name,
+                                                                                int begin_key_name_length,
+                                                                                uint8_t const* end_key_name,
+                                                                                int end_key_name_length,
+                                                                                int64_t summaryVersion,
+                                                                                int rangeLimit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_read_blob_granules_description(FDBTransaction* tr,
+                                                                                       uint8_t const* begin_key_name,
+                                                                                       int begin_key_name_length,
+                                                                                       uint8_t const* end_key_name,
+                                                                                       int end_key_name_length,
+                                                                                       int64_t begin_version,
+                                                                                       int64_t read_version,
+                                                                                       int64_t* read_version_out);
+
+#define FDB_KEYSEL_LAST_LESS_THAN(k, l) k, l, 0, 0
+#define FDB_KEYSEL_LAST_LESS_OR_EQUAL(k, l) k, l, 1, 0
+#define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
+#define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_select_api_version_impl(int runtime_version, int header_version);
+
+DLLEXPORT int fdb_get_max_api_version(void);
+DLLEXPORT const char* fdb_get_client_version(void);
+
+/* LEGACY API VERSIONS */
+
+#if FDB_API_VERSION < 620
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_version(FDBFuture* f, int64_t* out_version);
+#else
+#define fdb_future_get_version(f, ov) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 610 || defined FDB_INCLUDE_LEGACY_TYPES
+typedef struct FDB_cluster FDBCluster;
+
+typedef enum {
+	/* This option is only a placeholder for C compatibility and should not be used */
+	FDB_CLUSTER_OPTION_DUMMY_DO_NOT_USE = -1
+} FDBClusterOption;
+#endif
+
+#if FDB_API_VERSION < 610
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_cluster(FDBFuture* f, FDBCluster** out_cluster);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_database(FDBFuture* f, FDBDatabase** out_database);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_create_cluster(const char* cluster_file_path);
+
+DLLEXPORT void fdb_cluster_destroy(FDBCluster* c);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_cluster_set_option(FDBCluster* c,
+                                                                FDBClusterOption option,
+                                                                uint8_t const* value,
+                                                                int value_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_cluster_create_database(FDBCluster* c,
+                                                                    uint8_t const* db_name,
+                                                                    int db_name_length);
+#else
+#define fdb_future_get_cluster(f, oc) FDB_REMOVED_FUNCTION
+#define fdb_future_get_database(f, od) FDB_REMOVED_FUNCTION
+#define fdb_create_cluster(cfp) FDB_REMOVED_FUNCTION
+#define fdb_cluster_destroy(c) FDB_REMOVED_FUNCTION
+#define fdb_cluster_set_option(c, o, v, vl) FDB_REMOVED_FUNCTION
+#define fdb_cluster_create_database(c, dn, dnl) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 23
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_error(FDBFuture* f, const char** out_description /* = NULL */);
+
+DLLEXPORT fdb_bool_t fdb_future_is_error(FDBFuture* f);
+#else
+#define fdb_future_is_error(x) FDB_REMOVED_FUNCTION
+#endif
+
+#if FDB_API_VERSION < 14
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_future_get_keyvalue_array(FDBFuture* f,
+                                                                       FDBKeyValue const** out_kv,
+                                                                       int* out_count);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get(FDBTransaction* tr,
+                                                            uint8_t const* key_name,
+                                                            int key_name_length);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_key(FDBTransaction* tr,
+                                                                uint8_t const* key_name,
+                                                                int key_name_length,
+                                                                fdb_bool_t or_equal,
+                                                                int offset);
+
+DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_setup_network(const char* local_address);
+
+DLLEXPORT void fdb_transaction_set_option(FDBTransaction* tr, FDBTransactionOption option);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range(FDBTransaction* tr,
+                                                                  uint8_t const* begin_key_name,
+                                                                  int begin_key_name_length,
+                                                                  uint8_t const* end_key_name,
+                                                                  int end_key_name_length,
+                                                                  int limit);
+
+DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_selector(FDBTransaction* tr,
+                                                                           uint8_t const* begin_key_name,
+                                                                           int begin_key_name_length,
+                                                                           fdb_bool_t begin_or_equal,
+                                                                           int begin_offset,
+                                                                           uint8_t const* end_key_name,
+                                                                           int end_key_name_length,
+                                                                           fdb_bool_t end_or_equal,
+                                                                           int end_offset,
+                                                                           int limit);
+#else
+#define fdb_transaction_get_range_selector(tr, bkn, bknl, boe, bo, ekn, eknl, eoe, eo, lim) FDB_REMOVED_FUNCTION
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/740/fdb_c_apiversion.g.h b/bindings/rust/foundationdb-sys/include/740/fdb_c_apiversion.g.h
new file mode 100644
index 00000000000..c9a25d96e76
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/740/fdb_c_apiversion.g.h
@@ -0,0 +1,41 @@
+#ifndef FDB_C_APIVERSION_G_H
+#define FDB_C_APIVERSION_G_H
+#pragma once
+
+/*
+ * fdb_c_apiversion.g.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2024 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+/* The latest FDB C API version */
+#define FDB_LATEST_API_VERSION 740
+
+/* The latest FDB API version supported by bindings. It may lag behind the latest C API version */
+#define FDB_LATEST_BINDINGS_API_VERSION 740
+
+/* API version introducing client_tmp_dir option */
+#define FDB_API_VERSION_CLIENT_TMP_DIR 720
+
+/* API version introducing disable_client_bypass option */
+#define FDB_API_VERSION_DISABLE_CLIENT_BYPASS 720
+
+/* API version with multitenancy API released */
+#define FDB_API_VERSION_TENANT_API_RELEASED 720
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/740/fdb_c_options.g.h b/bindings/rust/foundationdb-sys/include/740/fdb_c_options.g.h
new file mode 100644
index 00000000000..e695d099dd1
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/740/fdb_c_options.g.h
@@ -0,0 +1,625 @@
+#ifndef FDB_C_OPTIONS_G_H
+#define FDB_C_OPTIONS_G_H
+#pragma once
+
+/*
+ * FoundationDB C API
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2024 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the 'License');
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an 'AS IS' BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * Do not include this file directly.
+ */
+
+typedef enum {
+    /* Deprecated */
+    /* Parameter: (String) IP:PORT */
+    FDB_NET_OPTION_LOCAL_ADDRESS=10,
+
+    /* Deprecated */
+    /* Parameter: (String) path to cluster file */
+    FDB_NET_OPTION_CLUSTER_FILE=20,
+
+    /* Enables trace output to a file in a directory of the clients choosing */
+    /* Parameter: (String) path to output directory (or NULL for current working directory) */
+    FDB_NET_OPTION_TRACE_ENABLE=30,
+
+    /* Sets the maximum size in bytes of a single trace output file. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on individual file size. The default is a maximum size of 10,485,760 bytes. */
+    /* Parameter: (Int) max size of a single trace output file */
+    FDB_NET_OPTION_TRACE_ROLL_SIZE=31,
+
+    /* Sets the maximum size of all the trace output files put together. This value should be in the range ``[0, INT64_MAX]``. If the value is set to 0, there is no limit on the total size of the files. The default is a maximum size of 104,857,600 bytes. If the default roll size is used, this means that a maximum of 10 trace files will be written at a time. */
+    /* Parameter: (Int) max total size of trace files */
+    FDB_NET_OPTION_TRACE_MAX_LOGS_SIZE=32,
+
+    /* Sets the 'LogGroup' attribute with the specified value for all events in the trace output files. The default log group is 'default'. */
+    /* Parameter: (String) value of the LogGroup attribute */
+    FDB_NET_OPTION_TRACE_LOG_GROUP=33,
+
+    /* Select the format of the log files. xml (the default) and json are supported. */
+    /* Parameter: (String) Format of trace files */
+    FDB_NET_OPTION_TRACE_FORMAT=34,
+
+    /* Select clock source for trace files. now (the default) or realtime are supported. */
+    /* Parameter: (String) Trace clock source */
+    FDB_NET_OPTION_TRACE_CLOCK_SOURCE=35,
+
+    /* Once provided, this string will be used to replace the port/PID in the log file names. */
+    /* Parameter: (String) The identifier that will be part of all trace file names */
+    FDB_NET_OPTION_TRACE_FILE_IDENTIFIER=36,
+
+    /* Use the same base trace file name for all client threads as it did before version 7.2. The current default behavior is to use distinct trace file names for client threads by including their version and thread index. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_TRACE_SHARE_AMONG_CLIENT_THREADS=37,
+
+    /* Initialize trace files on network setup, determine the local IP later. Otherwise tracing is initialized when opening the first database. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_TRACE_INITIALIZE_ON_SETUP=38,
+
+    /* Set file suffix for partially written log files. */
+    /* Parameter: (String) Append this suffix to partially written log files. When a log file is complete, it is renamed to remove the suffix. No separator is added between the file and the suffix. If you want to add a file extension, you should include the separator - e.g. '.tmp' instead of 'tmp' to add the 'tmp' extension. */
+    FDB_NET_OPTION_TRACE_PARTIAL_FILE_SUFFIX=39,
+
+    /* Set internal tuning or debugging knobs */
+    /* Parameter: (String) knob_name=knob_value */
+    FDB_NET_OPTION_KNOB=40,
+
+    /* Deprecated */
+    /* Parameter: (String) file path or linker-resolved name */
+    FDB_NET_OPTION_TLS_PLUGIN=41,
+
+    /* Set the certificate chain */
+    /* Parameter: (Bytes) certificates */
+    FDB_NET_OPTION_TLS_CERT_BYTES=42,
+
+    /* Set the file from which to load the certificate chain */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_CERT_PATH=43,
+
+    /* Set the private key corresponding to your own certificate */
+    /* Parameter: (Bytes) key */
+    FDB_NET_OPTION_TLS_KEY_BYTES=45,
+
+    /* Set the file from which to load the private key corresponding to your own certificate */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_KEY_PATH=46,
+
+    /* Set the peer certificate field verification criteria */
+    /* Parameter: (Bytes) verification pattern */
+    FDB_NET_OPTION_TLS_VERIFY_PEERS=47,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_BUGGIFY_ENABLE=48,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_BUGGIFY_DISABLE=49,
+
+    /* Set the probability of a BUGGIFY section being active for the current execution.  Only applies to code paths first traversed AFTER this option is changed. */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=50,
+
+    /* Set the probability of an active BUGGIFY section being fired */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_BUGGIFY_SECTION_FIRED_PROBABILITY=51,
+
+    /* Set the ca bundle */
+    /* Parameter: (Bytes) ca bundle */
+    FDB_NET_OPTION_TLS_CA_BYTES=52,
+
+    /* Set the file from which to load the certificate authority bundle */
+    /* Parameter: (String) file path */
+    FDB_NET_OPTION_TLS_CA_PATH=53,
+
+    /* Set the passphrase for encrypted private key. Password should be set before setting the key for the password to be used. */
+    /* Parameter: (String) key passphrase */
+    FDB_NET_OPTION_TLS_PASSWORD=54,
+
+    /* Prevent client from connecting to a non-TLS endpoint by throwing network connection failed error. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_TLS_DISABLE_PLAINTEXT_CONNECTION=55,
+
+    /* Disables the multi-version client API and instead uses the local client directly. Must be set before setting up the network. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_MULTI_VERSION_CLIENT_API=60,
+
+    /* If set, callbacks from external client libraries can be called from threads created by the FoundationDB client library. Otherwise, callbacks will be called from either the thread used to add the callback or the network thread. Setting this option can improve performance when connected using an external client, but may not be safe to use in all environments. Must be set before setting up the network. WARNING: This feature is considered experimental at this time. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CALLBACKS_ON_EXTERNAL_THREADS=61,
+
+    /* Adds an external client library for use by the multi-version client API. Must be set before setting up the network. */
+    /* Parameter: (String) path to client library */
+    FDB_NET_OPTION_EXTERNAL_CLIENT_LIBRARY=62,
+
+    /* Searches the specified path for dynamic libraries and adds them to the list of client libraries for use by the multi-version client API. Must be set before setting up the network. */
+    /* Parameter: (String) path to directory containing client libraries */
+    FDB_NET_OPTION_EXTERNAL_CLIENT_DIRECTORY=63,
+
+    /* Prevents connections through the local client, allowing only connections through externally loaded client libraries. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_LOCAL_CLIENT=64,
+
+    /* Spawns multiple worker threads for each version of the client that is loaded.  Setting this to a number greater than one implies disable_local_client. */
+    /* Parameter: (Int) Number of client threads to be spawned.  Each cluster will be serviced by a single client thread. */
+    FDB_NET_OPTION_CLIENT_THREADS_PER_VERSION=65,
+
+    /* Adds an external client library to be used with a future version protocol. This option can be used testing purposes only! */
+    /* Parameter: (String) path to client library */
+    FDB_NET_OPTION_FUTURE_VERSION_CLIENT_LIBRARY=66,
+
+    /* Retain temporary external client library copies that are created for enabling multi-threading. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_RETAIN_CLIENT_LIBRARY_COPIES=67,
+
+    /* Ignore the failure to initialize some of the external clients */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_IGNORE_EXTERNAL_CLIENT_FAILURES=68,
+
+    /* Fail with an error if there is no client matching the server version the client is connecting to */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_FAIL_INCOMPATIBLE_CLIENT=69,
+
+    /* Disables logging of client statistics, such as sampled transaction activity. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_CLIENT_STATISTICS_LOGGING=70,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_ENABLE_SLOW_TASK_PROFILING=71,
+
+    /* Enables debugging feature to perform run loop profiling. Requires trace logging to be enabled. WARNING: this feature is not recommended for use in production. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_ENABLE_RUN_LOOP_PROFILING=71,
+
+    /* Prevents the multi-version client API from being disabled, even if no external clients are configured. This option is required to use GRV caching. */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_DISABLE_CLIENT_BYPASS=72,
+
+    /* Enable client buggify - will make requests randomly fail (intended for client testing) */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_ENABLE=80,
+
+    /* Disable client buggify */
+    /* Parameter: Option takes no parameter */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_DISABLE=81,
+
+    /* Set the probability of a CLIENT_BUGGIFY section being active for the current execution. */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_ACTIVATED_PROBABILITY=82,
+
+    /* Set the probability of an active CLIENT_BUGGIFY section being fired. A section will only fire if it was activated */
+    /* Parameter: (Int) probability expressed as a percentage between 0 and 100 */
+    FDB_NET_OPTION_CLIENT_BUGGIFY_SECTION_FIRED_PROBABILITY=83,
+
+    /* Set a tracer to run on the client. Should be set to the same value as the tracer set on the server. */
+    /* Parameter: (String) Distributed tracer type. Choose from none, log_file, or network_lossy */
+    FDB_NET_OPTION_DISTRIBUTED_CLIENT_TRACER=90,
+
+    /* Sets the directory for storing temporary files created by FDB client, such as temporary copies of client libraries. Defaults to /tmp */
+    /* Parameter: (String) Client directory for temporary files.  */
+    FDB_NET_OPTION_CLIENT_TMP_DIR=91,
+
+    /* This option is set automatically to communicate the list of supported clients to the active client. */
+    /* Parameter: (String) [release version],[source version],[protocol version];... This is a hidden parameter and should not be used directly by applications.*/
+    FDB_NET_OPTION_SUPPORTED_CLIENT_VERSIONS=1000,
+
+    /* This option is set automatically on all clients loaded externally using the multi-version API. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_NET_OPTION_EXTERNAL_CLIENT=1001,
+
+    /* This option tells a child on a multiversion client what transport ID to use. */
+    /* Parameter: (Int) Transport ID for the child connection This is a hidden parameter and should not be used directly by applications.*/
+    FDB_NET_OPTION_EXTERNAL_CLIENT_TRANSPORT_ID=1002
+} FDBNetworkOption;
+
+typedef enum {
+    /* Set the size of the client location cache. Raising this value can boost performance in very large databases where clients access data in a near-random pattern. Defaults to 100000. */
+    /* Parameter: (Int) Max location cache entries */
+    FDB_DB_OPTION_LOCATION_CACHE_SIZE=10,
+
+    /* Set the maximum number of watches allowed to be outstanding on a database connection. Increasing this number could result in increased resource usage. Reducing this number will not cancel any outstanding watches. Defaults to 10000 and cannot be larger than 1000000. */
+    /* Parameter: (Int) Max outstanding watches */
+    FDB_DB_OPTION_MAX_WATCHES=20,
+
+    /* Specify the machine ID that was passed to fdbserver processes running on the same machine as this client, for better location-aware load balancing. */
+    /* Parameter: (String) Hexadecimal ID */
+    FDB_DB_OPTION_MACHINE_ID=21,
+
+    /* Specify the datacenter ID that was passed to fdbserver processes running in the same datacenter as this client, for better location-aware load balancing. */
+    /* Parameter: (String) A string identifier for the datacenter */
+    FDB_DB_OPTION_DATACENTER_ID=22,
+
+    /* Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_SNAPSHOT_RYW_ENABLE=26,
+
+    /* Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_SNAPSHOT_RYW_DISABLE=27,
+
+    /* Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option. This sets the ``transaction_logging_max_field_length`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) Maximum length of escaped key and value fields. */
+    FDB_DB_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    /* Set a timeout in milliseconds which, when elapsed, will cause each transaction automatically to be cancelled. This sets the ``timeout`` option of each transaction created by this database. See the transaction option description for more information. Using this option requires that the API version is 610 or higher. */
+    /* Parameter: (Int) value in milliseconds of timeout */
+    FDB_DB_OPTION_TRANSACTION_TIMEOUT=500,
+
+    /* Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. This sets the ``retry_limit`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) number of times to retry */
+    FDB_DB_OPTION_TRANSACTION_RETRY_LIMIT=501,
+
+    /* Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. This sets the ``max_retry_delay`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) value in milliseconds of maximum delay */
+    FDB_DB_OPTION_TRANSACTION_MAX_RETRY_DELAY=502,
+
+    /* Set the maximum transaction size in bytes. This sets the ``size_limit`` option on each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: (Int) value in bytes */
+    FDB_DB_OPTION_TRANSACTION_SIZE_LIMIT=503,
+
+    /* The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_CAUSAL_READ_RISKY=504,
+
+    /* Deprecated. Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_INCLUDE_PORT_IN_ADDRESS=505,
+
+    /* Set a random idempotency id for all transactions. See the transaction option description for more information. This feature is in development and not ready for general use. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_AUTOMATIC_IDEMPOTENCY=506,
+
+    /* Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. This sets the ``bypass_unreadable`` option of each transaction created by this database. See the transaction option description for more information. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_BYPASS_UNREADABLE=700,
+
+    /* By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    /* Enables conflicting key reporting on all transactions, allowing them to retrieve the keys that are conflicting with other transactions. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_TRANSACTION_REPORT_CONFLICTING_KEYS=702,
+
+    /* Use configuration database. */
+    /* Parameter: Option takes no parameter */
+    FDB_DB_OPTION_USE_CONFIG_DATABASE=800,
+
+    /* Enables verification of causal read risky by checking whether clients are able to read stale data when they detect a recovery, and logging an error if so. */
+    /* Parameter: (Int) integer between 0 and 100 expressing the probability a client will verify it can't read stale data */
+    FDB_DB_OPTION_TEST_CAUSAL_READ_RISKY=900
+} FDBDatabaseOption;
+
+typedef enum {
+    /* The transaction, if not self-conflicting, may be committed a second time after commit succeeds, in the event of a fault */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_WRITE_RISKY=10,
+
+    /* The read version will be committed, and usually will be the latest committed, but might not be the latest committed in the event of a simultaneous fault and misbehaving clock. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_READ_RISKY=20,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_CAUSAL_READ_DISABLE=21,
+
+    /* Addresses returned by get_addresses_for_key include the port when enabled. As of api version 630, this option is enabled by default and setting this has no effect. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_INCLUDE_PORT_IN_ADDRESS=23,
+
+    /* The next write performed on this transaction will not generate a write conflict range. As a result, other transactions which read the key(s) being modified by the next write will not conflict with this transaction. Care needs to be taken when using this option on a transaction that is shared between multiple threads. When setting this option, write conflict ranges will be disabled on the next write operation, regardless of what thread it is on. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_NEXT_WRITE_NO_WRITE_CONFLICT_RANGE=30,
+
+    /* Committing this transaction will bypass the normal load balancing across commit proxies and go directly to the specifically nominated 'first commit proxy'. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_COMMIT_ON_FIRST_PROXY=40,
+
+    /*  */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_CHECK_WRITES_ENABLE=50,
+
+    /* Reads performed by a transaction will not see any prior mutations that occurred in that transaction, instead seeing the value which was in the database at the transaction's read version. This option may provide a small performance benefit for the client, but also disables a number of client-side optimizations which are beneficial for transactions which tend to read and write the same keys within a single transaction. It is an error to set this option after performing any reads or writes on the transaction. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE=51,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_AHEAD_DISABLE=52,
+
+    /* Storage server should cache disk blocks needed for subsequent read requests in this transaction.  This is the default behavior. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_SERVER_SIDE_CACHE_ENABLE=507,
+
+    /* Storage server should not cache disk blocks needed for subsequent read requests in this transaction.  This can be used to avoid cache pollution for reads not expected to be repeated. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_SERVER_SIDE_CACHE_DISABLE=508,
+
+    /* Use normal read priority for subsequent read requests in this transaction.  This is the default read priority. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_PRIORITY_NORMAL=509,
+
+    /* Use low read priority for subsequent read requests in this transaction. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_PRIORITY_LOW=510,
+
+    /* Use high read priority for subsequent read requests in this transaction. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_PRIORITY_HIGH=511,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_DATACENTER=110,
+
+    /*  */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_RISKY=120,
+
+    /* Deprecated */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_DURABILITY_DEV_NULL_IS_WEB_SCALE=130,
+
+    /* Specifies that this transaction should be treated as highest priority and that lower priority transactions should block behind this one. Use is discouraged outside of low-level tools */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_PRIORITY_SYSTEM_IMMEDIATE=200,
+
+    /* Specifies that this transaction should be treated as low priority and that default priority transactions will be processed first. Batch priority transactions will also be throttled at load levels smaller than for other types of transactions and may be fully cut off in the event of machine failures. Useful for doing batch work simultaneously with latency-sensitive work */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_PRIORITY_BATCH=201,
+
+    /* This is a write-only transaction which sets the initial configuration. This option is designed for use by database system tools only. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_INITIALIZE_NEW_DATABASE=300,
+
+    /* Allows this transaction to read and modify system keys (those that start with the byte 0xFF). Implies raw_access. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_ACCESS_SYSTEM_KEYS=301,
+
+    /* Allows this transaction to read system keys (those that start with the byte 0xFF). Implies raw_access. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_SYSTEM_KEYS=302,
+
+    /* Allows this transaction to access the raw key-space when tenant mode is on. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_RAW_ACCESS=303,
+
+    /* Allows this transaction to bypass storage quota enforcement. Should only be used for transactions that directly or indirectly decrease the size of the tenant group's data. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_BYPASS_STORAGE_QUOTA=304,
+
+    /*  */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_DEBUG_DUMP=400,
+
+    /*  */
+    /* Parameter: (String) Optional transaction name */
+    FDB_TR_OPTION_DEBUG_RETRY_LOGGING=401,
+
+    /* Deprecated */
+    /* Parameter: (String) String identifier to be used in the logs when tracing this transaction. The identifier must not exceed 100 characters. */
+    FDB_TR_OPTION_TRANSACTION_LOGGING_ENABLE=402,
+
+    /* Sets a client provided identifier for the transaction that will be used in scenarios like tracing or profiling. Client trace logging or transaction profiling must be separately enabled. */
+    /* Parameter: (String) String identifier to be used when tracing or profiling this transaction. The identifier must not exceed 100 characters. */
+    FDB_TR_OPTION_DEBUG_TRANSACTION_IDENTIFIER=403,
+
+    /* Enables tracing for this transaction and logs results to the client trace logs. The DEBUG_TRANSACTION_IDENTIFIER option must be set before using this option, and client trace logging must be enabled to get log output. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_LOG_TRANSACTION=404,
+
+    /* Sets the maximum escaped length of key and value fields to be logged to the trace file via the LOG_TRANSACTION option, after which the field will be truncated. A negative value disables truncation. */
+    /* Parameter: (Int) Maximum length of escaped key and value fields. */
+    FDB_TR_OPTION_TRANSACTION_LOGGING_MAX_FIELD_LENGTH=405,
+
+    /* Sets an identifier for server tracing of this transaction. When committed, this identifier triggers logging when each part of the transaction authority encounters it, which is helpful in diagnosing slowness in misbehaving clusters. The identifier is randomly generated. When there is also a debug_transaction_identifier, both IDs are logged together. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SERVER_REQUEST_TRACING=406,
+
+    /* Set a timeout in milliseconds which, when elapsed, will cause the transaction automatically to be cancelled. Valid parameter values are ``[0, INT_MAX]``. If set to 0, will disable all timeouts. All pending and any future uses of the transaction will throw an exception. The transaction can be used again after it is reset. Prior to API version 610, like all other transaction options, the timeout must be reset after a call to ``onError``. If the API version is 610 or greater, the timeout is not reset after an ``onError`` call. This allows the user to specify a longer timeout on specific transactions than the default timeout specified through the ``transaction_timeout`` database option without the shorter database timeout cancelling transactions that encounter a retryable error. Note that at all API versions, it is safe and legal to set the timeout each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) value in milliseconds of timeout */
+    FDB_TR_OPTION_TIMEOUT=500,
+
+    /* Set a maximum number of retries after which additional calls to ``onError`` will throw the most recently seen error code. Valid parameter values are ``[-1, INT_MAX]``. If set to -1, will disable the retry limit. Prior to API version 610, like all other transaction options, the retry limit must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the retry limit each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) number of times to retry */
+    FDB_TR_OPTION_RETRY_LIMIT=501,
+
+    /* Set the maximum amount of backoff delay incurred in the call to ``onError`` if the error is retryable. Defaults to 1000 ms. Valid parameter values are ``[0, INT_MAX]``. If the maximum retry delay is less than the current retry delay of the transaction, then the current retry delay will be clamped to the maximum retry delay. Prior to API version 610, like all other transaction options, the maximum retry delay must be reset after a call to ``onError``. If the API version is 610 or greater, the retry limit is not reset after an ``onError`` call. Note that at all API versions, it is safe and legal to set the maximum retry delay each time the transaction begins, so most code written assuming the older behavior can be upgraded to the newer behavior without requiring any modification, and the caller is not required to implement special logic in retry loops to only conditionally set this option. */
+    /* Parameter: (Int) value in milliseconds of maximum delay */
+    FDB_TR_OPTION_MAX_RETRY_DELAY=502,
+
+    /* Set the transaction size limit in bytes. The size is calculated by combining the sizes of all keys and values written or mutated, all key ranges cleared, and all read and write conflict ranges. (In other words, it includes the total size of all data included in the request to the cluster to commit the transaction.) Large transactions can cause performance problems on FoundationDB clusters, so setting this limit to a smaller value than the default can help prevent the client from accidentally degrading the cluster's performance. This value must be at least 32 and cannot be set to higher than 10,000,000, the default transaction size limit. */
+    /* Parameter: (Int) value in bytes */
+    FDB_TR_OPTION_SIZE_LIMIT=503,
+
+    /* Associate this transaction with this ID for the purpose of checking whether or not this transaction has already committed. Must be at least 16 bytes and less than 256 bytes. This feature is in development and not ready for general use. Unless the automatic_idempotency option is set after this option, the client will not automatically attempt to remove this id from the cluster after a successful commit. */
+    /* Parameter: (String) Unique ID This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_IDEMPOTENCY_ID=504,
+
+    /* Automatically assign a random 16 byte idempotency id for this transaction. Prevents commits from failing with ``commit_unknown_result``. WARNING: If you are also using the multiversion client or transaction timeouts, if either cluster_version_changed or transaction_timed_out was thrown during a commit, then that commit may have already succeeded or may succeed in the future. This feature is in development and not ready for general use. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_AUTOMATIC_IDEMPOTENCY=505,
+
+    /* Snapshot read operations will see the results of writes done in the same transaction. This is the default behavior. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SNAPSHOT_RYW_ENABLE=600,
+
+    /* Snapshot read operations will not see the results of writes done in the same transaction. This was the default behavior prior to API version 300. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SNAPSHOT_RYW_DISABLE=601,
+
+    /* The transaction can read and write to locked databases, and is responsible for checking that it took the lock. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_LOCK_AWARE=700,
+
+    /* By default, operations that are performed on a transaction while it is being committed will not only fail themselves, but they will attempt to fail other in-flight operations (such as the commit) as well. This behavior is intended to help developers discover situations where operations could be unintentionally executed after the transaction has been reset. Setting this option removes that protection, causing only the offending operation to fail. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USED_DURING_COMMIT_PROTECTION_DISABLE=701,
+
+    /* The transaction can read from locked databases. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_READ_LOCK_AWARE=702,
+
+    /* No other transactions will be applied before this transaction within the same commit version. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_FIRST_IN_BATCH=710,
+
+    /* This option should only be used by tools which change the database configuration. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USE_PROVISIONAL_PROXIES=711,
+
+    /* The transaction can retrieve keys that are conflicting with other transactions. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_REPORT_CONFLICTING_KEYS=712,
+
+    /* By default, the special key space will only allow users to read from exactly one module (a subspace in the special key space). Use this option to allow reading from zero or more modules. Users who set this option should be prepared for new modules, which may have different behaviors than the modules they're currently reading. For example, a new module might block or return an error. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SPECIAL_KEY_SPACE_RELAXED=713,
+
+    /* By default, users are not allowed to write to special keys. Enable this option will implicitly enable all options required to achieve the configuration change. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_SPECIAL_KEY_SPACE_ENABLE_WRITES=714,
+
+    /* Adds a tag to the transaction that can be used to apply manual targeted throttling. At most 5 tags can be set on a transaction. */
+    /* Parameter: (String) String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters. */
+    FDB_TR_OPTION_TAG=800,
+
+    /* Adds a tag to the transaction that can be used to apply manual or automatic targeted throttling. At most 5 tags can be set on a transaction. */
+    /* Parameter: (String) String identifier used to associated this transaction with a throttling group. Must not exceed 16 characters. */
+    FDB_TR_OPTION_AUTO_THROTTLE_TAG=801,
+
+    /* Adds a parent to the Span of this transaction. Used for transaction tracing. A span can be identified with a 33 bytes serialized binary format which consists of: 8 bytes protocol version, e.g. ``0x0FDB00B073000000LL`` in little-endian format, 16 bytes trace id, 8 bytes span id, 1 byte set to 1 if sampling is enabled */
+    /* Parameter: (Bytes) A serialized binary byte string of length 33 used to associate the span of this transaction with a parent */
+    FDB_TR_OPTION_SPAN_PARENT=900,
+
+    /* Asks storage servers for how many bytes a clear key range contains. Otherwise uses the location cache to roughly estimate this. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_EXPENSIVE_CLEAR_COST_ESTIMATION_ENABLE=1000,
+
+    /* Allows ``get`` operations to read from sections of keyspace that have become unreadable because of versionstamp operations. These reads will view versionstamp operations as if they were set operations that did not fill in the versionstamp. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_BYPASS_UNREADABLE=1100,
+
+    /* Allows this transaction to use cached GRV from the database context. Defaults to off. Upon first usage, starts a background updater to periodically update the cache to avoid stale read versions. The disable_client_bypass option must also be set. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_USE_GRV_CACHE=1101,
+
+    /* Specifically instruct this transaction to NOT use cached GRV. Primarily used for the read version cache's background updater to avoid attempting to read a cached entry in specific situations. */
+    /* Parameter: Option takes no parameter This is a hidden parameter and should not be used directly by applications.*/
+    FDB_TR_OPTION_SKIP_GRV_CACHE=1102,
+
+    /* Attach given authorization token to the transaction such that subsequent tenant-aware requests are authorized */
+    /* Parameter: (String) A JSON Web Token authorized to access data belonging to one or more tenants, indicated by 'tenants' claim of the token's payload. */
+    FDB_TR_OPTION_AUTHORIZATION_TOKEN=2000,
+
+    /* Enables replica consistency check, which compares the results returned by storage server replicas (as many as specified by consistency_check_required_replicas option) for a given read request, in client-side load balancer. */
+    /* Parameter: Option takes no parameter */
+    FDB_TR_OPTION_ENABLE_REPLICA_CONSISTENCY_CHECK=4000,
+
+    /* Specifies the number of storage server replica results that the load balancer needs to compare when enable_replica_consistency_check option is set. */
+    /* Parameter: (Int) Number of storage replicas over which the load balancer consistency check is done. */
+    FDB_TR_OPTION_CONSISTENCY_CHECK_REQUIRED_REPLICAS=4001
+} FDBTransactionOption;
+
+typedef enum {
+    /* Client intends to consume the entire range and would like it all transferred as early as possible. */
+    FDB_STREAMING_MODE_WANT_ALL=-2,
+
+    /* The default. The client doesn't know how much of the range it is likely to used and wants different performance concerns to be balanced. Only a small portion of data is transferred to the client initially (in order to minimize costs if the client doesn't read the entire range), and as the caller iterates over more items in the range larger batches will be transferred in order to minimize latency. After enough iterations, the iterator mode will eventually reach the same byte limit as ``WANT_ALL`` */
+    FDB_STREAMING_MODE_ITERATOR=-1,
+
+    /* Infrequently used. The client has passed a specific row limit and wants that many rows delivered in a single batch. Because of iterator operation in client drivers make request batches transparent to the user, consider ``WANT_ALL`` StreamingMode instead. A row limit must be specified if this mode is used. */
+    FDB_STREAMING_MODE_EXACT=0,
+
+    /* Infrequently used. Transfer data in batches small enough to not be much more expensive than reading individual rows, to minimize cost if iteration stops early. */
+    FDB_STREAMING_MODE_SMALL=1,
+
+    /* Infrequently used. Transfer data in batches sized in between small and large. */
+    FDB_STREAMING_MODE_MEDIUM=2,
+
+    /* Infrequently used. Transfer data in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the client stops iteration early, some disk and network bandwidth may be wasted. The batch size may still be too small to allow a single client to get high throughput from the database, so if that is what you need consider the SERIAL StreamingMode. */
+    FDB_STREAMING_MODE_LARGE=3,
+
+    /* Transfer data in batches large enough that an individual client can get reasonable read bandwidth from the database. If the client stops iteration early, considerable disk and network bandwidth may be wasted. */
+    FDB_STREAMING_MODE_SERIAL=4
+} FDBStreamingMode;
+
+typedef enum {
+    /* Performs an addition of little-endian integers. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The integers to be added must be stored in a little-endian representation.  They can be signed in two's complement representation or unsigned. You can add to an integer at a known offset in the value by prepending the appropriate number of zero bytes to ``param`` and padding with zero bytes to match the length of the value. However, this offset technique requires that you know the addition will not cause the integer field within the value to overflow. */
+    FDB_MUTATION_TYPE_ADD=2,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_AND=6,
+
+    /* Performs a bitwise ``and`` operation.  If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_AND=6,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_OR=7,
+
+    /* Performs a bitwise ``or`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_OR=7,
+
+    /* Deprecated */
+    FDB_MUTATION_TYPE_XOR=8,
+
+    /* Performs a bitwise ``xor`` operation.  If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. */
+    FDB_MUTATION_TYPE_BIT_XOR=8,
+
+    /* Appends ``param`` to the end of the existing value already in the database at the given key (or creates the key and sets the value to ``param`` if the key is empty). This will only append the value if the final concatenated value size is less than or equal to the maximum value size (i.e., if it fits). WARNING: No error is surfaced back to the user if the final value is too large because the mutation will not be applied until after the transaction has been committed. Therefore, it is only safe to use this mutation type if one can guarantee that one will keep the total value size under the maximum size. */
+    FDB_MUTATION_TYPE_APPEND_IF_FITS=9,
+
+    /* Performs a little-endian comparison of byte strings. If the existing value in the database is not present or shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The larger of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_MAX=12,
+
+    /* Performs a little-endian comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored in the database. If the existing value in the database is shorter than ``param``, it is first extended to the length of ``param`` with zero bytes.  If ``param`` is shorter than the existing value in the database, the existing value is truncated to match the length of ``param``. The smaller of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_MIN=13,
+
+    /* Transforms ``key`` using a versionstamp for the transaction. Sets the transformed key in the database to ``param``. The key is transformed by removing the final four bytes from the key and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the key from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the key is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the offset was computed from only the final two bytes rather than the final four bytes. */
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_KEY=14,
+
+    /* Transforms ``param`` using a versionstamp for the transaction. Sets the ``key`` given to the transformed ``param``. The parameter is transformed by removing the final four bytes from ``param`` and reading those as a little-Endian 32-bit integer to get a position ``pos``. The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the versionstamp of the transaction used. The first byte of the parameter is position 0. A versionstamp is a 10 byte, unique, monotonically (but not sequentially) increasing value for each committed transaction. The first 8 bytes are the committed version of the database (serialized in big-Endian order). The last 2 bytes are monotonic in the serialization order for transactions. WARNING: At this time, versionstamps are compatible with the Tuple layer only in the Java, Python, and Go bindings. Also, note that prior to API version 520, the versionstamp was always placed at the beginning of the parameter rather than computing an offset. */
+    FDB_MUTATION_TYPE_SET_VERSIONSTAMPED_VALUE=15,
+
+    /* Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the smaller of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_BYTE_MIN=16,
+
+    /* Performs lexicographic comparison of byte strings. If the existing value in the database is not present, then ``param`` is stored. Otherwise the larger of the two values is then stored in the database. */
+    FDB_MUTATION_TYPE_BYTE_MAX=17,
+
+    /* Performs an atomic ``compare and clear`` operation. If the existing value in the database is equal to the given value, then given key is cleared. */
+    FDB_MUTATION_TYPE_COMPARE_AND_CLEAR=20
+} FDBMutationType;
+
+typedef enum {
+    /* Used to add a read conflict range */
+    FDB_CONFLICT_RANGE_TYPE_READ=0,
+
+    /* Used to add a write conflict range */
+    FDB_CONFLICT_RANGE_TYPE_WRITE=1
+} FDBConflictRangeType;
+
+typedef enum {
+    /* Returns ``true`` if the error indicates the operations in the transactions should be retried because of transient error. */
+    FDB_ERROR_PREDICATE_RETRYABLE=50000,
+
+    /* Returns ``true`` if the error indicates the transaction may have succeeded, though not in a way the system can verify. */
+    FDB_ERROR_PREDICATE_MAYBE_COMMITTED=50001,
+
+    /* Returns ``true`` if the error indicates the transaction has not committed, though in a way that can be retried. */
+    FDB_ERROR_PREDICATE_RETRYABLE_NOT_COMMITTED=50002
+} FDBErrorPredicate;
+
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/740/fdb_c_types.h b/bindings/rust/foundationdb-sys/include/740/fdb_c_types.h
new file mode 100644
index 00000000000..779e227ad5e
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/740/fdb_c_types.h
@@ -0,0 +1,47 @@
+/*
+ * fdb_c_types.h
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2013-2022 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FDB_C_TYPES_H
+#define FDB_C_TYPES_H
+#pragma once
+
+#ifndef DLLEXPORT
+#define DLLEXPORT
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Pointers to these opaque types represent objects in the FDB API */
+typedef struct FDB_future FDBFuture;
+typedef struct FDB_result FDBResult;
+typedef struct FDB_cluster FDBCluster;
+typedef struct FDB_database FDBDatabase;
+typedef struct FDB_tenant FDBTenant;
+typedef struct FDB_transaction FDBTransaction;
+
+typedef int fdb_error_t;
+typedef int fdb_bool_t;
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/bindings/rust/foundationdb-sys/include/740/version.txt b/bindings/rust/foundationdb-sys/include/740/version.txt
new file mode 100644
index 00000000000..815da58b7a9
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/include/740/version.txt
@@ -0,0 +1 @@
+7.4.1
diff --git a/bindings/rust/foundationdb-sys/src/lib.rs b/bindings/rust/foundationdb-sys/src/lib.rs
new file mode 100644
index 00000000000..d7eb2468322
--- /dev/null
+++ b/bindings/rust/foundationdb-sys/src/lib.rs
@@ -0,0 +1,250 @@
+#![allow(non_upper_case_globals)]
+#![allow(non_camel_case_types)]
+#![allow(non_snake_case)]
+#![allow(clippy::unreadable_literal)]
+include!(concat!(env!("OUT_DIR"), "/bindings.rs"));
+
+/// Defines the FDB_API_VERSION constant and generates the `if_cfg_api_versions` macro
+/// from a list of (name, number) versions.
+///
+/// `if_cfg_api_versions` has one branch for all possible version combinations:
+/// - (min = ...)
+/// - (max = ...)
+/// - (min = ..., max = ...) with min < max
+///
+/// For macro expansion reasons, we need to generate all the branches in a single expansion,
+/// so this macro uses accumulators to gather all branch data before expanding it in one go.
+/// In short, this is a combinatorial generator. Given `[0, 1, 2, 3]` it generates branches for:
+/// - (min = 0)
+/// - (min = 1)
+/// - (min = 2)
+/// - (min = 3)
+/// - (max = 0)
+/// - (max = 1)
+/// - (max = 2)
+/// - (max = 3)
+/// - (min = 0, max = 1)
+/// - (min = 0, max = 2)
+/// - (min = 0, max = 3)
+/// - (min = 1, max = 2)
+/// - (min = 1, max = 3)
+/// - (min = 2, max = 3)
+macro_rules! versions_expand {
+    ($(($version_name:tt, $version:tt)),+ $(,)?) => {
+        // Entry point: start with a list of (version_name, version_number)
+        // define the FDB_API_VERSION constant
+        $(
+            #[cfg(feature = $version_name)]
+            pub const FDB_API_VERSION: u32 = $version;
+        )*
+        // Call the "@pre" phase with:
+        // - visited_versions: []
+        // - remaining_versions: versions
+        // - acc2: [] (will store min branches)
+        // - acc3: [] (will store max branches)
+        versions_expand!(@pre [][$(($version_name, $version))+][][]);
+    };
+    (@pre [$($max:tt)*][$min:tt $($other:tt)*][$(($($acc2:tt)*))*][$(($($acc3:tt)*))*]) => {
+        // "@pre" phase generates (min = ...) and (max = ...) branches
+        // While remaining_versions is not empty:
+        // - move one version from remaining to visited
+        // - add one "min" branch to acc2
+        // - add one "max" branch to acc3
+        versions_expand!(@pre [$($max)* $min][$($other)*][$(($($acc2)*))* ($min $($other)*)][$(($($acc3)*))* ($min $($max)*)]);
+    };
+    (@pre [$min:tt $($version:tt)*][] $acc2:tt $acc3:tt) => {
+        // remaining_versions is empty: end of "@pre" phase
+        // Call the "@mid" phase with:
+        // - min_range: [versions[0]]
+        // - max_range: versions[1..]
+        // - acc1: [] (will store min-max combination branches)
+        // - acc2: min_branches
+        // - acc3: max_branches
+        versions_expand!(@mid [$min][$($version)*][] $acc2 $acc3);
+    };
+    (@mid [$min:tt $($version:tt)*][$max:tt $($other:tt)*][$(($($acc1:tt)*))*] $acc2:tt $acc3:tt) => {
+        // "@mid" phase generates all (min = ..., max = ...) branches
+        // This step generates all pairs for the current min
+        // While the max_range is not empty:
+        // - let max be the smallest version in max_range
+        // - add the "min max" branch to acc1
+        // - move max to the min_range
+        versions_expand!(@mid [$min $($version)* $max][$($other)*][$(($($acc1)*))* ($min $max $($version)*)] $acc2 $acc3);
+    };
+    (@mid [$drop:tt $min:tt $($version:tt)*][] $acc1:tt $acc2:tt $acc3:tt) => {
+        // max_range is empty: end of inner "@mid" loop
+        // - drop current min
+        // - set the second smallest version in min_range as new min
+        // - set all remaining versions as the max_range
+        versions_expand!(@mid [$min][$($version)*] $acc1 $acc2 $acc3);
+    };
+    (@mid [$drop:tt][] $acc1:tt $acc2:tt $acc3:tt) => {
+        // min_range is empty: end of "@mid" phase
+        // Call the "@end" phase with:
+        // - the $ sign so it can use it as a symbol in the macro
+        // - acc1: min_max_branches
+        // - acc2: min_branches
+        // - acc3: max_branches
+        versions_expand!(@end ($) $acc1 $acc2 $acc3);
+    };
+    (@end ($d:tt)
+        [$((($min_name1:tt, $min1:tt) ($max_name1:tt, $max1:tt) $(($version_name1:tt, $version1:tt))*))*]
+        [$((($min_name2:tt, $min2:tt) $(($version_name2:tt, $version2:tt))*))*]
+        [$((($max_name3:tt, $max3:tt) $(($version_name3:tt, $version3:tt))*))*]
+    ) => {
+        // "@end" phase generates the macro in one expansion
+        // For each branch type, generates the appropriate cfg attributes
+
+        /// Similar to `cfg_api_versions` proc-macro, but as a regular macro.
+        /// Unlike proc-macros which are unstable on expressions and non-inlined modules,
+        /// `if_cfg_api_versions` can be used on these places.
+        ///
+        /// Any feature after the "min" and "max" arguments will be joined in the "any" predicate.
+        ///
+        /// ### Constraints:
+        /// - `if/else` always requires block syntax (i.e., `{}` around branches).
+        /// - Avoid using multiple items in a single macro call.
+        /// - Best suited for guarding expressions, single items, or blocks.
+        ///
+        /// ## Behavior
+        /// ### Single statement
+        /// Guard the statment without additional curly braces
+        /// ```rs
+        /// if_cfg_api_versions!(max = 520 => prinln!("foo"));
+        /// // expands to:
+        /// #[cfg(any(feature = "fdb-5_1", feature = "fdb-5_2"))]
+        /// println!("foo");
+        /// ```
+        ///
+        /// ### Muliple statements
+        /// Guard a block wrapping the statments
+        /// ```rs
+        /// if_cfg_api_versions!(max = 520 =>
+        ///     prinln!("foo");
+        ///     prinln!("bar");
+        /// );
+        /// // expands to:
+        /// #[cfg(any(feature = "fdb-5_1", feature = "fdb-5_2"))]
+        /// {
+        ///     println!("foo");
+        ///     println!("bar");
+        /// }
+        /// ```
+        ///
+        /// ### Single Item (e.g., `mod`, `fn`, etc.)
+        /// Guard the item without additional culry braces
+        /// ```rs
+        /// if_cfg_api_versions!(max = 520 => pub mod foo);
+        /// // expands to:
+        /// #[cfg(any(feature = "fdb-5_1", feature = "fdb-5_2"))]
+        /// pub mod foo;
+        /// ```
+        ///
+        /// ### Multiple Items: **NOT RECOMMANDED**
+        /// Only guard the first item (does not add curly braces since it would be invalid syntax)
+        /// ```rs
+        /// if_cfg_api_versions!(max = 520 =>
+        ///     pub mod foo;
+        ///     pub mod bar;
+        /// );
+        /// // expands to:
+        /// #[cfg(any(feature = "fdb-5_1", feature = "fdb-5_2"))]
+        /// pub mod foo;
+        /// pub mod bar; // not guarded
+        /// ```
+        ///
+        /// ### If/Else
+        /// Both branches must be wrapped in curly braces, guard the first branch and the second with the opposite condition
+        /// ```rs
+        /// let result = if_cfg_api_versions!(max = 520 => {
+        ///     println!("5.x");
+        ///     true
+        /// } else {
+        ///     println!("6.0+");
+        ///     false
+        /// });
+        /// // expands to:
+        /// let result = {
+        ///     #[cfg(any(feature = "fdb-5_1", feature = "fdb-5_2"))]
+        ///     {
+        ///         println!("5.x");
+        ///         true
+        ///     }
+        ///     #[cfg(not(any(feature = "fdb-5_1", feature = "fdb-5_2")))]
+        ///     {
+        ///         println!("6.0+");
+        ///         false
+        ///     }
+        /// };
+        /// ```
+        #[macro_export]
+        macro_rules! if_cfg_api_versions {
+            // multiple statements
+            ($d($k:tt = $v:tt),+ => $a:stmt; $d($b:stmt)+) => {
+                if_cfg_api_versions!($d($k=$v),+ => { $a; $d($b)+ })
+            };
+            // min-max branches
+            $(
+                (min=$min1, max=$max1 $d(,feature = $feature:literal)* => {$d($then:tt)*} else {$d($else:tt)*}) => {{
+                    #[cfg(any(feature=$min_name1 $(,feature=$version_name1)* ,feature=$max_name1 $d(,feature=$feature)*))]
+                    { $d($then)* }
+                    #[cfg(not(any(feature=$min_name1 $(,feature=$version_name1)* ,feature=$max_name1 $d(,feature=$feature)*)))]
+                    { $d($else)* }
+                }};
+                (min=$min1, max=$max1 $d(,feature = $feature:literal)* => $d($then:tt)*) => {
+                    #[cfg(any(feature=$min_name1 $(,feature=$version_name1)* ,feature=$max_name1 $d(,feature=$feature)*))]
+                    $d($then)*
+                };
+            )*
+            // min branches
+            $(
+                (min=$min2 $d(,feature = $feature:literal)* => {$d($then:tt)*} else {$d($else:tt)*}) => {{
+                    #[cfg(any(feature=$min_name2 $(,feature=$version_name2)* $d(,feature=$feature)*))]
+                    { $d($then)* }
+                    #[cfg(not(any(feature=$min_name2 $(,feature=$version_name2)* $d(,feature=$feature)*)))]
+                    { $d($else)* }
+                }};
+                (min=$min2 $d(,feature = $feature:literal)* => $d($then:tt)*) => {
+                    #[cfg(any(feature=$min_name2 $(,feature=$version_name2)* $d(,feature=$feature)*))]
+                    $d($then)*
+                };
+            )*
+            // max branches
+            $(
+                (max=$max3 $d(,feature = $feature:literal)* => {$d($then:tt)*} else {$d($else:tt)*}) => {{
+                    #[cfg(any($(feature=$version_name3,)* feature=$max_name3 $d(,feature=$feature)*))]
+                    { $d($then)* }
+                    #[cfg(not(any($(feature=$version_name3,)* feature=$max_name3 $d(,feature=$feature)*)))]
+                    { $d($else)* }
+                }};
+                (max=$max3 $d(,feature = $feature:literal)* => $d($then:tt)*) => {
+                    #[cfg(any($(feature=$version_name3,)* feature=$max_name3 $d(,feature=$feature)*))]
+                    $d($then)*
+                };
+            )*
+            // unsupported versions
+            (min=$min:tt, max=$max:tt  $d(,feature = $feature:literal)* => $d($t:tt)*) => {
+                compile_error!(concat!("Use of unsupported version, or min >= max. Supported: ", $($min2, " " ,)*));
+            };
+            (min=$min:tt $d(,feature = $feature:literal)* => $d($t:tt)*) => {
+                compile_error!(concat!("Use of unsupported version. Supported: ", $($min2, " " ,)*));
+            };
+            (max=$max:tt $d(,feature = $feature:literal)* => $d($t:tt)*) => {
+                compile_error!(concat!("Use of unsupported version. Supported: ", $($min2, " " ,)*));
+            };
+        }
+    };
+}
+
+versions_expand![
+    ("fdb-5_1", 510),
+    ("fdb-5_2", 520),
+    ("fdb-6_0", 600),
+    ("fdb-6_1", 610),
+    ("fdb-6_2", 620),
+    ("fdb-6_3", 630),
+    ("fdb-7_0", 700),
+    ("fdb-7_1", 710),
+    ("fdb-7_3", 730),
+    ("fdb-7_4", 740),
+];
diff --git a/bindings/rust/foundationdb-tuple/CHANGELOG.md b/bindings/rust/foundationdb-tuple/CHANGELOG.md
new file mode 100644
index 00000000000..c7f45eddce7
--- /dev/null
+++ b/bindings/rust/foundationdb-tuple/CHANGELOG.md
@@ -0,0 +1,44 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.11.0] - 2026-06-24
+
+### <!-- 1 -->🚀 Features
+
+- Feat: migrate workspace to Rust 2024 edition (#255)
+
+[0.11.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.10.0..0.11.0
+
+
+## [0.10.0] - 2025-10-24
+
+### <!-- 1 -->🚀 Features
+
+- Implement `std::fmt::Display` on `Subspace`
+
+### <!-- 2 -->🐛 Bug Fixes
+
+- Fix: resolve clippy warnings and add doc alias
+
+### <!-- 8 -->⚙️ Miscellaneous
+
+- Clippy fixes
+- Bump MSRV to 1.82
+- Clippy --fix
+- Bump msrv to 1.85
+
+[0.10.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.9.1..0.10.0
+
+
+## [0.9.1] - 2025-01-06
+
+### <!-- 4 -->⚙️ Other changes
+
+- Update release
+- Split the fdb-tuple module into its own crate
+
+
diff --git a/bindings/rust/foundationdb-tuple/Cargo.toml b/bindings/rust/foundationdb-tuple/Cargo.toml
new file mode 100644
index 00000000000..e3125de157a
--- /dev/null
+++ b/bindings/rust/foundationdb-tuple/Cargo.toml
@@ -0,0 +1,36 @@
+[package]
+name = "foundationdb-tuple"
+version = "0.11.0"
+authors = [
+    "Benjamin Fry <benjaminfry@me.com>",
+    "Vincent Rouillé <vincent@clikengo.com>",
+    "Pierre Zemb <contact@pierrezemb.fr>",
+]
+edition = "2024"
+rust-version = "1.85.1"
+
+description = """
+Foundationdb tuple pack/unpack implementation in rust
+"""
+
+documentation = "https://docs.rs/foundationdb"
+repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+license = "MIT/Apache-2.0"
+
+readme = "README.md"
+keywords = ["foundationdb", "kv", "tuple"]
+categories = ["database"]
+
+[package.metadata.docs.rs]
+features = ["uuid", "num-bigint"]
+
+[badges]
+codecov = { repository = "foundationdb-rs/foundationdb-rs", branch = "main", service = "github" }
+
+[features]
+default = ["uuid"]
+
+[dependencies]
+memchr = "2.8.2"
+uuid = { version = "1.23.3", optional = true }
+num-bigint = { version = "0.5.1", optional = true }
diff --git a/bindings/rust/foundationdb-tuple/README.md b/bindings/rust/foundationdb-tuple/README.md
new file mode 100644
index 00000000000..29269bf2b74
--- /dev/null
+++ b/bindings/rust/foundationdb-tuple/README.md
@@ -0,0 +1,3 @@
+# FoundationDB Tuple
+
+A rust implementation of the [tuple encoding](https://github.com/apple/foundationdb/blob/main/design/tuple.md) used by FoundationDB.
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-tuple/src/element.rs b/bindings/rust/foundationdb-tuple/src/element.rs
new file mode 100644
index 00000000000..71749cf162c
--- /dev/null
+++ b/bindings/rust/foundationdb-tuple/src/element.rs
@@ -0,0 +1,230 @@
+use super::pack::{f32_to_u32_be_bytes, f64_to_u64_be_bytes};
+use super::{Bytes, Versionstamp};
+use std::{borrow::Cow, cmp};
+
+#[cfg(feature = "num-bigint")]
+use num_bigint::Sign;
+#[cfg(feature = "num-bigint")]
+use std::convert::TryFrom;
+
+#[derive(Clone, Debug)]
+pub enum Element<'a> {
+    Nil,
+    Bytes(Bytes<'a>),
+    String(Cow<'a, str>),
+    Tuple(Vec<Element<'a>>),
+    Int(i64),
+    #[cfg(feature = "num-bigint")]
+    BigInt(num_bigint::BigInt),
+    Float(f32),
+    Double(f64),
+    Bool(bool),
+    #[cfg(feature = "uuid")]
+    Uuid(uuid::Uuid),
+    Versionstamp(Versionstamp),
+}
+
+struct CmpElement<'a, 'b>(&'a Element<'b>);
+
+impl PartialEq for CmpElement<'_, '_> {
+    fn eq(&self, other: &Self) -> bool {
+        self.cmp(other) == cmp::Ordering::Equal
+    }
+}
+impl Eq for CmpElement<'_, '_> {}
+
+impl PartialOrd for CmpElement<'_, '_> {
+    fn partial_cmp(&self, other: &Self) -> Option<cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for CmpElement<'_, '_> {
+    fn cmp(&self, other: &Self) -> cmp::Ordering {
+        self.0
+            .code()
+            .cmp(&other.0.code())
+            .then_with(|| match (&self.0, &other.0) {
+                (Element::Bytes(a), Element::Bytes(b)) => a.cmp(b),
+                (Element::String(a), Element::String(b)) => a.cmp(b),
+                (Element::Tuple(a), Element::Tuple(b)) => {
+                    let a_values = a.iter().map(CmpElement);
+                    let b_values = b.iter().map(CmpElement);
+                    a_values.cmp(b_values)
+                }
+                (Element::Int(a), Element::Int(b)) => a.cmp(b),
+                #[cfg(feature = "num-bigint")]
+                (Element::BigInt(a), Element::BigInt(b)) => a.cmp(b),
+                #[cfg(feature = "num-bigint")]
+                (Element::BigInt(a), Element::Int(b)) => match i64::try_from(a) {
+                    Ok(a) => a.cmp(b),
+                    Err(_) => a.sign().cmp(&Sign::NoSign),
+                },
+                #[cfg(feature = "num-bigint")]
+                (Element::Int(a), Element::BigInt(b)) => match i64::try_from(b) {
+                    Ok(b) => a.cmp(&b),
+                    Err(_) => Sign::NoSign.cmp(&b.sign()),
+                },
+                (Element::Float(a), Element::Float(b)) => {
+                    f32_to_u32_be_bytes(*a).cmp(&f32_to_u32_be_bytes(*b))
+                }
+                (Element::Double(a), Element::Double(b)) => {
+                    f64_to_u64_be_bytes(*a).cmp(&f64_to_u64_be_bytes(*b))
+                }
+                #[cfg(feature = "uuid")]
+                (Element::Uuid(a), Element::Uuid(b)) => a.cmp(b),
+                (Element::Versionstamp(a), Element::Versionstamp(b)) => a.cmp(b),
+                _ => cmp::Ordering::Equal,
+            })
+    }
+}
+
+impl PartialEq for Element<'_> {
+    fn eq(&self, other: &Self) -> bool {
+        self.cmp(other) == cmp::Ordering::Equal
+    }
+}
+impl Eq for Element<'_> {}
+
+impl PartialOrd for Element<'_> {
+    fn partial_cmp(&self, other: &Self) -> Option<cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+impl Ord for Element<'_> {
+    fn cmp(&self, other: &Self) -> cmp::Ordering {
+        self.cmp_at_root(other)
+    }
+}
+
+impl<'a> Element<'a> {
+    fn code(&self) -> u8 {
+        match self {
+            Element::Nil => super::NIL,
+            Element::Bytes(_) => super::BYTES,
+            Element::String(_) => super::STRING,
+            Element::Tuple(_) => super::NESTED,
+            Element::Int(_) => super::INTZERO,
+            #[cfg(feature = "num-bigint")]
+            Element::BigInt(_) => super::INTZERO,
+            Element::Float(_) => super::FLOAT,
+            Element::Double(_) => super::DOUBLE,
+            Element::Bool(v) => {
+                if *v {
+                    super::TRUE
+                } else {
+                    super::FALSE
+                }
+            }
+            #[cfg(feature = "uuid")]
+            Element::Uuid(_) => super::UUID,
+            Element::Versionstamp(_) => super::VERSIONSTAMP,
+        }
+    }
+
+    #[inline]
+    fn cmp_values(&self) -> &[Self] {
+        match self {
+            Element::Tuple(v) => v.as_slice(),
+            v => std::slice::from_ref(v),
+        }
+    }
+
+    fn cmp_at_root(&self, b: &Element<'_>) -> cmp::Ordering {
+        let a_values = self.cmp_values().iter().map(CmpElement);
+        let b_values = b.cmp_values().iter().map(CmpElement);
+        a_values.cmp(b_values)
+    }
+
+    pub fn into_owned(self) -> Element<'static> {
+        match self {
+            Element::Nil => Element::Nil,
+            Element::Bytes(v) => Element::Bytes(v.into_owned().into()),
+            Element::String(v) => Element::String(Cow::Owned(v.into_owned())),
+            Element::Tuple(v) => Element::Tuple(v.into_iter().map(|e| e.into_owned()).collect()),
+            Element::Int(v) => Element::Int(v),
+            #[cfg(feature = "num-bigint")]
+            Element::BigInt(v) => Element::BigInt(v),
+            Element::Float(v) => Element::Float(v),
+            Element::Double(v) => Element::Double(v),
+            Element::Bool(v) => Element::Bool(v),
+            #[cfg(feature = "uuid")]
+            Element::Uuid(v) => Element::Uuid(v),
+            Element::Versionstamp(v) => Element::Versionstamp(v),
+        }
+    }
+
+    pub fn as_bytes(&self) -> Option<&Bytes<'_>> {
+        match self {
+            Element::Bytes(v) => Some(v),
+            _ => None,
+        }
+    }
+
+    pub fn as_str(&self) -> Option<&str> {
+        match self {
+            Element::String(v) => Some(v),
+            _ => None,
+        }
+    }
+
+    pub fn as_tuple(&self) -> Option<&[Element<'a>]> {
+        match self {
+            Element::Tuple(v) => Some(v.as_slice()),
+            _ => None,
+        }
+    }
+
+    pub fn as_i64(&self) -> Option<i64> {
+        match self {
+            Element::Int(v) => Some(*v),
+            #[cfg(feature = "num-bigint")]
+            Element::BigInt(v) => i64::try_from(v).ok(),
+            _ => None,
+        }
+    }
+
+    #[cfg(feature = "num-bigint")]
+    pub fn as_bigint(&self) -> Option<&num_bigint::BigInt> {
+        match self {
+            Element::BigInt(v) => Some(v),
+            _ => None,
+        }
+    }
+
+    pub fn as_f32(&self) -> Option<f32> {
+        match self {
+            Element::Float(v) => Some(*v),
+            _ => None,
+        }
+    }
+
+    pub fn as_f64(&self) -> Option<f64> {
+        match self {
+            Element::Double(v) => Some(*v),
+            _ => None,
+        }
+    }
+
+    pub fn as_bool(&self) -> Option<bool> {
+        match *self {
+            Element::Bool(v) => Some(v),
+            _ => None,
+        }
+    }
+
+    #[cfg(feature = "uuid")]
+    pub fn as_uuid(&self) -> Option<&uuid::Uuid> {
+        match self {
+            Element::Uuid(v) => Some(v),
+            _ => None,
+        }
+    }
+
+    pub fn as_versionstamp(&self) -> Option<&Versionstamp> {
+        match self {
+            Element::Versionstamp(v) => Some(v),
+            _ => None,
+        }
+    }
+}
diff --git a/bindings/rust/foundationdb-tuple/src/lib.rs b/bindings/rust/foundationdb-tuple/src/lib.rs
new file mode 100644
index 00000000000..d1ac08564c7
--- /dev/null
+++ b/bindings/rust/foundationdb-tuple/src/lib.rs
@@ -0,0 +1,697 @@
+//! Implementation of the official tuple layer typecodes
+//!
+//! The official specification can be found [here](https://github.com/apple/foundationdb/blob/master/design/tuple.md).
+
+mod element;
+mod pack;
+mod subspace;
+mod versionstamp;
+
+use std::borrow::Cow;
+use std::fmt::{self, Display};
+use std::io;
+use std::ops::Deref;
+use std::result;
+
+#[cfg(feature = "uuid")]
+pub use uuid::Uuid;
+
+pub use element::Element;
+pub use pack::{TuplePack, TupleUnpack, VersionstampOffset};
+pub use subspace::Subspace;
+pub use versionstamp::Versionstamp;
+
+const NIL: u8 = 0x00;
+const BYTES: u8 = 0x01;
+const STRING: u8 = 0x02;
+const NESTED: u8 = 0x05;
+const NEGINTSTART: u8 = 0x0b;
+const INTZERO: u8 = 0x14;
+const POSINTEND: u8 = 0x1d;
+const FLOAT: u8 = 0x20;
+const DOUBLE: u8 = 0x21;
+const FALSE: u8 = 0x26;
+const TRUE: u8 = 0x27;
+#[cfg(feature = "uuid")]
+const UUID: u8 = 0x30;
+// Not a single official binding is implementing 80 Bit versionstamp...
+// const VERSIONSTAMP_88: u8 = 0x32;
+const VERSIONSTAMP: u8 = 0x33;
+
+const ESCAPE: u8 = 0xff;
+
+/// Tracks the depth of a Tuple decoding chain
+#[derive(Copy, Clone)]
+pub struct TupleDepth(usize);
+
+impl TupleDepth {
+    fn new() -> Self {
+        TupleDepth(0)
+    }
+
+    /// Increment the depth by one, this be called when calling into `Tuple::{encode, decode}` of tuple-like datastructures
+    pub fn increment(self) -> Self {
+        TupleDepth(self.0 + 1)
+    }
+
+    /// Returns the current depth in any recursive tuple processing, 0 representing there having been no recursion
+    pub fn depth(self) -> usize {
+        self.0
+    }
+}
+
+/// A packing/unpacking error
+#[derive(Debug)]
+pub enum PackError {
+    Message(Box<str>),
+    IoError(io::Error),
+    TrailingBytes,
+    MissingBytes,
+    BadStringFormat,
+    BadCode {
+        found: u8,
+        expected: Option<u8>,
+    },
+    BadPrefix,
+    #[cfg(feature = "uuid")]
+    BadUuid,
+    UnsupportedIntLength,
+}
+
+impl From<io::Error> for PackError {
+    fn from(err: io::Error) -> Self {
+        PackError::IoError(err)
+    }
+}
+
+impl Display for PackError {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match self {
+            PackError::Message(s) => s.fmt(f),
+            PackError::IoError(err) => err.fmt(f),
+            PackError::TrailingBytes => write!(f, "trailing bytes"),
+            PackError::MissingBytes => write!(f, "missing bytes"),
+            PackError::BadStringFormat => write!(f, "not an utf8 string"),
+            PackError::BadCode { found, .. } => write!(f, "bad code, found {found}"),
+            PackError::BadPrefix => write!(f, "bad prefix"),
+            #[cfg(feature = "uuid")]
+            PackError::BadUuid => write!(f, "bad uuid"),
+            PackError::UnsupportedIntLength => write!(f, "integer length was to large"),
+        }
+    }
+}
+
+impl std::error::Error for PackError {}
+
+/// Alias for `Result<..., tuple::Error>`
+pub type PackResult<T> = result::Result<T, PackError>;
+
+/// Represent a sequence of bytes (i.e. &[u8])
+///
+/// This sequence can be either owned or borrowed.
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct Bytes<'a>(pub Cow<'a, [u8]>);
+
+impl fmt::Debug for Bytes<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+
+impl fmt::Display for Bytes<'_> {
+    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
+        write!(fmt, "b\"")?;
+        for &byte in self.0.iter() {
+            if byte == b'\\' {
+                write!(fmt, r"\\")?;
+            } else if byte.is_ascii_alphanumeric() {
+                write!(fmt, "{}", byte as char)?;
+            } else {
+                write!(fmt, "\\x{byte:02x}")?;
+            }
+        }
+        write!(fmt, "\"")
+    }
+}
+
+impl Bytes<'_> {
+    pub fn into_owned(self) -> Vec<u8> {
+        self.0.into_owned()
+    }
+}
+
+impl Deref for Bytes<'_> {
+    type Target = [u8];
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+impl AsRef<[u8]> for Bytes<'_> {
+    fn as_ref(&self) -> &[u8] {
+        &self.0
+    }
+}
+
+impl<'a> From<&'a [u8]> for Bytes<'a> {
+    fn from(bytes: &'a [u8]) -> Self {
+        Self(Cow::Borrowed(bytes))
+    }
+}
+impl From<Vec<u8>> for Bytes<'static> {
+    fn from(vec: Vec<u8>) -> Self {
+        Self(Cow::Owned(vec))
+    }
+}
+
+impl<'a> From<&'a str> for Bytes<'a> {
+    fn from(s: &'a str) -> Self {
+        s.as_bytes().into()
+    }
+}
+impl From<String> for Bytes<'static> {
+    fn from(vec: String) -> Self {
+        vec.into_bytes().into()
+    }
+}
+
+/// Pack value and returns the packed buffer
+///
+/// # Panics
+///
+/// Panics if the encoded data size doesn't fit in `u32`.
+pub fn pack<T: TuplePack>(v: &T) -> Vec<u8> {
+    v.pack_to_vec()
+}
+
+/// Pack value and returns the packed buffer
+///
+/// # Panics
+///
+/// Panics if there is multiple versionstamp present or if the encoded data size doesn't fit in `u32`.
+pub fn pack_with_versionstamp<T: TuplePack>(v: &T) -> Vec<u8> {
+    v.pack_to_vec_with_versionstamp()
+}
+
+/// Pack value into the given buffer
+///
+/// # Panics
+///
+/// Panics if the encoded data size doesn't fit in `u32`.
+pub fn pack_into<T: TuplePack>(v: &T, output: &mut Vec<u8>) -> VersionstampOffset {
+    v.pack_into_vec(output)
+}
+
+/// Pack value into the given buffer
+///
+/// # Panics
+///
+/// Panics if there is multiple versionstamp present or if the encoded data size doesn't fit in `u32`.
+pub fn pack_into_with_versionstamp<T: TuplePack>(v: &T, output: &mut Vec<u8>) {
+    let offset = v.pack_into_vec_with_versionstamp(output);
+    if let VersionstampOffset::MultipleIncomplete = offset {
+        panic!("pack_into_with_versionstamp does not allow multiple versionstamps");
+    }
+}
+
+/// Unpack input
+pub fn unpack<'de, T: TupleUnpack<'de>>(input: &'de [u8]) -> PackResult<T> {
+    T::unpack_root(input)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const NIL_VAL: Option<()> = None;
+
+    fn test_serde<'de, T>(val: T, buf: &'de [u8])
+    where
+        T: TuplePack + TupleUnpack<'de> + fmt::Debug + PartialEq,
+    {
+        assert_eq!(Bytes::from(pack(&val)), Bytes::from(buf));
+        assert_eq!(unpack::<'de, T>(buf).unwrap(), val);
+    }
+
+    #[test]
+    fn test_spec() {
+        test_serde(NIL_VAL, &[NIL]);
+        test_serde((NIL_VAL,), &[NIL]);
+        test_serde(((NIL_VAL,),), &[NESTED, NIL, ESCAPE, NIL]);
+        // assert_eq!(to_bytes(b"foo\x00bar").unwrap(), b"\x01foo\x00\xffbar\x00");
+        test_serde("FÔO\x00bar".to_owned(), b"\x02F\xc3\x94O\x00\xffbar\x00");
+        test_serde(
+            (("foo\x00bar".to_owned(), NIL_VAL, ()),),
+            b"\x05\x02foo\x00\xffbar\x00\x00\xff\x05\x00\x00",
+        );
+        test_serde(-1, b"\x13\xfe");
+        test_serde(-5551212, b"\x11\xabK\x93");
+        test_serde(-42f32, b"\x20\x3d\xd7\xff\xff");
+    }
+
+    #[test]
+    fn test_simple() {
+        // bool
+        test_serde(false, &[FALSE]);
+        test_serde(true, &[TRUE]);
+
+        // int
+        test_serde(0i64, &[INTZERO]);
+        test_serde(1i64, &[0x15, 1]);
+        test_serde(-1i64, &[0x13, 254]);
+        test_serde(100i64, &[21, 100]);
+
+        test_serde(10000i32, &[22, 39, 16]);
+        test_serde(-100i16, &[19, 155]);
+        test_serde(-10000i64, &[18, 216, 239]);
+        test_serde(-1000000i64, &[17, 240, 189, 191]);
+
+        // boundary condition
+        test_serde(255u16, &[0x15, 255]);
+        test_serde(256i32, &[0x16, 1, 0]);
+        test_serde(-255i16, &[0x13, 0]);
+        test_serde(-256i64, &[0x12, 254, 255]);
+
+        // versionstamp
+        test_serde(
+            Versionstamp::complete(*b"\xaa\xbb\xcc\xdd\xee\xff\x00\x01\x02\x03", 0),
+            b"\x33\xaa\xbb\xcc\xdd\xee\xff\x00\x01\x02\x03\x00\x00",
+        );
+        test_serde(
+            Versionstamp::complete(*b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a", 657),
+            b"\x33\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x02\x91",
+        );
+
+        test_serde(0, b"\x14");
+        test_serde(1, b"\x15\x01");
+        test_serde(-1, b"\x13\xfe");
+        test_serde(255, b"\x15\xff");
+        test_serde(-255, b"\x13\x00");
+        test_serde(256, b"\x16\x01\x00");
+        test_serde(-256, b"\x12\xfe\xff");
+        test_serde(65536, b"\x17\x01\x00\x00");
+        test_serde(-65536, b"\x11\xfe\xff\xff");
+        test_serde(i64::MAX, b"\x1C\x7f\xff\xff\xff\xff\xff\xff\xff");
+        test_serde(i64::MAX as u64 + 1, b"\x1C\x80\x00\x00\x00\x00\x00\x00\x00");
+        test_serde(u64::MAX, b"\x1C\xff\xff\xff\xff\xff\xff\xff\xff");
+        test_serde(
+            u128::MAX,
+            b"\x1D\x10\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff",
+        );
+        test_serde(
+            u64::MAX as u128 + 1,
+            b"\x1D\x09\x01\x00\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            u64::MAX as i128 + 1,
+            b"\x1D\x09\x01\x00\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            i64::MIN as i128 + 1,
+            b"\x0C\x80\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            i64::MIN as i128 - 1,
+            b"\x0C\x7f\xff\xff\xff\xff\xff\xff\xfe",
+        );
+        test_serde(-(u64::MAX as i128), b"\x0C\x00\x00\x00\x00\x00\x00\x00\x00");
+        test_serde(
+            -(u64::MAX as i128) - 1,
+            b"\x0b\xf6\xfe\xff\xff\xff\xff\xff\xff\xff\xff",
+        );
+        test_serde(
+            -(u64::MAX as i128) - 2,
+            b"\x0b\xf6\xfe\xff\xff\xff\xff\xff\xff\xff\xfe",
+        );
+        test_serde(
+            (u64::MAX as i128) * -2,
+            b"\x0b\xf6\xfe\x00\x00\x00\x00\x00\x00\x00\x01",
+        );
+        test_serde(
+            (u64::MAX as i128) * 2,
+            b"\x1d\x09\x01\xff\xff\xff\xff\xff\xff\xff\xfe",
+        );
+        test_serde(-4294967295i64, b"\x10\x00\x00\x00\x00");
+        test_serde(i64::MIN + 2, b"\x0C\x80\x00\x00\x00\x00\x00\x00\x01");
+        test_serde(i64::MIN + 1, b"\x0C\x80\x00\x00\x00\x00\x00\x00\x00");
+        test_serde(i64::MIN, b"\x0C\x7f\xff\xff\xff\xff\xff\xff\xff");
+
+        test_serde(9252427359321063944i128, b"\x1c\x80g9\xa9np\x02\x08");
+        assert!(matches!(
+            unpack::<i64>(b"\x1c\x80g9\xa9np\x02\x08").unwrap_err(),
+            PackError::UnsupportedIntLength
+        ));
+
+        test_serde(
+            -9252427359321063944i128,
+            b"\x0c\x7f\x98\xc6V\x91\x8f\xfd\xf7",
+        );
+        assert!(matches!(
+            unpack::<i64>(b"\x0c\x7f\x98\xc6V\x91\x8f\xfd\xf7").unwrap_err(),
+            PackError::UnsupportedIntLength
+        ));
+
+        test_serde(u64::MAX as i128, b"\x1c\xff\xff\xff\xff\xff\xff\xff\xff");
+        assert!(matches!(
+            unpack::<i64>(b"\x1c\xff\xff\xff\xff\xff\xff\xff\xff").unwrap_err(),
+            PackError::UnsupportedIntLength
+        ));
+
+        test_serde(-(u64::MAX as i128), b"\x0c\x00\x00\x00\x00\x00\x00\x00\x00");
+        assert!(matches!(
+            unpack::<i64>(b"\x0c\x00\x00\x00\x00\x00\x00\x00\x00").unwrap_err(),
+            PackError::UnsupportedIntLength
+        ));
+
+        test_serde(
+            (i64::MAX as i128) + 1,
+            b"\x1c\x80\x00\x00\x00\x00\x00\x00\x00",
+        );
+        assert!(matches!(
+            unpack::<i64>(b"\x1c\x80\x00\x00\x00\x00\x00\x00\x00").unwrap_err(),
+            PackError::UnsupportedIntLength
+        ));
+
+        test_serde(
+            (i64::MIN as i128) - 1,
+            b"\x0c\x7f\xff\xff\xff\xff\xff\xff\xfe",
+        );
+        assert!(matches!(
+            unpack::<i64>(b"\x0c\x7f\xff\xff\xff\xff\xff\xff\xfe").unwrap_err(),
+            PackError::UnsupportedIntLength
+        ));
+    }
+
+    #[test]
+    fn test_typecode_band_ordering() {
+        // Order-preserving keys rely on packed tuples comparing byte-lexicographically
+        // (Rust's `Vec<u8>` ordering). This mirrors a subspace-prefix scheme where the
+        // prefix is a u32 discriminant, with a negative "header" band strictly before it
+        // and an f32 band strictly after it. The typecode band, not the value, decides:
+        //   negatives (0x0c..=0x13)  <  u32 (0x14..=0x18)  <  f32 (0x20 ...)
+        let hex = |b: &[u8]| {
+            b.iter()
+                .map(|x| format!("{x:02x}"))
+                .collect::<Vec<_>>()
+                .join(" ")
+        };
+
+        // "before" band: signed ints, min and max of the range we might use.
+        let neg_min = pack(&i64::MIN); // 0c 7f ff ff ff ff ff ff ff (most negative)
+        let neg_max = pack(&-1i64); //    13 fe                      (closest to u32 band)
+
+        // middle band: the u32 subspace prefix, min and max discriminant.
+        let u32_min = pack(&0u32); //     14                         (INTZERO)
+        let u32_max = pack(&u32::MAX); //  18 ff ff ff ff            (4-byte positive int)
+
+        // "after" band: f32 markers >= 1.0, min and max of the range we might use.
+        let f_min = pack(&1.0f32); //     20 bf 80 00 00             (closest to u32 band)
+        let f_max = pack(&f32::MAX); //    20 ff 7f ff ff
+
+        println!("i64::MIN = {}", hex(&neg_min));
+        println!("-1i64    = {}", hex(&neg_max));
+        println!("0u32     = {}", hex(&u32_min));
+        println!("u32::MAX = {}", hex(&u32_max));
+        println!("1.0f32   = {}", hex(&f_min));
+        println!("f32::MAX = {}", hex(&f_max));
+
+        // Within each band numeric order is preserved (nothing weird inside a band).
+        assert!(neg_min < neg_max); // 0c ..    < 13 fe
+        assert!(u32_min < u32_max); // 14       < 18 ..
+        assert!(f_min < f_max); //     20 bf .. < 20 ff ..
+
+        // Whole "before" band sorts under the u32 band; tightest pair is -1 vs 0.
+        assert!(neg_max < u32_min); // 13 fe < 14
+        assert!(neg_min < u32_min); // 0c .. < 14 (even the most negative stays below)
+
+        // Whole "after" band sorts over the u32 band; tightest pair is u32::MAX vs 1.0.
+        assert!(u32_max < f_min); //   18 ff ff ff ff < 20 bf 80 00 00
+        assert!(u32_max < f_max); //   18 ..          < 20 ff .. (magnitude irrelevant)
+    }
+
+    #[cfg(feature = "num-bigint")]
+    #[test]
+    fn test_bigint() {
+        use num_bigint::{BigInt, BigUint};
+        // int
+        test_serde(BigInt::from(0i64), &[INTZERO]);
+        test_serde(BigUint::from(0u64), &[INTZERO]);
+        test_serde(BigInt::from(1i64), &[0x15, 1]);
+        test_serde(BigUint::from(1u64), &[0x15, 1]);
+        test_serde(BigInt::from(-1i64), &[0x13, 254]);
+        test_serde(BigInt::from(100i64), &[0x15, 100]);
+        test_serde(BigUint::from(100u64), &[0x15, 100]);
+
+        test_serde(BigInt::from(10000i32), &[0x16, 39, 16]);
+        test_serde(BigUint::from(10000u32), &[0x16, 39, 16]);
+        test_serde(BigInt::from(-100i16), &[19, 155]);
+        test_serde(BigInt::from(-10000i64), &[18, 216, 239]);
+        test_serde(BigInt::from(-1000000i64), &[17, 240, 189, 191]);
+
+        // boundary condition
+        test_serde(BigInt::from(255u16), &[0x15, 255]);
+        test_serde(BigUint::from(255u16), &[0x15, 255]);
+        test_serde(BigInt::from(256i32), &[0x16, 1, 0]);
+        test_serde(BigInt::from(-255i16), &[0x13, 0]);
+        test_serde(BigInt::from(-256i64), &[0x12, 254, 255]);
+
+        test_serde(BigInt::from(0), b"\x14");
+        test_serde(BigUint::from(0u64), b"\x14");
+        test_serde(BigInt::from(1), b"\x15\x01");
+        test_serde(BigUint::from(1u64), b"\x15\x01");
+        test_serde(BigInt::from(-1), b"\x13\xfe");
+        test_serde(BigInt::from(255), b"\x15\xff");
+        test_serde(BigUint::from(255u64), b"\x15\xff");
+        test_serde(BigInt::from(-255), b"\x13\x00");
+        test_serde(BigInt::from(256), b"\x16\x01\x00");
+        test_serde(BigUint::from(256u64), b"\x16\x01\x00");
+        test_serde(BigInt::from(-256), b"\x12\xfe\xff");
+        test_serde(BigInt::from(65536), b"\x17\x01\x00\x00");
+        test_serde(BigUint::from(65536u64), b"\x17\x01\x00\x00");
+        test_serde(BigInt::from(-65536), b"\x11\xfe\xff\xff");
+        test_serde(
+            BigInt::from(i64::MAX),
+            b"\x1C\x7f\xff\xff\xff\xff\xff\xff\xff",
+        );
+        test_serde(
+            BigUint::from(i64::MAX as u64),
+            b"\x1C\x7f\xff\xff\xff\xff\xff\xff\xff",
+        );
+        test_serde(
+            BigInt::from(i64::MAX as u64 + 1),
+            b"\x1C\x80\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            BigUint::from(i64::MAX as u64 + 1),
+            b"\x1C\x80\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            BigInt::from(u64::MAX),
+            b"\x1C\xff\xff\xff\xff\xff\xff\xff\xff",
+        );
+        test_serde(
+            BigUint::from(u64::MAX),
+            b"\x1C\xff\xff\xff\xff\xff\xff\xff\xff",
+        );
+        test_serde(
+            BigInt::from(u128::MAX),
+            b"\x1D\x10\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff",
+        );
+        test_serde(
+            BigUint::from(u128::MAX),
+            b"\x1D\x10\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff",
+        );
+        test_serde(
+            BigInt::from(u64::MAX as u128 + 1),
+            b"\x1D\x09\x01\x00\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            BigUint::from(u64::MAX as u128 + 1),
+            b"\x1D\x09\x01\x00\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            BigInt::from(u64::MAX as i128 + 1),
+            b"\x1D\x09\x01\x00\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            BigUint::from(u64::MAX as u128 + 1),
+            b"\x1D\x09\x01\x00\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            BigInt::from(i64::MIN as i128 + 1),
+            b"\x0C\x80\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            BigInt::from(i64::MIN as i128 - 1),
+            b"\x0C\x7f\xff\xff\xff\xff\xff\xff\xfe",
+        );
+        test_serde(
+            BigInt::from(-(u64::MAX as i128)),
+            b"\x0C\x00\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            BigInt::from(-(u64::MAX as i128) - 1),
+            b"\x0b\xf6\xfe\xff\xff\xff\xff\xff\xff\xff\xff",
+        );
+        test_serde(
+            BigInt::from(-(u64::MAX as i128) - 2),
+            b"\x0b\xf6\xfe\xff\xff\xff\xff\xff\xff\xff\xfe",
+        );
+        test_serde(
+            BigInt::from((u64::MAX as i128) * -2),
+            b"\x0b\xf6\xfe\x00\x00\x00\x00\x00\x00\x00\x01",
+        );
+        test_serde(
+            BigInt::from((u64::MAX as i128) * 2),
+            b"\x1d\x09\x01\xff\xff\xff\xff\xff\xff\xff\xfe",
+        );
+        test_serde(BigInt::from(-4294967295i64), b"\x10\x00\x00\x00\x00");
+        test_serde(
+            BigInt::from(i64::MIN + 2),
+            b"\x0C\x80\x00\x00\x00\x00\x00\x00\x01",
+        );
+        test_serde(
+            BigInt::from(i64::MIN + 1),
+            b"\x0C\x80\x00\x00\x00\x00\x00\x00\x00",
+        );
+        test_serde(
+            BigInt::from(i64::MIN),
+            b"\x0C\x7f\xff\xff\xff\xff\xff\xff\xff",
+        );
+
+        test_serde(
+            Element::BigInt(9252427359321063944i128.into()),
+            b"\x1c\x80g9\xa9np\x02\x08",
+        );
+        test_serde(
+            Element::BigInt((-9252427359321063944i128).into()),
+            b"\x0c\x7f\x98\xc6V\x91\x8f\xfd\xf7",
+        );
+    }
+
+    #[cfg(feature = "uuid")]
+    #[test]
+    fn test_uuid() {
+        use uuid::Uuid;
+
+        test_serde(
+            Element::Uuid(
+                Uuid::from_slice(
+                    b"\xba\xff\xff\xff\xff\x5e\xba\x11\x00\x00\x00\x00\x5c\xa1\xab\x1e",
+                )
+                .unwrap(),
+            ),
+            b"\x30\xba\xff\xff\xff\xff\x5e\xba\x11\x00\x00\x00\x00\x5c\xa1\xab\x1e",
+        );
+    }
+
+    #[test]
+    fn test_bindingtester() {
+        test_serde("NEW_TRANSACTION".to_string(), b"\x02NEW_TRANSACTION\x00");
+        test_serde(
+            vec!["NEW_TRANSACTION".to_string()],
+            b"\x02NEW_TRANSACTION\x00",
+        );
+        test_serde(
+            vec![
+                Element::String(Cow::Borrowed("PUSH")),
+                Element::Bytes(Bytes::from(
+                    b"\x01tester_output\x00\x01results\x00\x14".as_ref(),
+                )),
+            ],
+            b"\x02PUSH\x00\x01\x01tester_output\x00\xff\x01results\x00\xff\x14\x00",
+        );
+        test_serde(
+            vec![Element::String(Cow::Borrowed("PUSH")), Element::Nil],
+            b"\x02PUSH\x00\x00",
+        );
+        test_serde(
+            vec![
+                Element::String(Cow::Borrowed("PUSH")),
+                Element::Tuple(vec![
+                    Element::Nil,
+                    Element::Float(3299069000000.0),
+                    Element::Float(-0.000000000000000000000000000000000000011883096),
+                ]),
+            ],
+            b"\x02PUSH\x00\x05\x00\xff \xd4@\x07\xf5 \x7f~\x9a\xc2\x00",
+        );
+        test_serde(
+            vec![
+                Element::String(Cow::Borrowed("PUSH")),
+                Element::Int(-133525682914243904),
+            ],
+            b"\x02PUSH\x00\x0c\xfe%\x9f\x19M\x81J\xbf",
+        );
+
+        test_serde(
+            Element::Tuple(vec![Element::Nil, Element::Nil]),
+            b"\x00\x00",
+        );
+        test_serde(
+            Element::Tuple(vec![
+                Element::String(Cow::Borrowed("PUSH")),
+                Element::Tuple(vec![Element::Double(-8.251343508909708e-15)]),
+            ]),
+            b"\x02PUSH\x00\x05!B\xfdkl\x9f\xcc\x8eK\x00",
+        );
+    }
+
+    #[test]
+    fn test_element() {
+        test_serde(Element::Bool(true), &[TRUE]);
+        test_serde(Element::Bool(false), &[FALSE]);
+        test_serde(Element::Int(-1), &[0x13, 254]);
+        test_serde(
+            Element::Versionstamp(Versionstamp::complete(
+                *b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a",
+                657,
+            )),
+            b"\x33\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x02\x91",
+        );
+        test_serde(
+            (Element::Versionstamp(Versionstamp::complete(
+                *b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a",
+                657,
+            )),),
+            b"\x33\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x02\x91",
+        );
+        test_serde(
+            (Element::Versionstamp(Versionstamp::complete(
+                *b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a",
+                657,
+            )),),
+            b"\x33\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x02\x91",
+        );
+        test_serde(
+            vec![Element::Bool(true), Element::Bool(false)],
+            &[TRUE, FALSE],
+        );
+        test_serde(
+            vec![Element::Tuple(vec![
+                Element::Bool(true),
+                Element::Bool(false),
+            ])],
+            &[NESTED, TRUE, FALSE, NIL],
+        );
+        test_serde(Vec::<Element>::new(), &[]);
+        test_serde(Element::Tuple(vec![]), &[]);
+    }
+
+    #[test]
+    fn test_verstionstamp() {
+        assert_eq!(
+            Bytes::from(pack(&("foo", Versionstamp::incomplete(0)))),
+            Bytes::from(&b"\x02foo\x00\x33\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00"[..])
+        );
+        assert_eq!(
+            Bytes::from(pack_with_versionstamp(&(
+                "foo",
+                Versionstamp::incomplete(0)
+            ))),
+            Bytes::from(
+                &b"\x02foo\x00\x33\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x06\x00\x00\x00"
+                    [..]
+            )
+        );
+    }
+}
diff --git a/bindings/rust/foundationdb-tuple/src/pack.rs b/bindings/rust/foundationdb-tuple/src/pack.rs
new file mode 100644
index 00000000000..32030a61dc6
--- /dev/null
+++ b/bindings/rust/foundationdb-tuple/src/pack.rs
@@ -0,0 +1,1106 @@
+use super::*;
+use memchr::memchr_iter;
+use std::convert::TryFrom;
+use std::io;
+use std::mem;
+
+#[derive(Debug, Copy, Clone, Ord, PartialOrd, Eq, PartialEq, Hash)]
+pub enum VersionstampOffset {
+    None { size: u32 },
+    OneIncomplete { offset: u32 },
+    MultipleIncomplete,
+}
+impl std::ops::AddAssign<u32> for VersionstampOffset {
+    fn add_assign(&mut self, r: u32) {
+        if let VersionstampOffset::None { size } = self {
+            *size += r;
+        }
+    }
+}
+impl std::ops::AddAssign for VersionstampOffset {
+    fn add_assign(&mut self, rhs: Self) {
+        match (&mut *self, rhs) {
+            (VersionstampOffset::None { size }, VersionstampOffset::None { size: r }) => {
+                *size += r;
+            }
+            (VersionstampOffset::None { size }, VersionstampOffset::OneIncomplete { offset }) => {
+                *self = VersionstampOffset::OneIncomplete {
+                    offset: *size + offset,
+                };
+            }
+            (
+                VersionstampOffset::OneIncomplete { .. },
+                VersionstampOffset::OneIncomplete { .. },
+            )
+            | (VersionstampOffset::None { .. }, VersionstampOffset::MultipleIncomplete)
+            | (VersionstampOffset::OneIncomplete { .. }, VersionstampOffset::MultipleIncomplete) => {
+                *self = VersionstampOffset::MultipleIncomplete;
+            }
+            _ => {}
+        }
+    }
+}
+
+const PACK_ERR_MSG: &str = "pack io error on Vec, data size didn't fit in `u32`?";
+
+/// A type that can be packed
+pub trait TuplePack {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset>;
+
+    fn pack_root<W: io::Write>(&self, w: &mut W) -> io::Result<VersionstampOffset> {
+        self.pack(w, TupleDepth::new())
+    }
+
+    /// Pack value and returns the packed buffer
+    ///
+    /// # Panics
+    ///
+    /// Panics if the encoded data size doesn't fit in `u32`.
+    fn pack_to_vec(&self) -> Vec<u8> {
+        let mut vec = Vec::new();
+        self.pack_into_vec(&mut vec);
+        vec
+    }
+
+    /// Pack value and returns the packed buffer
+    ///
+    /// # Panics
+    ///
+    /// Panics if there is multiple versionstamp present or if the encoded data size doesn't fit in `u32`.
+    fn pack_to_vec_with_versionstamp(&self) -> Vec<u8> {
+        let mut vec = Vec::new();
+        let offset = self.pack_into_vec_with_versionstamp(&mut vec);
+        if let VersionstampOffset::MultipleIncomplete = offset {
+            panic!("pack_to_vec_with_versionstamp does not allow multiple versionstamps");
+        }
+        vec
+    }
+
+    /// Pack value into the given buffer
+    ///
+    /// # Panics
+    ///
+    /// Panics if the encoded data size doesn't fit in `u32`.
+    fn pack_into_vec(&self, output: &mut Vec<u8>) -> VersionstampOffset {
+        self.pack_root(output).expect(PACK_ERR_MSG)
+    }
+
+    /// Pack value into the given buffer
+    ///
+    /// # Panics
+    ///
+    /// Panics if the encoded data size doesn't fit in `u32`.
+    fn pack_into_vec_with_versionstamp(&self, output: &mut Vec<u8>) -> VersionstampOffset {
+        let mut offset = VersionstampOffset::None {
+            size: u32::try_from(output.len()).expect(PACK_ERR_MSG),
+        };
+        offset += self.pack_root(output).expect(PACK_ERR_MSG);
+        if let VersionstampOffset::OneIncomplete { offset } = offset {
+            output.extend_from_slice(&offset.to_le_bytes());
+        }
+        offset
+    }
+}
+
+/// A type that can be unpacked
+pub trait TupleUnpack<'de>: Sized {
+    fn unpack(input: &'de [u8], tuple_depth: TupleDepth) -> PackResult<(&'de [u8], Self)>;
+
+    fn unpack_root(input: &'de [u8]) -> PackResult<Self> {
+        let (input, this) = Self::unpack(input, TupleDepth::new())?;
+        if !input.is_empty() {
+            return Err(PackError::TrailingBytes);
+        }
+        Ok(this)
+    }
+}
+
+impl<T> TuplePack for &T
+where
+    T: TuplePack,
+{
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        (*self).pack(w, tuple_depth)
+    }
+}
+
+#[inline]
+fn parse_bytes(input: &[u8], num: usize) -> PackResult<(&[u8], &[u8])> {
+    if input.len() < num {
+        Err(PackError::MissingBytes)
+    } else {
+        Ok((&input[num..], &input[..num]))
+    }
+}
+
+#[inline]
+fn parse_byte(input: &[u8]) -> PackResult<(&[u8], u8)> {
+    if input.is_empty() {
+        Err(PackError::MissingBytes)
+    } else {
+        Ok((&input[1..], input[0]))
+    }
+}
+
+fn parse_code(input: &[u8], expected: u8) -> PackResult<&[u8]> {
+    let (input, found) = parse_byte(input)?;
+    if found == expected {
+        Ok(input)
+    } else {
+        Err(PackError::BadCode {
+            found,
+            expected: Some(expected),
+        })
+    }
+}
+
+fn write_bytes<W: io::Write>(w: &mut W, v: &[u8]) -> io::Result<VersionstampOffset> {
+    let mut size =
+        u32::try_from(v.len()).map_err(|err| io::Error::new(io::ErrorKind::InvalidData, err))?;
+    let mut pos = 0;
+    for idx in memchr_iter(NIL, v) {
+        let next_idx = idx + 1;
+        size += 1;
+        w.write_all(&v[pos..next_idx])?;
+        w.write_all(&[ESCAPE])?;
+        pos = next_idx;
+    }
+    w.write_all(&v[pos..])?;
+    w.write_all(&[NIL])?;
+    size += 2;
+    Ok(VersionstampOffset::None { size })
+}
+
+fn parse_slice(input: &[u8]) -> PackResult<(&[u8], Cow<'_, [u8]>)> {
+    let mut bytes = Vec::new();
+    let mut pos = 0;
+    for idx in memchr_iter(NIL, input) {
+        let next_idx = idx + 1;
+        if input.get(next_idx) == Some(&ESCAPE) {
+            bytes.extend_from_slice(&input[pos..next_idx]);
+            pos = next_idx + 1;
+        } else {
+            let slice = &input[pos..idx];
+            return Ok((
+                &input[next_idx..],
+                (if pos == 0 {
+                    Cow::Borrowed(slice)
+                } else {
+                    bytes.extend_from_slice(slice);
+                    Cow::Owned(bytes)
+                }),
+            ));
+        }
+    }
+    Err(PackError::MissingBytes)
+}
+
+fn parse_string(input: &[u8]) -> PackResult<(&[u8], Cow<'_, str>)> {
+    let (input, slice) = parse_slice(input)?;
+    Ok((
+        input,
+        match slice {
+            Cow::Borrowed(slice) => {
+                Cow::Borrowed(std::str::from_utf8(slice).map_err(|_| PackError::BadStringFormat)?)
+            }
+            Cow::Owned(vec) => {
+                Cow::Owned(String::from_utf8(vec).map_err(|_| PackError::BadStringFormat)?)
+            }
+        },
+    ))
+}
+
+impl TuplePack for () {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        if tuple_depth.depth() > 0 {
+            w.write_all(&[NESTED, NIL])?;
+            Ok(VersionstampOffset::None { size: 2 })
+        } else {
+            Ok(VersionstampOffset::None { size: 0 })
+        }
+    }
+}
+
+impl TupleUnpack<'_> for () {
+    fn unpack(mut input: &[u8], tuple_depth: TupleDepth) -> PackResult<(&[u8], Self)> {
+        if tuple_depth.depth() > 0 {
+            input = parse_code(input, NESTED)?;
+            input = parse_code(input, NIL)?;
+        }
+        Ok((input, ()))
+    }
+}
+
+macro_rules! tuple_impls {
+    ($(($($n:tt $name:ident $v:ident)+))+) => {
+        $(
+            impl<$($name),+> TuplePack for ($($name,)+)
+            where
+                $($name: TuplePack,)+
+            {
+                fn pack<W: io::Write>(&self, w: &mut W, tuple_depth: TupleDepth) -> io::Result<VersionstampOffset> {
+                    let mut offset = VersionstampOffset::None { size: 0 };
+                    if tuple_depth.depth() > 0 {
+                        w.write_all(&[NESTED])?;
+                        offset += 1;
+                    }
+
+                    $(
+                        offset += self.$n.pack(w, tuple_depth.increment())?;
+                    )*
+
+                    if tuple_depth.depth() > 0 {
+                        w.write_all(&[NIL])?;
+                        offset += 1;
+                    }
+                    Ok(offset)
+                }
+            }
+
+            impl<'de, $($name),+> TupleUnpack<'de> for ($($name,)+)
+            where
+                $($name: TupleUnpack<'de>,)+
+            {
+                fn unpack(input: &'de [u8], tuple_depth: TupleDepth) -> PackResult<(&'de [u8], Self)> {
+                    let input = if tuple_depth.depth() > 0 { parse_code(input, NESTED)? } else { input };
+
+                    $(
+                        let (input, $v) = $name::unpack(input, tuple_depth.increment())?;
+                    )*
+
+                    let input = if tuple_depth.depth() > 0 { parse_code(input, NIL)? } else { input };
+
+                    let tuple = ( $($v,)* );
+                    Ok((input, tuple))
+                }
+            }
+        )+
+    }
+}
+
+tuple_impls! {
+    (0 T0 t0)
+    (0 T0 t0 1 T1 t1)
+    (0 T0 t0 1 T1 t1 2 T2 t2)
+    (0 T0 t0 1 T1 t1 2 T2 t2 3 T3 t3)
+    (0 T0 t0 1 T1 t1 2 T2 t2 3 T3 t3 4 T4 t4)
+    (0 T0 t0 1 T1 t1 2 T2 t2 3 T3 t3 4 T4 t4 5 T5 t5)
+    (0 T0 t0 1 T1 t1 2 T2 t2 3 T3 t3 4 T4 t4 5 T5 t5 6 T6 t6)
+    (0 T0 t0 1 T1 t1 2 T2 t2 3 T3 t3 4 T4 t4 5 T5 t5 6 T6 t6 7 T7 t7)
+    (0 T0 t0 1 T1 t1 2 T2 t2 3 T3 t3 4 T4 t4 5 T5 t5 6 T6 t6 7 T7 t7 8 T8 t8)
+    (0 T0 t0 1 T1 t1 2 T2 t2 3 T3 t3 4 T4 t4 5 T5 t5 6 T6 t6 7 T7 t7 8 T8 t8 9 T9 t9)
+    (0 T0 t0 1 T1 t1 2 T2 t2 3 T3 t3 4 T4 t4 5 T5 t5 6 T6 t6 7 T7 t7 8 T8 t8 9 T9 t9 10 T10 t10)
+    (0 T0 t0 1 T1 t1 2 T2 t2 3 T3 t3 4 T4 t4 5 T5 t5 6 T6 t6 7 T7 t7 8 T8 t8 9 T9 t9 10 T10 t10 11 T11 t11)
+}
+
+const MAX_SZ: usize = 8;
+
+macro_rules! sign_bit {
+    ($type:ident) => {
+        (1 << (mem::size_of::<$type>() * 8 - 1))
+    };
+}
+
+macro_rules! unpack_ux {
+    ($ux: ident, $input: expr_2021, $n: expr_2021) => {{
+        let (input, bytes) = parse_bytes($input, $n)?;
+        let mut arr = [0u8; ::std::mem::size_of::<$ux>()];
+        (&mut arr[(::std::mem::size_of::<$ux>() - $n)..]).copy_from_slice(bytes);
+        (input, $ux::from_be_bytes(arr))
+    }};
+}
+
+macro_rules! unpack_px {
+    ($ix: ident, $ux: ident, $input: expr_2021, $n: expr_2021) => {{
+        let (input, bytes) = parse_bytes($input, $n)?;
+        let mut arr = [0u8; ::std::mem::size_of::<$ux>()];
+        (&mut arr[(::std::mem::size_of::<$ux>() - $n)..]).copy_from_slice(bytes);
+        let x = $ix::from_be_bytes(arr);
+        if x < 0 {
+            Err(PackError::UnsupportedIntLength)
+        } else {
+            Ok((input, x))
+        }
+    }};
+}
+macro_rules! unpack_nx {
+    ($ix: ident, $ux: ident, $input: expr_2021, $n: expr_2021) => {{
+        let (input, bytes) = parse_bytes($input, $n)?;
+        let mut arr = [0xffu8; ::std::mem::size_of::<$ix>()];
+        (&mut arr[(::std::mem::size_of::<$ix>() - $n)..]).copy_from_slice(bytes);
+        let x = $ix::from_be_bytes(arr).wrapping_add(1);
+        if x > 0 {
+            Err(PackError::UnsupportedIntLength)
+        } else {
+            Ok((input, x))
+        }
+    }};
+}
+
+macro_rules! impl_ux {
+    ($ux: ident) => {
+        impl_ux!($ux, mem::size_of::<$ux>());
+    };
+    ($ux: ident, $max_sz:expr_2021) => {
+        impl TuplePack for $ux {
+            fn pack<W: io::Write>(
+                &self,
+                w: &mut W,
+                _tuple_depth: TupleDepth,
+            ) -> io::Result<VersionstampOffset> {
+                const SZ: usize = mem::size_of::<$ux>();
+                let u = *self;
+                let n = SZ - (u.leading_zeros() as usize) / 8;
+                let mut offset = VersionstampOffset::None { size: n as u32 + 1 };
+                if SZ <= MAX_SZ || n <= MAX_SZ {
+                    w.write_all(&[INTZERO + n as u8])?;
+                } else {
+                    w.write_all(&[POSINTEND, n as u8])?;
+                    offset += 1;
+                };
+                w.write_all(&u.to_be_bytes()[SZ - n..])?;
+
+                Ok(offset)
+            }
+        }
+
+        impl<'de> TupleUnpack<'de> for $ux {
+            fn unpack(input: &[u8], _tuple_depth: TupleDepth) -> PackResult<(&[u8], Self)> {
+                const SZ: usize = mem::size_of::<$ux>();
+                let (input, found) = parse_byte(input)?;
+                if INTZERO <= found && found <= INTZERO + $max_sz as u8 {
+                    let n = (found - INTZERO) as usize;
+                    Ok(unpack_ux!($ux, input, n))
+                } else if found == POSINTEND {
+                    let (input, raw_length) = parse_byte(input)?;
+                    let n: usize = usize::from(raw_length);
+                    if n > SZ {
+                        return Err(PackError::UnsupportedIntLength);
+                    }
+                    Ok(unpack_ux!($ux, input, n))
+                } else {
+                    Err(PackError::BadCode {
+                        found,
+                        expected: None,
+                    })
+                }
+            }
+        }
+    };
+}
+
+macro_rules! impl_ix {
+    ($ix: ident, $ux: ident) => {
+        impl_ix!($ix, $ux, mem::size_of::<$ix>());
+    };
+    ($ix: ident, $ux: ident, $max_sz:expr_2021) => {
+        impl TuplePack for $ix {
+            fn pack<W: io::Write>(
+                &self,
+                w: &mut W,
+                _tuple_depth: TupleDepth,
+            ) -> io::Result<VersionstampOffset> {
+                const SZ: usize = mem::size_of::<$ix>();
+                let i = *self;
+                let u = self.wrapping_abs() as $ux;
+                let n = SZ - (u.leading_zeros() as usize) / 8;
+                let mut offset = VersionstampOffset::None { size: n as u32 + 1 };
+                let arr = if i >= 0 {
+                    if SZ <= MAX_SZ || n <= MAX_SZ {
+                        w.write_all(&[INTZERO + n as u8])?;
+                    } else {
+                        w.write_all(&[POSINTEND, n as u8])?;
+                        offset += 1;
+                    }
+                    (u.to_be_bytes())
+                } else {
+                    if SZ <= MAX_SZ || n <= MAX_SZ {
+                        w.write_all(&[INTZERO - n as u8])?;
+                    } else {
+                        w.write_all(&[NEGINTSTART, n as u8 ^ 0xff])?;
+                        offset += 1;
+                    }
+                    (i.wrapping_sub(1).to_be_bytes())
+                };
+                w.write_all(&arr[SZ - n..])?;
+
+                Ok(offset)
+            }
+        }
+
+        impl<'de> TupleUnpack<'de> for $ix {
+            fn unpack(input: &[u8], _tuple_depth: TupleDepth) -> PackResult<(&[u8], Self)> {
+                const SZ: usize = mem::size_of::<$ix>();
+                let (input, found) = parse_byte(input)?;
+                if INTZERO <= found && found <= INTZERO + $max_sz as u8 {
+                    let n = (found - INTZERO) as usize;
+                    unpack_px!($ix, $ux, input, n)
+                } else if INTZERO - $max_sz as u8 <= found && found < INTZERO {
+                    let n = (INTZERO - found) as usize;
+                    unpack_nx!($ix, $ux, input, n)
+                } else if found == NEGINTSTART {
+                    let (input, raw_length) = parse_byte(input)?;
+                    let n = usize::from(raw_length ^ 0xff);
+                    if n > SZ {
+                        return Err(PackError::UnsupportedIntLength);
+                    }
+                    unpack_nx!($ix, $ux, input, n)
+                } else if found == POSINTEND {
+                    let (input, raw_length) = parse_byte(input)?;
+                    let n: usize = usize::from(raw_length);
+                    if n > SZ {
+                        return Err(PackError::UnsupportedIntLength);
+                    }
+                    unpack_px!($ix, $ux, input, n)
+                } else {
+                    Err(PackError::BadCode {
+                        found,
+                        expected: None,
+                    })
+                }
+            }
+        }
+    };
+}
+
+macro_rules! impl_fx {
+    ( $fx: ident, $fx_to_ux_be_bytes: ident, $ux_width: tt, $parse_ux: ident, $ux: ident, $code: ident) => {
+        #[inline]
+        pub(super) fn $fx_to_ux_be_bytes(f: $fx) -> [u8; $ux_width] {
+            let u = if f.is_sign_negative() {
+                f.to_bits() ^ $ux::MAX
+            } else {
+                f.to_bits() ^ sign_bit!($ux)
+            };
+            u.to_be_bytes()
+        }
+        impl TuplePack for $fx {
+            fn pack<W: io::Write>(
+                &self,
+                w: &mut W,
+                _tuple_depth: TupleDepth,
+            ) -> io::Result<VersionstampOffset> {
+                let bytes = $fx_to_ux_be_bytes(*self);
+                w.write_all(&[$code])?;
+                w.write_all(&bytes)?;
+                Ok(VersionstampOffset::None {
+                    size: std::mem::size_of::<$fx>() as u32 + 1,
+                })
+            }
+        }
+
+        fn $parse_ux(input: &[u8]) -> PackResult<(&[u8], $ux)> {
+            let (input, bytes) = parse_bytes(input, mem::size_of::<$ux>())?;
+            let mut arr = [0u8; mem::size_of::<$ux>()];
+            arr.copy_from_slice(bytes);
+            Ok((input, $ux::from_be_bytes(arr)))
+        }
+        impl<'de> TupleUnpack<'de> for $fx {
+            fn unpack(input: &[u8], _tuple_depth: TupleDepth) -> PackResult<(&[u8], Self)> {
+                let input = parse_code(input, $code)?;
+                let (input, u) = $parse_ux(input)?;
+                Ok((
+                    input,
+                    $fx::from_bits(if (u & sign_bit!($ux)) == 0 {
+                        u ^ $ux::MAX
+                    } else {
+                        u ^ sign_bit!($ux)
+                    }),
+                ))
+            }
+        }
+    };
+}
+
+//impl_ux!(u8);
+impl_ux!(u16);
+impl_ux!(u32);
+impl_ux!(u64);
+impl_ux!(u128, MAX_SZ);
+impl_ux!(usize);
+
+//impl_ix!(i8, u8);
+impl_ix!(i16, u16);
+impl_ix!(i32, u32);
+impl_ix!(i64, u64);
+impl_ix!(i128, u128, MAX_SZ);
+impl_ix!(isize, usize);
+
+impl_fx!(f32, f32_to_u32_be_bytes, 4, parse_u32, u32, FLOAT);
+impl_fx!(f64, f64_to_u64_be_bytes, 8, parse_u64, u64, DOUBLE);
+
+#[cfg(feature = "num-bigint")]
+mod bigint {
+    use super::*;
+    use num_bigint::{BigInt, BigUint, Sign};
+    use std::convert::TryFrom;
+
+    fn invert(bytes: &mut [u8]) {
+        // The ones' complement of a binary number is defined as the value
+        // obtained by inverting all the bits in the binary representation
+        // of the number (swapping 0s for 1s and vice versa).
+        for byte in bytes.iter_mut() {
+            *byte = !*byte;
+        }
+    }
+
+    fn inverted(bytes: &[u8]) -> Vec<u8> {
+        // The ones' complement of a binary number is defined as the value
+        // obtained by inverting all the bits in the binary representation
+        // of the number (swapping 0s for 1s and vice versa).
+        bytes.iter().map(|byte| !*byte).collect()
+    }
+
+    fn bigint_n(n: usize) -> io::Result<u8> {
+        u8::try_from(n).map_err(|_| {
+            std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "BigUint requires more than 255 bytes to be represented",
+            )
+        })
+    }
+
+    impl TuplePack for BigInt {
+        fn pack<W: io::Write>(
+            &self,
+            w: &mut W,
+            _tuple_depth: TupleDepth,
+        ) -> io::Result<VersionstampOffset> {
+            if self.sign() == Sign::NoSign {
+                w.write_all(&[INTZERO])?;
+                return Ok(VersionstampOffset::None { size: 1 });
+            }
+            let (sign, mut bytes) = self.to_bytes_be();
+            let n = bytes.len();
+            let mut offset = VersionstampOffset::None { size: n as u32 + 1 };
+            match sign {
+                Sign::Minus => {
+                    if n <= MAX_SZ {
+                        w.write_all(&[INTZERO - n as u8])?;
+                    } else {
+                        w.write_all(&[NEGINTSTART, bigint_n(n)? ^ 0xff])?;
+                        offset += 1;
+                    }
+                    invert(&mut bytes);
+                    w.write_all(&bytes)?;
+                }
+                Sign::NoSign => unreachable!(),
+                Sign::Plus => {
+                    if n <= MAX_SZ {
+                        w.write_all(&[INTZERO + n as u8])?;
+                    } else {
+                        w.write_all(&[POSINTEND, bigint_n(n)?])?;
+                        offset += 1;
+                    }
+                    w.write_all(&bytes)?;
+                }
+            }
+
+            Ok(offset)
+        }
+    }
+
+    impl TupleUnpack<'_> for BigInt {
+        fn unpack(input: &[u8], _tuple_depth: TupleDepth) -> PackResult<(&[u8], Self)> {
+            let (input, found) = parse_byte(input)?;
+            if INTZERO <= found && found <= INTZERO + MAX_SZ as u8 {
+                let n = (found - INTZERO) as usize;
+                let (input, bytes) = parse_bytes(input, n)?;
+                Ok((input, Self::from_bytes_be(Sign::Plus, bytes)))
+            } else if INTZERO - MAX_SZ as u8 <= found && found < INTZERO {
+                let n = (INTZERO - found) as usize;
+                let (input, bytes) = parse_bytes(input, n)?;
+                Ok((input, Self::from_bytes_be(Sign::Minus, &inverted(bytes))))
+            } else if found == NEGINTSTART {
+                let (input, raw_length) = parse_byte(input)?;
+                let n = usize::from(raw_length ^ 0xff);
+                let (input, bytes) = parse_bytes(input, n)?;
+                Ok((input, Self::from_bytes_be(Sign::Minus, &inverted(bytes))))
+            } else if found == POSINTEND {
+                let (input, raw_length) = parse_byte(input)?;
+                let n: usize = usize::from(raw_length);
+                let (input, bytes) = parse_bytes(input, n)?;
+                Ok((input, Self::from_bytes_be(Sign::Plus, bytes)))
+            } else {
+                Err(PackError::BadCode {
+                    found,
+                    expected: None,
+                })
+            }
+        }
+    }
+
+    impl TuplePack for BigUint {
+        fn pack<W: io::Write>(
+            &self,
+            w: &mut W,
+            _tuple_depth: TupleDepth,
+        ) -> io::Result<VersionstampOffset> {
+            let n = self.bits();
+            if n == 0 {
+                w.write_all(&[INTZERO])?;
+                return Ok(VersionstampOffset::None { size: 1 });
+            }
+            let bytes = self.to_bytes_be();
+            let n = bytes.len();
+            let mut offset = VersionstampOffset::None { size: n as u32 + 1 };
+            if n <= MAX_SZ {
+                w.write_all(&[INTZERO + n as u8])?;
+            } else {
+                w.write_all(&[POSINTEND, bigint_n(n)?])?;
+                offset += 1;
+            }
+            w.write_all(&bytes)?;
+
+            Ok(offset)
+        }
+    }
+
+    impl TupleUnpack<'_> for BigUint {
+        fn unpack(input: &[u8], _tuple_depth: TupleDepth) -> PackResult<(&[u8], Self)> {
+            let (input, found) = parse_byte(input)?;
+            if INTZERO <= found && found <= INTZERO + MAX_SZ as u8 {
+                let n = (found - INTZERO) as usize;
+                let (input, bytes) = parse_bytes(input, n)?;
+                Ok((input, Self::from_bytes_be(bytes)))
+            } else if found == POSINTEND {
+                let (input, raw_length) = parse_byte(input)?;
+                let n: usize = usize::from(raw_length);
+                let (input, bytes) = parse_bytes(input, n)?;
+                Ok((input, Self::from_bytes_be(bytes)))
+            } else {
+                Err(PackError::BadCode {
+                    found,
+                    expected: None,
+                })
+            }
+        }
+    }
+}
+
+impl TuplePack for bool {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        _tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        w.write_all(&[if *self { TRUE } else { FALSE }])?;
+        Ok(VersionstampOffset::None { size: 1 })
+    }
+}
+
+impl TupleUnpack<'_> for bool {
+    fn unpack(input: &[u8], _tuple_depth: TupleDepth) -> PackResult<(&[u8], Self)> {
+        let (input, v) = parse_byte(input)?;
+        match v {
+            FALSE => Ok((input, false)),
+            TRUE => Ok((input, true)),
+            _ => Err(PackError::Message(
+                format!("{v} is not a valid bool value").into_boxed_str(),
+            )),
+        }
+    }
+}
+
+impl<T> TuplePack for &[T]
+where
+    T: TuplePack,
+{
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        let mut offset = VersionstampOffset::None { size: 0 };
+
+        if tuple_depth.depth() > 0 {
+            w.write_all(&[NESTED])?;
+            offset += 1;
+        }
+
+        for v in self.iter() {
+            offset += v.pack(w, tuple_depth.increment())?;
+        }
+
+        if tuple_depth.depth() > 0 {
+            w.write_all(&[NIL])?;
+            offset += 1;
+        }
+        Ok(offset)
+    }
+}
+
+impl<T> TuplePack for Vec<T>
+where
+    T: TuplePack,
+{
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        self.as_slice().pack(w, tuple_depth)
+    }
+}
+
+fn is_end_of_tuple(input: &[u8], nested: bool) -> bool {
+    match input.first() {
+        None => true,
+        _ if !nested => false,
+        Some(&NIL) => Some(&ESCAPE) != input.get(1),
+        _ => false,
+    }
+}
+
+impl<'de, T> TupleUnpack<'de> for Vec<T>
+where
+    T: TupleUnpack<'de>,
+{
+    fn unpack(mut input: &'de [u8], tuple_depth: TupleDepth) -> PackResult<(&'de [u8], Self)> {
+        let nested = tuple_depth.depth() > 0;
+        if nested {
+            input = parse_code(input, NESTED)?;
+        }
+
+        let mut vec = Vec::new();
+
+        while !is_end_of_tuple(input, nested) {
+            let (rem, v) = T::unpack(input, tuple_depth.increment())?;
+            input = rem;
+            vec.push(v);
+        }
+
+        if nested {
+            input = parse_code(input, NIL)?;
+        }
+
+        Ok((input, vec))
+    }
+}
+
+impl TuplePack for Bytes<'_> {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        _tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        w.write_all(&[BYTES])?;
+        write_bytes(w, self.as_ref())
+    }
+}
+
+impl<'de> TupleUnpack<'de> for Bytes<'de> {
+    fn unpack(input: &'de [u8], _tuple_depth: TupleDepth) -> PackResult<(&'de [u8], Self)> {
+        let input = parse_code(input, BYTES)?;
+        let (input, v) = parse_slice(input)?;
+        Ok((input, Bytes(v)))
+    }
+}
+
+impl TuplePack for &[u8] {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        Bytes::from(*self).pack(w, tuple_depth)
+    }
+}
+
+impl TuplePack for Vec<u8> {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        Bytes::from(self.as_slice()).pack(w, tuple_depth)
+    }
+}
+
+impl<'de> TupleUnpack<'de> for Vec<u8> {
+    fn unpack(input: &'de [u8], tuple_depth: TupleDepth) -> PackResult<(&'de [u8], Self)> {
+        let (input, bytes) = Bytes::unpack(input, tuple_depth)?;
+        Ok((input, bytes.into_owned()))
+    }
+}
+
+impl TuplePack for &str {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        _tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        w.write_all(&[STRING])?;
+        write_bytes(w, self.as_bytes())
+    }
+}
+
+impl TuplePack for String {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        self.as_str().pack(w, tuple_depth)
+    }
+}
+
+impl TuplePack for Cow<'_, str> {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        self.as_ref().pack(w, tuple_depth)
+    }
+}
+
+impl<'de> TupleUnpack<'de> for Cow<'de, str> {
+    fn unpack(input: &'de [u8], _tuple_depth: TupleDepth) -> PackResult<(&'de [u8], Self)> {
+        let input = parse_code(input, STRING)?;
+        let (input, v) = parse_string(input)?;
+        Ok((input, v))
+    }
+}
+
+impl TupleUnpack<'_> for String {
+    fn unpack(input: &[u8], _tuple_depth: TupleDepth) -> PackResult<(&[u8], Self)> {
+        let input = parse_code(input, STRING)?;
+        let (input, v) = parse_string(input)?;
+        Ok((input, v.into_owned()))
+    }
+}
+
+impl<T> TuplePack for Option<T>
+where
+    T: TuplePack,
+{
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        match self {
+            None => {
+                let size = if tuple_depth.depth() > 1 {
+                    // Empty value in nested tuple is encoded with [NIL, ESCAPE] to
+                    // disambiguate itself with end-of-tuple marker.
+                    w.write_all(&[NIL, ESCAPE])?;
+                    2
+                } else {
+                    w.write_all(&[NIL])?;
+                    1
+                };
+                Ok(VersionstampOffset::None { size })
+            }
+            Some(v) => v.pack(w, tuple_depth),
+        }
+    }
+}
+
+impl<'de, T> TupleUnpack<'de> for Option<T>
+where
+    T: TupleUnpack<'de>,
+{
+    fn unpack(mut input: &'de [u8], tuple_depth: TupleDepth) -> PackResult<(&'de [u8], Self)> {
+        if let Some(&NIL) = input.first() {
+            input = parse_code(input, NIL)?;
+            if tuple_depth.depth() > 1 {
+                input = parse_code(input, ESCAPE)?;
+            }
+            Ok((input, None))
+        } else {
+            let (input, v) = T::unpack(input, tuple_depth)?;
+            Ok((input, Some(v)))
+        }
+    }
+}
+
+impl TuplePack for Element<'_> {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        match self {
+            Element::Nil => Option::<()>::None.pack(w, tuple_depth),
+            Element::Bool(b) => b.pack(w, tuple_depth),
+            Element::Int(i) => i.pack(w, tuple_depth),
+            Element::Float(f) => f.pack(w, tuple_depth),
+            Element::Double(f) => f.pack(w, tuple_depth),
+            Element::String(c) => c.pack(w, tuple_depth),
+            Element::Bytes(b) => b.pack(w, tuple_depth),
+            Element::Versionstamp(b) => b.pack(w, tuple_depth),
+            Element::Tuple(v) => v.pack(w, tuple_depth),
+            #[cfg(feature = "uuid")]
+            Element::Uuid(v) => v.pack(w, tuple_depth),
+            #[cfg(feature = "num-bigint")]
+            Element::BigInt(v) => v.pack(w, tuple_depth),
+        }
+    }
+}
+
+impl<'de> TupleUnpack<'de> for Element<'de> {
+    fn unpack(input: &'de [u8], tuple_depth: TupleDepth) -> PackResult<(&'de [u8], Self)> {
+        const INTMIN: u8 = INTZERO - 8;
+        const INTMAX: u8 = INTZERO + 8;
+
+        let first = match input.first() {
+            None if tuple_depth.depth() == 0 => return Ok((input, Element::Tuple(Vec::new()))),
+            None => return Err(PackError::MissingBytes),
+            Some(byte) => byte,
+        };
+
+        let (mut input, mut v) = match *first {
+            NIL => {
+                let (input, _) = Option::<()>::unpack(input, tuple_depth)?;
+                (input, Element::Nil)
+            }
+            BYTES => {
+                let (input, v) = Bytes::unpack(input, tuple_depth)?;
+                (input, Element::Bytes(v))
+            }
+            STRING => {
+                let (input, v) = Cow::<'de, str>::unpack(input, tuple_depth)?;
+                (input, Element::String(v))
+            }
+            NESTED => {
+                let (input, v) = Vec::<Self>::unpack(input, tuple_depth)?;
+                (input, Element::Tuple(v))
+            }
+            INTMIN..=INTMAX => match i64::unpack(input, tuple_depth) {
+                Ok((input, v)) => (input, Element::Int(v)),
+                #[cfg(feature = "num-bigint")]
+                Err(PackError::UnsupportedIntLength) => {
+                    let (input, v) = num_bigint::BigInt::unpack(input, tuple_depth)?;
+                    (input, Element::BigInt(v))
+                }
+                Err(err) => return Err(err),
+            },
+            #[cfg(feature = "num-bigint")]
+            NEGINTSTART => {
+                let (input, v) = num_bigint::BigInt::unpack(input, tuple_depth)?;
+                (input, Element::BigInt(v))
+            }
+            #[cfg(feature = "num-bigint")]
+            POSINTEND => {
+                let (input, v) = num_bigint::BigInt::unpack(input, tuple_depth)?;
+                (input, Element::BigInt(v))
+            }
+            #[cfg(not(feature = "num-bigint"))]
+            NEGINTSTART => {
+                let (input, v) = i64::unpack(input, tuple_depth)?;
+                (input, Element::Int(v))
+            }
+            #[cfg(not(feature = "num-bigint"))]
+            POSINTEND => {
+                let (input, v) = i64::unpack(input, tuple_depth)?;
+                (input, Element::Int(v))
+            }
+            FLOAT => {
+                let (input, v) = f32::unpack(input, tuple_depth)?;
+                (input, Element::Float(v))
+            }
+            DOUBLE => {
+                let (input, v) = f64::unpack(input, tuple_depth)?;
+                (input, Element::Double(v))
+            }
+            FALSE | TRUE => {
+                let (input, v) = bool::unpack(input, tuple_depth)?;
+                (input, Element::Bool(v))
+            }
+            VERSIONSTAMP => {
+                let (input, v) = Versionstamp::unpack(input, tuple_depth)?;
+                (input, Element::Versionstamp(v))
+            }
+            #[cfg(feature = "uuid")]
+            UUID => {
+                let (input, v) = uuid::Uuid::unpack(input, tuple_depth)?;
+                (input, Element::Uuid(v))
+            }
+            found => {
+                return Err(PackError::BadCode {
+                    found,
+                    expected: None,
+                });
+            }
+        };
+
+        if tuple_depth.depth() == 0 && !input.is_empty() {
+            let mut tuple = vec![v];
+            while !input.is_empty() {
+                let (rem, v) = Self::unpack(input, tuple_depth.increment())?;
+                tuple.push(v);
+                input = rem;
+            }
+            v = Element::Tuple(tuple);
+        }
+
+        Ok((input, v))
+    }
+}
+
+impl TuplePack for Versionstamp {
+    fn pack<W: io::Write>(
+        &self,
+        w: &mut W,
+        _tuple_depth: TupleDepth,
+    ) -> io::Result<VersionstampOffset> {
+        w.write_all(&[VERSIONSTAMP])?;
+        w.write_all(self.as_bytes())?;
+        if self.is_complete() {
+            Ok(VersionstampOffset::None { size: 1 + 12 })
+        } else {
+            Ok(VersionstampOffset::OneIncomplete { offset: 1 })
+        }
+    }
+}
+
+impl TupleUnpack<'_> for Versionstamp {
+    fn unpack(input: &[u8], _tuple_depth: TupleDepth) -> PackResult<(&[u8], Self)> {
+        let input = parse_code(input, VERSIONSTAMP)?;
+        let (input, slice) = parse_bytes(input, 12)?;
+        let mut bytes = [0xff; 12];
+        bytes.copy_from_slice(slice);
+        Ok((input, Versionstamp::from(bytes)))
+    }
+}
+
+#[cfg(feature = "uuid")]
+mod pack_uuid {
+    use super::*;
+    use uuid::Uuid;
+
+    impl TuplePack for Uuid {
+        fn pack<W: io::Write>(
+            &self,
+            w: &mut W,
+            _tuple_depth: TupleDepth,
+        ) -> io::Result<VersionstampOffset> {
+            w.write_all(&[UUID])?;
+            w.write_all(self.as_bytes())?;
+            Ok(VersionstampOffset::None { size: 1 + 16 })
+        }
+    }
+
+    impl TupleUnpack<'_> for Uuid {
+        fn unpack(input: &[u8], _tuple_depth: TupleDepth) -> PackResult<(&[u8], Self)> {
+            let input = parse_code(input, UUID)?;
+            let (input, slice) = parse_bytes(input, 16)?;
+            let uuid = Self::from_slice(slice).map_err(|_| PackError::BadUuid)?;
+            Ok((input, uuid))
+        }
+    }
+}
diff --git a/bindings/rust/foundationdb-tuple/src/subspace.rs b/bindings/rust/foundationdb-tuple/src/subspace.rs
new file mode 100644
index 00000000000..23a6d345dd3
--- /dev/null
+++ b/bindings/rust/foundationdb-tuple/src/subspace.rs
@@ -0,0 +1,320 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+use super::*;
+use std::fmt::Formatter;
+use std::hash::Hash;
+
+/// Represents a well-defined region of keyspace in a FoundationDB database
+///
+/// It provides a convenient way to use FoundationDB tuples to define namespaces for
+/// different categories of data. The namespace is specified by a prefix tuple which is prepended
+/// to all tuples packed by the subspace. When unpacking a key with the subspace, the prefix tuple
+/// will be removed from the result.
+///
+/// As a best practice, API clients should use at least one subspace for application data. For
+/// general guidance on subspace usage, see the Subspaces section of the [Developer Guide].
+///
+/// [Developer Guide]: https://apple.github.io/foundationdb/developer-guide.html#subspaces
+#[derive(Debug, Clone, Eq, PartialEq, Hash)]
+pub struct Subspace {
+    prefix: Vec<u8>,
+    versionstamp_offset: VersionstampOffset,
+}
+
+impl Display for Subspace {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        for &b in &self.prefix {
+            if (32..127).contains(&b) && b != b'\\' {
+                write!(f, "{}", b as char)?;
+            } else if b == b'\\' {
+                write!(f, "\\\\")?;
+            } else {
+                write!(f, "\\x{b:02x}")?;
+            }
+        }
+        Ok(())
+    }
+}
+
+impl<E: TuplePack> From<E> for Subspace {
+    fn from(e: E) -> Self {
+        let mut prefix = vec![];
+        let versionstamp_offset = pack_into(&e, &mut prefix);
+        Self {
+            prefix,
+            versionstamp_offset,
+        }
+    }
+}
+
+impl Subspace {
+    /// `all` returns the Subspace corresponding to all keys in a FoundationDB database.
+    pub fn all() -> Self {
+        Self {
+            prefix: Vec::new(),
+            versionstamp_offset: VersionstampOffset::None { size: 0 },
+        }
+    }
+
+    /// Returns a new Subspace from the provided bytes.
+    pub fn from_bytes(prefix: impl Into<Vec<u8>>) -> Self {
+        let prefix = prefix.into();
+        Self {
+            versionstamp_offset: VersionstampOffset::None {
+                size: u32::try_from(prefix.len()).expect("data doesn't fit u32"),
+            },
+            prefix,
+        }
+    }
+
+    /// Convert into prefix key bytes
+    pub fn into_bytes(self) -> Vec<u8> {
+        self.prefix
+    }
+
+    /// Returns a new Subspace whose prefix extends this Subspace with a given tuple encodable.
+    pub fn subspace<T: TuplePack>(&self, t: &T) -> Self {
+        let mut prefix = self.prefix.clone();
+        let mut versionstamp_offset = self.versionstamp_offset;
+        versionstamp_offset += pack_into(t, &mut prefix);
+        Self {
+            prefix,
+            versionstamp_offset,
+        }
+    }
+
+    /// `bytes` returns the literal bytes of the prefix of this Subspace.
+    pub fn bytes(&self) -> &[u8] {
+        self.prefix.as_slice()
+    }
+
+    /// Returns the key encoding the specified Tuple with the prefix of this Subspace
+    /// prepended.
+    pub fn pack<T: TuplePack>(&self, t: &T) -> Vec<u8> {
+        let mut out = self.prefix.clone();
+        pack_into(t, &mut out);
+        out
+    }
+
+    /// Returns the key encoding the specified Tuple with the prefix of this Subspace
+    /// prepended, with a versionstamp.
+    pub fn pack_with_versionstamp<T: TuplePack>(&self, t: &T) -> Vec<u8> {
+        let mut output = self.prefix.clone();
+        let mut versionstamp_offset = self.versionstamp_offset;
+        versionstamp_offset += pack_into(t, &mut output);
+        match versionstamp_offset {
+            VersionstampOffset::OneIncomplete { offset } => {
+                output.extend_from_slice(&offset.to_le_bytes());
+            }
+            VersionstampOffset::MultipleIncomplete => {
+                panic!("Subspace cannot contain more than one incomplete versionstamp");
+            }
+            _ => {}
+        }
+        output
+    }
+
+    /// `unpack` returns the Tuple encoded by the given key with the prefix of this Subspace
+    /// removed.  `unpack` will return an error if the key is not in this Subspace or does not
+    /// encode a well-formed Tuple.
+    pub fn unpack<'de, T: TupleUnpack<'de>>(&self, key: &'de [u8]) -> PackResult<T> {
+        if !self.is_start_of(key) {
+            return Err(PackError::BadPrefix);
+        }
+        let key = &key[self.prefix.len()..];
+        unpack(key)
+    }
+
+    /// `is_start_of` returns true if the provided key starts with the prefix of this Subspace,
+    /// indicating that the Subspace logically contains the key.
+    pub fn is_start_of(&self, key: &[u8]) -> bool {
+        key.starts_with(&self.prefix)
+    }
+
+    /// `range` returns first and last key of given Subspace
+    pub fn range(&self) -> (Vec<u8>, Vec<u8>) {
+        let mut begin = Vec::with_capacity(self.prefix.len() + 1);
+        begin.extend_from_slice(&self.prefix);
+        begin.push(0x00);
+
+        let mut end = Vec::with_capacity(self.prefix.len() + 1);
+        end.extend_from_slice(&self.prefix);
+        end.push(0xff);
+
+        (begin, end)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+
+    #[test]
+    fn sub() {
+        let ss0: Subspace = 1.into();
+        let ss1 = ss0.subspace(&2);
+
+        let ss2: Subspace = (1, 2).into();
+
+        assert_eq!(ss1.bytes(), ss2.bytes());
+    }
+
+    #[test]
+    fn pack_unpack() {
+        let ss0: Subspace = 1.into();
+        let tup = (2, 3);
+
+        let packed = ss0.pack(&tup);
+        let expected = pack(&(1, 2, 3));
+        assert_eq!(expected, packed);
+
+        let tup_unpack: (i64, i64) = ss0.unpack(&packed).unwrap();
+        assert_eq!(tup, tup_unpack);
+
+        assert!(ss0.unpack::<(i64, i64, i64)>(&packed).is_err());
+    }
+
+    #[test]
+    fn subspace_pack_with_versionstamp() {
+        let subspace: Subspace = 1.into();
+        let tup = (Versionstamp::incomplete(0), 2);
+
+        let packed = subspace.pack_with_versionstamp(&tup);
+        let expected = pack_with_versionstamp(&(1, Versionstamp::incomplete(0), 2));
+        assert_eq!(expected, packed);
+    }
+
+    #[test]
+    fn subspace_unpack_with_versionstamp() {
+        // On unpack, the versionstamp will be complete, so pack_with_versionstamp won't append
+        // the offset.
+        let subspace: Subspace = 1.into();
+        let tup = (Versionstamp::complete([1; 10], 0), 2);
+        let packed = subspace.pack_with_versionstamp(&tup);
+        let tup_unpack: (Versionstamp, i64) = subspace.unpack(&packed).unwrap();
+        assert_eq!(tup, tup_unpack);
+
+        assert!(
+            subspace
+                .unpack::<(i64, Versionstamp, i64)>(&packed)
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn unpack_with_subspace_versionstamp() {
+        let subspace: Subspace = Versionstamp::complete([1; 10], 2).into();
+        let tup = (Versionstamp::complete([1; 10], 0), 2);
+        let packed = subspace.pack_with_versionstamp(&tup);
+        let tup_unpack: (Versionstamp, i64) = subspace.unpack(&packed).unwrap();
+        assert_eq!(tup, tup_unpack);
+        assert!(
+            subspace
+                .unpack::<(Versionstamp, Versionstamp, i64)>(&packed)
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn subspace_can_use_incomplete_versionstamp() {
+        let subspace: Subspace = Versionstamp::incomplete(0).into();
+        let tup = (1, 2);
+
+        let packed = subspace.pack_with_versionstamp(&tup);
+        let expected = pack_with_versionstamp(&(Versionstamp::incomplete(0), 1, 2));
+        assert_eq!(expected, packed);
+    }
+
+    #[test]
+    fn child_subspace_can_use_incomplete_versionstamp() {
+        let subspace: Subspace = 1.into();
+        let subspace = subspace.subspace(&Versionstamp::incomplete(0));
+        let tup = (1, 2);
+        let packed = subspace.pack_with_versionstamp(&tup);
+        let expected = pack_with_versionstamp(&(1, Versionstamp::incomplete(0), 1, 2));
+        assert_eq!(expected, packed);
+    }
+
+    #[test]
+    #[should_panic]
+    fn subspace_cannot_use_multiple_incomplete_versionstamps() {
+        let subspace: Subspace = Versionstamp::incomplete(0).into();
+        let subspace = subspace.subspace(&Versionstamp::incomplete(0));
+        subspace.pack_with_versionstamp(&1);
+    }
+
+    #[test]
+    #[should_panic]
+    fn subspace_cannot_pack_multiple_incomplete_versionstamps() {
+        let subspace: Subspace = Versionstamp::incomplete(0).into();
+        subspace.pack_with_versionstamp(&Versionstamp::incomplete(0));
+    }
+
+    #[test]
+    fn is_start_of() {
+        let ss0: Subspace = 1.into();
+        let ss1: Subspace = 2.into();
+        let tup = (2, 3);
+
+        assert!(ss0.is_start_of(&ss0.pack(&tup)));
+        assert!(!ss1.is_start_of(&ss0.pack(&tup)));
+        assert!(Subspace::from("start").is_start_of(&pack(&"start")));
+        assert!(Subspace::from("start").is_start_of(&pack(&"start".to_string())));
+        assert!(!Subspace::from("start").is_start_of(&pack(&"starting")));
+        assert!(Subspace::from("start").is_start_of(&pack(&("start", "end"))));
+        assert!(Subspace::from(("start", 42)).is_start_of(&pack(&("start", 42, "end"))));
+    }
+
+    #[test]
+    fn range() {
+        let ss: Subspace = 1.into();
+        let tup = (2, 3);
+        let packed = ss.pack(&tup);
+
+        let (begin, end) = ss.range();
+        assert!(packed >= begin && packed <= end);
+    }
+
+    #[test]
+    fn equality() {
+        let sub1 = Subspace::all().subspace(&"test");
+        let sub2 = Subspace::all().subspace(&"test");
+        let sub3 = Subspace::all().subspace(&"test2");
+        assert_eq!(sub1, sub2);
+        assert_ne!(sub1, sub3);
+    }
+
+    #[test]
+    fn hash() {
+        let sub1 = Subspace::all().subspace(&"test");
+        let sub2 = Subspace::all().subspace(&"test2");
+
+        let map: HashMap<Subspace, u8> = HashMap::from([(sub1, 1), (sub2, 2)]);
+
+        assert_eq!(map.get(&Subspace::all().subspace(&"test")).unwrap(), &1);
+        assert_eq!(map.get(&Subspace::all().subspace(&"test2")).unwrap(), &2);
+    }
+
+    #[test]
+    fn display() {
+        let sub1 = Subspace::all().subspace(&"test");
+        let sub2 = Subspace::all().subspace(&"test2").subspace(&"path1");
+        let sub3 = Subspace::all().subspace(&"test3").subspace(&"__커피__");
+        let sub4 = Subspace::all().subspace(&"test4\\path1\\path2");
+
+        assert_eq!(format!("{sub1}"), r#"\x02test\x00"#);
+        assert_eq!(format!("{sub2}"), r#"\x02test2\x00\x02path1\x00"#);
+        assert_eq!(
+            format!("{sub3}"),
+            r#"\x02test3\x00\x02__\xec\xbb\xa4\xed\x94\xbc__\x00"#
+        );
+        assert_eq!(format!("{sub4}"), r#"\x02test4\\path1\\path2\x00"#);
+    }
+}
diff --git a/bindings/rust/foundationdb-tuple/src/versionstamp.rs b/bindings/rust/foundationdb-tuple/src/versionstamp.rs
new file mode 100644
index 00000000000..516f5e65b19
--- /dev/null
+++ b/bindings/rust/foundationdb-tuple/src/versionstamp.rs
@@ -0,0 +1,62 @@
+use super::{Bytes, Element};
+use std::fmt;
+
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct Versionstamp {
+    bytes: [u8; 12],
+}
+
+impl fmt::Debug for Versionstamp {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        Bytes::from(&self.bytes[..]).fmt(f)
+    }
+}
+
+impl Versionstamp {
+    pub fn incomplete(user_version: u16) -> Self {
+        let mut bytes = [0xff; 12];
+        bytes[10..].copy_from_slice(&user_version.to_be_bytes());
+        Versionstamp { bytes }
+    }
+
+    pub fn complete(tr_version: [u8; 10], user_version: u16) -> Self {
+        let mut bytes = [0xff; 12];
+        bytes[0..10].copy_from_slice(&tr_version);
+        bytes[10..].copy_from_slice(&user_version.to_be_bytes());
+        Versionstamp { bytes }
+    }
+
+    pub fn transaction_version(&self) -> &[u8] {
+        &self.bytes[0..10]
+    }
+
+    pub fn user_version(&self) -> u16 {
+        let mut user_version = [0; 2];
+        user_version.copy_from_slice(&self.bytes[10..12]);
+        u16::from_be_bytes(user_version)
+    }
+
+    pub fn is_complete(&self) -> bool {
+        self.bytes[0..10] != [0xff; 10]
+    }
+
+    pub fn as_bytes(&self) -> &[u8; 12] {
+        &self.bytes
+    }
+}
+
+impl From<[u8; 12]> for Versionstamp {
+    fn from(bytes: [u8; 12]) -> Self {
+        Versionstamp { bytes }
+    }
+}
+
+impl Element<'_> {
+    pub fn count_incomplete_versionstamp(&self) -> usize {
+        match self {
+            Element::Versionstamp(v) if !v.is_complete() => 1,
+            Element::Tuple(v) => v.iter().map(Element::count_incomplete_versionstamp).sum(),
+            _ => 0,
+        }
+    }
+}
diff --git a/bindings/rust/foundationdb/CHANGELOG.md b/bindings/rust/foundationdb/CHANGELOG.md
new file mode 100644
index 00000000000..44927f0b078
--- /dev/null
+++ b/bindings/rust/foundationdb/CHANGELOG.md
@@ -0,0 +1,625 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.11.0] - 2026-06-24
+
+### <!-- 1 -->🚀 Features
+
+- Feat: first draft of leader election recipe implementation
+- Use Deref<Target=Transaction>
+- Feat(leader_election): implement O(1) ballot-based Active Disk Paxos algorithm
+- Feat(recipes): add ranked register recipe
+- Feat: add transaction conflict reporting and unified retry runner
+- Feat: migrate workspace to Rust 2024 edition (#255)
+
+### <!-- 2 -->🐛 Bug Fixes
+
+- Fix(directory): use get_ranges_keyvalues for proper pagination
+- Fix: replace version-based timeouts with Duration-based approach
+- Fix(simulation): simplify leader election invariants to core algorithm properties
+- Fix(leader-election): internalize versionstamp to prevent unregistered leadership claims
+- Fix(simulation): use microsecond precision for log entry ordering
+- Use get_ranges_keyvalues for complete range reads (fixes #72)
+
+### <!-- 4 -->🚜 Refactor
+
+- Refactor(simulation): remove redundant invariants and unused types
+
+### <!-- 5 -->📚 Documentation
+
+- Docs(leader-election): add simulation testing documentation
+- Docs(leader-election): improve module and struct documentation
+
+### <!-- 8 -->⚙️ Miscellaneous
+
+- Format code and update invariants
+- Clarify infinite-retry behavior and add timeout/retry safeguards (fixes
+- Chore: align nix toolchain with CI stable (Rust 1.96) and fix 1.96 clippy lints
+
+### <!-- 9 -->📦 Other Changes
+
+- Rewrite fdb_rt to split wakeup and polling phase
+- Review comments
+
+[0.11.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.10.0..0.11.0
+
+
+## [0.10.0] - 2025-10-24
+
+### <!-- 1 -->🚀 Features
+
+- Feat(foundationdb) : Expose Timekeeper API
+- Profiling Keyspace Scanner
+- Add support 7.4
+- Impl std::error::Error for TransactionCommitError
+- Add optional tracing feature
+- Add `intrumented_run`
+- Add unsafe to new_from_pointer function
+
+### <!-- 2 -->🐛 Bug Fixes
+
+- Fix(foundationdb) : Replace unmaintained ring crate with sha2 in examples
+- Add  on fields in MetricKey
+- Don't log as error all commit errors
+- Fix: resolve clippy warnings and add doc alias
+
+### <!-- 5 -->📚 Documentation
+
+- Doc, multi-statements support
+- Doc-related clippy fixes
+
+### <!-- 6 -->🧪 Testing
+
+- Add a test on failed closure
+
+### <!-- 8 -->⚙️ Miscellaneous
+
+- Bump rand to 0.9.0
+- Bump MSRV to 1.82
+- Test on Apple silicon
+- Clippy --fix
+- Fix warnings
+- Bump msrv to 1.85
+
+### <!-- 9 -->📦 Other Changes
+
+- Use cfg_api_versions and if_cfg_api_versions
+- Specifically use C ABI for packed structs
+- Some spaces and tabs doc formalization
+- Rename instrumentation by trace
+
+[0.10.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.9.2..0.10.0
+
+
+## [0.9.2] - 2025-01-06
+
+### <!-- 0 -->🚀 added
+
+- Add multi_version compatibility
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Test get_metadata_version on 7.3
+
+### <!-- 3 -->🆙 Bump
+
+- Bump async-trait from 0.1.83 to 0.1.84
+- Bump tokio from 1.40.0 to 1.41.0
+- Bump uuid from 1.10.0 to 1.11.0
+- Bump futures from 0.3.30 to 0.3.31
+
+### <!-- 4 -->⚙️ Other changes
+
+- Merge pull request [#211](https://github.com/foundationdb-rs/foundationdb-rs/pull/211) from foundationdb-rs/dependabot/cargo/serde-1.0.217
+- Merge pull request [#190](https://github.com/foundationdb-rs/foundationdb-rs/pull/190) from spiraldb/ji/split-tuple-into-crate
+- Merge pull request [#173](https://github.com/foundationdb-rs/foundationdb-rs/pull/173) from foundationdb-rs/dependabot/cargo/serde_json-1.0.132
+- Apply review changes
+- Improve libfdb transaction error
+
+[0.9.2]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.9.1..0.9.2
+
+## [0.9.1] - 2024-10-08
+
+### <!-- 0 -->🚀 added
+
+- Add examples for using versionstamps
+- Add Database.get_main_thread_busyness
+
+### <!-- 3 -->🆙 Bump
+
+- Bump MSRV to 1.71.1
+- Bump all dependencies and setup dependabot
+
+### <!-- 4 -->⚙️ Other changes
+
+- Generate CHANGELOG per crate
+- Handle nested FdbBindingErrors
+- Expose FdbBindingError::get_fdb_error
+
+[0.9.1]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.9.0..0.9.1
+
+## [0.9.0] - 2024-03-15
+
+### <!-- 0 -->🚀 added
+
+- Add more useful version of get_mapped_ranges
+- Add perform_no_op method
+- Introduce db_run
+- Introduce FdbBindingError
+- Add hello_world using db.run
+- Use cargo add in doc
+- Remove panic during RetryableTransaction::commit
+- Feat(foundationdb): rework RetryableTransaction
+- Feat(foundationdb): add raw method to create a Database
+- Initial commit for Tenant
+- Implement Tenant{Create,SetActive,Delete}
+- Implement list_tenant
+- Get TenantManagement::get_tenant
+- Fix `list_range` and add tenant::run
+- Feat(tuple) add function to pack a subspace key with a versionstamp
+- Add integ tests for tuple subspaces with versionstamps
+- Add support for 7.3
+- Add more feature flag
+- Add Database.get_client_status
+- Add support for tenant info in 7.3
+- Add MicroQueue examples
+- Bump fdb crate to 0.9.0 and sim to 0.2.0
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Clippy warnings
+- Run tenants tests when feature is used
+- Avoid infinite recursion on debug impl
+- Fix: Mark Fdb struct wrappers as packed
+- Use Debug impl as Display
+- Make the db_run non capturing
+- Apply cargo fmt recommendation
+- Fix std::slice::from_raw_parts behavior on nightly
+- Fix(foundationdb): remove flappy tests
+
+### <!-- 2 -->🚜 Refactor
+
+- Remove unused StreamingMode
+- Remove unnecessary casts.
+
+### <!-- 3 -->🆙 Bump
+
+- Chore: bump rust to 1.57
+- Bump msrv
+- Bump crates version
+- Bump msrv for bindgen and env_logger
+- Bump dependencies
+- Bump dep
+
+### <!-- 4 -->⚙️ Other changes
+
+- Build on docs.rs with the required features
+- Reformat table
+- Clippy
+- Rename examples
+- Hide tenant api behind a feature
+- Introduce a pass-through transaction option setter
+- Cargo {fmt,clippy}
+- Prepare release
+- Clippy: Simplify non-minimal-cfg.
+- Clippy: Suppress "should_implement_trait" for `Database::default()`.
+- Cargo fmt
+- Removing default fdb version
+- Cargo fmt/clippy
+- Replace get(0) by first()
+- Return errors instead of expect
+- Use higher-level get_ranges
+- Create MicroQueue struct
+- Simplify first_item method and prevent extra allocations
+- Use local variable instead of struct ffield for random seed
+- Default Unit value for FdbResult
+
+## [0.7.0] - 2022-07-11
+
+### <!-- 0 -->🚀 added
+
+- Add micro index example
+- Add tested example to explain how to use fdb to store blob data.
+- Add missing async keyword on simple-index example
+- Add explanation about blob example
+- Add a simple blob example
+- Add support for api 700
+- Initial commit for get_range_split_points
+- Implement Iterator for FdbKeys
+- FdbAddress should be #[repr(transparent)]
+- Expose FdbKey and other only in 7.0
+- Implement range split point
+- Introduce get/set metatadaVersion
+- Introduce run method
+- Add Hash, Eq and PartialEq to Subspace
+- Add example about atomic_op
+- Initial commit to support fdb 7.1
+- Initial commit for get_mapped_range
+- Allow retrieval of embedded kvs in mapped_range
+- Allow KeySelector in mapped_range
+- Improve doc about mapped_range
+
+### <!-- 2 -->🚜 Refactor
+
+- Remove clikengo link in Cargo.toml
+- Use macro cfg_api_versions when possible
+
+### <!-- 3 -->🆙 Bump
+
+- Bump dependencies
+- Bump deps
+- Bump rust patch version
+
+### <!-- 4 -->⚙️ Other changes
+
+- Improve blob example display
+- Use tokio reactor in examples
+- Improve blob example with a manifest system
+- Reduce unsafe scope
+- Limit FdbKeys and FdbKey to fdb700+
+- Reduce use of `cfg_api_versions`
+- Clippy
+- Revert "feat(foundationdb): introduce run method"
+- Split modules in separate files
+- Move test mapped_range into range's tests
+- Improve documentation
+- Prepare for 0.7.0
+
+## [0.6.0] - 2022-04-08
+
+### <!-- 0 -->🚀 added
+
+- Add support for api 630
+- Introduce platform tier
+- Feat(foundationdb,bindingtester): Add directory
+- Add warning on create
+- Fix compilation with 1.46.0 and add back install on script
+- Bump crate version, maintainers and documentation
+- Bump rust edition to 2021
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Fix doc artifacts of removed methods
+- Fix: Bump minimum version to rust 1.46
+- Cargo clippy --fix and fmt
+- Run estimate range tests only on 630
+- Fix several panics during some seeds
+- Fix clippy warnings
+- Typo
+- Fix(directory): avoid throwing bad CannotMoveBetweenPartition
+- Fix code in documentation
+- Fix(directory): avoid initializing the version key on create_or_open
+- Fix(directory): Scan old and new path during Directory.Move
+
+### <!-- 2 -->🚜 Refactor
+
+- Accept a slice instead of a Vec as path
+- Refactor(directory): Node are always loaded and existing
+
+### <!-- 3 -->🆙 Bump
+
+- Bump version to 5.0.1
+- Bump deps
+
+### <!-- 4 -->⚙️ Other changes
+
+- Cargo fmt
+- Make tuple::hca::HighContentionAllocator be Send (#214)
+- Removing reference to master branch
+- Code-review
+- Chore: code-review
+- Rollback breaking change on Subspace::from_bytes
+- Chore(directory): cleanup tuple looking syntax
+- Clippy
+
+## [0.5.0] - 2020-09-17
+
+### <!-- 0 -->🚀 added
+
+- Add versionstamp support to tuple
+- Add docs and description of algorithm
+- Get_addresses_for_key test
+- Add NEGINSTART and POSINTEND to tuple
+- Add boot_async method
+- Add support for pack with versionstamp
+- Simplify add_assign logic for VerstionstampOffset
+- Add transact limits test and make the code easier to read
+- Add tests for boot_async
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Fixed flaky networking test
+- Fix variable does not need to be mutable in bindingtester
+- Fix integer cast possible undefined behavior
+- Fix missing rename for fdb_api to api
+- Fix default feature compilation
+- Fix Element::tuple deserialization
+- Fix build on linux/osx
+- Clippy fixes
+- Fix tests
+- Fix build after naming changes
+- Fix build without uuid feature
+- Fix bindingtester scripted seed 674776253
+- Fixed i64 encoding index out of range error
+- Fix panic on i64
+- Fix #136: Segfault when pending future dropped
+- Fix foundationdb-gen features
+- Cargo.toml fix docs.rs features
+- Fix copyright link
+- Cargo.toml fix badges links
+- Fix spurious test_future_discard panic
+- Fix DoubleEndedIterator for FdbValuesIter
+- Fix Cargo.toml repository links
+- Fixes from review
+- Fix #170: protect boot from undefined behavior
+- Fix #181: boot can still trigger undefined behavior if `f` panic and does not abort.
+- Fix some cargo clippy issues
+- Fix use after free in Database::new
+- Fix doc in KeySelector first_greater_than*
+- Fix bigint support
+- Fix bigint support on element
+- Fix Element order between BigInt and Int
+- Fix versionstamp offset and bindingtester
+- Fix unpack of ix that doesn't fix in ix
+- Fix build for rust < 1.42
+- Fix broken transact() limits
+- Fix cargo clippy warning
+- Fix missing tokio features for tokio_async test
+- Simplify and fix UB in boot API
+- Fix even `run` can lead to UB
+- Fix api_ub test on API <610
+
+### <!-- 2 -->🚜 Refactor
+
+- Remove unnecessary cast in unsafe blocks
+- Remove is_maybe_committed as it is already accessible
+- Remove failure dependency
+- Remove useless import
+- Bindingtester refactoring
+- Remove dbg!
+
+### <!-- 3 -->🆙 Bump
+
+- Bump version to 0.4.1
+
+### <!-- 4 -->⚙️ Other changes
+
+- Core: auto-generate all code at build time
+- Upgrade rand from 0.4 to 0.6 (#104)
+- Upgrade uuid from 0.6 to 0.7 (#105)
+- Cleanup the fdb version features from primary crate (#99)
+- Rust edition 2018
+- Async/await: complete rewrite of foundationdb
+- New get_ranges_key_values -> Stream<KeyValue> api on Transaction
+- Renamed foundationdb_sys import from fdb to fdb_sys for clarity
+- Rename fdb_api to api
+- Foundationdb api 510, 520, 600 support
+- Working threaded bindingtester
+- Bindingtester is now complete and serde is replaced by a solution close to the original
+- Make RangeOption::next_range public
+- Fdb 620 support
+- Futures 0.3 is stable now
+- Cleanup dependencies and rename Error as FdbError
+- Documentation and API improvements
+- Transaction documentation and some API simplifications
+- Impl Send/Sync for some future results
+- Make FdbFuture and FdbFutureHandle private
+- Rename tuple::Error and tuple::Result to PackError and PackResult
+- Hca implementation and tests
+- Foundationdb-sys version is now 0.4.0
+- Returned Future/Stream are now publicly Unpin
+- Restore abort future test
+- :transact data is now passed as mutable
+- Changed back to i64
+- Handle when encoded value overflows
+- Hca outline
+- Lib updates + tweaks to hca
+- Consider each key via fold
+- Bahgawd it works
+- Working tests
+- Tweaks to doc formatting
+- Update rand requirement from 0.6.5 to 0.7.0
+- Mark FdbFuture as Send + Sync
+- Make comment more accurate
+- Update README links and requirements
+- Force foundationdb-gen to version 0.4.0+
+- Update Cargo.toml authors
+- :transact api is now generic and should be future proof.
+- RangeOption can now be constructed from (Vec<u8>, Vec<u8>)
+- RangeOption tests & from RangeInclusive
+- Embed 6.2.10 fdb_c.h and fdb.options
+- Embed all supported version includes
+- Default to locally available foundationdb include
+- Test_set_conflict now checks the error message
+- Cargo.toml badges & docs.rs metadata
+- Impl std::error::Error for FdbError
+- Bigint tuple suport enhancements
+- Disable tokio test until #170 is resolved
+- Renamed BadLength to UnsupportedIntLength
+- Pack/unpack optional bigint support
+- Limit risks of transmute errors of fdb_sys::FDBKeyValue to FdbKeyValue
+- Impl std::error::Error for PackError
+- Use `#[non_exhaustive]` on RangeOption and generated enums
+- Typo in documentation
+- Few api improvements:
+- Default to foundation 620 api
+- Cargo fmt
+- Ignore test_ub test due to panic hook issue in the code coverage CI test
+- Update README and CHANGELOG
+
+## [0.3.0] - 2018-11-16
+
+### <!-- 0 -->🚀 added
+
+- Add docs link to Cargo.toml
+- Add `futures` dependency to example.
+- Add futures to docs
+- `GetKeyResult` and `GetAddressResult` return value
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Fix imports in example
+
+### <!-- 4 -->⚙️ Other changes
+
+- Win64 support
+- Change `TrxGet::value` to return `Option<&[u8]>`
+- Prepare 0.3 release
+
+## [0.2] - 2018-05-09
+
+### <!-- 0 -->🚀 added
+
+- Add some READMEs
+- Add Readme for the fdb crate
+- Add metadata
+- Add FdbError and conversion helpers
+- Add first working example
+- Add `example_get_multi`
+- Add comments
+- Add set_option() api to Database/Transaction
+- Add run and stop
+- Add network set_option
+- Add init functions
+- Add library level documentation and examples
+- Add Apple copyright due to most of the docs from FoundationDB docs
+- Add docs for options
+- Cancel/committed_version/get_address_for_key
+- Add `Transaction::watch`, #19
+- Add `Transaction::atomic_op`, #15
+- Add `Transaction::get_range`, #14
+- Add testcases with conflict scenario
+- Add `Database::transact`, #29
+- Add docs about retrylimit/timeout, fix watch
+- Add floating-point support
+- Add `bindingtester`, #39
+- Add nested tuple/single value
+- Add `Transaction::add_conflict_range`, #20
+- Add Subspace, #36
+- Add benchmark
+- Add support for threading/batching
+- Add into FdbError for tuple::Error
+- Add some tests to validate recursive tuples
+- Add some debug lines
+- Add decode/encode for Option
+- Add single tuple support back
+
+### <!-- 1 -->🐛 Bug Fixes
+
+- Fix version
+- Fix some urls
+- Fix doc tests for stable
+- Fix typo on comment
+- Fix compile error on tests
+- Fix crash with uninitialized memory access
+- Fix bug on binary decoding
+- Fix off-by-one on integer encoding
+- Support nested Empty, fix overflow on int
+- Fix segfault on watch test, #58
+- Fix errors to updated format
+- Publicize TupleDepth::increment, fix typos
+
+### <!-- 2 -->🚜 Refactor
+
+- Remove unsafe from futures
+- Remove tokio from the example
+- Refactor context and network
+- Remove debug printlns
+- Remove `Send` from `FdbFuture`
+- Remove bad test
+- Remove the redundant `new` method
+- Impl `From` and remove `RangeOptionBuilder::from_tuple`
+- Remove single tuple variant
+
+### <!-- 3 -->🆙 Bump
+
+- Bump versions
+
+### <!-- 4 -->⚙️ Other changes
+
+- Initial library create for foundationdb rust bindings
+- Initial binding generation working
+- Context initialization
+- Generate options types from fdb.options
+- Use consts from sys crate
+- Move examples code to lib
+- Default config path based on OS
+- Change `TrxCommit::Item` to `Transaction`
+- Delete outdated comment
+- Cleanup errors and warnings
+- Update readme and cargo.toml
+- Use defualt path for all examples
+- Update hello example
+- Copy the library level docs to the crate Readme
+- Copied docs from C api
+- Call `fdb_future_destory` on FdbFuture::drop
+- Track bindings.rs in Git
+- Revise `Tranasction::get_range`
+- Move examples into tests, cleanup tests
+- Versionstamp, {get,set}_read_version, #20
+- Support rust-style tuple
+- Integer encoding
+- Support tuple encoding
+- A type safe SingleType and conversions
+- Switch to named constants
+- Check edge conditions
+- Switch nested to use TupleValue
+- Cleanup subspace
+- Rename `covers` to `is_start_of`
+- Extract `Single` types to `tuple::single`
+- Rename TupleError to tuple::Error
+- Rename TupleValue to tuple::Value
+- Rename SingleValue to tuple::single::Value
+- Rename SingleType to tuple::single::Type
+- Split `Single` and `Tuple` traits into `Encode` and `Decode`
+- Rename `single` to `item`
+- Use `Uuid` from the `uuid` crate
+- Dedup Tuple::{Decode,Encode} and Item::{Decode,Encode}
+- Make `tuple::item` private and re-export `tuple::item::Value` as `tuple::Item`
+- Make `tuple::item::Value` variants more Rusty
+- Make `tuple::item::Value` non-exhaustive
+- Rename `tuple::Value` to `Tuple` and `tuple::Item` to `Element`
+- Impl Encode for &str
+- Revert "impl Encode for &str"
+- Impl Encode for some borrowed types
+- Subspace tests for tuple variants
+- Reduce allocations when decoding
+- Allow the association of other errors to FdbError
+- Reexport Error from the lib
+- Dont force conversion of error in transact
+- Allow custom error type
+- Drop Other from Error
+- Initialization of class-scheduling
+- Implement simulator
+- Cleanup
+- Cleanup with new tuple semantics
+- All working
+- Use transact on all DB interactions
+- Don't force borrowing
+- Make the `subspace` module private
+- Clean up tests with single-element tuples
+- Revert "clean up tests with single-element tuples"
+- Rename `keyvalues` to `key_values`
+- Rename `encode_to_vec` to `to_vec`
+- Rename `decode_full` to `try_from`
+- Track when inside tuples during encoding
+- Drop the single tuple variant
+- Rebase to Rust named fns
+- Bounds checks and more tests for Option...
+- Encode_to and decode_from
+- Clean up one last reference to str
+- Update changelog for 0.2
+- Document key selector
+
+[unreleased]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.9.0..HEAD
+[0.9.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.7.0..v0.9.0
+[0.7.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.6.0..v0.7.0
+[0.6.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.5.0..v0.6.0
+[0.5.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/v0.3.0..0.5.0
+[0.3.0]: https://github.com/foundationdb-rs}/foundationdb-rs/compare/0.2..v0.3.0
+
+<!-- generated by git-cliff -->
diff --git a/bindings/rust/foundationdb/Cargo.toml b/bindings/rust/foundationdb/Cargo.toml
new file mode 100644
index 00000000000..07f4c033158
--- /dev/null
+++ b/bindings/rust/foundationdb/Cargo.toml
@@ -0,0 +1,80 @@
+[package]
+name = "foundationdb"
+version = "0.11.0"
+authors = [
+    "Benjamin Fry <benjaminfry@me.com>",
+    "Vincent Rouillé <vincent@clikengo.com>",
+    "Pierre Zemb <contact@pierrezemb.fr>"
+]
+edition = "2024"
+rust-version = "1.85.1"
+
+description = """
+High level client bindings for FoundationDB.
+"""
+
+documentation = "https://docs.rs/foundationdb"
+repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+license = "MIT/Apache-2.0"
+
+readme = "README.md"
+keywords = ["foundationdb", "kv"]
+categories = ["database"]
+
+[package.metadata.docs.rs]
+features = ["embedded-fdb-include", "fdb-7_4", "uuid", "recipes"]
+
+[badges]
+codecov = { repository = "foundationdb-rs/foundationdb-rs", branch = "main", service = "github" }
+
+[features]
+default = ["uuid", "recipes"]
+uuid = ["dep:uuid", "foundationdb-tuple/uuid"]
+num-bigint = ["dep:num-bigint", "foundationdb-tuple/num-bigint"]
+# Use the locally embedded foundationdb fdb_c.h and fdb.options files
+embedded-fdb-include = [
+    "foundationdb-sys/embedded-fdb-include",
+    "foundationdb-gen/embedded-fdb-include",
+]
+fdb-5_1 = ["foundationdb-sys/fdb-5_1", "foundationdb-gen/fdb-5_1"]
+fdb-5_2 = ["foundationdb-sys/fdb-5_2", "foundationdb-gen/fdb-5_2"]
+fdb-6_0 = ["foundationdb-sys/fdb-6_0", "foundationdb-gen/fdb-6_0"]
+fdb-6_1 = ["foundationdb-sys/fdb-6_1", "foundationdb-gen/fdb-6_1"]
+fdb-6_2 = ["foundationdb-sys/fdb-6_2", "foundationdb-gen/fdb-6_2"]
+fdb-6_3 = ["foundationdb-sys/fdb-6_3", "foundationdb-gen/fdb-6_3"]
+fdb-7_0 = ["foundationdb-sys/fdb-7_0", "foundationdb-gen/fdb-7_0"]
+fdb-7_1 = ["foundationdb-sys/fdb-7_1", "foundationdb-gen/fdb-7_1"]
+fdb-7_3 = ["foundationdb-sys/fdb-7_3", "foundationdb-gen/fdb-7_3"]
+fdb-7_4 = ["foundationdb-sys/fdb-7_4", "foundationdb-gen/fdb-7_4"]
+recipes = ["recipes-leader-election", "recipes-ranked-register"]
+recipes-leader-election = ["recipes-ranked-register"]
+recipes-ranked-register = []
+trace = ["tracing"]
+
+[build-dependencies]
+foundationdb-gen = { version = "0.11.0", path = "../foundationdb-gen", default-features = false }
+
+[dependencies]
+foundationdb-sys = { version = "0.11.0", path = "../foundationdb-sys", default-features = false }
+foundationdb-macros = { version = "0.4.0", path = "../foundationdb-macros" }
+foundationdb-tuple = { version = "0.11.0", path = "../foundationdb-tuple" }
+futures = "0.3.32"
+libc = "0.2"
+rand = { version = "0.10.1", features = ["default"] }
+static_assertions = "1.1.0"
+uuid = { version = "1.23.3", optional = true }
+num-bigint = { version = "0.5.1", optional = true }
+async-trait = "0.1.89"
+async-recursion = "1.1.1"
+tracing = { version = "0.1.44", optional = true }
+
+[dev-dependencies]
+byteorder = "1.5.0"
+lazy_static = "1.5.0"
+tokio = { version = "1.52.3", features = ["full"] }
+sha2 = "0.11.0"
+data-encoding = "2.11.0"
+bytesize = "2.4"
+uuid = { version = "1.23.3", features = ["v4"] }
+futures-util = "0.3.32"
+tracing-subscriber = "0.3.23"
diff --git a/bindings/rust/foundationdb/README.md b/bindings/rust/foundationdb/README.md
new file mode 100644
index 00000000000..887acee1e2b
--- /dev/null
+++ b/bindings/rust/foundationdb/README.md
@@ -0,0 +1,178 @@
+# FoundationDB Rust Client API
+
+This is a wrapper library around the FoundationDB (Fdb) C API. It implements futures based interfaces over the Fdb future C implementations.
+
+## Prerequisites
+
+* Rust 1.85.1 or more,
+* FoundationDB's client installed.
+
+## Platform Support
+
+Support for different platforms ("targets") are organized into three tiers, each with a different set of guarantees. For more information on the policies for targets at each tier, see the [Target Tier Policy](#target-tier-policy).
+
+| Platform       | Tier   | Notes                                                                                                                               |
+|----------------|--------|-------------------------------------------------------------------------------------------------------------------------------------|
+| linux x86_64   | 1      |                                                                                                                                     |
+| osx x86_64     | 2      |                                                                                                                                     |
+| osx Silicon    | 2      |                                                                                                                                     |
+| Windows x86_64 | 3      | [Windows build has been officially discontinue, now maintained by the community](https://github.com/apple/foundationdb/issues/5135) |
+
+For more information on the policies for targets at each tier, see the
+
+## Target Tier Policy
+
+### Tier 1
+
+`Tier 1` targets can be thought of as "guaranteed to work". This means that:
+
+* we are actively checking correctness with the [BindingTester](https://github.com/apple/foundationdb/blob/master/bindings/bindingtester/spec/bindingApiTester.md),
+* we are running classic Rust tests on each pull requests,
+* you can use the crate on the platform.
+
+
+### Tier 2
+
+`Tier 2` targets can be thought of as "guaranteed to build". This means that:
+
+* we are running classic Rust tests on each pull requests,
+* you can use the crate on the platform.
+
+But we are not checking correctness.
+
+### Tier 3
+
+`Tier 3` targets are platforms we would like to have as Tier 2. You might be able to compile, but no CI has been set up.
+
+## Getting Started
+
+### Install FoundationDB
+
+You first need to install FoundationDB. You can follow the official documentation:
+
+* [Getting Started on Linux](https://apple.github.io/foundationdb/getting-started-linux.html)
+* [Getting started on macOS](https://apple.github.io/foundationdb/getting-started-mac.html)
+
+### Add dependencies on foundationdb-rs
+
+```shell
+cargo add foundationdb -F embedded-fdb-include
+cargo add futures
+```
+
+This Rust crate is not tied to any Async Runtime.
+
+### Exposed features
+
+| Features               | Notes                                                                          |
+|------------------------|--------------------------------------------------------------------------------|
+| `fdb-5_1`              | Support for FoundationDB 5.1.X                                                 |
+| `fdb-5_2`              | Support for FoundationDB 5.2.X                                                 |
+| `fdb-6_0`              | Support for FoundationDB 6.0.X                                                 |
+| `fdb-6_1`              | Support for FoundationDB 6.1.X                                                 |
+| `fdb-6_2`              | Support for FoundationDB 6.2.X                                                 |
+| `fdb-6_3`              | Support for FoundationDB 6.3.X                                                 |
+| `fdb-7_0`              | Support for FoundationDB 7.0.X                                                 |
+| `fdb-7_1`              | Support for FoundationDB 7.1.X                                                 |
+| `fdb-7_3`              | Support for FoundationDB 7.3.X                                                 |
+| `fdb-7_4`              | Support for FoundationDB 7.4.X                                                 |
+| `embedded-fdb-include` | Use the locally embedded FoundationDB fdb_c.h and fdb.options files to compile |
+| `uuid`                 | Support for the uuid crate for Tuples                                          |
+| `num-bigint`           | Support for the bigint crate for Tuples                                        |
+| `trace`                | Enable tracing on transaction related operations                               |
+
+### Hello, World using the crate
+
+We are going to use the Tokio runtime for this example:
+
+```rust
+use futures::prelude::*;
+
+#[tokio::main]
+async fn main() {
+    // Optional: creating a Database initializes the client automatically.
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+
+    // Have fun with the FDB API
+    hello_world().await.expect("could not run the hello world");
+
+    // The network is stopped automatically at process exit.
+}
+
+async fn hello_world() -> foundationdb::FdbResult<()> {
+    let db = foundationdb::Database::default()?;
+
+    // write a value in a retryable closure
+    match db
+        .run(|trx, _maybe_committed| async move {
+            trx.set(b"hello", b"world");
+            Ok::<_, foundationdb::FdbBindingError>(())
+        })
+        .await
+    {
+        Ok(_) => println!("transaction committed"),
+        Err(_) => eprintln!("cannot commit transaction"),
+    };
+
+    // read a value
+    match db
+        .run(|trx, _maybe_committed| async move { Ok::<_, foundationdb::FdbBindingError>(trx.get(b"hello", false).await.unwrap()) })
+        .await
+    {
+        Ok(slice) => assert_eq!(b"world", slice.unwrap().as_ref()),
+        Err(_) => eprintln!("cannot commit transaction"),
+    }
+
+    Ok(())
+}
+```
+
+## Additional notes
+
+### The class-scheduling tutorial
+
+The official FoundationDB's tutorial is called the [Class Scheduling](https://apple.github.io/foundationdb/class-scheduling.html). You can find the Rust version in the [examples](https://github.com/foundationdb-rs/foundationdb-rs/tree/main/foundationdb/examples).
+
+### The blob tutorial
+
+The official FoundationDB documentation provides also [another topic](https://apple.github.io/foundationdb/largeval.html#modeling-large-values)
+which is further discussed inside a [design recipe](https://apple.github.io/foundationdb/blob.html).
+A Rust implementation can be found [here](https://github.com/foundationdb-rs/foundationdb-rs/tree/main/foundationdb/examples/blob.rs).
+
+Another [example](https://github.com/foundationdb-rs/foundationdb-rs/tree/main/foundationdb/examples/blob-with-manifest.rs),
+explores how to use subspaces to attach metadata to our blob.
+
+### Must-read documentations
+
+* [Developer Guide](https://apple.github.io/foundationdb/developer-guide.html)
+* [Data Modeling Guide](https://apple.github.io/foundationdb/data-modeling.html)
+
+### Initialization
+
+The Client is initialized on first use: creating a `Database` starts the network automatically, like `fdb.open()` does in the official bindings. You can also initialize it explicitly with the safe and idempotent `foundationdb::boot` function. The network then runs until process exit, where it is stopped and joined automatically. See `foundationdb::api` for more configuration options of the Fdb Client.
+
+**Warning**: the automatic stop at process exit is meant for tests and short-lived tools. In a production application, prefer handling the network stop yourself: the network thread is the event loop driving every transaction, you may still have on-going operations at exit time, and you usually want a clean teardown. Finish or cancel your work, drop the `Database` handles, then call `foundationdb::api::stop_network()` (`foundationdb::api::disable_stop_on_exit()` additionally turns the exit hook into a no-op).
+
+###  Migration from 0.11 to 0.12
+
+The initialization of the foundationdb API is now safe and idempotent, and the network can no longer be stopped by dropping the boot guard (issues #132, #195). Previously you had to write:
+
+```rust,ignore
+// old, up to 0.11
+let network = unsafe { foundationdb::boot() };
+// do stuff
+drop(network);
+```
+
+Now this can be converted to:
+
+```rust
+foundationdb::boot().expect("failed to initialize FoundationDB");
+// do stuff; the network is stopped automatically at process exit
+```
+
+Calling `boot` is even optional if you create a `Database`. Tests no longer need to be serialized with `--test-threads=1`: every test can boot in any order, in parallel.
+
+### API stability
+
+_WARNING_ Until the 1.0 release of this library, the API may be in constant flux.
diff --git a/bindings/rust/foundationdb/build.rs b/bindings/rust/foundationdb/build.rs
new file mode 100644
index 00000000000..5fb37d7783b
--- /dev/null
+++ b/bindings/rust/foundationdb/build.rs
@@ -0,0 +1,18 @@
+extern crate foundationdb_gen;
+
+use std::env;
+use std::fs::File;
+use std::io::prelude::*;
+use std::path::PathBuf;
+
+fn main() {
+    let out_path = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR is undefined!"));
+    let options_file = out_path.join("options.rs");
+    let mut options = String::new();
+    foundationdb_gen::emit(&mut options).expect("couldn't emit options.rs code!");
+
+    File::create(options_file)
+        .expect("couldn't create options.rs!")
+        .write_all(options.as_bytes())
+        .expect("couldn't write options.rs!");
+}
diff --git a/bindings/rust/foundationdb/examples/README.md b/bindings/rust/foundationdb/examples/README.md
new file mode 100644
index 00000000000..601807dc57c
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/README.md
@@ -0,0 +1 @@
+See [tests](../tests/) for examples
diff --git a/bindings/rust/foundationdb/examples/atomic-op-counter.rs b/bindings/rust/foundationdb/examples/atomic-op-counter.rs
new file mode 100644
index 00000000000..c3d250ff7a4
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/atomic-op-counter.rs
@@ -0,0 +1,88 @@
+use byteorder::ByteOrder;
+use foundationdb::tuple::Subspace;
+use foundationdb::{Database, FdbBindingError, FdbResult, Transaction, options};
+
+#[tokio::main]
+async fn main() {
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+    let db = Database::new_compat(None)
+        .await
+        .expect("failed to get database");
+    db.set_option(options::DatabaseOption::TransactionTimeout(5000))
+        .expect("failed to set transaction timeout");
+    db.set_option(options::DatabaseOption::TransactionRetryLimit(3))
+        .expect("failed to set transaction retry limit");
+
+    let counter_key = Subspace::all().subspace(&"stats").pack(&"my_counter");
+
+    // write initial value
+    db.run(|trx, _maybe_committed| {
+        let counter_key = counter_key.clone();
+        async move {
+            increment(&trx, &counter_key, 1);
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await
+    .expect("could not commit");
+
+    // read counter
+    let v1 = db
+        .run(|trx, _maybe_committed| {
+            let counter_key = counter_key.clone();
+            async move {
+                let val = read_counter(&trx, &counter_key).await?;
+                Ok::<_, FdbBindingError>(val)
+            }
+        })
+        .await
+        .expect("could not read counter");
+    dbg!(v1);
+    assert!(v1 > 0);
+
+    // decrement
+    db.run(|trx, _maybe_committed| {
+        let counter_key = counter_key.clone();
+        async move {
+            increment(&trx, &counter_key, -1);
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await
+    .expect("could not commit");
+
+    let v2 = db
+        .run(|trx, _maybe_committed| {
+            let counter_key = counter_key.clone();
+            async move {
+                let val = read_counter(&trx, &counter_key).await?;
+                Ok::<_, FdbBindingError>(val)
+            }
+        })
+        .await
+        .expect("could not read counter");
+    dbg!(v2);
+    assert_eq!(v1 - 1, v2);
+}
+
+fn increment(trx: &Transaction, key: &[u8], incr: i64) {
+    // generate the right buffer for atomic_op
+    let mut buf = [0u8; 8];
+    byteorder::LE::write_i64(&mut buf, incr);
+
+    trx.atomic_op(key, &buf, options::MutationType::Add);
+}
+
+async fn read_counter(trx: &Transaction, key: &[u8]) -> FdbResult<i64> {
+    let raw_counter = trx.get(key, true).await?.expect("no value found");
+
+    let counter = byteorder::LE::read_i64(raw_counter.as_ref());
+    Ok(counter)
+}
diff --git a/bindings/rust/foundationdb/examples/blob-with-manifest.rs b/bindings/rust/foundationdb/examples/blob-with-manifest.rs
new file mode 100644
index 00000000000..c1ba06bfc47
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/blob-with-manifest.rs
@@ -0,0 +1,409 @@
+use bytesize::ByteSize;
+use foundationdb::tuple::{PackError, Subspace, pack, unpack};
+use foundationdb::{Database, FdbBindingError, RangeOption};
+use futures::TryStreamExt;
+use sha2::{Digest, Sha256};
+use std::fmt::{Display, Formatter};
+use std::fs::File;
+use std::io::{Cursor, Read, Seek, SeekFrom};
+use uuid::Uuid;
+
+///
+/// This example is  concrete using of [blob example](./blob.rs)
+///
+/// The goal of this example is to create a simple blob storage system
+///
+/// As we can't predict the size of data, we'll create a system of data involving
+/// a manifest and a bunch of chunk of data.
+///
+/// The genuine idea would be to create a simple key => value entry and to store every bytes
+/// into it.
+///
+/// For example:
+///  my_file => <data>
+///
+/// This way doesn't allow to append metadata.
+///
+/// Caution : This example can't handle file of more than 10 MB.
+///
+/// The idea is to split the key between a manifest and a data
+///
+/// A manifest can be represent as:
+///     uuid              : the unique identifier through database
+///     name              : the name of the data
+///     size              : size of total data
+///     chunk size        : max chunk size
+///     number of chunks  : number of chunks of total data
+///
+/// As foundation DB can only store binary data, we have to pack our manifest.
+///
+/// This can be done through a tuple of data.
+///
+/// The foundation DB packing API is clever enough to keep the type of each field.
+///
+/// The "/" materialize the foundation subspace separator you can see it as "\x02"
+///
+/// This manifest will be stored as
+///
+/// <uuid>/_manifest => <manifest_data>
+///
+/// Then each chunk of data
+///
+/// <uuid>/_data/0 => <chunk_data_0>
+/// <uuid>/_data/1 => <chunk_data_1>
+/// <uuid>/_data/2 => <chunk_data_2>
+/// <uuid>/_data/3 => <chunk_data_3>
+/// ...
+/// <uuid>/_data/n => <chunk_data_n>
+///
+/// To get data from database we have to gather all chunk of data associated to defined uuid,
+/// we have to scan the database using the subspace of the uuid.
+///
+/// As all data is contained inside the <uuid>/_data subspace.
+///
+/// We can range between <uuid>/_data/\x00 and <uuid>/_data/\xff
+///
+/// \x00 is the minimal value that can be stored in subspace
+/// \xff is the maximal value that can be stored in subspace
+///
+/// So
+///     \x00 <= 0 < \xff
+///     \x00 <= 1 < \xff
+///     \x00 <= 2 < \xff
+///     ...
+///     \x00 <= n < \xff
+///
+///
+/// Thus foundation DB will retrieve keys/values:
+///
+///     <uuid>/_data/0 => <chunk_data_0>
+///     <uuid>/_data/1 => <chunk_data_1>
+///     <uuid>/_data/2 => <chunk_data_2>
+///     <uuid>/_data/3 => <chunk_data_3>
+///     ...
+///     <uuid>/_data/n => <chunk_data_n>
+///
+/// If we accumulate each chunk data, we gather the original data.
+///
+/// Finally, we have to check the correctness of our data.
+///
+/// As we have stored the manifest in the <uuid>/_manifest subspace
+///
+/// We can get this key/value.
+///
+/// Unpack the manifest_data to the type tuple and finally recreate our manifest containing
+/// the hex digest.
+///
+/// We can compute the checksum of data from database and compare it to the manifest digest.
+///
+/// Workflow:
+///
+/// 0 - Create keyspace and cleanup previous one
+/// 1 - Load bytes from image
+/// 2 - Compute checksum of input data
+/// 3 - Write bytes to database
+/// 4 - Read bytes from database
+/// 5 - Compute checksum of output data and verify correctness
+async fn clear_subspace(db: &Database, subspaces: Vec<&Subspace>) {
+    db.run(|transaction, _| {
+        let subspaces = subspaces.clone();
+        async move {
+            for subspace in subspaces {
+                transaction.clear_subspace_range(subspace)
+            }
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await
+    .expect("Unable to commit transaction");
+}
+
+fn sha256_hex_digest<R: Read>(mut reader: R) -> String {
+    let mut context = Sha256::new();
+    let mut buffer = [0_u8; 1024];
+
+    loop {
+        let count = reader.read(&mut buffer).expect("Unable to read buffer");
+
+        if count == 0_usize {
+            break;
+        }
+        context.update(&buffer[..count]);
+    }
+
+    let digest = context.finalize();
+
+    data_encoding::HEXLOWER.encode(digest.as_ref())
+}
+
+fn load_bytes_from_file(path: &str) -> (Vec<u8>, String) {
+    let mut file = File::open(path).expect("Unable to open path");
+    let mut buffer = [0_u8; 1024];
+    let mut data = vec![];
+
+    loop {
+        let count = file.read(&mut buffer).expect("Unable to read from file");
+        if count == 0_usize {
+            break;
+        }
+        data.extend(&buffer[..count].to_vec())
+    }
+    file.seek(SeekFrom::Start(0))
+        .expect("Unable to rewind file cursor");
+
+    let digest = sha256_hex_digest(&mut file);
+    (data, digest)
+}
+
+static CHUNK_SIZE: usize = 1024;
+
+/// Write slice of data to database using given subspace
+async fn write_data(db: &Database, subspace: &Subspace, data: &Vec<u8>) {
+    if data.is_empty() {
+        return;
+    }
+
+    db.run(|transaction, _| async move {
+        transaction.set(subspace.bytes(), data.as_slice());
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("Unable to commit transaction");
+}
+
+/// Writes to database a slice of data chunked with to the given subspace
+/// If chunk size isn't provided **CHUNK_SIZE**
+async fn write_blob(
+    db: &Database,
+    subspace: &Subspace,
+    data: &[u8],
+    chunk_size: Option<usize>,
+) -> usize {
+    if data.is_empty() {
+        return 0;
+    }
+
+    db.run(|transaction, _| async move {
+        let chunk_size = chunk_size.unwrap_or(CHUNK_SIZE);
+
+        let mut chunk_number = 0;
+        data.chunks(chunk_size).for_each(|chunk| {
+            let start = chunk_number * chunk_size;
+            let end = start + chunk.len();
+
+            let key = subspace.pack(&(chunk_number));
+            transaction.set(&key, &data[start..end]);
+            chunk_number += 1;
+        });
+
+        Ok::<_, FdbBindingError>(chunk_number)
+    })
+    .await
+    .expect("Unable to commit transaction")
+}
+
+/// Read data from database
+async fn read_data(db: &Database, subspace: &Subspace) -> Option<Vec<u8>> {
+    db.run(|transaction, _| async move {
+        let get_result = transaction.get(subspace.bytes(), false).await?;
+        Ok::<_, FdbBindingError>(get_result.map(|data| data.to_vec()))
+    })
+    .await
+    .ok()
+    .flatten()
+}
+
+/// Gets data from database from the given subspace with specified key name.
+async fn read_blob(db: &Database, subspace: &Subspace) -> Vec<u8> {
+    db.run(|transaction, _| async move {
+        let range = RangeOption::from(subspace.range());
+        let mut data: Vec<u8> = vec![];
+        let mut stream = transaction.get_ranges_keyvalues(range, false);
+        while let Some(result) = stream.try_next().await? {
+            data.extend(result.value().iter());
+        }
+
+        Ok::<_, FdbBindingError>(data)
+    })
+    .await
+    .expect("Unable to read blob")
+}
+
+struct FileManifest {
+    name: String,
+    chunk_size: Option<usize>,
+    nb_chunks: usize,
+    digest: String,
+    size: usize,
+    uuid: Uuid,
+}
+
+impl FileManifest {
+    pub fn serialize(&self) -> Vec<u8> {
+        pack(&(
+            &self.name,
+            self.chunk_size,
+            self.nb_chunks,
+            &self.digest,
+            &self.size,
+            &self.uuid,
+        ))
+    }
+
+    pub fn try_deserialize(value: &[u8]) -> Result<Self, PackError> {
+        let (name, chunk_size, nb_chunks, digest, size, uuid): (
+            String,
+            Option<usize>,
+            usize,
+            String,
+            usize,
+            Uuid,
+        ) = unpack(value)?;
+
+        Ok(FileManifest {
+            name,
+            chunk_size,
+            nb_chunks,
+            digest,
+            size,
+            uuid,
+        })
+    }
+}
+
+impl Display for FileManifest {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "Manifest of data {}\n\t\tname: {}\n\t\tchecksum: {}\n\t\tsize: {}\n\t\tblock size: {}\n\t\tnumber of chunks: {}\n",
+            self.uuid,
+            self.name,
+            self.digest,
+            ByteSize(self.size as u64).display().si(),
+            ByteSize(self.chunk_size.unwrap_or(CHUNK_SIZE) as u64)
+                .display()
+                .si(),
+            self.nb_chunks
+        )
+    }
+}
+
+async fn populate_data(
+    db: &Database,
+    subspace: &Subspace,
+    file_names: &Vec<&str>,
+    chunk_sizes: &Vec<usize>,
+) -> Vec<Subspace> {
+    let mut files_subspace: Vec<Subspace> = vec![];
+
+    println!("--- Populate database");
+    for file_name in file_names {
+        println!("Writing file {file_name}");
+
+        let (data, digest) = load_bytes_from_file(file_name);
+
+        for chunk_size in chunk_sizes {
+            let uuid = Uuid::new_v4();
+
+            let subspace_file = subspace.subspace(&(uuid));
+            let subspace_data = subspace_file.subspace(&("_data"));
+            let subspace_manifest = subspace_file.subspace(&("_manifest"));
+
+            println!(
+                "\twith chunk of {}",
+                ByteSize(*chunk_size as u64).display().si()
+            );
+            let nb_chunks = write_blob(db, &subspace_data, &data, Some(*chunk_size)).await;
+
+            let manifest = FileManifest {
+                name: file_name.to_string(),
+                chunk_size: Some(*chunk_size),
+                nb_chunks,
+                digest: digest.clone(),
+                size: data.len(),
+                uuid,
+            }
+            .serialize();
+            write_data(db, &subspace_manifest, &manifest).await;
+
+            files_subspace.push(subspace_file);
+        }
+
+        let uuid = Uuid::new_v4();
+        let subspace_file = subspace.subspace(&(uuid));
+        let subspace_data = subspace_file.subspace(&("_data"));
+        let subspace_manifest = subspace_file.subspace(&("_manifest"));
+
+        let nb_chunks = write_blob(db, &subspace_data, &data, None).await;
+        let manifest = FileManifest {
+            name: file_name.to_string(),
+            chunk_size: None,
+            nb_chunks,
+            digest: digest.clone(),
+            size: data.len(),
+            uuid,
+        }
+        .serialize();
+        write_data(db, &subspace_manifest, &manifest).await;
+    }
+
+    files_subspace
+}
+
+async fn check_data_stored(db: &Database, files_subspaces: Vec<Subspace>) {
+    println!("\n--- Checking data stored");
+    for file_subspace in files_subspaces {
+        let manifest_subspace = file_subspace.subspace(&("_manifest"));
+        let data_subspace = file_subspace.subspace(&("_data"));
+        let manifest_data = read_data(db, &manifest_subspace)
+            .await
+            .expect("Unable to get manifest");
+        let manifest = FileManifest::try_deserialize(&manifest_data)
+            .expect("Unable to deserialize manifest data");
+
+        let data_from_database = read_blob(db, &data_subspace).await;
+
+        let data_from_database = Cursor::new(data_from_database);
+        let digest_data_from_database = sha256_hex_digest(data_from_database);
+
+        println!("{manifest}");
+        assert_eq!(digest_data_from_database, manifest.digest);
+        println!(
+            "\t Verify data integrity:\n\t\tfrom database hex digest : {}\n\t\treference hex digest     : {}\n",
+            manifest.digest, digest_data_from_database
+        );
+    }
+}
+
+#[tokio::main]
+async fn main() {
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+    let db = Database::new_compat(None)
+        .await
+        .expect("Unable to create database");
+    db.set_option(foundationdb::options::DatabaseOption::TransactionTimeout(
+        5000,
+    ))
+    .expect("failed to set transaction timeout");
+    db.set_option(foundationdb::options::DatabaseOption::TransactionRetryLimit(3))
+        .expect("failed to set transaction retry limit");
+
+    // Create the subspace handling image data
+    let images_subspace = Subspace::all().subspace(&("images"));
+
+    clear_subspace(&db, vec![&images_subspace]).await;
+
+    // define matrix of tests
+    let file_names = vec!["./assets/logo-400x400.png"];
+    let chunk_sizes = vec![500, 512, 1000, 2000, 4000, 10000, 20000];
+
+    let files = populate_data(&db, &images_subspace, &file_names, &chunk_sizes).await;
+    check_data_stored(&db, files).await;
+}
diff --git a/bindings/rust/foundationdb/examples/blob.rs b/bindings/rust/foundationdb/examples/blob.rs
new file mode 100644
index 00000000000..b190398077d
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/blob.rs
@@ -0,0 +1,100 @@
+use foundationdb::tuple::Subspace;
+use foundationdb::{Database, FdbBindingError, RangeOption};
+use futures::TryStreamExt;
+use rand::RngExt;
+use rand::distr::Uniform;
+
+/// The goal of this example is to store blob data as chunk of 1kB
+/// Retrieve these data then verify correctness
+async fn clear_subspace(db: &Database, subspace: &Subspace) {
+    db.run(|trx, _maybe_committed| async move {
+        trx.clear_subspace_range(subspace);
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("Unable to commit transaction");
+}
+
+static CHUNK_SIZE: usize = 1024;
+async fn write_blob(db: &Database, subspace: &Subspace, data: &[u8]) {
+    db.run(|trx, _maybe_committed| async move {
+        let mut chunk_number = 0;
+        data.chunks(CHUNK_SIZE).for_each(|chunk| {
+            let start = chunk_number * CHUNK_SIZE;
+            let end = start + chunk.len();
+
+            let key = subspace.pack(&(start));
+            trx.set(&key, &data[start..end]);
+            chunk_number += 1;
+        });
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("Unable to commit transaction");
+}
+
+async fn read_blob(db: &Database, subspace: &Subspace) -> Vec<u8> {
+    db.run(|trx, _maybe_committed| async move {
+        let range = RangeOption::from(subspace.range());
+
+        let mut data: Vec<u8> = vec![];
+        let mut stream = trx.get_ranges_keyvalues(range, false);
+        while let Some(result) = stream.try_next().await? {
+            data.extend(result.value().iter());
+        }
+
+        Ok::<_, FdbBindingError>(data)
+    })
+    .await
+    .expect("Unable to read blob")
+}
+
+async fn test_blob_storing(db: &Database, subspace: &Subspace, iteration: usize) {
+    // Generate random 10k bytes
+    let data: Vec<u8> = rand::rng()
+        .sample_iter(Uniform::new_inclusive(0, 255).expect("Unable to create random generator"))
+        .map(|x| x as u8)
+        .take(10000)
+        .collect();
+
+    // Create a subspace for iteration
+    let subspace = subspace.subspace(&(iteration));
+
+    // Write data as chunk of 1024
+    write_blob(db, &subspace, &data).await;
+
+    // Read data
+    let result = read_blob(db, &subspace).await;
+
+    // Check correctness
+    assert_eq!(&data, &result);
+}
+
+#[tokio::main]
+async fn main() {
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+    let db = Database::new_compat(None)
+        .await
+        .expect("Unable to create database");
+    db.set_option(foundationdb::options::DatabaseOption::TransactionTimeout(
+        5000,
+    ))
+    .expect("failed to set transaction timeout");
+    db.set_option(foundationdb::options::DatabaseOption::TransactionRetryLimit(3))
+        .expect("failed to set transaction retry limit");
+
+    let subspace = Subspace::all().subspace(&("example-blob"));
+    clear_subspace(&db, &subspace).await;
+
+    for i in 1..=100 {
+        println!("Iteration #{i}");
+        test_blob_storing(&db, &subspace, i).await;
+    }
+}
diff --git a/bindings/rust/foundationdb/examples/budgeted_scan.rs b/bindings/rust/foundationdb/examples/budgeted_scan.rs
new file mode 100644
index 00000000000..7ffd5f76f03
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/budgeted_scan.rs
@@ -0,0 +1,260 @@
+//! Scanning a large range across several transactions, each one bounded by a
+//! [`ClientBudget`].
+//!
+//! FoundationDB transactions may not live longer than five seconds, so a scan
+//! that does not fit in one transaction has to be cut into pages, each page
+//! resuming where the previous one stopped. This example shows the pattern:
+//!
+//! * the closure sets a budget (2.5s, comfortably below the five second limit),
+//! * it reads batch after batch and checks the budget between batches,
+//! * when the budget is exhausted it *stops* instead of failing: the closure
+//!   returns the progress it made, and the transaction commits normally,
+//! * `main` reopens a transaction from the continuation key and keeps going
+//!   until the scan reports it reached the end of the range.
+//!
+//! There is deliberately no helper API for this: the budget is a client-side
+//! estimate you check where it makes sense for your workload, and what to do
+//! when it runs out (stop, commit partial work, checkpoint elsewhere) is an
+//! application decision.
+
+use std::time::{Duration, Instant};
+
+use foundationdb::options::StreamingMode;
+use foundationdb::*;
+use futures_util::TryStreamExt;
+
+/// Keys written by the setup, `PREFIX` .. `END`.
+const PREFIX: &[u8] = b"budgeted_scan/";
+const END: &[u8] = b"budgeted_scan0";
+
+/// Number of rows and value size of the data set. 4000 x 1 KiB is around 4 MiB,
+/// so a scan with a 1 MiB target per batch takes a handful of batches.
+const ROWS: usize = 4000;
+const VALUE_SIZE: usize = 1024;
+/// Rows written per setup transaction, to stay well below the 10 MiB
+/// transaction size limit.
+const ROWS_PER_SETUP_TRX: usize = 500;
+
+fn key_of(index: usize) -> Vec<u8> {
+    let mut key = PREFIX.to_vec();
+    key.extend_from_slice(format!("{index:08}").as_bytes());
+    key
+}
+
+/// What one budgeted transaction managed to do.
+struct Page {
+    /// Rows read by this transaction.
+    rows: usize,
+    /// Last key processed, or `None` if the page read nothing. The next
+    /// transaction resumes *after* it, with `first_greater_than`.
+    last_key: Option<Vec<u8>>,
+    /// `true` when the range was fully consumed, that is when the batch stream
+    /// ended on its own rather than the budget cutting it short.
+    complete: bool,
+}
+
+/// Scans from `after` (exclusive, `None` to start at the beginning of the
+/// range) for as long as `budget` allows.
+async fn scan_page(
+    db: &Database,
+    after: Option<Vec<u8>>,
+    budget: ClientBudget,
+) -> Result<Page, FdbBindingError> {
+    db.run(|trx, _maybe_committed| {
+        let after = after.clone();
+        let budget = budget.clone();
+        async move {
+            // Set the budget first: it starts a fresh accounting generation, and
+            // on a retry the new attempt gets the full allowance again.
+            trx.set_client_budget(budget);
+
+            let begin = match &after {
+                // Exclusive continuation: resume strictly after the last key we
+                // processed, so no row is read twice and none is skipped.
+                Some(last) => KeySelector::first_greater_than(last.as_slice()),
+                None => KeySelector::first_greater_or_equal(PREFIX),
+            };
+            let opt = RangeOption {
+                begin,
+                end: KeySelector::first_greater_or_equal(END),
+                // Serial asks the cluster for the largest batches it will send
+                // (around 80 KiB), which is what we want when the loop, not the
+                // batch size, is deciding when to stop. `target_bytes` is only
+                // an upper cap: it never grows a batch beyond what the mode
+                // asks for.
+                mode: StreamingMode::Serial,
+                target_bytes: 1 << 20,
+                ..RangeOption::default()
+            };
+
+            let mut rows = 0;
+            let mut last_key = None;
+            // The stream ending is the only proof the range is exhausted.
+            let mut complete = true;
+            let mut batches = trx.get_ranges(opt, false);
+
+            while let Some(batch) = batches.try_next().await? {
+                for kv in batch.iter() {
+                    rows += 1;
+                    last_key = Some(kv.key().to_vec());
+                }
+
+                // The budget is checked *between* batches, never inside one: the
+                // batch that was in flight when the budget expired still lands and
+                // is fully processed. Expect an overshoot of up to one batch, and
+                // in time, of however long that batch took to arrive: nothing here
+                // interrupts an await. Size the budget with that margin in mind
+                // (2.5s against a 5s transaction limit).
+                if let Err(exceeded) = trx.check_client_budget() {
+                    // Matched, not propagated with `?`. Returning the error would
+                    // abort the whole `db.run` and throw away both the work of
+                    // this page and the continuation key. Breaking instead lets
+                    // the closure return normally: the transaction commits and the
+                    // caller resumes from `last_key`.
+                    println!("    budget reached: {exceeded}");
+                    complete = false;
+                    break;
+                }
+            }
+
+            Ok::<_, FdbBindingError>(Page {
+                rows,
+                last_key,
+                complete,
+            })
+        }
+    })
+    .await
+}
+
+/// Runs the full scan, one transaction per page, and returns how many rows and
+/// how many transactions it took.
+async fn scan_all(db: &Database, budget: ClientBudget) -> Result<(usize, usize), FdbBindingError> {
+    let mut continuation = None;
+    let mut total_rows = 0;
+    let mut transactions = 0;
+
+    loop {
+        let page = scan_page(db, continuation.clone(), budget.clone()).await?;
+        transactions += 1;
+        total_rows += page.rows;
+        println!(
+            "  transaction {}: {} row(s), {} rows so far",
+            transactions, page.rows, total_rows
+        );
+
+        if page.complete {
+            break;
+        }
+        // A page cut short by the budget always has a continuation key, unless
+        // it read nothing at all, which means there was nothing left to read.
+        match page.last_key {
+            Some(last) => continuation = Some(last),
+            None => break,
+        }
+    }
+
+    Ok((total_rows, transactions))
+}
+
+async fn setup(db: &Database) -> Result<(), FdbBindingError> {
+    let value = vec![b'x'; VALUE_SIZE];
+
+    db.run(|trx, _| async move {
+        trx.clear_range(PREFIX, END);
+        Ok::<_, FdbBindingError>(())
+    })
+    .await?;
+
+    for chunk_start in (0..ROWS).step_by(ROWS_PER_SETUP_TRX) {
+        let value = value.clone();
+        db.run(move |trx, _| {
+            let value = value.clone();
+            async move {
+                for index in chunk_start..(chunk_start + ROWS_PER_SETUP_TRX).min(ROWS) {
+                    trx.set(&key_of(index), &value);
+                }
+                Ok::<_, FdbBindingError>(())
+            }
+        })
+        .await?;
+    }
+
+    Ok(())
+}
+
+async fn run_example() -> Result<(), FdbBindingError> {
+    let db = Database::default()?;
+
+    println!("Writing {ROWS} rows of {VALUE_SIZE} bytes...");
+    setup(&db).await?;
+
+    println!("Scanning with a 2.5s per-transaction budget:");
+    let started = Instant::now();
+    let (rows, transactions) = scan_all(
+        &db,
+        ClientBudget {
+            time_limit: Some(Duration::from_millis(2500)),
+            ..ClientBudget::default()
+        },
+    )
+    .await?;
+    println!(
+        "  {rows} row(s) in {transactions} transaction(s), {:?}",
+        started.elapsed()
+    );
+
+    // On a local cluster 4 MiB is read well within 2.5s, so the scan above ends
+    // in a single transaction. The same loop with a byte budget of half a
+    // mebibyte shows the continuation actually resuming, a few batches per
+    // transaction.
+    println!("Scanning again with a 512 KiB read budget, to force continuations:");
+    let (rows, transactions) = scan_all(
+        &db,
+        ClientBudget {
+            max_bytes_read: Some(512 * 1024),
+            ..ClientBudget::default()
+        },
+    )
+    .await?;
+    println!("  {rows} row(s) in {transactions} transaction(s)");
+
+    db.run(|trx, _| async move {
+        trx.clear_range(PREFIX, END);
+        Ok::<_, FdbBindingError>(())
+    })
+    .await?;
+
+    Ok(())
+}
+
+#[tokio::main]
+async fn main() {
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+
+    if let Err(e) = run_example().await {
+        eprintln!("Error: {e:?}");
+    }
+}
+
+/*
+// Expected output:
+//
+// Writing 4000 rows of 1024 bytes...
+// Scanning with a 2.5s per-transaction budget:
+//   transaction 1: 4000 row(s), 4000 rows so far
+//   4000 row(s) in 1 transaction(s), 12.147459ms
+// Scanning again with a 512 KiB read budget, to force continuations:
+//     budget reached: client budget exceeded (bytes read): used 549150 bytes, limit 524288 bytes. ...
+//   transaction 1: 525 row(s), 525 rows so far
+//   ...
+//   transaction 8: 325 row(s), 4000 rows so far
+//   4000 row(s) in 8 transaction(s)
+*/
diff --git a/bindings/rust/foundationdb/examples/class-scheduling.rs b/bindings/rust/foundationdb/examples/class-scheduling.rs
new file mode 100644
index 00000000000..6c2891ba3e3
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/class-scheduling.rs
@@ -0,0 +1,408 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+#[macro_use]
+extern crate lazy_static;
+
+use std::borrow::Cow;
+use std::ops::Deref;
+use std::thread;
+
+use rand::rngs::ThreadRng;
+
+use rand::prelude::IndexedRandom;
+
+use foundationdb as fdb;
+use foundationdb::tuple::{Subspace, pack, unpack};
+use foundationdb::{
+    Database, FdbBindingError, FdbError, FdbResult, RangeOption, RetryableError, Transaction,
+};
+use futures::TryStreamExt;
+
+type Result<T> = std::result::Result<T, Error>;
+
+// The blessed layer-error pattern: one enum for the whole layer, carrying the
+// FdbError (and the retry loop's own FdbBindingError) as a source. The
+// `RetryableError` impl below makes `db.run` retry-transparent for wrapped
+// FdbErrors, and the caller gets this typed error back from `db.run`.
+#[derive(Debug)]
+enum Error {
+    NoRemainingSeats,
+    TooManyClasses,
+    Fdb(FdbError),
+    Binding(FdbBindingError),
+}
+
+impl std::fmt::Display for Error {
+    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+        match self {
+            Error::NoRemainingSeats => write!(f, "No remaining seats"),
+            Error::TooManyClasses => write!(f, "Too many classes"),
+            Error::Fdb(e) => write!(f, "FoundationDB error: {e}"),
+            Error::Binding(e) => write!(f, "Retry loop error: {e}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Error::Fdb(e) => Some(e),
+            Error::Binding(e) => Some(e),
+            Error::NoRemainingSeats | Error::TooManyClasses => None,
+        }
+    }
+}
+
+impl From<FdbError> for Error {
+    fn from(err: FdbError) -> Self {
+        Error::Fdb(err)
+    }
+}
+
+impl From<FdbBindingError> for Error {
+    fn from(err: FdbBindingError) -> Self {
+        Error::Binding(err)
+    }
+}
+
+// The default retry_decision walks source() and finds the wrapped FdbError.
+impl RetryableError for Error {}
+
+// Data model:
+// ("attends", student, class) = ""
+// ("class", class_name) = seatsLeft
+
+// Generate 1,620 classes like '9:00 chem for dummies'
+const LEVELS: &[&str] = &[
+    "intro",
+    "for dummies",
+    "remedial",
+    "101",
+    "201",
+    "301",
+    "mastery",
+    "lab",
+    "seminar",
+];
+
+const TYPES: &[&str] = &[
+    "chem", "bio", "cs", "geometry", "calc", "alg", "film", "music", "art", "dance",
+];
+
+const TIMES: &[&str] = &[
+    "2:00", "3:00", "4:00", "5:00", "6:00", "7:00", "8:00", "9:00", "10:00", "11:00", "12:00",
+    "13:00", "14:00", "15:00", "16:00", "17:00", "18:00", "19:00",
+];
+
+lazy_static! {
+    static ref ALL_CLASSES: Vec<String> = all_classes();
+}
+
+// TODO: make these tuples?
+fn all_classes() -> Vec<String> {
+    let mut class_names: Vec<String> = Vec::new();
+    for level in LEVELS {
+        for _type in TYPES {
+            for time in TIMES {
+                class_names.push(format!("{time} {_type} {level}"));
+            }
+        }
+    }
+
+    class_names
+}
+
+fn init_classes(trx: &Transaction, all_classes: &[String]) {
+    let class_subspace = Subspace::from("class");
+    for class in all_classes {
+        trx.set(&class_subspace.pack(class), &pack(&100_i64));
+    }
+}
+
+async fn init(db: &Database, all_classes: &[String]) {
+    db.run(|trx, _maybe_committed| async move {
+        trx.clear_subspace_range(&"attends".into());
+        trx.clear_subspace_range(&"class".into());
+        init_classes(&trx, all_classes);
+        Ok::<_, Error>(())
+    })
+    .await
+    .expect("failed to initialize data");
+}
+
+async fn get_available_classes(db: &Database) -> Vec<String> {
+    db.run(|trx, _maybe_committed| async move {
+        let range = RangeOption::from(&Subspace::from("class"));
+
+        let mut available_classes = Vec::<String>::new();
+        let mut stream = trx.get_ranges_keyvalues(range, false);
+        while let Some(key_value) = stream.try_next().await? {
+            let count: i64 = unpack(key_value.value()).expect("failed to decode count");
+
+            if count > 0 {
+                let class: String = unpack(key_value.key()).expect("failed to decode class");
+                available_classes.push(class);
+            }
+        }
+
+        Ok::<_, Error>(available_classes)
+    })
+    .await
+    .expect("failed to get classes")
+}
+
+async fn ditch_trx(trx: &Transaction, student: &str, class: &str) -> FdbResult<()> {
+    let attends_key = pack(&("attends", student, class));
+
+    // TODO: should get take an &Encode? current impl does encourage &[u8] reuse...
+    if trx.get(&attends_key, true).await?.is_none() {
+        return Ok(());
+    }
+
+    let class_key = pack(&("class", class));
+    let available_seats = trx
+        .get(&class_key, true)
+        .await?
+        .expect("class seats were not initialized");
+    let available_seats: i64 =
+        unpack::<i64>(available_seats.deref()).expect("failed to decode i64") + 1;
+
+    //println!("{} ditching class: {}", student, class);
+    trx.set(&class_key, &pack(&available_seats));
+    trx.clear(&attends_key);
+    Ok(())
+}
+
+async fn ditch(db: &Database, student: String, class: String) -> Result<()> {
+    db.run(move |trx, _maybe_committed| {
+        let student = student.clone();
+        let class = class.clone();
+        async move {
+            ditch_trx(&trx, &student, &class).await?;
+            Ok::<_, Error>(())
+        }
+    })
+    .await
+}
+
+async fn signup_trx(trx: &Transaction, student: &str, class: &str) -> Result<()> {
+    let attends_key = pack(&("attends", student, class));
+    if trx.get(&attends_key, true).await?.is_some() {
+        //println!("{} already taking class: {}", student, class);
+        return Ok(());
+    }
+
+    let class_key = pack(&("class", class));
+    let available_seats: i64 = unpack(
+        &trx.get(&class_key, true)
+            .await?
+            .expect("class seats were not initialized"),
+    )
+    .expect("failed to decode i64");
+
+    if available_seats <= 0 {
+        return Err(Error::NoRemainingSeats);
+    }
+
+    let attends_range = RangeOption::from(&("attends", &student).into());
+    let attends: Vec<_> = trx
+        .get_ranges_keyvalues(attends_range, false)
+        .try_collect()
+        .await?;
+    if attends.len() >= 5 {
+        return Err(Error::TooManyClasses);
+    }
+
+    //println!("{} taking class: {}", student, class);
+    trx.set(&class_key, &pack(&(available_seats - 1)));
+    trx.set(&attends_key, &pack(&""));
+
+    Ok(())
+}
+
+async fn signup(db: &Database, student: String, class: String) -> Result<()> {
+    db.run(move |trx, _maybe_committed| {
+        let student = student.clone();
+        let class = class.clone();
+        async move { signup_trx(&trx, &student, &class).await }
+    })
+    .await
+}
+
+async fn switch_classes(
+    db: &Database,
+    student_id: String,
+    old_class: String,
+    new_class: String,
+) -> Result<()> {
+    db.run(move |trx, _maybe_committed| {
+        let student_id = student_id.clone();
+        let old_class = old_class.clone();
+        let new_class = new_class.clone();
+        async move {
+            ditch_trx(&trx, &student_id, &old_class).await?;
+            signup_trx(&trx, &student_id, &new_class).await?;
+            Ok::<_, Error>(())
+        }
+    })
+    .await
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Mood {
+    Add,
+    Ditch,
+    Switch,
+}
+
+async fn perform_op(
+    db: &Database,
+    rng: &mut ThreadRng,
+    mood: Mood,
+    student_id: &str,
+    all_classes: &[String],
+    my_classes: &mut Vec<String>,
+) -> Result<()> {
+    match mood {
+        Mood::Add => {
+            let class = all_classes.choose(rng).unwrap();
+            signup(db, student_id.to_string(), class.to_string()).await?;
+            my_classes.push(class.to_string());
+        }
+        Mood::Ditch => {
+            let class = all_classes.choose(rng).unwrap();
+            ditch(db, student_id.to_string(), class.to_string()).await?;
+            my_classes.retain(|s| s != class);
+        }
+        Mood::Switch => {
+            let old_class = my_classes.choose(rng).unwrap().to_string();
+            let new_class = all_classes.choose(rng).unwrap();
+            switch_classes(
+                db,
+                student_id.to_string(),
+                old_class.to_string(),
+                new_class.to_string(),
+            )
+            .await?;
+            my_classes.retain(|s| s != &old_class);
+            my_classes.push(new_class.to_string());
+        }
+    }
+    Ok(())
+}
+
+async fn simulate_students(student_id: usize, num_ops: usize) {
+    let db = Database::new_compat(None)
+        .await
+        .expect("failed to get database");
+    db.set_option(fdb::options::DatabaseOption::TransactionTimeout(5000))
+        .expect("failed to set transaction timeout");
+    db.set_option(fdb::options::DatabaseOption::TransactionRetryLimit(3))
+        .expect("failed to set transaction retry limit");
+
+    let student_id = format!("s{student_id}");
+    let mut rng = rand::rng();
+
+    let mut available_classes = Cow::Borrowed(&*ALL_CLASSES);
+    let mut my_classes = Vec::<String>::new();
+
+    for _ in 0..num_ops {
+        let mut moods = Vec::<Mood>::new();
+
+        if !my_classes.is_empty() {
+            moods.push(Mood::Ditch);
+            moods.push(Mood::Switch);
+        }
+
+        if my_classes.len() < 5 {
+            moods.push(Mood::Add);
+        }
+
+        let mood = moods.choose(&mut rng).copied().unwrap();
+
+        // on errors we recheck for available classes
+        if perform_op(
+            &db,
+            &mut rng,
+            mood,
+            &student_id,
+            &available_classes,
+            &mut my_classes,
+        )
+        .await
+        .is_err()
+        {
+            println!("getting available classes");
+            available_classes = Cow::Owned(get_available_classes(&db).await);
+        }
+    }
+}
+
+async fn run_sim(db: &Database, students: usize, ops_per_student: usize) {
+    let mut threads: Vec<(usize, thread::JoinHandle<()>)> = Vec::with_capacity(students);
+    for i in 0..students {
+        // TODO: ClusterInner has a mutable pointer reference, if thread-safe, mark that trait as Sync, then we can clone DB here...
+        threads.push((
+            i,
+            thread::spawn(move || {
+                futures::executor::block_on(simulate_students(i, ops_per_student));
+            }),
+        ));
+    }
+
+    // explicitly join...
+    for (id, thread) in threads {
+        thread.join().expect("failed to join thread");
+
+        let student_id = format!("s{id}");
+        let student_id_clone = student_id.clone();
+
+        db.run(move |trx, _maybe_committed| {
+            let student_id_inner = student_id_clone.clone();
+            async move {
+                let attends_range = RangeOption::from(&("attends", &student_id_inner).into());
+                let mut stream = trx.get_ranges_keyvalues(attends_range, false);
+                while let Some(key_value) = stream.try_next().await? {
+                    let (_, s, class) =
+                        unpack::<(String, String, String)>(key_value.key()).unwrap();
+                    assert_eq!(student_id_inner, s);
+
+                    println!("{student_id_inner} is taking: {class}");
+                }
+                Ok::<_, Error>(())
+            }
+        })
+        .await
+        .expect("get_ranges_keyvalues failed");
+    }
+
+    println!("Ran {} transactions", students * ops_per_student);
+}
+
+#[tokio::main]
+async fn main() {
+    fdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+    let db = fdb::Database::new_compat(None)
+        .await
+        .expect("failed to get database");
+    db.set_option(fdb::options::DatabaseOption::TransactionTimeout(5000))
+        .expect("failed to set transaction timeout");
+    db.set_option(fdb::options::DatabaseOption::TransactionRetryLimit(3))
+        .expect("failed to set transaction retry limit");
+    init(&db, &ALL_CLASSES).await;
+    println!("Initialized");
+    run_sim(&db, 10, 10).await;
+}
diff --git a/bindings/rust/foundationdb/examples/conflict_reporting.rs b/bindings/rust/foundationdb/examples/conflict_reporting.rs
new file mode 100644
index 00000000000..47859d7efc8
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/conflict_reporting.rs
@@ -0,0 +1,200 @@
+//! This example demonstrates how to use custom [`RunnerHooks`] to observe
+//! the transaction retry loop lifecycle, including conflict reporting.
+//!
+//! It creates two transactions that conflict on the same key, showing
+//! the full hook lifecycle: commit error → conflicting keys → retry → success.
+//!
+//! The user hook is stacked with [`MetricsHooks`] in a tuple, so the same run
+//! also produces the per-attempt metrics report of `instrumented_run`.
+
+use foundationdb::options::TransactionOption;
+use foundationdb::runner::MetricsHooks;
+use foundationdb::*;
+use foundationdb_macros::cfg_api_versions;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+/// Prints the write conflict ranges the attempt accumulated, which is what the
+/// resolver will check other transactions against.
+///
+/// Before the commit these are an approximate superset when versionstamped keys
+/// are used: the versionstamp is only resolved at commit time.
+///
+/// The `\xff\xff/transaction/write_conflict_range/` special keyspace exists from
+/// API version 630, hence the two variants below.
+#[cfg_api_versions(min = 630)]
+async fn print_write_conflict_ranges(trx: &Transaction, attempt: usize) -> FdbResult<()> {
+    let ranges = trx.write_conflict_ranges().await?;
+    println!(
+        "  before_commit (attempt {attempt}): {} write conflict range(s)",
+        ranges.len()
+    );
+    for range in &ranges {
+        println!(
+            "    {:?} .. {:?}",
+            String::from_utf8_lossy(range.begin()),
+            String::from_utf8_lossy(range.end()),
+        );
+    }
+    Ok(())
+}
+
+#[cfg_api_versions(min = 510, max = 620)]
+async fn print_write_conflict_ranges(_trx: &Transaction, _attempt: usize) -> FdbResult<()> {
+    Ok(())
+}
+
+/// A simple hook implementation that prints each lifecycle event.
+struct PrintHooks;
+
+impl RunnerHooks for PrintHooks {
+    fn on_attempt_start(&self, _trx: &Transaction, attempt: usize) {
+        println!("  on_attempt_start: attempt {attempt}");
+    }
+
+    /// Last point where the transaction can be inspected inside the attempt:
+    /// the write conflict ranges are complete here, while `conflicting_keys`
+    /// below only tells what actually clashed, and only once the commit failed.
+    async fn before_commit(&self, trx: &Transaction, attempt: usize) -> FdbResult<()> {
+        print_write_conflict_ranges(trx, attempt).await
+    }
+
+    async fn on_commit_error(&self, err: &TransactionCommitError, attempt: usize) -> FdbResult<()> {
+        let keys = err.conflicting_keys().await?;
+        println!(
+            "  on_commit_error (attempt {attempt}): {} range(s)",
+            keys.len()
+        );
+        for range in &keys {
+            println!(
+                "    {:?} .. {:?}",
+                String::from_utf8_lossy(range.begin()),
+                String::from_utf8_lossy(range.end()),
+            );
+        }
+        Ok(())
+    }
+
+    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
+        println!("  on_hook_error (attempt {attempt}): {}", err.message());
+    }
+
+    fn on_closure_error(&self, err: &FdbError, attempt: usize) {
+        println!("  on_closure_error (attempt {attempt}): {}", err.message());
+    }
+
+    fn on_error_duration(&self, ms: u64, attempt: usize) {
+        println!("  on_error_duration (attempt {attempt}): {ms}ms");
+    }
+
+    fn on_commit_success(&self, _committed: &TransactionCommitted, ms: u64, attempt: usize) {
+        println!("  on_commit_success (attempt {attempt}): committed in {ms}ms");
+    }
+
+    fn on_retry(&self, attempt: usize) {
+        println!("  on_retry: attempt {attempt} is over");
+    }
+
+    fn on_complete(&self) {
+        println!("  on_complete");
+    }
+}
+
+#[tokio::main]
+async fn main() {
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+
+    if let Err(e) = run_example().await {
+        eprintln!("Error: {e:?}");
+    }
+}
+
+async fn run_example() -> Result<(), FdbBindingError> {
+    let db = Database::default()?;
+    let attempt = Arc::new(AtomicU64::new(0));
+
+    println!("Running transaction with PrintHooks (forcing a conflict)...");
+
+    // Both hooks observe the same run: the metrics ones fill the report, the
+    // printing ones comment on it. Callbacks fire left to right.
+    let metrics = TransactionMetrics::new();
+    let hooks = (MetricsHooks::new(&metrics), PrintHooks);
+
+    db.run_with_hooks(&hooks, |trx, _| {
+        let attempt = attempt.clone();
+        async move {
+            let current = attempt.fetch_add(1, Ordering::SeqCst);
+
+            // Enable conflict reporting
+            trx.set_option(TransactionOption::ReportConflictingKeys)?;
+
+            // Read a key to establish a read conflict range
+            let _ = trx.get(b"example_conflict_key", false).await?;
+
+            if current == 0 {
+                // On first attempt, have another transaction write to the same key
+                let db2 = Database::default()?;
+                let other = db2.create_trx()?;
+                other.set(b"example_conflict_key", b"sneaky_write");
+                other
+                    .commit()
+                    .await
+                    .map_err(|e| FdbBindingError::NonRetryableFdbError(FdbError::from(e)))?;
+                println!("  (injected conflicting write)");
+            }
+
+            trx.set(b"example_conflict_key", b"my_value");
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await?;
+
+    let report = metrics.get_metrics_data();
+    println!("Transaction succeeded after conflict!");
+    println!(
+        "{} attempt(s), {} conflict(s), total usage: {:?}",
+        report.attempts.len(),
+        report.transaction.conflict_count,
+        report.total_usage(),
+    );
+    for attempt in &report.attempts {
+        println!(
+            "  attempt {}: {:?}, {} conflicting range(s)",
+            attempt.index,
+            attempt.outcome,
+            attempt.conflicting_keys.ranges().len(),
+        );
+    }
+
+    Ok(())
+}
+
+/*
+// Expected output:
+//
+// Running transaction with PrintHooks (forcing a conflict)...
+//   on_attempt_start: attempt 0
+//   (injected conflicting write)
+//   before_commit (attempt 0): 1 write conflict range(s)
+//     "example_conflict_key" .. "example_conflict_key\0"
+//   on_commit_error (attempt 0): 1 range(s)
+//     "example_conflict_key" .. "example_conflict_key\0"
+//   on_error_duration (attempt 0): 0ms
+//   on_retry: attempt 0 is over
+//   on_attempt_start: attempt 1
+//   before_commit (attempt 1): 1 write conflict range(s)
+//     "example_conflict_key" .. "example_conflict_key\0"
+//   on_commit_success (attempt 1): committed in 1ms
+//   on_complete
+// Transaction succeeded after conflict!
+// 2 attempt(s), 1 conflict(s), total usage: UsageSnapshot { .. }
+//   attempt 0: Retried { cause: FdbError { error_code: 1020 } }, 1 conflicting range(s)
+//   attempt 1: Committed, 0 conflicting range(s)
+*/
diff --git a/bindings/rust/foundationdb/examples/hello-world.rs b/bindings/rust/foundationdb/examples/hello-world.rs
new file mode 100644
index 00000000000..641bc9252c4
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/hello-world.rs
@@ -0,0 +1,49 @@
+#[tokio::main]
+async fn main() {
+    // The FoundationDB client is initialized on first use, and the network is
+    // stopped and joined automatically at process exit, which is fine for tests
+    // and short-lived tools like this example. In a production application,
+    // prefer a clean teardown: the network thread is the event loop driving
+    // every transaction and you may still have on-going operations at exit time.
+    // Finish or cancel your work, drop the Database handles, then call
+    // `foundationdb::api::stop_network()` yourself (terminal: any FoundationDB
+    // use afterwards fails with error 2025).
+    hello_world().await.expect("could not run the hello world");
+}
+
+async fn hello_world() -> foundationdb::FdbResult<()> {
+    let db = foundationdb::Database::default()?;
+
+    // By default, the FoundationDB C API will retry indefinitely if it cannot reach the cluster
+    // or if DNS resolution fails. To prevent this, you can set a timeout or a retry limit on the
+    // database object.
+    db.set_option(foundationdb::options::DatabaseOption::TransactionTimeout(
+        5000,
+    ))?; // 5 seconds
+    db.set_option(foundationdb::options::DatabaseOption::TransactionRetryLimit(3))?;
+
+    // write a value in a retryable closure
+    match db
+        .run(|trx, _maybe_committed| async move {
+            trx.set(b"hello", b"world");
+            Ok::<_, foundationdb::FdbBindingError>(())
+        })
+        .await
+    {
+        Ok(_) => println!("transaction committed"),
+        Err(_) => eprintln!("cannot commit transaction"),
+    };
+
+    // read a value
+    match db
+        .run(|trx, _maybe_committed| async move {
+            Ok::<_, foundationdb::FdbBindingError>(trx.get(b"hello", false).await.unwrap())
+        })
+        .await
+    {
+        Ok(slice) => assert_eq!(b"world", slice.unwrap().as_ref()),
+        Err(_) => eprintln!("cannot commit transaction"),
+    }
+
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/examples/instrumented.rs b/bindings/rust/foundationdb/examples/instrumented.rs
new file mode 100644
index 00000000000..105d74b3505
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/instrumented.rs
@@ -0,0 +1,125 @@
+//! This example demonstrates how to use the `instrumented_run` method to execute
+//! a transaction and receive a detailed metrics report upon completion.
+//!
+//! The `instrumented_run` method is a powerful tool for monitoring and debugging
+//! transaction performance, as it provides precise counters for operations, byte
+//! counts for reads and writes, timing information, and support for custom metrics.
+
+use foundationdb::{Database, FdbBindingError};
+
+#[tokio::main]
+async fn main() {
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+
+    // Run the instrumented example
+    if let Err(e) = instrumented_example().await {
+        eprintln!("Error running instrumented example: {e:?}");
+    }
+}
+
+async fn instrumented_example() -> Result<(), FdbBindingError> {
+    let db = Database::default()?;
+
+    println!("Running an instrumented transaction...");
+
+    // Use `instrumented_run` to execute a transaction and get metrics.
+    let result = db
+        .instrumented_run(|txn, _| async move {
+            // Perform a few simple operations
+            txn.set(b"instrumented_key", b"instrumented_value");
+            let _ = txn.get(b"instrumented_key", false).await?;
+
+            // Register a custom metric directly on the transaction
+            txn.set_custom_metric("operations_count", 1, &[("type", "write")]);
+
+            Ok(())
+        })
+        .await;
+
+    // Handle the result and print the metrics report
+    match result {
+        Ok((_, metrics)) => {
+            println!("Transaction successful!");
+            println!("--- Metrics Report ---");
+            println!("{metrics:#?}");
+            println!("----------------------");
+        }
+        Err((err, metrics)) => {
+            eprintln!("Transaction failed: {err:?}");
+            eprintln!("--- Metrics Report (on failure) ---");
+            println!("{metrics:#?}");
+            println!("-----------------------------------");
+            return Err(err);
+        }
+    }
+
+    Ok(())
+}
+
+/*
+// Example output:
+
+Running an instrumented transaction...
+Transaction successful!
+--- Metrics Report ---
+MetricsReport {
+    attempts: [
+        AttemptMetrics {
+            index: 0,
+            usage: UsageSnapshot {
+                elapsed: 11.703552ms,
+                bytes_read: 34,
+                bytes_written: 34,
+                keys_values_fetched: 1,
+                call_get: 1,
+                call_get_range: 0,
+                call_set: 1,
+                call_clear: 0,
+                call_clear_range: 0,
+                call_atomic_op: 0,
+            },
+            custom_metrics: {
+                MetricKey {
+                    name: "operations_count",
+                    labels: [
+                        (
+                            "type",
+                            "write",
+                        ),
+                    ],
+                }: 1,
+            },
+            duration: Some(
+                11.701935ms,
+            ),
+            commit_duration: Some(
+                10.609832ms,
+            ),
+            grv_duration: None,
+            on_error_duration: None,
+            outcome: Committed,
+            conflicting_keys: NotRequested,
+            read_version: None,
+        },
+    ],
+    total_duration: Some(
+        11.726852ms,
+    ),
+    transaction: TransactionInfo {
+        retries: 0,
+        conflict_count: 0,
+        read_version: None,
+        commit_version: Some(
+            70442567195,
+        ),
+    },
+}
+----------------------
+*/
diff --git a/bindings/rust/foundationdb/examples/key_selectors.rs b/bindings/rust/foundationdb/examples/key_selectors.rs
new file mode 100644
index 00000000000..ce2f9672274
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/key_selectors.rs
@@ -0,0 +1,432 @@
+use std::collections::HashSet;
+
+use foundationdb::{Database, FdbError, KeySelector, RangeOption};
+use futures_util::TryStreamExt;
+
+// Helper function to insert some initial data: "a" through "z"
+async fn setup_db(db: &Database) -> Result<(), FdbError> {
+    let transaction_result: Result<(), FdbError> = db
+        .run(|trx, _maybe_committed| async move {
+            trx.clear_range(b"", b"\\xFF"); // Clear all existing keys
+            let keys_to_insert = vec![
+                "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p",
+                "q", "r", "s", "t", "u", "v", "w", "x", "y", "z",
+            ];
+            for key_str in keys_to_insert {
+                let key_bytes = key_str.as_bytes();
+                trx.set(key_bytes, key_bytes); // Using key as value for simplicity
+            }
+            Ok(())
+        })
+        .await
+        .map_err(|binding_err: foundationdb::FdbBindingError| {
+            eprintln!("FoundationDB Binding Error during setup_db: {binding_err:?}");
+            FdbError::from_code(2004) // client_invalid_operation
+        });
+
+    transaction_result
+}
+
+/**
+ * Helper function to run a range query test using KeySelectors.
+ * It fetches a range of keys and asserts them against the expected keys.
+ */
+async fn run_range_query_test<'a>(
+    db: &'a Database,
+    options: RangeOption<'a>,
+    expected_keys: Vec<&str>,
+) -> Result<(), FdbError> {
+    let query_result: Result<HashSet<String>, FdbError> = db
+        .run(move |trx, _maybe_committed| {
+            let options = options.clone(); // Clone options to move into async block
+            async move {
+                let mut results: HashSet<String> = HashSet::new();
+                let mut elements = trx.get_ranges_keyvalues(options, false);
+                while let Ok(Some(element)) = elements.try_next().await {
+                    // Collect keys for comparison
+                    results.insert(String::from_utf8_lossy(element.key()).to_string());
+                }
+                Ok(results)
+            }
+        })
+        .await
+        .map_err(|binding_err: foundationdb::FdbBindingError| {
+            eprintln!("FoundationDB Binding Error during run_range_query_test: {binding_err:?}");
+            FdbError::from_code(2004) // client_invalid_operation
+        });
+
+    let actual_keys_set = query_result?;
+
+    let expected = HashSet::from_iter(expected_keys.iter().map(|s| s.to_string()));
+
+    let difference = actual_keys_set.difference(&expected).collect::<Vec<_>>();
+    if !difference.is_empty() {
+        eprintln!("Expected keys: {expected_keys:?}");
+        eprintln!("Actual keys: {actual_keys_set:?}");
+        eprintln!("Difference: {difference:?}");
+        assert!(
+            difference.is_empty(),
+            "Expected {} keys, but got {}",
+            expected_keys.len(),
+            difference.len()
+        );
+    }
+
+    Ok(())
+}
+
+async fn key_selector_example(db: &Database) -> Result<(), FdbError> {
+    setup_db(db).await?;
+
+    // Selectors: first_greater_or_equal(b"a") to first_greater_than(b"h")
+    // Keys: a, b, c, d, ..., z
+    // Begin: first_greater_or_equal(b"a") -> resolves to "a"
+    // End: first_greater_than(b"h") -> resolves to "i"
+    // Range is ["a", "i") -> "a", "b", "c", "d", "e", "f", "g", "h"
+    println!(
+        "Running: FGOE(\"a\") to FGT(\"h\") -> expecting ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h']"
+    );
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::first_greater_or_equal(b"a"),
+            end: KeySelector::first_greater_than(b"h"),
+            ..Default::default()
+        },
+        vec!["a", "b", "c", "d", "e", "f", "g", "h"],
+    )
+    .await?;
+
+    // Original example: Get range ["b", "d") which means keys "b", "c"
+    // Keys: a, b, c, d, ..., z
+    // Begin: first_greater_or_equal(b"b") -> resolves to "b"
+    // End: first_greater_than(b"c") -> resolves to "d"
+    // Range is ["b", "d") -> "b", "c"
+    println!("Running: FGOE(\"b\") to FGT(\"c\") -> expecting ['b', 'c']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::first_greater_or_equal(b"b"),
+            end: KeySelector::first_greater_than(b"c"), // resolves to "d"
+            ..Default::default()
+        },
+        vec!["b", "c"],
+    )
+    .await?;
+
+    // Selectors: first_greater_or_equal (begin) and first_greater_or_equal (end)
+    // Begin: KeySelector::first_greater_or_equal(b"c") -> "c"
+    // End: KeySelector::first_greater_or_equal(b"f") -> "f"
+    // Range: ["c", "f") -> "c", "d", "e"
+    println!("Running: FGOE(\"c\") to FGOE(\"f\") -> expecting ['c', 'd', 'e']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::first_greater_or_equal(b"c"),
+            end: KeySelector::first_greater_or_equal(b"f"),
+            ..Default::default()
+        },
+        vec!["c", "d", "e"],
+    )
+    .await?;
+
+    // Selectors: first_greater_than (begin) and last_less_than (end)
+    // Begin: KeySelector::first_greater_than(b"b") -> "c"
+    // End: KeySelector::last_less_than(b"f") -> "e" (key is "e", range is exclusive at end)
+    // Range: ["c", "e") -> "c", "d"
+    println!("Running: FGT(\"b\") to LLT(\"f\") -> expecting ['c', 'd']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::first_greater_than(b"b"),
+            end: KeySelector::last_less_than(b"f"),
+            ..Default::default()
+        },
+        vec!["c", "d"],
+    )
+    .await?;
+
+    // Selectors: KeySelector::new for both begin and end, with various offsets
+    // Begin: KeySelector::new(b"a", true, 2) -> first_greater_or_equal("a") + 2 -> "c"
+    // End: KeySelector::new(b"g", false, 0) -> first_greater_than("g") + 0 -> "h"
+    // Range: ["c", "h") -> "c", "d", "e", "f", "g"
+    println!("Running: new(a,T,2) to new(g,F,0) -> expecting ['c', 'd', 'e', 'f', 'g']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::new(std::borrow::Cow::Borrowed(b"a"), true, 2),
+            end: KeySelector::new(std::borrow::Cow::Borrowed(b"g"), false, 0),
+            ..Default::default()
+        },
+        vec!["c", "d", "e", "f", "g"],
+    )
+    .await?;
+
+    // Selectors: KeySelector::new(b"a", true, 0) and KeySelector::new(b"g", false, -2)
+    // Begin: KeySelector::new(b"a", true, 0) -> FGOE("a") + 0 -> "a"
+    // End: KeySelector::new(b"g", false, -2) -> FGT("g") - 2 -> "h" - 2 -> "d"
+    // Range: ["a", "d") -> "a", "b", "c"
+    println!("Running: new(a,T,0) to new(g,F,-2) -> expecting ['a', 'b', 'c']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::new(std::borrow::Cow::Borrowed(b"a"), true, 0),
+            end: KeySelector::new(std::borrow::Cow::Borrowed(b"g"), false, -2),
+            ..Default::default()
+        },
+        vec!["a", "b", "c"],
+    )
+    .await?;
+
+    // Selectors resolve to the same key, resulting in an empty range
+    // Begin: KeySelector::first_greater_or_equal(b"d") -> "d"
+    // End: KeySelector::first_greater_than(b"c") -> "d" (equivalent to first_greater_or_equal(b"d"))
+    // Range: ["d", "d") -> empty
+    println!("Running: FGOE(\"d\") to FGT(\"c\") -> expecting []");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::first_greater_or_equal(b"d"),
+            end: KeySelector::first_greater_than(b"c"),
+            ..Default::default()
+        },
+        vec![],
+    )
+    .await?;
+
+    // Selectors: last_less_or_equal (begin) and first_greater_than (end)
+    // Begin: KeySelector::last_less_or_equal(b"c") -> "c"
+    // End: KeySelector::first_greater_than(b"f") -> "g"
+    // Range: ["c", "g") -> "c", "d", "e", "f"
+    println!("Running: LLOE(\"c\") to FGT(\"f\") -> expecting ['c', 'd', 'e', 'f']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::last_less_or_equal(b"c"),
+            end: KeySelector::first_greater_than(b"f"),
+            ..Default::default()
+        },
+        vec!["c", "d", "e", "f"],
+    )
+    .await?;
+
+    // Selectors: last_less_than (begin) and last_less_than (end)
+    // Begin: KeySelector::last_less_than(b"c") -> "b"
+    // End: KeySelector::last_less_than(b"f") -> "e"
+    // Range: ["b", "e") -> "b", "c", "d"
+    println!("Running: LLT(\"c\") to LLT(\"f\") -> expecting ['b', 'c', 'd']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::last_less_than(b"c"),
+            end: KeySelector::last_less_than(b"f"),
+            ..Default::default()
+        },
+        vec!["b", "c", "d"],
+    )
+    .await?;
+
+    // Selectors: last_less_than (begin) and last_less_or_equal (end)
+    // Begin: KeySelector::last_less_than(b"c") -> "b"
+    // End: KeySelector::last_less_or_equal(b"f") -> "f"
+    // Range: ["b", "f") -> "b", "c", "d", "e"
+    println!("Running: LLT(\"c\") to LLOE(\"f\") -> expecting ['b', 'c', 'd', 'e']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::last_less_than(b"c"),
+            end: KeySelector::last_less_or_equal(b"f"),
+            ..Default::default()
+        },
+        vec!["b", "c", "d", "e"],
+    )
+    .await?;
+
+    // Selectors: last_less_than (begin) and first_greater_than (end)
+    // Begin: KeySelector::last_less_than(b"c") -> "b"
+    // End: KeySelector::first_greater_than(b"f") -> "g"
+    // Range: ["b", "g") -> "b", "c", "d", "e", "f"
+    println!("Running: LLT(\"c\") to FGT(\"f\") -> expecting ['b', 'c', 'd', 'e', 'f']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::last_less_than(b"c"),
+            end: KeySelector::first_greater_than(b"f"),
+            ..Default::default()
+        },
+        vec!["b", "c", "d", "e", "f"],
+    )
+    .await?;
+
+    // Selectors: last_less_than (begin) and first_greater_or_equal (end)
+    // Begin: KeySelector::last_less_than(b"c") -> "b"
+    // End: KeySelector::first_greater_or_equal(b"f") -> "f"
+    // Range: ["b", "f") -> "b", "c", "d", "e"
+    println!("Running: LLT(\"c\") to FGOE(\"f\") -> expecting ['b', 'c', 'd', 'e']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::last_less_than(b"c"),
+            end: KeySelector::first_greater_or_equal(b"f"),
+            ..Default::default()
+        },
+        vec!["b", "c", "d", "e"],
+    )
+    .await?;
+
+    // Selectors: last_less_or_equal (begin) and last_less_than (end)
+    // Begin: KeySelector::last_less_or_equal(b"c") -> "c"
+    // End: KeySelector::last_less_than(b"f") -> "e"
+    // Range: ["c", "e") -> "c", "d"
+    println!("Running: LLOE(\"c\") to LLT(\"f\") -> expecting ['c', 'd']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::last_less_or_equal(b"c"),
+            end: KeySelector::last_less_than(b"f"),
+            ..Default::default()
+        },
+        vec!["c", "d"],
+    )
+    .await?;
+
+    // Selectors: last_less_or_equal (begin) and last_less_or_equal (end)
+    // Begin: KeySelector::last_less_or_equal(b"c") -> "c"
+    // End: KeySelector::last_less_or_equal(b"f") -> "f"
+    // Range: ["c", "f") -> "c", "d", "e"
+    println!("Running: LLOE(\"c\") to LLOE(\"f\") -> expecting ['c', 'd', 'e']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::last_less_or_equal(b"c"),
+            end: KeySelector::last_less_or_equal(b"f"),
+            ..Default::default()
+        },
+        vec!["c", "d", "e"],
+    )
+    .await?;
+
+    // Selectors: last_less_or_equal (begin) and first_greater_or_equal (end)
+    // Begin: KeySelector::last_less_or_equal(b"c") -> "c"
+    // End: KeySelector::first_greater_or_equal(b"f") -> "f"
+    // Range: ["c", "f") -> "c", "d", "e"
+    println!("Running: LLOE(\"c\") to FGOE(\"f\") -> expecting ['c', 'd', 'e']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::last_less_or_equal(b"c"),
+            end: KeySelector::first_greater_or_equal(b"f"),
+            ..Default::default()
+        },
+        vec!["c", "d", "e"],
+    )
+    .await?;
+
+    // Selectors: first_greater_than (begin) and last_less_or_equal (end)
+    // Begin: KeySelector::first_greater_than(b"c") -> "d"
+    // End: KeySelector::last_less_or_equal(b"f") -> "f"
+    // Range: ["d", "f") -> "d", "e"
+    println!("Running: FGT(\"c\") to LLOE(\"f\") -> expecting ['d', 'e']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::first_greater_than(b"c"),
+            end: KeySelector::last_less_or_equal(b"f"),
+            ..Default::default()
+        },
+        vec!["d", "e"],
+    )
+    .await?;
+
+    // Selectors: first_greater_than (begin) and first_greater_than (end)
+    // Begin: KeySelector::first_greater_than(b"c") -> "d"
+    // End: KeySelector::first_greater_than(b"f") -> "g"
+    // Range: ["d", "g") -> "d", "e", "f"
+    println!("Running: FGT(\"c\") to FGT(\"f\") -> expecting ['d', 'e', 'f']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::first_greater_than(b"c"),
+            end: KeySelector::first_greater_than(b"f"),
+            ..Default::default()
+        },
+        vec!["d", "e", "f"],
+    )
+    .await?;
+
+    // Selectors: first_greater_than (begin) and first_greater_or_equal (end)
+    // Begin: KeySelector::first_greater_than(b"c") -> "d"
+    // End: KeySelector::first_greater_or_equal(b"f") -> "f"
+    // Range: ["d", "f") -> "d", "e"
+    println!("Running: FGT(\"c\") to FGOE(\"f\") -> expecting ['d', 'e']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::first_greater_than(b"c"),
+            end: KeySelector::first_greater_or_equal(b"f"),
+            ..Default::default()
+        },
+        vec!["d", "e"],
+    )
+    .await?;
+
+    // Selectors: first_greater_or_equal (begin) and last_less_than (end)
+    // Begin: KeySelector::first_greater_or_equal(b"c") -> "c"
+    // End: KeySelector::last_less_than(b"f") -> "e"
+    // Range: ["c", "e") -> "c", "d"
+    println!("Running: FGOE(\"c\") to LLT(\"f\") -> expecting ['c', 'd']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::first_greater_or_equal(b"c"),
+            end: KeySelector::last_less_than(b"f"),
+            ..Default::default()
+        },
+        vec!["c", "d"],
+    )
+    .await?;
+
+    // Selectors: first_greater_or_equal (begin) and last_less_or_equal (end)
+    // Begin: KeySelector::first_greater_or_equal(b"c") -> "c"
+    // End: KeySelector::last_less_or_equal(b"f") -> "f"
+    // Range: ["c", "f") -> "c", "d", "e"
+    println!("Running: FGOE(\"c\") to LLOE(\"f\") -> expecting ['c', 'd', 'e']");
+    run_range_query_test(
+        db,
+        RangeOption {
+            begin: KeySelector::first_greater_or_equal(b"c"),
+            end: KeySelector::last_less_or_equal(b"f"),
+            ..Default::default()
+        },
+        vec!["c", "d", "e"],
+    )
+    .await?;
+
+    println!("All key selector examples ran successfully!");
+    Ok(())
+}
+
+#[tokio::main]
+async fn main() {
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+
+    match Database::default() {
+        Ok(db) => {
+            if let Err(e) = key_selector_example(&db).await {
+                eprintln!("Error in key_selector_example: {e:?}");
+                // Consider panic! or std::process::exit(1) for CI environments
+            }
+        }
+        Err(e) => {
+            eprintln!("Failed to open FDB database: {e:?}");
+            // Consider panic! or std::process::exit(1)
+        }
+    }
+}
diff --git a/bindings/rust/foundationdb/examples/micro-queue.rs b/bindings/rust/foundationdb/examples/micro-queue.rs
new file mode 100644
index 00000000000..d055cad9521
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/micro-queue.rs
@@ -0,0 +1,190 @@
+use core::fmt;
+use std::error;
+
+use foundationdb::{Database, FdbBindingError, RangeOption, future::FdbValue, tuple::Subspace};
+use futures::StreamExt;
+use rand::{Rng, rngs::SmallRng};
+
+/// Clears subspaces of a database.
+///
+/// # Errors
+///
+/// If client failed to commit transaction.
+async fn clear_subspace(db: &Database, subspace: &Subspace) -> Result<(), FdbBindingError> {
+    db.run(|trx, _| async move {
+        trx.clear_subspace_range(subspace);
+        Ok(())
+    })
+    .await
+}
+
+/// Error returned on attempt to insert an item in a [`MicroQueue`]
+/// which length is [`usize::MAX`].
+#[derive(Debug)]
+pub struct Overflow;
+
+impl fmt::Display for Overflow {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("queue is too long")
+    }
+}
+
+impl error::Error for Overflow {}
+
+/// First-in-first-out (FIFO) queue of UTF-8 strings, implemented as a layer on
+/// top of `FoundationDB`, after the [Java recipe](https://github.com/apple/foundationdb/blob/main/recipes/java-recipes/MicroQueue.java).
+pub struct MicroQueue {
+    db: Database,
+    queue: Subspace,
+    rng: SmallRng,
+}
+
+impl MicroQueue {
+    /// Creates a new, empty, queue in `prefix` [`Subspace`].
+    ///
+    /// # Errors
+    ///
+    /// * If client failed to clear `prefix` [`Subspace`]
+    pub async fn new(
+        db: Database,
+        prefix: impl Into<Vec<u8>> + Send + Sync + Unpin,
+    ) -> Result<Self, FdbBindingError> {
+        let queue = Subspace::from_bytes(prefix);
+        clear_subspace(&db, &queue).await?;
+        Ok(Self {
+            db,
+            queue,
+            rng: rand::make_rng(),
+        })
+    }
+
+    /// Get the last index in the queue.
+    ///
+    /// # Errors
+    ///
+    /// * If client failed to get [`FdbValues`](foundationdb::future::FdbValues)
+    ///   stored under `prefix` [`Subspace`].
+    /// * If client failed to commit transaction.
+    async fn last_index(&self) -> Result<usize, FdbBindingError> {
+        self.db
+            .run(|trx, _maybe_committed| async move {
+                Ok(trx
+                    .get_ranges_keyvalues(self.queue.range().into(), true)
+                    .count()
+                    .await)
+            })
+            .await
+    }
+
+    /// Add an element to the queue.
+    ///
+    /// # Errors
+    ///
+    /// * If client failed to get [`FdbValues`](foundationdb::future::FdbValues)
+    ///   stored under `prefix` [`Subspace`].
+    /// * If client failed to commit transaction.
+    /// * If the capacity of the queue is [`usize::MAX`].
+    pub async fn enqueue(&mut self, value: &str) -> Result<(), FdbBindingError> {
+        let index = self
+            .last_index()
+            .await?
+            .checked_add(1)
+            .ok_or_else(|| FdbBindingError::new_custom_error(Box::new(Overflow)))?;
+
+        let rands = {
+            // Create random seed to avoid conflicts.
+            let mut rands = [0_u8; 20];
+            self.rng.fill_bytes(&mut rands);
+            rands
+        };
+
+        let key = &self.queue.subspace(&(index, rands.as_slice()));
+
+        self.db
+            .run(|trx, _maybe_committed| async move {
+                trx.set(key.bytes(), value.as_bytes());
+                Ok(())
+            })
+            .await
+    }
+
+    /// Get the top element of the queue.
+    ///
+    /// # Errors
+    ///
+    /// * Upon failure to collect stream.
+    /// * If client failed to commit transaction.
+    async fn first_item(&self) -> Result<Option<FdbValue>, FdbBindingError> {
+        self.db
+            .run(|trx, _maybe_committed| async move {
+                trx.get_ranges_keyvalues(RangeOption::from(&self.queue).rev(), true)
+                    .next()
+                    .await
+                    .transpose()
+                    .map_err(Into::into)
+            })
+            .await
+    }
+
+    /// Remove the top element from the queue.
+    ///
+    /// # Errors
+    ///
+    /// * Upon failure to collect the stream of key values in `prefix` [`Subspace`].
+    /// * If client failed to commit transaction.
+    ///
+    /// # Panics
+    ///
+    /// * If value is corrupted (invalid UTF-8).
+    pub async fn dequeue(&mut self) -> Result<Option<String>, FdbBindingError> {
+        match self.first_item().await? {
+            None => Ok(None),
+            Some(fdb_value) => {
+                let key = fdb_value.key();
+                let value = std::str::from_utf8(fdb_value.value()).expect("valid UTF-8");
+                self.db
+                    .run(|trx, _maybe_committed| async move {
+                        trx.clear(key);
+                        Ok(Some(value.to_owned()))
+                    })
+                    .await
+            }
+        }
+    }
+}
+
+const LINE: [&str; 13] = [
+    "Alice", "Bob", "Carol", "Dave", "Eve", "Frank", "George", "Harry", "Ian", "Jack", "Liz",
+    "Mary", "Nathan",
+];
+
+#[tokio::main]
+async fn main() -> Result<(), FdbBindingError> {
+    // initialize FoundationDB Client API
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+
+    // attempt connection to FoundationDB
+    let db = Database::default()?;
+
+    // create a micro queue in `Q` subspace
+    let mut q = MicroQueue::new(db, "Q").await?;
+
+    // push values at the back of the queue
+    for value in LINE {
+        q.enqueue(value).await?;
+    }
+
+    // pop values from the front of the queue
+    while let Some(value) = q.dequeue().await? {
+        println!("{value}");
+    }
+
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/examples/multi_version.rs b/bindings/rust/foundationdb/examples/multi_version.rs
new file mode 100644
index 00000000000..0e396f8392d
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/multi_version.rs
@@ -0,0 +1,101 @@
+use byteorder::ByteOrder;
+use foundationdb::api::FdbApiBuilder;
+use foundationdb::options::NetworkOption;
+use foundationdb::tuple::Subspace;
+use foundationdb::{Database, FdbBindingError, options};
+
+/// This example demonstrate usage of multi_version compatibility client.
+///
+/// While you still need to compile the crate with a specific FoundationDB library version,
+/// it allows you to connect to a cluster with a different API version. Be aware that using
+/// this feature might lead to divergent behaviors.
+///
+/// Ref: https://apple.github.io/foundationdb/api-general.html#multi-version-client-api
+const NETWORK_OPTION_EXTERNAL_CLIENT_DIRECTORY: &str =
+    "FDB_NETWORK_OPTION_EXTERNAL_CLIENT_DIRECTORY";
+
+#[tokio::main]
+async fn main() {
+    let mut network_builder = FdbApiBuilder::default()
+        .build()
+        .expect("Failed to build API");
+    // You can either use FoundationDB network option through environment variables
+    // or through network options in code.
+    // directory specified should contain at least one libfdb.so
+    if std::env::var(NETWORK_OPTION_EXTERNAL_CLIENT_DIRECTORY).is_err() {
+        network_builder = network_builder
+            .set_option(NetworkOption::ExternalClientDirectory(
+                "/usr/lib/foundationdb/".to_string(),
+            ))
+            .expect("Failed to add external library directory");
+    }
+    network_builder.boot().expect("failed to start the network");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+
+    // You can replace `None` with an `Option` with the path to your `fdb.cluster` file
+    let db = Database::new_compat(None)
+        .await
+        .expect("failed to get database");
+    db.set_option(options::DatabaseOption::TransactionTimeout(5000))
+        .expect("failed to set transaction timeout");
+    db.set_option(options::DatabaseOption::TransactionRetryLimit(3))
+        .expect("failed to set transaction retry limit");
+
+    // used to catch the first cluster_version_changed error when using external clients
+    // when using external clients, it will throw cluster_version_changed for the first time establish the connection to
+    // the cluster. Thus, we catch it by doing a get version request to establish the connection
+    // The 3000ms timeout is a guard to avoid waiting forever when the cli cannot talk to any coordinators
+    let _ = db
+        .run(|trx, _| async move {
+            trx.set_option(options::TransactionOption::Timeout(3000))?;
+            let maybe_version = trx.get_read_version().await;
+
+            match maybe_version {
+                Ok(_) => Ok(()),
+                // 1039: cluster_version_changed
+                Err(err) if err.code() == 1039 => Err(FdbBindingError::from(err)),
+                Err(err) => Err(FdbBindingError::NonRetryableFdbError(err)),
+            }
+        })
+        .await;
+
+    let key = Subspace::all()
+        .subspace(&"examples")
+        .pack(&"multi_version_incr");
+
+    // increment or create key with "1"
+    db.run(|trx, _| {
+        let key = key.clone();
+        async move {
+            let mut buf = [0u8; 8];
+            byteorder::LE::write_i64(&mut buf, 1);
+            trx.atomic_op(&key, &buf, options::MutationType::Add);
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await
+    .expect("could not commit");
+
+    // read counter value
+    let raw_counter = db
+        .run(|trx, _| {
+            let key = key.clone();
+            async move {
+                let result = trx.get(&key, true).await?;
+                Ok::<_, FdbBindingError>(result)
+            }
+        })
+        .await
+        .expect("could not read key")
+        .expect("no value found");
+
+    let counter = byteorder::LE::read_i64(raw_counter.as_ref());
+    dbg!(counter);
+    assert!(counter > 0);
+}
diff --git a/bindings/rust/foundationdb/examples/simple-index.rs b/bindings/rust/foundationdb/examples/simple-index.rs
new file mode 100644
index 00000000000..61ba1516bd0
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/simple-index.rs
@@ -0,0 +1,220 @@
+use foundationdb::tuple::{Subspace, TuplePack, unpack};
+use foundationdb::{Database, FdbBindingError, FdbResult, RangeOption, Transaction};
+use futures::TryStreamExt;
+use std::fmt::{Display, Formatter};
+
+#[derive(Default)]
+struct User {
+    id: String,
+    name: String,
+    zipcode: String,
+}
+
+impl Display for User {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "id => '{}', zipcode => '{}', name => '{}'",
+            self.id, self.zipcode, self.name
+        )
+    }
+}
+
+/// Cleanup any data from previous run
+async fn clear_subspaces(db: &Database, subspaces: &[Subspace]) {
+    db.run(|trx, _maybe_committed| async move {
+        // teardown, clear data from previous run
+        for subspace in subspaces {
+            trx.clear_subspace_range(subspace);
+        }
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("Unable to commit transaction");
+}
+
+async fn create_user(
+    transaction: &Transaction,
+    id: &str,
+    zipcode: &str,
+    name: &str,
+    user_subspace: &Subspace,
+    zipcode_index_subspace: &Subspace,
+) {
+    let key = user_subspace.pack(&(id, zipcode));
+    let index = zipcode_index_subspace.pack(&(zipcode, id));
+
+    transaction.set(&key, &name.pack_to_vec());
+    transaction.set(&index, &[]);
+}
+
+async fn get_user(
+    user_subspace: &Subspace,
+    transaction: &Transaction,
+    user_id: &str,
+    zipcode: &str,
+) -> FdbResult<User> {
+    let key = user_subspace.pack(&(user_id, zipcode));
+
+    let user = transaction
+        .get(&key, false)
+        .await?
+        .expect("Could not found a row");
+
+    let name: String = unpack(&user).expect("Could not unpack");
+    Ok(User {
+        id: user_id.to_string(),
+        zipcode: zipcode.to_string(),
+        name,
+    })
+}
+
+async fn search_user_by_zipcode(
+    db: &Database,
+    user_subspace: &Subspace,
+    zipcode_index: &Subspace,
+    zipcode: &str,
+) -> Result<Vec<User>, FdbBindingError> {
+    db.run(|trx, _maybe_committed| async move {
+        // Create scanning zipcode index range
+        let begin = zipcode_index.pack(&(zipcode));
+
+        let mut end = zipcode_index.pack(&(zipcode));
+        end.pop();
+        end.push(255_u8);
+
+        let range = RangeOption::from((begin, end));
+
+        let mut users = vec![];
+        let mut stream = trx.get_ranges_keyvalues(range, false);
+        while let Some(result) = stream.try_next().await? {
+            let (zipcode, id): (String, String) = zipcode_index
+                .unpack(result.key())
+                .expect("Unable to unpack value from index");
+
+            let result_user = get_user(user_subspace, &trx, &id, &zipcode).await;
+
+            if let Ok(user) = result_user {
+                users.push(user);
+            }
+        }
+
+        Ok(users)
+    })
+    .await
+}
+
+#[tokio::main]
+async fn main() {
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+    let db = Database::new_compat(None)
+        .await
+        .expect("failed to get database");
+    db.set_option(foundationdb::options::DatabaseOption::TransactionTimeout(
+        5000,
+    ))
+    .expect("failed to set transaction timeout");
+    db.set_option(foundationdb::options::DatabaseOption::TransactionRetryLimit(3))
+        .expect("failed to set transaction retry limit");
+
+    let user_subspace = Subspace::from_bytes("user");
+    let zipcode_index_subspace = Subspace::from_bytes("zipcode_index");
+
+    clear_subspaces(
+        &db,
+        &[user_subspace.clone(), zipcode_index_subspace.clone()],
+    )
+    .await;
+
+    populate_users(&db, &user_subspace, &zipcode_index_subspace)
+        .await
+        .expect("Unable to populate database");
+
+    let users = search_user_by_zipcode(&db, &user_subspace, &zipcode_index_subspace, "205").await;
+
+    match users {
+        Ok(users) => users.iter().for_each(|user| println!("{user}")),
+        Err(e) => eprintln!("Error searching users: {e}"),
+    }
+}
+
+async fn populate_users(
+    db: &Database,
+    user_subspace: &Subspace,
+    zipcode_index_subspace: &Subspace,
+) -> Result<(), FdbBindingError> {
+    db.run(|trx, _maybe_committed| async move {
+        create_user(
+            &trx,
+            "001",
+            "20500",
+            "Barack",
+            user_subspace,
+            zipcode_index_subspace,
+        )
+        .await;
+        create_user(
+            &trx,
+            "002",
+            "20500",
+            "Michelle",
+            user_subspace,
+            zipcode_index_subspace,
+        )
+        .await;
+        create_user(
+            &trx,
+            "003",
+            "20500",
+            "Sasha",
+            user_subspace,
+            zipcode_index_subspace,
+        )
+        .await;
+        create_user(
+            &trx,
+            "004",
+            "20500",
+            "Malia",
+            user_subspace,
+            zipcode_index_subspace,
+        )
+        .await;
+        create_user(
+            &trx,
+            "005",
+            "20500",
+            "Bo",
+            user_subspace,
+            zipcode_index_subspace,
+        )
+        .await;
+        create_user(
+            &trx,
+            "101",
+            "SW1A 1AA",
+            "Elizabeth",
+            user_subspace,
+            zipcode_index_subspace,
+        )
+        .await;
+        create_user(
+            &trx,
+            "102",
+            "SW1A 1AA",
+            "Philip",
+            user_subspace,
+            zipcode_index_subspace,
+        )
+        .await;
+        Ok(())
+    })
+    .await
+}
diff --git a/bindings/rust/foundationdb/examples/versionstamp.rs b/bindings/rust/foundationdb/examples/versionstamp.rs
new file mode 100644
index 00000000000..4b7a3f87b48
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/versionstamp.rs
@@ -0,0 +1,148 @@
+use foundationdb::{
+    Database, FdbBindingError, FdbError, RangeOption, options,
+    tuple::{Subspace, Versionstamp, pack, pack_with_versionstamp, unpack},
+};
+use futures::StreamExt;
+
+#[tokio::main]
+async fn main() {
+    foundationdb::boot().expect("failed to initialize FoundationDB");
+    // The network is stopped and joined automatically at process exit, which is
+    // fine for tests and short-lived tools like this example. In a production
+    // application, prefer a clean teardown: the network thread is the event loop
+    // driving every transaction and you may still have on-going operations at
+    // exit time. Finish or cancel your work, drop the Database handles, then
+    // call `foundationdb::api::stop_network()` yourself (terminal: any
+    // FoundationDB use afterwards fails with error 2025).
+
+    run_versionstamp_key_example()
+        .await
+        .expect("failed to run versionstamp example");
+
+    run_versionstamp_value_example()
+        .await
+        .expect("failed to run versionstamp example");
+}
+
+async fn run_versionstamp_key_example() -> Result<(), FdbBindingError> {
+    println!("running example for setting versionstamped keys");
+    // Using versionstamps in order to create a sequential path.
+    let db = Database::default()?;
+    db.set_option(options::DatabaseOption::TransactionTimeout(5000))?;
+    db.set_option(options::DatabaseOption::TransactionRetryLimit(3))?;
+
+    let subspace = Subspace::all().subspace(&"versionstamp_example");
+    let (from, to) = subspace.range();
+    let trx_clear = db.create_trx()?;
+    trx_clear.clear_range(&from, &to);
+    trx_clear.commit().await.map_err(FdbError::from)?;
+
+    // Handles cloned from the runner transaction share one user-version allocator.
+    // Explicit Versionstamp::incomplete(42) remains supported, but can collide.
+    db.run(|trx, _| {
+        let subspace = subspace.clone();
+        async move {
+            let component_a = trx.clone();
+            let component_b = trx.clone();
+
+            // Allocate inside the retry closure because retries restart allocation at zero.
+            for (component, value) in [
+                (&component_a, "component_a_1"),
+                (&component_b, "component_b_1"),
+                (&component_a, "component_a_2"),
+            ] {
+                let versionstamp = Versionstamp::incomplete(component.allocate_user_version()?);
+                let key = subspace.pack_with_versionstamp(&("prefix", &versionstamp));
+                component.atomic_op(
+                    &key,
+                    &pack(&value),
+                    options::MutationType::SetVersionstampedKey,
+                );
+            }
+
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await?;
+
+    // The three keys share one 10-byte transaction version and have user versions 0, 1, and 2.
+
+    let trx = db.create_trx()?;
+    let range = RangeOption::from((from, to));
+    let mut kvs = trx.get_ranges_keyvalues(range, false);
+    while let Some(kv) = kvs.next().await {
+        let kv = kv?;
+        let (_, v) = subspace
+            .unpack::<(String, Versionstamp)>(kv.key())
+            .expect("failed to unpack key");
+        let value = unpack::<String>(kv.value()).expect("failed to unpack value");
+        println!(
+            "{:?} {}: {}",
+            v.transaction_version(),
+            v.user_version(),
+            value
+        );
+    }
+    Ok(())
+}
+
+async fn run_versionstamp_value_example() -> Result<(), FdbBindingError> {
+    println!("running example for setting versionstamped values");
+    // You can use versionstamps in values too, for example to point to a versionstamped key.
+    let db = Database::default()?;
+    db.set_option(options::DatabaseOption::TransactionTimeout(5000))?;
+    db.set_option(options::DatabaseOption::TransactionRetryLimit(3))?;
+
+    let subspace = Subspace::all().subspace(&"versionstamp_example");
+    let (from, to) = subspace.range();
+    let trx_clear = db.create_trx()?;
+    trx_clear.clear_range(&from, &to);
+    trx_clear.commit().await.map_err(FdbError::from)?;
+
+    // In our transaction we will create a versionstamped key, and then reference it in another
+    // known "index" key.
+    let index_key = subspace.pack(&"index");
+    db.run(|trx, _| {
+        let subspace = subspace.clone();
+        let index_key = index_key.clone();
+        async move {
+            // Reuse one allocated stamp for the data key and its index reference.
+            let versionstamp = Versionstamp::incomplete(trx.allocate_user_version()?);
+            let key_tuple = ("data", &versionstamp);
+            let key = subspace.pack_with_versionstamp(&key_tuple);
+
+            trx.atomic_op(
+                &key,
+                &pack(&"some value"),
+                options::MutationType::SetVersionstampedKey,
+            );
+            trx.atomic_op(
+                &index_key,
+                &pack_with_versionstamp(&key_tuple),
+                options::MutationType::SetVersionstampedValue,
+            );
+
+            Ok::<_, FdbBindingError>(())
+        }
+    })
+    .await?;
+
+    // Now we created our versionstamped key and a reference to it.
+    // We can read the index key and get the versionstamped key back.
+    let trx = db.create_trx()?;
+    let index_kv = trx
+        .get(&index_key, false)
+        .await?
+        .expect("didn't find index");
+    let versionstamped_key =
+        unpack::<(String, Versionstamp)>(&index_kv).expect("failed to unpack value");
+
+    // notice that we don't pack with versionstamp here because the versionstamp we received is complete.
+    let versionstamped_value = trx
+        .get(&subspace.pack(&versionstamped_key), false)
+        .await?
+        .expect("didn't find reference");
+    let value = unpack::<String>(&versionstamped_value).expect("failed to unpack value");
+    println!("got back value {value}");
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/src/api.rs b/bindings/rust/foundationdb/src/api.rs
new file mode 100644
index 00000000000..05f7f1e3742
--- /dev/null
+++ b/bindings/rust/foundationdb/src/api.rs
@@ -0,0 +1,507 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Configuration of foundationDB API and Network
+//!
+//! Provides a safe wrapper around the following C API calls:
+//!
+//! - [API versioning](https://apple.github.io/foundationdb/api-c.html#api-versioning)
+//! - [Network](https://apple.github.io/foundationdb/api-c.html#network)
+//!
+//! The network lifecycle is tracked by a process-global state machine
+//! (`Uninitialized -> ApiVersionSelected -> Running -> Stopped`). Booting is safe
+//! and idempotent, the network is started lazily by [`crate::Database`]
+//! constructors if needed, and it runs until process exit: an atexit hook stops it
+//! and joins the network thread, as required by the C API. Applications that
+//! manage their own shutdown can call [`disable_stop_on_exit`] and/or
+//! [`stop_network`].
+//!
+//! <div class="warning">
+//!
+//! The automatic stop at process exit is meant for tests and short-lived tools.
+//! In a production application, prefer a clean teardown: the network thread is
+//! the event loop driving every transaction and you may still have on-going
+//! operations at exit time. Finish or cancel your work, drop the
+//! [`crate::Database`] handles, then call [`stop_network`] yourself.
+//!
+//! </div>
+
+use std::io::Write;
+use std::sync::atomic::{AtomicBool, AtomicI32, Ordering};
+use std::sync::{Mutex, MutexGuard, PoisonError};
+use std::thread::JoinHandle;
+
+use crate::options::NetworkOption;
+use crate::{FdbError, FdbResult, error};
+use foundationdb_sys as fdb_sys;
+
+/// Returns the max api version of the underlying Fdb C API Client
+pub fn get_max_api_version() -> i32 {
+    unsafe { fdb_sys::fdb_get_max_api_version() }
+}
+
+// FDB C error codes used by the lifecycle state machine
+const ERR_API_VERSION_UNSET: i32 = 2200;
+const ERR_API_VERSION_ALREADY_SET: i32 = 2201;
+const ERR_API_VERSION_NOT_SUPPORTED: i32 = 2203;
+const ERR_NETWORK_ALREADY_SETUP: i32 = 2009;
+const ERR_NETWORK_CANNOT_BE_RESTARTED: i32 = 2025;
+
+/// Process-global lifecycle of the FoundationDB client.
+///
+/// The C API allows selecting the API version and setting up the network once per
+/// process, and the network can never be restarted once stopped. Every FFI call
+/// involved lives in exactly one transition below, serialized by the `NETWORK`
+/// mutex.
+enum NetworkLifecycle {
+    Uninitialized,
+    ApiVersionSelected {
+        api_version: i32,
+    },
+    Running {
+        api_version: i32,
+        handle: JoinHandle<()>,
+    },
+    Stopped {
+        api_version: i32,
+    },
+}
+
+static NETWORK: Mutex<NetworkLifecycle> = Mutex::new(NetworkLifecycle::Uninitialized);
+static STOP_ON_EXIT: AtomicBool = AtomicBool::new(true);
+// Last error returned by fdb_run_network (0 = none). An atomic, not a mutex: the
+// network thread must never take a lock shared with the thread joining it.
+static NETWORK_RUN_ERROR: AtomicI32 = AtomicI32::new(0);
+
+fn lock_network() -> MutexGuard<'static, NetworkLifecycle> {
+    // State is only mutated after the corresponding FFI call succeeded, so a
+    // poisoned lock still guards a consistent state. The one exception is a
+    // thread-spawn panic in start_network after fdb_setup_network succeeded
+    // (OS resource exhaustion): the state then stays ApiVersionSelected while
+    // the network is set up, and any retry fails with 2009. Deliberately not
+    // handled: nothing sensible can be done at that point.
+    NETWORK.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+impl NetworkLifecycle {
+    fn select_api_version(&mut self, version: i32) -> FdbResult<()> {
+        match self {
+            NetworkLifecycle::Uninitialized => {
+                error::eval(unsafe {
+                    fdb_sys::fdb_select_api_version_impl(version, fdb_sys::FDB_API_VERSION as i32)
+                })
+                .inspect_err(|e| {
+                    // generally means the local libfdb doesn't support the requested version
+                    if e.code() == ERR_API_VERSION_NOT_SUPPORTED {
+                        let max_api_version = get_max_api_version();
+                        if max_api_version < fdb_sys::FDB_API_VERSION as i32 {
+                            eprintln!(
+                                "The version of FoundationDB binding requested '{}' is not supported",
+                                fdb_sys::FDB_API_VERSION
+                            );
+                            eprintln!(
+                                "by the installed FoundationDB C library. Maximum supported version by the local library is {max_api_version}"
+                            );
+                        }
+                    }
+                })?;
+                *self = NetworkLifecycle::ApiVersionSelected {
+                    api_version: version,
+                };
+                Ok(())
+            }
+            NetworkLifecycle::ApiVersionSelected { api_version }
+            | NetworkLifecycle::Running { api_version, .. }
+            | NetworkLifecycle::Stopped { api_version } => {
+                if *api_version == version {
+                    Ok(())
+                } else {
+                    Err(FdbError::from_code(ERR_API_VERSION_ALREADY_SET))
+                }
+            }
+        }
+    }
+
+    fn set_network_option(&mut self, option: NetworkOption) -> FdbResult<()> {
+        match self {
+            // unreachable through the public API: a NetworkBuilder only exists once
+            // an api version is selected
+            NetworkLifecycle::Uninitialized => Err(FdbError::from_code(ERR_API_VERSION_UNSET)),
+            NetworkLifecycle::ApiVersionSelected { .. } => {
+                // SAFETY: the api version is selected and the network is not set up
+                // yet; calls are serialized by the NETWORK mutex.
+                unsafe { option.apply() }
+            }
+            NetworkLifecycle::Running { .. } => Err(FdbError::from_code(ERR_NETWORK_ALREADY_SETUP)),
+            NetworkLifecycle::Stopped { .. } => {
+                Err(FdbError::from_code(ERR_NETWORK_CANNOT_BE_RESTARTED))
+            }
+        }
+    }
+
+    fn start_network(&mut self) -> FdbResult<()> {
+        if matches!(self, NetworkLifecycle::Uninitialized) {
+            self.select_api_version(fdb_sys::FDB_API_VERSION as i32)?;
+        }
+        match self {
+            NetworkLifecycle::Uninitialized => unreachable!("the api version was just selected"),
+            NetworkLifecycle::ApiVersionSelected { api_version } => {
+                let api_version = *api_version;
+                error::eval(unsafe { fdb_sys::fdb_setup_network() })?;
+                // Registered once the network is set up, i.e. after libfdb_c was
+                // loaded: atexit handlers run in LIFO order, so ours stops and joins
+                // the network before any exit-time cleanup of the library itself.
+                if unsafe { libc::atexit(network_atexit_hook) } != 0 {
+                    eprintln!(
+                        "failed to register the FoundationDB atexit hook; the network will not be stopped automatically at process exit"
+                    );
+                }
+                let handle = std::thread::Builder::new()
+                    .name("fdb-network".to_string())
+                    .spawn(run_network_thread)
+                    .expect("failed to spawn the fdb-network thread");
+                *self = NetworkLifecycle::Running {
+                    api_version,
+                    handle,
+                };
+                Ok(())
+            }
+            NetworkLifecycle::Running { .. } => Ok(()),
+            NetworkLifecycle::Stopped { .. } => {
+                Err(FdbError::from_code(ERR_NETWORK_CANNOT_BE_RESTARTED))
+            }
+        }
+    }
+
+    fn stop_network(&mut self) -> FdbResult<()> {
+        match self {
+            NetworkLifecycle::Uninitialized => Ok(()),
+            NetworkLifecycle::ApiVersionSelected { api_version } => {
+                // Nothing is running, but an explicit stop must be terminal so that
+                // a later lazy boot cannot restart the network behind the caller's
+                // back.
+                *self = NetworkLifecycle::Stopped {
+                    api_version: *api_version,
+                };
+                Ok(())
+            }
+            NetworkLifecycle::Running { .. } => {
+                // Stop before taking the variant apart: on error the state stays
+                // Running, handle included.
+                error::eval(unsafe { fdb_sys::fdb_stop_network() })?;
+                let NetworkLifecycle::Running {
+                    api_version,
+                    handle,
+                } = std::mem::replace(self, NetworkLifecycle::Uninitialized)
+                else {
+                    unreachable!("state was just matched as Running");
+                };
+                if handle.join().is_err() {
+                    // run_network_thread cannot panic; keep the exit path panic-free
+                    // anyway (eprintln! panics if the stderr write fails).
+                    let _ = writeln!(std::io::stderr(), "the fdb-network thread panicked");
+                }
+                *self = NetworkLifecycle::Stopped { api_version };
+                Ok(())
+            }
+            NetworkLifecycle::Stopped { .. } => Ok(()),
+        }
+    }
+}
+
+/// Body of the "fdb-network" thread.
+///
+/// Invariant: this function must never lock `NETWORK`, as `stop_network` joins the
+/// thread while holding the lock.
+fn run_network_thread() {
+    if let Err(err) = error::eval(unsafe { fdb_sys::fdb_run_network() }) {
+        NETWORK_RUN_ERROR.store(err.code(), Ordering::Release);
+        let _ = writeln!(
+            std::io::stderr(),
+            "fdb_run_network returned an error: {err}"
+        );
+    }
+}
+
+/// Stops the network at process exit, as required by the C API contract.
+///
+/// Panic-free: unwinding out of an `extern "C"` function would abort with a less
+/// useful message.
+extern "C" fn network_atexit_hook() {
+    if !STOP_ON_EXIT.load(Ordering::Acquire) {
+        return;
+    }
+    if let Err(err) = lock_network().stop_network() {
+        // Exiting with the network still running is undefined behavior, aborting
+        // is not.
+        let _ = writeln!(
+            std::io::stderr(),
+            "failed to stop the FoundationDB network at exit: {err}"
+        );
+        std::process::abort();
+    }
+}
+
+/// Stops the FoundationDB network and joins the network thread.
+///
+/// This is terminal for the process: once it returns `Ok`, every FoundationDB
+/// operation fails with error 2025 (`network_cannot_be_restarted`), including in
+/// other threads. It is idempotent. One exception to terminality: if the client
+/// was never initialized at all (no boot, no API version selected, no `Database`
+/// created), the call is a plain no-op and a later boot still succeeds.
+///
+/// Tests and short-lived tools can simply rely on the automatic stop at process
+/// exit. In a production application, prefer calling this yourself as part of a
+/// clean shutdown sequence, once on-going operations are finished and the
+/// [`crate::Database`] handles are dropped.
+///
+/// Must not be called from the network thread itself (e.g. from a future
+/// callback), as it joins that thread.
+///
+/// # Examples
+///
+/// ```rust
+/// foundationdb::boot().expect("failed to initialize FoundationDB");
+/// // ... use FoundationDB ...
+/// foundationdb::api::stop_network().expect("failed to stop the network");
+/// // The stop is terminal: any use of FoundationDB now fails with error 2025.
+/// assert_eq!(foundationdb::boot().err().map(|e| e.code()), Some(2025));
+/// ```
+pub fn stop_network() -> FdbResult<()> {
+    lock_network().stop_network()
+}
+
+/// Disables the automatic network stop at process exit.
+///
+/// The atexit hook registered when the network starts becomes a no-op. Use it
+/// when your application owns its shutdown sequence and calls [`stop_network`]
+/// itself: the C API requires the network to be stopped and joined before a
+/// normal process exit.
+pub fn disable_stop_on_exit() {
+    STOP_ON_EXIT.store(false, Ordering::Release);
+}
+
+/// Returns the error reported by the network event loop, if it stopped with one.
+pub fn network_run_error() -> Option<FdbError> {
+    match NETWORK_RUN_ERROR.load(Ordering::Acquire) {
+        0 => None,
+        code => Some(FdbError::from_code(code)),
+    }
+}
+
+/// Starts the network with the default API version if nothing was booted yet.
+///
+/// Lazy-boot entry point used by `Database` constructors.
+pub(crate) fn ensure_network_started() -> FdbResult<()> {
+    lock_network().start_network()
+}
+
+/// A Builder with which different versions of the Fdb C API can be initialized
+///
+/// ```
+/// foundationdb::api::FdbApiBuilder::default().build().expect("fdb api initialized");
+/// ```
+pub struct FdbApiBuilder {
+    runtime_version: i32,
+}
+
+impl FdbApiBuilder {
+    /// The version of run-time behavior the API is requested to provide.
+    pub fn runtime_version(&self) -> i32 {
+        self.runtime_version
+    }
+
+    /// Set the version of run-time behavior the API is requested to provide.
+    ///
+    /// Must be less than or equal to header_version, `foundationdb_sys::FDB_API_VERSION`, and should almost always be equal.
+    /// Language bindings which themselves expose API versioning will usually pass the version requested by the application.
+    pub fn set_runtime_version(mut self, version: i32) -> Self {
+        self.runtime_version = version;
+        self
+    }
+
+    /// Selects the foundationDB API version and returns a `NetworkBuilder`.
+    ///
+    /// Idempotent: re-selecting the version already in use is a no-op.
+    ///
+    /// # Errors
+    ///
+    /// - error 2201 (`api_version_already_set`) if a different version was selected
+    ///   before
+    /// - error 2203 (`api_version_not_supported`) if the installed libfdb_c does
+    ///   not support the requested version
+    pub fn build(self) -> FdbResult<NetworkBuilder> {
+        lock_network().select_api_version(self.runtime_version)?;
+        Ok(NetworkBuilder { _private: () })
+    }
+}
+
+impl Default for FdbApiBuilder {
+    fn default() -> Self {
+        FdbApiBuilder {
+            runtime_version: fdb_sys::FDB_API_VERSION as i32,
+        }
+    }
+}
+
+/// A Builder to configure network options and start the network event loop.
+///
+/// ```
+/// use foundationdb::api::FdbApiBuilder;
+///
+/// let network_builder = FdbApiBuilder::default().build().expect("fdb api initialized");
+/// network_builder.boot().expect("fdb network running");
+/// ```
+pub struct NetworkBuilder {
+    _private: (),
+}
+
+impl NetworkBuilder {
+    /// Set network options.
+    ///
+    /// # Errors
+    ///
+    /// - error 2009 (`network_already_setup`) once the network is running
+    /// - error 2025 (`network_cannot_be_restarted`) once the network is stopped
+    pub fn set_option(self, option: NetworkOption) -> FdbResult<Self> {
+        lock_network().set_network_option(option)?;
+        Ok(self)
+    }
+
+    /// Starts the FoundationDB network event loop in a dedicated thread.
+    ///
+    /// Safe and idempotent: booting an already running network is a no-op. The
+    /// network runs until process exit, where an atexit hook stops it and joins the
+    /// network thread, or until an explicit [`stop_network`] call.
+    ///
+    /// # Errors
+    ///
+    /// - error 2025 (`network_cannot_be_restarted`) if the network was stopped
+    ///
+    /// # Examples
+    ///
+    /// ```rust
+    /// use foundationdb::api::FdbApiBuilder;
+    ///
+    /// let network_builder = FdbApiBuilder::default().build().expect("fdb api initialized");
+    /// network_builder.boot().expect("fdb network running");
+    /// // do some interesting things with the API...
+    /// ```
+    ///
+    /// ```rust
+    /// use foundationdb::api::FdbApiBuilder;
+    ///
+    /// #[tokio::main]
+    /// async fn main() {
+    ///     let network_builder = FdbApiBuilder::default().build().expect("fdb api initialized");
+    ///     network_builder.boot().expect("fdb network running");
+    ///     // do some interesting things with the API...
+    /// }
+    /// ```
+    pub fn boot(self) -> FdbResult<NetworkAutoStop> {
+        lock_network().start_network()?;
+        Ok(NetworkAutoStop { _private: () })
+    }
+}
+
+/// Kept for backward compatibility: dropping it does nothing.
+///
+/// The network runs until process exit (an atexit hook stops it and joins the
+/// network thread), or until an explicit [`stop_network`] call.
+pub struct NetworkAutoStop {
+    _private: (),
+}
+
+impl Drop for NetworkAutoStop {
+    fn drop(&mut self) {
+        // Intentionally inert: the network is stopped at process exit (or by an
+        // explicit stop_network()), never on guard drop. Stopping on drop would
+        // make any later use of FoundationDB in the process fail with error 2025.
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_max_api() {
+        assert!(get_max_api_version() > 0);
+    }
+
+    // Only exercises the FFI-free arms of the transition table, on locally
+    // constructed states: lib unit tests share one process, so they must neither
+    // touch the NETWORK static nor select a real api version.
+    #[test]
+    fn test_transition_table_ffi_free_arms() {
+        // ApiVersionSelected
+        let mut state = NetworkLifecycle::ApiVersionSelected { api_version: 710 };
+        state
+            .select_api_version(710)
+            .expect("same version must be idempotent");
+        assert_eq!(
+            state.select_api_version(620).unwrap_err().code(),
+            ERR_API_VERSION_ALREADY_SET
+        );
+        state.stop_network().expect("stop before start must be Ok");
+        assert!(matches!(
+            state,
+            NetworkLifecycle::Stopped { api_version: 710 }
+        ));
+
+        // Running (dummy finished thread; stop_network is never called on it)
+        let mut state = NetworkLifecycle::Running {
+            api_version: 710,
+            handle: std::thread::spawn(|| {}),
+        };
+        state
+            .start_network()
+            .expect("start while running must be idempotent");
+        assert_eq!(
+            state.select_api_version(620).unwrap_err().code(),
+            ERR_API_VERSION_ALREADY_SET
+        );
+        assert_eq!(
+            state
+                .set_network_option(NetworkOption::TraceEnable(String::new()))
+                .unwrap_err()
+                .code(),
+            ERR_NETWORK_ALREADY_SETUP
+        );
+
+        // Stopped is terminal
+        let mut state = NetworkLifecycle::Stopped { api_version: 710 };
+        assert_eq!(
+            state.start_network().unwrap_err().code(),
+            ERR_NETWORK_CANNOT_BE_RESTARTED
+        );
+        assert_eq!(
+            state
+                .set_network_option(NetworkOption::TraceEnable(String::new()))
+                .unwrap_err()
+                .code(),
+            ERR_NETWORK_CANNOT_BE_RESTARTED
+        );
+        state.stop_network().expect("stop must be idempotent");
+        state
+            .select_api_version(710)
+            .expect("re-selecting the same version stays Ok once stopped");
+
+        // Uninitialized
+        let mut state = NetworkLifecycle::Uninitialized;
+        state.stop_network().expect("stopping nothing must be Ok");
+        assert!(matches!(state, NetworkLifecycle::Uninitialized));
+        assert_eq!(
+            state
+                .set_network_option(NetworkOption::TraceEnable(String::new()))
+                .unwrap_err()
+                .code(),
+            ERR_API_VERSION_UNSET
+        );
+    }
+}
diff --git a/bindings/rust/foundationdb/src/budget.rs b/bindings/rust/foundationdb/src/budget.rs
new file mode 100644
index 00000000000..c0c96396130
--- /dev/null
+++ b/bindings/rust/foundationdb/src/budget.rs
@@ -0,0 +1,682 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Per-attempt usage accounting and the client-side budget.
+//!
+//! <div class="warning">
+//!
+//! The budget is a **client-side feature of this Rust binding**, not a native
+//! FoundationDB limit. Nothing here is enforced by the cluster: the binding
+//! counts the bytes and calls that go through [`Transaction`](crate::Transaction)
+//! and compares them with the configured limits when you ask it to, with
+//! [`Transaction::check_client_budget`](crate::Transaction::check_client_budget).
+//! The numbers are therefore an **estimate**, checked *between* operations:
+//! a single operation can overshoot a limit, and reads that are still in flight
+//! are not counted yet.
+//!
+//! It is fully decoupled from
+//! [`TransactionOption::Timeout`](crate::options::TransactionOption::Timeout) and
+//! [`TransactionOption::SizeLimit`](crate::options::TransactionOption::SizeLimit),
+//! which are enforced by the C client. Use those to bound what the database
+//! does; use the budget to bound what your own code does before it reaches
+//! them.
+//!
+//! </div>
+//!
+//! # Per-attempt semantics
+//!
+//! Accounting is always on and scoped to a single *transaction attempt*: usage
+//! is reset whenever the transaction restarts (`on_error`, `reset`), while the
+//! configured limits survive and apply to the new attempt. A retried
+//! transaction therefore gets a fresh time and byte allowance, exactly like it
+//! gets a fresh read version.
+//!
+//! # Determinism and simulation
+//!
+//! The byte and call counters are deterministic: they depend only on the
+//! operations your code issues. [`ClientBudget::time_limit`] is not, unless you
+//! say where time comes from: give the budget a [`Clock`] with
+//! [`ClientBudget::with_clock`] and every elapsed time of the attempt is
+//! measured with it. Under FoundationDB's deterministic simulator, pass a clock
+//! backed by simulated time so that a run replays identically.
+//!
+//! Without one the [`WallClock`] is used, which is the right default outside
+//! simulation but makes time budgets non-reproducible: do not rely on them in a
+//! simulated workload. See [`crate::env`] for the whole picture.
+
+use std::collections::HashMap;
+use std::fmt;
+use std::sync::Arc;
+use std::sync::Mutex;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::Duration;
+
+use crate::env::{Clock, WallClock};
+use crate::metrics::MetricKey;
+
+/// Client-side limits applied to a single transaction attempt.
+///
+/// Each field is optional, `None` meaning "no limit". A default `ClientBudget`
+/// limits nothing.
+///
+/// See the [module documentation](self): these limits are computed by the
+/// binding from what it observes, not enforced by FoundationDB.
+///
+/// # Example
+///
+/// ```
+/// # use foundationdb::*;
+/// # use std::time::Duration;
+/// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
+/// # let db = Database::default()?;
+/// let trx = db.create_trx()?;
+/// trx.set_client_budget(ClientBudget {
+///     time_limit: Some(Duration::from_secs(2)),
+///     max_bytes_read: Some(10 * 1024 * 1024),
+///     ..ClientBudget::default()
+/// });
+/// # Ok(())
+/// # }
+/// ```
+#[derive(Debug, Clone, Default)]
+pub struct ClientBudget {
+    /// Maximum time an attempt may spend, measured from the start of the attempt
+    /// with the [`clock`](Self::clock) of this budget.
+    pub time_limit: Option<Duration>,
+    /// Maximum number of bytes read by an attempt, keys and values summed.
+    pub max_bytes_read: Option<u64>,
+    /// Maximum number of bytes written by an attempt, keys, values and mutation
+    /// parameters summed.
+    pub max_bytes_written: Option<u64>,
+    /// Where [`time_limit`](Self::time_limit) reads time from, `None` meaning
+    /// the [`WallClock`].
+    ///
+    /// Set it with [`with_clock`](Self::with_clock) to keep time budgets
+    /// deterministic, see the [module documentation](self).
+    pub clock: Option<Arc<dyn Clock>>,
+}
+
+impl ClientBudget {
+    /// Measures the attempts with `clock` instead of the [`WallClock`].
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, clock))
+    )]
+    pub fn with_clock(self, clock: impl Clock + 'static) -> Self {
+        Self {
+            clock: Some(Arc::new(clock)),
+            ..self
+        }
+    }
+
+    /// Checks `usage` against these limits, returning the first exceeded one.
+    pub(crate) fn check(&self, usage: &AttemptUsage) -> Result<(), BudgetExceeded> {
+        if let Some(limit) = self.time_limit {
+            let used = usage.elapsed().as_millis() as u64;
+            let limit = limit.as_millis() as u64;
+            if used > limit {
+                return Err(BudgetExceeded {
+                    kind: BudgetKind::Time,
+                    used,
+                    limit,
+                });
+            }
+        }
+
+        if let Some(limit) = self.max_bytes_read {
+            let used = usage.bytes_read();
+            if used > limit {
+                return Err(BudgetExceeded {
+                    kind: BudgetKind::BytesRead,
+                    used,
+                    limit,
+                });
+            }
+        }
+
+        if let Some(limit) = self.max_bytes_written {
+            let used = usage.bytes_written();
+            if used > limit {
+                return Err(BudgetExceeded {
+                    kind: BudgetKind::BytesWritten,
+                    used,
+                    limit,
+                });
+            }
+        }
+
+        Ok(())
+    }
+}
+
+/// Which [`ClientBudget`] limit was exceeded.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BudgetKind {
+    /// [`ClientBudget::time_limit`], in milliseconds.
+    Time,
+    /// [`ClientBudget::max_bytes_read`], in bytes.
+    BytesRead,
+    /// [`ClientBudget::max_bytes_written`], in bytes.
+    BytesWritten,
+}
+
+impl fmt::Display for BudgetKind {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            BudgetKind::Time => write!(f, "time"),
+            BudgetKind::BytesRead => write!(f, "bytes read"),
+            BudgetKind::BytesWritten => write!(f, "bytes written"),
+        }
+    }
+}
+
+/// A [`ClientBudget`] limit was exceeded by the current transaction attempt.
+///
+/// `used` and `limit` are expressed in milliseconds for [`BudgetKind::Time`],
+/// in bytes otherwise.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct BudgetExceeded {
+    /// The limit that was exceeded.
+    pub kind: BudgetKind,
+    /// What the attempt used, milliseconds for [`BudgetKind::Time`], bytes
+    /// otherwise.
+    pub used: u64,
+    /// The configured limit, in the same unit as `used`.
+    pub limit: u64,
+}
+
+impl fmt::Display for BudgetExceeded {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let unit = match self.kind {
+            BudgetKind::Time => "ms",
+            BudgetKind::BytesRead | BudgetKind::BytesWritten => "bytes",
+        };
+        write!(
+            f,
+            "client budget exceeded ({}): used {} {}, limit {} {}. This is a client-side estimate of this binding, not a FoundationDB limit",
+            self.kind, self.used, unit, self.limit, unit
+        )
+    }
+}
+
+impl std::error::Error for BudgetExceeded {}
+
+/// Usage accounted for a single transaction attempt.
+///
+/// Counters are incremented by [`Transaction`](crate::Transaction) as
+/// operations are issued (writes) or resolved (reads). They are always on: no
+/// instrumentation is required to get them.
+///
+/// A new instance is created for every attempt, see the
+/// [module documentation](self).
+///
+/// The application metrics recorded with
+/// [`Transaction::set_custom_metric`](crate::Transaction::set_custom_metric) are
+/// stored here too, and are therefore per-attempt as well. Their map is
+/// allocated on first use, so a transaction that never records one pays
+/// nothing. Without a metrics consumer collecting them (typically
+/// [`Database::instrumented_run`](crate::Database::instrumented_run)), they are
+/// simply dropped with the generation.
+#[derive(Debug)]
+pub struct AttemptUsage {
+    /// Where the elapsed time of this attempt is measured.
+    clock: Arc<dyn Clock>,
+    /// The monotonic reading taken when the attempt started.
+    started_at: Duration,
+    bytes_read: AtomicU64,
+    bytes_written: AtomicU64,
+    keys_values_fetched: AtomicU64,
+    call_get: AtomicU64,
+    call_get_range: AtomicU64,
+    call_set: AtomicU64,
+    call_clear: AtomicU64,
+    call_clear_range: AtomicU64,
+    call_atomic_op: AtomicU64,
+    /// Application metrics of this attempt, allocated on first use.
+    custom: Mutex<Option<HashMap<MetricKey, u64>>>,
+}
+
+impl Default for AttemptUsage {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl AttemptUsage {
+    /// Starts a new, empty accounting generation, measured with the
+    /// [`WallClock`].
+    pub fn new() -> Self {
+        Self::with_clock(None)
+    }
+
+    /// Starts a new, empty accounting generation measured with `clock`, or with
+    /// the [`WallClock`] when it is `None`.
+    pub(crate) fn with_clock(clock: Option<Arc<dyn Clock>>) -> Self {
+        let clock = clock.unwrap_or_else(|| Arc::new(WallClock::new()));
+        Self {
+            started_at: clock.monotonic(),
+            clock,
+            bytes_read: AtomicU64::new(0),
+            bytes_written: AtomicU64::new(0),
+            keys_values_fetched: AtomicU64::new(0),
+            call_get: AtomicU64::new(0),
+            call_get_range: AtomicU64::new(0),
+            call_set: AtomicU64::new(0),
+            call_clear: AtomicU64::new(0),
+            call_clear_range: AtomicU64::new(0),
+            call_atomic_op: AtomicU64::new(0),
+            custom: Mutex::new(None),
+        }
+    }
+
+    /// Time elapsed since the attempt started, measured with the clock the
+    /// attempt was stamped with.
+    ///
+    /// A clock that goes backwards yields zero rather than panicking.
+    pub fn elapsed(&self) -> Duration {
+        self.clock.monotonic().saturating_sub(self.started_at)
+    }
+
+    /// Bytes read so far, keys and values summed.
+    pub fn bytes_read(&self) -> u64 {
+        self.bytes_read.load(Ordering::Relaxed)
+    }
+
+    /// Bytes written so far, keys, values and mutation parameters summed.
+    pub fn bytes_written(&self) -> u64 {
+        self.bytes_written.load(Ordering::Relaxed)
+    }
+
+    /// Takes a consistent-enough copy of every counter.
+    ///
+    /// Counters are read one after the other without a lock, so a snapshot
+    /// taken while operations are completing may mix values from slightly
+    /// different instants.
+    pub fn snapshot(&self) -> UsageSnapshot {
+        UsageSnapshot {
+            elapsed: self.elapsed(),
+            bytes_read: self.bytes_read.load(Ordering::Relaxed),
+            bytes_written: self.bytes_written.load(Ordering::Relaxed),
+            keys_values_fetched: self.keys_values_fetched.load(Ordering::Relaxed),
+            call_get: self.call_get.load(Ordering::Relaxed),
+            call_get_range: self.call_get_range.load(Ordering::Relaxed),
+            call_set: self.call_set.load(Ordering::Relaxed),
+            call_clear: self.call_clear.load(Ordering::Relaxed),
+            call_clear_range: self.call_clear_range.load(Ordering::Relaxed),
+            call_atomic_op: self.call_atomic_op.load(Ordering::Relaxed),
+        }
+    }
+
+    /// Records a resolved `get` or `get_key`.
+    pub(crate) fn record_get(&self, bytes: u64, keys_values: u64) {
+        self.bytes_read.fetch_add(bytes, Ordering::Relaxed);
+        self.keys_values_fetched
+            .fetch_add(keys_values, Ordering::Relaxed);
+        self.call_get.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Records a resolved `get_range` batch.
+    pub(crate) fn record_get_range(&self, bytes: u64, keys_values: u64) {
+        self.bytes_read.fetch_add(bytes, Ordering::Relaxed);
+        self.keys_values_fetched
+            .fetch_add(keys_values, Ordering::Relaxed);
+        self.call_get_range.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Records a `set`.
+    pub(crate) fn record_set(&self, bytes: u64) {
+        self.bytes_written.fetch_add(bytes, Ordering::Relaxed);
+        self.call_set.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Records a `clear`.
+    pub(crate) fn record_clear(&self, bytes: u64) {
+        self.bytes_written.fetch_add(bytes, Ordering::Relaxed);
+        self.call_clear.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Records a `clear_range`.
+    pub(crate) fn record_clear_range(&self, bytes: u64) {
+        self.bytes_written.fetch_add(bytes, Ordering::Relaxed);
+        self.call_clear_range.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Records an `atomic_op`.
+    pub(crate) fn record_atomic_op(&self, bytes: u64) {
+        self.bytes_written.fetch_add(bytes, Ordering::Relaxed);
+        self.call_atomic_op.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Sets an application metric of this attempt, replacing any previous value.
+    pub(crate) fn set_custom(&self, key: MetricKey, value: u64) {
+        self.with_custom(|custom| {
+            custom.insert(key, value);
+        });
+    }
+
+    /// Adds `amount` to an application metric of this attempt, starting from
+    /// zero if it was not recorded yet.
+    pub(crate) fn increment_custom(&self, key: MetricKey, amount: u64) {
+        self.with_custom(|custom| {
+            *custom.entry(key).or_insert(0) += amount;
+        });
+    }
+
+    /// The application metrics recorded during this attempt.
+    pub fn custom_metrics(&self) -> HashMap<MetricKey, u64> {
+        self.custom
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+            .clone()
+            .unwrap_or_default()
+    }
+
+    fn with_custom<R>(&self, f: impl FnOnce(&mut HashMap<MetricKey, u64>) -> R) -> R {
+        let mut custom = self
+            .custom
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        f(custom.get_or_insert_with(HashMap::new))
+    }
+}
+
+/// A copy of the counters of a single transaction attempt, taken by
+/// [`AttemptUsage::snapshot`] or
+/// [`Transaction::attempt_usage`](crate::Transaction::attempt_usage).
+///
+/// Every byte count is a client-side estimate, see the
+/// [module documentation](self).
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct UsageSnapshot {
+    /// Time elapsed since the attempt started.
+    pub elapsed: Duration,
+    /// Bytes read: for each resolved read, the key(s) requested plus the
+    /// key-values returned.
+    pub bytes_read: u64,
+    /// Bytes written: keys, values and mutation parameters handed to the
+    /// client. For `clear_range` only the two boundary keys are counted, **not**
+    /// the volume of data the range deletes.
+    pub bytes_written: u64,
+    /// Number of key-values returned by resolved reads.
+    pub keys_values_fetched: u64,
+    /// Number of `get` and `get_key` calls resolved.
+    pub call_get: u64,
+    /// Number of `get_range` batches resolved. A single `get_ranges` stream
+    /// counts once per underlying FoundationDB batch, not once per stream.
+    pub call_get_range: u64,
+    /// Number of `set` calls.
+    pub call_set: u64,
+    /// Number of `clear` calls.
+    pub call_clear: u64,
+    /// Number of `clear_range` calls.
+    pub call_clear_range: u64,
+    /// Number of `atomic_op` calls.
+    pub call_atomic_op: u64,
+}
+
+/// The accounting generation currently active on a transaction.
+///
+/// Operations clone the `Arc` out of the slot when they are **issued** and
+/// record into that clone when they complete. Starting a new attempt swaps the
+/// slot with a fresh [`AttemptUsage`] instead of zeroing the current one, so a
+/// read issued during attempt N that completes during attempt N+1 records into
+/// the counters of attempt N, which nobody reads anymore, and cannot pollute
+/// N+1.
+#[derive(Debug, Default)]
+pub(crate) struct UsageSlot(Mutex<Arc<AttemptUsage>>);
+
+impl UsageSlot {
+    /// The generation to record into for an operation issued now.
+    pub(crate) fn current(&self) -> Arc<AttemptUsage> {
+        self.0
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+            .clone()
+    }
+
+    /// Starts a fresh generation measured with `clock` (the [`WallClock`] when
+    /// `None`), leaving the previous one to the in-flight operations still
+    /// holding it.
+    pub(crate) fn begin(&self, clock: Option<Arc<dyn Clock>>) {
+        let mut slot = self
+            .0
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        *slot = Arc::new(AttemptUsage::with_clock(clock));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A clock the test moves by hand, in milliseconds.
+    #[derive(Debug, Clone, Default)]
+    struct FakeClock(Arc<AtomicU64>);
+
+    impl FakeClock {
+        fn set_millis(&self, millis: u64) {
+            self.0.store(millis, Ordering::Relaxed);
+        }
+    }
+
+    impl Clock for FakeClock {
+        fn monotonic(&self) -> Duration {
+            Duration::from_millis(self.0.load(Ordering::Relaxed))
+        }
+
+        fn wall(&self) -> Duration {
+            self.monotonic()
+        }
+    }
+
+    #[test]
+    fn budget_without_limits_never_fails() {
+        let usage = AttemptUsage::new();
+        usage.record_get(1_000_000, 10);
+        usage.record_set(1_000_000);
+
+        assert!(ClientBudget::default().check(&usage).is_ok());
+    }
+
+    #[test]
+    fn budget_allows_usage_up_to_the_limit() {
+        let budget = ClientBudget {
+            max_bytes_read: Some(10),
+            max_bytes_written: Some(10),
+            ..ClientBudget::default()
+        };
+
+        let usage = AttemptUsage::new();
+        usage.record_get(10, 1);
+        usage.record_set(10);
+
+        assert!(budget.check(&usage).is_ok());
+    }
+
+    #[test]
+    fn budget_reports_exceeded_bytes_read() {
+        let budget = ClientBudget {
+            max_bytes_read: Some(10),
+            ..ClientBudget::default()
+        };
+
+        let usage = AttemptUsage::new();
+        usage.record_get(7, 1);
+        assert!(budget.check(&usage).is_ok());
+        usage.record_get_range(5, 2);
+
+        let err = budget.check(&usage).unwrap_err();
+        assert_eq!(err.kind, BudgetKind::BytesRead);
+        assert_eq!(err.used, 12);
+        assert_eq!(err.limit, 10);
+        assert!(err.to_string().contains("client-side estimate"));
+    }
+
+    #[test]
+    fn budget_reports_exceeded_bytes_written() {
+        let budget = ClientBudget {
+            max_bytes_written: Some(4),
+            ..ClientBudget::default()
+        };
+
+        let usage = AttemptUsage::new();
+        usage.record_set(2);
+        usage.record_clear(1);
+        usage.record_clear_range(1);
+        assert!(budget.check(&usage).is_ok());
+        usage.record_atomic_op(1);
+
+        let err = budget.check(&usage).unwrap_err();
+        assert_eq!(err.kind, BudgetKind::BytesWritten);
+        assert_eq!(err.used, 5);
+        assert_eq!(err.limit, 4);
+    }
+
+    #[test]
+    fn budget_reports_exceeded_time() {
+        let clock = FakeClock::default();
+        clock.set_millis(1_000);
+
+        let budget = ClientBudget {
+            time_limit: Some(Duration::from_millis(20)),
+            ..ClientBudget::default()
+        }
+        .with_clock(clock.clone());
+
+        let usage = AttemptUsage::with_clock(budget.clock.clone());
+        clock.set_millis(1_020);
+        assert!(budget.check(&usage).is_ok(), "the limit itself is allowed");
+
+        clock.set_millis(1_035);
+
+        let err = budget.check(&usage).unwrap_err();
+        assert_eq!(err.kind, BudgetKind::Time);
+        assert_eq!(err.used, 35);
+        assert_eq!(err.limit, 20);
+        assert!(err.to_string().contains("client-side estimate"));
+    }
+
+    #[test]
+    fn elapsed_follows_a_custom_clock() {
+        let clock = FakeClock::default();
+        clock.set_millis(500);
+
+        let usage = AttemptUsage::with_clock(Some(Arc::new(clock.clone())));
+        assert_eq!(usage.elapsed(), Duration::ZERO);
+
+        clock.set_millis(700);
+        assert_eq!(usage.elapsed(), Duration::from_millis(200));
+        assert_eq!(usage.snapshot().elapsed, Duration::from_millis(200));
+    }
+
+    #[test]
+    fn a_clock_going_backwards_saturates_to_zero() {
+        let clock = FakeClock::default();
+        clock.set_millis(1_000);
+
+        let usage = AttemptUsage::with_clock(Some(Arc::new(clock.clone())));
+        clock.set_millis(10);
+
+        assert_eq!(usage.elapsed(), Duration::ZERO);
+    }
+
+    #[test]
+    fn a_new_generation_is_stamped_with_the_given_clock() {
+        let clock = FakeClock::default();
+        clock.set_millis(100);
+
+        let slot = UsageSlot::default();
+        let previous = slot.current();
+
+        slot.begin(Some(Arc::new(clock.clone())));
+        let current = slot.current();
+        clock.set_millis(160);
+
+        assert_eq!(current.elapsed(), Duration::from_millis(60));
+        // The previous generation keeps the wall clock it was stamped with.
+        assert!(previous.elapsed() < Duration::from_millis(60));
+    }
+
+    #[test]
+    fn snapshot_counts_every_operation() {
+        let usage = AttemptUsage::new();
+        usage.record_get(3, 1);
+        usage.record_get_range(7, 2);
+        usage.record_set(4);
+        usage.record_clear(5);
+        usage.record_clear_range(6);
+        usage.record_atomic_op(7);
+
+        let snapshot = usage.snapshot();
+        assert_eq!(snapshot.bytes_read, 10);
+        assert_eq!(snapshot.bytes_written, 22);
+        assert_eq!(snapshot.keys_values_fetched, 3);
+        assert_eq!(snapshot.call_get, 1);
+        assert_eq!(snapshot.call_get_range, 1);
+        assert_eq!(snapshot.call_set, 1);
+        assert_eq!(snapshot.call_clear, 1);
+        assert_eq!(snapshot.call_clear_range, 1);
+        assert_eq!(snapshot.call_atomic_op, 1);
+    }
+
+    #[test]
+    fn custom_metrics_are_scoped_to_the_generation() {
+        let slot = UsageSlot::default();
+        let key = MetricKey::new("documents", &[("kind", "user")]);
+
+        assert!(slot.current().custom_metrics().is_empty());
+
+        slot.current().set_custom(key.clone(), 2);
+        slot.current().increment_custom(key.clone(), 3);
+        assert_eq!(slot.current().custom_metrics().get(&key), Some(&5));
+
+        let previous = slot.current();
+        slot.begin(None);
+
+        assert!(slot.current().custom_metrics().is_empty());
+        assert_eq!(previous.custom_metrics().get(&key), Some(&5));
+    }
+
+    #[test]
+    fn a_new_generation_starts_empty() {
+        let slot = UsageSlot::default();
+        slot.current().record_set(42);
+        assert_eq!(slot.current().snapshot().bytes_written, 42);
+
+        slot.begin(None);
+
+        let snapshot = slot.current().snapshot();
+        assert_eq!(
+            UsageSnapshot {
+                elapsed: Duration::ZERO,
+                ..snapshot
+            },
+            UsageSnapshot::default()
+        );
+    }
+
+    #[test]
+    fn a_stale_generation_does_not_pollute_the_next_one() {
+        let slot = UsageSlot::default();
+
+        // An operation issued during the first attempt, still in flight.
+        let in_flight = slot.current();
+
+        slot.begin(None);
+        slot.current().record_get(10, 1);
+
+        // The stale operation completes and records into its own generation.
+        in_flight.record_get(999, 99);
+
+        let snapshot = slot.current().snapshot();
+        assert_eq!(snapshot.bytes_read, 10);
+        assert_eq!(snapshot.keys_values_fetched, 1);
+        assert_eq!(snapshot.call_get, 1);
+        assert_eq!(in_flight.snapshot().bytes_read, 999);
+    }
+}
diff --git a/bindings/rust/foundationdb/src/cluster.rs b/bindings/rust/foundationdb/src/cluster.rs
new file mode 100644
index 00000000000..5d9a64bf1d8
--- /dev/null
+++ b/bindings/rust/foundationdb/src/cluster.rs
@@ -0,0 +1,105 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Implementations of the FDBCluster C API
+//!
+//! https://apple.github.io/foundationdb/api-c.html#cluster
+
+use std::convert::TryFrom;
+use std::future::Future;
+use std::ptr::NonNull;
+use std::sync::Arc;
+
+use crate::future::*;
+use crate::{error, Database, FdbError, FdbResult};
+use foundationdb_sys as fdb_sys;
+
+/// An opaque type that represents a Cluster in the FoundationDB C API.
+#[derive(Clone)]
+pub struct Cluster {
+    inner: Arc<ClusterHandle>,
+}
+struct ClusterHandle(NonNull<fdb_sys::FDBCluster>);
+// The C API permits cross-thread use of cluster handles; Arc keeps the handle alive
+// until the last Cluster clone is dropped.
+unsafe impl Send for ClusterHandle {}
+unsafe impl Sync for ClusterHandle {}
+impl Drop for ClusterHandle {
+    fn drop(&mut self) {
+        unsafe {
+            fdb_sys::fdb_cluster_destroy(self.0.as_ptr());
+        }
+    }
+}
+
+impl Cluster {
+    pub fn new(
+        path: Option<&str>,
+    ) -> impl Future<Output = FdbResult<Cluster>> + Send + Sync + Unpin {
+        let path_str = path.map(|path| std::ffi::CString::new(path).unwrap());
+        let path_ptr = path_str
+            .as_ref()
+            .map(|path| path.as_ptr())
+            .unwrap_or(std::ptr::null());
+        let f = FdbFuture::new(unsafe { fdb_sys::fdb_create_cluster(path_ptr) });
+        drop(path_str);
+        f
+    }
+
+    /// Returns an FdbFuture which will be set to an FDBCluster object.
+    ///
+    /// # Arguments
+    ///
+    /// * `path` - A string giving a local path of a cluster file (often called ‘fdb.cluster’) which contains connection information for the FoundationDB cluster. See `foundationdb::default_config_path()`
+    ///
+    pub fn from_path(path: &str) -> impl Future<Output = FdbResult<Cluster>> + Send + Sync + Unpin {
+        Self::new(Some(path))
+    }
+
+    pub fn default() -> impl Future<Output = FdbResult<Cluster>> {
+        Self::new(None)
+    }
+
+    /// Returns an `FdbFuture` which will be set to an `Database` object.
+    pub fn create_database(
+        &self,
+    ) -> impl Future<Output = FdbResult<Database>> + Send + Sync + Unpin {
+        FdbFuture::new(unsafe {
+            fdb_sys::fdb_cluster_create_database(self.inner.0.as_ptr(), b"DB" as *const _, 2)
+        })
+    }
+}
+
+impl TryFrom<FdbFutureHandle> for Cluster {
+    type Error = FdbError;
+
+    fn try_from(f: FdbFutureHandle) -> FdbResult<Self> {
+        let mut v: *mut fdb_sys::FDBCluster = std::ptr::null_mut();
+        error::eval(unsafe { fdb_sys::fdb_future_get_cluster(f.as_ptr(), &mut v) })?;
+
+        Ok(Cluster {
+            inner: Arc::new(ClusterHandle(NonNull::new(v).expect(
+                "fdb_future_get_cluster to not return null if there is no error",
+            ))),
+        })
+    }
+}
+
+impl TryFrom<FdbFutureHandle> for Database {
+    type Error = FdbError;
+
+    fn try_from(f: FdbFutureHandle) -> FdbResult<Self> {
+        let mut v: *mut fdb_sys::FDBDatabase = std::ptr::null_mut();
+        error::eval(unsafe { fdb_sys::fdb_future_get_database(f.as_ptr(), &mut v) })?;
+
+        Ok(Database {
+            inner: NonNull::new(v)
+                .expect("fdb_future_get_database to not return null if there is no error"),
+        })
+    }
+}
diff --git a/bindings/rust/foundationdb/src/database.rs b/bindings/rust/foundationdb/src/database.rs
new file mode 100644
index 00000000000..25ab46d77d8
--- /dev/null
+++ b/bindings/rust/foundationdb/src/database.rs
@@ -0,0 +1,654 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Implementations of the FDBDatabase C API
+//!
+//! <https://apple.github.io/foundationdb/api-c.html#database>
+
+use std::convert::TryInto;
+use std::marker::PhantomData;
+use std::pin::Pin;
+use std::ptr::NonNull;
+use std::time::{Duration, Instant};
+
+use fdb_sys::if_cfg_api_versions;
+use foundationdb_macros::cfg_api_versions;
+use foundationdb_sys as fdb_sys;
+
+use crate::metrics::{MetricsReport, TransactionMetrics};
+use crate::options;
+use crate::runner::{MetricsHooks, RunnerHooks, TransactionRunner};
+use crate::transaction::*;
+use crate::{FdbError, FdbResult, error};
+
+use crate::error::RetryableError;
+use futures::prelude::*;
+
+/// Wrapper around the boolean representing whether the
+/// previous transaction is still on fly
+/// This wrapper prevents the boolean to be copy and force it
+/// to be moved instead.
+/// This pretty handy when you don't want to see the `Database::run` closure
+/// capturing the environment.
+pub struct MaybeCommitted(bool);
+
+impl MaybeCommitted {
+    pub(crate) fn new(maybe_committed: bool) -> Self {
+        Self(maybe_committed)
+    }
+}
+
+impl From<MaybeCommitted> for bool {
+    fn from(value: MaybeCommitted) -> Self {
+        value.0
+    }
+}
+
+/// Represents a FoundationDB database
+///
+/// A mutable, lexicographically ordered mapping from binary keys to binary values.
+///
+/// Modifications to a database are performed via transactions.
+pub struct Database {
+    pub(crate) inner: NonNull<fdb_sys::FDBDatabase>,
+}
+unsafe impl Send for Database {}
+unsafe impl Sync for Database {}
+impl Drop for Database {
+    fn drop(&mut self) {
+        unsafe {
+            fdb_sys::fdb_database_destroy(self.inner.as_ptr());
+        }
+    }
+}
+
+#[cfg_api_versions(min = 610)]
+impl Database {
+    /// Create a database for the given configuration path if any, or the default one.
+    ///
+    /// If the client was not initialized yet, the network is started with the
+    /// default API version, like [`crate::boot`] would.
+    pub fn new(path: Option<&str>) -> FdbResult<Database> {
+        crate::api::ensure_network_started()?;
+        let path_str =
+            path.map(|path| std::ffi::CString::new(path).expect("path to be convertible to CStr"));
+        let path_ptr = path_str
+            .as_ref()
+            .map(|path| path.as_ptr())
+            .unwrap_or(std::ptr::null());
+        let mut v: *mut fdb_sys::FDBDatabase = std::ptr::null_mut();
+        let err = unsafe { fdb_sys::fdb_create_database(path_ptr, &mut v) };
+        drop(path_str); // path_str own the CString that we are getting the ptr from
+        error::eval(err)?;
+        let ptr =
+            NonNull::new(v).expect("fdb_create_database to not return null if there is no error");
+        // Safe because the database is constructed in this scope and we know it's
+        // a valid pointer.
+        Ok(unsafe { Self::new_from_pointer(ptr) })
+    }
+
+    /// Create a new FDBDatabase from a raw pointer. Users are expected to use the `new` method.
+    ///
+    /// # Safety
+    ///
+    /// The caller must ensure that `ptr` is a valid pointer to an `FDBDatabase` object
+    /// obtained from the FoundationDB C API, and that the pointer is not aliased or used
+    /// after being passed to this function.
+    pub unsafe fn new_from_pointer(ptr: NonNull<fdb_sys::FDBDatabase>) -> Self {
+        Self { inner: ptr }
+    }
+
+    /// Create a database for the given configuration path
+    pub fn from_path(path: &str) -> FdbResult<Database> {
+        Self::new(Some(path))
+    }
+
+    /// Create a database for the default configuration path
+    #[allow(clippy::should_implement_trait)]
+    pub fn default() -> FdbResult<Database> {
+        Self::new(None)
+    }
+}
+
+#[cfg_api_versions(min = 730)]
+impl Database {
+    /// Retrieve a client-side status information in a JSON format.
+    pub fn get_client_status(
+        &self,
+    ) -> impl Future<Output = FdbResult<crate::future::FdbSlice>> + Send + Sync + Unpin + use<>
+    {
+        crate::future::FdbFuture::new(unsafe {
+            fdb_sys::fdb_database_get_client_status(self.inner.as_ptr())
+        })
+    }
+}
+
+impl Database {
+    /// Create a database for the given configuration path
+    ///
+    /// This is a compatibility api. If you only use API version ≥ 610 you should
+    /// use `Database::new`, `Database::from_path` or  `Database::default`.
+    pub async fn new_compat(path: Option<&str>) -> FdbResult<Database> {
+        crate::api::ensure_network_started()?;
+        if_cfg_api_versions!(min = 510, max = 600 => {
+            let cluster = crate::cluster::Cluster::new(path).await?;
+            let database = cluster.create_database().await?;
+            Ok(database)
+        } else {
+            Database::new(path)
+        })
+    }
+
+    /// Called to set an option an on `Database`.
+    pub fn set_option(&self, opt: options::DatabaseOption) -> FdbResult<()> {
+        unsafe { opt.apply(self.inner.as_ptr()) }
+    }
+
+    /// Creates a new transaction on the given database.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn create_trx(&self) -> FdbResult<Transaction> {
+        let mut trx: *mut fdb_sys::FDBTransaction = std::ptr::null_mut();
+        let err =
+            unsafe { fdb_sys::fdb_database_create_transaction(self.inner.as_ptr(), &mut trx) };
+        error::eval(err)?;
+        Ok(Transaction::new(NonNull::new(trx).expect(
+            "fdb_database_create_transaction to not return null if there is no error",
+        )))
+    }
+
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub(crate) fn create_retryable_trx(&self) -> FdbResult<RetryableTransaction> {
+        Ok(RetryableTransaction::new(self.create_trx()?))
+    }
+
+    /// `transact` returns a future which retries on error. It tries to resolve a future created by
+    /// caller-provided function `f` inside a retry loop, providing it with a newly created
+    /// transaction. After caller-provided future resolves, the transaction will be committed
+    /// automatically.
+    ///
+    /// # Warning: Hanging on Network/DNS failures
+    ///
+    /// By default, the FoundationDB C API will retry indefinitely if it cannot reach the cluster
+    /// or if DNS resolution fails. This can cause `transact` to hang forever.
+    /// To prevent this, you should set [`options::DatabaseOption::TransactionTimeout`] or
+    /// [`options::DatabaseOption::TransactionRetryLimit`] on the [`Database`] object, or
+    /// [`options::TransactionOption::Timeout`] or [`options::TransactionOption::RetryLimit`] on the transaction
+    /// itself.
+    ///
+    /// Note that `TransactOption` also provides `retry_limit` and `time_out`, but these are
+    /// Rust-side budgets that are only checked *between* retries. If the C API hangs during a call
+    /// like `commit()` or `on_error()`, these budgets will not be reached.
+    ///
+    /// Once [Generic Associated Types](https://github.com/rust-lang/rfcs/blob/master/text/1598-generic_associated_types.md)
+    /// lands in stable rust, the returned future of f won't need to be boxed anymore, also the
+    /// lifetime limitations around f might be lowered.
+    pub async fn transact<F>(&self, mut f: F, options: TransactOption) -> Result<F::Item, F::Error>
+    where
+        F: DatabaseTransact,
+    {
+        let is_idempotent = options.is_idempotent;
+        let time_out = options.time_out.map(|d| Instant::now() + d);
+        let retry_limit = options.retry_limit;
+        let mut tries: u32 = 0;
+        let mut trx = self.create_trx()?;
+        let mut can_retry = move || {
+            tries += 1;
+            retry_limit.map(|limit| tries < limit).unwrap_or(true)
+                && time_out.map(|t| Instant::now() < t).unwrap_or(true)
+        };
+        loop {
+            let r = f.transact(trx).await;
+            f = r.0;
+            trx = r.1;
+            trx = match r.2 {
+                Ok(item) => match trx.commit().await {
+                    Ok(_) => break Ok(item),
+                    Err(e) => {
+                        if (is_idempotent || !e.is_maybe_committed()) && can_retry() {
+                            e.on_error().await?
+                        } else {
+                            break Err(F::Error::from(e.into()));
+                        }
+                    }
+                },
+                Err(user_err) => match user_err.try_into_fdb_error() {
+                    Ok(e) => {
+                        if (is_idempotent || !e.is_maybe_committed()) && can_retry() {
+                            trx.on_error(e).await?
+                        } else {
+                            break Err(F::Error::from(e));
+                        }
+                    }
+                    Err(user_err) => break Err(user_err),
+                },
+            };
+        }
+    }
+
+    /// `transact_boxed` is a version of [`Database::transact`] that accepts a closure returning a
+    /// pinned, boxed future.
+    ///
+    /// # Warning: Hanging on Network/DNS failures
+    ///
+    /// By default, the FoundationDB C API will retry indefinitely if it cannot reach the cluster
+    /// or if DNS resolution fails. This can cause `transact_boxed` to hang forever.
+    /// To prevent this, you should set [`options::DatabaseOption::TransactionTimeout`] or
+    /// [`options::DatabaseOption::TransactionRetryLimit`] on the [`Database`] object, or
+    /// [`options::TransactionOption::Timeout`] or [`options::TransactionOption::RetryLimit`] on the transaction
+    /// itself.
+    ///
+    /// Note that `TransactOption` also provides `retry_limit` and `time_out`, but these are
+    /// Rust-side budgets that are only checked *between* retries. If the C API hangs during a call
+    /// like `commit()` or `on_error()`, these budgets will not be reached.
+    pub fn transact_boxed<'trx, F, D, T, E>(
+        &'trx self,
+        data: D,
+        f: F,
+        options: TransactOption,
+    ) -> impl Future<Output = Result<T, E>> + Send + 'trx
+    where
+        for<'a> F: FnMut(
+            &'a Transaction,
+            &'a mut D,
+        ) -> Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>,
+        E: TransactError,
+        F: Send + 'trx,
+        T: Send + 'trx,
+        E: Send + 'trx,
+        D: Send + 'trx,
+    {
+        self.transact(
+            boxed::FnMutBoxed {
+                f,
+                d: data,
+                m: PhantomData,
+            },
+            options,
+        )
+    }
+
+    /// `transact_boxed_local` is a version of [`Database::transact`] that accepts a closure returning a
+    /// pinned, boxed future that is not `Send`.
+    ///
+    /// # Warning: Hanging on Network/DNS failures
+    ///
+    /// By default, the FoundationDB C API will retry indefinitely if it cannot reach the cluster
+    /// or if DNS resolution fails. This can cause `transact_boxed_local` to hang forever.
+    /// To prevent this, you should set [`options::DatabaseOption::TransactionTimeout`] or
+    /// [`options::DatabaseOption::TransactionRetryLimit`] on the [`Database`] object, or
+    /// [`options::TransactionOption::Timeout`] or [`options::TransactionOption::RetryLimit`] on the transaction
+    /// itself.
+    ///
+    /// Note that `TransactOption` also provides `retry_limit` and `time_out`, but these are
+    /// Rust-side budgets that are only checked *between* retries. If the C API hangs during a call
+    /// like `commit()` or `on_error()`, these budgets will not be reached.
+    pub fn transact_boxed_local<'trx, F, D, T, E>(
+        &'trx self,
+        data: D,
+        f: F,
+        options: TransactOption,
+    ) -> impl Future<Output = Result<T, E>> + 'trx
+    where
+        for<'a> F:
+            FnMut(&'a Transaction, &'a mut D) -> Pin<Box<dyn Future<Output = Result<T, E>> + 'a>>,
+        E: TransactError,
+        F: 'trx,
+        T: 'trx,
+        E: 'trx,
+        D: 'trx,
+    {
+        self.transact(
+            boxed_local::FnMutBoxedLocal {
+                f,
+                d: data,
+                m: PhantomData,
+            },
+            options,
+        )
+    }
+
+    /// Runs a transactional function against this Database with retry logic.
+    /// The associated closure will be called until a non-retryable FDBError
+    /// is thrown or commit(), returns success.
+    ///
+    /// Users are **not** expected to keep reference to the `RetryableTransaction`. If a weak or strong
+    /// reference is kept by the user, the binding will throw an error.
+    ///
+    /// # Warning: retry
+    ///
+    /// It might retry indefinitely if the transaction is highly contentious. It is recommended to
+    /// set [`options::TransactionOption::RetryLimit`] or [`options::TransactionOption::Timeout`] on the transaction
+    /// if the task needs to be guaranteed to finish. These options can be safely set on every iteration of the closure.
+    ///
+    /// # Warning: Hanging on Network/DNS failures
+    ///
+    /// By default, the FoundationDB C API will retry indefinitely if it cannot reach the cluster
+    /// or if DNS resolution fails. This can cause `run` to hang forever.
+    /// To prevent this, you should set [`options::DatabaseOption::TransactionTimeout`] or
+    /// [`options::DatabaseOption::TransactionRetryLimit`] on the [`Database`] object, or
+    /// [`options::TransactionOption::Timeout`] or [`options::TransactionOption::RetryLimit`] on the transaction
+    /// itself.
+    ///
+    /// # Warning: Maybe committed transactions
+    ///
+    /// As with other client/server databases, in some failure scenarios a client may be unable to determine
+    /// whether a transaction succeeded. You should make sure your closure is idempotent.
+    ///
+    /// The closure will notify the user in case of a maybe_committed transaction in a previous run
+    ///  with the `MaybeCommitted` provided in the closure.
+    ///
+    /// This one can be used as boolean with
+    /// ```ignore
+    /// db.run(|trx, maybe_committed| async {
+    ///     if maybe_committed.into() {
+    ///         // Handle the problem if needed
+    ///     }
+    ///     Ok::<_, FdbBindingError>(())
+    /// }).await;
+    ///```
+    ///
+    /// # Typed closure errors
+    ///
+    /// The closure error type `E` is generic: any type implementing
+    /// [`RetryableError`](crate::RetryableError) works, and the caller gets it
+    /// back typed. Errors are classified through
+    /// [`RetryableError::retry_decision`](crate::RetryableError::retry_decision):
+    /// by default any error that is, or wraps (through `source()`), an
+    /// [`FdbError`] is handed to `on_error`, which judges retryability and
+    /// applies backoff; [`RetryDecision::Retry`](crate::RetryDecision::Retry)
+    /// is routed through `on_error` with code 1020 (not_committed), so backoff
+    /// and [`options::TransactionOption::RetryLimit`] apply uniformly and
+    /// `MaybeCommitted` is left untouched. When retries are exhausted or the
+    /// error is not retryable, the original closure error is returned as-is.
+    ///
+    /// A closure that never names an error type is ambiguous; pin it on the
+    /// tail expression, for example `Ok::<_, FdbBindingError>(value)`.
+    ///
+    /// # Hooks and retry policy
+    ///
+    /// This is [`runner()`](Self::runner) with its defaults: no hooks and the
+    /// native retry policy. Use the builder to observe the run with
+    /// [`RunnerHooks`] or to decide the retries with a
+    /// [`RetryPolicy`](crate::runner::RetryPolicy).
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, closure))
+    )]
+    pub async fn run<F, Fut, T, E>(&self, closure: F) -> Result<T, E>
+    where
+        F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
+        Fut: Future<Output = Result<T, E>>,
+        E: RetryableError,
+    {
+        self.runner().run(closure).await
+    }
+
+    /// A builder for a transactional run, to plug [`RunnerHooks`] and a
+    /// [`RetryPolicy`](crate::runner::RetryPolicy) into it.
+    ///
+    /// ```no_run
+    /// # use foundationdb::*;
+    /// # use foundationdb::runner::MetricsHooks;
+    /// # async fn example(db: &Database) -> Result<(), FdbBindingError> {
+    /// let metrics = TransactionMetrics::new();
+    /// db.runner()
+    ///     .hooks(&MetricsHooks::new(&metrics))
+    ///     .run(|trx, _| async move {
+    ///         trx.set(b"key", b"value");
+    ///         Ok::<_, FdbBindingError>(())
+    ///     })
+    ///     .await
+    /// # }
+    /// ```
+    pub fn runner(&self) -> TransactionRunner<'_> {
+        TransactionRunner::new(self)
+    }
+
+    /// Runs a transactional function against this Database with retry logic and custom hooks.
+    ///
+    /// Sugar for `db.runner().hooks(hooks).run(closure)`. Stack several hooks
+    /// with a tuple: `db.run_with_hooks(&(first, second), closure)`.
+    ///
+    /// See [`RunnerHooks`] for what each hook observes and in which order.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, hooks, closure))
+    )]
+    pub async fn run_with_hooks<'a, F, Fut, T, E, H: RunnerHooks>(
+        &'a self,
+        hooks: &'a H,
+        closure: F,
+    ) -> Result<T, E>
+    where
+        F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
+        Fut: Future<Output = Result<T, E>>,
+        E: RetryableError,
+    {
+        self.runner().hooks(hooks).run(closure).await
+    }
+
+    /// Runs a transactional function against this Database with retry logic and metrics collection.
+    /// The associated closure will be called until a non-retryable FDBError
+    /// is thrown or commit() returns success.
+    ///
+    /// This method is similar to `run()` but additionally collects and returns metrics about
+    /// the transaction execution, including operation counts, bytes read/written, and retry counts.
+    /// It is [`MetricsHooks`] plugged into [`runner()`](Self::runner): stack them
+    /// on your own hooks with `db.run_with_hooks(&(MetricsHooks::new(&metrics), my_hooks), closure)`
+    /// to get the same report out of a run you observe yourself.
+    ///
+    /// # Arguments
+    /// * `closure` - A function that takes a RetryableTransaction and MaybeCommitted flag and returns a Future
+    ///
+    /// # Returns
+    /// * `Result<(T, Metrics), (FdbBindingError, Metrics)>` - On success, returns the result of the transaction and collected metrics.
+    ///   On failure, returns the error and the metrics collected up to the point of failure.
+    ///
+    /// # Warning: retry
+    ///
+    /// It might retry indefinitely if the transaction is highly contentious. It is recommended to
+    /// set [`options::TransactionOption::RetryLimit`] or [`options::TransactionOption::Timeout`] on the transaction
+    /// if the task needs to be guaranteed to finish.
+    ///
+    /// # Warning: Maybe committed transactions
+    ///
+    /// As with other client/server databases, in some failure scenarios a client may be unable to determine
+    /// whether a transaction succeeded. The closure will be notified of a maybe_committed transaction
+    /// in a previous run with the `MaybeCommitted` provided in the closure.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, closure))
+    )]
+    pub async fn instrumented_run<F, Fut, T, E>(
+        &self,
+        closure: F,
+    ) -> Result<(T, MetricsReport), (E, MetricsReport)>
+    where
+        F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
+        Fut: Future<Output = Result<T, E>>,
+        E: RetryableError,
+    {
+        let metrics = TransactionMetrics::new();
+        let hooks = MetricsHooks::new(&metrics);
+
+        match self.runner().hooks(&hooks).run(closure).await {
+            Ok(value) => Ok((value, metrics.get_metrics_data())),
+            Err(err) => Err((err, metrics.get_metrics_data())),
+        }
+    }
+
+    /// Perform a no-op against FDB to check network thread liveness. This operation will not change the underlying data
+    /// in any way, nor will it perform any I/O against the FDB cluster. However, it will schedule some amount of work
+    /// onto the FDB client and wait for it to complete. The FoundationDB client operates by scheduling onto an event
+    /// queue that is then processed by a single thread (the "network thread"). This method can be used to determine if
+    /// the network thread has entered a state where it is no longer processing requests or if its time to process
+    /// requests has increased. If the network thread is busy, this operation may take some amount of time to complete,
+    /// which is why this operation returns a future.
+    pub async fn perform_no_op(&self) -> FdbResult<()> {
+        let trx = self.create_trx()?;
+
+        // Set the read version of the transaction, then read it back. This requires no I/O, but it does
+        // require the network thread be running. The exact value used for the read version is unimportant.
+        trx.set_read_version(42);
+        trx.get_read_version().await?;
+        Ok(())
+    }
+
+    /// Returns a value where 0 indicates that the client is idle and 1 (or larger) indicates that the client is saturated.
+    /// By default, this value is updated every second.
+    #[cfg_api_versions(min = 710)]
+    pub async fn get_main_thread_busyness(&self) -> FdbResult<f64> {
+        let busyness =
+            unsafe { fdb_sys::fdb_database_get_main_thread_busyness(self.inner.as_ptr()) };
+        Ok(busyness)
+    }
+}
+pub trait DatabaseTransact: Sized {
+    type Item;
+    type Error: TransactError;
+    type Future: Future<Output = (Self, Transaction, Result<Self::Item, Self::Error>)>;
+    fn transact(self, trx: Transaction) -> Self::Future;
+}
+
+#[allow(clippy::needless_lifetimes)]
+#[allow(clippy::type_complexity)]
+mod boxed {
+    use super::*;
+
+    async fn boxed_data_fut<'t, F, T, E, D>(
+        mut f: FnMutBoxed<'t, F, D>,
+        trx: Transaction,
+    ) -> (FnMutBoxed<'t, F, D>, Transaction, Result<T, E>)
+    where
+        F: for<'a> FnMut(
+            &'a Transaction,
+            &'a mut D,
+        ) -> Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>,
+        E: TransactError,
+    {
+        let r = (f.f)(&trx, &mut f.d).await;
+        (f, trx, r)
+    }
+
+    pub struct FnMutBoxed<'t, F, D> {
+        pub f: F,
+        pub d: D,
+        pub m: PhantomData<&'t ()>,
+    }
+    impl<'t, F, T, E, D> DatabaseTransact for FnMutBoxed<'t, F, D>
+    where
+        F: for<'a> FnMut(
+            &'a Transaction,
+            &'a mut D,
+        ) -> Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>,
+        F: 't + Send,
+        T: 't,
+        E: 't,
+        D: 't + Send,
+        E: TransactError,
+    {
+        type Item = T;
+        type Error = E;
+        type Future = Pin<
+            Box<
+                dyn Future<Output = (Self, Transaction, Result<Self::Item, Self::Error>)>
+                    + Send
+                    + 't,
+            >,
+        >;
+
+        fn transact(self, trx: Transaction) -> Self::Future {
+            boxed_data_fut(self, trx).boxed()
+        }
+    }
+}
+
+#[allow(clippy::needless_lifetimes)]
+#[allow(clippy::type_complexity)]
+mod boxed_local {
+    use super::*;
+
+    async fn boxed_local_data_fut<'t, F, T, E, D>(
+        mut f: FnMutBoxedLocal<'t, F, D>,
+        trx: Transaction,
+    ) -> (FnMutBoxedLocal<'t, F, D>, Transaction, Result<T, E>)
+    where
+        F: for<'a> FnMut(
+            &'a Transaction,
+            &'a mut D,
+        ) -> Pin<Box<dyn Future<Output = Result<T, E>> + 'a>>,
+        E: TransactError,
+    {
+        let r = (f.f)(&trx, &mut f.d).await;
+        (f, trx, r)
+    }
+
+    pub struct FnMutBoxedLocal<'t, F, D> {
+        pub f: F,
+        pub d: D,
+        pub m: PhantomData<&'t ()>,
+    }
+    impl<'t, F, T, E, D> DatabaseTransact for FnMutBoxedLocal<'t, F, D>
+    where
+        F: for<'a> FnMut(
+            &'a Transaction,
+            &'a mut D,
+        ) -> Pin<Box<dyn Future<Output = Result<T, E>> + 'a>>,
+        F: 't,
+        T: 't,
+        E: 't,
+        D: 't,
+        E: TransactError,
+    {
+        type Item = T;
+        type Error = E;
+        type Future = Pin<
+            Box<dyn Future<Output = (Self, Transaction, Result<Self::Item, Self::Error>)> + 't>,
+        >;
+
+        fn transact(self, trx: Transaction) -> Self::Future {
+            boxed_local_data_fut(self, trx).boxed_local()
+        }
+    }
+}
+
+/// A trait that must be implemented to use `Database::transact` this application error types.
+pub trait TransactError: From<FdbError> {
+    fn try_into_fdb_error(self) -> Result<FdbError, Self>;
+}
+impl<T> TransactError for T
+where
+    T: From<FdbError> + TryInto<FdbError, Error = T>,
+{
+    fn try_into_fdb_error(self) -> Result<FdbError, Self> {
+        self.try_into()
+    }
+}
+impl TransactError for FdbError {
+    fn try_into_fdb_error(self) -> Result<FdbError, Self> {
+        Ok(self)
+    }
+}
+
+/// A set of options that controls the behavior of `Database::transact`.
+#[derive(Default, Clone)]
+pub struct TransactOption {
+    pub retry_limit: Option<u32>,
+    pub time_out: Option<Duration>,
+    pub is_idempotent: bool,
+}
+
+impl TransactOption {
+    /// An idempotent TransactOption
+    pub fn idempotent() -> Self {
+        Self {
+            is_idempotent: true,
+            ..TransactOption::default()
+        }
+    }
+}
diff --git a/bindings/rust/foundationdb/src/directory/directory_layer.rs b/bindings/rust/foundationdb/src/directory/directory_layer.rs
new file mode 100644
index 00000000000..e39a157c719
--- /dev/null
+++ b/bindings/rust/foundationdb/src/directory/directory_layer.rs
@@ -0,0 +1,800 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! The default Directory implementation.
+
+use crate::RangeOption;
+use crate::directory::directory_partition::DirectoryPartition;
+use crate::directory::directory_subspace::DirectorySubspace;
+use crate::directory::error::DirectoryError;
+use crate::directory::node::Node;
+use crate::directory::{Directory, DirectoryOutput, compare_slice, strinc};
+use crate::future::FdbSlice;
+use crate::tuple::hca::HighContentionAllocator;
+use crate::tuple::{Element, Subspace, TuplePack};
+use crate::{FdbResult, Transaction};
+use async_recursion::async_recursion;
+use async_trait::async_trait;
+use futures::TryStreamExt;
+use std::cmp::Ordering;
+use std::ops::Deref;
+use std::sync::Arc;
+
+pub(crate) const DEFAULT_SUB_DIRS: i64 = 0;
+const MAJOR_VERSION: u32 = 1;
+const MINOR_VERSION: u32 = 0;
+const PATCH_VERSION: u32 = 0;
+pub(crate) const DEFAULT_NODE_PREFIX: &[u8] = b"\xFE";
+const DEFAULT_HCA_PREFIX: &[u8] = b"hca";
+pub(crate) const PARTITION_LAYER: &[u8] = b"partition";
+pub(crate) const LAYER_SUFFIX: &[u8] = b"layer";
+
+/// A DirectoryLayer defines a new root directory.
+/// The node subspace and content subspace control where the directory metadata and contents,
+/// respectively, are stored. The default root directory has a node subspace with raw prefix \xFE
+/// and a content subspace with no prefix.
+#[derive(Clone)]
+pub struct DirectoryLayer {
+    pub(crate) inner: Arc<DirectoryLayerInner>,
+}
+
+impl std::fmt::Debug for DirectoryLayer {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.inner.fmt(f)
+    }
+}
+
+#[derive(Debug)]
+pub struct DirectoryLayerInner {
+    pub(crate) root_node: Subspace,
+    pub(crate) node_subspace: Subspace,
+    pub(crate) content_subspace: Subspace,
+    pub(crate) allocator: HighContentionAllocator,
+    pub(crate) allow_manual_prefixes: bool,
+
+    pub(crate) path: Vec<String>,
+}
+
+impl Deref for DirectoryLayer {
+    type Target = DirectoryLayerInner;
+
+    fn deref(&self) -> &Self::Target {
+        &self.inner
+    }
+}
+
+impl Default for DirectoryLayer {
+    /// The default root directory stores directory layer metadata in keys beginning with 0xFE,
+    ///and allocates newly created directories in (unused) prefixes starting with 0x00 through 0xFD.
+    ///This is appropriate for otherwise empty databases, but may conflict with other formal or informal partitionings of keyspace.
+    /// If you already have other content in your database, you may wish to use NewDirectoryLayer to
+    /// construct a non-standard root directory to control where metadata and keys are stored.
+    fn default() -> Self {
+        Self::new(
+            Subspace::from_bytes(DEFAULT_NODE_PREFIX),
+            Subspace::all(),
+            false,
+        )
+    }
+}
+
+impl DirectoryLayer {
+    pub fn new(
+        node_subspace: Subspace,
+        content_subspace: Subspace,
+        allow_manual_prefixes: bool,
+    ) -> Self {
+        let root_node = node_subspace.subspace(&node_subspace.bytes());
+        let allocator = HighContentionAllocator::new(root_node.subspace(&DEFAULT_HCA_PREFIX));
+
+        DirectoryLayer {
+            inner: Arc::new(DirectoryLayerInner {
+                root_node,
+                node_subspace,
+                content_subspace,
+                allocator,
+                allow_manual_prefixes,
+                path: vec![],
+            }),
+        }
+    }
+
+    pub(crate) fn new_with_path(
+        node_subspace: Subspace,
+        content_subspace: Subspace,
+        allow_manual_prefixes: bool,
+        path: &[String],
+    ) -> Self {
+        let root_node = node_subspace.subspace(&node_subspace.bytes());
+        let allocator = HighContentionAllocator::new(root_node.subspace(&DEFAULT_HCA_PREFIX));
+
+        DirectoryLayer {
+            inner: Arc::new(DirectoryLayerInner {
+                root_node,
+                node_subspace,
+                content_subspace,
+                allocator,
+                allow_manual_prefixes,
+                path: Vec::from(path),
+            }),
+        }
+    }
+
+    pub fn get_path(&self) -> &[String] {
+        self.path.as_slice()
+    }
+
+    fn node_with_optional_prefix(&self, prefix: Option<FdbSlice>) -> Option<Subspace> {
+        prefix.map(|fdb_slice| self.node_with_prefix(&fdb_slice.deref()))
+    }
+
+    fn node_with_prefix<T: TuplePack>(&self, prefix: &T) -> Subspace {
+        self.inner.node_subspace.subspace(prefix)
+    }
+
+    async fn find(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<Option<Node>, DirectoryError> {
+        let mut current_path = vec![];
+        let mut node_subspace = self.root_node.clone();
+        let mut layer = vec![];
+        let mut loaded = false;
+
+        // walking through the provided path
+        for path_name in path.iter() {
+            current_path.push(path_name.clone());
+            let key = node_subspace.subspace(&(DEFAULT_SUB_DIRS, path_name.to_owned()));
+
+            // finding the next node
+            let fdb_slice_value = trx.get(key.bytes(), false).await?;
+
+            loaded = true;
+            node_subspace = match self.node_with_optional_prefix(fdb_slice_value) {
+                None => return Ok(None),
+                Some(subspace) => subspace,
+            };
+
+            layer = Node::load_metadata(trx, &node_subspace).await?;
+            if layer.as_slice().eq(PARTITION_LAYER) {
+                break;
+            }
+        }
+
+        if !loaded {
+            layer = Node::load_metadata(trx, &node_subspace).await?;
+        }
+
+        Ok(Some(Node {
+            subspace: node_subspace,
+            current_path,
+            target_path: Vec::from(path),
+            directory_layer: self.clone(),
+            layer,
+        }))
+    }
+
+    fn to_absolute_path(&self, sub_path: &[String]) -> Vec<String> {
+        let mut path: Vec<String> = Vec::with_capacity(self.path.len() + sub_path.len());
+
+        path.extend_from_slice(&self.path);
+        path.extend_from_slice(sub_path);
+
+        path
+    }
+
+    pub(crate) fn contents_of_node(
+        &self,
+        subspace: &Subspace,
+        path: &[String],
+        layer: &[u8],
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        let prefix: Vec<u8> = self.node_subspace.unpack(subspace.bytes())?;
+
+        if layer.eq(PARTITION_LAYER) {
+            Ok(DirectoryOutput::DirectoryPartition(
+                DirectoryPartition::new(&self.to_absolute_path(path), prefix, self.clone()),
+            ))
+        } else {
+            Ok(DirectoryOutput::DirectorySubspace(DirectorySubspace::new(
+                &self.to_absolute_path(path),
+                prefix,
+                self,
+                layer.to_owned(),
+            )))
+        }
+    }
+
+    /// `create_or_open_internal` is the function used to open and/or create a directory.
+    #[async_recursion]
+    async fn create_or_open_internal(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+        prefix: Option<&'async_recursion [u8]>,
+        layer: Option<&'async_recursion [u8]>,
+        allow_create: bool,
+        allow_open: bool,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.check_version(trx, false).await?;
+
+        if prefix.is_some() && !self.allow_manual_prefixes {
+            if self.path.is_empty() {
+                return Err(DirectoryError::PrefixNotAllowed);
+            }
+
+            return Err(DirectoryError::CannotPrefixInPartition);
+        }
+
+        if path.is_empty() {
+            return Err(DirectoryError::NoPathProvided);
+        }
+
+        if let Some(node) = self.find(trx, path).await? {
+            if node.is_in_partition(false) {
+                let sub_path = node.get_partition_subpath();
+                match node.get_contents()? {
+                    DirectoryOutput::DirectorySubspace(_) => unreachable!("already in partition"),
+                    DirectoryOutput::DirectoryPartition(directory_partition) => {
+                        let dir_space = directory_partition
+                            .directory_subspace
+                            .directory_layer
+                            .create_or_open_internal(
+                                trx,
+                                &sub_path,
+                                prefix,
+                                layer,
+                                allow_create,
+                                allow_open,
+                            )
+                            .await?;
+                        Ok(dir_space)
+                    }
+                }
+            } else {
+                self.open_internal(layer, &node, allow_open).await
+            }
+        } else {
+            self.create_internal(trx, path, layer, prefix, allow_create)
+                .await
+        }
+    }
+
+    async fn open_internal(
+        &self,
+        layer: Option<&[u8]>,
+        node: &Node,
+        allow_open: bool,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        if !allow_open {
+            return Err(DirectoryError::DirAlreadyExists);
+        }
+
+        match layer {
+            None => {}
+            Some(layer) if !layer.is_empty() => match compare_slice(layer, &node.layer) {
+                Ordering::Equal => {}
+                _ => {
+                    return Err(DirectoryError::IncompatibleLayer);
+                }
+            },
+            Some(_) => {}
+        }
+
+        node.get_contents()
+    }
+
+    async fn create_internal(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+        layer: Option<&[u8]>,
+        prefix: Option<&[u8]>,
+        allow_create: bool,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        let path_last = path.last().ok_or(DirectoryError::NoPathProvided)?;
+
+        if !allow_create {
+            return Err(DirectoryError::DirectoryDoesNotExists);
+        }
+
+        let layer = layer.unwrap_or_default();
+
+        self.check_version(trx, true).await?;
+        let new_prefix = self.get_prefix(trx, prefix).await?;
+
+        let is_prefix_free = self
+            .is_prefix_free(trx, new_prefix.as_slice(), prefix.is_none())
+            .await?;
+
+        if !is_prefix_free {
+            return Err(DirectoryError::DirectoryPrefixInUse);
+        }
+
+        let parent_node = self.get_parent_node(trx, path).await?;
+        let node = self.node_with_prefix(&new_prefix);
+
+        let key = parent_node.subspace(&(DEFAULT_SUB_DIRS, path_last));
+        let key_layer = node.pack(&LAYER_SUFFIX);
+
+        trx.set(key.bytes(), &new_prefix);
+        trx.set(&key_layer, layer);
+
+        self.contents_of_node(&node, path, layer)
+    }
+
+    async fn get_parent_node(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<Subspace, DirectoryError> {
+        match path.split_last() {
+            None => Ok(self.root_node.clone()),
+            Some((_, remains)) => {
+                if remains.is_empty() {
+                    return Ok(self.root_node.clone());
+                }
+                let parent = self
+                    .create_or_open_internal(trx, remains, None, None, true, true)
+                    .await?;
+
+                Ok(self.node_with_prefix(&parent.bytes()?))
+            }
+        }
+    }
+
+    async fn is_prefix_free(
+        &self,
+        trx: &Transaction,
+        prefix: &[u8],
+        snapshot: bool,
+    ) -> Result<bool, DirectoryError> {
+        if prefix.is_empty() {
+            return Ok(false);
+        }
+
+        let node = self.node_containing_key(trx, prefix, snapshot).await?;
+
+        if node.is_some() {
+            return Ok(false);
+        }
+
+        let mut range_option = RangeOption::from((
+            self.node_subspace.pack(&prefix),
+            self.node_subspace.pack(&strinc(prefix.to_vec())),
+        ));
+        range_option.limit = Some(1);
+
+        let result = trx
+            .get_ranges_keyvalues(range_option, snapshot)
+            .try_next()
+            .await?;
+
+        Ok(result.is_none())
+    }
+
+    async fn node_containing_key(
+        &self,
+        trx: &Transaction,
+        key: &[u8],
+        snapshot: bool,
+    ) -> Result<Option<Subspace>, DirectoryError> {
+        if key.starts_with(self.node_subspace.bytes()) {
+            return Ok(Some(self.root_node.clone()));
+        }
+
+        let mut key_after = key.to_vec();
+        // pushing 0x00 to simulate keyAfter
+        key_after.push(0);
+
+        let range_end = self.node_subspace.pack(&key_after);
+
+        let mut range_option = RangeOption::from((self.node_subspace.range().0, range_end));
+        range_option.reverse = true;
+        range_option.limit = Some(1);
+
+        // checking range
+        let fdb_value = trx
+            .get_ranges_keyvalues(range_option, snapshot)
+            .try_next()
+            .await?;
+
+        if let Some(fdb_key_value) = fdb_value {
+            let previous_prefix: Vec<Element> = self.node_subspace.unpack(fdb_key_value.key())?;
+
+            if let Some(Element::Bytes(previous_prefix)) = previous_prefix.first() {
+                if key.starts_with(previous_prefix) {
+                    return Ok(Some(self.node_with_prefix(previous_prefix)));
+                };
+            };
+        }
+        Ok(None)
+    }
+
+    async fn get_prefix(
+        &self,
+        trx: &Transaction,
+        prefix: Option<&[u8]>,
+    ) -> Result<Vec<u8>, DirectoryError> {
+        match prefix {
+            None => {
+                // no prefix provided, allocating one
+                let allocator = self.allocator.allocate(trx).await?;
+                let subspace = self.content_subspace.subspace(&allocator);
+
+                // checking range
+                let mut range_option = RangeOption::from(subspace.range());
+                range_option.limit = Some(1);
+
+                let result = trx
+                    .get_ranges_keyvalues(range_option, false)
+                    .try_next()
+                    .await?;
+
+                if result.is_some() {
+                    return Err(DirectoryError::PrefixNotEmpty);
+                }
+
+                Ok(subspace.into_bytes())
+            }
+            Some(v) => Ok(v.to_vec()),
+        }
+    }
+
+    /// `check_version` is checking the Directory's version in FDB.
+    async fn check_version(
+        &self,
+        trx: &Transaction,
+        allow_creation: bool,
+    ) -> Result<(), DirectoryError> {
+        let version = self.get_version_value(trx).await?;
+        match version {
+            None => {
+                if allow_creation {
+                    self.initialize_directory(trx).await
+                } else {
+                    Ok(())
+                }
+            }
+            Some(versions) => {
+                if versions.len() < 12 {
+                    return Err(DirectoryError::Version(
+                        "incorrect version length".to_string(),
+                    ));
+                }
+                let mut arr = [0u8; 4];
+                arr.copy_from_slice(&versions[0..4]);
+                let major: u32 = u32::from_le_bytes(arr);
+
+                arr.copy_from_slice(&versions[4..8]);
+                let minor: u32 = u32::from_le_bytes(arr);
+
+                arr.copy_from_slice(&versions[8..12]);
+                let patch: u32 = u32::from_le_bytes(arr);
+
+                if major > MAJOR_VERSION {
+                    let msg = format!(
+                        "cannot load directory with version {major}.{minor}.{patch} using directory layer {MAJOR_VERSION}.{MINOR_VERSION}.{PATCH_VERSION}"
+                    );
+                    return Err(DirectoryError::Version(msg));
+                }
+
+                if minor > MINOR_VERSION {
+                    let msg = format!(
+                        "directory with version {major}.{minor}.{patch} is read-only when opened using directory layer {MAJOR_VERSION}.{MINOR_VERSION}.{PATCH_VERSION}"
+                    );
+                    return Err(DirectoryError::Version(msg));
+                }
+
+                Ok(())
+            }
+        }
+    }
+
+    /// `initialize_directory` is initializing the directory
+    async fn initialize_directory(&self, trx: &Transaction) -> Result<(), DirectoryError> {
+        let mut value = vec![];
+        value.extend(&MAJOR_VERSION.to_le_bytes());
+        value.extend(&MINOR_VERSION.to_le_bytes());
+        value.extend(&PATCH_VERSION.to_le_bytes());
+        let version_subspace: &[u8] = b"version";
+        let directory_version_key = self.root_node.subspace(&version_subspace);
+        trx.set(directory_version_key.bytes(), &value);
+
+        Ok(())
+    }
+
+    async fn get_version_value(&self, trx: &Transaction) -> FdbResult<Option<FdbSlice>> {
+        let version_subspace: &[u8] = b"version";
+        let version_key = self.root_node.subspace(&version_subspace);
+
+        trx.get(version_key.bytes(), false).await
+    }
+
+    async fn exists_internal(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<bool, DirectoryError> {
+        self.check_version(trx, false).await?;
+
+        match self.find(trx, path).await? {
+            None => Ok(false),
+            Some(node) if node.is_in_partition(false) => {
+                node.get_contents()?
+                    .exists(trx, &node.get_partition_subpath())
+                    .await
+            }
+            Some(_node) => Ok(true),
+        }
+    }
+
+    async fn list_internal(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<Vec<String>, DirectoryError> {
+        self.check_version(trx, false).await?;
+
+        let node = self
+            .find(trx, path)
+            .await?
+            .ok_or(DirectoryError::PathDoesNotExists)?;
+        if node.is_in_partition(true) {
+            match node.get_contents()? {
+                DirectoryOutput::DirectorySubspace(_) => unreachable!("already in partition"),
+                DirectoryOutput::DirectoryPartition(directory_partition) => {
+                    return directory_partition
+                        .directory_subspace
+                        .directory_layer
+                        .list(trx, &node.get_partition_subpath())
+                        .await;
+                }
+            };
+        }
+
+        node.list_sub_folders(trx).await
+    }
+
+    async fn move_to_internal(
+        &self,
+        trx: &Transaction,
+        old_path: &[String],
+        new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.check_version(trx, true).await?;
+
+        if old_path.len() <= new_path.len()
+            && compare_slice(old_path, &new_path[..old_path.len()]) == Ordering::Equal
+        {
+            return Err(DirectoryError::CannotMoveBetweenSubdirectory);
+        }
+
+        let old_node = self.find(trx, old_path).await?;
+        let new_node = self.find(trx, new_path).await?;
+
+        let old_node = match old_node {
+            None => return Err(DirectoryError::PathDoesNotExists),
+            Some(n) => n,
+        };
+        let old_node_exists_in_partition = old_node.is_in_partition(false);
+
+        match new_node {
+            None => {
+                if old_node_exists_in_partition {
+                    return Err(DirectoryError::CannotMoveBetweenPartition);
+                }
+            }
+            Some(new_node) => {
+                let new_node_exists_in_partition = new_node.is_in_partition(false);
+                if old_node_exists_in_partition || new_node_exists_in_partition {
+                    if !old_node_exists_in_partition
+                        || !new_node_exists_in_partition
+                        || !old_node.current_path.eq(&new_node.current_path)
+                    {
+                        return Err(DirectoryError::CannotMoveBetweenPartition);
+                    }
+
+                    return new_node
+                        .get_contents()?
+                        .move_to(
+                            trx,
+                            &old_node.get_partition_subpath(),
+                            &new_node.get_partition_subpath(),
+                        )
+                        .await;
+                }
+                return Err(DirectoryError::DirAlreadyExists);
+            }
+        }
+
+        let (new_path_last, parent_path) = new_path
+            .split_last()
+            .ok_or(DirectoryError::DirAlreadyExists)?;
+
+        let parent_node = self
+            .find(trx, parent_path)
+            .await?
+            .ok_or(DirectoryError::ParentDirDoesNotExists)?;
+
+        let key = parent_node
+            .subspace
+            .subspace(&(DEFAULT_SUB_DIRS, new_path_last));
+        let value: Vec<u8> = self.node_subspace.unpack(old_node.subspace.bytes())?;
+        trx.set(key.bytes(), &value);
+
+        self.remove_from_parent(trx, old_path).await?;
+
+        self.contents_of_node(&old_node.subspace, new_path, &old_node.layer)
+    }
+
+    async fn remove_from_parent(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<(), DirectoryError> {
+        let (last_element, parent_path) = path
+            .split_last()
+            .ok_or(DirectoryError::BadDestinationDirectory)?;
+
+        match self.find(trx, parent_path).await? {
+            None => {}
+            Some(parent_node) => {
+                let key = parent_node.subspace.pack(&(DEFAULT_SUB_DIRS, last_element));
+                trx.clear(&key);
+            }
+        }
+
+        Ok(())
+    }
+
+    #[async_recursion]
+    async fn remove_internal(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+        fail_on_nonexistent: bool,
+    ) -> Result<bool, DirectoryError> {
+        self.check_version(trx, true).await?;
+
+        if path.is_empty() {
+            return Err(DirectoryError::CannotModifyRootDirectory);
+        }
+
+        let node = match self.find(trx, path).await? {
+            Some(node) => node,
+            None if fail_on_nonexistent => return Err(DirectoryError::DirectoryDoesNotExists),
+            None => return Ok(false),
+        };
+
+        if node.is_in_partition(false) {
+            match node.get_contents()? {
+                DirectoryOutput::DirectorySubspace(_) => {
+                    unreachable!("already directory partition")
+                }
+                DirectoryOutput::DirectoryPartition(d) => {
+                    return d
+                        .directory_subspace
+                        .directory_layer
+                        .remove_internal(trx, &node.get_partition_subpath(), fail_on_nonexistent)
+                        .await;
+                }
+            }
+        }
+
+        self.remove_recursive(trx, &node.subspace).await?;
+        self.remove_from_parent(trx, path).await?;
+
+        Ok(true)
+    }
+
+    #[async_recursion]
+    async fn remove_recursive(
+        &self,
+        trx: &Transaction,
+        node_sub: &Subspace,
+    ) -> Result<(), DirectoryError> {
+        let sub_dir = node_sub.subspace(&DEFAULT_SUB_DIRS);
+        let range_option = RangeOption::from(&sub_dir);
+
+        let mut stream = std::pin::pin!(trx.get_ranges_keyvalues(range_option, false));
+        while let Some(row_key) = stream.try_next().await? {
+            let sub_node = self.node_with_prefix(&row_key.value());
+            self.remove_recursive(trx, &sub_node).await?;
+        }
+
+        let node_prefix: Vec<u8> = self.node_subspace.unpack(node_sub.bytes())?;
+
+        trx.clear_range(&node_prefix, &strinc(node_prefix.to_owned()));
+        trx.clear_subspace_range(node_sub);
+
+        Ok(())
+    }
+}
+
+#[async_trait]
+impl Directory for DirectoryLayer {
+    async fn create_or_open(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        prefix: Option<&[u8]>,
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.create_or_open_internal(txn, path, prefix, layer, true, true)
+            .await
+    }
+
+    async fn create(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        prefix: Option<&[u8]>,
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.create_or_open_internal(txn, path, prefix, layer, true, false)
+            .await
+    }
+
+    async fn open(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.create_or_open_internal(txn, path, None, layer, false, true)
+            .await
+    }
+
+    async fn exists(&self, trx: &Transaction, path: &[String]) -> Result<bool, DirectoryError> {
+        self.exists_internal(trx, path).await
+    }
+
+    async fn move_directory(
+        &self,
+        _trx: &Transaction,
+        _new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        Err(DirectoryError::CannotMoveRootDirectory)
+    }
+
+    /// `move_to` the directory from old_path to new_path(both relative to this
+    /// Directory), and returns the directory (at its new location) and its
+    /// contents as a Subspace. Move will return an error if a directory
+    /// does not exist at oldPath, a directory already exists at newPath, or the
+    /// parent directory of newPath does not exist.
+    async fn move_to(
+        &self,
+        trx: &Transaction,
+        old_path: &[String],
+        new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.move_to_internal(trx, old_path, new_path).await
+    }
+
+    async fn remove(&self, trx: &Transaction, path: &[String]) -> Result<bool, DirectoryError> {
+        self.remove_internal(trx, path, true).await
+    }
+
+    async fn remove_if_exists(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<bool, DirectoryError> {
+        self.remove_internal(trx, path, false).await
+    }
+
+    async fn list(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<Vec<String>, DirectoryError> {
+        self.list_internal(trx, path).await
+    }
+}
diff --git a/bindings/rust/foundationdb/src/directory/directory_partition.rs b/bindings/rust/foundationdb/src/directory/directory_partition.rs
new file mode 100644
index 00000000000..66e4253c068
--- /dev/null
+++ b/bindings/rust/foundationdb/src/directory/directory_partition.rs
@@ -0,0 +1,247 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! A resulting Subspace whose prefix is preprended to all of its descendant directories's prefixes.
+
+use crate::Transaction;
+use crate::directory::directory_layer::{DEFAULT_NODE_PREFIX, DirectoryLayer, PARTITION_LAYER};
+use crate::directory::directory_subspace::DirectorySubspace;
+use crate::directory::error::DirectoryError;
+use crate::directory::{Directory, DirectoryOutput};
+use crate::tuple::Subspace;
+use async_trait::async_trait;
+use std::ops::Deref;
+use std::sync::Arc;
+
+/// A `DirectoryPartition` is a DirectorySubspace whose prefix is preprended to all of its descendant
+/// directories's prefixes. It cannot be used as a Subspace. Instead, you must create at
+/// least one subdirectory to store content.
+#[derive(Clone)]
+pub struct DirectoryPartition {
+    pub(crate) inner: Arc<DirectoryPartitionInner>,
+}
+
+#[derive(Debug)]
+pub struct DirectoryPartitionInner {
+    pub(crate) directory_subspace: DirectorySubspace,
+    pub(crate) parent_directory_layer: DirectoryLayer,
+}
+
+impl Deref for DirectoryPartition {
+    type Target = DirectoryPartitionInner;
+
+    fn deref(&self) -> &Self::Target {
+        &self.inner
+    }
+}
+
+impl std::fmt::Debug for DirectoryPartition {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.inner.fmt(f)
+    }
+}
+
+impl DirectoryPartition {
+    // https://github.com/apple/foundationdb/blob/master/bindings/flow/DirectoryPartition.h#L34-L43
+    pub(crate) fn new(
+        path: &[String],
+        prefix: Vec<u8>,
+        parent_directory_layer: DirectoryLayer,
+    ) -> Self {
+        let mut node_subspace_bytes = vec![];
+        node_subspace_bytes.extend_from_slice(&prefix);
+        node_subspace_bytes.extend_from_slice(DEFAULT_NODE_PREFIX);
+
+        let new_directory_layer = DirectoryLayer::new_with_path(
+            Subspace::from_bytes(node_subspace_bytes),
+            Subspace::from_bytes(prefix.as_slice()),
+            false,
+            path,
+        );
+
+        DirectoryPartition {
+            inner: Arc::new(DirectoryPartitionInner {
+                directory_subspace: DirectorySubspace::new(
+                    path,
+                    prefix,
+                    &new_directory_layer,
+                    Vec::from(PARTITION_LAYER),
+                ),
+                parent_directory_layer,
+            }),
+        }
+    }
+}
+
+impl DirectoryPartition {
+    pub fn get_path(&self) -> &[String] {
+        self.inner.directory_subspace.get_path()
+    }
+
+    fn get_directory_layer_for_path(&self, path: &[String]) -> DirectoryLayer {
+        if path.is_empty() {
+            self.parent_directory_layer.clone()
+        } else {
+            self.directory_subspace.directory_layer.clone()
+        }
+    }
+
+    fn get_partition_subpath(
+        &self,
+        path: &[String],
+        directory_layer: Option<DirectoryLayer>,
+    ) -> Result<Vec<String>, DirectoryError> {
+        let directory = match directory_layer {
+            None => self.directory_subspace.directory_layer.clone(),
+            Some(d) => d,
+        };
+
+        if directory.path.len() > self.directory_subspace.get_path().len() {
+            return Err(DirectoryError::CannotCreateSubpath);
+        }
+
+        let mut new_path = vec![];
+
+        new_path.extend_from_slice(&self.directory_subspace.get_path()[directory.path.len()..]);
+        new_path.extend_from_slice(path);
+
+        Ok(new_path)
+    }
+
+    pub fn get_layer(&self) -> &[u8] {
+        b"partition"
+    }
+}
+
+#[async_trait]
+impl Directory for DirectoryPartition {
+    async fn create_or_open(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        prefix: Option<&[u8]>,
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.inner
+            .directory_subspace
+            .create_or_open(txn, path, prefix, layer)
+            .await
+    }
+
+    async fn create(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        prefix: Option<&[u8]>,
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.inner
+            .directory_subspace
+            .create(txn, path, prefix, layer)
+            .await
+    }
+
+    async fn open(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.inner.directory_subspace.open(txn, path, layer).await
+    }
+
+    async fn exists(&self, trx: &Transaction, path: &[String]) -> Result<bool, DirectoryError> {
+        let directory_layer = self.get_directory_layer_for_path(path);
+
+        directory_layer
+            .exists(
+                trx,
+                &self.get_partition_subpath(path, Some(directory_layer.clone()))?,
+            )
+            .await
+    }
+
+    async fn move_directory(
+        &self,
+        trx: &Transaction,
+        new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        let directory_layer = self.get_directory_layer_for_path(&[]);
+        let directory_layer_path = &directory_layer.path;
+
+        if directory_layer_path.len() > new_path.len() {
+            return Err(DirectoryError::CannotMoveBetweenPartition);
+        }
+
+        for (i, path) in directory_layer_path.iter().enumerate() {
+            match new_path.get(i) {
+                None => return Err(DirectoryError::CannotMoveBetweenPartition),
+                Some(new_path_item) => {
+                    if !new_path_item.eq(path) {
+                        return Err(DirectoryError::CannotMoveBetweenPartition);
+                    }
+                }
+            }
+        }
+
+        let mut new_relative_path = vec![];
+        new_relative_path.extend_from_slice(&new_path[directory_layer_path.len()..]);
+
+        directory_layer
+            .move_to(
+                trx,
+                &self.get_partition_subpath(&[], Some(directory_layer.clone()))?,
+                &new_relative_path,
+            )
+            .await
+    }
+
+    async fn move_to(
+        &self,
+        trx: &Transaction,
+        old_path: &[String],
+        new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.inner
+            .directory_subspace
+            .move_to(trx, old_path, new_path)
+            .await
+    }
+
+    async fn remove(&self, trx: &Transaction, path: &[String]) -> Result<bool, DirectoryError> {
+        let directory_layer = self.get_directory_layer_for_path(path);
+        directory_layer
+            .remove(
+                trx,
+                &self.get_partition_subpath(path, Some(directory_layer.clone()))?,
+            )
+            .await
+    }
+
+    async fn remove_if_exists(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<bool, DirectoryError> {
+        let directory_layer = self.get_directory_layer_for_path(path);
+        directory_layer
+            .remove_if_exists(
+                trx,
+                &self.get_partition_subpath(path, Some(directory_layer.clone()))?,
+            )
+            .await
+    }
+
+    async fn list(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<Vec<String>, DirectoryError> {
+        self.inner.directory_subspace.list(trx, path).await
+    }
+}
diff --git a/bindings/rust/foundationdb/src/directory/directory_subspace.rs b/bindings/rust/foundationdb/src/directory/directory_subspace.rs
new file mode 100644
index 00000000000..24926bda529
--- /dev/null
+++ b/bindings/rust/foundationdb/src/directory/directory_subspace.rs
@@ -0,0 +1,242 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! The resulting Subspace generated with a Directory
+
+use crate::Transaction;
+use crate::directory::directory_layer::DirectoryLayer;
+use crate::directory::error::DirectoryError;
+use crate::directory::{Directory, DirectoryOutput};
+use crate::tuple::{PackResult, Subspace, TuplePack, TupleUnpack};
+use async_trait::async_trait;
+
+/// A `DirectorySubspace` represents the contents of a directory, but it also remembers
+/// the path with which it was opened and offers convenience methods to operate on the directory at that path.
+/// An instance of `DirectorySubspace` can be used for all the usual subspace operations.
+/// It can also be used to operate on the directory with which it was opened.
+#[derive(Debug, Clone)]
+pub struct DirectorySubspace {
+    pub(crate) directory_layer: DirectoryLayer,
+    subspace: Subspace,
+    path: Vec<String>,
+    layer: Vec<u8>,
+}
+
+impl DirectorySubspace {
+    pub fn new(
+        path: &[String],
+        prefix: Vec<u8>,
+        directory_layer: &DirectoryLayer,
+        layer: Vec<u8>,
+    ) -> Self {
+        DirectorySubspace {
+            directory_layer: directory_layer.clone(),
+            subspace: Subspace::from_bytes(prefix),
+            path: Vec::from(path),
+            layer,
+        }
+    }
+
+    // https://github.com/apple/foundationdb/blob/master/bindings/flow/DirectorySubspace.cpp#L105
+    fn get_partition_subpath(
+        &self,
+        path: &[String],
+        directory_layer: Option<DirectoryLayer>,
+    ) -> Result<Vec<String>, DirectoryError> {
+        let directory = match directory_layer {
+            None => self.directory_layer.clone(),
+            Some(d) => d,
+        };
+
+        if directory.path.len() > self.path.len() {
+            return Err(DirectoryError::CannotCreateSubpath);
+        }
+
+        let mut new_path = vec![];
+
+        new_path.extend_from_slice(&self.path[directory.path.len()..]);
+        new_path.extend_from_slice(path);
+
+        Ok(new_path)
+    }
+}
+
+impl DirectorySubspace {
+    pub fn subspace<T: TuplePack>(&self, t: &T) -> Subspace {
+        self.subspace.subspace(t)
+    }
+
+    pub fn bytes(&self) -> &[u8] {
+        self.subspace.bytes()
+    }
+
+    pub fn pack<T: TuplePack>(&self, t: &T) -> Vec<u8> {
+        self.subspace.pack(t)
+    }
+
+    pub fn unpack<'de, T: TupleUnpack<'de>>(&self, key: &'de [u8]) -> PackResult<T> {
+        self.subspace.unpack(key)
+    }
+
+    pub fn range(&self) -> (Vec<u8>, Vec<u8>) {
+        self.subspace.range()
+    }
+
+    pub fn get_path(&self) -> &[String] {
+        self.path.as_slice()
+    }
+
+    pub fn set_path(&mut self, path: Vec<String>) {
+        self.path = path;
+    }
+
+    pub fn get_layer(&self) -> &[u8] {
+        self.layer.as_slice()
+    }
+
+    pub fn is_start_of(&self, key: &[u8]) -> bool {
+        self.subspace.is_start_of(key)
+    }
+
+    fn get_directory_layer_for_path(&self, _: &[String]) -> DirectoryLayer {
+        self.directory_layer.clone()
+    }
+}
+
+#[async_trait]
+impl Directory for DirectorySubspace {
+    async fn create_or_open(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        prefix: Option<&[u8]>,
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.directory_layer
+            .create_or_open(txn, &self.get_partition_subpath(path, None)?, prefix, layer)
+            .await
+    }
+
+    async fn create(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        prefix: Option<&[u8]>,
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.directory_layer
+            .create(txn, &self.get_partition_subpath(path, None)?, prefix, layer)
+            .await
+    }
+
+    async fn open(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.directory_layer
+            .open(txn, &self.get_partition_subpath(path, None)?, layer)
+            .await
+    }
+
+    async fn exists(&self, trx: &Transaction, path: &[String]) -> Result<bool, DirectoryError> {
+        let directory_layer = self.get_directory_layer_for_path(path);
+
+        directory_layer
+            .exists(
+                trx,
+                &self.get_partition_subpath(path, Some(directory_layer.clone()))?,
+            )
+            .await
+    }
+
+    async fn move_directory(
+        &self,
+        trx: &Transaction,
+        new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        let directory_layer = self.get_directory_layer_for_path(&[]);
+        let directory_layer_path = &directory_layer.path;
+
+        if directory_layer_path.len() > new_path.len() {
+            return Err(DirectoryError::CannotMoveBetweenPartition);
+        }
+
+        for (i, path) in directory_layer_path.iter().enumerate() {
+            match new_path.get(i) {
+                None => return Err(DirectoryError::CannotMoveBetweenPartition),
+                Some(new_path_item) => {
+                    if !new_path_item.eq(path) {
+                        return Err(DirectoryError::CannotMoveBetweenPartition);
+                    }
+                }
+            }
+        }
+
+        let mut new_relative_path = vec![];
+        new_relative_path.extend_from_slice(&new_path[directory_layer_path.len()..]);
+
+        directory_layer
+            .move_to(
+                trx,
+                &self.get_partition_subpath(&[], Some(directory_layer.clone()))?,
+                &new_relative_path,
+            )
+            .await
+    }
+
+    async fn move_to(
+        &self,
+        trx: &Transaction,
+        old_path: &[String],
+        new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        self.directory_layer
+            .move_to(
+                trx,
+                &self.get_partition_subpath(old_path, None)?,
+                &self.get_partition_subpath(new_path, None)?,
+            )
+            .await
+    }
+
+    async fn remove(&self, trx: &Transaction, path: &[String]) -> Result<bool, DirectoryError> {
+        let directory_layer = self.get_directory_layer_for_path(path);
+        directory_layer
+            .remove(
+                trx,
+                &self.get_partition_subpath(path, Some(directory_layer.clone()))?,
+            )
+            .await
+    }
+
+    async fn remove_if_exists(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<bool, DirectoryError> {
+        let directory_layer = self.get_directory_layer_for_path(path);
+        directory_layer
+            .remove_if_exists(
+                trx,
+                &self.get_partition_subpath(path, Some(directory_layer.clone()))?,
+            )
+            .await
+    }
+
+    async fn list(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<Vec<String>, DirectoryError> {
+        self.directory_layer
+            .list(trx, &self.get_partition_subpath(path, None)?)
+            .await
+    }
+}
diff --git a/bindings/rust/foundationdb/src/directory/error.rs b/bindings/rust/foundationdb/src/directory/error.rs
new file mode 100644
index 00000000000..6a4a8a3af00
--- /dev/null
+++ b/bindings/rust/foundationdb/src/directory/error.rs
@@ -0,0 +1,103 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Errors that can be thrown by Directory.
+
+use crate::error;
+use crate::tuple::PackError;
+use crate::tuple::hca::HcaError;
+use std::io;
+
+/// The enumeration holding all possible errors from a Directory.
+#[derive(Debug)]
+pub enum DirectoryError {
+    /// cannot modify the root directory
+    CannotModifyRootDirectory,
+    /// prefix is already used
+    DirectoryPrefixInUse,
+    /// Directory does not exists
+    DirectoryDoesNotExists,
+    /// missing path.
+    NoPathProvided,
+    /// tried to create an already existing path.
+    DirAlreadyExists,
+    /// missing directory.
+    PathDoesNotExists,
+    /// Parent does not exists
+    ParentDirDoesNotExists,
+    /// the layer is incompatible.
+    IncompatibleLayer,
+    /// the destination directory cannot be a subdirectory of the source directory.
+    BadDestinationDirectory,
+    /// Bad directory version.
+    Version(String),
+    /// cannot specify a prefix unless manual prefixes are enabled
+    PrefixNotAllowed,
+    /// cannot specify a prefix in a partition.
+    CannotPrefixInPartition,
+    /// the root directory cannot be moved
+    CannotMoveRootDirectory,
+    CannotMoveBetweenPartition,
+    /// the destination directory cannot be a subdirectory of the source directory
+    CannotMoveBetweenSubdirectory,
+    /// Prefix is not empty
+    PrefixNotEmpty,
+    /// Thrown when the subpath cannot be computed due to length errors
+    CannotCreateSubpath,
+    /// cannot open subspace in the root of a directory partition
+    CannotOpenDirectoryPartition,
+    /// cannot get key for the root of a directory partition
+    CannotGetKeyDirectoryPartition,
+    /// cannot pack for the root of a directory partition
+    CannotPackDirectoryPartition,
+    /// cannot unpack keys using the root of a directory partition
+    CannotUnpackDirectoryPartition,
+    /// cannot get range for the root of a directory partition
+    CannotRangeDirectoryPartition,
+    IoError(io::Error),
+    FdbError(error::FdbError),
+    HcaError(HcaError),
+    PackError(PackError),
+    Other(String),
+}
+
+impl std::fmt::Display for DirectoryError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        std::fmt::Debug::fmt(self, f)
+    }
+}
+
+impl std::error::Error for DirectoryError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            DirectoryError::IoError(e) => Some(e),
+            DirectoryError::FdbError(e) => Some(e),
+            DirectoryError::HcaError(e) => Some(e),
+            DirectoryError::PackError(e) => Some(e),
+            _ => None,
+        }
+    }
+}
+
+impl From<error::FdbError> for DirectoryError {
+    fn from(err: error::FdbError) -> Self {
+        DirectoryError::FdbError(err)
+    }
+}
+
+impl From<HcaError> for DirectoryError {
+    fn from(err: HcaError) -> Self {
+        DirectoryError::HcaError(err)
+    }
+}
+
+impl From<PackError> for DirectoryError {
+    fn from(err: PackError) -> Self {
+        DirectoryError::PackError(err)
+    }
+}
diff --git a/bindings/rust/foundationdb/src/directory/mod.rs b/bindings/rust/foundationdb/src/directory/mod.rs
new file mode 100644
index 00000000000..1eeeaf66b03
--- /dev/null
+++ b/bindings/rust/foundationdb/src/directory/mod.rs
@@ -0,0 +1,389 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Directory provides a tool for managing related subspaces.
+//!
+//! The FoundationDB API provides directories as a tool for managing related Subspaces.
+//! For general guidance on directory usage, see the discussion in the [Developer Guide](https://apple.github.io/foundationdb/developer-guide.html#directories).
+//!
+//! Directories are identified by hierarchical paths analogous to the paths in a Unix-like file system.
+//! A path is represented as a slice of strings. Each directory has an associated subspace used to
+//! store its content. The directory layer maps each path to a short prefix used for the
+//! corresponding subspace. In effect, directories provide a level of indirection for access to subspaces.
+//! Directory operations are transactional.
+//!
+//! It is a direct backport of the [Flow implementation](https://github.com/apple/foundationdb/tree/master/bindings/flow).
+//!
+//! Examples:
+//!
+//! ```rust
+//! use futures::prelude::*;
+//! use foundationdb::directory::Directory;
+//!
+//! async fn async_main() -> foundationdb::FdbResult<()> {
+//!     let db = foundationdb::Database::default()?;
+//!
+//!     // creates a transaction
+//!     let trx = db.create_trx()?;
+//!
+//!     // creates a directory
+//!     let directory = foundationdb::directory::DirectoryLayer::default();
+//!
+//!     let path = vec![String::from("my-awesome-app"), String::from("my-awesome-user")];
+//!
+//!     // use the directory to create a subspace to use
+//!     let content_subspace = directory.create_or_open(
+//!         // the transaction used to read/write the directory.
+//!         &trx,
+//!         // the path used, which can view as a UNIX path like `/app/my-app`.
+//!         &path,
+//!         // do not use any custom prefix or layer
+//!         None, None,
+//!     ).await;
+//!     assert_eq!(true, content_subspace.is_ok());
+//!
+//!     // Don't forget to commit your transaction to persist the subspace
+//!     trx.commit().await?;
+//!
+//!     Ok(())
+//! }
+//!
+//! foundationdb::boot().expect("failed to initialize FoundationDB");
+//! futures::executor::block_on(async_main()).expect("failed to run");
+//! ```
+
+mod directory_layer;
+mod directory_partition;
+mod directory_subspace;
+mod error;
+mod node;
+
+use crate::Transaction;
+use crate::tuple::{PackResult, Subspace, TuplePack, TupleUnpack};
+use async_trait::async_trait;
+use core::cmp;
+pub use directory_layer::DirectoryLayer;
+pub use directory_partition::DirectoryPartition;
+pub use directory_subspace::DirectorySubspace;
+pub use error::DirectoryError;
+use std::cmp::Ordering;
+
+/// `Directory` represents a subspace of keys in a FoundationDB database, identified by a hierarchical path.
+///
+/// # Warning: Hanging on Network/DNS failures
+///
+/// Directory operations are transactional and rely on the [`Transaction`] passed to them.
+/// By default, the FoundationDB C API will retry indefinitely if it cannot reach the cluster
+/// or if DNS resolution fails. This can cause directory operations to hang forever.
+/// To prevent this, you should set [`crate::options::DatabaseOption::TransactionTimeout`] or
+/// [`crate::options::DatabaseOption::TransactionRetryLimit`] on the [`crate::Database`] object, or
+/// [`crate::options::TransactionOption::Timeout`] or [`crate::options::TransactionOption::RetryLimit`] on the transaction
+/// itself.
+#[async_trait]
+pub trait Directory {
+    /// Creates or opens the subdirectory of this Directory located at path (creating parent directories, if necessary).
+    ///
+    /// # Warning
+    ///
+    /// If you need to create several paths with the same prefix, you **must** use several transactions(See [this link](https://github.com/apple/foundationdb/issues/895#issuecomment-436704180) for context)
+    async fn create_or_open(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        prefix: Option<&[u8]>,
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError>;
+
+    /// Creates a subdirectory of this Directory located at path (creating parent directories if necessary).
+    ///
+    /// # Warning
+    ///
+    /// If you need to create several paths with the same prefix, you **must** use several transactions(See [this link](https://github.com/apple/foundationdb/issues/895#issuecomment-436704180) for context)
+    async fn create(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        prefix: Option<&[u8]>,
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError>;
+
+    /// Opens the subdirectory of this Directory located at path.
+    async fn open(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError>;
+
+    /// Checks if the subdirectory of this Directory located at path exists.
+    async fn exists(&self, trx: &Transaction, path: &[String]) -> Result<bool, DirectoryError>;
+
+    /// Moves this Directory to the specified newAbsolutePath.
+    async fn move_directory(
+        &self,
+        trx: &Transaction,
+        new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError>;
+
+    /// Moves the subdirectory of this Directory located at oldpath to newpath.
+    async fn move_to(
+        &self,
+        trx: &Transaction,
+        old_path: &[String],
+        new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError>;
+
+    /// Removes the subdirectory of this Directory located at path and all of its subdirectories, as well as all of their contents.
+    async fn remove(&self, trx: &Transaction, path: &[String]) -> Result<bool, DirectoryError>;
+
+    /// Removes the subdirectory of this Directory located at path (if the path exists) and all of its subdirectories, as well as all of their contents.
+    async fn remove_if_exists(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<bool, DirectoryError>;
+
+    /// List the subdirectories of this directory at a given subpath.
+    async fn list(&self, trx: &Transaction, path: &[String])
+    -> Result<Vec<String>, DirectoryError>;
+}
+
+pub(crate) fn compare_slice<T: Ord>(a: &[T], b: &[T]) -> cmp::Ordering {
+    for (ai, bi) in a.iter().zip(b.iter()) {
+        match ai.cmp(bi) {
+            Ordering::Equal => continue,
+            ord => return ord,
+        }
+    }
+
+    // if every single element was equal, compare length
+    a.len().cmp(&b.len())
+}
+
+/// DirectoryOutput represents the different output of a Directory.
+#[derive(Clone, Debug)]
+pub enum DirectoryOutput {
+    /// Under classic usage, you will obtain an `DirectorySubspace`
+    DirectorySubspace(DirectorySubspace),
+    /// You can open an `DirectoryPartition` by using the "partition" layer
+    DirectoryPartition(DirectoryPartition),
+}
+
+impl DirectoryOutput {
+    pub fn subspace<T: TuplePack>(&self, t: &T) -> Result<Subspace, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => Ok(d.subspace(t)),
+            DirectoryOutput::DirectoryPartition(_) => {
+                Err(DirectoryError::CannotOpenDirectoryPartition)
+            }
+        }
+    }
+
+    pub fn bytes(&self) -> Result<&[u8], DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => Ok(d.bytes()),
+            DirectoryOutput::DirectoryPartition(_) => {
+                Err(DirectoryError::CannotOpenDirectoryPartition)
+            }
+        }
+    }
+
+    pub fn pack<T: TuplePack>(&self, t: &T) -> Result<Vec<u8>, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => Ok(d.pack(t)),
+            DirectoryOutput::DirectoryPartition(_) => {
+                Err(DirectoryError::CannotPackDirectoryPartition)
+            }
+        }
+    }
+
+    pub fn unpack<'de, T: TupleUnpack<'de>>(
+        &self,
+        key: &'de [u8],
+    ) -> Result<PackResult<T>, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => Ok(d.unpack(key)),
+            DirectoryOutput::DirectoryPartition(_) => {
+                Err(DirectoryError::CannotPackDirectoryPartition)
+            }
+        }
+    }
+
+    pub fn range(&self) -> Result<(Vec<u8>, Vec<u8>), DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => Ok(d.range()),
+            DirectoryOutput::DirectoryPartition(_) => {
+                Err(DirectoryError::CannotRangeDirectoryPartition)
+            }
+        }
+    }
+
+    pub fn get_path(&self) -> &[String] {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => d.get_path(),
+            DirectoryOutput::DirectoryPartition(d) => d.get_path(),
+        }
+    }
+
+    pub fn get_layer(&self) -> &[u8] {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => d.get_layer(),
+            DirectoryOutput::DirectoryPartition(d) => d.get_layer(),
+        }
+    }
+}
+
+#[async_trait]
+impl Directory for DirectoryOutput {
+    async fn create_or_open(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        prefix: Option<&[u8]>,
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => {
+                d.create_or_open(txn, path, prefix, layer).await
+            }
+            DirectoryOutput::DirectoryPartition(d) => {
+                d.create_or_open(txn, path, prefix, layer).await
+            }
+        }
+    }
+
+    async fn create(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        prefix: Option<&[u8]>,
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => d.create(txn, path, prefix, layer).await,
+            DirectoryOutput::DirectoryPartition(d) => d.create(txn, path, prefix, layer).await,
+        }
+    }
+
+    async fn open(
+        &self,
+        txn: &Transaction,
+        path: &[String],
+        layer: Option<&[u8]>,
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => d.open(txn, path, layer).await,
+            DirectoryOutput::DirectoryPartition(d) => d.open(txn, path, layer).await,
+        }
+    }
+
+    async fn exists(&self, trx: &Transaction, path: &[String]) -> Result<bool, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => d.exists(trx, path).await,
+            DirectoryOutput::DirectoryPartition(d) => d.exists(trx, path).await,
+        }
+    }
+
+    async fn move_directory(
+        &self,
+        trx: &Transaction,
+        new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => d.move_directory(trx, new_path).await,
+            DirectoryOutput::DirectoryPartition(d) => d.move_directory(trx, new_path).await,
+        }
+    }
+
+    async fn move_to(
+        &self,
+        trx: &Transaction,
+        old_path: &[String],
+        new_path: &[String],
+    ) -> Result<DirectoryOutput, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => d.move_to(trx, old_path, new_path).await,
+            DirectoryOutput::DirectoryPartition(d) => d.move_to(trx, old_path, new_path).await,
+        }
+    }
+
+    async fn remove(&self, trx: &Transaction, path: &[String]) -> Result<bool, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => d.remove(trx, path).await,
+            DirectoryOutput::DirectoryPartition(d) => d.remove(trx, path).await,
+        }
+    }
+
+    async fn remove_if_exists(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<bool, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => d.remove_if_exists(trx, path).await,
+            DirectoryOutput::DirectoryPartition(d) => d.remove_if_exists(trx, path).await,
+        }
+    }
+
+    async fn list(
+        &self,
+        trx: &Transaction,
+        path: &[String],
+    ) -> Result<Vec<String>, DirectoryError> {
+        match self {
+            DirectoryOutput::DirectorySubspace(d) => d.list(trx, path).await,
+            DirectoryOutput::DirectoryPartition(d) => d.list(trx, path).await,
+        }
+    }
+}
+
+// Strinc returns the first key that would sort outside the range prefixed by prefix.
+pub(crate) fn strinc(key: Vec<u8>) -> Vec<u8> {
+    let mut key = key;
+
+    for i in (0..key.len()).rev() {
+        if key[i] != 0xff {
+            key[i] += 1;
+            break;
+        } else {
+            // stripping key from trailing 0xFF bytes
+            key.remove(i);
+        }
+    }
+    key
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // https://github.com/apple/foundationdb/blob/e34df983ee8c0db333babf36fb620318d026553d/bindings/c/test/unit/unit_tests.cpp#L95
+    #[test]
+    fn test_strinc() {
+        assert_eq!(strinc(Vec::from("a".as_bytes())), Vec::from("b".as_bytes()));
+        assert_eq!(strinc(Vec::from("y".as_bytes())), Vec::from("z".as_bytes()));
+        assert_eq!(
+            strinc(Vec::from("!".as_bytes())),
+            Vec::from("\"".as_bytes())
+        );
+        assert_eq!(strinc(Vec::from("*".as_bytes())), Vec::from("+".as_bytes()));
+        assert_eq!(
+            strinc(Vec::from("fdb".as_bytes())),
+            Vec::from("fdc".as_bytes())
+        );
+        assert_eq!(
+            strinc(Vec::from("foundation database 6".as_bytes())),
+            Vec::from("foundation database 7".as_bytes())
+        );
+
+        assert_eq!(strinc(vec![61u8, 62u8, 255u8]), vec![61u8, 63u8]);
+        assert_eq!(strinc(vec![253u8, 255u8]), vec![254u8]);
+        assert_eq!(strinc(vec![253u8, 255u8, 255u8]), vec![254u8]);
+        assert_eq!(strinc(vec![255u8, 255u8, 255u8]), Vec::<u8>::new());
+    }
+}
diff --git a/bindings/rust/foundationdb/src/directory/node.rs b/bindings/rust/foundationdb/src/directory/node.rs
new file mode 100644
index 00000000000..f327ed64c7d
--- /dev/null
+++ b/bindings/rust/foundationdb/src/directory/node.rs
@@ -0,0 +1,70 @@
+use crate::RangeOption;
+use crate::Transaction;
+use crate::directory::DirectoryOutput;
+use crate::directory::directory_layer::{
+    DEFAULT_SUB_DIRS, DirectoryLayer, LAYER_SUFFIX, PARTITION_LAYER,
+};
+use crate::directory::error::DirectoryError;
+use crate::tuple::Subspace;
+use futures::TryStreamExt;
+
+#[derive(Debug, Clone)]
+pub(super) struct Node {
+    pub(super) subspace: Subspace,
+    pub(super) current_path: Vec<String>,
+    pub(super) target_path: Vec<String>,
+    pub(super) directory_layer: DirectoryLayer,
+    pub(super) layer: Vec<u8>,
+}
+
+impl Node {
+    // `load_metadata` is loading extra information for the node, like the layer
+    pub(crate) async fn load_metadata(
+        trx: &Transaction,
+        subspace: &Subspace,
+    ) -> Result<Vec<u8>, DirectoryError> {
+        let key = subspace.pack(&LAYER_SUFFIX);
+        let layer = match trx.get(&key, false).await {
+            Err(err) => return Err(DirectoryError::FdbError(err)),
+            Ok(fdb_slice) => fdb_slice.as_deref().unwrap_or_default().to_vec(),
+        };
+        Ok(layer)
+    }
+
+    pub(crate) fn get_partition_subpath(&self) -> Vec<String> {
+        Vec::from(&self.target_path[self.current_path.len()..])
+    }
+
+    /// list sub-folders for a node
+    pub(crate) async fn list_sub_folders(
+        &self,
+        trx: &Transaction,
+    ) -> Result<Vec<String>, DirectoryError> {
+        let range_option = RangeOption::from(&self.subspace.subspace(&DEFAULT_SUB_DIRS));
+
+        let results: Vec<String> = trx
+            .get_ranges_keyvalues(range_option, false)
+            .map_ok(|fdb_value| {
+                let subspace = Subspace::from_bytes(fdb_value.key());
+                // stripping from subspace
+                let sub_directory: (i64, String) = self.subspace.unpack(subspace.bytes())?;
+                Ok(sub_directory.1)
+            })
+            .try_collect::<Vec<Result<String, DirectoryError>>>()
+            .await?
+            .into_iter()
+            .collect::<Result<Vec<String>, DirectoryError>>()?;
+
+        Ok(results)
+    }
+
+    pub(crate) fn is_in_partition(&self, include_empty_subpath: bool) -> bool {
+        self.layer.as_slice().eq(PARTITION_LAYER)
+            && (include_empty_subpath || self.target_path.len() > self.current_path.len())
+    }
+
+    pub(crate) fn get_contents(&self) -> Result<DirectoryOutput, DirectoryError> {
+        self.directory_layer
+            .contents_of_node(&self.subspace, &self.current_path, &self.layer)
+    }
+}
diff --git a/bindings/rust/foundationdb/src/env.rs b/bindings/rust/foundationdb/src/env.rs
new file mode 100644
index 00000000000..faa7e7de231
--- /dev/null
+++ b/bindings/rust/foundationdb/src/env.rs
@@ -0,0 +1,373 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Pluggable sources for the effects that must stay deterministic under
+//! FoundationDB simulation: time and randomness.
+//!
+//! # Why control flow must not read ambient time or randomness
+//!
+//! The deterministic simulator virtualizes both: it decides what time it is and
+//! which pseudo-random choices are made, which is precisely what lets it replay
+//! a failing run from a seed. Code that calls `Instant::now()` or draws from a
+//! thread-local generator steps outside that control, so its behavior changes
+//! from run to run and a bug found in simulation cannot be reproduced.
+//!
+//! The way out is to take time and randomness as dependencies instead of
+//! reaching for them: [`Clock`] and [`Rng`], bundled in an [`Environment`].
+//! Production code uses [`WallClock`] and [`SeededRng`], which do the obvious
+//! thing. Simulation workloads pass implementations backed by the simulator,
+//! provided by the `foundationdb-simulation` crate.
+//!
+//! Ambient wall-clock time remains fine for purely observational output, metrics
+//! durations or log timestamps that nothing branches on.
+//!
+//! # Measure with monotonic, persist with wall
+//!
+//! [`Clock`] offers two readings and they are not interchangeable.
+//! [`Clock::monotonic`] never goes backwards but counts from an epoch private to
+//! that one instance, so it is the right and only choice for durations,
+//! deadlines, budgets and backoff. [`Clock::wall`] is a real timestamp, counted
+//! from the UNIX epoch, so it is the right choice for anything written to the
+//! database or compared across processes, at the cost of being able to jump when
+//! the machine clock is adjusted.
+//!
+//! Never persist a monotonic reading and never compare two of them coming from
+//! different [`Clock`] instances: the values are meaningless outside the
+//! instance that produced them.
+//!
+//! # Drawing a lot of randomness
+//!
+//! [`Rng`] is deliberately minimal, one `u64` per call through a shared
+//! reference. A component that needs a large volume of random data, or
+//! distributions this trait does not offer, should draw a single `u64` and use
+//! it to seed its own local generator (`rand_chacha::ChaCha8Rng::seed_from_u64`
+//! for instance). The run stays reproducible, since the seed came from the
+//! environment, and the heavy sampling stays local and fast.
+//!
+//! # Non-goals
+//!
+//! This module supplies *values*, never control over execution: there is no
+//! sleep and no spawn capability here. Under simulation the caller owns the
+//! schedule: it advances simulated time and re-invokes the deterministic unit of
+//! work. An asynchronous `Timer` capability is planned surface and is
+//! deliberately deferred, so do not work around its absence by sleeping on the
+//! ambient runtime inside code that must be simulable.
+//!
+//! # Known limitation
+//!
+//! Under simulation, wall time is derived from simulated time and therefore
+//! never jumps. Bugs that only appear when the machine clock is stepped by NTP,
+//! a leap second or an operator, cannot be exercised in simulation: exercise
+//! those with a purpose-built [`Clock`] in a unit test instead.
+
+use std::collections::hash_map::RandomState;
+use std::fmt;
+use std::hash::{BuildHasher, Hasher};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+/// Where time comes from.
+///
+/// See the [module documentation](self) for why time is a dependency rather
+/// than something to reach for, and for the rule that decides between the two
+/// readings: measure with [`monotonic`](Self::monotonic), persist with
+/// [`wall`](Self::wall).
+pub trait Clock: fmt::Debug + Send + Sync {
+    /// A monotonic reading, for measuring how much time has passed.
+    ///
+    /// Successive readings never decrease, which makes this the reading to use
+    /// for elapsed times, deadlines, budgets and backoff.
+    ///
+    /// <div class="warning">
+    ///
+    /// The epoch is arbitrary and **private to this instance**. Never persist a
+    /// monotonic reading, and never compare readings taken from two different
+    /// `Clock` instances: only the difference between two readings of the *same*
+    /// instance carries meaning.
+    ///
+    /// </div>
+    fn monotonic(&self) -> Duration;
+
+    /// A wall-clock reading, time elapsed since the UNIX epoch.
+    ///
+    /// This is a real timestamp, comparable across processes and machines, so it
+    /// is the reading to persist in the database or put in a message. In
+    /// production it can jump forwards or backwards when the machine clock is
+    /// adjusted (NTP, a leap second, an operator), so never measure a duration
+    /// with it. Under simulation it is deterministic.
+    fn wall(&self) -> Duration;
+}
+
+/// Where pseudo-random values come from.
+///
+/// See the [module documentation](self) for why randomness is a dependency
+/// rather than something to reach for, and for the pattern to follow when a lot
+/// of randomness is needed.
+///
+/// <div class="warning">
+///
+/// Implementations are **not** cryptographically secure and must not be used to
+/// derive secrets, tokens or keys.
+///
+/// </div>
+pub trait Rng: fmt::Debug + Send + Sync {
+    /// The next value of the sequence, uniform over the whole `u64` range.
+    ///
+    /// This takes `&self` so that a generator can be shared: an implementation
+    /// advances its state through interior mutability.
+    fn next_u64(&self) -> u64;
+
+    /// The next value of the sequence, uniform over the whole `u32` range.
+    ///
+    /// The default implementation truncates [`next_u64`](Self::next_u64).
+    fn next_u32(&self) -> u32 {
+        self.next_u64() as u32
+    }
+}
+
+/// The [`Clock`] of production code, reading the clocks of the machine.
+///
+/// [`monotonic`](Clock::monotonic) counts from the moment the instance was
+/// built, so the first reading of a fresh `WallClock` is close to zero.
+#[derive(Debug, Clone)]
+pub struct WallClock {
+    anchor: Instant,
+}
+
+impl WallClock {
+    /// Builds a clock whose monotonic epoch is now.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug"))]
+    pub fn new() -> Self {
+        Self {
+            anchor: Instant::now(),
+        }
+    }
+}
+
+impl Default for WallClock {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Clock for WallClock {
+    fn monotonic(&self) -> Duration {
+        self.anchor.elapsed()
+    }
+
+    fn wall(&self) -> Duration {
+        // A system clock set before 1970 is the only way this fails, and no
+        // caller can do anything useful with an error here.
+        SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap_or(Duration::ZERO)
+    }
+}
+
+/// The [`Rng`] of production code: SplitMix64, seeded once.
+///
+/// [`new`](Self::new) takes the seed, which makes the whole sequence
+/// reproducible: the same seed always yields the same values in the same order.
+/// [`Default`] takes its seed from the entropy the standard library uses to seed
+/// `HashMap`, which is best effort, unpredictable in practice but neither
+/// reproducible nor guaranteed by anything.
+///
+/// <div class="warning">
+///
+/// SplitMix64 is a fast statistical generator, **not** a cryptographic one.
+///
+/// </div>
+#[derive(Debug)]
+pub struct SeededRng {
+    state: AtomicU64,
+}
+
+/// The golden-ratio increment of SplitMix64.
+const SPLITMIX_GAMMA: u64 = 0x9E37_79B9_7F4A_7C15;
+
+impl SeededRng {
+    /// Builds a generator producing the sequence of `seed`, reproducibly.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug"))]
+    pub fn new(seed: u64) -> Self {
+        Self {
+            state: AtomicU64::new(seed),
+        }
+    }
+}
+
+impl Default for SeededRng {
+    fn default() -> Self {
+        Self::new(RandomState::new().build_hasher().finish())
+    }
+}
+
+impl Rng for SeededRng {
+    fn next_u64(&self) -> u64 {
+        // fetch_add hands back the state this call consumed and leaves the next
+        // one in place, so concurrent callers each finalize a distinct value.
+        let z = self.state.fetch_add(SPLITMIX_GAMMA, Ordering::Relaxed);
+        let z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+        let z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+        z ^ (z >> 31)
+    }
+}
+
+/// The effects a layer needs but must not reach for: time and randomness.
+///
+/// Cloning is cheap, both sources sit behind an `Arc`, so an `Environment` is
+/// meant to be passed by value into the layers and recipes that need it and kept
+/// alongside the [`Database`](crate::Database).
+///
+/// # Example
+///
+/// ```
+/// # use foundationdb::env::Environment;
+/// // Production: machine clock, generator seeded from entropy.
+/// let env = Environment::default();
+///
+/// // A reproducible run: the same seed replays the same sequence.
+/// let env = Environment::with_seed(42);
+/// let first = env.rng().next_u64();
+/// assert_eq!(Environment::with_seed(42).rng().next_u64(), first);
+/// ```
+#[derive(Clone, Debug)]
+pub struct Environment {
+    clock: Arc<dyn Clock>,
+    rng: Arc<dyn Rng>,
+}
+
+impl Environment {
+    /// Bundles a clock and a generator.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(clock, rng))
+    )]
+    pub fn new(clock: Arc<dyn Clock>, rng: Arc<dyn Rng>) -> Self {
+        Self { clock, rng }
+    }
+
+    /// The machine clock, with a generator replaying the sequence of `seed`.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug"))]
+    pub fn with_seed(seed: u64) -> Self {
+        Self::new(Arc::new(WallClock::new()), Arc::new(SeededRng::new(seed)))
+    }
+
+    /// The clock of this environment.
+    pub fn clock(&self) -> &Arc<dyn Clock> {
+        &self.clock
+    }
+
+    /// The pseudo-random generator of this environment.
+    pub fn rng(&self) -> &Arc<dyn Rng> {
+        &self.rng
+    }
+}
+
+impl Default for Environment {
+    fn default() -> Self {
+        Self::new(Arc::new(WallClock::new()), Arc::new(SeededRng::default()))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn take(rng: &SeededRng, count: usize) -> Vec<u64> {
+        (0..count).map(|_| rng.next_u64()).collect()
+    }
+
+    #[test]
+    fn the_same_seed_produces_the_same_sequence() {
+        let expected = take(&SeededRng::new(42), 16);
+
+        assert_eq!(take(&SeededRng::new(42), 16), expected);
+        assert!(
+            expected.windows(2).any(|pair| pair[0] != pair[1]),
+            "the sequence is constant: {expected:?}"
+        );
+    }
+
+    #[test]
+    fn different_seeds_produce_different_sequences() {
+        assert_ne!(take(&SeededRng::new(42), 16), take(&SeededRng::new(43), 16));
+    }
+
+    #[test]
+    fn next_u32_truncates_next_u64() {
+        let wide = SeededRng::new(7);
+        let narrow = SeededRng::new(7);
+
+        for _ in 0..16 {
+            assert_eq!(narrow.next_u32(), wide.next_u64() as u32);
+        }
+    }
+
+    #[test]
+    fn wall_clock_monotonic_never_goes_backwards() {
+        let clock = WallClock::new();
+
+        let mut previous = clock.monotonic();
+        for _ in 0..1_000 {
+            let now = clock.monotonic();
+            assert!(now >= previous, "{now:?} is before {previous:?}");
+            previous = now;
+        }
+    }
+
+    #[test]
+    fn wall_clock_wall_is_a_real_timestamp() {
+        // Any machine running this test has a clock set past 2020.
+        const YEAR_2020: Duration = Duration::from_secs(1_577_836_800);
+
+        assert!(WallClock::new().wall() > YEAR_2020);
+    }
+
+    #[test]
+    fn the_default_environment_is_usable() {
+        let env = Environment::default();
+
+        assert!(env.clock().monotonic() < Duration::from_secs(1));
+        let drawn: Vec<u64> = (0..4).map(|_| env.rng().next_u64()).collect();
+        assert!(drawn.windows(2).any(|pair| pair[0] != pair[1]));
+
+        // Cloning shares the very same sources.
+        let clone = env.clone();
+        assert!(Arc::ptr_eq(clone.clock(), env.clock()));
+        assert!(Arc::ptr_eq(clone.rng(), env.rng()));
+    }
+
+    #[test]
+    fn a_seeded_environment_replays_its_sequence() {
+        let expected: Vec<u64> = (0..8)
+            .map(|_| Environment::with_seed(99).rng().next_u64())
+            .collect();
+
+        // Every fresh environment restarts the same sequence.
+        assert!(expected.iter().all(|value| *value == expected[0]));
+
+        let env = Environment::with_seed(99);
+        assert_eq!(env.rng().next_u64(), expected[0]);
+        assert_ne!(
+            env.rng().next_u64(),
+            expected[0],
+            "the sequence must advance"
+        );
+    }
+
+    #[test]
+    fn debug_output_names_the_implementations() {
+        assert!(format!("{:?}", WallClock::new()).contains("WallClock"));
+        assert!(format!("{:?}", SeededRng::new(1)).contains("SeededRng"));
+
+        let debug = format!("{:?}", Environment::with_seed(1));
+        assert!(debug.contains("Environment"), "{debug}");
+        assert!(debug.contains("WallClock"), "{debug}");
+        assert!(debug.contains("SeededRng"), "{debug}");
+    }
+}
diff --git a/bindings/rust/foundationdb/src/error.rs b/bindings/rust/foundationdb/src/error.rs
new file mode 100644
index 00000000000..5808456fd37
--- /dev/null
+++ b/bindings/rust/foundationdb/src/error.rs
@@ -0,0 +1,337 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Error types for the Fdb crate
+
+use crate::budget::BudgetExceeded;
+use crate::directory::DirectoryError;
+use crate::options;
+use crate::tuple::PackError;
+use crate::tuple::hca::HcaError;
+use foundationdb_sys as fdb_sys;
+use std::ffi::CStr;
+use std::fmt;
+use std::fmt::{Debug, Display, Formatter};
+
+pub(crate) fn eval(error_code: fdb_sys::fdb_error_t) -> FdbResult<()> {
+    let rust_code: i32 = error_code;
+    if rust_code == 0 {
+        Ok(())
+    } else {
+        Err(FdbError::from_code(error_code))
+    }
+}
+
+/// The Standard Error type of FoundationDB
+#[derive(Debug, Copy, Clone)]
+pub struct FdbError {
+    /// The FoundationDB error code
+    error_code: i32,
+}
+
+impl FdbError {
+    /// Converts from a raw foundationDB error code
+    pub fn from_code(error_code: fdb_sys::fdb_error_t) -> Self {
+        Self { error_code }
+    }
+
+    pub fn message(self) -> &'static str {
+        let error_str =
+            unsafe { CStr::from_ptr::<'static>(fdb_sys::fdb_get_error(self.error_code)) };
+        error_str
+            .to_str()
+            .expect("bad error string from FoundationDB")
+    }
+
+    fn is_error_predicate(self, predicate: options::ErrorPredicate) -> bool {
+        // This cast to `i32` isn't unnecessary in all configurations.
+        #[allow(clippy::unnecessary_cast)]
+        let check =
+            unsafe { fdb_sys::fdb_error_predicate(predicate.code() as i32, self.error_code) };
+
+        check != 0
+    }
+
+    /// Indicates the transaction may have succeeded, though not in a way the system can verify.
+    pub fn is_maybe_committed(self) -> bool {
+        self.is_error_predicate(options::ErrorPredicate::MaybeCommitted)
+    }
+
+    /// Indicates the operations in the transactions should be retried because of transient error.
+    pub fn is_retryable(self) -> bool {
+        self.is_error_predicate(options::ErrorPredicate::Retryable)
+    }
+
+    /// Indicates the transaction has not committed, though in a way that can be retried.
+    pub fn is_retryable_not_committed(self) -> bool {
+        self.is_error_predicate(options::ErrorPredicate::RetryableNotCommitted)
+    }
+
+    /// Raw foundationdb error code
+    pub fn code(self) -> i32 {
+        self.error_code
+    }
+}
+
+impl fmt::Display for FdbError {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        std::fmt::Display::fmt(&self.message(), f)
+    }
+}
+
+impl std::error::Error for FdbError {}
+
+/// Alias for `Result<..., FdbError>`
+pub type FdbResult<T = ()> = Result<T, FdbError>;
+
+/// This error represent all errors that can be throwed by `db.run`.
+/// Layer developers may use the `CustomError`.
+#[non_exhaustive]
+pub enum FdbBindingError {
+    NonRetryableFdbError(FdbError),
+    HcaError(HcaError),
+    DirectoryError(DirectoryError),
+    PackError(PackError),
+    /// A reference to the `RetryableTransaction` has been kept
+    ReferenceToTransactionKept,
+    /// All 65536 user versions have been allocated for the transaction attempt.
+    UserVersionExhausted,
+    /// A custom error that layer developers can use
+    ///
+    /// The retry loop of [`crate::Database::run`] recovers the underlying
+    /// [`FdbError`] by walking the boxed error's `source()` chain, so box the
+    /// error itself (or a type that keeps the `FdbError` as its `source()`).
+    /// Never box a stringified error (`e.to_string().into()`): the conversion
+    /// destroys the source chain, and a retryable error becomes fatal.
+    CustomError(Box<dyn std::error::Error + Send + Sync>),
+    /// The client-side budget of the transaction attempt was exceeded, as
+    /// reported by [`crate::Transaction::check_client_budget`]
+    ClientBudgetExceeded(BudgetExceeded),
+    #[cfg(feature = "recipes-leader-election")]
+    /// Leader election specific error
+    LeaderElectionError(crate::recipes::leader_election::LeaderElectionError),
+}
+
+/// Walks an error's `source()` chain, returning the first `FdbError` found.
+///
+/// The depth cap guards against pathological or cyclic source chains.
+pub(crate) fn find_fdb_error(err: &(dyn std::error::Error + 'static)) -> Option<FdbError> {
+    const MAX_DEPTH: usize = 128;
+    let mut current = Some(err);
+    for _ in 0..=MAX_DEPTH {
+        let e = current?;
+        if let Some(fdb) = e.downcast_ref::<FdbError>() {
+            return Some(*fdb);
+        }
+        current = e.source();
+    }
+    None
+}
+
+impl FdbBindingError {
+    /// Returns the underlying `FdbError`, if any.
+    ///
+    /// A `CustomError` boxing an `FdbError` or an `FdbBindingError` is checked
+    /// first, then the whole `source()` chain is walked, so any error that
+    /// carries an `FdbError` as its `source()` (however deeply nested) is found.
+    pub fn get_fdb_error(&self) -> Option<FdbError> {
+        if let Self::CustomError(e) = self {
+            if let Some(e) = e.downcast_ref::<FdbError>() {
+                return Some(*e);
+            }
+            if let Some(e) = e.downcast_ref::<FdbBindingError>() {
+                return e.get_fdb_error();
+            }
+        }
+        find_fdb_error(self)
+    }
+}
+
+impl From<FdbError> for FdbBindingError {
+    fn from(e: FdbError) -> Self {
+        Self::NonRetryableFdbError(e)
+    }
+}
+
+impl From<HcaError> for FdbBindingError {
+    fn from(e: HcaError) -> Self {
+        Self::HcaError(e)
+    }
+}
+
+impl From<DirectoryError> for FdbBindingError {
+    fn from(e: DirectoryError) -> Self {
+        Self::DirectoryError(e)
+    }
+}
+
+impl From<BudgetExceeded> for FdbBindingError {
+    fn from(e: BudgetExceeded) -> Self {
+        Self::ClientBudgetExceeded(e)
+    }
+}
+
+#[cfg(feature = "recipes-leader-election")]
+impl From<crate::recipes::leader_election::LeaderElectionError> for FdbBindingError {
+    fn from(error: crate::recipes::leader_election::LeaderElectionError) -> Self {
+        Self::LeaderElectionError(error)
+    }
+}
+
+impl FdbBindingError {
+    /// create a new custom error
+    pub fn new_custom_error(e: Box<dyn std::error::Error + Send + Sync>) -> Self {
+        Self::CustomError(e)
+    }
+}
+
+impl Debug for FdbBindingError {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        match self {
+            FdbBindingError::NonRetryableFdbError(err) => write!(f, "{err:?}"),
+            FdbBindingError::HcaError(err) => write!(f, "{err:?}"),
+            FdbBindingError::DirectoryError(err) => write!(f, "{err:?}"),
+            FdbBindingError::PackError(err) => write!(f, "{err:?}"),
+            FdbBindingError::ReferenceToTransactionKept => {
+                write!(f, "Reference to transaction kept")
+            }
+            FdbBindingError::UserVersionExhausted => {
+                write!(f, "Transaction user version allocator exhausted")
+            }
+            FdbBindingError::CustomError(err) => write!(f, "{err:?}"),
+            FdbBindingError::ClientBudgetExceeded(err) => write!(f, "{err}"),
+            #[cfg(feature = "recipes-leader-election")]
+            FdbBindingError::LeaderElectionError(err) => write!(f, "{err:?}"),
+        }
+    }
+}
+
+impl Display for FdbBindingError {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        std::fmt::Debug::fmt(&self, f)
+    }
+}
+
+impl std::error::Error for FdbBindingError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::NonRetryableFdbError(e) => Some(e),
+            Self::HcaError(e) => Some(e),
+            Self::DirectoryError(e) => Some(e),
+            Self::PackError(e) => Some(e),
+            Self::CustomError(e) => Some(e.as_ref()),
+            Self::ClientBudgetExceeded(e) => Some(e),
+            Self::ReferenceToTransactionKept => None,
+            Self::UserVersionExhausted => None,
+            #[cfg(feature = "recipes-leader-election")]
+            Self::LeaderElectionError(e) => Some(e),
+        }
+    }
+}
+
+/// What the retry loop of [`crate::Database::run`] does with a closure error.
+///
+/// Produced by [`RetryableError::retry_decision`]. In every case the C API
+/// remains the single retry governor: backoff, max retry delay and
+/// `TransactionOption::RetryLimit` are applied by `fdb_transaction_on_error`,
+/// never by a Rust-side budget.
+#[non_exhaustive]
+#[derive(Debug, Clone, Copy)]
+pub enum RetryDecision {
+    /// The error is, or wraps, this `FdbError`: hand it to `on_error` and let
+    /// the C API judge retryability.
+    Fdb(FdbError),
+    /// App-level retry request with no native error underneath (lock
+    /// contention, optimistic-concurrency conditions). Routed through
+    /// `on_error` with code 1020 (not_committed, retryable by definition), so
+    /// backoff and retry limits apply uniformly.
+    Retry,
+    /// Not retryable: the loop returns the original error to the caller as-is.
+    Fatal,
+}
+
+/// What the retry loop of [`crate::Database::run`] asks of a closure error.
+///
+/// The default `retry_decision` walks the `source()` chain looking for an
+/// [`FdbError`], so any error type that keeps its `FdbError` as a source (the
+/// idiomatic thiserror `#[from]`/`#[source]` pattern) is retry-transparent
+/// without overriding anything. Override only to add [`RetryDecision::Retry`]
+/// arms for app-level retry conditions.
+///
+/// The `From` bounds let the loop surface its own failures through your type:
+/// `From<FdbError>` supports `?` on `FdbResult` inside the closure, and
+/// `From<FdbBindingError>` carries loop-level failures such as
+/// [`FdbBindingError::ReferenceToTransactionKept`].
+///
+/// `FdbError` itself cannot implement this trait (there is no lossless
+/// `From<FdbBindingError> for FdbError`); use a wrapper type such as
+/// [`FdbBindingError`] or your own enum.
+///
+/// # Example
+///
+/// ```
+/// use foundationdb::{FdbBindingError, FdbError, RetryableError};
+///
+/// #[derive(Debug)]
+/// enum MyLayerError {
+///     Fdb(FdbError),
+///     Binding(FdbBindingError),
+///     InvalidDocument,
+/// }
+///
+/// impl std::fmt::Display for MyLayerError {
+///     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+///         write!(f, "{self:?}")
+///     }
+/// }
+///
+/// impl std::error::Error for MyLayerError {
+///     fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+///         match self {
+///             Self::Fdb(e) => Some(e),
+///             Self::Binding(e) => Some(e),
+///             Self::InvalidDocument => None,
+///         }
+///     }
+/// }
+///
+/// impl From<FdbError> for MyLayerError {
+///     fn from(e: FdbError) -> Self {
+///         Self::Fdb(e)
+///     }
+/// }
+///
+/// impl From<FdbBindingError> for MyLayerError {
+///     fn from(e: FdbBindingError) -> Self {
+///         Self::Binding(e)
+///     }
+/// }
+///
+/// // The default source() walk makes wrapped FdbErrors retryable.
+/// impl RetryableError for MyLayerError {}
+/// ```
+pub trait RetryableError:
+    std::error::Error + Send + Sync + Sized + 'static + From<FdbError> + From<FdbBindingError>
+{
+    /// Classifies this error for the retry loop.
+    fn retry_decision(&self) -> RetryDecision {
+        match find_fdb_error(self) {
+            Some(e) => RetryDecision::Fdb(e),
+            None => RetryDecision::Fatal,
+        }
+    }
+}
+
+impl RetryableError for FdbBindingError {
+    fn retry_decision(&self) -> RetryDecision {
+        match self.get_fdb_error() {
+            Some(e) => RetryDecision::Fdb(e),
+            None => RetryDecision::Fatal,
+        }
+    }
+}
diff --git a/bindings/rust/foundationdb/src/fdb_keys.rs b/bindings/rust/foundationdb/src/fdb_keys.rs
new file mode 100644
index 00000000000..54364b7943b
--- /dev/null
+++ b/bindings/rust/foundationdb/src/fdb_keys.rs
@@ -0,0 +1,181 @@
+// Copyright 2022 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Definitions of FDBKeys, used in api version 700 and more.
+
+use crate::error;
+use crate::from_raw_fdb_slice;
+use crate::future::FdbFutureHandle;
+use crate::{FdbError, FdbResult};
+use foundationdb_sys as fdb_sys;
+use std::fmt;
+use std::ops::Deref;
+
+/// An slice of keys owned by a FoundationDB future
+pub struct FdbKeys {
+    _f: FdbFutureHandle,
+    keys: *const FdbKey,
+    len: i32,
+}
+unsafe impl Sync for FdbKeys {}
+unsafe impl Send for FdbKeys {}
+
+impl TryFrom<FdbFutureHandle> for FdbKeys {
+    type Error = FdbError;
+
+    fn try_from(f: FdbFutureHandle) -> FdbResult<Self> {
+        let mut keys = std::ptr::null();
+        let mut len = 0;
+
+        error::eval(unsafe { fdb_sys::fdb_future_get_key_array(f.as_ptr(), &mut keys, &mut len) })?;
+
+        Ok(FdbKeys {
+            _f: f,
+            keys: keys as *const FdbKey,
+            len,
+        })
+    }
+}
+
+impl Deref for FdbKeys {
+    type Target = [FdbKey];
+    fn deref(&self) -> &Self::Target {
+        assert_eq_size!(FdbKey, fdb_sys::FDBKey);
+        assert_eq_align!(FdbKey, u8);
+        from_raw_fdb_slice(self.keys, self.len as usize)
+    }
+}
+
+impl AsRef<[FdbKey]> for FdbKeys {
+    fn as_ref(&self) -> &[FdbKey] {
+        self.deref()
+    }
+}
+
+impl<'a> IntoIterator for &'a FdbKeys {
+    type Item = &'a FdbKey;
+    type IntoIter = std::slice::Iter<'a, FdbKey>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.deref().iter()
+    }
+}
+
+/// An iterator of keyvalues owned by a foundationDB future
+pub struct FdbKeysIter {
+    f: std::rc::Rc<FdbFutureHandle>,
+    keys: *const FdbKey,
+    len: i32,
+    pos: i32,
+}
+
+impl Iterator for FdbKeysIter {
+    type Item = FdbRowKey;
+    fn next(&mut self) -> Option<Self::Item> {
+        #[allow(clippy::iter_nth_zero)]
+        self.nth(0)
+    }
+
+    fn size_hint(&self) -> (usize, Option<usize>) {
+        let rem = (self.len - self.pos) as usize;
+        (rem, Some(rem))
+    }
+
+    fn nth(&mut self, n: usize) -> Option<Self::Item> {
+        let pos = (self.pos as usize).checked_add(n);
+        match pos {
+            Some(pos) if pos < self.len as usize => {
+                // safe because pos < self.len
+                let row_key = unsafe { self.keys.add(pos) };
+                self.pos = pos as i32 + 1;
+
+                Some(FdbRowKey {
+                    _f: self.f.clone(),
+                    row_key,
+                })
+            }
+            _ => {
+                self.pos = self.len;
+                None
+            }
+        }
+    }
+}
+
+impl IntoIterator for FdbKeys {
+    type Item = FdbRowKey;
+    type IntoIter = FdbKeysIter;
+
+    fn into_iter(self) -> Self::IntoIter {
+        FdbKeysIter {
+            f: std::rc::Rc::new(self._f),
+            keys: self.keys,
+            len: self.len,
+            pos: 0,
+        }
+    }
+}
+/// A row key you can own
+///
+/// Until dropped, this might prevent multiple key/values from beeing freed.
+/// (i.e. the future that own the data is dropped once all data it provided is dropped)
+pub struct FdbRowKey {
+    _f: std::rc::Rc<FdbFutureHandle>,
+    row_key: *const FdbKey,
+}
+
+impl Deref for FdbRowKey {
+    type Target = FdbKey;
+    fn deref(&self) -> &Self::Target {
+        assert_eq_size!(FdbKey, fdb_sys::FDBKey);
+        assert_eq_align!(FdbKey, u8);
+        unsafe { &*(self.row_key) }
+    }
+}
+impl AsRef<FdbKey> for FdbRowKey {
+    fn as_ref(&self) -> &FdbKey {
+        self.deref()
+    }
+}
+impl PartialEq for FdbRowKey {
+    fn eq(&self, other: &Self) -> bool {
+        self.deref() == other.deref()
+    }
+}
+
+impl Eq for FdbRowKey {}
+impl fmt::Debug for FdbRowKey {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        self.deref().fmt(f)
+    }
+}
+
+#[repr(C, packed)]
+/// An FdbKey, owned by a FoundationDB Future
+pub struct FdbKey(fdb_sys::FDBKey);
+
+impl FdbKey {
+    /// retrieves the associated key
+    pub fn key(&self) -> &[u8] {
+        from_raw_fdb_slice(self.0.key, self.0.key_length as usize)
+    }
+}
+
+impl PartialEq for FdbKey {
+    fn eq(&self, other: &Self) -> bool {
+        self.key() == other.key()
+    }
+}
+
+impl Eq for FdbKey {}
+
+impl fmt::Debug for FdbKey {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "({:?})", crate::tuple::Bytes::from(self.key()),)
+    }
+}
diff --git a/bindings/rust/foundationdb/src/future.rs b/bindings/rust/foundationdb/src/future.rs
new file mode 100644
index 00000000000..060b7aa52b6
--- /dev/null
+++ b/bindings/rust/foundationdb/src/future.rs
@@ -0,0 +1,518 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Most functions in the FoundationDB API are asynchronous, meaning that they
+//! may return to the caller before actually delivering their Fdbresult.
+//!
+//! These functions always return FDBFuture*. An FDBFuture object represents a
+//! Fdbresult value or error to be delivered at some future time. You can wait for
+//! a Future to be “ready” – to have a value or error delivered – by setting a
+//! callback function, or by blocking a thread, or by polling. Once a Future is
+//! ready, you can extract either an error code or a value of the appropriate
+//! type (the documentation for the original function will tell you which
+//! fdb_future_get_*() function you should call).
+//!
+//! Futures make it easy to do multiple operations in parallel, by calling several
+//! asynchronous functions before waiting for any of the Fdbresults. This can be
+//! important for reducing the latency of transactions.
+//!
+
+use std::convert::TryFrom;
+use std::ffi::CStr;
+use std::fmt;
+use std::ops::Deref;
+use std::os::raw::c_char;
+use std::pin::Pin;
+use std::ptr::NonNull;
+use std::sync::Arc;
+
+#[cfg_api_versions(min = 700)]
+pub use crate::fdb_keys::FdbKeys;
+use crate::from_raw_fdb_slice;
+#[cfg_api_versions(min = 710)]
+pub use crate::mapped_key_values::MappedKeyValues;
+use fdb_sys::if_cfg_api_versions;
+use foundationdb_macros::cfg_api_versions;
+use foundationdb_sys as fdb_sys;
+use futures::prelude::*;
+use futures::task::{AtomicWaker, Context, Poll};
+
+use crate::{FdbError, FdbResult, error};
+
+/// An opaque type that represents a Future in the FoundationDB C API.
+pub struct FdbFutureHandle(NonNull<fdb_sys::FDBFuture>);
+
+impl FdbFutureHandle {
+    pub const fn as_ptr(&self) -> *mut fdb_sys::FDBFuture {
+        self.0.as_ptr()
+    }
+}
+unsafe impl Sync for FdbFutureHandle {}
+unsafe impl Send for FdbFutureHandle {}
+impl Drop for FdbFutureHandle {
+    fn drop(&mut self) {
+        // `fdb_future_destroy` cancels the future, so we don't need to call
+        // `fdb_future_cancel` explicitly.
+        unsafe { fdb_sys::fdb_future_destroy(self.as_ptr()) }
+    }
+}
+
+/// An opaque type that represents a pending Future that will be converted to a
+/// predefined result type.
+///
+/// Non owned result type (Fdb
+pub struct FdbFuture<T> {
+    f: Option<FdbFutureHandle>,
+    waker: Option<Arc<AtomicWaker>>,
+    phantom: std::marker::PhantomData<T>,
+}
+
+impl<T> FdbFuture<T>
+where
+    T: TryFrom<FdbFutureHandle, Error = FdbError> + Unpin,
+{
+    pub fn new(f: *mut fdb_sys::FDBFuture) -> Self {
+        Self {
+            f: Some(FdbFutureHandle(
+                NonNull::new(f).expect("FDBFuture to not be null"),
+            )),
+            waker: None,
+            phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+impl<T> Future for FdbFuture<T>
+where
+    T: TryFrom<FdbFutureHandle, Error = FdbError> + Unpin,
+{
+    type Output = FdbResult<T>;
+
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, cx))
+    )]
+    fn poll(mut self: Pin<&mut Self>, cx: &mut Context) -> Poll<FdbResult<T>> {
+        let f = self.f.as_ref().expect("cannot poll after resolve");
+        let ready = unsafe { fdb_sys::fdb_future_is_ready(f.as_ptr()) };
+        if ready == 0 {
+            let f_ptr = f.as_ptr();
+            let mut register = false;
+            let waker = self.waker.get_or_insert_with(|| {
+                register = true;
+                Arc::new(AtomicWaker::new())
+            });
+            waker.register(cx.waker());
+            if register {
+                let network_waker: Arc<AtomicWaker> = waker.clone();
+                let network_waker_ptr = Arc::into_raw(network_waker);
+                unsafe {
+                    fdb_sys::fdb_future_set_callback(
+                        f_ptr,
+                        Some(fdb_future_callback),
+                        network_waker_ptr as *mut _,
+                    );
+                }
+            }
+            Poll::Pending
+        } else {
+            Poll::Ready(
+                error::eval(unsafe { fdb_sys::fdb_future_get_error(f.as_ptr()) })
+                    .and_then(|()| T::try_from(self.f.take().expect("self.f.is_some()"))),
+            )
+        }
+    }
+}
+
+pub static CUSTOM_EXECUTOR_HOOK: std::sync::OnceLock<fn()> = std::sync::OnceLock::new();
+
+// The callback from fdb C API can be called from multiple threads. so this callback should be
+// thread-safe.
+extern "C" fn fdb_future_callback(
+    _f: *mut fdb_sys::FDBFuture,
+    callback_parameter: *mut ::std::os::raw::c_void,
+) {
+    // resolve all wakeup chain
+    let network_waker: Arc<AtomicWaker> = unsafe { Arc::from_raw(callback_parameter as *const _) };
+    network_waker.wake();
+
+    // polling phase for a custom executor (e.g. the simulation)
+    if let Some(poll_pending_tasks) = CUSTOM_EXECUTOR_HOOK.get() {
+        poll_pending_tasks();
+    }
+}
+
+/// A slice of bytes owned by a foundationDB future
+pub struct FdbSlice {
+    _f: FdbFutureHandle,
+    value: *const u8,
+    len: i32,
+}
+unsafe impl Sync for FdbSlice {}
+unsafe impl Send for FdbSlice {}
+
+impl Deref for FdbSlice {
+    type Target = [u8];
+    fn deref(&self) -> &Self::Target {
+        from_raw_fdb_slice(self.value, self.len as usize)
+    }
+}
+impl AsRef<[u8]> for FdbSlice {
+    fn as_ref(&self) -> &[u8] {
+        self.deref()
+    }
+}
+
+impl TryFrom<FdbFutureHandle> for FdbSlice {
+    type Error = FdbError;
+
+    fn try_from(f: FdbFutureHandle) -> FdbResult<Self> {
+        let mut value = std::ptr::null();
+        let mut len = 0;
+
+        error::eval(unsafe { fdb_sys::fdb_future_get_key(f.as_ptr(), &mut value, &mut len) })?;
+
+        Ok(FdbSlice { _f: f, value, len })
+    }
+}
+
+impl TryFrom<FdbFutureHandle> for Option<FdbSlice> {
+    type Error = FdbError;
+
+    fn try_from(f: FdbFutureHandle) -> FdbResult<Self> {
+        let mut present = 0;
+        let mut value = std::ptr::null();
+        let mut len = 0;
+
+        error::eval(unsafe {
+            fdb_sys::fdb_future_get_value(f.as_ptr(), &mut present, &mut value, &mut len)
+        })?;
+
+        Ok(if present == 0 {
+            None
+        } else {
+            Some(FdbSlice { _f: f, value, len })
+        })
+    }
+}
+
+/// A slice of addresses owned by a foundationDB future
+pub struct FdbAddresses {
+    _f: FdbFutureHandle,
+    strings: *const FdbAddress,
+    len: i32,
+}
+unsafe impl Sync for FdbAddresses {}
+unsafe impl Send for FdbAddresses {}
+
+impl TryFrom<FdbFutureHandle> for FdbAddresses {
+    type Error = FdbError;
+
+    fn try_from(f: FdbFutureHandle) -> FdbResult<Self> {
+        let mut strings: *mut *const c_char = std::ptr::null_mut();
+        let mut len = 0;
+
+        error::eval(unsafe {
+            fdb_sys::fdb_future_get_string_array(f.as_ptr(), &mut strings, &mut len)
+        })?;
+
+        Ok(FdbAddresses {
+            _f: f,
+            strings: strings as *const FdbAddress,
+            len,
+        })
+    }
+}
+
+impl Deref for FdbAddresses {
+    type Target = [FdbAddress];
+
+    fn deref(&self) -> &Self::Target {
+        assert_eq_size!(FdbAddress, *const c_char);
+        assert_eq_align!(FdbAddress, u8);
+        from_raw_fdb_slice(self.strings, self.len as usize)
+    }
+}
+impl AsRef<[FdbAddress]> for FdbAddresses {
+    fn as_ref(&self) -> &[FdbAddress] {
+        self.deref()
+    }
+}
+
+/// An address owned by a foundationDB future
+///
+/// Because the data it represent is owned by the future in FdbAddresses, you
+/// can never own a FdbAddress directly, you can only have references to it.
+/// This way, you can never obtain a lifetime greater than the lifetime of the
+/// slice that gave you access to it.
+#[repr(C, packed)]
+pub struct FdbAddress {
+    c_str: *const c_char,
+}
+
+impl Deref for FdbAddress {
+    type Target = CStr;
+
+    fn deref(&self) -> &CStr {
+        unsafe { std::ffi::CStr::from_ptr(self.c_str) }
+    }
+}
+impl AsRef<CStr> for FdbAddress {
+    fn as_ref(&self) -> &CStr {
+        self.deref()
+    }
+}
+
+/// An slice of keyvalues owned by a foundationDB future
+pub struct FdbValues {
+    _f: FdbFutureHandle,
+    keyvalues: *const FdbKeyValue,
+    len: i32,
+    more: bool,
+}
+unsafe impl Sync for FdbValues {}
+unsafe impl Send for FdbValues {}
+
+impl FdbValues {
+    /// `true` if there is another range after this one
+    pub fn more(&self) -> bool {
+        self.more
+    }
+}
+
+impl TryFrom<FdbFutureHandle> for FdbValues {
+    type Error = FdbError;
+    fn try_from(f: FdbFutureHandle) -> FdbResult<Self> {
+        let mut keyvalues = std::ptr::null();
+        let mut len = 0;
+        let mut more = 0;
+
+        unsafe {
+            error::eval(fdb_sys::fdb_future_get_keyvalue_array(
+                f.as_ptr(),
+                &mut keyvalues,
+                &mut len,
+                &mut more,
+            ))?
+        }
+
+        Ok(FdbValues {
+            _f: f,
+            keyvalues: keyvalues as *const FdbKeyValue,
+            len,
+            more: more != 0,
+        })
+    }
+}
+
+impl Deref for FdbValues {
+    type Target = [FdbKeyValue];
+    fn deref(&self) -> &Self::Target {
+        assert_eq_size!(FdbKeyValue, fdb_sys::FDBKeyValue);
+        assert_eq_align!(FdbKeyValue, u8);
+
+        from_raw_fdb_slice(self.keyvalues, self.len as usize)
+    }
+}
+impl AsRef<[FdbKeyValue]> for FdbValues {
+    fn as_ref(&self) -> &[FdbKeyValue] {
+        self.deref()
+    }
+}
+
+impl<'a> IntoIterator for &'a FdbValues {
+    type Item = &'a FdbKeyValue;
+    type IntoIter = std::slice::Iter<'a, FdbKeyValue>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.deref().iter()
+    }
+}
+impl IntoIterator for FdbValues {
+    type Item = FdbValue;
+    type IntoIter = FdbValuesIter;
+
+    fn into_iter(self) -> Self::IntoIter {
+        FdbValuesIter {
+            f: Arc::new(self._f),
+            keyvalues: self.keyvalues,
+            len: self.len,
+            pos: 0,
+        }
+    }
+}
+
+/// An iterator of keyvalues owned by a foundationDB future
+pub struct FdbValuesIter {
+    f: Arc<FdbFutureHandle>,
+    keyvalues: *const FdbKeyValue,
+    len: i32,
+    pos: i32,
+}
+
+unsafe impl Send for FdbValuesIter {}
+
+impl Iterator for FdbValuesIter {
+    type Item = FdbValue;
+    fn next(&mut self) -> Option<Self::Item> {
+        #[allow(clippy::iter_nth_zero)]
+        self.nth(0)
+    }
+
+    fn nth(&mut self, n: usize) -> Option<Self::Item> {
+        let pos = (self.pos as usize).checked_add(n);
+        match pos {
+            Some(pos) if pos < self.len as usize => {
+                // safe because pos < self.len
+                let keyvalue = unsafe { self.keyvalues.add(pos) };
+                self.pos = pos as i32 + 1;
+
+                Some(FdbValue {
+                    _f: self.f.clone(),
+                    keyvalue,
+                })
+            }
+            _ => {
+                self.pos = self.len;
+                None
+            }
+        }
+    }
+
+    fn size_hint(&self) -> (usize, Option<usize>) {
+        let rem = (self.len - self.pos) as usize;
+        (rem, Some(rem))
+    }
+}
+impl ExactSizeIterator for FdbValuesIter {
+    #[inline]
+    fn len(&self) -> usize {
+        (self.len - self.pos) as usize
+    }
+}
+impl DoubleEndedIterator for FdbValuesIter {
+    fn next_back(&mut self) -> Option<Self::Item> {
+        self.nth_back(0)
+    }
+
+    fn nth_back(&mut self, n: usize) -> Option<Self::Item> {
+        if n < self.len() {
+            self.len -= 1 + n as i32;
+            // safe because len < original len
+            let keyvalue = unsafe { self.keyvalues.add(self.len as usize) };
+            Some(FdbValue {
+                _f: self.f.clone(),
+                keyvalue,
+            })
+        } else {
+            self.pos = self.len;
+            None
+        }
+    }
+}
+
+/// A keyvalue you can own
+///
+/// Until dropped, this might prevent multiple key/values from beeing freed.
+/// (i.e. the future that own the data is dropped once all data it provided is dropped)
+pub struct FdbValue {
+    _f: Arc<FdbFutureHandle>,
+    keyvalue: *const FdbKeyValue,
+}
+
+unsafe impl Send for FdbValue {}
+
+impl Deref for FdbValue {
+    type Target = FdbKeyValue;
+    fn deref(&self) -> &Self::Target {
+        assert_eq_size!(FdbKeyValue, fdb_sys::FDBKeyValue);
+        assert_eq_align!(FdbKeyValue, u8);
+        unsafe { &*self.keyvalue }
+    }
+}
+impl AsRef<FdbKeyValue> for FdbValue {
+    fn as_ref(&self) -> &FdbKeyValue {
+        self.deref()
+    }
+}
+impl PartialEq for FdbValue {
+    fn eq(&self, other: &Self) -> bool {
+        self.deref() == other.deref()
+    }
+}
+impl Eq for FdbValue {}
+impl fmt::Debug for FdbValue {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        self.deref().fmt(f)
+    }
+}
+
+/// A keyvalue owned by a foundationDB future
+///
+/// Because the data it represent is owned by the future in FdbValues, you
+/// can never own a FdbKeyValue directly, you can only have references to it.
+/// This way, you can never obtain a lifetime greater than the lifetime of the
+/// slice that gave you access to it.
+#[repr(C, packed)]
+pub struct FdbKeyValue(fdb_sys::FDBKeyValue);
+
+impl FdbKeyValue {
+    /// key
+    pub fn key(&self) -> &[u8] {
+        // This cast to `*const u8` isn't unnecessary in all configurations.
+        #[allow(clippy::unnecessary_cast)]
+        from_raw_fdb_slice(self.0.key as *const u8, self.0.key_length as usize)
+    }
+
+    /// value
+    pub fn value(&self) -> &[u8] {
+        // This cast to `*const u8` isn't unnecessary in all configurations.
+        #[allow(clippy::unnecessary_cast)]
+        from_raw_fdb_slice(self.0.value as *const u8, self.0.value_length as usize)
+    }
+}
+
+impl PartialEq for FdbKeyValue {
+    fn eq(&self, other: &Self) -> bool {
+        (self.key(), self.value()) == (other.key(), other.value())
+    }
+}
+impl Eq for FdbKeyValue {}
+impl fmt::Debug for FdbKeyValue {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(
+            f,
+            "({:?}, {:?})",
+            crate::tuple::Bytes::from(self.key()),
+            crate::tuple::Bytes::from(self.value())
+        )
+    }
+}
+
+impl TryFrom<FdbFutureHandle> for i64 {
+    type Error = FdbError;
+
+    fn try_from(f: FdbFutureHandle) -> FdbResult<Self> {
+        let mut version: i64 = 0;
+        error::eval(unsafe {
+            if_cfg_api_versions!(min = 620 => {
+                fdb_sys::fdb_future_get_int64(f.as_ptr(), &mut version)
+            } else {
+                fdb_sys::fdb_future_get_version(f.as_ptr(), &mut version)
+            })
+        })?;
+        Ok(version)
+    }
+}
+
+impl TryFrom<FdbFutureHandle> for () {
+    type Error = FdbError;
+    fn try_from(_f: FdbFutureHandle) -> FdbResult<Self> {
+        Ok(())
+    }
+}
diff --git a/bindings/rust/foundationdb/src/keyselector.rs b/bindings/rust/foundationdb/src/keyselector.rs
new file mode 100644
index 00000000000..7ebd02c6136
--- /dev/null
+++ b/bindings/rust/foundationdb/src/keyselector.rs
@@ -0,0 +1,107 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! A `KeySelector` identifies a particular key in the database.
+
+use crate::tuple::Bytes;
+use std::borrow::Cow;
+
+/// A `KeySelector` identifies a particular key in the database.
+///
+/// FoundationDB's lexicographically ordered data model permits finding keys based on their order
+/// (for example, finding the first key in the database greater than a given key). Key selectors
+/// represent a description of a key in the database that could be resolved to an actual key by
+/// `Transaction::get_key` or used directly as the beginning or end of a range in
+/// `Transaction::getRange`.
+///
+/// Note that the way the key selectors are resolved is somewhat non-intuitive, so users who wish
+/// to use a key selector other than the default ones described below should probably consult that
+/// documentation before proceeding.
+///
+/// Generally one of the following static methods should be used to construct a KeySelector:
+///
+/// - `last_less_than`
+/// - `last_less_or_equal`
+/// - `first_greater_than`
+/// - `first_greater_or_equal`
+///
+/// A dedicated [example](https://github.com/foundationdb-rs/foundationdb-rs/blob/main/foundationdb/examples/key_selectors.rs) is available on Github.
+#[derive(Clone, Debug)]
+pub struct KeySelector<'a> {
+    key: Bytes<'a>,
+    or_equal: bool,
+    offset: i32,
+}
+
+impl<'a> KeySelector<'a> {
+    /// Constructs a new KeySelector from the given parameters.
+    pub const fn new(key: Cow<'a, [u8]>, or_equal: bool, offset: i32) -> Self {
+        Self {
+            key: Bytes(key),
+            or_equal,
+            offset,
+        }
+    }
+
+    /// Returns a the key that serves as the anchor for this `KeySelector`
+    pub fn key(&self) -> &[u8] {
+        self.key.as_ref()
+    }
+
+    /// True if this is an `or_equal` `KeySelector`
+    pub fn or_equal(&self) -> bool {
+        self.or_equal
+    }
+
+    /// Returns the key offset parameter for this `KeySelector`
+    pub fn offset(&self) -> i32 {
+        self.offset
+    }
+
+    /// Creates a `KeySelector` that picks the last key less than the parameter
+    pub fn last_less_than<K: Into<Cow<'a, [u8]>>>(key: K) -> Self {
+        Self::new(key.into(), false, 0)
+    }
+
+    /// Creates a `KeySelector` that picks the last key less than or equal to the parameter
+    pub fn last_less_or_equal<K: Into<Cow<'a, [u8]>>>(key: K) -> Self {
+        Self::new(key.into(), true, 0)
+    }
+
+    /// Creates a `KeySelector` that picks the first key greater than the parameter
+    pub fn first_greater_than<K: Into<Cow<'a, [u8]>>>(key: K) -> Self {
+        Self::new(key.into(), true, 1)
+    }
+
+    /// Creates a `KeySelector` that picks the first key greater than or equal to the parameter
+    pub fn first_greater_or_equal<K: Into<Cow<'a, [u8]>>>(key: K) -> Self {
+        Self::new(key.into(), false, 1)
+    }
+
+    fn make_key(&mut self, key: &[u8]) {
+        match &mut self.key {
+            Bytes(Cow::Borrowed(..)) => self.key = Bytes::from(key.to_owned()),
+            Bytes(Cow::Owned(vec)) => {
+                vec.clear();
+                vec.extend_from_slice(key);
+            }
+        };
+    }
+
+    pub(crate) fn make_first_greater_or_equal(&mut self, key: &[u8]) {
+        self.make_key(key);
+        self.or_equal = false;
+        self.offset = 1;
+    }
+
+    pub(crate) fn make_first_greater_than(&mut self, key: &[u8]) {
+        self.make_key(key);
+        self.or_equal = true;
+        self.offset = 1;
+    }
+}
diff --git a/bindings/rust/foundationdb/src/lib.rs b/bindings/rust/foundationdb/src/lib.rs
new file mode 100644
index 00000000000..f4cd4d76ea9
--- /dev/null
+++ b/bindings/rust/foundationdb/src/lib.rs
@@ -0,0 +1,151 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+#![doc = include_str!("../README.md")]
+
+use foundationdb_sys::if_cfg_api_versions;
+
+#[macro_use]
+extern crate static_assertions;
+
+pub mod api;
+#[deny(missing_docs)]
+pub mod budget;
+if_cfg_api_versions! {min = 510, max = 600 =>
+    pub mod cluster;
+}
+mod database;
+pub mod directory;
+#[deny(missing_docs)]
+pub mod env;
+mod error;
+if_cfg_api_versions! {min = 700 =>
+    #[deny(missing_docs)]
+    pub mod fdb_keys;
+}
+pub mod future;
+mod keyselector;
+if_cfg_api_versions! {min = 710 =>
+    #[deny(missing_docs)]
+    pub mod mapped_key_values;
+}
+
+pub mod metrics;
+
+/// Generated configuration types for use with the various `set_option` functions
+#[allow(clippy::all)]
+pub mod options;
+
+#[cfg(any(feature = "recipes", feature = "recipes-leader-election"))]
+pub mod recipes;
+
+// Re-export metrics types for convenience
+pub use crate::metrics::{
+    AttemptMetrics, AttemptOutcome, ConflictKeys, MetricsReport, TransactionMetrics,
+};
+
+#[deny(missing_docs)]
+pub mod runner;
+
+pub mod timekeeper;
+mod transaction;
+mod tuple_ext;
+
+pub mod tuple {
+    pub use crate::tuple_ext::*;
+    pub use foundationdb_tuple::*;
+}
+
+if_cfg_api_versions! {min = 510, max = 600 =>
+    pub use crate::cluster::Cluster;
+}
+
+pub use crate::budget::{AttemptUsage, BudgetExceeded, BudgetKind, ClientBudget, UsageSnapshot};
+pub use crate::database::*;
+pub use crate::env::{Clock, Environment, Rng, SeededRng, WallClock};
+pub use crate::error::{FdbBindingError, RetryDecision, RetryableError};
+pub use crate::error::{FdbError, FdbResult};
+pub use crate::keyselector::*;
+pub use crate::runner::{
+    AttemptFailure, MetricsHooks, NativeRetryPolicy, RetryPolicy, RunnerHooks, TransactionRunner,
+};
+pub use crate::transaction::*;
+
+/// Initialize the FoundationDB Client API and start the network thread.
+///
+/// Safe and idempotent: calling it multiple times returns `Ok` as long as the
+/// (default) API version matches. Calling it is optional: creating a [`Database`]
+/// initializes the client automatically. The network runs until process exit,
+/// where an atexit hook stops it and joins the network thread, or until an
+/// explicit [`api::stop_network`] call.
+///
+/// The returned guard is kept for backward compatibility, dropping it does
+/// nothing.
+///
+/// <div class="warning">
+///
+/// The automatic stop at process exit is a convenience suited to tests and
+/// short-lived tools. In a production application, prefer handling the network
+/// stop yourself: the network thread is the event loop driving every
+/// transaction, you may still have on-going operations at exit time, and you
+/// usually want a clean teardown. Finish or cancel your work, drop your
+/// [`Database`] handles, then call [`api::stop_network`].
+///
+/// </div>
+///
+/// # Errors
+///
+/// - error 2201 (`api_version_already_set`) if a different API version was
+///   selected before
+/// - error 2025 (`network_cannot_be_restarted`) if the network was stopped
+///
+/// # Examples
+///
+/// ```rust
+/// foundationdb::boot().expect("failed to initialize FoundationDB");
+/// // do some interesting things with the API...
+/// ```
+///
+/// ```rust
+/// #[tokio::main]
+/// async fn main() {
+///     foundationdb::boot().expect("failed to initialize FoundationDB");
+///     // do some interesting things with the API...
+/// }
+/// ```
+pub fn boot() -> FdbResult<api::NetworkAutoStop> {
+    api::FdbApiBuilder::default().build()?.boot()
+}
+
+/// Returns the default Fdb cluster configuration file path
+#[cfg(target_os = "linux")]
+pub fn default_config_path() -> &'static str {
+    "/etc/foundationdb/fdb.cluster"
+}
+
+/// Returns the default Fdb cluster configuration file path
+#[cfg(target_os = "macos")]
+pub fn default_config_path() -> &'static str {
+    "/usr/local/etc/foundationdb/fdb.cluster"
+}
+
+/// Returns the default Fdb cluster configuration file path
+#[cfg(target_os = "windows")]
+pub fn default_config_path() -> &'static str {
+    "C:/ProgramData/foundationdb/fdb.cluster"
+}
+
+/// slice::from_raw_parts assumes the pointer to be aligned and non-null.
+/// Since Rust nightly (mid-February 2024), it is enforced with debug asserts,
+/// but the FDBServer can return a null pointer if the slice is empty:
+/// ptr: 0x0, len: 0
+/// To avoid the assert, an empty slice is directly returned in that situation
+fn from_raw_fdb_slice<T, U: Into<usize>>(ptr: *const T, len: U) -> &'static [T] {
+    if ptr.is_null() {
+        return &[];
+    }
+    unsafe { std::slice::from_raw_parts(ptr, len.into()) }
+}
diff --git a/bindings/rust/foundationdb/src/mapped_key_values.rs b/bindings/rust/foundationdb/src/mapped_key_values.rs
new file mode 100644
index 00000000000..5b9da383741
--- /dev/null
+++ b/bindings/rust/foundationdb/src/mapped_key_values.rs
@@ -0,0 +1,271 @@
+// Copyright 2022 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Definitions of MappedKeyValues, used in api version 710 and more.
+//!
+//! GetMappedRange is an experimental feature introduced in FDB 7.1. It is intended to improve the
+//! client throughput and reduce latency for a commonly used traffic pattern.
+//! An experiment with Record Layer shows that this optimization can get 4x client throughput on a certain workload.
+//!
+//! More info can be found in the [relevant documentation](https://github.com/apple/foundationdb/wiki/Everything-about-GetMappedRange).
+
+use crate::from_raw_fdb_slice;
+use crate::future::{FdbFutureHandle, FdbKeyValue};
+use crate::{error, KeySelector};
+use crate::{FdbError, FdbResult};
+use foundationdb_sys as fdb_sys;
+use std::borrow::Cow;
+use std::fmt;
+
+use std::ops::Deref;
+use std::sync::Arc;
+
+/// An slice of mapped keyvalues owned by a foundationDB future produced by the `get_mapped` method.
+pub struct MappedKeyValues {
+    _f: FdbFutureHandle,
+    mapped_keyvalues: *const FdbMappedKeyValue,
+    len: i32,
+    more: bool,
+}
+unsafe impl Sync for MappedKeyValues {}
+unsafe impl Send for MappedKeyValues {}
+
+impl MappedKeyValues {
+    /// `true` if there is another range after this one
+    pub fn more(&self) -> bool {
+        self.more
+    }
+}
+
+impl TryFrom<FdbFutureHandle> for MappedKeyValues {
+    type Error = FdbError;
+    fn try_from(f: FdbFutureHandle) -> FdbResult<Self> {
+        let mut mapped_keyvalues = std::ptr::null();
+        let mut len = 0;
+        let mut more = 0;
+
+        unsafe {
+            error::eval(fdb_sys::fdb_future_get_mappedkeyvalue_array(
+                f.as_ptr(),
+                &mut mapped_keyvalues,
+                &mut len,
+                &mut more,
+            ))?
+        }
+
+        Ok(MappedKeyValues {
+            _f: f,
+            mapped_keyvalues: mapped_keyvalues as *const FdbMappedKeyValue,
+            len,
+            more: more != 0,
+        })
+    }
+}
+
+#[repr(C, packed)]
+/// A KeyValue produced by a mapped operation, ownder by a Foundation Future.
+pub struct FdbMappedKeyValue(fdb_sys::FDBMappedKeyValue);
+
+impl PartialEq for FdbMappedKeyValue {
+    fn eq(&self, other: &Self) -> bool {
+        (self.parent_key(), self.parent_value()) == (other.parent_key(), other.parent_value())
+    }
+}
+impl Eq for FdbMappedKeyValue {}
+impl fmt::Debug for FdbMappedKeyValue {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(
+            f,
+            "({:?}, {:?})",
+            crate::tuple::Bytes::from(self.parent_key()),
+            crate::tuple::Bytes::from(self.parent_value())
+        )
+    }
+}
+
+impl FdbMappedKeyValue {
+    /// Retrieves the "parent" key that generated the secondary scan.
+    pub fn parent_key(&self) -> &[u8] {
+        from_raw_fdb_slice(self.0.key.key, self.0.key.key_length as usize)
+    }
+
+    /// Retrieves the "parent" value that generated the secondary scan.
+    pub fn parent_value(&self) -> &[u8] {
+        from_raw_fdb_slice(self.0.value.key, self.0.value.key_length as usize)
+    }
+
+    /// Retrieves the beginning of the range
+    pub fn begin_range(&self) -> &[u8] {
+        from_raw_fdb_slice(
+            self.0.getRange.begin.key.key,
+            self.0.getRange.begin.key.key_length as usize,
+        )
+    }
+
+    /// Retrieves the end of the range
+    pub fn end_range(&self) -> &[u8] {
+        from_raw_fdb_slice(
+            self.0.getRange.end.key.key,
+            self.0.getRange.end.key.key_length as usize,
+        )
+    }
+
+    /// Retrieves the beginning of the range as a [`KeySelector`]
+    pub fn begin_selector(&self) -> KeySelector<'_> {
+        KeySelector::new(Cow::from(self.begin_range()), false, 0)
+    }
+
+    /// Retrieves the end of the range as a [`KeySelector`]
+    pub fn end_selector(&self) -> KeySelector<'_> {
+        KeySelector::new(Cow::from(self.end_range()), false, 0)
+    }
+
+    /// retrieves the associated slice of [`FdbKeyValue`]
+    pub fn key_values(&self) -> &[FdbKeyValue] {
+        from_raw_fdb_slice(
+            self.0.getRange.data as *const FdbKeyValue,
+            self.0.getRange.m_size as usize,
+        )
+    }
+}
+
+impl Deref for MappedKeyValues {
+    type Target = [FdbMappedKeyValue];
+
+    fn deref(&self) -> &Self::Target {
+        assert_eq_size!(FdbMappedKeyValue, fdb_sys::FDBMappedKeyValue);
+        assert_eq_align!(FdbMappedKeyValue, u8);
+        from_raw_fdb_slice(self.mapped_keyvalues, self.len as usize)
+    }
+}
+
+impl AsRef<[FdbMappedKeyValue]> for MappedKeyValues {
+    fn as_ref(&self) -> &[FdbMappedKeyValue] {
+        self.deref()
+    }
+}
+
+impl<'a> IntoIterator for &'a MappedKeyValues {
+    type Item = &'a FdbMappedKeyValue;
+    type IntoIter = std::slice::Iter<'a, FdbMappedKeyValue>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.deref().iter()
+    }
+}
+
+/// An FdbMappedValue that you can own.
+pub struct FdbMappedValue {
+    _f: Arc<FdbFutureHandle>,
+    mapped_keyvalue: *const FdbMappedKeyValue,
+}
+
+impl IntoIterator for MappedKeyValues {
+    type Item = FdbMappedValue;
+    type IntoIter = FdbMappedValuesIter;
+
+    fn into_iter(self) -> Self::IntoIter {
+        FdbMappedValuesIter {
+            f: Arc::new(self._f),
+            mapped_keyvalues: self.mapped_keyvalues,
+            len: self.len,
+            pos: 0,
+        }
+    }
+}
+
+unsafe impl Send for FdbMappedValue {}
+
+impl Deref for FdbMappedValue {
+    type Target = FdbMappedKeyValue;
+    fn deref(&self) -> &Self::Target {
+        assert_eq_size!(FdbMappedKeyValue, fdb_sys::FDBMappedKeyValue);
+        assert_eq_align!(FdbMappedKeyValue, u8);
+        unsafe { &*self.mapped_keyvalue }
+    }
+}
+impl AsRef<FdbMappedKeyValue> for FdbMappedValue {
+    fn as_ref(&self) -> &FdbMappedKeyValue {
+        self.deref()
+    }
+}
+impl PartialEq for FdbMappedValue {
+    fn eq(&self, other: &Self) -> bool {
+        self.deref() == other.deref()
+    }
+}
+impl Eq for FdbMappedValue {}
+
+/// An iterator of mapped keyvalues owned by a foundationDB future
+pub struct FdbMappedValuesIter {
+    f: Arc<FdbFutureHandle>,
+    mapped_keyvalues: *const FdbMappedKeyValue,
+    len: i32,
+    pos: i32,
+}
+
+unsafe impl Send for FdbMappedValuesIter {}
+
+impl Iterator for FdbMappedValuesIter {
+    type Item = FdbMappedValue;
+    fn next(&mut self) -> Option<Self::Item> {
+        #[allow(clippy::iter_nth_zero)]
+        self.nth(0)
+    }
+
+    fn nth(&mut self, n: usize) -> Option<Self::Item> {
+        let pos = (self.pos as usize).checked_add(n);
+        match pos {
+            Some(pos) if pos < self.len as usize => {
+                // safe because pos < self.len
+                let mapped_keyvalue = unsafe { self.mapped_keyvalues.add(pos) };
+                self.pos = pos as i32 + 1;
+
+                Some(FdbMappedValue {
+                    _f: self.f.clone(),
+                    mapped_keyvalue,
+                })
+            }
+            _ => {
+                self.pos = self.len;
+                None
+            }
+        }
+    }
+
+    fn size_hint(&self) -> (usize, Option<usize>) {
+        let rem = (self.len - self.pos) as usize;
+        (rem, Some(rem))
+    }
+}
+impl ExactSizeIterator for FdbMappedValuesIter {
+    #[inline]
+    fn len(&self) -> usize {
+        (self.len - self.pos) as usize
+    }
+}
+impl DoubleEndedIterator for FdbMappedValuesIter {
+    fn next_back(&mut self) -> Option<Self::Item> {
+        self.nth_back(0)
+    }
+
+    fn nth_back(&mut self, n: usize) -> Option<Self::Item> {
+        if n < self.len() {
+            self.len -= 1 + n as i32;
+            // safe because len < original len
+            let keyvalue = unsafe { self.mapped_keyvalues.add(self.len as usize) };
+            Some(FdbMappedValue {
+                _f: self.f.clone(),
+                mapped_keyvalue: keyvalue,
+            })
+        } else {
+            self.pos = self.len;
+            None
+        }
+    }
+}
diff --git a/bindings/rust/foundationdb/src/metrics.rs b/bindings/rust/foundationdb/src/metrics.rs
new file mode 100644
index 00000000000..1ffde68d800
--- /dev/null
+++ b/bindings/rust/foundationdb/src/metrics.rs
@@ -0,0 +1,614 @@
+//! Per-attempt metrics collected by [`Database::instrumented_run`](crate::Database::instrumented_run).
+//!
+//! The report is a list of [`AttemptMetrics`], one per transaction attempt, in
+//! order: a retried transaction keeps everything it did in its earlier
+//! attempts. Operation counters come from the always-on
+//! [`UsageSnapshot`] of the attempt, so
+//! instrumentation only adds the timings, the outcome and the aggregates on
+//! top of what the binding already counts.
+
+use crate::budget::{AttemptUsage, UsageSnapshot};
+use crate::error::FdbError;
+use crate::transaction::ConflictingKeyRange;
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+/// Label key-value pairs for metrics
+pub type Labels = Vec<(String, String)>;
+
+/// Unique key for a metric: name + labels
+#[derive(Clone, Hash, Eq, PartialEq, Debug)]
+pub struct MetricKey {
+    pub name: String,
+    pub labels: Labels,
+}
+
+impl MetricKey {
+    /// Create a new MetricKey
+    ///
+    /// # Arguments
+    /// * `name` - The name of the metric
+    /// * `labels` - Key-value pairs for labeling the metric
+    ///
+    /// # Returns
+    /// * `MetricKey` - A new MetricKey instance
+    pub fn new(name: &str, labels: &[(&str, &str)]) -> Self {
+        // Convert labels to owned strings
+        let mut sorted_labels: Labels = labels
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.to_string()))
+            .collect();
+
+        // Sort labels by key to ensure consistent ordering
+        sorted_labels.sort_by(|a, b| a.0.cmp(&b.0));
+
+        Self {
+            name: name.to_string(),
+            labels: sorted_labels,
+        }
+    }
+}
+
+/// How a transaction attempt ended.
+///
+/// Marked non exhaustive: finer-grained failure reporting is expected to add
+/// variants.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub enum AttemptOutcome {
+    /// The attempt committed. For a run, only the last attempt can be in this
+    /// state.
+    Committed,
+    /// The attempt was retried, `cause` being the error handed to `on_error`.
+    /// A closure error asking for a retry without a native error underneath
+    /// surfaces here as code 1020 (`not_committed`).
+    Retried { cause: FdbError },
+    /// The attempt ended the run without committing: the error was not
+    /// retryable, or the retries were exhausted.
+    Failed,
+}
+
+/// The conflicting key ranges of a transaction attempt.
+///
+/// They are only read after a commit conflict, and only carry ranges when
+/// [`TransactionOption::ReportConflictingKeys`](crate::options::TransactionOption::ReportConflictingKeys)
+/// was set on the transaction.
+#[derive(Debug, Clone, Default)]
+pub enum ConflictKeys {
+    /// The attempt did not fail on a commit conflict, so nothing was read.
+    #[default]
+    NotRequested,
+    /// The special keyspace was read. The list is empty when
+    /// `ReportConflictingKeys` was not enabled.
+    Available(Vec<ConflictingKeyRange>),
+    /// The special keyspace read failed.
+    ReadFailed(FdbError),
+}
+
+impl ConflictKeys {
+    /// The conflicting ranges, empty unless they were read successfully.
+    pub fn ranges(&self) -> &[ConflictingKeyRange] {
+        match self {
+            ConflictKeys::Available(ranges) => ranges,
+            ConflictKeys::NotRequested | ConflictKeys::ReadFailed(_) => &[],
+        }
+    }
+}
+
+/// Everything recorded about a single transaction attempt.
+///
+/// One is pushed to [`MetricsReport::attempts`] when the attempt ends, so an
+/// attempt that was retried keeps its own counters, timings and custom metrics
+/// instead of being overwritten by the next one.
+#[derive(Debug, Clone)]
+pub struct AttemptMetrics {
+    /// Position of the attempt in the run, starting at 0.
+    pub index: usize,
+    /// Operation counters and bytes of the attempt, from the always-on
+    /// accounting. See [`crate::budget`] for how precise they are.
+    pub usage: UsageSnapshot,
+    /// Application metrics recorded during the attempt with
+    /// [`Transaction::set_custom_metric`](crate::Transaction::set_custom_metric).
+    pub custom_metrics: HashMap<MetricKey, u64>,
+    /// Wall clock of the attempt, measured from its start to the end of its
+    /// work: the retry backoff performed by `on_error` is **not** included.
+    pub duration: Option<Duration>,
+    /// Time spent in `commit`, `None` if the attempt never reached it.
+    pub commit_duration: Option<Duration>,
+    /// Time spent waiting on `get_read_version`, `None` if it was never called.
+    /// The first completion of the attempt is kept.
+    pub grv_duration: Option<Duration>,
+    /// Time spent in `on_error`, backoff included. `None` if `on_error` did not
+    /// run, which is the case for the last attempt of a run.
+    pub on_error_duration: Option<Duration>,
+    /// How the attempt ended.
+    pub outcome: AttemptOutcome,
+    /// Conflicting key ranges, only read after a commit conflict.
+    pub conflicting_keys: ConflictKeys,
+    /// Read version of the attempt, recorded when
+    /// [`Transaction::get_read_version`](crate::Transaction::get_read_version)
+    /// is called. The binding never fetches it on its own.
+    pub read_version: Option<i64>,
+}
+
+/// Transaction-level information that spans attempts
+#[derive(Debug, Default, Clone)]
+pub struct TransactionInfo {
+    /// Number of retries performed, that is `attempts.len() - 1` for a
+    /// completed run
+    pub retries: u64,
+    /// Number of retries caused by commit conflicts (`not_committed`, error 1020)
+    pub conflict_count: u64,
+    /// Last read version observed, see [`AttemptMetrics::read_version`]
+    pub read_version: Option<i64>,
+    /// Commit version of the committed attempt
+    pub commit_version: Option<i64>,
+}
+
+/// The metrics of a whole `instrumented_run`: the detail of every attempt plus
+/// the aggregates that only make sense for the run as a whole.
+#[derive(Debug, Clone, Default)]
+pub struct MetricsReport {
+    /// One entry per transaction attempt, in order. Nothing is lost across
+    /// retries.
+    pub attempts: Vec<AttemptMetrics>,
+    /// Wall clock of the whole run, every attempt and backoff included.
+    pub total_duration: Option<Duration>,
+    /// Information that spans attempts.
+    pub transaction: TransactionInfo,
+}
+
+impl MetricsReport {
+    /// Sums the usage of every attempt, retries included.
+    ///
+    /// `elapsed` is the sum of the attempt durations, which is shorter than
+    /// [`total_duration`](Self::total_duration): the retry backoffs are not
+    /// part of any attempt.
+    pub fn total_usage(&self) -> UsageSnapshot {
+        self.attempts
+            .iter()
+            .fold(UsageSnapshot::default(), |mut total, attempt| {
+                let usage = &attempt.usage;
+                total.elapsed += usage.elapsed;
+                total.bytes_read += usage.bytes_read;
+                total.bytes_written += usage.bytes_written;
+                total.keys_values_fetched += usage.keys_values_fetched;
+                total.call_get += usage.call_get;
+                total.call_get_range += usage.call_get_range;
+                total.call_set += usage.call_set;
+                total.call_clear += usage.call_clear;
+                total.call_clear_range += usage.call_clear_range;
+                total.call_atomic_op += usage.call_atomic_op;
+                total
+            })
+    }
+
+    /// The attempt that ended the run, `None` if no attempt was ever started.
+    pub fn last_attempt(&self) -> Option<&AttemptMetrics> {
+        self.attempts.last()
+    }
+}
+
+/// The attempt currently being recorded.
+///
+/// Holds the accounting generation of the transaction, so that the attempt can
+/// be pushed to the report even after the transaction itself is gone (a
+/// non-retryable `on_error` consumes it), and the pieces that are known before
+/// the attempt ends.
+#[derive(Debug, Default)]
+struct OpenAttempt {
+    usage: Option<Arc<AttemptUsage>>,
+    duration: Option<Duration>,
+    commit_duration: Option<Duration>,
+    grv_duration: Option<Duration>,
+    conflicting_keys: ConflictKeys,
+    read_version: Option<i64>,
+}
+
+/// Collects the metrics of a transaction, attempt after attempt.
+///
+/// This is the handle shared between the transaction, the runner hooks and the
+/// caller: cloning it clones the handle, not the data. The recording methods
+/// are called by the binding as the transaction progresses, the report is read
+/// back with [`get_metrics_data`](Self::get_metrics_data).
+#[derive(Debug, Clone, Default)]
+pub struct TransactionMetrics {
+    /// The report being built.
+    pub metrics: Arc<Mutex<MetricsReport>>,
+    /// The attempt being recorded, pushed to the report when it ends.
+    open: Arc<Mutex<OpenAttempt>>,
+}
+
+impl TransactionMetrics {
+    /// Create a new instance of TransactionMetrics
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    fn report(&self) -> std::sync::MutexGuard<'_, MetricsReport> {
+        self.metrics
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+
+    fn open(&self) -> std::sync::MutexGuard<'_, OpenAttempt> {
+        self.open
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+
+    /// Starts recording a new attempt, on the accounting generation the
+    /// transaction just entered.
+    ///
+    /// Anything recorded on a previous attempt that was not ended with
+    /// [`finish_attempt`](Self::finish_attempt) is dropped: the transaction
+    /// restarted without reaching a conclusion, typically because
+    /// [`Transaction::set_client_budget`](crate::Transaction::set_client_budget)
+    /// or [`Transaction::reset`](crate::Transaction::reset) was called.
+    pub(crate) fn begin_attempt(&self, usage: Arc<AttemptUsage>) {
+        let mut open = self.open();
+
+        #[cfg(feature = "trace")]
+        if let Some(dropped) = open.usage.as_ref() {
+            // `elapsed` always moves, so the counters are what tells whether
+            // the attempt being dropped did anything worth reporting. Some
+            // activity is recorded straight on `OpenAttempt` instead of
+            // `AttemptUsage` (read version, conflicting keys, commit
+            // duration, grv duration), so it has to be checked too.
+            let snapshot = dropped.snapshot();
+            let idle = snapshot
+                == UsageSnapshot {
+                    elapsed: snapshot.elapsed,
+                    ..UsageSnapshot::default()
+                }
+                && dropped.custom_metrics().is_empty()
+                && open.read_version.is_none()
+                && open.duration.is_none()
+                && open.commit_duration.is_none()
+                && open.grv_duration.is_none()
+                && matches!(open.conflicting_keys, ConflictKeys::NotRequested);
+
+            if !idle {
+                tracing::warn!(
+                    "a new attempt was opened while the previous one was still open, its usage and custom metrics are dropped (set_client_budget or reset called mid-attempt)"
+                );
+            }
+        }
+
+        *open = OpenAttempt {
+            usage: Some(usage),
+            ..OpenAttempt::default()
+        };
+    }
+
+    /// Freezes the duration of the attempt at the current elapsed time, so that
+    /// what happens next (retry backoff, error handling) is not counted as part
+    /// of it. Later calls do not move it.
+    pub(crate) fn mark_attempt_end(&self) {
+        let mut open = self.open();
+        if open.duration.is_none() {
+            open.duration = open.usage.as_ref().map(|usage| usage.elapsed());
+        }
+    }
+
+    /// Records the time spent in `commit`, whatever its result, and ends the
+    /// attempt's work.
+    pub(crate) fn record_commit(&self, duration: Duration) {
+        let mut open = self.open();
+        open.commit_duration = Some(duration);
+        if open.duration.is_none() {
+            open.duration = open.usage.as_ref().map(|usage| usage.elapsed());
+        }
+    }
+
+    /// Records the time spent waiting on `get_read_version`, whatever its
+    /// result. Later calls of the same attempt are ignored.
+    pub(crate) fn record_grv(&self, duration: Duration) {
+        let mut open = self.open();
+        if open.grv_duration.is_none() {
+            open.grv_duration = Some(duration);
+        }
+    }
+
+    /// Ends the current attempt and pushes it to the report.
+    ///
+    /// Does nothing when no attempt is being recorded, which makes it safe to
+    /// call on the exit paths of a runner that may already have ended it.
+    pub fn finish_attempt(&self, outcome: AttemptOutcome) {
+        let (usage, open) = {
+            let mut open = self.open();
+            match open.usage.take() {
+                // `usage` was taken above, so this leaves the scratch empty.
+                Some(usage) => (usage, std::mem::take(&mut *open)),
+                None => return,
+            }
+        };
+
+        let retried = matches!(outcome, AttemptOutcome::Retried { .. });
+
+        let mut report = self.report();
+        let index = report.attempts.len();
+        report.attempts.push(AttemptMetrics {
+            index,
+            usage: usage.snapshot(),
+            custom_metrics: usage.custom_metrics(),
+            duration: open.duration.or_else(|| Some(usage.elapsed())),
+            commit_duration: open.commit_duration,
+            grv_duration: open.grv_duration,
+            on_error_duration: None,
+            outcome,
+            conflicting_keys: open.conflicting_keys,
+            read_version: open.read_version,
+        });
+
+        if retried {
+            report.transaction.retries += 1;
+        }
+    }
+
+    /// Records the time spent in `on_error` for the attempt that just ended.
+    ///
+    /// The runner measures it after `on_error` returned, hence after the
+    /// attempt was pushed: it lands on the last attempt of the report.
+    pub fn set_on_error_duration(&self, duration: Duration) {
+        if let Some(attempt) = self.report().attempts.last_mut() {
+            attempt.on_error_duration = Some(duration);
+        }
+    }
+
+    /// Records the total duration of the run.
+    pub fn set_total_duration(&self, duration: Duration) {
+        self.report().total_duration = Some(duration);
+    }
+
+    /// Records the read version of the current attempt.
+    pub fn set_read_version(&self, version: i64) {
+        self.open().read_version = Some(version);
+        self.report().transaction.read_version = Some(version);
+    }
+
+    /// Records the commit version of the transaction.
+    pub fn set_commit_version(&self, version: i64) {
+        self.report().transaction.commit_version = Some(version);
+    }
+
+    /// Records the conflicting key ranges of the current attempt.
+    pub fn set_conflicting_keys(&self, keys: ConflictKeys) {
+        self.open().conflicting_keys = keys;
+    }
+
+    /// Increment the conflict counter
+    pub fn increment_conflict_count(&self) {
+        self.report().transaction.conflict_count += 1;
+    }
+
+    /// Get the number of retries
+    pub fn get_retries(&self) -> u64 {
+        self.report().transaction.retries
+    }
+
+    /// Returns a clone of the report built so far.
+    pub fn get_metrics_data(&self) -> MetricsReport {
+        self.report().clone()
+    }
+
+    /// Returns a clone of the transaction information.
+    pub fn get_transaction_info(&self) -> TransactionInfo {
+        self.report().transaction.clone()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashSet;
+
+    #[test]
+    fn test_metric_key_equality() {
+        // Test that different combinations of the same labels are considered equal
+        let key1 = MetricKey::new("counter", &[("region", "us-west"), ("service", "api")]);
+        let key2 = MetricKey::new("counter", &[("service", "api"), ("region", "us-west")]);
+
+        // Same labels in different order should be considered equal
+        assert_eq!(key1, key2);
+
+        // Different label values should produce different keys
+        let key3 = MetricKey::new("counter", &[("region", "us-east"), ("service", "api")]);
+        assert_ne!(key1, key3);
+
+        // Different label keys should produce different keys
+        let key4 = MetricKey::new("counter", &[("zone", "us-west"), ("service", "api")]);
+        assert_ne!(key1, key4);
+
+        // Different metric names should produce different keys
+        let key5 = MetricKey::new("timer", &[("region", "us-west"), ("service", "api")]);
+        assert_ne!(key1, key5);
+    }
+
+    #[test]
+    fn test_metric_key_in_hashmap() {
+        let mut metrics = HashMap::new();
+
+        // Insert metrics with different label combinations
+        metrics.insert(
+            MetricKey::new("counter", &[("region", "us-west"), ("service", "api")]),
+            100,
+        );
+        metrics.insert(
+            MetricKey::new("counter", &[("region", "us-east"), ("service", "api")]),
+            200,
+        );
+        metrics.insert(
+            MetricKey::new("timer", &[("region", "us-west"), ("service", "api")]),
+            300,
+        );
+
+        // Verify we can retrieve metrics with the same label combinations
+        assert_eq!(
+            metrics.get(&MetricKey::new(
+                "counter",
+                &[("region", "us-west"), ("service", "api")]
+            )),
+            Some(&100)
+        );
+
+        // Verify we can retrieve metrics with labels in different order
+        assert_eq!(
+            metrics.get(&MetricKey::new(
+                "counter",
+                &[("service", "api"), ("region", "us-west")]
+            )),
+            Some(&100)
+        );
+
+        // Verify different label values produce different keys
+        assert_eq!(
+            metrics.get(&MetricKey::new(
+                "counter",
+                &[("region", "us-east"), ("service", "api")]
+            )),
+            Some(&200)
+        );
+
+        // Verify different metric names produce different keys
+        assert_eq!(
+            metrics.get(&MetricKey::new(
+                "timer",
+                &[("region", "us-west"), ("service", "api")]
+            )),
+            Some(&300)
+        );
+    }
+
+    #[test]
+    fn test_metric_key_label_order_independence() {
+        // Create a HashSet to verify uniqueness
+        let mut unique_keys = HashSet::new();
+
+        // Add keys with the same labels in different orders
+        unique_keys.insert(MetricKey::new(
+            "counter",
+            &[("a", "1"), ("b", "2"), ("c", "3")],
+        ));
+        unique_keys.insert(MetricKey::new(
+            "counter",
+            &[("a", "1"), ("c", "3"), ("b", "2")],
+        ));
+        unique_keys.insert(MetricKey::new(
+            "counter",
+            &[("b", "2"), ("a", "1"), ("c", "3")],
+        ));
+        unique_keys.insert(MetricKey::new(
+            "counter",
+            &[("b", "2"), ("c", "3"), ("a", "1")],
+        ));
+        unique_keys.insert(MetricKey::new(
+            "counter",
+            &[("c", "3"), ("a", "1"), ("b", "2")],
+        ));
+        unique_keys.insert(MetricKey::new(
+            "counter",
+            &[("c", "3"), ("b", "2"), ("a", "1")],
+        ));
+
+        // All permutations should be considered the same key
+        assert_eq!(unique_keys.len(), 1);
+    }
+
+    /// Every attempt keeps its own counters and custom metrics, and the report
+    /// aggregates them.
+    #[test]
+    fn attempts_are_recorded_one_by_one() {
+        let metrics = TransactionMetrics::new();
+        let key = MetricKey::new("documents", &[]);
+
+        // Nothing to push before an attempt is opened.
+        metrics.finish_attempt(AttemptOutcome::Failed);
+        assert!(metrics.get_metrics_data().attempts.is_empty());
+
+        let first = Arc::new(AttemptUsage::new());
+        metrics.begin_attempt(first.clone());
+        first.record_set(10);
+        first.increment_custom(key.clone(), 1);
+        metrics.record_commit(Duration::from_millis(3));
+        metrics.record_grv(Duration::from_millis(5));
+        metrics.record_grv(Duration::from_millis(1)); // first sample wins
+        metrics.finish_attempt(AttemptOutcome::Retried {
+            cause: FdbError::from_code(1020),
+        });
+        metrics.set_on_error_duration(Duration::from_millis(7));
+
+        let second = Arc::new(AttemptUsage::new());
+        metrics.begin_attempt(second.clone());
+        second.record_set(4);
+        second.increment_custom(key.clone(), 2);
+        metrics.finish_attempt(AttemptOutcome::Committed);
+
+        // A second end is a no-op: an attempt is pushed exactly once.
+        metrics.finish_attempt(AttemptOutcome::Failed);
+
+        let report = metrics.get_metrics_data();
+        assert_eq!(report.attempts.len(), 2);
+        assert_eq!(report.transaction.retries, 1);
+
+        let first = &report.attempts[0];
+        assert_eq!(first.index, 0);
+        assert_eq!(first.usage.bytes_written, 10);
+        assert_eq!(first.custom_metrics.get(&key), Some(&1));
+        assert_eq!(first.commit_duration, Some(Duration::from_millis(3)));
+        assert_eq!(first.grv_duration, Some(Duration::from_millis(5)));
+        assert_eq!(first.on_error_duration, Some(Duration::from_millis(7)));
+        assert!(matches!(
+            first.outcome,
+            AttemptOutcome::Retried { cause } if cause.code() == 1020
+        ));
+
+        let second = &report.attempts[1];
+        assert_eq!(second.index, 1);
+        assert_eq!(second.usage.bytes_written, 4);
+        assert_eq!(second.custom_metrics.get(&key), Some(&2));
+        assert!(second.commit_duration.is_none());
+        assert!(second.grv_duration.is_none());
+        assert!(matches!(second.outcome, AttemptOutcome::Committed));
+
+        assert_eq!(report.total_usage().bytes_written, 14);
+        assert_eq!(report.total_usage().call_set, 2);
+    }
+
+    /// An attempt whose only activity was `set_read_version` (no counter
+    /// touched, no custom metric) must not be silently dropped: it should be
+    /// discarded the same way a busy attempt is when a new one starts before
+    /// `finish_attempt` was called, and the crate must keep working normally
+    /// afterwards. This covers the state side of the `idle` heuristic in
+    /// `begin_attempt`; the `#[cfg(feature = "trace")]` warning itself is not
+    /// asserted here as the crate has no test pattern capturing `tracing`
+    /// output content (see `tests/trace.rs`, which only checks the writer
+    /// doesn't panic).
+    #[test]
+    fn dropped_attempt_with_only_read_version_is_handled() {
+        let metrics = TransactionMetrics::new();
+
+        let first = Arc::new(AttemptUsage::new());
+        metrics.begin_attempt(first.clone());
+        metrics.set_read_version(42);
+
+        // A new attempt starts (e.g. `set_client_budget`/`reset`) without the
+        // first one ever reaching `finish_attempt`: it must be dropped
+        // cleanly, no panic.
+        let second = Arc::new(AttemptUsage::new());
+        metrics.begin_attempt(second.clone());
+        second.record_set(1);
+        metrics.finish_attempt(AttemptOutcome::Committed);
+
+        let report = metrics.get_metrics_data();
+        assert_eq!(report.attempts.len(), 1);
+        let only = &report.attempts[0];
+        assert_eq!(only.usage.bytes_written, 1);
+        assert!(matches!(only.outcome, AttemptOutcome::Committed));
+
+        // The read version set on the dropped attempt is still reflected at
+        // the transaction level.
+        assert_eq!(report.transaction.read_version, Some(42));
+    }
+}
diff --git a/bindings/rust/foundationdb/src/options.rs b/bindings/rust/foundationdb/src/options.rs
new file mode 100644
index 00000000000..dbb879f98f6
--- /dev/null
+++ b/bindings/rust/foundationdb/src/options.rs
@@ -0,0 +1 @@
+include!(concat!(env!("OUT_DIR"), "/options.rs"));
diff --git a/bindings/rust/foundationdb/src/recipes/leader_election/algorithm.rs b/bindings/rust/foundationdb/src/recipes/leader_election/algorithm.rs
new file mode 100644
index 00000000000..df7d72645ad
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/leader_election/algorithm.rs
@@ -0,0 +1,427 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Transactional implementation of the Dynamo-style lease state machine.
+
+use crate::{
+    Transaction,
+    recipes::ranked_register::Rank,
+    tuple::{Subspace, pack, unpack},
+};
+use std::ops::Deref;
+use std::time::Duration;
+
+use super::types::PendingNextState;
+use super::{
+    ElectionState, LeaderElectionError, Leadership, LocalState, Observation, ParticipantId,
+    PollOutcome, PollResult, PollTransition, ResignOutcome, Result, keys::state_key,
+};
+
+const STATE_SCHEMA_VERSION: u64 = 1;
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+struct DurableState {
+    revision: u64,
+    owner: Option<ParticipantId>,
+    lease_duration: Option<Duration>,
+}
+
+async fn read_state<T>(txn: &T, key: &[u8]) -> Result<DurableState>
+where
+    T: Deref<Target = Transaction>,
+{
+    let Some(value) = txn.get(key, false).await? else {
+        return Ok(DurableState::default());
+    };
+
+    decode_state(&value)
+}
+
+fn decode_state(value: &[u8]) -> Result<DurableState> {
+    let (
+        schema_version,
+        revision,
+        has_owner,
+        owner,
+        has_lease_duration,
+        lease_duration_secs,
+        lease_duration_subsec_nanos,
+    ): (u64, u64, bool, String, bool, u64, u32) = unpack(value)?;
+    if schema_version != STATE_SCHEMA_VERSION {
+        return Err(LeaderElectionError::InvalidState(format!(
+            "unknown durable state schema version {schema_version}, expected {STATE_SCHEMA_VERSION}"
+        )));
+    }
+    let owner = if has_owner {
+        Some(ParticipantId::new(owner)?)
+    } else if owner.is_empty() {
+        None
+    } else {
+        return Err(LeaderElectionError::InvalidState(
+            "released state contains an owner ID".to_owned(),
+        ));
+    };
+    if !has_lease_duration && (lease_duration_secs != 0 || lease_duration_subsec_nanos != 0) {
+        return Err(LeaderElectionError::InvalidState(
+            "missing lease duration has non-zero fields".to_owned(),
+        ));
+    }
+    if has_lease_duration && lease_duration_subsec_nanos >= 1_000_000_000 {
+        return Err(LeaderElectionError::InvalidState(
+            "lease duration subsecond nanos is out of range".to_owned(),
+        ));
+    }
+    let lease_duration =
+        has_lease_duration.then(|| Duration::new(lease_duration_secs, lease_duration_subsec_nanos));
+    if revision == 0 && (owner.is_some() || lease_duration.is_some()) {
+        return Err(LeaderElectionError::InvalidState(
+            "zero revision state is not empty".to_owned(),
+        ));
+    }
+    if revision > 0 && lease_duration.is_none() {
+        return Err(LeaderElectionError::InvalidState(
+            "created state has no lease duration".to_owned(),
+        ));
+    }
+    if lease_duration == Some(Duration::ZERO) {
+        return Err(LeaderElectionError::InvalidState(
+            "persisted lease duration is zero".to_owned(),
+        ));
+    }
+    Ok(DurableState {
+        revision,
+        owner,
+        lease_duration,
+    })
+}
+
+fn write_state<T>(txn: &T, key: &[u8], state: &DurableState)
+where
+    T: Deref<Target = Transaction>,
+{
+    txn.set(key, &encode_state(state));
+}
+
+fn encode_state(state: &DurableState) -> Vec<u8> {
+    let owner = state.owner.as_ref().map_or("", ParticipantId::as_str);
+    let (lease_duration_secs, lease_duration_subsec_nanos) =
+        state.lease_duration.map_or((0, 0), |duration| {
+            (duration.as_secs(), duration.subsec_nanos())
+        });
+    pack(&(
+        STATE_SCHEMA_VERSION,
+        state.revision,
+        state.owner.is_some(),
+        owner,
+        state.lease_duration.is_some(),
+        lease_duration_secs,
+        lease_duration_subsec_nanos,
+    ))
+}
+
+fn next_revision(state: &DurableState) -> Result<u64> {
+    state
+        .revision
+        .checked_add(1)
+        .ok_or(LeaderElectionError::RevisionExhausted)
+}
+
+fn same_observation(state: &DurableState, observation: &Observation) -> bool {
+    state.owner.as_ref() == Some(observation.owner())
+        && state.revision == observation.rank().as_u64()
+        && state.lease_duration == Some(observation.lease_duration())
+}
+
+fn valid_leadership(
+    state: &DurableState,
+    participant: &ParticipantId,
+    leadership: &Leadership,
+    now: Duration,
+) -> bool {
+    leadership.participant() == participant
+        && state.owner.as_ref() == Some(participant)
+        && state.revision == leadership.rank().as_u64()
+        && state.lease_duration == Some(leadership.lease_duration())
+        && now.saturating_sub(leadership.last_renewed_at()) < leadership.lease_duration()
+}
+
+fn leader_result<T>(
+    txn: &T,
+    key: &[u8],
+    state: &DurableState,
+    participant: &ParticipantId,
+    lease_duration: Duration,
+    attempt_started_at: Duration,
+    transition: PollTransition,
+) -> Result<PollResult>
+where
+    T: Deref<Target = Transaction>,
+{
+    let revision = next_revision(state)?;
+    let next_state = DurableState {
+        revision,
+        owner: Some(participant.clone()),
+        lease_duration: Some(lease_duration),
+    };
+    write_state(txn, key, &next_state);
+    let rank = Rank::from(revision);
+
+    #[cfg(feature = "trace")]
+    let action = match transition {
+        PollTransition::Acquired => "acquisition",
+        PollTransition::Renewed => "renewal",
+        PollTransition::TookOver => "takeover",
+        PollTransition::Reacquired => "reacquisition",
+        PollTransition::Followed => "follower",
+    };
+
+    #[cfg(feature = "trace")]
+    tracing::debug!(
+        poll_outcome = "leader",
+        poll_action = action,
+        participant = participant.as_str(),
+        revision,
+        takeover = transition == PollTransition::TookOver,
+        reacquisition = transition == PollTransition::Reacquired,
+        "leader-election poll staged in transaction"
+    );
+
+    Ok(PollResult::new(
+        PollOutcome::Leader { rank, transition },
+        PendingNextState::leadership(Leadership::new(
+            participant.clone(),
+            rank,
+            lease_duration,
+            attempt_started_at,
+        )),
+    ))
+}
+
+fn follower_result(
+    state: &DurableState,
+    previous: Option<&Observation>,
+    _reason: &'static str,
+) -> Result<PollResult> {
+    let owner = state.owner.clone().ok_or_else(|| {
+        LeaderElectionError::InvalidState(
+            "follower result requested from released state".to_owned(),
+        )
+    })?;
+    let lease_duration = state.lease_duration.ok_or_else(|| {
+        LeaderElectionError::InvalidState(
+            "follower result requested without lease duration".to_owned(),
+        )
+    })?;
+    let rank = Rank::from(state.revision);
+    let next_observation = match previous {
+        Some(previous) if same_observation(state, previous) => {
+            PendingNextState::preserve_observation(previous.clone())
+        }
+        Some(_) | None => PendingNextState::new_observation(owner.clone(), rank, lease_duration),
+    };
+
+    #[cfg(feature = "trace")]
+    tracing::debug!(
+        poll_outcome = "follower",
+        poll_reason = _reason,
+        owner = owner.as_str(),
+        revision = rank.as_u64(),
+        "leader-election poll observed owner"
+    );
+
+    let outcome = PollOutcome::Follower {
+        owner,
+        rank,
+        lease_duration,
+    };
+
+    Ok(PollResult::new(outcome, next_observation))
+}
+
+pub(crate) async fn poll<T>(
+    txn: &T,
+    subspace: &Subspace,
+    lease_duration: Duration,
+    participant: &ParticipantId,
+    local_state: &LocalState,
+    attempt_started_at: Duration,
+) -> Result<PollResult>
+where
+    T: Deref<Target = Transaction>,
+{
+    let key = state_key(subspace);
+    let state = read_state(txn, &key).await?;
+
+    match local_state {
+        LocalState::Leadership(leadership)
+            if valid_leadership(&state, participant, leadership, attempt_started_at) =>
+        {
+            leader_result(
+                txn,
+                &key,
+                &state,
+                participant,
+                lease_duration,
+                attempt_started_at,
+                PollTransition::Renewed,
+            )
+        }
+        LocalState::Observation(observation) if state.owner.is_some() => {
+            if same_observation(&state, observation)
+                && attempt_started_at.saturating_sub(observation.first_observed_at())
+                    >= observation.lease_duration()
+            {
+                let transition = if observation.owner() == participant {
+                    PollTransition::Reacquired
+                } else {
+                    PollTransition::TookOver
+                };
+                leader_result(
+                    txn,
+                    &key,
+                    &state,
+                    participant,
+                    lease_duration,
+                    attempt_started_at,
+                    transition,
+                )
+            } else {
+                follower_result(&state, Some(observation), "observation")
+            }
+        }
+        LocalState::Unknown if state.owner.is_some() => follower_result(&state, None, "unknown"),
+        LocalState::Leadership(_) if state.owner.is_some() => {
+            follower_result(&state, None, "leadership_not_renewable")
+        }
+        LocalState::Observation(_) | LocalState::Unknown | LocalState::Leadership(_) => {
+            leader_result(
+                txn,
+                &key,
+                &state,
+                participant,
+                lease_duration,
+                attempt_started_at,
+                PollTransition::Acquired,
+            )
+        }
+    }
+}
+
+pub(crate) async fn state<T>(txn: &T, subspace: &Subspace) -> Result<ElectionState>
+where
+    T: Deref<Target = Transaction>,
+{
+    let state = read_state(txn, &state_key(subspace)).await?;
+    Ok(ElectionState::new(
+        state.owner,
+        Rank::from(state.revision),
+        state.lease_duration,
+    ))
+}
+
+pub(crate) async fn resign<T>(
+    txn: &T,
+    subspace: &Subspace,
+    leadership: &Leadership,
+) -> Result<ResignOutcome>
+where
+    T: Deref<Target = Transaction>,
+{
+    let key = state_key(subspace);
+    let state = read_state(txn, &key).await?;
+    if state.owner.as_ref() != Some(leadership.participant())
+        || state.revision != leadership.rank().as_u64()
+        || state.lease_duration != Some(leadership.lease_duration())
+    {
+        #[cfg(feature = "trace")]
+        let rejection_reason = if state.owner.as_ref() != Some(leadership.participant()) {
+            "owner_changed"
+        } else if state.revision != leadership.rank().as_u64() {
+            "revision_changed"
+        } else {
+            "lease_duration_changed"
+        };
+        #[cfg(feature = "trace")]
+        tracing::debug!(
+            resign_outcome = "rejected",
+            resign_reason = rejection_reason,
+            participant = leadership.participant().as_str(),
+            leadership_revision = leadership.rank().as_u64(),
+            revision = state.revision,
+            "leader-election stale resignation rejected"
+        );
+        return Ok(ResignOutcome::Rejected);
+    }
+
+    let released = DurableState {
+        revision: state.revision,
+        owner: None,
+        lease_duration: state.lease_duration,
+    };
+    write_state(txn, &key, &released);
+    #[cfg(feature = "trace")]
+    tracing::debug!(
+        resign_outcome = "resigned",
+        revision = released.revision,
+        "leader-election resignation staged in transaction"
+    );
+    Ok(ResignOutcome::Resigned)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn durable_state_version_one_round_trips() {
+        let state = DurableState {
+            revision: 42,
+            owner: Some(ParticipantId::new("alice-incarnation").unwrap()),
+            lease_duration: Some(Duration::new(5, 123)),
+        };
+
+        assert_eq!(decode_state(&encode_state(&state)).unwrap(), state);
+    }
+
+    #[test]
+    fn maximum_participant_id_keeps_durable_state_below_fdb_value_limit() {
+        let owner =
+            ParticipantId::new("\0".repeat((ParticipantId::MAX_ENCODED_BYTES - 2) / 2)).unwrap();
+        assert_eq!(
+            pack(&owner.as_str()).len(),
+            ParticipantId::MAX_ENCODED_BYTES
+        );
+        let state = DurableState {
+            revision: u64::MAX,
+            owner: Some(owner),
+            lease_duration: Some(Duration::new(u64::MAX, 999_999_999)),
+        };
+
+        assert!(encode_state(&state).len() <= 100_000);
+    }
+
+    #[test]
+    fn unknown_durable_state_schema_version_is_rejected() {
+        let value = pack(&(2_u64, 1_u64, true, "alice", true, 5_u64, 0_u32));
+
+        assert!(matches!(
+            decode_state(&value),
+            Err(LeaderElectionError::InvalidState(message))
+                if message.contains("unknown durable state schema version 2")
+        ));
+    }
+
+    #[test]
+    fn untagged_six_field_durable_state_is_rejected() {
+        let value = pack(&(1_u64, true, "alice", true, 5_u64, 0_u32));
+
+        assert!(matches!(
+            decode_state(&value),
+            Err(LeaderElectionError::PackError(_))
+        ));
+    }
+}
diff --git a/bindings/rust/foundationdb/src/recipes/leader_election/errors.rs b/bindings/rust/foundationdb/src/recipes/leader_election/errors.rs
new file mode 100644
index 00000000000..612ea555c76
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/leader_election/errors.rs
@@ -0,0 +1,150 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Error types returned by leader-election operations.
+
+use crate::tuple::PackError;
+use crate::{FdbBindingError, FdbError, RetryableError};
+use std::fmt;
+
+/// Leader-election-specific errors.
+///
+/// [`LeaderElectionError::Fdb`] retains the underlying FoundationDB error for
+/// the caller's transaction runner to classify. The other variants identify
+/// invalid local configuration, unsupported durable data, or a protocol limit.
+#[derive(Debug)]
+pub enum LeaderElectionError {
+    /// The durable state could not be decoded or violated a protocol invariant.
+    ///
+    /// Do not treat this as an unowned state. It can indicate corrupt data, an
+    /// incompatible schema, or data written outside this recipe.
+    InvalidState(String),
+    /// A [`ParticipantId`](super::ParticipantId) was empty.
+    ///
+    /// Empty text cannot distinguish a participating process incarnation.
+    InvalidParticipantId,
+    /// A [`ParticipantId`](super::ParticipantId) exceeds the encoded-size limit.
+    ///
+    /// The limit includes tuple encoding and NUL escaping, so it guarantees the
+    /// complete durable election state fits below FoundationDB's value limit.
+    ParticipantIdTooLarge {
+        /// Tuple-encoded participant ID size in bytes.
+        encoded_size: usize,
+        /// Maximum supported tuple-encoded participant ID size in bytes.
+        limit: usize,
+    },
+    /// A configured lease duration was zero.
+    ///
+    /// A zero duration would make every local validity interval immediately
+    /// expired, so [`super::LeaderElection::new`] rejects it.
+    InvalidLeaseDuration,
+    /// The durable revision reached `u64::MAX`.
+    ///
+    /// No further ownership transition can create a strictly newer fencing
+    /// rank in this election subspace.
+    RevisionExhausted,
+    /// An underlying FoundationDB read, write, or commit-related error occurred.
+    ///
+    /// Inspect the source error and let the enclosing transaction runner apply
+    /// its normal retry policy where appropriate.
+    Fdb(FdbError),
+    /// A transaction-runner error occurred.
+    Binding(Box<FdbBindingError>),
+    /// Failed to encode or decode the recipe's durable tuple state.
+    ///
+    /// On reads this can accompany malformed or incompatible durable data; on
+    /// writes it prevents staging the requested state change.
+    PackError(PackError),
+}
+
+impl fmt::Display for LeaderElectionError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidState(message) => write!(f, "Invalid leader election state: {message}"),
+            Self::InvalidParticipantId => write!(f, "Participant ID must not be empty"),
+            Self::ParticipantIdTooLarge {
+                encoded_size,
+                limit,
+            } => write!(
+                f,
+                "Encoded participant ID is {encoded_size} bytes, above the {limit}-byte limit"
+            ),
+            Self::InvalidLeaseDuration => write!(f, "Lease duration must not be zero"),
+            Self::RevisionExhausted => write!(f, "Leader-election revision is exhausted"),
+            Self::Fdb(error) => write!(f, "Database error: {error}"),
+            Self::Binding(error) => write!(f, "Retry loop error: {error}"),
+            Self::PackError(error) => write!(f, "Pack error: {error:?}"),
+        }
+    }
+}
+
+impl std::error::Error for LeaderElectionError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Fdb(error) => Some(error),
+            Self::Binding(error) => Some(error.as_ref()),
+            Self::PackError(error) => Some(error),
+            Self::InvalidState(_)
+            | Self::InvalidParticipantId
+            | Self::ParticipantIdTooLarge { .. }
+            | Self::InvalidLeaseDuration
+            | Self::RevisionExhausted => None,
+        }
+    }
+}
+
+impl From<FdbError> for LeaderElectionError {
+    fn from(error: FdbError) -> Self {
+        Self::Fdb(error)
+    }
+}
+
+impl From<FdbBindingError> for LeaderElectionError {
+    fn from(error: FdbBindingError) -> Self {
+        Self::Binding(Box::new(error))
+    }
+}
+
+impl From<PackError> for LeaderElectionError {
+    fn from(error: PackError) -> Self {
+        Self::PackError(error)
+    }
+}
+
+/// The `source()` chain exposes wrapped FoundationDB errors, so the default
+/// retry decision is transparent to `Database::run`.
+impl RetryableError for LeaderElectionError {}
+
+/// Result type for [`super::LeaderElection`] operations.
+pub type Result<T> = std::result::Result<T, LeaderElectionError>;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{RetryDecision, RetryableError};
+
+    #[test]
+    fn fdb_errors_are_retry_transparent() {
+        let error = LeaderElectionError::Fdb(FdbError::from_code(1020));
+
+        assert!(matches!(error.retry_decision(), RetryDecision::Fdb(_)));
+    }
+
+    #[test]
+    fn runner_errors_are_preserved() {
+        let error = LeaderElectionError::from(FdbBindingError::ReferenceToTransactionKept);
+
+        assert!(matches!(error, LeaderElectionError::Binding(_)));
+    }
+
+    #[test]
+    fn runner_error_source_chain_is_retry_transparent() {
+        let error = LeaderElectionError::from(FdbBindingError::from(FdbError::from_code(1020)));
+
+        assert!(matches!(error.retry_decision(), RetryDecision::Fdb(_)));
+    }
+}
diff --git a/bindings/rust/foundationdb/src/recipes/leader_election/keys.rs b/bindings/rust/foundationdb/src/recipes/leader_election/keys.rs
new file mode 100644
index 00000000000..4b64f5ecea0
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/leader_election/keys.rs
@@ -0,0 +1,36 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Key management for leader election.
+//!
+//! A single key holds the durable coordination state. It stores the relative
+//! lease duration, but no clock reading, absolute timestamp, renewal time, or
+//! expiry deadline. Takeover timing is a local caller concern.
+//!
+//! # Value schema
+//!
+//! ```text
+//! (schema_version: u64, revision: u64, has_owner: bool, owner: String,
+//!  has_lease_duration: bool, lease_duration_secs: u64,
+//!  lease_duration_subsec_nanos: u32)
+//! ```
+//!
+//! The schema version is decoded strictly. Untagged layouts from development
+//! versions of this recipe are unsupported: clear the election subspace before
+//! using this version of the recipe. The election revision is also the fencing
+//! rank for every paired ranked register, so clear those register subspaces
+//! before reuse as well. Leaving an older register fence in place rejects the
+//! new election's lower ranks.
+
+use crate::tuple::Subspace;
+
+const STATE_PREFIX: &str = "state";
+
+/// Returns the single durable election-state key.
+pub(crate) fn state_key(subspace: &Subspace) -> Vec<u8> {
+    subspace.pack(&(STATE_PREFIX,))
+}
diff --git a/bindings/rust/foundationdb/src/recipes/leader_election/mod.rs b/bindings/rust/foundationdb/src/recipes/leader_election/mod.rs
new file mode 100644
index 00000000000..888cd2e6901
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/leader_election/mod.rs
@@ -0,0 +1,326 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Poll-based Dynamo-style leader leases with FoundationDB fencing.
+//!
+//! This recipe adapts the client-side timing model of the
+//! [Amazon DynamoDB lock client](https://aws.amazon.com/blogs/aws/new-amazon-dynamodb-lock-client/).
+//! A caller observes a durable owner record and uses elapsed time from its own
+//! monotonic clock to decide when that unchanged record is suspicious.
+//! FoundationDB's serializable transaction on one state key, not local time,
+//! resolves concurrent acquisition, renewal, reacquisition, and takeover.
+//! The protocol is Dynamo-inspired, not wire-compatible with the DynamoDB lock
+//! client.
+//!
+//! ## Durable state and local time
+//!
+//! Durable state contains an optional owner, a monotonically increasing
+//! revision, and the last persisted relative lease duration. It contains no
+//! wall-clock or monotonic-clock reading, last-renewed timestamp, deadline, or
+//! expiry. A released record retains its revision and duration, while a
+//! never-created record has revision zero and no duration.
+//!
+//! [`Leadership`](crate::recipes::leader_election::Leadership) and
+//! [`Observation`](crate::recipes::leader_election::Observation) are caller-local
+//! state. A leadership token may renew only while elapsed time on that caller's
+//! clock is below the duration stored in its exact durable revision. A follower
+//! waits the duration stored in its exact observation, never this handle's
+//! configured duration.
+//! If the observed owner, revision, or duration changes, the caller starts a
+//! new observation window. If it is unchanged, the original observation time
+//! is retained.
+//!
+//! Clocks are never persisted or compared across processes. They only measure
+//! elapsed time for the caller that recorded them. On process restart, use a
+//! fresh [`ParticipantId`](crate::recipes::leader_election::ParticipantId) and
+//! begin again with
+//! [`LocalState::Unknown`](crate::recipes::leader_election::LocalState::Unknown),
+//! so the new incarnation observes the durable state and waits anew before
+//! attempting takeover.
+//!
+//! ## Cutover from v0.11 durable state
+//!
+//! This release's durable state is intentionally incompatible with v0.11.
+//! v0.11 and new clients use different keys, so a mixed deployment is unsafe:
+//! each population can elect a leader without observing or fencing the other.
+//!
+//! Upgrade by a destructive cutover, not an in-place migration. Stop or
+//! quiesce every old participant and all protected work before starting the
+//! new deployment. Then allocate fresh subspaces or epochs for the new
+//! election, its [`RankedRegister`](crate::recipes::ranked_register::RankedRegister),
+//! and the protected sink or rank namespace. Only then start clients using
+//! this release. This recipe neither reads nor migrates v0.11 durable state.
+//!
+//! ## Poll lifecycle
+//!
+//! Call [`LeaderElection::poll`](crate::recipes::leader_election::LeaderElection::poll)
+//! inside the closure passed to
+//! [`Database::run`](crate::Database::run). Read `attempt_started_at` from the
+//! caller's monotonic clock immediately before each `poll` call, including
+//! every retry attempt. It controls renewal and takeover eligibility and stamps
+//! new leadership, so time spent reading, retrying, or committing only shortens
+//! local validity.
+//!
+//! A returned [`PollResult`](crate::recipes::leader_election::PollResult) is
+//! only prepared state. Adopt it with
+//! [`PollResult::into_next_state`](crate::recipes::leader_election::PollResult::into_next_state)
+//! after the outer `Database::run` succeeds. Use a fresh `adopted_at` reading
+//! then: it starts timing for a new or reset observation only after its durable
+//! read is known to have committed. An unchanged observation and a new
+//! leadership token retain their original attempt-local times. This prevents
+//! retries, cancellation, and unknown commits from authorizing work based on
+//! uncommitted caller-local state.
+//!
+//! The poll transaction reads and, for a leadership transition, writes the
+//! same durable key. FoundationDB conflict resolution serializes competing
+//! transitions. Local time only permits an attempted conditional takeover; it
+//! does not prove that the prior process stopped.
+//!
+//! ## Renewal cadence and fencing epochs
+//!
+//! Renew with substantial headroom before local expiry. A cadence around one
+//! third of a lease leaves more room than polling at half a lease for
+//! scheduling delay, transaction retries, and commit latency. Tune it to the
+//! application's latency budget. This is availability guidance, not a safety
+//! condition or a durable expiry.
+//!
+//! A successful acquisition, renewal, reacquisition, or takeover returns a
+//! fresh [`Rank`](crate::recipes::ranked_register::Rank). Each is a new fencing
+//! epoch, including renewal by the same participant. Once the newer rank is
+//! installed, protected work using an older rank, even from that same process,
+//! can be rejected. Leadership status alone never authorizes an unfenced
+//! external side effect.
+//!
+//! Ranks returned by this recipe are opaque durable revisions. Do not mix them
+//! with [`Rank::new`](crate::recipes::ranked_register::Rank::new) values in the
+//! same ranked register or rank space. A manually constructed rank can exceed
+//! every future election revision and permanently fence election-backed work.
+//!
+//! Correctness-sensitive FoundationDB work must use the rank with a
+//! [`RankedRegister`](crate::recipes::ranked_register::RankedRegister) in the
+//! same enclosing transaction. An external sink must atomically enforce the
+//! rank and reject older ranks. See the
+//! [`RankedRegister` composition example](crate::recipes::ranked_register#composing-with-leader-election)
+//! rather than treating a successful poll as sufficient authorization.
+//!
+//! ## Safety versus liveness
+//!
+//! Local expiry does not revoke durable ownership. It only prevents this caller
+//! from renewing with its local token and can lead a follower with an unchanged
+//! observation to attempt takeover. A failed or unavailable poll cannot renew
+//! leadership, so callers must stop protected work that depends on a stale
+//! local token. Fencing ranks, not timing alone, protect against a delayed or
+//! partitioned process.
+//!
+//! Do not rely on a background heartbeat that cannot interrupt, fence, or stop
+//! in-progress protected work. It can renew a lease, but the protected-work
+//! path must still stop when it cannot obtain and use a current fencing rank.
+//!
+//! ## Protocol walkthrough
+//!
+//! 1. Create a non-zero-duration
+//!    [`LeaderElection`](crate::recipes::leader_election::LeaderElection) and a
+//!    fresh [`ParticipantId`](crate::recipes::leader_election::ParticipantId)
+//!    for this process incarnation. Start with
+//!    [`LocalState::Unknown`](crate::recipes::leader_election::LocalState::Unknown).
+//! 2. Poll in a `Database::run` attempt. A released or never-created state
+//!    produces [`PollOutcome::Leader`](crate::recipes::leader_election::PollOutcome::Leader)
+//!    with [`PollTransition::Acquired`](crate::recipes::leader_election::PollTransition::Acquired).
+//!    After the outer transaction succeeds, adopt its
+//!    [`Leadership`](crate::recipes::leader_election::Leadership) through
+//!    [`PollResult::into_next_state`](crate::recipes::leader_election::PollResult::into_next_state).
+//! 3. A caller that sees another owner receives
+//!    [`PollOutcome::Follower`](crate::recipes::leader_election::PollOutcome::Follower).
+//!    Its next [`LocalState`](crate::recipes::leader_election::LocalState)
+//!    contains an [`Observation`](crate::recipes::leader_election::Observation)
+//!    of that exact owner, revision, duration, and local observation time.
+//!    Repeated polls preserve that time only while the durable record is
+//!    unchanged.
+//! 4. The current holder polls with its matching, locally unexpired
+//!    [`Leadership`](crate::recipes::leader_election::Leadership) and receives
+//!    [`PollTransition::Renewed`](crate::recipes::leader_election::PollTransition::Renewed)
+//!    with a new rank. An unchanged observation that has waited at least its
+//!    persisted duration permits
+//!    [`PollTransition::TookOver`](crate::recipes::leader_election::PollTransition::TookOver),
+//!    or [`PollTransition::Reacquired`](crate::recipes::leader_election::PollTransition::Reacquired)
+//!    when the observer is the same participant.
+//! 5. For every leader outcome, co-commit the protected FoundationDB work with
+//!    the returned [`Rank`](crate::recipes::ranked_register::Rank), including
+//!    [`RankedRegister::read`](crate::recipes::ranked_register::RankedRegister::read)
+//!    to install its fence. A later rank fences delayed work using every older
+//!    rank.
+//! 6. A holder may call
+//!    [`LeaderElection::resign`](crate::recipes::leader_election::LeaderElection::resign)
+//!    with its exact leadership token. The conditional release preserves the
+//!    revision, so the next acquisition receives a strictly newer rank. A stale
+//!    resignation is rejected.
+//! 7. If the outer run retries, fails, is cancelled, or has an unknown commit,
+//!    do not adopt its `PollResult`. The next successful run rediscovers the
+//!    durable state. After restart, discard all local state, generate a fresh
+//!    participant ID, and follow the observation path again.
+//!
+//! ## Caller responsibilities
+//!
+//! The caller owns scheduling, retry policy, transaction options, sleeping,
+//! randomization, background work, and caller-local state. This component does
+//! not call `Database::run`, retry, set transaction options, sleep, draw random
+//! values, start background work, or read wall-clock time.
+//!
+//! ## Further reading
+//!
+//! - [AWS Builders Library: Leader Election in Distributed Systems](https://aws.amazon.com/builders-library/leader-election-in-distributed-systems/)
+//! - [Martin Kleppmann: How to do distributed locking](https://martin.kleppmann.com/2016/02/08/how-to-do-distributed-locking.html)
+//! - Mike Burrows, "The Chubby Lock Service for Loosely-Coupled Distributed
+//!   Systems" (OSDI 2006).
+//! - Gregory Chockler and Dahlia Malkhi, "Active Disk Paxos with Infinitely
+//!   Many Processes" (PODC 2002).
+//! - Salman Niazi, Mahmoud Ismail, Gautier Berthou, and Jim Dowling, "Leader
+//!   Election Using NewSQL Database Systems" (DAIS 2015, LNCS 9038).
+//! - [AWS Labs: Amazon DynamoDB Lock Client](https://github.com/awslabs/amazon-dynamodb-lock-client)
+//! - [Apache ZooKeeper Recipes, GUID note](https://zookeeper.apache.org/doc/r3.5.5/recipes.html)
+
+mod algorithm;
+mod errors;
+mod keys;
+mod types;
+
+pub use errors::{LeaderElectionError, Result};
+pub use types::{
+    ElectionState, Leadership, LocalState, Observation, ParticipantId, PollOutcome, PollResult,
+    PollTransition, ResignOutcome,
+};
+
+use crate::{Transaction, tuple::Subspace};
+use std::ops::Deref;
+use std::time::Duration;
+
+/// A handle for one independently scoped leader lease.
+///
+/// `lease_duration` is this caller's non-zero desired duration. It is
+/// persisted on every successful acquisition, takeover, and renewal. Existing
+/// foreign records remain governed by their own persisted duration. The handle
+/// holds no caller-local state and performs no scheduling or retries.
+#[derive(Clone, Debug)]
+pub struct LeaderElection {
+    subspace: Subspace,
+    lease_duration: Duration,
+}
+
+impl LeaderElection {
+    /// Creates an election handle with the non-zero duration it will persist on
+    /// successful ownership changes.
+    ///
+    /// Constructing a handle does not read or initialize durable state.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(subspace))
+    )]
+    pub fn new(subspace: Subspace, lease_duration: Duration) -> Result<Self> {
+        if lease_duration.is_zero() {
+            return Err(LeaderElectionError::InvalidLeaseDuration);
+        }
+        Ok(Self {
+            subspace,
+            lease_duration,
+        })
+    }
+
+    /// Returns this handle's desired duration for its future owner records.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn lease_duration(&self) -> Duration {
+        self.lease_duration
+    }
+
+    /// Polls the durable lease state in the caller's transaction.
+    ///
+    /// A released state is acquired immediately. An exact, locally unexpired
+    /// [`Leadership`] token renews ownership with a fresh revision. A first or
+    /// changed [`Observation`] never steals; only an exact unchanged observation
+    /// may take over, or same-owner reacquire, after the observed record's
+    /// persisted duration. An expired or mismatched leadership token becomes
+    /// observation/reacquisition state and cannot renew directly.
+    ///
+    /// `attempt_started_at` must be read from the caller's monotonic clock
+    /// immediately before this call in each retry attempt. It is deliberately
+    /// before the durable read, making renewal and takeover decisions
+    /// conservative relative to read and commit delay. After the enclosing
+    /// `Database::run` succeeds, pass a fresh caller-clock reading to
+    /// [`PollResult::into_next_state`] to adopt the returned state.
+    ///
+    /// Renew well before the local deadline represented by [`Leadership`],
+    /// leaving headroom for scheduling delay, retries, and commit latency.
+    /// This affects availability only; it is not a durable expiry or safety
+    /// condition.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(
+            level = "debug",
+            skip(self, txn, participant, local_state),
+            fields(participant = participant.as_str())
+        )
+    )]
+    pub async fn poll<T>(
+        &self,
+        txn: &T,
+        participant: &ParticipantId,
+        local_state: &LocalState,
+        attempt_started_at: Duration,
+    ) -> Result<PollResult>
+    where
+        T: Deref<Target = Transaction>,
+    {
+        algorithm::poll(
+            txn,
+            &self.subspace,
+            self.lease_duration,
+            participant,
+            local_state,
+            attempt_started_at,
+        )
+        .await
+    }
+
+    /// Reads durable state without making any liveness or leadership-validity claim.
+    ///
+    /// This is a snapshot only. It does not create a local observation, permit
+    /// renewal or takeover, or authorize protected work.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, txn))
+    )]
+    pub async fn state<T>(&self, txn: &T) -> Result<ElectionState>
+    where
+        T: Deref<Target = Transaction>,
+    {
+        algorithm::state(txn, &self.subspace).await
+    }
+
+    /// Releases ownership only when `leadership` still exactly matches durable state.
+    ///
+    /// The revision and persisted duration remain, so a later acquisition has
+    /// a strictly newer fencing rank. A stale delayed resignation is rejected.
+    /// This conditional operation does not make a liveness claim and may be
+    /// used to relinquish an otherwise exact durable token after its local
+    /// renewal window has elapsed.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(
+            level = "debug",
+            skip(self, txn, leadership),
+            fields(
+                participant = leadership.participant().as_str(),
+                leadership_revision = leadership.rank().as_u64()
+            )
+        )
+    )]
+    pub async fn resign<T>(&self, txn: &T, leadership: &Leadership) -> Result<ResignOutcome>
+    where
+        T: Deref<Target = Transaction>,
+    {
+        algorithm::resign(txn, &self.subspace, leadership).await
+    }
+}
diff --git a/bindings/rust/foundationdb/src/recipes/leader_election/types.rs b/bindings/rust/foundationdb/src/recipes/leader_election/types.rs
new file mode 100644
index 00000000000..e3db8a89623
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/leader_election/types.rs
@@ -0,0 +1,549 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Public values exchanged with the Dynamo-style lease protocol.
+
+use super::{LeaderElectionError, Result};
+use crate::recipes::ranked_register::Rank;
+use std::time::Duration;
+
+/// Identifies one caller process incarnation participating in an election.
+///
+/// Keep one ID for the lifetime of a process incarnation, then use a fresh ID
+/// after restart. Reusing an ID across concurrent callers is protocol misuse:
+/// fencing ranks preserve durable data safety, but the callers cannot safely
+/// coordinate leadership or protected work as one incarnation.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct ParticipantId(String);
+
+impl ParticipantId {
+    /// Maximum tuple-encoded size of a process-incarnation ID.
+    ///
+    /// The limit includes the tuple string type code, terminator, and escaping
+    /// of embedded NUL bytes. It leaves enough space for the rest of the
+    /// durable election state below FoundationDB's 100,000-byte value limit.
+    pub const MAX_ENCODED_BYTES: usize = 95_000;
+
+    /// Creates a non-empty process-incarnation ID within the encoded-size limit.
+    ///
+    /// The value is persisted as the durable owner when this participant leads,
+    /// so it must distinguish a restarted process from its previous incarnation.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(value)))]
+    pub fn new(value: impl Into<String>) -> Result<Self> {
+        let value = value.into();
+        if value.is_empty() {
+            return Err(LeaderElectionError::InvalidParticipantId);
+        }
+        let encoded_size = value
+            .bytes()
+            .filter(|byte| *byte == 0)
+            .fold(value.len().saturating_add(2), |size, _| {
+                size.saturating_add(1)
+            });
+        if encoded_size > Self::MAX_ENCODED_BYTES {
+            return Err(LeaderElectionError::ParticipantIdTooLarge {
+                encoded_size,
+                limit: Self::MAX_ENCODED_BYTES,
+            });
+        }
+        Ok(Self(value))
+    }
+
+    /// Returns the caller-supplied process-incarnation ID as text.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn participant_id_accepts_the_encoded_size_limit() {
+        let value = "\0".repeat((ParticipantId::MAX_ENCODED_BYTES - 2) / 2);
+
+        assert!(ParticipantId::new(value).is_ok());
+    }
+
+    #[test]
+    fn participant_id_rejects_an_encoded_size_above_the_limit() {
+        let value = "\0".repeat(ParticipantId::MAX_ENCODED_BYTES / 2);
+
+        match ParticipantId::new(value) {
+            Err(LeaderElectionError::ParticipantIdTooLarge {
+                encoded_size,
+                limit,
+            }) => {
+                assert_eq!(encoded_size, ParticipantId::MAX_ENCODED_BYTES + 2);
+                assert_eq!(limit, ParticipantId::MAX_ENCODED_BYTES);
+            }
+            result => panic!("expected an oversized participant ID error, got {result:?}"),
+        }
+    }
+}
+
+/// Caller-owned state carried between successful outer transactions.
+///
+/// No variant is persisted or transferable to another process incarnation. Its
+/// timing values belong to the caller's monotonic clock. Replace it only with
+/// [`PollResult::into_next_state`] after the enclosing
+/// [`Database::run`](crate::Database::run) succeeds.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum LocalState {
+    /// No durable state has been adopted by this caller.
+    Unknown,
+    /// An exact durable owner record this caller is not authorized to renew.
+    ///
+    /// The preserved observation time can permit a conditional takeover only
+    /// if a later poll sees the same owner, revision, and lease duration.
+    Observation(Observation),
+    /// The exact durable owner record this caller may attempt to renew locally.
+    ///
+    /// It does not prove current durable ownership. A later poll must still
+    /// match the record and find this caller's local lease interval unexpired.
+    Leadership(Leadership),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum PendingNextState {
+    PreservedObservation(Observation),
+    NewObservation {
+        owner: ParticipantId,
+        rank: Rank,
+        lease_duration: Duration,
+    },
+    Leadership(Leadership),
+}
+
+impl PendingNextState {
+    pub(super) fn preserve_observation(observation: Observation) -> Self {
+        Self::PreservedObservation(observation)
+    }
+
+    pub(super) fn new_observation(
+        owner: ParticipantId,
+        rank: Rank,
+        lease_duration: Duration,
+    ) -> Self {
+        Self::NewObservation {
+            owner,
+            rank,
+            lease_duration,
+        }
+    }
+
+    pub(super) fn leadership(leadership: Leadership) -> Self {
+        Self::Leadership(leadership)
+    }
+
+    fn into_local_state(self, adopted_at: Duration) -> LocalState {
+        // A new observation starts its timer only after the outer transaction
+        // commits; a preserved observation retains the timer already adopted.
+        match self {
+            Self::PreservedObservation(observation) => LocalState::Observation(observation),
+            Self::NewObservation {
+                owner,
+                rank,
+                lease_duration,
+            } => LocalState::Observation(Observation::new(owner, rank, lease_duration, adopted_at)),
+            Self::Leadership(leadership) => LocalState::Leadership(leadership),
+        }
+    }
+}
+
+impl LocalState {
+    /// Returns the initial state for a caller that has not adopted a poll result.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug"))]
+    pub fn unknown() -> Self {
+        Self::Unknown
+    }
+
+    /// Returns the adopted observation, if this caller is following an owner.
+    ///
+    /// `None` means either no state has been adopted or this caller holds a
+    /// local leadership token. It does not query durable state.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn observation(&self) -> Option<&Observation> {
+        match self {
+            Self::Observation(observation) => Some(observation),
+            Self::Unknown | Self::Leadership(_) => None,
+        }
+    }
+
+    /// Returns the adopted local leadership token, if any.
+    ///
+    /// The returned token is input to a later [`super::LeaderElection::poll`]
+    /// or [`super::LeaderElection::resign`] call, not proof that the caller
+    /// remains the durable owner.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn leadership(&self) -> Option<&Leadership> {
+        match self {
+            Self::Leadership(leadership) => Some(leadership),
+            Self::Unknown | Self::Observation(_) => None,
+        }
+    }
+}
+
+/// An exact durable owner record adopted after a successful outer transaction.
+///
+/// This records the owner, revision, and persisted duration observed together,
+/// plus the caller-clock instant at which that result was adopted. It is valid
+/// for takeover timing only while a later poll finds the same durable record.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Observation {
+    owner: ParticipantId,
+    rank: Rank,
+    lease_duration: Duration,
+    first_observed_at: Duration,
+}
+
+impl Observation {
+    pub(crate) fn new(
+        owner: ParticipantId,
+        rank: Rank,
+        lease_duration: Duration,
+        first_observed_at: Duration,
+    ) -> Self {
+        Self {
+            owner,
+            rank,
+            lease_duration,
+            first_observed_at,
+        }
+    }
+
+    /// Returns the owner in the exact durable record this caller observed.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn owner(&self) -> &ParticipantId {
+        &self.owner
+    }
+
+    /// Returns the exact observed durable revision as a fencing rank.
+    ///
+    /// A changed rank makes this observation ineligible to authorize a
+    /// takeover, even if the owner text is unchanged.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn rank(&self) -> Rank {
+        self.rank
+    }
+
+    /// Returns the lease duration persisted with the observed revision.
+    ///
+    /// Followers use this value, rather than a handle's configured duration,
+    /// when deciding whether the unchanged record is old enough to challenge.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn lease_duration(&self) -> Duration {
+        self.lease_duration
+    }
+
+    /// Returns the caller-clock time when this observation was adopted.
+    ///
+    /// Compare it only with readings from the same caller's monotonic clock.
+    /// It is not a durable timestamp or a deadline for the observed owner.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn first_observed_at(&self) -> Duration {
+        self.first_observed_at
+    }
+}
+
+/// The exact durable owner record a caller may attempt to renew before local expiry.
+///
+/// It is caller-local evidence, not a lease granted by a durable clock: a poll
+/// must still verify the participant, rank, and persisted duration against
+/// durable state. A later successful leader poll, including renewal by this
+/// same participant, supersedes this token's fencing rank.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Leadership {
+    participant: ParticipantId,
+    rank: Rank,
+    lease_duration: Duration,
+    last_renewed_at: Duration,
+}
+
+impl Leadership {
+    pub(crate) fn new(
+        participant: ParticipantId,
+        rank: Rank,
+        lease_duration: Duration,
+        last_renewed_at: Duration,
+    ) -> Self {
+        Self {
+            participant,
+            rank,
+            lease_duration,
+            last_renewed_at,
+        }
+    }
+
+    /// Returns the process incarnation this token identifies as owner.
+    ///
+    /// A renewal attempt additionally requires this to match the participant
+    /// passed to [`super::LeaderElection::poll`].
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn participant(&self) -> &ParticipantId {
+        &self.participant
+    }
+
+    /// Returns this token's durable revision as a fencing rank.
+    ///
+    /// A later successful leader poll supersedes this rank, including renewal
+    /// by the same participant.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn rank(&self) -> Rank {
+        self.rank
+    }
+
+    /// Returns the lease duration persisted with this token.
+    ///
+    /// It bounds local renewability from [`Self::last_renewed_at`], not the
+    /// durable owner's lifetime.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn lease_duration(&self) -> Duration {
+        self.lease_duration
+    }
+
+    /// Returns the caller-clock time supplied at the successful poll attempt's start.
+    ///
+    /// A renewal is locally eligible only while elapsed time from this value is
+    /// less than [`Self::lease_duration`]. It must be compared only with the
+    /// same caller's monotonic clock.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn last_renewed_at(&self) -> Duration {
+        self.last_renewed_at
+    }
+}
+
+/// The role and fencing rank prepared by one poll transaction attempt.
+///
+/// The rank may protect work staged in the same transaction, but it authorizes
+/// no committed or external work until the enclosing
+/// [`Database::run`](crate::Database::run) succeeds.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PollOutcome {
+    /// The transaction staged this caller as owner with a fresh fencing rank.
+    ///
+    /// [`PollTransition`] classifies how that staged ownership was reached.
+    Leader {
+        rank: Rank,
+        transition: PollTransition,
+    },
+    /// A durable owner was observed, but no leadership transition was staged.
+    ///
+    /// The fields form the exact record used to produce the next
+    /// [`LocalState::Observation`].
+    Follower {
+        owner: ParticipantId,
+        rank: Rank,
+        lease_duration: Duration,
+    },
+}
+
+/// The state-machine transition classified by one poll attempt.
+///
+/// This is an outcome label, not separately persisted durable state. It is
+/// meaningful only with the [`PollOutcome`] produced by the committed outer
+/// transaction.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PollTransition {
+    /// A released or never-created durable state was acquired immediately.
+    Acquired,
+    /// An exact, locally unexpired [`Leadership`] token was renewed.
+    Renewed,
+    /// An unchanged foreign [`Observation`] was replaced after its persisted duration.
+    TookOver,
+    /// An expired [`Observation`] of this same participant was acquired again.
+    Reacquired,
+    /// A durable owner was observed without a permitted leadership transition.
+    ///
+    /// This is returned for [`PollOutcome::Follower`] and never stages an
+    /// ownership mutation.
+    Followed,
+}
+
+impl PollOutcome {
+    /// Returns whether this attempt staged an ownership transition.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn is_leader(&self) -> bool {
+        matches!(self, Self::Leader { .. })
+    }
+
+    /// Returns the observed or newly staged durable revision as a fencing rank.
+    ///
+    /// Only [`Self::is_leader`] outcomes provide a new rank that can protect
+    /// work staged by this poll transaction.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn rank(&self) -> Rank {
+        match self {
+            Self::Leader { rank, .. } | Self::Follower { rank, .. } => *rank,
+        }
+    }
+
+    /// Returns the transition classification for this attempt.
+    ///
+    /// [`PollOutcome::Follower`] always reports [`PollTransition::Followed`].
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn transition(&self) -> PollTransition {
+        match self {
+            Self::Leader { transition, .. } => *transition,
+            Self::Follower { .. } => PollTransition::Followed,
+        }
+    }
+
+    /// Returns whether this attempt staged replacement of a foreign owner.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn is_takeover(&self) -> bool {
+        self.transition() == PollTransition::TookOver
+    }
+
+    /// Returns whether this attempt staged reacquisition of this participant's expired record.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn is_reacquisition(&self) -> bool {
+        self.transition() == PollTransition::Reacquired
+    }
+
+    /// Returns the observed owner when this attempt produced follower state.
+    ///
+    /// The owner is an observation, not an authorization for the caller.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn owner(&self) -> Option<&ParticipantId> {
+        match self {
+            Self::Follower { owner, .. } => Some(owner),
+            Self::Leader { .. } => None,
+        }
+    }
+
+    /// Returns the observed persisted lease duration when following.
+    ///
+    /// This duration is relevant to a later poll only with the matching
+    /// [`Observation`] adopted by [`PollResult::into_next_state`].
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn lease_duration(&self) -> Option<Duration> {
+        match self {
+            Self::Follower { lease_duration, .. } => Some(*lease_duration),
+            Self::Leader { .. } => None,
+        }
+    }
+}
+
+/// The result prepared by [`super::LeaderElection::poll`].
+///
+/// Keep this value inside the transaction callback until the enclosing
+/// [`Database::run`](crate::Database::run) succeeds. Before then, the
+/// transaction can retry, be cancelled, or fail to commit. On success, inspect
+/// [`Self::outcome`] and consume it with [`Self::into_next_state`] to carry
+/// caller-local validity into the next attempt.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PollResult {
+    outcome: PollOutcome,
+    pending_next_state: PendingNextState,
+}
+
+impl PollResult {
+    pub(super) fn new(outcome: PollOutcome, pending_next_state: PendingNextState) -> Self {
+        Self {
+            outcome,
+            pending_next_state,
+        }
+    }
+
+    /// Returns the role and fencing rank prepared by this transaction attempt.
+    ///
+    /// See [`PollOutcome`] for when the rank is usable for protected work.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn outcome(&self) -> &PollOutcome {
+        &self.outcome
+    }
+
+    /// Consumes this result and returns the caller-local state for the next attempt.
+    ///
+    /// `adopted_at` must be read from the caller's monotonic clock after the
+    /// enclosing [`Database::run`](crate::Database::run) succeeds. It timestamps only a new or reset
+    /// observation; an unchanged observation and leadership token retain their
+    /// original attempt-local timestamps.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn into_next_state(self, adopted_at: Duration) -> LocalState {
+        self.pending_next_state.into_local_state(adopted_at)
+    }
+}
+
+/// A read-only snapshot of durable state for diagnostics and observability.
+///
+/// It makes no liveness, expiry, or leadership-validity claim. Use
+/// [`super::LeaderElection::poll`] with caller-owned [`LocalState`] for
+/// protocol decisions instead of deriving authority from this snapshot.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ElectionState {
+    owner: Option<ParticipantId>,
+    rank: Rank,
+    lease_duration: Option<Duration>,
+}
+
+impl ElectionState {
+    pub(crate) fn new(
+        owner: Option<ParticipantId>,
+        rank: Rank,
+        lease_duration: Option<Duration>,
+    ) -> Self {
+        Self {
+            owner,
+            rank,
+            lease_duration,
+        }
+    }
+
+    /// Returns the durable owner, if the observed state is not released.
+    ///
+    /// `Some` does not show whether that owner is running or locally renewable.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn owner(&self) -> Option<&ParticipantId> {
+        self.owner.as_ref()
+    }
+
+    /// Returns the durable revision as a fencing rank.
+    ///
+    /// A rank is retained after resignation so a later acquisition receives a
+    /// strictly newer fencing epoch.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn rank(&self) -> Rank {
+        self.rank
+    }
+
+    /// Returns the last persisted lease duration, if this state has been created.
+    ///
+    /// It is historical state, not a persisted expiration deadline.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn lease_duration(&self) -> Option<Duration> {
+        self.lease_duration
+    }
+}
+
+/// Result of a conditional resignation attempt.
+///
+/// It describes what the current transaction staged and is final only after
+/// the enclosing [`Database::run`](crate::Database::run) succeeds.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ResignOutcome {
+    /// The matching [`Leadership`] token staged a release in the current transaction.
+    Resigned,
+    /// The durable owner, revision, or persisted duration no longer matched.
+    ///
+    /// No release mutation was staged, preventing an old delayed resignation
+    /// from releasing a newer leader.
+    Rejected,
+}
+
+impl ResignOutcome {
+    /// Returns whether the current transaction staged the matching resignation.
+    ///
+    /// This is not proof of release until the outer transaction commits.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn is_resigned(&self) -> bool {
+        matches!(self, Self::Resigned)
+    }
+}
diff --git a/bindings/rust/foundationdb/src/recipes/mod.rs b/bindings/rust/foundationdb/src/recipes/mod.rs
new file mode 100644
index 00000000000..1d01c48ec67
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/mod.rs
@@ -0,0 +1,38 @@
+//! # FoundationDB Recipes
+//!
+//! This module provides high-level distributed system recipes for FoundationDB,
+//! similar to Apache Curator for ZooKeeper. These recipes implement common
+//! distributed system patterns and primitives on top of FoundationDB's
+//! transactional key-value store.
+//!
+//! ## Available Recipes
+//!
+//! - **Leader Election**: Distributed leader election mechanism that allows
+//!   multiple processes to coordinate and elect a single leader. This is useful
+//!   for implementing primary/secondary architectures, distributed task coordination,
+//!   and ensuring single-writer patterns in distributed systems.
+//!
+//! ## Usage
+//!
+//! Each recipe is behind its own feature flag to keep the core library lightweight.
+//! Enable the recipes you need in your `Cargo.toml`:
+//!
+//! ```toml
+//! [dependencies]
+//! foundationdb = { version = "*", features = ["recipes-leader-election"] }
+//! ```
+//!
+//! Or enable all recipes at once:
+//!
+//! ```toml
+//! [dependencies]
+//! foundationdb = { version = "*", features = ["recipes"] }
+//! ```
+
+/// Leader election recipe for distributed consensus
+#[cfg(feature = "recipes-leader-election")]
+pub mod leader_election;
+
+/// Ranked register recipe for Paxos-style ballot fencing
+#[cfg(feature = "recipes-ranked-register")]
+pub mod ranked_register;
diff --git a/bindings/rust/foundationdb/src/recipes/ranked_register/algorithm.rs b/bindings/rust/foundationdb/src/recipes/ranked_register/algorithm.rs
new file mode 100644
index 00000000000..23c7273dba4
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/ranked_register/algorithm.rs
@@ -0,0 +1,305 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Ranked register algorithm
+//!
+//! Implements the core read/write/value operations from Chockler & Malkhi's
+//! "Active Disk Paxos with infinitely many processes" (PODC 2002, Section 5.1, Figure 3).
+//!
+//! All functions operate within a FoundationDB transaction for atomicity.
+
+use crate::{
+    RangeOption, Transaction,
+    tuple::{Subspace, pack, unpack},
+};
+use futures::TryStreamExt;
+use std::ops::Deref;
+
+use super::{
+    MAX_VALUE_CHUNK_BYTES,
+    errors::{RankedRegisterError, Result},
+    keys,
+    types::*,
+};
+
+const STATE_SCHEMA_VERSION: u64 = 1;
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+struct MetadataState {
+    max_read_rank: Rank,
+    max_write_rank: Rank,
+}
+
+/// Reads versioned durable metadata. An absent key is the bottom state.
+async fn read_metadata<T>(txn: &T, key: &[u8]) -> Result<Option<MetadataState>>
+where
+    T: Deref<Target = Transaction>,
+{
+    let Some(value) = txn.get(key, false).await? else {
+        return Ok(None);
+    };
+
+    decode_metadata(&value).map(Some)
+}
+
+fn decode_metadata(value: &[u8]) -> Result<MetadataState> {
+    let (schema_version, max_read_rank, max_write_rank): (u64, u64, u64) =
+        unpack(value).map_err(|error| {
+            RankedRegisterError::InvalidState(format!(
+                "metadata does not match the versioned ranked-register schema: {error:?}"
+            ))
+        })?;
+    if schema_version != STATE_SCHEMA_VERSION {
+        return Err(RankedRegisterError::InvalidState(format!(
+            "unknown metadata schema version {schema_version}, expected {STATE_SCHEMA_VERSION}"
+        )));
+    }
+
+    Ok(MetadataState {
+        max_read_rank: Rank::from(max_read_rank),
+        max_write_rank: Rank::from(max_write_rank),
+    })
+}
+
+fn write_metadata<T>(txn: &T, key: &[u8], state: MetadataState)
+where
+    T: Deref<Target = Transaction>,
+{
+    txn.set(
+        key,
+        &pack(&(
+            STATE_SCHEMA_VERSION,
+            state.max_read_rank.as_u64(),
+            state.max_write_rank.as_u64(),
+        )),
+    );
+}
+
+/// Reads and validates all raw value chunks.
+async fn read_value<T>(txn: &T, subspace: &Subspace, has_metadata: bool) -> Result<Option<Vec<u8>>>
+where
+    T: Deref<Target = Transaction>,
+{
+    let value_subspace = keys::value_subspace(subspace);
+    let mut chunks = txn.get_ranges_keyvalues(RangeOption::from(&value_subspace), false);
+    let mut expected_index = 0_u64;
+    let mut value = Vec::new();
+    let mut has_chunks = false;
+
+    while let Some(chunk) = chunks.try_next().await? {
+        if !has_metadata {
+            return Err(RankedRegisterError::InvalidState(
+                "value chunks exist without register metadata".to_owned(),
+            ));
+        }
+
+        let index = decode_value_index(&value_subspace, chunk.key())?;
+        validate_value_index(expected_index, index)?;
+        expected_index = expected_index.checked_add(1).ok_or_else(|| {
+            RankedRegisterError::InvalidState(
+                "value chunk index sequence exceeds the supported u64 domain".to_owned(),
+            )
+        })?;
+        value.extend_from_slice(chunk.value());
+        has_chunks = true;
+    }
+
+    Ok(has_chunks.then_some(value))
+}
+
+fn decode_value_index(value_subspace: &Subspace, key: &[u8]) -> Result<u64> {
+    let (index,): (u64,) = value_subspace.unpack(key).map_err(|error| {
+        RankedRegisterError::InvalidState(format!("malformed value chunk key: {error:?}"))
+    })?;
+    Ok(index)
+}
+
+fn validate_value_index(expected: u64, actual: u64) -> Result<()> {
+    if actual != expected {
+        return Err(RankedRegisterError::InvalidState(format!(
+            "value chunk index {actual} is not the expected contiguous index {expected}"
+        )));
+    }
+    Ok(())
+}
+
+fn write_value<T>(txn: &T, subspace: &Subspace, value: &[u8]) -> Result<usize>
+where
+    T: Deref<Target = Transaction>,
+{
+    let value_subspace = keys::value_subspace(subspace);
+    txn.clear_subspace_range(&value_subspace);
+
+    if value.is_empty() {
+        txn.set(&keys::value_key(subspace, 0), value);
+        return Ok(1);
+    }
+
+    for (index, chunk) in value.chunks(MAX_VALUE_CHUNK_BYTES).enumerate() {
+        let index = u64::try_from(index).map_err(|_| {
+            RankedRegisterError::InvalidState(
+                "value requires more chunks than the supported u64 index domain".to_owned(),
+            )
+        })?;
+        txn.set(&keys::value_key(subspace, index), chunk);
+    }
+
+    Ok(value_chunk_count(value.len()))
+}
+
+fn value_chunk_count(value_len: usize) -> usize {
+    if value_len == 0 {
+        1
+    } else {
+        value_len / MAX_VALUE_CHUNK_BYTES + usize::from(value_len % MAX_VALUE_CHUNK_BYTES != 0)
+    }
+}
+
+/// Perform a ranked read on the register.
+///
+/// Updates `max_read_rank` if the given rank is higher than the current one,
+/// effectively installing a fence that prevents lower-ranked writes.
+/// Returns the current write rank and value.
+pub async fn read<T>(txn: &T, subspace: &Subspace, rank: Rank) -> Result<ReadResult>
+where
+    T: Deref<Target = Transaction>,
+{
+    let metadata_key = keys::state_key(subspace);
+    let maybe_state = read_metadata(txn, &metadata_key).await?;
+    let mut state = maybe_state.unwrap_or_default();
+    let value = read_value(txn, subspace, maybe_state.is_some()).await?;
+
+    if rank > state.max_read_rank {
+        #[cfg(feature = "trace")]
+        tracing::debug!(
+            register_action = "fence_installed",
+            rank = rank.as_u64(),
+            previous_max_read_rank = state.max_read_rank.as_u64(),
+            "ranked-register fence staged in transaction"
+        );
+        state.max_read_rank = rank;
+        write_metadata(txn, &metadata_key, state);
+    }
+
+    Ok(ReadResult {
+        write_rank: state.max_write_rank,
+        value,
+    })
+}
+
+/// Perform a ranked write on the register.
+///
+/// Commits the value only if:
+/// - `rank >= max_read_rank` (no higher-ranked read has installed a fence)
+/// - `rank > max_write_rank` (no equal-or-higher-ranked write has occurred)
+///
+/// Returns `Committed` if the write succeeds, `Aborted` otherwise.
+pub async fn write<T>(
+    txn: &T,
+    subspace: &Subspace,
+    rank: Rank,
+    value: &[u8],
+    max_value_bytes: Option<usize>,
+) -> Result<WriteResult>
+where
+    T: Deref<Target = Transaction>,
+{
+    if let Some(limit) = max_value_bytes.filter(|limit| value.len() > *limit) {
+        return Err(RankedRegisterError::ValueTooLarge {
+            value_size: value.len(),
+            limit,
+        });
+    }
+
+    let metadata_key = keys::state_key(subspace);
+    let maybe_state = read_metadata(txn, &metadata_key).await?;
+    let mut state = maybe_state.unwrap_or_default();
+
+    if rank < state.max_read_rank || rank <= state.max_write_rank {
+        #[cfg(feature = "trace")]
+        tracing::debug!(
+            register_action = "write_aborted",
+            rank = rank.as_u64(),
+            max_read_rank = state.max_read_rank.as_u64(),
+            max_write_rank = state.max_write_rank.as_u64(),
+            fenced_by_read = rank < state.max_read_rank,
+            fenced_by_write = rank <= state.max_write_rank,
+            "ranked-register write rejected by fencing rank"
+        );
+        return Ok(WriteResult::Aborted);
+    }
+
+    #[cfg(feature = "trace")]
+    let previous_max_write_rank = state.max_write_rank;
+    state.max_write_rank = rank;
+    write_metadata(txn, &metadata_key, state);
+    #[cfg(feature = "trace")]
+    let chunk_count = write_value(txn, subspace, value)?;
+    #[cfg(not(feature = "trace"))]
+    write_value(txn, subspace, value)?;
+
+    #[cfg(feature = "trace")]
+    tracing::debug!(
+        register_action = "write_staged",
+        rank = rank.as_u64(),
+        previous_max_read_rank = state.max_read_rank.as_u64(),
+        previous_max_write_rank = previous_max_write_rank.as_u64(),
+        value_bytes = value.len(),
+        value_chunks = chunk_count,
+        "ranked-register write staged in transaction"
+    );
+
+    Ok(WriteResult::Committed)
+}
+
+/// Read the current value without updating ranks.
+///
+/// This is a plain read for followers and observers. It does not update
+/// `max_read_rank`, so it installs no durable fence. As non-snapshot reads,
+/// metadata and value chunks add conflict ranges for this register.
+///
+/// Safe to call from any process at any time.
+pub async fn value<T>(txn: &T, subspace: &Subspace) -> Result<Option<Vec<u8>>>
+where
+    T: Deref<Target = Transaction>,
+{
+    let metadata_key = keys::state_key(subspace);
+    let maybe_state = read_metadata(txn, &metadata_key).await?;
+    read_value(txn, subspace, maybe_state.is_some()).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn value_chunk_count_preserves_empty_values() {
+        assert_eq!(value_chunk_count(0), 1);
+        assert_eq!(value_chunk_count(MAX_VALUE_CHUNK_BYTES), 1);
+        assert_eq!(value_chunk_count(MAX_VALUE_CHUNK_BYTES + 1), 2);
+    }
+
+    #[test]
+    fn non_contiguous_value_index_is_invalid_state() {
+        let error = validate_value_index(0, 1).expect_err("gapped value chunks must fail");
+        assert!(matches!(error, RankedRegisterError::InvalidState(_)));
+    }
+
+    #[test]
+    fn malformed_metadata_is_invalid_state() {
+        let error = decode_metadata(&pack(&(0_u64, 0_u64)))
+            .expect_err("untagged metadata must not be decoded");
+        assert!(matches!(error, RankedRegisterError::InvalidState(_)));
+    }
+
+    #[test]
+    fn unknown_metadata_version_is_invalid_state() {
+        let error = decode_metadata(&pack(&(STATE_SCHEMA_VERSION + 1, 0_u64, 0_u64)))
+            .expect_err("unknown schema versions must fail");
+        assert!(matches!(error, RankedRegisterError::InvalidState(_)));
+    }
+}
diff --git a/bindings/rust/foundationdb/src/recipes/ranked_register/errors.rs b/bindings/rust/foundationdb/src/recipes/ranked_register/errors.rs
new file mode 100644
index 00000000000..427a1578274
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/ranked_register/errors.rs
@@ -0,0 +1,88 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Error types for the ranked register
+
+use crate::tuple::PackError;
+use crate::{FdbBindingError, FdbError, RetryableError};
+use std::fmt;
+
+/// Ranked register specific errors
+#[derive(Debug)]
+pub enum RankedRegisterError {
+    /// Database error
+    Fdb(FdbError),
+    /// Retry loop error
+    Binding(FdbBindingError),
+    /// Serialization error
+    PackError(PackError),
+    /// Invalid state encountered in the register
+    InvalidState(String),
+    /// The requested raw value exceeds this handle's configured limit.
+    ///
+    /// This is a non-retryable caller error. The limit is local configuration
+    /// and is never persisted in FoundationDB.
+    ValueTooLarge {
+        /// Requested raw value size in bytes.
+        value_size: usize,
+        /// Configured maximum raw value size in bytes.
+        limit: usize,
+    },
+}
+
+impl fmt::Display for RankedRegisterError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Fdb(e) => write!(f, "Database error: {e}"),
+            Self::Binding(e) => write!(f, "Retry loop error: {e}"),
+            Self::PackError(e) => write!(f, "Pack error: {e:?}"),
+            Self::InvalidState(msg) => write!(f, "Invalid state: {msg}"),
+            Self::ValueTooLarge { value_size, limit } => {
+                write!(
+                    f,
+                    "Register value is {value_size} bytes, above the {limit}-byte limit"
+                )
+            }
+        }
+    }
+}
+
+impl std::error::Error for RankedRegisterError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Fdb(e) => Some(e),
+            Self::Binding(e) => Some(e),
+            Self::PackError(e) => Some(e),
+            Self::InvalidState(_) | Self::ValueTooLarge { .. } => None,
+        }
+    }
+}
+
+impl From<FdbError> for RankedRegisterError {
+    fn from(error: FdbError) -> Self {
+        Self::Fdb(error)
+    }
+}
+
+impl From<FdbBindingError> for RankedRegisterError {
+    fn from(error: FdbBindingError) -> Self {
+        Self::Binding(error)
+    }
+}
+
+impl From<PackError> for RankedRegisterError {
+    fn from(error: PackError) -> Self {
+        Self::PackError(error)
+    }
+}
+
+/// The `source()` chain exposes the wrapped `FdbError`, so the default
+/// `retry_decision` makes this error retry-transparent in `db.run`.
+impl RetryableError for RankedRegisterError {}
+
+/// Result type for ranked register operations
+pub type Result<T> = std::result::Result<T, RankedRegisterError>;
diff --git a/bindings/rust/foundationdb/src/recipes/ranked_register/keys.rs b/bindings/rust/foundationdb/src/recipes/ranked_register/keys.rs
new file mode 100644
index 00000000000..a9929c39e6e
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/ranked_register/keys.rs
@@ -0,0 +1,53 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Key management for the ranked register
+//!
+//! Each [`RankedRegister`](super::RankedRegister) stores versioned metadata at
+//! one key and its value in sequential child keys in its own [`Subspace`].
+//!
+//! # Key Schema
+//!
+//! ```text
+//! <subspace>/state       -> (schema_version: u64, max_read_rank: u64, max_write_rank: u64)
+//! <subspace>/value/<u64> -> raw value chunk
+//! ```
+//!
+//! Value chunks use consecutive indices starting at zero. Each is raw bytes,
+//! up to FoundationDB's exact 100,000-byte value limit. The metadata schema is
+//! decoded strictly. Older unversioned state is unsupported, so use a fresh
+//! subspace or clear an existing subspace before adopting this schema.
+//!
+//! Every ranked read or write for one subspace contends on this single key, so
+//! those updates serialize through FoundationDB conflicts. Model a keyed
+//! collection with one child subspace per logical key.
+
+use crate::tuple::Subspace;
+
+/// Key prefix for register state
+const STATE_PREFIX: &str = "state";
+const VALUE_PREFIX: &str = "value";
+
+/// Generate the key for the register state
+///
+/// Returns the single key where all register state is stored.
+///
+/// # Key Structure
+/// `<subspace>/state`
+pub fn state_key(subspace: &Subspace) -> Vec<u8> {
+    subspace.pack(&(STATE_PREFIX,))
+}
+
+/// Returns the child subspace containing raw value chunks.
+pub(crate) fn value_subspace(subspace: &Subspace) -> Subspace {
+    subspace.subspace(&(VALUE_PREFIX,))
+}
+
+/// Returns the key for one raw value chunk.
+pub(crate) fn value_key(subspace: &Subspace, index: u64) -> Vec<u8> {
+    value_subspace(subspace).pack(&(index,))
+}
diff --git a/bindings/rust/foundationdb/src/recipes/ranked_register/mod.rs b/bindings/rust/foundationdb/src/recipes/ranked_register/mod.rs
new file mode 100644
index 00000000000..aea8266e238
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/ranked_register/mod.rs
@@ -0,0 +1,283 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! # Ranked Register for FoundationDB
+//!
+//! A shared memory abstraction that encapsulates Paxos ballots, based on
+//! Chockler & Malkhi's "Active Disk Paxos with infinitely many processes"
+//! (PODC 2002). A ranked register is a mutable register with conflict detection
+//! via ranks, supporting unbounded processes with finite storage.
+//!
+//! Sections 4.2 and 4.3 of the paper use one logical ranked register. Section
+//! 5.1 implements it from one read-modify-write object, while Section 5.2 uses
+//! `n` registers as replicas to emulate one fault-tolerant logical register.
+//! This implementation is the single logical cell because FoundationDB already
+//! supplies replication and transactions. Multiple child-subspace registers are
+//! application sharding, not a replication requirement from the paper.
+//!
+//! ## Operations
+//!
+//! | Operation | Who | Effect |
+//! |-----------|-----|--------|
+//! | [`read(rank)`](crate::recipes::ranked_register::RankedRegister::read) | Leader | Raises max_read_rank only for a higher rank, returns current value |
+//! | [`write(rank, value)`](crate::recipes::ranked_register::RankedRegister::write) | Leader | Commits only if rank is high enough |
+//! | [`value()`](crate::recipes::ranked_register::RankedRegister::value) | Followers | Plain read, no fence installed |
+//!
+//! ## Addressing, schema, and capacity
+//!
+//! One [`RankedRegister`](crate::recipes::ranked_register::RankedRegister) owns
+//! one [`Subspace`](crate::tuple::Subspace). Its internal `"state"` key stores
+//! a versioned metadata tuple, while raw value bytes are stored in sequential
+//! `"value"/<u64 index>` child keys. For a keyed collection, derive a child
+//! subspace from each logical key before constructing the register:
+//!
+//! ```rust
+//! use foundationdb::{recipes::ranked_register::RankedRegister, tuple::Subspace};
+//!
+//! let registers = Subspace::all().subspace(&"document-registers");
+//! let document_id = "document-42";
+//! let register = RankedRegister::new(registers.subspace(&(document_id,)));
+//! # let _ = register;
+//! ```
+//!
+//! Each value chunk is raw bytes and may be exactly
+//! [`MAX_VALUE_CHUNK_BYTES`](crate::recipes::ranked_register::MAX_VALUE_CHUNK_BYTES)
+//! bytes. [`RankedRegister::new`](crate::recipes::ranked_register::RankedRegister::new)
+//! imposes no recipe aggregate limit, although
+//! FoundationDB transaction limits remain the backend boundary. Use
+//! [`RankedRegister::with_max_value_bytes`](crate::recipes::ranked_register::RankedRegister::with_max_value_bytes)
+//! to impose a local aggregate limit
+//! on one handle. That limit is never stored in FoundationDB, so all handles
+//! that write through the same subspace should use compatible limits.
+//!
+//! This schema is intentionally incompatible with ranked-register state from
+//! v0.11 and earlier. It does not decode the former unversioned tuple layout.
+//! Start with a fresh subspace, or clear an existing register subspace before
+//! using this version.
+//!
+//! Ranked reads and writes for one register contend on that single key and are
+//! serialized by FoundationDB conflicts. Use separate child subspaces to shard
+//! independently updated logical items.
+//!
+//! ## Rank domains
+//!
+//! A register rank space has one authority. Do not mix
+//! [`Rank::new`](crate::recipes::ranked_register::Rank::new) values with
+//! leader-election ranks or values issued by another rank allocator in the
+//! same register. A rank from a different domain can permanently fence valid
+//! future writes from the intended authority.
+//!
+//! Although the primitive stores one optional value, a successful ranked write
+//! can fence additional application-key writes staged in the same transaction.
+//! Stage those writes only when
+//! [`WriteResult::Committed`](crate::recipes::ranked_register::WriteResult::Committed)
+//! is returned. One rank can commit only once per register because each write
+//! requires a rank strictly greater than the stored maximum write rank.
+//!
+//! ## Composing with Leader Election
+//!
+//! The ranked register is designed to work with the leader election recipe.
+//! Every successful leader poll returns a fencing rank derived from the durable
+//! revision, providing automatic fencing against stale leaders. This includes
+//! same-owner renewal: installing the new rank fences delayed work using the
+//! prior rank from that same process.
+//!
+//! ```rust,no_run
+//! # #[cfg(feature = "recipes-leader-election")]
+//! # mod leader_election_example {
+//! # async fn example(db: &foundationdb::Database) -> Result<(), foundationdb::FdbBindingError> {
+//! use std::time::Duration;
+//!
+//! use foundationdb::{
+//!     env::{Clock, Environment},
+//!     options::TransactionOption,
+//!     recipes::{
+//!         leader_election::{LeaderElection, LocalState, ParticipantId, PollOutcome},
+//!         ranked_register::{RankedRegister, WriteResult},
+//!     },
+//!     tuple::Subspace,
+//!     FdbBindingError,
+//! };
+//!
+//! let election = LeaderElection::new(
+//!     Subspace::all().subspace(&"my-election"),
+//!     Duration::from_secs(10),
+//! )?;
+//! let register = RankedRegister::new(Subspace::all().subspace(&"my-state"));
+//! let participant = ParticipantId::new("process-incarnation")?;
+//! let local_state = LocalState::unknown();
+//! let env = Environment::default();
+//!
+//! // The application owns retries, options, scheduling, and local observation.
+//! let result = db.run(|txn, _maybe_committed| {
+//!     let election = election.clone();
+//!     let register = register.clone();
+//!     let participant = participant.clone();
+//!     let local_state = local_state.clone();
+//!     let env = env.clone();
+//!     async move {
+//!         txn.set_option(TransactionOption::AutomaticIdempotency)?;
+//!         let attempt_started_at = env.clock().monotonic();
+//!         let poll = election
+//!             .poll(&txn, &participant, &local_state, attempt_started_at)
+//!             .await?;
+//!         if let PollOutcome::Leader { rank, .. } = poll.outcome() {
+//!             register
+//!                 .read(&txn, *rank)
+//!                 .await
+//!                 .map_err(|error| FdbBindingError::new_custom_error(Box::new(error)))?;
+//!             let write_result = register
+//!                 .write(&txn, *rank, b"new_value")
+//!                 .await
+//!                 .map_err(|error| FdbBindingError::new_custom_error(Box::new(error)))?;
+//!             if write_result == WriteResult::Committed {
+//!                 txn.set(b"application-key", b"new_value");
+//!             }
+//!         }
+//!         Ok::<_, FdbBindingError>(poll)
+//!     }
+//! }).await?;
+//! // Adopt this only after db.run succeeded.
+//! let local_state = result.into_next_state(env.clock().monotonic());
+//! # let _ = local_state;
+//! # Ok(())
+//! # }
+//! # }
+//! ```
+//!
+//! ### Why This Works
+//!
+//! - Durable leader-election revisions increase monotonically
+//! - A renewal is a new fencing epoch, even for the same leader
+//! - `read(rank)` installs a fence at that fencing rank
+//! - Any write with a lower fencing rank is automatically rejected
+//! - `value()` is safe for followers, it never installs a fence
+
+mod algorithm;
+mod errors;
+mod keys;
+mod types;
+
+pub use errors::{RankedRegisterError, Result};
+pub use types::{Rank, ReadResult, RegisterState, WriteResult};
+
+use crate::{Transaction, tuple::Subspace};
+use std::ops::Deref;
+
+/// Maximum size of one raw register-value chunk.
+///
+/// This is FoundationDB's exact 100,000-byte value limit.
+pub const MAX_VALUE_CHUNK_BYTES: usize = 100_000;
+
+/// A ranked register backed by FoundationDB
+///
+/// Provides a mutable register with conflict detection via ranks.
+/// No initialization is needed — an absent key represents the bottom state
+/// (zero ranks, no value).
+///
+/// # Thread Safety
+///
+/// `RankedRegister` is [`Clone`], [`Send`], and [`Sync`]. It holds only a
+/// [`Subspace`] and can be safely shared across tasks.
+#[derive(Clone, Debug)]
+pub struct RankedRegister {
+    subspace: Subspace,
+    max_value_bytes: Option<usize>,
+}
+
+impl RankedRegister {
+    /// Create a new ranked register instance
+    ///
+    /// The subspace isolates this register from other data in the database.
+    /// No initialization step is required — the register starts in the
+    /// bottom state (zero ranks, no value) until the first write.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(subspace))
+    )]
+    pub fn new(subspace: Subspace) -> Self {
+        Self {
+            subspace,
+            max_value_bytes: None,
+        }
+    }
+
+    /// Create a ranked register with a local aggregate value-size limit.
+    ///
+    /// The limit applies only to writes through this handle. It is not durable
+    /// state, so use compatible limits for all writers of the same subspace.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(subspace))
+    )]
+    pub fn with_max_value_bytes(subspace: Subspace, limit: usize) -> Self {
+        Self {
+            subspace,
+            max_value_bytes: Some(limit),
+        }
+    }
+
+    /// Returns a reference to the underlying subspace
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn subspace(&self) -> &Subspace {
+        &self.subspace
+    }
+
+    /// Perform a ranked read
+    ///
+    /// Raises `max_read_rank` only when the given rank is higher, installing a
+    /// fence that prevents lower-ranked writes. A superseded rank returns the
+    /// current write rank and value without changing the installed fence.
+    ///
+    /// Used by the leader before writing to ensure consistency.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, txn))
+    )]
+    pub async fn read<T>(&self, txn: &T, rank: Rank) -> Result<ReadResult>
+    where
+        T: Deref<Target = Transaction>,
+    {
+        algorithm::read(txn, &self.subspace, rank).await
+    }
+
+    /// Perform a ranked write
+    ///
+    /// Commits the value only if:
+    /// - `rank >= max_read_rank` (no higher fence)
+    /// - `rank > max_write_rank` (no equal-or-higher write)
+    ///
+    /// Returns [`WriteResult::Committed`] or [`WriteResult::Aborted`].
+    /// Returns [`RankedRegisterError::ValueTooLarge`] when this handle has a
+    /// configured limit and `value` exceeds it.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, txn, value))
+    )]
+    pub async fn write<T>(&self, txn: &T, rank: Rank, value: &[u8]) -> Result<WriteResult>
+    where
+        T: Deref<Target = Transaction>,
+    {
+        algorithm::write(txn, &self.subspace, rank, value, self.max_value_bytes).await
+    }
+
+    /// Read the current value without updating ranks
+    ///
+    /// Safe for followers and observers: it installs no durable fence. Its
+    /// normal non-snapshot FoundationDB read still adds a conflict range for
+    /// this register key, so it can conflict with a concurrent leader write.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, txn))
+    )]
+    pub async fn value<T>(&self, txn: &T) -> Result<Option<Vec<u8>>>
+    where
+        T: Deref<Target = Transaction>,
+    {
+        algorithm::value(txn, &self.subspace).await
+    }
+}
diff --git a/bindings/rust/foundationdb/src/recipes/ranked_register/types.rs b/bindings/rust/foundationdb/src/recipes/ranked_register/types.rs
new file mode 100644
index 00000000000..5130f7ddf7e
--- /dev/null
+++ b/bindings/rust/foundationdb/src/recipes/ranked_register/types.rs
@@ -0,0 +1,158 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Core data structures for the ranked register
+//!
+//! Implements the ranked register abstraction from Chockler & Malkhi's
+//! "Active Disk Paxos with infinitely many processes" (PODC 2002).
+
+use std::fmt;
+
+/// A rank value for ordering register operations
+///
+/// Encodes both a process identifier and a sequence number into a single `u64`.
+/// The high 32 bits hold the sequence number, and the low 32 bits hold the
+/// process ID. This ensures that ranks from the same process are ordered by
+/// sequence, and ties between different processes are broken by process ID.
+///
+/// # Encoding
+///
+/// ```text
+/// |--- sequence (32 bits) ---|--- process_id (32 bits) ---|
+/// ```
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Default)]
+pub struct Rank(u64);
+
+impl Rank {
+    /// The zero rank, representing the bottom/uninitialized state
+    pub const ZERO: Rank = Rank(0);
+
+    /// Create a new rank from a process ID and sequence number
+    ///
+    /// The sequence occupies the high 32 bits and the process ID the low 32 bits,
+    /// so ranks are ordered primarily by sequence, then by process ID.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug"))]
+    pub fn new(process_id: u32, sequence: u32) -> Self {
+        Self(((sequence as u64) << 32) | process_id as u64)
+    }
+
+    /// Returns the process ID component of this rank
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn process_id(&self) -> u32 {
+        self.0 as u32
+    }
+
+    /// Returns the sequence number component of this rank
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn sequence(&self) -> u32 {
+        (self.0 >> 32) as u32
+    }
+
+    /// Returns the raw `u64` representation
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn as_u64(&self) -> u64 {
+        self.0
+    }
+}
+
+impl From<u64> for Rank {
+    fn from(value: u64) -> Self {
+        Self(value)
+    }
+}
+
+impl fmt::Display for Rank {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "Rank(seq={}, pid={})",
+            self.sequence(),
+            self.process_id()
+        )
+    }
+}
+
+/// Logical state of the ranked register
+///
+/// Tracks the maximum read and write ranks alongside the current value. The
+/// implementation stores metadata and value chunks separately.
+/// Private fields enforce invariants through the algorithm module.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct RegisterState {
+    pub(crate) max_read_rank: Rank,
+    pub(crate) max_write_rank: Rank,
+    pub(crate) value: Option<Vec<u8>>,
+}
+
+impl RegisterState {
+    /// Returns the highest rank that has performed a read
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn max_read_rank(&self) -> Rank {
+        self.max_read_rank
+    }
+
+    /// Returns the highest rank that has successfully written
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn max_write_rank(&self) -> Rank {
+        self.max_write_rank
+    }
+
+    /// Returns the current value, if any
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn value(&self) -> Option<&[u8]> {
+        self.value.as_deref()
+    }
+}
+
+/// Result of a ranked read operation
+///
+/// Contains the write rank and value at the time of the read.
+/// The read also installs a fence at the given rank, preventing
+/// lower-ranked writes from succeeding.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ReadResult {
+    pub(crate) write_rank: Rank,
+    pub(crate) value: Option<Vec<u8>>,
+}
+
+impl ReadResult {
+    /// Returns the rank of the last successful write
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn write_rank(&self) -> Rank {
+        self.write_rank
+    }
+
+    /// Returns a reference to the current value, if any
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn value(&self) -> Option<&[u8]> {
+        self.value.as_deref()
+    }
+
+    /// Consumes self and returns the value
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn into_value(self) -> Option<Vec<u8>> {
+        self.value
+    }
+}
+
+/// Result of a ranked write operation
+#[must_use = "a committed write result controls whether co-staged application writes are valid"]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum WriteResult {
+    /// The write was accepted (rank was high enough)
+    Committed,
+    /// The write was rejected (rank too low)
+    Aborted,
+}
+
+impl WriteResult {
+    /// Returns `true` if the write was committed
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn is_committed(&self) -> bool {
+        matches!(self, WriteResult::Committed)
+    }
+}
diff --git a/bindings/rust/foundationdb/src/runner.rs b/bindings/rust/foundationdb/src/runner.rs
new file mode 100644
index 00000000000..42b6259b9f7
--- /dev/null
+++ b/bindings/rust/foundationdb/src/runner.rs
@@ -0,0 +1,856 @@
+// Copyright 2026 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! The retry runner behind [`Database::run`](crate::Database::run).
+//!
+//! The runner is built from three independent pieces:
+//!
+//! * the **attempt**: run the closure on a transaction, then commit it. One
+//!   attempt does exactly one pass and never retries.
+//! * the **hooks** ([`RunnerHooks`]): purely observational callbacks fired
+//!   around each attempt. They cannot change what the runner decides.
+//! * the **policy** ([`RetryPolicy`]): the only thing that can change a
+//!   decision. It sees the failure and the decision the runner proposes, and
+//!   returns the decision to apply.
+//!
+//! They are assembled by [`TransactionRunner`], the builder returned by
+//! [`Database::runner`](crate::Database::runner):
+//!
+//! ```no_run
+//! # use foundationdb::*;
+//! # use foundationdb::runner::MetricsHooks;
+//! # async fn example(db: &Database) -> Result<(), FdbBindingError> {
+//! let metrics = TransactionMetrics::new();
+//! db.runner()
+//!     .hooks(&MetricsHooks::new(&metrics))
+//!     .run(|trx, _maybe_committed| async move {
+//!         trx.set(b"key", b"value");
+//!         Ok::<_, FdbBindingError>(())
+//!     })
+//!     .await?;
+//! let report = metrics.get_metrics_data();
+//! # let _ = report;
+//! # Ok(())
+//! # }
+//! ```
+//!
+//! # Retry semantics
+//!
+//! `fdb_transaction_on_error` remains the single retry governor: backoff, max
+//! retry delay and [`TransactionOption::RetryLimit`](crate::options::TransactionOption::RetryLimit)
+//! are applied by the C API, never by a Rust-side budget. A closure error asking
+//! for a retry without a native error underneath
+//! ([`RetryDecision::Retry`]) is routed through `on_error` with code 1020
+//! (`not_committed`) so that it obeys the same budget.
+
+use std::time::{Duration, Instant};
+
+use crate::database::{Database, MaybeCommitted};
+use crate::error::{FdbBindingError, FdbError, FdbResult, RetryDecision, RetryableError};
+use crate::metrics::{AttemptOutcome, ConflictKeys, TransactionMetrics};
+use crate::transaction::{
+    RetryableTransaction, Transaction, TransactionCommitError, TransactionCommitted,
+};
+
+/// `not_committed`: the retryable error code a [`RetryDecision::Retry`] is
+/// routed through.
+const NOT_COMMITTED: i32 = 1020;
+
+/// Observation points of the retry runner.
+///
+/// Hooks are **purely observational**: nothing they do or return changes what
+/// the runner decides. Use a [`RetryPolicy`] to influence retries. Every method
+/// has a no-op default, so an implementation only overrides what it needs.
+///
+/// # Ordering
+///
+/// Every callback receives the index of the attempt it belongs to, starting at
+/// `0` and matching [`AttemptMetrics::index`](crate::metrics::AttemptMetrics::index).
+/// Per attempt, in order:
+///
+/// 1. [`on_attempt_start`](Self::on_attempt_start)
+/// 2. the closure runs
+/// 3. if the closure succeeded: [`before_commit`](Self::before_commit), then
+///    the commit
+///    * commit succeeded: [`on_commit_success`](Self::on_commit_success), the
+///      run is over
+///    * commit failed: [`on_commit_error`](Self::on_commit_error), then
+///      `on_error`, then [`on_error_duration`](Self::on_error_duration) and
+///      [`on_retry`](Self::on_retry) if the transaction was retried
+/// 4. if the closure failed: [`on_closure_error`](Self::on_closure_error) (only
+///    when the error maps to an [`FdbError`], that is when the runner is about
+///    to call `on_error`), then `on_error`, then
+///    [`on_error_duration`](Self::on_error_duration) and
+///    [`on_retry`](Self::on_retry) if the transaction was retried
+///
+/// [`on_complete`](Self::on_complete) fires exactly once per run, on **every**
+/// exit path: success, non-retryable error, exhausted retries or binding error.
+///
+/// The two fallible hooks ([`before_commit`](Self::before_commit) and
+/// [`on_commit_error`](Self::on_commit_error)) never abort the runner: their
+/// error is reported to [`on_hook_error`](Self::on_hook_error) and the run
+/// continues exactly as if they had succeeded.
+///
+/// # Transaction access
+///
+/// Hooks see a `&Transaction`, never the clonable
+/// [`RetryableTransaction`]: a hook that could
+/// keep a reference to it would make the runner fail with
+/// [`FdbBindingError::ReferenceToTransactionKept`].
+///
+/// # Composition
+///
+/// [`RunnerHooks`] is implemented for `()` (no-op), `&H`, `Option<H>` (`None`
+/// is a no-op) and `(A, B)`, which nest for any arity: `(a, (b, c))`. In a
+/// tuple, callbacks fire left to right, and both sides always run even if the
+/// left one returned an error, the first error being the one reported.
+pub trait RunnerHooks {
+    /// Called when an attempt starts, before the closure runs.
+    fn on_attempt_start(&self, _trx: &Transaction, _attempt: usize) {}
+
+    /// Called after the closure succeeded, before the transaction is committed.
+    ///
+    /// This is the last point where the transaction can be read or written
+    /// inside the attempt. Returning an error does **not** abort the commit: it
+    /// is reported through [`on_hook_error`](Self::on_hook_error) and the
+    /// transaction is committed anyway.
+    fn before_commit(
+        &self,
+        _trx: &Transaction,
+        _attempt: usize,
+    ) -> impl Future<Output = FdbResult<()>> + Send {
+        async { Ok(()) }
+    }
+
+    /// Called with the error of a hook that failed, right after it failed.
+    fn on_hook_error(&self, _err: &FdbError, _attempt: usize) {}
+
+    /// Called after a successful commit, with the time the commit took.
+    fn on_commit_success(
+        &self,
+        _committed: &TransactionCommitted,
+        _commit_duration_ms: u64,
+        _attempt: usize,
+    ) {
+    }
+
+    /// Called when the commit failed, **before** `on_error` resets the
+    /// transaction. This is the only window to read conflicting keys or inspect
+    /// the state of the failed attempt.
+    ///
+    /// It fires whatever the runner does next, including when the
+    /// [`RetryPolicy`] turns the failure into a fatal one. An error returned
+    /// here is reported through [`on_hook_error`](Self::on_hook_error) and
+    /// changes nothing else.
+    fn on_commit_error(
+        &self,
+        _err: &TransactionCommitError,
+        _attempt: usize,
+    ) -> impl Future<Output = FdbResult<()>> + Send {
+        async { Ok(()) }
+    }
+
+    /// Called when a closure error is about to be handed to `on_error`.
+    ///
+    /// A closure error classified as [`RetryDecision::Retry`] surfaces here as
+    /// a synthetic `FdbError` with code 1020 (`not_committed`). A fatal error
+    /// never reaches this hook.
+    fn on_closure_error(&self, _err: &FdbError, _attempt: usize) {}
+
+    /// Called after `on_error` returned, with the time it took, backoff
+    /// included.
+    fn on_error_duration(&self, _duration_ms: u64, _attempt: usize) {}
+
+    /// Called when the attempt is about to be retried, that is once `on_error`
+    /// accepted to retry it.
+    fn on_retry(&self, _attempt: usize) {}
+
+    /// Called exactly once when the run ends, whatever its outcome.
+    fn on_complete(&self) {}
+}
+
+impl RunnerHooks for () {}
+
+impl<H: RunnerHooks + Sync> RunnerHooks for &H {
+    fn on_attempt_start(&self, trx: &Transaction, attempt: usize) {
+        (*self).on_attempt_start(trx, attempt)
+    }
+
+    fn before_commit(
+        &self,
+        trx: &Transaction,
+        attempt: usize,
+    ) -> impl Future<Output = FdbResult<()>> + Send {
+        (*self).before_commit(trx, attempt)
+    }
+
+    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
+        (*self).on_hook_error(err, attempt)
+    }
+
+    fn on_commit_success(
+        &self,
+        committed: &TransactionCommitted,
+        commit_duration_ms: u64,
+        attempt: usize,
+    ) {
+        (*self).on_commit_success(committed, commit_duration_ms, attempt)
+    }
+
+    fn on_commit_error(
+        &self,
+        err: &TransactionCommitError,
+        attempt: usize,
+    ) -> impl Future<Output = FdbResult<()>> + Send {
+        (*self).on_commit_error(err, attempt)
+    }
+
+    fn on_closure_error(&self, err: &FdbError, attempt: usize) {
+        (*self).on_closure_error(err, attempt)
+    }
+
+    fn on_error_duration(&self, duration_ms: u64, attempt: usize) {
+        (*self).on_error_duration(duration_ms, attempt)
+    }
+
+    fn on_retry(&self, attempt: usize) {
+        (*self).on_retry(attempt)
+    }
+
+    fn on_complete(&self) {
+        (*self).on_complete()
+    }
+}
+
+impl<H: RunnerHooks + Sync> RunnerHooks for Option<H> {
+    fn on_attempt_start(&self, trx: &Transaction, attempt: usize) {
+        if let Some(hooks) = self {
+            hooks.on_attempt_start(trx, attempt);
+        }
+    }
+
+    async fn before_commit(&self, trx: &Transaction, attempt: usize) -> FdbResult<()> {
+        match self {
+            Some(hooks) => hooks.before_commit(trx, attempt).await,
+            None => Ok(()),
+        }
+    }
+
+    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
+        if let Some(hooks) = self {
+            hooks.on_hook_error(err, attempt);
+        }
+    }
+
+    fn on_commit_success(
+        &self,
+        committed: &TransactionCommitted,
+        commit_duration_ms: u64,
+        attempt: usize,
+    ) {
+        if let Some(hooks) = self {
+            hooks.on_commit_success(committed, commit_duration_ms, attempt);
+        }
+    }
+
+    async fn on_commit_error(&self, err: &TransactionCommitError, attempt: usize) -> FdbResult<()> {
+        match self {
+            Some(hooks) => hooks.on_commit_error(err, attempt).await,
+            None => Ok(()),
+        }
+    }
+
+    fn on_closure_error(&self, err: &FdbError, attempt: usize) {
+        if let Some(hooks) = self {
+            hooks.on_closure_error(err, attempt);
+        }
+    }
+
+    fn on_error_duration(&self, duration_ms: u64, attempt: usize) {
+        if let Some(hooks) = self {
+            hooks.on_error_duration(duration_ms, attempt);
+        }
+    }
+
+    fn on_retry(&self, attempt: usize) {
+        if let Some(hooks) = self {
+            hooks.on_retry(attempt);
+        }
+    }
+
+    fn on_complete(&self) {
+        if let Some(hooks) = self {
+            hooks.on_complete();
+        }
+    }
+}
+
+impl<A: RunnerHooks + Sync, B: RunnerHooks + Sync> RunnerHooks for (A, B) {
+    fn on_attempt_start(&self, trx: &Transaction, attempt: usize) {
+        self.0.on_attempt_start(trx, attempt);
+        self.1.on_attempt_start(trx, attempt);
+    }
+
+    async fn before_commit(&self, trx: &Transaction, attempt: usize) -> FdbResult<()> {
+        let first = self.0.before_commit(trx, attempt).await;
+        let second = self.1.before_commit(trx, attempt).await;
+        first.and(second)
+    }
+
+    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
+        self.0.on_hook_error(err, attempt);
+        self.1.on_hook_error(err, attempt);
+    }
+
+    fn on_commit_success(
+        &self,
+        committed: &TransactionCommitted,
+        commit_duration_ms: u64,
+        attempt: usize,
+    ) {
+        self.0
+            .on_commit_success(committed, commit_duration_ms, attempt);
+        self.1
+            .on_commit_success(committed, commit_duration_ms, attempt);
+    }
+
+    async fn on_commit_error(&self, err: &TransactionCommitError, attempt: usize) -> FdbResult<()> {
+        let first = self.0.on_commit_error(err, attempt).await;
+        let second = self.1.on_commit_error(err, attempt).await;
+        first.and(second)
+    }
+
+    fn on_closure_error(&self, err: &FdbError, attempt: usize) {
+        self.0.on_closure_error(err, attempt);
+        self.1.on_closure_error(err, attempt);
+    }
+
+    fn on_error_duration(&self, duration_ms: u64, attempt: usize) {
+        self.0.on_error_duration(duration_ms, attempt);
+        self.1.on_error_duration(duration_ms, attempt);
+    }
+
+    fn on_retry(&self, attempt: usize) {
+        self.0.on_retry(attempt);
+        self.1.on_retry(attempt);
+    }
+
+    fn on_complete(&self) {
+        self.0.on_complete();
+        self.1.on_complete();
+    }
+}
+
+/// Hooks collecting a [`MetricsReport`](crate::metrics::MetricsReport) into a
+/// [`TransactionMetrics`].
+///
+/// They are what [`Database::instrumented_run`](crate::Database::instrumented_run)
+/// is made of, and can be stacked on any other hooks to get the same report out
+/// of a plain [`run`](crate::Database::run):
+///
+/// ```no_run
+/// # use foundationdb::*;
+/// # use foundationdb::runner::MetricsHooks;
+/// # struct MyHooks;
+/// # impl foundationdb::runner::RunnerHooks for MyHooks {}
+/// # async fn example(db: &Database) -> Result<(), FdbBindingError> {
+/// let metrics = TransactionMetrics::new();
+/// db.run_with_hooks(&(MetricsHooks::new(&metrics), MyHooks), |trx, _| async move {
+///     trx.set(b"key", b"value");
+///     Ok::<_, FdbBindingError>(())
+/// })
+/// .await?;
+///
+/// let report = metrics.get_metrics_data();
+/// # let _ = report;
+/// # Ok(())
+/// # }
+/// ```
+///
+/// The run is timed from the construction of the hooks, so build one per run.
+///
+/// The collector is attached to the transaction when the first attempt starts,
+/// which is what makes the counters of a plain `run` land in the report. A
+/// transaction only ever reports to one collector: stacking two `MetricsHooks`
+/// leaves the second one empty.
+pub struct MetricsHooks {
+    metrics: TransactionMetrics,
+    start: Instant,
+}
+
+impl MetricsHooks {
+    /// Collects the metrics of a run into `metrics`.
+    ///
+    /// The handle is cloned, so the caller keeps reading the report from its
+    /// own [`TransactionMetrics`] once the run is over.
+    pub fn new(metrics: &TransactionMetrics) -> Self {
+        Self {
+            metrics: metrics.clone(),
+            start: Instant::now(),
+        }
+    }
+}
+
+impl RunnerHooks for MetricsHooks {
+    fn on_attempt_start(&self, trx: &Transaction, _attempt: usize) {
+        // Wires the collector onto the transaction the runner created, which is
+        // what makes the counters of every attempt land in the report. A no-op
+        // from the second attempt on: the transaction keeps its collector
+        // across retries.
+        trx.attach_metrics(&self.metrics);
+    }
+
+    async fn on_commit_error(
+        &self,
+        err: &TransactionCommitError,
+        _attempt: usize,
+    ) -> FdbResult<()> {
+        // not_committed (1020) = commit conflict
+        if err.code() == NOT_COMMITTED {
+            self.metrics.increment_conflict_count();
+        }
+        // Reading from the \xff\xff/transaction/conflicting_keys/ special keyspace is
+        // resolved client-side — no network round-trip to the cluster. The future still
+        // goes through the FDB network thread event loop, but the data comes from an
+        // in-memory map populated during the commit response. Returns empty if
+        // ReportConflictingKeys was not set.
+        match err.conflicting_keys().await {
+            Ok(keys) => {
+                self.metrics
+                    .set_conflicting_keys(ConflictKeys::Available(keys));
+                Ok(())
+            }
+            Err(read_error) => {
+                self.metrics
+                    .set_conflicting_keys(ConflictKeys::ReadFailed(read_error));
+                Err(read_error)
+            }
+        }
+    }
+
+    fn on_error_duration(&self, duration_ms: u64, _attempt: usize) {
+        // `on_error` already pushed the attempt it ended, so this lands on the
+        // last attempt of the report.
+        self.metrics
+            .set_on_error_duration(Duration::from_millis(duration_ms));
+    }
+
+    fn on_commit_success(
+        &self,
+        committed: &TransactionCommitted,
+        _commit_duration_ms: u64,
+        _attempt: usize,
+    ) {
+        // The attempt itself was pushed by `Transaction::commit`, which also
+        // recorded how long the commit took.
+        if let Ok(version) = committed.committed_version() {
+            self.metrics.set_commit_version(version);
+        }
+    }
+
+    fn on_complete(&self) {
+        // An attempt still open when the run ends is the one that failed:
+        // attempts that committed or were retried were pushed by the
+        // transaction itself, which makes this a no-op for them.
+        self.metrics.finish_attempt(AttemptOutcome::Failed);
+        self.metrics.set_total_duration(self.start.elapsed());
+    }
+}
+
+/// The failure a [`RetryPolicy`] is asked about.
+#[derive(Debug)]
+#[non_exhaustive]
+pub enum AttemptFailure<'a, E> {
+    /// The closure returned an error, the transaction was not committed.
+    Closure(&'a E),
+    /// The closure succeeded but the commit failed.
+    Commit(&'a TransactionCommitError),
+}
+
+/// Decides what the runner does with a failed attempt.
+///
+/// The runner classifies the failure on its own and passes its verdict as
+/// `proposed`; the policy returns the decision to apply, which is `proposed`
+/// itself unless it wants to override it:
+///
+/// * [`RetryDecision::Fatal`] ends the run and returns the original error, the
+///   one the closure produced or the commit error, never something the policy
+///   made up.
+/// * [`RetryDecision::Fdb`] hands that error to `fdb_transaction_on_error`,
+///   which judges retryability and applies the backoff.
+/// * [`RetryDecision::Retry`] does the same with code 1020 (`not_committed`),
+///   which is retryable by definition.
+///
+/// A policy cannot corrupt the
+/// [`MaybeCommitted`] flag handed to the closure: it is
+/// computed from the original error before the policy is consulted.
+///
+/// # Example: cap the number of attempts
+///
+/// ```
+/// use foundationdb::runner::{AttemptFailure, RetryPolicy};
+/// use foundationdb::{FdbBindingError, RetryDecision};
+///
+/// struct MaxAttempts(usize);
+///
+/// impl RetryPolicy<FdbBindingError> for MaxAttempts {
+///     fn decide(
+///         &self,
+///         _failure: AttemptFailure<'_, FdbBindingError>,
+///         proposed: RetryDecision,
+///         attempt: usize,
+///     ) -> RetryDecision {
+///         if attempt + 1 >= self.0 {
+///             RetryDecision::Fatal
+///         } else {
+///             proposed
+///         }
+///     }
+/// }
+/// ```
+pub trait RetryPolicy<E> {
+    /// Returns the decision to apply for `failure`, `proposed` being what the
+    /// runner would do on its own.
+    fn decide(
+        &self,
+        failure: AttemptFailure<'_, E>,
+        proposed: RetryDecision,
+        attempt: usize,
+    ) -> RetryDecision;
+}
+
+/// The default policy: it always applies what the runner proposes, leaving
+/// `fdb_transaction_on_error` the last word on retries.
+#[derive(Debug, Clone, Copy, Default)]
+pub struct NativeRetryPolicy;
+
+impl<E> RetryPolicy<E> for NativeRetryPolicy {
+    fn decide(
+        &self,
+        _failure: AttemptFailure<'_, E>,
+        proposed: RetryDecision,
+        _attempt: usize,
+    ) -> RetryDecision {
+        proposed
+    }
+}
+
+/// How a single attempt ended, carrying whatever still owns the transaction.
+enum Attempt<T, E> {
+    /// The closure succeeded and the transaction committed.
+    Committed {
+        committed: TransactionCommitted,
+        value: T,
+        commit_duration_ms: u64,
+    },
+    /// The closure failed, the transaction is untouched and can be retried.
+    ClosureFailed {
+        transaction: RetryableTransaction,
+        error: E,
+    },
+    /// The commit failed, the transaction is owned by the error.
+    CommitFailed(TransactionCommitError),
+    /// The runner could not get the transaction back from the closure.
+    BindingFailed(FdbBindingError),
+}
+
+/// Runs the closure once and commits, without any retry logic.
+///
+/// The closure future is built by the caller so that the runner keeps owning
+/// the closure itself: an attempt that borrowed it would make every `run`
+/// future require `F: Sync`.
+async fn run_attempt<Fut, T, E, H>(
+    transaction: RetryableTransaction,
+    hooks: &H,
+    closure_result: Fut,
+    attempt: usize,
+) -> Attempt<T, E>
+where
+    Fut: Future<Output = Result<T, E>>,
+    H: RunnerHooks,
+{
+    hooks.on_attempt_start(&transaction, attempt);
+
+    let value = match closure_result.await {
+        Ok(value) => value,
+        Err(error) => return Attempt::ClosureFailed { transaction, error },
+    };
+
+    // Observational: a failing hook is reported, the commit happens anyway.
+    if let Err(hook_error) = hooks.before_commit(&transaction, attempt).await {
+        hooks.on_hook_error(&hook_error, attempt);
+    }
+
+    let now_commit = Instant::now();
+    match transaction.commit().await {
+        Ok(Ok(committed)) => Attempt::Committed {
+            committed,
+            value,
+            commit_duration_ms: now_commit.elapsed().as_millis() as u64,
+        },
+        Ok(Err(commit_error)) => Attempt::CommitFailed(commit_error),
+        Err(binding_error) => Attempt::BindingFailed(binding_error),
+    }
+}
+
+/// The retry loop: classification, policy, `on_error` and backoff on top of
+/// [`run_attempt`].
+///
+/// Wrapped by [`run_with_hooks`], which owns firing
+/// [`RunnerHooks::on_complete`] on every exit path.
+async fn retry_loop<F, Fut, T, E, H, P>(
+    initial_transaction: RetryableTransaction,
+    hooks: &H,
+    policy: &P,
+    closure: F,
+) -> Result<T, E>
+where
+    F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
+    Fut: Future<Output = Result<T, E>>,
+    E: RetryableError,
+    H: RunnerHooks,
+    P: RetryPolicy<E>,
+{
+    let mut maybe_committed = false;
+    let mut transaction = initial_transaction;
+    let mut attempt: usize = 0;
+
+    loop {
+        let closure_result = closure(transaction.clone(), MaybeCommitted::new(maybe_committed));
+
+        let (retried_transaction, _fdb_err) =
+            match run_attempt(transaction, hooks, closure_result, attempt).await {
+                Attempt::Committed {
+                    committed,
+                    value,
+                    commit_duration_ms,
+                } => {
+                    hooks.on_commit_success(&committed, commit_duration_ms, attempt);
+
+                    #[cfg(feature = "trace")]
+                    tracing::info!(attempt, "success, returning result");
+
+                    return Ok(value);
+                }
+
+                Attempt::BindingFailed(binding_error) => {
+                    #[cfg(feature = "trace")]
+                    tracing::error!(attempt, "transaction reference kept, aborting transaction");
+
+                    return Err(E::from(binding_error));
+                }
+
+                Attempt::ClosureFailed { transaction, error } => {
+                    let proposed = error.retry_decision();
+                    // maybe_committed is computed from the original error only,
+                    // before the policy is consulted: a previous maybe-committed
+                    // attempt must stay visible to the closure whatever the
+                    // policy decides. The synthetic 1020 of `Retry` leaves it
+                    // untouched on purpose.
+                    if let RetryDecision::Fdb(fdb_err) = proposed {
+                        maybe_committed = fdb_err.is_maybe_committed();
+                    }
+
+                    let fdb_err =
+                        match policy.decide(AttemptFailure::Closure(&error), proposed, attempt) {
+                            RetryDecision::Fdb(fdb_err) => fdb_err,
+                            // Synthetic retryable code (1020, not_committed): backoff and
+                            // RetryLimit stay governed by fdb_transaction_on_error.
+                            RetryDecision::Retry => FdbError::from_code(NOT_COMMITTED),
+                            RetryDecision::Fatal => return Err(error),
+                        };
+                    hooks.on_closure_error(&fdb_err, attempt);
+
+                    let now_on_error = Instant::now();
+                    match transaction.on_error(fdb_err).await {
+                        Ok(Ok(transaction)) => {
+                            hooks.on_error_duration(
+                                now_on_error.elapsed().as_millis() as u64,
+                                attempt,
+                            );
+                            (transaction, fdb_err)
+                        }
+                        // Retries exhausted or non-retryable: return the original
+                        // closure error, which carries the caller's context.
+                        Ok(Err(_non_retryable)) => return Err(error),
+                        Err(binding_error) => return Err(E::from(binding_error)),
+                    }
+                }
+
+                Attempt::CommitFailed(commit_error) => {
+                    maybe_committed = commit_error.is_maybe_committed();
+                    let proposed = RetryDecision::Fdb(*commit_error);
+
+                    // Fires before the policy is consulted: a hook reading the
+                    // conflicting keys must see them even when the run is about
+                    // to end.
+                    if let Err(hook_error) = hooks.on_commit_error(&commit_error, attempt).await {
+                        hooks.on_hook_error(&hook_error, attempt);
+                    }
+
+                    let fdb_err = match policy.decide(
+                        AttemptFailure::Commit(&commit_error),
+                        proposed,
+                        attempt,
+                    ) {
+                        RetryDecision::Fdb(fdb_err) => fdb_err,
+                        RetryDecision::Retry => FdbError::from_code(NOT_COMMITTED),
+                        RetryDecision::Fatal => {
+                            return Err(E::from(FdbBindingError::from(*commit_error)));
+                        }
+                    };
+
+                    // The transaction is taken out of the error so that the
+                    // error handed to `on_error` is the one the policy chose.
+                    let (transaction, _commit_err) = commit_error.into_parts();
+                    let now_on_error = Instant::now();
+                    match transaction.on_error(fdb_err).await {
+                        Ok(transaction) => {
+                            hooks.on_error_duration(
+                                now_on_error.elapsed().as_millis() as u64,
+                                attempt,
+                            );
+                            (RetryableTransaction::new(transaction), fdb_err)
+                        }
+                        Err(non_retryable) => {
+                            #[cfg(feature = "trace")]
+                            tracing::error!(
+                                attempt,
+                                error_code = non_retryable.code(),
+                                "could not commit, non retryable error"
+                            );
+
+                            return Err(E::from(FdbBindingError::from(non_retryable)));
+                        }
+                    }
+                }
+            };
+
+        #[cfg(feature = "trace")]
+        tracing::warn!(
+            attempt,
+            error_code = _fdb_err.code(),
+            "restarting transaction"
+        );
+
+        hooks.on_retry(attempt);
+        transaction = retried_transaction;
+        attempt += 1;
+    }
+}
+
+/// The retry runner: [`retry_loop`] plus the guarantee that
+/// [`RunnerHooks::on_complete`] fires exactly once.
+#[cfg_attr(
+    feature = "trace",
+    tracing::instrument(level = "debug", skip(initial_transaction, hooks, policy, closure))
+)]
+pub(crate) async fn run_with_hooks<F, Fut, T, E, H, P>(
+    initial_transaction: RetryableTransaction,
+    hooks: &H,
+    policy: &P,
+    closure: F,
+) -> Result<T, E>
+where
+    F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
+    Fut: Future<Output = Result<T, E>>,
+    E: RetryableError,
+    H: RunnerHooks,
+    P: RetryPolicy<E>,
+{
+    let result = retry_loop(initial_transaction, hooks, policy, closure).await;
+    hooks.on_complete();
+    result
+}
+
+/// Builder for a transactional run, returned by
+/// [`Database::runner`](crate::Database::runner).
+///
+/// It assembles the [`RunnerHooks`] and the [`RetryPolicy`] of a single call to
+/// [`run`](Self::run): no hooks and [`NativeRetryPolicy`] by default. Both are
+/// borrowed, so the same hooks and policy can be reused across runs (mind
+/// [`MetricsHooks`], which times the run from its own construction).
+///
+/// ```no_run
+/// # use foundationdb::*;
+/// # async fn example(db: &Database) -> Result<(), FdbBindingError> {
+/// db.runner()
+///     .run(|trx, _| async move {
+///         trx.set(b"key", b"value");
+///         Ok::<_, FdbBindingError>(())
+///     })
+///     .await
+/// # }
+/// ```
+pub struct TransactionRunner<'a, H = (), P = NativeRetryPolicy> {
+    db: &'a Database,
+    hooks: &'a H,
+    policy: &'a P,
+}
+
+impl<'a> TransactionRunner<'a, (), NativeRetryPolicy> {
+    /// A runner on `db` with no hooks and the native retry policy.
+    pub(crate) fn new(db: &'a Database) -> Self {
+        Self {
+            db,
+            hooks: &(),
+            policy: &NativeRetryPolicy,
+        }
+    }
+}
+
+impl<'a, H, P> TransactionRunner<'a, H, P> {
+    /// Observes the run with `hooks`, replacing any hooks set before.
+    ///
+    /// Stack several of them with a tuple: `.hooks(&(first, second))`.
+    pub fn hooks<H2>(self, hooks: &'a H2) -> TransactionRunner<'a, H2, P> {
+        TransactionRunner {
+            db: self.db,
+            hooks,
+            policy: self.policy,
+        }
+    }
+
+    /// Decides the retries with `policy` instead of [`NativeRetryPolicy`].
+    pub fn retry_policy<P2>(self, policy: &'a P2) -> TransactionRunner<'a, H, P2> {
+        TransactionRunner {
+            db: self.db,
+            hooks: self.hooks,
+            policy,
+        }
+    }
+
+    /// Runs `closure` in a transaction, retrying it until it commits or the
+    /// error is fatal.
+    ///
+    /// See [`Database::run`](crate::Database::run) for the semantics of the
+    /// closure, its error type and the retries.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, closure))
+    )]
+    pub async fn run<F, Fut, T, E>(self, closure: F) -> Result<T, E>
+    where
+        F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
+        Fut: Future<Output = Result<T, E>>,
+        E: RetryableError,
+        H: RunnerHooks,
+        P: RetryPolicy<E>,
+    {
+        let transaction = match self.db.create_retryable_trx() {
+            Ok(transaction) => transaction,
+            // The run is over before it started, but it did start: hooks that
+            // report on completion must still be called exactly once.
+            Err(err) => {
+                self.hooks.on_complete();
+                return Err(E::from(err));
+            }
+        };
+
+        run_with_hooks(transaction, self.hooks, self.policy, closure).await
+    }
+}
diff --git a/bindings/rust/foundationdb/src/timekeeper.rs b/bindings/rust/foundationdb/src/timekeeper.rs
new file mode 100644
index 00000000000..7c4e9dda0fd
--- /dev/null
+++ b/bindings/rust/foundationdb/src/timekeeper.rs
@@ -0,0 +1,102 @@
+//! There is a key range called TimeKeeper in the system key space which stores a rolling history window
+//! of time to version mappings, with one data point every 10 seconds.
+//! It is not exposed via any user-facing API, though of course the data can be read by a user.
+//! It is not an official database feature and should not be relied on for anything where accuracy
+//! is critical as nothing prevents or detects system clock skew on the FDB process logging these data points.
+//!
+//! TimeKeeper is used by backup and restore to convert timestamps to approximate versions and versions
+//! to approximate timestamps to make reasoning about backup data and restore operations easier.
+//! Lookups work by finding the nearest value for the query version or timestamp, taking the equivalent other value,
+//! and then adding an adjustment estimate based on 1 million versions per 1 second.
+//! This logic accounts for arbitrary version advancement due to recovery, DR switch operations, or any other reason.
+//!
+//! [source](https://forums.foundationdb.org/t/versionstamp-as-absolute-time/2442/3)
+
+use crate::future::FdbValue;
+use crate::options::TransactionOption;
+use crate::{FdbBindingError, FdbResult, KeySelector, RangeOption, Transaction};
+use foundationdb_tuple::{pack, unpack};
+use futures::StreamExt;
+
+/// Timekeeper keys are stored in a special keyspace
+/// Can be found in the [Java implementation](https://github.com/FoundationDB/fdb-record-layer/blob/main/fdb-extensions/src/main/java/com/apple/foundationdb/system/SystemKeyspace.java#L80)
+const TIME_KEEPER_PREFIX: &[u8] = b"\xff\x02/timeKeeper/map/";
+
+/// Flavor about the mode of scanning
+pub enum HintMode {
+    /// The read version is ensure to be before the timestamp
+    BeforeTimestamp,
+    /// The read version is ensured to be after the timestamp
+    AfterTimestamp,
+}
+
+/// Try to get a version ID closer as possible as the asked timestamp
+///
+/// If no result are found, either your timestamp is in the future of the
+/// Timekeeper or the data has been rolled by fresh ones.
+///
+/// The layout os follow:
+///
+/// TIME_KEEPER_PREFIX/timestamp1 => read_version1
+/// TIME_KEEPER_PREFIX/timestamp2 => read_version2
+/// TIME_KEEPER_PREFIX/timestamp3 => read_version3
+///
+/// Each key are associated to a pack read version on 8 bytes
+/// compatible with an i64.
+///
+/// Timestamps are provided from unix time as seconds
+pub async fn hint_version_from_timestamp(
+    trx: &Transaction,
+    unix_timestamp_as_seconds: u64,
+    mode: HintMode,
+    snapshot: bool,
+) -> Result<Option<u64>, FdbBindingError> {
+    // Timekeeper range keys are stored in /0x00/0x02 system namespace
+    // to be able to read this range, the transaction must have
+    // capabilities to read System Keys
+    trx.set_option(TransactionOption::ReadSystemKeys)?;
+    // The profiling should be used even when the Database has been locked
+    trx.set_option(TransactionOption::ReadLockAware)?;
+
+    // Timekeeper keys are defined has prefix/timestamp
+    let mut start_key_bytes = TIME_KEEPER_PREFIX.to_vec();
+    start_key_bytes.extend_from_slice(&pack(&unix_timestamp_as_seconds));
+    // we get the first key greater than this value because timekeeper doesn't tick
+    // each seconds but rather each 10 seconds but not each time
+    let start_key = KeySelector::first_greater_or_equal(start_key_bytes.clone());
+
+    // The end of the scan is the end of the timekeeper range
+    // but we won't scan it the whole range
+    let mut end_key_bytes = TIME_KEEPER_PREFIX.to_vec();
+    end_key_bytes.extend_from_slice(b"\xff");
+    let end_key = KeySelector::first_greater_than(end_key_bytes);
+
+    let mut range = match mode {
+        HintMode::AfterTimestamp => RangeOption::from((start_key, end_key)),
+        HintMode::BeforeTimestamp => {
+            let mut range = RangeOption::from((
+                KeySelector::first_greater_than(TIME_KEEPER_PREFIX),
+                start_key,
+            ));
+            range.reverse = true;
+            range
+        }
+    };
+    // No need to scan further than the next and previous key
+    range.limit = Some(1);
+
+    // We get the first key matching our start range bound
+    let results = trx
+        .get_ranges_keyvalues(range, snapshot)
+        .take(1)
+        .collect::<Vec<FdbResult<FdbValue>>>()
+        .await;
+
+    // If any result then the value found will be the read version ID
+    if let Some(Ok(kv)) = results.first() {
+        let version = unpack(kv.value()).map_err(FdbBindingError::PackError)?;
+        return Ok(Some(version));
+    }
+    // otherwise timestamp too old or is future
+    Ok(None)
+}
diff --git a/bindings/rust/foundationdb/src/transaction.rs b/bindings/rust/foundationdb/src/transaction.rs
new file mode 100644
index 00000000000..058b3e5a6b6
--- /dev/null
+++ b/bindings/rust/foundationdb/src/transaction.rs
@@ -0,0 +1,2045 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Implementations of the FDBTransaction C API
+//!
+//! <https://apple.github.io/foundationdb/api-c.html#transaction>
+
+use foundationdb_sys as fdb_sys;
+use std::fmt;
+use std::ops::{Deref, Range, RangeInclusive};
+use std::ptr::NonNull;
+use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::{Arc, Mutex, OnceLock};
+use std::time::Instant;
+
+use crate::budget::{AttemptUsage, BudgetExceeded, ClientBudget, UsageSlot, UsageSnapshot};
+use crate::env::Clock;
+use crate::future::*;
+use crate::keyselector::*;
+use crate::metrics::{AttemptOutcome, MetricKey, TransactionMetrics};
+use crate::options;
+
+use crate::{FdbError, FdbResult, error};
+use foundationdb_macros::cfg_api_versions;
+
+use crate::error::FdbBindingError;
+
+use futures::{
+    Future, FutureExt, Stream, TryFutureExt, TryStreamExt, future, future::Either, stream,
+};
+
+#[cfg_api_versions(min = 610)]
+const METADATA_VERSION_KEY: &[u8] = b"\xff/metadataVersion";
+
+/// Special keyspace prefix for conflicting keys.
+const CONFLICTING_KEYS_PREFIX: &[u8] = b"\xff\xff/transaction/conflicting_keys/";
+// Matches C++ SystemData.cpp conflictingKeysRange end key.
+const CONFLICTING_KEYS_END: &[u8] = b"\xff\xff/transaction/conflicting_keys/\xff\xff";
+
+/// Special keyspace prefix for the read conflict ranges of a transaction.
+#[cfg_api_versions(min = 630)]
+const READ_CONFLICT_RANGE_PREFIX: &[u8] = b"\xff\xff/transaction/read_conflict_range/";
+#[cfg_api_versions(min = 630)]
+const READ_CONFLICT_RANGE_END: &[u8] = b"\xff\xff/transaction/read_conflict_range/\xff\xff";
+
+/// Special keyspace prefix for the write conflict ranges of a transaction.
+#[cfg_api_versions(min = 630)]
+const WRITE_CONFLICT_RANGE_PREFIX: &[u8] = b"\xff\xff/transaction/write_conflict_range/";
+#[cfg_api_versions(min = 630)]
+const WRITE_CONFLICT_RANGE_END: &[u8] = b"\xff\xff/transaction/write_conflict_range/\xff\xff";
+
+/// A key range reported by one of the conflict-range special keyspaces.
+///
+/// Returned by [`Transaction::conflicting_keys`] (the ranges that made a commit
+/// fail), [`Transaction::read_conflict_ranges`] and
+/// [`Transaction::write_conflict_ranges`] (the ranges the transaction has
+/// accumulated so far).
+///
+/// Those keyspaces all encode ranges using boundary markers:
+/// - Value `b"1"` marks the inclusive start of a range
+/// - Value `b"0"` marks the exclusive end of a range
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct ConflictRange {
+    begin: Vec<u8>,
+    end: Vec<u8>,
+}
+
+impl ConflictRange {
+    /// The inclusive begin of the range.
+    pub fn begin(&self) -> &[u8] {
+        &self.begin
+    }
+
+    /// The exclusive end of the range.
+    pub fn end(&self) -> &[u8] {
+        &self.end
+    }
+}
+
+impl fmt::Display for ConflictRange {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "{}..{}",
+            String::from_utf8_lossy(&self.begin),
+            String::from_utf8_lossy(&self.end),
+        )
+    }
+}
+
+/// The range type returned by [`Transaction::conflicting_keys`], an alias of
+/// [`ConflictRange`] which all three conflict-range readers share.
+pub type ConflictingKeyRange = ConflictRange;
+
+/// Incremental parser of the `b"1"` / `b"0"` boundary encoding used by the
+/// `\xff\xff/transaction/*` conflict-range special keyspaces.
+///
+/// A range is only emitted once its end marker arrives, and the open begin
+/// marker survives across [`feed`](Self::feed) calls: a `b"1"` and its matching
+/// `b"0"` can land in two different `get_range` batches, so the parser is fed
+/// batch after batch and the caller paginates until the keyspace is exhausted.
+///
+/// A begin marker whose end marker never arrives is dropped: only complete
+/// ranges are returned, in every build profile.
+struct ConflictRangeParser {
+    prefix_len: usize,
+    ranges: Vec<ConflictRange>,
+    open_begin: Option<Vec<u8>>,
+}
+
+impl ConflictRangeParser {
+    /// `prefix` is the special keyspace prefix to strip from the keys fed in.
+    fn new(prefix: &[u8]) -> Self {
+        Self {
+            prefix_len: prefix.len(),
+            ranges: Vec::new(),
+            open_begin: None,
+        }
+    }
+
+    /// Feeds one batch of `(key, value)` pairs, in keyspace order.
+    fn feed<'a, I>(&mut self, batch: I)
+    where
+        I: IntoIterator<Item = (&'a [u8], &'a [u8])>,
+    {
+        for (raw_key, value) in batch {
+            let key = raw_key.get(self.prefix_len..).unwrap_or_default().to_vec();
+
+            match value {
+                b"1" => {
+                    #[cfg(feature = "trace")]
+                    if self.open_begin.is_some() {
+                        tracing::warn!(
+                            "'1' marker following an unpaired one in a conflict range keyspace, range dropped"
+                        );
+                    }
+
+                    self.open_begin = Some(key);
+                }
+                b"0" => {
+                    if let Some(begin) = self.open_begin.take() {
+                        self.ranges.push(ConflictRange { begin, end: key });
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+
+    /// Returns the complete ranges parsed so far, dropping a begin marker left
+    /// open by the end of the stream.
+    fn finish(self) -> Vec<ConflictRange> {
+        #[cfg(feature = "trace")]
+        if self.open_begin.is_some() {
+            tracing::warn!(
+                "unpaired '1' marker at the end of a conflict range keyspace, range dropped"
+            );
+        }
+
+        self.ranges
+    }
+}
+
+/// A committed transaction.
+#[derive(Debug)]
+#[repr(transparent)]
+pub struct TransactionCommitted {
+    tr: Transaction,
+}
+
+impl TransactionCommitted {
+    /// Retrieves the database version number at which a given transaction was committed.
+    ///
+    /// Read-only transactions do not modify the database when committed and will have a committed
+    /// version of -1. Keep in mind that a transaction which reads keys and then sets them to their
+    /// current values may be optimized to a read-only transaction.
+    ///
+    /// Note that database versions are not necessarily unique to a given transaction and so cannot
+    /// be used to determine in what order two transactions completed. The only use for this
+    /// function is to manually enforce causal consistency when calling `set_read_version()` on
+    /// another subsequent transaction.
+    ///
+    /// Most applications will not call this function.
+    pub fn committed_version(&self) -> FdbResult<i64> {
+        let mut version: i64 = 0;
+        error::eval(unsafe {
+            fdb_sys::fdb_transaction_get_committed_version(self.tr.inner.as_ptr(), &mut version)
+        })?;
+        Ok(version)
+    }
+
+    /// Reset the transaction to its initial state.
+    ///
+    /// This will not affect previously committed data.
+    ///
+    /// This is similar to dropping the transaction and creating a new one.
+    /// User versions allocated before reset are invalid for the new attempt,
+    /// which starts allocating again at zero.
+    pub fn reset(mut self) -> Transaction {
+        self.tr.reset();
+        self.tr
+    }
+}
+impl From<TransactionCommitted> for Transaction {
+    fn from(tc: TransactionCommitted) -> Transaction {
+        tc.reset()
+    }
+}
+
+/// A failed to commit transaction.
+pub struct TransactionCommitError {
+    tr: Transaction,
+    err: FdbError,
+}
+
+impl TransactionCommitError {
+    /// Implements the recommended retry and backoff behavior for a transaction. This function knows
+    /// which of the error codes generated by other `Transaction` functions represent temporary
+    /// error conditions and which represent application errors that should be handled by the
+    /// application. It also implements an exponential backoff strategy to avoid swamping the
+    /// database cluster with excessive retries when there is a high level of conflict between
+    /// transactions.
+    ///
+    /// You should not call this method most of the times and use `Database::transact` which
+    /// implements a retry loop strategy for you.
+    ///
+    /// On success the transaction enters a new attempt: its
+    /// [usage](Transaction::attempt_usage) restarts from zero, while its
+    /// [client budget](Transaction::set_client_budget) is kept. User versions
+    /// allocated by [`Transaction::allocate_user_version`] are invalid for the
+    /// new attempt, which starts allocating again at zero.
+    pub fn on_error(self) -> impl Future<Output = FdbResult<Transaction>> {
+        self.tr.mark_attempt_end();
+        let cause = self.err;
+
+        FdbFuture::<()>::new(unsafe {
+            fdb_sys::fdb_transaction_on_error(self.tr.inner.as_ptr(), self.err.code())
+        })
+        .map_ok(move |()| {
+            self.tr.end_attempt(AttemptOutcome::Retried { cause });
+            self.tr.begin_attempt_usage();
+            self.tr.reset_user_version_allocator();
+            self.tr
+        })
+    }
+
+    /// Reads the conflicting key ranges that caused this commit failure.
+    ///
+    /// Only returns meaningful results if
+    /// [`TransactionOption::ReportConflictingKeys`](crate::options::TransactionOption::ReportConflictingKeys)
+    /// was set on the transaction **and** the error is `not_committed` (code 1020).
+    ///
+    /// Must be called **before** [`on_error`](Self::on_error) which resets the transaction.
+    ///
+    /// # Errors
+    ///
+    /// Returns an `FdbError` if the special keyspace read fails.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub async fn conflicting_keys(&self) -> FdbResult<Vec<ConflictingKeyRange>> {
+        self.tr.conflicting_keys().await
+    }
+
+    /// Reset the transaction to its initial state.
+    ///
+    /// This is similar to dropping the transaction and creating a new one.
+    /// User versions allocated before reset are invalid for the new attempt,
+    /// which starts allocating again at zero.
+    pub fn reset(mut self) -> Transaction {
+        self.tr.reset();
+        self.tr
+    }
+
+    /// Splits the error into the transaction it failed on and the error itself,
+    /// without resetting anything.
+    ///
+    /// Used by the retry runner to hand `on_error` an error chosen by a
+    /// [`RetryPolicy`](crate::runner::RetryPolicy) rather than the commit error
+    /// itself.
+    pub(crate) fn into_parts(self) -> (Transaction, FdbError) {
+        (self.tr, self.err)
+    }
+}
+
+impl Deref for TransactionCommitError {
+    type Target = FdbError;
+    fn deref(&self) -> &FdbError {
+        &self.err
+    }
+}
+
+impl From<TransactionCommitError> for FdbError {
+    fn from(tce: TransactionCommitError) -> FdbError {
+        tce.err
+    }
+}
+
+impl fmt::Debug for TransactionCommitError {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "TransactionCommitError({})", self.err)
+    }
+}
+
+impl fmt::Display for TransactionCommitError {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        self.err.fmt(f)
+    }
+}
+
+impl std::error::Error for TransactionCommitError {}
+
+/// The result of `Transaction::Commit`
+type TransactionResult = Result<TransactionCommitted, TransactionCommitError>;
+
+/// A cancelled transaction
+#[derive(Debug)]
+#[repr(transparent)]
+pub struct TransactionCancelled {
+    tr: Transaction,
+}
+impl TransactionCancelled {
+    /// Reset the transaction to its initial state.
+    ///
+    /// This is similar to dropping the transaction and creating a new one.
+    /// User versions allocated before reset are invalid for the new attempt,
+    /// which starts allocating again at zero.
+    pub fn reset(mut self) -> Transaction {
+        self.tr.reset();
+        self.tr
+    }
+}
+impl From<TransactionCancelled> for Transaction {
+    fn from(tc: TransactionCancelled) -> Transaction {
+        tc.reset()
+    }
+}
+
+/// In FoundationDB, a transaction is a mutable snapshot of a database.
+///
+/// All read and write operations on a transaction see and modify an otherwise-unchanging version of the database and only change the underlying database if and when the transaction is committed. Read operations do see the effects of previous write operations on the same transaction. Committing a transaction usually succeeds in the absence of conflicts.
+///
+/// Applications must provide error handling and an appropriate retry loop around the application code for a transaction. See the documentation for [fdb_transaction_on_error()](https://apple.github.io/foundationdb/api-c.html#transaction).
+///
+/// Transactions group operations into a unit with the properties of atomicity, isolation, and durability. Transactions also provide the ability to maintain an application’s invariants or integrity constraints, supporting the property of consistency. Together these properties are known as ACID.
+///
+/// Transactions are also causally consistent: once a transaction has been successfully committed, all subsequently created transactions will see the modifications made by it.
+#[derive(Debug)]
+pub struct Transaction {
+    // Order of fields should not be changed, because Rust drops field top-to-bottom, and
+    // transaction should be dropped before cluster.
+    inner: NonNull<fdb_sys::FDBTransaction>,
+    /// Metrics collector of the transaction, attached at creation or by a
+    /// runner hook, see [`Transaction::attach_metrics`]. Set at most once.
+    metrics: OnceLock<TransactionMetrics>,
+    /// Always-on accounting of the current attempt, see [`crate::budget`].
+    usage: UsageSlot,
+    /// Client-side limits applied to the current attempt. Unlike `usage`, they
+    /// are configuration: they survive `on_error` and `reset`.
+    budget: Mutex<ClientBudget>,
+    /// The next user version to issue for an incomplete versionstamp in the
+    /// current transaction attempt.
+    user_version: AtomicU32,
+}
+unsafe impl Send for Transaction {}
+unsafe impl Sync for Transaction {}
+
+/// Converts Rust `bool` into `fdb_sys::fdb_bool_t`
+#[inline]
+fn fdb_bool(v: bool) -> fdb_sys::fdb_bool_t {
+    if v { 1 } else { 0 }
+}
+#[inline]
+fn fdb_len(len: usize, context: &'static str) -> std::os::raw::c_int {
+    assert!(len <= i32::MAX as usize, "{context}.len() > i32::MAX");
+    len as i32
+}
+#[inline]
+fn fdb_iteration(iteration: usize) -> std::os::raw::c_int {
+    if iteration > i32::MAX as usize {
+        0 // this will cause client_invalid_operation
+    } else {
+        iteration as i32
+    }
+}
+#[inline]
+fn fdb_limit(v: usize) -> std::os::raw::c_int {
+    if v > i32::MAX as usize {
+        i32::MAX
+    } else {
+        v as i32
+    }
+}
+
+/// `RangeOption` represents a query parameters for range scan query.
+///
+/// You can construct `RangeOption` easily:
+///
+/// ```
+/// use foundationdb::RangeOption;
+///
+/// let opt = RangeOption::from((b"begin".as_ref(), b"end".as_ref()));
+/// let opt: RangeOption = (b"begin".as_ref()..b"end".as_ref()).into();
+/// let opt = RangeOption {
+///     limit: Some(10),
+///     ..RangeOption::from((b"begin".as_ref(), b"end".as_ref()))
+/// };
+/// ```
+#[derive(Debug, Clone)]
+pub struct RangeOption<'a> {
+    /// The beginning of the range.
+    pub begin: KeySelector<'a>,
+    /// The end of the range.
+    pub end: KeySelector<'a>,
+    /// If non-zero, indicates the maximum number of key-value pairs to return.
+    /// `None` and `Some(0)` both mean unlimited.
+    pub limit: Option<usize>,
+    /// If non-zero, indicates a (soft) cap on the combined number of bytes of keys and values to
+    /// return for each item.
+    pub target_bytes: usize,
+    /// One of the options::StreamingMode values indicating how the caller would like the data in
+    /// the range returned.
+    pub mode: options::StreamingMode,
+    /// If true, key-value pairs will be returned in reverse lexicographical order beginning at
+    /// the end of the range.
+    pub reverse: bool,
+    #[doc(hidden)]
+    pub __non_exhaustive: std::marker::PhantomData<()>,
+}
+
+impl RangeOption<'_> {
+    /// Reverses the range direction.
+    pub fn rev(mut self) -> Self {
+        self.reverse = !self.reverse;
+        self
+    }
+
+    pub fn next_range(mut self, kvs: &FdbValues) -> Option<Self> {
+        if !kvs.more() {
+            return None;
+        }
+
+        let last = kvs.last()?;
+        let last_key = last.key();
+
+        if let Some(limit) = self.limit.as_mut().filter(|limit| **limit != 0) {
+            *limit = limit.saturating_sub(kvs.len());
+            if *limit == 0 {
+                return None;
+            }
+        }
+
+        if self.reverse {
+            self.end.make_first_greater_or_equal(last_key);
+        } else {
+            self.begin.make_first_greater_than(last_key);
+        }
+        Some(self)
+    }
+
+    #[cfg_api_versions(min = 710)]
+    pub(crate) fn next_mapped_range(mut self, kvs: &MappedKeyValues) -> Option<Self> {
+        if !kvs.more() {
+            return None;
+        }
+
+        let last = kvs.last()?;
+        let last_key = last.parent_key();
+
+        if let Some(limit) = self.limit.as_mut().filter(|limit| **limit != 0) {
+            *limit = limit.saturating_sub(kvs.len());
+            if *limit == 0 {
+                return None;
+            }
+        }
+
+        if self.reverse {
+            self.end.make_first_greater_or_equal(last_key);
+        } else {
+            self.begin.make_first_greater_than(last_key);
+        }
+        Some(self)
+    }
+}
+
+impl Default for RangeOption<'_> {
+    fn default() -> Self {
+        Self {
+            begin: KeySelector::first_greater_or_equal([].as_ref()),
+            end: KeySelector::first_greater_or_equal([].as_ref()),
+            limit: None,
+            target_bytes: 0,
+            mode: options::StreamingMode::Iterator,
+            reverse: false,
+            __non_exhaustive: std::marker::PhantomData,
+        }
+    }
+}
+
+impl<'a> From<(KeySelector<'a>, KeySelector<'a>)> for RangeOption<'a> {
+    fn from((begin, end): (KeySelector<'a>, KeySelector<'a>)) -> Self {
+        Self {
+            begin,
+            end,
+            ..Self::default()
+        }
+    }
+}
+impl From<(Vec<u8>, Vec<u8>)> for RangeOption<'static> {
+    fn from((begin, end): (Vec<u8>, Vec<u8>)) -> Self {
+        Self {
+            begin: KeySelector::first_greater_or_equal(begin),
+            end: KeySelector::first_greater_or_equal(end),
+            ..Self::default()
+        }
+    }
+}
+impl<'a> From<(&'a [u8], &'a [u8])> for RangeOption<'a> {
+    fn from((begin, end): (&'a [u8], &'a [u8])) -> Self {
+        Self {
+            begin: KeySelector::first_greater_or_equal(begin),
+            end: KeySelector::first_greater_or_equal(end),
+            ..Self::default()
+        }
+    }
+}
+impl<'a> From<std::ops::Range<KeySelector<'a>>> for RangeOption<'a> {
+    fn from(range: Range<KeySelector<'a>>) -> Self {
+        RangeOption::from((range.start, range.end))
+    }
+}
+
+impl<'a> From<std::ops::Range<&'a [u8]>> for RangeOption<'a> {
+    fn from(range: Range<&'a [u8]>) -> Self {
+        RangeOption::from((range.start, range.end))
+    }
+}
+
+impl From<std::ops::Range<std::vec::Vec<u8>>> for RangeOption<'static> {
+    fn from(range: Range<Vec<u8>>) -> Self {
+        RangeOption::from((range.start, range.end))
+    }
+}
+
+impl<'a> From<std::ops::RangeInclusive<&'a [u8]>> for RangeOption<'a> {
+    fn from(range: RangeInclusive<&'a [u8]>) -> Self {
+        let (start, end) = range.into_inner();
+        (KeySelector::first_greater_or_equal(start)..KeySelector::first_greater_than(end)).into()
+    }
+}
+
+impl From<std::ops::RangeInclusive<std::vec::Vec<u8>>> for RangeOption<'static> {
+    fn from(range: RangeInclusive<Vec<u8>>) -> Self {
+        let (start, end) = range.into_inner();
+        (KeySelector::first_greater_or_equal(start)..KeySelector::first_greater_than(end)).into()
+    }
+}
+
+impl Transaction {
+    pub(crate) fn new(inner: NonNull<fdb_sys::FDBTransaction>) -> Self {
+        Self {
+            inner,
+            metrics: OnceLock::new(),
+            usage: UsageSlot::default(),
+            budget: Mutex::new(ClientBudget::default()),
+            user_version: AtomicU32::new(0),
+        }
+    }
+
+    /// Allocates a user version for an incomplete [`Versionstamp`](crate::tuple::Versionstamp).
+    ///
+    /// Values start at zero and increase through `65535`. Values issued by
+    /// this allocator are unique within the current transaction attempt, across
+    /// all handles that share that transaction. Explicit user versions supplied
+    /// to `Versionstamp::incomplete` remain supported, but can collide with
+    /// allocator-issued versions or with each other.
+    ///
+    /// The allocator performs no database operations and adds no conflict
+    /// ranges. It has no reservation mechanism: allocate a value when building
+    /// the versionstamped mutation that will use it.
+    ///
+    /// `reset` and a successful `on_error` start a new transaction attempt and
+    /// restart allocation at zero. A cancelled transaction retains its issued
+    /// values until it is reset. Versions from a previous attempt therefore
+    /// must not be reused in mutations for the new attempt.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`FdbBindingError::UserVersionExhausted`] after all 65536 user
+    /// versions have been issued for this attempt.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn allocate_user_version(&self) -> Result<u16, FdbBindingError> {
+        self.user_version
+            .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |current| {
+                (current <= u16::MAX as u32).then_some(current + 1)
+            })
+            .map(|current| current as u16)
+            .map_err(|_| FdbBindingError::UserVersionExhausted)
+    }
+
+    /// Attaches a metrics collector to this transaction and opens its first
+    /// attempt on the accounting generation currently in use.
+    ///
+    /// A transaction collects metrics for at most one
+    /// [`TransactionMetrics`]: attaching a second one does nothing, the first
+    /// collector keeps receiving everything. This is what
+    /// [`MetricsHooks`](crate::runner::MetricsHooks) uses to wire itself onto a
+    /// transaction created by the runner.
+    pub(crate) fn attach_metrics(&self, metrics: &TransactionMetrics) {
+        if self.metrics.set(metrics.clone()).is_ok() {
+            self.open_metrics_attempt();
+        }
+    }
+
+    /// The metrics collector of the transaction, if one is attached.
+    fn metrics(&self) -> Option<&TransactionMetrics> {
+        self.metrics.get()
+    }
+
+    /// Points the metrics at the accounting generation of the current attempt,
+    /// so that whatever happens from now on is recorded there.
+    fn open_metrics_attempt(&self) {
+        if let Some(metrics) = self.metrics() {
+            metrics.begin_attempt(self.usage.current());
+        }
+    }
+
+    /// Freezes the duration of the current attempt: it is over, only the retry
+    /// machinery runs from here.
+    fn mark_attempt_end(&self) {
+        if let Some(metrics) = self.metrics() {
+            metrics.mark_attempt_end();
+        }
+    }
+
+    /// Pushes the current attempt to the metrics report.
+    fn end_attempt(&self, outcome: AttemptOutcome) {
+        if let Some(metrics) = self.metrics() {
+            metrics.finish_attempt(outcome);
+        }
+    }
+
+    /// The accounting generation an operation issued now must record into.
+    ///
+    /// Callers of asynchronous operations must capture it when the operation is
+    /// **issued** and record into that clone on completion, so that a future
+    /// outliving its attempt cannot pollute the next one.
+    fn usage(&self) -> Arc<AttemptUsage> {
+        self.usage.current()
+    }
+
+    /// Starts a fresh accounting generation measured with `clock`.
+    ///
+    /// This never touches the budget mutex: callers take the clock out of the
+    /// budget themselves, in the same critical section as whatever else they
+    /// need from it.
+    fn begin_attempt_with_clock(&self, clock: Option<Arc<dyn Clock>>) {
+        self.usage.begin(clock);
+        self.open_metrics_attempt();
+    }
+
+    /// Starts a fresh accounting generation for a new transaction attempt.
+    ///
+    /// Usage counters restart from zero and the elapsed time is measured from
+    /// here, with the clock of the current budget. The client budget, being
+    /// configuration, is left untouched.
+    ///
+    /// An instrumented transaction also starts recording a new attempt: call
+    /// [`end_attempt`](Self::end_attempt) first when the attempt that is ending
+    /// must appear in the report.
+    pub(crate) fn begin_attempt_usage(&self) {
+        let clock = self
+            .budget
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+            .clock
+            .clone();
+        self.begin_attempt_with_clock(clock);
+    }
+
+    /// Returns the usage accounted for the current transaction attempt.
+    ///
+    /// Accounting is always on, no instrumentation needed. The counters are
+    /// client-side estimates and are reset on every new attempt, see
+    /// [`crate::budget`].
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn attempt_usage(&self) -> UsageSnapshot {
+        self.usage().snapshot()
+    }
+
+    /// Sets the client-side budget of this transaction.
+    ///
+    /// The limits are **not** enforced by FoundationDB and not enforced
+    /// automatically: they are checked when you call
+    /// [`check_client_budget`](Self::check_client_budget). See [`crate::budget`]
+    /// for what is counted and how precise it is.
+    ///
+    /// Setting a budget starts a fresh accounting generation, so the limits
+    /// apply to what happens from now on. They then survive `on_error` and
+    /// `reset`, and apply to each subsequent attempt with usage back at zero.
+    /// That generation, and every later one, is measured with the
+    /// [`clock`](ClientBudget::clock) of this budget.
+    ///
+    /// On an instrumented transaction, set the budget before doing anything
+    /// else: the new generation is also the one the metrics record into, so
+    /// operations performed before this call are not reported.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn set_client_budget(&self, budget: ClientBudget) {
+        // One critical section: store the budget and take its clock out, so the
+        // generation below cannot be stamped with the clock of a budget that a
+        // concurrent call has already replaced.
+        let clock = {
+            let mut slot = self
+                .budget
+                .lock()
+                .unwrap_or_else(|poisoned| poisoned.into_inner());
+            *slot = budget;
+            slot.clock.clone()
+        };
+        self.begin_attempt_with_clock(clock);
+    }
+
+    /// Removes every client-side limit of this transaction.
+    ///
+    /// Accounting keeps running: only the limits are dropped.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn clear_client_budget(&self) {
+        *self
+            .budget
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner()) = ClientBudget::default();
+    }
+
+    /// Checks the usage of the current attempt against the client-side budget.
+    ///
+    /// This is a synchronous, cheap check: a few atomic loads and one reading of
+    /// the [`clock`](ClientBudget::clock) of the budget, the wall clock by
+    /// default, no call to the database. Nothing calls it for you, so call it
+    /// between the operations of your transaction, typically inside a
+    /// [`Database::run`](crate::Database::run) closure where
+    /// [`FdbBindingError`](crate::FdbBindingError) makes `?` work:
+    ///
+    /// ```
+    /// # use foundationdb::*;
+    /// # use std::time::Duration;
+    /// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
+    /// # let db = Database::default()?;
+    /// # let keys: Vec<Vec<u8>> = vec![];
+    /// db.run(|trx, _| {
+    ///     let keys = keys.clone();
+    ///     async move {
+    ///         trx.set_client_budget(ClientBudget {
+    ///             max_bytes_read: Some(1024 * 1024),
+    ///             ..ClientBudget::default()
+    ///         });
+    ///         for key in keys {
+    ///             trx.get(&key, false).await?;
+    ///             trx.check_client_budget()?;
+    ///         }
+    ///         Ok::<_, FdbBindingError>(())
+    ///     }
+    /// })
+    /// .await?;
+    /// # Ok(())
+    /// # }
+    /// ```
+    ///
+    /// # Errors
+    ///
+    /// Returns the first [`BudgetExceeded`] limit found, checked in order:
+    /// time, bytes read, bytes written.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn check_client_budget(&self) -> Result<(), BudgetExceeded> {
+        let budget = self
+            .budget
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+            .clone();
+        budget.check(&self.usage())
+    }
+
+    /// Called to set an option on an FDBTransaction.
+    pub fn set_option(&self, opt: options::TransactionOption) -> FdbResult<()> {
+        unsafe { opt.apply(self.inner.as_ptr()) }
+    }
+
+    /// Pass through an option given a code and raw data. Useful when creating a passthrough layer
+    /// where the code and data will be provided as raw, in order to avoid deserializing to an option
+    /// and serializing it back to code and data.
+    /// In general, you should use `set_option`.
+    pub fn set_raw_option(
+        &self,
+        code: fdb_sys::FDBTransactionOption,
+        data: Option<Vec<u8>>,
+    ) -> FdbResult<()> {
+        let (data_ptr, size) = data
+            .as_ref()
+            .map(|data| {
+                (
+                    data.as_ptr(),
+                    i32::try_from(data.len()).expect("len to fit in i32"),
+                )
+            })
+            .unwrap_or_else(|| (std::ptr::null(), 0));
+        let err = unsafe {
+            fdb_sys::fdb_transaction_set_option(self.inner.as_ptr(), code, data_ptr, size)
+        };
+        if err != 0 {
+            Err(FdbError::from_code(err))
+        } else {
+            Ok(())
+        }
+    }
+
+    /// Modify the database snapshot represented by transaction to change the given
+    /// key to have the given value.
+    ///
+    /// If the given key was not previously present in the database it is inserted.
+    /// The modification affects the actual database only if transaction is later
+    /// committed with `Transaction::commit`.
+    ///
+    /// # Arguments
+    ///
+    /// * `key` - the name of the key to be inserted into the database.
+    /// * `value` - the value to be inserted into the database
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, key, value))
+    )]
+    pub fn set(&self, key: &[u8], value: &[u8]) {
+        unsafe {
+            fdb_sys::fdb_transaction_set(
+                self.inner.as_ptr(),
+                key.as_ptr(),
+                fdb_len(key.len(), "key"),
+                value.as_ptr(),
+                fdb_len(value.len(), "value"),
+            )
+        }
+
+        self.usage().record_set((key.len() + value.len()) as u64);
+    }
+
+    /// Modify the database snapshot represented by transaction to remove the given key from the
+    /// database.
+    ///
+    /// If the key was not previously present in the database, there is no effect. The modification
+    /// affects the actual database only if transaction is later committed with
+    /// `Transaction::commit`.
+    ///
+    /// # Arguments
+    ///
+    /// * `key` - the name of the key to be removed from the database.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, key))
+    )]
+    pub fn clear(&self, key: &[u8]) {
+        unsafe {
+            fdb_sys::fdb_transaction_clear(
+                self.inner.as_ptr(),
+                key.as_ptr(),
+                fdb_len(key.len(), "key"),
+            )
+        }
+
+        self.usage().record_clear(key.len() as u64);
+    }
+
+    /// Reads a value from the database snapshot represented by transaction.
+    ///
+    /// Returns an FDBFuture which will be set to the value of key in the database if there is any.
+    ///
+    /// # Arguments
+    ///
+    /// * `key` - the name of the key to be looked up in the database
+    /// * `snapshot` - `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
+    ///
+    /// The [attempt usage](Self::attempt_usage) is recorded when the future
+    /// resolves successfully, into the attempt that issued the read: a read
+    /// still in flight is not visible to
+    /// [`check_client_budget`](Self::check_client_budget) yet.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, key))
+    )]
+    pub fn get(
+        &self,
+        key: &[u8],
+        snapshot: bool,
+    ) -> impl Future<Output = FdbResult<Option<FdbSlice>>> + Send + Sync + Unpin + use<> {
+        let usage = self.usage();
+        let lenght_key = key.len();
+
+        FdbFuture::<Option<FdbSlice>>::new(unsafe {
+            fdb_sys::fdb_transaction_get(
+                self.inner.as_ptr(),
+                key.as_ptr(),
+                fdb_len(key.len(), "key"),
+                fdb_bool(snapshot),
+            )
+        })
+        .map(move |result| {
+            if let Ok(value) = &result {
+                let (bytes_count, kv_fetched) = if let Some(values) = value {
+                    ((lenght_key + values.len()) as u64, 1)
+                } else {
+                    (lenght_key as u64, 0)
+                };
+
+                usage.record_get(bytes_count, kv_fetched);
+            }
+            result
+        })
+    }
+
+    /// Modify the database snapshot represented by transaction to perform the operation indicated
+    /// by operationType with operand param to the value stored by the given key.
+    ///
+    /// An atomic operation is a single database command that carries out several logical steps:
+    /// reading the value of a key, performing a transformation on that value, and writing the
+    /// result. Different atomic operations perform different transformations. Like other database
+    /// operations, an atomic operation is used within a transaction; however, its use within a
+    /// transaction will not cause the transaction to conflict.
+    ///
+    /// Atomic operations do not expose the current value of the key to the client but simply send
+    /// the database the transformation to apply. In regard to conflict checking, an atomic
+    /// operation is equivalent to a write without a read. It can only cause other transactions
+    /// performing reads of the key to conflict.
+    ///
+    /// By combining these logical steps into a single, read-free operation, FoundationDB can
+    /// guarantee that the transaction will not conflict due to the operation. This makes atomic
+    /// operations ideal for operating on keys that are frequently modified. A common example is
+    /// the use of a key-value pair as a counter.
+    ///
+    /// # Warning
+    ///
+    /// If a transaction uses both an atomic operation and a strictly serializable read on the same
+    /// key, the benefits of using the atomic operation (for both conflict checking and performance)
+    /// are lost.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, key, param))
+    )]
+    pub fn atomic_op(&self, key: &[u8], param: &[u8], op_type: options::MutationType) {
+        unsafe {
+            fdb_sys::fdb_transaction_atomic_op(
+                self.inner.as_ptr(),
+                key.as_ptr(),
+                fdb_len(key.len(), "key"),
+                param.as_ptr(),
+                fdb_len(param.len(), "param"),
+                op_type.code(),
+            )
+        }
+
+        self.usage()
+            .record_atomic_op((key.len() + param.len()) as u64);
+    }
+
+    /// Resolves a key selector against the keys in the database snapshot represented by
+    /// transaction.
+    ///
+    /// Returns an FDBFuture which will be set to the key in the database matching the key
+    /// selector.
+    ///
+    /// # Arguments
+    ///
+    /// * `selector`: the key selector
+    /// * `snapshot`: `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
+    ///
+    /// In the [attempt usage](Self::attempt_usage), this counts as a `get` of
+    /// the selector key plus the resolved key, recorded when the future
+    /// resolves successfully.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, selector, snapshot))
+    )]
+    pub fn get_key(
+        &self,
+        selector: &KeySelector,
+        snapshot: bool,
+    ) -> impl Future<Output = FdbResult<FdbSlice>> + Send + Sync + Unpin + use<> {
+        let key = selector.key();
+        let usage = self.usage();
+        let length_key = key.len();
+
+        FdbFuture::<FdbSlice>::new(unsafe {
+            fdb_sys::fdb_transaction_get_key(
+                self.inner.as_ptr(),
+                key.as_ptr(),
+                fdb_len(key.len(), "key"),
+                fdb_bool(selector.or_equal()),
+                selector.offset(),
+                fdb_bool(snapshot),
+            )
+        })
+        .map(move |result| {
+            if let Ok(resolved_key) = &result {
+                usage.record_get((length_key + resolved_key.len()) as u64, 0);
+            }
+            result
+        })
+    }
+
+    /// Reads all key-value pairs in the database snapshot represented by transaction (potentially
+    /// limited by limit, target_bytes, or mode) which have a key lexicographically greater than or
+    /// equal to the key resolved by the begin key selector and lexicographically less than the key
+    /// resolved by the end key selector.
+    ///
+    /// Returns a stream of KeyValue slices.
+    ///
+    /// This method is a little more efficient than `get_ranges_keyvalues` but a little harder to
+    /// use.
+    ///
+    /// # Arguments
+    ///
+    /// * `opt`: the range, limit, target_bytes and mode
+    /// * `snapshot`: `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, opt, snapshot))
+    )]
+    pub fn get_ranges<'a>(
+        &'a self,
+        opt: RangeOption<'a>,
+        snapshot: bool,
+    ) -> impl Stream<Item = FdbResult<FdbValues>> + Send + Sync + Unpin + 'a {
+        stream::unfold((1, Some(opt)), move |(iteration, maybe_opt)| {
+            if let Some(opt) = maybe_opt {
+                Either::Left(self.get_range(&opt, iteration as usize, snapshot).map(
+                    move |maybe_values| {
+                        let next_opt = match &maybe_values {
+                            Ok(values) => opt.next_range(values),
+                            Err(..) => None,
+                        };
+                        Some((maybe_values, (iteration + 1, next_opt)))
+                    },
+                ))
+            } else {
+                Either::Right(future::ready(None))
+            }
+        })
+    }
+
+    /// Reads all key-value pairs in the database snapshot represented by transaction (potentially
+    /// limited by limit, target_bytes, or mode) which have a key lexicographically greater than or
+    /// equal to the key resolved by the begin key selector and lexicographically less than the key
+    /// resolved by the end key selector.
+    ///
+    /// Returns a stream of KeyValue.
+    ///
+    /// # Arguments
+    ///
+    /// * `opt`: the range, limit, target_bytes and mode
+    /// * `snapshot`: `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, opt, snapshot))
+    )]
+    pub fn get_ranges_keyvalues<'a>(
+        &'a self,
+        opt: RangeOption<'a>,
+        snapshot: bool,
+    ) -> impl Stream<Item = FdbResult<FdbValue>> + Unpin + 'a {
+        self.get_ranges(opt, snapshot)
+            .map_ok(|values| stream::iter(values.into_iter().map(Ok)))
+            .try_flatten()
+    }
+
+    /// Reads all key-value pairs in the database snapshot represented by transaction (potentially
+    /// limited by limit, target_bytes, or mode) which have a key lexicographically greater than or
+    /// equal to the key resolved by the begin key selector and lexicographically less than the key
+    /// resolved by the end key selector.
+    ///
+    /// <div class="warning">
+    /// This method returns <strong>only a single batch</strong> of results, not necessarily all
+    /// key-value pairs in the range. It is a low-level primitive for manual pagination. Most
+    /// callers should use
+    /// <a href="struct.Transaction.html#method.get_ranges_keyvalues"><code>get_ranges_keyvalues</code></a>,
+    /// which automatically pages through the full range and yields every key-value pair as a stream.
+    /// </div>
+    ///
+    /// # Arguments
+    ///
+    /// * `opt`: the range, limit, target_bytes and mode
+    /// * `iteration`: If opt.mode is Iterator, this parameter should start at 1 and be incremented
+    ///   by 1 for each successive call while reading this range. In all other cases it is ignored.
+    /// * `snapshot`: `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
+    ///
+    /// In the [attempt usage](Self::attempt_usage), each resolved batch counts
+    /// as one `call_get_range`: a full range scan through
+    /// [`get_ranges`](Self::get_ranges) counts once per underlying batch.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, opt, snapshot))
+    )]
+    pub fn get_range(
+        &self,
+        opt: &RangeOption,
+        iteration: usize,
+        snapshot: bool,
+    ) -> impl Future<Output = FdbResult<FdbValues>> + Send + Sync + Unpin + use<> {
+        self.get_range_impl(opt, iteration, snapshot, Some(self.usage()))
+    }
+
+    /// Same as [`get_range`](Self::get_range), but not accounted in the
+    /// [attempt usage](Self::attempt_usage).
+    ///
+    /// For reads the binding performs on behalf of the user, on the special
+    /// keyspace, which should neither consume the client budget nor show up in
+    /// the usage of the user's own operations.
+    pub(crate) fn get_range_unmetered(
+        &self,
+        opt: &RangeOption,
+        iteration: usize,
+        snapshot: bool,
+    ) -> impl Future<Output = FdbResult<FdbValues>> + Send + Sync + Unpin + use<> {
+        self.get_range_impl(opt, iteration, snapshot, None)
+    }
+
+    /// `usage` is the accounting generation to record into, `None` to skip
+    /// accounting entirely.
+    fn get_range_impl(
+        &self,
+        opt: &RangeOption,
+        iteration: usize,
+        snapshot: bool,
+        usage: Option<Arc<AttemptUsage>>,
+    ) -> impl Future<Output = FdbResult<FdbValues>> + Send + Sync + Unpin + use<> {
+        let begin = &opt.begin;
+        let end = &opt.end;
+        let key_begin = begin.key();
+        let key_end = end.key();
+
+        FdbFuture::<FdbValues>::new(unsafe {
+            fdb_sys::fdb_transaction_get_range(
+                self.inner.as_ptr(),
+                key_begin.as_ptr(),
+                fdb_len(key_begin.len(), "key_begin"),
+                fdb_bool(begin.or_equal()),
+                begin.offset(),
+                key_end.as_ptr(),
+                fdb_len(key_end.len(), "key_end"),
+                fdb_bool(end.or_equal()),
+                end.offset(),
+                fdb_limit(opt.limit.unwrap_or(0)),
+                fdb_limit(opt.target_bytes),
+                opt.mode.code(),
+                fdb_iteration(iteration),
+                fdb_bool(snapshot),
+                fdb_bool(opt.reverse),
+            )
+        })
+        .map(move |result| {
+            if let Ok(values) = &result {
+                let kv_fetched = values.len();
+                let mut bytes_count = 0;
+
+                for key_value in values.as_ref() {
+                    let key_len = key_value.key().len();
+                    let value_len = key_value.value().len();
+
+                    bytes_count += (key_len + value_len) as u64
+                }
+
+                if let Some(usage) = usage.as_ref() {
+                    usage.record_get_range(bytes_count, kv_fetched as u64);
+                }
+            };
+
+            result
+        })
+    }
+
+    /// Mapped Range is an experimental feature introduced in FDB 7.1.
+    /// It is intended to improve the client throughput and reduce latency for querying data through a Subspace used as a "index".
+    /// In such a case, querying records by scanning an index in relational databases can be
+    /// translated to a GetRange request on the index entries followed up by multiple GetValue requests for the record entries in FDB.
+    ///
+    /// This method is allowing FoundationDB "follow up" a GetRange request with GetValue requests,
+    /// this can happen in one request without additional back and forth. Considering the overhead
+    /// of each request, this saves time and resources on serialization, deserialization, and network.
+    ///
+    /// A mapped request will:
+    ///
+    /// * Do a range query (same as a `Transaction.get_range` request) and get the result. We call it the primary query.
+    /// * For each key-value pair in the primary query result, translate it to a `get_range` query and get the result. We call them secondary queries.
+    /// * Put all results in a nested structure and return them.
+    ///
+    /// **WARNING** : This feature is considered experimental at this time. It is only allowed when
+    /// using snapshot isolation AND disabling read-your-writes.
+    ///
+    /// More info can be found in the relevant [documentation](https://github.com/apple/foundationdb/wiki/Everything-about-GetMappedRange#input).
+    ///
+    /// This is the "raw" version, users are expected to use [Transaction::get_mapped_ranges]
+    ///
+    /// In the [attempt usage](Self::attempt_usage), a resolved batch counts as
+    /// one `call_get_range` and as the bytes of the primary key-values plus the
+    /// nested key-values returned by the secondary queries.
+    #[cfg_api_versions(min = 710)]
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, opt, mapper, snapshot))
+    )]
+    pub fn get_mapped_range(
+        &self,
+        opt: &RangeOption,
+        mapper: &[u8],
+        iteration: usize,
+        snapshot: bool,
+    ) -> impl Future<Output = FdbResult<MappedKeyValues>> + Send + Sync + Unpin + use<> {
+        let begin = &opt.begin;
+        let end = &opt.end;
+        let key_begin = begin.key();
+        let key_end = end.key();
+
+        let usage = self.usage();
+
+        FdbFuture::<MappedKeyValues>::new(unsafe {
+            fdb_sys::fdb_transaction_get_mapped_range(
+                self.inner.as_ptr(),
+                key_begin.as_ptr(),
+                fdb_len(key_begin.len(), "key_begin"),
+                fdb_bool(begin.or_equal()),
+                begin.offset(),
+                key_end.as_ptr(),
+                fdb_len(key_end.len(), "key_end"),
+                fdb_bool(end.or_equal()),
+                end.offset(),
+                mapper.as_ptr(),
+                fdb_len(mapper.len(), "mapper_length"),
+                fdb_limit(opt.limit.unwrap_or(0)),
+                fdb_limit(opt.target_bytes),
+                opt.mode.code(),
+                fdb_iteration(iteration),
+                fdb_bool(snapshot),
+                fdb_bool(opt.reverse),
+            )
+        })
+        .map(move |result| {
+            if let Ok(values) = &result {
+                let mut bytes_count = 0;
+                let mut kv_fetched = 0;
+
+                for mapped_key_value in values.as_ref() {
+                    bytes_count += (mapped_key_value.parent_key().len()
+                        + mapped_key_value.parent_value().len())
+                        as u64;
+                    kv_fetched += 1;
+
+                    for key_value in mapped_key_value.key_values() {
+                        bytes_count += (key_value.key().len() + key_value.value().len()) as u64;
+                        kv_fetched += 1;
+                    }
+                }
+
+                usage.record_get_range(bytes_count, kv_fetched);
+            }
+
+            result
+        })
+    }
+
+    /// Mapped Range is an experimental feature introduced in FDB 7.1.
+    /// It is intended to improve the client throughput and reduce latency for querying data through a Subspace used as a "index".
+    /// In such a case, querying records by scanning an index in relational databases can be
+    /// translated to a GetRange request on the index entries followed up by multiple GetValue requests for the record entries in FDB.
+    ///
+    /// This method is allowing FoundationDB "follow up" a GetRange request with GetValue requests,
+    /// this can happen in one request without additional back and forth. Considering the overhead
+    /// of each request, this saves time and resources on serialization, deserialization, and network.
+    ///
+    /// A mapped request will:
+    ///
+    /// * Do a range query (same as a `Transaction.get_range` request) and get the result. We call it the primary query.
+    /// * For each key-value pair in the primary query result, translate it to a `get_range` query and get the result. We call them secondary queries.
+    /// * Put all results in a nested structure and return them.
+    ///
+    /// **WARNING** : This feature is considered experimental at this time. It is only allowed when
+    /// using snapshot isolation AND disabling read-your-writes.
+    ///
+    /// More info can be found in the relevant [documentation](https://github.com/apple/foundationdb/wiki/Everything-about-GetMappedRange#input).
+    #[cfg_api_versions(min = 710)]
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, opt, mapper, snapshot))
+    )]
+    pub fn get_mapped_ranges<'a>(
+        &'a self,
+        opt: RangeOption<'a>,
+        mapper: &'a [u8],
+        snapshot: bool,
+    ) -> impl Stream<Item = FdbResult<MappedKeyValues>> + Send + Sync + Unpin + 'a {
+        stream::unfold((1, Some(opt)), move |(iteration, maybe_opt)| {
+            if let Some(opt) = maybe_opt {
+                Either::Left(
+                    self.get_mapped_range(&opt, mapper, iteration as usize, snapshot)
+                        .map(move |maybe_values| {
+                            let next_opt = match &maybe_values {
+                                Ok(values) => opt.next_mapped_range(values),
+                                Err(..) => None,
+                            };
+                            Some((maybe_values, (iteration + 1, next_opt)))
+                        }),
+                )
+            } else {
+                Either::Right(future::ready(None))
+            }
+        })
+    }
+
+    /// Modify the database snapshot represented by transaction to remove all keys (if any) which
+    /// are lexicographically greater than or equal to the given begin key and lexicographically
+    /// less than the given end_key.
+    ///
+    /// The modification affects the actual database only if transaction is later committed with
+    /// `Transaction::commit`.
+    ///
+    /// In the [attempt usage](Self::attempt_usage), this counts as the two
+    /// boundary keys only: the volume of data actually deleted is unknown to
+    /// the client.
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, begin, end))
+    )]
+    pub fn clear_range(&self, begin: &[u8], end: &[u8]) {
+        unsafe {
+            fdb_sys::fdb_transaction_clear_range(
+                self.inner.as_ptr(),
+                begin.as_ptr(),
+                fdb_len(begin.len(), "begin"),
+                end.as_ptr(),
+                fdb_len(end.len(), "end"),
+            )
+        }
+
+        self.usage()
+            .record_clear_range((begin.len() + end.len()) as u64);
+    }
+
+    /// Get the estimated byte size of the key range based on the byte sample collected by FDB
+    #[cfg_api_versions(min = 630)]
+    pub fn get_estimated_range_size_bytes(
+        &self,
+        begin: &[u8],
+        end: &[u8],
+    ) -> impl Future<Output = FdbResult<i64>> + Send + Sync + Unpin + use<> {
+        FdbFuture::<i64>::new(unsafe {
+            fdb_sys::fdb_transaction_get_estimated_range_size_bytes(
+                self.inner.as_ptr(),
+                begin.as_ptr(),
+                fdb_len(begin.len(), "begin"),
+                end.as_ptr(),
+                fdb_len(end.len(), "end"),
+            )
+        })
+    }
+
+    /// Attempts to commit the sets and clears previously applied to the database snapshot
+    /// represented by transaction to the actual database.
+    ///
+    /// The commit may or may not succeed – in particular, if a conflicting transaction previously
+    /// committed, then the commit must fail in order to preserve transactional isolation. If the
+    /// commit does succeed, the transaction is durably committed to the database and all
+    /// subsequently started transactions will observe its effects.
+    ///
+    /// It is not necessary to commit a read-only transaction – you can simply drop it.
+    ///
+    /// Callers will usually want to retry a transaction if the commit or a another method on the
+    /// transaction returns a retryable error (see `on_error` and/or `Database::transact`).
+    ///
+    /// As with other client/server databases, in some failure scenarios a client may be unable to
+    /// determine whether a transaction succeeded. In these cases, `Transaction::commit` will return
+    /// an error and `is_maybe_committed()` will returns true on that error. The `on_error` function
+    /// treats this error as retryable, so retry loops that don’t check for `is_maybe_committed()`
+    /// could execute the transaction twice. In these cases, you must consider the idempotence of
+    /// the transaction. For more information, see [Transactions with unknown results](https://apple.github.io/foundationdb/developer-guide.html#developer-guide-unknown-results).
+    ///
+    /// Normally, commit will wait for outstanding reads to return. However, if those reads were
+    /// snapshot reads or the transaction option for disabling “read-your-writes” has been invoked,
+    /// any outstanding reads will immediately return errors.
+    ///
+    /// On an instrumented transaction, the commit ends the current attempt: its
+    /// duration is recorded whatever the result, and a successful commit pushes
+    /// the attempt to the metrics report as
+    /// [`AttemptOutcome::Committed`](crate::metrics::AttemptOutcome::Committed).
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub fn commit(self) -> impl Future<Output = TransactionResult> + Send + Sync + Unpin {
+        let metrics = self.metrics().cloned();
+        let started_at = Instant::now();
+
+        FdbFuture::<()>::new(unsafe { fdb_sys::fdb_transaction_commit(self.inner.as_ptr()) }).map(
+            move |r| {
+                if let Some(metrics) = &metrics {
+                    metrics.record_commit(started_at.elapsed());
+                }
+                match r {
+                    Ok(()) => {
+                        self.end_attempt(AttemptOutcome::Committed);
+                        Ok(TransactionCommitted { tr: self })
+                    }
+                    Err(err) => Err(TransactionCommitError { tr: self, err }),
+                }
+            },
+        )
+    }
+
+    /// Implements the recommended retry and backoff behavior for a transaction. This function knows
+    /// which of the error codes generated by other `Transaction` functions represent temporary
+    /// error conditions and which represent application errors that should be handled by the
+    /// application. It also implements an exponential backoff strategy to avoid swamping the
+    /// database cluster with excessive retries when there is a high level of conflict between
+    /// transactions.
+    ///
+    /// It is not necessary to call `reset()` when handling an error with `on_error()` since the
+    /// transaction has already been reset.
+    ///
+    /// You should not call this method most of the times and use `Database::transact` which
+    /// implements a retry loop strategy for you.
+    ///
+    /// On success the transaction enters a new attempt: its
+    /// [usage](Self::attempt_usage) restarts from zero, while its
+    /// [client budget](Self::set_client_budget) is kept. User versions
+    /// allocated by [`Self::allocate_user_version`] are invalid for the new
+    /// attempt, which starts allocating again at zero.
+    pub fn on_error(
+        self,
+        err: FdbError,
+    ) -> impl Future<Output = FdbResult<Transaction>> + Send + Sync + Unpin {
+        self.mark_attempt_end();
+
+        FdbFuture::<()>::new(unsafe {
+            fdb_sys::fdb_transaction_on_error(self.inner.as_ptr(), err.code())
+        })
+        .map_ok(move |()| {
+            self.end_attempt(AttemptOutcome::Retried { cause: err });
+            self.begin_attempt_usage();
+            self.reset_user_version_allocator();
+            self
+        })
+    }
+
+    /// Cancels the transaction. All pending or future uses of the transaction will return a
+    /// transaction_cancelled error. The transaction can be used again after it is reset. User
+    /// versions already allocated remain consumed until that reset starts a new attempt.
+    pub fn cancel(self) -> TransactionCancelled {
+        unsafe {
+            fdb_sys::fdb_transaction_cancel(self.inner.as_ptr());
+        }
+        TransactionCancelled { tr: self }
+    }
+
+    /// Records an application metric for the current attempt, replacing any
+    /// value previously recorded under the same name and labels.
+    ///
+    /// Custom metrics are always on, like the [usage](Self::attempt_usage)
+    /// counters, and scoped to the current attempt: a retry starts from an
+    /// empty set, and the values of the attempt that ended stay attached to it
+    /// in the report. Recording one on a transaction nobody collects metrics
+    /// from is free of consequence: the values are dropped along with the
+    /// attempt.
+    ///
+    /// # Arguments
+    /// * `name` - The name of the metric (e.g., "query_time", "cache_hits")
+    /// * `value` - The value to record
+    /// * `labels` - Key-value pairs for labeling the metric, allowing for dimensional metrics
+    ///   (e.g., `[("operation", "read"), ("region", "us-west")]`)
+    ///
+    /// # Example
+    /// ```
+    /// # use foundationdb::*;
+    /// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
+    /// # let db = Database::default()?;
+    /// let (_, metrics) = db
+    ///     .instrumented_run(|txn, _| async move {
+    ///         txn.set_custom_metric("documents_indexed", 42, &[("kind", "user")]);
+    ///         Ok::<_, FdbBindingError>(())
+    ///     })
+    ///     .await
+    ///     .map_err(|(err, _)| err)?;
+    ///
+    /// // The values are attached to the attempt that recorded them.
+    /// let attempt = metrics.attempts.last().expect("one attempt");
+    /// # let _ = attempt;
+    /// # Ok(())
+    /// # }
+    /// ```
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, labels))
+    )]
+    pub fn set_custom_metric(&self, name: &str, value: u64, labels: &[(&str, &str)]) {
+        self.usage().set_custom(MetricKey::new(name, labels), value);
+    }
+
+    /// Adds `amount` to an application metric of the current attempt, starting
+    /// from zero if it was not recorded yet.
+    ///
+    /// Same per-attempt semantics as [`set_custom_metric`](Self::set_custom_metric).
+    ///
+    /// # Arguments
+    /// * `name` - The name of the metric to increment (e.g., "requests", "bytes_processed")
+    /// * `amount` - The amount to increment the metric by
+    /// * `labels` - Key-value pairs for labeling the metric, allowing for dimensional metrics
+    ///   (e.g., `[("status", "success"), ("endpoint", "api/v1/users")]`)
+    ///
+    /// # Example
+    /// ```
+    /// # use foundationdb::*;
+    /// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
+    /// # let db = Database::default()?;
+    /// let txn = db.create_trx()?;
+    ///
+    /// txn.increment_custom_metric("cache_misses", 1, &[("cache", "user_data")]);
+    /// txn.increment_custom_metric("cache_misses", 1, &[("cache", "user_data")]);
+    /// // The metric of the current attempt is now 2.
+    /// # Ok(())
+    /// # }
+    /// ```
+    #[cfg_attr(
+        feature = "trace",
+        tracing::instrument(level = "debug", skip(self, labels))
+    )]
+    pub fn increment_custom_metric(&self, name: &str, amount: u64, labels: &[(&str, &str)]) {
+        self.usage()
+            .increment_custom(MetricKey::new(name, labels), amount);
+    }
+
+    /// Returns a list of public network addresses as strings, one for each of the storage servers
+    /// responsible for storing key_name and its associated value.
+    pub fn get_addresses_for_key(
+        &self,
+        key: &[u8],
+    ) -> impl Future<Output = FdbResult<FdbAddresses>> + Send + Sync + Unpin + use<> {
+        FdbFuture::new(unsafe {
+            fdb_sys::fdb_transaction_get_addresses_for_key(
+                self.inner.as_ptr(),
+                key.as_ptr(),
+                fdb_len(key.len(), "key"),
+            )
+        })
+    }
+
+    /// A watch's behavior is relative to the transaction that created it. A watch will report a
+    /// change in relation to the key’s value as readable by that transaction. The initial value
+    /// used for comparison is either that of the transaction’s read version or the value as
+    /// modified by the transaction itself prior to the creation of the watch. If the value changes
+    /// and then changes back to its initial value, the watch might not report the change.
+    ///
+    /// Until the transaction that created it has been committed, a watch will not report changes
+    /// made by other transactions. In contrast, a watch will immediately report changes made by
+    /// the transaction itself. Watches cannot be created if the transaction has set the
+    /// READ_YOUR_WRITES_DISABLE transaction option, and an attempt to do so will return an
+    /// watches_disabled error.
+    ///
+    /// If the transaction used to create a watch encounters an error during commit, then the watch
+    /// will be set with that error. A transaction whose commit result is unknown will set all of
+    /// its watches with the commit_unknown_result error. If an uncommitted transaction is reset or
+    /// destroyed, then any watches it created will be set with the transaction_cancelled error.
+    ///
+    /// Returns an future representing an empty value that will be set once the watch has
+    /// detected a change to the value at the specified key.
+    ///
+    /// By default, each database connection can have no more than 10,000 watches that have not yet
+    /// reported a change. When this number is exceeded, an attempt to create a watch will return a
+    /// too_many_watches error. This limit can be changed using the MAX_WATCHES database option.
+    /// Because a watch outlives the transaction that creates it, any watch that is no longer
+    /// needed should be cancelled by dropping its future.
+    pub fn watch(
+        &self,
+        key: &[u8],
+    ) -> impl Future<Output = FdbResult<()>> + Send + Sync + Unpin + use<> {
+        FdbFuture::new(unsafe {
+            fdb_sys::fdb_transaction_watch(
+                self.inner.as_ptr(),
+                key.as_ptr(),
+                fdb_len(key.len(), "key"),
+            )
+        })
+    }
+
+    /// Returns an FDBFuture which will be set to the approximate transaction size so far in the
+    /// returned future, which is the summation of the estimated size of mutations, read conflict
+    /// ranges, and write conflict ranges.
+    ///
+    /// This can be called multiple times before the transaction is committed.
+    #[cfg_api_versions(min = 620)]
+    pub fn get_approximate_size(
+        &self,
+    ) -> impl Future<Output = FdbResult<i64>> + Send + Sync + Unpin + use<> {
+        FdbFuture::new(unsafe {
+            fdb_sys::fdb_transaction_get_approximate_size(self.inner.as_ptr())
+        })
+    }
+
+    /// Gets a list of keys that can split the given range into (roughly) equally sized chunks based on chunk_size.
+    /// Note: the returned split points contain the start key and end key of the given range.
+    #[cfg_api_versions(min = 700)]
+    pub fn get_range_split_points(
+        &self,
+        begin: &[u8],
+        end: &[u8],
+        chunk_size: i64,
+    ) -> impl Future<Output = FdbResult<FdbKeys>> + Send + Sync + Unpin + use<> {
+        FdbFuture::<FdbKeys>::new(unsafe {
+            fdb_sys::fdb_transaction_get_range_split_points(
+                self.inner.as_ptr(),
+                begin.as_ptr(),
+                fdb_len(begin.len(), "begin"),
+                end.as_ptr(),
+                fdb_len(end.len(), "end"),
+                chunk_size,
+            )
+        })
+    }
+
+    /// Returns an FDBFuture which will be set to the versionstamp which was used by any
+    /// versionstamp operations in this transaction.
+    ///
+    /// The future will be ready only after the successful completion of a call to `commit()` on
+    /// this Transaction. Read-only transactions do not modify the database when committed and will
+    /// result in the future completing with an error. Keep in mind that a transaction which reads
+    /// keys and then sets them to their current values may be optimized to a read-only transaction.
+    ///
+    /// Most applications will not call this function.
+    pub fn get_versionstamp(
+        &self,
+    ) -> impl Future<Output = FdbResult<FdbSlice>> + Send + Sync + Unpin + use<> {
+        FdbFuture::new(unsafe { fdb_sys::fdb_transaction_get_versionstamp(self.inner.as_ptr()) })
+    }
+
+    /// The transaction obtains a snapshot read version automatically at the time of the first call
+    /// to `get_*()` (including this one) and (unless causal consistency has been deliberately
+    /// compromised by transaction options) is guaranteed to represent all transactions which were
+    /// reported committed before that call.
+    ///
+    /// On an instrumented transaction, the version is recorded in the metrics of
+    /// the current attempt. It is only ever recorded when this method is called:
+    /// the binding never fetches a read version on its own.
+    pub fn get_read_version(
+        &self,
+    ) -> impl Future<Output = FdbResult<i64>> + Send + Sync + Unpin + use<> {
+        let metrics = self.metrics().cloned();
+        let started_at = metrics.as_ref().map(|_| Instant::now());
+
+        FdbFuture::<i64>::new(unsafe {
+            fdb_sys::fdb_transaction_get_read_version(self.inner.as_ptr())
+        })
+        .map(move |result| {
+            if let (Some(metrics), Some(started_at)) = (&metrics, started_at) {
+                metrics.record_grv(started_at.elapsed());
+                if let Ok(version) = result {
+                    metrics.set_read_version(version);
+                }
+            }
+            result
+        })
+    }
+
+    /// Sets the snapshot read version used by a transaction.
+    ///
+    /// This is not needed in simple cases.
+    /// If the given version is too old, subsequent reads will fail with error_code_past_version;
+    /// if it is too new, subsequent reads may be delayed indefinitely and/or fail with
+    /// error_code_future_version. If any of get_*() have been called on this transaction already,
+    /// the result is undefined.
+    pub fn set_read_version(&self, version: i64) {
+        unsafe { fdb_sys::fdb_transaction_set_read_version(self.inner.as_ptr(), version) }
+    }
+
+    /// The metadata version key `\xff/metadataVersion` is a key intended to help layers deal with hot keys.
+    /// The value of this key is sent to clients along with the read version from the proxy,
+    /// so a client can read its value without communicating with a storage server.
+    /// To retrieve the metadataVersion, you need to set `TransactionOption::ReadSystemKeys`
+    #[cfg_api_versions(min = 610)]
+    pub async fn get_metadata_version(&self, snapshot: bool) -> FdbResult<Option<i64>> {
+        match self.get(METADATA_VERSION_KEY, snapshot).await {
+            Ok(Some(fdb_slice)) => {
+                let value = fdb_slice.deref();
+                // as we cannot write the metadata-key directly(we must mutate with an atomic_op),
+                // can we assume that it will always be the correct size?
+                if value.len() < 8 {
+                    return Ok(None);
+                }
+
+                // The 80-bits versionstamps are 10 bytes longs, and are composed of:
+                // * 8 bytes (Transaction Version)
+                // * followed by 2 bytes (Transaction Batch Order)
+                // More details can be found here: https://forums.foundationdb.org/t/implementing-versionstamps-in-bindings/250
+                let mut arr = [0u8; 8];
+                arr.copy_from_slice(&value[0..8]);
+                let transaction_version: i64 = i64::from_be_bytes(arr);
+
+                Ok(Some(transaction_version))
+            }
+            Ok(None) => Ok(None),
+
+            Err(err) => Err(err),
+        }
+    }
+
+    #[cfg_api_versions(min = 610)]
+    pub fn update_metadata_version(&self) {
+        // The param is transformed by removing the final four bytes from ``param`` and reading
+        // those as a little-Endian 32-bit integer to get a position ``pos``.
+        // The 10 bytes of the parameter from ``pos`` to ``pos + 10`` are replaced with the
+        // versionstamp of the transaction used. The first byte of the parameter is position 0.
+        // As we only have the metadata value, we can just create an 14-bytes Vec filled with 0u8.
+        let param = vec![0u8; 14];
+        self.atomic_op(
+            METADATA_VERSION_KEY,
+            param.as_slice(),
+            options::MutationType::SetVersionstampedValue,
+        )
+    }
+
+    /// Reset transaction to its initial state.
+    ///
+    /// In order to protect against a race condition with cancel(), this call require a mutable
+    /// access to the transaction.
+    ///
+    /// This is similar to dropping the transaction and creating a new one.
+    ///
+    /// It is not necessary to call `reset()` when handling an error with `on_error()` since the
+    /// transaction has already been reset.
+    ///
+    /// This starts a new attempt: the [usage](Self::attempt_usage) restarts from
+    /// zero, while the [client budget](Self::set_client_budget) is kept. On an
+    /// instrumented transaction, the attempt being recorded is abandoned rather
+    /// than reported: it reached no conclusion. User versions allocated before
+    /// reset are invalid for the new attempt, which starts allocating again at
+    /// zero.
+    pub fn reset(&mut self) {
+        unsafe { fdb_sys::fdb_transaction_reset(self.inner.as_ptr()) }
+        self.begin_attempt_usage();
+        self.reset_user_version_allocator();
+    }
+
+    fn reset_user_version_allocator(&self) {
+        self.user_version.store(0, Ordering::Relaxed);
+    }
+
+    /// Reads the conflicting key ranges from the special keyspace after a commit conflict.
+    ///
+    /// This method reads from `\xff\xff/transaction/conflicting_keys/` and parses the
+    /// boundary encoding where `b"1"` marks range starts and `b"0"` marks range ends.
+    ///
+    /// The special keyspace read is resolved client-side — no network round-trip to the
+    /// cluster. The future still goes through the FDB network thread event loop, but the
+    /// data comes from an in-memory map populated during the commit response. Returns
+    /// an empty `Vec` if
+    /// [`TransactionOption::ReportConflictingKeys`](crate::options::TransactionOption::ReportConflictingKeys)
+    /// was not set.
+    ///
+    /// Requires API version 630 or later: the special keyspace does not exist on
+    /// older versions, where this read fails.
+    ///
+    /// Only complete ranges are returned. A begin marker whose end marker never
+    /// arrives is dropped, identically in debug and release builds.
+    ///
+    /// # Errors
+    ///
+    /// Returns an `FdbError` if the special keyspace read fails.
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub async fn conflicting_keys(&self) -> FdbResult<Vec<ConflictingKeyRange>> {
+        self.read_conflict_range_keyspace(CONFLICTING_KEYS_PREFIX, CONFLICTING_KEYS_END)
+            .await
+    }
+
+    /// Reads the read conflict ranges accumulated by this transaction so far.
+    ///
+    /// These are the ranges the resolver will check for conflicts at commit
+    /// time: every key read by the transaction, plus the ranges added with
+    /// [`add_conflict_range`](Self::add_conflict_range). A point read of `k`
+    /// shows up as `k..k\x00`.
+    ///
+    /// <div class="warning">
+    /// Reading this keyspace waits for every pending read of the transaction to
+    /// settle, since a read that has not returned yet has not registered its
+    /// conflict range. Called in the middle of a batch of concurrent reads, it
+    /// is therefore as slow as the slowest of them.
+    /// </div>
+    ///
+    /// The read itself is performed by the binding on your behalf: it is not
+    /// accounted in the [attempt usage](Self::attempt_usage) and does not
+    /// consume the [client budget](Self::set_client_budget).
+    ///
+    /// Only complete ranges are returned, see [`conflicting_keys`](Self::conflicting_keys).
+    ///
+    /// # Errors
+    ///
+    /// Returns an `FdbError` if the special keyspace read fails.
+    #[cfg_api_versions(min = 630)]
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub async fn read_conflict_ranges(&self) -> FdbResult<Vec<ConflictRange>> {
+        self.read_conflict_range_keyspace(READ_CONFLICT_RANGE_PREFIX, READ_CONFLICT_RANGE_END)
+            .await
+    }
+
+    /// Reads the write conflict ranges accumulated by this transaction so far.
+    ///
+    /// These are the ranges the transaction will conflict *other* transactions
+    /// on: every key it wrote, plus the ranges added with
+    /// [`add_conflict_range`](Self::add_conflict_range). A single `set` of `k`
+    /// shows up as `k..k\x00`.
+    ///
+    /// <div class="warning">
+    /// Before the commit, this is an approximate <em>superset</em> of the final
+    /// write conflict ranges when the transaction uses versionstamped keys: the
+    /// versionstamp is only known at commit time, so the incomplete key is
+    /// reported with its placeholder bytes.
+    /// </div>
+    ///
+    /// The read itself is performed by the binding on your behalf: it is not
+    /// accounted in the [attempt usage](Self::attempt_usage) and does not
+    /// consume the [client budget](Self::set_client_budget).
+    ///
+    /// Only complete ranges are returned, see [`conflicting_keys`](Self::conflicting_keys).
+    ///
+    /// # Errors
+    ///
+    /// Returns an `FdbError` if the special keyspace read fails.
+    #[cfg_api_versions(min = 630)]
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub async fn write_conflict_ranges(&self) -> FdbResult<Vec<ConflictRange>> {
+        self.read_conflict_range_keyspace(WRITE_CONFLICT_RANGE_PREFIX, WRITE_CONFLICT_RANGE_END)
+            .await
+    }
+
+    /// Reads one conflict-range special keyspace to its end and parses it.
+    ///
+    /// The reads go through the unmetered path: they are performed by the
+    /// binding itself and must not show up in the user's usage or budget. The
+    /// keyspace is paginated because a marker pair can straddle two batches,
+    /// which [`ConflictRangeParser`] handles by carrying the open begin marker
+    /// from one batch to the next.
+    async fn read_conflict_range_keyspace(
+        &self,
+        prefix: &[u8],
+        end: &[u8],
+    ) -> FdbResult<Vec<ConflictRange>> {
+        let mut parser = ConflictRangeParser::new(prefix);
+        let mut next = Some(RangeOption::from((prefix, end)));
+        let mut iteration = 1;
+
+        while let Some(opt) = next {
+            let values = self.get_range_unmetered(&opt, iteration, false).await?;
+            parser.feed(values.iter().map(|kv| (kv.key(), kv.value())));
+            next = opt.next_range(&values);
+            iteration += 1;
+        }
+
+        Ok(parser.finish())
+    }
+
+    /// Adds a conflict range to a transaction without performing the associated read or write.
+    ///
+    /// # Note
+    ///
+    /// Most applications will use the serializable isolation that transactions provide by default
+    /// and will not need to manipulate conflict ranges.
+    pub fn add_conflict_range(
+        &self,
+        begin: &[u8],
+        end: &[u8],
+        ty: options::ConflictRangeType,
+    ) -> FdbResult<()> {
+        error::eval(unsafe {
+            fdb_sys::fdb_transaction_add_conflict_range(
+                self.inner.as_ptr(),
+                begin.as_ptr(),
+                fdb_len(begin.len(), "begin"),
+                end.as_ptr(),
+                fdb_len(end.len(), "end"),
+                ty.code(),
+            )
+        })
+    }
+}
+
+impl Drop for Transaction {
+    fn drop(&mut self) {
+        unsafe {
+            fdb_sys::fdb_transaction_destroy(self.inner.as_ptr());
+        }
+    }
+}
+
+/// A retryable transaction, generated by Database.run
+#[derive(Clone)]
+pub struct RetryableTransaction {
+    inner: Arc<Transaction>,
+}
+
+impl Deref for RetryableTransaction {
+    type Target = Transaction;
+    fn deref(&self) -> &Transaction {
+        self.inner.deref()
+    }
+}
+
+impl RetryableTransaction {
+    pub(crate) fn new(t: Transaction) -> RetryableTransaction {
+        RetryableTransaction { inner: Arc::new(t) }
+    }
+
+    pub(crate) fn take(self) -> Result<Transaction, FdbBindingError> {
+        // checking weak references
+        if Arc::weak_count(&self.inner) != 0 {
+            return Err(FdbBindingError::ReferenceToTransactionKept);
+        }
+        Arc::try_unwrap(self.inner).map_err(|_| FdbBindingError::ReferenceToTransactionKept)
+    }
+
+    pub(crate) async fn on_error(
+        self,
+        err: FdbError,
+    ) -> Result<Result<RetryableTransaction, FdbError>, FdbBindingError> {
+        Ok(self
+            .take()?
+            .on_error(err)
+            .await
+            .map(RetryableTransaction::new))
+    }
+
+    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
+    pub(crate) async fn commit(
+        self,
+    ) -> Result<Result<TransactionCommitted, TransactionCommitError>, FdbBindingError> {
+        Ok(self.take()?.commit().await)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{CONFLICTING_KEYS_PREFIX, ConflictRangeParser};
+
+    /// Builds a marker as the special keyspace returns it: the prefix, the key
+    /// it is a boundary of, and the `1`/`0` value.
+    fn marker(key: &str, value: &'static [u8]) -> (Vec<u8>, &'static [u8]) {
+        let mut full = CONFLICTING_KEYS_PREFIX.to_vec();
+        full.extend_from_slice(key.as_bytes());
+        (full, value)
+    }
+
+    fn feed(parser: &mut ConflictRangeParser, batch: &[(Vec<u8>, &'static [u8])]) {
+        parser.feed(batch.iter().map(|(k, v)| (k.as_slice(), *v)));
+    }
+
+    #[test]
+    fn parses_ranges_within_one_batch() {
+        let mut parser = ConflictRangeParser::new(CONFLICTING_KEYS_PREFIX);
+        feed(
+            &mut parser,
+            &[
+                marker("a", b"1"),
+                marker("b", b"0"),
+                marker("c", b"1"),
+                marker("d", b"0"),
+            ],
+        );
+
+        let ranges = parser.finish();
+        assert_eq!(ranges.len(), 2);
+        assert_eq!(ranges[0].begin(), b"a");
+        assert_eq!(ranges[0].end(), b"b");
+        assert_eq!(ranges[1].begin(), b"c");
+        assert_eq!(ranges[1].end(), b"d");
+    }
+
+    /// The whole point of the incremental parser: a begin marker in one batch
+    /// and its end marker in the next one still make a single range.
+    #[test]
+    fn open_range_survives_across_batches() {
+        let mut parser = ConflictRangeParser::new(CONFLICTING_KEYS_PREFIX);
+        feed(&mut parser, &[marker("a", b"1")]);
+        feed(&mut parser, &[marker("b", b"0"), marker("c", b"1")]);
+        feed(&mut parser, &[marker("d", b"0")]);
+
+        let ranges = parser.finish();
+        assert_eq!(ranges.len(), 2);
+        assert_eq!(ranges[0].begin(), b"a");
+        assert_eq!(ranges[0].end(), b"b");
+        assert_eq!(ranges[1].begin(), b"c");
+        assert_eq!(ranges[1].end(), b"d");
+    }
+
+    #[test]
+    fn empty_input_yields_no_range() {
+        let mut parser = ConflictRangeParser::new(CONFLICTING_KEYS_PREFIX);
+        feed(&mut parser, &[]);
+        assert!(parser.finish().is_empty());
+    }
+
+    /// A begin marker whose end marker never arrives is dropped, in every build
+    /// profile: the guarantee is that only complete ranges come out.
+    #[test]
+    fn unmatched_begin_at_end_of_stream_is_dropped() {
+        let mut parser = ConflictRangeParser::new(CONFLICTING_KEYS_PREFIX);
+        feed(
+            &mut parser,
+            &[marker("a", b"1"), marker("b", b"0"), marker("c", b"1")],
+        );
+
+        let ranges = parser.finish();
+        assert_eq!(ranges.len(), 1);
+        assert_eq!(ranges[0].begin(), b"a");
+        assert_eq!(ranges[0].end(), b"b");
+    }
+
+    /// A begin marker arriving while one is still open replaces it: the range
+    /// the dropped marker opened is never emitted.
+    #[test]
+    fn a_second_begin_marker_replaces_the_open_one() {
+        let mut parser = ConflictRangeParser::new(CONFLICTING_KEYS_PREFIX);
+        feed(
+            &mut parser,
+            &[marker("a", b"1"), marker("b", b"1"), marker("c", b"0")],
+        );
+
+        let ranges = parser.finish();
+        assert_eq!(ranges.len(), 1);
+        assert_eq!(ranges[0].begin(), b"b");
+        assert_eq!(ranges[0].end(), b"c");
+    }
+
+    /// Values that are neither `1` nor `0` are not boundaries and are ignored.
+    #[test]
+    fn unknown_marker_values_are_ignored() {
+        let mut parser = ConflictRangeParser::new(CONFLICTING_KEYS_PREFIX);
+        feed(
+            &mut parser,
+            &[marker("a", b"1"), marker("x", b"?"), marker("b", b"0")],
+        );
+
+        let ranges = parser.finish();
+        assert_eq!(ranges.len(), 1);
+        assert_eq!(ranges[0].begin(), b"a");
+        assert_eq!(ranges[0].end(), b"b");
+    }
+}
diff --git a/bindings/rust/foundationdb/src/tuple_ext/hca.rs b/bindings/rust/foundationdb/src/tuple_ext/hca.rs
new file mode 100644
index 00000000000..67e77eb9c9e
--- /dev/null
+++ b/bindings/rust/foundationdb/src/tuple_ext/hca.rs
@@ -0,0 +1,239 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! The directory layer offers subspace indirection, where logical application subspaces are mapped to short, auto-generated key prefixes. This prefix assignment is done by the High Contention Allocator, which allows many clients to allocate short directory prefixes efficiently.
+//!
+//! The allocation process works over candidate value windows. It uses two subspaces to operate, the "counters" subspace and "recents" subspace (derived from the subspace used to create the HCA).
+//!
+//! "counters" contains a single key : "counters : window_start", whose value is the number of allocations in the current window. "window_start" is an integer that marks the lower bound of values that can be assigned from the current window.
+//! "recents" can contain many keys : "recents : candidate", where each "candidate" is an integer that has been assigned to some client
+//!
+//! Assignment has two stages that are executed in a loop until they both succeed.
+//!
+//! 1. Find the current window. The client scans "counters : *" to get the current "window_start" and how many allocations have been made in the current window.
+//!    If the window is more than half-full (using pre-defined window sizes), the window is advanced: "counters : *" and "recents : *" are both cleared, and a new "counters : window_start + window_size" key is created with a value of 0. (1) is retried
+//!    If the window still has space, it moves to (2).
+//!
+//! 2. Find a candidate value inside that window. The client picks a candidate number between "[window_start, window_start + window_size)" and tries to set the key "recents : candidate".
+//!    If the write succeeds, the candidate is returned as the allocated value. Success!
+//!    If the write fails because the window has been advanced, it repeats (1).
+//!    If the write fails because the value was already set, it repeats (2).
+
+use std::fmt;
+use std::sync::{Mutex, PoisonError};
+
+use futures::future;
+use rand::{RngExt, rngs::SmallRng};
+
+use crate::options::{ConflictRangeType, MutationType, TransactionOption};
+use crate::tuple::{PackError, Subspace};
+use crate::*;
+
+const ONE_BYTES: &[u8] = &[0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00];
+
+pub enum HcaError {
+    FdbError(FdbError),
+    PackError(PackError),
+    InvalidDirectoryLayerMetadata,
+    PoisonError,
+}
+
+impl fmt::Debug for HcaError {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match self {
+            HcaError::FdbError(err) => err.fmt(f),
+            HcaError::PackError(err) => err.fmt(f),
+            HcaError::InvalidDirectoryLayerMetadata => {
+                write!(f, "invalid directory layer metadata")
+            }
+            HcaError::PoisonError => write!(f, "mutex poisoned"),
+        }
+    }
+}
+
+impl fmt::Display for HcaError {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        fmt::Debug::fmt(self, f)
+    }
+}
+
+impl std::error::Error for HcaError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            HcaError::FdbError(e) => Some(e),
+            HcaError::PackError(e) => Some(e),
+            HcaError::InvalidDirectoryLayerMetadata | HcaError::PoisonError => None,
+        }
+    }
+}
+
+impl From<FdbError> for HcaError {
+    fn from(err: FdbError) -> Self {
+        Self::FdbError(err)
+    }
+}
+impl From<PackError> for HcaError {
+    fn from(err: PackError) -> Self {
+        Self::PackError(err)
+    }
+}
+impl<T> From<PoisonError<T>> for HcaError {
+    fn from(_err: PoisonError<T>) -> Self {
+        Self::PoisonError
+    }
+}
+
+impl TransactError for HcaError {
+    fn try_into_fdb_error(self) -> Result<FdbError, Self> {
+        match self {
+            HcaError::FdbError(err) => Ok(err),
+            _ => Err(self),
+        }
+    }
+}
+
+/// Represents a High Contention Allocator for a given subspace
+#[derive(Debug)]
+pub struct HighContentionAllocator {
+    counters: Subspace,
+    recent: Subspace,
+    allocation_mutex: Mutex<()>,
+}
+
+impl HighContentionAllocator {
+    /// Constructs an allocator that will use the input subspace for assigning values.
+    /// The given subspace should not be used by anything other than the allocator
+    pub fn new(subspace: Subspace) -> HighContentionAllocator {
+        HighContentionAllocator {
+            counters: subspace.subspace(&0i64),
+            recent: subspace.subspace(&1i64),
+            allocation_mutex: Mutex::new(()),
+        }
+    }
+
+    /// Returns a byte string that
+    ///   1) has never and will never be returned by another call to this method on the same subspace
+    ///   2) is nearly as short as possible given the above
+    pub async fn allocate(&self, trx: &Transaction) -> Result<i64, HcaError> {
+        let (begin, end) = self.counters.range();
+        let begin = KeySelector::first_greater_or_equal(begin);
+        let end = KeySelector::first_greater_than(end);
+        let counters_range = RangeOption {
+            begin,
+            end,
+            limit: Some(1),
+            reverse: true,
+            ..RangeOption::default()
+        };
+        let mut rng: SmallRng = rand::make_rng();
+
+        loop {
+            let kvs = trx.get_range(&counters_range, 1, true).await?;
+
+            let mut start: i64 = if let Some(first) = kvs.first() {
+                self.counters.unpack(first.key())?
+            } else {
+                0
+            };
+
+            let mut window_advanced = false;
+
+            let window = loop {
+                let counters_start = self.counters.subspace(&start);
+
+                let count_future = {
+                    let _mutex_guard = self.allocation_mutex.lock()?;
+                    if window_advanced {
+                        trx.clear_range(self.counters.bytes(), counters_start.bytes());
+                        trx.set_option(TransactionOption::NextWriteNoWriteConflictRange)?;
+                        trx.clear_range(self.recent.bytes(), self.recent.subspace(&start).bytes());
+                    };
+
+                    // Increment the allocation count for the current window
+                    trx.atomic_op(counters_start.bytes(), ONE_BYTES, MutationType::Add);
+                    trx.get(counters_start.bytes(), true)
+                };
+
+                let count_value = count_future.await?;
+                let count = if let Some(count_value) = count_value {
+                    if count_value.len() != 8 {
+                        return Err(HcaError::InvalidDirectoryLayerMetadata);
+                    }
+                    let mut bytes = [0u8; 8];
+                    bytes.copy_from_slice(&count_value);
+                    i64::from_le_bytes(bytes)
+                } else {
+                    0
+                };
+
+                let window = Self::window_size(start);
+                if count * 2 < window {
+                    break window;
+                }
+
+                start += window;
+                window_advanced = true;
+            };
+
+            loop {
+                // As of the snapshot being read from, the window is less than half
+                // full, so this should be expected to take 2 tries.  Under high
+                // contention (and when the window advances), there is an additional
+                // subsequent risk of conflict for this transaction.
+                let candidate: i64 = rng.random_range(start..start + window);
+                let recent_candidate = self.recent.subspace(&candidate);
+
+                let (latest_counter, candidate_value) = {
+                    let _mutex_guard = self.allocation_mutex.lock()?;
+                    let latest_counter = trx.get_range(&counters_range, 1, true);
+                    let candidate_value = trx.get(recent_candidate.bytes(), false);
+                    trx.set_option(TransactionOption::NextWriteNoWriteConflictRange)?;
+                    trx.set(recent_candidate.bytes(), &[]);
+                    (latest_counter, candidate_value)
+                };
+
+                let (latest_counter, candidate_value) =
+                    future::try_join(latest_counter, candidate_value).await?;
+
+                let current_window_start: i64 = if let Some(first) = latest_counter.first() {
+                    self.counters.unpack(first.key())?
+                } else {
+                    0
+                };
+
+                if current_window_start > start {
+                    break;
+                }
+
+                if candidate_value.is_none() {
+                    let mut after = recent_candidate.bytes().to_vec();
+                    after.push(0x00);
+                    trx.add_conflict_range(
+                        recent_candidate.bytes(),
+                        &after,
+                        ConflictRangeType::Write,
+                    )?;
+                    return Ok(candidate);
+                }
+            }
+        }
+    }
+
+    fn window_size(start: i64) -> i64 {
+        // Larger window sizes are better for high contention, smaller sizes for
+        // keeping the keys small.  But if there are many allocations, the keys
+        // can't be too small.  So start small and scale up.  We don't want this to
+        // ever get *too* big because we have to store about window_size/2 recent
+        // items.
+        match start {
+            _ if start < 255 => 64,
+            _ if start < 65535 => 1024,
+            _ => 8192,
+        }
+    }
+}
diff --git a/bindings/rust/foundationdb/src/tuple_ext/mod.rs b/bindings/rust/foundationdb/src/tuple_ext/mod.rs
new file mode 100644
index 00000000000..01c14e46ead
--- /dev/null
+++ b/bindings/rust/foundationdb/src/tuple_ext/mod.rs
@@ -0,0 +1,2 @@
+pub mod hca;
+mod subspace;
diff --git a/bindings/rust/foundationdb/src/tuple_ext/subspace.rs b/bindings/rust/foundationdb/src/tuple_ext/subspace.rs
new file mode 100644
index 00000000000..f3e69cf1c84
--- /dev/null
+++ b/bindings/rust/foundationdb/src/tuple_ext/subspace.rs
@@ -0,0 +1,22 @@
+use crate::{KeySelector, RangeOption, Transaction};
+use foundationdb_tuple::Subspace;
+use std::borrow::Cow;
+
+impl From<&Subspace> for RangeOption<'static> {
+    fn from(subspace: &Subspace) -> Self {
+        let (begin, end) = subspace.range();
+
+        Self {
+            begin: KeySelector::first_greater_or_equal(Cow::Owned(begin)),
+            end: KeySelector::first_greater_or_equal(Cow::Owned(end)),
+            ..Self::default()
+        }
+    }
+}
+
+impl Transaction {
+    pub fn clear_subspace_range(&self, subspace: &Subspace) {
+        let (begin, end) = subspace.range();
+        self.clear_range(&begin, &end)
+    }
+}
diff --git a/bindings/rust/foundationdb/tests/api.rs b/bindings/rust/foundationdb/tests/api.rs
new file mode 100644
index 00000000000..fde3c495a28
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/api.rs
@@ -0,0 +1,46 @@
+use foundationdb::api::{self, FdbApiBuilder};
+use foundationdb::options::NetworkOption;
+
+// The whole lifecycle in a single #[test]: `stop_network` is terminal for the
+// process, so a second test in this binary would race it.
+#[test]
+fn test_network_lifecycle() {
+    // boot is safe and idempotent
+    let _guard1 = foundationdb::boot().expect("failed to boot fdb");
+    let _guard2 = foundationdb::boot().expect("boot must be idempotent");
+
+    // re-selecting the same api version is Ok, a different one fails with 2201
+    let builder = FdbApiBuilder::default()
+        .build()
+        .expect("re-selecting the same api version must be Ok");
+    let err = FdbApiBuilder::default()
+        .set_runtime_version(300)
+        .build()
+        .map(drop)
+        .expect_err("selecting another api version must fail");
+    assert_eq!(err.code(), 2201);
+
+    // network options are rejected once the network is running
+    let err = builder
+        .set_option(NetworkOption::TraceEnable(String::new()))
+        .map(drop)
+        .expect_err("setting a network option after boot must fail");
+    assert_eq!(err.code(), 2009);
+
+    // the network event loop reported no error
+    assert!(api::network_run_error().is_none());
+
+    // explicit stop: Ok, idempotent, terminal
+    api::stop_network().expect("failed to stop the network");
+    api::stop_network().expect("stop_network must be idempotent");
+    let err = foundationdb::boot()
+        .map(drop)
+        .expect_err("boot after stop must fail");
+    assert_eq!(err.code(), 2025);
+    let err = futures::executor::block_on(foundationdb::Database::new_compat(None))
+        .map(drop)
+        .expect_err("creating a database after stop must fail");
+    assert_eq!(err.code(), 2025);
+    // the guards drop here: they are inert, and the atexit hook then finds the
+    // network already stopped and does nothing
+}
diff --git a/bindings/rust/foundationdb/tests/api_ub.rs b/bindings/rust/foundationdb/tests/api_ub.rs
new file mode 100644
index 00000000000..7530376ad9b
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/api_ub.rs
@@ -0,0 +1,22 @@
+use std::panic;
+
+#[test]
+fn test_run() {
+    let old = panic::take_hook();
+    panic::set_hook(Box::new(|_| {}));
+    let mut db = None;
+    let result = panic::catch_unwind(panic::AssertUnwindSafe(|| {
+        // Run the foundationdb client API
+        let _drop_me = foundationdb::boot().expect("failed to initialize FoundationDB");
+        db = Some(futures::executor::block_on(foundationdb::Database::new_compat(None)).unwrap());
+        // Try to escape via unwind
+        panic!("UNWIND!")
+    }));
+    assert!(result.is_err());
+    // The boot guard is inert: the network survives the unwind and the database
+    // is still usable (see issue #132).
+    let trx = db.unwrap().create_trx().unwrap();
+    futures::executor::block_on(trx.get_read_version())
+        .expect("the network must survive an unwind past the boot guard");
+    panic::set_hook(old);
+}
diff --git a/bindings/rust/foundationdb/tests/atomic.rs b/bindings/rust/foundationdb/tests/atomic.rs
new file mode 100644
index 00000000000..de34eae5a04
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/atomic.rs
@@ -0,0 +1,61 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+use byteorder::ByteOrder;
+use foundationdb::*;
+use futures::future::*;
+
+mod common;
+
+async fn atomic_add(db: &Database, key: &[u8], value: i64) -> FdbResult<()> {
+    let trx = db.create_trx()?;
+
+    let val = {
+        let mut buf = [0u8; 8];
+        byteorder::LE::write_i64(&mut buf, value);
+        buf
+    };
+    trx.atomic_op(key, &val, options::MutationType::Add);
+
+    trx.commit().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_atomic() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-atomic";
+
+    let db = common::database().await?;
+
+    println!("clear!");
+    {
+        let trx = db.create_trx()?;
+        trx.clear(KEY);
+        trx.commit().await?;
+    }
+
+    println!("concurrent!");
+    {
+        let n = 1000usize;
+
+        let fut_add = try_join_all((0..n).map(|_| atomic_add(&db, KEY, 1)));
+        let fut_sub = try_join_all((0..n).map(|_| atomic_add(&db, KEY, -1)));
+
+        // Wait for all atomic operations
+        try_join(fut_add, fut_sub).await?;
+    }
+
+    println!("check!");
+    {
+        let trx = db.create_trx()?;
+        let value = trx.get(KEY, false).await?.expect("value should exists");
+        let v: i64 = byteorder::LE::read_i64(&value);
+        if v != 0 {
+            panic!("expected 0, found {v}");
+        }
+    }
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/tests/budget.rs b/bindings/rust/foundationdb/tests/budget.rs
new file mode 100644
index 00000000000..16b4aaf6701
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/budget.rs
@@ -0,0 +1,507 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Per-attempt usage accounting and client-side budget, against a live cluster.
+
+use foundationdb::options::StreamingMode;
+use foundationdb::*;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::Duration;
+
+mod common;
+
+/// `transaction_too_old`, retryable, retried without any backoff.
+const TRANSACTION_TOO_OLD: i32 = 1007;
+
+/// A clock the test moves by hand, in milliseconds, standing in for the
+/// simulated time a workload would run on.
+#[derive(Debug, Clone, Default)]
+struct FakeClock(Arc<AtomicU64>);
+
+impl FakeClock {
+    fn set_millis(&self, millis: u64) {
+        self.0.store(millis, Ordering::Relaxed);
+    }
+}
+
+impl Clock for FakeClock {
+    fn monotonic(&self) -> Duration {
+        Duration::from_millis(self.0.load(Ordering::Relaxed))
+    }
+
+    fn wall(&self) -> Duration {
+        self.monotonic()
+    }
+}
+
+/// Writes are accounted as soon as they are issued, no commit needed.
+#[tokio::test]
+async fn usage_counts_writes() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-budget-writes-key";
+    const VALUE: &[u8] = b"value";
+    const PARAM: &[u8] = b"\x01\x00\x00\x00\x00\x00\x00\x00";
+    const BEGIN: &[u8] = b"test-budget-writes-";
+    const END: &[u8] = b"test-budget-writes.";
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    trx.set(KEY, VALUE);
+    trx.clear(KEY);
+    trx.clear_range(BEGIN, END);
+    trx.atomic_op(KEY, PARAM, options::MutationType::Add);
+
+    let usage = trx.attempt_usage();
+    assert_eq!(usage.call_set, 1);
+    assert_eq!(usage.call_clear, 1);
+    assert_eq!(usage.call_clear_range, 1);
+    assert_eq!(usage.call_atomic_op, 1);
+    assert_eq!(
+        usage.bytes_written,
+        (KEY.len() + VALUE.len() + KEY.len() + BEGIN.len() + END.len() + KEY.len() + PARAM.len())
+            as u64
+    );
+    assert_eq!(usage.bytes_read, 0);
+
+    Ok(())
+}
+
+/// Reads are accounted when their future resolves.
+#[tokio::test]
+async fn usage_counts_reads() -> FdbResult<()> {
+    const PREFIX: &[u8] = b"test-budget-reads-";
+    const MISSING: &[u8] = b"test-budget-reads-missing-key";
+    const VALUE: &[u8] = b"value";
+
+    let keys: Vec<Vec<u8>> = (0..3)
+        .map(|i| [PREFIX, format!("{i}").as_bytes()].concat())
+        .collect();
+
+    let db = common::database().await?;
+
+    {
+        let trx = db.create_trx()?;
+        trx.clear_range(PREFIX, b"test-budget-reads.");
+        for key in &keys {
+            trx.set(key, VALUE);
+        }
+        trx.commit().await.expect("failed to commit");
+    }
+
+    // get, on an existing then on a missing key.
+    let trx = db.create_trx()?;
+    trx.get(&keys[0], false).await?;
+    trx.get(MISSING, false).await?;
+
+    let usage = trx.attempt_usage();
+    assert_eq!(usage.call_get, 2);
+    assert_eq!(usage.keys_values_fetched, 1);
+    assert_eq!(
+        usage.bytes_read,
+        (keys[0].len() + VALUE.len() + MISSING.len()) as u64
+    );
+
+    // get_key counts as a get of the selector key plus the resolved key.
+    let trx = db.create_trx()?;
+    let selector = KeySelector::first_greater_or_equal(keys[0].as_slice());
+    let resolved = trx.get_key(&selector, false).await?;
+
+    let usage = trx.attempt_usage();
+    assert_eq!(usage.call_get, 1);
+    assert_eq!(usage.keys_values_fetched, 0);
+    assert_eq!(usage.bytes_read, (keys[0].len() + resolved.len()) as u64);
+
+    // get_range counts one call per resolved batch.
+    let trx = db.create_trx()?;
+    let opt = RangeOption {
+        mode: StreamingMode::WantAll,
+        ..RangeOption::from((PREFIX, b"test-budget-reads.".as_ref()))
+    };
+    let values = trx.get_range(&opt, 1, false).await?;
+    assert_eq!(values.len(), keys.len());
+
+    let usage = trx.attempt_usage();
+    assert_eq!(usage.call_get_range, 1);
+    assert_eq!(usage.call_get, 0);
+    assert_eq!(usage.keys_values_fetched, keys.len() as u64);
+    assert_eq!(
+        usage.bytes_read,
+        keys.iter().map(|k| (k.len() + VALUE.len()) as u64).sum()
+    );
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn budget_exceeded_on_bytes_written() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-budget-bytes-written-key";
+    const VALUE: &[u8] = b"a-value-larger-than-the-limit";
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    trx.set_client_budget(ClientBudget {
+        max_bytes_written: Some(8),
+        ..ClientBudget::default()
+    });
+    assert!(trx.check_client_budget().is_ok());
+
+    trx.set(KEY, VALUE);
+
+    let err = trx.check_client_budget().unwrap_err();
+    assert_eq!(err.kind, BudgetKind::BytesWritten);
+    assert_eq!(err.used, (KEY.len() + VALUE.len()) as u64);
+    assert_eq!(err.limit, 8);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn budget_exceeded_on_bytes_read() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-budget-bytes-read-key";
+    const VALUE: &[u8] = b"a-value-larger-than-the-limit";
+
+    let db = common::database().await?;
+
+    {
+        let trx = db.create_trx()?;
+        trx.set(KEY, VALUE);
+        trx.commit().await.expect("failed to commit");
+    }
+
+    let trx = db.create_trx()?;
+    trx.set_client_budget(ClientBudget {
+        max_bytes_read: Some(8),
+        ..ClientBudget::default()
+    });
+    assert!(trx.check_client_budget().is_ok());
+
+    trx.get(KEY, false).await?;
+
+    let err = trx.check_client_budget().unwrap_err();
+    assert_eq!(err.kind, BudgetKind::BytesRead);
+    assert_eq!(err.used, (KEY.len() + VALUE.len()) as u64);
+    assert_eq!(err.limit, 8);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn budget_exceeded_on_time() -> FdbResult<()> {
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    trx.set_client_budget(ClientBudget {
+        time_limit: Some(Duration::from_millis(20)),
+        ..ClientBudget::default()
+    });
+    assert!(trx.check_client_budget().is_ok());
+
+    tokio::time::sleep(Duration::from_millis(50)).await;
+
+    let err = trx.check_client_budget().unwrap_err();
+    assert_eq!(err.kind, BudgetKind::Time);
+    assert!(err.used >= 20, "used {} ms", err.used);
+    assert_eq!(err.limit, 20);
+
+    Ok(())
+}
+
+/// With a [`Clock`] the time limit no longer depends on how fast the machine
+/// is: the test advances time itself and the numbers are exact.
+#[tokio::test]
+async fn budget_exceeded_on_time_with_a_custom_clock() -> FdbResult<()> {
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    let clock = FakeClock::default();
+    clock.set_millis(1_000);
+
+    trx.set_client_budget(
+        ClientBudget {
+            time_limit: Some(Duration::from_millis(20)),
+            ..ClientBudget::default()
+        }
+        .with_clock(clock.clone()),
+    );
+    assert!(trx.check_client_budget().is_ok());
+
+    // The limit itself is allowed, anything past it is not.
+    clock.set_millis(1_020);
+    assert!(trx.check_client_budget().is_ok());
+
+    clock.set_millis(1_050);
+
+    let err = trx.check_client_budget().unwrap_err();
+    assert_eq!(err.kind, BudgetKind::Time);
+    assert_eq!(err.used, 50);
+    assert_eq!(err.limit, 20);
+    assert_eq!(trx.attempt_usage().elapsed, Duration::from_millis(50));
+
+    Ok(())
+}
+
+/// The clock is configuration too: the generation a new attempt starts is
+/// measured with the clock of the budget, not with the wall clock.
+#[tokio::test]
+async fn the_clock_survives_a_new_attempt() -> FdbResult<()> {
+    let db = common::database().await?;
+    let mut trx = db.create_trx()?;
+
+    let clock = FakeClock::default();
+    clock.set_millis(1_000);
+
+    trx.set_client_budget(
+        ClientBudget {
+            time_limit: Some(Duration::from_millis(20)),
+            ..ClientBudget::default()
+        }
+        .with_clock(clock.clone()),
+    );
+
+    clock.set_millis(1_100);
+    assert!(trx.check_client_budget().is_err());
+
+    trx.reset();
+
+    // The new attempt was stamped at 1_100 ms, so it starts from zero.
+    assert_eq!(trx.attempt_usage().elapsed, Duration::ZERO);
+    assert!(trx.check_client_budget().is_ok());
+
+    clock.set_millis(1_130);
+
+    let err = trx.check_client_budget().unwrap_err();
+    assert_eq!(err.kind, BudgetKind::Time);
+    assert_eq!(err.used, 30);
+    assert_eq!(err.limit, 20);
+
+    // Same contract after an `on_error` restart.
+    let trx = trx
+        .on_error(FdbError::from_code(TRANSACTION_TOO_OLD))
+        .await?;
+    assert_eq!(trx.attempt_usage().elapsed, Duration::ZERO);
+
+    clock.set_millis(1_175);
+
+    let err = trx.check_client_budget().unwrap_err();
+    assert_eq!(err.kind, BudgetKind::Time);
+    assert_eq!(err.used, 45);
+    assert_eq!(err.limit, 20);
+
+    Ok(())
+}
+
+/// The budget is configuration, the usage is per-attempt: `on_error` keeps the
+/// former and resets the latter.
+#[tokio::test]
+async fn budget_survives_on_error_while_usage_resets() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-budget-on-error-key";
+    const VALUE: &[u8] = b"a-value-larger-than-the-limit";
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    trx.set_client_budget(ClientBudget {
+        max_bytes_written: Some(8),
+        ..ClientBudget::default()
+    });
+    trx.set(KEY, VALUE);
+    assert!(trx.check_client_budget().is_err());
+
+    let trx = trx
+        .on_error(FdbError::from_code(TRANSACTION_TOO_OLD))
+        .await?;
+
+    let usage = trx.attempt_usage();
+    assert_eq!(usage.bytes_written, 0);
+    assert_eq!(usage.call_set, 0);
+    assert!(
+        trx.check_client_budget().is_ok(),
+        "usage should have been reset by the new attempt"
+    );
+
+    // The limit is still armed for the new attempt.
+    trx.set(KEY, VALUE);
+    assert_eq!(
+        trx.check_client_budget().unwrap_err().kind,
+        BudgetKind::BytesWritten
+    );
+
+    Ok(())
+}
+
+/// Same contract for an explicit `reset`.
+#[tokio::test]
+async fn reset_starts_a_new_attempt() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-budget-reset-key";
+    const VALUE: &[u8] = b"a-value-larger-than-the-limit";
+
+    let db = common::database().await?;
+    let mut trx = db.create_trx()?;
+
+    trx.set_client_budget(ClientBudget {
+        max_bytes_written: Some(8),
+        ..ClientBudget::default()
+    });
+    trx.set(KEY, VALUE);
+    assert!(trx.check_client_budget().is_err());
+
+    trx.reset();
+
+    assert_eq!(trx.attempt_usage().bytes_written, 0);
+    assert!(trx.check_client_budget().is_ok());
+
+    trx.clear_client_budget();
+    trx.set(KEY, VALUE);
+    assert!(trx.check_client_budget().is_ok());
+
+    Ok(())
+}
+
+/// An exceeded budget converts into an `FdbBindingError`, so `?` works inside a
+/// `run` closure, and it is not retried.
+#[tokio::test]
+async fn budget_exceeded_is_fatal_in_run() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-budget-run-key";
+    const VALUE: &[u8] = b"a-value-larger-than-the-limit";
+
+    let db = common::database().await?;
+
+    let result: Result<(), FdbBindingError> = db
+        .run(|trx, _| async move {
+            trx.set_client_budget(ClientBudget {
+                max_bytes_written: Some(8),
+                ..ClientBudget::default()
+            });
+            trx.set(KEY, VALUE);
+            trx.check_client_budget()?;
+            Ok(())
+        })
+        .await;
+
+    match result {
+        Err(FdbBindingError::ClientBudgetExceeded(err)) => {
+            assert_eq!(err.kind, BudgetKind::BytesWritten);
+            assert!(err.to_string().contains("client-side estimate"));
+        }
+        other => panic!("expected a ClientBudgetExceeded error, got {other:?}"),
+    }
+
+    Ok(())
+}
+
+/// The pattern of `examples/budgeted_scan.rs`: a scan cut into pages by the
+/// budget, each page resuming exclusively after the last key of the previous
+/// one. Every row must be seen exactly once across the pages.
+#[tokio::test]
+async fn budgeted_scan_resumes_without_losing_or_repeating_rows() -> FdbResult<()> {
+    const PREFIX: &[u8] = b"test-budget-scan/";
+    const END: &[u8] = b"test-budget-scan0";
+    const ROWS: usize = 400;
+    const VALUE_SIZE: usize = 1024;
+
+    fn key_of(index: usize) -> Vec<u8> {
+        let mut key = PREFIX.to_vec();
+        key.extend_from_slice(format!("{index:05}").as_bytes());
+        key
+    }
+
+    let db = common::database().await?;
+
+    db.run(|trx, _| async move {
+        trx.clear_range(PREFIX, END);
+        for index in 0..ROWS {
+            trx.set(&key_of(index), &vec![b'x'; VALUE_SIZE]);
+        }
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("setup");
+
+    let mut seen: Vec<Vec<u8>> = Vec::new();
+    let mut continuation: Option<Vec<u8>> = None;
+    let mut transactions = 0;
+
+    loop {
+        let after = continuation.clone();
+        // A budget smaller than one batch: each transaction reads a single
+        // batch, then stops on the check that follows it.
+        let (keys, complete) = db
+            .run(move |trx, _| {
+                let after = after.clone();
+                async move {
+                    trx.set_client_budget(ClientBudget {
+                        max_bytes_read: Some(1),
+                        ..ClientBudget::default()
+                    });
+
+                    let begin = match &after {
+                        Some(last) => KeySelector::first_greater_than(last.as_slice()),
+                        None => KeySelector::first_greater_or_equal(PREFIX),
+                    };
+                    let opt = RangeOption {
+                        begin,
+                        end: KeySelector::first_greater_or_equal(END),
+                        mode: StreamingMode::Serial,
+                        target_bytes: 1 << 20,
+                        ..RangeOption::default()
+                    };
+
+                    let mut keys: Vec<Vec<u8>> = Vec::new();
+                    let mut complete = true;
+                    let mut batches = trx.get_ranges(opt, false);
+                    while let Some(batch) =
+                        futures_util::TryStreamExt::try_next(&mut batches).await?
+                    {
+                        for kv in batch.iter() {
+                            keys.push(kv.key().to_vec());
+                        }
+                        // Matched, not propagated: the page is kept and the
+                        // caller resumes from its last key.
+                        if trx.check_client_budget().is_err() {
+                            complete = false;
+                            break;
+                        }
+                    }
+
+                    Ok::<_, FdbBindingError>((keys, complete))
+                }
+            })
+            .await
+            .expect("scan page");
+
+        transactions += 1;
+        let last = keys.last().cloned();
+        seen.extend(keys);
+
+        if complete {
+            break;
+        }
+        match last {
+            Some(last) => continuation = Some(last),
+            None => break,
+        }
+    }
+
+    assert!(
+        transactions > 1,
+        "the budget should have cut the scan into several transactions, got {transactions}"
+    );
+    assert_eq!(seen.len(), ROWS, "a row was lost or read twice");
+    let expected: Vec<Vec<u8>> = (0..ROWS).map(key_of).collect();
+    assert_eq!(seen, expected, "rows are not the expected ones, in order");
+
+    db.run(|trx, _| async move {
+        trx.clear_range(PREFIX, END);
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("cleanup");
+
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/tests/common/mod.rs b/bindings/rust/foundationdb/tests/common/mod.rs
new file mode 100644
index 00000000000..b5eea869276
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/common/mod.rs
@@ -0,0 +1,20 @@
+use foundationdb as fdb;
+use rand::RngExt;
+use rand::distr::Alphanumeric;
+
+/// generate random string. Foundationdb watch only fires when value changed, so updating with same
+/// value twice will not fire watches. To make examples work over multiple run, we use random
+/// string as a value.
+#[allow(unused)]
+pub fn random_str(len: usize) -> String {
+    rand::rng()
+        .sample_iter(&Alphanumeric)
+        .take(len)
+        .map(char::from)
+        .collect()
+}
+
+#[allow(unused)]
+pub async fn database() -> fdb::FdbResult<fdb::Database> {
+    fdb::Database::new_compat(None).await
+}
diff --git a/bindings/rust/foundationdb/tests/conflict_ranges.rs b/bindings/rust/foundationdb/tests/conflict_ranges.rs
new file mode 100644
index 00000000000..cef5aa1f40b
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/conflict_ranges.rs
@@ -0,0 +1,218 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! The read and write conflict range readers, against a live cluster.
+//!
+//! The `\xff\xff/transaction/{read,write}_conflict_range/` special keyspaces
+//! exist from API version 630.
+
+#[allow(unused_imports)]
+use foundationdb::*;
+#[allow(unused_imports)]
+use foundationdb_macros::cfg_api_versions;
+
+mod common;
+
+/// Whether `ranges` holds exactly `begin..end`.
+#[allow(dead_code)]
+fn contains(ranges: &[ConflictRange], begin: &[u8], end: &[u8]) -> bool {
+    ranges
+        .iter()
+        .any(|range| range.begin() == begin && range.end() == end)
+}
+
+/// A point read registers `key..key\x00`, a range read the range itself.
+#[cfg_api_versions(min = 630)]
+#[tokio::test]
+async fn read_conflict_ranges_report_reads() -> FdbResult<()> {
+    const POINT: &[u8] = b"test-rcr-point";
+    const RANGE_BEGIN: &[u8] = b"test-rcr-range-a";
+    const RANGE_END: &[u8] = b"test-rcr-range-z";
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    trx.get(POINT, false).await?;
+    trx.get_range(
+        &RangeOption::from((RANGE_BEGIN, RANGE_END)),
+        1,
+        false, // not a snapshot read: it must register a conflict range
+    )
+    .await?;
+
+    let ranges = trx.read_conflict_ranges().await?;
+
+    let mut point_key = POINT.to_vec();
+    point_key.push(0);
+    assert!(
+        contains(&ranges, POINT, &point_key),
+        "point read missing from {ranges:?}"
+    );
+    assert!(
+        contains(&ranges, RANGE_BEGIN, RANGE_END),
+        "range read missing from {ranges:?}"
+    );
+
+    Ok(())
+}
+
+/// A snapshot read is not serializable and registers no read conflict range.
+#[cfg_api_versions(min = 630)]
+#[tokio::test]
+async fn snapshot_reads_register_no_read_conflict_range() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-rcr-snapshot";
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    trx.get(KEY, true).await?;
+
+    assert!(trx.read_conflict_ranges().await?.is_empty());
+
+    Ok(())
+}
+
+/// Writes register write conflict ranges, and only those.
+#[cfg_api_versions(min = 630)]
+#[tokio::test]
+async fn write_conflict_ranges_report_writes() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-wcr-key";
+    const CLEAR_BEGIN: &[u8] = b"test-wcr-cleared-a";
+    const CLEAR_END: &[u8] = b"test-wcr-cleared-z";
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    trx.set(KEY, b"value");
+    trx.clear_range(CLEAR_BEGIN, CLEAR_END);
+
+    let ranges = trx.write_conflict_ranges().await?;
+
+    let mut key_end = KEY.to_vec();
+    key_end.push(0);
+    assert!(
+        contains(&ranges, KEY, &key_end),
+        "set missing from {ranges:?}"
+    );
+    assert!(
+        contains(&ranges, CLEAR_BEGIN, CLEAR_END),
+        "cleared range missing from {ranges:?}"
+    );
+
+    // A write is not a read.
+    assert!(trx.read_conflict_ranges().await?.is_empty());
+
+    Ok(())
+}
+
+/// A range added without the associated read or write shows up in the keyspace
+/// matching its type.
+#[cfg_api_versions(min = 630)]
+#[tokio::test]
+async fn add_conflict_range_shows_up() -> FdbResult<()> {
+    const READ_BEGIN: &[u8] = b"test-acr-read-a";
+    const READ_END: &[u8] = b"test-acr-read-z";
+    const WRITE_BEGIN: &[u8] = b"test-acr-write-a";
+    const WRITE_END: &[u8] = b"test-acr-write-z";
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    trx.add_conflict_range(READ_BEGIN, READ_END, options::ConflictRangeType::Read)?;
+    trx.add_conflict_range(WRITE_BEGIN, WRITE_END, options::ConflictRangeType::Write)?;
+
+    let read_ranges = trx.read_conflict_ranges().await?;
+    let write_ranges = trx.write_conflict_ranges().await?;
+
+    assert!(
+        contains(&read_ranges, READ_BEGIN, READ_END),
+        "added read range missing from {read_ranges:?}"
+    );
+    assert!(
+        contains(&write_ranges, WRITE_BEGIN, WRITE_END),
+        "added write range missing from {write_ranges:?}"
+    );
+    assert!(!contains(&read_ranges, WRITE_BEGIN, WRITE_END));
+    assert!(!contains(&write_ranges, READ_BEGIN, READ_END));
+
+    Ok(())
+}
+
+/// A fresh transaction has no conflict range at all.
+#[cfg_api_versions(min = 630)]
+#[tokio::test]
+async fn fresh_transaction_has_no_conflict_range() -> FdbResult<()> {
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    assert!(trx.read_conflict_ranges().await?.is_empty());
+    assert!(trx.write_conflict_ranges().await?.is_empty());
+
+    Ok(())
+}
+
+/// Hundreds of disjoint ranges do not fit in one `get_range` batch, so the
+/// reader has to paginate and to carry a begin marker whose end marker lands in
+/// the next batch. A single-batch read truncates the result here.
+#[cfg_api_versions(min = 630)]
+#[tokio::test]
+async fn many_conflict_ranges_are_fully_paginated() -> FdbResult<()> {
+    const RANGES: usize = 500;
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    for index in 0..RANGES {
+        let begin = format!("test-many-rcr/{index:05}/a");
+        let end = format!("test-many-rcr/{index:05}/b");
+        trx.add_conflict_range(
+            begin.as_bytes(),
+            end.as_bytes(),
+            options::ConflictRangeType::Read,
+        )?;
+    }
+
+    let ranges = trx.read_conflict_ranges().await?;
+
+    assert_eq!(ranges.len(), RANGES, "conflict ranges were truncated");
+    for (index, range) in ranges.iter().enumerate() {
+        assert_eq!(
+            range.begin(),
+            format!("test-many-rcr/{index:05}/a").as_bytes()
+        );
+        assert_eq!(
+            range.end(),
+            format!("test-many-rcr/{index:05}/b").as_bytes()
+        );
+    }
+
+    Ok(())
+}
+
+/// Reading the conflict ranges is a binding-internal read: it must not move the
+/// usage counters of the attempt, nor consume the client budget.
+#[cfg_api_versions(min = 630)]
+#[tokio::test]
+async fn reading_conflict_ranges_is_unmetered() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-rcr-unmetered";
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    trx.set(KEY, b"value");
+    let before = trx.attempt_usage();
+
+    trx.read_conflict_ranges().await?;
+    trx.write_conflict_ranges().await?;
+
+    let after = trx.attempt_usage();
+    assert_eq!(after.bytes_read, before.bytes_read);
+    assert_eq!(after.call_get_range, before.call_get_range);
+    assert_eq!(after.keys_values_fetched, before.keys_values_fetched);
+
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/tests/database.rs b/bindings/rust/foundationdb/tests/database.rs
new file mode 100644
index 00000000000..87db98a581b
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/database.rs
@@ -0,0 +1,36 @@
+use foundationdb_macros::cfg_api_versions;
+
+mod common;
+
+#[cfg_api_versions(min = 730)]
+#[tokio::test]
+async fn test_status() -> foundationdb::FdbResult<()> {
+    let db = common::database().await?;
+    let status = db.get_client_status().await?;
+
+    let status =
+        std::str::from_utf8(status.as_ref()).expect("could not find any utf-8 bytes to read");
+    assert!(
+        status.contains("Healthy"),
+        "Could not find healthy in '{status}'"
+    );
+
+    Ok(())
+}
+
+#[cfg_api_versions(min = 710)]
+#[tokio::test]
+async fn test_get_main_thread_busyness() -> foundationdb::FdbResult<()> {
+    let db = common::database().await?;
+
+    let busyness = db
+        .get_main_thread_busyness()
+        .await
+        .expect("could not get busyness");
+    assert!(
+        busyness == 0.0,
+        "{}",
+        format!("non-zero thread busyness: {busyness}")
+    );
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/tests/directory.rs b/bindings/rust/foundationdb/tests/directory.rs
new file mode 100644
index 00000000000..ad88134b1f9
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/directory.rs
@@ -0,0 +1,81 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+use foundationdb::directory::DirectoryLayer;
+
+use foundationdb::directory::Directory;
+
+use foundationdb::tuple::Subspace;
+use foundationdb::*;
+
+mod common;
+
+#[tokio::test]
+// testing basic features of the Directory, everything is tracked using with the BindingTester.
+async fn test_directory() {
+    let db = common::database().await.expect("cannot open fdb");
+
+    // Scope the directory layer to a test-specific subspace: create() fails on
+    // an already existing path, so reruns need a fresh state, and clearing only
+    // our own subspace keeps the rest of the cluster untouched.
+    let test_root = Subspace::from("test-directory");
+    let directory = DirectoryLayer::new(
+        test_root.subspace(&"node"),
+        test_root.subspace(&"content"),
+        false,
+    );
+
+    eprintln!("clearing the test subspace");
+    let trx = db.create_trx().expect("cannot create txn");
+    trx.clear_subspace_range(&test_root);
+    trx.commit().await.expect("could not clear keys");
+
+    eprintln!("creating directories");
+
+    test_create_then_open_then_delete(&db, &directory, vec![String::from("application")])
+        .await
+        .expect("failed to run");
+
+    test_create_then_open_then_delete(&db, &directory, vec![String::from("1"), String::from("2")])
+        .await
+        .expect("failed to run");
+}
+
+async fn test_create_then_open_then_delete(
+    db: &Database,
+    directory: &DirectoryLayer,
+    path: Vec<String>,
+) -> FdbResult<()> {
+    let trx = db.create_trx()?;
+
+    eprintln!("creating {:?}", path);
+    let create_output = directory.create(&trx, &path, None, None).await;
+    assert!(
+        create_output.is_ok(),
+        "cannot create: {:?}",
+        create_output.err().unwrap()
+    );
+    trx.commit().await.expect("cannot commit");
+    let trx = db.create_trx()?;
+
+    eprintln!("opening {:?}", path);
+    let open_output = directory.open(&trx, &path, None).await;
+    assert!(
+        open_output.is_ok(),
+        "cannot create: {:?}",
+        open_output.err().unwrap()
+    );
+
+    assert_eq!(
+        create_output.unwrap().bytes().unwrap(),
+        open_output.unwrap().bytes().unwrap()
+    );
+    trx.commit().await.expect("cannot commit");
+
+    // removing folder
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/tests/error.rs b/bindings/rust/foundationdb/tests/error.rs
new file mode 100644
index 00000000000..71b950980eb
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/error.rs
@@ -0,0 +1,127 @@
+use foundationdb::directory::DirectoryError;
+use foundationdb::tuple::hca::HcaError;
+use foundationdb::{FdbBindingError, FdbError, RetryDecision, RetryableError};
+use std::fmt;
+
+#[test]
+// This test is here because I'm always creating infinite recursion on Display and Debug impl 🤦
+// Exhibit A: https://github.com/foundationdb-rs/foundationdb-rs/pull/83
+// Exhibit B: https://github.com/foundationdb-rs/foundationdb-rs/issues/93
+fn test_debug_display_trait() {
+    let error = FdbBindingError::ReferenceToTransactionKept;
+    println!("{error}");
+    println!("{error:?}");
+}
+
+/// A typical layer error wrapping an FdbError as its source, like a
+/// thiserror enum with `#[source]`/`#[from]` would.
+#[derive(Debug)]
+struct LayerError {
+    source: FdbError,
+}
+
+impl fmt::Display for LayerError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "layer error: {}", self.source)
+    }
+}
+
+impl std::error::Error for LayerError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        Some(&self.source)
+    }
+}
+
+#[test]
+fn get_fdb_error_walks_source_chain() {
+    let layer_err = LayerError {
+        source: FdbError::from_code(1020),
+    };
+    let err = FdbBindingError::new_custom_error(Box::new(layer_err));
+    assert_eq!(err.get_fdb_error().map(|e| e.code()), Some(1020));
+}
+
+#[test]
+fn get_fdb_error_finds_nested_directory_hca() {
+    let err = FdbBindingError::from(DirectoryError::HcaError(HcaError::FdbError(
+        FdbError::from_code(1020),
+    )));
+    assert_eq!(err.get_fdb_error().map(|e| e.code()), Some(1020));
+}
+
+#[test]
+fn get_fdb_error_boxed_binding_error() {
+    let inner = FdbBindingError::from(FdbError::from_code(1020));
+    let err = FdbBindingError::new_custom_error(Box::new(inner));
+    assert_eq!(err.get_fdb_error().map(|e| e.code()), Some(1020));
+}
+
+/// A layer error enum implementing RetryableError with the default
+/// source-walk classification.
+#[derive(Debug)]
+enum TypedLayerError {
+    Fdb(FdbError),
+    Binding(FdbBindingError),
+    Invalid,
+}
+
+impl fmt::Display for TypedLayerError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{self:?}")
+    }
+}
+
+impl std::error::Error for TypedLayerError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Fdb(e) => Some(e),
+            Self::Binding(e) => Some(e),
+            Self::Invalid => None,
+        }
+    }
+}
+
+impl From<FdbError> for TypedLayerError {
+    fn from(e: FdbError) -> Self {
+        Self::Fdb(e)
+    }
+}
+
+impl From<FdbBindingError> for TypedLayerError {
+    fn from(e: FdbBindingError) -> Self {
+        Self::Binding(e)
+    }
+}
+
+impl RetryableError for TypedLayerError {}
+
+#[test]
+fn retry_decision_default_walk() {
+    let wrapped = TypedLayerError::Fdb(FdbError::from_code(1020));
+    match wrapped.retry_decision() {
+        RetryDecision::Fdb(e) => assert_eq!(e.code(), 1020),
+        other => panic!("expected Fdb decision, got {other:?}"),
+    }
+
+    let nested = TypedLayerError::Binding(FdbBindingError::from(FdbError::from_code(1020)));
+    match nested.retry_decision() {
+        RetryDecision::Fdb(e) => assert_eq!(e.code(), 1020),
+        other => panic!("expected Fdb decision, got {other:?}"),
+    }
+
+    match TypedLayerError::Invalid.retry_decision() {
+        RetryDecision::Fatal => {}
+        other => panic!("expected Fatal decision, got {other:?}"),
+    }
+}
+
+#[test]
+fn stringified_error_has_no_fdb_error() {
+    // Stringifying an error destroys the source chain: there is no FdbError
+    // to recover from a String, so such errors are never retried.
+    let layer_err = LayerError {
+        source: FdbError::from_code(1020),
+    };
+    let err = FdbBindingError::CustomError(layer_err.to_string().into());
+    assert!(err.get_fdb_error().is_none());
+}
diff --git a/bindings/rust/foundationdb/tests/future.rs b/bindings/rust/foundationdb/tests/future.rs
new file mode 100644
index 00000000000..300734a2557
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/future.rs
@@ -0,0 +1,58 @@
+use foundationdb::*;
+use futures::prelude::*;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+
+mod common;
+
+struct AbortingFuture<F> {
+    inner: F,
+    polled: bool,
+}
+
+impl<T> Future for AbortingFuture<T>
+where
+    T: Future + Unpin,
+{
+    type Output = FdbResult<bool>;
+
+    fn poll(mut self: Pin<&mut Self>, cx: &mut Context) -> Poll<FdbResult<bool>> {
+        // poll once only
+        if !self.polled {
+            self.polled = true;
+            match Pin::new(&mut self.as_mut().inner).poll(cx) {
+                Poll::Pending => (),
+                _ => return Poll::Ready(Ok(false)),
+            }
+        }
+
+        Poll::Ready(Ok(true))
+    }
+}
+
+#[tokio::test]
+async fn test_future_discard() -> FdbResult<()> {
+    // dropping a future while it's in the pending state should not crash
+    let db = common::database().await?;
+    let mut hit_pending = false;
+    for _i in 0..=1000 {
+        let hit_pending_step = db
+            .transact_boxed_local(
+                (),
+                |trx, ()| {
+                    AbortingFuture {
+                        inner: trx.get(b"key", false),
+                        polled: false,
+                    }
+                    .boxed_local()
+                },
+                TransactOption::default(),
+            )
+            .await?;
+        hit_pending = hit_pending || hit_pending_step;
+    }
+
+    assert!(hit_pending);
+
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/tests/get.rs b/bindings/rust/foundationdb/tests/get.rs
new file mode 100644
index 00000000000..c2c3b1b3193
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/get.rs
@@ -0,0 +1,380 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+use foundationdb::*;
+use foundationdb_macros::cfg_api_versions;
+use futures::future::*;
+use std::ops::Deref;
+use std::sync::{Arc, atomic::*};
+
+mod common;
+
+// These tests run in parallel without any explicit boot: the first
+// `common::database()` call starts the network lazily (see issue #132).
+
+#[tokio::test]
+async fn test_set_get() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    let trx = db.create_trx()?;
+    trx.set(b"hello", b"world");
+    trx.commit().await?;
+
+    let trx = db.create_trx()?;
+    let value = trx.get(b"hello", false).await?.unwrap();
+    assert_eq!(value.deref(), b"world");
+
+    trx.clear(b"hello");
+    trx.commit().await?;
+
+    let trx = db.create_trx()?;
+    assert!(trx.get(b"hello", false).await?.is_none());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_get_multi() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    let trx = db.create_trx()?;
+    let keys: &[&[u8]] = &[b"hello", b"world", b"foo", b"bar"];
+    let _results = try_join_all(keys.iter().map(|k| trx.get(k, false))).await?;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_set_conflict() -> FdbResult<()> {
+    let key = b"test_set_conflict";
+    let db = common::database().await?;
+
+    let trx1 = db.create_trx()?;
+    let trx2 = db.create_trx()?;
+
+    // try to read value to set conflict range
+    let _ = trx2.get(key, false).await?;
+
+    // commit first transaction to create conflict
+    trx1.set(key, common::random_str(10).as_bytes());
+    trx1.commit().await?;
+
+    // commit seconds transaction, which will cause conflict
+    trx2.set(key, common::random_str(10).as_bytes());
+    let err = trx2.commit().await.unwrap_err();
+    assert_eq!(
+        err.message(),
+        "Transaction not committed due to conflict with another transaction"
+    );
+    assert_eq!(
+        format!("{err}"),
+        "Transaction not committed due to conflict with another transaction"
+    );
+    assert_eq!(
+        format!("{err:?}"),
+        "TransactionCommitError(Transaction not committed due to conflict with another transaction)"
+    );
+    assert!(err.is_retryable());
+    assert!(err.is_retryable_not_committed());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_set_conflict_snapshot() -> FdbResult<()> {
+    let key = b"test_set_conflict_snapshot";
+    let db = common::database().await?;
+
+    let trx1 = db.create_trx()?;
+    let trx2 = db.create_trx()?;
+
+    // snapshot read does not set conflict range, so both transaction will be
+    // committed.
+    let _ = trx2.get(key, true).await?;
+
+    // commit first transaction
+    trx1.set(key, common::random_str(10).as_bytes());
+    trx1.commit().await?;
+
+    // commit seconds transaction, which will *not* cause conflict because of
+    // snapshot read
+    trx2.set(key, common::random_str(10).as_bytes());
+    trx2.commit().await?;
+
+    Ok(())
+}
+
+// Makes the key dirty. It will abort transactions which performs non-snapshot read on the `key`.
+async fn make_dirty(db: &Database, key: &[u8]) -> FdbResult<()> {
+    let trx = db.create_trx()?;
+    trx.set(key, b"");
+    trx.commit().await?;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_transact() -> FdbResult<()> {
+    const KEY: &[u8] = b"test_transact";
+    const RETRY_COUNT: usize = 5;
+    async fn async_body(
+        db: &Database,
+        trx: &Transaction,
+        try_count0: Arc<AtomicUsize>,
+    ) -> FdbResult<()> {
+        // increment try counter
+        try_count0.fetch_add(1, Ordering::SeqCst);
+
+        trx.set_option(options::TransactionOption::RetryLimit(RETRY_COUNT as i32))
+            .expect("failed to set retry limit");
+
+        // update conflict range
+        trx.get(KEY, false).await?;
+
+        // make current transaction invalid by making conflict
+        make_dirty(db, KEY).await?;
+
+        trx.set(KEY, common::random_str(10).as_bytes());
+
+        // `Database::transact` will handle commit by itself, so returns without commit
+        Ok(())
+    }
+
+    let try_count = Arc::new(AtomicUsize::new(0));
+    let db = common::database().await?;
+    let res = db
+        .transact_boxed(
+            &db,
+            |trx, db| async_body(db, trx, try_count.clone()).boxed(),
+            TransactOption::default(),
+        )
+        .await;
+    assert!(res.is_err(), "should not be able to commit");
+
+    // `TransactionOption::RetryCount` does not count first try, so `try_count` should be equal to
+    // `RETRY_COUNT+1`
+    assert_eq!(try_count.load(Ordering::SeqCst), RETRY_COUNT + 1);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_transact_limit() -> FdbResult<()> {
+    const KEY: &[u8] = b"test_transact_limit";
+    async fn async_body(
+        db: &Database,
+        trx: &Transaction,
+        try_count0: Arc<AtomicUsize>,
+    ) -> FdbResult<()> {
+        // increment try counter
+        try_count0.fetch_add(1, Ordering::SeqCst);
+
+        // update conflict range
+        trx.get(KEY, false).await?;
+
+        // make current transaction invalid by making conflict
+        make_dirty(db, KEY).await?;
+
+        trx.set(KEY, common::random_str(10).as_bytes());
+
+        // `Database::transact` will handle commit by itself, so returns without commit
+        Ok(())
+    }
+
+    let try_count = Arc::new(AtomicUsize::new(0));
+    let db = common::database().await?;
+    let res = db
+        .transact_boxed(
+            &db,
+            |trx, db| async_body(db, trx, try_count.clone()).boxed(),
+            TransactOption {
+                retry_limit: Some(5),
+                ..TransactOption::default()
+            },
+        )
+        .await;
+    assert!(res.is_err(), "should not be able to commit");
+
+    assert_eq!(try_count.load(Ordering::SeqCst), 5);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_transact_timeout() -> FdbResult<()> {
+    const KEY: &[u8] = b"test_transact_timeout";
+    async fn async_body(
+        db: &Database,
+        trx: &Transaction,
+        try_count0: Arc<AtomicUsize>,
+    ) -> FdbResult<()> {
+        // increment try counter
+        try_count0.fetch_add(1, Ordering::SeqCst);
+
+        // update conflict range
+        trx.get(KEY, false).await?;
+
+        // make current transaction invalid by making conflict
+        make_dirty(db, KEY).await?;
+
+        trx.set(KEY, common::random_str(10).as_bytes());
+
+        // `Database::transact` will handle commit by itself, so returns without commit
+        Ok(())
+    }
+
+    let try_count = Arc::new(AtomicUsize::new(0));
+    let db = common::database().await?;
+    let res = db
+        .transact_boxed(
+            &db,
+            |trx, db| async_body(db, trx, try_count.clone()).boxed(),
+            TransactOption {
+                time_out: Some(std::time::Duration::from_millis(250)),
+                ..TransactOption::default()
+            },
+        )
+        .await;
+    assert!(res.is_err(), "should not be able to commit");
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_versionstamp() -> FdbResult<()> {
+    const KEY: &[u8] = b"test_versionstamp";
+    let db = common::database().await?;
+
+    let trx = db.create_trx()?;
+    trx.set(KEY, common::random_str(10).as_bytes());
+    let f_version = trx.get_versionstamp();
+    trx.commit().await?;
+    f_version.await?;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_read_version() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    let trx = db.create_trx()?;
+    trx.get_read_version().await?;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_set_read_version() -> FdbResult<()> {
+    const KEY: &[u8] = b"test_set_read_version";
+    let db = common::database().await?;
+
+    let trx = db.create_trx()?;
+    trx.set_read_version(0);
+    assert!(trx.get(KEY, false).await.is_err());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_get_addresses_for_key() -> FdbResult<()> {
+    const KEY: &[u8] = b"test_get_addresses_for_key";
+
+    let db = common::database().await?;
+
+    let trx = db.create_trx()?;
+    trx.clear(KEY);
+    trx.commit().await?;
+
+    let trx = db.create_trx()?;
+    let addrs = trx.get_addresses_for_key(KEY).await?;
+    let mut it = addrs.iter();
+    let addr0 = it.next().unwrap();
+    eprintln!("{}", addr0.to_str().unwrap());
+    assert!(it.next().is_none());
+
+    Ok(())
+}
+
+#[cfg_api_versions(min = 610)]
+#[tokio::test]
+async fn test_metadata_version() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    let trx = db.create_trx()?;
+    trx.set_option(options::TransactionOption::AccessSystemKeys)?;
+    trx.update_metadata_version();
+    let commit_result = trx.commit().await.expect("could not commit");
+    let commit_version = commit_result.committed_version()?;
+    assert!(commit_version > 0, "transaction was read-only(-1)");
+
+    // second time, we should have the previous `commit_version`
+    let trx = db.create_trx()?;
+    trx.set_option(options::TransactionOption::ReadSystemKeys)?;
+    let metadata_version = trx
+        .get_metadata_version(false)
+        .await?
+        .expect("metadataVersion should be set by the previous transaction");
+    eprintln!("commit_version: {commit_version}, metadata_version: {metadata_version}");
+    assert_eq!(commit_version, metadata_version);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_set_raw_option() -> FdbResult<()> {
+    const KEY: &[u8] = b"test_set_raw_option_async";
+    const RETRY_COUNT: usize = 5;
+    async fn async_body(
+        db: &Database,
+        trx: &Transaction,
+        try_count0: Arc<AtomicUsize>,
+    ) -> FdbResult<()> {
+        // increment try counter
+        try_count0.fetch_add(1, Ordering::SeqCst);
+        let option = options::TransactionOption::RetryLimit(RETRY_COUNT as i32);
+        trx.set_raw_option(option.code(), Some(RETRY_COUNT.to_le_bytes().to_vec()))
+            .expect("failed to set retry limit");
+
+        // update conflict range
+        trx.get(KEY, false).await?;
+
+        // make current transaction invalid by making conflict
+        make_dirty(db, KEY).await?;
+
+        trx.set(KEY, common::random_str(10).as_bytes());
+
+        // `Database::transact` will handle commit by itself, so returns without commit
+        Ok(())
+    }
+
+    let try_count = Arc::new(AtomicUsize::new(0));
+    let db = common::database().await?;
+    let res = db
+        .transact_boxed(
+            &db,
+            |trx, db| async_body(db, trx, try_count.clone()).boxed(),
+            TransactOption::default(),
+        )
+        .await;
+    assert!(res.is_err(), "should not be able to commit");
+
+    // `TransactionOption::RetryCount` does not count first try, so `try_count` should be equal to
+    // `RETRY_COUNT+1`
+    assert_eq!(try_count.load(Ordering::SeqCst), RETRY_COUNT + 1);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_fails_to_set_unknown_raw_option() -> FdbResult<()> {
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+    let res = trx.set_raw_option(0, None);
+    assert!(res.is_err(), "should not be able to set option");
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/tests/hca.rs b/bindings/rust/foundationdb/tests/hca.rs
new file mode 100644
index 00000000000..402dd2e9e37
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/hca.rs
@@ -0,0 +1,95 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+use foundationdb::tuple::{Subspace, hca::HighContentionAllocator};
+use foundationdb::{FdbResult, TransactOption};
+use futures::prelude::*;
+use std::collections::HashSet;
+use std::iter::FromIterator;
+
+mod common;
+
+#[tokio::test]
+async fn test_hca_many_sequential_allocations() -> FdbResult<()> {
+    const N: usize = 1000;
+    // Not a byte-prefix of the concurrent test's subspace: both tests run in
+    // parallel and clear their own subspace range at startup.
+    const KEY: &[u8] = b"test-hca-seq";
+
+    let db = common::database().await?;
+
+    {
+        let tx = db.create_trx()?;
+        tx.clear_subspace_range(&Subspace::from_bytes(KEY));
+        tx.commit().await?;
+    }
+
+    let hca = HighContentionAllocator::new(Subspace::from_bytes(KEY));
+
+    let mut all_ints = Vec::new();
+
+    for _ in 0..N {
+        let tx = db.create_trx()?;
+
+        let next_int: i64 = hca
+            .allocate(&tx)
+            .await
+            .expect("could not allocate with HCA");
+        all_ints.push(next_int);
+
+        tx.commit().await?;
+    }
+
+    check_hca_result_uniqueness(&all_ints);
+
+    eprintln!("ran test {all_ints:?}");
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_hca_concurrent_allocations() -> FdbResult<()> {
+    const N: usize = 1000;
+    const KEY: &[u8] = b"test-hca-conc";
+
+    let db = common::database().await?;
+
+    {
+        let tx = db.create_trx()?;
+        tx.clear_subspace_range(&Subspace::from_bytes(KEY));
+        tx.commit().await?;
+    }
+
+    let hca = HighContentionAllocator::new(Subspace::from_bytes(KEY));
+
+    let all_ints: Vec<i64> = future::try_join_all((0..N).map(|_| {
+        db.transact_boxed(
+            &hca,
+            move |tx, hca| hca.allocate(tx).boxed(),
+            TransactOption::default(),
+        )
+    }))
+    .await
+    .unwrap();
+    check_hca_result_uniqueness(&all_ints);
+
+    eprintln!("ran test {all_ints:?}");
+
+    Ok(())
+}
+
+fn check_hca_result_uniqueness(results: &[i64]) {
+    let result_set: HashSet<i64> = HashSet::from_iter(results.to_owned());
+
+    if results.len() != result_set.len() {
+        panic!(
+            "Set size does not much, got duplicates from HCA. Set: {:?}, List: {:?}",
+            result_set.len(),
+            results.len(),
+        );
+    }
+}
diff --git a/bindings/rust/foundationdb/tests/leader_election_ranked_register.rs b/bindings/rust/foundationdb/tests/leader_election_ranked_register.rs
new file mode 100644
index 00000000000..27760d5112b
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/leader_election_ranked_register.rs
@@ -0,0 +1,1264 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://opensource.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT> or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+mod common;
+
+#[cfg(feature = "recipes-leader-election")]
+mod leader_election_tests {
+    use std::{
+        sync::{
+            Arc, Mutex,
+            atomic::{AtomicUsize, Ordering},
+        },
+        time::Duration,
+    };
+
+    use foundationdb::{
+        Database, FdbBindingError,
+        options::TransactionOption,
+        recipes::{
+            leader_election::{
+                LeaderElection, Leadership, LocalState, ParticipantId, PollOutcome, PollResult,
+                PollTransition, ResignOutcome,
+            },
+            ranked_register::{RankedRegister, RankedRegisterError, WriteResult},
+        },
+        tuple::Subspace,
+    };
+    use tokio::sync::Barrier;
+
+    fn participant(value: &str) -> ParticipantId {
+        ParticipantId::new(value).expect("test participant ID is valid")
+    }
+
+    fn register_error(error: RankedRegisterError) -> FdbBindingError {
+        FdbBindingError::new_custom_error(Box::new(error))
+    }
+
+    async fn setup_election(
+        db: &Database,
+        test_name: &str,
+        lease_duration: Duration,
+    ) -> Result<LeaderElection, FdbBindingError> {
+        let subspace = Subspace::all().subspace(&("leader_election_ranked_register", test_name));
+        let (begin, end) = subspace.range();
+        db.run(|txn, _| {
+            let begin = begin.clone();
+            let end = end.clone();
+            async move {
+                txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                txn.clear_range(&begin, &end);
+                Ok::<_, FdbBindingError>(())
+            }
+        })
+        .await?;
+        Ok(LeaderElection::new(subspace, lease_duration)?)
+    }
+
+    async fn setup_register(
+        db: &Database,
+        test_name: &str,
+    ) -> Result<RankedRegister, FdbBindingError> {
+        let subspace =
+            Subspace::all().subspace(&("leader_election_ranked_register_state", test_name));
+        let (begin, end) = subspace.range();
+        db.run(|txn, _| {
+            let begin = begin.clone();
+            let end = end.clone();
+            async move {
+                txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                txn.clear_range(&begin, &end);
+                Ok::<_, FdbBindingError>(())
+            }
+        })
+        .await?;
+        Ok(RankedRegister::new(subspace))
+    }
+
+    struct CompletedPoll {
+        result: PollResult,
+        next_state: LocalState,
+    }
+
+    #[derive(Clone)]
+    struct TestTime(Arc<Mutex<Duration>>);
+
+    impl TestTime {
+        fn new(now: Duration) -> Self {
+            Self(Arc::new(Mutex::new(now)))
+        }
+
+        fn monotonic(&self) -> Duration {
+            *self
+                .0
+                .lock()
+                .expect("test clock mutex must not be poisoned")
+        }
+
+        fn set(&self, now: Duration) {
+            *self
+                .0
+                .lock()
+                .expect("test clock mutex must not be poisoned") = now;
+        }
+    }
+
+    async fn poll(
+        db: &Database,
+        election: &LeaderElection,
+        participant: &ParticipantId,
+        local_state: &LocalState,
+        attempt_started_at: Duration,
+        adopted_at: Duration,
+    ) -> Result<CompletedPoll, FdbBindingError> {
+        let election = election.clone();
+        let participant = participant.clone();
+        let local_state = local_state.clone();
+        let time = TestTime::new(attempt_started_at);
+        db.run(|txn, _| {
+            let election = election.clone();
+            let participant = participant.clone();
+            let local_state = local_state.clone();
+            let time = time.clone();
+            async move {
+                txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                let attempt_started_at = time.monotonic();
+                Ok::<_, FdbBindingError>(
+                    election
+                        .poll(&txn, &participant, &local_state, attempt_started_at)
+                        .await?,
+                )
+            }
+        })
+        .await
+        .map(|result| {
+            time.set(adopted_at);
+            CompletedPoll {
+                next_state: result.clone().into_next_state(time.monotonic()),
+                result,
+            }
+        })
+    }
+
+    async fn state(
+        db: &Database,
+        election: &LeaderElection,
+    ) -> Result<foundationdb::recipes::leader_election::ElectionState, FdbBindingError> {
+        let election = election.clone();
+        db.run(|txn, _| {
+            let election = election.clone();
+            async move {
+                txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                Ok::<_, FdbBindingError>(election.state(&txn).await?)
+            }
+        })
+        .await
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    async fn service_poll(
+        db: &Database,
+        election: &LeaderElection,
+        register: &RankedRegister,
+        participant: &ParticipantId,
+        local_state: &LocalState,
+        attempt_started_at: Duration,
+        adopted_at: Duration,
+        value: &[u8],
+    ) -> Result<(CompletedPoll, Option<WriteResult>), FdbBindingError> {
+        let election = election.clone();
+        let register = register.clone();
+        let participant = participant.clone();
+        let local_state = local_state.clone();
+        let value = value.to_vec();
+        let time = TestTime::new(attempt_started_at);
+        db.run(|txn, _| {
+            let election = election.clone();
+            let register = register.clone();
+            let participant = participant.clone();
+            let local_state = local_state.clone();
+            let value = value.clone();
+            let time = time.clone();
+            async move {
+                txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                let attempt_started_at = time.monotonic();
+                let result = election
+                    .poll(&txn, &participant, &local_state, attempt_started_at)
+                    .await?;
+                let write = if let PollOutcome::Leader { rank, .. } = result.outcome() {
+                    register.read(&txn, *rank).await.map_err(register_error)?;
+                    Some(
+                        register
+                            .write(&txn, *rank, &value)
+                            .await
+                            .map_err(register_error)?,
+                    )
+                } else {
+                    None
+                };
+                Ok::<_, FdbBindingError>((result, write))
+            }
+        })
+        .await
+        .map(|(result, write)| {
+            time.set(adopted_at);
+            (
+                CompletedPoll {
+                    next_state: result.clone().into_next_state(time.monotonic()),
+                    result,
+                },
+                write,
+            )
+        })
+    }
+
+    fn leadership(state: &LocalState) -> Leadership {
+        state
+            .leadership()
+            .expect("leader result carries a leadership token")
+            .clone()
+    }
+
+    #[tokio::test]
+    async fn zero_duration_constructor_is_rejected() {
+        let subspace = Subspace::all().subspace(&("leader_election_ranked_register", "zero"));
+        assert!(LeaderElection::new(subspace, Duration::ZERO).is_err());
+    }
+
+    #[tokio::test]
+    async fn vacant_state_is_acquired_immediately() -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let election = setup_election(&db, "vacant", Duration::from_secs(5)).await?;
+        let alice = participant("alice-vacant");
+
+        let result = poll(
+            &db,
+            &election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        assert!(result.result.outcome().is_leader());
+        assert_eq!(
+            result.result.outcome().transition(),
+            PollTransition::Acquired
+        );
+        assert_eq!(result.result.outcome().rank().as_u64(), 1);
+        assert_eq!(
+            leadership(&result.next_state).lease_duration(),
+            Duration::from_secs(5)
+        );
+
+        let durable = state(&db, &election).await?;
+        assert_eq!(durable.owner(), Some(&alice));
+        assert_eq!(durable.rank().as_u64(), 1);
+        assert_eq!(durable.lease_duration(), Some(Duration::from_secs(5)));
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn exact_unexpired_renewal_publishes_fresh_rank_and_duration()
+    -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let initial = setup_election(&db, "renewal", Duration::from_secs(5)).await?;
+        let renewal = LeaderElection::new(
+            Subspace::all().subspace(&("leader_election_ranked_register", "renewal")),
+            Duration::from_secs(9),
+        )?;
+        let alice = participant("alice-renewal");
+        let acquired = poll(
+            &db,
+            &initial,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+
+        let renewed = poll(
+            &db,
+            &renewal,
+            &alice,
+            &acquired.next_state,
+            Duration::from_secs(1),
+            Duration::from_secs(1),
+        )
+        .await?;
+        assert_eq!(
+            renewed.result.outcome().transition(),
+            PollTransition::Renewed
+        );
+        assert_eq!(renewed.result.outcome().rank().as_u64(), 2);
+        assert_eq!(
+            leadership(&renewed.next_state).lease_duration(),
+            Duration::from_secs(9)
+        );
+
+        let durable = state(&db, &renewal).await?;
+        assert_eq!(durable.owner(), Some(&alice));
+        assert_eq!(durable.rank().as_u64(), 2);
+        assert_eq!(durable.lease_duration(), Some(Duration::from_secs(9)));
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn first_foreign_observation_cannot_steal() -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let election = setup_election(&db, "foreign_observation", Duration::from_secs(5)).await?;
+        let alice = participant("alice-foreign");
+        let bob = participant("bob-foreign");
+        poll(
+            &db,
+            &election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+
+        let observed = poll(
+            &db,
+            &election,
+            &bob,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        assert!(!observed.result.outcome().is_leader());
+        assert_eq!(
+            observed.result.outcome().transition(),
+            PollTransition::Followed
+        );
+        assert_eq!(
+            observed.result.outcome().lease_duration(),
+            Some(Duration::from_secs(5))
+        );
+        assert!(observed.next_state.observation().is_some());
+
+        let durable = state(&db, &election).await?;
+        assert_eq!(durable.owner(), Some(&alice));
+        assert_eq!(durable.rank().as_u64(), 1);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn takeover_requires_exact_unchanged_observation_and_persisted_duration()
+    -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let alice_election = setup_election(&db, "takeover", Duration::from_secs(5)).await?;
+        let bob_election = LeaderElection::new(
+            Subspace::all().subspace(&("leader_election_ranked_register", "takeover")),
+            Duration::from_secs(3),
+        )?;
+        let alice = participant("alice-takeover");
+        let bob = participant("bob-takeover");
+        poll(
+            &db,
+            &alice_election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        let observed = poll(
+            &db,
+            &bob_election,
+            &bob,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+
+        let early = poll(
+            &db,
+            &bob_election,
+            &bob,
+            &observed.next_state,
+            Duration::from_secs(4),
+            Duration::from_secs(4),
+        )
+        .await?;
+        assert!(!early.result.outcome().is_leader());
+
+        let takeover = poll(
+            &db,
+            &bob_election,
+            &bob,
+            &early.next_state,
+            Duration::from_secs(5),
+            Duration::from_secs(5),
+        )
+        .await?;
+        assert!(takeover.result.outcome().is_leader());
+        assert_eq!(
+            takeover.result.outcome().transition(),
+            PollTransition::TookOver
+        );
+        assert_eq!(takeover.result.outcome().rank().as_u64(), 2);
+        assert_eq!(
+            leadership(&takeover.next_state).lease_duration(),
+            Duration::from_secs(3)
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn delayed_read_does_not_age_a_new_observation() -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let election = setup_election(&db, "delayed_observation", Duration::from_secs(5)).await?;
+        let alice = participant("alice-delayed-observation");
+        let bob = participant("bob-delayed-observation");
+        poll(
+            &db,
+            &election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+
+        let observed = poll(
+            &db,
+            &election,
+            &bob,
+            &LocalState::unknown(),
+            Duration::from_secs(1),
+            Duration::from_secs(100),
+        )
+        .await?;
+        assert_eq!(
+            observed
+                .next_state
+                .observation()
+                .expect("follower result carries an observation")
+                .first_observed_at(),
+            Duration::from_secs(100)
+        );
+
+        let early = poll(
+            &db,
+            &election,
+            &bob,
+            &observed.next_state,
+            Duration::from_secs(104),
+            Duration::from_secs(104),
+        )
+        .await?;
+        assert!(!early.result.outcome().is_leader());
+
+        let takeover = poll(
+            &db,
+            &election,
+            &bob,
+            &early.next_state,
+            Duration::from_secs(105),
+            Duration::from_secs(105),
+        )
+        .await?;
+        assert_eq!(
+            takeover.result.outcome().transition(),
+            PollTransition::TookOver
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn leadership_expires_from_attempt_start_not_later_adoption()
+    -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let election =
+            setup_election(&db, "leadership_attempt_start", Duration::from_secs(5)).await?;
+        let alice = participant("alice-leadership-attempt-start");
+
+        let acquired = poll(
+            &db,
+            &election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::from_secs(100),
+        )
+        .await?;
+        assert_eq!(
+            leadership(&acquired.next_state).last_renewed_at(),
+            Duration::ZERO
+        );
+
+        let expired = poll(
+            &db,
+            &election,
+            &alice,
+            &acquired.next_state,
+            Duration::from_secs(100),
+            Duration::from_secs(100),
+        )
+        .await?;
+        assert!(!expired.result.outcome().is_leader());
+        assert_eq!(
+            expired.result.outcome().transition(),
+            PollTransition::Followed
+        );
+        assert_eq!(expired.result.outcome().owner(), Some(&alice));
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn changed_revision_resets_observation() -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let election = setup_election(&db, "observation_reset", Duration::from_secs(5)).await?;
+        let alice = participant("alice-reset");
+        let bob = participant("bob-reset");
+        let acquired = poll(
+            &db,
+            &election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        let observed = poll(
+            &db,
+            &election,
+            &bob,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        let renewed = poll(
+            &db,
+            &election,
+            &alice,
+            &acquired.next_state,
+            Duration::from_secs(1),
+            Duration::from_secs(1),
+        )
+        .await?;
+        assert_eq!(renewed.result.outcome().rank().as_u64(), 2);
+
+        let reset = poll(
+            &db,
+            &election,
+            &bob,
+            &observed.next_state,
+            Duration::from_secs(10),
+            Duration::from_secs(10),
+        )
+        .await?;
+        assert!(!reset.result.outcome().is_leader());
+        let reset_observation = reset.next_state.observation().expect("observation reset");
+        assert_eq!(reset_observation.rank().as_u64(), 2);
+        assert_eq!(
+            reset_observation.first_observed_at(),
+            Duration::from_secs(10)
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn shorter_local_duration_honors_incumbent_persisted_duration()
+    -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let alice_election =
+            setup_election(&db, "persisted_duration", Duration::from_secs(10)).await?;
+        let bob_election = LeaderElection::new(
+            Subspace::all().subspace(&("leader_election_ranked_register", "persisted_duration")),
+            Duration::from_secs(1),
+        )?;
+        let alice = participant("alice-duration");
+        let bob = participant("bob-duration");
+        poll(
+            &db,
+            &alice_election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        let observed = poll(
+            &db,
+            &bob_election,
+            &bob,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+
+        let early = poll(
+            &db,
+            &bob_election,
+            &bob,
+            &observed.next_state,
+            Duration::from_secs(1),
+            Duration::from_secs(1),
+        )
+        .await?;
+        assert!(!early.result.outcome().is_leader());
+        assert_eq!(
+            early.result.outcome().lease_duration(),
+            Some(Duration::from_secs(10))
+        );
+
+        let takeover = poll(
+            &db,
+            &bob_election,
+            &bob,
+            &early.next_state,
+            Duration::from_secs(10),
+            Duration::from_secs(10),
+        )
+        .await?;
+        assert_eq!(
+            takeover.result.outcome().transition(),
+            PollTransition::TookOver
+        );
+        assert_eq!(
+            leadership(&takeover.next_state).lease_duration(),
+            Duration::from_secs(1)
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn expired_same_owner_first_observes_then_reacquires() -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let election = setup_election(&db, "reacquisition", Duration::from_secs(5)).await?;
+        let alice = participant("alice-reacquisition");
+        let acquired = poll(
+            &db,
+            &election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+
+        let expired = poll(
+            &db,
+            &election,
+            &alice,
+            &acquired.next_state,
+            Duration::from_secs(5),
+            Duration::from_secs(5),
+        )
+        .await?;
+        assert!(!expired.result.outcome().is_leader());
+        assert_eq!(
+            expired.result.outcome().transition(),
+            PollTransition::Followed
+        );
+        assert_eq!(expired.result.outcome().owner(), Some(&alice));
+
+        let reacquired = poll(
+            &db,
+            &election,
+            &alice,
+            &expired.next_state,
+            Duration::from_secs(10),
+            Duration::from_secs(10),
+        )
+        .await?;
+        assert!(reacquired.result.outcome().is_leader());
+        assert_eq!(
+            reacquired.result.outcome().transition(),
+            PollTransition::Reacquired
+        );
+        assert_eq!(reacquired.result.outcome().rank().as_u64(), 2);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn stale_renewal_token_cannot_change_state() -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let election = setup_election(&db, "stale_renewal", Duration::from_secs(5)).await?;
+        let alice = participant("alice-stale-renewal");
+        let acquired = poll(
+            &db,
+            &election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        let renewed = poll(
+            &db,
+            &election,
+            &alice,
+            &acquired.next_state,
+            Duration::from_secs(1),
+            Duration::from_secs(1),
+        )
+        .await?;
+        assert_eq!(renewed.result.outcome().rank().as_u64(), 2);
+
+        let stale = poll(
+            &db,
+            &election,
+            &alice,
+            &acquired.next_state,
+            Duration::from_secs(2),
+            Duration::from_secs(2),
+        )
+        .await?;
+        assert!(!stale.result.outcome().is_leader());
+        assert_eq!(stale.result.outcome().rank().as_u64(), 2);
+        let durable = state(&db, &election).await?;
+        assert_eq!(durable.owner(), Some(&alice));
+        assert_eq!(durable.rank().as_u64(), 2);
+
+        let election_for_resign = election.clone();
+        let renewed_token = leadership(&renewed.next_state);
+        let resigned = db
+            .run(|txn, _| {
+                let election = election_for_resign.clone();
+                let token = renewed_token.clone();
+                async move {
+                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                    Ok::<_, FdbBindingError>(election.resign(&txn, &token).await?)
+                }
+            })
+            .await?;
+        assert_eq!(resigned, ResignOutcome::Resigned);
+
+        let reacquired_from_stale = poll(
+            &db,
+            &election,
+            &alice,
+            &acquired.next_state,
+            Duration::from_secs(3),
+            Duration::from_secs(3),
+        )
+        .await?;
+        assert!(reacquired_from_stale.result.outcome().is_leader());
+        assert_eq!(
+            reacquired_from_stale.result.outcome().transition(),
+            PollTransition::Acquired
+        );
+        assert_eq!(reacquired_from_stale.result.outcome().rank().as_u64(), 3);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn exact_resignation_preserves_rank_and_duration_and_stale_is_rejected()
+    -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let alice_election = setup_election(&db, "resignation", Duration::from_secs(5)).await?;
+        let bob_election = LeaderElection::new(
+            Subspace::all().subspace(&("leader_election_ranked_register", "resignation")),
+            Duration::from_secs(3),
+        )?;
+        let alice = participant("alice-resignation");
+        let bob = participant("bob-resignation");
+        let acquired = poll(
+            &db,
+            &alice_election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        let alice_token = leadership(&acquired.next_state);
+
+        let election = alice_election.clone();
+        let token = alice_token.clone();
+        let resigned = db
+            .run(|txn, _| {
+                let election = election.clone();
+                let token = token.clone();
+                async move {
+                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                    Ok::<_, FdbBindingError>(election.resign(&txn, &token).await?)
+                }
+            })
+            .await?;
+        assert_eq!(resigned, ResignOutcome::Resigned);
+        let released = state(&db, &alice_election).await?;
+        assert_eq!(released.owner(), None);
+        assert_eq!(released.rank().as_u64(), 1);
+        assert_eq!(released.lease_duration(), Some(Duration::from_secs(5)));
+
+        let _bob_acquired = poll(
+            &db,
+            &bob_election,
+            &bob,
+            &LocalState::unknown(),
+            Duration::from_secs(1),
+            Duration::from_secs(1),
+        )
+        .await?;
+        let stale_election = alice_election.clone();
+        let stale_token = alice_token.clone();
+        let stale = db
+            .run(|txn, _| {
+                let election = stale_election.clone();
+                let token = stale_token.clone();
+                async move {
+                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                    Ok::<_, FdbBindingError>(election.resign(&txn, &token).await?)
+                }
+            })
+            .await?;
+        assert_eq!(stale, ResignOutcome::Rejected);
+        let durable = state(&db, &bob_election).await?;
+        assert_eq!(durable.owner(), Some(&bob));
+        assert_eq!(durable.rank().as_u64(), 2);
+        assert_eq!(durable.lease_duration(), Some(Duration::from_secs(3)));
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn takeover_conflicting_with_resignation_retries_safely() -> Result<(), FdbBindingError> {
+        let db = Arc::new(crate::common::database().await?);
+        let election = setup_election(&db, "resign_conflict", Duration::from_secs(5)).await?;
+        let alice = participant("alice-resign-conflict");
+        let bob = participant("bob-resign-conflict");
+        let acquired = poll(
+            &db,
+            &election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        let observed = poll(
+            &db,
+            &election,
+            &bob,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        let alice_token = leadership(&acquired.next_state);
+
+        let staged = Arc::new(Barrier::new(2));
+        let release = Arc::new(Barrier::new(2));
+        let attempts = Arc::new(AtomicUsize::new(0));
+        let resignation_db = db.clone();
+        let resignation_election = election.clone();
+        let resignation_token = alice_token.clone();
+        let resignation_staged = staged.clone();
+        let resignation_release = release.clone();
+        let resignation_attempts = attempts.clone();
+        let resignation = tokio::spawn(async move {
+            resignation_db
+                .run(|txn, _| {
+                    let election = resignation_election.clone();
+                    let token = resignation_token.clone();
+                    let staged = resignation_staged.clone();
+                    let release = resignation_release.clone();
+                    let first_attempt = resignation_attempts.fetch_add(1, Ordering::SeqCst) == 0;
+                    async move {
+                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                        let outcome = election.resign(&txn, &token).await?;
+                        if first_attempt {
+                            staged.wait().await;
+                            release.wait().await;
+                        }
+                        Ok::<_, FdbBindingError>(outcome)
+                    }
+                })
+                .await
+        });
+
+        staged.wait().await;
+        let takeover = poll(
+            &db,
+            &election,
+            &bob,
+            &observed.next_state,
+            Duration::from_secs(5),
+            Duration::from_secs(5),
+        )
+        .await?;
+        assert_eq!(
+            takeover.result.outcome().transition(),
+            PollTransition::TookOver
+        );
+        release.wait().await;
+
+        assert_eq!(
+            resignation
+                .await
+                .expect("resignation task must not panic")?,
+            ResignOutcome::Rejected
+        );
+        assert!(attempts.load(Ordering::SeqCst) >= 2);
+        let durable = state(&db, &election).await?;
+        assert_eq!(durable.owner(), Some(&bob));
+        assert_eq!(durable.rank().as_u64(), 2);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn concurrent_unknown_polls_acquire_exactly_once() -> Result<(), FdbBindingError> {
+        let db = Arc::new(crate::common::database().await?);
+        let election = setup_election(&db, "concurrent_unknown", Duration::from_secs(5)).await?;
+        let alice = participant("alice-concurrent-unknown");
+        let bob = participant("bob-concurrent-unknown");
+        let staged = Arc::new(Barrier::new(3));
+        let alice_attempts = Arc::new(AtomicUsize::new(0));
+        let bob_attempts = Arc::new(AtomicUsize::new(0));
+
+        let alice_poll = {
+            let db = db.clone();
+            let election = election.clone();
+            let participant = alice.clone();
+            let staged = staged.clone();
+            let attempts = alice_attempts.clone();
+            tokio::spawn(async move {
+                db.run(|txn, _| {
+                    let election = election.clone();
+                    let participant = participant.clone();
+                    let staged = staged.clone();
+                    let first_attempt = attempts.fetch_add(1, Ordering::SeqCst) == 0;
+                    async move {
+                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                        let result = election
+                            .poll(&txn, &participant, &LocalState::unknown(), Duration::ZERO)
+                            .await?;
+                        if first_attempt {
+                            staged.wait().await;
+                        }
+                        Ok::<_, FdbBindingError>(result)
+                    }
+                })
+                .await
+            })
+        };
+        let bob_poll = {
+            let db = db.clone();
+            let election = election.clone();
+            let participant = bob.clone();
+            let staged = staged.clone();
+            let attempts = bob_attempts.clone();
+            tokio::spawn(async move {
+                db.run(|txn, _| {
+                    let election = election.clone();
+                    let participant = participant.clone();
+                    let staged = staged.clone();
+                    let first_attempt = attempts.fetch_add(1, Ordering::SeqCst) == 0;
+                    async move {
+                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                        let result = election
+                            .poll(&txn, &participant, &LocalState::unknown(), Duration::ZERO)
+                            .await?;
+                        if first_attempt {
+                            staged.wait().await;
+                        }
+                        Ok::<_, FdbBindingError>(result)
+                    }
+                })
+                .await
+            })
+        };
+
+        staged.wait().await;
+        let alice_result = alice_poll.await.expect("alice task must not panic")?;
+        let bob_result = bob_poll.await.expect("bob task must not panic")?;
+        let acquired = [(&alice, &alice_result), (&bob, &bob_result)]
+            .into_iter()
+            .find_map(|(participant, result)| {
+                (result.outcome().transition() == PollTransition::Acquired).then_some(participant)
+            })
+            .expect("one concurrent unknown poll must acquire");
+
+        assert_eq!(
+            [alice_result.outcome(), bob_result.outcome()]
+                .into_iter()
+                .filter(|outcome| outcome.transition() == PollTransition::Acquired)
+                .count(),
+            1
+        );
+        assert_eq!(
+            [alice_result.outcome(), bob_result.outcome()]
+                .into_iter()
+                .filter(|outcome| outcome.transition() == PollTransition::Followed)
+                .count(),
+            1
+        );
+        assert!(
+            alice_attempts.load(Ordering::SeqCst) >= 2 || bob_attempts.load(Ordering::SeqCst) >= 2,
+            "one conflicting poll must retry"
+        );
+        let durable = state(&db, &election).await?;
+        assert_eq!(durable.owner(), Some(acquired));
+        assert_eq!(durable.rank().as_u64(), 1);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn retried_poll_adopts_only_committed_attempt_result() -> Result<(), FdbBindingError> {
+        let db = Arc::new(crate::common::database().await?);
+        let election = setup_election(&db, "retry_adoption", Duration::from_secs(5)).await?;
+        let alice = participant("alice-retry-adoption");
+        let bob = participant("bob-retry-adoption");
+        let acquired = poll(
+            &db,
+            &election,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+        let staged = Arc::new(Barrier::new(2));
+        let release = Arc::new(Barrier::new(2));
+        let attempts = Arc::new(AtomicUsize::new(0));
+        let time = TestTime::new(Duration::ZERO);
+        let bob_poll = {
+            let db = db.clone();
+            let election = election.clone();
+            let participant = bob.clone();
+            let staged = staged.clone();
+            let release = release.clone();
+            let attempts = attempts.clone();
+            let time = time.clone();
+            tokio::spawn(async move {
+                db.run(|txn, _| {
+                    let election = election.clone();
+                    let participant = participant.clone();
+                    let staged = staged.clone();
+                    let release = release.clone();
+                    let first_attempt = attempts.fetch_add(1, Ordering::SeqCst) == 0;
+                    let time = time.clone();
+                    async move {
+                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                        let result = election
+                            .poll(&txn, &participant, &LocalState::unknown(), time.monotonic())
+                            .await?;
+                        // A read-only transaction does not conflict-check its election read at
+                        // commit. This isolated marker makes the staged attempt a write
+                        // transaction, so Alice's renewal deterministically forces its retry.
+                        txn.set(
+                            b"leader_election_ranked_register/retry_adoption_marker",
+                            b"",
+                        );
+                        if first_attempt {
+                            staged.wait().await;
+                            release.wait().await;
+                        }
+                        Ok::<_, FdbBindingError>(result)
+                    }
+                })
+                .await
+            })
+        };
+
+        staged.wait().await;
+        let renewed = poll(
+            &db,
+            &election,
+            &alice,
+            &acquired.next_state,
+            Duration::from_secs(1),
+            Duration::from_secs(1),
+        )
+        .await?;
+        assert_eq!(renewed.result.outcome().rank().as_u64(), 2);
+        time.set(Duration::from_secs(10));
+        release.wait().await;
+
+        let result = bob_poll.await.expect("bob task must not panic")?;
+        assert!(attempts.load(Ordering::SeqCst) >= 2);
+        assert_eq!(result.outcome().transition(), PollTransition::Followed);
+        assert_eq!(result.outcome().rank().as_u64(), 2);
+        let next_state = result.into_next_state(time.monotonic());
+        let observation = next_state
+            .observation()
+            .expect("the committed retry must produce an observation");
+        assert_eq!(observation.rank().as_u64(), 2);
+        assert_eq!(observation.first_observed_at(), Duration::from_secs(10));
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn leader_poll_fences_ranked_register_and_stale_rank_is_rejected()
+    -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let alice_election = setup_election(&db, "ranked_register", Duration::from_secs(5)).await?;
+        let bob_election = LeaderElection::new(
+            Subspace::all().subspace(&("leader_election_ranked_register", "ranked_register")),
+            Duration::from_secs(5),
+        )?;
+        let register = setup_register(&db, "ranked_register").await?;
+        let alice = participant("alice-register");
+        let bob = participant("bob-register");
+
+        let (first, first_write) = service_poll(
+            &db,
+            &alice_election,
+            &register,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+            b"alice",
+        )
+        .await?;
+        assert_eq!(
+            first.result.outcome().transition(),
+            PollTransition::Acquired
+        );
+        assert_eq!(first_write, Some(WriteResult::Committed));
+        let observed = poll(
+            &db,
+            &bob_election,
+            &bob,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+        )
+        .await?;
+
+        let (takeover, takeover_write) = service_poll(
+            &db,
+            &bob_election,
+            &register,
+            &bob,
+            &observed.next_state,
+            Duration::from_secs(5),
+            Duration::from_secs(5),
+            b"bob",
+        )
+        .await?;
+        assert_eq!(
+            takeover.result.outcome().transition(),
+            PollTransition::TookOver
+        );
+        assert_eq!(takeover_write, Some(WriteResult::Committed));
+        assert!(takeover.result.outcome().rank() > first.result.outcome().rank());
+
+        let stale_rank = first.result.outcome().rank();
+        let register_ref = register.clone();
+        let stale_write = db
+            .run(|txn, _| {
+                let register = register_ref.clone();
+                async move {
+                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                    register
+                        .write(&txn, stale_rank, b"stale")
+                        .await
+                        .map_err(register_error)
+                }
+            })
+            .await?;
+        assert_eq!(stale_write, WriteResult::Aborted);
+
+        let register_ref = register.clone();
+        let current_rank = takeover.result.outcome().rank();
+        let (write_rank, value) = db
+            .run(|txn, _| {
+                let register = register_ref.clone();
+                async move {
+                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                    let read = register
+                        .read(&txn, current_rank)
+                        .await
+                        .map_err(register_error)?;
+                    Ok::<_, FdbBindingError>((read.write_rank(), read.into_value()))
+                }
+            })
+            .await?;
+        assert_eq!(write_rank, current_rank);
+        assert_eq!(value.as_deref(), Some(b"bob".as_slice()));
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn same_participant_renewal_self_fences_old_rank_writes() -> Result<(), FdbBindingError> {
+        let db = crate::common::database().await?;
+        let election = setup_election(&db, "self_fencing", Duration::from_secs(5)).await?;
+        let register = setup_register(&db, "self_fencing").await?;
+        let alice = participant("alice-self-fencing");
+
+        let (acquired, acquired_write) = service_poll(
+            &db,
+            &election,
+            &register,
+            &alice,
+            &LocalState::unknown(),
+            Duration::ZERO,
+            Duration::ZERO,
+            b"rank-one",
+        )
+        .await?;
+        assert_eq!(
+            acquired.result.outcome().transition(),
+            PollTransition::Acquired
+        );
+        assert_eq!(acquired_write, Some(WriteResult::Committed));
+
+        let (renewed, renewed_write) = service_poll(
+            &db,
+            &election,
+            &register,
+            &alice,
+            &acquired.next_state,
+            Duration::from_secs(1),
+            Duration::from_secs(1),
+            b"rank-two",
+        )
+        .await?;
+        assert_eq!(
+            renewed.result.outcome().transition(),
+            PollTransition::Renewed
+        );
+        assert_eq!(renewed_write, Some(WriteResult::Committed));
+        assert_eq!(renewed.result.outcome().rank().as_u64(), 2);
+
+        let stale_rank = acquired.result.outcome().rank();
+        let register_ref = register.clone();
+        let stale_write = db
+            .run(|txn, _| {
+                let register = register_ref.clone();
+                async move {
+                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                    register
+                        .write(&txn, stale_rank, b"stale")
+                        .await
+                        .map_err(register_error)
+                }
+            })
+            .await?;
+        assert_eq!(stale_write, WriteResult::Aborted);
+
+        let register_ref = register.clone();
+        let current_rank = renewed.result.outcome().rank();
+        let (write_rank, value) = db
+            .run(|txn, _| {
+                let register = register_ref.clone();
+                async move {
+                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                    let read = register
+                        .read(&txn, current_rank)
+                        .await
+                        .map_err(register_error)?;
+                    Ok::<_, FdbBindingError>((read.write_rank(), read.into_value()))
+                }
+            })
+            .await?;
+        assert_eq!(write_rank, current_rank);
+        assert_eq!(value.as_deref(), Some(b"rank-two".as_slice()));
+        Ok(())
+    }
+}
diff --git a/bindings/rust/foundationdb/tests/metrics.rs b/bindings/rust/foundationdb/tests/metrics.rs
new file mode 100644
index 00000000000..0cb22c34268
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/metrics.rs
@@ -0,0 +1,603 @@
+use foundationdb::metrics::{AttemptOutcome, MetricKey, TransactionMetrics};
+use foundationdb::runner::MetricsHooks;
+use foundationdb::*;
+mod common;
+use std::borrow::Cow;
+use std::sync::{Arc, Mutex};
+
+/// Tests a successful transaction using `instrumented_run`.
+///
+/// A run without retry reports exactly one attempt, holding the operations of
+/// the transaction and ending as committed.
+#[tokio::test]
+async fn instrumented_run_success() -> FdbResult<()> {
+    const KEY: &[u8] = b"test_metrics_success";
+    const VALUE: &[u8] = b"value";
+    const SUCCESS: u64 = 42;
+
+    let db = common::database().await?;
+
+    let (result, metrics) = db
+        .instrumented_run(|txn, _| async move {
+            txn.set(KEY, VALUE);
+            Ok::<_, FdbBindingError>(SUCCESS)
+        })
+        .await
+        .expect("transaction should succeed");
+
+    assert_eq!(result, SUCCESS);
+
+    assert_eq!(metrics.attempts.len(), 1);
+    let attempt = &metrics.attempts[0];
+    assert_eq!(attempt.index, 0);
+    assert_eq!(attempt.usage.call_set, 1);
+    assert_eq!(
+        attempt.usage.bytes_written,
+        (KEY.len() + VALUE.len()) as u64
+    );
+    assert!(matches!(attempt.outcome, AttemptOutcome::Committed));
+    assert!(attempt.commit_duration.is_some());
+    assert!(attempt.grv_duration.is_none());
+    assert!(attempt.on_error_duration.is_none());
+
+    let total = metrics.total_usage();
+    assert_eq!(total.call_set, 1);
+    assert_eq!(total.bytes_written, (KEY.len() + VALUE.len()) as u64);
+
+    assert_eq!(metrics.transaction.retries, 0);
+    assert!(metrics.total_duration.is_some());
+
+    Ok(())
+}
+
+/// Tests the retry mechanism of `instrumented_run`.
+///
+/// A forced retryable error gives one attempt per try: every attempt keeps its
+/// own counters and custom metrics instead of being wiped by the next one, and
+/// only the last one is committed.
+#[tokio::test]
+async fn instrumented_run_with_n_retries() -> FdbResult<()> {
+    const KEY: &[u8] = b"test_metrics_retry";
+    const VALUE: &[u8] = b"value";
+    const SUCCESS: u64 = 42;
+
+    // Number of retries we want to force
+    const EXPECTED_RETRIES: u64 = 3;
+
+    let db = common::database().await?;
+
+    // Use Arc<Mutex<>> to share and modify the counter across async calls
+    let attempt_counter = Arc::new(Mutex::new(0u64));
+
+    let (result, metrics) = db
+        .instrumented_run(|txn, _| {
+            let counter = attempt_counter.clone();
+            async move {
+                // Set a key to verify metrics
+                txn.set(KEY, VALUE);
+
+                // Increment the counter and check if we should still fail
+                let mut attempts = counter.lock().unwrap();
+                *attempts += 1;
+
+                // Each attempt tags itself, so a wiped attempt would show up.
+                txn.set_custom_metric("attempt_number", *attempts, &[("kind", "forced")]);
+
+                if *attempts <= EXPECTED_RETRIES {
+                    // Return a retryable error (not_committed) for the first N attempts
+                    Err(FdbBindingError::from(FdbError::from_code(1020)))
+                } else {
+                    // Succeed on attempt N+1
+                    Ok(SUCCESS)
+                }
+            }
+        })
+        .await
+        .expect("transaction should succeed after retries");
+
+    assert_eq!(result, SUCCESS);
+
+    // One attempt per try, nothing lost across the retries.
+    assert_eq!(metrics.attempts.len(), EXPECTED_RETRIES as usize + 1);
+    assert_eq!(metrics.transaction.retries, EXPECTED_RETRIES);
+
+    let custom_key = MetricKey::new("attempt_number", &[("kind", "forced")]);
+    for (index, attempt) in metrics.attempts.iter().enumerate() {
+        assert_eq!(attempt.index, index);
+
+        // The per-attempt usage is retained, not wiped by the following attempt.
+        assert_eq!(attempt.usage.call_set, 1, "attempt {index}");
+        assert_eq!(
+            attempt.usage.bytes_written,
+            (KEY.len() + VALUE.len()) as u64,
+            "attempt {index}"
+        );
+        assert_eq!(
+            attempt.custom_metrics.get(&custom_key).copied(),
+            Some(index as u64 + 1),
+            "attempt {index}"
+        );
+
+        let is_last = index == EXPECTED_RETRIES as usize;
+        match (&attempt.outcome, is_last) {
+            (AttemptOutcome::Committed, true) => {}
+            (AttemptOutcome::Retried { cause }, false) => {
+                assert_eq!(cause.code(), 1020, "attempt {index}");
+                assert!(
+                    attempt.on_error_duration.is_some(),
+                    "attempt {index} went through on_error"
+                );
+            }
+            (outcome, _) => panic!("unexpected outcome for attempt {index}: {outcome:?}"),
+        }
+    }
+
+    // Totals are the sum of the attempts.
+    let total = metrics.total_usage();
+    assert_eq!(total.call_set, EXPECTED_RETRIES + 1);
+    assert_eq!(
+        total.bytes_written,
+        (EXPECTED_RETRIES + 1) * (KEY.len() + VALUE.len()) as u64
+    );
+
+    // Verify the counter
+    let final_attempts = *attempt_counter.lock().unwrap();
+    assert_eq!(final_attempts, EXPECTED_RETRIES + 1);
+
+    Ok(())
+}
+
+/// Performs a comprehensive test of all counter metrics.
+///
+/// This test executes a single transaction that performs a variety of operations:
+/// - Multiple `SET` operations
+/// - A `GET` operation
+/// - A `GET_RANGE` operation
+/// - `CLEAR` and `CLEAR_RANGE` operations
+/// - An `ATOMIC_OP`
+///
+/// It then performs precise assertions on all relevant counter metrics, including
+/// operation counts, exact bytes written, and exact bytes read, ensuring they are
+/// all tracked correctly within a single attempt.
+#[tokio::test]
+async fn test_counter_metrics() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    const PREFIX: &[u8] = b"test_counter_metrics_";
+    const SET_OPS: usize = 3;
+    let mut bytes_written: u64 = 0;
+    for i in 0..SET_OPS {
+        let key = format!("{}_key{}", std::str::from_utf8(PREFIX).unwrap(), i);
+        let value = format!("value{}", i);
+        bytes_written += (key.len() + value.len()) as u64;
+    }
+    // clear, clear_range and atomic_op of the closure below.
+    let clear_key = format!("{}_key2", std::str::from_utf8(PREFIX).unwrap());
+    let clear_range_begin = format!("{}_key1", std::str::from_utf8(PREFIX).unwrap());
+    let clear_range_end = format!("{}_key3", std::str::from_utf8(PREFIX).unwrap());
+    let atomic_key = format!("{}_atomic", std::str::from_utf8(PREFIX).unwrap());
+    bytes_written +=
+        (clear_key.len() + clear_range_begin.len() + clear_range_end.len() + atomic_key.len() + 8)
+            as u64;
+
+    let ((fetched_count, bytes_read), metrics) = match db
+        .instrumented_run(|txn, _| {
+            async move {
+                // 1. SET operations
+                for i in 0..SET_OPS {
+                    let key = format!("{}_key{}", std::str::from_utf8(PREFIX).unwrap(), i);
+                    let value = format!("value{}", i);
+                    txn.set(key.as_bytes(), value.as_bytes());
+                }
+
+                // 2. GET operation
+                let get_key = format!("{}_key1", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
+                let mut bytes_read_acc = 0;
+                if let Some(value_slice) = txn.get(&get_key, false).await? {
+                    bytes_read_acc += (get_key.len() + value_slice.len()) as u64;
+                }
+                let get_count = 1;
+
+                // 3. GET_RANGE operation
+                let range_begin =
+                    format!("{}_key", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
+                let range_end =
+                    format!("{}_key4", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
+                let range_option = RangeOption {
+                    begin: KeySelector::first_greater_or_equal(Cow::from(range_begin)),
+                    end: KeySelector::first_greater_or_equal(Cow::from(range_end)),
+                    limit: Some(100),
+                    ..Default::default()
+                };
+                let range_result = txn.get_range(&range_option, 1, false).await?;
+                for kv in range_result.iter() {
+                    bytes_read_acc += (kv.key().len() + kv.value().len()) as u64;
+                }
+
+                let range_count = range_result.len();
+
+                // 4. CLEAR operation
+                let clear_key =
+                    format!("{}_key2", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
+                txn.clear(&clear_key);
+
+                // 5. CLEAR_RANGE operation
+                let clear_range_begin =
+                    format!("{}_key1", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
+                let clear_range_end =
+                    format!("{}_key3", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
+                txn.clear_range(&clear_range_begin[..], &clear_range_end[..]);
+
+                // 6. ATOMIC operation (add)
+                let atomic_key =
+                    format!("{}_atomic", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
+                txn.atomic_op(
+                    &atomic_key,
+                    &[1, 0, 0, 0, 0, 0, 0, 0],
+                    options::MutationType::Add,
+                );
+
+                Ok((get_count + range_count, bytes_read_acc))
+            }
+        })
+        .await
+    {
+        Ok(val) => val,
+        Err((err, _)) => match err {
+            FdbBindingError::NonRetryableFdbError(fdb_err) => return Err(fdb_err),
+            _ => panic!("Test failed with unexpected error type: {:?}", err),
+        },
+    };
+
+    // A single attempt: its usage is the whole story.
+    assert_eq!(metrics.attempts.len(), 1);
+    let usage = metrics.attempts[0].usage;
+
+    assert_eq!(
+        usage.call_set, SET_OPS as u64,
+        "Should have {} SET operations",
+        SET_OPS
+    );
+    assert_eq!(usage.call_get, 1, "Should have 1 GET operation");
+    assert_eq!(usage.call_get_range, 1, "Should have 1 GET_RANGE operation");
+
+    // Verify the number of key-values fetched matches our result count
+    assert_eq!(
+        usage.keys_values_fetched, fetched_count as u64,
+        "Should have fetched {} key-values",
+        fetched_count
+    );
+
+    assert_eq!(
+        usage.bytes_written, bytes_written,
+        "Should have written {} bytes",
+        bytes_written
+    );
+    assert_eq!(
+        usage.bytes_read, bytes_read,
+        "Should have read {} bytes",
+        bytes_read
+    );
+
+    assert_eq!(usage.call_clear, 1, "Should have 1 CLEAR operation");
+    assert_eq!(
+        usage.call_clear_range, 1,
+        "Should have 1 CLEAR_RANGE operation"
+    );
+    assert_eq!(usage.call_atomic_op, 1, "Should have 1 ATOMIC operation");
+
+    // Without a retry, the totals are that single attempt.
+    let total = metrics.total_usage();
+    assert_eq!(total.call_set, usage.call_set);
+    assert_eq!(total.call_get, usage.call_get);
+    assert_eq!(total.keys_values_fetched, usage.keys_values_fetched);
+    assert_eq!(total.bytes_read, usage.bytes_read);
+    assert_eq!(total.bytes_written, usage.bytes_written);
+    assert_eq!(total.call_clear, usage.call_clear);
+    assert_eq!(total.call_clear_range, usage.call_clear_range);
+    assert_eq!(total.call_atomic_op, usage.call_atomic_op);
+
+    // Verify transaction info
+    assert_eq!(metrics.transaction.retries, 0, "Should have no retries");
+    assert!(
+        metrics.transaction.commit_version.is_some(),
+        "Should have a commit version"
+    );
+
+    Ok(())
+}
+
+/// Tests the `TransactionInfo` fields within the metrics report.
+#[tokio::test]
+async fn test_transaction_info() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    // read_version: recorded when the user asks for it, on the attempt and on
+    // the transaction information.
+    {
+        let metrics = TransactionMetrics::new();
+        let hooks = MetricsHooks::new(&metrics);
+
+        let read_version = db
+            .run_with_hooks(&hooks, |txn, _| {
+                let metrics = metrics.clone();
+                async move {
+                    let read_version = txn.get_read_version().await?;
+                    // Visible on the transaction information as soon as it is
+                    // read, without waiting for the run to end.
+                    assert_eq!(
+                        metrics.get_transaction_info().read_version,
+                        Some(read_version)
+                    );
+                    let again = txn.get_read_version().await?;
+                    assert_eq!(again, read_version);
+                    Ok::<_, FdbBindingError>(read_version)
+                }
+            })
+            .await
+            .expect("transaction should succeed");
+
+        let report = metrics.get_metrics_data();
+        assert_eq!(report.attempts.len(), 1);
+        assert_eq!(report.attempts[0].read_version, Some(read_version));
+        assert!(report.attempts[0].grv_duration.is_some());
+    }
+
+    // commit_version
+    {
+        let (_result, metrics) = db
+            .instrumented_run(|txn, _| async move {
+                txn.set(b"test_commit_version", b"value");
+                Ok::<_, FdbBindingError>(())
+            })
+            .await
+            .expect("Transaction failed");
+
+        assert!(metrics.transaction.commit_version.is_some());
+        // Not asked for, not fetched.
+        assert!(metrics.transaction.read_version.is_none());
+        assert!(metrics.attempts[0].grv_duration.is_none());
+    }
+
+    // retries
+    {
+        const EXPECTED_RETRIES: u64 = 2;
+
+        let attempt_counter = Arc::new(Mutex::new(0u64));
+
+        let (_, metrics) = db
+            .instrumented_run(|_txn, _| {
+                let counter = attempt_counter.clone();
+                async move {
+                    let mut attempts = counter.lock().unwrap();
+                    *attempts += 1;
+
+                    if *attempts <= EXPECTED_RETRIES {
+                        Err(FdbBindingError::from(FdbError::from_code(1020)))
+                    } else {
+                        Ok(())
+                    }
+                }
+            })
+            .await
+            .expect("Transaction should have succeeded after retries");
+
+        assert_eq!(metrics.transaction.retries, EXPECTED_RETRIES);
+        assert_eq!(metrics.attempts.len(), EXPECTED_RETRIES as usize + 1);
+    }
+
+    Ok(())
+}
+
+/// Setting a client budget mid-attempt starts a fresh accounting generation,
+/// and the attempt being recorded goes with it: only what happens after the call
+/// is reported.
+#[tokio::test]
+async fn set_client_budget_mid_attempt_drops_what_was_recorded() -> FdbResult<()> {
+    const KEY: &[u8] = b"test_metrics_budget_mid_attempt";
+    const VALUE: &[u8] = b"value";
+
+    let db = common::database().await?;
+
+    let (_, metrics) = db
+        .instrumented_run(|txn, _| async move {
+            txn.set(b"test_metrics_budget_before", VALUE);
+            txn.set_custom_metric("before_budget", 1, &[]);
+
+            txn.set_client_budget(ClientBudget::default());
+
+            txn.set(KEY, VALUE);
+            txn.set_custom_metric("after_budget", 1, &[]);
+            Ok::<_, FdbBindingError>(())
+        })
+        .await
+        .expect("transaction should succeed");
+
+    assert_eq!(metrics.attempts.len(), 1);
+    let attempt = &metrics.attempts[0];
+
+    // The write itself did happen, only its accounting was dropped.
+    assert_eq!(attempt.usage.call_set, 1);
+    assert_eq!(
+        attempt.usage.bytes_written,
+        (KEY.len() + VALUE.len()) as u64
+    );
+
+    assert!(
+        attempt
+            .custom_metrics
+            .contains_key(&MetricKey::new("after_budget", &[]))
+    );
+    assert!(
+        !attempt
+            .custom_metrics
+            .contains_key(&MetricKey::new("before_budget", &[]))
+    );
+
+    Ok(())
+}
+
+/// A run that never commits reports its last attempt as failed.
+#[tokio::test]
+async fn instrumented_run_failure_reports_the_last_attempt() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    #[derive(Debug)]
+    struct Fatal;
+    impl std::fmt::Display for Fatal {
+        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+            write!(f, "fatal")
+        }
+    }
+    impl std::error::Error for Fatal {}
+
+    let (_err, metrics) = db
+        .instrumented_run(|txn, _| async move {
+            txn.set(b"test_metrics_failure", b"value");
+            // A custom error with no FdbError underneath is not retryable.
+            Err::<(), _>(FdbBindingError::new_custom_error(Box::new(Fatal)))
+        })
+        .await
+        .expect_err("transaction should fail");
+
+    assert_eq!(metrics.attempts.len(), 1);
+    let attempt = &metrics.attempts[0];
+    assert!(matches!(attempt.outcome, AttemptOutcome::Failed));
+    assert_eq!(attempt.usage.call_set, 1);
+    assert!(attempt.commit_duration.is_none(), "commit never ran");
+    assert_eq!(metrics.transaction.retries, 0);
+
+    Ok(())
+}
+
+/// Exhausting the retry limit consumes the transaction inside `on_error`: the
+/// attempt it was running must still be reported.
+#[tokio::test]
+async fn instrumented_run_reports_the_attempt_that_exhausted_the_retries() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    let (_err, metrics) = db
+        .instrumented_run(|txn, _| async move {
+            txn.set_option(options::TransactionOption::RetryLimit(0))?;
+            txn.set(b"test_metrics_retry_limit", b"value");
+            Err::<(), _>(FdbBindingError::from(FdbError::from_code(1020)))
+        })
+        .await
+        .expect_err("the retry limit should be reached");
+
+    assert_eq!(metrics.attempts.len(), 1);
+    let attempt = &metrics.attempts[0];
+    assert!(matches!(attempt.outcome, AttemptOutcome::Failed));
+    assert_eq!(attempt.usage.call_set, 1);
+    assert_eq!(metrics.transaction.retries, 0);
+
+    Ok(())
+}
+
+/// Tests that the timings of the attempts are recorded.
+#[tokio::test]
+async fn test_time_metrics() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    // A committed attempt has a duration and a commit duration, and never went
+    // through on_error.
+    {
+        let (_result, metrics) = db
+            .instrumented_run(|txn, _| async move {
+                for i in 0..10 {
+                    let key = format!("test_time_metrics_{}", i).into_bytes();
+                    txn.set(&key, b"value");
+                }
+                let _ = txn.get(b"test_time_metrics_0", false).await?;
+                Ok::<_, FdbBindingError>(())
+            })
+            .await
+            .expect("Transaction failed");
+
+        assert_eq!(metrics.attempts.len(), 1);
+        let attempt = &metrics.attempts[0];
+        assert!(attempt.duration.is_some(), "attempt duration");
+        assert!(attempt.commit_duration.is_some(), "commit duration");
+        assert!(
+            attempt.grv_duration.is_none(),
+            "get_read_version was not called"
+        );
+        assert!(attempt.on_error_duration.is_none(), "on_error did not run");
+        assert!(metrics.total_duration >= attempt.duration);
+    }
+
+    // A retried attempt has its on_error duration recorded, and its own
+    // duration excludes the retry backoff.
+    {
+        let attempt_counter = Arc::new(Mutex::new(0u64));
+        let (_, metrics) = db
+            .instrumented_run(|_txn, _| {
+                let counter = attempt_counter.clone();
+                async move {
+                    let mut attempts = counter.lock().unwrap();
+                    *attempts += 1;
+
+                    if *attempts == 1 {
+                        Err(FdbBindingError::from(FdbError::from_code(1020)))
+                    } else {
+                        Ok(())
+                    }
+                }
+            })
+            .await
+            .expect("Transaction should have succeeded after retry");
+
+        assert_eq!(metrics.attempts.len(), 2);
+        assert!(
+            metrics.attempts[0].on_error_duration.is_some(),
+            "Error handling time should be recorded"
+        );
+        assert!(metrics.attempts[1].on_error_duration.is_none());
+    }
+
+    Ok(())
+}
+
+/// Custom metrics recorded on the transaction are reported per attempt, and are
+/// infallible: an uninstrumented transaction simply drops them.
+#[tokio::test]
+async fn test_transaction_custom_metrics() -> Result<(), FdbBindingError> {
+    let db = common::database().await?;
+
+    // No metrics consumer: recording is a no-op, not an error.
+    let txn = db.create_trx()?;
+    txn.set_custom_metric("dropped", 1, &[]);
+    txn.increment_custom_metric("dropped", 1, &[]);
+    drop(txn);
+
+    let (_, metrics) = db
+        .instrumented_run(|txn, _| async move {
+            txn.set_custom_metric("txn_counter", 100, &[("operation", "read")]);
+            txn.set_custom_metric("txn_timer", 200, &[("component", "storage")]);
+
+            txn.increment_custom_metric("txn_incremented", 10, &[("type", "query")]);
+            txn.increment_custom_metric("txn_incremented", 15, &[("type", "query")]);
+
+            // Read a value to make sure the transaction does something
+            let _value = txn.get(b"test_key", false).await?;
+
+            Ok::<_, FdbBindingError>(())
+        })
+        .await
+        .map_err(|(err, _)| err)?;
+
+    assert_eq!(metrics.attempts.len(), 1);
+    let custom = &metrics.attempts[0].custom_metrics;
+
+    let key = MetricKey::new("txn_counter", &[("operation", "read")]);
+    assert_eq!(custom.get(&key).copied(), Some(100));
+
+    let key = MetricKey::new("txn_timer", &[("component", "storage")]);
+    assert_eq!(custom.get(&key).copied(), Some(200));
+
+    // Increments accumulate within the attempt.
+    let key = MetricKey::new("txn_incremented", &[("type", "query")]);
+    assert_eq!(custom.get(&key).copied(), Some(25));
+
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/tests/range.rs b/bindings/rust/foundationdb/tests/range.rs
new file mode 100644
index 00000000000..24414f02061
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/range.rs
@@ -0,0 +1,500 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+#[cfg_api_versions(min = 710)]
+use crate::tuple::Subspace;
+
+use foundationdb::*;
+use foundationdb_macros::cfg_api_versions;
+use foundationdb_sys::if_cfg_api_versions;
+use futures::future;
+use futures::prelude::*;
+
+use std::borrow::Cow;
+
+mod common;
+
+// Kept as a single sequential #[test] on purpose: test_range_option_async and
+// test_get_estimate_range share the "test-rangeoption-" prefix, and the two
+// mapped-range tests clear the same data/index subspaces.
+#[test]
+fn test_range() {
+    let _guard = foundationdb::boot().expect("failed to initialize FoundationDB");
+    futures::executor::block_on(test_get_range_async()).expect("failed to run");
+    futures::executor::block_on(test_range_option_async()).expect("failed to run");
+    futures::executor::block_on(test_get_ranges_async()).expect("failed to run");
+    if_cfg_api_versions!(min = 630 =>
+        futures::executor::block_on(test_get_estimate_range()).expect("failed to run")
+    );
+    if_cfg_api_versions!(min = 700 =>
+        futures::executor::block_on(test_get_range_split_points()).expect("failed to run")
+    );
+    if_cfg_api_versions!(min = 710 =>
+            futures::executor::block_on(test_mapped_value()).expect("failed to run");
+            futures::executor::block_on(test_mapped_values()).expect("failed to run")
+    )
+}
+
+async fn test_get_range_async() -> FdbResult<()> {
+    const N: usize = 10000;
+
+    let db = common::database().await?;
+
+    {
+        let trx = db.create_trx()?;
+        let key_begin = "test-range-";
+        let key_end = "test-range.";
+
+        eprintln!("clearing...");
+        trx.clear_range(key_begin.as_bytes(), key_end.as_bytes());
+
+        eprintln!("inserting...");
+        for _ in 0..N {
+            let key = format!("{}-{}", key_begin, common::random_str(10));
+            let value = common::random_str(10);
+            trx.set(key.as_bytes(), value.as_bytes());
+        }
+
+        eprintln!("counting...");
+        let begin = KeySelector::first_greater_or_equal(Cow::Borrowed(key_begin.as_bytes()));
+        let end = KeySelector::first_greater_than(Cow::Borrowed(key_end.as_bytes()));
+        let opt = RangeOption::from((begin, end));
+
+        let range = trx.get_range(&opt, 1, false).await?;
+        assert!(!range.is_empty());
+        assert!(range.more());
+        let len = range.len();
+        let mut i = 0;
+        for kv in &range {
+            assert!(!kv.key().is_empty());
+            assert!(!kv.value().is_empty());
+            i += 1;
+        }
+        assert_eq!(i, len);
+
+        let refs_asc = (&range).into_iter().collect::<Vec<_>>();
+        assert_eq!(
+            refs_asc,
+            (&range).into_iter().rev().rev().collect::<Vec<_>>()
+        );
+
+        let owned_asc = trx
+            .get_range(&opt, 1, false)
+            .await?
+            .into_iter()
+            .collect::<Vec<_>>();
+        assert_eq!(owned_asc, range.into_iter().rev().rev().collect::<Vec<_>>());
+    }
+
+    Ok(())
+}
+
+async fn test_get_ranges_async() -> FdbResult<()> {
+    const N: usize = 10000;
+
+    let db = common::database().await?;
+
+    {
+        let trx = db.create_trx()?;
+        let key_begin = "test-ranges-";
+        let key_end = "test-ranges.";
+
+        eprintln!("clearing...");
+        trx.clear_range(key_begin.as_bytes(), key_end.as_bytes());
+
+        eprintln!("inserting...");
+        for _ in 0..N {
+            let key = format!("{}-{}", key_begin, common::random_str(10));
+            let value = common::random_str(10);
+            trx.set(key.as_bytes(), value.as_bytes());
+        }
+
+        eprintln!("counting...");
+        let begin = KeySelector::first_greater_or_equal(Cow::Borrowed(key_begin.as_bytes()));
+        let end = KeySelector::first_greater_than(Cow::Borrowed(key_end.as_bytes()));
+        let opt = RangeOption::from((begin, end));
+
+        let count = trx
+            .get_ranges(opt.clone(), false)
+            .try_fold(0usize, |count, kvs| future::ok(count + kvs.as_ref().len()))
+            .await?;
+
+        assert_eq!(count, N);
+        eprintln!("count: {count:?}");
+
+        let unlimited = RangeOption {
+            limit: Some(0),
+            ..opt
+        };
+        for reverse in [false, true] {
+            let opt = RangeOption {
+                reverse,
+                ..unlimited.clone()
+            };
+            let (pages, count) = trx
+                .get_ranges(opt, false)
+                .try_fold((0usize, 0usize), |(pages, count), kvs| {
+                    future::ok((pages + 1, count + kvs.len()))
+                })
+                .await?;
+            assert!(pages > 1, "expected a paginated range scan");
+            assert_eq!(count, N);
+        }
+    }
+
+    Ok(())
+}
+
+async fn test_range_option_async() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    {
+        let trx = db.create_trx()?;
+        let key_begin = "test-rangeoption-";
+        let key_end = "test-rangeoption.";
+        let k = |i: u32| format!("{key_begin}-{i:010}");
+
+        eprintln!("clearing...");
+        trx.clear_range(key_begin.as_bytes(), key_end.as_bytes());
+
+        eprintln!("inserting...");
+        for i in 0..10000 {
+            let value = common::random_str(10);
+            trx.set(k(i).as_bytes(), value.as_bytes());
+        }
+        assert_eq!(
+            trx.get_ranges(
+                (KeySelector::first_greater_or_equal(k(100).into_bytes())
+                    ..KeySelector::first_greater_or_equal(k(5000).as_bytes()))
+                    .into(),
+                false
+            )
+            .try_fold(0usize, |count, kvs| future::ok(count + kvs.as_ref().len()))
+            .await?,
+            4900
+        );
+        assert_eq!(
+            trx.get_ranges(
+                (
+                    KeySelector::first_greater_or_equal(k(100).into_bytes()),
+                    KeySelector::first_greater_or_equal(k(5000).as_bytes())
+                )
+                    .into(),
+                false
+            )
+            .try_fold(0usize, |count, kvs| future::ok(count + kvs.as_ref().len()))
+            .await?,
+            4900
+        );
+        assert_eq!(
+            trx.get_ranges((k(100).into_bytes()..k(5000).into_bytes()).into(), false)
+                .try_fold(0usize, |count, kvs| future::ok(count + kvs.as_ref().len()))
+                .await?,
+            4900
+        );
+        assert_eq!(
+            trx.get_ranges((k(100).into_bytes(), k(5000).into_bytes()).into(), false)
+                .try_fold(0usize, |count, kvs| future::ok(count + kvs.as_ref().len()))
+                .await?,
+            4900
+        );
+        assert_eq!(
+            trx.get_ranges((k(100).as_bytes()..k(5000).as_bytes()).into(), false)
+                .try_fold(0usize, |count, kvs| future::ok(count + kvs.as_ref().len()))
+                .await?,
+            4900
+        );
+        assert_eq!(
+            trx.get_ranges((k(100).as_bytes(), k(5000).as_bytes()).into(), false)
+                .try_fold(0usize, |count, kvs| future::ok(count + kvs.as_ref().len()))
+                .await?,
+            4900
+        );
+
+        assert_eq!(
+            trx.get_ranges(
+                (KeySelector::first_greater_or_equal(k(100).into_bytes())
+                    ..KeySelector::first_greater_than(k(5000).as_bytes()))
+                    .into(),
+                false
+            )
+            .try_fold(0usize, |count, kvs| future::ok(count + kvs.as_ref().len()))
+            .await?,
+            4901
+        );
+        assert_eq!(
+            trx.get_ranges((k(100).into_bytes()..=k(5000).into_bytes()).into(), false)
+                .try_fold(0usize, |count, kvs| future::ok(count + kvs.as_ref().len()))
+                .await?,
+            4901
+        );
+        assert_eq!(
+            trx.get_ranges((k(100).as_bytes()..=k(5000).as_bytes()).into(), false)
+                .try_fold(0usize, |count, kvs| future::ok(count + kvs.as_ref().len()))
+                .await?,
+            4901
+        );
+    }
+
+    Ok(())
+}
+
+#[cfg_api_versions(min = 630)]
+async fn test_get_estimate_range() -> FdbResult<()> {
+    const N: u32 = 10000;
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+    let key_begin = "test-rangeoption-";
+    let key_end = "test-rangeoption.";
+    let k = |i: u32| format!("{key_begin}-{i:010}");
+
+    eprintln!("clearing...");
+    trx.clear_range(key_begin.as_bytes(), key_end.as_bytes());
+
+    eprintln!("inserting...");
+    for i in 0..N {
+        let value = common::random_str(10);
+        trx.set(k(i).as_bytes(), value.as_bytes());
+    }
+    trx.commit().await?;
+
+    let trx = db.create_trx()?;
+    let estimate = trx
+        .get_estimated_range_size_bytes(key_begin.as_bytes(), key_end.as_bytes())
+        .await?;
+    eprintln!("get an estimate of {estimate} bytes");
+    assert!(estimate > 0);
+
+    Ok(())
+}
+
+#[cfg_api_versions(min = 700)]
+async fn test_get_range_split_points() -> FdbResult<()> {
+    const N: u32 = 10000;
+
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+    let key_begin = "test-split-point-";
+    let key_end = "test-split-point.";
+    let k = |i: u32| format!("{key_begin}-{i:010}");
+
+    eprintln!("clearing...");
+    trx.clear_range(key_begin.as_bytes(), key_end.as_bytes());
+
+    eprintln!("inserting...");
+    for i in 0..N {
+        let value = common::random_str(10);
+        trx.set(k(i).as_bytes(), value.as_bytes());
+    }
+    trx.commit().await?;
+
+    let trx = db.create_trx()?;
+    let splits = trx
+        .get_range_split_points(key_begin.as_bytes(), key_end.as_bytes(), 100)
+        .await?;
+    assert!(!splits.is_empty());
+    for split in splits {
+        eprintln!("split point: {:?}", split.key());
+    }
+    Ok(())
+}
+
+#[cfg_api_versions(min = 710)]
+async fn test_mapped_value() -> FdbResult<()> {
+    use foundationdb::tuple::{Subspace, pack};
+
+    let db = common::database().await?;
+
+    let data_subspace = Subspace::all().subspace(&("test-range-data"));
+    let index_subspace = Subspace::all().subspace(&("test-range-index"));
+    let number_of_records: i32 = 20;
+
+    clear_mapped_data(&db, &data_subspace, &index_subspace).await;
+
+    let blue_counter =
+        setup_mapped_data(&db, &data_subspace, &index_subspace, number_of_records).await?;
+
+    let t = db.create_trx()?;
+    let range_option = RangeOption::from(&index_subspace.subspace(&("blue")));
+
+    // The mapper is a Tuple that allow to transform keys.
+    // This one is allowing fdb to convert a key like `("test-range-index", "blue", PRIMARY_KEY)`
+    // to generate a scan in the range `("test-range-data", PRIMARY_KEY, ...)`
+    // More info can be found here: https://github.com/apple/foundationdb/wiki/Everything-about-GetMappedRange
+    let mapper = pack(&("test-range-data", "{K[2]}", "{...}"));
+
+    let mapped_key_values = t
+        .get_mapped_range(&range_option, &mapper, 1024, false)
+        .await?;
+
+    verify_mapped_values(blue_counter, vec![mapped_key_values]);
+
+    Ok(())
+}
+
+#[cfg_api_versions(min = 710)]
+async fn clear_mapped_data(db: &Database, data_subspace: &Subspace, index_subspace: &Subspace) {
+    let t = db.create_trx().expect("could not create transaction");
+    t.clear_subspace_range(data_subspace);
+    t.clear_subspace_range(index_subspace);
+    t.commit().await.expect("could not commit");
+}
+
+#[cfg_api_versions(min = 710)]
+fn verify_mapped_values(
+    blue_counter: i32,
+    vec_mapped_key_values: Vec<mapped_key_values::MappedKeyValues>,
+) {
+    use foundationdb::tuple::{Element, unpack};
+
+    let mut value_counter = 0;
+
+    for mapped_key_values in vec_mapped_key_values {
+        for mapped_key_value in mapped_key_values {
+            // checking the parent key that generated the scan
+            let parent_key: Vec<Element> =
+                unpack(mapped_key_value.parent_key()).expect("could not unpack index key");
+            assert!(parent_key.starts_with(&[
+                Element::String(Cow::from("test-range-index")),
+                Element::String(Cow::from("blue"))
+            ]));
+
+            let mapped_values = mapped_key_value.key_values();
+            assert_eq!(
+                mapped_values.len(),
+                2,
+                "bad length, expecting 2, got {}",
+                mapped_values.len()
+            );
+
+            for kv in mapped_values {
+                let key: Vec<Element> = unpack(kv.key()).expect("could not unpack key");
+                assert!(key.starts_with(&[Element::String(Cow::from("test-range-data"))]));
+            }
+            value_counter += 1;
+        }
+    }
+    assert_eq!(
+        value_counter, blue_counter,
+        "found {value_counter} elements instead of {blue_counter}"
+    );
+}
+
+#[cfg_api_versions(min = 710)]
+async fn test_mapped_values() -> FdbResult<()> {
+    use foundationdb::tuple::{Subspace, pack};
+
+    let db = common::database().await?;
+
+    let data_subspace = Subspace::all().subspace(&("test-range-data"));
+    let index_subspace = Subspace::all().subspace(&("test-range-index"));
+    let number_of_records: i32 = 10_000;
+
+    clear_mapped_data(&db, &data_subspace, &index_subspace).await;
+
+    let blue_counter =
+        setup_mapped_data(&db, &data_subspace, &index_subspace, number_of_records).await?;
+
+    let t = db.create_trx()?;
+    let range_option = RangeOption::from(&index_subspace.subspace(&("blue")));
+
+    // The mapper is a Tuple that allow to transform keys.
+    // This one is allowing fdb to convert a key like `("test-range-index", "blue", PRIMARY_KEY)`
+    // to generate a scan in the range `("test-range-data", PRIMARY_KEY, ...)`
+    // More info can be found here: https://github.com/apple/foundationdb/wiki/Everything-about-GetMappedRange
+    let mapper = pack(&("test-range-data", "{K[2]}", "{...}"));
+
+    let key_values = t
+        .get_mapped_ranges(range_option.clone(), &mapper, false)
+        .try_collect::<Vec<mapped_key_values::MappedKeyValues>>()
+        .await?;
+
+    dbg!(t.get_approximate_size().await?);
+
+    verify_mapped_values(blue_counter, key_values);
+
+    let unlimited = RangeOption {
+        limit: Some(0),
+        ..range_option
+    };
+    let (pages, parents) = t
+        .get_mapped_ranges(unlimited, &mapper, false)
+        .try_fold((0usize, 0usize), |(pages, parents), values| {
+            future::ok((pages + 1, parents + values.len()))
+        })
+        .await?;
+    assert!(pages > 1, "expected a paginated mapped range scan");
+    assert_eq!(parents, blue_counter as usize);
+
+    Ok(())
+}
+
+#[cfg_api_versions(min = 710)]
+async fn setup_mapped_data(
+    db: &Database,
+    data_subspace: &Subspace,
+    index_subspace: &Subspace,
+    number_of_records: i32,
+) -> Result<i32, FdbError> {
+    use foundationdb::tuple::pack;
+
+    let mut written_records = 0;
+    let mut blue_counter = 0;
+
+    loop {
+        let trx = db.create_trx()?;
+        eprintln!(
+            "Creating a new transaction, {} records left to write",
+            number_of_records - written_records
+        );
+        loop {
+            let primary_key = written_records;
+            let eye_color = match primary_key % 3 {
+                0 => {
+                    blue_counter += 1;
+                    "blue"
+                }
+                1 => "brown",
+                2 => "green",
+                _ => unreachable!(),
+            };
+
+            // write into the data subspace
+            trx.set(
+                &data_subspace.pack(&(primary_key, "eye_color", eye_color)),
+                eye_color.as_bytes(),
+            );
+            // write another key next to it
+            trx.set(
+                &data_subspace.pack(&(primary_key, "some_data")),
+                &pack(&("fdb-rs")),
+            );
+            // write into the index subspace
+            trx.set(&index_subspace.pack(&(eye_color, primary_key)), &[]);
+
+            written_records += 1;
+            if written_records == number_of_records {
+                eprintln!("committing batch, because we have all records");
+                break;
+            }
+
+            let size_trx = trx.get_approximate_size().await?;
+            if size_trx >= 100_000 {
+                eprintln!("committing batch, because we have already written ~{size_trx}b");
+                break;
+            }
+        }
+        trx.commit().await.expect("could not commit");
+        if written_records == number_of_records {
+            eprintln!("records are now ready");
+            break;
+        }
+    }
+
+    Ok(blue_counter)
+}
diff --git a/bindings/rust/foundationdb/tests/ranked_register.rs b/bindings/rust/foundationdb/tests/ranked_register.rs
new file mode 100644
index 00000000000..66967f07078
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/ranked_register.rs
@@ -0,0 +1,507 @@
+// Copyright 2024 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+mod common;
+
+#[cfg(feature = "recipes-ranked-register")]
+mod ranked_register_tests {
+    use std::sync::atomic::{AtomicU8, Ordering};
+
+    use foundationdb::{
+        Database, FdbBindingError, FdbError, RetryDecision, RetryableError,
+        options::TransactionOption,
+        recipes::ranked_register::{
+            MAX_VALUE_CHUNK_BYTES, Rank, RankedRegister, RankedRegisterError, WriteResult,
+        },
+        tuple::Subspace,
+    };
+
+    // RankedRegisterError implements RetryableError, so closures return it
+    // directly with plain `?` and the retry loop still recognizes wrapped
+    // FdbErrors through the source chain.
+
+    async fn setup_test(
+        db: &Database,
+        test_name: &str,
+    ) -> Result<RankedRegister, RankedRegisterError> {
+        let subspace = Subspace::all().subspace(&test_name);
+        let (from, to) = subspace.range();
+
+        let from_ref = &from;
+        let to_ref = &to;
+        db.run(|txn, _| async move {
+            txn.clear_range(from_ref, to_ref);
+            Ok::<_, RankedRegisterError>(())
+        })
+        .await?;
+
+        Ok(RankedRegister::new(subspace))
+    }
+
+    #[tokio::test]
+    async fn test_basic_write_and_read() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_basic_write_and_read").await?;
+
+        // Write with rank 1
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.write(&txn, Rank::from(1u64), b"hello").await?;
+                Ok::<_, RankedRegisterError>(r)
+            })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        // Read with rank 2 should return the value
+        let rr_ref = &rr;
+        let read_result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.read(&txn, Rank::from(2u64)).await?;
+                Ok::<_, RankedRegisterError>((r.write_rank(), r.into_value()))
+            })
+            .await?;
+        assert_eq!(read_result.0, Rank::from(1u64));
+        assert_eq!(read_result.1.as_deref(), Some(b"hello".as_slice()));
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_rank_fencing() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_rank_fencing").await?;
+
+        // Read with rank 10 installs a fence
+        let rr_ref = &rr;
+        db.run(|txn, _| async move {
+            rr_ref.read(&txn, Rank::from(10u64)).await?;
+            Ok::<_, RankedRegisterError>(())
+        })
+        .await?;
+
+        // Write with rank 5 should be aborted (below the fence)
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.write(&txn, Rank::from(5u64), b"blocked").await?;
+                Ok::<_, RankedRegisterError>(r)
+            })
+            .await?;
+        assert_eq!(result, WriteResult::Aborted);
+
+        // Write with rank 10 should succeed (equal to fence)
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.write(&txn, Rank::from(10u64), b"accepted").await?;
+                Ok::<_, RankedRegisterError>(r)
+            })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_write_ordering() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_write_ordering").await?;
+
+        // Write rank 1 value "A"
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.write(&txn, Rank::from(1u64), b"A").await?;
+                Ok::<_, RankedRegisterError>(r)
+            })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        // Write rank 2 value "B"
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.write(&txn, Rank::from(2u64), b"B").await?;
+                Ok::<_, RankedRegisterError>(r)
+            })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        // Read should return "B"
+        let rr_ref = &rr;
+        let read_result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.read(&txn, Rank::from(3u64)).await?;
+                Ok::<_, RankedRegisterError>(r.into_value())
+            })
+            .await?;
+        assert_eq!(read_result.as_deref(), Some(b"B".as_slice()));
+
+        // Write rank 1 value "C" should be aborted (max_write_rank is 2)
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.write(&txn, Rank::from(1u64), b"C").await?;
+                Ok::<_, RankedRegisterError>(r)
+            })
+            .await?;
+        assert_eq!(result, WriteResult::Aborted);
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_stale_write_rejected() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_stale_write_rejected").await?;
+
+        // Write with rank 5
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.write(&txn, Rank::from(5u64), b"initial").await?;
+                Ok::<_, RankedRegisterError>(r)
+            })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        // Read with rank 10 installs fence
+        let rr_ref = &rr;
+        db.run(|txn, _| async move {
+            rr_ref.read(&txn, Rank::from(10u64)).await?;
+            Ok::<_, RankedRegisterError>(())
+        })
+        .await?;
+
+        // Write with rank 7 should be aborted even though 7 > 5,
+        // because max_read_rank is 10
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.write(&txn, Rank::from(7u64), b"stale").await?;
+                Ok::<_, RankedRegisterError>(r)
+            })
+            .await?;
+        assert_eq!(result, WriteResult::Aborted);
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_follower_value_read() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_follower_value_read").await?;
+
+        // Write with rank 5
+        let rr_ref = &rr;
+        db.run(|txn, _| async move {
+            let _ = rr_ref.write(&txn, Rank::from(5u64), b"X").await?;
+            Ok::<_, RankedRegisterError>(())
+        })
+        .await?;
+
+        // value() returns "X"
+        let rr_ref = &rr;
+        let val = db
+            .run(|txn, _| async move {
+                let v = rr_ref.value(&txn).await?;
+                Ok::<_, RankedRegisterError>(v)
+            })
+            .await?;
+        assert_eq!(val.as_deref(), Some(b"X".as_slice()));
+
+        // Write with rank 10 should succeed (value() didn't install a fence)
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.write(&txn, Rank::from(10u64), b"Y").await?;
+                Ok::<_, RankedRegisterError>(r)
+            })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_empty_register() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_empty_register").await?;
+
+        // Read on fresh register
+        let rr_ref = &rr;
+        let read_result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.read(&txn, Rank::from(1u64)).await?;
+                Ok::<_, RankedRegisterError>((r.write_rank(), r.into_value()))
+            })
+            .await?;
+        assert_eq!(read_result.0, Rank::ZERO);
+        assert_eq!(read_result.1, None);
+
+        // value() on fresh register
+        let rr_ref = &rr;
+        let val = db
+            .run(|txn, _| async move {
+                let v = rr_ref.value(&txn).await?;
+                Ok::<_, RankedRegisterError>(v)
+            })
+            .await?;
+        assert_eq!(val, None);
+
+        // Write with rank 1 should succeed
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                let r = rr_ref.write(&txn, Rank::from(1u64), b"first").await?;
+                Ok::<_, RankedRegisterError>(r)
+            })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_multi_chunk_round_trip() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_multi_chunk_round_trip").await?;
+        let value = vec![0x5a; MAX_VALUE_CHUNK_BYTES + 1];
+        let value_ref = &value;
+
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), value_ref).await })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        let rr_ref = &rr;
+        let round_trip = db
+            .run(|txn, _| async move { rr_ref.value(&txn).await })
+            .await?;
+        assert_eq!(round_trip.as_deref(), Some(value.as_slice()));
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_empty_payload_is_present() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_empty_payload_is_present").await?;
+
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), b"").await })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        let rr_ref = &rr;
+        let value = db
+            .run(|txn, _| async move { rr_ref.value(&txn).await })
+            .await?;
+        assert_eq!(value.as_deref(), Some(b"".as_slice()));
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_shrinking_value_clears_stale_chunks() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_shrinking_value_clears_stale_chunks").await?;
+        let initial = vec![0x31; MAX_VALUE_CHUNK_BYTES * 2 + 1];
+        let initial_ref = &initial;
+
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), initial_ref).await })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(2_u64), b"small").await })
+            .await?;
+        assert_eq!(result, WriteResult::Committed);
+
+        let rr_ref = &rr;
+        let value = db
+            .run(|txn, _| async move { rr_ref.value(&txn).await })
+            .await?;
+        assert_eq!(value.as_deref(), Some(b"small".as_slice()));
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_configured_max_value_rejects_write() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let subspace = Subspace::all().subspace(&("test_configured_max_value_rejects_write",));
+        let rr = RankedRegister::with_max_value_bytes(subspace, 3);
+
+        let rr_ref = &rr;
+        let error = db
+            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), b"four").await })
+            .await
+            .expect_err("configured limit must reject oversized values");
+        assert!(matches!(
+            error,
+            RankedRegisterError::ValueTooLarge {
+                value_size: 4,
+                limit: 3,
+            }
+        ));
+        assert!(matches!(error.retry_decision(), RetryDecision::Fatal));
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_independent_handle_read_installs_fence() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let reader = setup_test(&db, "test_independent_handle_read_installs_fence").await?;
+        let writer = RankedRegister::new(reader.subspace().clone());
+
+        let reader_ref = &reader;
+        db.run(|txn, _| async move {
+            reader_ref.read(&txn, Rank::from(10_u64)).await?;
+            Ok::<_, RankedRegisterError>(())
+        })
+        .await?;
+
+        let writer_ref = &writer;
+        let result = db
+            .run(|txn, _| async move { writer_ref.write(&txn, Rank::from(9_u64), b"fenced").await })
+            .await?;
+        assert_eq!(result, WriteResult::Aborted);
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_equal_rank_recommit_is_aborted() -> Result<(), RankedRegisterError> {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_equal_rank_recommit_is_aborted").await?;
+
+        let rr_ref = &rr;
+        let first = db
+            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), b"first").await })
+            .await?;
+        assert_eq!(first, WriteResult::Committed);
+
+        let rr_ref = &rr;
+        let second = db
+            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), b"second").await })
+            .await?;
+        assert_eq!(second, WriteResult::Aborted);
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_concurrent_writes_conflict_on_register_state() -> Result<(), RankedRegisterError>
+    {
+        let db = crate::common::database().await?;
+        let rr = setup_test(&db, "test_concurrent_writes_conflict_on_register_state").await?;
+        let barrier = std::sync::Arc::new(tokio::sync::Barrier::new(2));
+
+        let first = rr.clone();
+        let first_barrier = barrier.clone();
+        let first_write = db.run(|txn, _| {
+            let first = first.clone();
+            let barrier = first_barrier.clone();
+            async move {
+                txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                txn.set_option(TransactionOption::RetryLimit(0))?;
+                let result = first.write(&txn, Rank::from(1_u64), b"a").await?;
+                barrier.wait().await;
+                Ok::<_, RankedRegisterError>(result)
+            }
+        });
+        let second = rr.clone();
+        let second_barrier = barrier.clone();
+        let second_write = db.run(|txn, _| {
+            let second = second.clone();
+            let barrier = second_barrier.clone();
+            async move {
+                txn.set_option(TransactionOption::AutomaticIdempotency)?;
+                txn.set_option(TransactionOption::RetryLimit(0))?;
+                let result = second.write(&txn, Rank::from(1_u64), b"b").await?;
+                barrier.wait().await;
+                Ok::<_, RankedRegisterError>(result)
+            }
+        });
+        let (write_a, write_b) = tokio::join!(first_write, second_write);
+        assert_eq!(
+            usize::from(write_a.is_ok()) + usize::from(write_b.is_ok()),
+            1
+        );
+
+        let rr_ref = &rr;
+        let value = db
+            .run(|txn, _| async move { rr_ref.value(&txn).await })
+            .await?;
+        assert!(matches!(value.as_deref(), Some(b"a") | Some(b"b")));
+
+        Ok(())
+    }
+
+    /// Regression freezing the old anti-pattern this file used to demonstrate:
+    /// stringifying an error into CustomError destroys the source chain, so
+    /// even the chain-walking retry detection cannot rescue it. A retryable
+    /// FdbError flattened to a String is fatal; that is correct, documented
+    /// behavior, and the fix is rewriting the wrapping (as the helpers above
+    /// now do), not the detection.
+    #[tokio::test]
+    async fn stringified_error_is_not_retried() {
+        let db = crate::common::database().await.expect("failed to open db");
+        let attempt = AtomicU8::new(0);
+        let attempt_ref = &attempt;
+
+        let result: Result<(), FdbBindingError> = db
+            .run(|_txn, _| async move {
+                attempt_ref.fetch_add(1, Ordering::SeqCst);
+                let err = RankedRegisterError::Fdb(FdbError::from_code(1020));
+                Err(FdbBindingError::CustomError(err.to_string().into()))
+            })
+            .await;
+
+        assert!(result.is_err(), "stringified errors must stay fatal");
+        assert_eq!(
+            attempt.load(Ordering::SeqCst),
+            1,
+            "a stringified retryable error must not be retried"
+        );
+    }
+
+    /// With the blessed pattern, a retryable FdbError injected through the
+    /// recipe's own error type is retried and the operation completes.
+    #[tokio::test]
+    async fn injected_fdb_error_retries_through_recipe_error() {
+        let db = crate::common::database().await.expect("failed to open db");
+        let rr = setup_test(&db, "test_injected_retry")
+            .await
+            .expect("setup failed");
+        let attempt = AtomicU8::new(0);
+        let attempt_ref = &attempt;
+
+        let rr_ref = &rr;
+        let result = db
+            .run(|txn, _| async move {
+                if attempt_ref.fetch_add(1, Ordering::SeqCst) == 0 {
+                    return Err(RankedRegisterError::Fdb(FdbError::from_code(1020)));
+                }
+                let r = rr_ref.write(&txn, Rank::from(1u64), b"retried").await?;
+                Ok(r)
+            })
+            .await
+            .expect("injected retryable error must be retried");
+
+        assert_eq!(result, WriteResult::Committed);
+        assert!(attempt.load(Ordering::SeqCst) >= 2);
+    }
+}
diff --git a/bindings/rust/foundationdb/tests/run_retry.rs b/bindings/rust/foundationdb/tests/run_retry.rs
new file mode 100644
index 00000000000..e6107dd646a
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/run_retry.rs
@@ -0,0 +1,280 @@
+// Copyright 2026 foundationdb-rs developers
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+//! Retry behavior of `Database::run` for closure errors that wrap an
+//! FdbError, request an app-level retry, or are fatal (#479).
+
+use std::fmt;
+use std::sync::atomic::{AtomicBool, AtomicU8, Ordering};
+
+use foundationdb::runner::{AttemptFailure, RetryPolicy};
+use foundationdb::{FdbBindingError, FdbError, RetryDecision, RetryableError, options};
+
+mod common;
+
+/// A layer error keeping the FdbError as its source, like a thiserror enum
+/// with `#[source]`/`#[from]` would.
+#[derive(Debug)]
+struct WrappedFdbError {
+    source: FdbError,
+}
+
+impl fmt::Display for WrappedFdbError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "layer error: {}", self.source)
+    }
+}
+
+impl std::error::Error for WrappedFdbError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        Some(&self.source)
+    }
+}
+
+/// A typed layer error with an app-level retry condition.
+#[derive(Debug)]
+enum RetryTestError {
+    /// App-level retry request, no native error underneath.
+    NeedsRetry,
+    /// A domain error with no FdbError anywhere in its chain.
+    InvalidDocument,
+    Fdb(FdbError),
+    Binding(FdbBindingError),
+}
+
+impl fmt::Display for RetryTestError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{self:?}")
+    }
+}
+
+impl std::error::Error for RetryTestError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Fdb(e) => Some(e),
+            Self::Binding(e) => Some(e),
+            Self::NeedsRetry | Self::InvalidDocument => None,
+        }
+    }
+}
+
+impl From<FdbError> for RetryTestError {
+    fn from(e: FdbError) -> Self {
+        Self::Fdb(e)
+    }
+}
+
+impl From<FdbBindingError> for RetryTestError {
+    fn from(e: FdbBindingError) -> Self {
+        Self::Binding(e)
+    }
+}
+
+impl RetryableError for RetryTestError {
+    fn retry_decision(&self) -> RetryDecision {
+        match self {
+            Self::NeedsRetry => RetryDecision::Retry,
+            Self::Fdb(e) => RetryDecision::Fdb(*e),
+            Self::InvalidDocument | Self::Binding(_) => RetryDecision::Fatal,
+        }
+    }
+}
+
+/// The end-to-end regression for #479: a retryable FdbError wrapped inside a
+/// layer error and boxed into CustomError is retried (port of the Go
+/// binding's TestErrorWrapping).
+#[tokio::test]
+async fn run_retries_wrapped_closure_error() {
+    let db = common::database().await.expect("failed to open database");
+    let attempt = AtomicU8::new(0);
+    let attempt_ref = &attempt;
+
+    let result = db
+        .run(|trx, _| async move {
+            if attempt_ref.fetch_add(1, Ordering::SeqCst) == 0 {
+                return Err(FdbBindingError::new_custom_error(Box::new(
+                    WrappedFdbError {
+                        source: FdbError::from_code(1020),
+                    },
+                )));
+            }
+            trx.set(b"run_retry_wrapped", b"ok");
+            Ok(())
+        })
+        .await;
+
+    assert!(result.is_ok(), "wrapped retryable error must be retried");
+    assert_eq!(attempt.load(Ordering::SeqCst), 2);
+}
+
+/// Same regression through a typed closure error: the default source() walk
+/// makes the wrapped FdbError retryable and the caller gets the typed error
+/// back on fatal paths.
+#[tokio::test]
+async fn run_retries_typed_wrapped_error() {
+    let db = common::database().await.expect("failed to open database");
+    let attempt = AtomicU8::new(0);
+    let attempt_ref = &attempt;
+
+    let result = db
+        .run(|trx, _| async move {
+            if attempt_ref.fetch_add(1, Ordering::SeqCst) == 0 {
+                return Err(RetryTestError::from(FdbError::from_code(1020)));
+            }
+            trx.set(b"run_retry_typed", b"ok");
+            Ok(())
+        })
+        .await;
+
+    assert!(result.is_ok(), "typed wrapped error must be retried");
+    assert_eq!(attempt.load(Ordering::SeqCst), 2);
+}
+
+/// RetryDecision::Retry re-runs the closure through on_error(1020).
+#[tokio::test]
+async fn run_retry_decision_reruns_closure() {
+    let db = common::database().await.expect("failed to open database");
+    let attempt = AtomicU8::new(0);
+    let attempt_ref = &attempt;
+
+    let result = db
+        .run(|trx, _| async move {
+            if attempt_ref.fetch_add(1, Ordering::SeqCst) == 0 {
+                return Err(RetryTestError::NeedsRetry);
+            }
+            trx.set(b"run_retry_decision", b"ok");
+            Ok(())
+        })
+        .await;
+
+    assert!(result.is_ok(), "Retry decision must re-run the closure");
+    assert_eq!(attempt.load(Ordering::SeqCst), 2);
+}
+
+/// RetryDecision::Retry is governed by the C API retry budget: with
+/// RetryLimit(n) the closure runs n + 1 times and exhaustion returns the
+/// ORIGINAL typed error, not a synthetic FdbError.
+#[tokio::test]
+async fn run_retry_decision_honors_retry_limit() {
+    let db = common::database().await.expect("failed to open database");
+    let attempt = AtomicU8::new(0);
+    let attempt_ref = &attempt;
+    let retry_limit = 2;
+
+    let result: Result<(), RetryTestError> = db
+        .run(|trx, _| async move {
+            trx.set_option(options::TransactionOption::RetryLimit(retry_limit))?;
+            attempt_ref.fetch_add(1, Ordering::SeqCst);
+            Err(RetryTestError::NeedsRetry)
+        })
+        .await;
+
+    assert!(
+        matches!(result, Err(RetryTestError::NeedsRetry)),
+        "exhaustion must return the original typed error, got {result:?}"
+    );
+    assert_eq!(attempt.load(Ordering::SeqCst) as i32, retry_limit + 1);
+}
+
+/// An error with no FdbError in its chain is fatal: the closure runs exactly
+/// once and the caller gets the original error back.
+#[tokio::test]
+async fn run_typed_error_fatal_returns_original() {
+    let db = common::database().await.expect("failed to open database");
+    let attempt = AtomicU8::new(0);
+    let attempt_ref = &attempt;
+
+    let result: Result<(), RetryTestError> = db
+        .run(|_trx, _| async move {
+            attempt_ref.fetch_add(1, Ordering::SeqCst);
+            Err(RetryTestError::InvalidDocument)
+        })
+        .await;
+
+    assert!(
+        matches!(result, Err(RetryTestError::InvalidDocument)),
+        "fatal error must be returned as-is, got {result:?}"
+    );
+    assert_eq!(attempt.load(Ordering::SeqCst), 1);
+}
+
+/// `MaybeCommitted` is computed from the closure error itself: an error
+/// wrapping `commit_unknown_result` (1021) tells the next attempt that the
+/// previous one may have committed.
+#[tokio::test]
+async fn run_reports_maybe_committed_from_the_closure_error() {
+    let db = common::database().await.expect("failed to open database");
+    let attempt = AtomicU8::new(0);
+    let attempt_ref = &attempt;
+    let seen = AtomicBool::new(false);
+    let seen_ref = &seen;
+
+    let result: Result<(), RetryTestError> = db
+        .run(|trx, maybe_committed| async move {
+            if attempt_ref.fetch_add(1, Ordering::SeqCst) == 0 {
+                // commit_unknown_result: retryable and maybe committed.
+                return Err(RetryTestError::from(FdbError::from_code(1021)));
+            }
+            seen_ref.store(maybe_committed.into(), Ordering::SeqCst);
+            trx.set(b"run_retry_maybe_committed", b"ok");
+            Ok(())
+        })
+        .await;
+
+    assert!(result.is_ok(), "1021 must be retried: {result:?}");
+    assert_eq!(attempt.load(Ordering::SeqCst), 2);
+    assert!(
+        seen.load(Ordering::SeqCst),
+        "the retried closure must see maybe_committed"
+    );
+}
+
+/// A [`RetryPolicy`] rewriting the decision cannot clear `MaybeCommitted`: the
+/// flag is computed from the original error, before the policy is consulted.
+#[tokio::test]
+async fn retry_policy_cannot_clear_maybe_committed() {
+    /// Turns every failure into a plain retry, which on its own would leave
+    /// `MaybeCommitted` untouched.
+    struct AlwaysRetry;
+
+    impl RetryPolicy<RetryTestError> for AlwaysRetry {
+        fn decide(
+            &self,
+            _failure: AttemptFailure<'_, RetryTestError>,
+            _proposed: RetryDecision,
+            _attempt: usize,
+        ) -> RetryDecision {
+            RetryDecision::Retry
+        }
+    }
+
+    let db = common::database().await.expect("failed to open database");
+    let attempt = AtomicU8::new(0);
+    let attempt_ref = &attempt;
+    let seen = AtomicBool::new(false);
+    let seen_ref = &seen;
+
+    let result: Result<(), RetryTestError> = db
+        .runner()
+        .retry_policy(&AlwaysRetry)
+        .run(|trx, maybe_committed| async move {
+            if attempt_ref.fetch_add(1, Ordering::SeqCst) == 0 {
+                return Err(RetryTestError::from(FdbError::from_code(1021)));
+            }
+            seen_ref.store(maybe_committed.into(), Ordering::SeqCst);
+            trx.set(b"run_retry_policy_maybe_committed", b"ok");
+            Ok(())
+        })
+        .await;
+
+    assert!(result.is_ok(), "the policy must retry: {result:?}");
+    assert_eq!(attempt.load(Ordering::SeqCst), 2);
+    assert!(
+        seen.load(Ordering::SeqCst),
+        "the policy must not be able to clear maybe_committed"
+    );
+}
diff --git a/bindings/rust/foundationdb/tests/runner_hooks.rs b/bindings/rust/foundationdb/tests/runner_hooks.rs
new file mode 100644
index 00000000000..4512fc90e9e
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/runner_hooks.rs
@@ -0,0 +1,640 @@
+use foundationdb::*;
+#[allow(unused_imports)]
+use foundationdb_macros::cfg_api_versions;
+#[allow(unused_imports)]
+use std::sync::Arc;
+#[allow(unused_imports)]
+use std::sync::atomic::{AtomicU64, Ordering};
+
+mod common;
+
+/// Happy path: instrumented_run completes with metrics, no conflicts.
+#[tokio::test]
+async fn test_happy_path_instrumented() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    let (result, metrics) = db
+        .instrumented_run(|trx, _| async move {
+            trx.set(b"test_runner_hooks_happy", b"value");
+            Ok::<_, FdbBindingError>(42u64)
+        })
+        .await
+        .expect("transaction should succeed");
+
+    assert_eq!(result, 42);
+    assert_eq!(metrics.transaction.retries, 0);
+    assert_eq!(metrics.attempts.len(), 1);
+    assert!(metrics.attempts[0].conflicting_keys.ranges().is_empty());
+
+    Ok(())
+}
+
+/// Conflict path via instrumented_run: force a conflict and verify the
+/// conflicting keys of the conflicted attempt are populated when
+/// ReportConflictingKeys is enabled.
+///
+/// ReportConflictingKeys (option 712) was added in FDB 6.3.
+#[cfg_api_versions(min = 630)]
+#[tokio::test]
+async fn test_conflict_reports_in_metrics() -> FdbResult<()> {
+    let db = common::database().await?;
+    let attempt = Arc::new(AtomicU64::new(0));
+
+    let (_, metrics) = db
+        .instrumented_run(|trx, _| {
+            let attempt = attempt.clone();
+            async move {
+                let current = attempt.fetch_add(1, Ordering::SeqCst);
+
+                // Enable conflict reporting
+                trx.set_option(options::TransactionOption::ReportConflictingKeys)?;
+
+                // Read a key to establish read conflict range
+                let _ = trx.get(b"test_conflict_metrics_key", false).await?;
+
+                if current == 0 {
+                    // On first attempt, write the same key from another transaction
+                    let db2 = Database::new_compat(None).await?;
+                    let other_trx = db2.create_trx()?;
+                    other_trx.set(b"test_conflict_metrics_key", b"other_value");
+                    other_trx
+                        .commit()
+                        .await
+                        .map_err(|e| FdbBindingError::NonRetryableFdbError(FdbError::from(e)))?;
+                }
+
+                trx.set(b"test_conflict_metrics_key", b"my_value");
+                Ok::<_, FdbBindingError>(())
+            }
+        })
+        .await
+        .expect("transaction should eventually succeed");
+
+    // Should have retried at least once
+    assert!(metrics.transaction.retries >= 1);
+    // Should have recorded at least one conflict
+    assert!(metrics.transaction.conflict_count >= 1);
+    // Conflicting keys should be populated on the attempt that conflicted
+    assert!(
+        metrics
+            .attempts
+            .iter()
+            .any(|attempt| !attempt.conflicting_keys.ranges().is_empty()),
+        "expected conflicting keys to be reported"
+    );
+
+    Ok(())
+}
+
+/// Direct API: use Transaction::conflicting_keys() on a TransactionCommitError.
+///
+/// ReportConflictingKeys (option 712) was added in FDB 6.3.
+#[cfg_api_versions(min = 630)]
+#[tokio::test]
+async fn test_conflict_keys_direct_api() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    // Transaction A: read, then try to commit after B writes the same key
+    let trx_a = db.create_trx()?;
+    trx_a.set_option(options::TransactionOption::ReportConflictingKeys)?;
+    let _ = trx_a.get(b"test_conflict_direct_key", false).await?;
+
+    // Transaction B: write the same key and commit
+    let trx_b = db.create_trx()?;
+    trx_b.set(b"test_conflict_direct_key", b"b_value");
+    trx_b.commit().await.expect("trx B should commit");
+
+    // Transaction A: write something and try to commit — should conflict
+    trx_a.set(b"test_conflict_direct_key", b"a_value");
+    let commit_result = trx_a.commit().await;
+
+    match commit_result {
+        Ok(_committed) => {
+            // It's possible (though unlikely) that A commits successfully
+            // if the read version window doesn't overlap. That's fine.
+        }
+        Err(commit_error) => {
+            // Read conflicting keys before on_error resets the transaction
+            let conflicting = commit_error.conflicting_keys().await?;
+            for range in &conflicting {
+                eprintln!(
+                    "conflicting range: begin={:?} end={:?}",
+                    String::from_utf8_lossy(range.begin()),
+                    String::from_utf8_lossy(range.end()),
+                );
+            }
+            assert!(
+                !conflicting.is_empty(),
+                "expected conflicting keys on commit error"
+            );
+
+            // Verify the conflicting range includes our key
+            let key: &[u8] = b"test_conflict_direct_key";
+            let has_our_key = conflicting
+                .iter()
+                .any(|range| key >= range.begin() && key < range.end());
+            assert!(has_our_key, "conflicting range should contain our key");
+        }
+    }
+
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// Hook composition, ordering and lifecycle
+// ---------------------------------------------------------------------------
+
+use foundationdb::runner::{AttemptFailure, MetricsHooks, RetryPolicy, RunnerHooks};
+use std::fmt;
+use std::sync::Mutex;
+
+/// A layer error with an app-level retry condition and a fatal domain error,
+/// the two cases a [`RetryPolicy`] is expected to arbitrate.
+#[derive(Debug)]
+enum HookTestError {
+    /// Carries a retryable FdbError, so the runner proposes `Fdb`.
+    Fdb(FdbError),
+    Binding(FdbBindingError),
+    /// No FdbError anywhere in the chain: the runner proposes `Fatal`.
+    Domain,
+}
+
+impl fmt::Display for HookTestError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{self:?}")
+    }
+}
+
+impl std::error::Error for HookTestError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Fdb(e) => Some(e),
+            Self::Binding(e) => Some(e),
+            Self::Domain => None,
+        }
+    }
+}
+
+impl From<FdbError> for HookTestError {
+    fn from(e: FdbError) -> Self {
+        Self::Fdb(e)
+    }
+}
+
+impl From<FdbBindingError> for HookTestError {
+    fn from(e: FdbBindingError) -> Self {
+        Self::Binding(e)
+    }
+}
+
+impl RetryableError for HookTestError {}
+
+/// Records every callback it receives, tagged with the name of the hook, so a
+/// tuple of them shows both the lifecycle order and the order inside the tuple.
+struct RecordingHooks {
+    name: &'static str,
+    events: Arc<Mutex<Vec<String>>>,
+}
+
+impl RecordingHooks {
+    fn new(name: &'static str, events: &Arc<Mutex<Vec<String>>>) -> Self {
+        Self {
+            name,
+            events: events.clone(),
+        }
+    }
+
+    fn record(&self, event: &str) {
+        self.events
+            .lock()
+            .expect("events mutex")
+            .push(format!("{}:{event}", self.name));
+    }
+}
+
+impl RunnerHooks for RecordingHooks {
+    fn on_attempt_start(&self, _trx: &Transaction, attempt: usize) {
+        self.record(&format!("attempt_start:{attempt}"));
+    }
+
+    async fn before_commit(&self, _trx: &Transaction, attempt: usize) -> FdbResult<()> {
+        self.record(&format!("before_commit:{attempt}"));
+        Ok(())
+    }
+
+    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
+        self.record(&format!("hook_error:{}:{attempt}", err.code()));
+    }
+
+    fn on_commit_success(&self, _committed: &TransactionCommitted, _ms: u64, attempt: usize) {
+        self.record(&format!("commit_success:{attempt}"));
+    }
+
+    async fn on_commit_error(&self, err: &TransactionCommitError, attempt: usize) -> FdbResult<()> {
+        self.record(&format!("commit_error:{}:{attempt}", err.code()));
+        Ok(())
+    }
+
+    fn on_closure_error(&self, err: &FdbError, attempt: usize) {
+        self.record(&format!("closure_error:{}:{attempt}", err.code()));
+    }
+
+    fn on_error_duration(&self, _ms: u64, attempt: usize) {
+        self.record(&format!("error_duration:{attempt}"));
+    }
+
+    fn on_retry(&self, attempt: usize) {
+        self.record(&format!("retry:{attempt}"));
+    }
+
+    fn on_complete(&self) {
+        self.record("complete");
+    }
+}
+
+/// Hooks whose `before_commit` always fails, to check that the runner reports
+/// it and commits anyway.
+struct FailingBeforeCommit {
+    events: Arc<Mutex<Vec<String>>>,
+}
+
+impl RunnerHooks for FailingBeforeCommit {
+    async fn before_commit(&self, _trx: &Transaction, _attempt: usize) -> FdbResult<()> {
+        self.events
+            .lock()
+            .expect("events mutex")
+            .push("before_commit".to_string());
+        // transaction_timed_out, an error the transaction itself never hit.
+        Err(FdbError::from_code(1031))
+    }
+
+    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
+        self.events
+            .lock()
+            .expect("events mutex")
+            .push(format!("hook_error:{}:{attempt}", err.code()));
+    }
+}
+
+/// Both hooks of a tuple fire, left to right, and the lifecycle order of a run
+/// that retries once is stable.
+#[tokio::test]
+async fn tuple_hooks_fire_left_to_right_in_lifecycle_order() {
+    let db = common::database().await.expect("failed to open database");
+    let events = Arc::new(Mutex::new(Vec::new()));
+    let hooks = (
+        RecordingHooks::new("a", &events),
+        RecordingHooks::new("b", &events),
+    );
+    let attempts = AtomicU64::new(0);
+    let attempts_ref = &attempts;
+
+    let result: Result<(), HookTestError> = db
+        .run_with_hooks(&hooks, |trx, _| async move {
+            if attempts_ref.fetch_add(1, Ordering::SeqCst) == 0 {
+                return Err(HookTestError::Fdb(FdbError::from_code(1020)));
+            }
+            trx.set(b"runner_hooks_tuple", b"ok");
+            Ok(())
+        })
+        .await;
+
+    assert!(result.is_ok(), "run should succeed on the second attempt");
+    let events = events.lock().expect("events mutex").clone();
+    assert_eq!(
+        events,
+        vec![
+            "a:attempt_start:0",
+            "b:attempt_start:0",
+            "a:closure_error:1020:0",
+            "b:closure_error:1020:0",
+            "a:error_duration:0",
+            "b:error_duration:0",
+            "a:retry:0",
+            "b:retry:0",
+            "a:attempt_start:1",
+            "b:attempt_start:1",
+            "a:before_commit:1",
+            "b:before_commit:1",
+            "a:commit_success:1",
+            "b:commit_success:1",
+            "a:complete",
+            "b:complete",
+        ],
+    );
+}
+
+/// `Option<H>`: `Some` behaves like the hooks themselves, `None` is a no-op.
+#[tokio::test]
+async fn option_hooks_are_a_noop_when_none() {
+    let db = common::database().await.expect("failed to open database");
+
+    let events = Arc::new(Mutex::new(Vec::new()));
+    let some = Some(RecordingHooks::new("some", &events));
+    db.run_with_hooks(&some, |trx, _| async move {
+        trx.set(b"runner_hooks_option_some", b"ok");
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("run should succeed");
+
+    assert_eq!(
+        events.lock().expect("events mutex").clone(),
+        vec![
+            "some:attempt_start:0",
+            "some:before_commit:0",
+            "some:commit_success:0",
+            "some:complete",
+        ],
+    );
+
+    let none: Option<RecordingHooks> = None;
+    db.run_with_hooks(&none, |trx, _| async move {
+        trx.set(b"runner_hooks_option_none", b"ok");
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("run should succeed without hooks");
+}
+
+/// A `before_commit` that fails is reported through `on_hook_error`, and the
+/// transaction is committed all the same.
+#[tokio::test]
+async fn before_commit_error_is_reported_but_does_not_abort_the_commit() {
+    let db = common::database().await.expect("failed to open database");
+    let events = Arc::new(Mutex::new(Vec::new()));
+    let hooks = FailingBeforeCommit {
+        events: events.clone(),
+    };
+
+    db.run_with_hooks(&hooks, |trx, _| async move {
+        trx.set(b"runner_hooks_before_commit", b"committed");
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("the failing hook must not abort the run");
+
+    assert_eq!(
+        events.lock().expect("events mutex").clone(),
+        vec!["before_commit", "hook_error:1031:0"],
+    );
+
+    let value = db
+        .run(|trx, _| async move {
+            Ok::<_, FdbBindingError>(
+                trx.get(b"runner_hooks_before_commit", false)
+                    .await?
+                    .map(|slice| slice.to_vec()),
+            )
+        })
+        .await
+        .expect("read back");
+    assert_eq!(value.as_deref(), Some(b"committed".as_ref()));
+}
+
+/// `on_complete` fires exactly once on the fatal path, and the original error
+/// is returned.
+#[tokio::test]
+async fn on_complete_fires_once_on_the_fatal_path() {
+    let db = common::database().await.expect("failed to open database");
+    let events = Arc::new(Mutex::new(Vec::new()));
+    let hooks = RecordingHooks::new("h", &events);
+
+    let result: Result<(), HookTestError> = db
+        .run_with_hooks(&hooks, |_trx, _| async move { Err(HookTestError::Domain) })
+        .await;
+
+    assert!(matches!(result, Err(HookTestError::Domain)));
+    assert_eq!(
+        events.lock().expect("events mutex").clone(),
+        vec!["h:attempt_start:0", "h:complete"],
+    );
+}
+
+/// `on_complete` fires exactly once when the C API retry budget is exhausted.
+#[tokio::test]
+async fn on_complete_fires_once_when_retries_are_exhausted() {
+    let db = common::database().await.expect("failed to open database");
+    let events = Arc::new(Mutex::new(Vec::new()));
+    let hooks = RecordingHooks::new("h", &events);
+
+    let result: Result<(), HookTestError> = db
+        .run_with_hooks(&hooks, |trx, _| async move {
+            trx.set_option(options::TransactionOption::RetryLimit(1))?;
+            Err(HookTestError::Fdb(FdbError::from_code(1020)))
+        })
+        .await;
+
+    assert!(matches!(result, Err(HookTestError::Fdb(_))));
+    let events = events.lock().expect("events mutex").clone();
+    assert_eq!(
+        events.iter().filter(|event| *event == "h:complete").count(),
+        1,
+        "on_complete must fire exactly once, got {events:?}"
+    );
+    assert_eq!(
+        events.last().map(String::as_str),
+        Some("h:complete"),
+        "on_complete must be the last event, got {events:?}"
+    );
+    // RetryLimit(1): one retry, so two attempts.
+    assert!(events.contains(&"h:attempt_start:1".to_string()));
+    assert!(!events.contains(&"h:attempt_start:2".to_string()));
+}
+
+// ---------------------------------------------------------------------------
+// Retry policies
+// ---------------------------------------------------------------------------
+
+/// Stops the run once `max` attempts have been made, whatever the error.
+struct MaxAttempts {
+    max: usize,
+}
+
+impl RetryPolicy<HookTestError> for MaxAttempts {
+    fn decide(
+        &self,
+        _failure: AttemptFailure<'_, HookTestError>,
+        proposed: RetryDecision,
+        attempt: usize,
+    ) -> RetryDecision {
+        if attempt + 1 >= self.max {
+            RetryDecision::Fatal
+        } else {
+            proposed
+        }
+    }
+}
+
+/// Retries an app-level error the runner would consider fatal.
+struct RetryDomainErrors;
+
+impl RetryPolicy<HookTestError> for RetryDomainErrors {
+    fn decide(
+        &self,
+        failure: AttemptFailure<'_, HookTestError>,
+        proposed: RetryDecision,
+        _attempt: usize,
+    ) -> RetryDecision {
+        match failure {
+            AttemptFailure::Closure(HookTestError::Domain) => RetryDecision::Retry,
+            _ => proposed,
+        }
+    }
+}
+
+/// A policy capping the attempts ends the run with the original closure error,
+/// before the C API retry budget has anything to say.
+#[tokio::test]
+async fn retry_policy_can_cap_the_number_of_attempts() {
+    let db = common::database().await.expect("failed to open database");
+    let attempts = AtomicU64::new(0);
+    let attempts_ref = &attempts;
+    let policy = MaxAttempts { max: 3 };
+
+    let result: Result<(), HookTestError> = db
+        .runner()
+        .retry_policy(&policy)
+        .run(|_trx, _| async move {
+            attempts_ref.fetch_add(1, Ordering::SeqCst);
+            // Retryable on its own: only the policy can stop this run.
+            Err(HookTestError::Fdb(FdbError::from_code(1020)))
+        })
+        .await;
+
+    assert!(
+        matches!(result, Err(HookTestError::Fdb(e)) if e.code() == 1020),
+        "the original closure error must be returned, got {result:?}"
+    );
+    assert_eq!(attempts.load(Ordering::SeqCst), 3);
+}
+
+/// A policy can retry an error the runner classifies as fatal: it goes through
+/// `on_error` with code 1020, like a `RetryDecision::Retry` from the error
+/// itself would.
+#[tokio::test]
+async fn retry_policy_can_retry_an_otherwise_fatal_error() {
+    let db = common::database().await.expect("failed to open database");
+    let attempts = AtomicU64::new(0);
+    let attempts_ref = &attempts;
+    let events = Arc::new(Mutex::new(Vec::new()));
+    let hooks = RecordingHooks::new("h", &events);
+
+    let result: Result<(), HookTestError> = db
+        .runner()
+        .hooks(&hooks)
+        .retry_policy(&RetryDomainErrors)
+        .run(|trx, _| async move {
+            if attempts_ref.fetch_add(1, Ordering::SeqCst) == 0 {
+                return Err(HookTestError::Domain);
+            }
+            trx.set(b"runner_hooks_policy_retry", b"ok");
+            Ok(())
+        })
+        .await;
+
+    assert!(result.is_ok(), "the policy must force a retry: {result:?}");
+    assert_eq!(attempts.load(Ordering::SeqCst), 2);
+    let events = events.lock().expect("events mutex").clone();
+    assert!(
+        events.contains(&"h:closure_error:1020:0".to_string()),
+        "the fatal error must be routed through on_error(1020), got {events:?}"
+    );
+}
+
+// ---------------------------------------------------------------------------
+// MetricsHooks stacked on user hooks
+// ---------------------------------------------------------------------------
+
+/// The wiring case: metrics hooks stacked on a user hook through the plain
+/// `run_with_hooks` produce the same complete report as `instrumented_run`.
+#[tokio::test]
+async fn metrics_hooks_stacked_on_user_hooks_produce_a_full_report() {
+    let db = common::database().await.expect("failed to open database");
+    let events = Arc::new(Mutex::new(Vec::new()));
+    let metrics = TransactionMetrics::new();
+    let hooks = (
+        MetricsHooks::new(&metrics),
+        RecordingHooks::new("user", &events),
+    );
+    let attempts = AtomicU64::new(0);
+    let attempts_ref = &attempts;
+
+    let result: Result<(), HookTestError> = db
+        .run_with_hooks(&hooks, |trx, _| async move {
+            let first = attempts_ref.fetch_add(1, Ordering::SeqCst) == 0;
+            trx.set(b"runner_hooks_metrics_stacked", b"value");
+            trx.set_custom_metric("stacked", 1, &[]);
+            let _ = trx.get(b"runner_hooks_metrics_stacked", false).await?;
+            if first {
+                return Err(HookTestError::Fdb(FdbError::from_code(1020)));
+            }
+            Ok(())
+        })
+        .await;
+
+    assert!(result.is_ok(), "run should succeed: {result:?}");
+
+    let report = metrics.get_metrics_data();
+    assert_eq!(report.transaction.retries, 1);
+    assert_eq!(
+        report.attempts.len(),
+        report.transaction.retries as usize + 1,
+        "attempts are pushed exactly once per attempt: {report:#?}"
+    );
+    assert!(report.total_duration.is_some());
+    assert!(report.transaction.commit_version.is_some());
+
+    let first = &report.attempts[0];
+    assert_eq!(first.index, 0);
+    assert!(matches!(first.outcome, AttemptOutcome::Retried { .. }));
+    assert!(first.on_error_duration.is_some());
+    assert_eq!(first.usage.call_set, 1);
+    assert_eq!(first.usage.call_get, 1);
+    assert!(first.usage.bytes_written > 0);
+    assert_eq!(
+        first
+            .custom_metrics
+            .get(&metrics::MetricKey::new("stacked", &[])),
+        Some(&1),
+    );
+
+    let last = report.attempts.last().expect("a last attempt");
+    assert!(matches!(last.outcome, AttemptOutcome::Committed));
+    assert!(last.commit_duration.is_some());
+    assert_eq!(last.usage.call_set, 1);
+
+    // The user hook saw the same run.
+    let events = events.lock().expect("events mutex").clone();
+    assert_eq!(
+        events.first().map(String::as_str),
+        Some("user:attempt_start:0")
+    );
+    assert_eq!(events.last().map(String::as_str), Some("user:complete"));
+}
+
+/// A reference to hooks is itself hooks, and delegates to what it points at.
+#[tokio::test]
+async fn reference_hooks_delegate_to_the_hooks_they_point_at() {
+    let db = common::database().await.expect("failed to open database");
+    let events = Arc::new(Mutex::new(Vec::new()));
+    let hooks = RecordingHooks::new("ref", &events);
+    let by_reference = &hooks;
+
+    db.run_with_hooks(&by_reference, |trx, _| async move {
+        trx.set(b"runner_hooks_reference", b"ok");
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("run should succeed");
+
+    assert_eq!(
+        events.lock().expect("events mutex").clone(),
+        vec![
+            "ref:attempt_start:0",
+            "ref:before_commit:0",
+            "ref:commit_success:0",
+            "ref:complete",
+        ],
+    );
+}
diff --git a/bindings/rust/foundationdb/tests/timekeeper.rs b/bindings/rust/foundationdb/tests/timekeeper.rs
new file mode 100644
index 00000000000..357f21b0f0e
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/timekeeper.rs
@@ -0,0 +1,57 @@
+use foundationdb::timekeeper::{HintMode, hint_version_from_timestamp};
+use std::time::SystemTime;
+
+#[tokio::test]
+async fn timekeeper() {
+    let database = foundationdb::Database::new_compat(None)
+        .await
+        .expect("Unable to create database");
+    let now = SystemTime::now()
+        .duration_since(SystemTime::UNIX_EPOCH)
+        .expect("Unable to get timestamp")
+        .as_secs();
+    // Let some time passed in order to create a new timekeeper entry
+    tokio::time::sleep(std::time::Duration::from_secs(10)).await;
+    // A new transaction is needed because the one which get the read version has no
+    // knowledge about the new System Namespace Keyspace thus, further timekeeper
+    // keys are unknown for the first transaction.
+    // Creating a new one, make the first to be commited. The second will have the right
+    // timekeeper state.
+    let trx = database.create_trx().expect("Unable to create transaction");
+    let result = hint_version_from_timestamp(&trx, now, HintMode::AfterTimestamp, true)
+        .await
+        .expect("Unable to get hint version");
+    assert!(result.is_some());
+
+    // create a new transaction to fail getting read version in the future
+    let trx = database.create_trx().expect("Unable to create transaction");
+    let future_date = now + 50;
+    let result = hint_version_from_timestamp(&trx, future_date, HintMode::AfterTimestamp, true)
+        .await
+        .expect("Unable to get hint version");
+    assert!(result.is_none());
+
+    // create a new transaction to get the first read version greater than a long past timestamp
+    let trx = database.create_trx().expect("Unable to create transaction");
+    let past_date = 0;
+    let result = hint_version_from_timestamp(&trx, past_date, HintMode::AfterTimestamp, true)
+        .await
+        .expect("Unable to get hint version");
+    assert!(result.is_some());
+
+    // create a new transaction to get the first available read version
+    let trx = database.create_trx().expect("Unable to create transaction");
+    let future_date = now + 50;
+    let result = hint_version_from_timestamp(&trx, future_date, HintMode::BeforeTimestamp, true)
+        .await
+        .expect("Unable to get hint version");
+    assert!(result.is_some());
+
+    // create a new transaction to fail getting older read version
+    let trx = database.create_trx().expect("Unable to create transaction");
+    let past_date = 0;
+    let result = hint_version_from_timestamp(&trx, past_date, HintMode::BeforeTimestamp, true)
+        .await
+        .expect("Unable to get hint version");
+    assert!(result.is_none());
+}
diff --git a/bindings/rust/foundationdb/tests/tokio.rs b/bindings/rust/foundationdb/tests/tokio.rs
new file mode 100644
index 00000000000..09b5c23dce5
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/tokio.rs
@@ -0,0 +1,206 @@
+extern crate core;
+
+use foundationdb::future::FdbValues;
+use foundationdb::options::ConflictRangeType;
+use foundationdb::tuple::{Subspace, pack};
+use foundationdb::*;
+use futures::prelude::*;
+use std::fmt::{Display, Formatter};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicI16, Ordering};
+use std::time::Duration;
+use tokio::time::timeout;
+
+mod common;
+
+#[derive(Debug)]
+enum CustomError {
+    MyError1,
+}
+
+impl Display for CustomError {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(f, "MyError1")
+    }
+}
+
+impl std::error::Error for CustomError {}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn do_run_with_custom_error() {
+    let db = Arc::new(
+        foundationdb::Database::new_compat(None)
+            .await
+            .expect("failed to open fdb"),
+    );
+
+    db.perform_no_op().await.expect("could not perform no_op");
+
+    let result: Result<(), FdbBindingError> = db
+        .run(|_trx, _maybe_committed| async move {
+            let toto: Box<CustomError> = Box::new(CustomError::MyError1);
+            Err(FdbBindingError::new_custom_error(toto))
+        })
+        .await;
+
+    match result {
+        Ok(_) => panic!("expecting an error, got an Ok from db.run"),
+        Err(err) => match err {
+            FdbBindingError::CustomError(e) => match e.downcast_ref::<CustomError>().unwrap() {
+                // no-op
+                CustomError::MyError1 => {}
+            },
+            FdbBindingError::ReferenceToTransactionKept => {}
+            _ => panic!("expecting an Custom Error"),
+        },
+    }
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn do_transact() {
+    let db = Arc::new(
+        foundationdb::Database::new_compat(None)
+            .await
+            .expect("failed to open fdb"),
+    );
+
+    if (timeout(Duration::from_secs(1), db.perform_no_op()).await).is_err() {
+        panic!("database is unavailable");
+    }
+
+    let adb = db;
+    tokio::spawn(async move {
+        async fn txnfn(_txn: &Transaction) -> FdbResult<()> {
+            Ok(())
+        }
+
+        adb.transact_boxed(
+            (),
+            |txn: &Transaction, ()| txnfn(txn).boxed(),
+            TransactOption::default(),
+        )
+        .await
+        .expect("failed to transact")
+    });
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn do_trx() {
+    let db = Arc::new(
+        foundationdb::Database::new_compat(None)
+            .await
+            .expect("failed to open fdb"),
+    );
+
+    let adb = db;
+    tokio::spawn(async move {
+        adb.create_trx()
+            .expect("failed to create trx")
+            .commit()
+            .await
+            .expect("failed to commit");
+    });
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn do_run() {
+    let limit_retry = 16;
+    let db = Arc::new(
+        foundationdb::Database::new_compat(None)
+            .await
+            .expect("failed to open fdb"),
+    );
+
+    let counter = AtomicI16::new(0);
+    let counter_ref = &counter;
+    let db_arc = &db;
+
+    let result = db
+        .run(|trx, _maybe_committed| async move {
+            let read_subspace = Subspace::all().subspace(&("do_run"));
+            let conflict_transaction = db_arc.create_trx().expect("could not create a transaction");
+
+            let local_counter = counter_ref.fetch_add(1, Ordering::SeqCst);
+
+            // virtually reading some random data in the subspace "do_run"
+            trx.add_conflict_range(
+                &read_subspace.range().0,
+                &read_subspace.range().1,
+                ConflictRangeType::Write,
+            )?;
+
+            let _keys: Vec<FdbValues> = trx
+                .get_ranges(read_subspace.range().into(), false)
+                .try_collect()
+                .await?;
+
+            trx.set(&read_subspace.pack(&(1)), &pack(&("42")));
+
+            if local_counter < limit_retry {
+                // writing with another transaction in the subspace "do_run"
+                conflict_transaction.set(&read_subspace.pack(&(2)), &pack(&("42")));
+                conflict_transaction
+                    .commit()
+                    .await
+                    .expect("cannot commit the conflict transaction");
+            }
+
+            // trying to commit
+            Ok::<_, FdbBindingError>(())
+        })
+        .await;
+
+    assert!(result.is_ok());
+    assert_eq!(limit_retry + 1, counter.load(Ordering::SeqCst));
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn do_run_with_transaction_limits() {
+    let limit_retry = 16;
+    let db = Arc::new(
+        foundationdb::Database::new_compat(None)
+            .await
+            .expect("failed to open fdb"),
+    );
+
+    let db_arc = &db;
+    let counter = AtomicI16::new(0);
+    let counter_ref = &counter;
+
+    let result = db
+        .run(|trx, _maybe_committed| async move {
+            // dedicated subspace: do_run() uses "do_run" and both tests run in parallel
+            let read_subspace = Subspace::all().subspace(&("do_run_limits"));
+            trx.set_option(foundationdb::options::TransactionOption::RetryLimit(16))?;
+
+            let conflict_transaction = db_arc.create_trx().expect("could not create a transaction");
+            counter_ref.fetch_add(1, Ordering::SeqCst);
+
+            // virtually reading some random data in the subspace "do_run_limits"
+            let _keys: Vec<FdbValues> = trx
+                .get_ranges(read_subspace.range().into(), false)
+                .try_collect()
+                .await?;
+
+            trx.set(
+                &Subspace::all().pack(&("do_run_limits", "1")),
+                &pack(&("42")),
+            );
+
+            // writing with another transaction in the subspace "do_run_limits"
+            conflict_transaction.set(
+                &Subspace::all().pack(&("do_run_limits", "2")),
+                &pack(&("42")),
+            );
+            conflict_transaction
+                .commit()
+                .await
+                .expect("cannot commit the conflict transaction");
+
+            Ok::<_, FdbBindingError>(())
+        })
+        .await;
+
+    assert!(result.is_err());
+    assert_eq!(limit_retry + 1, counter.load(Ordering::SeqCst));
+}
diff --git a/bindings/rust/foundationdb/tests/trace.rs b/bindings/rust/foundationdb/tests/trace.rs
new file mode 100644
index 00000000000..68512592f9a
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/trace.rs
@@ -0,0 +1,91 @@
+#[cfg(feature = "trace")]
+use foundationdb::{FdbBindingError, FdbError};
+#[cfg(feature = "trace")]
+use std::error::Error;
+#[cfg(feature = "trace")]
+use std::fmt::Formatter;
+#[cfg(feature = "trace")]
+use std::sync::atomic::AtomicU8;
+
+#[cfg(feature = "trace")]
+#[tokio::test]
+async fn test_trace() {
+    use tracing_subscriber::fmt::format::FmtSpan;
+
+    let test_writer = tracing_subscriber::fmt::TestWriter::new();
+
+    let _e = tracing_subscriber::fmt()
+        .with_max_level(tracing::Level::TRACE)
+        .with_span_events(FmtSpan::FULL)
+        .with_writer(test_writer)
+        .try_init();
+
+    test_traces_on_run().await;
+}
+
+#[cfg(feature = "trace")]
+#[tracing::instrument(skip_all)]
+async fn test_traces_on_run() {
+    let db = foundationdb::Database::new_compat(None)
+        .await
+        .expect("failed to open fdb");
+
+    db.run(|trx, _b| async move {
+        trx.set("tracing".as_ref(), "ok".as_ref());
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("could not run transaction");
+
+    // Test closure error
+    #[derive(Debug)]
+    struct CustomError;
+
+    impl std::fmt::Display for CustomError {
+        fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+            write!(f, "{self:?}")
+        }
+    }
+    impl Error for CustomError {}
+
+    let result = db
+        .run(|_trx, _b| async move {
+            Err::<(), FdbBindingError>(FdbBindingError::CustomError(Box::new(CustomError)))
+        })
+        .await;
+
+    assert!(result.is_err());
+
+    // test transaction kept error
+    let result = db
+        .run(|trx, _b| async move {
+            let trx_clone = trx.clone();
+            Ok(trx_clone)
+        })
+        .await;
+    assert!(result.is_err());
+    if let Err(e) = result {
+        assert!(matches!(e, FdbBindingError::ReferenceToTransactionKept));
+    }
+
+    // Test retryable errors
+    let attempt: AtomicU8 = AtomicU8::new(0);
+    let result = db
+        .run(|_trx, _| async {
+            let new_val = &attempt.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+            if *new_val < 2 {
+                return Err(FdbError::from_code(1020).into());
+            }
+            Ok::<_, FdbBindingError>(())
+        })
+        .await;
+    assert!(result.is_ok());
+
+    // cleaning up
+    db.run(|trx, _b| async move {
+        trx.clear("tracing".as_ref());
+        Ok::<_, FdbBindingError>(())
+    })
+    .await
+    .expect("could not run transaction");
+}
diff --git a/bindings/rust/foundationdb/tests/tuple.rs b/bindings/rust/foundationdb/tests/tuple.rs
new file mode 100644
index 00000000000..e61b5360c8a
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/tuple.rs
@@ -0,0 +1,363 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+use foundationdb::{
+    ClientBudget, Database, FdbBindingError, FdbError,
+    options::MutationType,
+    tuple::{Subspace, Versionstamp},
+};
+use futures::StreamExt;
+use std::sync::{Arc, Barrier, Mutex};
+use std::thread;
+
+mod common;
+
+#[tokio::test]
+// testing subspace with versionstamps.
+async fn test_tuples() {
+    let db = common::database().await.expect("cannot open fdb");
+
+    // Clear only this test's subspace: versionstamped keys accumulate across
+    // runs, and the rest of the cluster is none of our business.
+    eprintln!("clearing the test subspace");
+    let trx = db.create_trx().expect("cannot create txn");
+    trx.clear_subspace_range(&Subspace::from("test-tuple"));
+    trx.commit().await.expect("could not clear keys");
+
+    eprintln!("creating directories");
+    test_subspace_with_versionstamp(&db).await;
+}
+
+async fn test_subspace_with_versionstamp(db: &Database) {
+    let trx = db.create_trx().expect("cannot create txn");
+
+    // In this example we will create a subspace starting with a versionstamp.
+    let subspace = Subspace::from("test-tuple");
+    let subspace = subspace.subspace(&Versionstamp::incomplete(0));
+    let key = subspace.pack_with_versionstamp(&"key");
+
+    eprintln!("writing key {key:?}");
+    trx.atomic_op(&key, b"hello", MutationType::SetVersionstampedKey);
+
+    // we want to get the versionstamp back to be able to read the subspace.
+    let versionstamp = trx.get_versionstamp();
+
+    trx.commit().await.expect("cannot commit");
+
+    let versionstamp = versionstamp
+        .await
+        .expect("cannot get versionstamp after commit");
+    let versionstamp = Versionstamp::complete(
+        (*versionstamp)
+            .try_into()
+            .expect("versionstamp is the wrong size"),
+        0,
+    );
+    // Now that we have the versionstamp we can rebuild the subspace and read the key.
+    let trx = db.create_trx().expect("cannot create txn");
+
+    // In this example we will create a subspace starting with a versionstamp.
+    let subspace = Subspace::from("test-tuple");
+    let subspace = subspace.subspace(&versionstamp);
+
+    {
+        // we can read the whole subspace to get the chance to unpack the key too.
+        let mut elements = trx.get_ranges_keyvalues(subspace.range().into(), false);
+        while let Some(key_value) = elements.next().await {
+            let key_value = key_value.expect("cannot read keyvalue");
+            let key = subspace
+                .unpack::<String>(key_value.key())
+                .expect("cannot unpack key");
+            assert_eq!(key, "key");
+            assert_eq!(key_value.value(), b"hello");
+        }
+    }
+    trx.commit().await.expect("cannot commit");
+
+    // Now that the subspace already exists, we can add more versionstamped keys in there.
+    let trx = db.create_trx().expect("cannot create txn");
+    let key = subspace.pack_with_versionstamp(&Versionstamp::incomplete(0));
+    trx.atomic_op(&key, b"hello2", MutationType::SetVersionstampedKey);
+    let key_versionstamp = trx.get_versionstamp();
+    trx.commit().await.expect("cannot commit");
+    let key_versionstamp = key_versionstamp
+        .await
+        .expect("cannot get versionstamp after commit");
+    let key_versionstamp = Versionstamp::complete(
+        (*key_versionstamp)
+            .try_into()
+            .expect("versionstamp is the wrong size"),
+        0,
+    );
+    // we can read the key back by re-packing with the subspace:
+    let trx = db.create_trx().expect("cannot create txn");
+    let key = subspace.pack_with_versionstamp(&key_versionstamp);
+    let value = trx.get(&key, false).await.expect("cannot read key");
+    assert_eq!(value.as_deref(), Some(b"hello2".as_ref()));
+    trx.commit().await.expect("cannot commit");
+}
+
+#[tokio::test]
+async fn user_version_allocator_is_per_transaction_and_shared_by_runner_clones()
+-> Result<(), FdbBindingError> {
+    let db = common::database().await?;
+
+    let first = db.create_trx()?;
+    let second = db.create_trx()?;
+    assert_eq!(first.allocate_user_version()?, 0);
+    assert_eq!(second.allocate_user_version()?, 0);
+    assert_eq!(first.allocate_user_version()?, 1);
+
+    let versions = db
+        .run(|trx, _| async move {
+            let other_handle = trx.clone();
+            let versions = [
+                trx.allocate_user_version()?,
+                other_handle.allocate_user_version()?,
+                trx.allocate_user_version()?,
+            ];
+            drop(other_handle);
+            Ok::<_, FdbBindingError>(versions)
+        })
+        .await?;
+    assert_eq!(versions, [0, 1, 2]);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn user_version_allocator_is_concurrent_and_exhaustible() -> Result<(), FdbBindingError> {
+    const THREADS: usize = 8;
+    const VERSIONS_PER_THREAD: usize = 8_192;
+
+    let db = common::database().await?;
+    let trx = Arc::new(db.create_trx()?);
+    let start = Arc::new(Barrier::new(THREADS));
+    let mut threads = Vec::with_capacity(THREADS);
+    for _ in 0..THREADS {
+        let trx = trx.clone();
+        let start = start.clone();
+        threads.push(thread::spawn(move || {
+            start.wait();
+            (0..VERSIONS_PER_THREAD)
+                .map(|_| {
+                    trx.allocate_user_version()
+                        .expect("allocator must not exhaust early")
+                })
+                .collect::<Vec<_>>()
+        }));
+    }
+
+    let mut versions = threads
+        .into_iter()
+        .flat_map(|thread| thread.join().expect("allocator thread panicked"))
+        .collect::<Vec<_>>();
+    versions.sort_unstable();
+    assert_eq!(versions, (0..=u16::MAX).collect::<Vec<_>>());
+    assert!(matches!(
+        trx.allocate_user_version(),
+        Err(FdbBindingError::UserVersionExhausted)
+    ));
+    assert!(matches!(
+        trx.allocate_user_version(),
+        Err(FdbBindingError::UserVersionExhausted)
+    ));
+
+    let mut trx = Arc::try_unwrap(trx).expect("allocator references must be released");
+    trx.reset();
+    assert_eq!(trx.allocate_user_version()?, 0);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn user_version_allocator_restarts_with_transaction_attempts() -> Result<(), FdbBindingError>
+{
+    let db = common::database().await?;
+
+    let mut trx = db.create_trx()?;
+    assert_eq!(trx.allocate_user_version()?, 0);
+    trx.reset();
+    assert_eq!(trx.allocate_user_version()?, 0);
+
+    let trx = trx.on_error(FdbError::from_code(1020)).await?;
+    assert_eq!(trx.allocate_user_version()?, 0);
+
+    let trx = trx.cancel().reset();
+    assert_eq!(trx.allocate_user_version()?, 0);
+
+    let trx = trx.commit().await.map_err(FdbError::from)?.reset();
+    assert_eq!(trx.allocate_user_version()?, 0);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn user_version_allocator_restarts_after_commit_error_paths() -> Result<(), FdbBindingError> {
+    let db = common::database().await?;
+
+    let trx = commit_error_after_allocation(&db, b"test-user-version-reset-error").await;
+    let trx = trx.reset();
+    assert_eq!(trx.allocate_user_version()?, 0);
+
+    let trx = commit_error_after_allocation(&db, b"test-user-version-on-error").await;
+    let trx = trx.on_error().await?;
+    assert_eq!(trx.allocate_user_version()?, 0);
+
+    Ok(())
+}
+
+async fn commit_error_after_allocation(
+    db: &Database,
+    key: &[u8],
+) -> foundationdb::TransactionCommitError {
+    let trx = db.create_trx().expect("cannot create transaction");
+    assert_eq!(
+        trx.allocate_user_version()
+            .expect("cannot allocate user version"),
+        0
+    );
+    trx.get(key, false).await.expect("cannot read conflict key");
+
+    let conflicting = db
+        .create_trx()
+        .expect("cannot create conflicting transaction");
+    conflicting.set(key, b"conflicting value");
+    conflicting
+        .commit()
+        .await
+        .expect("cannot commit conflicting transaction");
+
+    trx.set(key, b"original value");
+    trx.commit().await.expect_err("transaction must conflict")
+}
+
+#[tokio::test]
+async fn user_version_allocator_survives_budget_changes_and_does_not_affect_accounting()
+-> Result<(), FdbBindingError> {
+    let db = common::database().await?;
+
+    let trx = db.create_trx()?;
+    assert_eq!(trx.allocate_user_version()?, 0);
+    trx.set_client_budget(ClientBudget::default());
+    assert_eq!(trx.allocate_user_version()?, 1);
+
+    let (version, metrics) = db
+        .instrumented_run(|trx, _| async move {
+            assert_eq!(trx.allocate_user_version()?, 0);
+            trx.allocate_user_version()
+        })
+        .await
+        .map_err(|(error, _metrics)| error)?;
+    assert_eq!(version, 1);
+    let usage = metrics.total_usage();
+    assert_eq!(usage.bytes_read, 0);
+    assert_eq!(usage.bytes_written, 0);
+    assert_eq!(usage.call_set, 0);
+    assert_eq!(usage.call_atomic_op, 0);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn user_version_allocator_runner_retry_restarts_and_keeps_clones_shared()
+-> Result<(), FdbBindingError> {
+    let db = common::database().await?;
+    let attempts = Arc::new(Mutex::new(Vec::new()));
+
+    db.run(|trx, _| {
+        let attempts = attempts.clone();
+        async move {
+            let clone = trx.clone();
+            let versions = [trx.allocate_user_version()?, clone.allocate_user_version()?];
+            drop(clone);
+
+            let mut attempts = attempts.lock().expect("attempt list mutex poisoned");
+            let retry = attempts.is_empty();
+            attempts.push(versions);
+            if retry {
+                Err(FdbBindingError::from(FdbError::from_code(1020)))
+            } else {
+                Ok(())
+            }
+        }
+    })
+    .await?;
+
+    assert_eq!(
+        *attempts.lock().expect("attempt list mutex poisoned"),
+        [[0, 1], [0, 1]]
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn explicit_versionstamps_remain_independent_from_allocation() -> Result<(), FdbBindingError>
+{
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+
+    let explicit = Versionstamp::incomplete(0);
+    assert_eq!(explicit.user_version(), 0);
+    assert_eq!(trx.allocate_user_version()?, 0);
+    assert_eq!(Versionstamp::incomplete(42).user_version(), 42);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn allocated_versionstamps_create_distinct_keys_in_one_transaction()
+-> Result<(), FdbBindingError> {
+    let db = common::database().await?;
+    let subspace = Subspace::from("test-user-version-allocator");
+
+    let clear = db.create_trx()?;
+    clear.clear_subspace_range(&subspace);
+    clear.commit().await.map_err(FdbError::from)?;
+
+    let trx = db.create_trx()?;
+    let a = &trx;
+    let b = &trx;
+    for (handle, value) in [
+        (a, b"a".as_slice()),
+        (b, b"b".as_slice()),
+        (a, b"c".as_slice()),
+    ] {
+        let user_version = handle.allocate_user_version()?;
+        let key = subspace.pack_with_versionstamp(&Versionstamp::incomplete(user_version));
+        handle.atomic_op(&key, value, MutationType::SetVersionstampedKey);
+    }
+    let transaction_version = trx.get_versionstamp();
+    trx.commit().await.map_err(FdbError::from)?;
+    let transaction_version: [u8; 10] = (*transaction_version.await?)
+        .try_into()
+        .expect("versionstamp is the wrong size");
+
+    let reader = db.create_trx()?;
+    for (user_version, value) in [
+        (0, b"a".as_slice()),
+        (1, b"b".as_slice()),
+        (2, b"c".as_slice()),
+    ] {
+        let versionstamp = Versionstamp::complete(transaction_version, user_version);
+        assert_eq!(
+            versionstamp.transaction_version(),
+            transaction_version.as_slice()
+        );
+        let key = subspace.pack(&versionstamp);
+        assert_eq!(reader.get(&key, false).await?.as_deref(), Some(value));
+    }
+    let mut entries = reader.get_ranges_keyvalues(subspace.range().into(), false);
+    let mut count = 0;
+    while let Some(entry) = entries.next().await {
+        entry?;
+        count += 1;
+    }
+    assert_eq!(count, 3);
+
+    Ok(())
+}
diff --git a/bindings/rust/foundationdb/tests/watch.rs b/bindings/rust/foundationdb/tests/watch.rs
new file mode 100644
index 00000000000..8fb448c73bb
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/watch.rs
@@ -0,0 +1,50 @@
+// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+use foundationdb::*;
+
+mod common;
+
+#[tokio::test]
+async fn test_watch() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-watch";
+
+    let db = common::database().await?;
+
+    eprintln!("setting watch");
+    let trx = db.create_trx()?;
+    let watch = trx.watch(KEY);
+    trx.commit().await?;
+    eprintln!("watch committed");
+
+    eprintln!("writing value");
+    let trx = db.create_trx()?;
+    let value = common::random_str(10);
+    trx.set(KEY, value.as_bytes());
+    trx.commit().await?;
+    eprintln!("write committed");
+
+    watch.await?;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_watch_without_commit() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-watch-2";
+
+    let db = common::database().await?;
+
+    eprintln!("setting watch");
+    let trx = db.create_trx()?;
+    let watch = trx.watch(KEY);
+
+    drop(trx);
+    assert!(watch.await.is_err());
+
+    Ok(())
+}
diff --git a/bindings/rust/rust-toolchain.toml b/bindings/rust/rust-toolchain.toml
new file mode 100644
index 00000000000..d148a7a8f6b
--- /dev/null
+++ b/bindings/rust/rust-toolchain.toml
@@ -0,0 +1,11 @@
+[toolchain]
+channel = "1.85.1"
+components = [
+    "cargo",
+    "clippy",
+    "rust-src",
+    "rustc",
+    "rustfmt",
+    "rust-analyzer",
+    "llvm-tools-preview",
+]
diff --git a/bindings/rust/scripts/run_bindingtester.sh b/bindings/rust/scripts/run_bindingtester.sh
new file mode 100755
index 00000000000..26f26201cda
--- /dev/null
+++ b/bindings/rust/scripts/run_bindingtester.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+set -ex;
+
+fdb_api_version=740
+
+fdb_rs_dir=$(pwd)
+fdb_builddir=${fdb_rs_dir:?}/target/foundationdb_build
+cd "${fdb_builddir:?}/foundationdb"
+
+# These are faulty seeds, for now, it is good to check them all the time to avoid regression.
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name api --compare python rust --seed 3534790651
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name api --compare python rust --seed 3864917676
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name api --concurrency 5 rust --seed 3153055325
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 2095856910
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 2483220251
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 241550211
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 1508488514
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 4203526853
+
+# https://github.com/foundationdb-rs/foundationdb-rs/issues/38
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 4142326254
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 4275610547
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 1951034301
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 1700644945
+
+# https://github.com/foundationdb-rs/foundationdb-rs/issues/42
+./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 584458794
+
+START=1
+END=${1-1}
+for i in $(eval echo "{$START..$END}")
+do
+  echo "Running iteration $i"
+  ./bindings/bindingtester/bindingtester.py --test-name scripted rust
+  ./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name api --compare python rust
+  ./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name api --concurrency 5 rust
+  ./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python
+  ./bindings/bindingtester/bindingtester.py --num-ops 100 --api-version $fdb_api_version --test-name directory_hca --concurrency 1 rust --no-directory-snapshot-ops
+done
diff --git a/bindings/rust/scripts/run_leader_election_simulation.sh b/bindings/rust/scripts/run_leader_election_simulation.sh
new file mode 100755
index 00000000000..9a9647b703e
--- /dev/null
+++ b/bindings/rust/scripts/run_leader_election_simulation.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -e
+
+# Number of runs (default: 1, use 0 for infinite)
+MAX_ITERATIONS=${1:-1}
+# Bound one pathological seed while keeping its traces for diagnosis.
+SEED_TIMEOUT=${LEADER_ELECTION_SEED_TIMEOUT:-15m}
+
+# Create trace directory
+mkdir -p ./target/traces
+
+# Build in release mode
+echo "Building in release mode..."
+cargo build --release -p foundationdb-recipes-simulation
+
+TEST="foundationdb-recipes-simulation/test_poll_leader_election.toml"
+
+echo ""
+echo "=========================================="
+echo "Running: $TEST"
+echo "=========================================="
+
+iteration=1
+while [ "$MAX_ITERATIONS" -eq 0 ] || [ "$iteration" -le "$MAX_ITERATIONS" ]; do
+    config=$(basename "$TEST" .toml)
+    seed=$(((RANDOM << 17) | (RANDOM << 2) | (RANDOM & 3)))
+    trace_dir="./target/traces/${config}-iteration-${iteration}-seed-${seed}"
+    mkdir -p "$trace_dir"
+
+    echo "----------------------"
+    echo "Config: $TEST"
+    echo "Iteration: $iteration"
+    echo "Seed: $seed"
+    echo "Per-seed timeout: $SEED_TIMEOUT"
+    echo "----------------------"
+
+    if timeout --kill-after=1m "$SEED_TIMEOUT" \
+        fdbserver -r simulation -f "$TEST" -b on --trace-format json -L "$trace_dir" --logsize 1GiB --seed "$seed"; then
+        rm -rf -- "$trace_dir"
+        echo "Iteration $iteration passed"
+    else
+        status=$?
+        if [ "$status" -eq 124 ] || [ "$status" -eq 137 ]; then
+            echo "TIMED OUT after $SEED_TIMEOUT on iteration $iteration"
+        fi
+        echo "FAILED on iteration $iteration for $TEST"
+        echo "Seed: $seed"
+        echo "Traces: $trace_dir"
+        printf 'Reproduce: fdbserver -r simulation -f %q -b on --trace-format json -L %q --logsize 1GiB --seed %s\n' \
+            "$TEST" "$trace_dir" "$seed"
+        exit "$status"
+    fi
+    iteration=$((iteration + 1))
+done
+
+echo "PASSED: $TEST"
+
+echo ""
+echo "=========================================="
+echo "All tests passed!"
+echo "=========================================="
diff --git a/bindings/rust/scripts/setup_bindingtester.sh b/bindings/rust/scripts/setup_bindingtester.sh
new file mode 100755
index 00000000000..4e842bd3de0
--- /dev/null
+++ b/bindings/rust/scripts/setup_bindingtester.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+set -ex;
+
+fdb_rs_dir=$(pwd)
+bindingtester="${fdb_rs_dir:?}/$1"
+
+pip install foundationdb==7.4.3
+fdboption_file="$(pip show foundationdb | grep Loca | awk '{print $2}')/fdb/fdboptions.py"
+echo "fdb option file: $fdboption_file"
+
+python3 --version
+
+## build the python bindings
+(
+  fdb_builddir=${fdb_rs_dir:?}/target/foundationdb_build
+  mkdir -p ${fdb_builddir:?}
+  cd ${fdb_builddir:?}
+
+  ## Get foundationdb source
+  git clone --depth 1 https://github.com/apple/foundationdb.git -b release-7.4
+  cd foundationdb
+  git checkout release-7.4
+
+  # Instead of building fdb-python with ninja/cmake, patching it with pip install
+  cp ${fdboption_file} ./bindings/python/fdb/fdboptions.py
+  echo "LATEST_API_VERSION = 740" >> ./bindings/python/fdb/apiversion.py
+  echo "FDB_VERSION = '7.4.3'" >> ./bindings/python/fdb/apiversion.py
+
+  # Tenants are not supported by this binding.
+  echo "testers['rust'] = Tester('rust', '${bindingtester}', 2040, 23, 740, types=ALL_TYPES)
+" >> ./bindings/bindingtester/known_testers.py
+)
+
+cd "${fdb_rs_dir}";
diff --git a/bindings/rust/scripts/simulation_entrypoint.sh b/bindings/rust/scripts/simulation_entrypoint.sh
new file mode 100755
index 00000000000..b388648f5f9
--- /dev/null
+++ b/bindings/rust/scripts/simulation_entrypoint.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# Simulation needs libc++.so at runtime
+export LD_LIBRARY_PATH=/usr/local/lib/x86_64-unknown-linux-gnu
+
+START=1
+END=${1-1}
+for i in $(eval echo "{$START..$END}")
+do
+  echo "----------------------"
+  echo "----------------------"
+  echo "Running iteration $i"
+  echo "----------------------"
+  echo "----------------------"
+  if ! fdbserver -r simulation -f foundationdb-simulation/examples/atomic/test_file_73.toml -b on --trace-format json; then
+      cat trace*.json | grep Rust
+      exit 1;
+  else
+      # Removing traces about success run
+      rm trace*.json
+  fi
+
+done

From 447ad2c4ea6aac2f89b8cf2044d5ccd48dc62ee9 Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Wed, 30 Sep 2026 16:07:41 -0700
Subject: [PATCH 02/11] Integrate Rust bindings with FoundationDB builds and
 tests

Add opt-in CMake targets using the in-tree C client and generated headers/options, register and package the Rust binding tester, add Cargo checks, and document the imported API compatibility and release boundaries.
---
 .github/workflows/format.yml                  |   4 +-
 .github/workflows/rust.yml                    |  97 ++++++++
 .github/workflows/tidy.yml                    |   3 +
 README.md                                     |   2 +
 bindings/CMakeLists.txt                       |   3 +
 bindings/bindingtester/known_testers.py       |   9 +
 bindings/rust/CMakeLists.txt                  | 110 +++++++++
 bindings/rust/CONTRIBUTING.md                 | 214 ++++--------------
 bindings/rust/README.md                       | 116 ++++++----
 bindings/rust/UPSTREAM.md                     |  24 ++
 .../foundationdb-bindingtester/Cargo.toml     |   2 +-
 .../rust/foundationdb-bindingtester/README.md |  49 +++-
 bindings/rust/foundationdb-gen/Cargo.toml     |   5 +-
 bindings/rust/foundationdb-gen/build.rs       |  69 ++++++
 bindings/rust/foundationdb-gen/src/lib.rs     |  54 +----
 bindings/rust/foundationdb-macros/Cargo.toml  |   2 +-
 .../rust/foundationdb-profiling/Cargo.toml    |   5 +-
 .../Cargo.toml                                |   2 +-
 .../rust/foundationdb-simulation/Cargo.toml   |   2 +-
 .../src/CppWorkload.cpp                       |  27 +--
 bindings/rust/foundationdb-sys/Cargo.toml     |   5 +-
 bindings/rust/foundationdb-sys/build.rs       |  11 +-
 bindings/rust/foundationdb-tuple/Cargo.toml   |   5 +-
 bindings/rust/foundationdb/Cargo.toml         |   5 +-
 bindings/rust/foundationdb/README.md          |  48 +---
 bindings/rust/scripts/run_bindingtester.sh    |  88 ++++---
 bindings/rust/scripts/setup_bindingtester.sh  |  38 +---
 cmake/AddFdbTest.cmake                        |  12 +
 cmake/FDBComponents.cmake                     |  21 ++
 documentation/sphinx/source/api-reference.rst |   1 +
 30 files changed, 621 insertions(+), 412 deletions(-)
 create mode 100644 .github/workflows/rust.yml
 create mode 100644 bindings/rust/CMakeLists.txt
 create mode 100644 bindings/rust/UPSTREAM.md
 create mode 100644 bindings/rust/foundationdb-gen/build.rs

diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 5cc605a0695..be422f601bc 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -26,10 +26,10 @@ jobs:
           sudo apt-get install clang-format-19
 
       - name: clang-format
-        # skip contrib dir, find all files named *.c/h/cpp/hpp,
+        # Skip contrib and historical Rust C-header snapshots, find *.c/h/cpp/hpp,
         # run clang-format 19.x on each file, in-place modifications
         run: |
-          find . -name contrib -prune -or -type f \
+          find . '(' -name contrib -or -path ./bindings/rust/foundationdb-sys/include ')' -prune -or -type f \
                  '(' -name \*.c -or -name \*.cpp -or -name \*.h -or -name \*.hpp ')' \
                  -exec clang-format-19 -i '{}' \;
 
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
new file mode 100644
index 00000000000..6de96765eb8
--- /dev/null
+++ b/.github/workflows/rust.yml
@@ -0,0 +1,97 @@
+name: Rust bindings
+
+on:
+  pull_request:
+    branches:
+      - main
+      - release-*
+    paths:
+      - bindings/rust/**
+      - fdbclient/vexillographer/fdb.options
+      - .github/workflows/rust.yml
+  push:
+    branches:
+      - main
+      - release-*
+    paths:
+      - bindings/rust/**
+      - fdbclient/vexillographer/fdb.options
+      - .github/workflows/rust.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: bindings/rust
+
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+
+jobs:
+  check:
+    name: Check and unit tests (${{ matrix.toolchain }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain: ["1.85.1", stable]
+    env:
+      RUSTUP_TOOLCHAIN: ${{ matrix.toolchain }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Install Rust and libclang
+        run: |
+          rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal
+          sudo apt-get update
+          sudo apt-get install --yes libclang-dev
+
+      - name: Check all workspace targets
+        # API version features are mutually exclusive; do not use --all-features.
+        run: >-
+          cargo check --locked --workspace --all-targets
+          --features embedded-fdb-include,fdb-7_4,num-bigint,trace
+
+      - name: Check supported historical APIs
+        # Some examples require newer APIs; historical compatibility covers the library.
+        run: |
+          for version in 6_1 6_2 6_3 7_0 7_1 7_3 7_4; do
+            cargo check --locked -p foundationdb --lib --no-default-features \
+              --features "embedded-fdb-include,fdb-${version},uuid"
+          done
+
+      - name: Test tuple encoding and macros
+        # These tests do not require libfdb_c or a running FoundationDB cluster.
+        run: |
+          cargo test --locked -p foundationdb-tuple --all-features
+          cargo test --locked -p foundationdb-macros
+
+      - name: Generate options from the repository schema
+        env:
+          FDB_INCLUDE_DIR: ${{ github.workspace }}/fdbclient/vexillographer
+        run: >-
+          cargo run --locked -p foundationdb-gen
+          --features embedded-fdb-include,fdb-7_4 --bin foundationdb-options-gen
+          > "$RUNNER_TEMP/rust-fdb-options.rs"
+
+  format:
+    name: Rustfmt
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    env:
+      RUSTUP_TOOLCHAIN: "1.85.1"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Install Rustfmt
+        run: rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal --component rustfmt
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
diff --git a/.github/workflows/tidy.yml b/.github/workflows/tidy.yml
index 9efd516071c..f792c67074d 100644
--- a/.github/workflows/tidy.yml
+++ b/.github/workflows/tidy.yml
@@ -88,6 +88,9 @@ jobs:
               flow/include/flow/sse2neon.h|flow/include/flow/xxhash.h)
                 continue
                 ;;
+              bindings/rust/foundationdb-sys/include/*)
+                continue  # historical C API snapshots for compatibility builds
+                ;;
             esac
             # These inputs are not parseable as standalone clang-tidy translation units in this workflow:
             # the public C headers require C consumer setup and intentionally use C typedefs, AWS headers are
diff --git a/README.md b/README.md
index d4c691921c1..127685d8073 100755
--- a/README.md
+++ b/README.md
@@ -177,6 +177,8 @@ The language bindings that CMake supports will have a corresponding `README.md`
 
 Generally, CMake will build all language bindings for which it can find all necessary dependencies. After each successful CMake run, CMake will tell you which language bindings it is going to build.
 
+The [Rust bindings](bindings/rust/README.md) are opt-in with `-DBUILD_RUST_BINDING=ON`. They retain the imported Rust API and currently select FoundationDB API 740; see their README for build requirements and compatibility limits.
+
 
 ### Generating `compile_commands.json`
 
diff --git a/bindings/CMakeLists.txt b/bindings/CMakeLists.txt
index 94a03d4cba7..9073f3bf0ea 100644
--- a/bindings/CMakeLists.txt
+++ b/bindings/CMakeLists.txt
@@ -12,6 +12,9 @@ endif()
 if(WITH_GO_BINDING AND NOT OPEN_FOR_IDE)
   add_subdirectory(go)
 endif()
+if(WITH_RUST_BINDING)
+  add_subdirectory(rust)
+endif()
 if(WITH_RUBY_BINDING)
   add_subdirectory(ruby)
 endif()
diff --git a/bindings/bindingtester/known_testers.py b/bindings/bindingtester/known_testers.py
index 615d173a6a8..adfe4a62cf4 100644
--- a/bindings/bindingtester/known_testers.py
+++ b/bindings/bindingtester/known_testers.py
@@ -117,6 +117,15 @@ def _absolute_path(path):
         MAX_API_VERSION,
         types=ALL_TYPES,
     ),
+    "rust": Tester(
+        "rust",
+        os.environ.get("FDB_RUST_BINDINGTESTER", _absolute_path("rust/bin/bindingtester")),
+        2040,
+        610,
+        740,
+        types=ALL_TYPES,
+        directory_snapshot_ops_enabled=False,
+    ),
     "flow": Tester(
         "flow",
         _absolute_path("flow/bin/fdb_flow_tester"),
diff --git a/bindings/rust/CMakeLists.txt b/bindings/rust/CMakeLists.txt
new file mode 100644
index 00000000000..b4027b063f6
--- /dev/null
+++ b/bindings/rust/CMakeLists.txt
@@ -0,0 +1,110 @@
+option(RUN_RUST_INTEGRATION_TESTS "Compile and run Rust tests against a temporary cluster" OFF)
+
+# bindgen and the Rust option generator consume the same headers and options as
+# the other bindings. Packaged historical headers remain available to Cargo users.
+set(rust_include_dir ${CMAKE_CURRENT_BINARY_DIR}/include)
+set(rust_header_inputs
+  ${CMAKE_SOURCE_DIR}/bindings/c/foundationdb/fdb_c.h
+  ${CMAKE_SOURCE_DIR}/bindings/c/foundationdb/fdb_c_types.h
+  ${CMAKE_BINARY_DIR}/bindings/c/foundationdb/fdb_c_options.g.h
+  ${CMAKE_BINARY_DIR}/bindings/c/foundationdb/fdb_c_apiversion.g.h
+  ${CMAKE_SOURCE_DIR}/fdbclient/vexillographer/fdb.options)
+set(rust_headers)
+foreach(header IN LISTS rust_header_inputs)
+  get_filename_component(name ${header} NAME)
+  list(APPEND rust_headers ${rust_include_dir}/${name})
+endforeach()
+add_custom_command(
+  OUTPUT ${rust_headers}
+  COMMAND ${CMAKE_COMMAND} -E make_directory ${rust_include_dir}
+  COMMAND ${CMAKE_COMMAND} -E copy_if_different ${rust_header_inputs} ${rust_include_dir}
+  DEPENDS ${rust_header_inputs} fdb_c_options
+  COMMENT "Stage current FoundationDB headers and options for Rust"
+  VERBATIM)
+add_custom_target(fdb_rust_headers DEPENDS ${rust_headers})
+
+set(rust_target_dir ${CMAKE_CURRENT_BINARY_DIR}/target)
+set(rust_env
+  FDB_INCLUDE_DIR=${rust_include_dir}
+  FDB_CLIENT_LIB_PATH=$<TARGET_FILE_DIR:fdb_c>
+  CARGO_TARGET_DIR=${rust_target_dir})
+set(rust_profile $<IF:$<CONFIG:Debug>,debug,release>)
+# API 740 is the newest API supported by the imported Rust binding. Building
+# against current headers does not imply support for every current C API.
+set(rust_cargo_args
+  --manifest-path ${CMAKE_CURRENT_SOURCE_DIR}/Cargo.toml
+  --locked
+  --profile $<IF:$<CONFIG:Debug>,dev,release>
+  --features foundationdb/fdb-7_4,foundationdb-gen/fdb-7_4)
+
+# Cargo owns Rust dependency tracking, including changes to build-script inputs.
+# Always invoking Cargo avoids maintaining a second Rust source list in CMake.
+add_custom_target(fdb_rust ALL
+  COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
+    ${CARGO_EXECUTABLE} build ${rust_cargo_args}
+    --package foundationdb --package bindingtester
+  DEPENDS fdb_c fdb_rust_headers
+  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+  COMMENT "Build Rust client and binding tester"
+  COMMAND_EXPAND_LISTS
+  VERBATIM)
+
+set(rust_tester ${CMAKE_CURRENT_BINARY_DIR}/bin/bindingtester)
+add_custom_target(fdb_rust_tester ALL
+  COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_CURRENT_BINARY_DIR}/bin
+  COMMAND ${CMAKE_COMMAND} -E copy_if_different
+    ${rust_target_dir}/${rust_profile}/bindingtester ${rust_tester}
+  DEPENDS fdb_rust
+  BYPRODUCTS ${rust_tester}
+  COMMENT "Stage Rust binding tester"
+  VERBATIM)
+
+set(rust_unit_packages
+  --package foundationdb
+  --package foundationdb-tuple
+  --package foundationdb-gen
+  --package foundationdb-macros)
+add_custom_target(fdb_rust_tests ALL
+  COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
+    ${CARGO_EXECUTABLE} test ${rust_cargo_args} ${rust_unit_packages} --lib --no-run
+  DEPENDS fdb_rust
+  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+  COMMENT "Compile Rust library unit tests"
+  COMMAND_EXPAND_LISTS
+  VERBATIM)
+
+if(APPLE)
+  set(rust_library_path DYLD_LIBRARY_PATH)
+else()
+  set(rust_library_path LD_LIBRARY_PATH)
+endif()
+set(rust_test_env ${rust_env}
+  "${rust_library_path}=$<TARGET_FILE_DIR:fdb_c>:$ENV{${rust_library_path}}")
+
+add_test(NAME rust_unit_tests
+  COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+    ${CARGO_EXECUTABLE} test ${rust_cargo_args} ${rust_unit_packages} --lib --offline
+  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+  COMMAND_EXPAND_LISTS)
+set_tests_properties(rust_unit_tests PROPERTIES TIMEOUT 300 LABELS "rust")
+
+if(RUN_RUST_INTEGRATION_TESTS)
+  add_custom_target(fdb_rust_integration_tests ALL
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
+      ${CARGO_EXECUTABLE} test ${rust_cargo_args} --package foundationdb --tests --no-run
+    DEPENDS fdb_rust_tests
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    COMMENT "Compile Rust client integration tests"
+    COMMAND_EXPAND_LISTS
+    VERBATIM)
+  add_fdbclient_test(NAME rust_integration_tests
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+      ${CARGO_EXECUTABLE} test ${rust_cargo_args} --package foundationdb --tests --offline -- --test-threads=1
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    TEST_TIMEOUT 1200)
+  # tmp_cluster otherwise preserves an inherited default cluster. These tests
+  # must always use the disposable cluster created by the test runner.
+  set_tests_properties(rust_integration_tests PROPERTIES
+    LABELS "rust;integration"
+    ENVIRONMENT_MODIFICATION "FDB_CLUSTER_FILE=unset:")
+endif()
diff --git a/bindings/rust/CONTRIBUTING.md b/bindings/rust/CONTRIBUTING.md
index b81b8dd1a92..79060118899 100644
--- a/bindings/rust/CONTRIBUTING.md
+++ b/bindings/rust/CONTRIBUTING.md
@@ -1,185 +1,69 @@
-# Contributing to FoundationDB Rust
+# Developing the Rust bindings
 
-Thank you for your interest in contributing to the FoundationDB Rust client! This guide will help you get started.
+Run Cargo commands from `bindings/rust`, where the toolchain and Cargo aliases are
+configured. The minimum Rust version is 1.85.1. Bindgen also requires libclang.
+Follow the FoundationDB repository contribution process for changes to this tree.
 
-## Getting Started
+## Standalone Cargo
 
-### Prerequisites
+For an installed FoundationDB client, use the existing versioned embedded headers:
 
-You'll need:
-- Rust 1.85.1 or later
-- FoundationDB client libraries (for runtime, not required for compilation with our setup)
-
-### Quick Development Setup
-
-We provide cargo aliases that use embedded headers, so you can compile without having FoundationDB installed:
-
-```shell
-# Build/test/check with latest FDB version (7.4)
+```sh
+cd bindings/rust
 cargo build-fdb-latest
-cargo test-fdb-latest
-cargo check-fdb-latest
-cargo clippy-fdb-latest
-```
-
-These commands will build the `foundationdb` crate with embedded headers for FDB 7.4.
-
-### Running a Local FoundationDB Cluster
-
-The easiest way to run a local FDB cluster for testing:
-
-```shell
-# Start a single-node cluster in Docker
-docker run -p 4500:4500 --name fdb -it --rm -d foundationdb/foundationdb:7.4.3
-docker exec fdb fdbcli --exec "configure new single memory"
-```
-
-## Development with Nix
-
-If you use Nix, we provide a `flake.nix` for a complete development environment:
-
-```shell
-# Enter the development shell
-nix develop
-
-# The shell includes all necessary dependencies and tools
-```
-
-For NixOS users, add this to your `configuration.nix` for the FDB cluster file:
-
-```nix
-{
-  environment.etc."foundationdb/fdb.cluster" = {
-    mode = "0555";
-    text = ''
-      docker:docker@127.0.0.1:4500
-    '';
-  };
-}
+cargo fmt --all -- --check
+cargo clippy-all
+cargo test -p foundationdb-tuple --all-features --locked
+cargo test -p foundationdb-macros --locked
 ```
 
-## Project Structure
+`*-fdb-latest` currently selects `fdb-7_4` and `embedded-fdb-include`. Embedded
+headers remove the need for installed headers, but linking and running binaries
+still require `libfdb_c`. Set `FDB_CLIENT_LIB_PATH` if the library is outside the
+linker's standard search path, and configure the platform's runtime library path
+when needed. Do not use `--all-features` for the client: API-version features are
+mutually exclusive.
 
-- `foundationdb/` - High-level Rust client API
-- `foundationdb-sys/` - Low-level C API bindings
-- `foundationdb-gen/` - Code generator for FDB options and types
-- `foundationdb-tuple/` - Tuple layer implementation
-- `foundationdb-macros/` - Procedural macros
-- `foundationdb-bindingtester/` - Official binding tester implementation
-- `foundationdb-simulation/` - Simulation testing framework
+For a custom header set, `FDB_INCLUDE_DIR` selects a directory containing
+`fdb_c.h`, its companion headers, and `fdb.options`. It takes precedence over
+embedded headers. CMake supplies this directory from the current repository.
 
-## Testing
+## Tests
 
-### Unit Tests
+The CMake targets and CTests are described in [README.md](README.md). Enable
+`RUN_RUST_INTEGRATION_TESTS` in addition to `BUILD_RUST_BINDING` to run the client
+integration tests against a temporary local test cluster. Keep
+`BUILD_PYTHON_BINDING=ON` for the shared test-runner fixture, then build and run:
 
-Run tests for the main crate:
-```shell
-cargo test-fdb-latest
+```sh
+cmake --build build --target fdb_rust_integration_tests fdbserver fdbcli fdbmonitor python_binding
+ctest --test-dir build -R '^rust_' --output-on-failure
 ```
 
-### Binding Tester
-
-We use the official FoundationDB binding tester to ensure correctness:
-
-```shell
-# Build the binding tester
-cargo build -p bindingtester
+Run these commands from the repository root (or substitute an absolute build
+directory).
 
-# Setup the binding tester environment (downloads FDB source and configures Python bindings)
-./scripts/setup_bindingtester.sh target/debug/bindingtester
+When testing with Cargo directly, the client integration tests need a disposable
+FoundationDB database. They write test keys and exercise database-wide behavior;
+do not point them at an application cluster. Set `FDB_CLUSTER_FILE` to the test
+cluster file, then run:
 
-# Run the binding tester suite (requires FDB cluster running)
-./scripts/run_bindingtester.sh
-
-# Run with more iterations (e.g., 100 iterations)
-./scripts/run_bindingtester.sh 100
+```sh
+cargo test-fdb-latest --locked
 ```
 
-The binding tester runs automatically in CI when a PR has the `correctness` label.
-
-### Leader-election simulation campaigns
-
-The leader-election simulator runs a smoke campaign of 1 worker x 10 seeds on
-ordinary pull requests and pushes to `main`. Changes to the leader-election or
-RankedRegister recipes, simulation code, the simulation runner, or this
-workflow automatically run an extended campaign of 4 workers x 50 seeds.
-
-The full campaign runs nightly at 02:00 UTC, when manually dispatched, and on
-pull requests carrying the `leader-election-correctness` label. It uses 4
-workers x 200 seeds. Apply that label when a change needs the full
-correctness campaign before the nightly run.
-
-## Code Style
-
-- Run `cargo fmt` before committing
-- Run `cargo clippy-fdb-latest` to check for common issues
-- Follow Rust naming conventions and idioms
-
-## Submitting Changes
-
-1. Fork the repository
-2. Create a feature branch (`git checkout -b feature/amazing-feature`)
-3. Make your changes
-4. Ensure tests pass (`cargo test-fdb-latest`)
-5. Run clippy (`cargo clippy-fdb-latest`)
-6. Format your code (`cargo fmt`)
-7. Commit your changes with a semantic commit message (see below)
-8. Push to your fork
-9. Open a Pull Request
-
-### Commit Message Convention
-
-We follow [Conventional Commits](https://www.conventionalcommits.org/) to generate clean changelogs:
-
-```
-<type>(<scope>): <subject>
-
-<body>
-
-<footer>
-```
-
-**Types:**
-- `feat`: New feature
-- `fix`: Bug fix
-- `docs`: Documentation changes
-- `style`: Code style changes (formatting, missing semicolons, etc.)
-- `refactor`: Code changes that neither fix bugs nor add features
-- `perf`: Performance improvements
-- `test`: Adding or updating tests
-- `build`: Changes to build system or dependencies
-- `ci`: CI/CD configuration changes
-- `chore`: Other changes that don't modify src or test files
-
-**Examples:**
-```
-feat(tuple): add support for nested tuples
-
-fix(transaction): handle network errors in retry loop
-
-docs: update binding tester instructions
-
-chore(deps): bump foundationdb-sys to 0.9.2
-```
-
-### Pull Request Guidelines
-
-- Provide a clear description of the changes
-- Include tests for new functionality
-- Update documentation as needed
-- Ensure CI passes
-- For significant changes, consider opening an issue first to discuss
-
-## Correctness
-
-This project prioritizes correctness. We run extensive binding tests to ensure compatibility with the official FoundationDB bindings. The binding tester runs thousands of test seeds regularly in CI.
-
-## Getting Help
+Use the in-tree [binding tester instructions](foundationdb-bindingtester/README.md)
+for comparison with Python. Tuple tests and macro tests do not need a cluster.
 
-- Join our [Discord server](https://discord.gg/zkgtbtFfWY)
-- Open an issue on [GitHub](https://github.com/foundationdb-rs/foundationdb-rs/issues)
-- Check existing issues and pull requests
+The simulation crates and their scripts are retained for focused simulator work;
+their READMEs describe the workload ABI and required server versions. The original
+repository's scheduled correctness, simulation, release, and documentation jobs
+are not enabled here. Validation should state the API feature, client/server
+version, tests, and binding-tester seeds actually exercised.
 
-## License
+## Contributions and licensing
 
-By contributing, you agree that your contributions will be licensed under the same dual license as the project (MIT/Apache-2.0).
+Keep changes focused and preserve public Rust API compatibility when possible.
+Run rustfmt and the relevant unit, integration, or binding tests. Existing
+changelogs record upstream releases; this migration does not create a new crate
+release. Preserve the imported MIT/Apache-2.0 license and contributor notices.
diff --git a/bindings/rust/README.md b/bindings/rust/README.md
index dd069decd10..37d91a8b785 100644
--- a/bindings/rust/README.md
+++ b/bindings/rust/README.md
@@ -1,48 +1,74 @@
-[![Discord](https://img.shields.io/discord/925467557903884349)](https://discord.gg/zkgtbtFfWY)
-[![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/foundationdb-rs/foundationdb-rs/ci.yml?branch=main)](https://github.com/foundationdb-rs/foundationdb-rs/actions)
-[![dependency status](https://deps.rs/repo/github/foundationdb-rs/foundationdb-rs/status.svg)](https://deps.rs/repo/github/foundationdb-rs/foundationdb-rs)
-[![Codecov](https://img.shields.io/codecov/c/github/foundationdb-rs/foundationdb-rs)](https://codecov.io/gh/foundationdb-rs/foundationdb-rs)
-![Rustc 1.85.1+](https://img.shields.io/badge/rustc-1.85.1+-lightgrey)
-
-# FoundationDB Rust Client
-
-The repo consists of multiple crates:
-
-| Library                                            | Status                                                                                                                                                                                                          | Description                                                 |
-|----------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------|
-| [**foundationdb**](foundationdb/README.md)         | [![Crates.io](https://img.shields.io/crates/v/foundationdb)](https://crates.io/crates/foundationdb) [![foundationdb](https://docs.rs/foundationdb/badge.svg)](https://docs.rs/foundationdb)                     | High level FoundationDB client API                          |
-| [**foundationdb-sys**](foundationdb-sys/README.md) | [![Crates.io](https://img.shields.io/crates/v/foundationdb-sys)](https://crates.io/crates/foundationdb-sys) [![foundationdb-sys](https://docs.rs/foundationdb-sys/badge.svg)](https://docs.rs/foundationdb-sys) | C API bindings for FoundationDB                             |
-| **foundationdb-gen**                               | n/a                                                                                                                                                                                                             | Code generator for common options and types of FoundationDB |
-
-The current version requires rustc 1.85.1+ to work.
-The previous version (0.3) is still maintained and is available within the 0.3 branch.
-
-You can access the `main` branch documentation [here](https://foundationdb-rs.github.io/foundationdb-rs/foundationdb/index.html).
-
-## Supported platforms
-
-Supported platforms are listed on the [foundationdb's README](foundationdb/README.md).
-
-## Contributing
-
-See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and guidelines.
-
-## Correctness
-
-Special care has been set up to be sure that the crate is correct, like official bindings. Every hour, we are running thousands of seeds on the [BindingTester](https://github.com/apple/foundationdb/blob/master/bindings/bindingtester/spec/bindingApiTester.md).
+# FoundationDB Rust bindings
+
+This Cargo workspace provides an async Rust interface to the FoundationDB C API,
+including transactions, tuple and directory layers, and a binding tester. It was
+imported from [foundationdb-rs](https://github.com/foundationdb-rs/foundationdb-rs).
+See [UPSTREAM.md](UPSTREAM.md) for the source revision and licensing provenance.
+
+## Crates
+
+| Crate | Purpose |
+| --- | --- |
+| [`foundationdb`](foundationdb/README.md) | Async client, transactions, directory layer, and recipes |
+| [`foundationdb-sys`](foundationdb-sys/README.md) | Raw C API bindings |
+| [`foundationdb-gen`](foundationdb-gen/README.md) | Generate Rust options from `fdb.options` |
+| [`foundationdb-tuple`](foundationdb-tuple/README.md) | Tuple encoding, subspaces, and versionstamps |
+| [`foundationdb-macros`](foundationdb-macros/README.md) | API-version conditional compilation |
+| [`bindingtester`](foundationdb-bindingtester/README.md) | FoundationDB binding tester protocol |
+| [`foundationdb-profiling`](foundationdb-profiling/README.md) | Client profiling data decoder |
+| [`foundationdb-simulation`](foundationdb-simulation/README.md) | Rust workloads for the deterministic simulator |
+| [`foundationdb-simulation-tracing`](foundationdb-simulation-tracing/README.md) | Simulator trace integration |
+| [`foundationdb-recipes-simulation`](foundationdb-recipes-simulation/README.md) | Recipe simulation workloads |
+
+## Building with FoundationDB
+
+Rust is optional and requires Rust 1.85.1 or later, Cargo, and libclang for
+bindgen. Enable it when configuring the repository, then build the Rust targets:
+
+```sh
+cmake -S . -B build -G Ninja -DBUILD_RUST_BINDING=ON
+cmake --build build --target fdb_rust fdb_rust_tester fdb_rust_tests
+ctest --test-dir build -R '^rust_' --output-on-failure
+```
+
+The CMake build links the in-tree `fdb_c` library and generates bindings from the
+same C headers and `fdb.options` as the other language bindings. Cargo artifacts
+stay in the build directory. See [CONTRIBUTING.md](CONTRIBUTING.md) for tests and
+standalone Cargo development.
+
+## Compatibility and current limits
+
+The migration preserves the upstream crate versions and public Rust API. Crate
+versions are independent of the FoundationDB server release number. Published
+crates on crates.io are separate releases; importing the source does not publish
+or transfer ownership of them.
+
+Select exactly one Cargo API feature: `fdb-5_1`, `fdb-5_2`, `fdb-6_0`, `fdb-6_1`,
+`fdb-6_2`, `fdb-6_3`, `fdb-7_0`, `fdb-7_1`, `fdb-7_3`, or `fdb-7_4`. The in-tree
+build selects `fdb-7_4` (API 740), the highest API supported by the imported
+workspace. A newer C client can serve that API, but this does not expose every
+feature of the current FoundationDB main branch. In particular, this import does
+not add API 800 wrappers or the native CDC API. Directory snapshot operations are
+also not supported by the Rust binding tester, and its scripted suite is skipped
+because it requires API 800. Additional wrappers and API-version support can be
+developed separately.
+
+The client follows the same transaction, retry, key-selector, tuple, and directory
+protocols as the other bindings, expressed through Rust futures and ownership.
+The [binding tester](foundationdb-bindingtester/README.md) exercises protocol
+compatibility. The import is not a claim of complete feature parity or a new
+cross-platform support guarantee. The CMake integration initially targets Linux
+and macOS; standalone Cargo retains upstream platform support.
+
+Simulation and profiling crates are retained as optional tools. Their compatibility
+with server-internal interfaces and profiling formats must be checked separately
+when changing server versions. Rust crates are not yet included in the native
+client installation packages, and the upstream publishing and scheduled simulation
+workflows are not installed by this migration.
 
 ## License
 
-Licensed under either of
-
-- Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
-- MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
-
-at your option.
-
-### Contribution
-
-Unless you explicitly state otherwise, any contribution intentionally
-submitted for inclusion in the work by you, as defined in the Apache-2.0
-license, shall be dual licensed as above, without any additional terms or
-conditions.
+The imported Rust workspace remains dual licensed under
+[Apache 2.0](LICENSE-APACHE) or [MIT](LICENSE-MIT), at your option. Existing author
+and copyright notices are preserved. FoundationDB's other components retain their
+existing licenses.
diff --git a/bindings/rust/UPSTREAM.md b/bindings/rust/UPSTREAM.md
new file mode 100644
index 00000000000..7d71aeac734
--- /dev/null
+++ b/bindings/rust/UPSTREAM.md
@@ -0,0 +1,24 @@
+# Import provenance
+
+- Source: https://github.com/foundationdb-rs/foundationdb-rs
+- Revision: `f0eda232ae2e99d3e9377229715a905f90cac4db`
+- Source commit date: 2026-09-25
+- Destination: `bindings/rust`
+- License: MIT OR Apache-2.0; see `LICENSE-MIT` and `LICENSE-APACHE`.
+
+The initial import preserves the ten-crate workspace, Cargo lockfile, examples,
+tests, historical C headers and option definitions, changelogs, and optional Nix
+development environment. The upstream project and its contributors retain their
+existing attribution. The complete upstream history remains available at the
+source repository and exact revision above; this is a source snapshot import.
+
+Repository-specific GitHub workflows, Dependabot/coverage/release configuration,
+agent instructions, and repository governance files were excluded. The adaptation
+commit integrates CMake, shared binding tests, repository metadata, and development
+documentation with FoundationDB. It does not import upstream hosted service
+credentials or establish automatic package publishing.
+
+Historical headers and `fdb.options` snapshots support standalone Cargo builds
+against older API versions. The in-tree CMake build uses the canonical FoundationDB
+headers and option definitions instead. Preserve the historical snapshots when
+updating current options or formatting current FoundationDB C/C++ sources.
diff --git a/bindings/rust/foundationdb-bindingtester/Cargo.toml b/bindings/rust/foundationdb-bindingtester/Cargo.toml
index b81cef22a05..ee7b318d949 100644
--- a/bindings/rust/foundationdb-bindingtester/Cargo.toml
+++ b/bindings/rust/foundationdb-bindingtester/Cargo.toml
@@ -14,7 +14,7 @@ description = """
 Bindings to the C api for FoundationDB
 """
 
-repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+repository = "https://github.com/apple/foundationdb"
 
 readme = "README.md"
 keywords = ["foundationdb", "kv"]
diff --git a/bindings/rust/foundationdb-bindingtester/README.md b/bindings/rust/foundationdb-bindingtester/README.md
index 2a89756f131..bbd464d6246 100644
--- a/bindings/rust/foundationdb-bindingtester/README.md
+++ b/bindings/rust/foundationdb-bindingtester/README.md
@@ -1,14 +1,47 @@
-Rust FoundationDB bindingtester
-===============================
+# Rust FoundationDB bindingtester
 
-This exe implements the official FoundationDB bindingtester protocol.
+This executable implements the shared FoundationDB bindingtester protocol.
+The Rust tester is registered as `rust` in `bindings/bindingtester/known_testers.py`.
 
-By running `./bindingtester.py ${this_executable}`, you can test how the rust foundationdb bindings behave.
+Configure FoundationDB with `BUILD_RUST_BINDING=ON` and
+`BUILD_PYTHON_BINDING=ON`, then build the Rust tester and Python reference binding:
 
-The following configurations are tested and should pass without any issue:
+```sh
+bindings/rust/scripts/setup_bindingtester.sh /path/to/build
+```
+
+With a running FoundationDB cluster, run the fixed regression seeds followed by
+one iteration of the API, concurrent API, directory, and directory
+allocator tests:
 
+```sh
+bindings/rust/scripts/run_bindingtester.sh /path/to/build 1 --cluster-file /path/to/fdb.cluster
 ```
-./bindingtester.py --test-name scripted
-./bindingtester.py --num-ops 1000 --test-name api --api-version 610
-./bindingtester.py --num-ops 1000 --concurrency 5 --test-name api --api-version 610
+
+The script uses Python and Rust artifacts from the same build, tests API version
+740, and compares API/directory results with the Python binding. It copies the
+shared harness and Python tester into the build tree so the Python tester imports
+the generated binding there. It does not install a Python package or clone a
+second FoundationDB checkout. Increase the second argument to repeat randomized tests; retain the logged seeds to reproduce
+failures.
+
+For an individual case after the script has staged the shared test harness:
+
+```sh
+export FDB_RUST_BINDINGTESTER=/path/to/build/bindings/rust/bin/bindingtester
+export PYTHONPATH=/path/to/build/bindings/python
+export LD_LIBRARY_PATH=/path/to/build/lib
+python3 /path/to/build/bindings/bindingtester/bindingtester.py rust --compare python \
+  --api-version 740 --test-name api --num-ops 1000 --seed 3534790651 \
+  --cluster-file /path/to/fdb.cluster
 ```
+
+On macOS, use `DYLD_LIBRARY_PATH` instead of `LD_LIBRARY_PATH`. `FDB_RUST_BINDINGTESTER`
+can also select a tester built directly with Cargo.
+
+The registered tester supports runtime API versions 610 through 740 and the
+shared tuple types, including arbitrary-width integers and versionstamps.
+Directory snapshot operations are disabled because the imported directory layer
+does not implement them. The scripted suite is skipped because it requires the
+current API version (800), beyond the Rust binding's API 740 support. Importing
+the binding does not establish full feature parity.
diff --git a/bindings/rust/foundationdb-gen/Cargo.toml b/bindings/rust/foundationdb-gen/Cargo.toml
index 47a95bcdc08..f9380fe7eac 100644
--- a/bindings/rust/foundationdb-gen/Cargo.toml
+++ b/bindings/rust/foundationdb-gen/Cargo.toml
@@ -14,7 +14,7 @@ Binding generation helper for FoundationDB.
 """
 
 documentation = "https://docs.rs/foundationdb"
-repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+repository = "https://github.com/apple/foundationdb"
 license = "MIT/Apache-2.0"
 
 readme = "README.md"
@@ -24,9 +24,6 @@ categories = ["database"]
 [package.metadata.docs.rs]
 features = ["embedded-fdb-include", "fdb-7_4"]
 
-[badges]
-codecov = { repository = "foundationdb-rs/foundationdb-rs", branch = "main", service = "github" }
-
 [features]
 default = []
 # Use the locally embedded foundationdb fdb.options file
diff --git a/bindings/rust/foundationdb-gen/build.rs b/bindings/rust/foundationdb-gen/build.rs
new file mode 100644
index 00000000000..eb649c34c98
--- /dev/null
+++ b/bindings/rust/foundationdb-gen/build.rs
@@ -0,0 +1,69 @@
+use std::{env, fs, path::PathBuf};
+
+#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "linux"))]
+const OPTIONS_FILE: &str = "/usr/include/foundationdb/fdb.options";
+
+#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "macos"))]
+const OPTIONS_FILE: &str = "/usr/local/include/foundationdb/fdb.options";
+
+#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "windows"))]
+const OPTIONS_FILE: &str = "C:/Program Files/foundationdb/include/foundationdb/fdb.options";
+
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-5_1"))]
+const OPTIONS_FILE: &str = "include/510/fdb.options";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-5_2"))]
+const OPTIONS_FILE: &str = "include/520/fdb.options";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_0"))]
+const OPTIONS_FILE: &str = "include/600/fdb.options";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_1"))]
+const OPTIONS_FILE: &str = "include/610/fdb.options";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_2"))]
+const OPTIONS_FILE: &str = "include/620/fdb.options";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_3"))]
+const OPTIONS_FILE: &str = "include/630/fdb.options";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_0"))]
+const OPTIONS_FILE: &str = "include/700/fdb.options";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_1"))]
+const OPTIONS_FILE: &str = "include/710/fdb.options";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_3"))]
+const OPTIONS_FILE: &str = "include/730/fdb.options";
+#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_4"))]
+const OPTIONS_FILE: &str = "include/740/fdb.options";
+
+// Compile error when no version feature is specified
+#[cfg(not(any(
+    feature = "fdb-5_1",
+    feature = "fdb-5_2",
+    feature = "fdb-6_0",
+    feature = "fdb-6_1",
+    feature = "fdb-6_2",
+    feature = "fdb-6_3",
+    feature = "fdb-7_0",
+    feature = "fdb-7_1",
+    feature = "fdb-7_3",
+    feature = "fdb-7_4",
+)))]
+compile_error!(
+    "foundationdb-gen requires a version feature to be specified.\n\
+     \n\
+     Available version features: fdb-5_1, fdb-5_2, fdb-6_0, fdb-6_1, fdb-6_2, fdb-6_3, fdb-7_0, fdb-7_1, fdb-7_3, fdb-7_4\n\
+     \n\
+     Examples:\n\
+     - With embedded include: features = [\"embedded-fdb-include\", \"fdb-7_4\"]\n\
+     - With system install: features = [\"fdb-7_4\"]"
+);
+
+fn main() {
+    println!("cargo:rerun-if-env-changed=FDB_OPTIONS_FILE");
+    println!("cargo:rerun-if-env-changed=FDB_INCLUDE_DIR");
+    let options_file = env::var_os("FDB_OPTIONS_FILE")
+        .map(PathBuf::from)
+        .or_else(|| {
+            env::var_os("FDB_INCLUDE_DIR").map(|path| PathBuf::from(path).join("fdb.options"))
+        })
+        .unwrap_or_else(|| PathBuf::from(OPTIONS_FILE));
+    println!("cargo:rerun-if-changed={}", options_file.display());
+    let out_path = PathBuf::from(env::var_os("OUT_DIR").expect("OUT_DIR is undefined!"));
+    fs::copy(&options_file, out_path.join("fdb.options"))
+        .unwrap_or_else(|err| panic!("couldn't read {}: {err}", options_file.display()));
+}
diff --git a/bindings/rust/foundationdb-gen/src/lib.rs b/bindings/rust/foundationdb-gen/src/lib.rs
index 4bcde344edb..283c4c0e0a5 100644
--- a/bindings/rust/foundationdb-gen/src/lib.rs
+++ b/bindings/rust/foundationdb-gen/src/lib.rs
@@ -332,59 +332,7 @@ where
     panic!("unexpected end of token");
 }
 
-#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "linux"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("/usr/include/foundationdb/fdb.options");
-
-#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "macos"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("/usr/local/include/foundationdb/fdb.options");
-
-#[cfg(all(not(feature = "embedded-fdb-include"), target_os = "windows"))]
-const OPTIONS_DATA: &[u8] =
-    include_bytes!("C:/Program Files/foundationdb/include/foundationdb/fdb.options");
-
-#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-5_1"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("../include/510/fdb.options");
-#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-5_2"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("../include/520/fdb.options");
-#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_0"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("../include/600/fdb.options");
-#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_1"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("../include/610/fdb.options");
-#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_2"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("../include/620/fdb.options");
-#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-6_3"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("../include/630/fdb.options");
-#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_0"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("../include/700/fdb.options");
-#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_1"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("../include/710/fdb.options");
-#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_3"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("../include/730/fdb.options");
-#[cfg(all(feature = "embedded-fdb-include", feature = "fdb-7_4"))]
-const OPTIONS_DATA: &[u8] = include_bytes!("../include/740/fdb.options");
-
-// Compile error when no version feature is specified
-#[cfg(not(any(
-    feature = "fdb-5_1",
-    feature = "fdb-5_2",
-    feature = "fdb-6_0",
-    feature = "fdb-6_1",
-    feature = "fdb-6_2",
-    feature = "fdb-6_3",
-    feature = "fdb-7_0",
-    feature = "fdb-7_1",
-    feature = "fdb-7_3",
-    feature = "fdb-7_4",
-)))]
-compile_error!(
-    "foundationdb-gen requires a version feature to be specified.\n\
-     \n\
-     Available version features: fdb-5_1, fdb-5_2, fdb-6_0, fdb-6_1, fdb-6_2, fdb-6_3, fdb-7_0, fdb-7_1, fdb-7_3, fdb-7_4\n\
-     \n\
-     Examples:\n\
-     - With embedded include: features = [\"embedded-fdb-include\", \"fdb-7_4\"]\n\
-     - With system install: features = [\"fdb-7_4\"]"
-);
+const OPTIONS_DATA: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/fdb.options"));
 
 pub fn emit(w: &mut impl fmt::Write) -> fmt::Result {
     let mut reader = OPTIONS_DATA;
diff --git a/bindings/rust/foundationdb-macros/Cargo.toml b/bindings/rust/foundationdb-macros/Cargo.toml
index 351174f3b48..9a7f87c929a 100644
--- a/bindings/rust/foundationdb-macros/Cargo.toml
+++ b/bindings/rust/foundationdb-macros/Cargo.toml
@@ -12,7 +12,7 @@ Macro definitions used to maintain the FoundationDB's crate
 """
 
 documentation = "https://docs.rs/foundationdb"
-repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+repository = "https://github.com/apple/foundationdb"
 license = "MIT/Apache-2.0"
 
 readme = "README.md"
diff --git a/bindings/rust/foundationdb-profiling/Cargo.toml b/bindings/rust/foundationdb-profiling/Cargo.toml
index b7f239d8afd..951e1726311 100644
--- a/bindings/rust/foundationdb-profiling/Cargo.toml
+++ b/bindings/rust/foundationdb-profiling/Cargo.toml
@@ -12,16 +12,13 @@ Read and decode FoundationDB client transaction profiling data
 """
 
 documentation = "https://docs.rs/foundationdb-profiling"
-repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+repository = "https://github.com/apple/foundationdb"
 license = "MIT/Apache-2.0"
 
 readme = "README.md"
 keywords = ["foundationdb", "profiling"]
 categories = ["database", "development-tools::profiling"]
 
-[badges]
-codecov = { repository = "foundationdb-rs/foundationdb-rs", branch = "main", service = "github" }
-
 [dependencies]
 futures-core = "0.3.32"
 thiserror = "2.0.18"
diff --git a/bindings/rust/foundationdb-simulation-tracing/Cargo.toml b/bindings/rust/foundationdb-simulation-tracing/Cargo.toml
index f58e2a432ce..5a0b5e51391 100644
--- a/bindings/rust/foundationdb-simulation-tracing/Cargo.toml
+++ b/bindings/rust/foundationdb-simulation-tracing/Cargo.toml
@@ -10,7 +10,7 @@ Forward tokio-tracing events into the FoundationDB simulator trace log
 """
 license = "MIT/Apache-2.0"
 documentation = "https://docs.rs/foundationdb-simulation-tracing"
-repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+repository = "https://github.com/apple/foundationdb"
 readme = "README.md"
 keywords = ["foundationdb", "simulation", "tracing"]
 
diff --git a/bindings/rust/foundationdb-simulation/Cargo.toml b/bindings/rust/foundationdb-simulation/Cargo.toml
index 4e043fe2dbf..301c5ca6d24 100644
--- a/bindings/rust/foundationdb-simulation/Cargo.toml
+++ b/bindings/rust/foundationdb-simulation/Cargo.toml
@@ -11,7 +11,7 @@ Embed Rust code within FoundationDB's simulation
 """
 license = "MIT/Apache-2.0"
 documentation = "https://docs.rs/foundationdb-simulation"
-repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+repository = "https://github.com/apple/foundationdb"
 readme = "README.md"
 keywords = ["foundationdb", "simulation"]
 
diff --git a/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp b/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
index 13119e38809..649e5fb4953 100644
--- a/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
+++ b/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
@@ -69,13 +69,11 @@ capi::FDBPromise wrap(GenericPromise<bool> promise) {
 } // namespace promise
 
 namespace context {
-void trace(
-	capi::OpaqueWorkloadContext* c_context,
-	capi::FDBSeverity c_severity,
-	const char* name,
-	const capi::FDBStringPair* c_details,
-	int n
-) {
+void trace(capi::OpaqueWorkloadContext* c_context,
+           capi::FDBSeverity c_severity,
+           const char* name,
+           const capi::FDBStringPair* c_details,
+           int n) {
 	auto context = (FDBWorkloadContext*)c_context;
 	FDBSeverity severity;
 	switch (c_severity) {
@@ -180,13 +178,12 @@ class Workload : public FDBWorkload {
 public:
 	Workload(const std::string& name) : name(name) {}
 	virtual ~Workload() {
-		if (this->workload.inner) WITH(this->workload, free);
+		if (this->workload.inner)
+			WITH(this->workload, free);
 	}
 
 #if FDB_API_VERSION <= 730
-	virtual std::string description() const override {
-		return "unreachable";
-	}
+	virtual std::string description() const override { return "unreachable"; }
 #endif
 
 	virtual bool init(FDBWorkloadContext* context) override {
@@ -205,15 +202,13 @@ class Workload : public FDBWorkload {
 	virtual void getMetrics(std::vector<FDBPerfMetric>& out) const override {
 		return WITH(this->workload, getMetrics, metrics::wrap(&out));
 	}
-	virtual double getCheckTimeout() override {
-		return WITH(this->workload, getCheckTimeout);
-	}
+	virtual double getCheckTimeout() override { return WITH(this->workload, getCheckTimeout); }
 };
 } // namespace translator
 
-class CppWorkloadFactory: public FDBWorkloadFactory {
+class CppWorkloadFactory : public FDBWorkloadFactory {
 public:
-	CppWorkloadFactory(FDBLogger* logger): FDBWorkloadFactory() {
+	CppWorkloadFactory(FDBLogger* logger) : FDBWorkloadFactory() {
 		logger->trace(FDBSeverity::Info, "CppWorkloadFactory", {});
 	}
 
diff --git a/bindings/rust/foundationdb-sys/Cargo.toml b/bindings/rust/foundationdb-sys/Cargo.toml
index fc43986659f..385dd30ec60 100644
--- a/bindings/rust/foundationdb-sys/Cargo.toml
+++ b/bindings/rust/foundationdb-sys/Cargo.toml
@@ -14,7 +14,7 @@ Bindings to the C api for FoundationDB
 """
 
 documentation = "https://docs.rs/foundationdb-sys"
-repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+repository = "https://github.com/apple/foundationdb"
 
 readme = "README.md"
 keywords = ["foundationdb", "kv"]
@@ -25,9 +25,6 @@ license = "MIT/Apache-2.0"
 [package.metadata.docs.rs]
 features = ["embedded-fdb-include", "fdb-7_4"]
 
-[badges]
-codecov = { repository = "foundationdb-rs/foundationdb-rs", branch = "main", service = "github" }
-
 [features]
 default = []
 # Use the locally embedded foundationdb fdb_c.h file
diff --git a/bindings/rust/foundationdb-sys/build.rs b/bindings/rust/foundationdb-sys/build.rs
index c2066cb22f0..836ef9c5e90 100644
--- a/bindings/rust/foundationdb-sys/build.rs
+++ b/bindings/rust/foundationdb-sys/build.rs
@@ -127,11 +127,16 @@ fn main() {
         api_version = 740;
     }
 
+    println!("cargo:rerun-if-env-changed=FDB_INCLUDE_DIR");
+    let include_path = env::var_os("FDB_INCLUDE_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| PathBuf::from(INCLUDE_PATH));
+
     let bindings = bindgen::Builder::default()
-        // TODO: there must be a way to get foundationdb from pkg-config...
-        .clang_arg(format!("-I{INCLUDE_PATH}"))
+        .clang_arg(format!("-I{}", include_path.display()))
         .clang_arg(format!("-D FDB_API_VERSION={api_version}"))
-        .header(format!("{INCLUDE_PATH}/fdb_c.h"))
+        .header(include_path.join("fdb_c.h").to_string_lossy())
+        .parse_callbacks(Box::new(bindgen::CargoCallbacks::new()))
         .generate_comments(true)
         .layout_tests(false)
         .generate()
diff --git a/bindings/rust/foundationdb-tuple/Cargo.toml b/bindings/rust/foundationdb-tuple/Cargo.toml
index e3125de157a..52069042a8c 100644
--- a/bindings/rust/foundationdb-tuple/Cargo.toml
+++ b/bindings/rust/foundationdb-tuple/Cargo.toml
@@ -14,7 +14,7 @@ Foundationdb tuple pack/unpack implementation in rust
 """
 
 documentation = "https://docs.rs/foundationdb"
-repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+repository = "https://github.com/apple/foundationdb"
 license = "MIT/Apache-2.0"
 
 readme = "README.md"
@@ -24,9 +24,6 @@ categories = ["database"]
 [package.metadata.docs.rs]
 features = ["uuid", "num-bigint"]
 
-[badges]
-codecov = { repository = "foundationdb-rs/foundationdb-rs", branch = "main", service = "github" }
-
 [features]
 default = ["uuid"]
 
diff --git a/bindings/rust/foundationdb/Cargo.toml b/bindings/rust/foundationdb/Cargo.toml
index 07f4c033158..e221cad536a 100644
--- a/bindings/rust/foundationdb/Cargo.toml
+++ b/bindings/rust/foundationdb/Cargo.toml
@@ -14,7 +14,7 @@ High level client bindings for FoundationDB.
 """
 
 documentation = "https://docs.rs/foundationdb"
-repository = "https://github.com/foundationdb-rs/foundationdb-rs"
+repository = "https://github.com/apple/foundationdb"
 license = "MIT/Apache-2.0"
 
 readme = "README.md"
@@ -24,9 +24,6 @@ categories = ["database"]
 [package.metadata.docs.rs]
 features = ["embedded-fdb-include", "fdb-7_4", "uuid", "recipes"]
 
-[badges]
-codecov = { repository = "foundationdb-rs/foundationdb-rs", branch = "main", service = "github" }
-
 [features]
 default = ["uuid", "recipes"]
 uuid = ["dep:uuid", "foundationdb-tuple/uuid"]
diff --git a/bindings/rust/foundationdb/README.md b/bindings/rust/foundationdb/README.md
index 887acee1e2b..28917dee857 100644
--- a/bindings/rust/foundationdb/README.md
+++ b/bindings/rust/foundationdb/README.md
@@ -7,42 +7,12 @@ This is a wrapper library around the FoundationDB (Fdb) C API. It implements fut
 * Rust 1.85.1 or more,
 * FoundationDB's client installed.
 
-## Platform Support
+## Platform support
 
-Support for different platforms ("targets") are organized into three tiers, each with a different set of guarantees. For more information on the policies for targets at each tier, see the [Target Tier Policy](#target-tier-policy).
-
-| Platform       | Tier   | Notes                                                                                                                               |
-|----------------|--------|-------------------------------------------------------------------------------------------------------------------------------------|
-| linux x86_64   | 1      |                                                                                                                                     |
-| osx x86_64     | 2      |                                                                                                                                     |
-| osx Silicon    | 2      |                                                                                                                                     |
-| Windows x86_64 | 3      | [Windows build has been officially discontinue, now maintained by the community](https://github.com/apple/foundationdb/issues/5135) |
-
-For more information on the policies for targets at each tier, see the
-
-## Target Tier Policy
-
-### Tier 1
-
-`Tier 1` targets can be thought of as "guaranteed to work". This means that:
-
-* we are actively checking correctness with the [BindingTester](https://github.com/apple/foundationdb/blob/master/bindings/bindingtester/spec/bindingApiTester.md),
-* we are running classic Rust tests on each pull requests,
-* you can use the crate on the platform.
-
-
-### Tier 2
-
-`Tier 2` targets can be thought of as "guaranteed to build". This means that:
-
-* we are running classic Rust tests on each pull requests,
-* you can use the crate on the platform.
-
-But we are not checking correctness.
-
-### Tier 3
-
-`Tier 3` targets are platforms we would like to have as Tier 2. You might be able to compile, but no CI has been set up.
+The imported client supports Linux and macOS; standalone Windows support is
+community maintained. See the [workspace README](../README.md) for the in-tree
+build and current validation scope. Upstream platform tiers and scheduled CI do
+not imply equivalent coverage in this repository.
 
 ## Getting Started
 
@@ -56,7 +26,7 @@ You first need to install FoundationDB. You can follow the official documentatio
 ### Add dependencies on foundationdb-rs
 
 ```shell
-cargo add foundationdb -F embedded-fdb-include
+cargo add foundationdb -F embedded-fdb-include,fdb-7_4
 cargo add futures
 ```
 
@@ -131,15 +101,15 @@ async fn hello_world() -> foundationdb::FdbResult<()> {
 
 ### The class-scheduling tutorial
 
-The official FoundationDB's tutorial is called the [Class Scheduling](https://apple.github.io/foundationdb/class-scheduling.html). You can find the Rust version in the [examples](https://github.com/foundationdb-rs/foundationdb-rs/tree/main/foundationdb/examples).
+The official FoundationDB's tutorial is called the [Class Scheduling](https://apple.github.io/foundationdb/class-scheduling.html). You can find the Rust version in the [examples](https://github.com/apple/foundationdb/tree/main/bindings/rust/foundationdb/examples).
 
 ### The blob tutorial
 
 The official FoundationDB documentation provides also [another topic](https://apple.github.io/foundationdb/largeval.html#modeling-large-values)
 which is further discussed inside a [design recipe](https://apple.github.io/foundationdb/blob.html).
-A Rust implementation can be found [here](https://github.com/foundationdb-rs/foundationdb-rs/tree/main/foundationdb/examples/blob.rs).
+A Rust implementation can be found [here](https://github.com/apple/foundationdb/tree/main/bindings/rust/foundationdb/examples/blob.rs).
 
-Another [example](https://github.com/foundationdb-rs/foundationdb-rs/tree/main/foundationdb/examples/blob-with-manifest.rs),
+Another [example](https://github.com/apple/foundationdb/tree/main/bindings/rust/foundationdb/examples/blob-with-manifest.rs),
 explores how to use subspaces to attach metadata to our blob.
 
 ### Must-read documentations
diff --git a/bindings/rust/scripts/run_bindingtester.sh b/bindings/rust/scripts/run_bindingtester.sh
index 26f26201cda..132a6dba638 100755
--- a/bindings/rust/scripts/run_bindingtester.sh
+++ b/bindings/rust/scripts/run_bindingtester.sh
@@ -1,40 +1,76 @@
 #!/usr/bin/env bash
 
-set -ex;
+set -euo pipefail
 
+if [[ $# == 0 ]]; then
+    echo "Usage: $0 <foundationdb-build-dir> [iterations] [bindingtester options...]" >&2
+    exit 2
+fi
+
+build_dir=$(cd "$1" && pwd -P)
+shift
+iterations=${1:-1}
+if [[ $# -gt 0 ]]; then
+    shift
+fi
+if [[ ! $iterations =~ ^[1-9][0-9]*$ ]]; then
+    echo "iterations must be a positive integer" >&2
+    exit 2
+fi
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
+bindings_dir=$(cd "${script_dir}/../.." && pwd -P)
+bindingtester="${build_dir}/bindings/bindingtester/bindingtester.py"
 fdb_api_version=740
+export FDB_RUST_BINDINGTESTER="${build_dir}/bindings/rust/bin/bindingtester"
+export PYTHONPATH="${build_dir}/bindings/python${PYTHONPATH:+:${PYTHONPATH}}"
+export LD_LIBRARY_PATH="${build_dir}/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+export DYLD_LIBRARY_PATH="${build_dir}/lib${DYLD_LIBRARY_PATH:+:${DYLD_LIBRARY_PATH}}"
+
+if [[ ! -x $FDB_RUST_BINDINGTESTER || ! -f ${build_dir}/bindings/python/fdb/fdboptions.py ]]; then
+    echo "Build fdb_rust_tester and python_binding first (see setup_bindingtester.sh)." >&2
+    exit 1
+fi
+
+# The Python tester imports its adjacent fdb package, so stage it beside the
+# generated Python binding rather than running it from the source tree.
+if [[ $bindings_dir != "${build_dir}/bindings" ]]; then
+    mkdir -p "${build_dir}/bindings/bindingtester" "${build_dir}/bindings/python/tests"
+    cp -R "${bindings_dir}/bindingtester/." "${build_dir}/bindings/bindingtester/"
+    cp -R "${bindings_dir}/python/tests/." "${build_dir}/bindings/python/tests/"
+fi
 
-fdb_rs_dir=$(pwd)
-fdb_builddir=${fdb_rs_dir:?}/target/foundationdb_build
-cd "${fdb_builddir:?}/foundationdb"
+extra_options=("$@")
+run_test() {
+    python3 "$bindingtester" "${extra_options[@]}" "$@"
+}
 
 # These are faulty seeds, for now, it is good to check them all the time to avoid regression.
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name api --compare python rust --seed 3534790651
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name api --compare python rust --seed 3864917676
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name api --concurrency 5 rust --seed 3153055325
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 2095856910
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 2483220251
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 241550211
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 1508488514
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 4203526853
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name api --compare python rust --seed 3534790651
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name api --compare python rust --seed 3864917676
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name api --concurrency 5 rust --seed 3153055325
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 2095856910
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 2483220251
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 241550211
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 1508488514
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 4203526853
 
 # https://github.com/foundationdb-rs/foundationdb-rs/issues/38
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 4142326254
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 4275610547
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 1951034301
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 1700644945
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 4142326254
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 4275610547
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 1951034301
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 1700644945
 
 # https://github.com/foundationdb-rs/foundationdb-rs/issues/42
-./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 584458794
+run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 584458794
 
-START=1
-END=${1-1}
-for i in $(eval echo "{$START..$END}")
-do
+# The shared scripted suite requires the current API version. Enable it once
+# the Rust binding supports that version; the imported binding is capped at 740.
+echo "Skipping scripted tests: they require the current API, newer than Rust's API 740."
+for ((i = 1; i <= iterations; i++)); do
   echo "Running iteration $i"
-  ./bindings/bindingtester/bindingtester.py --test-name scripted rust
-  ./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name api --compare python rust
-  ./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name api --concurrency 5 rust
-  ./bindings/bindingtester/bindingtester.py --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python
-  ./bindings/bindingtester/bindingtester.py --num-ops 100 --api-version $fdb_api_version --test-name directory_hca --concurrency 1 rust --no-directory-snapshot-ops
+  run_test --num-ops 1000 --api-version $fdb_api_version --test-name api --compare python rust
+  run_test --num-ops 1000 --api-version $fdb_api_version --test-name api --concurrency 5 rust
+  run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python
+  run_test --num-ops 100 --api-version $fdb_api_version --test-name directory_hca --concurrency 1 rust --no-directory-snapshot-ops
 done
diff --git a/bindings/rust/scripts/setup_bindingtester.sh b/bindings/rust/scripts/setup_bindingtester.sh
index 4e842bd3de0..74de155079f 100755
--- a/bindings/rust/scripts/setup_bindingtester.sh
+++ b/bindings/rust/scripts/setup_bindingtester.sh
@@ -1,35 +1,11 @@
 #!/usr/bin/env bash
 
-set -ex;
+set -euo pipefail
 
-fdb_rs_dir=$(pwd)
-bindingtester="${fdb_rs_dir:?}/$1"
+if [[ $# != 1 ]]; then
+    echo "Usage: $0 <foundationdb-build-dir>" >&2
+    exit 2
+fi
 
-pip install foundationdb==7.4.3
-fdboption_file="$(pip show foundationdb | grep Loca | awk '{print $2}')/fdb/fdboptions.py"
-echo "fdb option file: $fdboption_file"
-
-python3 --version
-
-## build the python bindings
-(
-  fdb_builddir=${fdb_rs_dir:?}/target/foundationdb_build
-  mkdir -p ${fdb_builddir:?}
-  cd ${fdb_builddir:?}
-
-  ## Get foundationdb source
-  git clone --depth 1 https://github.com/apple/foundationdb.git -b release-7.4
-  cd foundationdb
-  git checkout release-7.4
-
-  # Instead of building fdb-python with ninja/cmake, patching it with pip install
-  cp ${fdboption_file} ./bindings/python/fdb/fdboptions.py
-  echo "LATEST_API_VERSION = 740" >> ./bindings/python/fdb/apiversion.py
-  echo "FDB_VERSION = '7.4.3'" >> ./bindings/python/fdb/apiversion.py
-
-  # Tenants are not supported by this binding.
-  echo "testers['rust'] = Tester('rust', '${bindingtester}', 2040, 23, 740, types=ALL_TYPES)
-" >> ./bindings/bindingtester/known_testers.py
-)
-
-cd "${fdb_rs_dir}";
+# The configured build must enable BUILD_RUST_BINDING and BUILD_PYTHON_BINDING.
+cmake --build "$1" --target fdb_rust_tester python_binding
diff --git a/cmake/AddFdbTest.cmake b/cmake/AddFdbTest.cmake
index 0dbe8b4b394..80b35a59b25 100644
--- a/cmake/AddFdbTest.cmake
+++ b/cmake/AddFdbTest.cmake
@@ -437,6 +437,18 @@ function(prepare_binding_test_files build_directory target_name target_dependenc
       COMMENT "Copy generated.go for bindingtester")
   endif()
 
+  if(WITH_RUST_BINDING)
+    add_dependencies(${target_name} fdb_rust_tester)
+    add_custom_command(
+      TARGET ${target_name}
+      POST_BUILD
+      COMMAND ${CMAKE_COMMAND} -E make_directory ${build_directory}/tests/rust/bin
+      COMMAND ${CMAKE_COMMAND} -E copy
+        ${CMAKE_BINARY_DIR}/bindings/rust/bin/bindingtester
+        ${build_directory}/tests/rust/bin/bindingtester
+      COMMENT "Copy Rust tester for bindingtester")
+  endif()
+
   if(WITH_SWIFT_BINDING)
     add_dependencies(${target_name} stacktester_swift)
     add_custom_command(
diff --git a/cmake/FDBComponents.cmake b/cmake/FDBComponents.cmake
index a8daf9b3531..f58e716b71c 100644
--- a/cmake/FDBComponents.cmake
+++ b/cmake/FDBComponents.cmake
@@ -157,6 +157,26 @@ else()
   endif()
 endif()
 
+################################################################################
+# Rust
+################################################################################
+
+# Rust remains opt-in while the imported binding is integrated with the build
+# and binding tester. Other components do not require a Rust toolchain.
+option(BUILD_RUST_BINDING "build rust binding" OFF)
+set(WITH_RUST_BINDING OFF)
+if(BUILD_RUST_BINDING AND NOT OPEN_FOR_IDE)
+  if(NOT WITH_C_BINDING)
+    message(FATAL_ERROR "Rust binding depends on the C binding")
+  endif()
+  if(WIN32 OR CMAKE_CROSSCOMPILING OR USE_SANITIZER)
+    message(FATAL_ERROR "The Rust CMake build currently supports native, non-sanitized Unix builds only")
+  endif()
+  find_program(CARGO_EXECUTABLE cargo REQUIRED)
+  find_program(RUSTC_EXECUTABLE rustc REQUIRED)
+  set(WITH_RUST_BINDING ON)
+endif()
+
 ################################################################################
 # Swift
 ################################################################################
@@ -372,6 +392,7 @@ function(print_components)
   message(STATUS "Build Python Bindings:                ${WITH_PYTHON_BINDING}")
   message(STATUS "Build Java Bindings:                  ${WITH_JAVA_BINDING}")
   message(STATUS "Build Go bindings:                    ${WITH_GO_BINDING}")
+  message(STATUS "Build Rust bindings:                  ${WITH_RUST_BINDING}")
   message(STATUS "Build Swift bindings:                 ${WITH_SWIFT_BINDING}")
   message(STATUS "Build Ruby bindings:                  ${WITH_RUBY_BINDING}")
   message(STATUS "Build Swift (depends on Swift):       ${WITH_SWIFT}")
diff --git a/documentation/sphinx/source/api-reference.rst b/documentation/sphinx/source/api-reference.rst
index c0064b401b5..5cd1dc0e08c 100644
--- a/documentation/sphinx/source/api-reference.rst
+++ b/documentation/sphinx/source/api-reference.rst
@@ -14,6 +14,7 @@ The following documents give detailed descriptions of the API for each language:
    api-ruby
    Java API <https://www.javadoc.io/doc/org.foundationdb/fdb-java/latest/index.html>
    Go API <https://godoc.org/github.com/apple/foundationdb/bindings/go/src/fdb>
+   Rust API <https://docs.rs/foundationdb>
    api-c
    api-error-codes
    special-keys

From 4b0d34468a7a0d0e4944ee966b247d1b82a4f1fb Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Wed, 30 Sep 2026 17:17:40 -0700
Subject: [PATCH 03/11] Fix Rust binding safety and compatibility issues

---
 .github/workflows/tidy.yml                    |   9 +-
 bindings/rust/CMakeLists.txt                  |  10 ++
 bindings/rust/README.md                       |  10 +-
 bindings/rust/UPSTREAM.md                     |   9 ++
 bindings/rust/foundationdb-gen/src/lib.rs     |   4 +-
 .../src/CppWorkload.cpp                       |  16 +--
 .../foundationdb-simulation/src/bindings.rs   |   3 +-
 .../src/headers/CppWorkload.h                 |  12 +-
 bindings/rust/foundationdb/src/cluster.rs     |  14 ++-
 bindings/rust/foundationdb/src/database.rs    |  28 ++---
 bindings/rust/foundationdb/src/future.rs      |  18 ++-
 .../foundationdb/src/mapped_key_values.rs     |   5 +-
 bindings/rust/foundationdb/src/runner.rs      |  17 ++-
 bindings/rust/foundationdb/src/transaction.rs | 106 ++++++++++--------
 bindings/rust/foundationdb/tests/api.rs       |  10 ++
 bindings/rust/foundationdb/tests/get.rs       |   4 +-
 bindings/rust/foundationdb/tests/range.rs     |  12 ++
 bindings/rust/foundationdb/tests/run_retry.rs |  67 ++++++++++-
 18 files changed, 252 insertions(+), 102 deletions(-)

diff --git a/.github/workflows/tidy.yml b/.github/workflows/tidy.yml
index f792c67074d..8c290581771 100644
--- a/.github/workflows/tidy.yml
+++ b/.github/workflows/tidy.yml
@@ -118,7 +118,14 @@ jobs:
               if [[ $FILE == fdbserver/*/*RocksDB*.cpp ]]; then
                 ninja -C build_output fdbserver/rocksdb-prefix/src/rocksdb-stamp/rocksdb-download
               fi
-              if ! clang-tidy -p build_output --warnings-as-errors='*' "$FILE"; then
+              COMPILE_ARGS=()
+              case "$FILE" in
+                bindings/rust/foundationdb-simulation/src/CppWorkload.cpp|bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h)
+                  # Cargo owns this bridge, so it has no CMake compilation database entry.
+                  COMPILE_ARGS=(-- -x c++ -std=c++14 -DFDB_API_VERSION=740)
+                  ;;
+              esac
+              if ! clang-tidy -p build_output --warnings-as-errors='*' "$FILE" "${COMPILE_ARGS[@]}"; then
                 PASSED=false
               fi
               echo
diff --git a/bindings/rust/CMakeLists.txt b/bindings/rust/CMakeLists.txt
index b4027b063f6..21bf7ff67f6 100644
--- a/bindings/rust/CMakeLists.txt
+++ b/bindings/rust/CMakeLists.txt
@@ -88,6 +88,16 @@ add_test(NAME rust_unit_tests
   COMMAND_EXPAND_LISTS)
 set_tests_properties(rust_unit_tests PROPERTIES TIMEOUT 300 LABELS "rust")
 
+# This compile-fail doctest checks the public raw-pointer ownership boundary.
+# Other client doctests may require a running cluster.
+add_test(NAME rust_future_safety_tests
+  COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+    ${CARGO_EXECUTABLE} test ${rust_cargo_args} --package foundationdb --doc --offline
+    future::FdbFuture
+  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+  COMMAND_EXPAND_LISTS)
+set_tests_properties(rust_future_safety_tests PROPERTIES TIMEOUT 300 LABELS "rust")
+
 if(RUN_RUST_INTEGRATION_TESTS)
   add_custom_target(fdb_rust_integration_tests ALL
     COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
diff --git a/bindings/rust/README.md b/bindings/rust/README.md
index 37d91a8b785..07350cc0c3c 100644
--- a/bindings/rust/README.md
+++ b/bindings/rust/README.md
@@ -38,10 +38,12 @@ standalone Cargo development.
 
 ## Compatibility and current limits
 
-The migration preserves the upstream crate versions and public Rust API. Crate
-versions are independent of the FoundationDB server release number. Published
-crates on crates.io are separate releases; importing the source does not publish
-or transfer ownership of them.
+The migration preserves the upstream crate versions. Two API corrections are
+documented in [UPSTREAM.md](UPSTREAM.md): raw-future ownership requires `unsafe`,
+and integer options take `i64` to cover the C API's full range. Crate versions are
+independent of the FoundationDB server release number. Published crates on
+crates.io are separate releases; importing the source does not publish or transfer
+ownership of them.
 
 Select exactly one Cargo API feature: `fdb-5_1`, `fdb-5_2`, `fdb-6_0`, `fdb-6_1`,
 `fdb-6_2`, `fdb-6_3`, `fdb-7_0`, `fdb-7_1`, `fdb-7_3`, or `fdb-7_4`. The in-tree
diff --git a/bindings/rust/UPSTREAM.md b/bindings/rust/UPSTREAM.md
index 7d71aeac734..20f7ce7bb9b 100644
--- a/bindings/rust/UPSTREAM.md
+++ b/bindings/rust/UPSTREAM.md
@@ -22,3 +22,12 @@ Historical headers and `fdb.options` snapshots support standalone Cargo builds
 against older API versions. The in-tree CMake build uses the canonical FoundationDB
 headers and option definitions instead. Preserve the historical snapshots when
 updating current options or formatting current FoundationDB C/C++ sources.
+
+The in-tree adaptation also corrects two public API contracts from this snapshot:
+
+- `FdbFuture::new` is now unsafe because it takes unique ownership of a raw C
+  future. Callers must establish pointer validity, ownership, and the result type
+  before constructing the wrapper.
+- Integer option payloads use `i64`, matching the signed 64-bit values accepted by
+  the C API. Callers with explicitly typed `i32` values must widen them with
+  `i64::from(value)`; unsuffixed integer literals continue to infer the right type.
diff --git a/bindings/rust/foundationdb-gen/src/lib.rs b/bindings/rust/foundationdb-gen/src/lib.rs
index 283c4c0e0a5..442e7faa185 100644
--- a/bindings/rust/foundationdb-gen/src/lib.rs
+++ b/bindings/rust/foundationdb-gen/src/lib.rs
@@ -105,7 +105,7 @@ impl FdbScope {
                 }
                 FdbOptionTy::Int => {
                     writeln!(w, "(v) => {{")?;
-                    writeln!(w, "{TAB4}let data: [u8;8] = i64::to_ne_bytes(v as i64);",)?;
+                    writeln!(w, "{TAB4}let data: [u8;8] = v.to_ne_bytes();",)?;
                     writeln!(
                         w,
                         "{TAB4}fdb_sys::{fn_name}({args}, data.as_ptr() as *const u8, 8)"
@@ -224,7 +224,7 @@ impl FdbOption {
 
     fn get_ty(&self) -> Option<&'static str> {
         match self.param_type {
-            FdbOptionTy::Int => Some("i32"),
+            FdbOptionTy::Int => Some("i64"),
             FdbOptionTy::Str => Some("String"),
             FdbOptionTy::Bytes => Some("Vec<u8>"),
             FdbOptionTy::Empty => None,
diff --git a/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp b/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
index 649e5fb4953..f01b5aab4f9 100644
--- a/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
+++ b/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
@@ -183,26 +183,26 @@ class Workload : public FDBWorkload {
 	}
 
 #if FDB_API_VERSION <= 730
-	virtual std::string description() const override { return "unreachable"; }
+	std::string description() const override { return "unreachable"; }
 #endif
 
-	virtual bool init(FDBWorkloadContext* context) override {
+	bool init(FDBWorkloadContext* context) override {
 		this->workload = translator::workloadCFactory(this->name.c_str(), context::wrap(context));
 		return true;
 	}
-	virtual void setup(FDBDatabase* db, GenericPromise<bool> done) override {
+	void setup(FDBDatabase* db, GenericPromise<bool> done) override {
 		return WITH(this->workload, setup, (capi::FDBDatabase*)db, promise::wrap(done));
 	}
-	virtual void start(FDBDatabase* db, GenericPromise<bool> done) override {
+	void start(FDBDatabase* db, GenericPromise<bool> done) override {
 		return WITH(this->workload, start, (capi::FDBDatabase*)db, promise::wrap(done));
 	}
-	virtual void check(FDBDatabase* db, GenericPromise<bool> done) override {
+	void check(FDBDatabase* db, GenericPromise<bool> done) override {
 		return WITH(this->workload, check, (capi::FDBDatabase*)db, promise::wrap(done));
 	}
-	virtual void getMetrics(std::vector<FDBPerfMetric>& out) const override {
+	void getMetrics(std::vector<FDBPerfMetric>& out) const override {
 		return WITH(this->workload, getMetrics, metrics::wrap(&out));
 	}
-	virtual double getCheckTimeout() override { return WITH(this->workload, getCheckTimeout); }
+	double getCheckTimeout() override { return WITH(this->workload, getCheckTimeout); }
 };
 } // namespace translator
 
@@ -212,7 +212,7 @@ class CppWorkloadFactory : public FDBWorkloadFactory {
 		logger->trace(FDBSeverity::Info, "CppWorkloadFactory", {});
 	}
 
-	virtual std::shared_ptr<FDBWorkload> create(const std::string& name) {
+	std::shared_ptr<FDBWorkload> create(const std::string& name) override {
 		return std::make_shared<translator::Workload>(name);
 	}
 };
diff --git a/bindings/rust/foundationdb-simulation/src/bindings.rs b/bindings/rust/foundationdb-simulation/src/bindings.rs
index 785baea0099..036194dcaa1 100644
--- a/bindings/rust/foundationdb-simulation/src/bindings.rs
+++ b/bindings/rust/foundationdb-simulation/src/bindings.rs
@@ -299,7 +299,8 @@ impl WorkloadContext {
         duration: Duration,
     ) -> impl std::future::Future<Output = fdb::FdbResult<()>> + Send + Sync + 'static + use<> {
         let f = with! { self.0 => delay(duration.as_secs_f64()) };
-        fdb::future::FdbFuture::new(f as *mut _)
+        // SAFETY: delay returns a new, owned C future with no result value.
+        unsafe { fdb::future::FdbFuture::new(f as *mut _) }
     }
 }
 
diff --git a/bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h b/bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h
index 4b50edc54aa..858b62543b8 100644
--- a/bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h
+++ b/bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h
@@ -25,6 +25,8 @@
 #include <vector>
 #include <functional>
 #include <memory>
+#include <type_traits>
+#include <utility>
 
 #ifndef DLLEXPORT
 #if defined(_MSC_VER)
@@ -36,10 +38,10 @@
 #endif
 #endif
 
-typedef struct FDB_future FDBFuture;
-typedef struct FDB_result FDBResult;
-typedef struct FDB_database FDBDatabase;
-typedef struct FDB_transaction FDBTransaction;
+using FDBFuture = struct FDB_future;
+using FDBResult = struct FDB_result;
+using FDBDatabase = struct FDB_database;
+using FDBTransaction = struct FDB_transaction;
 
 enum class FDBSeverity { Debug, Info, Warn, WarnAlways, Error };
 
@@ -77,7 +79,7 @@ class GenericPromise {
 	std::shared_ptr<FDBPromise> impl;
 
 public:
-	template <class Ptr>
+	template <class Ptr, std::enable_if_t<!std::is_same<std::decay_t<Ptr>, GenericPromise>::value, int> = 0>
 	explicit GenericPromise(Ptr&& impl) : impl(std::forward<Ptr>(impl)) {}
 	void send(T val) { impl->send(&val); }
 };
diff --git a/bindings/rust/foundationdb/src/cluster.rs b/bindings/rust/foundationdb/src/cluster.rs
index 5d9a64bf1d8..f8d9ff9c9b6 100644
--- a/bindings/rust/foundationdb/src/cluster.rs
+++ b/bindings/rust/foundationdb/src/cluster.rs
@@ -16,7 +16,7 @@ use std::ptr::NonNull;
 use std::sync::Arc;
 
 use crate::future::*;
-use crate::{error, Database, FdbError, FdbResult};
+use crate::{Database, FdbError, FdbResult, error};
 use foundationdb_sys as fdb_sys;
 
 /// An opaque type that represents a Cluster in the FoundationDB C API.
@@ -46,7 +46,7 @@ impl Cluster {
             .as_ref()
             .map(|path| path.as_ptr())
             .unwrap_or(std::ptr::null());
-        let f = FdbFuture::new(unsafe { fdb_sys::fdb_create_cluster(path_ptr) });
+        let f = unsafe { FdbFuture::new(fdb_sys::fdb_create_cluster(path_ptr)) };
         drop(path_str);
         f
     }
@@ -69,9 +69,13 @@ impl Cluster {
     pub fn create_database(
         &self,
     ) -> impl Future<Output = FdbResult<Database>> + Send + Sync + Unpin {
-        FdbFuture::new(unsafe {
-            fdb_sys::fdb_cluster_create_database(self.inner.0.as_ptr(), b"DB" as *const _, 2)
-        })
+        unsafe {
+            FdbFuture::new(fdb_sys::fdb_cluster_create_database(
+                self.inner.0.as_ptr(),
+                b"DB" as *const _,
+                2,
+            ))
+        }
     }
 }
 
diff --git a/bindings/rust/foundationdb/src/database.rs b/bindings/rust/foundationdb/src/database.rs
index 25ab46d77d8..bef2d07d179 100644
--- a/bindings/rust/foundationdb/src/database.rs
+++ b/bindings/rust/foundationdb/src/database.rs
@@ -29,12 +29,11 @@ use crate::{FdbError, FdbResult, error};
 use crate::error::RetryableError;
 use futures::prelude::*;
 
-/// Wrapper around the boolean representing whether the
-/// previous transaction is still on fly
-/// This wrapper prevents the boolean to be copy and force it
-/// to be moved instead.
-/// This pretty handy when you don't want to see the `Database::run` closure
-/// capturing the environment.
+/// Whether any earlier attempt in this run may have committed.
+///
+/// Once true, this remains true for every subsequent attempt, even if later
+/// attempts fail with errors that are known not to have committed.
+/// Convert it to a boolean with `bool::from` when checking the flag.
 pub struct MaybeCommitted(bool);
 
 impl MaybeCommitted {
@@ -122,9 +121,11 @@ impl Database {
         &self,
     ) -> impl Future<Output = FdbResult<crate::future::FdbSlice>> + Send + Sync + Unpin + use<>
     {
-        crate::future::FdbFuture::new(unsafe {
-            fdb_sys::fdb_database_get_client_status(self.inner.as_ptr())
-        })
+        unsafe {
+            crate::future::FdbFuture::new(fdb_sys::fdb_database_get_client_status(
+                self.inner.as_ptr(),
+            ))
+        }
     }
 }
 
@@ -339,8 +340,8 @@ impl Database {
     /// As with other client/server databases, in some failure scenarios a client may be unable to determine
     /// whether a transaction succeeded. You should make sure your closure is idempotent.
     ///
-    /// The closure will notify the user in case of a maybe_committed transaction in a previous run
-    ///  with the `MaybeCommitted` provided in the closure.
+    /// The closure receives a [`MaybeCommitted`] flag indicating whether any earlier attempt
+    /// in this run may have committed. Once true, it stays true for all subsequent attempts.
     ///
     /// This one can be used as boolean with
     /// ```ignore
@@ -458,8 +459,9 @@ impl Database {
     /// # Warning: Maybe committed transactions
     ///
     /// As with other client/server databases, in some failure scenarios a client may be unable to determine
-    /// whether a transaction succeeded. The closure will be notified of a maybe_committed transaction
-    /// in a previous run with the `MaybeCommitted` provided in the closure.
+    /// whether a transaction succeeded. The closure receives a [`MaybeCommitted`] flag indicating
+    /// whether any earlier attempt in this run may have committed. Once true, it stays true for
+    /// all subsequent attempts.
     #[cfg_attr(
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, closure))
diff --git a/bindings/rust/foundationdb/src/future.rs b/bindings/rust/foundationdb/src/future.rs
index 060b7aa52b6..b7c6c994fa9 100644
--- a/bindings/rust/foundationdb/src/future.rs
+++ b/bindings/rust/foundationdb/src/future.rs
@@ -76,7 +76,23 @@ impl<T> FdbFuture<T>
 where
     T: TryFrom<FdbFutureHandle, Error = FdbError> + Unpin,
 {
-    pub fn new(f: *mut fdb_sys::FDBFuture) -> Self {
+    /// Takes ownership of a future returned by the FoundationDB C API.
+    ///
+    /// # Safety
+    ///
+    /// `f` must be a non-null, valid `FDBFuture` whose result can be extracted by
+    /// `T::try_from`. Ownership of the future is transferred to this wrapper:
+    /// no other owner may destroy it or release its result memory. In particular,
+    /// the same pointer must not be passed to this constructor more than once.
+    ///
+    /// Constructing an owning wrapper requires an explicit unsafe call:
+    ///
+    /// ```compile_fail,E0133
+    /// use foundationdb::future::FdbFuture;
+    ///
+    /// let future = FdbFuture::<()>::new(std::ptr::null_mut());
+    /// ```
+    pub unsafe fn new(f: *mut fdb_sys::FDBFuture) -> Self {
         Self {
             f: Some(FdbFutureHandle(
                 NonNull::new(f).expect("FDBFuture to not be null"),
diff --git a/bindings/rust/foundationdb/src/mapped_key_values.rs b/bindings/rust/foundationdb/src/mapped_key_values.rs
index 5b9da383741..a9e70f66b35 100644
--- a/bindings/rust/foundationdb/src/mapped_key_values.rs
+++ b/bindings/rust/foundationdb/src/mapped_key_values.rs
@@ -19,7 +19,6 @@ use crate::future::{FdbFutureHandle, FdbKeyValue};
 use crate::{error, KeySelector};
 use crate::{FdbError, FdbResult};
 use foundationdb_sys as fdb_sys;
-use std::borrow::Cow;
 use std::fmt;
 
 use std::ops::Deref;
@@ -117,12 +116,12 @@ impl FdbMappedKeyValue {
 
     /// Retrieves the beginning of the range as a [`KeySelector`]
     pub fn begin_selector(&self) -> KeySelector<'_> {
-        KeySelector::new(Cow::from(self.begin_range()), false, 0)
+        KeySelector::first_greater_or_equal(self.begin_range())
     }
 
     /// Retrieves the end of the range as a [`KeySelector`]
     pub fn end_selector(&self) -> KeySelector<'_> {
-        KeySelector::new(Cow::from(self.end_range()), false, 0)
+        KeySelector::first_greater_or_equal(self.end_range())
     }
 
     /// retrieves the associated slice of [`FdbKeyValue`]
diff --git a/bindings/rust/foundationdb/src/runner.rs b/bindings/rust/foundationdb/src/runner.rs
index 42b6259b9f7..8ad25e2788c 100644
--- a/bindings/rust/foundationdb/src/runner.rs
+++ b/bindings/rust/foundationdb/src/runner.rs
@@ -485,9 +485,9 @@ pub enum AttemptFailure<'a, E> {
 /// * [`RetryDecision::Retry`] does the same with code 1020 (`not_committed`),
 ///   which is retryable by definition.
 ///
-/// A policy cannot corrupt the
-/// [`MaybeCommitted`] flag handed to the closure: it is
-/// computed from the original error before the policy is consulted.
+/// A policy cannot clear the [`MaybeCommitted`] flag handed to the closure:
+/// it accumulates the original errors from all attempts before the policy is
+/// consulted.
 ///
 /// # Example: cap the number of attempts
 ///
@@ -646,13 +646,10 @@ where
 
                 Attempt::ClosureFailed { transaction, error } => {
                     let proposed = error.retry_decision();
-                    // maybe_committed is computed from the original error only,
-                    // before the policy is consulted: a previous maybe-committed
-                    // attempt must stay visible to the closure whatever the
-                    // policy decides. The synthetic 1020 of `Retry` leaves it
-                    // untouched on purpose.
+                    // Later failures cannot resolve an earlier uncertain commit.
+                    // Preserve it regardless of the policy's replacement error.
                     if let RetryDecision::Fdb(fdb_err) = proposed {
-                        maybe_committed = fdb_err.is_maybe_committed();
+                        maybe_committed |= fdb_err.is_maybe_committed();
                     }
 
                     let fdb_err =
@@ -682,7 +679,7 @@ where
                 }
 
                 Attempt::CommitFailed(commit_error) => {
-                    maybe_committed = commit_error.is_maybe_committed();
+                    maybe_committed |= commit_error.is_maybe_committed();
                     let proposed = RetryDecision::Fdb(*commit_error);
 
                     // Fires before the policy is consulted: a hook reading the
diff --git a/bindings/rust/foundationdb/src/transaction.rs b/bindings/rust/foundationdb/src/transaction.rs
index 058b3e5a6b6..63b871bcd35 100644
--- a/bindings/rust/foundationdb/src/transaction.rs
+++ b/bindings/rust/foundationdb/src/transaction.rs
@@ -238,9 +238,12 @@ impl TransactionCommitError {
         self.tr.mark_attempt_end();
         let cause = self.err;
 
-        FdbFuture::<()>::new(unsafe {
-            fdb_sys::fdb_transaction_on_error(self.tr.inner.as_ptr(), self.err.code())
-        })
+        unsafe {
+            FdbFuture::<()>::new(fdb_sys::fdb_transaction_on_error(
+                self.tr.inner.as_ptr(),
+                self.err.code(),
+            ))
+        }
         .map_ok(move |()| {
             self.tr.end_attempt(AttemptOutcome::Retried { cause });
             self.tr.begin_attempt_usage();
@@ -895,14 +898,14 @@ impl Transaction {
         let usage = self.usage();
         let lenght_key = key.len();
 
-        FdbFuture::<Option<FdbSlice>>::new(unsafe {
-            fdb_sys::fdb_transaction_get(
+        unsafe {
+            FdbFuture::<Option<FdbSlice>>::new(fdb_sys::fdb_transaction_get(
                 self.inner.as_ptr(),
                 key.as_ptr(),
                 fdb_len(key.len(), "key"),
                 fdb_bool(snapshot),
-            )
-        })
+            ))
+        }
         .map(move |result| {
             if let Ok(value) = &result {
                 let (bytes_count, kv_fetched) = if let Some(values) = value {
@@ -988,16 +991,16 @@ impl Transaction {
         let usage = self.usage();
         let length_key = key.len();
 
-        FdbFuture::<FdbSlice>::new(unsafe {
-            fdb_sys::fdb_transaction_get_key(
+        unsafe {
+            FdbFuture::<FdbSlice>::new(fdb_sys::fdb_transaction_get_key(
                 self.inner.as_ptr(),
                 key.as_ptr(),
                 fdb_len(key.len(), "key"),
                 fdb_bool(selector.or_equal()),
                 selector.offset(),
                 fdb_bool(snapshot),
-            )
-        })
+            ))
+        }
         .map(move |result| {
             if let Ok(resolved_key) = &result {
                 usage.record_get((length_key + resolved_key.len()) as u64, 0);
@@ -1136,8 +1139,8 @@ impl Transaction {
         let key_begin = begin.key();
         let key_end = end.key();
 
-        FdbFuture::<FdbValues>::new(unsafe {
-            fdb_sys::fdb_transaction_get_range(
+        unsafe {
+            FdbFuture::<FdbValues>::new(fdb_sys::fdb_transaction_get_range(
                 self.inner.as_ptr(),
                 key_begin.as_ptr(),
                 fdb_len(key_begin.len(), "key_begin"),
@@ -1153,8 +1156,8 @@ impl Transaction {
                 fdb_iteration(iteration),
                 fdb_bool(snapshot),
                 fdb_bool(opt.reverse),
-            )
-        })
+            ))
+        }
         .map(move |result| {
             if let Ok(values) = &result {
                 let kv_fetched = values.len();
@@ -1220,8 +1223,8 @@ impl Transaction {
 
         let usage = self.usage();
 
-        FdbFuture::<MappedKeyValues>::new(unsafe {
-            fdb_sys::fdb_transaction_get_mapped_range(
+        unsafe {
+            FdbFuture::<MappedKeyValues>::new(fdb_sys::fdb_transaction_get_mapped_range(
                 self.inner.as_ptr(),
                 key_begin.as_ptr(),
                 fdb_len(key_begin.len(), "key_begin"),
@@ -1239,8 +1242,8 @@ impl Transaction {
                 fdb_iteration(iteration),
                 fdb_bool(snapshot),
                 fdb_bool(opt.reverse),
-            )
-        })
+            ))
+        }
         .map(move |result| {
             if let Ok(values) = &result {
                 let mut bytes_count = 0;
@@ -1349,15 +1352,15 @@ impl Transaction {
         begin: &[u8],
         end: &[u8],
     ) -> impl Future<Output = FdbResult<i64>> + Send + Sync + Unpin + use<> {
-        FdbFuture::<i64>::new(unsafe {
-            fdb_sys::fdb_transaction_get_estimated_range_size_bytes(
+        unsafe {
+            FdbFuture::<i64>::new(fdb_sys::fdb_transaction_get_estimated_range_size_bytes(
                 self.inner.as_ptr(),
                 begin.as_ptr(),
                 fdb_len(begin.len(), "begin"),
                 end.as_ptr(),
                 fdb_len(end.len(), "end"),
-            )
-        })
+            ))
+        }
     }
 
     /// Attempts to commit the sets and clears previously applied to the database snapshot
@@ -1393,7 +1396,7 @@ impl Transaction {
         let metrics = self.metrics().cloned();
         let started_at = Instant::now();
 
-        FdbFuture::<()>::new(unsafe { fdb_sys::fdb_transaction_commit(self.inner.as_ptr()) }).map(
+        unsafe { FdbFuture::<()>::new(fdb_sys::fdb_transaction_commit(self.inner.as_ptr())) }.map(
             move |r| {
                 if let Some(metrics) = &metrics {
                     metrics.record_commit(started_at.elapsed());
@@ -1433,9 +1436,12 @@ impl Transaction {
     ) -> impl Future<Output = FdbResult<Transaction>> + Send + Sync + Unpin {
         self.mark_attempt_end();
 
-        FdbFuture::<()>::new(unsafe {
-            fdb_sys::fdb_transaction_on_error(self.inner.as_ptr(), err.code())
-        })
+        unsafe {
+            FdbFuture::<()>::new(fdb_sys::fdb_transaction_on_error(
+                self.inner.as_ptr(),
+                err.code(),
+            ))
+        }
         .map_ok(move |()| {
             self.end_attempt(AttemptOutcome::Retried { cause: err });
             self.begin_attempt_usage();
@@ -1536,13 +1542,13 @@ impl Transaction {
         &self,
         key: &[u8],
     ) -> impl Future<Output = FdbResult<FdbAddresses>> + Send + Sync + Unpin + use<> {
-        FdbFuture::new(unsafe {
-            fdb_sys::fdb_transaction_get_addresses_for_key(
+        unsafe {
+            FdbFuture::new(fdb_sys::fdb_transaction_get_addresses_for_key(
                 self.inner.as_ptr(),
                 key.as_ptr(),
                 fdb_len(key.len(), "key"),
-            )
-        })
+            ))
+        }
     }
 
     /// A watch's behavior is relative to the transaction that created it. A watch will report a
@@ -1574,13 +1580,13 @@ impl Transaction {
         &self,
         key: &[u8],
     ) -> impl Future<Output = FdbResult<()>> + Send + Sync + Unpin + use<> {
-        FdbFuture::new(unsafe {
-            fdb_sys::fdb_transaction_watch(
+        unsafe {
+            FdbFuture::new(fdb_sys::fdb_transaction_watch(
                 self.inner.as_ptr(),
                 key.as_ptr(),
                 fdb_len(key.len(), "key"),
-            )
-        })
+            ))
+        }
     }
 
     /// Returns an FDBFuture which will be set to the approximate transaction size so far in the
@@ -1592,9 +1598,11 @@ impl Transaction {
     pub fn get_approximate_size(
         &self,
     ) -> impl Future<Output = FdbResult<i64>> + Send + Sync + Unpin + use<> {
-        FdbFuture::new(unsafe {
-            fdb_sys::fdb_transaction_get_approximate_size(self.inner.as_ptr())
-        })
+        unsafe {
+            FdbFuture::new(fdb_sys::fdb_transaction_get_approximate_size(
+                self.inner.as_ptr(),
+            ))
+        }
     }
 
     /// Gets a list of keys that can split the given range into (roughly) equally sized chunks based on chunk_size.
@@ -1606,16 +1614,16 @@ impl Transaction {
         end: &[u8],
         chunk_size: i64,
     ) -> impl Future<Output = FdbResult<FdbKeys>> + Send + Sync + Unpin + use<> {
-        FdbFuture::<FdbKeys>::new(unsafe {
-            fdb_sys::fdb_transaction_get_range_split_points(
+        unsafe {
+            FdbFuture::<FdbKeys>::new(fdb_sys::fdb_transaction_get_range_split_points(
                 self.inner.as_ptr(),
                 begin.as_ptr(),
                 fdb_len(begin.len(), "begin"),
                 end.as_ptr(),
                 fdb_len(end.len(), "end"),
                 chunk_size,
-            )
-        })
+            ))
+        }
     }
 
     /// Returns an FDBFuture which will be set to the versionstamp which was used by any
@@ -1630,7 +1638,11 @@ impl Transaction {
     pub fn get_versionstamp(
         &self,
     ) -> impl Future<Output = FdbResult<FdbSlice>> + Send + Sync + Unpin + use<> {
-        FdbFuture::new(unsafe { fdb_sys::fdb_transaction_get_versionstamp(self.inner.as_ptr()) })
+        unsafe {
+            FdbFuture::new(fdb_sys::fdb_transaction_get_versionstamp(
+                self.inner.as_ptr(),
+            ))
+        }
     }
 
     /// The transaction obtains a snapshot read version automatically at the time of the first call
@@ -1647,9 +1659,11 @@ impl Transaction {
         let metrics = self.metrics().cloned();
         let started_at = metrics.as_ref().map(|_| Instant::now());
 
-        FdbFuture::<i64>::new(unsafe {
-            fdb_sys::fdb_transaction_get_read_version(self.inner.as_ptr())
-        })
+        unsafe {
+            FdbFuture::<i64>::new(fdb_sys::fdb_transaction_get_read_version(
+                self.inner.as_ptr(),
+            ))
+        }
         .map(move |result| {
             if let (Some(metrics), Some(started_at)) = (&metrics, started_at) {
                 metrics.record_grv(started_at.elapsed());
diff --git a/bindings/rust/foundationdb/tests/api.rs b/bindings/rust/foundationdb/tests/api.rs
index fde3c495a28..5102d36e53f 100644
--- a/bindings/rust/foundationdb/tests/api.rs
+++ b/bindings/rust/foundationdb/tests/api.rs
@@ -5,6 +5,16 @@ use foundationdb::options::NetworkOption;
 // process, so a second test in this binary would race it.
 #[test]
 fn test_network_lifecycle() {
+    // Integer options use the C API's full signed 64-bit domain. These values
+    // must reach the client without truncating to a negative 32-bit integer.
+    FdbApiBuilder::default()
+        .build()
+        .expect("failed to select fdb api")
+        .set_option(NetworkOption::TraceRollSize(3 * 1024 * 1024 * 1024))
+        .expect("trace roll size above i32::MAX must be accepted")
+        .set_option(NetworkOption::TraceMaxLogsSize(i64::MAX))
+        .expect("maximum signed 64-bit trace log size must be accepted");
+
     // boot is safe and idempotent
     let _guard1 = foundationdb::boot().expect("failed to boot fdb");
     let _guard2 = foundationdb::boot().expect("boot must be idempotent");
diff --git a/bindings/rust/foundationdb/tests/get.rs b/bindings/rust/foundationdb/tests/get.rs
index c2c3b1b3193..310e8f3c259 100644
--- a/bindings/rust/foundationdb/tests/get.rs
+++ b/bindings/rust/foundationdb/tests/get.rs
@@ -129,7 +129,7 @@ async fn test_transact() -> FdbResult<()> {
         // increment try counter
         try_count0.fetch_add(1, Ordering::SeqCst);
 
-        trx.set_option(options::TransactionOption::RetryLimit(RETRY_COUNT as i32))
+        trx.set_option(options::TransactionOption::RetryLimit(RETRY_COUNT as i64))
             .expect("failed to set retry limit");
 
         // update conflict range
@@ -336,7 +336,7 @@ async fn test_set_raw_option() -> FdbResult<()> {
     ) -> FdbResult<()> {
         // increment try counter
         try_count0.fetch_add(1, Ordering::SeqCst);
-        let option = options::TransactionOption::RetryLimit(RETRY_COUNT as i32);
+        let option = options::TransactionOption::RetryLimit(RETRY_COUNT as i64);
         trx.set_raw_option(option.code(), Some(RETRY_COUNT.to_le_bytes().to_vec()))
             .expect("failed to set retry limit");
 
diff --git a/bindings/rust/foundationdb/tests/range.rs b/bindings/rust/foundationdb/tests/range.rs
index 24414f02061..75c3b21cf7e 100644
--- a/bindings/rust/foundationdb/tests/range.rs
+++ b/bindings/rust/foundationdb/tests/range.rs
@@ -332,6 +332,18 @@ async fn test_mapped_value() -> FdbResult<()> {
         .get_mapped_range(&range_option, &mapper, 1024, false)
         .await?;
 
+    // Neighboring records surround each interior child range, so a shifted
+    // selector would include the previous record and omit the last child key.
+    for mapped_key_value in &mapped_key_values {
+        let child_range = RangeOption::from((
+            mapped_key_value.begin_selector(),
+            mapped_key_value.end_selector(),
+        ));
+        let child_values = t.get_range(&child_range, 1, false).await?;
+        assert!(!child_values.more());
+        assert_eq!(child_values.as_ref(), mapped_key_value.key_values());
+    }
+
     verify_mapped_values(blue_counter, vec![mapped_key_values]);
 
     Ok(())
diff --git a/bindings/rust/foundationdb/tests/run_retry.rs b/bindings/rust/foundationdb/tests/run_retry.rs
index e6107dd646a..2424ab35ce2 100644
--- a/bindings/rust/foundationdb/tests/run_retry.rs
+++ b/bindings/rust/foundationdb/tests/run_retry.rs
@@ -177,7 +177,7 @@ async fn run_retry_decision_honors_retry_limit() {
         matches!(result, Err(RetryTestError::NeedsRetry)),
         "exhaustion must return the original typed error, got {result:?}"
     );
-    assert_eq!(attempt.load(Ordering::SeqCst) as i32, retry_limit + 1);
+    assert_eq!(attempt.load(Ordering::SeqCst) as i64, retry_limit + 1);
 }
 
 /// An error with no FdbError in its chain is fatal: the closure runs exactly
@@ -233,6 +233,71 @@ async fn run_reports_maybe_committed_from_the_closure_error() {
     );
 }
 
+/// A later `transaction_too_old` cannot resolve an earlier uncertain commit.
+#[tokio::test]
+async fn run_keeps_maybe_committed_after_later_closure_errors() {
+    let db = common::database().await.expect("failed to open database");
+    let attempt = AtomicU8::new(0);
+    let attempt_ref = &attempt;
+
+    let result: Result<(), RetryTestError> = db
+        .run(|trx, maybe_committed| async move {
+            let attempt = attempt_ref.fetch_add(1, Ordering::SeqCst);
+            assert_eq!(bool::from(maybe_committed), attempt != 0);
+            match attempt {
+                0 => Err(RetryTestError::from(FdbError::from_code(1021))),
+                1 => Err(RetryTestError::from(FdbError::from_code(1007))),
+                _ => {
+                    trx.set(b"run_retry_sticky_closure", b"ok");
+                    Ok(())
+                }
+            }
+        })
+        .await;
+
+    assert!(result.is_ok(), "both errors must be retried: {result:?}");
+    assert_eq!(attempt.load(Ordering::SeqCst), 3);
+}
+
+/// A commit conflict cannot resolve an earlier uncertain commit either.
+#[tokio::test]
+async fn run_keeps_maybe_committed_after_commit_conflicts() {
+    let db = common::database().await.expect("failed to open database");
+    let db_ref = &db;
+    let attempt = AtomicU8::new(0);
+    let attempt_ref = &attempt;
+    let key = b"run_retry_sticky_commit";
+
+    let result: Result<(), RetryTestError> = db
+        .run(|trx, maybe_committed| async move {
+            let attempt = attempt_ref.fetch_add(1, Ordering::SeqCst);
+            assert_eq!(bool::from(maybe_committed), attempt != 0);
+            if attempt == 0 {
+                return Err(RetryTestError::from(FdbError::from_code(1021)));
+            }
+            if attempt == 1 {
+                trx.get(key, false).await?;
+                // Commit a write after the outer transaction's read to force
+                // its commit, rather than its closure, to fail with a conflict.
+                db_ref
+                    .run(|other, _| async move {
+                        other.set(key, b"conflict");
+                        Ok::<_, FdbBindingError>(())
+                    })
+                    .await?;
+            }
+            trx.set(key, b"ok");
+            Ok(())
+        })
+        .await;
+
+    assert!(
+        result.is_ok(),
+        "the commit conflict must be retried: {result:?}"
+    );
+    assert_eq!(attempt.load(Ordering::SeqCst), 3);
+}
+
 /// A [`RetryPolicy`] rewriting the decision cannot clear `MaybeCommitted`: the
 /// flag is computed from the original error, before the policy is consulted.
 #[tokio::test]

From 17628c7f5fb2e6bb2039d876ffd10449b0e0ab3f Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Wed, 30 Sep 2026 19:12:30 -0700
Subject: [PATCH 04/11] Fix Rust future wakeups and simulator context lifetimes

---
 bindings/rust/CMakeLists.txt                  |  27 +-
 bindings/rust/CONTRIBUTING.md                 |   4 +
 bindings/rust/README.md                       |   7 +-
 bindings/rust/UPSTREAM.md                     |   7 +-
 .../src/lib.rs                                |  10 +-
 .../rust/foundationdb-simulation/README.md    |   9 +
 .../foundationdb-simulation/src/bindings.rs   | 332 ++++++++++++++++--
 .../rust/foundationdb-simulation/src/env.rs   |  60 +---
 .../rust/foundationdb-simulation/src/lib.rs   |  94 +++--
 .../src/registration.rs                       |  95 +++++
 bindings/rust/foundationdb/src/future.rs      | 165 ++++++++-
 bindings/rust/foundationdb/src/runner.rs      |   9 +-
 .../rust/foundationdb/tests/runner_hooks.rs   |  38 +-
 13 files changed, 711 insertions(+), 146 deletions(-)
 create mode 100644 bindings/rust/foundationdb-simulation/src/registration.rs

diff --git a/bindings/rust/CMakeLists.txt b/bindings/rust/CMakeLists.txt
index 21bf7ff67f6..4e93df15a5a 100644
--- a/bindings/rust/CMakeLists.txt
+++ b/bindings/rust/CMakeLists.txt
@@ -31,10 +31,11 @@ set(rust_env
 set(rust_profile $<IF:$<CONFIG:Debug>,debug,release>)
 # API 740 is the newest API supported by the imported Rust binding. Building
 # against current headers does not imply support for every current C API.
-set(rust_cargo_args
+set(rust_cargo_base_args
   --manifest-path ${CMAKE_CURRENT_SOURCE_DIR}/Cargo.toml
   --locked
-  --profile $<IF:$<CONFIG:Debug>,dev,release>
+  --profile $<IF:$<CONFIG:Debug>,dev,release>)
+set(rust_cargo_args ${rust_cargo_base_args}
   --features foundationdb/fdb-7_4,foundationdb-gen/fdb-7_4)
 
 # Cargo owns Rust dependency tracking, including changes to build-script inputs.
@@ -63,10 +64,13 @@ set(rust_unit_packages
   --package foundationdb
   --package foundationdb-tuple
   --package foundationdb-gen
-  --package foundationdb-macros)
+  --package foundationdb-macros
+  --package foundationdb-simulation)
+set(rust_unit_args ${rust_cargo_args}
+  --features foundationdb-simulation/fdb-7_4)
 add_custom_target(fdb_rust_tests ALL
   COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
-    ${CARGO_EXECUTABLE} test ${rust_cargo_args} ${rust_unit_packages} --lib --no-run
+    ${CARGO_EXECUTABLE} test ${rust_unit_args} ${rust_unit_packages} --lib --no-run
   DEPENDS fdb_rust
   WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
   COMMENT "Compile Rust library unit tests"
@@ -83,7 +87,7 @@ set(rust_test_env ${rust_env}
 
 add_test(NAME rust_unit_tests
   COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
-    ${CARGO_EXECUTABLE} test ${rust_cargo_args} ${rust_unit_packages} --lib --offline
+    ${CARGO_EXECUTABLE} test ${rust_unit_args} ${rust_unit_packages} --lib --offline
   WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
   COMMAND_EXPAND_LISTS)
 set_tests_properties(rust_unit_tests PROPERTIES TIMEOUT 300 LABELS "rust")
@@ -98,6 +102,19 @@ add_test(NAME rust_future_safety_tests
   COMMAND_EXPAND_LISTS)
 set_tests_properties(rust_future_safety_tests PROPERTIES TIMEOUT 300 LABELS "rust")
 
+foreach(symbol str_from_c WorkloadContext::new register_workload_context WrappedWorkload)
+  string(REPLACE "::" "_" test_suffix ${symbol})
+  add_test(NAME rust_simulation_${test_suffix}_safety_tests
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+      ${CARGO_EXECUTABLE} test ${rust_cargo_base_args}
+      --features foundationdb-simulation/fdb-7_4
+      --package foundationdb-simulation --doc --offline ${symbol}
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    COMMAND_EXPAND_LISTS)
+  set_tests_properties(rust_simulation_${test_suffix}_safety_tests PROPERTIES
+    TIMEOUT 300 LABELS "rust")
+endforeach()
+
 if(RUN_RUST_INTEGRATION_TESTS)
   add_custom_target(fdb_rust_integration_tests ALL
     COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
diff --git a/bindings/rust/CONTRIBUTING.md b/bindings/rust/CONTRIBUTING.md
index 79060118899..90294b650d9 100644
--- a/bindings/rust/CONTRIBUTING.md
+++ b/bindings/rust/CONTRIBUTING.md
@@ -55,6 +55,10 @@ cargo test-fdb-latest --locked
 Use the in-tree [binding tester instructions](foundationdb-bindingtester/README.md)
 for comparison with Python. Tuple tests and macro tests do not need a cluster.
 
+`rust_unit_tests` also checks simulation context lifetime and thread guards with
+fake callbacks; it does not start the simulator. Simulation workload execution
+is a separate check against a compatible server.
+
 The simulation crates and their scripts are retained for focused simulator work;
 their READMEs describe the workload ABI and required server versions. The original
 repository's scheduled correctness, simulation, release, and documentation jobs
diff --git a/bindings/rust/README.md b/bindings/rust/README.md
index 07350cc0c3c..b9f90ed312f 100644
--- a/bindings/rust/README.md
+++ b/bindings/rust/README.md
@@ -38,9 +38,10 @@ standalone Cargo development.
 
 ## Compatibility and current limits
 
-The migration preserves the upstream crate versions. Two API corrections are
-documented in [UPSTREAM.md](UPSTREAM.md): raw-future ownership requires `unsafe`,
-and integer options take `i64` to cover the C API's full range. Crate versions are
+The migration preserves the upstream crate versions. API corrections are
+documented in [UPSTREAM.md](UPSTREAM.md): raw-pointer ownership requires `unsafe`,
+integer options take `i64` to cover the C API's full range, and simulation workload
+wrappers enforce context lifetime and thread access. Crate versions are
 independent of the FoundationDB server release number. Published crates on
 crates.io are separate releases; importing the source does not publish or transfer
 ownership of them.
diff --git a/bindings/rust/UPSTREAM.md b/bindings/rust/UPSTREAM.md
index 20f7ce7bb9b..f95f38e0235 100644
--- a/bindings/rust/UPSTREAM.md
+++ b/bindings/rust/UPSTREAM.md
@@ -23,7 +23,7 @@ against older API versions. The in-tree CMake build uses the canonical Foundatio
 headers and option definitions instead. Preserve the historical snapshots when
 updating current options or formatting current FoundationDB C/C++ sources.
 
-The in-tree adaptation also corrects two public API contracts from this snapshot:
+The in-tree adaptation also corrects public API contracts from this snapshot:
 
 - `FdbFuture::new` is now unsafe because it takes unique ownership of a raw C
   future. Callers must establish pointer validity, ownership, and the result type
@@ -31,3 +31,8 @@ The in-tree adaptation also corrects two public API contracts from this snapshot
 - Integer option payloads use `i64`, matching the signed 64-bit values accepted by
   the C API. Callers with explicitly typed `i32` values must widen them with
   `i64::from(value)`; unsuffixed integer literals continue to infer the right type.
+- Raw simulation context and string constructors require `unsafe`. Workloads are
+  wrapped through `RustWorkload::wrap`; `WrappedWorkload` is opaque, and workload
+  callback tables are managed by the crate. Context clones and environments
+  panic before accessing C state if used from another thread or after their
+  workload is released.
diff --git a/bindings/rust/foundationdb-simulation-tracing/src/lib.rs b/bindings/rust/foundationdb-simulation-tracing/src/lib.rs
index 848c1a63421..fe9d0b6b14e 100644
--- a/bindings/rust/foundationdb-simulation-tracing/src/lib.rs
+++ b/bindings/rust/foundationdb-simulation-tracing/src/lib.rs
@@ -345,7 +345,15 @@ mod tests {
     /// A zeroed context is enough for guard tests: we only store it in the slot
     /// and drop it, never calling any method that would dereference a pointer.
     fn dummy_context() -> WorkloadContext {
-        WorkloadContext::new(unsafe { std::mem::zeroed::<FDBWorkloadContext>() })
+        // SAFETY: These guard tests only construct, clone, and drop the context;
+        // they never emit trace events or perform native context operations.
+        unsafe {
+            WorkloadContext::new(FDBWorkloadContext {
+                api_version: 1,
+                inner: std::ptr::null_mut(),
+                vt: std::ptr::null_mut(),
+            })
+        }
     }
 
     fn slot_generation() -> Option<u64> {
diff --git a/bindings/rust/foundationdb-simulation/README.md b/bindings/rust/foundationdb-simulation/README.md
index d58202e9814..73d0a6b384f 100644
--- a/bindings/rust/foundationdb-simulation/README.md
+++ b/bindings/rust/foundationdb-simulation/README.md
@@ -158,6 +158,15 @@ See the `atomic` and `noop` implementations in the `examples/` directory for com
 ## The WorkloadContext
 
 The `WorkloadContext` passed at instantiation is the primary way to interact with the simulator.
+Contexts and environments created from them may be cloned, but their operations
+must run on the simulator thread that created the workload. Calls from another
+thread or after the registered workload is released panic before accessing the
+native context. Keeping a clone does not extend the native workload's lifetime.
+
+Raw context and string conversion entry points are unsafe. `WrappedWorkload` is
+an opaque owned value; factories create it with `RustWorkload::wrap()` rather
+than constructing a raw C workload or overriding its callback table.
+
 It provides several useful methods:
 
 - `trace(severity, name, details)`: Add a log entry to the FDB trace files.
diff --git a/bindings/rust/foundationdb-simulation/src/bindings.rs b/bindings/rust/foundationdb-simulation/src/bindings.rs
index 036194dcaa1..473d84cbe7b 100644
--- a/bindings/rust/foundationdb-simulation/src/bindings.rs
+++ b/bindings/rust/foundationdb-simulation/src/bindings.rs
@@ -6,6 +6,11 @@
 use std::{
     ffi::{self, c_char},
     str::FromStr,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    thread::{self, ThreadId},
     time::Duration,
 };
 
@@ -35,8 +40,13 @@ pub const FDB_WORKLOAD_API_VERSION: i32 = raw_bindings::FDB_WORKLOAD_API_VERSION
 // String conversions
 
 #[doc(hidden)]
-#[allow(clippy::not_unsafe_ptr_arg_deref)]
-pub fn str_from_c(c_buf: *const c_char) -> String {
+/// # Safety
+/// `c_buf` must point to a readable, NUL-terminated string for this call.
+///
+/// ```compile_fail,E0133
+/// foundationdb_simulation::internals::str_from_c(std::ptr::null());
+/// ```
+pub unsafe fn str_from_c(c_buf: *const c_char) -> String {
     let c_str = unsafe { ffi::CStr::from_ptr(c_buf) };
     c_str.to_str().unwrap().to_string()
 }
@@ -96,8 +106,34 @@ macro_rules! details {
 // -----------------------------------------------------------------------------
 // Rust Types
 
-/// Wrapper around the C FDBWorkloadContext
-pub struct WorkloadContext(FDBWorkloadContext);
+/// A simulator context shared by one workload and its environment handles.
+///
+/// Context operations panic outside the creating thread or after the registered
+/// workload is released. Cloning the context does not extend the native lifetime.
+#[derive(Clone)]
+pub struct WorkloadContext(Arc<ContextState>);
+
+struct ContextState {
+    raw: FDBWorkloadContext,
+    owner: ThreadId,
+    active: AtomicBool,
+}
+
+// SAFETY: Raw context access is private and always checks the owning thread and
+// lifetime first. No other thread can call the native vtable or invalidate the
+// context, and dropping the state does not dereference its raw pointers.
+unsafe impl Send for ContextState {}
+// SAFETY: The same owner-thread check prevents concurrent native access.
+unsafe impl Sync for ContextState {}
+
+pub(crate) struct ContextOwner(pub(crate) WorkloadContext);
+
+impl Drop for ContextOwner {
+    fn drop(&mut self) {
+        self.0.assert_owner();
+        self.0.0.active.store(false, Ordering::Release);
+    }
+}
 /// Wrapper around the C FDBPromise
 pub struct Promise(FDBPromise);
 /// Wrapper around the C FDBMetrics
@@ -140,21 +176,13 @@ pub enum Severity {
 
 macro_rules! with {
     ($this:expr_2021=>$method:ident($($args:expr_2021),* $(,)?)) => {
-        unsafe { (*$this.vt).$method.unwrap_unchecked()($this.inner $(, $args)*) }
+        {
+            let raw = $this;
+            unsafe { (*raw.vt).$method.unwrap_unchecked()(raw.inner $(, $args)*) }
+        }
     };
 }
 
-impl Clone for WorkloadContext {
-    /// Clones the wrapper by copying the underlying `FDBWorkloadContext` POD (a
-    /// bundle of raw pointers owned by fdbserver, with no `Drop`). The clone
-    /// aliases the same fdbserver-owned context, so it is only valid for the
-    /// lifetime of the workload instance the original was handed to; once
-    /// fdbserver frees that context, every clone dangles.
-    fn clone(&self) -> Self {
-        Self(self.0)
-    }
-}
-
 /// Detail key automatically appended to `Severity::Error` trace events.
 const RUST_FAILURE_KEY: &str = "RustFailure";
 /// Detail key automatically appended to every trace event, regardless of severity.
@@ -203,13 +231,50 @@ where
 
 impl WorkloadContext {
     #[doc(hidden)]
-    pub fn new(raw: FDBWorkloadContext) -> Self {
-        Self(raw)
+    /// # Safety
+    /// Every operation on this context or its clones requires `raw` to identify
+    /// a live native context with a complete vtable owned by the creating thread.
+    /// The caller must uphold that lifetime for all handles. Construction,
+    /// cloning, and dropping do not access the native pointers. Registration
+    /// hooks invalidate all clones before the native context is destroyed.
+    ///
+    /// ```compile_fail,E0133
+    /// use foundationdb_simulation::{WorkloadContext, internals::FDBWorkloadContext};
+    /// let raw = FDBWorkloadContext {
+    ///     api_version: 1,
+    ///     inner: std::ptr::null_mut(),
+    ///     vt: std::ptr::null_mut(),
+    /// };
+    /// WorkloadContext::new(raw);
+    /// ```
+    pub unsafe fn new(raw: FDBWorkloadContext) -> Self {
+        Self(Arc::new(ContextState {
+            raw,
+            owner: thread::current().id(),
+            active: AtomicBool::new(true),
+        }))
+    }
+
+    fn assert_owner(&self) {
+        assert_eq!(
+            self.0.owner,
+            thread::current().id(),
+            "simulation context accessed outside its owning thread"
+        );
+    }
+
+    fn raw(&self) -> FDBWorkloadContext {
+        self.assert_owner();
+        assert!(
+            self.0.active.load(Ordering::Acquire),
+            "simulation context accessed after workload release"
+        );
+        self.0.raw
     }
 
     /// Get the server FDB_WORKLOAD_API_VERSION
     pub fn get_workload_api_version(&self) -> i32 {
-        self.0.api_version
+        self.raw().api_version
     }
 
     /// Add a log entry in the FoundationDB logs.
@@ -236,7 +301,7 @@ impl WorkloadContext {
             })
             .collect::<Vec<_>>();
         with! {
-            self.0 => trace(
+            self.raw() => trace(
                 severity as FDBSeverity,
                 name.as_ptr(),
                 details.as_ptr(),
@@ -246,19 +311,19 @@ impl WorkloadContext {
     }
     /// Get the process id of the workload
     pub fn get_process_id(&self) -> u64 {
-        with! { self.0 => getProcessID() }
+        with! { self.raw() => getProcessID() }
     }
     /// Set the process id of the workload
     pub fn set_process_id(&self, id: u64) {
-        with! { self.0 => setProcessID(id) }
+        with! { self.raw() => setProcessID(id) }
     }
     /// Get the current simulated time in seconds (starts at zero)
     pub fn now(&self) -> f64 {
-        with! { self.0 => now() }
+        with! { self.raw() => now() }
     }
     /// Get a determinist 32-bit random number
     pub fn rnd(&self) -> u32 {
-        with! { self.0 => rnd() }
+        with! { self.raw() => rnd() }
     }
     /// Get the value of a parameter from the simulation config file
     ///
@@ -275,30 +340,31 @@ impl WorkloadContext {
         let name = str_for_c(name);
         let default_value = str_for_c(null);
         let raw_value = with! {
-            self.0 => getOption(name.as_ptr(), default_value.as_ptr())
+            self.raw() => getOption(name.as_ptr(), default_value.as_ptr())
         };
-        let value = str_from_c(raw_value.inner);
+        // SAFETY: getOption returns an owned, NUL-terminated string.
+        let value = unsafe { str_from_c(raw_value.inner) };
         with! { raw_value => free() };
         if value == null { None } else { Some(value) }
     }
     /// Get the client id of the workload
     pub fn client_id(&self) -> i32 {
-        with! { self.0 => clientId() }
+        with! { self.raw() => clientId() }
     }
     /// Get the client id of the workload
     pub fn client_count(&self) -> i32 {
-        with! { self.0 => clientCount() }
+        with! { self.raw() => clientCount() }
     }
     /// Get a determinist 64-bit random number
     pub fn shared_random_number(&self) -> i64 {
-        with! { self.0 => sharedRandomNumber() }
+        with! { self.raw() => sharedRandomNumber() }
     }
     /// Return a future that will be ready after a given (simulated) duration
     pub fn delay(
         &self,
         duration: Duration,
     ) -> impl std::future::Future<Output = fdb::FdbResult<()>> + Send + Sync + 'static + use<> {
-        let f = with! { self.0 => delay(duration.as_secs_f64()) };
+        let f = with! { self.raw() => delay(duration.as_secs_f64()) };
         // SAFETY: delay returns a new, owned C future with no result value.
         unsafe { fdb::future::FdbFuture::new(f as *mut _) }
     }
@@ -388,6 +454,212 @@ impl<'a> Metric<'a> {
 mod tests {
     use super::{Severity, capitalize_first_byte, prepare_trace_details, str_for_c};
 
+    use std::cell::Cell;
+    use std::panic::{AssertUnwindSafe, catch_unwind};
+    use std::sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    };
+    use std::time::Duration;
+
+    use super::WorkloadContext;
+    use super::raw_bindings::*;
+    use crate::registration::register_workload_context;
+    use crate::{Metrics, RustWorkload, SimDatabase};
+
+    struct NativeContext {
+        calls: Arc<AtomicUsize>,
+        next_random: Cell<u32>,
+    }
+
+    unsafe extern "C" fn now(raw: *mut OpaqueWorkloadContext) -> f64 {
+        // SAFETY: The test keeps NativeContext alive until workload release.
+        let context = unsafe { &*(raw as *const NativeContext) };
+        context.calls.fetch_add(1, Ordering::Relaxed);
+        12.0
+    }
+
+    unsafe extern "C" fn rnd(raw: *mut OpaqueWorkloadContext) -> u32 {
+        // SAFETY: The test keeps NativeContext alive until workload release.
+        let context = unsafe { &*(raw as *const NativeContext) };
+        context.calls.fetch_add(1, Ordering::Relaxed);
+        let value = context.next_random.get();
+        context.next_random.set(value + 1);
+        value
+    }
+
+    // The unused callbacks are still present so the fake has a complete vtable.
+    unsafe extern "C" fn trace(
+        _: *mut OpaqueWorkloadContext,
+        _: FDBSeverity,
+        _: *const std::ffi::c_char,
+        _: *const FDBStringPair,
+        _: i32,
+    ) {
+    }
+    unsafe extern "C" fn get_process_id(_: *mut OpaqueWorkloadContext) -> u64 {
+        0
+    }
+    unsafe extern "C" fn set_process_id(_: *mut OpaqueWorkloadContext, _: u64) {}
+    unsafe extern "C" fn free_string(_: *const std::ffi::c_char) {}
+    unsafe extern "C" fn get_option(
+        _: *mut OpaqueWorkloadContext,
+        _: *const std::ffi::c_char,
+        default: *const std::ffi::c_char,
+    ) -> FDBString {
+        FDBString {
+            inner: default,
+            vt: &FDBString_FDBString_VT {
+                free: Some(free_string),
+            } as *const _ as *mut _,
+        }
+    }
+    unsafe extern "C" fn client_id(_: *mut OpaqueWorkloadContext) -> i32 {
+        0
+    }
+    unsafe extern "C" fn client_count(_: *mut OpaqueWorkloadContext) -> i32 {
+        1
+    }
+    unsafe extern "C" fn shared_random_number(_: *mut OpaqueWorkloadContext) -> i64 {
+        42
+    }
+    unsafe extern "C" fn delay(_: *mut OpaqueWorkloadContext, _: f64) -> *mut FDBFuture {
+        unreachable!("test does not schedule delays")
+    }
+
+    const CONTEXT_VT: FDBWorkloadContext_FDBWorkloadContext_VT =
+        FDBWorkloadContext_FDBWorkloadContext_VT {
+            trace: Some(trace),
+            getProcessID: Some(get_process_id),
+            setProcessID: Some(set_process_id),
+            now: Some(now),
+            rnd: Some(rnd),
+            getOption: Some(get_option),
+            clientId: Some(client_id),
+            clientCount: Some(client_count),
+            sharedRandomNumber: Some(shared_random_number),
+            delay: Some(delay),
+        };
+
+    fn native_context(calls: Arc<AtomicUsize>) -> (Box<NativeContext>, FDBWorkloadContext) {
+        let mut native = Box::new(NativeContext {
+            calls,
+            next_random: Cell::new(42),
+        });
+        let raw = FDBWorkloadContext {
+            api_version: super::FDB_WORKLOAD_API_VERSION,
+            inner: &mut *native as *mut NativeContext as *mut _,
+            vt: &CONTEXT_VT as *const _ as *mut _,
+        };
+        (native, raw)
+    }
+
+    struct TestWorkload(Option<WorkloadContext>);
+
+    impl RustWorkload for TestWorkload {
+        async fn setup(&mut self, _: SimDatabase) {}
+        async fn start(&mut self, _: SimDatabase) {}
+        async fn check(&mut self, _: SimDatabase) {}
+        fn get_metrics(&self, _: Metrics) {}
+        fn get_check_timeout(&self) -> f64 {
+            7.0
+        }
+    }
+
+    impl Drop for TestWorkload {
+        fn drop(&mut self) {
+            if let Some(context) = &self.0 {
+                assert_eq!(context.now(), 12.0);
+            }
+        }
+    }
+
+    #[test]
+    fn environment_rejects_access_after_registered_workload_release() {
+        let calls = Arc::new(AtomicUsize::new(0));
+        let (native, raw) = native_context(calls.clone());
+        let mut escaped = None;
+        // SAFETY: Native context stays alive through the same-thread free call.
+        let workload = unsafe {
+            register_workload_context(raw, |context| {
+                escaped = Some(context.clone());
+                TestWorkload(Some(context)).wrap()
+            })
+        };
+        let context = escaped.unwrap();
+        let environment = context.environment();
+        assert_eq!(environment.clock().monotonic(), Duration::from_secs(12));
+        assert_eq!(environment.rng().next_u32(), 42);
+        // SAFETY: These are the callbacks on the registered, live allocation.
+        unsafe {
+            assert_eq!((*workload.vt).getCheckTimeout.unwrap()(workload.inner), 7.0);
+            (*workload.vt).free.unwrap()(workload.inner);
+        }
+        assert_eq!(
+            calls.load(Ordering::Relaxed),
+            3,
+            "destructor retains live context"
+        );
+        drop(native);
+        assert!(catch_unwind(AssertUnwindSafe(|| context.now())).is_err());
+        assert!(catch_unwind(AssertUnwindSafe(|| environment.clock().wall())).is_err());
+        assert!(catch_unwind(AssertUnwindSafe(|| environment.rng().next_u64())).is_err());
+        assert_eq!(
+            calls.load(Ordering::Relaxed),
+            3,
+            "rejected access never enters native context"
+        );
+    }
+
+    #[test]
+    fn environment_rejects_other_threads_without_consuming_randomness() {
+        let calls = Arc::new(AtomicUsize::new(0));
+        let (_native, raw) = native_context(calls.clone());
+        let mut escaped = None;
+        // SAFETY: Native context stays alive through the same-thread free call.
+        let workload = unsafe {
+            register_workload_context(raw, |context| {
+                escaped = Some(context.environment());
+                TestWorkload(None).wrap()
+            })
+        };
+        let environment = escaped.unwrap();
+        let other_thread = environment.clone();
+        std::thread::spawn(move || {
+            assert!(catch_unwind(AssertUnwindSafe(|| other_thread.clock().monotonic())).is_err());
+            assert!(catch_unwind(AssertUnwindSafe(|| other_thread.rng().next_u32())).is_err());
+        })
+        .join()
+        .unwrap();
+        assert_eq!(calls.load(Ordering::Relaxed), 0);
+        assert_eq!(environment.rng().next_u64(), (42_u64 << 32) | 43);
+        assert_eq!(calls.load(Ordering::Relaxed), 2);
+        // SAFETY: This is the unique release of the registered allocation.
+        unsafe { (*workload.vt).free.unwrap()(workload.inner) };
+        assert!(catch_unwind(AssertUnwindSafe(|| environment.rng().next_u32())).is_err());
+        assert_eq!(calls.load(Ordering::Relaxed), 2);
+    }
+
+    #[test]
+    fn factory_unwind_invalidates_escaped_context() {
+        let calls = Arc::new(AtomicUsize::new(0));
+        let (native, raw) = native_context(calls.clone());
+        let mut escaped = None;
+        assert!(
+            catch_unwind(AssertUnwindSafe(|| unsafe {
+                // SAFETY: The native context outlives registration, which unwinds.
+                register_workload_context(raw, |context| {
+                    escaped = Some(context.environment());
+                    panic!("factory failed");
+                })
+            }))
+            .is_err()
+        );
+        drop(native);
+        assert!(catch_unwind(AssertUnwindSafe(|| escaped.unwrap().rng().next_u32())).is_err());
+        assert_eq!(calls.load(Ordering::Relaxed), 0);
+    }
+
     #[test]
     fn str_for_c_escapes_interior_nul() {
         assert_eq!(str_for_c("a\0b").to_bytes(), br"a\0b");
diff --git a/bindings/rust/foundationdb-simulation/src/env.rs b/bindings/rust/foundationdb-simulation/src/env.rs
index 9f5d448432c..9055fcf02d1 100644
--- a/bindings/rust/foundationdb-simulation/src/env.rs
+++ b/bindings/rust/foundationdb-simulation/src/env.rs
@@ -20,13 +20,12 @@
 //! }
 //! ```
 //!
-//! # Lifetime
+//! # Lifetime and threads
 //!
-//! Every type here holds a copy of the fdbserver-owned context, with the same
-//! caveat as [`WorkloadContext::clone`]: the copy aliases a context that
-//! fdbserver frees with the workload instance. Keep a [`SimClock`], a
-//! [`SimRng`], or an [`Environment`] holding them no longer than the workload
-//! that produced it. Using one afterwards dereferences a dangling pointer.
+//! Handles share the workload's guarded context. Calls panic if the workload has
+//! been released or if they run outside the simulator thread that created it.
+//! An [`Environment`] may be cloned or moved, but accessing its clock or RNG on
+//! another thread is rejected before entering fdbserver.
 
 use std::fmt;
 use std::sync::Arc;
@@ -36,19 +35,6 @@ use foundationdb::env::{Clock, Environment, Rng};
 
 use crate::bindings::WorkloadContext;
 
-/// A copy of the fdbserver-owned workload context.
-///
-/// The wrapped [`WorkloadContext`] is a bundle of raw pointers with no `Drop`,
-/// so copying it is free and dropping it does nothing. See the
-/// [module documentation](self) for how long the copy stays valid.
-struct ContextHandle(WorkloadContext);
-
-impl ContextHandle {
-    fn new(context: &WorkloadContext) -> Self {
-        Self(context.clone())
-    }
-}
-
 /// The [`Clock`] of a simulated workload, reading fdbserver's simulated time.
 ///
 /// [`monotonic`](Clock::monotonic) is the simulated clock, which starts at zero
@@ -61,22 +47,14 @@ impl ContextHandle {
 ///
 /// See the [module documentation](self) for how long an instance stays valid.
 pub struct SimClock {
-    context: ContextHandle,
+    context: WorkloadContext,
 }
 
-// SAFETY: the wrapped context is a bundle of raw pointers into fdbserver, which
-// drives every workload callback on a single thread, so the context is never
-// accessed concurrently. This is the same justification as the rest of the
-// crate's use of the raw context, see `Clone for WorkloadContext`.
-unsafe impl Send for SimClock {}
-// SAFETY: see the `Send` impl above.
-unsafe impl Sync for SimClock {}
-
 impl SimClock {
     /// Reads simulated time from `context`.
     pub fn new(context: &WorkloadContext) -> Self {
         Self {
-            context: ContextHandle::new(context),
+            context: context.clone(),
         }
     }
 }
@@ -91,7 +69,7 @@ impl Clock for SimClock {
     fn monotonic(&self) -> Duration {
         // The simulated clock starts at zero and never goes backwards, but it is
         // an f64 crossing the FFI boundary: clamp rather than panic.
-        Duration::from_secs_f64(self.context.0.now().max(0.0))
+        Duration::from_secs_f64(self.context.now().max(0.0))
     }
 
     /// Simulated wall time counts from the UNIX epoch at simulation start, so
@@ -116,22 +94,14 @@ impl Clock for SimClock {
 ///
 /// See the [module documentation](self) for how long an instance stays valid.
 pub struct SimRng {
-    context: ContextHandle,
+    context: WorkloadContext,
 }
 
-// SAFETY: the wrapped context is a bundle of raw pointers into fdbserver, which
-// drives every workload callback on a single thread, so the context is never
-// accessed concurrently. This is the same justification as the rest of the
-// crate's use of the raw context, see `Clone for WorkloadContext`.
-unsafe impl Send for SimRng {}
-// SAFETY: see the `Send` impl above.
-unsafe impl Sync for SimRng {}
-
 impl SimRng {
     /// Draws from the deterministic generator of `context`.
     pub fn new(context: &WorkloadContext) -> Self {
         Self {
-            context: ContextHandle::new(context),
+            context: context.clone(),
         }
     }
 }
@@ -146,14 +116,14 @@ impl Rng for SimRng {
     /// Composes two 32-bit draws, so one call consumes two values of the
     /// simulator's sequence.
     fn next_u64(&self) -> u64 {
-        let high = self.context.0.rnd();
-        let low = self.context.0.rnd();
+        let high = self.context.rnd();
+        let low = self.context.rnd();
         (u64::from(high) << 32) | u64::from(low)
     }
 
     /// One draw of the simulator's sequence, taken directly from the generator.
     fn next_u32(&self) -> u32 {
-        self.context.0.rnd()
+        self.context.rnd()
     }
 }
 
@@ -164,8 +134,8 @@ impl WorkloadContext {
     /// Pass it to the layers and recipes the workload exercises so that they
     /// read time and randomness from the simulator instead of from the machine.
     ///
-    /// The result borrows nothing, but it holds a copy of this context: see the
-    /// [module documentation](self) for how long it stays valid.
+    /// Calls on the resulting clock and RNG panic after this workload is
+    /// released or outside its simulator thread.
     pub fn environment(&self) -> Environment {
         Environment::new(Arc::new(SimClock::new(self)), Arc::new(SimRng::new(self)))
     }
diff --git a/bindings/rust/foundationdb-simulation/src/lib.rs b/bindings/rust/foundationdb-simulation/src/lib.rs
index 1c5e1c74fc7..7995d849282 100644
--- a/bindings/rust/foundationdb-simulation/src/lib.rs
+++ b/bindings/rust/foundationdb-simulation/src/lib.rs
@@ -9,6 +9,7 @@ use foundationdb_sys::FDBDatabase as FDBDatabaseAlias;
 mod bindings;
 pub mod env;
 mod fdb_rt;
+mod registration;
 
 use bindings::{
     FDB_WORKLOAD_API_VERSION, FDBDatabase, FDBMetrics, FDBPromise, FDBWorkload, FDBWorkload_VT,
@@ -23,8 +24,29 @@ use fdb_rt::fdb_spawn;
 
 /// Rust representation of a simulated FoundationDB database
 pub type SimDatabase = Arc<Database>;
-/// Rust representation of a FoundationDB workload
-pub type WrappedWorkload = FDBWorkload;
+/// An owned FoundationDB workload created by [`RustWorkload::wrap`].
+///
+/// The native pointer and callback table are private so safe factories cannot
+/// return an invalid workload.
+///
+/// ```compile_fail,E0308
+/// use foundationdb_simulation::{WrappedWorkload, internals::FDBWorkload};
+/// let raw = FDBWorkload {
+///     api_version: 1,
+///     inner: std::ptr::null_mut(),
+///     vt: std::ptr::null_mut(),
+/// };
+/// let _: WrappedWorkload = raw;
+/// ```
+pub struct WrappedWorkload(FDBWorkload);
+
+impl Drop for WrappedWorkload {
+    fn drop(&mut self) {
+        // SAFETY: Only RustWorkload::wrap constructs this owned allocation and
+        // its matching vtable, and registration transfers rather than copies it.
+        unsafe { (*self.0.vt).free.unwrap()(self.0.inner) };
+    }
+}
 
 /// Equivalent to the C++ abstract class `FDBWorkload`
 #[allow(async_fn_in_trait)]
@@ -63,27 +85,30 @@ pub trait RustWorkload: Sized + 'static {
     /// Set the check timeout in simulated seconds for this workload.
     fn get_check_timeout(&self) -> f64;
 
-    /// Virtual Table used by the C API
-    const VT: FDBWorkload_VT = FDBWorkload_VT {
-        setup: Some(workload_setup::<Self>),
-        start: Some(workload_start::<Self>),
-        check: Some(workload_check::<Self>),
-        getMetrics: Some(workload_get_metrics::<Self>),
-        getCheckTimeout: Some(workload_get_check_timeout::<Self>),
-        free: Some(workload_drop::<Self>),
-    };
-
     /// Wrap the underlying Rust type so it can be passed to the C API
     fn wrap(self) -> WrappedWorkload {
         let inner = Box::into_raw(Box::new(self));
-        WrappedWorkload {
+        WrappedWorkload(FDBWorkload {
             api_version: FDB_WORKLOAD_API_VERSION,
             inner: inner as *mut _,
-            vt: &Self::VT as *const _ as *mut _,
-        }
+            vt: &WorkloadVtable::<Self>::VT as *const _ as *mut _,
+        })
     }
 }
 
+struct WorkloadVtable<W>(std::marker::PhantomData<W>);
+
+impl<W: RustWorkload> WorkloadVtable<W> {
+    const VT: FDBWorkload_VT = FDBWorkload_VT {
+        setup: Some(workload_setup::<W>),
+        start: Some(workload_start::<W>),
+        check: Some(workload_check::<W>),
+        getMetrics: Some(workload_get_metrics::<W>),
+        getCheckTimeout: Some(workload_get_check_timeout::<W>),
+        free: Some(workload_drop::<W>),
+    };
+}
+
 /// Equivalent to the C++ abstract class `FDBWorkloadFactory`
 pub trait RustWorkloadFactory {
     /// The runtime FDB_API_VERSION to use
@@ -220,8 +245,9 @@ unsafe extern "C" fn workload_drop<W: RustWorkload>(raw_workload: *mut OpaqueWor
 #[doc(hidden)]
 /// Primitives exposed for the registrations hooks, should not be used otherwise
 pub mod internals {
-    pub use crate::bindings::{FDBWorkloadContext, str_from_c};
+    pub use crate::bindings::{FDBWorkload, FDBWorkloadContext, str_from_c};
     pub use crate::fdb_rt::poll_pending_tasks;
+    pub use crate::registration::register_workload_context;
 
     #[cfg(feature = "cpp-abi")]
     unsafe extern "C" {
@@ -247,10 +273,10 @@ pub mod internals {
 macro_rules! register_factory {
     ($name:ident) => {
         #[unsafe(no_mangle)]
-        extern "C" fn workloadCFactory(
+        unsafe extern "C" fn workloadCFactory(
             raw_name: *const std::ffi::c_char,
             raw_context: $crate::internals::FDBWorkloadContext,
-        ) -> $crate::WrappedWorkload {
+        ) -> $crate::internals::FDBWorkload {
             use std::sync::atomic::{AtomicBool, Ordering};
             static DONE: AtomicBool = AtomicBool::new(false);
             if DONE
@@ -266,12 +292,17 @@ macro_rules! register_factory {
                     .set($crate::internals::poll_pending_tasks)
                     .unwrap();
             }
-            let name = $crate::internals::str_from_c(raw_name);
-            let context = $crate::WorkloadContext::new(raw_context);
-            <$name as $crate::RustWorkloadFactory>::create(name, context)
+            // SAFETY: The simulator supplies a live string and context, invokes
+            // callbacks on this thread, and releases the workload before context.
+            unsafe {
+                let name = $crate::internals::str_from_c(raw_name);
+                $crate::internals::register_workload_context(raw_context, |context| {
+                    <$name as $crate::RustWorkloadFactory>::create(name, context)
+                })
+            }
         }
         #[unsafe(no_mangle)]
-        extern "C" fn workloadFactory(logger: *const u8) -> *const u8 {
+        unsafe extern "C" fn workloadFactory(logger: *const u8) -> *const u8 {
             unsafe { $crate::internals::workloadCppFactory(logger) }
         }
     };
@@ -283,10 +314,10 @@ macro_rules! register_factory {
 macro_rules! register_workload {
     ($name:ident) => {
         #[unsafe(no_mangle)]
-        extern "C" fn workloadCFactory(
+        unsafe extern "C" fn workloadCFactory(
             raw_name: *const std::ffi::c_char,
             raw_context: $crate::internals::FDBWorkloadContext,
-        ) -> $crate::WrappedWorkload {
+        ) -> $crate::internals::FDBWorkload {
             use std::sync::atomic::{AtomicBool, Ordering};
             static DONE: AtomicBool = AtomicBool::new(false);
             if DONE
@@ -302,12 +333,19 @@ macro_rules! register_workload {
                     .set($crate::internals::poll_pending_tasks)
                     .unwrap();
             }
-            let name = $crate::internals::str_from_c(raw_name);
-            let context = $crate::WorkloadContext::new(raw_context);
-            $crate::RustWorkload::wrap(<$name as $crate::SingleRustWorkload>::new(name, context))
+            // SAFETY: The simulator supplies a live string and context, invokes
+            // callbacks on this thread, and releases the workload before context.
+            unsafe {
+                let name = $crate::internals::str_from_c(raw_name);
+                $crate::internals::register_workload_context(raw_context, |context| {
+                    $crate::RustWorkload::wrap(<$name as $crate::SingleRustWorkload>::new(
+                        name, context,
+                    ))
+                })
+            }
         }
         #[unsafe(no_mangle)]
-        extern "C" fn workloadFactory(logger: *const u8) -> *const u8 {
+        unsafe extern "C" fn workloadFactory(logger: *const u8) -> *const u8 {
             unsafe { $crate::internals::workloadCppFactory(logger) }
         }
     };
diff --git a/bindings/rust/foundationdb-simulation/src/registration.rs b/bindings/rust/foundationdb-simulation/src/registration.rs
new file mode 100644
index 00000000000..4655adf0155
--- /dev/null
+++ b/bindings/rust/foundationdb-simulation/src/registration.rs
@@ -0,0 +1,95 @@
+//! Owns the lifetime shared by a registered workload and its context handles.
+
+use crate::bindings::{
+    ContextOwner, FDB_WORKLOAD_API_VERSION, FDBDatabase, FDBMetrics, FDBPromise, FDBWorkload,
+    FDBWorkload_VT, FDBWorkloadContext, OpaqueWorkload,
+};
+use crate::{WorkloadContext, WrappedWorkload};
+
+struct RegisteredWorkload {
+    // Field order keeps the context live through the user's workload destructor.
+    workload: WrappedWorkload,
+    _context: ContextOwner,
+}
+
+/// Registers a workload and invalidates its context when the simulator releases it.
+///
+/// # Safety
+/// `raw_context` must be a valid context on its owning simulator thread, with a
+/// complete vtable. The simulator must keep it alive until it calls the returned
+/// workload's `free` callback. All callbacks must run on that same thread, follow
+/// the workload ABI contracts, and `free` must be called at most once.
+///
+/// ```compile_fail,E0133
+/// use foundationdb_simulation::internals::{FDBWorkloadContext, register_workload_context};
+/// let raw = FDBWorkloadContext {
+///     api_version: 1,
+///     inner: std::ptr::null_mut(),
+///     vt: std::ptr::null_mut(),
+/// };
+/// register_workload_context(raw, |_| unreachable!());
+/// ```
+#[doc(hidden)]
+pub unsafe fn register_workload_context(
+    raw_context: FDBWorkloadContext,
+    create: impl FnOnce(WorkloadContext) -> WrappedWorkload,
+) -> FDBWorkload {
+    // SAFETY: This function's caller supplies the native lifetime; ContextOwner
+    // revokes every clone when this lifetime ends, including factory unwinding.
+    let context = ContextOwner(unsafe { WorkloadContext::new(raw_context) });
+    let workload = create(context.0.clone());
+    FDBWorkload {
+        api_version: FDB_WORKLOAD_API_VERSION,
+        inner: Box::into_raw(Box::new(RegisteredWorkload {
+            workload,
+            _context: context,
+        })) as *mut _,
+        vt: &VT as *const _ as *mut _,
+    }
+}
+
+const VT: FDBWorkload_VT = FDBWorkload_VT {
+    setup: Some(setup),
+    start: Some(start),
+    check: Some(check),
+    getMetrics: Some(get_metrics),
+    getCheckTimeout: Some(get_check_timeout),
+    free: Some(free),
+};
+
+macro_rules! forward {
+    ($raw:ident, $method:ident $(, $arg:ident)*) => {{
+        // SAFETY: The simulator returns the registered allocation to its matching
+        // callback with arguments satisfying the external-workload ABI.
+        unsafe {
+            let registered = &*($raw as *const RegisteredWorkload);
+            let workload = &registered.workload.0;
+            (*workload.vt).$method.unwrap()(workload.inner $(, $arg)*)
+        }
+    }};
+}
+
+unsafe extern "C" fn setup(raw: *mut OpaqueWorkload, db: *mut FDBDatabase, done: FDBPromise) {
+    forward!(raw, setup, db, done);
+}
+
+unsafe extern "C" fn start(raw: *mut OpaqueWorkload, db: *mut FDBDatabase, done: FDBPromise) {
+    forward!(raw, start, db, done);
+}
+
+unsafe extern "C" fn check(raw: *mut OpaqueWorkload, db: *mut FDBDatabase, done: FDBPromise) {
+    forward!(raw, check, db, done);
+}
+
+unsafe extern "C" fn get_metrics(raw: *mut OpaqueWorkload, out: FDBMetrics) {
+    forward!(raw, getMetrics, out);
+}
+
+unsafe extern "C" fn get_check_timeout(raw: *mut OpaqueWorkload) -> f64 {
+    forward!(raw, getCheckTimeout)
+}
+
+unsafe extern "C" fn free(raw: *mut OpaqueWorkload) {
+    // SAFETY: The simulator releases this registered allocation exactly once.
+    unsafe { drop(Box::from_raw(raw as *mut RegisteredWorkload)) };
+}
diff --git a/bindings/rust/foundationdb/src/future.rs b/bindings/rust/foundationdb/src/future.rs
index b7c6c994fa9..93576153d6d 100644
--- a/bindings/rust/foundationdb/src/future.rs
+++ b/bindings/rust/foundationdb/src/future.rs
@@ -114,18 +114,12 @@ where
         tracing::instrument(level = "debug", skip(self, cx))
     )]
     fn poll(mut self: Pin<&mut Self>, cx: &mut Context) -> Poll<FdbResult<T>> {
-        let f = self.f.as_ref().expect("cannot poll after resolve");
-        let ready = unsafe { fdb_sys::fdb_future_is_ready(f.as_ptr()) };
-        if ready == 0 {
-            let f_ptr = f.as_ptr();
-            let mut register = false;
-            let waker = self.waker.get_or_insert_with(|| {
-                register = true;
-                Arc::new(AtomicWaker::new())
-            });
-            waker.register(cx.waker());
-            if register {
-                let network_waker: Arc<AtomicWaker> = waker.clone();
+        let f_ptr = self.f.as_ref().expect("cannot poll after resolve").as_ptr();
+        if poll_ready(
+            &mut self.waker,
+            cx,
+            || unsafe { fdb_sys::fdb_future_is_ready(f_ptr) != 0 },
+            |network_waker| {
                 let network_waker_ptr = Arc::into_raw(network_waker);
                 unsafe {
                     fdb_sys::fdb_future_set_callback(
@@ -134,14 +128,43 @@ where
                         network_waker_ptr as *mut _,
                     );
                 }
-            }
-            Poll::Pending
-        } else {
-            Poll::Ready(
-                error::eval(unsafe { fdb_sys::fdb_future_get_error(f.as_ptr()) })
-                    .and_then(|()| T::try_from(self.f.take().expect("self.f.is_some()"))),
-            )
+            },
+        )
+        .is_pending()
+        {
+            return Poll::Pending;
         }
+        Poll::Ready(
+            error::eval(unsafe { fdb_sys::fdb_future_get_error(f_ptr) })
+                .and_then(|()| T::try_from(self.f.take().expect("self.f.is_some()"))),
+        )
+    }
+}
+
+fn poll_ready(
+    waker: &mut Option<Arc<AtomicWaker>>,
+    cx: &Context<'_>,
+    mut is_ready: impl FnMut() -> bool,
+    set_callback: impl FnOnce(Arc<AtomicWaker>),
+) -> Poll<()> {
+    if is_ready() {
+        return Poll::Ready(());
+    }
+    let mut register = false;
+    let waker = waker.get_or_insert_with(|| {
+        register = true;
+        Arc::new(AtomicWaker::new())
+    });
+    waker.register(cx.waker());
+    if register {
+        set_callback(Arc::clone(waker));
+    }
+    // Completion may have consumed the previous task's waker before registration.
+    // Recheck readiness so the one-shot callback cannot leave this task pending.
+    if is_ready() {
+        Poll::Ready(())
+    } else {
+        Poll::Pending
     }
 }
 
@@ -532,3 +555,107 @@ impl TryFrom<FdbFutureHandle> for () {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::cell::{Cell, RefCell};
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::task::{Wake, Waker};
+
+    #[derive(Default)]
+    struct WakeCount(AtomicUsize);
+
+    impl Wake for WakeCount {
+        fn wake(self: Arc<Self>) {
+            self.0.fetch_add(1, Ordering::SeqCst);
+        }
+    }
+
+    #[derive(Default)]
+    struct PendingFuture {
+        ready: Cell<bool>,
+        callback: RefCell<Option<Arc<AtomicWaker>>>,
+    }
+
+    impl PendingFuture {
+        fn complete(&self) {
+            self.ready.set(true);
+            self.callback.borrow_mut().take().unwrap().wake();
+        }
+
+        fn poll(
+            &self,
+            waker: &mut Option<Arc<AtomicWaker>>,
+            cx: &Context<'_>,
+            complete_after_read: bool,
+        ) -> Poll<()> {
+            poll_ready(
+                waker,
+                cx,
+                || {
+                    let ready = self.ready.get();
+                    if complete_after_read && !ready {
+                        // The C readiness check has observed false, then the
+                        // network callback completes before the caller registers.
+                        self.complete();
+                    }
+                    ready
+                },
+                |callback| {
+                    assert!(self.callback.replace(Some(callback)).is_none());
+                },
+            )
+        }
+    }
+
+    #[test]
+    fn completion_before_registering_a_new_task_is_ready() {
+        let future = PendingFuture::default();
+        let mut registration = None;
+        let old_task = Arc::new(WakeCount::default());
+        let old_waker = Waker::from(Arc::clone(&old_task));
+        let new_task = Arc::new(WakeCount::default());
+        let new_waker = Waker::from(Arc::clone(&new_task));
+
+        assert!(
+            future
+                .poll(&mut registration, &Context::from_waker(&old_waker), false)
+                .is_pending()
+        );
+        assert!(
+            future
+                .poll(&mut registration, &Context::from_waker(&new_waker), true)
+                .is_ready()
+        );
+        assert_eq!(old_task.0.load(Ordering::SeqCst), 1);
+        assert_eq!(new_task.0.load(Ordering::SeqCst), 0);
+        assert!(future.callback.borrow().is_none());
+    }
+
+    #[test]
+    fn completion_after_registering_a_new_task_wakes_it() {
+        let future = PendingFuture::default();
+        let mut registration = None;
+        let old_task = Arc::new(WakeCount::default());
+        let old_waker = Waker::from(Arc::clone(&old_task));
+        let new_task = Arc::new(WakeCount::default());
+        let new_waker = Waker::from(Arc::clone(&new_task));
+
+        for waker in [&old_waker, &new_waker] {
+            assert!(
+                future
+                    .poll(&mut registration, &Context::from_waker(waker), false)
+                    .is_pending()
+            );
+        }
+        future.complete();
+        assert_eq!(old_task.0.load(Ordering::SeqCst), 0);
+        assert_eq!(new_task.0.load(Ordering::SeqCst), 1);
+        assert!(
+            future
+                .poll(&mut registration, &Context::from_waker(&new_waker), false)
+                .is_ready()
+        );
+    }
+}
diff --git a/bindings/rust/foundationdb/src/runner.rs b/bindings/rust/foundationdb/src/runner.rs
index 8ad25e2788c..5ed22d528c0 100644
--- a/bindings/rust/foundationdb/src/runner.rs
+++ b/bindings/rust/foundationdb/src/runner.rs
@@ -109,7 +109,8 @@ const NOT_COMMITTED: i32 = 1020;
 /// tuple, callbacks fire left to right, and both sides always run even if the
 /// left one returned an error, the first error being the one reported.
 pub trait RunnerHooks {
-    /// Called when an attempt starts, before the closure runs.
+    /// Called when an attempt starts, before invoking the closure to construct
+    /// its future.
     fn on_attempt_start(&self, _trx: &Transaction, _attempt: usize) {}
 
     /// Called after the closure succeeded, before the transaction is committed.
@@ -558,7 +559,7 @@ enum Attempt<T, E> {
     BindingFailed(FdbBindingError),
 }
 
-/// Runs the closure once and commits, without any retry logic.
+/// Awaits the closure future and commits, without any retry logic.
 ///
 /// The closure future is built by the caller so that the runner keeps owning
 /// the closure itself: an attempt that borrowed it would make every `run`
@@ -573,8 +574,6 @@ where
     Fut: Future<Output = Result<T, E>>,
     H: RunnerHooks,
 {
-    hooks.on_attempt_start(&transaction, attempt);
-
     let value = match closure_result.await {
         Ok(value) => value,
         Err(error) => return Attempt::ClosureFailed { transaction, error },
@@ -620,6 +619,8 @@ where
     let mut attempt: usize = 0;
 
     loop {
+        // The closure can issue operations while constructing its future.
+        hooks.on_attempt_start(&transaction, attempt);
         let closure_result = closure(transaction.clone(), MaybeCommitted::new(maybe_committed));
 
         let (retried_transaction, _fdb_err) =
diff --git a/bindings/rust/foundationdb/tests/runner_hooks.rs b/bindings/rust/foundationdb/tests/runner_hooks.rs
index 4512fc90e9e..7c92416f41b 100644
--- a/bindings/rust/foundationdb/tests/runner_hooks.rs
+++ b/bindings/rust/foundationdb/tests/runner_hooks.rs
@@ -290,12 +290,19 @@ async fn tuple_hooks_fire_left_to_right_in_lifecycle_order() {
     let attempts_ref = &attempts;
 
     let result: Result<(), HookTestError> = db
-        .run_with_hooks(&hooks, |trx, _| async move {
-            if attempts_ref.fetch_add(1, Ordering::SeqCst) == 0 {
-                return Err(HookTestError::Fdb(FdbError::from_code(1020)));
+        .run_with_hooks(&hooks, |trx, _| {
+            let attempt = attempts_ref.fetch_add(1, Ordering::SeqCst);
+            events
+                .lock()
+                .expect("events mutex")
+                .push(format!("closure:{attempt}"));
+            async move {
+                if attempt == 0 {
+                    return Err(HookTestError::Fdb(FdbError::from_code(1020)));
+                }
+                trx.set(b"runner_hooks_tuple", b"ok");
+                Ok(())
             }
-            trx.set(b"runner_hooks_tuple", b"ok");
-            Ok(())
         })
         .await;
 
@@ -306,6 +313,7 @@ async fn tuple_hooks_fire_left_to_right_in_lifecycle_order() {
         vec![
             "a:attempt_start:0",
             "b:attempt_start:0",
+            "closure:0",
             "a:closure_error:1020:0",
             "b:closure_error:1020:0",
             "a:error_duration:0",
@@ -314,6 +322,7 @@ async fn tuple_hooks_fire_left_to_right_in_lifecycle_order() {
             "b:retry:0",
             "a:attempt_start:1",
             "b:attempt_start:1",
+            "closure:1",
             "a:before_commit:1",
             "b:before_commit:1",
             "a:commit_success:1",
@@ -561,15 +570,20 @@ async fn metrics_hooks_stacked_on_user_hooks_produce_a_full_report() {
     let attempts_ref = &attempts;
 
     let result: Result<(), HookTestError> = db
-        .run_with_hooks(&hooks, |trx, _| async move {
+        .run_with_hooks(&hooks, |trx, _| {
             let first = attempts_ref.fetch_add(1, Ordering::SeqCst) == 0;
+            // These operations start before the returned future is polled.
+            let read_version = trx.get_read_version();
             trx.set(b"runner_hooks_metrics_stacked", b"value");
             trx.set_custom_metric("stacked", 1, &[]);
-            let _ = trx.get(b"runner_hooks_metrics_stacked", false).await?;
-            if first {
-                return Err(HookTestError::Fdb(FdbError::from_code(1020)));
+            async move {
+                let _ = read_version.await?;
+                let _ = trx.get(b"runner_hooks_metrics_stacked", false).await?;
+                if first {
+                    return Err(HookTestError::Fdb(FdbError::from_code(1020)));
+                }
+                Ok(())
             }
-            Ok(())
         })
         .await;
 
@@ -589,6 +603,8 @@ async fn metrics_hooks_stacked_on_user_hooks_produce_a_full_report() {
     assert_eq!(first.index, 0);
     assert!(matches!(first.outcome, AttemptOutcome::Retried { .. }));
     assert!(first.on_error_duration.is_some());
+    assert!(first.grv_duration.is_some());
+    assert!(first.read_version.is_some());
     assert_eq!(first.usage.call_set, 1);
     assert_eq!(first.usage.call_get, 1);
     assert!(first.usage.bytes_written > 0);
@@ -602,6 +618,8 @@ async fn metrics_hooks_stacked_on_user_hooks_produce_a_full_report() {
     let last = report.attempts.last().expect("a last attempt");
     assert!(matches!(last.outcome, AttemptOutcome::Committed));
     assert!(last.commit_duration.is_some());
+    assert!(last.grv_duration.is_some());
+    assert!(last.read_version.is_some());
     assert_eq!(last.usage.call_set, 1);
 
     // The user hook saw the same run.

From e85693e0656e097a8ef45e1b65b74531b05fd522 Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Wed, 30 Sep 2026 20:16:25 -0700
Subject: [PATCH 05/11] Fix Rust callback, executor, and attempt ownership

---
 bindings/rust/CMakeLists.txt                  |   2 +-
 bindings/rust/CONTRIBUTING.md                 |   7 +-
 bindings/rust/README.md                       |   5 +-
 bindings/rust/UPSTREAM.md                     |   2 +
 .../src/leader_election/workload.rs           |   2 +-
 .../examples/tracing_demo/lib.rs              |   2 +-
 .../rust/foundationdb-simulation/README.md    |   4 +-
 .../foundationdb-simulation/docs/fdb_rt.md    | 351 ++++-------------
 .../examples/atomic/lib.rs                    |   2 +-
 .../examples/noop/lib.rs                      |   2 +-
 .../examples/shared/lib.rs                    |   2 +-
 .../foundationdb-simulation/src/bindings.rs   |  98 ++++-
 .../foundationdb-simulation/src/fdb_rt.rs     | 366 +++++++++++++++---
 .../rust/foundationdb-simulation/src/lib.rs   |   8 +-
 bindings/rust/foundationdb/src/metrics.rs     |  29 +-
 bindings/rust/foundationdb/src/transaction.rs |  16 +-
 bindings/rust/foundationdb/tests/metrics.rs   |  38 +-
 17 files changed, 561 insertions(+), 375 deletions(-)

diff --git a/bindings/rust/CMakeLists.txt b/bindings/rust/CMakeLists.txt
index 4e93df15a5a..0e9e8bdb9ed 100644
--- a/bindings/rust/CMakeLists.txt
+++ b/bindings/rust/CMakeLists.txt
@@ -102,7 +102,7 @@ add_test(NAME rust_future_safety_tests
   COMMAND_EXPAND_LISTS)
 set_tests_properties(rust_future_safety_tests PROPERTIES TIMEOUT 300 LABELS "rust")
 
-foreach(symbol str_from_c WorkloadContext::new register_workload_context WrappedWorkload)
+foreach(symbol str_from_c WorkloadContext::new register_workload_context WrappedWorkload Metrics)
   string(REPLACE "::" "_" test_suffix ${symbol})
   add_test(NAME rust_simulation_${test_suffix}_safety_tests
     COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
diff --git a/bindings/rust/CONTRIBUTING.md b/bindings/rust/CONTRIBUTING.md
index 90294b650d9..7cc8cad4f79 100644
--- a/bindings/rust/CONTRIBUTING.md
+++ b/bindings/rust/CONTRIBUTING.md
@@ -55,9 +55,10 @@ cargo test-fdb-latest --locked
 Use the in-tree [binding tester instructions](foundationdb-bindingtester/README.md)
 for comparison with Python. Tuple tests and macro tests do not need a cluster.
 
-`rust_unit_tests` also checks simulation context lifetime and thread guards with
-fake callbacks; it does not start the simulator. Simulation workload execution
-is a separate check against a compatible server.
+`rust_unit_tests` also checks simulation context and metrics callbacks, executor
+wakeups, and thread ownership. The simulation safety doctests check that borrowed
+metrics sinks cannot escape their callback. These checks do not start the simulator;
+workload execution is a separate check against a compatible server.
 
 The simulation crates and their scripts are retained for focused simulator work;
 their READMEs describe the workload ABI and required server versions. The original
diff --git a/bindings/rust/README.md b/bindings/rust/README.md
index b9f90ed312f..4402cb074e9 100644
--- a/bindings/rust/README.md
+++ b/bindings/rust/README.md
@@ -41,8 +41,9 @@ standalone Cargo development.
 The migration preserves the upstream crate versions. API corrections are
 documented in [UPSTREAM.md](UPSTREAM.md): raw-pointer ownership requires `unsafe`,
 integer options take `i64` to cover the C API's full range, and simulation workload
-wrappers enforce context lifetime and thread access. Crate versions are
-independent of the FoundationDB server release number. Published crates on
+wrappers enforce context lifetime and thread access. Simulation metrics sinks are
+borrowed for their callback, and executor futures stay on their creating thread.
+Crate versions are independent of the FoundationDB server release number. Published crates on
 crates.io are separate releases; importing the source does not publish or transfer
 ownership of them.
 
diff --git a/bindings/rust/UPSTREAM.md b/bindings/rust/UPSTREAM.md
index f95f38e0235..c4e5b65b043 100644
--- a/bindings/rust/UPSTREAM.md
+++ b/bindings/rust/UPSTREAM.md
@@ -36,3 +36,5 @@ The in-tree adaptation also corrects public API contracts from this snapshot:
   callback tables are managed by the crate. Context clones and environments
   panic before accessing C state if used from another thread or after their
   workload is released.
+- `Metrics<'_>` borrows its native sink for one `get_metrics` callback. A workload
+  cannot retain the sink after returning; collect owned metric values instead.
diff --git a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs
index 8dc1e8f151c..3444d49f824 100644
--- a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs
+++ b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs
@@ -580,7 +580,7 @@ impl RustWorkload for LeaderElectionWorkload {
         }
     }
 
-    fn get_metrics(&self, mut out: Metrics) {
+    fn get_metrics(&self, mut out: Metrics<'_>) {
         out.extend([
             Metric::val("swarm_profile", self.profile.metric_value()),
             Metric::val("operation_count", self.operation_count as f64),
diff --git a/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs b/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs
index 74b7534d3da..8829feba6d6 100644
--- a/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs
+++ b/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs
@@ -124,7 +124,7 @@ impl RustWorkload for TracingDemoWorkload {
         tracing::info!(client = self.client_id, phase = "check", "workload check");
     }
 
-    fn get_metrics(&self, mut out: Metrics) {
+    fn get_metrics(&self, mut out: Metrics<'_>) {
         out.extend([Metric::val("committed", self.committed as i32 as f64)]);
     }
 
diff --git a/bindings/rust/foundationdb-simulation/README.md b/bindings/rust/foundationdb-simulation/README.md
index 73d0a6b384f..0ad421e17d7 100644
--- a/bindings/rust/foundationdb-simulation/README.md
+++ b/bindings/rust/foundationdb-simulation/README.md
@@ -118,7 +118,7 @@ pub trait RustWorkload {
     async fn setup(&mut self, db: SimDatabase);
     async fn start(&mut self, db: SimDatabase);
     async fn check(&mut self, db: SimDatabase);
-    fn get_metrics(&self, out: Metrics);
+    fn get_metrics(&self, out: Metrics<'_>);
     fn get_check_timeout(&self) -> f64;
 }
 ```
@@ -270,7 +270,7 @@ At the end of the simulation, the `get_metrics` method is called for each client
 Implement this method to report results.
 
 ```rust
-fn get_metrics(&self, out: Metrics) {
+fn get_metrics(&self, out: Metrics<'_>) {
     // val metrics are summed across all clients
     out.push(Metric::val("total_ops", self.ops as f64));
     // avg metrics are averaged across all clients
diff --git a/bindings/rust/foundationdb-simulation/docs/fdb_rt.md b/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
index a50856b1bde..9c3fe96ded6 100644
--- a/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
+++ b/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
@@ -1,284 +1,67 @@
-Here is an explanation of how `fdb_spawn` communicates with the simulation through the
-foundationdb-rs SDK.
-```rs
-    fdb_spawn(async move {
-        ... // code that relies on polling FdbFutures
-    }
-```
-
-The executor uses a two-phase model: **wakeup** (which queues tasks) and **polling** (which
-executes them). This separation enables proper handling of shared futures and prevents
-re-entrancy issues.
-
-## Core Data Structures
-
-A thread-local queue holds tasks that have been woken and are waiting to be polled:
-```rs
-thread_local! {
-    static TASKS: RefCell<Vec<Arc<Task>>> = const { RefCell::new(Vec::new()) };
-}
-```
-
-The `Task` struct wraps a pinned future. The `Option` allows the future to be taken out
-during polling and put back if it returns `Pending`:
-```rs
-struct Task {
-    f: UnsafeCell<Option<Pin<Box<dyn Future<Output = ()>>>>>,
-}
-```
-
-## Spawning a Task
-
-`fdb_spawn` takes in a Rust Future, wraps it in a `Task`, and immediately polls it:
-```rs
-pub(crate) fn fdb_spawn<F>(future: F)
-where
-    F: Future<Output = ()> + 'static,
-{
-    // Create a Task containing the pinned future wrapped in Option
-    let task = Arc::new(Task {
-        f: UnsafeCell::new(Some(Box::pin(future))),
-    });
-    // Immediately poll the task to start execution
-    task.poll();
-}
-```
-
-## Polling a Task
-
-`Task::poll` creates a waker from itself and polls the future:
-```rs
-impl Task {
-    fn poll(self: Arc<Self>) {
-        // Create a Waker that references this Task
-        let waker = unsafe { Waker::from_raw(self.clone().into_waker()) };
-        let cx = &mut Context::from_waker(&waker);
-        // Take the future out of the slot
-        let slot = unsafe { &mut *self.f.get() };
-        if let Some(mut f) = slot.take() {
-            // Poll the future
-            if f.as_mut().poll(cx).is_pending() {
-                // If Pending, put the future back for later polling
-                *slot = Some(f);
-            }
-            // If Ready, the future is dropped (not put back)
-        }
-    }
-}
-```
-
-## Waking a Task
-
-The key insight of this architecture: **waking a task does not poll it**. Instead, it
-queues the task for later polling:
-```rs
-impl Task {
-    // Called when Waker::wake() is invoked (consumes the waker)
-    fn wake(ptr: *const ()) {
-        let task = Self::from_ptr(ptr);
-        // Just push to the queue - don't poll yet
-        TASKS.with_borrow_mut(|tasks| tasks.push(task))
-    }
-
-    // Called when Waker::wake_by_ref() is invoked (doesn't consume the waker)
-    fn wake_by_ref(ptr: *const ()) {
-        let task = Self::from_ptr(ptr);
-        TASKS.with_borrow_mut(|tasks| tasks.push(task.clone()));
-        mem::forget(task);  // Don't decrement ref count since we cloned
-    }
-}
-```
-
-## Draining the Queue
-
-`poll_pending_tasks` drains the queue and polls all waiting tasks:
-```rs
-pub fn poll_pending_tasks() {
-    let mut tasks = TASKS.with_borrow_mut(mem::take);
-    tasks.drain(..).for_each(Task::poll);
-}
-```
-
-## FdbFuture Polling
-
-`poll()` runs the closure until encountering an `await`. The case we're interested in takes
-place when foundationdb-rs issues a call to fdbserver using the C-API through `fdb_sys`.
-Calls that return an `FDBFuture*` are wrapped into `FdbFuture` which implements poll:
-```rs
-pub(crate) struct FdbFuture<T> {
-    f: Option<FdbFutureHandle>,
-    waker: Option<Arc<AtomicWaker>>,
-    phantom: std::marker::PhantomData<T>,
-}
-
-impl<T> Future for FdbFuture<T>
-where
-    T: TryFrom<FdbFutureHandle, Error = FdbError> + Unpin,
-{
-    type Output = FdbResult<T>;
-
-    fn poll(mut self: Pin<&mut Self>, cx: &mut Context) -> Poll<FdbResult<T>> {
-        let f = self.f.as_ref().expect("cannot poll after resolve");
-        let ready = unsafe { fdb_sys::fdb_future_is_ready(f.as_ptr()) };
-        if ready == 0 {
-            // Future not ready yet - set up the callback
-            let f_ptr = f.as_ptr();
-            let mut register = false;
-            let waker = self.waker.get_or_insert_with(|| {
-                register = true;
-                Arc::new(AtomicWaker::new())
-            });
-            // Register our Task's waker into the AtomicWaker
-            // This clones the waker
-            waker.register(cx.waker());
-            if register {
-                // First poll: set up the FDB callback
-                let network_waker: Arc<AtomicWaker> = waker.clone();
-                let network_waker_ptr = Arc::into_raw(network_waker);
-                unsafe {
-                    fdb_sys::fdb_future_set_callback(
-                        f_ptr,
-                        Some(fdb_future_callback),
-                        network_waker_ptr as *mut _,
-                    );
-                }
-            }
-            Poll::Pending
-        } else {
-            // Future is ready - extract the result
-            Poll::Ready(
-                error::eval(unsafe { fdb_sys::fdb_future_get_error(f.as_ptr()) })
-                    .and_then(|()| T::try_from(self.f.take().expect("self.f.is_some()"))),
-            )
-        }
-    }
-}
-```
-
-## Initial Spawn Summary
-
-To summarize what happens when `fdb_spawn` is called:
-- `fdb_spawn` creates a `Task` wrapping the pinned future and immediately calls `task.poll()`
-- `Task::poll` creates a waker and polls the future
-- When an `FdbFuture` is polled, it:
-  - Registers our `Waker` into an `AtomicWaker` (cloning it)
-  - Sets `fdb_future_callback` as callback with the `AtomicWaker` as argument
-  - Returns `Poll::Pending`
-- `Task::poll` sees `Pending` and puts the future back in the slot
-- `fdb_spawn` returns
-
-```
-fdb_spawn
-  └─ Task::poll
-       └─ FdbFuture::poll
-            ├─ waker.register(cx.waker())  // clones our waker into AtomicWaker
-            ├─ fdb_future_set_callback     // registers callback with FDB
-            └─ returns Pending
-       └─ future put back in slot
-  └─ returns
-```
-
-After this, the future has been handed to the simulation and `fdb_spawn` returns. If your
-Workload is valid, execution is returned to the simulation. The fdbserver runs, internally
-resolving the future and, when done, notifies `FdbFutureHandle` by calling its callback.
-
-## The Callback and Executor Hook
-
-When FDB resolves a future, it calls `fdb_future_callback`. This is where the two-phase
-model comes together:
-```rs
-pub static CUSTOM_EXECUTOR_HOOK: std::sync::OnceLock<fn()> = std::sync::OnceLock::new();
-
-extern "C" fn fdb_future_callback(
-    _f: *mut fdb_sys::FDBFuture,
-    callback_parameter: *mut ::std::os::raw::c_void,
-) {
-    // Phase 1: Wakeup - resolve all wakeup chain
-    let network_waker: Arc<AtomicWaker> = unsafe { Arc::from_raw(callback_parameter as *const _) };
-    network_waker.wake();  // This calls Task::wake(), which queues the task
-
-    // Phase 2: Polling - poll all queued tasks
-    if let Some(poll_pending_tasks) = CUSTOM_EXECUTOR_HOOK.get() {
-        poll_pending_tasks();
-    }
-}
-```
-
-The simulation registers `poll_pending_tasks` as the executor hook during workload
-initialization (in `register_workload!` or `register_factory!`):
-```rs
-foundationdb::future::CUSTOM_EXECUTOR_HOOK
-    .set(foundationdb_simulation::internals::poll_pending_tasks)
-    .unwrap();
-```
-
-## Callback Execution Flow
-
-When `fdb_future_callback` is called:
-1. `network_waker.wake()` calls the waker stored in `AtomicWaker`
-2. This invokes `Task::wake()`, which pushes the task to `TASKS` queue
-3. `poll_pending_tasks()` drains the queue and polls all tasks
-4. `Task::poll` polls the future, which finds `fdb_future_is_ready` returns non-zero
-5. `FdbFuture::poll` returns `Poll::Ready` with the result
-
-```
-fdb_future_callback
-  ├─ network_waker.wake()
-  │    └─ Task::wake() -> pushes task to TASKS queue
-  └─ poll_pending_tasks()
-       └─ Task::poll
-            └─ FdbFuture::poll
-                 └─ fdb_future_is_ready == true
-                 └─ returns Ready(result)
-            └─ future continues executing...
-```
-
-## Encountering Another FdbFuture
-
-If the closure encounters another `FdbFuture`, the cycle continues:
-- `FdbFuture::poll` is called which:
-  - Registers the `Waker` (cloning it)
-  - Sets `fdb_future_callback` as callback
-  - Returns `Poll::Pending`
-- `Task::poll` puts the future back in the slot
-- Later, when FDB resolves the new future, `fdb_future_callback` is called again
-
-```
-fdb_future_callback (for first future)
-  ├─ network_waker.wake() -> queues task
-  └─ poll_pending_tasks()
-       └─ Task::poll
-            └─ FdbFuture::poll (first)
-                 └─ returns Ready
-            └─ ... more code runs ...
-            └─ FdbFuture::poll (second)
-                 ├─ waker.register()
-                 ├─ fdb_future_set_callback
-                 └─ returns Pending
-            └─ future put back in slot
-
-... later, fdbserver resolves second future ...
-
-fdb_future_callback (for second future)
-  ├─ network_waker.wake() -> queues task
-  └─ poll_pending_tasks()
-       └─ Task::poll
-            └─ ... continues from where it left off ...
-```
-
-## Completion
-
-When the task's future finishes without setting a new callback (no more `FdbFuture`s to
-await), `Task::poll` sees `Poll::Ready(())` and does not put the future back in the slot.
-The future is dropped, and when all references to the `Task` are dropped, the `Task` itself
-is freed:
-
-```
-fdb_future_callback
-  ├─ network_waker.wake() -> queues task
-  └─ poll_pending_tasks()
-       └─ Task::poll
-            └─ future.poll() returns Ready(())
-            └─ future is dropped (not put back)
-       └─ Task dropped (if no more references)
-```
+The simulator executor runs Rust futures on the thread that creates them. The futures
+may contain `Rc`, thread-affine simulator state, and other values that are not `Send`.
+Their wakers, however, are ordinary Rust `Waker`s and may safely be cloned, woken, or
+dropped on any thread.
+
+## Ownership and scheduling
+
+Each thread has its own executor registry. Only this registry owns the pinned futures;
+neither a waker nor the shared notification queue contains a future or a pointer to one.
+Task IDs are never reused within an executor.
+
+A waker contains a task ID, an atomic queued flag, and a weak reference to its owner's
+notification queue. The standard library's `Wake` implementation constructs the `Waker`
+from this `Send + Sync` state without a custom unsafe `RawWaker` implementation.
+
+Waking adds a notification to the owner's queue. Duplicate wakes before the next poll
+are coalesced. The queue holds the notification state alive until it is consumed, so
+even a consuming `Waker::wake()` schedules a poll before releasing the final waker.
+Waking never polls the future directly.
+
+`fdb_spawn` inserts a future into the current thread's registry, queues its first poll,
+and calls `poll_pending_tasks`. The drain removes each future from the registry while
+polling it and restores it only if it returns `Pending`. No queue lock or registry borrow
+spans user polling or destruction. A thread-local guard defers nested drains, including
+synchronous FoundationDB callbacks, until the current poll has returned. Tasks spawned
+during a poll also wait for that poll to finish.
+
+The drain continues until the queue is empty. A wake during a poll schedules another poll
+after the current one, including when the wake comes from another thread. As with other
+executors, a future must not wake itself indefinitely without making progress.
+
+## FoundationDB callbacks
+
+The workload registration macros install `poll_pending_tasks` in
+`foundationdb::future::CUSTOM_EXECUTOR_HOOK`. A pending `FdbFuture` registers the task's
+waker in its callback state. When the C future completes, its callback first wakes that
+state and then invokes the executor hook:
+
+```text
+FDB future callback on the simulator thread
+  -> wake task -> enqueue notification
+  -> CUSTOM_EXECUTOR_HOOK -> poll_pending_tasks
+      -> remove future from owner registry
+      -> poll future
+          -> Ready: destroy it on its owner
+          -> Pending: restore it to owner registry
+```
+
+The simulator's normal callbacks run on the owner thread and therefore resume work
+immediately. A wake from another thread is safe but does not create a simulator event
+or move execution to that thread: the owner must next call `poll_pending_tasks` to make
+progress. Calling the hook on a foreign thread drains only that thread's own executor.
+This executor is not a general-purpose cross-thread event loop.
+
+## Completion and cancellation
+
+A completed future is destroyed on its owner even if external wakers still exist. Later
+wakes for its task ID are harmless. If a pending future loses its final waker without
+being woken, the waker's destructor queues cancellation. The owner drops that future on
+its next drain. This preserves owner-thread destruction when the last waker is dropped
+by another thread and avoids permanently retaining an unreachable pending task.
+
+If the owner does not drain again, cancellation remains deferred until its executor is
+destroyed at thread exit. Exiting the owner thread drops all remaining futures locally;
+outstanding wakers contain only weak queue references and remain safe to use afterward.
+Cancellation callbacks that reenter the executor during this teardown return immediately.
+The executor has no independent timer or background thread to drive foreign wakes.
diff --git a/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs b/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs
index ebda74d5191..ca285f08f96 100644
--- a/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs
+++ b/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs
@@ -289,7 +289,7 @@ impl RustWorkload for AtomicWorkload {
             );
         }
     }
-    fn get_metrics(&self, mut out: Metrics) {
+    fn get_metrics(&self, mut out: Metrics<'_>) {
         println!("rust_get_metrics({})", self.client_id);
         out.extend([
             Metric::val("expected_count", self.expected_count as f64),
diff --git a/bindings/rust/foundationdb-simulation/examples/noop/lib.rs b/bindings/rust/foundationdb-simulation/examples/noop/lib.rs
index bff85abc5ee..edb38e487f2 100644
--- a/bindings/rust/foundationdb-simulation/examples/noop/lib.rs
+++ b/bindings/rust/foundationdb-simulation/examples/noop/lib.rs
@@ -70,7 +70,7 @@ impl RustWorkload for NoopWorkload {
             &[("Layer", "Rust"), ("Stage", "Check")],
         );
     }
-    fn get_metrics(&self, mut out: Metrics) {
+    fn get_metrics(&self, mut out: Metrics<'_>) {
         println!("rust_get_metrics({}_{})", self.name, self.client_id);
         out.reserve(8);
         out.push(Metric::val("test", 42));
diff --git a/bindings/rust/foundationdb-simulation/examples/shared/lib.rs b/bindings/rust/foundationdb-simulation/examples/shared/lib.rs
index a4b42551723..9c59c1951a3 100644
--- a/bindings/rust/foundationdb-simulation/examples/shared/lib.rs
+++ b/bindings/rust/foundationdb-simulation/examples/shared/lib.rs
@@ -66,7 +66,7 @@ impl RustWorkload for SharedWorkload {
             self.phase_clock.now()
         );
     }
-    fn get_metrics(&self, mut _out: Metrics) {
+    fn get_metrics(&self, mut _out: Metrics<'_>) {
         println!("rust_get_metrics({})", self.client_id);
     }
     fn get_check_timeout(&self) -> f64 {
diff --git a/bindings/rust/foundationdb-simulation/src/bindings.rs b/bindings/rust/foundationdb-simulation/src/bindings.rs
index 473d84cbe7b..1a46b06a17e 100644
--- a/bindings/rust/foundationdb-simulation/src/bindings.rs
+++ b/bindings/rust/foundationdb-simulation/src/bindings.rs
@@ -136,8 +136,30 @@ impl Drop for ContextOwner {
 }
 /// Wrapper around the C FDBPromise
 pub struct Promise(FDBPromise);
-/// Wrapper around the C FDBMetrics
-pub struct Metrics(FDBMetrics);
+/// A metrics sink borrowed for one [`crate::RustWorkload::get_metrics`] callback.
+///
+/// The native sink is destroyed after the callback returns, so workloads cannot
+/// retain it for later use:
+///
+/// ```compile_fail,E0521
+/// use std::cell::RefCell;
+/// use foundationdb_simulation::{Metrics, RustWorkload, SimDatabase};
+///
+/// struct RetainingWorkload {
+///     saved: RefCell<Option<Metrics<'static>>>,
+/// }
+///
+/// impl RustWorkload for RetainingWorkload {
+///     async fn setup(&mut self, _: SimDatabase) {}
+///     async fn start(&mut self, _: SimDatabase) {}
+///     async fn check(&mut self, _: SimDatabase) {}
+///     fn get_metrics(&self, out: Metrics<'_>) {
+///         *self.saved.borrow_mut() = Some(out);
+///     }
+///     fn get_check_timeout(&self) -> f64 { 1.0 }
+/// }
+/// ```
+pub struct Metrics<'callback>(&'callback mut FDBMetrics);
 
 /// A single metric entry
 #[derive(Clone)]
@@ -388,20 +410,20 @@ impl Drop for Promise {
     }
 }
 
-impl Metrics {
-    pub(crate) fn new(raw: FDBMetrics) -> Self {
+impl<'callback> Metrics<'callback> {
+    pub(crate) fn new(raw: &'callback mut FDBMetrics) -> Self {
         Self(raw)
     }
     /// Call std::vector::reserve on the underlying C++ sink
     pub fn reserve(&mut self, n: usize) {
-        with! { self.0 => reserve(n as i32) }
+        with! { &*self.0 => reserve(n as i32) }
     }
     /// Push a [Metric] entry in the underlying C++ sink
     pub fn push(&mut self, metric: Metric) {
         let key_storage = str_for_c(metric.key);
         let fmt_storage = str_for_c(metric.fmt.unwrap_or("%.3g"));
         with! {
-            self.0 => push(FDBMetric {
+            &*self.0 => push(FDBMetric {
                 key: key_storage.as_ptr(),
                 fmt: fmt_storage.as_ptr(),
                 val: metric.val,
@@ -465,7 +487,7 @@ mod tests {
     use super::WorkloadContext;
     use super::raw_bindings::*;
     use crate::registration::register_workload_context;
-    use crate::{Metrics, RustWorkload, SimDatabase};
+    use crate::{Metric, Metrics, RustWorkload, SimDatabase};
 
     struct NativeContext {
         calls: Arc<AtomicUsize>,
@@ -560,7 +582,19 @@ mod tests {
         async fn setup(&mut self, _: SimDatabase) {}
         async fn start(&mut self, _: SimDatabase) {}
         async fn check(&mut self, _: SimDatabase) {}
-        fn get_metrics(&self, _: Metrics) {}
+        fn get_metrics(&self, mut out: Metrics<'_>) {
+            out.reserve(3);
+            out.push(Metric::val("operations", 7));
+            out.extend([
+                Metric::avg("latency", 2.5),
+                Metric {
+                    key: "completion",
+                    val: 1.0,
+                    avg: false,
+                    fmt: Some("%.0f"),
+                },
+            ]);
+        }
         fn get_check_timeout(&self) -> f64 {
             7.0
         }
@@ -574,6 +608,54 @@ mod tests {
         }
     }
 
+    #[derive(Default)]
+    struct NativeMetrics {
+        reservations: Vec<i32>,
+        entries: Vec<(String, f64, bool, String)>,
+    }
+
+    unsafe extern "C" fn reserve_metrics(raw: *mut OpaqueMetrics, n: i32) {
+        // SAFETY: The metrics callback keeps the native sink alive and exclusive.
+        let sink = unsafe { &mut *(raw as *mut NativeMetrics) };
+        sink.reservations.push(n);
+        sink.entries.reserve(n as usize);
+    }
+
+    unsafe extern "C" fn push_metric(raw: *mut OpaqueMetrics, metric: FDBMetric) {
+        // SAFETY: The callback owns the sink and borrows these strings for this call.
+        let sink = unsafe { &mut *(raw as *mut NativeMetrics) };
+        let key = unsafe { super::str_from_c(metric.key) };
+        let format = unsafe { super::str_from_c(metric.fmt) };
+        sink.entries.push((key, metric.val, metric.avg, format));
+    }
+
+    #[test]
+    fn metrics_callback_writes_to_borrowed_native_sink() {
+        let workload = TestWorkload(None).wrap();
+        let mut sink = NativeMetrics::default();
+        let mut metrics_vt = FDBMetrics_FDBMetrics_VT {
+            reserve: Some(reserve_metrics),
+            push: Some(push_metric),
+        };
+        let raw_metrics = FDBMetrics {
+            inner: &mut sink as *mut NativeMetrics as *mut _,
+            vt: &mut metrics_vt,
+        };
+
+        // SAFETY: The workload, sink, and vtable all remain live for this callback.
+        unsafe { (*workload.0.vt).getMetrics.unwrap()(workload.0.inner, raw_metrics) };
+
+        assert_eq!(sink.reservations.first(), Some(&3));
+        assert_eq!(
+            sink.entries,
+            vec![
+                ("operations".into(), 7.0, false, "%.3g".into()),
+                ("latency".into(), 2.5, true, "%.3g".into()),
+                ("completion".into(), 1.0, false, "%.0f".into()),
+            ]
+        );
+    }
+
     #[test]
     fn environment_rejects_access_after_registered_workload_release() {
         let calls = Arc::new(AtomicUsize::new(0));
diff --git a/bindings/rust/foundationdb-simulation/src/fdb_rt.rs b/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
index 8e90a4ed5fd..572a788a349 100644
--- a/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
+++ b/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
@@ -6,80 +6,344 @@
 #![doc = include_str!("../docs/fdb_rt.md")]
 
 use std::{
-    cell::{RefCell, UnsafeCell},
+    cell::{Cell, RefCell},
+    collections::{BTreeMap, VecDeque},
     future::Future,
-    mem,
     pin::Pin,
-    sync::Arc,
-    task::{Context, RawWaker, RawWakerVTable, Waker},
+    sync::{
+        Arc, Mutex, Weak,
+        atomic::{AtomicBool, Ordering},
+    },
+    task::{Context, Wake, Waker},
 };
 
+type TaskId = usize;
+type Task = Pin<Box<dyn Future<Output = ()>>>;
+type Queue = Mutex<VecDeque<Notification>>;
+
 thread_local! {
-    static TASKS: RefCell<Vec<Arc<Task>>> = const { RefCell::new(Vec::new()) };
+    static EXECUTOR: RefCell<Executor> = RefCell::new(Executor::default());
+    static POLLING: Cell<bool> = const { Cell::new(false) };
 }
 
-struct Task {
-    f: UnsafeCell<Option<Pin<Box<dyn Future<Output = ()>>>>>,
+#[derive(Default)]
+struct Executor {
+    tasks: BTreeMap<TaskId, Task>,
+    queue: Arc<Queue>,
+    next_id: TaskId,
 }
 
-impl Task {
-    const VTABLE: RawWakerVTable =
-        RawWakerVTable::new(Self::clone, Self::wake, Self::wake_by_ref, Self::drop);
-
-    fn poll(self: Arc<Self>) {
-        let waker = unsafe { Waker::from_raw(self.clone().into_waker()) };
-        let cx = &mut Context::from_waker(&waker);
-        let slot = unsafe { &mut *self.f.get() };
-        if let Some(mut f) = slot.take() {
-            if f.as_mut().poll(cx).is_pending() {
-                *slot = Some(f);
-            }
+enum Notification {
+    Ready(Arc<TaskWaker>),
+    Cancel(TaskId),
+}
+
+/// Wakers may cross threads, but must never own or access an executor's futures.
+struct TaskWaker {
+    id: TaskId,
+    queue: Weak<Queue>,
+    queued: AtomicBool,
+}
+
+impl Wake for TaskWaker {
+    fn wake(self: Arc<Self>) {
+        if self.queued.swap(true, Ordering::AcqRel) {
+            return;
         }
+        let Some(queue) = self.queue.upgrade() else {
+            return;
+        };
+        queue
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+            .push_back(Notification::Ready(self));
     }
+}
 
-    fn from_ptr(ptr: *const ()) -> Arc<Self> {
-        unsafe { Arc::from_raw(&*(ptr as *const Self)) }
-    }
-    fn into_waker(self: Arc<Self>) -> RawWaker {
-        RawWaker::new(Arc::into_raw(self) as *const (), &Self::VTABLE)
+impl Drop for TaskWaker {
+    fn drop(&mut self) {
+        // A pending future with no remaining wakers cannot make progress. Only
+        // its owner may destroy it, even when its last waker dies on another thread.
+        if let Some(queue) = self.queue.upgrade() {
+            queue
+                .lock()
+                .unwrap_or_else(|poisoned| poisoned.into_inner())
+                .push_back(Notification::Cancel(self.id));
+        }
     }
+}
 
-    fn clone(ptr: *const ()) -> RawWaker {
-        let task = Self::from_ptr(ptr);
-        mem::forget(task.clone());
-        task.into_waker()
-    }
-    fn wake(ptr: *const ()) {
-        let task = Self::from_ptr(ptr);
-        TASKS.with_borrow_mut(|tasks| tasks.push(task))
-    }
-    fn wake_by_ref(ptr: *const ()) {
-        let task = Self::from_ptr(ptr);
-        TASKS.with_borrow_mut(|tasks| tasks.push(task.clone()));
-        mem::forget(task);
-    }
-    fn drop(ptr: *const ()) {
-        drop(Self::from_ptr(ptr))
+struct PollingGuard;
+
+impl Drop for PollingGuard {
+    fn drop(&mut self) {
+        let _ = POLLING.try_with(|polling| polling.set(false));
     }
 }
 
-/// Poll all tasks in the pending queue
+/// Poll this thread's queued tasks until no notifications remain.
+///
+/// Wakes from other threads are delivered here, on the thread that spawned the
+/// future. Calling this function on a different thread cannot poll those tasks.
+/// Nested calls defer to the outer drain, so a future is never polled reentrantly.
 pub fn poll_pending_tasks() {
-    let mut tasks = TASKS.with_borrow_mut(mem::take);
-    tasks.drain(..).for_each(Task::poll);
+    // Cancelling a future during thread teardown can invoke the callback hook.
+    // Its executor is already being destroyed and must not be entered again.
+    let Ok(queue) = EXECUTOR.try_with(|executor| executor.borrow().queue.clone()) else {
+        return;
+    };
+    let Ok(false) = POLLING.try_with(|polling| polling.replace(true)) else {
+        return;
+    };
+    let _guard = PollingGuard;
+    loop {
+        let notification = queue
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+            .pop_front();
+        let Some(notification) = notification else {
+            return;
+        };
+        // Neither the queue lock nor the registry borrow may span user polling
+        // or destruction: either can synchronously wake or spawn another task.
+        match notification {
+            Notification::Ready(notification) => {
+                notification.queued.store(false, Ordering::Release);
+                let id = notification.id;
+                let future = EXECUTOR.with_borrow_mut(|executor| executor.tasks.remove(&id));
+                if let Some(mut future) = future {
+                    let waker = Waker::from(notification);
+                    let mut cx = Context::from_waker(&waker);
+                    if future.as_mut().poll(&mut cx).is_pending() {
+                        EXECUTOR.with_borrow_mut(|executor| {
+                            executor.tasks.insert(id, future);
+                        });
+                    }
+                }
+            }
+            Notification::Cancel(id) => {
+                let future = EXECUTOR.with_borrow_mut(|executor| executor.tasks.remove(&id));
+                drop(future);
+            }
+        }
+    }
 }
 
-/// Spawn an async block and resolve all contained FoundationDB futures
+/// Spawn an async block and resolve all contained FoundationDB futures.
 pub(crate) fn fdb_spawn<F>(future: F)
 where
     F: Future<Output = ()> + 'static,
 {
-    // The simulation executor is single-threaded, but `Waker` requires the task
-    // pointer to be usable as `Send + Sync`, so we use `Arc` (not `Rc`) to uphold the
-    // `RawWaker` safety contract even though `Task` is neither `Send` nor `Sync`.
-    #[allow(clippy::arc_with_non_send_sync)]
-    let task = Arc::new(Task {
-        f: UnsafeCell::new(Some(Box::pin(future))),
+    let notification = EXECUTOR.with_borrow_mut(|executor| {
+        let id = executor.next_id;
+        executor.next_id = id.checked_add(1).expect("simulation task IDs exhausted");
+        executor.tasks.insert(id, Box::pin(future));
+        Arc::new(TaskWaker {
+            id,
+            queue: Arc::downgrade(&executor.queue),
+            queued: AtomicBool::new(false),
+        })
     });
-    task.poll();
+    notification.wake();
+    poll_pending_tasks();
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::{
+        future::poll_fn,
+        rc::Rc,
+        sync::mpsc,
+        task::Poll,
+        thread::{self, ThreadId},
+    };
+
+    struct LocalFuture {
+        owner: ThreadId,
+        polls: Rc<Cell<usize>>,
+        drops: Arc<Mutex<Vec<ThreadId>>>,
+        wakers: Arc<Mutex<Vec<Waker>>>,
+        ready: Arc<AtomicBool>,
+    }
+
+    impl Future for LocalFuture {
+        type Output = ();
+
+        fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
+            assert_eq!(thread::current().id(), self.owner);
+            self.polls.set(self.polls.get() + 1);
+            if self.ready.load(Ordering::Acquire) {
+                Poll::Ready(())
+            } else {
+                self.wakers.lock().unwrap().push(cx.waker().clone());
+                Poll::Pending
+            }
+        }
+    }
+
+    impl Drop for LocalFuture {
+        fn drop(&mut self) {
+            assert_eq!(thread::current().id(), self.owner);
+            // FDB cancellation can synchronously invoke this hook, including
+            // when the owner thread is destroying its executor registry.
+            poll_pending_tasks();
+            self.drops.lock().unwrap().push(thread::current().id());
+        }
+    }
+
+    #[test]
+    fn foreign_wakes_only_poll_and_drop_the_future_on_its_owner() {
+        let owner = thread::current().id();
+        let polls = Rc::new(Cell::new(0));
+        let drops = Arc::new(Mutex::new(Vec::new()));
+        let wakers = Arc::new(Mutex::new(Vec::new()));
+        let ready = Arc::new(AtomicBool::new(false));
+        fdb_spawn(LocalFuture {
+            owner,
+            polls: polls.clone(),
+            drops: drops.clone(),
+            wakers: wakers.clone(),
+            ready: ready.clone(),
+        });
+        let waker = wakers.lock().unwrap().pop().unwrap();
+        let other_waker = waker.clone();
+        ready.store(true, Ordering::Release);
+        let first = thread::spawn(move || {
+            waker.wake_by_ref();
+            waker.wake_by_ref();
+            waker.wake();
+            poll_pending_tasks();
+        });
+        let second = thread::spawn(move || {
+            other_waker.wake();
+            poll_pending_tasks();
+        });
+        first.join().unwrap();
+        second.join().unwrap();
+        assert_eq!(polls.get(), 1);
+        assert!(drops.lock().unwrap().is_empty());
+
+        poll_pending_tasks();
+        assert_eq!(polls.get(), 2);
+        assert_eq!(*drops.lock().unwrap(), [owner]);
+    }
+
+    #[test]
+    fn dropping_the_last_foreign_waker_cancels_on_the_owner() {
+        let owner = thread::current().id();
+        let polls = Rc::new(Cell::new(0));
+        let drops = Arc::new(Mutex::new(Vec::new()));
+        let wakers = Arc::new(Mutex::new(Vec::new()));
+        fdb_spawn(LocalFuture {
+            owner,
+            polls: polls.clone(),
+            drops: drops.clone(),
+            wakers: wakers.clone(),
+            ready: Arc::new(AtomicBool::new(false)),
+        });
+        let waker = wakers.lock().unwrap().pop().unwrap();
+        thread::spawn(move || {
+            drop(waker);
+            poll_pending_tasks();
+        })
+        .join()
+        .unwrap();
+        assert!(drops.lock().unwrap().is_empty());
+
+        poll_pending_tasks();
+        assert_eq!(polls.get(), 1);
+        assert_eq!(*drops.lock().unwrap(), [owner]);
+    }
+
+    #[test]
+    fn duplicate_and_reentrant_wakes_are_polled_after_the_current_poll() {
+        let polls = Rc::new(Cell::new(0));
+        let observed_polls = polls.clone();
+        fdb_spawn(poll_fn(move |cx| {
+            let count = observed_polls.get() + 1;
+            observed_polls.set(count);
+            if count == 1 {
+                cx.waker().wake_by_ref();
+                cx.waker().wake_by_ref();
+                poll_pending_tasks();
+                assert_eq!(observed_polls.get(), 1);
+                Poll::Pending
+            } else {
+                Poll::Ready(())
+            }
+        }));
+        assert_eq!(polls.get(), 2);
+    }
+
+    #[test]
+    fn spawning_during_a_poll_defers_the_child_until_the_parent_returns() {
+        let events = Rc::new(RefCell::new(Vec::new()));
+        let observed_events = events.clone();
+        fdb_spawn(async move {
+            observed_events.borrow_mut().push("parent enter");
+            let child_events = observed_events.clone();
+            fdb_spawn(async move {
+                child_events.borrow_mut().push("child");
+            });
+            observed_events.borrow_mut().push("parent exit");
+        });
+        assert_eq!(*events.borrow(), ["parent enter", "parent exit", "child"]);
+    }
+
+    #[test]
+    fn a_pending_future_without_a_waker_is_released() {
+        let held = Rc::new(());
+        let future_held = held.clone();
+        fdb_spawn(poll_fn(move |_| {
+            let _ = &future_held;
+            Poll::Pending
+        }));
+        assert_eq!(Rc::strong_count(&held), 1);
+    }
+
+    #[test]
+    fn completed_task_wakers_do_not_retain_or_repoll_its_future() {
+        let held = Rc::new(());
+        let future_held = held.clone();
+        let wakers = Arc::new(Mutex::new(Vec::new()));
+        let captured_wakers = wakers.clone();
+        fdb_spawn(poll_fn(move |cx| {
+            let _ = &future_held;
+            captured_wakers.lock().unwrap().push(cx.waker().clone());
+            Poll::Ready(())
+        }));
+        assert_eq!(Rc::strong_count(&held), 1);
+        let waker = wakers.lock().unwrap().pop().unwrap();
+        thread::spawn(move || waker.wake()).join().unwrap();
+        poll_pending_tasks();
+        assert_eq!(Rc::strong_count(&held), 1);
+    }
+
+    #[test]
+    fn owner_exit_releases_local_futures_while_foreign_wakers_remain_valid() {
+        let drops = Arc::new(Mutex::new(Vec::new()));
+        let observed_drops = drops.clone();
+        let (sender, receiver) = mpsc::channel();
+        let owner = thread::spawn(move || {
+            let owner = thread::current().id();
+            let wakers = Arc::new(Mutex::new(Vec::new()));
+            fdb_spawn(LocalFuture {
+                owner,
+                polls: Rc::new(Cell::new(0)),
+                drops: observed_drops,
+                wakers: wakers.clone(),
+                ready: Arc::new(AtomicBool::new(false)),
+            });
+            sender.send(wakers.lock().unwrap().pop().unwrap()).unwrap();
+            owner
+        })
+        .join()
+        .unwrap();
+        let waker = receiver.recv().unwrap();
+        assert_eq!(*drops.lock().unwrap(), [owner]);
+        waker.wake_by_ref();
+        drop(waker);
+        poll_pending_tasks();
+    }
 }
diff --git a/bindings/rust/foundationdb-simulation/src/lib.rs b/bindings/rust/foundationdb-simulation/src/lib.rs
index 7995d849282..a294852ac58 100644
--- a/bindings/rust/foundationdb-simulation/src/lib.rs
+++ b/bindings/rust/foundationdb-simulation/src/lib.rs
@@ -79,8 +79,8 @@ pub trait RustWorkload: Sized + 'static {
     ///
     /// # Arguments
     ///
-    /// * `out` - A metric sink
-    fn get_metrics(&self, out: Metrics);
+    /// * `out` - A metric sink borrowed for this callback
+    fn get_metrics(&self, out: Metrics<'_>);
 
     /// Set the check timeout in simulated seconds for this workload.
     fn get_check_timeout(&self) -> f64;
@@ -217,11 +217,11 @@ unsafe extern "C" fn workload_check<W: RustWorkload + 'static>(
 }
 unsafe extern "C" fn workload_get_metrics<W: RustWorkload>(
     raw_workload: *mut OpaqueWorkload,
-    raw_metrics: FDBMetrics,
+    mut raw_metrics: FDBMetrics,
 ) {
     unsafe {
         let workload = &*(raw_workload as *mut W);
-        let out = Metrics::new(raw_metrics);
+        let out = Metrics::new(&mut raw_metrics);
         workload.get_metrics(out);
         #[cfg(coverage)]
         write_coverage_profile();
diff --git a/bindings/rust/foundationdb/src/metrics.rs b/bindings/rust/foundationdb/src/metrics.rs
index 1ffde68d800..cfff995d42c 100644
--- a/bindings/rust/foundationdb/src/metrics.rs
+++ b/bindings/rust/foundationdb/src/metrics.rs
@@ -302,13 +302,29 @@ impl TransactionMetrics {
         }
     }
 
-    /// Records the time spent waiting on `get_read_version`, whatever its
-    /// result. Later calls of the same attempt are ignored.
-    pub(crate) fn record_grv(&self, duration: Duration) {
+    /// Records a GRV completion only while its issuing attempt is still open.
+    /// The first timing of that attempt is kept, even when the GRV failed.
+    pub(crate) fn record_grv(
+        &self,
+        usage: &Arc<AttemptUsage>,
+        duration: Duration,
+        version: Option<i64>,
+    ) {
         let mut open = self.open();
+        if !open
+            .usage
+            .as_ref()
+            .is_some_and(|current| Arc::ptr_eq(current, usage))
+        {
+            return;
+        }
         if open.grv_duration.is_none() {
             open.grv_duration = Some(duration);
         }
+        if let Some(version) = version {
+            open.read_version = Some(version);
+            self.report().transaction.read_version = Some(version);
+        }
     }
 
     /// Ends the current attempt and pushes it to the report.
@@ -532,8 +548,8 @@ mod tests {
         first.record_set(10);
         first.increment_custom(key.clone(), 1);
         metrics.record_commit(Duration::from_millis(3));
-        metrics.record_grv(Duration::from_millis(5));
-        metrics.record_grv(Duration::from_millis(1)); // first sample wins
+        metrics.record_grv(&first, Duration::from_millis(5), Some(42));
+        metrics.record_grv(&first, Duration::from_millis(1), Some(42)); // first sample wins
         metrics.finish_attempt(AttemptOutcome::Retried {
             cause: FdbError::from_code(1020),
         });
@@ -541,6 +557,7 @@ mod tests {
 
         let second = Arc::new(AttemptUsage::new());
         metrics.begin_attempt(second.clone());
+        metrics.record_grv(&first, Duration::from_millis(20), Some(43));
         second.record_set(4);
         second.increment_custom(key.clone(), 2);
         metrics.finish_attempt(AttemptOutcome::Committed);
@@ -551,6 +568,7 @@ mod tests {
         let report = metrics.get_metrics_data();
         assert_eq!(report.attempts.len(), 2);
         assert_eq!(report.transaction.retries, 1);
+        assert_eq!(report.transaction.read_version, Some(42));
 
         let first = &report.attempts[0];
         assert_eq!(first.index, 0);
@@ -570,6 +588,7 @@ mod tests {
         assert_eq!(second.custom_metrics.get(&key), Some(&2));
         assert!(second.commit_duration.is_none());
         assert!(second.grv_duration.is_none());
+        assert!(second.read_version.is_none());
         assert!(matches!(second.outcome, AttemptOutcome::Committed));
 
         assert_eq!(report.total_usage().bytes_written, 14);
diff --git a/bindings/rust/foundationdb/src/transaction.rs b/bindings/rust/foundationdb/src/transaction.rs
index 63b871bcd35..0c54cc036b9 100644
--- a/bindings/rust/foundationdb/src/transaction.rs
+++ b/bindings/rust/foundationdb/src/transaction.rs
@@ -1651,13 +1651,14 @@ impl Transaction {
     /// reported committed before that call.
     ///
     /// On an instrumented transaction, the version is recorded in the metrics of
-    /// the current attempt. It is only ever recorded when this method is called:
-    /// the binding never fetches a read version on its own.
+    /// the issuing attempt. A future polled after that attempt ends does not
+    /// update the report. The binding never fetches a read version on its own.
     pub fn get_read_version(
         &self,
     ) -> impl Future<Output = FdbResult<i64>> + Send + Sync + Unpin + use<> {
-        let metrics = self.metrics().cloned();
-        let started_at = metrics.as_ref().map(|_| Instant::now());
+        let recording = self
+            .metrics()
+            .map(|metrics| (metrics.clone(), self.usage(), Instant::now()));
 
         unsafe {
             FdbFuture::<i64>::new(fdb_sys::fdb_transaction_get_read_version(
@@ -1665,11 +1666,8 @@ impl Transaction {
             ))
         }
         .map(move |result| {
-            if let (Some(metrics), Some(started_at)) = (&metrics, started_at) {
-                metrics.record_grv(started_at.elapsed());
-                if let Ok(version) = result {
-                    metrics.set_read_version(version);
-                }
+            if let Some((metrics, usage, started_at)) = recording {
+                metrics.record_grv(&usage, started_at.elapsed(), result.as_ref().ok().copied());
             }
             result
         })
diff --git a/bindings/rust/foundationdb/tests/metrics.rs b/bindings/rust/foundationdb/tests/metrics.rs
index 0cb22c34268..e5b51e604f6 100644
--- a/bindings/rust/foundationdb/tests/metrics.rs
+++ b/bindings/rust/foundationdb/tests/metrics.rs
@@ -1,5 +1,5 @@
 use foundationdb::metrics::{AttemptOutcome, MetricKey, TransactionMetrics};
-use foundationdb::runner::MetricsHooks;
+use foundationdb::runner::{MetricsHooks, RunnerHooks};
 use foundationdb::*;
 mod common;
 use std::borrow::Cow;
@@ -389,6 +389,42 @@ async fn test_transaction_info() -> FdbResult<()> {
     Ok(())
 }
 
+/// Completed native GRVs can be polled after the transaction has entered a new
+/// attempt. Their results remain usable, but must not populate its metrics.
+#[tokio::test]
+async fn retained_grv_does_not_record_into_a_later_attempt() -> FdbResult<()> {
+    let db = common::database().await?;
+
+    for retry in [false, true] {
+        let metrics = TransactionMetrics::new();
+        let hooks = MetricsHooks::new(&metrics);
+        let mut txn = db.create_trx()?;
+        hooks.on_attempt_start(&txn, 0);
+
+        let retained = txn.get_read_version();
+        // Both calls share the transaction's read version. Awaiting the second
+        // makes the first native result ready without polling its Rust wrapper.
+        let original_version = txn.get_read_version().await?;
+
+        if retry {
+            txn = txn.on_error(FdbError::from_code(1020)).await?;
+        } else {
+            txn.reset();
+        }
+        assert_eq!(retained.await?, original_version);
+        txn.commit().await.expect("empty attempt should commit");
+
+        let report = metrics.get_metrics_data();
+        assert_eq!(report.attempts.len(), if retry { 2 } else { 1 });
+        let current = report.last_attempt().expect("the new attempt was recorded");
+        assert!(current.grv_duration.is_none());
+        assert!(current.read_version.is_none());
+        assert_eq!(report.transaction.read_version, Some(original_version));
+    }
+
+    Ok(())
+}
+
 /// Setting a client budget mid-attempt starts a fresh accounting generation,
 /// and the attempt being recorded goes with it: only what happens after the call
 /// is reported.

From 612174c47b390b3408a9bd5067e5db5caf8dad26 Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Wed, 30 Sep 2026 20:34:14 -0700
Subject: [PATCH 06/11] Fix Rust simulator native input and wake safety

---
 bindings/rust/CMakeLists.txt                  |  15 +-
 bindings/rust/CONTRIBUTING.md                 |   5 +-
 bindings/rust/Cargo.lock                      |  57 ++++++
 bindings/rust/README.md                       |   2 +
 bindings/rust/UPSTREAM.md                     |   6 +
 .../rust/foundationdb-simulation/Cargo.toml   |   1 +
 .../rust/foundationdb-simulation/build.rs     |   1 +
 .../foundationdb-simulation/docs/fdb_rt.md    |   4 +
 .../foundationdb-simulation/src/bindings.rs   | 185 +++++++++++++++++-
 .../foundationdb-simulation/src/fdb_rt.rs     |  94 +++++++--
 bindings/rust/foundationdb/src/runner.rs      |  12 +-
 11 files changed, 359 insertions(+), 23 deletions(-)

diff --git a/bindings/rust/CMakeLists.txt b/bindings/rust/CMakeLists.txt
index 0e9e8bdb9ed..5d5174d4077 100644
--- a/bindings/rust/CMakeLists.txt
+++ b/bindings/rust/CMakeLists.txt
@@ -102,7 +102,7 @@ add_test(NAME rust_future_safety_tests
   COMMAND_EXPAND_LISTS)
 set_tests_properties(rust_future_safety_tests PROPERTIES TIMEOUT 300 LABELS "rust")
 
-foreach(symbol str_from_c WorkloadContext::new register_workload_context WrappedWorkload Metrics)
+foreach(symbol str_from_c WorkloadContext::new WorkloadContext::set_process_id register_workload_context WrappedWorkload Metrics)
   string(REPLACE "::" "_" test_suffix ${symbol})
   add_test(NAME rust_simulation_${test_suffix}_safety_tests
     COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
@@ -115,6 +115,19 @@ foreach(symbol str_from_c WorkloadContext::new register_workload_context Wrapped
     TIMEOUT 300 LABELS "rust")
 endforeach()
 
+add_test(NAME rust_simulation_wake_order_tests
+  COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+    "RUSTFLAGS=$ENV{RUSTFLAGS} --cfg fdb_simulation_loom"
+    CARGO_TARGET_DIR=${rust_target_dir}-loom
+    ${CARGO_EXECUTABLE} test ${rust_cargo_base_args}
+    --features foundationdb-simulation/fdb-7_4
+    --package foundationdb-simulation --lib --offline
+    fdb_rt::loom_tests::coalesced_wake_publishes_before_poll -- --exact
+  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+  COMMAND_EXPAND_LISTS)
+set_tests_properties(rust_simulation_wake_order_tests PROPERTIES
+  TIMEOUT 300 LABELS "rust")
+
 if(RUN_RUST_INTEGRATION_TESTS)
   add_custom_target(fdb_rust_integration_tests ALL
     COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
diff --git a/bindings/rust/CONTRIBUTING.md b/bindings/rust/CONTRIBUTING.md
index 7cc8cad4f79..a4f7ea3957b 100644
--- a/bindings/rust/CONTRIBUTING.md
+++ b/bindings/rust/CONTRIBUTING.md
@@ -57,7 +57,10 @@ for comparison with Python. Tuple tests and macro tests do not need a cluster.
 
 `rust_unit_tests` also checks simulation context and metrics callbacks, executor
 wakeups, and thread ownership. The simulation safety doctests check that borrowed
-metrics sinks cannot escape their callback. These checks do not start the simulator;
+metrics sinks cannot escape their callback and process switching requires `unsafe`.
+`rust_simulation_wake_order_tests` uses Loom to explore weak-memory interleavings of
+the executor's wake and dequeue code. Its separate Cargo target directory keeps
+model synchronization out of normal builds. These checks do not start the simulator;
 workload execution is a separate check against a compatible server.
 
 The simulation crates and their scripts are retained for focused simulator work;
diff --git a/bindings/rust/Cargo.lock b/bindings/rust/Cargo.lock
index f47ce5f71b7..030495abc04 100644
--- a/bindings/rust/Cargo.lock
+++ b/bindings/rust/Cargo.lock
@@ -366,6 +366,7 @@ dependencies = [
  "foundationdb",
  "foundationdb-sys",
  "futures-util",
+ "loom",
 ]
 
 [[package]]
@@ -484,6 +485,21 @@ dependencies = [
  "slab",
 ]
 
+[[package]]
+name = "generator"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54ade96dc9003043bce7c035c85a9df5a858bfb2039c5a2e6fdf00f324f6c551"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "log",
+ "rustversion",
+ "windows-link",
+ "windows-result",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.4.3"
@@ -565,6 +581,28 @@ version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
+[[package]]
+name = "loom"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
+dependencies = [
+ "cfg-if",
+ "generator",
+ "scoped-tls",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -777,6 +815,12 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -975,10 +1019,14 @@ version = "0.3.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
 dependencies = [
+ "matchers",
  "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
  "sharded-slab",
  "smallvec",
  "thread_local",
+ "tracing",
  "tracing-core",
  "tracing-log",
 ]
@@ -1081,6 +1129,15 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
diff --git a/bindings/rust/README.md b/bindings/rust/README.md
index 4402cb074e9..3924eec27d8 100644
--- a/bindings/rust/README.md
+++ b/bindings/rust/README.md
@@ -43,6 +43,8 @@ documented in [UPSTREAM.md](UPSTREAM.md): raw-pointer ownership requires `unsafe
 integer options take `i64` to cover the C API's full range, and simulation workload
 wrappers enforce context lifetime and thread access. Simulation metrics sinks are
 borrowed for their callback, and executor futures stay on their creating thread.
+Process switching requires an unsafe call, and custom metric formats are checked
+before they reach the native formatter.
 Crate versions are independent of the FoundationDB server release number. Published crates on
 crates.io are separate releases; importing the source does not publish or transfer
 ownership of them.
diff --git a/bindings/rust/UPSTREAM.md b/bindings/rust/UPSTREAM.md
index c4e5b65b043..4bc76160cd6 100644
--- a/bindings/rust/UPSTREAM.md
+++ b/bindings/rust/UPSTREAM.md
@@ -38,3 +38,9 @@ The in-tree adaptation also corrects public API contracts from this snapshot:
   workload is released.
 - `Metrics<'_>` borrows its native sink for one `get_metrics` callback. A workload
   cannot retain the sink after returning; collect owned metric values instead.
+- `WorkloadContext::set_process_id` is unsafe: its integer argument represents a
+  native process pointer and must satisfy the documented lifetime and restoration
+  requirements.
+- Custom metric formats are checked before reaching native formatting. They must
+  contain exactly one floating-point conversion without argument-supplied width,
+  precision, positional arguments, or length modifiers; invalid formats panic.
diff --git a/bindings/rust/foundationdb-simulation/Cargo.toml b/bindings/rust/foundationdb-simulation/Cargo.toml
index 301c5ca6d24..4ff290509cd 100644
--- a/bindings/rust/foundationdb-simulation/Cargo.toml
+++ b/bindings/rust/foundationdb-simulation/Cargo.toml
@@ -28,6 +28,7 @@ bindgen = "0.73.2"
 
 [dev-dependencies]
 futures-util = "0.3.32"
+loom = "0.7.2"
 
 [features]
 default = ["embedded-fdb-include"]
diff --git a/bindings/rust/foundationdb-simulation/build.rs b/bindings/rust/foundationdb-simulation/build.rs
index 513e55a7a40..d7ddac337d0 100644
--- a/bindings/rust/foundationdb-simulation/build.rs
+++ b/bindings/rust/foundationdb-simulation/build.rs
@@ -4,6 +4,7 @@ extern crate cc;
 
 fn main() {
     println!("cargo:rustc-check-cfg=cfg(coverage)");
+    println!("cargo:rustc-check-cfg=cfg(fdb_simulation_loom)");
 
     let bindings = bindgen::Builder::default()
         .header("src/headers/CWorkload.h")
diff --git a/bindings/rust/foundationdb-simulation/docs/fdb_rt.md b/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
index 9c3fe96ded6..64a428e3e7f 100644
--- a/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
+++ b/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
@@ -18,6 +18,10 @@ are coalesced. The queue holds the notification state alive until it is consumed
 even a consuming `Waker::wake()` schedules a poll before releasing the final waker.
 Waking never polls the future directly.
 
+Before polling, the owner acquires the queued flag while clearing it. A coalesced
+wake does not take the queue lock, so this acquire makes its producer's writes
+visible to the poll even when no second notification was enqueued.
+
 `fdb_spawn` inserts a future into the current thread's registry, queues its first poll,
 and calls `poll_pending_tasks`. The drain removes each future from the registry while
 polling it and restores it only if it returns `Pending`. No queue lock or registry borrow
diff --git a/bindings/rust/foundationdb-simulation/src/bindings.rs b/bindings/rust/foundationdb-simulation/src/bindings.rs
index 1a46b06a17e..ccfb23060f5 100644
--- a/bindings/rust/foundationdb-simulation/src/bindings.rs
+++ b/bindings/rust/foundationdb-simulation/src/bindings.rs
@@ -170,7 +170,13 @@ pub struct Metric<'a> {
     pub val: f64,
     /// Indicates if the value represents an average or not
     pub avg: bool,
-    /// C++ string formatter of the metric
+    /// C `printf` format for one `double`, defaulting to `%.3g`.
+    ///
+    /// Supported formats contain exactly one `a`, `A`, `e`, `E`, `f`, `F`, `g`,
+    /// or `G` conversion, with optional `-`, `+`, space, `#`, and `0` flags and
+    /// decimal width and precision no greater than `i32::MAX`. Literal text and
+    /// `%%` are allowed. Length modifiers, positional arguments, `*`, and other
+    /// conversions are rejected by [`Metrics::push`] before entering native code.
     pub fmt: Option<&'a str>,
 }
 
@@ -335,8 +341,23 @@ impl WorkloadContext {
     pub fn get_process_id(&self) -> u64 {
         with! { self.raw() => getProcessID() }
     }
-    /// Set the process id of the workload
-    pub fn set_process_id(&self, id: u64) {
+    /// Switch the simulator's current process using a native process handle.
+    ///
+    /// # Safety
+    /// During simulation, `id` must be an unchanged handle previously obtained
+    /// from [`Self::get_process_id`] in the same simulator instance, and its
+    /// native process must remain alive while selected. It is a pointer-valued
+    /// handle, not an arbitrary numeric process identifier. The caller must
+    /// ensure intervening operations are valid for that process and restore the
+    /// previous process before yielding, returning, or unwinding.
+    ///
+    /// ```compile_fail,E0133
+    /// use foundationdb_simulation::WorkloadContext;
+    /// fn change_process(context: &WorkloadContext) {
+    ///     context.set_process_id(1);
+    /// }
+    /// ```
+    pub unsafe fn set_process_id(&self, id: u64) {
         with! { self.raw() => setProcessID(id) }
     }
     /// Get the current simulated time in seconds (starts at zero)
@@ -410,6 +431,65 @@ impl Drop for Promise {
     }
 }
 
+// Native metric formatting passes exactly one double to printf. Keep this
+// grammar narrow so neither the conversion nor width/precision consumes a
+// differently typed or additional variadic argument.
+fn valid_metric_format(format: &str) -> bool {
+    fn decimal(input: &mut &[u8]) -> bool {
+        let mut value = 0_i32;
+        while let Some((&digit, rest)) = input.split_first() {
+            if !digit.is_ascii_digit() {
+                break;
+            }
+            let Some(next) = value
+                .checked_mul(10)
+                .and_then(|value| value.checked_add(i32::from(digit - b'0')))
+            else {
+                return false;
+            };
+            value = next;
+            *input = rest;
+        }
+        true
+    }
+
+    let mut input = format.as_bytes();
+    let mut conversion = false;
+    while let Some((&byte, rest)) = input.split_first() {
+        input = rest;
+        if byte != b'%' {
+            continue;
+        }
+        if input.first() == Some(&b'%') {
+            input = &input[1..];
+            continue;
+        }
+        if conversion {
+            return false;
+        }
+        while matches!(input.first(), Some(b'-' | b'+' | b' ' | b'#' | b'0')) {
+            input = &input[1..];
+        }
+        if !decimal(&mut input) {
+            return false;
+        }
+        if input.first() == Some(&b'.') {
+            input = &input[1..];
+            if !decimal(&mut input) {
+                return false;
+            }
+        }
+        match input.split_first() {
+            Some((b'a' | b'A' | b'e' | b'E' | b'f' | b'F' | b'g' | b'G', rest)) => {
+                conversion = true;
+                input = rest;
+            }
+            _ => return false,
+        }
+    }
+    conversion
+}
+
 impl<'callback> Metrics<'callback> {
     pub(crate) fn new(raw: &'callback mut FDBMetrics) -> Self {
         Self(raw)
@@ -418,10 +498,19 @@ impl<'callback> Metrics<'callback> {
     pub fn reserve(&mut self, n: usize) {
         with! { &*self.0 => reserve(n as i32) }
     }
-    /// Push a [Metric] entry in the underlying C++ sink
+    /// Push a [Metric] entry in the underlying C++ sink.
+    ///
+    /// # Panics
+    /// Panics before calling the native sink if [`Metric::fmt`] does not follow
+    /// its supported single-double format grammar.
     pub fn push(&mut self, metric: Metric) {
+        let format = metric.fmt.unwrap_or("%.3g");
+        assert!(
+            valid_metric_format(format),
+            "invalid metric format: {format:?}"
+        );
         let key_storage = str_for_c(metric.key);
-        let fmt_storage = str_for_c(metric.fmt.unwrap_or("%.3g"));
+        let fmt_storage = str_for_c(format);
         with! {
             &*self.0 => push(FDBMetric {
                 key: key_storage.as_ptr(),
@@ -656,6 +745,92 @@ mod tests {
         );
     }
 
+    #[test]
+    fn metrics_reject_unsafe_formats_before_calling_the_native_sink() {
+        let mut sink = NativeMetrics::default();
+        let mut metrics_vt = FDBMetrics_FDBMetrics_VT {
+            reserve: Some(reserve_metrics),
+            push: Some(push_metric),
+        };
+        let mut raw_metrics = FDBMetrics {
+            inner: &mut sink as *mut NativeMetrics as *mut _,
+            vt: &mut metrics_vt,
+        };
+
+        for format in [
+            None,
+            Some("%a"),
+            Some("%A"),
+            Some("%e"),
+            Some("%E"),
+            Some("%f"),
+            Some("%F"),
+            Some("%g"),
+            Some("%G"),
+            Some("%.0f"),
+            Some("load=%-+#010.3f%%"),
+            Some("% .f"),
+            Some("%% latency %.6g ms %%"),
+        ] {
+            super::Metrics::new(&mut raw_metrics).push(Metric {
+                key: "value",
+                val: 1.25,
+                avg: false,
+                fmt: format,
+            });
+            assert_eq!(
+                sink.entries.last(),
+                Some(&("value".into(), 1.25, false, format.unwrap_or("%.3g").into(),)),
+            );
+        }
+
+        let forwarded = sink.entries.len();
+        for format in [
+            "",
+            "value %%",
+            "%n",
+            "%s",
+            "%d",
+            "%c",
+            "%p",
+            "%Lf",
+            "%lf",
+            "%llf",
+            "%hf",
+            "%zf",
+            "%jf",
+            "%tf",
+            "%1$f",
+            "%1$.*2$f",
+            "%*f",
+            "%.*f",
+            "%*.*f",
+            "%f %g",
+            "%f %n",
+            "%f%",
+            "%",
+            "%.",
+            "%.2",
+            "%.2.3f",
+            "%2147483648f",
+            "%.2147483648f",
+            "%99999999999999999999999g",
+            "%g\0%n",
+        ] {
+            // Catch on the Rust side: a panic must never cross the C callback.
+            let rejected = catch_unwind(AssertUnwindSafe(|| {
+                super::Metrics::new(&mut raw_metrics).push(Metric {
+                    key: "rejected",
+                    val: 1.25,
+                    avg: false,
+                    fmt: Some(format),
+                });
+            }));
+            assert!(rejected.is_err(), "accepted {format:?}");
+            assert_eq!(sink.entries.len(), forwarded, "forwarded {format:?}");
+        }
+    }
+
     #[test]
     fn environment_rejects_access_after_registered_workload_release() {
         let calls = Arc::new(AtomicUsize::new(0));
diff --git a/bindings/rust/foundationdb-simulation/src/fdb_rt.rs b/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
index 572a788a349..9cd2a818f69 100644
--- a/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
+++ b/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
@@ -10,13 +10,15 @@ use std::{
     collections::{BTreeMap, VecDeque},
     future::Future,
     pin::Pin,
-    sync::{
-        Arc, Mutex, Weak,
-        atomic::{AtomicBool, Ordering},
-    },
+    sync::{Arc, Weak, atomic::Ordering},
     task::{Context, Wake, Waker},
 };
 
+#[cfg(all(test, fdb_simulation_loom))]
+use loom::sync::{Mutex, atomic::AtomicBool};
+#[cfg(not(all(test, fdb_simulation_loom)))]
+use std::sync::{Mutex, atomic::AtomicBool};
+
 type TaskId = usize;
 type Task = Pin<Box<dyn Future<Output = ()>>>;
 type Queue = Mutex<VecDeque<Notification>>;
@@ -73,6 +75,19 @@ impl Drop for TaskWaker {
     }
 }
 
+fn next_notification(queue: &Queue) -> Option<Notification> {
+    let notification = queue
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner())
+        .pop_front();
+    if let Some(Notification::Ready(waker)) = &notification {
+        // Coalesced wakes skip the queue lock. Acquire their publication before
+        // polling; a later wake sees false and queues another notification.
+        waker.queued.swap(false, Ordering::AcqRel);
+    }
+    notification
+}
+
 struct PollingGuard;
 
 impl Drop for PollingGuard {
@@ -97,18 +112,13 @@ pub fn poll_pending_tasks() {
     };
     let _guard = PollingGuard;
     loop {
-        let notification = queue
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .pop_front();
-        let Some(notification) = notification else {
+        let Some(notification) = next_notification(&queue) else {
             return;
         };
         // Neither the queue lock nor the registry borrow may span user polling
         // or destruction: either can synchronously wake or spawn another task.
         match notification {
             Notification::Ready(notification) => {
-                notification.queued.store(false, Ordering::Release);
                 let id = notification.id;
                 let future = EXECUTOR.with_borrow_mut(|executor| executor.tasks.remove(&id));
                 if let Some(mut future) = future {
@@ -148,7 +158,7 @@ where
     poll_pending_tasks();
 }
 
-#[cfg(test)]
+#[cfg(all(test, not(fdb_simulation_loom)))]
 mod tests {
     use super::*;
     use std::{
@@ -347,3 +357,65 @@ mod tests {
         poll_pending_tasks();
     }
 }
+
+#[cfg(all(test, fdb_simulation_loom))]
+mod loom_tests {
+    use super::*;
+    use std::{future::poll_fn, task::Poll};
+
+    #[test]
+    fn coalesced_wake_publishes_before_poll() {
+        loom::model(|| {
+            let queue = Arc::new(Queue::default());
+            let notification = Arc::new(TaskWaker {
+                id: 0,
+                queue: Arc::downgrade(&queue),
+                queued: AtomicBool::new(false),
+            });
+            let retained_waker = Waker::from(notification.clone());
+            retained_waker.wake_by_ref();
+
+            let ready = Arc::new(AtomicBool::new(false));
+            let wake_done = Arc::new(AtomicBool::new(false));
+            let producer_ready = ready.clone();
+            let producer_done = wake_done.clone();
+            let producer_waker = retained_waker.clone();
+            let producer = loom::thread::spawn(move || {
+                producer_ready.store(true, Ordering::Relaxed);
+                producer_waker.wake_by_ref();
+                producer_done.store(true, Ordering::Relaxed);
+            });
+
+            // Schedule the second wake while the first is still queued, without
+            // acquiring its writes through a join, channel, or readiness flag.
+            while !wake_done.load(Ordering::Relaxed) {
+                loom::thread::yield_now();
+            }
+            let Some(Notification::Ready(waker)) = next_notification(&queue) else {
+                panic!("expected the queued wake");
+            };
+            let waker = Waker::from(waker);
+            let mut future = std::pin::pin!(poll_fn(|_| {
+                if ready.load(Ordering::Relaxed) {
+                    Poll::Ready(())
+                } else {
+                    Poll::Pending
+                }
+            }));
+            assert!(
+                future
+                    .as_mut()
+                    .poll(&mut Context::from_waker(&waker))
+                    .is_ready(),
+                "the coalesced wake must publish readiness before polling"
+            );
+            producer.join().unwrap();
+
+            // std Arc/Waker preserve the real Wake implementation. These
+            // retained references prevent final-drop synchronization from
+            // supplying the acquire that the queue must provide itself.
+            drop(retained_waker);
+            drop(notification);
+        });
+    }
+}
diff --git a/bindings/rust/foundationdb/src/runner.rs b/bindings/rust/foundationdb/src/runner.rs
index 5ed22d528c0..d2299940ace 100644
--- a/bindings/rust/foundationdb/src/runner.rs
+++ b/bindings/rust/foundationdb/src/runner.rs
@@ -87,8 +87,9 @@ const NOT_COMMITTED: i32 = 1020;
 ///    [`on_error_duration`](Self::on_error_duration) and
 ///    [`on_retry`](Self::on_retry) if the transaction was retried
 ///
-/// [`on_complete`](Self::on_complete) fires exactly once per run, on **every**
-/// exit path: success, non-retryable error, exhausted retries or binding error.
+/// [`on_complete`](Self::on_complete) fires exactly once when the run returns:
+/// success, non-retryable error, exhausted retries or binding error. Canceling a
+/// run by dropping its future does not invoke this hook.
 ///
 /// The two fallible hooks ([`before_commit`](Self::before_commit) and
 /// [`on_commit_error`](Self::on_commit_error)) never abort the runner: their
@@ -170,7 +171,8 @@ pub trait RunnerHooks {
     /// accepted to retry it.
     fn on_retry(&self, _attempt: usize) {}
 
-    /// Called exactly once when the run ends, whatever its outcome.
+    /// Called exactly once when the run returns, whatever its outcome.
+    /// Dropping the run's future before it returns does not invoke this hook.
     fn on_complete(&self) {}
 }
 
@@ -600,7 +602,7 @@ where
 /// [`run_attempt`].
 ///
 /// Wrapped by [`run_with_hooks`], which owns firing
-/// [`RunnerHooks::on_complete`] on every exit path.
+/// [`RunnerHooks::on_complete`] when the run returns.
 async fn retry_loop<F, Fut, T, E, H, P>(
     initial_transaction: RetryableTransaction,
     hooks: &H,
@@ -742,7 +744,7 @@ where
 }
 
 /// The retry runner: [`retry_loop`] plus the guarantee that
-/// [`RunnerHooks::on_complete`] fires exactly once.
+/// [`RunnerHooks::on_complete`] fires exactly once when the run returns.
 #[cfg_attr(
     feature = "trace",
     tracing::instrument(level = "debug", skip(initial_transaction, hooks, policy, closure))

From be99a8c8344254e7b064dad39db1c261dbfd42c1 Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Wed, 30 Sep 2026 21:12:22 -0700
Subject: [PATCH 07/11] Fix Rust phase ownership and client compatibility

---
 bindings/rust/CONTRIBUTING.md                 |   5 +-
 bindings/rust/README.md                       |   7 +
 bindings/rust/UPSTREAM.md                     |   8 +
 .../rust/foundationdb-simulation/README.md    |  13 +
 .../foundationdb-simulation/docs/fdb_rt.md    |  23 +-
 .../foundationdb-simulation/src/bindings.rs   | 395 ++++++++++++++++++
 .../foundationdb-simulation/src/fdb_rt.rs     |  47 ++-
 .../rust/foundationdb-simulation/src/lib.rs   | 258 +++++++++---
 bindings/rust/foundationdb-tuple/src/lib.rs   |   3 +
 bindings/rust/foundationdb-tuple/src/pack.rs  |   8 +-
 .../rust/foundationdb-tuple/src/subspace.rs   |   3 +
 bindings/rust/foundationdb/src/api.rs         |  10 +
 bindings/rust/foundationdb/src/timekeeper.rs  |  17 +-
 bindings/rust/foundationdb/src/transaction.rs |  17 +
 .../rust/foundationdb/tests/timekeeper.rs     |  33 ++
 .../rust/foundationdb/tests/versionstamp.rs   | 136 ++++++
 16 files changed, 913 insertions(+), 70 deletions(-)
 create mode 100644 bindings/rust/foundationdb/tests/versionstamp.rs

diff --git a/bindings/rust/CONTRIBUTING.md b/bindings/rust/CONTRIBUTING.md
index a4f7ea3957b..1e4b9e0941c 100644
--- a/bindings/rust/CONTRIBUTING.md
+++ b/bindings/rust/CONTRIBUTING.md
@@ -56,7 +56,10 @@ Use the in-tree [binding tester instructions](foundationdb-bindingtester/README.
 for comparison with Python. Tuple tests and macro tests do not need a cluster.
 
 `rust_unit_tests` also checks simulation context and metrics callbacks, executor
-wakeups, and thread ownership. The simulation safety doctests check that borrowed
+wakeups, thread ownership, and phase teardown through native workload callbacks.
+Client integration tests check timekeeper read-error propagation and versionstamp
+behavior in separate processes selecting runtime APIs 510, 520, and 740.
+The simulation safety doctests check that borrowed
 metrics sinks cannot escape their callback and process switching requires `unsafe`.
 `rust_simulation_wake_order_tests` uses Loom to explore weak-memory interleavings of
 the executor's wake and dequeue code. Its separate Cargo target directory keeps
diff --git a/bindings/rust/README.md b/bindings/rust/README.md
index 3924eec27d8..31b3f6eb8db 100644
--- a/bindings/rust/README.md
+++ b/bindings/rust/README.md
@@ -43,6 +43,8 @@ documented in [UPSTREAM.md](UPSTREAM.md): raw-pointer ownership requires `unsafe
 integer options take `i64` to cover the C API's full range, and simulation workload
 wrappers enforce context lifetime and thread access. Simulation metrics sinks are
 borrowed for their callback, and executor futures stay on their creating thread.
+Freeing a simulation workload cancels its suspended phase before releasing the
+workload or context. Phase database handles remain owned by the native caller.
 Process switching requires an unsafe call, and custom metric formats are checked
 before they reach the native formatter.
 Crate versions are independent of the FoundationDB server release number. Published crates on
@@ -59,6 +61,11 @@ also not supported by the Rust binding tester, and its scripted suite is skipped
 because it requires API 800. Additional wrappers and API-version support can be
 developed separately.
 
+Versionstamped key and value mutations require runtime API 520 or later. With
+API 510, these mutations panic before reaching the C client; other supported
+API 510 operations remain available. Tuple versionstamp helpers use the modern
+four-byte offset encoding.
+
 The client follows the same transaction, retry, key-selector, tuple, and directory
 protocols as the other bindings, expressed through Rust futures and ownership.
 The [binding tester](foundationdb-bindingtester/README.md) exercises protocol
diff --git a/bindings/rust/UPSTREAM.md b/bindings/rust/UPSTREAM.md
index 4bc76160cd6..fbf199c2d48 100644
--- a/bindings/rust/UPSTREAM.md
+++ b/bindings/rust/UPSTREAM.md
@@ -44,3 +44,11 @@ The in-tree adaptation also corrects public API contracts from this snapshot:
 - Custom metric formats are checked before reaching native formatting. They must
   contain exactly one floating-point conversion without argument-supplied width,
   precision, positional arguments, or length modifiers; invalid formats panic.
+- Simulation phases own their suspended workload and are cancelled before native
+  workload teardown. Borrowed database handles are disarmed on completion and
+  cancellation; all Rust references must be dropped before either path finishes.
+- Versionstamped mutations require runtime API 520 or later. Earlier runtime
+  versions panic before issuing either mutation because their key and value
+  encodings differ from the tuple helpers' modern encoding.
+- Timekeeper range-read errors propagate to the caller's retry loop. `None` means
+  a successful read found no matching entry.
diff --git a/bindings/rust/foundationdb-simulation/README.md b/bindings/rust/foundationdb-simulation/README.md
index 0ad421e17d7..f76ba0e2c12 100644
--- a/bindings/rust/foundationdb-simulation/README.md
+++ b/bindings/rust/foundationdb-simulation/README.md
@@ -264,6 +264,19 @@ steps, allowing the `fdbserver` to drive simulation events between awaits.
 - All foundationdb-rs async operations are compatible with this model.
 - Avoid using arbitrary async primitives from other crates (e.g., `tokio::sleep`).
 
+If the native tester releases the workload while a phase is suspended, its task is canceled
+before the workload is destroyed. Final metrics collection or a new phase also cancels a
+phase left pending after the tester abandoned its native waiter. Late wakes cannot restart
+it. Timeout queries during `check` use the value sampled just before that phase began.
+Phase futures and workload destructors still have a live context during this teardown. A native callback must not free
+a workload reentrantly while its user phase is actively being polled.
+
+`SimDatabase` is a borrowed native database represented by a Rust `Arc`. The phase guard
+releases the Rust allocation on completion and cancellation without releasing the native
+caller's database reference. Every strong and weak `SimDatabase` reference must be dropped
+by the end of the phase, including cancellation. Retaining one terminates the process before
+it can outlive the borrowed native handle.
+
 ## Reporting Metrics
 
 At the end of the simulation, the `get_metrics` method is called for each client.
diff --git a/bindings/rust/foundationdb-simulation/docs/fdb_rt.md b/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
index 64a428e3e7f..277f7f7e923 100644
--- a/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
+++ b/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
@@ -22,8 +22,8 @@ Before polling, the owner acquires the queued flag while clearing it. A coalesce
 wake does not take the queue lock, so this acquire makes its producer's writes
 visible to the poll even when no second notification was enqueued.
 
-`fdb_spawn` inserts a future into the current thread's registry, queues its first poll,
-and calls `poll_pending_tasks`. The drain removes each future from the registry while
+`enqueue` inserts a future into the current thread's registry and queues its first poll.
+The workload owner records its task ID before calling `poll_pending_tasks`. The drain removes each future from the registry while
 polling it and restores it only if it returns `Pending`. No queue lock or registry borrow
 spans user polling or destruction. A thread-local guard defers nested drains, including
 synchronous FoundationDB callbacks, until the current poll has returned. Tasks spawned
@@ -58,6 +58,25 @@ This executor is not a general-purpose cross-thread event loop.
 
 ## Completion and cancellation
 
+The native workload owns its pending phase task. Releasing the workload synchronously
+removes and drops that task before dropping the user workload and invalidating the native
+context. Task destruction defers nested executor drains. The phase owns its workload while
+suspended and returns it before releasing its promise, including on cancellation. A timeout
+query during `check` uses the value sampled immediately before that phase began, avoiding
+aliasing its exclusive workload borrow; idle queries call the workload getter normally.
+A final metrics callback or new phase first cancels any task left behind by an abandoned
+native waiter. That cancellation retains only a weak workload reference: if releasing the
+old promise frees the native workload reentrantly, its destructor still runs with a live
+context and the incoming callback does not access the released workload. Resolving
+or releasing that promise can synchronously call native teardown, so no phase borrow or
+extra workload owner survives the callback. Native teardown during an actual user poll is
+an ABI violation and fails closed; Rust cannot synchronously destroy an executing future.
+
+A phase database is borrowed from the native caller. A guard retains its last Rust `Arc`
+until the user future is destroyed, then frees the Rust allocation without calling the
+native database destructor. Strong or weak database references that escape completion or
+cancellation terminate the process before the native pointer can be used after its lifetime.
+
 A completed future is destroyed on its owner even if external wakers still exist. Later
 wakes for its task ID are harmless. If a pending future loses its final waker without
 being woken, the waker's destructor queues cancellation. The owner drops that future on
diff --git a/bindings/rust/foundationdb-simulation/src/bindings.rs b/bindings/rust/foundationdb-simulation/src/bindings.rs
index ccfb23060f5..5b6974a38c9 100644
--- a/bindings/rust/foundationdb-simulation/src/bindings.rs
+++ b/bindings/rust/foundationdb-simulation/src/bindings.rs
@@ -831,6 +831,401 @@ mod tests {
         }
     }
 
+    #[cfg(not(fdb_simulation_loom))]
+    mod lifecycle {
+        use super::*;
+        use std::{
+            cell::RefCell,
+            future::{pending, poll_fn},
+            rc::Rc,
+            task::{Poll, Waker},
+        };
+
+        // This unit-test executable supplies the C destroy symbol. The workload
+        // callbacks still construct the real Database wrapper, so an accidental
+        // Database::drop is observable without dereferencing a fake C++ object.
+        #[derive(Default)]
+        struct NativeDatabase {
+            releases: Cell<usize>,
+        }
+
+        #[unsafe(no_mangle)]
+        unsafe extern "C" fn fdb_database_destroy(raw: *mut foundationdb_sys::FDBDatabase) {
+            let database = unsafe { &*(raw as *const NativeDatabase) };
+            database.releases.set(database.releases.get() + 1);
+        }
+
+        struct NativePromise {
+            events: Rc<RefCell<Vec<&'static str>>>,
+            on_send: Option<FDBWorkload>,
+            on_free: Option<FDBWorkload>,
+        }
+
+        unsafe extern "C" fn send(raw: *mut OpaquePromise, _: bool) {
+            let promise = unsafe { &mut *(raw as *mut NativePromise) };
+            promise.events.borrow_mut().push("promise send");
+            if let Some(workload) = promise.on_send.take() {
+                unsafe { (*workload.vt).free.unwrap()(workload.inner) };
+            }
+        }
+
+        unsafe extern "C" fn free(raw: *mut OpaquePromise) {
+            let promise = unsafe { Box::from_raw(raw as *mut NativePromise) };
+            promise.events.borrow_mut().push("promise free");
+            if let Some(workload) = promise.on_free {
+                unsafe { (*workload.vt).free.unwrap()(workload.inner) };
+            }
+        }
+
+        const PROMISE_VT: FDBPromise_FDBPromise_VT = FDBPromise_FDBPromise_VT {
+            send: Some(send),
+            free: Some(free),
+        };
+
+        fn promise(
+            events: &Rc<RefCell<Vec<&'static str>>>,
+            on_send: Option<FDBWorkload>,
+            on_free: Option<FDBWorkload>,
+        ) -> FDBPromise {
+            FDBPromise {
+                inner: Box::into_raw(Box::new(NativePromise {
+                    events: events.clone(),
+                    on_send,
+                    on_free,
+                })) as *mut _,
+                vt: &PROMISE_VT as *const _ as *mut _,
+            }
+        }
+
+        #[derive(Clone, Copy)]
+        enum Wait {
+            Ready,
+            RetainWaker,
+            NoWaker,
+        }
+
+        struct PhaseDrop {
+            context: WorkloadContext,
+            events: Rc<RefCell<Vec<&'static str>>>,
+        }
+
+        impl Drop for PhaseDrop {
+            fn drop(&mut self) {
+                assert_eq!(self.context.now(), 12.0);
+                self.events.borrow_mut().push("phase drop");
+                // Destruction may synchronously invoke the executor hook.
+                crate::fdb_rt::poll_pending_tasks();
+            }
+        }
+
+        struct LifecycleWorkload {
+            context: WorkloadContext,
+            events: Rc<RefCell<Vec<&'static str>>>,
+            waker: Rc<RefCell<Option<Waker>>>,
+            wait: Wait,
+            completed: usize,
+        }
+
+        impl LifecycleWorkload {
+            async fn phase(&mut self, db: SimDatabase) {
+                let _drop = PhaseDrop {
+                    context: self.context.clone(),
+                    events: self.events.clone(),
+                };
+                self.events.borrow_mut().push("phase poll");
+                match self.wait {
+                    Wait::Ready => {}
+                    Wait::RetainWaker => {
+                        poll_fn(|cx| {
+                            *self.waker.borrow_mut() = Some(cx.waker().clone());
+                            Poll::<()>::Pending
+                        })
+                        .await;
+                    }
+                    Wait::NoWaker => pending::<()>().await,
+                }
+                self.completed += 1;
+                drop(db);
+            }
+        }
+
+        impl RustWorkload for LifecycleWorkload {
+            async fn setup(&mut self, db: SimDatabase) {
+                self.phase(db).await;
+            }
+            async fn start(&mut self, db: SimDatabase) {
+                self.phase(db).await;
+            }
+            async fn check(&mut self, db: SimDatabase) {
+                self.phase(db).await;
+            }
+            fn get_metrics(&self, _: Metrics<'_>) {
+                assert_eq!(self.context.now(), 12.0);
+                self.events.borrow_mut().push("metrics");
+            }
+            fn get_check_timeout(&self) -> f64 {
+                7.0
+            }
+        }
+
+        impl Drop for LifecycleWorkload {
+            fn drop(&mut self) {
+                assert_eq!(self.context.now(), 12.0);
+                self.events.borrow_mut().push("workload drop");
+            }
+        }
+
+        fn workload(
+            raw: FDBWorkloadContext,
+            events: &Rc<RefCell<Vec<&'static str>>>,
+            waker: &Rc<RefCell<Option<Waker>>>,
+            wait: Wait,
+        ) -> FDBWorkload {
+            // SAFETY: Each test owns the native context until the registered
+            // workload's unique same-thread free, including reentrant callbacks.
+            unsafe {
+                register_workload_context(raw, |context| {
+                    LifecycleWorkload {
+                        context,
+                        events: events.clone(),
+                        waker: waker.clone(),
+                        wait,
+                        completed: 0,
+                    }
+                    .wrap()
+                })
+            }
+        }
+
+        fn release_native_database(database: &mut NativeDatabase) {
+            // Exercise the same linked C symbol as Database::drop. Only this
+            // native owner release is permitted for the phase's borrowed handle.
+            unsafe {
+                foundationdb_sys::fdb_database_destroy(database as *mut NativeDatabase as *mut _);
+            }
+            assert_eq!(database.releases.get(), 1);
+        }
+
+        #[test]
+        fn native_free_cancels_a_suspended_phase_before_workload_and_context() {
+            let (native, context) = native_context(Arc::new(AtomicUsize::new(0)));
+            let events = Rc::new(RefCell::new(Vec::new()));
+            let waker = Rc::new(RefCell::new(None));
+            let workload = workload(context, &events, &waker, Wait::RetainWaker);
+            let mut database = NativeDatabase::default();
+            unsafe {
+                (*workload.vt).check.unwrap()(
+                    workload.inner,
+                    &mut database as *mut NativeDatabase as *mut _,
+                    promise(&events, None, None),
+                );
+                assert_eq!(*events.borrow(), ["phase poll"]);
+                // The native timeout expression may start check before asking
+                // for its timeout; the pending check still owns a mutable W.
+                assert_eq!((*workload.vt).getCheckTimeout.unwrap()(workload.inner), 7.0);
+                (*workload.vt).free.unwrap()(workload.inner);
+            }
+            assert_eq!(
+                *events.borrow(),
+                ["phase poll", "phase drop", "promise free", "workload drop"]
+            );
+            assert_eq!(database.releases.get(), 0);
+            drop(native);
+            waker.borrow_mut().take().unwrap().wake();
+            crate::fdb_rt::poll_pending_tasks();
+            assert_eq!(
+                events.borrow().len(),
+                4,
+                "late wake cannot poll freed state"
+            );
+            release_native_database(&mut database);
+        }
+
+        #[test]
+        fn metrics_after_timeout_cancel_the_phase_before_accessing_the_workload() {
+            for free_on_cancel in [false, true] {
+                let (_native, context) = native_context(Arc::new(AtomicUsize::new(0)));
+                let events = Rc::new(RefCell::new(Vec::new()));
+                let waker = Rc::new(RefCell::new(None));
+                let workload = workload(context, &events, &waker, Wait::RetainWaker);
+                let mut database = NativeDatabase::default();
+                let mut sink = NativeMetrics::default();
+                let mut metrics_vt = FDBMetrics_FDBMetrics_VT {
+                    reserve: Some(reserve_metrics),
+                    push: Some(push_metric),
+                };
+                let raw_metrics = FDBMetrics {
+                    inner: &mut sink as *mut NativeMetrics as *mut _,
+                    vt: &mut metrics_vt,
+                };
+                unsafe {
+                    (*workload.vt).check.unwrap()(
+                        workload.inner,
+                        &mut database as *mut NativeDatabase as *mut _,
+                        promise(&events, None, free_on_cancel.then_some(workload)),
+                    );
+                    assert_eq!((*workload.vt).getCheckTimeout.unwrap()(workload.inner), 7.0);
+                    // The tester requests metrics after its check waiter times
+                    // out, although the Rust phase still retains its waker.
+                    (*workload.vt).getMetrics.unwrap()(workload.inner, raw_metrics);
+                }
+                if free_on_cancel {
+                    assert_eq!(
+                        *events.borrow(),
+                        ["phase poll", "phase drop", "promise free", "workload drop"]
+                    );
+                } else {
+                    assert_eq!(
+                        *events.borrow(),
+                        ["phase poll", "phase drop", "promise free", "metrics"]
+                    );
+                    unsafe { (*workload.vt).free.unwrap()(workload.inner) };
+                }
+                let count = events.borrow().len();
+                waker.borrow_mut().take().unwrap().wake();
+                crate::fdb_rt::poll_pending_tasks();
+                assert_eq!(events.borrow().len(), count);
+                assert_eq!(database.releases.get(), 0);
+                release_native_database(&mut database);
+            }
+        }
+
+        #[test]
+        fn a_new_phase_cancels_a_previous_native_waiters_abandoned_task() {
+            let (_native, context) = native_context(Arc::new(AtomicUsize::new(0)));
+            let events = Rc::new(RefCell::new(Vec::new()));
+            let waker = Rc::new(RefCell::new(None));
+            let workload = workload(context, &events, &waker, Wait::RetainWaker);
+            let mut start_database = NativeDatabase::default();
+            let mut check_database = NativeDatabase::default();
+            unsafe {
+                (*workload.vt).start.unwrap()(
+                    workload.inner,
+                    &mut start_database as *mut NativeDatabase as *mut _,
+                    promise(&events, None, None),
+                );
+            }
+            let old_waker = waker.borrow_mut().take().unwrap();
+            unsafe {
+                (*workload.vt).check.unwrap()(
+                    workload.inner,
+                    &mut check_database as *mut NativeDatabase as *mut _,
+                    promise(&events, None, None),
+                );
+            }
+            assert_eq!(
+                *events.borrow(),
+                ["phase poll", "phase drop", "promise free", "phase poll"]
+            );
+            old_waker.wake();
+            crate::fdb_rt::poll_pending_tasks();
+            assert_eq!(events.borrow().len(), 4);
+            unsafe { (*workload.vt).free.unwrap()(workload.inner) };
+            assert_eq!(
+                *events.borrow(),
+                [
+                    "phase poll",
+                    "phase drop",
+                    "promise free",
+                    "phase poll",
+                    "phase drop",
+                    "promise free",
+                    "workload drop"
+                ]
+            );
+            drop(waker.borrow_mut().take());
+            release_native_database(&mut start_database);
+            release_native_database(&mut check_database);
+        }
+
+        #[test]
+        fn no_waker_cancellation_preserves_the_callers_database_reference() {
+            let (_native, context) = native_context(Arc::new(AtomicUsize::new(0)));
+            let events = Rc::new(RefCell::new(Vec::new()));
+            let workload = workload(
+                context,
+                &events,
+                &Rc::new(RefCell::new(None)),
+                Wait::NoWaker,
+            );
+            let mut database = NativeDatabase::default();
+            unsafe {
+                (*workload.vt).check.unwrap()(
+                    workload.inner,
+                    &mut database as *mut NativeDatabase as *mut _,
+                    promise(&events, None, Some(workload)),
+                );
+            }
+            assert_eq!(
+                *events.borrow(),
+                ["phase poll", "phase drop", "promise free", "workload drop"]
+            );
+            assert_eq!(database.releases.get(), 0);
+            release_native_database(&mut database);
+        }
+
+        #[test]
+        fn completion_releases_phase_state_before_reentrant_native_free() {
+            let (_native, context) = native_context(Arc::new(AtomicUsize::new(0)));
+            let events = Rc::new(RefCell::new(Vec::new()));
+            let workload = workload(context, &events, &Rc::new(RefCell::new(None)), Wait::Ready);
+            let mut database = NativeDatabase::default();
+            unsafe {
+                (*workload.vt).setup.unwrap()(
+                    workload.inner,
+                    &mut database as *mut NativeDatabase as *mut _,
+                    promise(&events, Some(workload), None),
+                );
+            }
+            assert_eq!(
+                *events.borrow(),
+                [
+                    "phase poll",
+                    "phase drop",
+                    "promise send",
+                    "workload drop",
+                    "promise free"
+                ]
+            );
+            assert_eq!(database.releases.get(), 0);
+            release_native_database(&mut database);
+        }
+
+        #[test]
+        fn timeout_is_not_queried_before_setup_initializes_the_workload() {
+            struct SetupDependentTimeout(Option<f64>);
+
+            impl RustWorkload for SetupDependentTimeout {
+                async fn setup(&mut self, _: SimDatabase) {
+                    self.0 = Some(7.0);
+                }
+                async fn start(&mut self, _: SimDatabase) {}
+                async fn check(&mut self, _: SimDatabase) {}
+                fn get_metrics(&self, _: Metrics<'_>) {}
+                fn get_check_timeout(&self) -> f64 {
+                    self.0.expect("setup initializes the check timeout")
+                }
+            }
+
+            let (_native, context) = native_context(Arc::new(AtomicUsize::new(0)));
+            let events = Rc::new(RefCell::new(Vec::new()));
+            let mut database = NativeDatabase::default();
+            unsafe {
+                let workload =
+                    register_workload_context(context, |_| SetupDependentTimeout(None).wrap());
+                (*workload.vt).setup.unwrap()(
+                    workload.inner,
+                    &mut database as *mut NativeDatabase as *mut _,
+                    promise(&events, None, None),
+                );
+                assert_eq!((*workload.vt).getCheckTimeout.unwrap()(workload.inner), 7.0);
+                (*workload.vt).free.unwrap()(workload.inner);
+            }
+            assert_eq!(database.releases.get(), 0);
+            release_native_database(&mut database);
+        }
+    }
+
     #[test]
     fn environment_rejects_access_after_registered_workload_release() {
         let calls = Arc::new(AtomicUsize::new(0));
diff --git a/bindings/rust/foundationdb-simulation/src/fdb_rt.rs b/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
index 9cd2a818f69..f434ed1cc37 100644
--- a/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
+++ b/bindings/rust/foundationdb-simulation/src/fdb_rt.rs
@@ -19,13 +19,14 @@ use loom::sync::{Mutex, atomic::AtomicBool};
 #[cfg(not(all(test, fdb_simulation_loom)))]
 use std::sync::{Mutex, atomic::AtomicBool};
 
-type TaskId = usize;
+pub(crate) type TaskId = usize;
 type Task = Pin<Box<dyn Future<Output = ()>>>;
 type Queue = Mutex<VecDeque<Notification>>;
 
 thread_local! {
     static EXECUTOR: RefCell<Executor> = RefCell::new(Executor::default());
     static POLLING: Cell<bool> = const { Cell::new(false) };
+    static CURRENT_TASK: Cell<Option<TaskId>> = const { Cell::new(None) };
 }
 
 #[derive(Default)]
@@ -88,11 +89,19 @@ fn next_notification(queue: &Queue) -> Option<Notification> {
     notification
 }
 
-struct PollingGuard;
+struct PollingTaskGuard;
+
+impl Drop for PollingTaskGuard {
+    fn drop(&mut self) {
+        CURRENT_TASK.with(|current| current.set(None));
+    }
+}
+
+struct PollingGuard(bool);
 
 impl Drop for PollingGuard {
     fn drop(&mut self) {
-        let _ = POLLING.try_with(|polling| polling.set(false));
+        let _ = POLLING.try_with(|polling| polling.set(self.0));
     }
 }
 
@@ -110,7 +119,7 @@ pub fn poll_pending_tasks() {
     let Ok(false) = POLLING.try_with(|polling| polling.replace(true)) else {
         return;
     };
-    let _guard = PollingGuard;
+    let _guard = PollingGuard(false);
     loop {
         let Some(notification) = next_notification(&queue) else {
             return;
@@ -122,6 +131,8 @@ pub fn poll_pending_tasks() {
                 let id = notification.id;
                 let future = EXECUTOR.with_borrow_mut(|executor| executor.tasks.remove(&id));
                 if let Some(mut future) = future {
+                    CURRENT_TASK.with(|current| current.set(Some(id)));
+                    let _task_guard = PollingTaskGuard;
                     let waker = Waker::from(notification);
                     let mut cx = Context::from_waker(&waker);
                     if future.as_mut().poll(&mut cx).is_pending() {
@@ -139,8 +150,8 @@ pub fn poll_pending_tasks() {
     }
 }
 
-/// Spawn an async block and resolve all contained FoundationDB futures.
-pub(crate) fn fdb_spawn<F>(future: F)
+/// Queue a task without polling it, so its owner can record the cancellation ID.
+pub(crate) fn enqueue<F>(future: F) -> TaskId
 where
     F: Future<Output = ()> + 'static,
 {
@@ -154,7 +165,31 @@ where
             queued: AtomicBool::new(false),
         })
     });
+    let id = notification.id;
     notification.wake();
+    id
+}
+
+/// Synchronously release a suspended task before its borrowed native state.
+pub(crate) fn cancel(id: TaskId) {
+    CURRENT_TASK.with(|current| {
+        assert_ne!(
+            current.get(),
+            Some(id),
+            "the native caller cannot free a workload during its phase poll"
+        );
+    });
+    let _guard = PollingGuard(POLLING.with(|polling| polling.replace(true)));
+    let future = EXECUTOR.with_borrow_mut(|executor| executor.tasks.remove(&id));
+    drop(future);
+}
+
+#[cfg(all(test, not(fdb_simulation_loom)))]
+fn fdb_spawn<F>(future: F)
+where
+    F: Future<Output = ()> + 'static,
+{
+    enqueue(future);
     poll_pending_tasks();
 }
 
diff --git a/bindings/rust/foundationdb-simulation/src/lib.rs b/bindings/rust/foundationdb-simulation/src/lib.rs
index a294852ac58..558e1a98325 100644
--- a/bindings/rust/foundationdb-simulation/src/lib.rs
+++ b/bindings/rust/foundationdb-simulation/src/lib.rs
@@ -1,7 +1,16 @@
 #![warn(missing_docs)]
 #![doc = include_str!("../README.md")]
 
-use std::{ptr::NonNull, sync::Arc};
+use std::{
+    cell::{Cell, RefCell},
+    future::Future,
+    mem::ManuallyDrop,
+    pin::Pin,
+    ptr::NonNull,
+    rc::Rc,
+    sync::Arc,
+    task::{Context, Poll},
+};
 
 use foundationdb::Database;
 use foundationdb_sys::FDBDatabase as FDBDatabaseAlias;
@@ -17,7 +26,7 @@ use bindings::{
 };
 pub use bindings::{Metric, Metrics, Severity, WorkloadContext};
 pub use env::{SimClock, SimRng};
-use fdb_rt::fdb_spawn;
+use fdb_rt::{TaskId, poll_pending_tasks};
 
 // -----------------------------------------------------------------------------
 // User friendly types
@@ -87,7 +96,12 @@ pub trait RustWorkload: Sized + 'static {
 
     /// Wrap the underlying Rust type so it can be passed to the C API
     fn wrap(self) -> WrappedWorkload {
-        let inner = Box::into_raw(Box::new(self));
+        let inner = Box::into_raw(Box::new(Rc::new(WorkloadState {
+            workload: RefCell::new(Some(Box::new(self))),
+            task: Cell::new(None),
+            check_timeout: Cell::new(None),
+            releasing_phase: Cell::new(false),
+        })));
         WrappedWorkload(FDBWorkload {
             api_version: FDB_WORKLOAD_API_VERSION,
             inner: inner as *mut _,
@@ -130,14 +144,88 @@ pub trait SingleRustWorkload: RustWorkload {
 // -----------------------------------------------------------------------------
 // C to Rust bindings
 
-fn check_database_ref(database: SimDatabase) {
-    if Arc::strong_count(&database) != 1 || Arc::weak_count(&database) != 0 {
-        eprintln!(
-            "Reference to Database kept between phases (setup/start/check). All references should be dropped."
-        );
-        std::process::exit(1);
+struct WorkloadState<W> {
+    workload: RefCell<Option<Box<W>>>,
+    task: Cell<Option<TaskId>>,
+    check_timeout: Cell<Option<f64>>,
+    releasing_phase: Cell<bool>,
+}
+
+// The phase owns W while suspended, rather than borrowing an allocation that the
+// native free callback can destroy. Cancellation returns it before owner teardown.
+struct PhaseWorkload<W> {
+    workload: Option<Box<W>>,
+    state: Rc<WorkloadState<W>>,
+}
+
+impl<W> Drop for PhaseWorkload<W> {
+    fn drop(&mut self) {
+        *self.state.workload.borrow_mut() = self.workload.take();
+    }
+}
+
+// The native caller owns this database reference. The guard always outlives the
+// user future, including cancellation, and releases only the Rust Arc allocation.
+struct PhaseDatabase(ManuallyDrop<SimDatabase>);
+
+impl Drop for PhaseDatabase {
+    fn drop(&mut self) {
+        // SAFETY: This is the guard's only release, and ManuallyDrop prevents a
+        // borrowed native reference from being destroyed on any error path.
+        let database = unsafe { ManuallyDrop::take(&mut self.0) };
+        if Arc::strong_count(&database) != 1 || Arc::weak_count(&database) != 0 {
+            eprintln!(
+                "Reference to Database kept after phase completion or cancellation. All references must be dropped."
+            );
+            std::process::exit(1);
+        }
+        let Ok(database) = Arc::try_unwrap(database) else {
+            unreachable!("the phase owns the only database reference")
+        };
+        let _borrowed = ManuallyDrop::new(database);
+    }
+}
+
+struct PhaseTask<W> {
+    future: Option<Pin<Box<dyn Future<Output = ()>>>>,
+    database: Option<PhaseDatabase>,
+    state: Option<Rc<WorkloadState<W>>>,
+    done: Option<Promise>,
+}
+
+impl<W> PhaseTask<W> {
+    fn release_phase(&mut self) {
+        if let Some(state) = self.state.take() {
+            state.releasing_phase.set(true);
+            drop(self.future.take());
+            drop(self.database.take());
+            state.releasing_phase.set(false);
+            state.task.set(None);
+            // Do not retain W across native promise callbacks: resolving or
+            // releasing a promise may synchronously free the registered workload.
+            drop(state);
+        }
+    }
+}
+
+impl<W> Future for PhaseTask<W> {
+    type Output = ();
+
+    fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
+        let this = self.get_mut();
+        if this.future.as_mut().unwrap().as_mut().poll(cx).is_pending() {
+            return Poll::Pending;
+        }
+        this.release_phase();
+        this.done.take().unwrap().send(true);
+        Poll::Ready(())
+    }
+}
+
+impl<W> Drop for PhaseTask<W> {
+    fn drop(&mut self) {
+        self.release_phase();
     }
-    std::mem::forget(database);
 }
 
 #[cfg(coverage)]
@@ -160,67 +248,119 @@ fn write_coverage_profile() {
     }
 }
 
-unsafe fn database_new(raw_database: *mut FDBDatabase) -> SimDatabase {
-    unsafe {
-        Arc::new(Database::new_from_pointer(NonNull::new_unchecked(
-            raw_database as *mut FDBDatabaseAlias,
-        )))
+enum Phase {
+    Setup,
+    Start,
+    Check,
+}
+
+// A native timeout abandons its waiter without notifying the Rust task. A new
+// phase or final metrics callback ends the previous phase's exclusive access.
+unsafe fn idle_workload<W: RustWorkload>(
+    raw_workload: *mut OpaqueWorkload,
+) -> Option<Rc<WorkloadState<W>>> {
+    let state = unsafe { &*(raw_workload as *const Rc<WorkloadState<W>>) };
+    let weak = Rc::downgrade(state);
+    let task = state.task.take();
+    if let Some(task) = task {
+        // Releasing the old promise can synchronously free the native owner.
+        // A strong Rc here would delay W's destructor past context invalidation.
+        fdb_rt::cancel(task);
     }
+    weak.upgrade()
 }
-unsafe extern "C" fn workload_setup<W: RustWorkload + 'static>(
+
+unsafe fn spawn_phase<W: RustWorkload>(
     raw_workload: *mut OpaqueWorkload,
     raw_database: *mut FDBDatabase,
     raw_promise: FDBPromise,
+    phase: Phase,
 ) {
-    unsafe {
-        let workload = &mut *(raw_workload as *mut W);
-        let database = database_new(raw_database);
-        let done = Promise::new(raw_promise);
-        fdb_spawn(async move {
-            workload.setup(database.clone()).await;
-            check_database_ref(database);
-            done.send(true);
-        });
+    // SAFETY: wrap allocates this owner and the ABI invokes its callbacks on the
+    // same thread, serially, until its unique free callback.
+    let Some(state) = (unsafe { idle_workload::<W>(raw_workload) }) else {
+        drop(Promise::new(raw_promise));
+        return;
+    };
+    let workload = state
+        .workload
+        .borrow_mut()
+        .take()
+        .expect("workload phases cannot overlap");
+    // Native callers may evaluate check() before getCheckTimeout(). Sampling
+    // while W is idle avoids aliasing a suspended phase's exclusive borrow.
+    if matches!(phase, Phase::Check) {
+        state.check_timeout.set(Some(workload.get_check_timeout()));
     }
+    let mut workload = PhaseWorkload {
+        workload: Some(workload),
+        state: state.clone(),
+    };
+    let ptr = NonNull::new(raw_database as *mut FDBDatabaseAlias)
+        .expect("the simulator must supply a database");
+    // SAFETY: The native caller supplies a live pointer for this phase. The
+    // guard suppresses Database::drop and rejects references escaping the phase.
+    let database = PhaseDatabase(ManuallyDrop::new(Arc::new(unsafe {
+        Database::new_from_pointer(ptr)
+    })));
+    let borrowed_database = Arc::clone(&database.0);
+    let future = async move {
+        let inner = workload.workload.as_mut().unwrap();
+        match phase {
+            Phase::Setup => inner.setup(borrowed_database).await,
+            Phase::Start => inner.start(borrowed_database).await,
+            Phase::Check => inner.check(borrowed_database).await,
+        }
+        // Keep the owning guard, rather than only its workload field, captured
+        // until the user future has released every borrow of W.
+        drop(workload);
+    };
+    let task = PhaseTask {
+        future: Some(Box::pin(future)),
+        database: Some(database),
+        state: Some(state.clone()),
+        done: Some(Promise::new(raw_promise)),
+    };
+    state.task.set(Some(fdb_rt::enqueue(task)));
+    drop(state);
+    poll_pending_tasks();
 }
-unsafe extern "C" fn workload_start<W: RustWorkload + 'static>(
+
+unsafe extern "C" fn workload_setup<W: RustWorkload>(
     raw_workload: *mut OpaqueWorkload,
     raw_database: *mut FDBDatabase,
     raw_promise: FDBPromise,
 ) {
-    unsafe {
-        let workload = &mut *(raw_workload as *mut W);
-        let database = database_new(raw_database);
-        let done = Promise::new(raw_promise);
-        fdb_spawn(async move {
-            workload.start(database.clone()).await;
-            check_database_ref(database);
-            done.send(true);
-        });
-    }
+    unsafe { spawn_phase::<W>(raw_workload, raw_database, raw_promise, Phase::Setup) };
 }
-unsafe extern "C" fn workload_check<W: RustWorkload + 'static>(
+
+unsafe extern "C" fn workload_start<W: RustWorkload>(
     raw_workload: *mut OpaqueWorkload,
     raw_database: *mut FDBDatabase,
     raw_promise: FDBPromise,
 ) {
-    unsafe {
-        let workload = &mut *(raw_workload as *mut W);
-        let database = database_new(raw_database);
-        let done = Promise::new(raw_promise);
-        fdb_spawn(async move {
-            workload.check(database.clone()).await;
-            check_database_ref(database);
-            done.send(true);
-        });
-    }
+    unsafe { spawn_phase::<W>(raw_workload, raw_database, raw_promise, Phase::Start) };
+}
+
+unsafe extern "C" fn workload_check<W: RustWorkload>(
+    raw_workload: *mut OpaqueWorkload,
+    raw_database: *mut FDBDatabase,
+    raw_promise: FDBPromise,
+) {
+    unsafe { spawn_phase::<W>(raw_workload, raw_database, raw_promise, Phase::Check) };
 }
 unsafe extern "C" fn workload_get_metrics<W: RustWorkload>(
     raw_workload: *mut OpaqueWorkload,
     mut raw_metrics: FDBMetrics,
 ) {
     unsafe {
-        let workload = &*(raw_workload as *mut W);
+        let Some(state) = idle_workload::<W>(raw_workload) else {
+            return;
+        };
+        let workload = state.workload.borrow();
+        let workload = workload
+            .as_ref()
+            .expect("cancellation restores the workload");
         let out = Metrics::new(&mut raw_metrics);
         workload.get_metrics(out);
         #[cfg(coverage)]
@@ -231,12 +371,28 @@ unsafe extern "C" fn workload_get_check_timeout<W: RustWorkload>(
     raw_workload: *mut OpaqueWorkload,
 ) -> f64 {
     unsafe {
-        let workload = &*(raw_workload as *mut W);
-        workload.get_check_timeout()
+        let state = &*(raw_workload as *const Rc<WorkloadState<W>>);
+        let workload = state.workload.borrow();
+        match workload.as_ref() {
+            Some(workload) => workload.get_check_timeout(),
+            None => state
+                .check_timeout
+                .get()
+                .expect("a phase samples its timeout"),
+        }
     }
 }
 unsafe extern "C" fn workload_drop<W: RustWorkload>(raw_workload: *mut OpaqueWorkload) {
-    unsafe { drop(Box::from_raw(raw_workload as *mut W)) };
+    let owner = unsafe { &*(raw_workload as *const Rc<WorkloadState<W>>) };
+    assert!(
+        !owner.releasing_phase.get(),
+        "the native caller cannot free a workload during its phase destructor"
+    );
+    let state = unsafe { Box::from_raw(raw_workload as *mut Rc<WorkloadState<W>>) };
+    if let Some(task) = state.task.take() {
+        fdb_rt::cancel(task);
+    }
+    drop(state);
 }
 
 // -----------------------------------------------------------------------------
diff --git a/bindings/rust/foundationdb-tuple/src/lib.rs b/bindings/rust/foundationdb-tuple/src/lib.rs
index d1ac08564c7..642791f386e 100644
--- a/bindings/rust/foundationdb-tuple/src/lib.rs
+++ b/bindings/rust/foundationdb-tuple/src/lib.rs
@@ -185,6 +185,9 @@ pub fn pack<T: TuplePack>(v: &T) -> Vec<u8> {
 
 /// Pack value and returns the packed buffer
 ///
+/// An incomplete versionstamp uses the four-byte offset encoding required by
+/// FoundationDB API 520 and later; earlier mutation formats are not supported.
+///
 /// # Panics
 ///
 /// Panics if there is multiple versionstamp present or if the encoded data size doesn't fit in `u32`.
diff --git a/bindings/rust/foundationdb-tuple/src/pack.rs b/bindings/rust/foundationdb-tuple/src/pack.rs
index 32030a61dc6..7d4d217e729 100644
--- a/bindings/rust/foundationdb-tuple/src/pack.rs
+++ b/bindings/rust/foundationdb-tuple/src/pack.rs
@@ -68,6 +68,10 @@ pub trait TuplePack {
 
     /// Pack value and returns the packed buffer
     ///
+    /// An incomplete versionstamp appends the four-byte offset used by
+    /// FoundationDB API 520 and later. Earlier versionstamped mutation formats
+    /// are not supported.
+    ///
     /// # Panics
     ///
     /// Panics if there is multiple versionstamp present or if the encoded data size doesn't fit in `u32`.
@@ -89,7 +93,9 @@ pub trait TuplePack {
         self.pack_root(output).expect(PACK_ERR_MSG)
     }
 
-    /// Pack value into the given buffer
+    /// Pack value into the given buffer, appending a four-byte offset for an
+    /// incomplete versionstamp. This encoding requires FoundationDB API 520 or
+    /// later for versionstamped mutations.
     ///
     /// # Panics
     ///
diff --git a/bindings/rust/foundationdb-tuple/src/subspace.rs b/bindings/rust/foundationdb-tuple/src/subspace.rs
index 23a6d345dd3..6180260c3be 100644
--- a/bindings/rust/foundationdb-tuple/src/subspace.rs
+++ b/bindings/rust/foundationdb-tuple/src/subspace.rs
@@ -104,6 +104,9 @@ impl Subspace {
 
     /// Returns the key encoding the specified Tuple with the prefix of this Subspace
     /// prepended, with a versionstamp.
+    ///
+    /// An incomplete versionstamp appends a four-byte offset, suitable for
+    /// versionstamped mutations with FoundationDB API 520 or later.
     pub fn pack_with_versionstamp<T: TuplePack>(&self, t: &T) -> Vec<u8> {
         let mut output = self.prefix.clone();
         let mut versionstamp_offset = self.versionstamp_offset;
diff --git a/bindings/rust/foundationdb/src/api.rs b/bindings/rust/foundationdb/src/api.rs
index 05f7f1e3742..9a58c51350b 100644
--- a/bindings/rust/foundationdb/src/api.rs
+++ b/bindings/rust/foundationdb/src/api.rs
@@ -73,11 +73,19 @@ enum NetworkLifecycle {
 }
 
 static NETWORK: Mutex<NetworkLifecycle> = Mutex::new(NetworkLifecycle::Uninitialized);
+// Published after successful API selection and never changed. Version-dependent
+// transaction operations must not take the lifecycle lock (network shutdown
+// holds it while joining the network thread).
+static SELECTED_API_VERSION: AtomicI32 = AtomicI32::new(0);
 static STOP_ON_EXIT: AtomicBool = AtomicBool::new(true);
 // Last error returned by fdb_run_network (0 = none). An atomic, not a mutex: the
 // network thread must never take a lock shared with the thread joining it.
 static NETWORK_RUN_ERROR: AtomicI32 = AtomicI32::new(0);
 
+pub(crate) fn selected_api_version() -> i32 {
+    SELECTED_API_VERSION.load(Ordering::Acquire)
+}
+
 fn lock_network() -> MutexGuard<'static, NetworkLifecycle> {
     // State is only mutated after the corresponding FFI call succeeded, so a
     // poisoned lock still guards a consistent state. The one exception is a
@@ -113,6 +121,7 @@ impl NetworkLifecycle {
                 *self = NetworkLifecycle::ApiVersionSelected {
                     api_version: version,
                 };
+                SELECTED_API_VERSION.store(version, Ordering::Release);
                 Ok(())
             }
             NetworkLifecycle::ApiVersionSelected { api_version }
@@ -320,6 +329,7 @@ impl FdbApiBuilder {
     ///
     /// Must be less than or equal to header_version, `foundationdb_sys::FDB_API_VERSION`, and should almost always be equal.
     /// Language bindings which themselves expose API versioning will usually pass the version requested by the application.
+    /// Versionstamped mutations require runtime API 520 or later in this binding.
     pub fn set_runtime_version(mut self, version: i32) -> Self {
         self.runtime_version = version;
         self
diff --git a/bindings/rust/foundationdb/src/timekeeper.rs b/bindings/rust/foundationdb/src/timekeeper.rs
index 7c4e9dda0fd..1d610084068 100644
--- a/bindings/rust/foundationdb/src/timekeeper.rs
+++ b/bindings/rust/foundationdb/src/timekeeper.rs
@@ -12,11 +12,10 @@
 //!
 //! [source](https://forums.foundationdb.org/t/versionstamp-as-absolute-time/2442/3)
 
-use crate::future::FdbValue;
 use crate::options::TransactionOption;
-use crate::{FdbBindingError, FdbResult, KeySelector, RangeOption, Transaction};
+use crate::{FdbBindingError, KeySelector, RangeOption, Transaction};
 use foundationdb_tuple::{pack, unpack};
-use futures::StreamExt;
+use futures::TryStreamExt;
 
 /// Timekeeper keys are stored in a special keyspace
 /// Can be found in the [Java implementation](https://github.com/FoundationDB/fdb-record-layer/blob/main/fdb-extensions/src/main/java/com/apple/foundationdb/system/SystemKeyspace.java#L80)
@@ -45,6 +44,10 @@ pub enum HintMode {
 /// compatible with an i64.
 ///
 /// Timestamps are provided from unix time as seconds
+///
+/// Read failures are returned to the caller so that retryable errors can be
+/// handled by the transaction's retry loop. `None` means the read succeeded
+/// without finding a matching entry.
 pub async fn hint_version_from_timestamp(
     trx: &Transaction,
     unix_timestamp_as_seconds: u64,
@@ -86,14 +89,10 @@ pub async fn hint_version_from_timestamp(
     range.limit = Some(1);
 
     // We get the first key matching our start range bound
-    let results = trx
-        .get_ranges_keyvalues(range, snapshot)
-        .take(1)
-        .collect::<Vec<FdbResult<FdbValue>>>()
-        .await;
+    let result = trx.get_ranges_keyvalues(range, snapshot).try_next().await?;
 
     // If any result then the value found will be the read version ID
-    if let Some(Ok(kv)) = results.first() {
+    if let Some(kv) = result {
         let version = unpack(kv.value()).map_err(FdbBindingError::PackError)?;
         return Ok(Some(version));
     }
diff --git a/bindings/rust/foundationdb/src/transaction.rs b/bindings/rust/foundationdb/src/transaction.rs
index 0c54cc036b9..ec1773800d5 100644
--- a/bindings/rust/foundationdb/src/transaction.rs
+++ b/bindings/rust/foundationdb/src/transaction.rs
@@ -944,11 +944,28 @@ impl Transaction {
     /// If a transaction uses both an atomic operation and a strictly serializable read on the same
     /// key, the benefits of using the atomic operation (for both conflict checking and performance)
     /// are lost.
+    ///
+    /// # Panics
+    ///
+    /// `SetVersionstampedKey` and `SetVersionstampedValue` require runtime API 520
+    /// or later. Earlier APIs use different key and value encodings, which this
+    /// binding does not support; both mutations panic before reaching the native
+    /// client, including when given manually encoded operands.
     #[cfg_attr(
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, key, param))
     )]
     pub fn atomic_op(&self, key: &[u8], param: &[u8], op_type: options::MutationType) {
+        if matches!(
+            op_type,
+            options::MutationType::SetVersionstampedKey
+                | options::MutationType::SetVersionstampedValue
+        ) {
+            assert!(
+                crate::api::selected_api_version() >= 520,
+                "versionstamped mutations require runtime API 520 or later"
+            );
+        }
         unsafe {
             fdb_sys::fdb_transaction_atomic_op(
                 self.inner.as_ptr(),
diff --git a/bindings/rust/foundationdb/tests/timekeeper.rs b/bindings/rust/foundationdb/tests/timekeeper.rs
index 357f21b0f0e..479b366c1fb 100644
--- a/bindings/rust/foundationdb/tests/timekeeper.rs
+++ b/bindings/rust/foundationdb/tests/timekeeper.rs
@@ -1,6 +1,39 @@
+use foundationdb::options::TransactionOption;
 use foundationdb::timekeeper::{HintMode, hint_version_from_timestamp};
+use foundationdb::{FdbBindingError, RangeOption};
 use std::time::SystemTime;
 
+mod common;
+
+#[tokio::test]
+async fn timekeeper_propagates_range_read_errors() -> Result<(), FdbBindingError> {
+    let database = common::database().await?;
+    let trx = database.create_trx()?;
+    trx.set_read_version(1);
+    trx.set_option(TransactionOption::ReadSystemKeys)?;
+    trx.set_option(TransactionOption::ReadLockAware)?;
+
+    let range = RangeOption::from((
+        b"\xff\x02/timeKeeper/map/".as_ref(),
+        b"\xff\x02/timeKeeper/map/\xff".as_ref(),
+    ));
+    let read_error = trx
+        .get_range(&range, 1, true)
+        .await
+        .err()
+        .expect("an obsolete read version must fail the range read");
+    assert_eq!(read_error.code(), 1007);
+
+    // The helper must return the range error, not fail while setting options.
+    trx.set_option(TransactionOption::ReadSystemKeys)?;
+    trx.set_option(TransactionOption::ReadLockAware)?;
+    let error = hint_version_from_timestamp(&trx, 0, HintMode::AfterTimestamp, true)
+        .await
+        .expect_err("a failed range read must not look like a missing timekeeper entry");
+    assert_eq!(error.get_fdb_error().unwrap().code(), read_error.code());
+    Ok(())
+}
+
 #[tokio::test]
 async fn timekeeper() {
     let database = foundationdb::Database::new_compat(None)
diff --git a/bindings/rust/foundationdb/tests/versionstamp.rs b/bindings/rust/foundationdb/tests/versionstamp.rs
new file mode 100644
index 00000000000..47896825927
--- /dev/null
+++ b/bindings/rust/foundationdb/tests/versionstamp.rs
@@ -0,0 +1,136 @@
+use foundationdb::{
+    Database,
+    api::FdbApiBuilder,
+    options::{MutationType, TransactionOption},
+    tuple::{self, Subspace, Versionstamp},
+};
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::process::Command;
+
+#[test]
+fn versionstamped_mutations_follow_selected_runtime_api() {
+    const CHILD_API: &str = "FDB_TEST_VERSIONSTAMP_RUNTIME_API";
+    let Ok(version) = std::env::var(CHILD_API) else {
+        // The C API selection is process-global and irreversible. Exercise old
+        // runtime semantics even when this binary was built with current headers.
+        for version in [510, 520, 740] {
+            if version > foundationdb_sys::FDB_API_VERSION {
+                continue;
+            }
+            let status = Command::new(std::env::current_exe().expect("test executable"))
+                .args([
+                    "--exact",
+                    "versionstamped_mutations_follow_selected_runtime_api",
+                    "--nocapture",
+                ])
+                .env(CHILD_API, version.to_string())
+                .status()
+                .expect("start test with independent API selection");
+            assert!(status.success(), "runtime API {version} failed");
+        }
+        return;
+    };
+    let version = version.parse::<i32>().expect("integer runtime API");
+    let _network = FdbApiBuilder::default()
+        .set_runtime_version(version)
+        .build()
+        .expect("select runtime API")
+        .boot()
+        .expect("start network");
+    futures::executor::block_on(check_versionstamped_mutations(version));
+}
+
+async fn check_versionstamped_mutations(version: i32) {
+    let db = Database::new_compat(None).await.expect("open database");
+    let subspace = Subspace::from(("test-versionstamp-runtime", version));
+    let trx = db.create_trx().expect("create cleanup transaction");
+    trx.set_option(TransactionOption::Timeout(10_000))
+        .expect("set timeout");
+    trx.clear_subspace_range(&subspace);
+    trx.commit().await.expect("clear test keys");
+
+    let stamped_key = subspace.pack_with_versionstamp(&("key", Versionstamp::incomplete(0)));
+    let value_key = subspace.pack(&"value");
+    let stamped_value = tuple::pack_with_versionstamp(&("value", Versionstamp::incomplete(1)));
+    let counter_key = subspace.pack(&"counter");
+    let trx = db.create_trx().expect("create mutation transaction");
+    trx.set_option(TransactionOption::Timeout(10_000))
+        .expect("set timeout");
+    if version < 520 {
+        for (key, value, mutation) in [
+            (
+                stamped_key.as_slice(),
+                b"stored".as_slice(),
+                MutationType::SetVersionstampedKey,
+            ),
+            (
+                value_key.as_slice(),
+                stamped_value.as_slice(),
+                MutationType::SetVersionstampedValue,
+            ),
+        ] {
+            let panic = catch_unwind(AssertUnwindSafe(|| trx.atomic_op(key, value, mutation)))
+                .expect_err("pre-520 versionstamped mutations must be rejected");
+            let message = panic
+                .downcast_ref::<String>()
+                .map(String::as_str)
+                .or_else(|| panic.downcast_ref::<&str>().copied());
+            assert_eq!(
+                message,
+                Some("versionstamped mutations require runtime API 520 or later")
+            );
+        }
+        assert_eq!(trx.attempt_usage().call_atomic_op, 0);
+        assert_eq!(trx.attempt_usage().bytes_written, 0);
+        // Unsupported versionstamps do not prevent API 510 atomic operations.
+        trx.atomic_op(&counter_key, &1_i64.to_le_bytes(), MutationType::Add);
+        trx.commit().await.expect("commit API 510 atomic add");
+        let read = db.create_trx().expect("create read transaction");
+        read.set_option(TransactionOption::Timeout(10_000))
+            .expect("set timeout");
+        assert_eq!(
+            read.get(&counter_key, false)
+                .await
+                .expect("read counter")
+                .as_deref(),
+            Some(1_i64.to_le_bytes().as_slice())
+        );
+        assert!(
+            read.get(&value_key, false)
+                .await
+                .expect("read rejected mutation")
+                .is_none()
+        );
+        return;
+    }
+
+    trx.atomic_op(&stamped_key, b"stored", MutationType::SetVersionstampedKey);
+    trx.atomic_op(
+        &value_key,
+        &stamped_value,
+        MutationType::SetVersionstampedValue,
+    );
+    let committed_version = trx.get_versionstamp();
+    trx.commit().await.expect("commit versionstamped mutations");
+    let committed_version = committed_version.await.expect("get commit versionstamp");
+    let transaction_version: [u8; 10] = (*committed_version).try_into().expect("ten-byte version");
+    let expected_key = subspace.pack(&("key", Versionstamp::complete(transaction_version, 0)));
+    let expected_value = tuple::pack(&("value", Versionstamp::complete(transaction_version, 1)));
+    let read = db.create_trx().expect("create read transaction");
+    read.set_option(TransactionOption::Timeout(10_000))
+        .expect("set timeout");
+    assert_eq!(
+        read.get(&expected_key, false)
+            .await
+            .expect("read versionstamped key")
+            .as_deref(),
+        Some(b"stored".as_slice())
+    );
+    assert_eq!(
+        read.get(&value_key, false)
+            .await
+            .expect("read versionstamped value")
+            .as_deref(),
+        Some(expected_value.as_slice())
+    );
+}

From c5400fbda9da977ad46791bb460b009eaae9b10f Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Wed, 30 Sep 2026 21:36:26 -0700
Subject: [PATCH 08/11] Fix Rust directory allocation and shared client
 lifecycle

---
 bindings/c/fdb_c.cpp                          |  10 ++
 bindings/c/foundationdb/fdb_c.h               |   8 +
 bindings/rust/CMakeLists.txt                  |  19 +-
 bindings/rust/CONTRIBUTING.md                 |   4 +
 bindings/rust/README.md                       |   7 +
 bindings/rust/UPSTREAM.md                     |   4 +
 .../foundationdb-bindingtester/src/main.rs    |  33 +++-
 .../rust/foundationdb-simulation/README.md    |  12 +-
 .../foundationdb-simulation/docs/fdb_rt.md    |   5 +-
 .../foundationdb-simulation/src/bindings.rs   | 127 +++++++++-----
 .../rust/foundationdb-simulation/src/lib.rs   |  45 +++--
 bindings/rust/foundationdb-sys/build.rs       |  10 ++
 bindings/rust/foundationdb-sys/src/lib.rs     |  23 +++
 bindings/rust/foundationdb/Cargo.toml         |   5 +
 .../examples/api_version_library.rs           |  57 ++++++
 bindings/rust/foundationdb/src/api.rs         |  39 +++--
 .../src/directory/directory_layer.rs          |   8 +-
 bindings/rust/foundationdb/tests/directory.rs |  65 ++++++-
 bindings/rust/tests/api_version_libraries.py  | 163 ++++++++++++++++++
 19 files changed, 566 insertions(+), 78 deletions(-)
 create mode 100644 bindings/rust/foundationdb/examples/api_version_library.rs
 create mode 100644 bindings/rust/tests/api_version_libraries.py

diff --git a/bindings/c/fdb_c.cpp b/bindings/c/fdb_c.cpp
index 9f54ade1f74..c2bb46afb67 100644
--- a/bindings/c/fdb_c.cpp
+++ b/bindings/c/fdb_c.cpp
@@ -20,6 +20,7 @@
 
 #include "fdbclient/FDBTypes.h"
 #include "flow/ProtocolVersion.h"
+#include <atomic>
 #include <cstdint>
 #define FDB_USE_LATEST_API_VERSION
 #define FDB_INCLUDE_LEGACY_TYPES
@@ -32,6 +33,7 @@
 #include "foundationdb/fdb_c_internal.h"
 
 int g_api_version = 0;
+static std::atomic<int> g_header_api_version{ 0 };
 
 /*
  * Our clients might share these ThreadSafe types between threads. It is therefore
@@ -1157,9 +1159,17 @@ extern "C" DLLEXPORT fdb_error_t fdb_select_api_version_impl(int runtime_version
 	FDB_API_CHANGED(fdb_transaction_set_option, 14);
 	/* End versioned API changes */
 
+	// Publish only after the runtime version and versioned entry points are final.
+	g_header_api_version.store(header_version, std::memory_order_release);
 	return error_code_success;
 }
 
+extern "C" DLLEXPORT void fdb_get_selected_api_versions(int* runtime_version, int* header_version) {
+	const int headerVersion = g_header_api_version.load(std::memory_order_acquire);
+	*runtime_version = headerVersion == 0 ? 0 : g_api_version;
+	*header_version = headerVersion;
+}
+
 extern "C" DLLEXPORT int fdb_get_max_api_version() {
 	return FDB_API_VERSION;
 }
diff --git a/bindings/c/foundationdb/fdb_c.h b/bindings/c/foundationdb/fdb_c.h
index 2ddd63f1b02..2cec6230c00 100644
--- a/bindings/c/foundationdb/fdb_c.h
+++ b/bindings/c/foundationdb/fdb_c.h
@@ -671,6 +671,14 @@ DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_split_points_w
 
 DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_select_api_version_impl(int runtime_version, int header_version);
 
+/*
+ * Returns the runtime and header versions selected by fdb_select_api_version_impl,
+ * or zero for both until selection completes successfully. Both output pointers
+ * must be non-null. This query is thread-safe; API selection must still complete
+ * before other threads use the FoundationDB API.
+ */
+DLLEXPORT void fdb_get_selected_api_versions(int* runtime_version, int* header_version);
+
 DLLEXPORT int fdb_get_max_api_version(void);
 DLLEXPORT const char* fdb_get_client_version(void);
 
diff --git a/bindings/rust/CMakeLists.txt b/bindings/rust/CMakeLists.txt
index 5d5174d4077..56d81028572 100644
--- a/bindings/rust/CMakeLists.txt
+++ b/bindings/rust/CMakeLists.txt
@@ -131,7 +131,9 @@ set_tests_properties(rust_simulation_wake_order_tests PROPERTIES
 if(RUN_RUST_INTEGRATION_TESTS)
   add_custom_target(fdb_rust_integration_tests ALL
     COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
-      ${CARGO_EXECUTABLE} test ${rust_cargo_args} --package foundationdb --tests --no-run
+      ${CARGO_EXECUTABLE} test ${rust_cargo_args} --package foundationdb --package bindingtester --tests --no-run
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
+      ${CARGO_EXECUTABLE} build ${rust_cargo_args} --package foundationdb --example api_version_library
     DEPENDS fdb_rust_tests
     WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
     COMMENT "Compile Rust client integration tests"
@@ -142,9 +144,22 @@ if(RUN_RUST_INTEGRATION_TESTS)
       ${CARGO_EXECUTABLE} test ${rust_cargo_args} --package foundationdb --tests --offline -- --test-threads=1
     WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
     TEST_TIMEOUT 1200)
+  add_fdbclient_test(NAME rust_bindingtester_on_error_tests
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+      ${CARGO_EXECUTABLE} test ${rust_cargo_base_args} --features foundationdb/fdb-7_4
+      --package bindingtester --bin bindingtester --offline
+      tests::on_error_restores_transaction_before_next_instruction -- --exact --ignored
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    TEST_TIMEOUT 300)
+  add_fdbclient_test(NAME rust_api_version_libraries_tests
+    COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/tests/api_version_libraries.py
+      --client-library $<TARGET_FILE:fdb_c>
+      --rust-library ${rust_target_dir}/${rust_profile}/examples/${CMAKE_SHARED_LIBRARY_PREFIX}api_version_library${CMAKE_SHARED_LIBRARY_SUFFIX}
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    TEST_TIMEOUT 120)
   # tmp_cluster otherwise preserves an inherited default cluster. These tests
   # must always use the disposable cluster created by the test runner.
-  set_tests_properties(rust_integration_tests PROPERTIES
+  set_tests_properties(rust_integration_tests rust_bindingtester_on_error_tests rust_api_version_libraries_tests PROPERTIES
     LABELS "rust;integration"
     ENVIRONMENT_MODIFICATION "FDB_CLUSTER_FILE=unset:")
 endif()
diff --git a/bindings/rust/CONTRIBUTING.md b/bindings/rust/CONTRIBUTING.md
index 1e4b9e0941c..aa339de031d 100644
--- a/bindings/rust/CONTRIBUTING.md
+++ b/bindings/rust/CONTRIBUTING.md
@@ -59,6 +59,10 @@ for comparison with Python. Tuple tests and macro tests do not need a cluster.
 wakeups, thread ownership, and phase teardown through native workload callbacks.
 Client integration tests check timekeeper read-error propagation and versionstamp
 behavior in separate processes selecting runtime APIs 510, 520, and 740.
+The live-cluster tests also cover raw directory-prefix collisions, transaction
+reuse after bindingtester `ON_ERROR`, and two independently loaded Rust libraries
+sharing a verified C API selection. The library test uses current in-tree headers
+and checks both runtime and header-version mismatches.
 The simulation safety doctests check that borrowed
 metrics sinks cannot escape their callback and process switching requires `unsafe`.
 `rust_simulation_wake_order_tests` uses Loom to explore weak-memory interleavings of
diff --git a/bindings/rust/README.md b/bindings/rust/README.md
index 31b3f6eb8db..b0bc8877050 100644
--- a/bindings/rust/README.md
+++ b/bindings/rust/README.md
@@ -66,6 +66,13 @@ API 510, these mutations panic before reaching the C client; other supported
 API 510 operations remain available. Tuple versionstamp helpers use the modern
 four-byte offset encoding.
 
+Multiple Rust simulator libraries can share the C client's API selection when
+built against the current headers and library. Registration verifies both the
+runtime and header versions before adopting an existing selection. Historical
+headers cannot query that state, so externally selected APIs are rejected instead
+of assuming compatibility. Each library must use the same version pair; this does
+not transfer ownership of the native network thread.
+
 The client follows the same transaction, retry, key-selector, tuple, and directory
 protocols as the other bindings, expressed through Rust futures and ownership.
 The [binding tester](foundationdb-bindingtester/README.md) exercises protocol
diff --git a/bindings/rust/UPSTREAM.md b/bindings/rust/UPSTREAM.md
index fbf199c2d48..3635c1cc8a4 100644
--- a/bindings/rust/UPSTREAM.md
+++ b/bindings/rust/UPSTREAM.md
@@ -52,3 +52,7 @@ The in-tree adaptation also corrects public API contracts from this snapshot:
   encodings differ from the tuple helpers' modern encoding.
 - Timekeeper range-read errors propagate to the caller's retry loop. `None` means
   a successful read found no matching entry.
+- Simulator registration checks API-selection failures. When built with the
+  current C headers, it uses `fdb_get_selected_api_versions` to verify an existing
+  process-wide runtime/header pair before initializing another Rust library.
+  Historical headers cannot verify another library's selection and return an error.
diff --git a/bindings/rust/foundationdb-bindingtester/src/main.rs b/bindings/rust/foundationdb-bindingtester/src/main.rs
index 3016b34c300..d0e107218a4 100644
--- a/bindings/rust/foundationdb-bindingtester/src/main.rs
+++ b/bindings/rust/foundationdb-bindingtester/src/main.rs
@@ -994,7 +994,7 @@ impl StackMachine {
                         Err(err) => StackResult::from(err),
                     })
                     .boxed_local();
-                self.push_fut(number, 0, f);
+                self.push_fut(number, trx_id, f);
                 pending = true;
             }
 
@@ -2797,3 +2797,34 @@ fn main() {
 
     info!("Done.");
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    #[ignore = "requires a running FoundationDB cluster"]
+    fn on_error_restores_transaction_before_next_instruction() {
+        futures::executor::block_on(async {
+            let db = Arc::new(Database::new_compat(None).await.expect("cannot open fdb"));
+            let mut sm = StackMachine::new(&db, Bytes::from(b"on-error-reuse".as_slice()));
+            let instructions = [
+                pack(&("NEW_TRANSACTION",)),
+                pack(&("PUSH", 1020)),
+                pack(&("ON_ERROR",)),
+                pack(&("GET_READ_VERSION",)),
+            ];
+
+            for (number, instruction) in instructions.iter().enumerate() {
+                sm.run_step(db.clone(), number, Instr::from(instruction))
+                    .await
+                    .expect("instruction failed");
+            }
+
+            assert!(sm.last_version > 0);
+            assert_eq!(sm.stack.len(), 2);
+            assert_eq!(sm.stack[0].data.as_ref(), Some(&RESULT_NOT_PRESENT));
+            assert_eq!(sm.stack[1].data.as_ref(), Some(&GOT_READ_VERSION));
+        });
+    }
+}
diff --git a/bindings/rust/foundationdb-simulation/README.md b/bindings/rust/foundationdb-simulation/README.md
index f76ba0e2c12..696796171ee 100644
--- a/bindings/rust/foundationdb-simulation/README.md
+++ b/bindings/rust/foundationdb-simulation/README.md
@@ -267,7 +267,8 @@ steps, allowing the `fdbserver` to drive simulation events between awaits.
 If the native tester releases the workload while a phase is suspended, its task is canceled
 before the workload is destroyed. Final metrics collection or a new phase also cancels a
 phase left pending after the tester abandoned its native waiter. Late wakes cannot restart
-it. Timeout queries during `check` use the value sampled just before that phase began.
+it. Timeout queries during `check` use the value sampled just before that phase began;
+a timeout query before `check` cancels an abandoned setup/start before reading the workload.
 Phase futures and workload destructors still have a live context during this teardown. A native callback must not free
 a workload reentrantly while its user phase is actively being polled.
 
@@ -346,3 +347,12 @@ callbacks, so a simulation failure or timeout before that callback has no profil
   use the fresh `&mut self` and `db` references passed to the next phase. Storing `SimDatabase`,
   `Transaction`, or `Future` objects across phases will lead to segmentation faults or other
   undefined behavior.
+
+### Shared client API selection
+
+Workload libraries built against the current FoundationDB C headers and library
+can share an API selection only when both runtime and header versions match.
+Registration rejects incompatible or unverifiable selections before creating a
+workload. Historical headers do not expose the selection query and therefore
+cannot adopt another library's selection. The simulator retains ownership of the
+network and the database handles it passes into workload phases.
diff --git a/bindings/rust/foundationdb-simulation/docs/fdb_rt.md b/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
index 277f7f7e923..f5e8a0b126b 100644
--- a/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
+++ b/bindings/rust/foundationdb-simulation/docs/fdb_rt.md
@@ -63,8 +63,9 @@ removes and drops that task before dropping the user workload and invalidating t
 context. Task destruction defers nested executor drains. The phase owns its workload while
 suspended and returns it before releasing its promise, including on cancellation. A timeout
 query during `check` uses the value sampled immediately before that phase began, avoiding
-aliasing its exclusive workload borrow; idle queries call the workload getter normally.
-A final metrics callback or new phase first cancels any task left behind by an abandoned
+aliasing its exclusive workload borrow; the cached value is cleared when that phase ends.
+A timeout query before `check` cancels an abandoned setup/start before reading its timeout.
+A final metrics callback or new phase also cancels any task left behind by an abandoned
 native waiter. That cancellation retains only a weak workload reference: if releasing the
 old promise frees the native workload reentrantly, its destructor still runs with a live
 context and the incoming callback does not access the released workload. Resolving
diff --git a/bindings/rust/foundationdb-simulation/src/bindings.rs b/bindings/rust/foundationdb-simulation/src/bindings.rs
index 5b6974a38c9..4bddea8f5ac 100644
--- a/bindings/rust/foundationdb-simulation/src/bindings.rs
+++ b/bindings/rust/foundationdb-simulation/src/bindings.rs
@@ -1023,6 +1023,7 @@ mod tests {
                 // The native timeout expression may start check before asking
                 // for its timeout; the pending check still owns a mutable W.
                 assert_eq!((*workload.vt).getCheckTimeout.unwrap()(workload.inner), 7.0);
+                assert_eq!(*events.borrow(), ["phase poll"]);
                 (*workload.vt).free.unwrap()(workload.inner);
             }
             assert_eq!(
@@ -1091,51 +1092,95 @@ mod tests {
         }
 
         #[test]
-        fn a_new_phase_cancels_a_previous_native_waiters_abandoned_task() {
-            let (_native, context) = native_context(Arc::new(AtomicUsize::new(0)));
-            let events = Rc::new(RefCell::new(Vec::new()));
-            let waker = Rc::new(RefCell::new(None));
-            let workload = workload(context, &events, &waker, Wait::RetainWaker);
-            let mut start_database = NativeDatabase::default();
-            let mut check_database = NativeDatabase::default();
-            unsafe {
-                (*workload.vt).start.unwrap()(
-                    workload.inner,
-                    &mut start_database as *mut NativeDatabase as *mut _,
-                    promise(&events, None, None),
+        fn checking_cancels_an_abandoned_start_in_either_timeout_argument_order() {
+            for timeout_first in [false, true] {
+                let (_native, context) = native_context(Arc::new(AtomicUsize::new(0)));
+                let events = Rc::new(RefCell::new(Vec::new()));
+                let waker = Rc::new(RefCell::new(None));
+                let workload = workload(context, &events, &waker, Wait::RetainWaker);
+                let mut start_database = NativeDatabase::default();
+                let mut check_database = NativeDatabase::default();
+                unsafe {
+                    (*workload.vt).start.unwrap()(
+                        workload.inner,
+                        &mut start_database as *mut NativeDatabase as *mut _,
+                        promise(&events, None, None),
+                    );
+                }
+                let old_waker = waker.borrow_mut().take().unwrap();
+                unsafe {
+                    if timeout_first {
+                        assert_eq!((*workload.vt).getCheckTimeout.unwrap()(workload.inner), 7.0);
+                        assert_eq!(
+                            *events.borrow(),
+                            ["phase poll", "phase drop", "promise free"]
+                        );
+                    }
+                    (*workload.vt).check.unwrap()(
+                        workload.inner,
+                        &mut check_database as *mut NativeDatabase as *mut _,
+                        promise(&events, None, None),
+                    );
+                    assert_eq!((*workload.vt).getCheckTimeout.unwrap()(workload.inner), 7.0);
+                }
+                assert_eq!(
+                    *events.borrow(),
+                    ["phase poll", "phase drop", "promise free", "phase poll"]
                 );
+                old_waker.wake();
+                crate::fdb_rt::poll_pending_tasks();
+                assert_eq!(events.borrow().len(), 4);
+                unsafe { (*workload.vt).free.unwrap()(workload.inner) };
+                assert_eq!(
+                    *events.borrow(),
+                    [
+                        "phase poll",
+                        "phase drop",
+                        "promise free",
+                        "phase poll",
+                        "phase drop",
+                        "promise free",
+                        "workload drop"
+                    ]
+                );
+                drop(waker.borrow_mut().take());
+                release_native_database(&mut start_database);
+                release_native_database(&mut check_database);
             }
-            let old_waker = waker.borrow_mut().take().unwrap();
-            unsafe {
-                (*workload.vt).check.unwrap()(
-                    workload.inner,
-                    &mut check_database as *mut NativeDatabase as *mut _,
-                    promise(&events, None, None),
+        }
+
+        #[test]
+        fn timeout_query_can_cancel_an_abandoned_phase_and_free_its_native_owner() {
+            for setup in [false, true] {
+                let (native, context) = native_context(Arc::new(AtomicUsize::new(0)));
+                let events = Rc::new(RefCell::new(Vec::new()));
+                let waker = Rc::new(RefCell::new(None));
+                let workload = workload(context, &events, &waker, Wait::RetainWaker);
+                let mut database = NativeDatabase::default();
+                unsafe {
+                    let phase = if setup {
+                        (*workload.vt).setup.unwrap()
+                    } else {
+                        (*workload.vt).start.unwrap()
+                    };
+                    phase(
+                        workload.inner,
+                        &mut database as *mut NativeDatabase as *mut _,
+                        promise(&events, None, Some(workload)),
+                    );
+                    assert_eq!((*workload.vt).getCheckTimeout.unwrap()(workload.inner), 0.0);
+                }
+                assert_eq!(
+                    *events.borrow(),
+                    ["phase poll", "phase drop", "promise free", "workload drop"]
                 );
+                assert_eq!(database.releases.get(), 0);
+                drop(native);
+                waker.borrow_mut().take().unwrap().wake();
+                crate::fdb_rt::poll_pending_tasks();
+                assert_eq!(events.borrow().len(), 4);
+                release_native_database(&mut database);
             }
-            assert_eq!(
-                *events.borrow(),
-                ["phase poll", "phase drop", "promise free", "phase poll"]
-            );
-            old_waker.wake();
-            crate::fdb_rt::poll_pending_tasks();
-            assert_eq!(events.borrow().len(), 4);
-            unsafe { (*workload.vt).free.unwrap()(workload.inner) };
-            assert_eq!(
-                *events.borrow(),
-                [
-                    "phase poll",
-                    "phase drop",
-                    "promise free",
-                    "phase poll",
-                    "phase drop",
-                    "promise free",
-                    "workload drop"
-                ]
-            );
-            drop(waker.borrow_mut().take());
-            release_native_database(&mut start_database);
-            release_native_database(&mut check_database);
         }
 
         #[test]
diff --git a/bindings/rust/foundationdb-simulation/src/lib.rs b/bindings/rust/foundationdb-simulation/src/lib.rs
index 558e1a98325..8609204088a 100644
--- a/bindings/rust/foundationdb-simulation/src/lib.rs
+++ b/bindings/rust/foundationdb-simulation/src/lib.rs
@@ -99,7 +99,7 @@ pub trait RustWorkload: Sized + 'static {
         let inner = Box::into_raw(Box::new(Rc::new(WorkloadState {
             workload: RefCell::new(Some(Box::new(self))),
             task: Cell::new(None),
-            check_timeout: Cell::new(None),
+            active_check_timeout: Cell::new(None),
             releasing_phase: Cell::new(false),
         })));
         WrappedWorkload(FDBWorkload {
@@ -147,7 +147,7 @@ pub trait SingleRustWorkload: RustWorkload {
 struct WorkloadState<W> {
     workload: RefCell<Option<Box<W>>>,
     task: Cell<Option<TaskId>>,
-    check_timeout: Cell<Option<f64>>,
+    active_check_timeout: Cell<Option<f64>>,
     releasing_phase: Cell<bool>,
 }
 
@@ -200,6 +200,7 @@ impl<W> PhaseTask<W> {
             drop(self.future.take());
             drop(self.database.take());
             state.releasing_phase.set(false);
+            state.active_check_timeout.set(None);
             state.task.set(None);
             // Do not retain W across native promise callbacks: resolving or
             // releasing a promise may synchronously free the registered workload.
@@ -254,8 +255,8 @@ enum Phase {
     Check,
 }
 
-// A native timeout abandons its waiter without notifying the Rust task. A new
-// phase or final metrics callback ends the previous phase's exclusive access.
+// A native timeout abandons its waiter without notifying the Rust task.
+// Callbacks requiring idle W must end the previous phase's exclusive access.
 unsafe fn idle_workload<W: RustWorkload>(
     raw_workload: *mut OpaqueWorkload,
 ) -> Option<Rc<WorkloadState<W>>> {
@@ -290,7 +291,9 @@ unsafe fn spawn_phase<W: RustWorkload>(
     // Native callers may evaluate check() before getCheckTimeout(). Sampling
     // while W is idle avoids aliasing a suspended phase's exclusive borrow.
     if matches!(phase, Phase::Check) {
-        state.check_timeout.set(Some(workload.get_check_timeout()));
+        state
+            .active_check_timeout
+            .set(Some(workload.get_check_timeout()));
     }
     let mut workload = PhaseWorkload {
         workload: Some(workload),
@@ -372,14 +375,22 @@ unsafe extern "C" fn workload_get_check_timeout<W: RustWorkload>(
 ) -> f64 {
     unsafe {
         let state = &*(raw_workload as *const Rc<WorkloadState<W>>);
-        let workload = state.workload.borrow();
-        match workload.as_ref() {
-            Some(workload) => workload.get_check_timeout(),
-            None => state
-                .check_timeout
-                .get()
-                .expect("a phase samples its timeout"),
+        if let Some(timeout) = state.active_check_timeout.get() {
+            // Check can still hold an exclusive borrow of W when the native
+            // caller evaluates the timeout after starting that phase.
+            return timeout;
         }
+        // The opposite argument order can leave an abandoned setup/start
+        // holding W. Cancel it before reading the workload's current timeout.
+        let Some(state) = idle_workload::<W>(raw_workload) else {
+            // Releasing the old promise synchronously freed the native owner.
+            return 0.0;
+        };
+        let workload = state.workload.borrow();
+        workload
+            .as_ref()
+            .expect("cancellation restores the workload")
+            .get_check_timeout()
     }
 }
 unsafe extern "C" fn workload_drop<W: RustWorkload>(raw_workload: *mut OpaqueWorkload) {
@@ -440,9 +451,10 @@ macro_rules! register_factory {
                 .is_ok()
             {
                 let version = <$name as $crate::RustWorkloadFactory>::FDB_API_VERSION;
-                let _ = foundationdb::api::FdbApiBuilder::default()
+                foundationdb::api::FdbApiBuilder::default()
                     .set_runtime_version(version as i32)
-                    .build();
+                    .build()
+                    .expect("the workload API must match the shared C client selection");
                 println!("FDB API version selected: {version}");
                 foundationdb::future::CUSTOM_EXECUTOR_HOOK
                     .set($crate::internals::poll_pending_tasks)
@@ -481,9 +493,10 @@ macro_rules! register_workload {
                 .is_ok()
             {
                 let version = <$name as $crate::SingleRustWorkload>::FDB_API_VERSION;
-                let _ = foundationdb::api::FdbApiBuilder::default()
+                foundationdb::api::FdbApiBuilder::default()
                     .set_runtime_version(version as i32)
-                    .build();
+                    .build()
+                    .expect("the workload API must match the shared C client selection");
                 println!("FDB API version selected: {version}");
                 foundationdb::future::CUSTOM_EXECUTOR_HOOK
                     .set($crate::internals::poll_pending_tasks)
diff --git a/bindings/rust/foundationdb-sys/build.rs b/bindings/rust/foundationdb-sys/build.rs
index 836ef9c5e90..d6496dc3cff 100644
--- a/bindings/rust/foundationdb-sys/build.rs
+++ b/bindings/rust/foundationdb-sys/build.rs
@@ -57,6 +57,8 @@ compile_error!(
 );
 
 fn main() {
+    println!("cargo:rustc-check-cfg=cfg(fdb_has_selected_api_versions)");
+
     // Link against fdb_c.
     println!("cargo:rustc-link-lib=fdb_c");
 
@@ -141,6 +143,14 @@ fn main() {
         .layout_tests(false)
         .generate()
         .expect("Unable to generate FoundationDB bindings");
+    // Historical headers cannot query another library's API selection. Detect
+    // the generated declaration rather than assuming support from the runtime API.
+    if bindings
+        .to_string()
+        .contains("pub fn fdb_get_selected_api_versions(")
+    {
+        println!("cargo:rustc-cfg=fdb_has_selected_api_versions");
+    }
     bindings
         .write_to_file(out_path.join("bindings.rs"))
         .expect("Couldn't write bindings!");
diff --git a/bindings/rust/foundationdb-sys/src/lib.rs b/bindings/rust/foundationdb-sys/src/lib.rs
index d7eb2468322..234bd9b541c 100644
--- a/bindings/rust/foundationdb-sys/src/lib.rs
+++ b/bindings/rust/foundationdb-sys/src/lib.rs
@@ -4,6 +4,29 @@
 #![allow(clippy::unreadable_literal)]
 include!(concat!(env!("OUT_DIR"), "/bindings.rs"));
 
+/// Returns the selected runtime and header API versions when the build headers
+/// expose the query. The returned pair is `(0, 0)` before successful selection.
+///
+/// Historical headers return `None`; code built with current headers requires a
+/// C library that also exports `fdb_get_selected_api_versions`.
+pub fn selected_api_versions() -> Option<(i32, i32)> {
+    #[cfg(fdb_has_selected_api_versions)]
+    {
+        let mut runtime_version = 0;
+        let mut header_version = 0;
+        // SAFETY: Both outputs are live, distinct integers. The C query is
+        // thread-safe and does not change API selection or the network lifecycle.
+        unsafe {
+            fdb_get_selected_api_versions(&mut runtime_version, &mut header_version);
+        }
+        Some((runtime_version, header_version))
+    }
+    #[cfg(not(fdb_has_selected_api_versions))]
+    {
+        None
+    }
+}
+
 /// Defines the FDB_API_VERSION constant and generates the `if_cfg_api_versions` macro
 /// from a list of (name, number) versions.
 ///
diff --git a/bindings/rust/foundationdb/Cargo.toml b/bindings/rust/foundationdb/Cargo.toml
index e221cad536a..88d54ea2349 100644
--- a/bindings/rust/foundationdb/Cargo.toml
+++ b/bindings/rust/foundationdb/Cargo.toml
@@ -75,3 +75,8 @@ bytesize = "2.4"
 uuid = { version = "1.23.3", features = ["v4"] }
 futures-util = "0.3.32"
 tracing-subscriber = "0.3.23"
+
+[[example]]
+name = "api_version_library"
+crate-type = ["cdylib"]
+required-features = ["fdb-7_4"]
diff --git a/bindings/rust/foundationdb/examples/api_version_library.rs b/bindings/rust/foundationdb/examples/api_version_library.rs
new file mode 100644
index 00000000000..4bc728bb817
--- /dev/null
+++ b/bindings/rust/foundationdb/examples/api_version_library.rs
@@ -0,0 +1,57 @@
+//! Shared-library fixture for the API-selection integration test.
+
+use foundationdb::{
+    Database,
+    api::FdbApiBuilder,
+    options::{MutationType, TransactionOption},
+    tuple::{Subspace, Versionstamp},
+};
+use foundationdb_sys::FDBDatabase;
+use std::mem::ManuallyDrop;
+use std::ptr::NonNull;
+
+#[unsafe(no_mangle)]
+pub extern "C" fn test_select_api(version: i32) -> i32 {
+    match FdbApiBuilder::default()
+        .set_runtime_version(version)
+        .build()
+    {
+        Ok(_) => 0,
+        Err(error) => error.code(),
+    }
+}
+
+/// Queue modern versionstamp mutations using this library's API-selection state.
+///
+/// # Safety
+///
+/// `database` must point to a live C API database with the network running. The
+/// caller must keep it alive and must not access it until this call returns.
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn test_versionstamped_mutations(database: *mut FDBDatabase) -> i32 {
+    // The harness retains ownership. This wrapper is used exclusively for this
+    // call, and all transactions are destroyed before returning the borrow.
+    let database = ManuallyDrop::new(unsafe {
+        Database::new_from_pointer(NonNull::new(database).expect("database pointer"))
+    });
+    let result = futures::executor::block_on(async {
+        let trx = database.create_trx()?;
+        trx.set_option(TransactionOption::Timeout(10_000))?;
+        trx.get_read_version().await?;
+
+        let subspace = Subspace::from("test-api-version-library");
+        let key = subspace.pack_with_versionstamp(&("key", Versionstamp::incomplete(0)));
+        let value = subspace.pack_with_versionstamp(&("value", Versionstamp::incomplete(1)));
+        trx.atomic_op(&key, b"value", MutationType::SetVersionstampedKey);
+        trx.atomic_op(
+            &subspace.pack(&"value"),
+            &value,
+            MutationType::SetVersionstampedValue,
+        );
+        Ok::<_, foundationdb::FdbError>(())
+    });
+    match result {
+        Ok(()) => 0,
+        Err(error) => error.code(),
+    }
+}
diff --git a/bindings/rust/foundationdb/src/api.rs b/bindings/rust/foundationdb/src/api.rs
index 9a58c51350b..3dd41e7367b 100644
--- a/bindings/rust/foundationdb/src/api.rs
+++ b/bindings/rust/foundationdb/src/api.rs
@@ -13,7 +13,7 @@
 //! - [API versioning](https://apple.github.io/foundationdb/api-c.html#api-versioning)
 //! - [Network](https://apple.github.io/foundationdb/api-c.html#network)
 //!
-//! The network lifecycle is tracked by a process-global state machine
+//! The network lifecycle is tracked by a Rust-library-local state machine
 //! (`Uninitialized -> ApiVersionSelected -> Running -> Stopped`). Booting is safe
 //! and idempotent, the network is started lazily by [`crate::Database`]
 //! constructors if needed, and it runs until process exit: an atexit hook stops it
@@ -52,7 +52,7 @@ const ERR_API_VERSION_NOT_SUPPORTED: i32 = 2203;
 const ERR_NETWORK_ALREADY_SETUP: i32 = 2009;
 const ERR_NETWORK_CANNOT_BE_RESTARTED: i32 = 2025;
 
-/// Process-global lifecycle of the FoundationDB client.
+/// Lifecycle of this Rust library's FoundationDB client.
 ///
 /// The C API allows selecting the API version and setting up the network once per
 /// process, and the network can never be restarted once stopped. Every FFI call
@@ -73,9 +73,9 @@ enum NetworkLifecycle {
 }
 
 static NETWORK: Mutex<NetworkLifecycle> = Mutex::new(NetworkLifecycle::Uninitialized);
-// Published after successful API selection and never changed. Version-dependent
-// transaction operations must not take the lifecycle lock (network shutdown
-// holds it while joining the network thread).
+// Published after successful or verified shared API selection and never changed.
+// Version-dependent transaction operations must not take the lifecycle lock
+// (network shutdown holds it while joining the network thread).
 static SELECTED_API_VERSION: AtomicI32 = AtomicI32::new(0);
 static STOP_ON_EXIT: AtomicBool = AtomicBool::new(true);
 // Last error returned by fdb_run_network (0 = none). An atomic, not a mutex: the
@@ -100,10 +100,20 @@ impl NetworkLifecycle {
     fn select_api_version(&mut self, version: i32) -> FdbResult<()> {
         match self {
             NetworkLifecycle::Uninitialized => {
-                error::eval(unsafe {
-                    fdb_sys::fdb_select_api_version_impl(version, fdb_sys::FDB_API_VERSION as i32)
-                })
-                .inspect_err(|e| {
+                let header_version = fdb_sys::FDB_API_VERSION as i32;
+                let selection =
+                    unsafe { fdb_sys::fdb_select_api_version_impl(version, header_version) };
+                // Another Rust shared library has its own lifecycle state. Only
+                // the shared C library can confirm both runtime semantics and
+                // the header version controlling its versioned entry points.
+                let selection = if selection == ERR_API_VERSION_ALREADY_SET
+                    && fdb_sys::selected_api_versions() == Some((version, header_version))
+                {
+                    0
+                } else {
+                    selection
+                };
+                error::eval(selection).inspect_err(|e| {
                     // generally means the local libfdb doesn't support the requested version
                     if e.code() == ERR_API_VERSION_NOT_SUPPORTED {
                         let max_api_version = get_max_api_version();
@@ -337,12 +347,17 @@ impl FdbApiBuilder {
 
     /// Selects the foundationDB API version and returns a `NetworkBuilder`.
     ///
-    /// Idempotent: re-selecting the version already in use is a no-op.
+    /// Re-selecting this Rust library's existing version is a no-op. With current
+    /// C headers and their matching library, a version selected by another shared
+    /// library is also accepted when both runtime and header versions match.
+    /// Historical headers cannot verify external selection and return error 2201.
+    /// This selects API behavior only; it does not adopt or start another library's
+    /// network thread.
     ///
     /// # Errors
     ///
-    /// - error 2201 (`api_version_already_set`) if a different version was selected
-    ///   before
+    /// - error 2201 (`api_version_already_set`) if a different runtime or header
+    ///   version was selected before, or an external selection cannot be verified
     /// - error 2203 (`api_version_not_supported`) if the installed libfdb_c does
     ///   not support the requested version
     pub fn build(self) -> FdbResult<NetworkBuilder> {
diff --git a/bindings/rust/foundationdb/src/directory/directory_layer.rs b/bindings/rust/foundationdb/src/directory/directory_layer.rs
index e39a157c719..423f73b3f5a 100644
--- a/bindings/rust/foundationdb/src/directory/directory_layer.rs
+++ b/bindings/rust/foundationdb/src/directory/directory_layer.rs
@@ -428,8 +428,12 @@ impl DirectoryLayer {
                 let allocator = self.allocator.allocate(trx).await?;
                 let subspace = self.content_subspace.subspace(&allocator);
 
-                // checking range
-                let mut range_option = RangeOption::from(subspace.range());
+                // A directory owns every raw key under its prefix, including the
+                // bare prefix and suffixes outside the tuple-element range.
+                let mut range_option = RangeOption::from((
+                    subspace.bytes().to_vec(),
+                    strinc(subspace.bytes().to_vec()),
+                ));
                 range_option.limit = Some(1);
 
                 let result = trx
diff --git a/bindings/rust/foundationdb/tests/directory.rs b/bindings/rust/foundationdb/tests/directory.rs
index ad88134b1f9..db11fee1bf0 100644
--- a/bindings/rust/foundationdb/tests/directory.rs
+++ b/bindings/rust/foundationdb/tests/directory.rs
@@ -5,7 +5,7 @@
 // http://opensource.org/licenses/MIT>, at your option. This file may not be
 // copied, modified, or distributed except according to those terms.
 
-use foundationdb::directory::DirectoryLayer;
+use foundationdb::directory::{DirectoryError, DirectoryLayer};
 
 use foundationdb::directory::Directory;
 
@@ -45,6 +45,69 @@ async fn test_directory() {
         .expect("failed to run");
 }
 
+#[tokio::test]
+async fn test_directory_rejects_occupied_bare_prefix() {
+    test_directory_rejects_occupied_raw_prefix("test-directory-bare-prefix", &[]).await;
+}
+
+#[tokio::test]
+async fn test_directory_rejects_occupied_ff_suffix() {
+    test_directory_rejects_occupied_raw_prefix("test-directory-ff-suffix", &[0xff]).await;
+}
+
+async fn test_directory_rejects_occupied_raw_prefix(name: &str, suffix: &[u8]) {
+    let db = common::database().await.expect("cannot open fdb");
+    let test_root = Subspace::from(name);
+    let content = test_root.subspace(&"content");
+    let directory = DirectoryLayer::new(test_root.subspace(&"node"), content.clone(), false);
+    let path = vec![String::from("occupied")];
+    let value = b"existing application data";
+
+    // Occupy every candidate in the initial allocator window so this does not
+    // depend on which random candidate the allocator chooses.
+    let keys: Vec<_> = (0..64_i64)
+        .map(|candidate| {
+            let mut key = content.pack(&candidate);
+            key.extend_from_slice(suffix);
+            key
+        })
+        .collect();
+    let trx = db.create_trx().expect("cannot create txn");
+    trx.clear_subspace_range(&test_root);
+    for key in &keys {
+        trx.set(key, value);
+    }
+    trx.commit()
+        .await
+        .expect("cannot populate occupied prefixes");
+
+    let trx = db.create_trx().expect("cannot create txn");
+    assert!(matches!(
+        directory.create(&trx, &path, None, None).await,
+        Err(DirectoryError::PrefixNotEmpty)
+    ));
+    drop(trx);
+
+    let trx = db.create_trx().expect("cannot create txn");
+    assert!(
+        !directory
+            .remove_if_exists(&trx, &path)
+            .await
+            .expect("cannot check rejected directory")
+    );
+    trx.commit().await.expect("cannot commit removal check");
+
+    let trx = db.create_trx().expect("cannot create txn");
+    for key in &keys {
+        let stored = trx
+            .get(key, false)
+            .await
+            .expect("cannot read occupied prefix")
+            .expect("existing key was removed");
+        assert_eq!(&*stored, value);
+    }
+}
+
 async fn test_create_then_open_then_delete(
     db: &Database,
     directory: &DirectoryLayer,
diff --git a/bindings/rust/tests/api_version_libraries.py b/bindings/rust/tests/api_version_libraries.py
new file mode 100644
index 00000000000..5023d5f95cc
--- /dev/null
+++ b/bindings/rust/tests/api_version_libraries.py
@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""Exercise independent Rust API-selection state against one shared C client."""
+
+import argparse
+import contextlib
+import ctypes
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import threading
+
+
+def load_client(path):
+    client = ctypes.CDLL(str(path), mode=ctypes.RTLD_LOCAL)
+    client.fdb_select_api_version_impl.argtypes = [ctypes.c_int, ctypes.c_int]
+    client.fdb_select_api_version_impl.restype = ctypes.c_int
+    client.fdb_get_selected_api_versions.argtypes = [
+        ctypes.POINTER(ctypes.c_int),
+        ctypes.POINTER(ctypes.c_int),
+    ]
+    client.fdb_get_selected_api_versions.restype = None
+    for name in ("fdb_setup_network", "fdb_run_network", "fdb_stop_network"):
+        function = getattr(client, name)
+        function.argtypes = []
+        function.restype = ctypes.c_int
+    client.fdb_create_database.argtypes = [
+        ctypes.c_char_p,
+        ctypes.POINTER(ctypes.c_void_p),
+    ]
+    client.fdb_create_database.restype = ctypes.c_int
+    client.fdb_database_destroy.argtypes = [ctypes.c_void_p]
+    client.fdb_database_destroy.restype = None
+    client.fdb_get_error.argtypes = [ctypes.c_int]
+    client.fdb_get_error.restype = ctypes.c_char_p
+    return client
+
+
+def load_rust(path):
+    library = ctypes.CDLL(str(path), mode=ctypes.RTLD_LOCAL)
+    library.test_select_api.argtypes = [ctypes.c_int]
+    library.test_select_api.restype = ctypes.c_int
+    library.test_versionstamped_mutations.argtypes = [ctypes.c_void_p]
+    library.test_versionstamped_mutations.restype = ctypes.c_int
+    return library
+
+
+def require(condition, message):
+    if not condition:
+        raise AssertionError(message)
+
+
+def check(client, error, operation):
+    if error:
+        description = client.fdb_get_error(error).decode("utf-8")
+        raise RuntimeError(f"{operation}: {error} ({description})")
+
+
+def selected_versions(client):
+    runtime = ctypes.c_int(-1)
+    header = ctypes.c_int(-1)
+    client.fdb_get_selected_api_versions(ctypes.byref(runtime), ctypes.byref(header))
+    return runtime.value, header.value
+
+
+@contextlib.contextmanager
+def running_database(client, cluster_file):
+    check(client, client.fdb_setup_network(), "set up network")
+    network_result = []
+    network = threading.Thread(
+        target=lambda: network_result.append(client.fdb_run_network()), daemon=True
+    )
+    network.start()
+    database = ctypes.c_void_p()
+    try:
+        cluster_path = str(cluster_file).encode() if cluster_file else None
+        check(
+            client,
+            client.fdb_create_database(cluster_path, ctypes.byref(database)),
+            "create database",
+        )
+        yield database
+    finally:
+        if database.value:
+            client.fdb_database_destroy(database)
+        stop_error = client.fdb_stop_network()
+        network.join(timeout=10)
+        require(not network.is_alive(), "network thread did not stop within 10 seconds")
+        check(client, stop_error, "stop network")
+        require(len(network_result) == 1, "network thread did not return a result")
+        check(client, network_result[0], "run network")
+
+
+def run_case(args):
+    client = load_client(args.client_library)
+    require(selected_versions(client) == (0, 0), "API was selected before the test")
+    with tempfile.TemporaryDirectory(prefix="fdb-rust-api-libraries-") as directory:
+        first_path = Path(directory) / ("first" + args.rust_library.suffix)
+        second_path = Path(directory) / ("second" + args.rust_library.suffix)
+        shutil.copyfile(args.rust_library, first_path)
+        shutil.copyfile(args.rust_library, second_path)
+        require(
+            not first_path.samefile(second_path),
+            "Rust fixtures must be distinct files so dlopen does not reuse one image",
+        )
+        first = load_rust(first_path)
+        if args.case == "incompatible-header":
+            check(client, client.fdb_select_api_version_impl(730, 730), "select native API")
+            require(first.test_select_api(730) == 2201, "accepted a mismatched header API")
+            require(selected_versions(client) == (730, 730), "changed the native API")
+            return
+
+        second = load_rust(second_path)
+        check(client, first.test_select_api(740), "select API in first Rust library")
+        require(selected_versions(client) == (740, 740), "first library used another client")
+        require(second.test_select_api(730) == 2201, "accepted a mismatched runtime API")
+        check(client, second.test_select_api(740), "adopt API in second Rust library")
+        check(client, first.test_select_api(740), "repeat selection in first Rust library")
+        require(selected_versions(client) == (740, 740), "changed the selected API")
+        with running_database(client, args.cluster_file) as database:
+            for name, library in (("first", first), ("second", second)):
+                check(
+                    client,
+                    library.test_versionstamped_mutations(database),
+                    f"versionstamp mutations in {name} Rust library",
+                )
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--client-library", required=True, type=Path)
+    parser.add_argument("--rust-library", required=True, type=Path)
+    parser.add_argument("--cluster-file", type=Path)
+    parser.add_argument(
+        "--case", choices=("shared-selection", "incompatible-header"), help=argparse.SUPPRESS
+    )
+    args = parser.parse_args()
+    if args.case:
+        run_case(args)
+        print(f"Rust API library regression passed: {args.case}", flush=True)
+        return
+
+    # API selection is irreversible, so each compatibility boundary needs a
+    # fresh process. An abort from either Rust library must fail the parent.
+    for case in ("shared-selection", "incompatible-header"):
+        command = [
+            sys.executable,
+            str(Path(__file__).resolve()),
+            "--client-library",
+            str(args.client_library.resolve()),
+            "--rust-library",
+            str(args.rust_library.resolve()),
+            "--case",
+            case,
+        ]
+        if args.cluster_file:
+            command.extend(("--cluster-file", str(args.cluster_file.resolve())))
+        subprocess.run(command, check=True, timeout=60)
+
+
+if __name__ == "__main__":
+    main()

From ba4fca461d819f4e5436494f490319e49a20a4e1 Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Wed, 30 Sep 2026 22:31:18 -0700
Subject: [PATCH 09/11] Fix Rust shared API initialization and failed retry
 ownership

---
 bindings/c/fdb_c.cpp                          |   8 ++
 bindings/c/foundationdb/fdb_c.h               |   1 +
 bindings/rust/CONTRIBUTING.md                 |   9 +-
 .../foundationdb-bindingtester/src/main.rs    |  31 +++--
 bindings/rust/foundationdb/src/transaction.rs |  30 ++++-
 bindings/rust/tests/api_version_libraries.py  | 117 ++++++++++++++++--
 documentation/sphinx/source/api-c.rst         |   4 +-
 7 files changed, 169 insertions(+), 31 deletions(-)

diff --git a/bindings/c/fdb_c.cpp b/bindings/c/fdb_c.cpp
index c2bb46afb67..2cfe4977579 100644
--- a/bindings/c/fdb_c.cpp
+++ b/bindings/c/fdb_c.cpp
@@ -22,6 +22,7 @@
 #include "flow/ProtocolVersion.h"
 #include <atomic>
 #include <cstdint>
+#include <mutex>
 #define FDB_USE_LATEST_API_VERSION
 #define FDB_INCLUDE_LEGACY_TYPES
 
@@ -1110,6 +1111,13 @@ extern "C" DLLEXPORT FDBFuture* fdb_transaction_get_range_split_points_with_limi
 		fdb_api_ptr_##func = (void*)&fdb_api_ptr_removed;
 
 extern "C" DLLEXPORT fdb_error_t fdb_select_api_version_impl(int runtime_version, int header_version) {
+	std::unique_lock<std::mutex> selectionLock;
+	RETURN_ON_ERROR(
+	    // Shared by every caller of this C library, including independently loaded language bindings.
+	    // Retain the mutex through process exit so late calls cannot encounter a destroyed lock.
+	    static auto* const selectionMutex = new std::mutex;
+	    selectionLock = std::unique_lock<std::mutex>(*selectionMutex););
+
 	/* Can only call this once */
 	if (g_api_version != 0)
 		return error_code_api_version_already_set;
diff --git a/bindings/c/foundationdb/fdb_c.h b/bindings/c/foundationdb/fdb_c.h
index 2cec6230c00..0fc53952e63 100644
--- a/bindings/c/foundationdb/fdb_c.h
+++ b/bindings/c/foundationdb/fdb_c.h
@@ -669,6 +669,7 @@ DLLEXPORT WARN_UNUSED_RESULT FDBFuture* fdb_transaction_get_range_split_points_w
 #define FDB_KEYSEL_FIRST_GREATER_THAN(k, l) k, l, 1, 1
 #define FDB_KEYSEL_FIRST_GREATER_OR_EQUAL(k, l) k, l, 0, 1
 
+/* Concurrent selection calls are serialized; calls after successful selection return api_version_already_set. */
 DLLEXPORT WARN_UNUSED_RESULT fdb_error_t fdb_select_api_version_impl(int runtime_version, int header_version);
 
 /*
diff --git a/bindings/rust/CONTRIBUTING.md b/bindings/rust/CONTRIBUTING.md
index aa339de031d..a067144fc84 100644
--- a/bindings/rust/CONTRIBUTING.md
+++ b/bindings/rust/CONTRIBUTING.md
@@ -59,10 +59,11 @@ for comparison with Python. Tuple tests and macro tests do not need a cluster.
 wakeups, thread ownership, and phase teardown through native workload callbacks.
 Client integration tests check timekeeper read-error propagation and versionstamp
 behavior in separate processes selecting runtime APIs 510, 520, and 740.
-The live-cluster tests also cover raw directory-prefix collisions, transaction
-reuse after bindingtester `ON_ERROR`, and two independently loaded Rust libraries
-sharing a verified C API selection. The library test uses current in-tree headers
-and checks both runtime and header-version mismatches.
+The live-cluster tests also cover raw directory-prefix collisions and transaction
+preservation after both retryable and nonretryable bindingtester `ON_ERROR` results,
+including reset and reuse. The library test uses current in-tree headers and two
+independently loaded Rust libraries to check concurrent initial API selection,
+shared selection, and runtime/header-version mismatches.
 The simulation safety doctests check that borrowed
 metrics sinks cannot escape their callback and process switching requires `unsafe`.
 `rust_simulation_wake_order_tests` uses Loom to explore weak-memory interleavings of
diff --git a/bindings/rust/foundationdb-bindingtester/src/main.rs b/bindings/rust/foundationdb-bindingtester/src/main.rs
index d0e107218a4..1153c8b089c 100644
--- a/bindings/rust/foundationdb-bindingtester/src/main.rs
+++ b/bindings/rust/foundationdb-bindingtester/src/main.rs
@@ -985,13 +985,10 @@ impl StackMachine {
                 let trx_id = self.next_trx_id();
                 let f = trx
                     .take(trx_id)
-                    .on_error(error)
-                    .map(|res| match res {
-                        Ok(trx) => StackResult {
-                            state: trx_name.map(|n| (n, TransactionState::Transaction(trx))),
-                            data: Ok(RESULT_NOT_PRESENT.clone().into_owned()),
-                        },
-                        Err(err) => StackResult::from(err),
+                    .on_error_with_transaction(error)
+                    .map(|(trx, result)| StackResult {
+                        state: trx_name.map(|n| (n, TransactionState::Transaction(trx))),
+                        data: result.map(|()| RESULT_NOT_PRESENT.clone().into_owned()),
                     })
                     .boxed_local();
                 self.push_fut(number, trx_id, f);
@@ -2808,11 +2805,20 @@ mod tests {
         futures::executor::block_on(async {
             let db = Arc::new(Database::new_compat(None).await.expect("cannot open fdb"));
             let mut sm = StackMachine::new(&db, Bytes::from(b"on-error-reuse".as_slice()));
+            let key = b"on-error-reuse".as_slice();
             let instructions = [
                 pack(&("NEW_TRANSACTION",)),
                 pack(&("PUSH", 1020)),
                 pack(&("ON_ERROR",)),
                 pack(&("GET_READ_VERSION",)),
+                pack(&("PUSH", 2000)),
+                pack(&("ON_ERROR",)),
+                pack(&("WAIT_FUTURE",)),
+                pack(&("PUSH", key)),
+                pack(&("GET",)),
+                pack(&("WAIT_FUTURE",)),
+                pack(&("RESET",)),
+                pack(&("GET_READ_VERSION",)),
             ];
 
             for (number, instruction) in instructions.iter().enumerate() {
@@ -2821,10 +2827,17 @@ mod tests {
                     .expect("instruction failed");
             }
 
-            assert!(sm.last_version > 0);
-            assert_eq!(sm.stack.len(), 2);
+            let error = Element::Bytes(pack(&(b"ERROR".as_slice(), b"2000".as_slice())).into());
+            let cancelled = Element::Bytes(pack(&(b"ERROR".as_slice(), b"1025".as_slice())).into());
+            assert_eq!(sm.stack.len(), 5);
             assert_eq!(sm.stack[0].data.as_ref(), Some(&RESULT_NOT_PRESENT));
             assert_eq!(sm.stack[1].data.as_ref(), Some(&GOT_READ_VERSION));
+            assert_eq!(sm.stack[2].data.as_ref(), Some(&error));
+            // A failed on_error cancels the native transaction at API >= 610.
+            // A replacement transaction or implicit reset would hide this state.
+            assert_eq!(sm.stack[3].data.as_ref(), Some(&cancelled));
+            assert_eq!(sm.stack[4].data.as_ref(), Some(&GOT_READ_VERSION));
+            assert!(sm.last_version > 0);
         });
     }
 }
diff --git a/bindings/rust/foundationdb/src/transaction.rs b/bindings/rust/foundationdb/src/transaction.rs
index ec1773800d5..4725c6ff20c 100644
--- a/bindings/rust/foundationdb/src/transaction.rs
+++ b/bindings/rust/foundationdb/src/transaction.rs
@@ -1447,10 +1447,28 @@ impl Transaction {
     /// [client budget](Self::set_client_budget) is kept. User versions
     /// allocated by [`Self::allocate_user_version`] are invalid for the new
     /// attempt, which starts allocating again at zero.
+    ///
+    /// On failure, the transaction is dropped. Use [`Self::on_error_with_transaction`]
+    /// to retain ownership on both success and failure.
     pub fn on_error(
         self,
         err: FdbError,
     ) -> impl Future<Output = FdbResult<Transaction>> + Send + Sync + Unpin {
+        self.on_error_with_transaction(err)
+            .map(|(transaction, result)| result.map(|()| transaction))
+    }
+
+    /// Applies the same retry and backoff behavior as [`Self::on_error`], returning
+    /// ownership of the transaction even when the error cannot be retried.
+    ///
+    /// On success, the returned transaction has been reset for a new attempt.
+    /// On failure, it retains the state left by the native error handler, which
+    /// may be canceled. Call [`Self::reset`] before using it for another attempt.
+    /// This method does not replace or explicitly reset the failed transaction.
+    pub fn on_error_with_transaction(
+        self,
+        err: FdbError,
+    ) -> impl Future<Output = (Transaction, FdbResult<()>)> + Send + Sync + Unpin {
         self.mark_attempt_end();
 
         unsafe {
@@ -1459,11 +1477,13 @@ impl Transaction {
                 err.code(),
             ))
         }
-        .map_ok(move |()| {
-            self.end_attempt(AttemptOutcome::Retried { cause: err });
-            self.begin_attempt_usage();
-            self.reset_user_version_allocator();
-            self
+        .map(move |result| {
+            if result.is_ok() {
+                self.end_attempt(AttemptOutcome::Retried { cause: err });
+                self.begin_attempt_usage();
+                self.reset_user_version_allocator();
+            }
+            (self, result)
         })
     }
 
diff --git a/bindings/rust/tests/api_version_libraries.py b/bindings/rust/tests/api_version_libraries.py
index 5023d5f95cc..94e4335d019 100644
--- a/bindings/rust/tests/api_version_libraries.py
+++ b/bindings/rust/tests/api_version_libraries.py
@@ -64,6 +64,34 @@ def selected_versions(client):
     return runtime.value, header.value
 
 
+def concurrent_selections(*operations):
+    barrier = threading.Barrier(len(operations), timeout=10)
+    results = [None] * len(operations)
+    errors = [None] * len(operations)
+
+    def select(index, operation):
+        try:
+            barrier.wait()
+            # CDLL releases the GIL while each independent library enters C.
+            results[index] = operation()
+        except Exception as error:
+            errors[index] = error
+
+    threads = [
+        threading.Thread(target=select, args=(index, operation), daemon=True)
+        for index, operation in enumerate(operations)
+    ]
+    for thread in threads:
+        thread.start()
+    for thread in threads:
+        thread.join(timeout=10)
+        require(not thread.is_alive(), "API selection did not finish within 10 seconds")
+    for error in errors:
+        if error is not None:
+            raise RuntimeError("concurrent API selection failed") from error
+    return results
+
+
 @contextlib.contextmanager
 def running_database(client, cluster_file):
     check(client, client.fdb_setup_network(), "set up network")
@@ -106,18 +134,80 @@ def run_case(args):
         )
         first = load_rust(first_path)
         if args.case == "incompatible-header":
-            check(client, client.fdb_select_api_version_impl(730, 730), "select native API")
-            require(first.test_select_api(730) == 2201, "accepted a mismatched header API")
+            check(
+                client,
+                client.fdb_select_api_version_impl(730, 730),
+                "select native API",
+            )
+            require(
+                first.test_select_api(730) == 2201, "accepted a mismatched header API"
+            )
             require(selected_versions(client) == (730, 730), "changed the native API")
             return
 
         second = load_rust(second_path)
-        check(client, first.test_select_api(740), "select API in first Rust library")
-        require(selected_versions(client) == (740, 740), "first library used another client")
-        require(second.test_select_api(730) == 2201, "accepted a mismatched runtime API")
-        check(client, second.test_select_api(740), "adopt API in second Rust library")
-        check(client, first.test_select_api(740), "repeat selection in first Rust library")
-        require(selected_versions(client) == (740, 740), "changed the selected API")
+        if args.case == "concurrent-matching":
+            results = concurrent_selections(
+                lambda: first.test_select_api(740),
+                lambda: second.test_select_api(740),
+            )
+            require(results == [0, 0], f"matching API selections failed: {results}")
+            expected_versions = (740, 740)
+        elif args.case == "concurrent-runtime-mismatch":
+            results = concurrent_selections(
+                lambda: first.test_select_api(740),
+                lambda: second.test_select_api(730),
+            )
+            require(
+                sorted(results) == [0, 2201],
+                f"conflicting runtime selections must have one winner: {results}",
+            )
+            expected_versions = ((740, 730)[results.index(0)], 740)
+        elif args.case == "concurrent-header-mismatch":
+            results = concurrent_selections(
+                lambda: first.test_select_api(730),
+                lambda: client.fdb_select_api_version_impl(730, 730),
+            )
+            require(
+                sorted(results) == [0, 2201],
+                f"conflicting header selections must have one winner: {results}",
+            )
+            expected_versions = (730, (740, 730)[results.index(0)])
+            require(
+                selected_versions(client) == expected_versions, "changed the API pair"
+            )
+            if expected_versions[1] == 730:
+                for library in (first, second):
+                    require(
+                        library.test_select_api(730) == 2201,
+                        "accepted the incompatible winning header API",
+                    )
+                return
+        else:
+            check(
+                client, first.test_select_api(740), "select API in first Rust library"
+            )
+            require(
+                selected_versions(client) == (740, 740),
+                "first library used another client",
+            )
+            require(
+                second.test_select_api(730) == 2201, "accepted a mismatched runtime API"
+            )
+            expected_versions = (740, 740)
+
+        require(
+            selected_versions(client) == expected_versions, "wrong API pair selected"
+        )
+        for name, library in (("first", first), ("second", second)):
+            check(
+                client,
+                library.test_select_api(expected_versions[0]),
+                f"adopt or repeat winning API in {name} Rust library",
+            )
+        require(
+            selected_versions(client) == expected_versions, "changed the selected API"
+        )
         with running_database(client, args.cluster_file) as database:
             for name, library in (("first", first), ("second", second)):
                 check(
@@ -132,9 +222,14 @@ def main():
     parser.add_argument("--client-library", required=True, type=Path)
     parser.add_argument("--rust-library", required=True, type=Path)
     parser.add_argument("--cluster-file", type=Path)
-    parser.add_argument(
-        "--case", choices=("shared-selection", "incompatible-header"), help=argparse.SUPPRESS
+    cases = (
+        "shared-selection",
+        "incompatible-header",
+        "concurrent-matching",
+        "concurrent-runtime-mismatch",
+        "concurrent-header-mismatch",
     )
+    parser.add_argument("--case", choices=cases, help=argparse.SUPPRESS)
     args = parser.parse_args()
     if args.case:
         run_case(args)
@@ -143,7 +238,7 @@ def main():
 
     # API selection is irreversible, so each compatibility boundary needs a
     # fresh process. An abort from either Rust library must fail the parent.
-    for case in ("shared-selection", "incompatible-header"):
+    for case in cases:
         command = [
             sys.executable,
             str(Path(__file__).resolve()),
diff --git a/documentation/sphinx/source/api-c.rst b/documentation/sphinx/source/api-c.rst
index 8971175bae1..78460d0a700 100644
--- a/documentation/sphinx/source/api-c.rst
+++ b/documentation/sphinx/source/api-c.rst
@@ -144,7 +144,7 @@ Prior to including ``fdb_c.h``, you must define the ``FDB_API_VERSION`` macro. T
 
    Passing a version less than ``FDB_API_VERSION`` will cause the API to behave as it did in the older version.
 
-   It is an error to call this function after it has returned successfully. It is not thread safe, and if called from more than one thread simultaneously its behavior is undefined.
+   Concurrent calls are serialized. Once a call succeeds, every later call returns ``api_version_already_set``, even when requesting the same version. API selection must still complete before other threads use the FoundationDB API.
 
    .. note:: This is actually implemented as a macro. If you are accessing this API via ``dlopen()`` or an FFI, you will need to use :func:`fdb_select_api_version_impl()`.
 
@@ -154,7 +154,7 @@ Prior to including ``fdb_c.h``, you must define the ``FDB_API_VERSION`` macro. T
 
    This is the actual entry point called by the :func:`fdb_select_api_version` macro. It should never be called directly from C, but if you are accessing this API via ``dlopen()`` or an FFI, you will need to use it. ``fdb_select_api_version(v)`` is equivalent to ``fdb_select_api_version_impl(v, FDB_API_VERSION)``.
 
-   It is an error to call this function after it has returned successfully. It is not thread safe, and if called from more than one thread simultaneously its behavior is undefined.
+   Concurrent calls are serialized. Once a call succeeds, every later call returns ``api_version_already_set``, even when requesting the same runtime and header versions. API selection must still complete before other threads use the FoundationDB API.
 
    ``runtime_version``
       The version of run-time behavior the API is requested to provide. Must be less than or equal to ``header_version``, and should almost always be equal.

From 096636931906e2be04700f59c4c30fa32b0268ec Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Thu, 1 Oct 2026 20:36:09 -0700
Subject: [PATCH 10/11] Align Rust bindings with shared binding behavior and
 tests

---
 .github/workflows/rust.yml                    |  41 ++-
 bindings/bindingtester/bindingtester.py       |   8 +-
 bindings/bindingtester/run_binding_tester.sh  |  20 +-
 bindings/bindingtester/tests/scripted.py      |   2 +-
 bindings/rust/CMakeLists.txt                  |  64 +++-
 bindings/rust/CONTRIBUTING.md                 |  15 +-
 bindings/rust/README.md                       |   7 +-
 bindings/rust/UPSTREAM.md                     |  11 +
 .../rust/foundationdb-bindingtester/README.md |  22 +-
 .../foundationdb-bindingtester/src/main.rs    | 309 ++++++++----------
 .../rust/foundationdb-profiling/Cargo.toml    |   2 +-
 .../src/lib.rs                                |  17 +-
 bindings/rust/foundationdb-tuple/src/lib.rs   |  42 ++-
 bindings/rust/foundationdb-tuple/src/pack.rs  |  10 +-
 .../rust/foundationdb-tuple/src/subspace.rs   |  28 +-
 bindings/rust/foundationdb/Cargo.toml         |  26 +-
 bindings/rust/foundationdb/README.md          |   7 +
 bindings/rust/foundationdb/src/budget.rs      |   9 +-
 bindings/rust/foundationdb/src/database.rs    |  13 +-
 .../src/directory/directory_layer.rs          |   2 +-
 bindings/rust/foundationdb/src/error.rs       |   5 +
 bindings/rust/foundationdb/src/lib.rs         |  10 +-
 bindings/rust/foundationdb/src/metrics.rs     |   9 +-
 bindings/rust/foundationdb/src/runner.rs      |  23 +-
 bindings/rust/foundationdb/src/transaction.rs | 164 +++++++---
 .../rust/foundationdb/src/tuple_ext/hca.rs    |  10 +-
 .../foundationdb/tests/conflict_ranges.rs     |   1 +
 bindings/rust/foundationdb/tests/directory.rs |  53 +++
 bindings/rust/foundationdb/tests/hca.rs       |  40 +++
 .../rust/foundationdb/tests/runner_hooks.rs   |   7 +-
 bindings/rust/foundationdb/tests/tuple.rs     |   8 +-
 .../rust/foundationdb/tests/versionstamp.rs   |   2 +
 bindings/rust/scripts/run_bindingtester.sh    |  18 +-
 bindings/rust/tests/current_headers.cmake     |  24 ++
 contrib/local_cluster/binding_test.py         |  20 +-
 35 files changed, 726 insertions(+), 323 deletions(-)
 create mode 100644 bindings/rust/tests/current_headers.cmake

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 6de96765eb8..63f7c3d12f5 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -7,7 +7,13 @@ on:
       - release-*
     paths:
       - bindings/rust/**
-      - fdbclient/vexillographer/fdb.options
+      - bindings/c/**
+      - bindings/bindingtester/**
+      - contrib/local_cluster/binding_test.py
+      - cmake/AddFdbTest.cmake
+      - cmake/FDBComponents.cmake
+      - fdbclient/vexillographer/**
+      - flow/ApiVersions.cmake
       - .github/workflows/rust.yml
   push:
     branches:
@@ -15,7 +21,13 @@ on:
       - release-*
     paths:
       - bindings/rust/**
-      - fdbclient/vexillographer/fdb.options
+      - bindings/c/**
+      - bindings/bindingtester/**
+      - contrib/local_cluster/binding_test.py
+      - cmake/AddFdbTest.cmake
+      - cmake/FDBComponents.cmake
+      - fdbclient/vexillographer/**
+      - flow/ApiVersions.cmake
       - .github/workflows/rust.yml
   workflow_dispatch:
 
@@ -52,11 +64,24 @@ jobs:
           sudo apt-get update
           sudo apt-get install --yes libclang-dev
 
-      - name: Check all workspace targets
+      - name: Generate current C headers and options
+        run: cmake -DOUTPUT_DIR="$RUNNER_TEMP/rust-fdb-include" -P tests/current_headers.cmake
+
+      - name: Check current headers and options
+        env:
+          FDB_INCLUDE_DIR: ${{ runner.temp }}/rust-fdb-include
+        run: |
+          cargo check --locked -p foundationdb --lib --features fdb-7_4
+          cargo check --locked -p foundationdb --lib --features fdb-7_4,accounting
+          cargo check --locked -p foundationdb --test ranked_register --no-default-features --features fdb-7_4,recipes-ranked-register
+
+      - name: Check all workspace targets against current headers
         # API version features are mutually exclusive; do not use --all-features.
+        env:
+          FDB_INCLUDE_DIR: ${{ runner.temp }}/rust-fdb-include
         run: >-
           cargo check --locked --workspace --all-targets
-          --features embedded-fdb-include,fdb-7_4,num-bigint,trace
+          --features embedded-fdb-include,fdb-7_4,num-bigint,trace,foundationdb/accounting
 
       - name: Check supported historical APIs
         # Some examples require newer APIs; historical compatibility covers the library.
@@ -72,14 +97,6 @@ jobs:
           cargo test --locked -p foundationdb-tuple --all-features
           cargo test --locked -p foundationdb-macros
 
-      - name: Generate options from the repository schema
-        env:
-          FDB_INCLUDE_DIR: ${{ github.workspace }}/fdbclient/vexillographer
-        run: >-
-          cargo run --locked -p foundationdb-gen
-          --features embedded-fdb-include,fdb-7_4 --bin foundationdb-options-gen
-          > "$RUNNER_TEMP/rust-fdb-options.rs"
-
   format:
     name: Rustfmt
     runs-on: ubuntu-24.04
diff --git a/bindings/bindingtester/bindingtester.py b/bindings/bindingtester/bindingtester.py
index 23f8d159094..5b853534ffc 100755
--- a/bindings/bindingtester/bindingtester.py
+++ b/bindings/bindingtester/bindingtester.py
@@ -273,6 +273,10 @@ def __init__(self, args):
 
         min_api_version = max([tester.min_api_version for tester in self.testers])
         max_api_version = min([tester.max_api_version for tester in self.testers])
+        # Scripted cases exercise the newest common API; randomized suites also
+        # sample older versions. A tester's ceiling need not match the harness's.
+        if self.args.test_name == "scripted" and self.args.api_version is None:
+            self.args.api_version = min(max_api_version, self.test.max_api_version)
         self.args.api_version = choose_api_version(
             self.args.api_version,
             min_api_version,
@@ -646,8 +650,8 @@ def parse_args(argv):
         "--api-version",
         default=None,
         type=int,
-        help="The API version that the testers should use. Not supported in scripted mode. (default = random version supported by "
-        "all testers)",
+        help="The API version that the testers should use. (default = newest common version in scripted mode, "
+        "random version supported by all testers otherwise)",
     )
     parser.add_argument(
         "--cluster-file",
diff --git a/bindings/bindingtester/run_binding_tester.sh b/bindings/bindingtester/run_binding_tester.sh
index dbec3314ab4..ed49477a8d7 100644
--- a/bindings/bindingtester/run_binding_tester.sh
+++ b/bindings/bindingtester/run_binding_tester.sh
@@ -25,8 +25,11 @@ BREAKONERROR="${BREAKONERROR:-0}"
 RUNSCRIPTS="${RUNSCRIPTS:-1}"
 RUNTESTS="${RUNTESTS:-1}"
 RANDOMTEST="${RANDOMTEST:-0}"
-# BINDINGTESTS="${BINDINGTESTS:-python python3 java java_async ruby go flow}"
-BINDINGTESTS="${BINDINGTESTS:-python python3 java java_async go flow swift}"
+DEFAULT_BINDINGTESTS="python java java_async go flow swift"
+if [[ -x "${FDB_RUST_BINDINGTESTER:-${SCRIPTDIR}/../rust/bin/bindingtester}" ]]; then
+	DEFAULT_BINDINGTESTS+=" rust"
+fi
+BINDINGTESTS="${BINDINGTESTS:-${DEFAULT_BINDINGTESTS}}"
 LOGLEVEL="${LOGLEVEL:-INFO}"
 _BINDINGTESTS=(${BINDINGTESTS})
 DISABLEDTESTS=()
@@ -41,7 +44,7 @@ VERSION="1.6"
 # Display syntax
 if [ "${#}" -lt 2 ]
 then
-	echo 'run_binding_tester.sh <number of cycles> <error file>'
+	echo 'run_binding_tester.sh <number of cycles> <error file> [bindingtester options...]'
 	echo '   cycles:   number of cycles to run test (0 => unlimitted)'
 	echo ''
 	echo '   Modifiable Environment Variables:'
@@ -61,6 +64,7 @@ fi
 # Read arguments
 MAXCYCLES="${1}"
 ERRORFILE="${2}"
+BINDINGTESTER_OPTIONS=("${@:3}")
 
 function logError()
 {
@@ -187,7 +191,7 @@ function runScriptedTest()
 	else
 		local test="${1}"
 
-		if ! runCommand "Scripting ${test} ..."  'python3' '-u' "${TESTFILE}" "${test}" --test-name scripted --logging-level "${LOGLEVEL}"
+		if ! runCommand "Scripting ${test} ..."  'python3' '-u' "${TESTFILE}" "${test}" --test-name scripted --logging-level "${LOGLEVEL}" "${BINDINGTESTER_OPTIONS[@]}"
 		then
 			let status="${status} + 1"
 		fi
@@ -212,25 +216,25 @@ function runTest()
 		fi
 
 		# API
-		if ([[ "${TESTINDEX}" -eq 0 ]] || [[ "${TESTINDEX}" -eq "${TESTTOTAL}" ]]) && ([[ "${BREAKONERROR}" -eq 0 ]] || [[ "${status}" -eq 0 ]]) && ! runCommand "   ${TESTTYPES[0]}" 'python3' '-u' "${TESTFILE}" "${test}" --test-name api --compare --num-ops "${OPERATIONS}" --logging-level "${LOGLEVEL}"
+		if ([[ "${TESTINDEX}" -eq 0 ]] || [[ "${TESTINDEX}" -eq "${TESTTOTAL}" ]]) && ([[ "${BREAKONERROR}" -eq 0 ]] || [[ "${status}" -eq 0 ]]) && ! runCommand "   ${TESTTYPES[0]}" 'python3' '-u' "${TESTFILE}" "${test}" --test-name api --compare --num-ops "${OPERATIONS}" --logging-level "${LOGLEVEL}" "${BINDINGTESTER_OPTIONS[@]}"
 		then
 			let status="${status} + 1"
 		fi
 
 		# Concurrent API
-		if ([[ "${TESTINDEX}" -eq 1 ]] || [[ "${TESTINDEX}" -eq "${TESTTOTAL}" ]]) && ([[ "${BREAKONERROR}" -eq 0 ]] || [[ "${status}" -eq 0 ]]) &&  ! runCommand "   ${TESTTYPES[1]}" 'python3' '-u' "${TESTFILE}" "${test}" --test-name api --concurrency "${CONCURRENCY}" --num-ops "${OPERATIONS}" --logging-level "${LOGLEVEL}"
+		if ([[ "${TESTINDEX}" -eq 1 ]] || [[ "${TESTINDEX}" -eq "${TESTTOTAL}" ]]) && ([[ "${BREAKONERROR}" -eq 0 ]] || [[ "${status}" -eq 0 ]]) &&  ! runCommand "   ${TESTTYPES[1]}" 'python3' '-u' "${TESTFILE}" "${test}" --test-name api --concurrency "${CONCURRENCY}" --num-ops "${OPERATIONS}" --logging-level "${LOGLEVEL}" "${BINDINGTESTER_OPTIONS[@]}"
 		then
 			let status="${status} + 1"
 		fi
 
 		# Directory
-		if ([[ "${TESTINDEX}" -eq 2 ]] || [[ "${TESTINDEX}" -eq "${TESTTOTAL}" ]]) && ([[ "${BREAKONERROR}" -eq 0 ]] || [[ "${status}" -eq 0 ]]) &&  ! runCommand "   ${TESTTYPES[2]}" 'python3' '-u' "${TESTFILE}" "${test}" --test-name directory --compare --num-ops "${OPERATIONS}" --logging-level "${LOGLEVEL}"
+		if ([[ "${TESTINDEX}" -eq 2 ]] || [[ "${TESTINDEX}" -eq "${TESTTOTAL}" ]]) && ([[ "${BREAKONERROR}" -eq 0 ]] || [[ "${status}" -eq 0 ]]) &&  ! runCommand "   ${TESTTYPES[2]}" 'python3' '-u' "${TESTFILE}" "${test}" --test-name directory --compare --num-ops "${OPERATIONS}" --logging-level "${LOGLEVEL}" "${BINDINGTESTER_OPTIONS[@]}"
 		then
 			let status="${status} + 1"
 		fi
 
 		# Directory HCA
-		if ([[ "${TESTINDEX}" -eq 3 ]] || [[ "${TESTINDEX}" -eq "${TESTTOTAL}" ]]) && ([[ "${BREAKONERROR}" -eq 0 ]] || [[ "${status}" -eq 0 ]]) &&  ! runCommand "   ${TESTTYPES[3]}" 'python3' '-u' "${TESTFILE}" "${test}" --test-name directory_hca --concurrency "${CONCURRENCY}"  --num-ops "${HCAOPERATIONS}" --logging-level "${LOGLEVEL}"
+		if ([[ "${TESTINDEX}" -eq 3 ]] || [[ "${TESTINDEX}" -eq "${TESTTOTAL}" ]]) && ([[ "${BREAKONERROR}" -eq 0 ]] || [[ "${status}" -eq 0 ]]) &&  ! runCommand "   ${TESTTYPES[3]}" 'python3' '-u' "${TESTFILE}" "${test}" --test-name directory_hca --concurrency "${CONCURRENCY}"  --num-ops "${HCAOPERATIONS}" --logging-level "${LOGLEVEL}" "${BINDINGTESTER_OPTIONS[@]}"
 		then
 			let status="${status} + 1"
 		fi
diff --git a/bindings/bindingtester/tests/scripted.py b/bindings/bindingtester/tests/scripted.py
index f5cc68b4905..754e445f069 100644
--- a/bindings/bindingtester/tests/scripted.py
+++ b/bindings/bindingtester/tests/scripted.py
@@ -39,7 +39,7 @@
 
 class ScriptedTest(Test):
     def __init__(self, subspace):
-        super(ScriptedTest, self).__init__(subspace, FDB_API_VERSION, FDB_API_VERSION)
+        super(ScriptedTest, self).__init__(subspace, 510, FDB_API_VERSION)
         self.workspace = self.subspace["workspace"]
         self.results_subspace = self.subspace["results"]
         # self.thread_subspace = self.subspace['threads'] # TODO: update START_THREAD so that we can create threads in subspaces
diff --git a/bindings/rust/CMakeLists.txt b/bindings/rust/CMakeLists.txt
index 56d81028572..d15533b59d7 100644
--- a/bindings/rust/CMakeLists.txt
+++ b/bindings/rust/CMakeLists.txt
@@ -65,7 +65,8 @@ set(rust_unit_packages
   --package foundationdb-tuple
   --package foundationdb-gen
   --package foundationdb-macros
-  --package foundationdb-simulation)
+  --package foundationdb-simulation
+  --package foundationdb-simulation-tracing)
 set(rust_unit_args ${rust_cargo_args}
   --features foundationdb-simulation/fdb-7_4)
 add_custom_target(fdb_rust_tests ALL
@@ -77,6 +78,16 @@ add_custom_target(fdb_rust_tests ALL
   COMMAND_EXPAND_LISTS
   VERBATIM)
 
+add_custom_target(fdb_rust_accounting_tests ALL
+  COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
+    ${CARGO_EXECUTABLE} test ${rust_cargo_args}
+    --features foundationdb/accounting --package foundationdb --lib --no-run
+  DEPENDS fdb_rust_tests
+  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+  COMMENT "Compile Rust accounting unit tests"
+  COMMAND_EXPAND_LISTS
+  VERBATIM)
+
 if(APPLE)
   set(rust_library_path DYLD_LIBRARY_PATH)
 else()
@@ -92,6 +103,14 @@ add_test(NAME rust_unit_tests
   COMMAND_EXPAND_LISTS)
 set_tests_properties(rust_unit_tests PROPERTIES TIMEOUT 300 LABELS "rust")
 
+add_test(NAME rust_accounting_unit_tests
+  COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+    ${CARGO_EXECUTABLE} test ${rust_cargo_args}
+    --features foundationdb/accounting --package foundationdb --lib --offline
+  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+  COMMAND_EXPAND_LISTS)
+set_tests_properties(rust_accounting_unit_tests PROPERTIES TIMEOUT 300 LABELS "rust")
+
 # This compile-fail doctest checks the public raw-pointer ownership boundary.
 # Other client doctests may require a running cluster.
 add_test(NAME rust_future_safety_tests
@@ -115,6 +134,16 @@ foreach(symbol str_from_c WorkloadContext::new WorkloadContext::set_process_id r
     TIMEOUT 300 LABELS "rust")
 endforeach()
 
+add_test(NAME rust_simulation_tracing_guard_safety_tests
+  COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+    ${CARGO_EXECUTABLE} test ${rust_cargo_base_args}
+    --features foundationdb-simulation-tracing/fdb-7_4
+    --package foundationdb-simulation-tracing --doc --offline TracingGuard
+  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+  COMMAND_EXPAND_LISTS)
+set_tests_properties(rust_simulation_tracing_guard_safety_tests PROPERTIES
+  TIMEOUT 300 LABELS "rust")
+
 add_test(NAME rust_simulation_wake_order_tests
   COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
     "RUSTFLAGS=$ENV{RUSTFLAGS} --cfg fdb_simulation_loom"
@@ -129,12 +158,26 @@ set_tests_properties(rust_simulation_wake_order_tests PROPERTIES
   TIMEOUT 300 LABELS "rust")
 
 if(RUN_RUST_INTEGRATION_TESTS)
+  if(NOT WITH_PYTHON_BINDING)
+    message(FATAL_ERROR "Rust integration tests require BUILD_PYTHON_BINDING=ON")
+  endif()
+  set(rust_accounting_test_args ${rust_cargo_args}
+    --features foundationdb/accounting --package foundationdb
+    --test budget --test metrics --test runner_hooks --test conflict_ranges
+    --test tuple --test versionstamp)
+  set(rust_recipes_test_args ${rust_cargo_args}
+    --features foundationdb/recipes --package foundationdb --lib
+    --test leader_election_ranked_register --test ranked_register)
   add_custom_target(fdb_rust_integration_tests ALL
     COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
       ${CARGO_EXECUTABLE} test ${rust_cargo_args} --package foundationdb --package bindingtester --tests --no-run
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
+      ${CARGO_EXECUTABLE} test ${rust_accounting_test_args} --no-run
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
+      ${CARGO_EXECUTABLE} test ${rust_recipes_test_args} --no-run
     COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
       ${CARGO_EXECUTABLE} build ${rust_cargo_args} --package foundationdb --example api_version_library
-    DEPENDS fdb_rust_tests
+    DEPENDS fdb_rust_accounting_tests fdb_rust_tester python_binding
     WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
     COMMENT "Compile Rust client integration tests"
     COMMAND_EXPAND_LISTS
@@ -144,6 +187,20 @@ if(RUN_RUST_INTEGRATION_TESTS)
       ${CARGO_EXECUTABLE} test ${rust_cargo_args} --package foundationdb --tests --offline -- --test-threads=1
     WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
     TEST_TIMEOUT 1200)
+  add_fdbclient_test(NAME rust_accounting_integration_tests
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+      ${CARGO_EXECUTABLE} test ${rust_accounting_test_args} --offline -- --test-threads=1
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    TEST_TIMEOUT 1200)
+  add_fdbclient_test(NAME rust_recipes_integration_tests
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+      ${CARGO_EXECUTABLE} test ${rust_recipes_test_args} --offline -- --test-threads=1
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    TEST_TIMEOUT 1200)
+  add_fdbclient_test(NAME rust_bindingtester_tests
+    COMMAND bash ${CMAKE_CURRENT_SOURCE_DIR}/scripts/run_bindingtester.sh ${CMAKE_BINARY_DIR} 1
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    TEST_TIMEOUT 1800)
   add_fdbclient_test(NAME rust_bindingtester_on_error_tests
     COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
       ${CARGO_EXECUTABLE} test ${rust_cargo_base_args} --features foundationdb/fdb-7_4
@@ -159,7 +216,8 @@ if(RUN_RUST_INTEGRATION_TESTS)
     TEST_TIMEOUT 120)
   # tmp_cluster otherwise preserves an inherited default cluster. These tests
   # must always use the disposable cluster created by the test runner.
-  set_tests_properties(rust_integration_tests rust_bindingtester_on_error_tests rust_api_version_libraries_tests PROPERTIES
+  set_tests_properties(rust_integration_tests rust_accounting_integration_tests rust_recipes_integration_tests
+    rust_bindingtester_tests rust_bindingtester_on_error_tests rust_api_version_libraries_tests PROPERTIES
     LABELS "rust;integration"
     ENVIRONMENT_MODIFICATION "FDB_CLUSTER_FILE=unset:")
 endif()
diff --git a/bindings/rust/CONTRIBUTING.md b/bindings/rust/CONTRIBUTING.md
index a067144fc84..21a4061099b 100644
--- a/bindings/rust/CONTRIBUTING.md
+++ b/bindings/rust/CONTRIBUTING.md
@@ -57,6 +57,13 @@ for comparison with Python. Tuple tests and macro tests do not need a cluster.
 
 `rust_unit_tests` also checks simulation context and metrics callbacks, executor
 wakeups, thread ownership, and phase teardown through native workload callbacks.
+The client is built and tested without accounting by default; the separate
+`rust_accounting_unit_tests` and `rust_accounting_integration_tests` enable the
+`accounting` feature. The latter runs budget, metrics, and related transaction
+coverage. `rust_recipes_integration_tests` separately enables `recipes` for library
+unit tests and the leader-election and ranked-register suites.
+`rust_bindingtester_tests` runs fixed regression seeds and the shared scripted
+and randomized suites against Python.
 Client integration tests check timekeeper read-error propagation and versionstamp
 behavior in separate processes selecting runtime APIs 510, 520, and 740.
 The live-cluster tests also cover raw directory-prefix collisions and transaction
@@ -65,12 +72,18 @@ including reset and reuse. The library test uses current in-tree headers and two
 independently loaded Rust libraries to check concurrent initial API selection,
 shared selection, and runtime/header-version mismatches.
 The simulation safety doctests check that borrowed
-metrics sinks cannot escape their callback and process switching requires `unsafe`.
+metrics sinks cannot escape their callback, process switching requires `unsafe`,
+and the tracing guard cannot move between threads.
 `rust_simulation_wake_order_tests` uses Loom to explore weak-memory interleavings of
 the executor's wake and dequeue code. Its separate Cargo target directory keeps
 model synchronization out of normal builds. These checks do not start the simulator;
 workload execution is a separate check against a compatible server.
 
+Hosted compile checks generate the current C headers and options using
+`tests/current_headers.cmake`, then check both the default client and the optional
+accounting build against those inputs. Historical API checks use their embedded
+headers separately.
+
 The simulation crates and their scripts are retained for focused simulator work;
 their READMEs describe the workload ABI and required server versions. The original
 repository's scheduled correctness, simulation, release, and documentation jobs
diff --git a/bindings/rust/README.md b/bindings/rust/README.md
index b0bc8877050..d3979ded47f 100644
--- a/bindings/rust/README.md
+++ b/bindings/rust/README.md
@@ -57,9 +57,10 @@ build selects `fdb-7_4` (API 740), the highest API supported by the imported
 workspace. A newer C client can serve that API, but this does not expose every
 feature of the current FoundationDB main branch. In particular, this import does
 not add API 800 wrappers or the native CDC API. Directory snapshot operations are
-also not supported by the Rust binding tester, and its scripted suite is skipped
-because it requires API 800. Additional wrappers and API-version support can be
-developed separately.
+also not supported by the Rust binding tester. The shared scripted suite selects
+the newest API supported by each tester: API 740 for Rust and API 800 for the
+current bindings. Additional wrappers and API-version support can be developed
+separately.
 
 Versionstamped key and value mutations require runtime API 520 or later. With
 API 510, these mutations panic before reaching the C client; other supported
diff --git a/bindings/rust/UPSTREAM.md b/bindings/rust/UPSTREAM.md
index 3635c1cc8a4..f248a24ceb9 100644
--- a/bindings/rust/UPSTREAM.md
+++ b/bindings/rust/UPSTREAM.md
@@ -56,3 +56,14 @@ The in-tree adaptation also corrects public API contracts from this snapshot:
   current C headers, it uses `fdb_get_selected_api_versions` to verify an existing
   process-wide runtime/header pair before initializing another Rust library.
   Historical headers cannot verify another library's selection and return an error.
+- High-level versionstamped tuple and subspace packing requires exactly one
+  incomplete versionstamp, matching the other bindings. Use ordinary packing
+  for tuples containing only completed versionstamps.
+- Transaction usage counters, client budgets, and metrics APIs require the
+  opt-in `accounting` feature. Recipes are also opt-in; the default client
+  enables only `uuid`.
+- Simulation tracing guards are bound to their installation thread so their
+  destruction clears the correct thread-local context.
+- Database-level directory instructions in the binding tester use the native
+  transaction retry loop and publish stack results only after commit, matching
+  the other testers. Transaction-level instructions retain the caller's transaction.
diff --git a/bindings/rust/foundationdb-bindingtester/README.md b/bindings/rust/foundationdb-bindingtester/README.md
index bbd464d6246..909cfdd7c16 100644
--- a/bindings/rust/foundationdb-bindingtester/README.md
+++ b/bindings/rust/foundationdb-bindingtester/README.md
@@ -11,20 +11,28 @@ bindings/rust/scripts/setup_bindingtester.sh /path/to/build
 ```
 
 With a running FoundationDB cluster, run the fixed regression seeds followed by
-one iteration of the API, concurrent API, directory, and directory
-allocator tests:
+the shared scripted suite and one iteration of the API, concurrent API, directory,
+and directory allocator tests:
 
 ```sh
 bindings/rust/scripts/run_bindingtester.sh /path/to/build 1 --cluster-file /path/to/fdb.cluster
 ```
 
-The script uses Python and Rust artifacts from the same build, tests API version
-740, and compares API/directory results with the Python binding. It copies the
+The script uses Python and Rust artifacts from the same build and compares
+API/directory results with the Python binding. Fixed regression seeds retain
+the API version that reproduced each failure;
+the shared runner uses API 740 for scripted cases and samples supported API
+versions for randomized cases. It copies the
 shared harness and Python tester into the build tree so the Python tester imports
 the generated binding there. It does not install a Python package or clone a
 second FoundationDB checkout. Increase the second argument to repeat randomized tests; retain the logged seeds to reproduce
 failures.
 
+Both packaged binding-test launchers include Rust automatically when its tester
+executable is present. `BINDINGTESTS=rust` selects only Rust with either launcher;
+`rust_bindingtester_tests` runs the same suites through CTest when
+`RUN_RUST_INTEGRATION_TESTS=ON`.
+
 For an individual case after the script has staged the shared test harness:
 
 ```sh
@@ -42,6 +50,6 @@ can also select a tester built directly with Cargo.
 The registered tester supports runtime API versions 610 through 740 and the
 shared tuple types, including arbitrary-width integers and versionstamps.
 Directory snapshot operations are disabled because the imported directory layer
-does not implement them. The scripted suite is skipped because it requires the
-current API version (800), beyond the Rust binding's API 740 support. Importing
-the binding does not establish full feature parity.
+does not implement them. Scripted tests use the newest API shared by the selected
+testers, preserving API 800 coverage for bindings that support it. Importing the
+binding does not establish full feature parity.
diff --git a/bindings/rust/foundationdb-bindingtester/src/main.rs b/bindings/rust/foundationdb-bindingtester/src/main.rs
index 1153c8b089c..79cb33a4536 100644
--- a/bindings/rust/foundationdb-bindingtester/src/main.rs
+++ b/bindings/rust/foundationdb-bindingtester/src/main.rs
@@ -523,6 +523,33 @@ impl TransactionState {
     }
 }
 
+async fn directory_operation<D, T, F>(
+    db: &Database,
+    transaction: &TransactionState,
+    is_db: bool,
+    data: D,
+    operation: F,
+) -> Result<T, FdbBindingError>
+where
+    F: for<'a> Fn(&'a Transaction, &'a D) -> future::LocalBoxFuture<'a, Result<T, DirectoryError>>,
+{
+    if is_db {
+        // Retry only the directory operation and commit. Stack arguments have already
+        // been popped, and the caller publishes the result once this succeeds.
+        db.run(|txn, _| {
+            let data = &data;
+            let operation = &operation;
+            async move { operation(&txn, data).await.map_err(FdbBindingError::from) }
+        })
+        .await
+    } else {
+        let TransactionState::Transaction(txn) = transaction else {
+            panic!("could not find an active transaction");
+        };
+        operation(txn, &data).await.map_err(FdbBindingError::from)
+    }
+}
+
 struct StackMachine {
     prefix: Bytes<'static>,
 
@@ -729,7 +756,7 @@ impl StackMachine {
         }
     }
 
-    fn push_directory_err(&mut self, code: &InstrCode, number: usize, err: DirectoryError) {
+    fn push_directory_err(&mut self, code: &InstrCode, number: usize, err: impl std::fmt::Debug) {
         debug!("[{number}] DIRECTORY_ERROR during {code:?}: {err:?}");
         self.push(number, Element::Tuple(vec![ERROR_DIRECTORY.clone()]));
 
@@ -1782,17 +1809,6 @@ impl StackMachine {
                     .get_current_directory()
                     .expect("could not find a directory");
 
-                let local_trx = db.create_trx().unwrap();
-                let txn = match is_db {
-                    true => &local_trx,
-                    false => match trx {
-                        TransactionState::Transaction(ref t) => t,
-                        _ => {
-                            panic!("could not find an active transaction");
-                        }
-                    },
-                };
-
                 debug!(
                     "creating path {:?} with layer {:?} and prefix {:?} using directory at index {}",
                     path.first().unwrap(),
@@ -1801,14 +1817,23 @@ impl StackMachine {
                     self.directory_index,
                 );
 
-                match directory
-                    .create(
-                        txn,
-                        path.first().unwrap(),
-                        prefix.as_deref(),
-                        layer.as_deref(),
-                    )
-                    .await
+                match directory_operation(
+                    &db,
+                    &trx,
+                    is_db,
+                    (directory, path, prefix, layer),
+                    |txn, (directory, path, prefix, layer)| {
+                        directory
+                            .create(
+                                txn,
+                                path.first().unwrap(),
+                                prefix.as_deref(),
+                                layer.as_deref(),
+                            )
+                            .boxed_local()
+                    },
+                )
+                .await
                 {
                     Ok(directory_subspace) => {
                         debug!(
@@ -1817,10 +1842,6 @@ impl StackMachine {
                         );
                         self.directory_stack
                             .push(DirectoryStackItem::DirectoryOutput(directory_subspace));
-                        if is_db {
-                            debug!("commiting local trx");
-                            local_trx.commit().await.expect("could not commit");
-                        }
                     }
                     Err(e) => {
                         self.push_directory_err(&instr.code, number, e);
@@ -1845,17 +1866,6 @@ impl StackMachine {
                     .get_current_directory()
                     .expect("could not find a directory");
 
-                let local_trx = db.create_trx().unwrap();
-                let txn = match is_db {
-                    true => &local_trx,
-                    false => match trx {
-                        TransactionState::Transaction(ref t) => t,
-                        _ => {
-                            panic!("could not find an active transaction");
-                        }
-                    },
-                };
-
                 debug!(
                     "opening path {:?} with layer {:?} with index {}",
                     path.first().unwrap(),
@@ -1863,9 +1873,18 @@ impl StackMachine {
                     self.directory_index
                 );
 
-                match directory
-                    .open(txn, path.first().unwrap(), layer.as_deref())
-                    .await
+                match directory_operation(
+                    &db,
+                    &trx,
+                    is_db,
+                    (directory, path, layer),
+                    |txn, (directory, path, layer)| {
+                        directory
+                            .open(txn, path.first().unwrap(), layer.as_deref())
+                            .boxed_local()
+                    },
+                )
+                .await
                 {
                     Ok(directory_subspace) => {
                         debug!(
@@ -1874,11 +1893,6 @@ impl StackMachine {
                         );
                         self.directory_stack
                             .push(DirectoryStackItem::DirectoryOutput(directory_subspace));
-
-                        if is_db {
-                            debug!("commiting local trx");
-                            local_trx.commit().await.expect("could not commit");
-                        }
                     }
                     Err(e) => {
                         self.push_directory_err(&instr.code, number, e);
@@ -1905,26 +1919,24 @@ impl StackMachine {
                     .get_current_directory()
                     .expect("could not find a directory");
 
-                let local_trx = db.create_trx().unwrap();
-                let txn = match is_db {
-                    true => &local_trx,
-                    false => match trx {
-                        TransactionState::Transaction(ref t) => t,
-                        _ => {
-                            panic!("could not find an active transaction");
-                        }
-                    },
-                };
-
                 debug!(
                     "create_or_open path {:?} with layer {:?} with index {}",
                     path.first().unwrap(),
                     layer,
                     self.directory_index
                 );
-                match directory
-                    .create_or_open(txn, path.first().unwrap(), None, layer.as_deref())
-                    .await
+                match directory_operation(
+                    &db,
+                    &trx,
+                    is_db,
+                    (directory, path, layer),
+                    |txn, (directory, path, layer)| {
+                        directory
+                            .create_or_open(txn, path.first().unwrap(), None, layer.as_deref())
+                            .boxed_local()
+                    },
+                )
+                .await
                 {
                     Ok(directory_subspace) => {
                         debug!(
@@ -1934,10 +1946,6 @@ impl StackMachine {
                         );
                         self.directory_stack
                             .push(DirectoryStackItem::DirectoryOutput(directory_subspace));
-                        if is_db {
-                            debug!("commiting local trx");
-                            local_trx.commit().await.expect("could not commit");
-                        }
                     }
                     Err(e) => self.push_directory_err(&instr.code, number, e),
                 };
@@ -1987,17 +1995,6 @@ impl StackMachine {
                     .get_current_directory()
                     .expect("could not find a directory");
 
-                let local_trx = db.create_trx().unwrap();
-                let txn = match is_db {
-                    true => &local_trx,
-                    false => match trx {
-                        TransactionState::Transaction(ref t) => t,
-                        _ => {
-                            panic!("could not find an active transaction");
-                        }
-                    },
-                };
-
                 debug!(
                     "moving {:?} to {:?} using directory at index {}",
                     paths.first().unwrap(),
@@ -2005,9 +2002,18 @@ impl StackMachine {
                     self.directory_index
                 );
 
-                match directory
-                    .move_to(txn, paths.first().unwrap(), paths.get(1).unwrap())
-                    .await
+                match directory_operation(
+                    &db,
+                    &trx,
+                    is_db,
+                    (directory, paths),
+                    |txn, (directory, paths)| {
+                        directory
+                            .move_to(txn, paths.first().unwrap(), paths.get(1).unwrap())
+                            .boxed_local()
+                    },
+                )
+                .await
                 {
                     Ok(s) => {
                         debug!(
@@ -2017,10 +2023,6 @@ impl StackMachine {
                         );
                         self.directory_stack
                             .push(DirectoryStackItem::DirectoryOutput(s));
-                        if is_db {
-                            debug!("commiting local trx");
-                            local_trx.commit().await.expect("could not commit");
-                        }
                     }
                     Err(e) => {
                         self.push_directory_err(&instr.code, number, e);
@@ -2039,22 +2041,20 @@ impl StackMachine {
                     .get_current_directory()
                     .expect("could not find a directory");
 
-                let local_trx = db.create_trx().unwrap();
-                let txn = match is_db {
-                    true => &local_trx,
-                    false => match trx {
-                        TransactionState::Transaction(ref t) => t,
-                        _ => {
-                            panic!("could not find an active transaction");
-                        }
-                    },
-                };
-
                 debug!("moving directory {:?} to {:?}", self.directory_index, paths);
 
-                match directory
-                    .move_directory(txn, paths.first().expect("popped tuple has no item"))
-                    .await
+                match directory_operation(
+                    &db,
+                    &trx,
+                    is_db,
+                    (directory, paths),
+                    |txn, (directory, paths)| {
+                        directory
+                            .move_directory(txn, paths.first().expect("popped tuple has no item"))
+                            .boxed_local()
+                    },
+                )
+                .await
                 {
                     Ok(s) => {
                         debug!(
@@ -2064,10 +2064,6 @@ impl StackMachine {
                         );
                         self.directory_stack
                             .push(DirectoryStackItem::DirectoryOutput(s));
-                        if is_db {
-                            debug!("commiting local trx");
-                            local_trx.commit().await.expect("could not commit");
-                        }
                     }
                     Err(e) => {
                         self.push_directory_err(&instr.code, number, e);
@@ -2088,34 +2084,30 @@ impl StackMachine {
                     .get_current_directory()
                     .expect("could not find a directory");
 
-                let local_trx = db.create_trx().unwrap();
-                let txn = match is_db {
-                    true => &local_trx,
-                    false => match trx {
-                        TransactionState::Transaction(ref t) => t,
-                        _ => {
-                            panic!("could not find an active transaction");
-                        }
-                    },
-                };
-
                 let paths = paths.first().expect("could not retrieve a path");
                 debug!(
                     "removing path {:?} using directory at index {}",
                     paths, self.directory_index
                 );
-                match directory.remove(txn, paths).await {
-                    Ok(deleted) => {
-                        if !deleted {
-                            self.push_directory_err(
-                                &instr.code,
-                                number,
-                                DirectoryError::Other(String::from("directory does not exists")),
-                            );
-                        } else if is_db {
-                            local_trx.commit().await.expect("could not commit");
+                match directory_operation(
+                    &db,
+                    &trx,
+                    is_db,
+                    (directory, paths),
+                    |txn, (directory, paths)| {
+                        async move {
+                            if directory.remove(txn, paths).await? {
+                                Ok(())
+                            } else {
+                                Err(DirectoryError::DirectoryDoesNotExists)
+                            }
                         }
-                    }
+                        .boxed_local()
+                    },
+                )
+                .await
+                {
+                    Ok(()) => {}
                     Err(e) => {
                         self.push_directory_err(&instr.code, number, e);
                     }
@@ -2135,24 +2127,17 @@ impl StackMachine {
                     .get_current_directory()
                     .expect("could not find a directory");
 
-                let local_trx = db.create_trx().unwrap();
-                let txn = match is_db {
-                    true => &local_trx,
-                    false => match trx {
-                        TransactionState::Transaction(ref t) => t,
-                        _ => {
-                            panic!("could not find an active transaction");
-                        }
-                    },
-                };
-
                 let paths = paths.first().expect("could not retrieve a path");
-                match directory.remove_if_exists(txn, paths).await {
-                    Ok(_) => {
-                        if is_db {
-                            local_trx.commit().await.expect("could not commit");
-                        }
-                    }
+                match directory_operation(
+                    &db,
+                    &trx,
+                    is_db,
+                    (directory, paths),
+                    |txn, (directory, paths)| directory.remove_if_exists(txn, paths).boxed_local(),
+                )
+                .await
+                {
+                    Ok(_) => {}
                     Err(err) => self.push_directory_err(&instr.code, number, err),
                 };
             }
@@ -2178,20 +2163,15 @@ impl StackMachine {
                     .get_current_directory()
                     .expect("could not find a directory");
 
-                let local_trx = db
-                    .create_trx()
-                    .expect("could not create a local transaction");
-                let txn = match is_db {
-                    true => &local_trx,
-                    false => match trx {
-                        TransactionState::Transaction(ref t) => t,
-                        _ => {
-                            panic!("could not find an active transaction");
-                        }
-                    },
-                };
-
-                match directory.list(txn, &paths).await {
+                match directory_operation(
+                    &db,
+                    &trx,
+                    is_db,
+                    (directory, &paths),
+                    |txn, (directory, paths)| directory.list(txn, paths).boxed_local(),
+                )
+                .await
+                {
                     Ok(children) => {
                         let mut elements: Vec<Element> = vec![];
                         debug!(
@@ -2207,10 +2187,6 @@ impl StackMachine {
                         }
                         let tuple = Element::Tuple(elements);
                         self.push(number, Element::Bytes(Bytes::from(tuple.pack_to_vec())));
-                        if is_db {
-                            debug!("commiting local trx");
-                            local_trx.commit().await.expect("could not commit");
-                        }
                     }
                     Err(e) => {
                         self.push_directory_err(&instr.code, number, e);
@@ -2232,25 +2208,18 @@ impl StackMachine {
                     .get_current_directory()
                     .expect("could not find a directory");
 
-                let local_trx = db.create_trx().unwrap();
-                let txn = match is_db {
-                    true => &local_trx,
-                    false => match trx {
-                        TransactionState::Transaction(ref t) => t,
-                        _ => {
-                            panic!("could not find an active transaction");
-                        }
-                    },
-                };
-
                 let paths = paths.first().expect("could not retrieve a path");
-                match directory.exists(txn, paths).await {
+                match directory_operation(
+                    &db,
+                    &trx,
+                    is_db,
+                    (directory, paths),
+                    |txn, (directory, paths)| directory.exists(txn, paths).boxed_local(),
+                )
+                .await
+                {
                     Ok(exists) => {
                         self.push(number, Element::Int(i64::from(exists)));
-                        if is_db {
-                            debug!("commiting local trx");
-                            local_trx.commit().await.expect("could not commit");
-                        }
                     }
                     Err(e) => {
                         self.push_directory_err(&instr.code, number, e);
diff --git a/bindings/rust/foundationdb-profiling/Cargo.toml b/bindings/rust/foundationdb-profiling/Cargo.toml
index 951e1726311..7c15dd263d7 100644
--- a/bindings/rust/foundationdb-profiling/Cargo.toml
+++ b/bindings/rust/foundationdb-profiling/Cargo.toml
@@ -25,6 +25,6 @@ thiserror = "2.0.18"
 tracing = "0.1.44"
 
 [dev-dependencies]
-foundationdb = { version = "0.11.0", path = "../foundationdb", default-features = false, features = ["fdb-7_4", "embedded-fdb-include"] }
+foundationdb = { version = "0.11.0", path = "../foundationdb", default-features = false, features = ["fdb-7_4", "embedded-fdb-include", "accounting"] }
 futures-util = "0.3.32"
 tokio = { version = "1.52.3", features = ["macros", "rt-multi-thread", "time"] }
diff --git a/bindings/rust/foundationdb-simulation-tracing/src/lib.rs b/bindings/rust/foundationdb-simulation-tracing/src/lib.rs
index fe9d0b6b14e..fcb899fee27 100644
--- a/bindings/rust/foundationdb-simulation-tracing/src/lib.rs
+++ b/bindings/rust/foundationdb-simulation-tracing/src/lib.rs
@@ -4,6 +4,8 @@
 use std::{
     cell::RefCell,
     env, fmt,
+    marker::PhantomData,
+    rc::Rc,
     sync::{Once, atomic::AtomicU64},
 };
 
@@ -76,7 +78,10 @@ pub fn install(context: &WorkloadContext) -> TracingGuard {
             );
         }
     });
-    TracingGuard { generation }
+    TracingGuard {
+        generation,
+        _thread_bound: PhantomData,
+    }
 }
 
 /// Reads the forwarding level once, while the global subscriber is installed.
@@ -111,8 +116,18 @@ fn parse_level_filter(value: Option<&str>) -> Result<LevelFilter, LevelParseErro
 /// points at the context this guard was created for (a newer [`install`]
 /// wins). Keep it alive for as long as tracing events should be forwarded,
 /// typically by storing it in your workload struct.
+/// The guard must be dropped on the thread where it was installed.
+///
+/// ```compile_fail,E0277
+/// use foundationdb_simulation_tracing::TracingGuard;
+///
+/// fn move_guard_to_thread(guard: TracingGuard) {
+///     std::thread::spawn(move || drop(guard));
+/// }
+/// ```
 pub struct TracingGuard {
     generation: u64,
+    _thread_bound: PhantomData<Rc<()>>,
 }
 
 impl Drop for TracingGuard {
diff --git a/bindings/rust/foundationdb-tuple/src/lib.rs b/bindings/rust/foundationdb-tuple/src/lib.rs
index 642791f386e..033c580a69f 100644
--- a/bindings/rust/foundationdb-tuple/src/lib.rs
+++ b/bindings/rust/foundationdb-tuple/src/lib.rs
@@ -190,7 +190,8 @@ pub fn pack<T: TuplePack>(v: &T) -> Vec<u8> {
 ///
 /// # Panics
 ///
-/// Panics if there is multiple versionstamp present or if the encoded data size doesn't fit in `u32`.
+/// Panics unless there is exactly one incomplete versionstamp, or if the
+/// encoded data size doesn't fit in `u32`.
 pub fn pack_with_versionstamp<T: TuplePack>(v: &T) -> Vec<u8> {
     v.pack_to_vec_with_versionstamp()
 }
@@ -208,12 +209,14 @@ pub fn pack_into<T: TuplePack>(v: &T, output: &mut Vec<u8>) -> VersionstampOffse
 ///
 /// # Panics
 ///
-/// Panics if there is multiple versionstamp present or if the encoded data size doesn't fit in `u32`.
+/// Panics unless there is exactly one incomplete versionstamp, or if the
+/// encoded data size doesn't fit in `u32`.
 pub fn pack_into_with_versionstamp<T: TuplePack>(v: &T, output: &mut Vec<u8>) {
     let offset = v.pack_into_vec_with_versionstamp(output);
-    if let VersionstampOffset::MultipleIncomplete = offset {
-        panic!("pack_into_with_versionstamp does not allow multiple versionstamps");
-    }
+    assert!(
+        matches!(offset, VersionstampOffset::OneIncomplete { .. }),
+        "pack_into_with_versionstamp requires exactly one incomplete versionstamp"
+    );
 }
 
 /// Unpack input
@@ -696,5 +699,34 @@ mod tests {
                     [..]
             )
         );
+
+        let mut prefixed = b"prefix".to_vec();
+        pack_into_with_versionstamp(&Versionstamp::incomplete(0), &mut prefixed);
+        let mut expected = b"prefix".to_vec();
+        expected.extend_from_slice(&pack(&Versionstamp::incomplete(0)));
+        expected.extend_from_slice(&7_u32.to_le_bytes());
+        assert_eq!(prefixed, expected);
+    }
+
+    #[test]
+    fn versionstamped_packing_requires_one_incomplete_stamp() {
+        let invalid = [
+            vec![Element::String("foo".into())],
+            vec![Element::Versionstamp(Versionstamp::complete([1; 10], 0))],
+            vec![
+                Element::Versionstamp(Versionstamp::incomplete(0)),
+                Element::Versionstamp(Versionstamp::incomplete(1)),
+            ],
+        ];
+        for tuple in invalid {
+            assert!(std::panic::catch_unwind(|| pack_with_versionstamp(&tuple)).is_err());
+            assert!(
+                std::panic::catch_unwind(|| {
+                    let mut output = b"prefix".to_vec();
+                    pack_into_with_versionstamp(&tuple, &mut output);
+                })
+                .is_err()
+            );
+        }
     }
 }
diff --git a/bindings/rust/foundationdb-tuple/src/pack.rs b/bindings/rust/foundationdb-tuple/src/pack.rs
index 7d4d217e729..c693446f745 100644
--- a/bindings/rust/foundationdb-tuple/src/pack.rs
+++ b/bindings/rust/foundationdb-tuple/src/pack.rs
@@ -74,13 +74,15 @@ pub trait TuplePack {
     ///
     /// # Panics
     ///
-    /// Panics if there is multiple versionstamp present or if the encoded data size doesn't fit in `u32`.
+    /// Panics unless there is exactly one incomplete versionstamp, or if the
+    /// encoded data size doesn't fit in `u32`.
     fn pack_to_vec_with_versionstamp(&self) -> Vec<u8> {
         let mut vec = Vec::new();
         let offset = self.pack_into_vec_with_versionstamp(&mut vec);
-        if let VersionstampOffset::MultipleIncomplete = offset {
-            panic!("pack_to_vec_with_versionstamp does not allow multiple versionstamps");
-        }
+        assert!(
+            matches!(offset, VersionstampOffset::OneIncomplete { .. }),
+            "pack_to_vec_with_versionstamp requires exactly one incomplete versionstamp"
+        );
         vec
     }
 
diff --git a/bindings/rust/foundationdb-tuple/src/subspace.rs b/bindings/rust/foundationdb-tuple/src/subspace.rs
index 6180260c3be..af812a14c2f 100644
--- a/bindings/rust/foundationdb-tuple/src/subspace.rs
+++ b/bindings/rust/foundationdb-tuple/src/subspace.rs
@@ -107,6 +107,11 @@ impl Subspace {
     ///
     /// An incomplete versionstamp appends a four-byte offset, suitable for
     /// versionstamped mutations with FoundationDB API 520 or later.
+    ///
+    /// # Panics
+    ///
+    /// Panics unless the subspace and tuple together contain exactly one
+    /// incomplete versionstamp.
     pub fn pack_with_versionstamp<T: TuplePack>(&self, t: &T) -> Vec<u8> {
         let mut output = self.prefix.clone();
         let mut versionstamp_offset = self.versionstamp_offset;
@@ -115,10 +120,11 @@ impl Subspace {
             VersionstampOffset::OneIncomplete { offset } => {
                 output.extend_from_slice(&offset.to_le_bytes());
             }
-            VersionstampOffset::MultipleIncomplete => {
-                panic!("Subspace cannot contain more than one incomplete versionstamp");
+            VersionstampOffset::None { .. } | VersionstampOffset::MultipleIncomplete => {
+                panic!(
+                    "Subspace::pack_with_versionstamp requires exactly one incomplete versionstamp"
+                );
             }
-            _ => {}
         }
         output
     }
@@ -196,11 +202,9 @@ mod tests {
 
     #[test]
     fn subspace_unpack_with_versionstamp() {
-        // On unpack, the versionstamp will be complete, so pack_with_versionstamp won't append
-        // the offset.
         let subspace: Subspace = 1.into();
         let tup = (Versionstamp::complete([1; 10], 0), 2);
-        let packed = subspace.pack_with_versionstamp(&tup);
+        let packed = subspace.pack(&tup);
         let tup_unpack: (Versionstamp, i64) = subspace.unpack(&packed).unwrap();
         assert_eq!(tup, tup_unpack);
 
@@ -215,7 +219,7 @@ mod tests {
     fn unpack_with_subspace_versionstamp() {
         let subspace: Subspace = Versionstamp::complete([1; 10], 2).into();
         let tup = (Versionstamp::complete([1; 10], 0), 2);
-        let packed = subspace.pack_with_versionstamp(&tup);
+        let packed = subspace.pack(&tup);
         let tup_unpack: (Versionstamp, i64) = subspace.unpack(&packed).unwrap();
         assert_eq!(tup, tup_unpack);
         assert!(
@@ -245,6 +249,16 @@ mod tests {
         assert_eq!(expected, packed);
     }
 
+    #[test]
+    fn subspace_versionstamped_packing_requires_an_incomplete_stamp() {
+        let complete = Versionstamp::complete([1; 10], 0);
+        let subspace: Subspace = 1.into();
+        assert!(std::panic::catch_unwind(|| subspace.pack_with_versionstamp(&2)).is_err());
+        assert!(std::panic::catch_unwind(|| subspace.pack_with_versionstamp(&complete)).is_err());
+        let subspace: Subspace = complete.into();
+        assert!(std::panic::catch_unwind(|| subspace.pack_with_versionstamp(&2)).is_err());
+    }
+
     #[test]
     #[should_panic]
     fn subspace_cannot_use_multiple_incomplete_versionstamps() {
diff --git a/bindings/rust/foundationdb/Cargo.toml b/bindings/rust/foundationdb/Cargo.toml
index 88d54ea2349..00b97463641 100644
--- a/bindings/rust/foundationdb/Cargo.toml
+++ b/bindings/rust/foundationdb/Cargo.toml
@@ -22,10 +22,12 @@ keywords = ["foundationdb", "kv"]
 categories = ["database"]
 
 [package.metadata.docs.rs]
-features = ["embedded-fdb-include", "fdb-7_4", "uuid", "recipes"]
+features = ["embedded-fdb-include", "fdb-7_4", "uuid", "recipes", "accounting"]
 
 [features]
-default = ["uuid", "recipes"]
+# Optional client-side usage counters, budgets, and transaction metrics.
+accounting = []
+default = ["uuid"]
 uuid = ["dep:uuid", "foundationdb-tuple/uuid"]
 num-bigint = ["dep:num-bigint", "foundationdb-tuple/num-bigint"]
 # Use the locally embedded foundationdb fdb_c.h and fdb.options files
@@ -80,3 +82,23 @@ tracing-subscriber = "0.3.23"
 name = "api_version_library"
 crate-type = ["cdylib"]
 required-features = ["fdb-7_4"]
+
+[[test]]
+name = "budget"
+required-features = ["accounting"]
+
+[[test]]
+name = "metrics"
+required-features = ["accounting"]
+
+[[example]]
+name = "budgeted_scan"
+required-features = ["accounting"]
+
+[[example]]
+name = "instrumented"
+required-features = ["accounting"]
+
+[[example]]
+name = "conflict_reporting"
+required-features = ["accounting"]
diff --git a/bindings/rust/foundationdb/README.md b/bindings/rust/foundationdb/README.md
index 28917dee857..f6ddf17e786 100644
--- a/bindings/rust/foundationdb/README.md
+++ b/bindings/rust/foundationdb/README.md
@@ -50,6 +50,13 @@ This Rust crate is not tied to any Async Runtime.
 | `uuid`                 | Support for the uuid crate for Tuples                                          |
 | `num-bigint`           | Support for the bigint crate for Tuples                                        |
 | `trace`                | Enable tracing on transaction related operations                               |
+| `accounting`           | Opt in to transaction usage counters, client budgets, and metrics hooks         |
+| `recipes`              | Opt in to all distributed-system recipes                                        |
+| `recipes-leader-election` | Opt in to leader election and its ranked-register dependency                  |
+| `recipes-ranked-register` | Opt in to the ranked-register recipe independently                          |
+
+Only `uuid` is enabled by default. Accounting and recipes are independent opt-in
+extensions; ordinary transactions do not maintain Rust-side usage counters.
 
 ### Hello, World using the crate
 
diff --git a/bindings/rust/foundationdb/src/budget.rs b/bindings/rust/foundationdb/src/budget.rs
index c0c96396130..17b82fa3610 100644
--- a/bindings/rust/foundationdb/src/budget.rs
+++ b/bindings/rust/foundationdb/src/budget.rs
@@ -7,6 +7,9 @@
 
 //! Per-attempt usage accounting and the client-side budget.
 //!
+//! Available with the `accounting` Cargo feature. Without it, transactions do
+//! not allocate accounting state or count operations and result bytes.
+//!
 //! <div class="warning">
 //!
 //! The budget is a **client-side feature of this Rust binding**, not a native
@@ -29,7 +32,7 @@
 //!
 //! # Per-attempt semantics
 //!
-//! Accounting is always on and scoped to a single *transaction attempt*: usage
+//! With this feature enabled, accounting covers each *transaction attempt*: usage
 //! is reset whenever the transaction restarts (`on_error`, `reset`), while the
 //! configured limits survive and apply to the new attempt. A retried
 //! transaction therefore gets a fresh time and byte allowance, exactly like it
@@ -208,8 +211,8 @@ impl std::error::Error for BudgetExceeded {}
 /// Usage accounted for a single transaction attempt.
 ///
 /// Counters are incremented by [`Transaction`](crate::Transaction) as
-/// operations are issued (writes) or resolved (reads). They are always on: no
-/// instrumentation is required to get them.
+/// operations are issued (writes) or resolved (reads). With `accounting`
+/// enabled, no metrics collector is required to get them.
 ///
 /// A new instance is created for every attempt, see the
 /// [module documentation](self).
diff --git a/bindings/rust/foundationdb/src/database.rs b/bindings/rust/foundationdb/src/database.rs
index bef2d07d179..01a227c1058 100644
--- a/bindings/rust/foundationdb/src/database.rs
+++ b/bindings/rust/foundationdb/src/database.rs
@@ -20,9 +20,12 @@ use fdb_sys::if_cfg_api_versions;
 use foundationdb_macros::cfg_api_versions;
 use foundationdb_sys as fdb_sys;
 
+#[cfg(feature = "accounting")]
 use crate::metrics::{MetricsReport, TransactionMetrics};
 use crate::options;
-use crate::runner::{MetricsHooks, RunnerHooks, TransactionRunner};
+#[cfg(feature = "accounting")]
+use crate::runner::MetricsHooks;
+use crate::runner::{RunnerHooks, TransactionRunner};
 use crate::transaction::*;
 use crate::{FdbError, FdbResult, error};
 
@@ -394,11 +397,11 @@ impl Database {
     ///
     /// ```no_run
     /// # use foundationdb::*;
-    /// # use foundationdb::runner::MetricsHooks;
+    /// # struct Hooks;
+    /// # impl RunnerHooks for Hooks {}
     /// # async fn example(db: &Database) -> Result<(), FdbBindingError> {
-    /// let metrics = TransactionMetrics::new();
     /// db.runner()
-    ///     .hooks(&MetricsHooks::new(&metrics))
+    ///     .hooks(&Hooks)
     ///     .run(|trx, _| async move {
     ///         trx.set(b"key", b"value");
     ///         Ok::<_, FdbBindingError>(())
@@ -434,6 +437,7 @@ impl Database {
     }
 
     /// Runs a transactional function against this Database with retry logic and metrics collection.
+    /// Available with the `accounting` Cargo feature.
     /// The associated closure will be called until a non-retryable FDBError
     /// is thrown or commit() returns success.
     ///
@@ -466,6 +470,7 @@ impl Database {
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, closure))
     )]
+    #[cfg(feature = "accounting")]
     pub async fn instrumented_run<F, Fut, T, E>(
         &self,
         closure: F,
diff --git a/bindings/rust/foundationdb/src/directory/directory_layer.rs b/bindings/rust/foundationdb/src/directory/directory_layer.rs
index 423f73b3f5a..8588af0ce91 100644
--- a/bindings/rust/foundationdb/src/directory/directory_layer.rs
+++ b/bindings/rust/foundationdb/src/directory/directory_layer.rs
@@ -489,7 +489,7 @@ impl DirectoryLayer {
                     return Err(DirectoryError::Version(msg));
                 }
 
-                if minor > MINOR_VERSION {
+                if minor > MINOR_VERSION && allow_creation {
                     let msg = format!(
                         "directory with version {major}.{minor}.{patch} is read-only when opened using directory layer {MAJOR_VERSION}.{MINOR_VERSION}.{PATCH_VERSION}"
                     );
diff --git a/bindings/rust/foundationdb/src/error.rs b/bindings/rust/foundationdb/src/error.rs
index 5808456fd37..2300a61ef37 100644
--- a/bindings/rust/foundationdb/src/error.rs
+++ b/bindings/rust/foundationdb/src/error.rs
@@ -8,6 +8,7 @@
 
 //! Error types for the Fdb crate
 
+#[cfg(feature = "accounting")]
 use crate::budget::BudgetExceeded;
 use crate::directory::DirectoryError;
 use crate::options;
@@ -111,6 +112,7 @@ pub enum FdbBindingError {
     CustomError(Box<dyn std::error::Error + Send + Sync>),
     /// The client-side budget of the transaction attempt was exceeded, as
     /// reported by [`crate::Transaction::check_client_budget`]
+    #[cfg(feature = "accounting")]
     ClientBudgetExceeded(BudgetExceeded),
     #[cfg(feature = "recipes-leader-election")]
     /// Leader election specific error
@@ -170,6 +172,7 @@ impl From<DirectoryError> for FdbBindingError {
     }
 }
 
+#[cfg(feature = "accounting")]
 impl From<BudgetExceeded> for FdbBindingError {
     fn from(e: BudgetExceeded) -> Self {
         Self::ClientBudgetExceeded(e)
@@ -204,6 +207,7 @@ impl Debug for FdbBindingError {
                 write!(f, "Transaction user version allocator exhausted")
             }
             FdbBindingError::CustomError(err) => write!(f, "{err:?}"),
+            #[cfg(feature = "accounting")]
             FdbBindingError::ClientBudgetExceeded(err) => write!(f, "{err}"),
             #[cfg(feature = "recipes-leader-election")]
             FdbBindingError::LeaderElectionError(err) => write!(f, "{err:?}"),
@@ -225,6 +229,7 @@ impl std::error::Error for FdbBindingError {
             Self::DirectoryError(e) => Some(e),
             Self::PackError(e) => Some(e),
             Self::CustomError(e) => Some(e.as_ref()),
+            #[cfg(feature = "accounting")]
             Self::ClientBudgetExceeded(e) => Some(e),
             Self::ReferenceToTransactionKept => None,
             Self::UserVersionExhausted => None,
diff --git a/bindings/rust/foundationdb/src/lib.rs b/bindings/rust/foundationdb/src/lib.rs
index f4cd4d76ea9..ce5d903271a 100644
--- a/bindings/rust/foundationdb/src/lib.rs
+++ b/bindings/rust/foundationdb/src/lib.rs
@@ -13,6 +13,7 @@ extern crate static_assertions;
 
 pub mod api;
 #[deny(missing_docs)]
+#[cfg(feature = "accounting")]
 pub mod budget;
 if_cfg_api_versions! {min = 510, max = 600 =>
     pub mod cluster;
@@ -33,16 +34,18 @@ if_cfg_api_versions! {min = 710 =>
     pub mod mapped_key_values;
 }
 
+#[cfg(feature = "accounting")]
 pub mod metrics;
 
 /// Generated configuration types for use with the various `set_option` functions
 #[allow(clippy::all)]
 pub mod options;
 
-#[cfg(any(feature = "recipes", feature = "recipes-leader-election"))]
+#[cfg(feature = "recipes-ranked-register")]
 pub mod recipes;
 
 // Re-export metrics types for convenience
+#[cfg(feature = "accounting")]
 pub use crate::metrics::{
     AttemptMetrics, AttemptOutcome, ConflictKeys, MetricsReport, TransactionMetrics,
 };
@@ -63,14 +66,17 @@ if_cfg_api_versions! {min = 510, max = 600 =>
     pub use crate::cluster::Cluster;
 }
 
+#[cfg(feature = "accounting")]
 pub use crate::budget::{AttemptUsage, BudgetExceeded, BudgetKind, ClientBudget, UsageSnapshot};
 pub use crate::database::*;
 pub use crate::env::{Clock, Environment, Rng, SeededRng, WallClock};
 pub use crate::error::{FdbBindingError, RetryDecision, RetryableError};
 pub use crate::error::{FdbError, FdbResult};
 pub use crate::keyselector::*;
+#[cfg(feature = "accounting")]
+pub use crate::runner::MetricsHooks;
 pub use crate::runner::{
-    AttemptFailure, MetricsHooks, NativeRetryPolicy, RetryPolicy, RunnerHooks, TransactionRunner,
+    AttemptFailure, NativeRetryPolicy, RetryPolicy, RunnerHooks, TransactionRunner,
 };
 pub use crate::transaction::*;
 
diff --git a/bindings/rust/foundationdb/src/metrics.rs b/bindings/rust/foundationdb/src/metrics.rs
index cfff995d42c..dc5d0f71b7f 100644
--- a/bindings/rust/foundationdb/src/metrics.rs
+++ b/bindings/rust/foundationdb/src/metrics.rs
@@ -1,9 +1,10 @@
 //! Per-attempt metrics collected by [`Database::instrumented_run`](crate::Database::instrumented_run).
 //!
+//! Available with the `accounting` Cargo feature.
+//!
 //! The report is a list of [`AttemptMetrics`], one per transaction attempt, in
 //! order: a retried transaction keeps everything it did in its earlier
-//! attempts. Operation counters come from the always-on
-//! [`UsageSnapshot`] of the attempt, so
+//! attempts. Operation counters come from the attempt's [`UsageSnapshot`], so
 //! instrumentation only adds the timings, the outcome and the aggregates on
 //! top of what the binding already counts.
 
@@ -105,8 +106,8 @@ impl ConflictKeys {
 pub struct AttemptMetrics {
     /// Position of the attempt in the run, starting at 0.
     pub index: usize,
-    /// Operation counters and bytes of the attempt, from the always-on
-    /// accounting. See [`crate::budget`] for how precise they are.
+    /// Operation counters and bytes of the attempt. See [`crate::budget`] for
+    /// how precise they are.
     pub usage: UsageSnapshot,
     /// Application metrics recorded during the attempt with
     /// [`Transaction::set_custom_metric`](crate::Transaction::set_custom_metric).
diff --git a/bindings/rust/foundationdb/src/runner.rs b/bindings/rust/foundationdb/src/runner.rs
index d2299940ace..c147d570fcc 100644
--- a/bindings/rust/foundationdb/src/runner.rs
+++ b/bindings/rust/foundationdb/src/runner.rs
@@ -22,18 +22,16 @@
 //!
 //! ```no_run
 //! # use foundationdb::*;
-//! # use foundationdb::runner::MetricsHooks;
+//! # struct Hooks;
+//! # impl RunnerHooks for Hooks {}
 //! # async fn example(db: &Database) -> Result<(), FdbBindingError> {
-//! let metrics = TransactionMetrics::new();
 //! db.runner()
-//!     .hooks(&MetricsHooks::new(&metrics))
+//!     .hooks(&Hooks)
 //!     .run(|trx, _maybe_committed| async move {
 //!         trx.set(b"key", b"value");
 //!         Ok::<_, FdbBindingError>(())
 //!     })
 //!     .await?;
-//! let report = metrics.get_metrics_data();
-//! # let _ = report;
 //! # Ok(())
 //! # }
 //! ```
@@ -47,10 +45,13 @@
 //! ([`RetryDecision::Retry`]) is routed through `on_error` with code 1020
 //! (`not_committed`) so that it obeys the same budget.
 
-use std::time::{Duration, Instant};
+#[cfg(feature = "accounting")]
+use std::time::Duration;
+use std::time::Instant;
 
 use crate::database::{Database, MaybeCommitted};
 use crate::error::{FdbBindingError, FdbError, FdbResult, RetryDecision, RetryableError};
+#[cfg(feature = "accounting")]
 use crate::metrics::{AttemptOutcome, ConflictKeys, TransactionMetrics};
 use crate::transaction::{
     RetryableTransaction, Transaction, TransactionCommitError, TransactionCommitted,
@@ -69,7 +70,7 @@ const NOT_COMMITTED: i32 = 1020;
 /// # Ordering
 ///
 /// Every callback receives the index of the attempt it belongs to, starting at
-/// `0` and matching [`AttemptMetrics::index`](crate::metrics::AttemptMetrics::index).
+/// `0`. With `accounting` enabled this matches the metrics report attempt index.
 /// Per attempt, in order:
 ///
 /// 1. [`on_attempt_start`](Self::on_attempt_start)
@@ -348,6 +349,8 @@ impl<A: RunnerHooks + Sync, B: RunnerHooks + Sync> RunnerHooks for (A, B) {
     }
 }
 
+/// Available with the `accounting` Cargo feature.
+///
 /// Hooks collecting a [`MetricsReport`](crate::metrics::MetricsReport) into a
 /// [`TransactionMetrics`].
 ///
@@ -380,11 +383,13 @@ impl<A: RunnerHooks + Sync, B: RunnerHooks + Sync> RunnerHooks for (A, B) {
 /// which is what makes the counters of a plain `run` land in the report. A
 /// transaction only ever reports to one collector: stacking two `MetricsHooks`
 /// leaves the second one empty.
+#[cfg(feature = "accounting")]
 pub struct MetricsHooks {
     metrics: TransactionMetrics,
     start: Instant,
 }
 
+#[cfg(feature = "accounting")]
 impl MetricsHooks {
     /// Collects the metrics of a run into `metrics`.
     ///
@@ -398,6 +403,7 @@ impl MetricsHooks {
     }
 }
 
+#[cfg(feature = "accounting")]
 impl RunnerHooks for MetricsHooks {
     fn on_attempt_start(&self, trx: &Transaction, _attempt: usize) {
         // Wires the collector onto the transaction the runner created, which is
@@ -773,7 +779,8 @@ where
 /// It assembles the [`RunnerHooks`] and the [`RetryPolicy`] of a single call to
 /// [`run`](Self::run): no hooks and [`NativeRetryPolicy`] by default. Both are
 /// borrowed, so the same hooks and policy can be reused across runs (mind
-/// [`MetricsHooks`], which times the run from its own construction).
+/// `MetricsHooks` from the `accounting` feature, which times the run from its
+/// own construction).
 ///
 /// ```no_run
 /// # use foundationdb::*;
diff --git a/bindings/rust/foundationdb/src/transaction.rs b/bindings/rust/foundationdb/src/transaction.rs
index 4725c6ff20c..163e730a116 100644
--- a/bindings/rust/foundationdb/src/transaction.rs
+++ b/bindings/rust/foundationdb/src/transaction.rs
@@ -14,14 +14,20 @@ use foundationdb_sys as fdb_sys;
 use std::fmt;
 use std::ops::{Deref, Range, RangeInclusive};
 use std::ptr::NonNull;
+use std::sync::Arc;
 use std::sync::atomic::{AtomicU32, Ordering};
-use std::sync::{Arc, Mutex, OnceLock};
+#[cfg(feature = "accounting")]
+use std::sync::{Mutex, OnceLock};
+#[cfg(feature = "accounting")]
 use std::time::Instant;
 
+#[cfg(feature = "accounting")]
 use crate::budget::{AttemptUsage, BudgetExceeded, ClientBudget, UsageSlot, UsageSnapshot};
+#[cfg(feature = "accounting")]
 use crate::env::Clock;
 use crate::future::*;
 use crate::keyselector::*;
+#[cfg(feature = "accounting")]
 use crate::metrics::{AttemptOutcome, MetricKey, TransactionMetrics};
 use crate::options;
 
@@ -229,13 +235,14 @@ impl TransactionCommitError {
     /// You should not call this method most of the times and use `Database::transact` which
     /// implements a retry loop strategy for you.
     ///
-    /// On success the transaction enters a new attempt: its
-    /// [usage](Transaction::attempt_usage) restarts from zero, while its
-    /// [client budget](Transaction::set_client_budget) is kept. User versions
+    /// On success the transaction enters a new attempt. With `accounting`, its
+    /// usage restarts from zero and its client budget is kept. User versions
     /// allocated by [`Transaction::allocate_user_version`] are invalid for the
     /// new attempt, which starts allocating again at zero.
     pub fn on_error(self) -> impl Future<Output = FdbResult<Transaction>> {
+        #[cfg(feature = "accounting")]
         self.tr.mark_attempt_end();
+        #[cfg(feature = "accounting")]
         let cause = self.err;
 
         unsafe {
@@ -245,7 +252,9 @@ impl TransactionCommitError {
             ))
         }
         .map_ok(move |()| {
+            #[cfg(feature = "accounting")]
             self.tr.end_attempt(AttemptOutcome::Retried { cause });
+            #[cfg(feature = "accounting")]
             self.tr.begin_attempt_usage();
             self.tr.reset_user_version_allocator();
             self.tr
@@ -358,11 +367,14 @@ pub struct Transaction {
     inner: NonNull<fdb_sys::FDBTransaction>,
     /// Metrics collector of the transaction, attached at creation or by a
     /// runner hook, see [`Transaction::attach_metrics`]. Set at most once.
+    #[cfg(feature = "accounting")]
     metrics: OnceLock<TransactionMetrics>,
-    /// Always-on accounting of the current attempt, see [`crate::budget`].
+    /// Accounting of the current attempt, see [`crate::budget`].
+    #[cfg(feature = "accounting")]
     usage: UsageSlot,
     /// Client-side limits applied to the current attempt. Unlike `usage`, they
     /// are configuration: they survive `on_error` and `reset`.
+    #[cfg(feature = "accounting")]
     budget: Mutex<ClientBudget>,
     /// The next user version to issue for an incomplete versionstamp in the
     /// current transaction attempt.
@@ -566,8 +578,11 @@ impl Transaction {
     pub(crate) fn new(inner: NonNull<fdb_sys::FDBTransaction>) -> Self {
         Self {
             inner,
+            #[cfg(feature = "accounting")]
             metrics: OnceLock::new(),
+            #[cfg(feature = "accounting")]
             usage: UsageSlot::default(),
+            #[cfg(feature = "accounting")]
             budget: Mutex::new(ClientBudget::default()),
             user_version: AtomicU32::new(0),
         }
@@ -603,7 +618,10 @@ impl Transaction {
             .map(|current| current as u16)
             .map_err(|_| FdbBindingError::UserVersionExhausted)
     }
+}
 
+#[cfg(feature = "accounting")]
+impl Transaction {
     /// Attaches a metrics collector to this transaction and opens its first
     /// attempt on the accounting generation currently in use.
     ///
@@ -686,7 +704,7 @@ impl Transaction {
 
     /// Returns the usage accounted for the current transaction attempt.
     ///
-    /// Accounting is always on, no instrumentation needed. The counters are
+    /// Available with `accounting`; no metrics collector is needed. The counters are
     /// client-side estimates and are reset on every new attempt, see
     /// [`crate::budget`].
     #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
@@ -698,7 +716,7 @@ impl Transaction {
     ///
     /// The limits are **not** enforced by FoundationDB and not enforced
     /// automatically: they are checked when you call
-    /// [`check_client_budget`](Self::check_client_budget). See [`crate::budget`]
+    /// `check_client_budget`. See [`crate::budget`]
     /// for what is counted and how precise it is.
     ///
     /// Setting a budget starts a fresh accounting generation, so the limits
@@ -784,7 +802,9 @@ impl Transaction {
             .clone();
         budget.check(&self.usage())
     }
+}
 
+impl Transaction {
     /// Called to set an option on an FDBTransaction.
     pub fn set_option(&self, opt: options::TransactionOption) -> FdbResult<()> {
         unsafe { opt.apply(self.inner.as_ptr()) }
@@ -844,6 +864,7 @@ impl Transaction {
             )
         }
 
+        #[cfg(feature = "accounting")]
         self.usage().record_set((key.len() + value.len()) as u64);
     }
 
@@ -870,6 +891,7 @@ impl Transaction {
             )
         }
 
+        #[cfg(feature = "accounting")]
         self.usage().record_clear(key.len() as u64);
     }
 
@@ -882,10 +904,10 @@ impl Transaction {
     /// * `key` - the name of the key to be looked up in the database
     /// * `snapshot` - `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
     ///
-    /// The [attempt usage](Self::attempt_usage) is recorded when the future
+    /// With `accounting`, attempt usage is recorded when the future
     /// resolves successfully, into the attempt that issued the read: a read
     /// still in flight is not visible to
-    /// [`check_client_budget`](Self::check_client_budget) yet.
+    /// `check_client_budget` yet.
     #[cfg_attr(
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, key))
@@ -895,18 +917,21 @@ impl Transaction {
         key: &[u8],
         snapshot: bool,
     ) -> impl Future<Output = FdbResult<Option<FdbSlice>>> + Send + Sync + Unpin + use<> {
+        #[cfg(feature = "accounting")]
         let usage = self.usage();
+        #[cfg(feature = "accounting")]
         let lenght_key = key.len();
 
-        unsafe {
+        let future = unsafe {
             FdbFuture::<Option<FdbSlice>>::new(fdb_sys::fdb_transaction_get(
                 self.inner.as_ptr(),
                 key.as_ptr(),
                 fdb_len(key.len(), "key"),
                 fdb_bool(snapshot),
             ))
-        }
-        .map(move |result| {
+        };
+        #[cfg(feature = "accounting")]
+        let future = future.map(move |result| {
             if let Ok(value) = &result {
                 let (bytes_count, kv_fetched) = if let Some(values) = value {
                     ((lenght_key + values.len()) as u64, 1)
@@ -917,7 +942,8 @@ impl Transaction {
                 usage.record_get(bytes_count, kv_fetched);
             }
             result
-        })
+        });
+        future
     }
 
     /// Modify the database snapshot represented by transaction to perform the operation indicated
@@ -977,6 +1003,7 @@ impl Transaction {
             )
         }
 
+        #[cfg(feature = "accounting")]
         self.usage()
             .record_atomic_op((key.len() + param.len()) as u64);
     }
@@ -992,7 +1019,7 @@ impl Transaction {
     /// * `selector`: the key selector
     /// * `snapshot`: `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
     ///
-    /// In the [attempt usage](Self::attempt_usage), this counts as a `get` of
+    /// With `accounting`, this counts as a `get` of
     /// the selector key plus the resolved key, recorded when the future
     /// resolves successfully.
     #[cfg_attr(
@@ -1005,10 +1032,12 @@ impl Transaction {
         snapshot: bool,
     ) -> impl Future<Output = FdbResult<FdbSlice>> + Send + Sync + Unpin + use<> {
         let key = selector.key();
+        #[cfg(feature = "accounting")]
         let usage = self.usage();
+        #[cfg(feature = "accounting")]
         let length_key = key.len();
 
-        unsafe {
+        let future = unsafe {
             FdbFuture::<FdbSlice>::new(fdb_sys::fdb_transaction_get_key(
                 self.inner.as_ptr(),
                 key.as_ptr(),
@@ -1017,13 +1046,15 @@ impl Transaction {
                 selector.offset(),
                 fdb_bool(snapshot),
             ))
-        }
-        .map(move |result| {
+        };
+        #[cfg(feature = "accounting")]
+        let future = future.map(move |result| {
             if let Ok(resolved_key) = &result {
                 usage.record_get((length_key + resolved_key.len()) as u64, 0);
             }
             result
-        })
+        });
+        future
     }
 
     /// Reads all key-value pairs in the database snapshot represented by transaction (potentially
@@ -1111,7 +1142,7 @@ impl Transaction {
     ///   by 1 for each successive call while reading this range. In all other cases it is ignored.
     /// * `snapshot`: `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
     ///
-    /// In the [attempt usage](Self::attempt_usage), each resolved batch counts
+    /// With `accounting`, each resolved batch counts
     /// as one `call_get_range`: a full range scan through
     /// [`get_ranges`](Self::get_ranges) counts once per underlying batch.
     #[cfg_attr(
@@ -1124,11 +1155,16 @@ impl Transaction {
         iteration: usize,
         snapshot: bool,
     ) -> impl Future<Output = FdbResult<FdbValues>> + Send + Sync + Unpin + use<> {
-        self.get_range_impl(opt, iteration, snapshot, Some(self.usage()))
+        self.get_range_impl(
+            opt,
+            iteration,
+            snapshot,
+            #[cfg(feature = "accounting")]
+            Some(self.usage()),
+        )
     }
 
-    /// Same as [`get_range`](Self::get_range), but not accounted in the
-    /// [attempt usage](Self::attempt_usage).
+    /// Same as [`get_range`](Self::get_range), but excluded from accounting.
     ///
     /// For reads the binding performs on behalf of the user, on the special
     /// keyspace, which should neither consume the client budget nor show up in
@@ -1139,7 +1175,13 @@ impl Transaction {
         iteration: usize,
         snapshot: bool,
     ) -> impl Future<Output = FdbResult<FdbValues>> + Send + Sync + Unpin + use<> {
-        self.get_range_impl(opt, iteration, snapshot, None)
+        self.get_range_impl(
+            opt,
+            iteration,
+            snapshot,
+            #[cfg(feature = "accounting")]
+            None,
+        )
     }
 
     /// `usage` is the accounting generation to record into, `None` to skip
@@ -1149,14 +1191,14 @@ impl Transaction {
         opt: &RangeOption,
         iteration: usize,
         snapshot: bool,
-        usage: Option<Arc<AttemptUsage>>,
+        #[cfg(feature = "accounting")] usage: Option<Arc<AttemptUsage>>,
     ) -> impl Future<Output = FdbResult<FdbValues>> + Send + Sync + Unpin + use<> {
         let begin = &opt.begin;
         let end = &opt.end;
         let key_begin = begin.key();
         let key_end = end.key();
 
-        unsafe {
+        let future = unsafe {
             FdbFuture::<FdbValues>::new(fdb_sys::fdb_transaction_get_range(
                 self.inner.as_ptr(),
                 key_begin.as_ptr(),
@@ -1174,9 +1216,10 @@ impl Transaction {
                 fdb_bool(snapshot),
                 fdb_bool(opt.reverse),
             ))
-        }
-        .map(move |result| {
-            if let Ok(values) = &result {
+        };
+        #[cfg(feature = "accounting")]
+        let future = future.map(move |result| {
+            if let (Some(usage), Ok(values)) = (usage.as_ref(), &result) {
                 let kv_fetched = values.len();
                 let mut bytes_count = 0;
 
@@ -1187,13 +1230,12 @@ impl Transaction {
                     bytes_count += (key_len + value_len) as u64
                 }
 
-                if let Some(usage) = usage.as_ref() {
-                    usage.record_get_range(bytes_count, kv_fetched as u64);
-                }
+                usage.record_get_range(bytes_count, kv_fetched as u64);
             };
 
             result
-        })
+        });
+        future
     }
 
     /// Mapped Range is an experimental feature introduced in FDB 7.1.
@@ -1218,7 +1260,7 @@ impl Transaction {
     ///
     /// This is the "raw" version, users are expected to use [Transaction::get_mapped_ranges]
     ///
-    /// In the [attempt usage](Self::attempt_usage), a resolved batch counts as
+    /// With `accounting`, a resolved batch counts as
     /// one `call_get_range` and as the bytes of the primary key-values plus the
     /// nested key-values returned by the secondary queries.
     #[cfg_api_versions(min = 710)]
@@ -1238,9 +1280,10 @@ impl Transaction {
         let key_begin = begin.key();
         let key_end = end.key();
 
+        #[cfg(feature = "accounting")]
         let usage = self.usage();
 
-        unsafe {
+        let future = unsafe {
             FdbFuture::<MappedKeyValues>::new(fdb_sys::fdb_transaction_get_mapped_range(
                 self.inner.as_ptr(),
                 key_begin.as_ptr(),
@@ -1260,8 +1303,9 @@ impl Transaction {
                 fdb_bool(snapshot),
                 fdb_bool(opt.reverse),
             ))
-        }
-        .map(move |result| {
+        };
+        #[cfg(feature = "accounting")]
+        let future = future.map(move |result| {
             if let Ok(values) = &result {
                 let mut bytes_count = 0;
                 let mut kv_fetched = 0;
@@ -1282,7 +1326,8 @@ impl Transaction {
             }
 
             result
-        })
+        });
+        future
     }
 
     /// Mapped Range is an experimental feature introduced in FDB 7.1.
@@ -1340,7 +1385,7 @@ impl Transaction {
     /// The modification affects the actual database only if transaction is later committed with
     /// `Transaction::commit`.
     ///
-    /// In the [attempt usage](Self::attempt_usage), this counts as the two
+    /// With `accounting`, this counts as the two
     /// boundary keys only: the volume of data actually deleted is unknown to
     /// the client.
     #[cfg_attr(
@@ -1358,6 +1403,7 @@ impl Transaction {
             )
         }
 
+        #[cfg(feature = "accounting")]
         self.usage()
             .record_clear_range((begin.len() + end.len()) as u64);
     }
@@ -1407,19 +1453,23 @@ impl Transaction {
     /// On an instrumented transaction, the commit ends the current attempt: its
     /// duration is recorded whatever the result, and a successful commit pushes
     /// the attempt to the metrics report as
-    /// [`AttemptOutcome::Committed`](crate::metrics::AttemptOutcome::Committed).
+    /// `AttemptOutcome::Committed`.
     #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
     pub fn commit(self) -> impl Future<Output = TransactionResult> + Send + Sync + Unpin {
+        #[cfg(feature = "accounting")]
         let metrics = self.metrics().cloned();
+        #[cfg(feature = "accounting")]
         let started_at = Instant::now();
 
         unsafe { FdbFuture::<()>::new(fdb_sys::fdb_transaction_commit(self.inner.as_ptr())) }.map(
             move |r| {
+                #[cfg(feature = "accounting")]
                 if let Some(metrics) = &metrics {
                     metrics.record_commit(started_at.elapsed());
                 }
                 match r {
                     Ok(()) => {
+                        #[cfg(feature = "accounting")]
                         self.end_attempt(AttemptOutcome::Committed);
                         Ok(TransactionCommitted { tr: self })
                     }
@@ -1442,9 +1492,8 @@ impl Transaction {
     /// You should not call this method most of the times and use `Database::transact` which
     /// implements a retry loop strategy for you.
     ///
-    /// On success the transaction enters a new attempt: its
-    /// [usage](Self::attempt_usage) restarts from zero, while its
-    /// [client budget](Self::set_client_budget) is kept. User versions
+    /// On success the transaction enters a new attempt. With `accounting`, its
+    /// usage restarts from zero and its client budget is kept. User versions
     /// allocated by [`Self::allocate_user_version`] are invalid for the new
     /// attempt, which starts allocating again at zero.
     ///
@@ -1469,6 +1518,7 @@ impl Transaction {
         self,
         err: FdbError,
     ) -> impl Future<Output = (Transaction, FdbResult<()>)> + Send + Sync + Unpin {
+        #[cfg(feature = "accounting")]
         self.mark_attempt_end();
 
         unsafe {
@@ -1479,7 +1529,9 @@ impl Transaction {
         }
         .map(move |result| {
             if result.is_ok() {
+                #[cfg(feature = "accounting")]
                 self.end_attempt(AttemptOutcome::Retried { cause: err });
+                #[cfg(feature = "accounting")]
                 self.begin_attempt_usage();
                 self.reset_user_version_allocator();
             }
@@ -1500,7 +1552,7 @@ impl Transaction {
     /// Records an application metric for the current attempt, replacing any
     /// value previously recorded under the same name and labels.
     ///
-    /// Custom metrics are always on, like the [usage](Self::attempt_usage)
+    /// Custom metrics require `accounting`, like the attempt usage
     /// counters, and scoped to the current attempt: a retry starts from an
     /// empty set, and the values of the attempt that ended stay attached to it
     /// in the report. Recording one on a transaction nobody collects metrics
@@ -1536,6 +1588,7 @@ impl Transaction {
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, labels))
     )]
+    #[cfg(feature = "accounting")]
     pub fn set_custom_metric(&self, name: &str, value: u64, labels: &[(&str, &str)]) {
         self.usage().set_custom(MetricKey::new(name, labels), value);
     }
@@ -1568,6 +1621,7 @@ impl Transaction {
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, labels))
     )]
+    #[cfg(feature = "accounting")]
     pub fn increment_custom_metric(&self, name: &str, amount: u64, labels: &[(&str, &str)]) {
         self.usage()
             .increment_custom(MetricKey::new(name, labels), amount);
@@ -1693,21 +1747,24 @@ impl Transaction {
     pub fn get_read_version(
         &self,
     ) -> impl Future<Output = FdbResult<i64>> + Send + Sync + Unpin + use<> {
+        #[cfg(feature = "accounting")]
         let recording = self
             .metrics()
             .map(|metrics| (metrics.clone(), self.usage(), Instant::now()));
 
-        unsafe {
+        let future = unsafe {
             FdbFuture::<i64>::new(fdb_sys::fdb_transaction_get_read_version(
                 self.inner.as_ptr(),
             ))
-        }
-        .map(move |result| {
+        };
+        #[cfg(feature = "accounting")]
+        let future = future.map(move |result| {
             if let Some((metrics, usage, started_at)) = recording {
                 metrics.record_grv(&usage, started_at.elapsed(), result.as_ref().ok().copied());
             }
             result
-        })
+        });
+        future
     }
 
     /// Sets the snapshot read version used by a transaction.
@@ -1777,14 +1834,15 @@ impl Transaction {
     /// It is not necessary to call `reset()` when handling an error with `on_error()` since the
     /// transaction has already been reset.
     ///
-    /// This starts a new attempt: the [usage](Self::attempt_usage) restarts from
-    /// zero, while the [client budget](Self::set_client_budget) is kept. On an
-    /// instrumented transaction, the attempt being recorded is abandoned rather
+    /// This starts a new attempt. With `accounting`, usage restarts from zero
+    /// and the client budget is kept. On an instrumented transaction, the
+    /// attempt being recorded is abandoned rather
     /// than reported: it reached no conclusion. User versions allocated before
     /// reset are invalid for the new attempt, which starts allocating again at
     /// zero.
     pub fn reset(&mut self) {
         unsafe { fdb_sys::fdb_transaction_reset(self.inner.as_ptr()) }
+        #[cfg(feature = "accounting")]
         self.begin_attempt_usage();
         self.reset_user_version_allocator();
     }
@@ -1835,8 +1893,7 @@ impl Transaction {
     /// </div>
     ///
     /// The read itself is performed by the binding on your behalf: it is not
-    /// accounted in the [attempt usage](Self::attempt_usage) and does not
-    /// consume the [client budget](Self::set_client_budget).
+    /// counted with `accounting` enabled and does not consume the client budget.
     ///
     /// Only complete ranges are returned, see [`conflicting_keys`](Self::conflicting_keys).
     ///
@@ -1865,8 +1922,7 @@ impl Transaction {
     /// </div>
     ///
     /// The read itself is performed by the binding on your behalf: it is not
-    /// accounted in the [attempt usage](Self::attempt_usage) and does not
-    /// consume the [client budget](Self::set_client_budget).
+    /// counted with `accounting` enabled and does not consume the client budget.
     ///
     /// Only complete ranges are returned, see [`conflicting_keys`](Self::conflicting_keys).
     ///
diff --git a/bindings/rust/foundationdb/src/tuple_ext/hca.rs b/bindings/rust/foundationdb/src/tuple_ext/hca.rs
index 67e77eb9c9e..bb77472a8fd 100644
--- a/bindings/rust/foundationdb/src/tuple_ext/hca.rs
+++ b/bindings/rust/foundationdb/src/tuple_ext/hca.rs
@@ -36,6 +36,10 @@ use crate::*;
 
 const ONE_BYTES: &[u8] = &[0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00];
 
+// Allocators for the same subspace may share a transaction, so their
+// read-before-write sequences must be serialized across allocator instances.
+static ALLOCATION_MUTEX: Mutex<()> = Mutex::new(());
+
 pub enum HcaError {
     FdbError(FdbError),
     PackError(PackError),
@@ -102,7 +106,6 @@ impl TransactError for HcaError {
 pub struct HighContentionAllocator {
     counters: Subspace,
     recent: Subspace,
-    allocation_mutex: Mutex<()>,
 }
 
 impl HighContentionAllocator {
@@ -112,7 +115,6 @@ impl HighContentionAllocator {
         HighContentionAllocator {
             counters: subspace.subspace(&0i64),
             recent: subspace.subspace(&1i64),
-            allocation_mutex: Mutex::new(()),
         }
     }
 
@@ -147,7 +149,7 @@ impl HighContentionAllocator {
                 let counters_start = self.counters.subspace(&start);
 
                 let count_future = {
-                    let _mutex_guard = self.allocation_mutex.lock()?;
+                    let _mutex_guard = ALLOCATION_MUTEX.lock()?;
                     if window_advanced {
                         trx.clear_range(self.counters.bytes(), counters_start.bytes());
                         trx.set_option(TransactionOption::NextWriteNoWriteConflictRange)?;
@@ -189,7 +191,7 @@ impl HighContentionAllocator {
                 let recent_candidate = self.recent.subspace(&candidate);
 
                 let (latest_counter, candidate_value) = {
-                    let _mutex_guard = self.allocation_mutex.lock()?;
+                    let _mutex_guard = ALLOCATION_MUTEX.lock()?;
                     let latest_counter = trx.get_range(&counters_range, 1, true);
                     let candidate_value = trx.get(recent_candidate.bytes(), false);
                     trx.set_option(TransactionOption::NextWriteNoWriteConflictRange)?;
diff --git a/bindings/rust/foundationdb/tests/conflict_ranges.rs b/bindings/rust/foundationdb/tests/conflict_ranges.rs
index cef5aa1f40b..19ebbfc6178 100644
--- a/bindings/rust/foundationdb/tests/conflict_ranges.rs
+++ b/bindings/rust/foundationdb/tests/conflict_ranges.rs
@@ -196,6 +196,7 @@ async fn many_conflict_ranges_are_fully_paginated() -> FdbResult<()> {
 /// Reading the conflict ranges is a binding-internal read: it must not move the
 /// usage counters of the attempt, nor consume the client budget.
 #[cfg_api_versions(min = 630)]
+#[cfg(feature = "accounting")]
 #[tokio::test]
 async fn reading_conflict_ranges_is_unmetered() -> FdbResult<()> {
     const KEY: &[u8] = b"test-rcr-unmetered";
diff --git a/bindings/rust/foundationdb/tests/directory.rs b/bindings/rust/foundationdb/tests/directory.rs
index db11fee1bf0..09613a44fcb 100644
--- a/bindings/rust/foundationdb/tests/directory.rs
+++ b/bindings/rust/foundationdb/tests/directory.rs
@@ -55,6 +55,59 @@ async fn test_directory_rejects_occupied_ff_suffix() {
     test_directory_rejects_occupied_raw_prefix("test-directory-ff-suffix", &[0xff]).await;
 }
 
+#[tokio::test]
+async fn test_directory_newer_minor_version_is_read_only() {
+    let db = common::database().await.expect("cannot open fdb");
+    let test_root = Subspace::from("test-directory-newer-minor");
+    let nodes = test_root.subspace(&"node");
+    let directory = DirectoryLayer::new(nodes.clone(), test_root.subspace(&"content"), false);
+    let existing = vec![String::from("existing")];
+    let missing = vec![String::from("missing")];
+
+    let trx = db.create_trx().expect("cannot create txn");
+    trx.clear_subspace_range(&test_root);
+    let created = directory
+        .create(&trx, &existing, None, None)
+        .await
+        .expect("cannot create directory");
+    let version_key = nodes.subspace(&nodes.bytes()).pack(&b"version".as_slice());
+    let version: Vec<_> = [1_u32, 1, 0]
+        .into_iter()
+        .flat_map(u32::to_le_bytes)
+        .collect();
+    trx.set(&version_key, &version);
+    trx.commit().await.expect("cannot commit directory fixture");
+
+    let trx = db.create_trx().expect("cannot create txn");
+    let opened = directory
+        .open(&trx, &existing, None)
+        .await
+        .expect("newer minor version must allow reads");
+    assert_eq!(created.bytes().unwrap(), opened.bytes().unwrap());
+    assert!(directory.exists(&trx, &existing).await.unwrap());
+    assert!(!directory.exists(&trx, &missing).await.unwrap());
+    assert_eq!(directory.list(&trx, &[]).await.unwrap(), existing);
+    assert!(
+        directory
+            .create_or_open(&trx, &existing, None, None)
+            .await
+            .is_ok()
+    );
+
+    assert!(matches!(
+        directory.create(&trx, &missing, None, None).await,
+        Err(DirectoryError::Version(_))
+    ));
+    assert!(matches!(
+        directory.move_to(&trx, &existing, &missing).await,
+        Err(DirectoryError::Version(_))
+    ));
+    assert!(matches!(
+        directory.remove(&trx, &existing).await,
+        Err(DirectoryError::Version(_))
+    ));
+}
+
 async fn test_directory_rejects_occupied_raw_prefix(name: &str, suffix: &[u8]) {
     let db = common::database().await.expect("cannot open fdb");
     let test_root = Subspace::from(name);
diff --git a/bindings/rust/foundationdb/tests/hca.rs b/bindings/rust/foundationdb/tests/hca.rs
index 402dd2e9e37..e012f33c782 100644
--- a/bindings/rust/foundationdb/tests/hca.rs
+++ b/bindings/rust/foundationdb/tests/hca.rs
@@ -10,6 +10,7 @@ use foundationdb::{FdbResult, TransactOption};
 use futures::prelude::*;
 use std::collections::HashSet;
 use std::iter::FromIterator;
+use std::sync::Barrier;
 
 mod common;
 
@@ -82,6 +83,45 @@ async fn test_hca_concurrent_allocations() -> FdbResult<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn test_hca_independent_allocators_share_transaction() -> FdbResult<()> {
+    const THREADS: usize = 8;
+    const ALLOCATIONS_PER_THREAD: usize = 64;
+    let subspace = Subspace::from_bytes(b"test-hca-shared-trx");
+    let db = common::database().await?;
+    let trx = db.create_trx()?;
+    trx.clear_subspace_range(&subspace);
+    trx.commit().await?;
+
+    let trx = db.create_trx()?;
+    let barrier = Barrier::new(THREADS);
+    // Cooperative tasks cannot interleave the allocator's synchronous read/set
+    // sequence. Separate threads and allocator instances exercise that boundary.
+    let all_ints = std::thread::scope(|scope| {
+        let workers: Vec<_> = (0..THREADS)
+            .map(|_| {
+                scope.spawn(|| {
+                    let allocator = HighContentionAllocator::new(subspace.clone());
+                    barrier.wait();
+                    (0..ALLOCATIONS_PER_THREAD)
+                        .map(|_| {
+                            futures::executor::block_on(allocator.allocate(&trx))
+                                .expect("cannot allocate on shared transaction")
+                        })
+                        .collect::<Vec<_>>()
+                })
+            })
+            .collect();
+        workers
+            .into_iter()
+            .flat_map(|worker| worker.join().expect("allocator thread panicked"))
+            .collect::<Vec<_>>()
+    });
+    check_hca_result_uniqueness(&all_ints);
+    trx.commit().await?;
+    Ok(())
+}
+
 fn check_hca_result_uniqueness(results: &[i64]) {
     let result_set: HashSet<i64> = HashSet::from_iter(results.to_owned());
 
diff --git a/bindings/rust/foundationdb/tests/runner_hooks.rs b/bindings/rust/foundationdb/tests/runner_hooks.rs
index 7c92416f41b..8eeb2e7f62d 100644
--- a/bindings/rust/foundationdb/tests/runner_hooks.rs
+++ b/bindings/rust/foundationdb/tests/runner_hooks.rs
@@ -9,6 +9,7 @@ use std::sync::atomic::{AtomicU64, Ordering};
 mod common;
 
 /// Happy path: instrumented_run completes with metrics, no conflicts.
+#[cfg(feature = "accounting")]
 #[tokio::test]
 async fn test_happy_path_instrumented() -> FdbResult<()> {
     let db = common::database().await?;
@@ -35,6 +36,7 @@ async fn test_happy_path_instrumented() -> FdbResult<()> {
 ///
 /// ReportConflictingKeys (option 712) was added in FDB 6.3.
 #[cfg_api_versions(min = 630)]
+#[cfg(feature = "accounting")]
 #[tokio::test]
 async fn test_conflict_reports_in_metrics() -> FdbResult<()> {
     let db = common::database().await?;
@@ -144,7 +146,9 @@ async fn test_conflict_keys_direct_api() -> FdbResult<()> {
 // Hook composition, ordering and lifecycle
 // ---------------------------------------------------------------------------
 
-use foundationdb::runner::{AttemptFailure, MetricsHooks, RetryPolicy, RunnerHooks};
+#[cfg(feature = "accounting")]
+use foundationdb::runner::MetricsHooks;
+use foundationdb::runner::{AttemptFailure, RetryPolicy, RunnerHooks};
 use std::fmt;
 use std::sync::Mutex;
 
@@ -557,6 +561,7 @@ async fn retry_policy_can_retry_an_otherwise_fatal_error() {
 
 /// The wiring case: metrics hooks stacked on a user hook through the plain
 /// `run_with_hooks` produce the same complete report as `instrumented_run`.
+#[cfg(feature = "accounting")]
 #[tokio::test]
 async fn metrics_hooks_stacked_on_user_hooks_produce_a_full_report() {
     let db = common::database().await.expect("failed to open database");
diff --git a/bindings/rust/foundationdb/tests/tuple.rs b/bindings/rust/foundationdb/tests/tuple.rs
index e61b5360c8a..55245d5d159 100644
--- a/bindings/rust/foundationdb/tests/tuple.rs
+++ b/bindings/rust/foundationdb/tests/tuple.rs
@@ -6,7 +6,7 @@
 // copied, modified, or distributed except according to those terms.
 
 use foundationdb::{
-    ClientBudget, Database, FdbBindingError, FdbError,
+    Database, FdbBindingError, FdbError,
     options::MutationType,
     tuple::{Subspace, Versionstamp},
 };
@@ -14,6 +14,9 @@ use futures::StreamExt;
 use std::sync::{Arc, Barrier, Mutex};
 use std::thread;
 
+#[cfg(feature = "accounting")]
+use foundationdb::ClientBudget;
+
 mod common;
 
 #[tokio::test]
@@ -95,7 +98,7 @@ async fn test_subspace_with_versionstamp(db: &Database) {
     );
     // we can read the key back by re-packing with the subspace:
     let trx = db.create_trx().expect("cannot create txn");
-    let key = subspace.pack_with_versionstamp(&key_versionstamp);
+    let key = subspace.pack(&key_versionstamp);
     let value = trx.get(&key, false).await.expect("cannot read key");
     assert_eq!(value.as_deref(), Some(b"hello2".as_ref()));
     trx.commit().await.expect("cannot commit");
@@ -236,6 +239,7 @@ async fn commit_error_after_allocation(
     trx.commit().await.expect_err("transaction must conflict")
 }
 
+#[cfg(feature = "accounting")]
 #[tokio::test]
 async fn user_version_allocator_survives_budget_changes_and_does_not_affect_accounting()
 -> Result<(), FdbBindingError> {
diff --git a/bindings/rust/foundationdb/tests/versionstamp.rs b/bindings/rust/foundationdb/tests/versionstamp.rs
index 47896825927..124ddd6f356 100644
--- a/bindings/rust/foundationdb/tests/versionstamp.rs
+++ b/bindings/rust/foundationdb/tests/versionstamp.rs
@@ -80,7 +80,9 @@ async fn check_versionstamped_mutations(version: i32) {
                 Some("versionstamped mutations require runtime API 520 or later")
             );
         }
+        #[cfg(feature = "accounting")]
         assert_eq!(trx.attempt_usage().call_atomic_op, 0);
+        #[cfg(feature = "accounting")]
         assert_eq!(trx.attempt_usage().bytes_written, 0);
         // Unsupported versionstamps do not prevent API 510 atomic operations.
         trx.atomic_op(&counter_key, &1_i64.to_le_bytes(), MutationType::Add);
diff --git a/bindings/rust/scripts/run_bindingtester.sh b/bindings/rust/scripts/run_bindingtester.sh
index 132a6dba638..7e27a1f9d32 100755
--- a/bindings/rust/scripts/run_bindingtester.sh
+++ b/bindings/rust/scripts/run_bindingtester.sh
@@ -64,13 +64,11 @@ run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --c
 # https://github.com/foundationdb-rs/foundationdb-rs/issues/42
 run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python --seed 584458794
 
-# The shared scripted suite requires the current API version. Enable it once
-# the Rust binding supports that version; the imported binding is capped at 740.
-echo "Skipping scripted tests: they require the current API, newer than Rust's API 740."
-for ((i = 1; i <= iterations; i++)); do
-  echo "Running iteration $i"
-  run_test --num-ops 1000 --api-version $fdb_api_version --test-name api --compare python rust
-  run_test --num-ops 1000 --api-version $fdb_api_version --test-name api --concurrency 5 rust
-  run_test --num-ops 1000 --api-version $fdb_api_version --test-name directory --concurrency 1 rust --no-directory-snapshot-ops --compare python
-  run_test --num-ops 100 --api-version $fdb_api_version --test-name directory_hca --concurrency 1 rust --no-directory-snapshot-ops
-done
+# Database-level directory operations must retry concurrent commit conflicts.
+run_test --num-ops 100 --api-version 610 --test-name directory_hca --concurrency 5 rust --seed 3179331380
+
+# The shared runner selects the newest supported API for scripted cases and
+# samples supported runtime versions for randomized cases.
+BINDINGTESTS=rust DISPLAYERROR=1 BREAKONERROR=1 \
+  bash "${build_dir}/bindings/bindingtester/run_binding_tester.sh" \
+    "$iterations" "${build_dir}/bindings/rust/bindingtester-errors.log" "${extra_options[@]}"
diff --git a/bindings/rust/tests/current_headers.cmake b/bindings/rust/tests/current_headers.cmake
new file mode 100644
index 00000000000..46785d4c8b3
--- /dev/null
+++ b/bindings/rust/tests/current_headers.cmake
@@ -0,0 +1,24 @@
+# Generate the canonical C header inputs for compile-only Rust CI without
+# configuring or linking the FoundationDB server.
+if(NOT DEFINED OUTPUT_DIR)
+  message(FATAL_ERROR "OUTPUT_DIR is required")
+endif()
+get_filename_component(fdb_source_dir "${CMAKE_CURRENT_LIST_DIR}/../../.." ABSOLUTE)
+include(${fdb_source_dir}/flow/ApiVersions.cmake)
+find_package(Python3 REQUIRED COMPONENTS Interpreter)
+
+file(MAKE_DIRECTORY ${OUTPUT_DIR})
+file(COPY
+  ${fdb_source_dir}/bindings/c/foundationdb/fdb_c.h
+  ${fdb_source_dir}/bindings/c/foundationdb/fdb_c_types.h
+  ${fdb_source_dir}/fdbclient/vexillographer/fdb.options
+  DESTINATION ${OUTPUT_DIR})
+configure_file(
+  ${fdb_source_dir}/bindings/c/foundationdb/fdb_c_apiversion.h.cmake
+  ${OUTPUT_DIR}/fdb_c_apiversion.g.h @ONLY)
+execute_process(
+  COMMAND ${Python3_EXECUTABLE}
+    ${fdb_source_dir}/fdbclient/vexillographer/vexillographer.py
+    ${fdb_source_dir}/fdbclient/vexillographer/fdb.options c
+    ${OUTPUT_DIR}/fdb_c_options.g.h
+  COMMAND_ERROR_IS_FATAL ANY)
diff --git a/contrib/local_cluster/binding_test.py b/contrib/local_cluster/binding_test.py
index f50416ba1f1..c996cca586d 100755
--- a/contrib/local_cluster/binding_test.py
+++ b/contrib/local_cluster/binding_test.py
@@ -187,7 +187,7 @@ async def _test_coroutine(
             env=self._env,
         ).run()
         try:
-            await asyncio.wait_for(process.wait(), timeout=self._timeout)
+            return_code = await asyncio.wait_for(process.wait(), timeout=self._timeout)
         finally:
             stdout = (await process.stdout.read(-1)).decode("utf-8")
             stderr = (await process.stderr.read(-1)).decode("utf-8")
@@ -199,6 +199,10 @@ async def _test_coroutine(
                 logger.warning("API Test stderr:\n{}".format(stderr))
             else:
                 logger.info("API Test stderr: [Empty]")
+        if return_code != 0:
+            raise RuntimeError(
+                f"Binding tester [{api_language}] {test_name} exited with {return_code}"
+            )
 
     async def _run_test(
         self,
@@ -267,13 +271,23 @@ async def run_directory_hca_test(self, test: str):
 
 
 API_LANGUAGES = [
-    "python3",
+    "python",
     "java",
     "java_async",
     "go",
     "flow",
     "swift",
 ]
+if os.access(
+    os.environ.get(
+        "FDB_RUST_BINDINGTESTER",
+        os.path.join(BINARY_DIR, "tests", "rust", "bin", "bindingtester"),
+    ),
+    os.X_OK,
+):
+    API_LANGUAGES.append("rust")
+if os.environ.get("BINDINGTESTS"):
+    API_LANGUAGES = os.environ["BINDINGTESTS"].split()
 
 
 def _log_cluster_lines_with_severity(
@@ -310,7 +324,7 @@ def _generate_test_list(test_set: TestSet, api_languages: List[str] = API_LANGUA
     result = []
     for test in tests:
         for api_language in api_languages:
-            result.append(lambda lang=api_language: test(lang))
+            result.append(lambda lang=api_language, run=test: run(lang))
     return result
 
 

From 916dc513a6f0ad83147cb60dfa35144327e39a4d Mon Sep 17 00:00:00 2001
From: Trevor Clinkenbeard <tclinkenbeard@openai.com>
Date: Thu, 1 Oct 2026 21:01:48 -0700
Subject: [PATCH 11/11] Trim Rust import to core bindings and C ABI simulation

---
 .github/workflows/rust.yml                    |   15 +-
 .github/workflows/tidy.yml                    |    9 +-
 bindings/rust/.cargo/config.toml              |    7 +-
 bindings/rust/CMakeLists.txt                  |  133 +-
 bindings/rust/CONTRIBUTING.md                 |  120 +-
 bindings/rust/Cargo.lock                      |  129 -
 bindings/rust/Cargo.toml                      |   11 +-
 bindings/rust/README.md                       |  129 +-
 bindings/rust/UPSTREAM.md                     |   97 +-
 bindings/rust/assets/logo-400x400.png         |  Bin 44113 -> 0 bytes
 bindings/rust/flake.lock                      |   66 -
 bindings/rust/flake.nix                       |   67 -
 .../rust/foundationdb-profiling/Cargo.toml    |   30 -
 .../rust/foundationdb-profiling/README.md     |   12 -
 .../examples/top_keys.rs                      |  120 -
 .../foundationdb-profiling/src/aggregate.rs   |  606 ----
 .../rust/foundationdb-profiling/src/decode.rs |  943 ------
 .../rust/foundationdb-profiling/src/event.rs  |  258 --
 .../rust/foundationdb-profiling/src/lib.rs    |  159 -
 .../rust/foundationdb-profiling/src/reader.rs | 1664 ----------
 .../tests/decode_all.rs                       |  542 ----
 .../tests/fixtures/commit_7_4.bin             |  Bin 614 -> 0 bytes
 .../tests/fixtures/commit_error_7_4.bin       |  Bin 312 -> 0 bytes
 .../foundationdb-profiling/tests/read_page.rs |  336 --
 .../Cargo.toml                                |   22 -
 .../foundationdb-recipes-simulation/README.md |   94 -
 .../src/leader_election/mod.rs                |   13 -
 .../src/leader_election/types.rs              |   86 -
 .../src/leader_election/workload.rs           | 2835 -----------------
 .../src/lib.rs                                |   13 -
 .../test_poll_leader_election.toml            |   42 -
 .../Cargo.toml                                |   39 -
 .../foundationdb-simulation-tracing/README.md |  104 -
 .../examples/tracing_demo/lib.rs              |  136 -
 .../tracing_demo/test_tracing_demo.toml       |    9 -
 .../src/lib.rs                                |  563 ----
 .../rust/foundationdb-simulation/Cargo.toml   |   10 +-
 .../rust/foundationdb-simulation/README.md    |  445 +--
 .../rust/foundationdb-simulation/build.rs     |   84 +-
 .../examples/atomic/Dockerfile                |   37 -
 .../examples/atomic/lib.rs                    |  265 +-
 .../{test_file_74.toml => test_file.toml}     |    0
 .../examples/atomic/test_file_73.toml         |   36 -
 .../examples/noop/lib.rs                      |   33 +-
 .../examples/shared/lib.rs                    |   44 +-
 .../src/CppWorkload.cpp                       |  222 --
 .../foundationdb-simulation/src/bindings.rs   |   43 +-
 .../rust/foundationdb-simulation/src/env.rs   |  142 -
 .../src/headers/CWorkload.h                   |  160 -
 .../src/headers/CppWorkload.h                 |  112 -
 .../rust/foundationdb-simulation/src/lib.rs   |   27 -
 bindings/rust/foundationdb/Cargo.toml         |   30 +-
 bindings/rust/foundationdb/README.md          |   21 +-
 .../examples/blob-with-manifest.rs            |  409 ---
 bindings/rust/foundationdb/examples/blob.rs   |  100 -
 .../foundationdb/examples/budgeted_scan.rs    |  260 --
 .../foundationdb/examples/class-scheduling.rs |  408 ---
 .../examples/conflict_reporting.rs            |  200 --
 .../foundationdb/examples/instrumented.rs     |  125 -
 .../rust/foundationdb/examples/micro-queue.rs |  190 --
 .../foundationdb/examples/simple-index.rs     |  220 --
 bindings/rust/foundationdb/src/budget.rs      |  685 ----
 bindings/rust/foundationdb/src/database.rs    |  159 +-
 bindings/rust/foundationdb/src/env.rs         |  373 ---
 bindings/rust/foundationdb/src/error.rs       |  133 -
 bindings/rust/foundationdb/src/lib.rs         |   32 +-
 bindings/rust/foundationdb/src/metrics.rs     |  634 ----
 .../src/recipes/leader_election/algorithm.rs  |  427 ---
 .../src/recipes/leader_election/errors.rs     |  150 -
 .../src/recipes/leader_election/keys.rs       |   36 -
 .../src/recipes/leader_election/mod.rs        |  326 --
 .../src/recipes/leader_election/types.rs      |  549 ----
 bindings/rust/foundationdb/src/recipes/mod.rs |   38 -
 .../src/recipes/ranked_register/algorithm.rs  |  305 --
 .../src/recipes/ranked_register/errors.rs     |   88 -
 .../src/recipes/ranked_register/keys.rs       |   53 -
 .../src/recipes/ranked_register/mod.rs        |  283 --
 .../src/recipes/ranked_register/types.rs      |  158 -
 bindings/rust/foundationdb/src/runner.rs      |  863 -----
 bindings/rust/foundationdb/src/timekeeper.rs  |  101 -
 bindings/rust/foundationdb/src/transaction.rs |  555 +---
 bindings/rust/foundationdb/tests/budget.rs    |  507 ---
 .../foundationdb/tests/conflict_ranges.rs     |   43 +-
 bindings/rust/foundationdb/tests/error.rs     |   61 +-
 .../tests/leader_election_ranked_register.rs  | 1264 --------
 bindings/rust/foundationdb/tests/metrics.rs   |  639 ----
 .../foundationdb/tests/ranked_register.rs     |  507 ---
 bindings/rust/foundationdb/tests/run_retry.rs |  121 +-
 .../rust/foundationdb/tests/runner_hooks.rs   |  663 ----
 .../rust/foundationdb/tests/timekeeper.rs     |   90 -
 bindings/rust/foundationdb/tests/tuple.rs     |   31 -
 .../rust/foundationdb/tests/versionstamp.rs   |    4 -
 bindings/rust/rust-toolchain.toml             |   10 +-
 .../scripts/run_leader_election_simulation.sh |   61 -
 .../rust/scripts/simulation_entrypoint.sh     |   23 -
 bindings/rust/tests/current_headers.cmake     |    1 +
 96 files changed, 526 insertions(+), 22479 deletions(-)
 delete mode 100644 bindings/rust/assets/logo-400x400.png
 delete mode 100644 bindings/rust/flake.lock
 delete mode 100644 bindings/rust/flake.nix
 delete mode 100644 bindings/rust/foundationdb-profiling/Cargo.toml
 delete mode 100644 bindings/rust/foundationdb-profiling/README.md
 delete mode 100644 bindings/rust/foundationdb-profiling/examples/top_keys.rs
 delete mode 100644 bindings/rust/foundationdb-profiling/src/aggregate.rs
 delete mode 100644 bindings/rust/foundationdb-profiling/src/decode.rs
 delete mode 100644 bindings/rust/foundationdb-profiling/src/event.rs
 delete mode 100644 bindings/rust/foundationdb-profiling/src/lib.rs
 delete mode 100644 bindings/rust/foundationdb-profiling/src/reader.rs
 delete mode 100644 bindings/rust/foundationdb-profiling/tests/decode_all.rs
 delete mode 100644 bindings/rust/foundationdb-profiling/tests/fixtures/commit_7_4.bin
 delete mode 100644 bindings/rust/foundationdb-profiling/tests/fixtures/commit_error_7_4.bin
 delete mode 100644 bindings/rust/foundationdb-profiling/tests/read_page.rs
 delete mode 100644 bindings/rust/foundationdb-recipes-simulation/Cargo.toml
 delete mode 100644 bindings/rust/foundationdb-recipes-simulation/README.md
 delete mode 100644 bindings/rust/foundationdb-recipes-simulation/src/leader_election/mod.rs
 delete mode 100644 bindings/rust/foundationdb-recipes-simulation/src/leader_election/types.rs
 delete mode 100644 bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs
 delete mode 100644 bindings/rust/foundationdb-recipes-simulation/src/lib.rs
 delete mode 100644 bindings/rust/foundationdb-recipes-simulation/test_poll_leader_election.toml
 delete mode 100644 bindings/rust/foundationdb-simulation-tracing/Cargo.toml
 delete mode 100644 bindings/rust/foundationdb-simulation-tracing/README.md
 delete mode 100644 bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs
 delete mode 100644 bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/test_tracing_demo.toml
 delete mode 100644 bindings/rust/foundationdb-simulation-tracing/src/lib.rs
 delete mode 100644 bindings/rust/foundationdb-simulation/examples/atomic/Dockerfile
 rename bindings/rust/foundationdb-simulation/examples/atomic/{test_file_74.toml => test_file.toml} (100%)
 delete mode 100644 bindings/rust/foundationdb-simulation/examples/atomic/test_file_73.toml
 delete mode 100644 bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
 delete mode 100644 bindings/rust/foundationdb-simulation/src/env.rs
 delete mode 100644 bindings/rust/foundationdb-simulation/src/headers/CWorkload.h
 delete mode 100644 bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h
 delete mode 100644 bindings/rust/foundationdb/examples/blob-with-manifest.rs
 delete mode 100644 bindings/rust/foundationdb/examples/blob.rs
 delete mode 100644 bindings/rust/foundationdb/examples/budgeted_scan.rs
 delete mode 100644 bindings/rust/foundationdb/examples/class-scheduling.rs
 delete mode 100644 bindings/rust/foundationdb/examples/conflict_reporting.rs
 delete mode 100644 bindings/rust/foundationdb/examples/instrumented.rs
 delete mode 100644 bindings/rust/foundationdb/examples/micro-queue.rs
 delete mode 100644 bindings/rust/foundationdb/examples/simple-index.rs
 delete mode 100644 bindings/rust/foundationdb/src/budget.rs
 delete mode 100644 bindings/rust/foundationdb/src/env.rs
 delete mode 100644 bindings/rust/foundationdb/src/metrics.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/leader_election/algorithm.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/leader_election/errors.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/leader_election/keys.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/leader_election/mod.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/leader_election/types.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/mod.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/ranked_register/algorithm.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/ranked_register/errors.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/ranked_register/keys.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/ranked_register/mod.rs
 delete mode 100644 bindings/rust/foundationdb/src/recipes/ranked_register/types.rs
 delete mode 100644 bindings/rust/foundationdb/src/runner.rs
 delete mode 100644 bindings/rust/foundationdb/src/timekeeper.rs
 delete mode 100644 bindings/rust/foundationdb/tests/budget.rs
 delete mode 100644 bindings/rust/foundationdb/tests/leader_election_ranked_register.rs
 delete mode 100644 bindings/rust/foundationdb/tests/metrics.rs
 delete mode 100644 bindings/rust/foundationdb/tests/ranked_register.rs
 delete mode 100644 bindings/rust/foundationdb/tests/runner_hooks.rs
 delete mode 100644 bindings/rust/foundationdb/tests/timekeeper.rs
 delete mode 100755 bindings/rust/scripts/run_leader_election_simulation.sh
 delete mode 100755 bindings/rust/scripts/simulation_entrypoint.sh

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 63f7c3d12f5..f74de41e667 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -72,16 +72,21 @@ jobs:
           FDB_INCLUDE_DIR: ${{ runner.temp }}/rust-fdb-include
         run: |
           cargo check --locked -p foundationdb --lib --features fdb-7_4
-          cargo check --locked -p foundationdb --lib --features fdb-7_4,accounting
-          cargo check --locked -p foundationdb --test ranked_register --no-default-features --features fdb-7_4,recipes-ranked-register
 
-      - name: Check all workspace targets against current headers
+      - name: Check client targets against current headers
         # API version features are mutually exclusive; do not use --all-features.
         env:
           FDB_INCLUDE_DIR: ${{ runner.temp }}/rust-fdb-include
         run: >-
-          cargo check --locked --workspace --all-targets
-          --features embedded-fdb-include,fdb-7_4,num-bigint,trace,foundationdb/accounting
+          cargo check --locked --workspace --exclude foundationdb-simulation --all-targets
+          --features foundationdb/fdb-7_4,foundationdb/num-bigint,foundationdb/trace,foundationdb-gen/fdb-7_4
+
+      - name: Check simulator C ABI and examples
+        env:
+          FDB_INCLUDE_DIR: ${{ runner.temp }}/rust-fdb-include
+        run: >-
+          cargo check --locked --package foundationdb-simulation --all-targets
+          --features fdb-7_4
 
       - name: Check supported historical APIs
         # Some examples require newer APIs; historical compatibility covers the library.
diff --git a/.github/workflows/tidy.yml b/.github/workflows/tidy.yml
index 8c290581771..f792c67074d 100644
--- a/.github/workflows/tidy.yml
+++ b/.github/workflows/tidy.yml
@@ -118,14 +118,7 @@ jobs:
               if [[ $FILE == fdbserver/*/*RocksDB*.cpp ]]; then
                 ninja -C build_output fdbserver/rocksdb-prefix/src/rocksdb-stamp/rocksdb-download
               fi
-              COMPILE_ARGS=()
-              case "$FILE" in
-                bindings/rust/foundationdb-simulation/src/CppWorkload.cpp|bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h)
-                  # Cargo owns this bridge, so it has no CMake compilation database entry.
-                  COMPILE_ARGS=(-- -x c++ -std=c++14 -DFDB_API_VERSION=740)
-                  ;;
-              esac
-              if ! clang-tidy -p build_output --warnings-as-errors='*' "$FILE" "${COMPILE_ARGS[@]}"; then
+              if ! clang-tidy -p build_output --warnings-as-errors='*' "$FILE"; then
                 PASSED=false
               fi
               echo
diff --git a/bindings/rust/.cargo/config.toml b/bindings/rust/.cargo/config.toml
index 17885922741..a0257424105 100644
--- a/bindings/rust/.cargo/config.toml
+++ b/bindings/rust/.cargo/config.toml
@@ -2,13 +2,12 @@
 # Common development aliases for contributors
 
 # Build/test/check with latest FDB version (7.4) using embedded headers
-# These work with Nix or when FDB headers are available
+# Linking requires an installed FoundationDB client library
 build-fdb-latest = "build -p foundationdb --features embedded-fdb-include,fdb-7_4"
 test-fdb-latest = "test -p foundationdb --features embedded-fdb-include,fdb-7_4"
 check-fdb-latest = "check -p foundationdb --features embedded-fdb-include,fdb-7_4"
 clippy-fdb-latest = "clippy -p foundationdb --features embedded-fdb-include,fdb-7_4"
 doc-fdb-latest = "doc -p foundationdb --features embedded-fdb-include,fdb-7_4"
 
-# Lint the whole workspace (all targets and features) and deny warnings.
-# Used by CI; run it before pushing.
-clippy-all = "clippy --all-targets --no-default-features --features num-bigint,embedded-fdb-include,fdb-7_4,trace -- -D warnings"
+# Lint retained crates and examples with the current supported API.
+clippy-all = "clippy --workspace --all-targets --features foundationdb/num-bigint,foundationdb/embedded-fdb-include,foundationdb/fdb-7_4,foundationdb/trace,foundationdb-gen/fdb-7_4,foundationdb-gen/embedded-fdb-include,foundationdb-simulation/fdb-7_4 -- -D warnings"
diff --git a/bindings/rust/CMakeLists.txt b/bindings/rust/CMakeLists.txt
index d15533b59d7..078a92d033e 100644
--- a/bindings/rust/CMakeLists.txt
+++ b/bindings/rust/CMakeLists.txt
@@ -1,4 +1,5 @@
 option(RUN_RUST_INTEGRATION_TESTS "Compile and run Rust tests against a temporary cluster" OFF)
+option(BUILD_RUST_SIMULATION "Build Rust simulator workloads and their tests" OFF)
 
 # bindgen and the Rust option generator consume the same headers and options as
 # the other bindings. Packaged historical headers remain available to Cargo users.
@@ -9,6 +10,9 @@ set(rust_header_inputs
   ${CMAKE_BINARY_DIR}/bindings/c/foundationdb/fdb_c_options.g.h
   ${CMAKE_BINARY_DIR}/bindings/c/foundationdb/fdb_c_apiversion.g.h
   ${CMAKE_SOURCE_DIR}/fdbclient/vexillographer/fdb.options)
+if(BUILD_RUST_SIMULATION)
+  list(APPEND rust_header_inputs ${CMAKE_SOURCE_DIR}/bindings/c/foundationdb/CWorkload.h)
+endif()
 set(rust_headers)
 foreach(header IN LISTS rust_header_inputs)
   get_filename_component(name ${header} NAME)
@@ -64,30 +68,16 @@ set(rust_unit_packages
   --package foundationdb
   --package foundationdb-tuple
   --package foundationdb-gen
-  --package foundationdb-macros
-  --package foundationdb-simulation
-  --package foundationdb-simulation-tracing)
-set(rust_unit_args ${rust_cargo_args}
-  --features foundationdb-simulation/fdb-7_4)
+  --package foundationdb-macros)
 add_custom_target(fdb_rust_tests ALL
   COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
-    ${CARGO_EXECUTABLE} test ${rust_unit_args} ${rust_unit_packages} --lib --no-run
+    ${CARGO_EXECUTABLE} test ${rust_cargo_args} ${rust_unit_packages} --lib --no-run
   DEPENDS fdb_rust
   WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
   COMMENT "Compile Rust library unit tests"
   COMMAND_EXPAND_LISTS
   VERBATIM)
 
-add_custom_target(fdb_rust_accounting_tests ALL
-  COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
-    ${CARGO_EXECUTABLE} test ${rust_cargo_args}
-    --features foundationdb/accounting --package foundationdb --lib --no-run
-  DEPENDS fdb_rust_tests
-  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
-  COMMENT "Compile Rust accounting unit tests"
-  COMMAND_EXPAND_LISTS
-  VERBATIM)
-
 if(APPLE)
   set(rust_library_path DYLD_LIBRARY_PATH)
 else()
@@ -98,19 +88,11 @@ set(rust_test_env ${rust_env}
 
 add_test(NAME rust_unit_tests
   COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
-    ${CARGO_EXECUTABLE} test ${rust_unit_args} ${rust_unit_packages} --lib --offline
+    ${CARGO_EXECUTABLE} test ${rust_cargo_args} ${rust_unit_packages} --lib --offline
   WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
   COMMAND_EXPAND_LISTS)
 set_tests_properties(rust_unit_tests PROPERTIES TIMEOUT 300 LABELS "rust")
 
-add_test(NAME rust_accounting_unit_tests
-  COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
-    ${CARGO_EXECUTABLE} test ${rust_cargo_args}
-    --features foundationdb/accounting --package foundationdb --lib --offline
-  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
-  COMMAND_EXPAND_LISTS)
-set_tests_properties(rust_accounting_unit_tests PROPERTIES TIMEOUT 300 LABELS "rust")
-
 # This compile-fail doctest checks the public raw-pointer ownership boundary.
 # Other client doctests may require a running cluster.
 add_test(NAME rust_future_safety_tests
@@ -121,63 +103,66 @@ add_test(NAME rust_future_safety_tests
   COMMAND_EXPAND_LISTS)
 set_tests_properties(rust_future_safety_tests PROPERTIES TIMEOUT 300 LABELS "rust")
 
-foreach(symbol str_from_c WorkloadContext::new WorkloadContext::set_process_id register_workload_context WrappedWorkload Metrics)
-  string(REPLACE "::" "_" test_suffix ${symbol})
-  add_test(NAME rust_simulation_${test_suffix}_safety_tests
+if(BUILD_RUST_SIMULATION)
+  set(rust_simulation_args ${rust_cargo_base_args}
+    --package foundationdb-simulation --features foundationdb-simulation/fdb-7_4)
+  add_custom_target(fdb_rust_simulation ALL
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
+      ${CARGO_EXECUTABLE} build ${rust_simulation_args} --lib --examples
+    DEPENDS fdb_rust
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    COMMENT "Build Rust simulator workloads"
+    COMMAND_EXPAND_LISTS
+    VERBATIM)
+  add_custom_target(fdb_rust_simulation_tests ALL
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
+      ${CARGO_EXECUTABLE} test ${rust_simulation_args} --lib --no-run
+    DEPENDS fdb_rust_simulation
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    COMMENT "Compile Rust simulator unit tests"
+    COMMAND_EXPAND_LISTS
+    VERBATIM)
+  add_test(NAME rust_simulation_unit_tests
     COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
-      ${CARGO_EXECUTABLE} test ${rust_cargo_base_args}
-      --features foundationdb-simulation/fdb-7_4
-      --package foundationdb-simulation --doc --offline ${symbol}
+      ${CARGO_EXECUTABLE} test ${rust_simulation_args} --lib --offline
     WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
     COMMAND_EXPAND_LISTS)
-  set_tests_properties(rust_simulation_${test_suffix}_safety_tests PROPERTIES
-    TIMEOUT 300 LABELS "rust")
-endforeach()
+  set_tests_properties(rust_simulation_unit_tests PROPERTIES
+    TIMEOUT 300 LABELS "rust;simulation")
 
-add_test(NAME rust_simulation_tracing_guard_safety_tests
-  COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
-    ${CARGO_EXECUTABLE} test ${rust_cargo_base_args}
-    --features foundationdb-simulation-tracing/fdb-7_4
-    --package foundationdb-simulation-tracing --doc --offline TracingGuard
-  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
-  COMMAND_EXPAND_LISTS)
-set_tests_properties(rust_simulation_tracing_guard_safety_tests PROPERTIES
-  TIMEOUT 300 LABELS "rust")
+  foreach(symbol str_from_c WorkloadContext::new WorkloadContext::set_process_id register_workload_context WrappedWorkload Metrics)
+    string(REPLACE "::" "_" test_suffix ${symbol})
+    add_test(NAME rust_simulation_${test_suffix}_safety_tests
+      COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+        ${CARGO_EXECUTABLE} test ${rust_simulation_args} --doc --offline ${symbol}
+      WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+      COMMAND_EXPAND_LISTS)
+    set_tests_properties(rust_simulation_${test_suffix}_safety_tests PROPERTIES
+      TIMEOUT 300 LABELS "rust;simulation")
+  endforeach()
 
-add_test(NAME rust_simulation_wake_order_tests
-  COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
-    "RUSTFLAGS=$ENV{RUSTFLAGS} --cfg fdb_simulation_loom"
-    CARGO_TARGET_DIR=${rust_target_dir}-loom
-    ${CARGO_EXECUTABLE} test ${rust_cargo_base_args}
-    --features foundationdb-simulation/fdb-7_4
-    --package foundationdb-simulation --lib --offline
-    fdb_rt::loom_tests::coalesced_wake_publishes_before_poll -- --exact
-  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
-  COMMAND_EXPAND_LISTS)
-set_tests_properties(rust_simulation_wake_order_tests PROPERTIES
-  TIMEOUT 300 LABELS "rust")
+  add_test(NAME rust_simulation_wake_order_tests
+    COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
+      "RUSTFLAGS=$ENV{RUSTFLAGS} --cfg fdb_simulation_loom"
+      CARGO_TARGET_DIR=${rust_target_dir}-loom
+      ${CARGO_EXECUTABLE} test ${rust_simulation_args} --lib --offline
+      fdb_rt::loom_tests::coalesced_wake_publishes_before_poll -- --exact
+    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+    COMMAND_EXPAND_LISTS)
+  set_tests_properties(rust_simulation_wake_order_tests PROPERTIES
+    TIMEOUT 300 LABELS "rust;simulation")
+endif()
 
 if(RUN_RUST_INTEGRATION_TESTS)
   if(NOT WITH_PYTHON_BINDING)
     message(FATAL_ERROR "Rust integration tests require BUILD_PYTHON_BINDING=ON")
   endif()
-  set(rust_accounting_test_args ${rust_cargo_args}
-    --features foundationdb/accounting --package foundationdb
-    --test budget --test metrics --test runner_hooks --test conflict_ranges
-    --test tuple --test versionstamp)
-  set(rust_recipes_test_args ${rust_cargo_args}
-    --features foundationdb/recipes --package foundationdb --lib
-    --test leader_election_ranked_register --test ranked_register)
   add_custom_target(fdb_rust_integration_tests ALL
     COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
       ${CARGO_EXECUTABLE} test ${rust_cargo_args} --package foundationdb --package bindingtester --tests --no-run
-    COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
-      ${CARGO_EXECUTABLE} test ${rust_accounting_test_args} --no-run
-    COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
-      ${CARGO_EXECUTABLE} test ${rust_recipes_test_args} --no-run
     COMMAND ${CMAKE_COMMAND} -E env ${rust_env}
       ${CARGO_EXECUTABLE} build ${rust_cargo_args} --package foundationdb --example api_version_library
-    DEPENDS fdb_rust_accounting_tests fdb_rust_tester python_binding
+    DEPENDS fdb_rust_tests fdb_rust_tester python_binding
     WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
     COMMENT "Compile Rust client integration tests"
     COMMAND_EXPAND_LISTS
@@ -187,16 +172,6 @@ if(RUN_RUST_INTEGRATION_TESTS)
       ${CARGO_EXECUTABLE} test ${rust_cargo_args} --package foundationdb --tests --offline -- --test-threads=1
     WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
     TEST_TIMEOUT 1200)
-  add_fdbclient_test(NAME rust_accounting_integration_tests
-    COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
-      ${CARGO_EXECUTABLE} test ${rust_accounting_test_args} --offline -- --test-threads=1
-    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
-    TEST_TIMEOUT 1200)
-  add_fdbclient_test(NAME rust_recipes_integration_tests
-    COMMAND ${CMAKE_COMMAND} -E env ${rust_test_env}
-      ${CARGO_EXECUTABLE} test ${rust_recipes_test_args} --offline -- --test-threads=1
-    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
-    TEST_TIMEOUT 1200)
   add_fdbclient_test(NAME rust_bindingtester_tests
     COMMAND bash ${CMAKE_CURRENT_SOURCE_DIR}/scripts/run_bindingtester.sh ${CMAKE_BINARY_DIR} 1
     WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
@@ -216,8 +191,8 @@ if(RUN_RUST_INTEGRATION_TESTS)
     TEST_TIMEOUT 120)
   # tmp_cluster otherwise preserves an inherited default cluster. These tests
   # must always use the disposable cluster created by the test runner.
-  set_tests_properties(rust_integration_tests rust_accounting_integration_tests rust_recipes_integration_tests
-    rust_bindingtester_tests rust_bindingtester_on_error_tests rust_api_version_libraries_tests PROPERTIES
+  set_tests_properties(rust_integration_tests rust_bindingtester_tests
+    rust_bindingtester_on_error_tests rust_api_version_libraries_tests PROPERTIES
     LABELS "rust;integration"
     ENVIRONMENT_MODIFICATION "FDB_CLUSTER_FILE=unset:")
 endif()
diff --git a/bindings/rust/CONTRIBUTING.md b/bindings/rust/CONTRIBUTING.md
index 21a4061099b..63f7390241b 100644
--- a/bindings/rust/CONTRIBUTING.md
+++ b/bindings/rust/CONTRIBUTING.md
@@ -1,15 +1,13 @@
 # Developing the Rust bindings
 
-Run Cargo commands from `bindings/rust`, where the toolchain and Cargo aliases are
-configured. The minimum Rust version is 1.85.1. Bindgen also requires libclang.
-Follow the FoundationDB repository contribution process for changes to this tree.
+Use Rust 1.85.1 or later, Cargo, and libclang. Follow the FoundationDB repository
+contribution process and preserve the imported licenses and contributor notices.
 
 ## Standalone Cargo
 
-For an installed FoundationDB client, use the existing versioned embedded headers:
+Run commands from `bindings/rust`. For an installed FoundationDB client:
 
 ```sh
-cd bindings/rust
 cargo build-fdb-latest
 cargo fmt --all -- --check
 cargo clippy-all
@@ -17,82 +15,56 @@ cargo test -p foundationdb-tuple --all-features --locked
 cargo test -p foundationdb-macros --locked
 ```
 
-`*-fdb-latest` currently selects `fdb-7_4` and `embedded-fdb-include`. Embedded
-headers remove the need for installed headers, but linking and running binaries
-still require `libfdb_c`. Set `FDB_CLIENT_LIB_PATH` if the library is outside the
-linker's standard search path, and configure the platform's runtime library path
-when needed. Do not use `--all-features` for the client: API-version features are
-mutually exclusive.
+The `*-fdb-latest` aliases select `fdb-7_4` and `embedded-fdb-include`. Embedded
+headers support standalone builds, but linking and execution still require
+`libfdb_c`. Set `FDB_CLIENT_LIB_PATH` and the platform's runtime library path when
+the library is outside the normal search paths. Client API features are mutually
+exclusive; do not use `--all-features` for the client.
 
-For a custom header set, `FDB_INCLUDE_DIR` selects a directory containing
-`fdb_c.h`, its companion headers, and `fdb.options`. It takes precedence over
-embedded headers. CMake supplies this directory from the current repository.
+`FDB_INCLUDE_DIR` overrides embedded headers. For client builds, it must contain
+`fdb_c.h`, its companion headers, and `fdb.options`; for simulator builds it must
+also contain `CWorkload.h`. CMake stages these inputs from the owning source tree.
+Standalone simulator builds otherwise use this repository's canonical
+`bindings/c/foundationdb/CWorkload.h`.
 
 ## Tests
 
-The CMake targets and CTests are described in [README.md](README.md). Enable
-`RUN_RUST_INTEGRATION_TESTS` in addition to `BUILD_RUST_BINDING` to run the client
-integration tests against a temporary local test cluster. Keep
-`BUILD_PYTHON_BINDING=ON` for the shared test-runner fixture, then build and run:
+Configure `BUILD_RUST_BINDING=ON` and build `fdb_rust_tests` for client, tuple,
+option-generator, and macro unit tests. `rust_future_safety_tests` also checks
+that raw future construction cannot bypass the ownership contract.
+
+Enable `RUN_RUST_INTEGRATION_TESTS=ON` and `BUILD_PYTHON_BINDING=ON` for tests
+against a disposable local cluster:
 
 ```sh
 cmake --build build --target fdb_rust_integration_tests fdbserver fdbcli fdbmonitor python_binding
 ctest --test-dir build -R '^rust_' --output-on-failure
 ```
 
-Run these commands from the repository root (or substitute an absolute build
-directory).
-
-When testing with Cargo directly, the client integration tests need a disposable
-FoundationDB database. They write test keys and exercise database-wide behavior;
-do not point them at an application cluster. Set `FDB_CLUSTER_FILE` to the test
-cluster file, then run:
-
-```sh
-cargo test-fdb-latest --locked
-```
-
-Use the in-tree [binding tester instructions](foundationdb-bindingtester/README.md)
-for comparison with Python. Tuple tests and macro tests do not need a cluster.
-
-`rust_unit_tests` also checks simulation context and metrics callbacks, executor
-wakeups, thread ownership, and phase teardown through native workload callbacks.
-The client is built and tested without accounting by default; the separate
-`rust_accounting_unit_tests` and `rust_accounting_integration_tests` enable the
-`accounting` feature. The latter runs budget, metrics, and related transaction
-coverage. `rust_recipes_integration_tests` separately enables `recipes` for library
-unit tests and the leader-election and ranked-register suites.
-`rust_bindingtester_tests` runs fixed regression seeds and the shared scripted
-and randomized suites against Python.
-Client integration tests check timekeeper read-error propagation and versionstamp
-behavior in separate processes selecting runtime APIs 510, 520, and 740.
-The live-cluster tests also cover raw directory-prefix collisions and transaction
-preservation after both retryable and nonretryable bindingtester `ON_ERROR` results,
-including reset and reuse. The library test uses current in-tree headers and two
-independently loaded Rust libraries to check concurrent initial API selection,
-shared selection, and runtime/header-version mismatches.
-The simulation safety doctests check that borrowed
-metrics sinks cannot escape their callback, process switching requires `unsafe`,
-and the tracing guard cannot move between threads.
-`rust_simulation_wake_order_tests` uses Loom to explore weak-memory interleavings of
-the executor's wake and dequeue code. Its separate Cargo target directory keeps
-model synchronization out of normal builds. These checks do not start the simulator;
-workload execution is a separate check against a compatible server.
-
-Hosted compile checks generate the current C headers and options using
-`tests/current_headers.cmake`, then check both the default client and the optional
-accounting build against those inputs. Historical API checks use their embedded
-headers separately.
-
-The simulation crates and their scripts are retained for focused simulator work;
-their READMEs describe the workload ABI and required server versions. The original
-repository's scheduled correctness, simulation, release, and documentation jobs
-are not enabled here. Validation should state the API feature, client/server
-version, tests, and binding-tester seeds actually exercised.
-
-## Contributions and licensing
-
-Keep changes focused and preserve public Rust API compatibility when possible.
-Run rustfmt and the relevant unit, integration, or binding tests. Existing
-changelogs record upstream releases; this migration does not create a new crate
-release. Preserve the imported MIT/Apache-2.0 license and contributor notices.
+These commands run from the repository root. Direct Cargo client integration tests
+also need a disposable cluster: set `FDB_CLUSTER_FILE`, then run
+`cargo test-fdb-latest --locked`. They write test keys and exercise database-wide
+behavior, so do not use an application cluster.
+
+The shared [binding tester](foundationdb-bindingtester/README.md) runs fixed
+regression seeds plus scripted and randomized comparisons against Python. Client
+coverage includes directory-prefix allocation, native retry/error ownership,
+commit uncertainty, and runtime-version-specific versionstamp behavior. Separate
+library subprocess tests cover compatible and incompatible API selection across
+independently loaded Rust libraries.
+
+## Simulator support
+
+Configure `BUILD_RUST_SIMULATION=ON` explicitly and build
+`fdb_rust_simulation_tests` to compile the C-ABI adapter, examples, and unit tests.
+The `rust_simulation_` CTests check context validity, callback metrics lifetimes,
+thread ownership, phase cancellation, and native teardown. The Loom test explores
+wake/dequeue memory ordering in a separate Cargo target directory. These checks do
+not execute the simulator; workload smoke tests use a compatible server as
+described in [foundationdb-simulation/README.md](foundationdb-simulation/README.md).
+
+Hosted checks cover all retained crates against generated current headers and
+check historical client API configurations against embedded snapshots separately.
+State the actual API feature, client/server versions, tests, and bindingtester
+seeds when reporting validation. Upstream release and scheduled simulation
+campaigns are not imported.
diff --git a/bindings/rust/Cargo.lock b/bindings/rust/Cargo.lock
index 030495abc04..2faff1f1af5 100644
--- a/bindings/rust/Cargo.lock
+++ b/bindings/rust/Cargo.lock
@@ -127,15 +127,6 @@ version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
-[[package]]
-name = "block-buffer"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -154,12 +145,6 @@ version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
-[[package]]
-name = "bytesize"
-version = "2.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7354288c522e7e980fafd2075d63d1285794c3a6a16cdd492f189ea406e5f18b"
-
 [[package]]
 name = "cc"
 version = "1.4.5"
@@ -213,12 +198,6 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
 [[package]]
 name = "cpufeatures"
 version = "0.3.1"
@@ -228,32 +207,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "crypto-common"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "data-encoding"
-version = "2.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
-
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer",
- "const-oid",
- "crypto-common",
-]
-
 [[package]]
 name = "env_filter"
 version = "2.0.0"
@@ -299,8 +252,6 @@ dependencies = [
  "async-recursion",
  "async-trait",
  "byteorder",
- "bytesize",
- "data-encoding",
  "foundationdb-gen",
  "foundationdb-macros",
  "foundationdb-sys",
@@ -311,7 +262,6 @@ dependencies = [
  "libc",
  "num-bigint",
  "rand",
- "sha2",
  "static_assertions",
  "tokio",
  "tracing",
@@ -336,50 +286,17 @@ dependencies = [
  "try_map",
 ]
 
-[[package]]
-name = "foundationdb-profiling"
-version = "0.1.0"
-dependencies = [
- "foundationdb",
- "futures-core",
- "futures-util",
- "thiserror",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "foundationdb-recipes-simulation"
-version = "0.1.0"
-dependencies = [
- "foundationdb",
- "foundationdb-simulation",
- "futures",
-]
-
 [[package]]
 name = "foundationdb-simulation"
 version = "0.3.0"
 dependencies = [
  "bindgen",
- "cc",
  "foundationdb",
  "foundationdb-sys",
  "futures-util",
  "loom",
 ]
 
-[[package]]
-name = "foundationdb-simulation-tracing"
-version = "0.1.0"
-dependencies = [
- "foundationdb",
- "foundationdb-simulation",
- "tracing",
- "tracing-core",
- "tracing-subscriber",
-]
-
 [[package]]
 name = "foundationdb-sys"
 version = "0.11.0"
@@ -518,15 +435,6 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
-[[package]]
-name = "hybrid-array"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
-dependencies = [
- "typenum",
-]
-
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
@@ -827,17 +735,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -913,26 +810,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "thiserror"
-version = "2.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "2.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.5",
-]
-
 [[package]]
 name = "thread_local"
 version = "1.1.10"
@@ -1037,12 +914,6 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fb1626d07cb5c1bb2cf17d94c0be4852e8a7c02b041acec9a8c5bdda99f9d580"
 
-[[package]]
-name = "typenum"
-version = "1.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
diff --git a/bindings/rust/Cargo.toml b/bindings/rust/Cargo.toml
index da26b3a126e..8205f8c5a7d 100644
--- a/bindings/rust/Cargo.toml
+++ b/bindings/rust/Cargo.toml
@@ -7,10 +7,15 @@ members = [
     "foundationdb-gen",
     "foundationdb-bindingtester",
     "foundationdb-macros",
-    "foundationdb-profiling",
     "foundationdb-simulation",
-    "foundationdb-simulation-tracing",
-    "foundationdb-recipes-simulation",
+]
+default-members = [
+    "foundationdb",
+    "foundationdb-tuple",
+    "foundationdb-sys",
+    "foundationdb-gen",
+    "foundationdb-bindingtester",
+    "foundationdb-macros",
 ]
 
 [profile.release]
diff --git a/bindings/rust/README.md b/bindings/rust/README.md
index d3979ded47f..608f05603ed 100644
--- a/bindings/rust/README.md
+++ b/bindings/rust/README.md
@@ -1,95 +1,84 @@
 # FoundationDB Rust bindings
 
 This Cargo workspace provides an async Rust interface to the FoundationDB C API,
-including transactions, tuple and directory layers, and a binding tester. It was
-imported from [foundationdb-rs](https://github.com/foundationdb-rs/foundationdb-rs).
-See [UPSTREAM.md](UPSTREAM.md) for the source revision and licensing provenance.
+including transactions, tuples, subspaces, the directory layer, and the shared
+binding tester. It was imported from
+[foundationdb-rs](https://github.com/foundationdb-rs/foundationdb-rs).
+[UPSTREAM.md](UPSTREAM.md) records the source revision and licensing provenance.
 
 ## Crates
 
 | Crate | Purpose |
 | --- | --- |
-| [`foundationdb`](foundationdb/README.md) | Async client, transactions, directory layer, and recipes |
+| [`foundationdb`](foundationdb/README.md) | Async client, transactions, and directory layer |
 | [`foundationdb-sys`](foundationdb-sys/README.md) | Raw C API bindings |
-| [`foundationdb-gen`](foundationdb-gen/README.md) | Generate Rust options from `fdb.options` |
+| [`foundationdb-gen`](foundationdb-gen/README.md) | Rust options generated from `fdb.options` |
 | [`foundationdb-tuple`](foundationdb-tuple/README.md) | Tuple encoding, subspaces, and versionstamps |
 | [`foundationdb-macros`](foundationdb-macros/README.md) | API-version conditional compilation |
-| [`bindingtester`](foundationdb-bindingtester/README.md) | FoundationDB binding tester protocol |
-| [`foundationdb-profiling`](foundationdb-profiling/README.md) | Client profiling data decoder |
-| [`foundationdb-simulation`](foundationdb-simulation/README.md) | Rust workloads for the deterministic simulator |
-| [`foundationdb-simulation-tracing`](foundationdb-simulation-tracing/README.md) | Simulator trace integration |
-| [`foundationdb-recipes-simulation`](foundationdb-recipes-simulation/README.md) | Recipe simulation workloads |
+| [`bindingtester`](foundationdb-bindingtester/README.md) | Shared binding tester protocol |
+| [`foundationdb-simulation`](foundationdb-simulation/README.md) | Optional C-ABI simulator workloads |
+
+The six client and tester crates are the default workspace members. Simulator
+support is selected explicitly. Application layers, client-budget policies,
+profiling decoders, and upstream development/release tooling are outside this
+import.
 
 ## Building with FoundationDB
 
 Rust is optional and requires Rust 1.85.1 or later, Cargo, and libclang for
-bindgen. Enable it when configuring the repository, then build the Rust targets:
+bindgen. Enable it when configuring the repository:
 
 ```sh
 cmake -S . -B build -G Ninja -DBUILD_RUST_BINDING=ON
 cmake --build build --target fdb_rust fdb_rust_tester fdb_rust_tests
-ctest --test-dir build -R '^rust_' --output-on-failure
+ctest --test-dir build -R '^rust_(unit_tests|future_safety_tests)$' --output-on-failure
 ```
 
-The CMake build links the in-tree `fdb_c` library and generates bindings from the
-same C headers and `fdb.options` as the other language bindings. Cargo artifacts
-stay in the build directory. See [CONTRIBUTING.md](CONTRIBUTING.md) for tests and
-standalone Cargo development.
-
-## Compatibility and current limits
-
-The migration preserves the upstream crate versions. API corrections are
-documented in [UPSTREAM.md](UPSTREAM.md): raw-pointer ownership requires `unsafe`,
-integer options take `i64` to cover the C API's full range, and simulation workload
-wrappers enforce context lifetime and thread access. Simulation metrics sinks are
-borrowed for their callback, and executor futures stay on their creating thread.
-Freeing a simulation workload cancels its suspended phase before releasing the
-workload or context. Phase database handles remain owned by the native caller.
-Process switching requires an unsafe call, and custom metric formats are checked
-before they reach the native formatter.
-Crate versions are independent of the FoundationDB server release number. Published crates on
-crates.io are separate releases; importing the source does not publish or transfer
-ownership of them.
-
-Select exactly one Cargo API feature: `fdb-5_1`, `fdb-5_2`, `fdb-6_0`, `fdb-6_1`,
+CMake uses the in-tree `fdb_c` library, generated C headers, and canonical
+`fdb.options`. Cargo artifacts stay in the build directory.
+[CONTRIBUTING.md](CONTRIBUTING.md) covers standalone Cargo and integration tests.
+
+To build the optional simulator adapter and its examples, also configure
+`BUILD_RUST_SIMULATION=ON` and build `fdb_rust_simulation_tests`. It uses the
+repository's canonical `CWorkload.h`, the C external-workload interface, and an
+executor that keeps futures on their simulator thread. Its unit and safety tests
+can be run with `ctest --test-dir build -R '^rust_simulation_' --output-on-failure`.
+Running workloads requires a compatible `fdbserver`; see the crate's README.
+
+## Compatibility
+
+Select exactly one client API feature: `fdb-5_1`, `fdb-5_2`, `fdb-6_0`, `fdb-6_1`,
 `fdb-6_2`, `fdb-6_3`, `fdb-7_0`, `fdb-7_1`, `fdb-7_3`, or `fdb-7_4`. The in-tree
-build selects `fdb-7_4` (API 740), the highest API supported by the imported
-workspace. A newer C client can serve that API, but this does not expose every
-feature of the current FoundationDB main branch. In particular, this import does
-not add API 800 wrappers or the native CDC API. Directory snapshot operations are
-also not supported by the Rust binding tester. The shared scripted suite selects
-the newest API supported by each tester: API 740 for Rust and API 800 for the
-current bindings. Additional wrappers and API-version support can be developed
-separately.
-
-Versionstamped key and value mutations require runtime API 520 or later. With
-API 510, these mutations panic before reaching the C client; other supported
-API 510 operations remain available. Tuple versionstamp helpers use the modern
-four-byte offset encoding.
-
-Multiple Rust simulator libraries can share the C client's API selection when
-built against the current headers and library. Registration verifies both the
-runtime and header versions before adopting an existing selection. Historical
-headers cannot query that state, so externally selected APIs are rejected instead
-of assuming compatibility. Each library must use the same version pair; this does
-not transfer ownership of the native network thread.
-
-The client follows the same transaction, retry, key-selector, tuple, and directory
-protocols as the other bindings, expressed through Rust futures and ownership.
-The [binding tester](foundationdb-bindingtester/README.md) exercises protocol
-compatibility. The import is not a claim of complete feature parity or a new
-cross-platform support guarantee. The CMake integration initially targets Linux
-and macOS; standalone Cargo retains upstream platform support.
-
-Simulation and profiling crates are retained as optional tools. Their compatibility
-with server-internal interfaces and profiling formats must be checked separately
-when changing server versions. Rust crates are not yet included in the native
-client installation packages, and the upstream publishing and scheduled simulation
-workflows are not installed by this migration.
+build selects API 740, the highest API exposed by the imported Rust client.
+Historical C headers and option snapshots remain available for standalone Cargo
+builds using `embedded-fdb-include`.
+
+A newer C client can serve API 740, but this import does not expose API 800 or
+native CDC wrappers. Directory snapshot operations are not supported by the Rust
+binding tester. Shared scripted tests select each tester's newest supported API:
+740 for Rust and 800 for the current bindings.
+
+Versionstamped mutations require runtime API 520 or later. With runtime API 510,
+these mutations panic before reaching the C client; other supported API 510
+operations remain available. Tuple versionstamp helpers use four-byte offsets.
+High-level versionstamped packing requires exactly one incomplete stamp; use
+ordinary packing for completed stamps.
+
+The simulator adapter targets the current C workload ABI. When built against
+current C client headers, independently loaded Rust workloads can share an API
+selection only after verifying both its runtime and header versions. Historical
+client headers cannot verify another library's selection and reject adoption.
+Simulator workload contexts, metrics sinks, and phase database handles enforce
+their native lifetime and thread boundaries. This does not transfer ownership of
+the native network thread.
+
+The in-tree build initially targets Linux and macOS. Native client distribution
+packaging and crate publishing are not configured by this import. Imported crate
+versions remain unchanged and are independent of the FoundationDB server version;
+this source import does not publish crates or transfer their ownership.
 
 ## License
 
-The imported Rust workspace remains dual licensed under
-[Apache 2.0](LICENSE-APACHE) or [MIT](LICENSE-MIT), at your option. Existing author
-and copyright notices are preserved. FoundationDB's other components retain their
-existing licenses.
+The imported workspace remains dual licensed under [Apache 2.0](LICENSE-APACHE)
+or [MIT](LICENSE-MIT), at your option. Existing author and copyright notices are
+preserved. FoundationDB's other components retain their existing licenses.
diff --git a/bindings/rust/UPSTREAM.md b/bindings/rust/UPSTREAM.md
index f248a24ceb9..50aa5a01bd9 100644
--- a/bindings/rust/UPSTREAM.md
+++ b/bindings/rust/UPSTREAM.md
@@ -6,64 +6,47 @@
 - Destination: `bindings/rust`
 - License: MIT OR Apache-2.0; see `LICENSE-MIT` and `LICENSE-APACHE`.
 
-The initial import preserves the ten-crate workspace, Cargo lockfile, examples,
-tests, historical C headers and option definitions, changelogs, and optional Nix
-development environment. The upstream project and its contributors retain their
-existing attribution. The complete upstream history remains available at the
-source repository and exact revision above; this is a source snapshot import.
+The initial source snapshot preserved the upstream workspace. The in-tree
+adaptation retains the six client/tester crates and minimal C-ABI simulator
+support, with their tests, historical client API snapshots, attribution, and
+licenses. Full upstream history remains available at the revision above.
 
-Repository-specific GitHub workflows, Dependabot/coverage/release configuration,
-agent instructions, and repository governance files were excluded. The adaptation
-commit integrates CMake, shared binding tests, repository metadata, and development
-documentation with FoundationDB. It does not import upstream hosted service
-credentials or establish automatic package publishing.
+Application recipes and their simulations, client accounting/budget/reporting and
+custom retry-policy APIs, profiling and Timekeeper utilities, simulator tracing
+integration, the legacy C++ workload bridge, and upstream Nix/Docker tooling are
+outside this binding import. They remain available in the original source
+snapshot. The core client still provides native transactions, retries, tuples,
+subspaces, directories, and mapped results.
 
-Historical headers and `fdb.options` snapshots support standalone Cargo builds
-against older API versions. The in-tree CMake build uses the canonical FoundationDB
-headers and option definitions instead. Preserve the historical snapshots when
-updating current options or formatting current FoundationDB C/C++ sources.
+CMake and shared tests use the repository's canonical C headers, `fdb.options`,
+and C workload interface. Historical client headers/options are preserved for
+standalone Cargo builds; do not rewrite them when updating current interfaces.
+Repository governance, hosted publishing, and upstream scheduled campaigns are
+not imported. Existing crate versions do not imply a new published release.
 
-The in-tree adaptation also corrects public API contracts from this snapshot:
+The adaptation corrects these retained API and safety contracts:
 
-- `FdbFuture::new` is now unsafe because it takes unique ownership of a raw C
-  future. Callers must establish pointer validity, ownership, and the result type
-  before constructing the wrapper.
-- Integer option payloads use `i64`, matching the signed 64-bit values accepted by
-  the C API. Callers with explicitly typed `i32` values must widen them with
-  `i64::from(value)`; unsuffixed integer literals continue to infer the right type.
-- Raw simulation context and string constructors require `unsafe`. Workloads are
-  wrapped through `RustWorkload::wrap`; `WrappedWorkload` is opaque, and workload
-  callback tables are managed by the crate. Context clones and environments
-  panic before accessing C state if used from another thread or after their
-  workload is released.
-- `Metrics<'_>` borrows its native sink for one `get_metrics` callback. A workload
-  cannot retain the sink after returning; collect owned metric values instead.
-- `WorkloadContext::set_process_id` is unsafe: its integer argument represents a
-  native process pointer and must satisfy the documented lifetime and restoration
-  requirements.
-- Custom metric formats are checked before reaching native formatting. They must
-  contain exactly one floating-point conversion without argument-supplied width,
-  precision, positional arguments, or length modifiers; invalid formats panic.
-- Simulation phases own their suspended workload and are cancelled before native
-  workload teardown. Borrowed database handles are disarmed on completion and
-  cancellation; all Rust references must be dropped before either path finishes.
-- Versionstamped mutations require runtime API 520 or later. Earlier runtime
-  versions panic before issuing either mutation because their key and value
-  encodings differ from the tuple helpers' modern encoding.
-- Timekeeper range-read errors propagate to the caller's retry loop. `None` means
-  a successful read found no matching entry.
-- Simulator registration checks API-selection failures. When built with the
-  current C headers, it uses `fdb_get_selected_api_versions` to verify an existing
-  process-wide runtime/header pair before initializing another Rust library.
-  Historical headers cannot verify another library's selection and return an error.
-- High-level versionstamped tuple and subspace packing requires exactly one
-  incomplete versionstamp, matching the other bindings. Use ordinary packing
-  for tuples containing only completed versionstamps.
-- Transaction usage counters, client budgets, and metrics APIs require the
-  opt-in `accounting` feature. Recipes are also opt-in; the default client
-  enables only `uuid`.
-- Simulation tracing guards are bound to their installation thread so their
-  destruction clears the correct thread-local context.
-- Database-level directory instructions in the binding tester use the native
-  transaction retry loop and publish stack results only after commit, matching
-  the other testers. Transaction-level instructions retain the caller's transaction.
+- Raw C future and simulation context/string constructors require `unsafe`.
+  Future wrappers take unique ownership of a valid pointer of the declared type.
+- Integer options take `i64`, matching the C API's signed 64-bit payloads.
+- Native retry handling discovers wrapped FoundationDB errors through their
+  source chain and retains commit uncertainty across later attempts.
+- Mapped-result selectors preserve server-provided range boundaries; futures
+  recheck readiness after installing the current task's waker.
+- Shared allocator synchronization protects callers using one transaction.
+  Directory metadata with a newer minor version remains readable, while writes
+  require compatible versions.
+- High-level versionstamped tuple/subspace packing requires exactly one incomplete
+  stamp. Versionstamped mutations require runtime API 520 or later; other supported
+  API 510 operations remain available.
+- Bindingtester database directory operations use native transaction retries and
+  publish results after commit. `on_error_with_transaction` preserves the original
+  transaction even when error handling fails.
+- Simulation wrappers enforce native context/thread lifetimes. Metrics borrow
+  their callback sink, process switching requires `unsafe`, and custom metric
+  formats must consume exactly one double.
+- Simulator futures stay on their owner thread. Workload release cancels suspended
+  phases before teardown; phase database handles remain owned by the native caller.
+- Current C headers expose the selected runtime/header pair so compatible loaded
+  Rust libraries can adopt it safely. Historical headers reject unverified
+  adoption. Neither path transfers ownership of the native network.
diff --git a/bindings/rust/assets/logo-400x400.png b/bindings/rust/assets/logo-400x400.png
deleted file mode 100644
index 2d3f03b632df870710302c9e41d3ae7474d339a3..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 44113
zcmeEtRa6{N(`_IS+$FfXySo!CxVyW%yE_DTf;+(n2p)8h0E08g0D<5HCwKCF|9!kK
z_xWF|r`Jq(ukJqQRPEZet0w-lsyrGp5%Rlt@6Z$#WHjErgGu}MLHqzc5;n*;^X?tR
zJ4G2uEx*FE{>MP0RsW;4zY9q?iZrs=l?u+CUw_1Jq;IJfdTojVm8<BtxR>%&eHXb!
zGf#@E=`$6mV16b9gH@H<bmTj&)!{ySJHm9w3(I1U4&WkpZ2m3;zPOz?_QHo@8)wao
zT}%K^sU%C`ezF!`1mA~7P#{K7d>az?pWg|Ce!aA#f~ER*BpNXe`g0ziiUN9tlwn*L
z^dO=$<^P`i-%0piOZfkEhfB=zj<-+Bm;<UZ5^!Kj88{g~Tud0Os8~!aOt88HoD3$J
zl#E1_JPa15q#q&{3>F#u|MNlyhnrZQQm>J3A28hB-@J>K16O!2fu=hBLP$YX7;Veq
zh{IdZJ47MGlrtg>tu>BdJnugG@qR>O(ZR*D%S|4ikhZ7yL&x|Q>*2sq{b36JcepKr
zl*RmzZ69)wtftEOG8|<D6az#!q+qV*!!Qcq;NZ21L$tf+9+s_Lw9N5pVEJ|#lJ|SM
zn}~zV&DN#+ys2rX<e4$P;(j8WsFH1w5sBja?+d^h@sNqheIgo&xQJ|aC)KMT0VZ}m
z)_NE4doI14y}*8ioU#OBQNsKpav%c@U?IKx##I$`NqQ-IV@ryRcF#gk&NwXhZz966
zkmC|#v0zen&2;48gUr^#eH%AO$V$u~Zb_&u+W|!dhZWp62d>&Zy~xb#QJr-Xq&19g
z!?&@ELpMF8#`Am+yl#%+-!H$`QK-hZ;6b77^1B^!+<UYenB+vM{db;xBn7$VR^_8*
ziY3&tB_lYFsIR}!C+Hx4_1!-va#jWV5V^@37H*ZDtf|b`b;H9zrH-WzrN8LZu+f5L
z(`vq4T0?Pi`2EO%1P>Y6?B}dlDex}1{d}Yl!BsVzkPTGHMOMq1n%)3;ph+^&j^ScP
zO$K@ja8DrED(Q8Jx-=0tSE_1eg?)eT4ok^NruZ#`ndL99wn>1}5GEKCY8ucfut@o3
zhd4bUttk)IKsfJq0~yd1>C@*$R>HsP6MUl(1#_hN66W0!%&rpT>46n|((kKu9v&>>
z9qZkyk!h_*N8ycBD&%FruJ*}`yZAtv_yk1Oe=i+LBM?`i=#`A{Q(XY`JqcqXaT*oZ
zDIg(@NkVN!&y_4gP}XCZQdGTKT+^DTYYwY^wDnAco_p!#x?P)%#Q{R1In;svlY=bv
zgn5B=<x<Q5&MNX`mXaOZh4IgtKS$B_Ns7m))zFiHu}r1gVUv`Vmr9z`W*9Z#6%6My
zBee$XMg3J=RToM;31*fFI;RSA>$vjsY!8+S0Q$L>7VC%kXg3n^HgVI5dJHzm$wztD
zJ9hqViScnSI@HjpgpttlNUfD3r}twFQ31{HxdFBUhoA6Ajv^#jLssDkw_k9JilP>P
zm0b)d=f8kHMIpJ7Gq>K&s&1;xBCqU>O8$B}$Zd>L7(t0>g-460!Lg>MG$OG^9yh3O
z>OGM6@H-U+>_3ayjYC%W#!RxR^+|n1U5s}3aun^u4eg?TftUJHrsoOJ|Mq}CQGuzM
z_{&W1?Sbf1B3b{VP;ESK#y;(n=P5~^(SFe|sR#cjWnGm!9YUPFIt!YHrXdt!j1E5I
z-{v`eh(BCK|2?M^ggNYxZwn{0A@E5PHYI7t2`f!(x=Q?LzCiQ#;Es+`5kKj!ggdo0
zNr~%%+wX(iob=zyD*pDl_+h4r3D>L486I*|7WW=FrQFMvPnGJeSlb$<SzOzQpJD{x
zzWis(G9-8msPqhYr<_P-DJZ%KXS9zedv5VdfgXe{B2S)V{r;|*X*4KlGt#|wEO-XH
zWtE-@#f3^cAfni7JXK|F!9ru3gP)|^EG%gSoRiOZNwyl4KXU9W%||Mrqu~FKe{r10
z=G7C=^4FBgOM@TeB+yfV9J%!imW%;6^Euk#VFKZVSV++{xanGCi}1>KI%FF9DqN?~
z^H10LZ?Ly|VxoCO@7IW86Zz=r97(2GJ-saQTY;yA1^0PP`SUtOHiHRD9J)$y2VMC8
z?97aThfR!)jA`-mqmFQ1j}CNwK(LWtq}L<7$e!9b(w0$q;6~SmaTadzl)ZJB9K}{l
z!@!CJQ<fQ*k~PeDaVn{YOF4~PS&W?dc}Mdg)@{a3^RsoP5>^3aUGp_wq<bPNioxIi
z@p5Wh%x2E<(WsaKBZ+{vc~|=<Pm`thlU)InP(z-&CLUhM!RSXT*hb3nTA?qF^uyf#
z1fev~gM0lv1pZ-FR1u9G+vb^6JTSS?S`RSHr3>^dBId<eM=rn_A&Fmv6QwB&lTix0
z_^thT?apYJYJwGV^FNMCX(+rfo5XV2GD7kLggT;=?4_EH{v;9L*-J?v$CE#NCA&hL
z_0Cm$$Xcvg|HEcUGk0z?w}`%NrJnV-&o<v$#?xz&U5oW04up_j`5kDMn)zkjr3Uq!
zNFbV^Zy)gRF=V1BSd=}z9SK`g#B7yTryw~uD7HS69L>$R|8-{mV@VuyuPj9n{Wflz
zeM}?rNuk4S_-3Ns%TtvBi?v{-XBBQY{YCoR#w{+%6P;)beLczK<{mi^=w`D5QSCp;
zj*{BzWt;M~caq=yM!TTpl~>pFoqlPya9$2(!IX+(Ap#C7t(p8kPm@7!Yk3Z2hGF#N
zhj|o|v8o93tMn8*DO3_V%4j3e_#&;gZCPr@U1+?o;FE{5M!U_*ax-abJvaL>v(`xa
zU2NA8Lv8H=RHHJ~+`<ByxHrau-FG32cF>zXeQ+FrP*L2c{tI*rR0w%C6=AvRbgC2-
z6R<ERtwA`$PiROAORyL;m>I=@$sSY)Po#co*_F_U<tfQz*29Tad@8$ct5|c}?nnj-
zE&Hu9E*Tl0Hq#v*&w@$<*umsuBgr@9;I<ZnWPIT0&Yt&+w}~fK+Ozz>P>)NLi5Q2d
z;F-H82h-CpDe>~f>T#8pB3SmA^;kv9LKz1rAw=*?Kr5^aU_qm6%hNtp7O$_W*G1UZ
zIyc)(c+g#EK6YPQk(|pwzQb=btY;n@$l)Wl_ciKpZXwS&rZGnJnzoe%T>l?lfr|#C
z?u&)_5y=1gabnzs+amj9vZtzf<oaYb&@}SnA`?ZKUoOX&oeT^`2yVY-RRpt*r0)j{
z!jh~*PG~?WZt$$^p8GM1DnIUex$x-E*7U$)=|M}|K{>jtkQ^lor_S95MyR+TZq^ns
zIcysLh#bcwwN3tC9HXF^t#s!`X!{xl*WMDM37auTsIH)IGCfFpBQ_a9rT&wKo)XUh
z3)^3o>lB-qJFz9D#9iQv;o*Gs62N&jv#&O<X$Y{?E6M4k>cpohgvM=1^!jDtCZNKs
zW`5JmM%U{$$gv~GYjH>XKZx@gYCa}15>@26VKSK~{qUqnj{cR2Y?Bs6RtuEssH2sL
z@e!@X<&0?O?LjeIe6d`-Dau*`LY>2{OP+<jI{U+1GmO+UrxLsbIeU(Hh%zmLSnZ+<
zEd9v7Uu4jq@v*RA9#x>B0MYclsSgJ){RSWWD6P@)K}4Gh6``IxxN#F!8pk@|hO9QC
zym@y?_i_*xW-XWHulK-8Mb~HOR#yF)THB3?Op$>i-i%IH4L!iKDlkN#f?(2*Wa=kD
zk=}uwOUnIRV_MOlZhgl98gw}Ysj|;gBllaSpQicI3;D{}O&8X?3I3GuM2*HNSz0%{
z{4W2vE)BJ*fe+{U5+qAz)v$vVloabQzbyk>KF5|obOp3(xH)PS@v<gm4>l2)DEbA*
zB%0<Vn&d(UR9&|@%Nir-dL$(>(t~OH1(#&S&HPdEoMMn2Q4N)nY;647IVNiBt(&rE
zRPVXW`4|>Y$WHF!=#~q(N-sqbstxdA9`pY(z2@*hJj~xjWp>Uqs7eMZ%L{cF7x+p^
z2fv^we$~KO{hK)i?<-)iD(t{c&sCK>R~yw<^h0|BjM9QDuQ)v(Vk{wRGc>3@5OT*q
zoL_N?_7II|vQ=dA$~9=GSRMHXdW5IWv3m%DP6n#-rAb6fe>qHfbHmcTbT^hl0=h%m
zZ@U;NBnenRcLSVobl+m3J{^R%nHk35ymuG=IV!fIJ`&F3@?Q4i_DnOEnYQ9l(4Jt4
z)=(fK9NdRCj$BT@wCIp&Jy$k@Jpu#Cbd~@tPX&C@0H6erhK}TmFTu<z;Z!qszOlKL
z)0h1<LNSp(iF2Fe)B2WUUis-&&PdW#ulnw9I=0TN6b6Z5L3sbLdiA>~O58<RhYMTl
zvKhiv2*(JnZJirc-)O0}tr_xSW*QR%w%`#zJp~rn4hswAsXbg@eJP#Lczi<vFCR7o
zk?a{L#dWbHszc3ZLSN)bSg4VtY#)<|9&9=NKg@9>Q|aZ`qLA$oSamDOj}f7>D!GM6
zMkd^Om1ub3TUD4s+soVktPNJ09D$M}$<}5Ema5-k?tAxz$jlz>;5DXNfZ}I*lmxGZ
zLA9&yP#8s7mfKGOp80Qu$aL@sni0fQ<wW2HE6L0s0ya@WSWi`@{0#3^Ar$71Nrkas
z##EU4Pk%vF)Rs4eGwfIGH`Zc3Mi3oRd}=%+Ja{~DE@@_sF+5~MDhgA=f9}ca284}}
zDr>bjUO9No@BQ7b6T5NhCekNm+Nmm1e>~-o0WZ5lI1mEUljs&Dn4*W(OFwH_Zg)*=
zF2K}#RwrJqtjCO5V6`oRt~UH5%f@Z-g=LFSMHj#KCao|+6~#i(IUoN9J+g<0S|^WM
zCmyHAe|yHr^6VEZ|7x<l#z<UT<2fBgfwVpq#cwDF5{an^3<4l@{xaEq8fh$95-2rz
z#>bsSE}bVq%P!rsBh}O9&<zLbiiD^GW+!rf-If?w)!6yu)1wF-PrF5?pEvsOw<_Ri
zQIlgq=mwN&27Y8jf0p2BEk}nN-JqZtN8zMw+;wb>o5;93o&;64n^<ZEJ1m|toUjp5
z#>1mDFTx+s2BIGPLWMXaK~@CvOm{&KXemVlQ}VVpk4{6Dl*dK2$2Oi8dKsmcD&mS}
z;5*P$z6&Rnb>^$jzt`V$x>NeSb*GL1-#)t^G%{4iFH(KMD@6tt?`kMXPBFbM=tnef
z{#NZo;=I4tkyRMe7=Z_Gjiw~FStI50L9F{Tq`Tw${E47k1NMjxD@f#+*J<8^U?u?7
z>MmwenmY+MfWZ7vv+X!NNethMI<@udVg3qcS<J$NXIm+C1g^c*jI6U`E3$9CjA*eN
zzhZZW?^08SQFrsGC50n*RxM{nqdUmp$gOi!jc!%ot_RZ2s|Wjqb6XK)xVK+kvsXtn
z^plmu*(a@LypJ+y$BCe}JhJ{H9b{1EGub_s5f#NSwc08B@y8v`klHXOCz+*U`&&)2
z;v;akSW~rI1cdj{KC5~mSyC08;u)Q|s)wshkBLIQg4gg&cNG{6@4*j_++&g-hY*k%
zT7l{~wA=`CZw;lC`Xx=wzb7Cnd=?_^&{30-{bZ|6K{8GhOo+9Bm<cvzqrk#|z!-#<
zt?4e7Xx>_r1Wc?FLK6}ZO>kp7vtGMcdv6{+BQpX5f_S$W88it#%>$>PUCo<JGi1m3
zy%3Sb|DzM5QDj3~G0iTbO0G8wDCK{vq+yUOA&``%B!YWoqy8%qw(*=6_4RR0zD|#t
zM=@*DcKjGk4$3-OayHiQCpWy?vn=jsx3Kc`IszGt?hJ-D42Hau*A31PHRtYqeyK%e
zje7`b05X=N^3+z^5~w_&Zgsu9?w1R=h4q?TrFnNq-<4xstmuxYSkbjpH6SSY_5n6F
zkrv&$N-(`|vU*jw$C!Jy3^^+}`FDNkp7V%;|6x9BLS2W4(g}OPhnEeg0C@SMZ8;<^
z5GQRGXbCzF?k<h!1KK@MwY@0Vw^K~6s#<C|<zhCQod>w;QidvBfe)DICm;eo0pa^N
zw5rhjRyBuka#@h)gqzEL<wq4uEHp#%jgiy!wX0Q-@0xTJNY>Y?jcBb2;~Asavz8G-
z^TZ4!Zt!k?`iQJ>E}0m|Xq#evO5=fkQm*#5(#CAj)^3r~-JuxEF*{S!@ujlmyIR9W
zkXJ}LN}>$_fYbA4(*W4O&H6!1H>1ldWg>G=nE-`g>WOi6{N&bM892)dk4+U718k!7
zOYMC&9*>;5;4BTl0mebJzOqvSSIbUxUESRok{~ymJl}-r!j><BS^5?<?K8WhT<>w}
zZ>?7ZJ;<KuDf8|Wtc)`JONtd0@Ob0R)}7nWcrh~+V!H^<Kxg#|`2BL-Ot(4#o{jz)
z;ZC62>JvtR%7nWrXG$s4e7n%FJ@Wu15^VSazirB5-w1456;pNhV^~y`-dokI6LLcc
z)K?~@qPyss0lIp-i-6f8jpU4_^`v8X!SqHKsq%~V9iM*^(U)Y{wrqM2-77?=C7RXb
z&as@Bzi0?J$c!*cc-`Ia)=tsMi&$^Ibc`-s`J*SZbBnmZRfro_iJO)+>wSf8U3NI_
zB70x3B8wT7?awQzvg>hxTAipW(UgtHfLa+VBLzndVJ0dS;vWvsL{KzZsMdnDr6$fV
z95FaPOvLPh+GSY*|Fp7NBqLMoDnboVs&J5f0>T(JdW9!oVaOEDui@rVxAwA#rmk+f
z0Uxk>@H1~R6clH8=kFgH_HI<T(k5s9g-XpL!%nE?&L>7PqA2~@&gaT0G0ej>-K2VW
zdRJy;AG(-77sjYHkHp$KtJ<szaOqfBIVCT|6H%`TRS2e*MNE8Ns1BX_8ahQQs!yNJ
zzGU5q#m=y(IUo38QC5Y@khX}CTdTqSws6{PVAQQ?)U0X7tZ9+J2vp*EJX<TLCJWNV
zYBX?YOhP7pDvY_q{S_YeEr7ht?;FjuArU;kPJpNYOuV(q1Dohq1(m0&EI;H7*|?)J
zM=7i>Wh6H>^hJFYS2^z7SZU4q9DPfQ_L<K<=@pOG+k-8tK60MzWGwyHvwr@%vfD<V
z!pRR5&i@Sb#onLqQ$Ts@F!d~iWWsnV;BIAwprMO$+<1cLYji)MV{XPgF&=}m@XOvN
zm8$`FQW86dz`*$TQ6cHP{51@+P4K;S8M`BTqtyy^I`_WFqHNAjts<*dRUo0Wn9cIZ
zv^JEbcrpx*+xdipuQo`g=R8=1r?DKrjI4;nwoj9^=@cCHuQg7)j!5&77}+)C(XX93
z`xzom#2CrbOm35CUz@>KcI^_UHkKaG35~J<4-$|urx!pf*hPqiok?HY=vZ=@q<W8+
z3Yxji@>c&=+v+?X4>Pr=<aKFZsp!?8#5~!cq7jR1o8AOJ*Zd1nS(}Ejm-zK+hEr^$
zB3%jBr%p!6M0CS=MErIT6wzc3mX1<0m~O2YHSsS0qZwp+k3^CVe1UvZ$Y=BHffu6w
z%;oQW94I*kQX*g0K5m!94n#b9s+lb1tloYU{cz*`!PEM`IvSUVPa@8WvzUPJL^E5n
zo4LB@Mhqc2Tf;DY4l{ti=SRT`$plv-$+RHJoIUyx5A_$|=kc$h!{*<wkJ*WU)Oo(i
zc%mAb2|u%_#H`O(G6iMV9aK^ZIH|_@=%y<~3Htpn9M`8qE;_YK6f07#Dx8m*6(K6^
z7Dtu-NqDnKt#3g^=Jhk?(}20bC#P&BPqJxMki5mGZqn749!TE(XDtO0U?M=CeCOH(
zD)yEgn81(TGc$CkdSb>UukeZt#_a1Lj!7|MsP*_wO=yY@@Zo8KQR{@{1a!hrgbEGA
z;tk1M@$sQ)krhwh=x3YgA>}+6$D)w>Pih07F7#7>62|&1R0$tpw~JtZaoIdX$2F^Y
z7m0ssiyOSp7QD|FiQ_HThW8}iGtzp-a#3PxeRd;c3&G`|;<zBZsKyR5#Vf5eABxTs
zGGfo8c?}%H+n&l1OxFirg0QKpa|p;xZAO{6HN1|ebxtPNDsT8E0ZLRCIL!HTS5^yg
z>k^;K@IrtmBDeTup$-*cG6fIHmiv+Tn3+p!^X+YA8cvo9&1*O~hzb-`t)&WO^sX{i
z9J=OiPT|xz|50s^Y(Gx!)Oc8qoq0CnDE3NM@GIcVraIxL`AC^yFhjjXda^%|f)C7j
z`iv(s7_rDl#LiH^3^LHXufSe1;O*EQPR3T=u66(AkarJc^WgD}4Ogo^dG$(pyTaqP
z30nL*Xtx6R^Pz%w55A-+LZ0O!vyi7JDV*_mS~_$Es%Y9WXzsUYAJ%Atb34Y7pz&pe
z%k>bSVOu?@6Ryj#g@nefg1c2}aB{&$!}Z&qBWJEc;6#k)jaYSamS3nt3RK4?nVsQ)
zDn_3NW<C#0Ni?ahdnnk5TIeh9i6NZ0m%O>pmcoz760i`lGiFDRj;_EimfS?l`5jSW
zrX_2J@$-xG)lX7=osv9mQeW1wOHfuDV9bz)pFo@(Ws=@cB$;fup35U5H+_HFY0<fk
zo8D`ikCmM=AU<eTbpHC9Ac7kgCIS(u6E3-MCMYA1svf3ZMT?@YNz-VQYK^(#_`)+I
z<W`To2CNSXY8@4h)<;hbp8HYFPe@i`Ezmb?H!%Ep$fm_?Sh8PGcIsNu26u87z3Xq%
z+H=tyV}^c?)=Je*8)4^+U2;VaZ;ByGVQ%+`;R+9Vkzu*t#Gy`FrEx{iPPr`4w>6}5
zKc5!XQLoup&w}A!?Mx~cwb(B~{8Nylr?nngRR~1DffY&!EqPqIH7*I!0V!`udu}jt
zo(W}1N*7T|0h_eh>bF*rZiY=A<}H6Ianf1_t#23}?fjUj$f8%qr#VnpUjWB9%-Dnz
zJd6<04=7}j{y9T{>CbZzJ(uj6L-<dso@LsW+~pq*T}6M<7`$9TA?P~y#t%iIh2Ahw
zU}{2r-RUcJ?o@()VsF%>^$b(D0SZK=$QWwptmrB;TwDX+FGpde^Q>bUxv0m4s59B9
zHS@Ot@<ONSQ{7PYUi3?R*Ztuv<t8_TD|eY>ZX_MB2Q{3_QDk{;&%znyn}tW&HvUgW
z%=TZrxoPm|PDac_oA@X(fvXSeNzyPFUn?ZBmq94#VB?0^Sf#N>bq}W%k!8$GUbFE?
z6lS+y`Lk;DN`*7o0yd5AJbmL}<-GJ(Z8>g7k|`a6$z{U1K-5FLVBfy|)Fe%R0x3P;
zdUQvuw4hUk$N7L8^!I|XlGAI~M@To4wSX(WiVDN0Yc~c{aDRM#!%uH%38KRRq9C9>
zz7sSxO{Gfh3zNARKV4TgGuBiA=W4r!;Dz}2%t2NC$m%LWBGUuAkfMECl9+4n_ME^)
z>zd;wT{p!eBd9$*L~VJPq2ifWB1-#@NkBogVXC!Z_DVVXAMHzGzv}Gx4#iv}15U*U
zHz&EDBW@8SNe+Ti5p#beD1xl_ncGQaEZ>@fh#N`f*$n(2OoFA;CEA&4>Pim?DD@|z
zdUe8u*$N9HOG=D)LA8z~MY#|+o0O3is@Mi?=(4=;AqxJYvc3*zVJZ~lHLEp~d47+Z
z8g%M5QKh^1EBIRgLE{J+0?WP%A&h+hrTKA_@1kC>*(gn(I!#1De3^2*??m(GKaqPV
z%gQYU{H^TJ5VbBc2V2h5uqwi2!mZU&rz}PtT0b}Oar%WucpAwu&+^e5{pd6aR~fOK
zeLt<xO+n8_)@eq=%XZe1%Jq|QAiWAfHG8Tc4>y}MVF6e<d1Ot9zR^3Sq<4&cj>RKH
zhtshjGN7pRMOS+5uJ%#P<w3)7MsU&2EZ(b6o@tb7WM|fG{EIY$P`je6c<kTl|Jw^N
z<2tul%KKCMikEh^`hamIayXpJt*Mf*<j()EMjrK}{?ml*@iZGJRM@>0;SpY>hQ;Qi
zGB6bpd*i1ht8&-qI5QlqrqwU733V<C68BrD6FX0zd%8WsjT9__`i$H5zMV_*J@+b6
zu@x&O=Bgw53NEzb=wKk+G)v4g1C#65n}@am3dc;L+i{zhAs-YPFq`S!&NbS+>`4zM
zN;X0B+K)q%C(z*(9%*Kke3Q#IEi~LK+9aW;vk~AD17bNQtJhDJYFCS&X3TvsuMxTZ
zI9p^Luz0{35HWavfF~-L6Eba6xyzN`>@Hwv;pG%>iGvd4*BQZ!rmK@&-CmV+q&dV>
z6m1A!ur*!x2pdZ;zpsphp7(ueKK(ZyQFQgGfIxDLoV@fF|05Q+i%G|T*8sZAq)4pg
z>ZP`xmf6hE_*j|h=O$F;_qxB#SRaD?pk#QMB-qlIV6KrXm)m4gqRHhP#JZdd8`MQg
z<68jQSeI|(RBL?{4CwSr86QLtWuEN&Ex1O3U;APc-W@omvm1V3@70EJ(DC@#&KIdu
z1l1S1CfK`h#hkD)70XdDn2BlxAu|%;J`UXjBl*`v2qQv7#0au@jm&gaO|QGVTxxqv
zZpLme3K@KH6Y@E~bLlo`eKi9Tu_%Z5qfTa9-q-VzYd^GdED&VJ)c7+P1?8K_F$y%W
zv#tnwf1P_iawwc>@~{iaTZqSlVuDTGZ<*-gc&2{+*Z}}~T{X{1p_<UqlI5dKm)xAK
zzy)W%C&8r7zbfGTD3$z#t>DuM+BU0lW>4GHp=|17FX4#E*Z~J$%I6+O`JmhK4nQeU
z#8*u+F&B<p_2=BlL9Lcre&ly6940!XEs?>$Sb<8%@ek>QCXkMw-4CGdpO-D}ZnYW{
z;}t1t`h8j7s!(U1-8vcsyq)7Qfb4EO{L}LfEU!3;sCuWU_@prj`2!6OT4Hwx%AAtJ
z*NO+T0_j$g=`-@Cu4868oQ3MBRzXkgY{6fYTvsTw-4(5%x;~-gA~)U^N}K=Ak1G2S
ztX9w`f?=0eJ6DBXGdPRsqcx3}{0M%FY=3Ug$h+Ns%s+9tr&uY`p#TJygfNj|J1R{{
zywcf_NZ_h*6Jz%W7FcEpeMg651roAfofuf*9OaUgs0+#r+Mmj@99Wc)XKw)b7z~9N
zKaHq~SY^Bm&VvX%78c^G(^Ia{V9PsF)!I!fD$Vqz|H$Q0?@yzuXsOsSo^ljwqJA`M
z!Hg=7m>`>`&vrkV1l=Bq#L(l#0v%$wPm`3hpxT4Q!7bGUcOoFvCR<at?!a}qrvu%S
zSMO#fw2zU%y!=^=-E0@BZrAVLEgyC-QZ1T^?4y#{s&VevCP7qLTg%5XRWC-3<GpS_
z7d&9&ULbFIauzcAL_K)lg#!a4TDl$6d?C`&I=3)ZP0ZK-C@6ZQ2QNUp2%{J5cx(IX
z)`m2|qe&1HiD|}!fuvL*nU2HOPgnw@#A#(8!%_l{fJXj|KXM1jdZV8CxnB+Fu;@|L
zVUVgn$XB5qol8pa@!-2)r<sm?@Wk6Ld?@72hh6j&=7+2FuQhaKAj5FSg7J@9fQzlW
zo;N}J224PEB`*ZK#(2DxOf+#gXg@xBcXzv>m*|^)pk~1<JqJM?wGYDXp_xF8rEXkI
zmdNUO?Z$&k`}9hbF^N`UkKYjbK(g=A03QTC741S+mTW}r+FNOK`hNCGSMzflc*!%7
zgv`{IgLw3SJ7L>h78q5|?pRm3SWWuGMK&ThRt5mpSpQ2sFPC^fsLp!wa8DFO!@pe(
z3t5%~7V3u)Yis@@=DUst$B)m;Sqmi>Y>nT$!@O37`3(^<Mf2rIN@feKPCLF#6#G8Z
zZ)?5`UKrVWEz)%%cSW8G)|(CSlYPo<xxaMt`gSu0|8>4Iu@3%jb}CMF8rL8Ru?NhH
zEN0_~Q*7uBR)uF{m$*vVn;j;ZNVp-HW%q=NZEg$J0=6c95Bxm8eKLjlK$m=nN9im`
zL&tP`fOk^pI#uDxM8Iq@o;vEWAer6>yI9lUfD{_+F002wgKyA`_#>DS_8PH5eMr*z
zJueSrKJaza7Vz{p=_YcO?TX&j=wJc?c;lLJ^Z<0-DsR?1vh_^!1=n#QSfQ1)8C!1E
zS~?EW;_g2aOVO~}BU>{?xWRf7-!Fh&k~luLw}v-kai=6GC`IT;ejL4@b>^MoFFAeB
z`*D1Z-ObKIlt5+sn<Prijav<(G+|CzJkv<^G-_z?OnNKc_DthV>XC7X_Zs-6yr-}D
zYR34LNCk{|ad|4#-KV>NOnfdLN9r%yfqqZ$A(AxsW?wg4`1{|>ap9Mf@TC_;-*oZ#
zBJji&$=~3hh$hpyn<b_Eo6bkT#&?wot*|^tlvC9r4{Op5pMqxBw7&bu5@52?O-(63
za=g~Ad7atM9xh^hrSIMdZN3gKXT#XylR!_Jz8O24qM>*u=`Tp0U)#kd8|1kN)JuxF
zzA)vwGa)JA0P}}p<0JCSv-39@DAMHy`?PeNolOqhN49aG^*JfH11!0Hu*O(f)M-<T
z%QMUSzjw3#ZztkGbL3vDkAHU9Z?@*J#p75nw<1>`{y1g=7VWRt(Tny&Loc{vkog~$
ze_J;(<xYSa_yQ}L;qIG=etEkMmxkJzZ|%kGq}bg7<zSEswugleStqPdDMHA#=<V_T
zNYspbZXmbid=#)~<V@p6nj4B>Y$g3h@-(qR_~12m7WyOG&($M2RlGjEuePVn%EzbS
zmyN01H~xyc*;Ji-ev&%k=<|Baw9CQ;nS>8BO1mErZh0<82A|~zo}cthP5_fi#!G-r
z?@aOIfg$p08^62c=@;;h+V#;1@FCW;;rbjcw{G}o-7lXuzgSD9AjKZ<Q9sKyX1bH+
z&ubifIZlEiLAaN9`w`uls6K2{!(-t<>#!Pd#!Vowz}zwA?FG3%8u>)AKxUz${n&lp
zLlKYnmH3nOzMu+~?FTBk5tYWCv?_jV<27RR=uMFKfID_8XEUd^1YD)4j0Bmv@_a=M
zImsO!5b=9x@ZgkhuP$h(7UcW6{T?mn)wSV9$~VvTzTxKgHmymV@!=ys%UgHz5Av~)
z$&zs~NT_f~%(hgXnhrQ4#xVDYd0{ivtZ!GA*eRGOb75pBLr#^pyZR5+Ur!?Z4}fwi
z3s}KA@B#sf@C+#_%~D6zo+BOG7Q`<k9-31ZUug%Zv2zNv&VY^LGsm!9)fz8Pykm!x
zAO?i^uT^GI5jyH(-iM!c&AH1{V_h6%_0Aje!8}IEKDYzV+6NMGap{j3GVoUFBig&M
z2yH?1KCvHhtpAKNor!cSPlVI@yuOkE$&Da~Anax@;ALR5DWqh;Jw{xq5FAP-Aic_d
z<bR*BXR&28Z9U`31|R*-{OFs`u0Jx+eWA&ct?e|zmiVUMCK_Jlw<jl=lXjriWsNxz
z;VLI(2O<2?YEX!K#c28-YX82kf*Q-BVGW1CVftLdQb8kk8o#B*6Y^V(%|IjTlPjyX
z9_v@YLe-EC%n305KLsmj&@6>4*9!AWsH@WrUX^UKU(JGG)dtkfeX;*knwui~jNz$y
zuZ#G%e3EaN^0bewHZ|Pq@r%}daxzh6xfyoU^*iafc}aXbeYq=Gx;=0Ra>JQho+-K{
zne8*sjIVUhLf?Zh9h+TtG4yV&zr@w}NuG~R$RR+$yZd`!^$}+p-)RHSr#<f!6(bv-
zz{H9kVSv9+afzuhHGg%t0e7($K?ZVtl>^aPDT`hgE?k%D?Ok^A(W-s&TI<^RJ*?au
zR%RBzF~m;=;~)Y<{J8L-hyT2#zHjai+?m2qlL=_;w56|keEUu4d5O1JrQybC6`7qZ
z_vmod<;G!^b>JT3=yAx=|7~{H)~ndyFw*|Vh8sLlAiESsgSSMfi_t_)kAT4X*BBSS
ztg?HZi3+)*1QT21Y<*q4x`){@L+@O`{&i|*B8g~lLFO2jyoa?MoesfN7C|Rd62v*i
zgYSJ$z)k7SeCi@DhDv!2v0%oRXahsUPv4mP`ROSeo@Jq^Bfpe1t;-qvV%pC=!M}v!
zq_zzDa_z^}<kx1{%Ibn%T*L^%i!Cy4>E8g&5uC*jy;V-2TzQ)u7lOxD*{`>nxPu0#
z_kbEWFL!El3;aF9%{pL_swrkbz3~u<44ALW&N%2`MYLwFjo2DM2PVUB4M=vNAoU|<
zQ>EbMsrxZ}6~F(n>GCSNKzY;Pa5x|M`}=#tuXz)Q1%P}qRR#i|1Jn0Qce~FCI;rqf
z1W`Fqiu;-%uRt&mAu%6uvBFPTj?JMRE3R62)D!6mp`(CTqXYY9UiJl}?;O`&CtGFH
z<Dje2mr)}DN5N}sv+W2DL4EbZzI)SvMgPnkQ}Kxla+d3nV#c>1s{|9rc+<`69<z}n
z9-Ny*0=2IlncEX%V`E57Ne+|t%bdo4Y+gRy-toT54{$Aq@{+F@x96Uou>^T^%&B>z
zkPsI@K%*q|4b~}o%t^`(92VJxolK1u*axCXVc#GM2EG%H`R}p$a}NF}V80GPS<L7H
z&$P=a0nB5nc)?-MC|c)zLmR8Hx#7A^;G$(9b|<Y_Ac>E+wEV}jq>+@U)*_^_rfzxp
zO&eFh%)kQ^(1-of!XhOn!}r1F-rGdLEj*`}?P_Gm{;hhyOTp^P<Cyaptu=b7ApyH}
zGzDWL^`IV6=4wm*u1<1VR6i>5`B}#fDi*J_#gLVOHTEDlZM0_Dj<oSu{=BrH98={)
zz7FWcGt|E3HNCIv`;KQMm@U6_laB#kZ!8KYbUtstV9WC?Wz9+HI}VZ`6PnsBNMylq
zfAZT%CL`zz&#JFHs*exCY7g<BQIUU0l*ryL&N=dSpi-=61l};V_4~>Vyw}WpImKD^
zcP^jW=%PHzC5|HQ)#q~psFM06qVqN<oCa3i3LD6-=DMb+mvBg5@MT_!eRemWb)Ng(
zYaG5eD>Nw3{(WQ3UR8M$44wH{I()*}1}-OUf~nP68klLiqPvLVOt;v0I&=FB!6n@F
zP`XXW#TUQc`AyZ_DVME_g_N);^94C10JQMLfH~g006`N$dm$Gu0QVf=`P{O!iT02G
z@rou@EFe`(C3Od3@yC9W_pJ{*Q(*9+!xhFM>%&HeZo<9wXDQ2TIL)o}Cg#4rd0Shw
z#fl9#jX$xQNeT~^BdZ^m{9-}_Z>i#)vQ1fr^%2;F<dh*DYri@nd69#H!;&3*zXD20
zmuq^Z;0vUUGmo9)5<dVV4Ypjf3VVCk21$!nHbfSNIkdD`&hfu!uy%4r;dDHU!sWvw
zl!d{CXkIpEhfNcOfbzg!o9u-ww0&so{4#|z$b>V{g|QPzkw9dd6yNj?p3W84&lIxP
z(oL*w1M)=sY5!Dx0TCCNhpwUxkPc4Oi{?CB?aIDcKy#=}KJu*?V4=-}2jPBRR4^x<
zF5DEiD#^mDaX3!3<L)x9i}Ah?5&LBeiFh|-slJu^3WsJi^R(NqMIv$Gt|>*wV(^vz
z2Qgzav!Jm!#UXQw3vL0V5nD4m<frR(9x8)@wF&H`3PnRq;0L8Pk9kdw_&_KJl7^zu
z#LIO)^^fr=^0#IT8$ZsFWaC<EpQ;s5UPBABx~1;0jjmBEa}x;X2D&LTI5H<DC~hK7
z6-SM1S58CsP3J_y!b)eSCg8CHZ1(Dpk2b3+1CQ&rFK^+VFVk=JFVC6KC}FhyOu{BG
zOV{mhW-^ozkzb*ntQjY#tlCF5h2*NAt&Tb&xqNCze{6_U7kyi0lNndb-oid<%k!5p
zSH6St=O1m9xQ}>g-x-<T>+-(T+~BhNZtdosWB2WmsZALB&<FkT85&Tv4D2&g<M$e!
z;oZ)=B!X=hwMNk4E}Q+%{VF%JKiO?#IBYBLn_Z2;vT*gp!%hO2^zCiFK|q+h{N<=0
zvgv%qKf$&jtPZI#bgRP0)%W|XLo6Ll_t&KPQJ|AgQ=6)}dVft|oz`jer@?-&SV}#y
zrJvJGTy91LAu(HHKI0U*sr$o89&d`(M?xXzQ7aBjzGB5W9^OCJ^{5bIxrF(GyW{pC
zZpj|A@zq-hWnMTammSul1gh#TM)^)abmxXh=0cy}SauS&%+xHhQ)Hr3qOQn<usdRG
z|5>>jzy>`}h9+s5iY%eu{#b#@$G7k7+-D8vel6#xNap9W_~)}YL6J4%!xOz^+YH`6
z^q<Zy3c=Bl{Qh50iNuvn_Dj6+9@}%rOv%L5UT(3;=e`pHNhHi)y3eH6Hs)L8Tfi#(
z!u1Q1PNF1<d#AJIVCSo&K)iIcY%6uFD`KhZWq%4dV5l#QdU#mSFthP0XtiGoij2Mu
zbKBk1o<#{q7{k#0t1;Pguk)YrnY-<5mUeD^bNRaA6s=^aL;q%s{jHel%sAFb^Ws8M
z{Ap;83{(`e#R$rD^B1$e(NIgy*;4}i<eg<kXujEs%y~QyzX=+=VG%#?8y^&Y6MS9a
z8U*}y*UuBnB4*pH;qA{FFUIcsG*-WBQQ>x}jR(Xy9iAP#6v3GAbk7=J8aM2q2DW~f
zVeIZi&-CPQSGro7#M@?RauXRG2A^?NKt&6+Tn9i|JeNGQb@2v0culC*z2G29DfR1&
zQ@zFW9wn>=CX9b2r=mHY%&Roa<KRxg(bw~Wv*hNydCeIcHGrIa`S@Ja$Xw-YlU1Ja
zB-h3gUguZGWZ|EriW@<y3_M7ye$2*fffzz(qQ@;4rNDOM{8yw|&x%W}y1CFLeT%@h
zsezE3U{T&bK8<bn-%0xZo(r*)bkAN)*giy_7XUnVv3E`Zqv98XvxA~O1w&`ZgAbeF
z1Y40TK{JDb5^AGPEtr)}Av{~suOoAj-j}Phu4f<pNe$y-SFrY1xe@EX4y?cbZfBhP
zzLi)ojU(!=Vonnpf+K^sn9t(Zyu4QZ=}eA#nuvhD+I~%aGjAZG=e_zf6_$d6*aN1%
zjPdtddEaJLBsX!D&(8Q((m6VX&5@aXy!}OjTjrJ!97KXkhqv{T`&*HLwDkax=Fys8
z-j?f3`*X5?aq8@q$F=7Gjxeyk|Ko${PQUa^#NG&(6<(os6`Vf|H60(@tTXMY1pG!V
z+_M_r;7YNplu;)a^sc>Y^0;4+nqgO0DLpHO5j5KYdHu6$ZN36|1^ap~>C$<$a_!8h
zwyOl44yZ?@F^OW4@M99&J05Y+ZsdMw9RLw$8?BxKbY>Q!|986Y2Jq86F}Sr2EA_h%
zZG=_86sK=xEtjwcUM98TGAO;Sm0O=1HWNBBn|6Beweql~sZnd!Mn%OEI8U`ilrz=&
zN=S{?;Y^`VWNW{bTIXmo^7JfeLu3bIhb+QYlZ_NX$%{m9ujicCB&oUe?=CFx?bZ5C
zz&o6r>?KS5*HhG>NI-b8RI(}Si2n{rVb{0#zE}&5_e@jDnY`kG9G9FzTA0hI!OjA&
z6-bZCkr;ytJXGufr~9v_qcL6PBE-a`Gz+5ninrpwNRAGh3eHa1TInJ43(oCO#>=l`
zY1#l?fN0SxF4B0ez6{6lXN7F)J@eu0K8sn{gp_lNgXQ0Cebe@Sxq%w_qKx~=XTPKA
z`%YixPOXcNp+j#3ZK0@D2l<RTo+V_13iPZ(gHnRGR@Xu=Q3rE!4}fyO>p_5bN*T&&
zP#YXS2S0*Ru6Zu6GZF8ISSe9{uSPc(XM9S+!a8C?eNuFJ8zhfIS3oM1uv;TSjlKE$
zi+AGwnth73tzZW4vnsUrNP3O;iOaEaVj9|u8;|&dTA4e<<!uo+P1X}MnuM^3)pZhA
zAZ=xcU92#a$vE~$Yu9?TaQw(?^tW8DqwaA$jj_+&!`ZK^WQ9s&9Aw2@;1+57Nu2+g
z3PZ8taB;Vd?ToE_&a@`Nud}3{GsS1GTfehUAd#Y)HfC+>P}5{%g!4-&kMN6I)+-N-
z{EsH$K;~w(>-{$+XnZQkoN2h(_7*TrJ@_o*i6}d*)K9^0J{4M_t&{FhKR#u+%(3;5
z&%uI+uBg?>?q%mNvj1xG9W9t5`GU5)Sm`_bE`l-s&aYxf-nqAsg`@&!8L=$p#`}#g
zP947$LB(2<;m|Ua_vr6ZhVt?4O5&)|2**6HwW4cK_U&4_*MsX0L#yavi|;$1d&f@N
zQxUBCOReEer!yrTKepDnn^rEMPc|sjE&d3d<<jDagxz-soXy{KxwQ(srf=nbxtrWT
zRb^Cd9=4TS-sUP}$KIqk{$ZepJJnV2tU<)B4XY`H_&2Ya`8l6=N0~rxeACZ}MLI<F
zYT*!>J|Qv520}Q=;sI?YD618E6;y*e5QCy#6cRiQi4qnb6g8Hy=zuurP;R4EB?ZHY
zpd>$I>Do0>tj9ppxYx>U9<^61Q&g?t-T9TI_?Nq1-GsIL`hje5{Nq`&y-;ru6fVxr
zS0FC@3O~e2@BQmG4r{wdQnG+4-=;gWMl$1t`T}@_BORJkKtj(r%z!kb-La;PpwqiV
zz<O{zxflL}yU2toX`ixC``iS#+bs9j;VOh3XCA7j@Gydn`6H~&tuEy8@xj1G*tP}I
zM+5k%syJudv^kQUU-_15zFUAM&JtrqXBleqCn>)5P8m&^q%eWAPd|?pWB}PR$y<um
z=EBfqWx~0W-l=o!bVwy~TC<gC=h$e!RxjH)SgbEF*k_da?4+r!xo`X}cjPU1dVnqU
zbxRC5jtiU!F1~2EvREZz_h!HTbdSnD=$@yGZnRs1v3Vd4;GJ%5=N-58t}yb$TB04S
zn@P!blj+r%IwQDux-5VMdS_ij|Npc0J>MlomvL#+-(xz~)A4e0mdRCR+uZMr4qA5@
zGD?=LpDWeg`Bvn%-;`;`{~|Fktj1-C6bJ2Vb7XwlkAb>TN{k$Nw0!P+{R6|TE)Who
z|L6!}#Fd296(}8*seunPH)`XUmDnlb@_JVVtI(n4!CPY4{#)74YgB~VWRgo*)6t8D
z=`1<NzsWKFsQ1W^O>CsSbpw!<dw4I*er;=9lBUmt5JmhzUS_(W@$n_vTF<wg-G8Ve
z^*(t$?VE0Lsy{(G0P*G0EG0+i$iHgIS{K!4+{lM^OYZS}tMMe50L2wkInKlOK+fFu
zl58#LchQfEB|p@XdTKJgnGGw*_^8W)#vge9{MT0Pfi=+)axde(=c3G)>EgtfYF{Xo
zLMdSxv1Qww=cq7Oj26tgw7!>E{_L_0@Bv$+H^pB#lJMWk7wn(wW;^iYeF-x}$A$2U
z59%Gt_@wOT$)?z@5RkHS3+PyKoGz58-|AJNc5_zOzl&!i5V7=hddWv>j<Klz?&-{z
zo!I^e)dnS?jJTSSqK=Xxlo&CtXXG34;Bi@)lM*(`rXe}OprRu(;#orAnZmNNhWJS<
zbr})3gS3`tBg5N=*7%R_?6pJn82t@|gX4M3y8_{0+LVJVV`tB<S@E0WAR|TncUo8&
z!EO*{TJ=6#p9aR;(^jhYsB>|0L96i2SuxlULHtO#NcTbg7gH!_05nnYkL+p+>u?e}
z$l=_cEXT>Stx_)ELQ&?u6<>e%Ymc#yQ)!kO#Jq2(lfA~ueUv+pc~$Sd&EDW9(*6S+
zkCy_eCt=DR4GdLZFuYVe5b144uf4+Cp4+lP%S>$5&P_ylN+v?-hqju<W|`_rbjDI9
z%gado8CThvTw<)Iq<9uOdKih+7b^}1z|%Ag2N=Oy*$$g;5Idfov)w3L6!mXSdjWhh
z`$I#cT}iuV?y++oL+)|^p6$Z@HRc)#4Y?<pU=Ofbjif^9A{;kD&=HOGcILk}Z!*OQ
zf`+}1Pr08iO96d0{LiX&-|JjsT(%pA*We2<=2UNN-195)gp-tKIP>+PjRc;RHII{(
zBf@#7Sy_b67Y;ZMj)-v|S&YGyfg8cmPzJpx17Ep-aJ@~nlO#$8+s1y<&VSOz{ku)n
zx?T7yXonYAUxYuHABYMk!w*lROcDvZY%u;TPYh>ed$#Z~jZ_iH!%@Wpg`&Vf-seEk
zVijF~v5sMsEB!x%?$JAmJG&TxE|*&%!H|nPmYq|!%OiQ0%P#UckJ~e%9$Ic0FBr`e
z-fHD#69Ixn^?ZZnF|-K^ztZ~M?1I;t;_KGnX3p@h&>o<ph#24((eY;OhqXLt>kW&?
z!B3Ld(2#835MJ3y`%Ys2;=BSI0EVYh%blTW#__OpSWhe0-@gLL3P0bk6}O!zI2Qjl
z*?l&KS7jBUgDo%cPh-bU%fVo4W2d6%%lv0ds~u_#KIpk}<F2DYA=T6SlTj0YDnDkC
zHQzXu%x+u7Z*8HRo#gMYjfwziKY~hf!H@4(A0>~DUM7h@K9UDEUH=W%+iR>h%LXT4
z@Z)W|7g*{V*tGF_(BTa`-+XEW3)KJo&DC_lYty{kam4{`!R_YgL)SfW2=ejFJ6oIn
z39wP@-WMo+9Y-&iZ{PgJXDc0Ypbk~M9IFI#>>c}>k8Ik*X0B_H<JL7KgnCt0@BTnz
z2libI!nFW0qB*=81qIQ~jq%E5#d{T)ljD#exP$oIz4%J3^y<a&&g$J0ljGx9ddn(U
zH~Ga)nKR`+k)oz{Zu@p&lf&q9Cia2WsV<X}{lit)%c51b%aO>;m&39|z}t;|h!4)3
zcD`ms4u^l1n|{7L-WX8=7gz#+P`z<=eV5?3c4JRMN8RkNfLTAXf${rbBYHiU(#Y8i
z;(;drEm?`Ez+H2^v?8SDtJYXU2_v70Gdaeqrb^&jlkC8b;G-YSLTKVY*VwPkon2xq
zNihK}A@nV_h@RhA`4-XlI<PJWY~ZkM?4fU9vk7a?FI2C6VYu>YlacQomRcjY{=dBd
zZ(hkqINB!1ELXo*Kl&eb5Qezz(uoT_5QZ+?6E+8X#dbBVS=Cpy{TAXlDu`bIkB_@$
zv`5M>H}9%XOpK%a8F?6R)e%G>Q}$bP+K_u>8#sE0yu)uSXTB(g>P{#!V-V@ay-|^f
z_+xcum6f8(?#>+-6ECVI=nsuiv1*T#T7Xw2c<r1PIwVH2AC?ppfq_|hY4h6Ffx63C
z@YNzh8bdP2mB1zU98%6$D1He?wjGdirqWwzhja~2;Ye#2pVi+a`(;<}C5S5e(R~Os
zx%WH2BVvCW;ev`X;J~ZXpys~s^{tvO_4~4K=a~gTZlr8FGZ(WwmpzVeM#v`5-niaD
zg{2YzEZCcZoY@=RCdW~UN63PE;rPW79n1o>MND_}6;b&H%|R|_mDBa@?=={CCt=4%
zx8djU`;$0fNErIl`(dO$jHh>x7BHNFEJAy#X>Q(YMG>z>)6i5BwPYsmSHWkIPV6+5
z=4uDtuMx(l&IwOB#)IsD&UFN97C#AQ;3zQohPBC(58>@tA|(f%MMMV{+h@#|#(^~x
zvmBqVTdtAXh0K?3mMzQmcKJcBWcK1#NF-gS3Rrt3#=jJQ?<0Jcs0|`FJnR8c0mqK~
zYM<$v$+~}#ze*Q}F5eI$i0QkcJ^_$7QA0|;aOh`X&(@Bhe@;CR`^HDf(g^sDVviOW
zABO1cE{-sh6R)Txk#$}3_V=vcH^^wY<IVZ|7v|ikj5LW5{>gsEdq_X;xQ^?WP0kOR
z*q@F&X_Kv_iNIAE5-!*+jrO)SRupAj^NF?N1O*T}!?uR)z}25i0~h4ag@W8nY-TNo
zb~pZFmX@=2Hh%<9*Bl#d8^5CPPF<Lu*tGtXspG+PR^h@APtq3f3qqn1`4C=H8IZ~v
z9%KN#)WnGchZ7VD#;J<(WE{UogzXt`&9wf*)>edEn*kc+DGAzC+|5n@kqc)r%%bou
zjV?OR5F1~*gHJYBvz%js9?>d=vx9Seag5uEEkT}oi`1saH4aaMKBw29dsKhcdhEGd
zZhZt;TxY$%!e-(SRur;e-~HZBtCW*QVJuali5U^8Ih#Uvfd^}xNEm@jk^(2uQVFwS
zNQ5%g=Tl0*fFyNX_k8GJPwdxi{KbCh{SpbI@~uxI;kTsRu!5UnA?vT=w_GE-4!6IL
zA;+7XRselYxC{fXH>6P>i2A4(y}}=c@u(SvZ<<4P+i~8cj<M%xkR`auESX$QDw_%;
zy9@fY1+`8dnWj~>rvAjUKw`b#))eNia!m}|z>YcNms@b8pD$|5SJEk7aM@3X`C6hL
zoGq&KWAJx?oQ2u%XBq5Z3-=&Iny0>a`ZUZKgtneo+G5BEcHHA%Iz+1jAep`0=@L%d
zrGQoirphuNj|z;6f<oXz?fgCpl58la;JURhfNFuHoy7Tx!Qd?SvAG*5ueH%b1gk<N
z;dtMMYO8S+bqO2zvALRKm7W4o#;i$=@($)Iklm}c^2zKiI8C#>^*gCmS$_`gA3ipB
zKKHNHG0dcadj3GZCLh2wDRB96)i@a7-LmluyD_Z6ZhRosDY*h;=h<DAj6;&5Bp_Jm
zy~pkUq3N2V<NBg?o1`%&wr$&<*hXVFjg7`mCbn%gRy%QH+iA?ke)D^8y|wQB^WM3$
z&&Id+`Sw0ASPzC|H8C*xa%9ZEa_c>sM>c@bU4bw`8JKXzJ>~I&K~nLtVnVBIP%ECZ
zfXKS)8Mer(n4Q*6M~uh{slL_5Wa>#r4ns3E%nkGdZ;9btn0V}<*iC6Zk^L0BB?BdZ
zbU0>H4(PAuNaSP>I`et5zdzN>b8O=mar0Z&na0T|M|PmSW7G_2w)EOxRyUT?2_^9u
z-=cS3A+0#o(3*2hh}rP$n`vcn+8`lA`|ajKN6$Vt0dyLZE>9SsGngep#tWY|)MF2?
z4gu;Z<+PawBq=N_NgHfq3PoTV3g>cIO#zp5fKNmVgTXHWH6zLi^+W~pe*CZ{P?{xe
zkH~OPu>{ZF(_q-8dvZcPSDSPe;!U!G_wN20wLO;{dB?X7&E6A<UdR%nIBNvj;gIEu
zkh^&-M&bVwgpB8^HgG$EHJTNXbQb=>u=q%tpgc<h^#7!O!D*F?=dP~zaBA@_Y4jF$
z6a+i!bf3I)X5Gs*@|SwT@MXA9gY@^wNHxJr)mTAjtl{wJ8k&8un8@Cpt)y;oPrSE)
zwmY*xrh)9Zk3CetiwkW`DGi6;dvc1{a{_*lAI7eT2VgTITwW?7l0^V%jLxQ$Z^olg
zy^ipF-DtxC7%Ya-6HQkm_!+pJ+<%5h#5IJPQ49yB5VBSr{@M8{VR3>VV~Kc`s<1<Z
zc``;WjZAtL=!#U*#Wh>PrWY6ka`_;`^?AvpL}8zzOy0*P`9p;Jx&)is!2-OOh(=55
zrui+UyKT3NbGY`?{B9qSfeb^}bXrMw^xux$-L*2sUY;1!9J>Q&xJD1jhe~k^F5bHr
z)_1f0OLme7LKG!l<h<*O)2a%e1#?*<Y1$vMw5^%NLeP<mGtiywHeG-d5Gt{q)^ahp
zcIqMd+@{g00L{K7kHU6_%HnJt4RcWmAKxP+-r+ESO2&+d%7=1>a5HBx?<fw>wTs(c
zrpqFfiz*ixZGY9beb#tLFoGJuY*$h|dTctaH9?0=C|rZxWfmy4AoV8a_5qp!;fqu;
zc(6uL#<B^#4QR?y`UtpFP?f+1og*6lY>a)n7n#kma~t}Tm~)|&L}LGe8j<LW|MDnj
z+%FMLOF`95(sylRYSHzyldnLvKA|>#z|Bd4WffYJM6EE(m~;&`ko)JBxPMC3Xz@cT
zKc6aJn#^?rbcUHh`}<>g=fx4o6y!}UV0%wf=i03xJZ(iaSB%1*+EDs4`dUIp$1-k<
zyAEN1=(tLzTzmj8kW-)lDw>2CrO>>^l_%TfPiJ@yL#UQC9;}Ru#Jmk2TVMi4;>=(8
zii4kArwCa^h=QerWUZq=pL`{39%m5nUGHip3*I6DGJ?|;;ytJ>1ZPOU7I7Y5#8Xk$
zUSAL5#G~`<cCudV^e$|vhBw4J_h|<illK?o{z+8H(i+XmrE79*aI9RwXR1eHsZ2+r
zMHDwU$|Je@qaUP&79*zdQ==a|BTI5cM-Neu?77D!cHq2@--JB{L=6R|53HZTj%!$G
z#vcb!@s6is;o!D8m%e@aPMCUhpySw@%*Og@10FGx#*j9+E^LPTMzi8aO?*x^N%M7<
zU1GSyPt^1{m^Q?bEYdh~x8MpGHF!!&ObPNI1k~^1Fgp)N)1{K>H1I{}>})6gq7IHB
z5ez18z5$Mby&($;T+WTnIi+>5F1gSa9TY?G`p_~T4UNFSyeU5}WQXxR!><EBy!A;@
zIe%hBt&LfzP)%|I5bVCCEUB3pQ>H2IqM_59o2KA%(n!5a67lUKxL|3e55Mx?cxzLL
z3}Uj&@WB=5%Yjl#4+!jg<%@L4hc|v}-G7_Mf2cyt2q~#)E`g1u0$pEtXV@EJ!m}TC
zqr;dXlJC}Xn{WXo>1b0j4hJy8iz-9^!bj66CtrtBFyw0qZ{Eykp(v@TS$?6Wpp1|f
zPqg)u=;U)oC1Ytf-ka))Ot#LZDJ#>8C}jH71#9XGE!3p)H?K|L@fb68z1tRdsa<5(
z<ps{r@RgmhCypsqf7JbFlI?fOiA~99*GMYQNF*bdTd)d`^4H@Fc>D{tl{zv#7Ux-o
zSa$fvA#1MjxZgrwyJ<Q8v76!NsIg7q?z~VVe)NoHsF`5}lmfw+nWr&VZy4<2&UJ7}
zMh%cKv@&E>_cQ%kJA!Q4hE{VgI&y<nI3C|jlU1#VmLXi-@{87@Di(^?LNQ#}vKbqu
z71EUrp_5Xvfz~mPkfdvg9i=Lq=BaAkuNVI-iI(Vx9-fPUW3p=A^KF64m)B|P&T-@2
zI+M(<v@dly969F}K(jjkEWypltip`t9V07alb>u;%P;ivz(&}>%}B{#z{?pX31Uu9
zXFOJmn(5=hNOLZtDS%;oR|x6qRyocNLQJ+%XtkNFk}MLOTG3LnZQsxf!2=A(;(R?G
z4I9lw2DI_`r(jb@3Rp0M9bYg`qBy&GT4VVVXoneQ`nniXO1xD<q4O_zD38TW%E1?i
zOEnXuD!)MaeBHf>s>1#2?PZ5`E&Op1>Ac3LB6`f|MYkyc7wLkY+Oz+&3vmmR6L%tI
zOA>QS^7%Q{@Y>+(E{+RNYoh%n#qfe`Jnw*CzG9gQ^#q}>*<2CkE(hcWmvppL_~sLZ
zq@YLg8d^<C3{;2Aw71ymDjM~A<y{k8cu^@x^<Xxi@QqP#8e|QtG%b<hPRhGhF?pah
z*0kp_62Ev=O9GrjbxHf#E*M}a>=aAcY_hKCG^Jx#(kOBGM>?$(dFIuoRi{B}ak7~p
z5^y~n0)XPjqicTIOqoOoqC0`6y_v_0;Q7^&h?4`7(~`a9`u&4)9ZRLvO1KM7t>~}a
zUAr^^LddWRv(otiL~CIM-o+*pN#c&d+WmIlku=!RE106K>c9A~#lYL}LE}Nc`~!10
z(v9NF;vW>of<v6KlusE~Gfp9S2RvZ$iwuD{KIA^_UGi?)<WEDWuJKAt=E>7AL4E=D
zub7c#cx3VfjZ{VSRSh^<$Uf6h;)&a{Tw~Evl6W%C=~l{I8mfuX8r<NKQ1}zc+se;7
z{3iS4Y*rXY(?yYqnG<5(pIUkPlS}>iHf{HH0$EG9dp$e;T%)G9-#3nH4PsbxBN4kZ
zIdL`pT9Jvb&Slc!MUoHRcT5`f7NfioiNpFzB~ULgib*kyX&NLr;^!I3q?6%hoxzo^
z*knLGTARGfjuB{_OI5ENtwTLnoph2acUR#&L^FBRUaKnSgGGSP4$#`&Y2Po$4u~XA
z$XJS&jt(Uwz5H~XbQRfTB;K@cX5|^JGr}ruE)8_AWO94aQ(qskoa8XR#G>`*%(3vH
zXq-mgjSNROUsb8>B>N!8f>o8WWY;z>Qo!w?ZcesO5AwmjznAhVCm)9<{qi_R2)%v}
zMB(jxaB4AU)#(^}DlAW9^qXK>RaH=S=F}S`w&;Kxxep(?uax+;4c{R4ulW}@Fy8zJ
zQF*?DXQZN>rZsJcq;|y!u9c%4h(9}cd}ZHyl19{30qpEuwA>RzjbeJ%h%w?w&7j<X
z`l-<uj|4|%7UDidLenndK`c@IK);1{X@=skg7KWC9fbYqLI_~v@3r^CjI0YPg3o|4
z!Hf1v4KV{rf6^4CgDyY`KENGi(Zf-VEvc%L<y{?5N46D!&XVb?lZBhOC42sx0xcMP
zrB3*ICl=awcC;5ik&7j~^_zM&Ag$|<o>jd`M{~5o#$8RyN&CE3zl$t!OsO)C*Yk)w
zlI^zN1At#0WLU4L93>IXC{e{JW#$a>CWIbufs^wXD|vC_;1%zray+oWrQ$cu!#wCT
z$y=)!x{K0Yah2b_7R?^m>sH(CPQ%5h*T?U1vcGMRd__o6BUk<<p5!m#=+IILAORMs
z;EnQ&BoZmPNT$&$))mLatS@x0(j)u30ac|WQ(J7z3^nFWxrrAoix~i#ZZS-Njxw48
z{jeVKW%f@~OW-$OidR!txK`P!_C<q9?0A2}CTGzxo)p)_`Ck$`!X5Df2W$4D&RlF;
zEAp+)af&){NIXxY_fMl&$cYS5&%s!2`B*BtT*z)=K<6-^E2D)M7e|l4v51jZg7Jbn
zF21Q`Vn{Sztsq6j1p5HtS8-J5p7Pi?!eeeW0bAs;-zDC`CEjqrbl5P5bxvUPl1lUv
z=>%&AKMyAyCMlG#TgFWTUpy5gX@fvL06BwR%$RFz%AdjTVx|Rc2c|V-=_mAk69R0`
zv-xPC$>nj_L@Gg`e_O8a*SeDJpojKj$i3PYGFFnHN0Zt#Z6w!Poyg@0hfgh8;{948
zFImzNAtlMXM0S(=X0iM-@{hs7$DKonppqriLN<fSH`F3RF<OIsqB7|~Q_hpo!rQ&c
zpI}8K)y*>lOBSS=t{hD`+XLDOaf7xM0kV=;73c4TT&DjDBz&w_+Et?x8J71Nia?VI
zrymcGrA+0J#TZt;r;}Nhsu-M&J25Ln#SFKuW2JZ|^bW(InJWgJpP5B<C8l=`7^6Ih
zOk^*uFD-W`S9+aDctw!9^`9y+sGME??q~_x68<{53g_vZd;6J@w|A;E{>^Z|!XmLb
zDy$9_2ME3IC27$`S<)o|`FFqv)I>cDvSuo=PF{c(cBzl#I6Vp33^tp<*dHndQ;ZGr
z;^rEOEHw2Vum;eDo=Om0!Z)y4#s@{I?=di@$D9b>i94ek-~e~w39obUVC{5xy~(_V
zLDu}LVSpT{8Wqh}bZM)b6mT}hrN8SNEEYd3fB+A}7>+(yyhQ<sgC{`WkoQ8R2>-)n
zD-(=a0fYLfOVg{Ekfb(p`<?CAMm@?^bGdK(@3ryLhsCDX1Qf&9LsXVEz5z=X(XrfI
zCU>6Zg7z>XU%{1lk|v`N3vUaKZp2Z?OsdgfZwxN#)*B&-qOAQ8sd{RD#XAWZgz+sH
zJ!2z044of}O8~tK@dJgBePF;WF|>sM^tdNn#w7{Gny^?|bAp2`TIM84(>k;T5W2)0
zR_^|}*d6CU&LfXi1eRs@lzkTXb$}v$<{1Y+njvT>x(*M)DVBjod&VqRf*bvW16eOx
z7Ee}#o@+|g)Y1p5iCCB^Ez7G=79LF^O9GHfPVB>d{c)m2mmp>f(|Xs>skF@;*0qIl
zos8Sraa;&nce~IyyD)+%i!{c=(`@6<iNyP}p`krQx-I}mF5sXGnnGtEF?nAd=w>^f
zT;reB#tz`V#ZOYqGC+s>+$JAglBgz;LWL1G1)_`U48Fwx-iU=0a%>3bDTf)Bk5hPt
z#+1M_cBA9qzUUdAStkmQNXUW=WiyCmLmkSmlx4#KdvR5KVzIM?e;$2Z42=iI83%m6
z(BMDDMPG<xD8Ob|j~FKl|A{18JvyPT?i6ZW6`H}!hHtX~_a{F(NB80>0!FTlAe9ou
z$~tevLCr0?a3*aod?L1_WoEH3WYXJyd*X)5^{EX(0=<Vb#{jpFF2jqJA^8Vc!(EoY
zW;)nohDuB>9*KK+6vKs}z0fD+kp{^>uo;)(4sD8M2G}4eUHSzCIpqy`$1E3#Hu)q*
zi6$%>xugzNj3M?J`+WwgREsvnEG%-3XpsK8tdBG6O>WOVpP=5hgLz?d*kGMiT1Qs<
zvfdOm3p$3uPKAZEGe2YWn4T@`p^Nnw##}hPovK|59cG0R9~?QQeINad%VV;&HM#Ke
z7`OT;lG$$m|D4h_>QE>-*jb7Ui&tigg0e9iPgZCrF`D$!sWf5dDWiOP*)WPw(#-a4
z(*i-=NZ^J#^9eRcXoC^hhqFu?Tzh_X8x*j<mi=_DkXqwg6l?F-)vmcZrmlmJl&i($
z#+yXhlDu<5F|nzTRsy0HPcy*#XVW{(9P68;k#O-fNlnA4(7>e5fOae*V+}H@=rNU3
zB1?frQhoF)vf*o$0?h(-vg2zXazdh?2kfZFZR4+%Q8QV%u^eJUhwlfoyRa-<y8Wqx
z3x*wqNsPRjE`vi1EUa~Amd+@QXYMr(yba?s;}SYuHYyhv7^9w^`OY?YR7OpRa<cYZ
z8F<OM2`JL~?gFL?E=If7#-n66@~|0Qawd7KbP{<Nrg+r#9zbM!H8YH@W$BQ{lZHJ>
z5=<D1#YY;zF6IG+CwT~q{G}U3=ui01p+EoCMYK7;guJwiuTIJPQsW8|>UB59mrh!-
zxU@76Ec}*`73_#dbukj&_j$AElnUluU`*cC%A~C{q_Z7QC7Xe(6j6H3_P)XAl}<9)
zr=ArGXLpIAaw{{SovS6tdI#X=eZtQp=jaZBSn^PJFp0|sF_TM6)5yv%bsgd{h^Re@
zOr)LZ(*+csg35CUFV?0mzg7)Dc_1ZRA~be<ZuRV!^>3)fHm(hZYkg4d?#TQqqAk;V
zC|TF`{V;3yp=0%(U58HrqA_Nb)$!Dm`Z!$#x+mXEquN3YJ>m4?JzRQ1AectZ6*cJq
zG4X;u>C!RPTRBxKeNyO#i{%(r6T@FXj+&qn?TBitoUM&&JgoN<?sIsC!7lC<Y|&ee
zx)6vV>XKn2O!eL?xJ3T*tRXpvAtJ<(&*CJR8ax|aG-ySAiqh@#E)Hhl2=&f{M<^<j
zq}8dBgteGb>~zn*k?Gh`>DbZ8+EMGAQ0bgl_0Frb`u;$+7Ok8G$mM;CO3Js8tH@LD
zL2oRV`4R{*ngwcjFjdt4F1*~JcvCl`?ZqehdvW!%x00^#ku=B!(WZw)#=E4`6N;sU
zK?+YuO^5}jOHlX7!91}i4f}q>@WL;@TKLlS#-H?hPgbGhC6(afr68t!?5%qV<?<oM
zZ`}TyKtk$+dUtL3SJ4M@X|%v!3waxcJ1l$Z!vWfSV;uuVqllg;V>#|j4NHS(mbAz5
z#vCQ$96gYWVkg%&DO23V)-g;o0Rn5u&I8oEg@=g`Ug`k2K9(4~w&RR5#om=zHv$jQ
z!$%_Wpo95Qr&9}g(D}@0(tty}VuWHAr9_ni^-68>*`k~a{kUrtl^g>-36RmWWSCIH
zIlv;UCZ9RT@bBXf{a957h%fWfZw&JWBdDSL1FRCj7gF%FVUM_W52Ep$neIFj%*ObR
zx{d9(n-n79070kWOyx428rX8?{e-}zShXw}prvsX5p#*cb!ePMUa4Uev%dV#7rDll
z(FQc#awTiQv7B#)`*s#ldt_roe<9kqZD!5Sm}~i;I3nua49_>mRPr5nCUpdz9nh|A
zzI4wbUcwb1lYgnxD9}T%s`ro{cz{E>#Xpj+=-2=82jDmVxt?g=+f4^%_#VD*O-O8~
zpWAS6ebACn#OiPOM$ON3*UIWF2qqnRaWG4)&K*?8MJgq6G4i)qc^OG`Yl;QLX4<Im
zmcf_#P*Qb<1KrR-bSOz@gjA&#pb{ktWR9h|DZ_;P4)suPN1%&%)0`$`8lz5`3b|x7
z=y-9|<9NI+BJ=yDb>sYC6WjpZT!%V{p9Nh)ff*tB>@JxKCF$sba$*mcAMrcrEQ#&L
z-?XU*J+Z<Q4wwvMTJmJU;b#iDW_!pb^{}WW_<`ZBAjM%ay~)pz@V?&}p}UXLw0uZA
zHlrLrKbe%olD4rm_)qDa>5i*mMD6!(+>0(f@ivDwefo;$HT06QV@F@kTK;$QH`GkH
z`~Dc_D-Se3tRF5~p&Ho$1pnqSF*NOOa^=_GC*Y^-^ARsmelt#7O$VgLtvx?Z#3*5j
zxPbn12n%`YES~3kX0rIWD`R>mH5QfC;SfuAIY+T@bf9i-k9nF5aOnxad6w9J23yFJ
ztLKU*MZcBsQI>d<yJA{w(n`3v8eRE!(SV&q`XyaYsXDllHi~Sx`za+FRzyZX7KH#e
z#6j(NS@L1p0GbIxw3`+TqsA}({V(PyXn{(QV5+;9C8k+J)ecOk#>=9g{t^_b6-R<{
z;?^Fpr=5mNN;S5iQl#UytLQG#DM{8(54xBwf=Objq*&iaMQB<s0R`mCua?0dZ+^nR
z7da4o8TEJ?b@?La`Yh)hLuJ<qNgKbCBKZ?DG1{7Rl;<eqkh)}=Bk8PuJtTNxd_AcY
zUcXxpAo@OkGcx?<P#1*eyDg>*km_NGmBt1CxFxH~=+ZpWj)iqpJ91XnZeFD>3HciK
zd4eL1By_!98E5wgtdvLv6V#>0uQ|Bw-UO)Eixt>_XI*SaS!K^|Sh<ewJ%jPA>#49h
zmT|p>iP_Ow%~>=i`bF=I$f9y>ieib3f3U}*=8|Gb7#MH=!{Oo6$}HK9u%v~zbord7
z?T>woOmFJW$T;8eX~1}@Nu4Z>WwLUUY)qb;MlQ%A0c1f+Ho7TW24m}yJ8u@J86hL1
z$icTzoTL`4%GrT^AV68PR;6K@SCV`ZloH2~IViA#I?~wh*QMy;97*IG`K9g?fBa{h
z_7}a~W9<E7J8KAn2%DtA>9FenGVGa6k)(Br9AF&6y-vT7e@RGpelTG6^0>RPkd9n3
zaFY)ys%Y2{t43ue;5ylLnv*=k(^AvHnyyKs6(@$(iu<fZ>MX{FZBYxG^@AXmhferP
zA4w>HEZA2TtuL@8k5sfbL5up*HT6cg?kc5GqRJw(CwTB45eHYNdD(c1LKX>$IM;9=
zsR4+{wuMe%-jko=8(dPWGve~gFCV^R@`i!xSrbDccBVg%4YxC7-1$q!9wO)nHSr83
z`5;;DX0*s_0o$amU!_VRQd&Jn;!D~NIt55GL@GR@ONI_Mfieo>{p4iHWa2tV05C<e
zs(|b@ctf4;kW#{GIZu>pQH<9vg&Z#qYV;4B=|Lh#b13~*Ua7Ptm2fVxw0YUGu54r-
z+~Y})rn3nqPhRKDuAniY3B!{*>&%{LYC^PzpO2r$a$nl-gX9tODt2_Tvl{}Z`-|b;
zx;H-y_M6QbVuC@QCUKKQVssJXy*lEt?{WfkS+PZ7(gvttn0@l#Xi~kK;-k;S+w8$b
zun4lRGgVJJ*z?XkEdZHnv}#-pLNHznxlp>kNgvdj?@pNh<Ebn(R^MDd@sykD6_9aB
z9=pb{FFo~itQ~ATh_)VQ`1jkMx;5rlOtx-QZ{n8+uEwiPZJcjM7S}^0E;&6VzOcZ5
z$m}ZWnY2+tl1*spJjW#t>KTU!QQpgrrkd)0AbqIH2k~bbaXdZL5w{}?e)2i$ZgN-B
zL&vLR3$(-&wb6ALy@#k|w=6VB8oA;j8bd6}<O<g@B0PX$%^MSA@LzewMHZSdr$xrG
zG6kE^)49~1l~+`AbjtW__rep_%cKw7jMDH8aDM`}(V-k^M;Hr<%x|nMC;+hQUuDA=
zVXA9d46-pj0|RSHLjRu&kRhGO09aH+GbC)R579M3^=ar%gDudGVEA%BdS%8aq>faV
z8*t&*9JZEMw_64$-|?p<X6($j-OHbzk%z=0tS1ON9!GmwP}g{UP@1qyPjy|g%o=2&
zA{uoeg0bOG1rf{Lmyvc>#e+BWSsrQRdQ~z=!G0G~Y@&x^$;7e_)wGrpA~5Be<BY2P
zNg5|b1Hb=R=d46VDXA;-E{PUI5;dvEhOjSt+ScG8$&Vx?Tp~)g${Vv^!=Nly*TBv*
zr&3m(52=0O4^E7G@-zeO%o;VP%sf$IHnf-?7M;9DKi9eR#+>(_zdmPj5E*27nO%|@
z5V+r?MI-*@nfOQ2iO%bi&4S!)s~aBsa3rf)gH~zArzEym+`>e_P=zC-A$ep)Ub5p_
zVKWnNf@qf$%HKK>5yiH92S>s1c|}DRUus6uid2_ks2UB*zw^p#7277YP^%e{b`3Dp
z1VyJ|V*P3JIJ6vfq<!=Fpzbh>epOREuPrN^sO8m0l2~VJZ9wb6<Er0RK)0hXm-<4+
zr4+U)_nSq>^Qa42bnA*bX{9=DCbhrC6O;wsTLOmB&^j#rI1&9X!{JZ#j-vQ^0KHy-
zULILy9(iJy%WdN{u2~Q-#1(>Sc0Y40J|wl6LXtNSwYq3W9S4qps7ax@V9eQ?F8Q~^
z=LnCRIb8e4{xxP`*RyxG`oXy)offl8g(Sef4e_mNxtSaVR_k*!=Wi1!za{aFfAE%M
zMaQA@Z0PRrdW2H_tUg7@;?rO-z?Q>DH#`#7^t!KD2{%?Bhq|a}#55%`wuo*9hbfvR
z4~Ihtzwep^&YheNe|qrF+C!R6c-l_N%S{K~<8dd<CoV!hqWy4!Cg9zR-aA`lU*-Wd
zz#=e#@mx@kWuZaJ&a$x_0z_z$gpI~M-ILVTmH$2S%o6*T2*3i}Vdau3B*aVrl1U0b
zO{Q+68_ddh6|)$nq8Wizf<);Cu_!1BioaAKQBofgCCO-_9Nmni)8ndK*;8mM#1jzR
z8P=UHvkg0)aUr$Tl1>3R=R1zAg;5E~m7kC#z)TiJfe2!O#=l*B>2-jm>#uDgulpT1
z7Xe+QhqCA-b)mR|+Z*JCP*svS7XpBP+vG|=S!X`$X{%|?_%9*T4(1BDSMSx?nwZ6q
zS!#)ES!!y@EKxw(8rXYbo5c-&Qr5D>Cf5uvfu*=|K@`Om+KDBOGY9~wrLfO)w`2t9
znphSTYU=niA96ZH?wn;0W*DXTec!*>anTWndS>rDaXg;-ZhKLKH>U1gif_qvd^Zo}
zmyGM2i1#@v;}teq49`SHFs%7wa<Q2_xEn@R#66r@kMGH6*FUTKOO~YFCbv|kuPX`f
zdkKzua3|Z=Q!eREsjEOU3ZWQMEJPc|7YC2=kZi-nBRVqK792H_I0n{b-;v&_sn1M7
zFiRa`7dq@us2%b}(~180J1U8xhe89T_FY1D)GnC`tDMFc#_`y@H^~f}m+waGKJ^3L
ztwb#<U_y4njzOMlBGhmDA9Gxv@vn+G#4^a|E0)X_|F{vnSl{1NePQ5Mvv@Lw>t6jd
zD{FcYFgEo~h1=O*j$cRM-l?M}Wo!ekV_jp|auX*_ftkspwfWbkOnh@TQ9AsKmB6#y
z%Cb^ba{{t0h^anbk)CYc{Ne{d6_26m@p_EicvK2?zrD^`naqk-NP1n0y;j5BC<hGg
zBm>b9M;m^3O}3_GEagZ8wixbLLNIad`u^sh1k%kxQsXM|)y3bKmgL6YL(hp->0^YX
zvSH5&+!&@y#rjx;A{>?6bcv^>+v!V&HGd^IOP;bD`CD!r^_SQW<ww~QlDy0>Pu1E6
z>$>TQr>8#RfC(z9^ulW4&9F;X3%-aGLzR*$k+5~bC-~)elB}(0yLF<-Vo4;jHC5?~
zR%LIsk+ErE7N(M;JabhSJF#lNcymfEI=ptE(-Hq@Biyd+A($0}KrspGKChw_LgMeP
zx#ohR>+R`~1>DDw6=oEIOtI!^`lTg(AO6PVLSzyJ*=-#3)ivE3<)-!>^{q%*BVn}c
zPqVuCXpc#^@Aq3qfeTixj=UIR9>9}F(WjUuK!2hZy(Z2s-s-a**K$qX?c%EL%$O^(
zVTdlnPy<W3@ehgqEGX8M5rOgn$|9YDqj*Y=tIW<jy}n%wVN#S-$^_O|bm|nb7TC)x
zGLjaP=HTGVsYcJFkW=Unk7l{+vNc6J4`x`A)GA>bw;U%f+FY5kcB|s=d>4G_IGn%<
zxHA-fLOVOOI~+D_b*5z`E;S_Aa>}d^8tiq1^zvD>`v6_<K;$T(V?qvw2e=~XOtnOL
zqC}#v5R@`1MrOq+Z4^U^w&Avi?&vFeRUXmSaGlCf^6=t)Mb^E{k~DM|O_qTZN`5>)
zfP&%55^MXXJSJPCZT7yu2R3%=dwlLRRtWwOUuFDuhA9<>eSw)A^|OT%v=)x=Z%re&
z6fN_ughFMFkRtyW9+>A(M*(h1Q9SruDrJq7+?rZ``Neq-+{BuxHlj^7<_ez|@Di|S
zBq9L;63FOgKLBqq_+(N5YJn{(9{P0%&n1x4i4A#eZKnhJ>en#AgCqX#;nZT|LA~$e
zIU_UHCEjjg$dx={H}9v?=qr+wMj!(Z+>R`{1D8A(A^Xt3@3$xFv8)CQ(p^M)=!;ql
zQgAR@cn--X$jNcR@p#+?rtw5<r%4vvQb3fVta&WbkT`O>>lbWps>onnG*w!O3_yT|
zg&G~<(kFH9e?dcq;=Hd0!pQnSLpVD?3h?zulIf+S&X*wDPHb52ElB`8exHUkc?tca
zJ9AawnIuS_6YN|0`H$wK4ZN{!aNjv<Q-D3GsCRD+A?Y{kQa6z0pd}=awdm07=kR3y
zZv)GPyLoy;zOIY1ZgQ~3U5;?3e@tB}ej$Us*Z%fsBOFbM1pG4U?CG4k2W=NSRh{)f
zppUGU!Sl!ASY)x#$?rc?HZeNah1J8AVfFdLYyP{FELkLUX*$GxmdiA+bKKXCtKaNx
zGjYh6H2jEQ0-p5uto!LrEYE^+TAXJMGUAj3N-?E`;zm>Z4mWZC99zU%=$Aw~Xp@Yb
z<w}M|=+2_hGDIn2;RQ0>iP#gQ3Vl31gd!WTRK%@nP9jp#wk%Dk)i`Le$XG$F8RLZ}
z9NC3^ZS0mpxtkew{59!#CxZf}`K#Xavd);yiL<ZI@;Tl)T!gTk^_lEWrd~3fIqAe_
z9jo$fx*gdlewbUptS^FT?t7QkjlLE<{?;J?9ZCwG9Fqqs0o_O@l1_7safW;BCNcna
zMzE&y*60uE2YPDPSK{kyr995Q;Yb#6QPG7w@;pX=OC;<;uvnkf`S2(0iaBK0EQ&Y*
zls~UBb2B~SIR*k9r=>LiF1N<wHq`@;7%WT8Mbr7J+Xu9UrR!vHy0RehPQ19F-q`pL
ztcP1iD%R&C=i5*x@82iyqcgD0gmQty)TtQ8RBppFPf?r-xdtFvzjq!e<5sr_WLSh(
z9D=RhEl?>U<sT~xjB_nDu1oV!tBbN{i)3d6YM9X&*ewc|XUj32z7SnfxnKZBMz~iW
zmyYmswc`4(Gi(FKMQ9J`WrLj1M*NS&WW|2k+CmF(kv|Ye{t|<K?q{PiK+G#}^wu-o
zy<w*bB8isjcZrOY!}Eb*x6l!!(yR%vm_fsM6Uq{|;fQ8Y-Xa4#Rn_59S)fb8Fcb9R
zqvSv2A%B(SnO!9C$G*eE#{T(9;9LrFEDStzXR6LglsGF+2QoTo0O5tHZ5CO8^bE+-
z)urf9(1d9JWfqq7)SPWFU+h%|zcux}Yo%QclbHA%<qW8D;k$A|a;mHwd}UFhrPv|@
z!|o;do&XV)k2^Yxqk7yb^%s$gkR^icnV#+ClS9v`mg~J?g7!Zela_giEY3PkjV~rY
zoA01}nQzYTm_PzWgT<M7;vA)r0wn-nW_a%wLxDa`AA@FrkU|fUeF}g3WiX^DW4=1^
zf-~Dt0<xn!L!Yd*KEz#@z*m68ft<0`EWWtwWa&d@iY~I)4@lO?Ap>DL4Q`fHRmGDf
z>Jq*1FXiVqa#R}!|0oJq<w}J2ckmVdcyJLWY(>3367gzLUjG4yUD#A9LnW1sUkO7v
zJrK23!-}tI5nQDxg@#m`#uHg|SA4qbS6>`QhG(RsmJ07eCB_vC8SkBZBsUJkAw(@<
zst%<vl}IE*r^ZA1T_I0L(pf3M>1@+U&@1wtgP$k}9!)9%b>gQGAQUm?^E3QjKmhHe
z&MMss&OxP%SDS`n8Ph3o$-(s?m#7=LZ}t5gON@|Fg7d#io!TC*IPDq=)=1@qKtP}C
zEd0Fo1y~VeV~1yi8bri#uTI2HArE5PsX$}IEG+H{Y8^h9y9P4UGN;;PVWg)=#Smm{
zC0{pMZV>z>8d9aUqi`{4T_u$QDP}{tBc?o?8VCycl8yMU2|ms#xWB$OB08WEZAagc
zx*qrV>ISIrk1Z}WIG8hzof$FFUr>8Wl2)F=$*r<UMQ^BNaRSS**jLx+EPzd3Zqh*4
zP#|Q_)-`m*ZEXC(&hYH?z~|6+o)TR0`Np-PZ1%TdqjBUTFDDV7I2rA>09KISV(7Iu
zW~8?yf;kz>KE;;yd(XCMufZeHhxVh;7Nb}6Wo<xcV9#Ij_qltl%)Wq-YC~V$2Ozbl
zutCCMt#TeKW>L_ac!hdcO*6iNqeGsH?+-_#@}<Wfe^Weoqz*e(bjq)T^a8M1R{Pc#
zs*(kvV)r3L;wZ;-=%?1jDs%4a)k62&<KiTANBRRJXaf;z@l;HA-WOY@2m^osIv)r4
z7@J-P;El#P8i(k2$`Akkt;flhgsWUa(!;Iq9r^s#C4BY2FS7>nd4)%z*Iv6-X`~ST
zl2>RC@a@AEh)4KLRH+@S7M#9+*B{tv063{&lV{q{4e=>4n!>}0qY^yfpY}!1);^vm
z?@nvBp&7-%V;5H8J)7%w$7gbKf~z}m#5E-8?BMkfWcuLIg{O-J@E24ChCB=|xJ5LY
zSt3j2!~e0J9fhUaZP%0be>FzBY92P|81x4*UT#b+^m=IfthO(&3?%K!;NbE$kIW2F
zSi{8__E@ZSjk?@%Zed#Vs?d~6VV>I?nz}?2KFvJy9<yD<{XoZ=rw}*${`opR1Mm+f
zC^nxP$2;RxiWVf<(;BP=k0+BOko|+OTaf?z0%uO+iM!Q$Lnh~U?_}4TRwv^bp5E?z
z=w8jAx%F7z{sx1Y{feC!KT<w$aMxcEzxM2S_j>GYJ=L8{Cw)9H<E;0@*?0ek$#MjZ
z9ZcTtN#3>Vu3Q8i65tVBlPNSE{W~K)ALxTsUz_lFS%y927ug12?A*d*SPZ%gPGP4q
zI=m<!NQFhl;4MRoqG1|n?EK@0p!rvYKbRg^)5LzN!As4-$nk!{-8|d#wKv|&_Fj9U
zU4!$pyt5a29J@?7;rF{ad3jn@%6>XHN$39vr+xJJ%{kt)r-k!jDY&%WmS1$3^|&Dz
zKt%fFeR9X_T!IewLM0M#-v&bgND7-saD~)?by@)E{9+0>;^G8@*LYWXxc=%w9riX=
zYTFp;6K(Hxlt@Xl;1N3*J*^@PcW0Z~tKwZ*OMtLGmOaBzr<;vVp<X!7LPbA#r0b}m
z^h;i~c1NH!YoJeYP`-%XP+Yc$OXi*=&ejWh`lA%|teY%h)IH0A0Bi=MH1PJA>B_@p
zBHy^6pNvC#fjOAE7nM=@${a8vg=#@mqhgPx>;}bdnTANwu?i1K=oorE)_AP8IwLq2
zQ(d1|U97NE*_)k2HIUFiCXCj0n<N<8=Vm?u{LP5f89lAhoH3{_W#2@<GA)m;v?e?@
zeS<q(*@P@<+f#WF?<4J+!mGwR=WE}B%5@yK%D>!&1kl?YZO2*LRI}Y)*ZTE#z+&J0
zh~!#?S1Ht{eW;J#&oegb>e~u!uR-KY6jSuVub3`JHm}CKSj}ZO=yB;$+1JT{k;4vD
z1+vbDKaDU&*-iRJc)#to*OoS?ym=i=@0Ggvn+u|k?L88{Jrb8+g=q;snyK+y*KZ83
zoZdT4uA=dc-Lrfh56ouW@A<v*RPQSOu7He{&jU8ci!b*?y%J~CjF3Wih(N7H<cg^E
zKZAcpSXRLoCwY&9l5`o!>L@;e;exl-PXW4_Lse9TNwa+6m(j5LBe<)T&{)W)Q9@qz
z!W~@k$nCBBmL#+M`0$A%q?3Rcd8sm{+q9OVJ1tjS4ftfk&G!JVZyTuzC`(`@buiDY
z4<qu#9OJpzE#F+SLCa1uauv07LoN)uejgY#L63ZTPx!!oK3<elAv3R?It+c{A6OQr
z;*8T!#dPW~gZ3M3O$`ke9@jNck}yR{Myldt?#t3ZJjpbi|Mj!QeZ0LTsM6jbLw$ZI
z1#CsLmX(pS^=tl>z-nKIv$`OQ(*cfu&f^CwR*JJn0KN6$`N3KDMoxBHa`TOci`8bt
zILqUYW<=3lhc&nyqlR48zkS0xh^;O`-xv?;y>kQgUQlu0|54&>YK)>?o|1hW13bG?
z1J@C!w4*e(FUZwOw9)3tl_T!5AX63Bx-)tp(e=uHr+6~RZ}Zd%#;huRw`3svOm3!7
zGRz;*@8N)!Uo;TSdO0h@+ko|O{n0R|oQ){tel8>F>+h6qI}F6CjI6Jt^TCK#SVSge
zwZU^pXzH476TlErM4pd(ga6Fd&;4%9ulY#n;Pr$O=UdHA)r)@nd6e>nUtu=6uS5!y
zOn>|Y;n9%#pUhexiB7hkrjk*(Gka0w1$3cY%*xBA&$RMf-BEuRkDLQzPe)9W<luAJ
zszAPU5UN(&DrIIap3iM!i$bb^pU@}4RX5}J_9Ssmhid5}Z&c|PRIkLNg@QqJ;QSuZ
zu>Csb2rc_;{@2Le=3XH#F<9zPS+T+RV1~W1FKZbct-*8u7&FzEfBkf?RWw){vbA61
zn^+vMeQL?c(&<kr!YRXYXDh7;2?e8;;k0nJG{jXtDN*fnbM!BQ$6slz4!Aiu>+|Mr
z2r_!gf;hF8IQ^BN%WJ=x&URYSU~@a4tkNhOERCeN-zm~pnaZ1D&ml5qS_%G&eO0$Q
zxU|$3r?<vB+ldVp&S~*s+|s?F+A`{i3N+aJEBcK@J@B1Z`}K)md#f)uU({$QfAiwk
z-42<GCOD0RE_E=f8y)=;^>;fh0EJ(MqfR>c2!bmgEeT#vv#j|~(~NRFT!oVzHoEU$
zF5{@;O~d=l_mD9h;;5Fh<Qlj+Hx|LMU~Ma$Ru1!p-)h2PjaQ`$temwK!J)7IiW7{M
zG7v4qIXlQP*ev|J$$9lX!wq<gGX?IcjiLP`(LDpz1toK6YQ&Z1un?Dn4DPp0s2t|N
zwz4Yi_Kt)f@+z;gTVOlxe7vxjVCZY28WAYdR`pxLL%^P>xS5fiw~e|$g&j3TkKF=Z
z$%@g{rF^0bn6?C?hb<pfAKPZam?f=U_eqFuK$xZf5_*um3j|>7AZ#DrZKX|@$%(Z;
z<6xIE>_w33vRH6!6pR6<hC^*Qd!@ORcwA5?9#`zInpc{jZY!(5+^)|AL77hzU{`uO
zGZ!^X4Mf5sAYBb*VMDlW7`I}Z7Uzccgrb2Zk=4qd%x`NGnXPD$35bH$YnwX?U%tB<
zzh~#9f6#m#4NPXO^$EGT**vJO{`!~DoAqDrtM%h$(J=7oy4c|q2X-(e)9y%H`krm&
zII8ue+5^)m`bzDWs{r#ir6KZVHqR<HpB^#(t6VLW>r(EnOs#1!{Znql0}*on*SB=n
zy@#3QKD5i{=jBj##LsTuGlsYfavSrZIKQPjeDp8X<{Jds<g`8W_o`npe5LowL~>xg
zxqCg7d*9-1KS~g6pV66Afe_H^CVGIR3_`{S<xB3U@4mD<TN%I7(7u*#!gF$0gDLSY
zCNdam$%T8%#vBAO85P=0;4|F^L50~t91{YcvWzFMBvcm2Fu&|a7P8F;9~FN7Ef*_I
z_6H_Nu?ExB7B&b*42hDkg_QT1fsgk);T#fUD0v%q92qF{i~Bf3g;kn3MRR!KsG9-t
z91=lMhLt@AolUEWJ;uJ~GFj{xIh!!-!4@VWVTJ=>I;BXU3|pI{xgjSr?C*F}D(9H?
z?;0?H748BXV_z)m{`u~@mH~g@LiOudmbG`MGG5}f3|UoGtljO{mP=7~5P?!gtB4!J
zk3ge4yu;e349E{YEux?iFPcXV9&82ZfFi}oK3v}BBJS{HC__`d+X$C}+DS-WC5M(n
zoiBkk4DFlCYj5LC=hm&?SetdeALev_^Xo7n{5r7(ezNCD_S;~+-r}@{sq1~=cl31<
z4fJdLGSww1^pkNM!s5LqBbpD@S&asQc#o&?B)Q%q?<L>Rk2p^XVX?=u@oNkCz-*M?
z(+&uyxfq#Xvp|(&k_9nlo9qZuq?@xAuMqks{=?W2e<4zOFMfMnNp$l+54PHd)hqa{
zV$)dqRu2q^T18eH6Dx7zIR~&{rWGjmSX_|>gU`M87yT&=&4xbiApPk;)cik-nz_m^
zF<hZL><F^m^%~Ku{G}Db;ZjwZ#=4_F!31S1Fi%R1cBcB`%;mT#uG*Wje(n<ne*P0k
zLVC0q1$%K~sApb2;|*%VA+A9H8x8^n{}CdXUeB@qoW5uO$?<y2OVU0c3m8C1L}2m|
zHSgcO_dzJwrF;+F@1{%=Ubpv1dLI1=Ph0thf(&x8h#{Yz-;;hFKe>-jR-50S=v)2O
za(%9yQ0!{Svpu!TRMQ;v?;HII++)3_`_q?nv*d6Pypa9mvuV|<*N|Di@#xvxaiaHL
zdqs^A_|Btn`5sBwle&Jbh#Tnb4}aN3p0^1nxH`zzLW8ZZmB__gy)*I0i(C!YJ0XB6
zs=K0iCb9rPp%_ZW@tK0I$V#49;@AZMhMpmc{F+GyigFKTB`(&AVo_F)`;{PX_h|Nx
ziV<A}@%jV%66khWX7-jYrh*y{=ZekT>^%j)$>Pe6%!QoiA>La+Sx=|G#K1no&7M2i
zk@ITLPPs#i>Zp9pY}CBHZ3aMH31gr!eu;T`I1g4<W<Il!H|3mjKv}fM=3=WY$ejDP
zCP#N>rZ3KEjkW0P_}jQQ?So{C#VgL5aJU>!{bgVw0vZ1ck;d`4Lp&`=3(e*I<lK+E
zeivj6p1}aqg6TGYqwlaL^WB7R<TQ3htyE`av~)(%e_>XH^d+w{zu0`-jH8#J59ZTe
zPv&k}LBdJ-;pM@9!R0XB#c}5IWXt*Ce?X$;1bVXf*l4oLlJVpF1WvD|Z}#QE_k*tL
zyuV$%LVx;<A3lA!-fWG$t+*QY?f3`$+x{Hz;Q)Q#*5%zq)anMlD9Aw8`!a8~APG5>
zRNH7I$iQ7(f@UTZOA>5PHAC4%ptL?*-LTIG#jjRBLurHw!x5kEjs9mSKf*0WEEJ9c
z<ERnF#ZFBy8EFj?e9&&-Pl~)_Lcs*$A~cKI9NtFM$xB*zbiAs+Q;ItIpqi$IXlMv8
zr3;cngO#lgcnQnr2&@hloP3NiId4`o)3*A@!2woSZr5S2G`*1HOmNqm;=XU(BC6=b
zt3Vw;<ONC<7Ke}uiLu%d1u?ZBPfms7iO|!>?$Q$>2I~5<b1wd5cU2<fT;g)JG8J}p
zY}os_Dd{gdoYDxhw(~0IL_E#x?2OKQS{QF#aIsQDX+~n?6RuCeuNJj>W?tjx{P6F!
zS)1gSzI1k+>B`Y~#IeTh{oT>J#J6-GUJ=KzJj7qUxt~M$^`JZ3c*mf1Df6LEP}k{!
z#c^44cvW`o@vS-pNcxL2wV_3UZjT^H*oXoRcV21&zp4<do}zXlwvPansY^S_!79;g
zdj^mQbML87a{bo|>9)&(h>Wt5Swf~9rv)O;YPRPYi#BPZxm{IZM22DjNqpikUii#t
z|38nKoLKnE2_~EETL{EF)Z!GZ&zif*%E;SNmIy$bi-v^=apL&PL{5(t>0$lqkm%Mc
zhKg343KW6^-(93|*y>Aj#i#dg3zRv5d#7CQPq9;j8jk~f$Oy=9Pnu<0>VM{6Y0Ccc
z{@Z3%M|kzd2ofd6$8b=h!s6z1uT{mK)Lmkc$Z4f1TRxGat1*A>^ilq>#kAhs98Up5
zE7CKV%g>0EZFc4#i{b!v+p<TceKV5+f7pJ}$}!fQz?V+Vv1QyF5AMlH?u)oV6ge2H
zZgqY?VfORC!-4n+lwR+-vDce8)~oYu<9$)bfQ)Y6{Bm})R?Jzo{?DrYMbI)1&NdFz
z&;J{^ETvCjV~K!_5GihEwefAVrf0SyN`9eM{-%cZi!6a&`nn-$S9{mbM;xMBVJCLl
z#`aiqHwMM^*66Yt$o$;M3PlDxb(yVp5WL}Jr^Z=c^UX|N4dp)+XRM2^^sd6<V5M$~
zo4k0(Vf&31K{_r+P4`ba($*efShjbkv(SOqZSe!@8Rt=-^*;nT_<nRYXFQ6lk7G@r
zcUIHez>mI0cIx`@(I=FgG@YqR`xCy>f;_n}lpO74n~Kkbe6<aE8aMWtKg+U0i)3hU
z7hUX(vC9v%*gFcMA*xV@v%uL?k#@|ZcEiQl7me?oIzC=)qW%8a3O7Y|bRVfzILC5r
za78BQyrVUNf9all>u1lOhX5y9_a=DrL9Lu&&5f9E36~>+kRIaG0lh5LPMHx^$o$@o
zDV?S6-wtcW|G^?iFmW?z5hqLAU!($!+M__R#|D7e1{ZE$wXF`?AmBGw&-;8_e{Qsf
zI~Oe3fX`4RnIv0t+nfavniV#r@l6|3X*$2NE}Y(;QMy)K?Mw2~qSK#M8k*W~*0Z%6
ziVSvp^DQWf%<IFrh?{%%Us(TH^vlHu|Neh2z#}E-chKgPu!EZ-{0?1rXfb(c|8BxH
z-|0bHrt$LlE!e7z08vCOaDLqOG)qo*Ndnx7Q&xk$WG<nmz;$Tl(}U1zRd&G3-cpcg
z`=w=kq~1y<pjMS~)h^Sr+On)R3;&DO?k0VWN!IzNIS055W8KMH2)bPP0|7ZmAI`}!
zJOw&o4TuHk2rrNb&h!lo&99ek>t$B0GmJS90bs8IS^1D*`|*EADqp+joWm)$;Q%X@
z<LHq9C4M@ZW8oG4H`kqUk2}Qxfjwz+hcBgjNq*CSp~g0Bfg<y}=CF#<nq4RhL8iLq
z@Nrnzlg#FrkOpN^Mx*O{jW^9T9{oP)O7`*1uiwJ;$^bC!?+qyWrFWW()hriyssZEl
z#sr$8JP)JsJvuz}RcyZMZApmHhG?2&{j@7$4c3#x2;9I|XnPmg9EFB(7)r<hMz}C$
z;SG+r+W-D?8-zWWdXel}+3(I5CBnD}vG<69X0a%1cs6Jpl{JKUAQH<AlVIm*sYo0R
zn}EQj!~CUg@Xf+-g4mxnVHuNtET~fz^DWLkskwx+ma04>e?>Xdbqon)dLon(_exp6
zZ>2_oxc;8hfc8@?L_|lvgQW{xB#-|J5Nctd(-VCd;%c=bf;%BIu%5twyq%vS^?6$P
ze+4k0*h_!X5(XiQ-Hw;XNsyVN4@V~NsMSOpeNV7^w9juxmrg``T2I>z6uFMtais~P
zyATjM3H%7_H`H)9?6P8h7tN91MoZoWIq#9u!tdkNLp&-O2+}w6XJM~>8#L6nH!2+(
z9Hf>{*zNh}@gJ6mxda||ARm@8{+oW&!d3QKJ;l|FoO#jtBqu~{|2>X>2vg+h2E*Z<
zfq1%429o4z5K6+^R;$|%$CoYPv%5AP5exLZ^@iJeJAJ&z5TPe0O2a}8Qj6SPT?kv`
zP6-6OtUeVd59MATy>Hw?K4b{ev<!JQX||Zi??um#zvIRKFksiW$l6U8VaQ{};bmj-
zIPf}exQzSuL}eg@QXg~0hA*uk%sO`Ck1LqqGFdIfJ=6nI(a%9tSUgh6r+b-V;U-eq
zZl^I%4%5xo)wEX2M_vGMIe8c*`+EdgXtDI^cUlSEVIRmV<iyCzc7=W%t#LxS+0P#~
zPhZoW^JMvc!|!N-B(~dR<A=8VoFSbL*8;W(`%Z<GDuPw_p`VLDr~^N;t+rvO#CyA~
z7|U@<@Wjci4A3<mL^csDK>h2H2cLHUe5;q;OE38!c%e>2|7)x0j}wJzzQg>(Ibyv%
zCu*n!A!P$}1`~M3r4Ryym$5neh%@iwFo2*FFWMXsc^qVTS-s!g?a5zUvD*M+#-l-0
z4>SAS@4d0N*j$c?=J`@33!XSvY=Dg>fH>isXs^kC-}xLt0cupf+QUbDhDWpDf?|)5
z$aR33jey5RPLRkFa+X^9qh{8Z;tPR<2q*MJkj23c;Ev*Td^!AYB~D4B#lk<<yl4Tg
zOyxqcVs$qpM2XP+D+p5f_ZtIctwY^1BIF(lI*O2|#o%RQaKFDn1{FZGA`l1_WmHv1
zP6~zijDV6X^$XF|=umhhUAwP;Jh&-2Ps}H%0n&B#kO6Z4JST{cnZGT_>hE+nO3d?I
z5_)9|+`$A$VD$-c2)Uo;{NIP9iH#G16A6wmu@8O`5ElXk2+%B^`Dj6hu~yL>IL@(m
z!f}6pYhCz<$XH{PCVa$}mFdq@F5g6#f6pfi#ry$~*$zaDgIg*ie$V>3;BxQI>avve
z*P+!vq(<w5SDY+DmsU6^7ARz|k5#o}IuapvR(UTK8XNCmSP;@Lq1(v7lq@#xu{ejM
zj0$xu35XOr@pQGJsPK6nF7|<c7o8|O`F&bZvn(m45#h~45ac_R2~X%x66yp~!bWp}
z7gZ>zY<`l}WV&QRd}#QA(f74Ec=D?vuINjQmymV}WGlhECOKBDW>co@lk5Unkt7h8
zKlrmzsIboumI5VFu2p{L8N2^!@2Vc!3YtBo!QI{6o#L*gP_$@pD=F^oE`ef2iWVpo
zE$;3`ilw+y+=5%a^nUm8{t5TI?89bvY<GS$lXG?p6r(i?s6`M=4nQ06zRO<>Tk;Pg
z(_O7(ilfBg*YujiA5G!y)w0L`$u4rApQvl81MshY5#^u#&<nY2y0qugJ({kN%VD0b
z#=wO65637!k4Q$gmul?+hoWh^mCmcn3G({vj@c-=_$cv;B3#hd+g|uiO+5Lin%~pN
z5*KgXs51T`S2pSXS4;JF_Wcr`P0DJsx1uXpT-e^X-(MotSSW6>0I#{I$Lnp7=GY`h
zSH>6K1OYxijomU!2b<GK`&Y(3bql#I3rPN<22nS&`c#rF6Hrz9H6+f1z3cX}5IA5<
z!@*C5pBF*id`!VCvvFgpyitNognCMU9b@Qpgf5_xNv}&u3>fKAOXv={)a!*@AC`nm
zE32&>OkdYKpO`CYVWjHoyY)^PjWpr>e5iY2c&Lt}P7LM@__n!oMVN#_M``tbb02k+
zVB@BExIt*1p?bCc(i^&Jd|GBgfHH%y)l*S!F-;${skNm^LGf0IGqXp8B{elhhA@Jm
zyx`~%w!W4%tgN*b{Itl($he7`IlsVegjbG~B9EJ{<J4e6OjKc@NIM$kGFrG$(b%L1
z(yMILHh!Mp3e{%2mXU2GQb9#SYdwo+Oa|4rFRo@yoq-o8PHk%z7Z<;Now$AW3p8Ec
zvfUfC-Sa(j$M*RlbA|iTa_?up*XGUZb{))X;tvSdr|B)&A!y;eXXQ5YH)y;syz$30
za>snVklSN(U`W~^g%Z2Od8IKfyRNRdpZ+1_izgDiVN@_q5HZ$P!^<>^H7!q%Q7cEk
z2bnl9ZE24OG7Br(vkjK%73sUN{i#44C{43C-*dy%5RK*d4E9NAo~nL6*gq$c19(s&
z0nzazrqipowoV_Y(gM&K^g9#fKsYkul{&**Uqc2FT$ETs|Jb4<;=X)+lPZ%oBn8yL
z*?j*U<xV4{zQ^(;=hG`q^H)PPz9{-qwK)3UY>UCdG@aU$#p`VWm@4CXHpr#BmgbkD
zm<EB^&-#Ch&Xxig8A<55OH{rG%z`4y?n@vHPC$8mzcR!6YU<9}AGpn3n4Pm6axY8b
zo$p2-w801IA0qCsY*hXjB(+@O4^(p~on4p2sPV|wq(S#{yr@-|+^M%uppQ<Eo{SOH
z?10Qq7r9$l;j5<I@-rG+rOMt#q;lRZ*iCfU1U+Q560lqVe$zR^uZ8mLF!oBsO-uwk
z#9`O{km*1@fcdAfZr8zz*Q9BtF@MyB%#R$wTAr|xF_-t24rmW7ndX`fqR2HrhC&+1
zuhf1hS{iX#Ha1RIRw=zZL>l-e=v9&_<T{$TpROHkx^!8c5ldh5QI2DD7L?G0>w2L0
zk7tiV-vN6JyzW8(8pSwXdo^iYxuPkY`<$*z$l-~wwg)9$gmyAJfJXZ~dpNiLurNJF
zl}j$6Y5Ks^{8B5y^qM)&*PkSVSJTOh1GkKuGq0Z6<JyK-vs*@l4w1R{g_yv+DWuuO
zzWK{<1X`S)?`htyi`mcn>2AoM0`dMtp)1tXD4Ar7r502v^krLKnd!uJf!^Z6?9sM9
zWYWnRhYxs?;FdL()Nx#t%i(KNq$C?f100#QAnEi{RVG;w&ypB3{jCf5%V6-sK{Dy+
zfIg;vxlM2(`UXNGuJ{Mwvj_N94f{Mk;p^L_;QAHdK8@K%^>#n>y?pYBhKy?`ZSU#T
z6c2C)sGc~4p4%2uyOF-GQ>XAIS78ZdjjxvxK~UNR@6je}piYbjAXsU?#Qtb7W1!n*
zv=q*SLoku$Ox$mAy|1b&Tzv?Re8?XoAwi=^`>EO?Qssjx@3`>RQa>a`G`L;;MnA}5
z|7PYO`rx4UTi-ZL>LXKJ2Rhqjwp4kfipr#N{+t|RNoJ9m5&XrtQTeAO=zi*l2p`8f
z&%KPty9dnjBNb#eK=~1?z2%={GyKNLKFJa;FTYOud(@#CKP)0!3$fOuX0Aga<K0bp
zTKxPNGL7#>v>}c{b!c+8dK?H;JroF&h)D#18O#F09<Cp21J^&KhYO-{ip?B|w{)iH
z*|;#m8?xBdksqY|2%kUD$ZC&ylXjd6BA3|Fegq;ve0*OBz7c#VwJC5mLVf^6G8zi-
zUJD|Z+S0NKp*-tM(Xs8CjF_crPtvgo4TBykMZ={)lLcm%h8DkAxb#`w-wGq!*Yol2
zV#0^`B-BjRZe1`suqmjh$!ZJxzK50?T&YhgbvG_@*GL;Z6EW8WVtIDdax?&Gn=Y{I
zLR&O;nL=5UYV*_8X-^Om`tW6rI4iO9<S8OPjI7L2wYbkpt+d_KGE4cQzi||gb2aYn
zjo?C=&#E%B+9E*V^*YKVt>48+SiE5x`t*oj+#HaU({wWYhXu#-7rc8fwublg;x*~*
z-K&Ik?wyPiGc=h0vR1;fmq}g1y4M_tSt5wC`IB^1oiX<I-o(1)aYjE7=6Iap%x9ry
z9^7pQSyPwWmz6uuPOM%mql&LH2DeU}fS+;PwM}IRB2GCZDFJ<1Z3`iPDmUrz@Ks37
zL(jc8Ugb51Y*)QL>ZrwEwEvoKld2*Vf{%c-po{Q*GsGd@-9h9QMy*l474nvvwYd~C
zPX~LmQ!iICT|#qoG1xR#*DaK3dg|OGs7WlcK%qGWUk+6P-6?{Wo#I&3?T!EpaUx<#
z2yBo^j>c=EDiHm1%UxT2Tf4=HdtK}ldR_|)^s(qHqs8hOF*fV%2N1m5u!uPS1MxzY
z`xx!G8xshX99F;kg&@{?o|r-ql#lI!gA=IFIo*%Q!1FD2`>W*+)jGuksqdPRFk4N)
zMt)&rv1^11iQF4D5Ad2=wz$WF-+&NuwErZ+CdQ9vJVfEx77~?jDhjKJ2Zta*#OZ!a
zc?it{v4wZGMo4o@5MOPzx&Dz-+#3BSqL1L&F-SGXpPTjc<@bNOK<Tg=iC?t_ZxZ3h
zR+$aM_izmE)zNc&GYEqCD6HDVG5do0YSNL?xmzV!#Tpf$gdj!|O8V-HIr7xet9WYO
ztcXr^u~%Ob5z0`eJo^9wV!o+5?|A#?^kgGJE5Mkh_{Qahum$zi+`W7#_1ce~jN}>9
ziH+A!nDI9qD%+^C)XJz8xQr@=90y%GcMz0K*B^SO29?KutTvx8$-VLGrbd3oRBZQA
zcw!9HVPM#Pv8a2)=ez7wsTAUj)bgQc1^G)t$RdKl5<(YNM*-=)B+9@iNAdHHTGwxZ
zs$EDMoD1`{*mVY#n^mEKPb#AZl{T4oOP$ZUF2_0zQo%$<!QM<urY+PH!ChpFJS(wK
z=au-P+lKFVXU;A@x7fK$Fy~zHwrC@Cycz9teM}9*zsZ7-+{b+z>!3P}VQ(1G@cJVI
zyOa+l6HG;M^Qe2^p5#<%a#m;hX@zwEg%`b5`Nk`-&i$ER84*po4Pd#Pz50+CQh%*{
z_^JURfTE{ynM2ofzmu>l8XX+znNa0k=ASCCvZVk)$g2WP@hxO1-=dowczJ|$cWlGB
zB(8-T3H|KVdd=AG5<d9-yzSg|iS=^cbk{)Cdbq(LyvF$UgPt!`zU+J=xA}VV{DW2l
zT1^KMCCd|;BNtIpbS+(RPK-}M;a1DofKGE7)I6^p-5}BR+iuplDk?uZoqbh=OeC!$
z`YTk~{6jO$kH1%q=#o~e8Ix-Vm~pX*kNS(v8^ftLJT^obL_onMjyDl_3(^Hu!fsC=
zs-s$-?S^IDm0ew^*Kj}-2|BAF$b{Xq;??^rY#usR2_!wCRV52<K-sq#j7Aw<<>mu7
zAh^M^Qf2dMm|zy=;9xZBFh+6iF`|y}y3_0ZVEfVtL734HURyj}+Nu&AZkXC<$-jNj
zRLME@>RI1;4FK8znc0*A3q4N#qJkVP-3T`z-|#56G|I2UIWk!mk&ZsDjf7>!K(02T
zKo^pt%Lbs2YMhzrvM88omQkS##l;&OjB3l9*GBbd(!z0Ki<u<9U=w+X{BLiJ1h%5&
zfsbvBUu3}!p)P*dS>+97{}L;i1GlFvBAzd0oS$~GD{BCR@w?4XN?cna;^#0Dy1QS+
zlWcze#h5~wZM1L-u@*X*XrU3f$+!x3>A3Za->z(E+*D{46ttf%)C9M`qj*ptDWYO)
z<L2y@4YLQ1a>xy!N9-@2ODGE@eJ{aHCd|Ezxt-J3XN7kmqD90QIOOHXz-3jz4;z*^
zChtEqDB<xO{6|UE-<ZRb>N=#lI3#jI7QN__!$145BE4&eC=?*4K#3eqE!5o^86hK=
z%n1lCUY4K~1Gdj(293b=P%&u9S6p2L@bx!Se#V%!_%oN;mguL_tTkP7o_s}0ov3`W
zy`6l0>a6AW!kM5HKGXbm8cwo8cD+#k`sh}+`x=G!n}Z4}V?;8lY`3;0b;EG2_Uq@R
z7uMhx?uO<j)<BL?WV8rPB-?t`<f!bn#5CM6{8gp5sC2k&DnxLPc9)LQRw7?^#l?id
zh$}~A{q%S{r@fD6so7G3TT7}?dN+l`8mKl3SAZr`qqu$wt_rFJ2jH3KS?%$L@9nzw
zPZ>lyU0K7M*z-KsZxOg{s+(Kkn966iKA!mf89AhR9a)>52bjCJ0*a9?_V921`bnKS
z6D-DdF}qu{3IoV=N{?7o<Xpzk*F}TR2}+#V4F5@2`0)`dMKXi7Fg@AZnI|{kj4Ai&
z#b4rnCw1Ch&^)1aVyh6dio?);2>%01(ZRI8i1#UFlk@s%lS!Z@Y0{)!A)XwqHZC0i
zY<QZzcio@fm2Mplko%4tKZx1ypss+?n@=paoN;7w<G(F}t*WX@&D2NQU;UBud-%97
zg|qAZGFhV1z`#HY*VGD)Z~2uTEkLVvJx^uHBLzN7T+wW_J>@1H@^eiQ0!~gOIVN%q
zqD8`Hvz4J{TSA5@!HFxuY+M{Vc$X}DKN?{tEliirBQ@*~A>|UquVsdvWEs?Xt(!-r
z3I{fT6?w(|xU}zcLI#i7sSbVg-aT=cG*B6AI(0ro;q1c&nJ$!<%&@z(;a8O{%?Mj>
zo$}9q15SksqhhGgMzHfS4wn~~;C>@hw$&+vOqF$Yt(D0X31U+5dr|@0%tT6m+g}+~
z1KYiPxpa=6`7z)|zrzh%UI9(;(;<TrZWTkfIo;L}EndN`%S7V9PX8A5#e*tPP<_Sm
zNR2ju?-Rv=De8+Cm3nusZ1L|qP91sqaLDC1EF2v=11p0)yCAx6J6D@BJomK`aK&U?
zel=#0ga4iaE8&dk5PBiZFiwo+&I1UZadHfd!Bg?~Z--nC*!P+I&#oIXn?k+P#xaHq
zQt{ilg|p!w#`C|Et!h&?QN)S?h4K!$>~Z6`;Vvp(Me}VTX#;^L^%6E1{l=)k)?x32
z@uF7>r>R=1@Zsf;+Y)*hz3Y`vv6`a~ekSh9%F*_roSkFQi~$V*<bfq{$*k}C_Q&BQ
zDyi{QKS_6THB=TlpI_RyzdzPwLfvr0;Y>J;uD0qm8XKyd2*<_$oGcLY7&)?oj&an)
z5RW8_tbabAbDVQEYvxOLT<*vKZS;gnjSKL8V5S4mBjL#5rZe4;X2yZIDv0n=3*W|h
zcM~pfMVh~ponJlE9L1*GzlL5k*iQkAgsLrZmpyeGN3MNr>lYoflBmR)D<sH?A2PzE
zwa?!S*|@g+(WFUOmT`r%bjZ4P>!g6%yS}KD9{-hN>14UN{W*Y`%ZSm4x~V0BCFYp>
z!L}`jcp{l@Lu9i2-5N1oo7(c{bD}Vdx`v&=a|c!@aIzeHgDS2S2F7_%MfPV$q`Ct+
zmJI7{3p;^6X%0F%1WI7)lV%B0C@m@;P{IH7d^&F0zSeRO{rFGaYXatX=j{@D-jSN<
z_>txYzswDG%$9_c5U1Rws@<;tZGHL0EGs-FK(M<<2Fwzd3pdsZ?Xe8GOhVCpo-U%A
zlaOZnv%N0SUyeZW|Mek}t(%?ck!eC`t3w0<o+P`I7#cQI#TT5YW<aG9Xt+*kHWI%o
z9YD@ybZU?Z#$%k;RfQM@kc*JKo+q+sZBF@e!nu<hw$vmjl70=|0uItPjeoaNbs3xM
zQnCGKixfGRoc7MLz}@tUwXd1*fkIp)6cz@BXy6mhwi9Q<D^E11wj@izOZ^3ksMfgN
ze9WZuW{Ka~xGHqGe0RxVkd<BX?N#!$e9`KwDrPi%RJ<lqF%RC#n9pYD__h?0<CcwB
z{W~NoHn*qr((Or7S**^!r``Mma>?{aZ|Kj(F>-aDav$<iH4y3g@KehPqKNoDH`QxC
z9@;n`7|>UyCja=UkwDCXX2$hu8Btku#w`<3?wm2|-t=crJFdd;<`=4Q<N|p}_0<Ur
zIh?qcOD<9riXR69fawFz<D$(~O2Yab&RVZEnVQJ9tz=Bv(}fc8XD5c=TmUmfJUS#c
zHi`4{ndU-PIMRLT?Z4BM_QaqAfbbVgDST`sT@g|}DK{f2UUN(_=+|#x$Xbre#0om)
zR9#K%6Tqn{o!k50{iJ3Cu&pXBN2}FT*2LM#k{RR)48VR4DDmZH_l5C9@O}>eLrOAS
zTv9H3Krzd}h)e&;-dJ4la*!4(I9GY_0+xPyawDFri`bRM*H5y?>i;2aC8>@1viJ0|
z`gT3f2@ZP}p-%m*ixHaqsfAX27&#eotfd8~q`UrcXIO!xZ*A+66PR|U%t`b1jgYad
zTFQC)H<t|*P-WkM3vH5;Z(4gLNdi7?)&Ss$<vK=_!>NW*7$DsL_=fkGoZA|H#!A%v
zyL7o^v29j6vHm9--m7?vmWnt1mmFkW*#iab@kopjGDfIe?quAP7WVlhE9k;$_jhGC
zN56nCj{;GBqnLhVQ;Q2Tl~+}V|8Os@qKpK2<t;DwZ*$n4DYf$+j+6OFTexg@a_ff&
zXjOVqJB+yWM`rj>;n21Og)-l!$D`wZt<Ke#M@VsG#@m9wLRn(zT|gil+2VdLe#C4U
zAMtUPNKkr>eR}s5;vCU*Of{-0nIo!ymGtHiky&?$5fB%B+&y}q?FU1~y43jEgCY%m
zV%nQ!B1nccmoetg`gkYIH2?VLIV}ZEzhit~9%*4jCyqbaRFqhw!DD($-$Y5;KP@<=
zJoxeG0WDexjS*>ZmT&5wd`aNM;mf<P_8`X#zpBNy{LA$qjTv7Iv*35F6!ZTA06w2Q
zjPK+7GyU>kle|v{@bYJTV91F_-B=`x`kf(*k#ch9?ORoOqsfwyo4>51whj&{2}C6p
zf~crgue~6R&9FB|5~l8tvzgwVJlj36C#f>mP-K}qtb*6@$t^s<rVPHEy)7b3yFQQF
zrx)zW&St^X`OXHLOXRJKQ)7$~KxHZ@Y0}zI?S)Yknkr^LK3TPzIq7n~#kC%0{%YSe
z`3{+kwwn`se{L^kXU8w>S>7lMG|cwlG4Tz`g#F4Yuq2ohVc0OYx*f+U!BzUj%L<c{
z1Ge&Y>LGA#3)V$_ysXI&=R}Kp9)c{GF|Dh=?e^<EGv<{<K~V8@X64!RrZmQ|$aC|9
z_;aOh*oyYuusY^zzgV+%Jd(lMd!s1fNSmMTX|*ELAFAPWYgR^*r4tK%lQg?BS}}LM
z`Jaw#qb{CL&H}I4Wxo_A%kC*eEr@Of@AY(UPcJNOxpnGgX8Luk#qn#1bvE<aR0i7s
zGYE4j-ZR5Zxux5Y%jwIx*|#7LOtKRsU-8mg{QNlaQhnPbXx0}@oY?54#%g>)zK5~i
zN7KIG*{^_QwNKOUqDR^9d4ZWZ$Uoq3C?n!oplKNW^EjHBZ@|cy;zA4aEQ#2fR`_v9
z;3|<g2=Yd0%&aTP7qhil;Fy}u1SL^mFtf_GpAZZ=E4zK?A#GuGuL}V|Pf5GSR#tpu
zGyFLXl4W9Q3xsUG?Oa5huA(7mCcDlQ%Schq4(~q0BisCsnfI&ddct~L&c9$(Q@Fdd
zp{~#HeYW9`ZokSI_1779A;^Oy*315UurPnh1@zgaixsPX*ea4=Z34v#5Nkq3b0?zu
zXcASQdOTCR+xPAQe$f{0?uF={#8fK{hypM2bes6=SEcST(<irV&f5>X|J+Bo#UKu2
zB7<(n){Bz(!!V1)+ns<t)n@6}2<jAPxWTFK>uQ8VeFWrp1!0jz`BS`nqg|cD7!2RQ
zD035*U-+jD>EW8$6$oPhe<qX5BD4A;t+1c>nSsllROyB&!botnn_uXcwFv*DuU5Gg
zx$T2~##op;bxnG>bJxzxgP8BH-Ol^R7p9k61IjZP);9#W4@}swFj+90Aq^{Yj`0tc
zS~|gcxrhi|8^3^>7EL`5sylUsVv{Uj5USsF4J!73idtK!{$3U}s$chJ!nUOjT(7d0
z)@p1&CGuD&O))hsX8iK0LrLT%MKy2yw^%gYU*Ra&%DxrynoCq^*2`DvGw1FLzri38
z{)JtMN9r$|H=PqWKn~L|Aw5fHa>aitLK-$SH=#W9w)yblRxxZ9Bq-MVj9_;|29|a&
ztXQdm25)RGS6kgYrERtwlRDU<R;6{6%jr*m{ZX7dwtmD;ZnND!Yvyft3Cf9>@?go&
zV@72x_Kq7fM7jsM|8P0oTa;^_Tg#6%gVy^4<e{9fN#p9y{-Z`C7vWjY&qMEvH-pBw
zcpmDx{0uoRowTU`LD`oH=58Z|ravS^V#Oe5ceC<@Td97gzc5q$z|#!TEslC%Kba{d
zyKWr#nNeiRCBcchU+BUsHsL+`vCn&BnjgzNMt4f<5*&B;?RxY)Sl4InYeKo3P_38z
zvzbep#|{ne_nl+ACP;Pyt6k0e1Fy95t6a;E?o34F;aL26QlofX-~)N{`pJclZ<$7m
zwL1L{0s_X0s)DR;ev0Q|1jJ3SY?a=xRAW%km1qgH5G{L>zp>6)A_Fbx7e10cVNj>$
zF*2rpZAHpGY26~i;o*BIwz&c$Wj3WQW4;T{8)6FI1Z|pvpiG(Wff*eG+mFW7WZZ|)
z&N<Dq>yAx$8is0|pd^{#t^BCh+bC>y>C?djd#VI+SbKy`x$P6*%08MfvzMq<4|Mr6
zx13O{!-e~5A(yFrs_QzODjxh$4x}%Byk`O945Ld!Sd6|PE`O7;#j=c<ZOI&rX0WRB
z-Xx_Aa%SNc5-xDqMePQ!*Lt81R6e{|-#0k@O@iK;=KWO&>=JdBIDr0_9S|m!SU2O$
z&5wK^$u*K&b=PvAuE(p_XExK`1&(>hRqk2e(>k-Ao>i$E(|1KKZ+`rN#;e}B=sI5|
z;S<lrN`BzIT(fUiu*Lq_ta$}JsSC_&g5?VhO6_UA2`}8#*qwQkZDB3ZADo#q+}qt1
zb9kvO^5KEVchNqVXcty@)=h4?V<DVlQeD_qfet>Kdc2}qUro5hy6|0dfhQF3Kk$I<
zX83HABB$3r`78WA6Fp_#hhuS1*_}GIfhpsB=olET4>udXK3u*zTeZ#{3468H9{Q<@
zd5AQwjNhb1XOZxoh042k9#H))t@B^6KPMTcNvIz0#!S7D*uT0Dcz)Lgxjo8cy6><R
z_c$q<qS1h-W_lZ7g#-+%PU>;%LyyJQ+n()FsqtigpYGuBy6(GIS5$4)`85HSsw&92
zgL}JpUa_C<Q|v++4a&&QXr?r!86<vsD$x7n$$QFDPj(h4u5QtN2B$x7`Td4i+%81d
z#FDn%2<JmUr^?Q8Qo$|oN{Mc`G(Ou}>)=sc#oKrw`&*!Y&J_Pn@K1tFTfXkk&%fU8
z1is|0OOwP^-q!)?oq>PZ!F90<i<S`HISp_JA+_`dMCeZO(z0x-Y<^e=F&=gvb6fpG
zum4%>ztcxb<6q2kCAU5T%f>dO>!aZJdM`+u=~^R*8r&~8SyM^{kTMM_+E>;nS_N|b
zTROXz1e3cv8^Pjciq{^*hK3@jeu2?u5YyX*;n+8@9jILbhG3rY7=|EqS>6vMc(x-p
zfL+;K)v@%qu50ahB_F8gVya6v*#-Sv^m^1y8M1JAbGze<JugtCDG3bkE0G@ZelHpE
z^nP7YcJJ1{qDl^05^wMLQR!b(S+4MVaaII+KP=L@txD+lCGm1Fv-n|>R9D@~A~iR2
zz}ryt@?g)*6UgFUigSJc@_Bm=5|kF;t*I^A2anYY-(o&sYaJ=X;RJ3$4gCLNo>h=a
zWr-MgkfGmp{kSs->27r?Lnhf9D6){HXD2pGsz7m)al8b~IT~)<cyq!Y1zH$qlWH@w
z$y4fX*GE*_3Fh6mwD=Mu1?Mpy3d_4bSRVM6QRNLv<eR|8IV4Ooua|ArIF)_=*)jfi
z!7Ur!He%xPs^8ZQ-vE&cZ~a|O!(@&&OvN&Au@kb6;B~#FrmsH!AvIZKLe(uTtjf;C
zZ$0`u+eq)=5OU$q?f#2cFNuoy%jD-{2G;zsu<Uwq7_O!&IPgvba-DKLFO`4h?Cf~M
zH_AW>qke&VHC=VPvfqE3Sk#v;q`=!PtE0m@0nS#ND$qgZxye}h2@hs}2RnOBp&A@^
zYSPe-GMb)SnvTdZ=%T%|;{}&ey32!^xTaVn5|i%|+0O)cNU*F=%F=%8rFB*lXc_u<
zL0R!*&n_Ctzf_bjOU%NA^r(~LDB^5Um}xPq$PUudSL}8I(0y<9v(&Z?IUUJxMv9b3
zGe`=BN$1Nkn^Dkfqa2<w?V*JX+vsaKOC#*OHyWI4b*dTsk?>fPo}M>HotOLYq>*F%
zlkmO7r2drSK=mf(BgAhFGD6{N793Y`K(4D{^^^H8a9tp1PRU(fGLBimx84$v%{@12
zGzpXJB5sco*vY@_l9^XpGzPbKB46Le(wOP|o8Ge4;FoE0*qMQA<oE64JQ2XzdO?Z_
zcHZCQ#uMtr#|tP8<?cl*i-UY}G;*Xj{LYYW-`MY-654kz)|@xLsOSzm*KRu9OmxZF
z;1N(v*fu9Gx9YhM0ZEL{yYHs!p>V8<bFY8R9zQx4n_H$|^vNjgQ{aP*ju5M;FKdAt
zo4TR}H99jWIT$6CX<hQ!etN88w$TdWf*dZ(bNI|u<LKePN)+@GG(Gm65zg(_h6qN2
z+M`dJ3eYfR$}0ESOZrA~E6CvoA-AqR{n1zHQOH!co1mC@;?Hy*UF+Z*yvg-RYqiq{
zUs<lR&0rW+H0-it#2e~Ff-PJ_(mj>2^sh3BHs#LyQq&#&F)goo&1+{_KQE=z<gav~
z&Vm%|SlThns5D~llX2Y2@|RDeevEfSPzZ=5F39;s*}26O<UK6I6-@I_deo@si!NCw
zChhxZy}0zlC#!htqeq^O@Iw2a$Yf_7m4D8*<1yybM{-g^+?)9pKi^LSN`kpa5-_$+
zs_TvLs(?c9wMtJ(eRBKUQ>Czzy~h^W=U<)Th}n}7HcFlw=&SSRxMskW*!tUgWUg^m
z<*1RQ;(^&j<kE~B#1#yo2aQ$3D>Mq=g56C0wv`Po9MdZESRcY)?-bTfI7M1vN@+HB
ztk9eb$|RUZe0?+jqE4-67JYXrPsJ>=DA2f#D3b&DEg4>}@Pn5PYg|)QKHhvB9JAv0
zr1yTCPze-2{S4g@u?~bPP8&0mI8?X@`-)AzvzApIqPPUB!Y`-n>(wZhJ&=n8;G_O7
zwh#3A0;T;s(-oIdCJ#w+Z&s$W!^co(9^ROX;}dy$s2>@ZU~_OSVG)@O`?*pt()f{W
z@?D(L9)P%EhvwO6=snQ%tw53}P^T5;h8@lp+;{j<R)I~<Jo-s&ay1(yPPisUy13X`
zfl^&tAPY;4AyvY!Qc1Zyw;LNdJhadYq7f4hE`An81}j7izsYy8%Er(V+-Ih5THDis
z^Ib+OVf`xby7QHU5A~4$L*zU$LE8dxZYLMHA%Wq@=jV%Msqys32|GHx$mPl$ny~j$
zF1ZUqclXKcjc_CRG1}IT9u(@5P#mUn<HK{*pQQsRjT|Exm64D*ZvBJS`jOo4Xjvj~
z^2NN{?X*ENm%j@^&1Y`she{>!1pn&m;F89BOUQ&-Jy#1y_F(_^aS<rYRQ9o*sN=W2
z%)%25GLYKvy(GF2SI77|tj;W6hXL!KTFa|gPnN3Q<c{25_sjnHX3Q<D$^#jOp}qy}
z>}O~3R=DhGuj<4{@X+4>P2-NEhp$TN_ck|dq<aD;-`VxsST)kDgTTLxi+4c2@8${$
ztC`QkE+mpVZajKkA7rH#xn7Do$_VtPm3rP2eP5Q+Kd@wl2V}Gex_h}wzq?I!+en=@
zQW{UILv~%g{G|88d3%hrGZRxmcJ$CDQrDR;_+W;dGevdZ*kc<l#O=%Rf>Q1`t?)QI
z0^J_e6><Ei{FY$kEYR742Zhp3R$Y<I4f_daz3Y*L^6rsC<mI=tR<<i82?YiHo+0z(
zm5DDrV+hkE@(V=idUQnRcRt#E&UvZQ61ksaho|RnNwQ+hRcHZ)+V4s=2={V(4{l*m
zuY+HNlDe+x(UWKtqN{-iMR=0%<tU2_po8Py|2O}K3Swa>cnzhmK!s}=2=GT$QA43x
H&OGctoOJw6

diff --git a/bindings/rust/flake.lock b/bindings/rust/flake.lock
deleted file mode 100644
index 5212e7c3453..00000000000
--- a/bindings/rust/flake.lock
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "nodes": {
-    "fdb-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1782312007,
-        "narHash": "sha256-DFr5o8fjyldBE0T3kgyeFVCBnZ/LD0OAEVycFeC0kJ0=",
-        "owner": "foundationdb-rs",
-        "repo": "overlay",
-        "rev": "d25f5f89b413efa1b04c0966623042f830409960",
-        "type": "github"
-      },
-      "original": {
-        "owner": "foundationdb-rs",
-        "repo": "overlay",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1789370336,
-        "narHash": "sha256-obwZbWHP7htCIoq2Z0g/uTMcEgN6yqcMNIcOMe6P2qI=",
-        "rev": "c7def046b9a883d46974757852106483d741586f",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1073483.c7def046b9a8/nixexprs.tar.zst"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.zst"
-      }
-    },
-    "root": {
-      "inputs": {
-        "fdb-overlay": "fdb-overlay",
-        "nixpkgs": "nixpkgs",
-        "rust-overlay": "rust-overlay"
-      }
-    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1789457514,
-        "narHash": "sha256-Aggle++fTyAifBy+QBPxjM+obO5iepKW/8MDxQtgGvI=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "89e99bf0778a8f2cd18c9360c3f19c1ee47fc739",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/bindings/rust/flake.nix b/bindings/rust/flake.nix
deleted file mode 100644
index 87b3389e7dd..00000000000
--- a/bindings/rust/flake.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{
-  description = "A dev environment for the crate foundationdb-rs";
-  inputs = {
-    nixpkgs.url = "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.zst";
-    rust-overlay.url = "github:oxalica/rust-overlay";
-    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
-    fdb-overlay.url = "github:foundationdb-rs/overlay";
-    fdb-overlay.inputs.nixpkgs.follows = "nixpkgs";
-  };
-
-  outputs = all@{ self, nixpkgs, fdb-overlay, rust-overlay, ... }: {
-    # Utilized by `nix develop`
-    devShells.x86_64-linux.default =
-      let
-        overlays = [ (import rust-overlay) fdb-overlay.overlays.default ];
-        pkgs = import nixpkgs {
-          inherit overlays;
-          system = "x86_64-linux";
-        };
-        # Toolchain pinned to the workspace MSRV via ./rust-toolchain.toml
-        rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
-      in
-      with pkgs;
-      mkShell {
-        buildInputs = [
-          # bindgen part
-          clang
-          llvmPackages.libclang
-          llvmPackages.libcxxClang
-          pkg-config
-
-          # Rust part
-          cargo-expand
-          cargo-edit
-          cargo-msrv
-          # uncomment when https://github.com/NixOS/nixpkgs/issues/354058 is fixed
-          # cargo-llvm-cov
-          cargo-audit
-          rustToolchain
-
-          git-cliff
-          release-plz
-
-          # FDB part
-          fdbserver74
-          libfdb74
-
-          # bindingTester part
-          python3
-          virtualenv
-        ];
-
-        # https://github.com/NixOS/nixpkgs/issues/52447#issuecomment-853429315
-        BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion clang}/include";
-        LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
-        FDB_CLIENT_LIB_PATH = "${libfdb74}/include";
-        LD_LIBRARY_PATH = "${libfdb74}/include";
-
-        # To import with Intellij IDEA
-        RUST_TOOLCHAIN_PATH = "${rustToolchain}/bin";
-        RUST_SRC_PATH = "${rustToolchain}/lib/rustlib/src/rust/library";
-
-        RUST_BACKTRACE = "1";
-      };
-  };
-}
diff --git a/bindings/rust/foundationdb-profiling/Cargo.toml b/bindings/rust/foundationdb-profiling/Cargo.toml
deleted file mode 100644
index 7c15dd263d7..00000000000
--- a/bindings/rust/foundationdb-profiling/Cargo.toml
+++ /dev/null
@@ -1,30 +0,0 @@
-[package]
-name = "foundationdb-profiling"
-version = "0.1.0"
-authors = [
-    "Pierre Zemb <contact@pierrezemb.fr>"
-]
-edition = "2024"
-rust-version = "1.85.1"
-
-description = """
-Read and decode FoundationDB client transaction profiling data
-"""
-
-documentation = "https://docs.rs/foundationdb-profiling"
-repository = "https://github.com/apple/foundationdb"
-license = "MIT/Apache-2.0"
-
-readme = "README.md"
-keywords = ["foundationdb", "profiling"]
-categories = ["database", "development-tools::profiling"]
-
-[dependencies]
-futures-core = "0.3.32"
-thiserror = "2.0.18"
-tracing = "0.1.44"
-
-[dev-dependencies]
-foundationdb = { version = "0.11.0", path = "../foundationdb", default-features = false, features = ["fdb-7_4", "embedded-fdb-include", "accounting"] }
-futures-util = "0.3.32"
-tokio = { version = "1.52.3", features = ["macros", "rt-multi-thread", "time"] }
diff --git a/bindings/rust/foundationdb-profiling/README.md b/bindings/rust/foundationdb-profiling/README.md
deleted file mode 100644
index b25f908be5e..00000000000
--- a/bindings/rust/foundationdb-profiling/README.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# FoundationDB-profiling
-
-Read and decode FoundationDB client transaction profiling data
-(`\xff\x02/fdbClientInfo/client_latency/`) from your own application.
-
-The crate does no I/O and does not depend on the `foundationdb` crate: you read the
-range given by `ProfileScanner::range` with your own FoundationDB bindings, and
-`ProfileScanner::read_page` reassembles and decodes the records into typed events,
-returning a cursor to resume from. `Aggregator` counts the hottest keys and ranges.
-
-See the [documentation](https://docs.rs/foundationdb-profiling) and
-[`examples/top_keys.rs`](examples/top_keys.rs).
diff --git a/bindings/rust/foundationdb-profiling/examples/top_keys.rs b/bindings/rust/foundationdb-profiling/examples/top_keys.rs
deleted file mode 100644
index cc5a627768a..00000000000
--- a/bindings/rust/foundationdb-profiling/examples/top_keys.rs
+++ /dev/null
@@ -1,120 +0,0 @@
-//! Reads the whole client profiling keyspace and prints the hottest keys, ranges and
-//! write hot spots, the way an application embedding this crate would.
-//!
-//! Enable client profiling on the cluster first, for instance for 1% of transactions:
-//!
-//! ```text
-//! fdbcli --exec "profile client set 0.01 default"
-//! ```
-//!
-//! Then, once the client has served some traffic and flushed its samples, run this
-//! example against the same cluster (optionally pass a cluster file as the first
-//! argument, otherwise the default one is used):
-//!
-//! ```text
-//! cargo run -p foundationdb-profiling --example top_keys
-//! ```
-
-use foundationdb::options::TransactionOption;
-use foundationdb::tuple::Bytes;
-use foundationdb::{ClientBudget, Database, FdbBindingError, KeySelector, RangeOption};
-use foundationdb_profiling::{Aggregator, Cursor, ProfileScanner, SkipReason};
-use futures_util::TryStreamExt;
-use std::time::Duration;
-
-const TOP_N: usize = 10;
-const BUCKET_COUNT: usize = 10;
-
-#[tokio::main]
-async fn main() {
-    foundationdb::boot().expect("failed to initialize FoundationDB");
-
-    let cluster_file = std::env::args().nth(1);
-    let db = Database::new(cluster_file.as_deref()).expect("failed to open database");
-
-    let mut cursor = Cursor::beginning();
-    let scanner = ProfileScanner::new();
-    let mut aggregator = Aggregator::default();
-    let mut read = 0usize;
-    let (mut decode_errors, mut broken_chunks) = (0usize, 0usize);
-
-    loop {
-        let page = db
-            .run(|trx, _maybe_committed| {
-                let scanner = scanner.clone();
-                let cursor = cursor.clone();
-                async move {
-                    // This crate never sets transaction options itself: that is the
-                    // caller's job, see the crate docs.
-                    trx.set_option(TransactionOption::ReadSystemKeys)?;
-                    // Every page is bounded by this budget, checked after every row.
-                    trx.set_client_budget(ClientBudget {
-                        time_limit: Some(Duration::from_secs(2)),
-                        ..ClientBudget::default()
-                    });
-                    let range = scanner.range(&cursor);
-                    let opt = RangeOption::from((
-                        KeySelector::first_greater_or_equal(range.begin.as_slice()),
-                        KeySelector::first_greater_or_equal(range.end.as_slice()),
-                    ));
-                    let rows = trx
-                        .get_ranges_keyvalues(opt, true)
-                        .map_ok(|kv| (kv.key().to_vec(), kv.value().to_vec()));
-                    let page = scanner
-                        .read_page(&cursor, rows, || trx.check_client_budget().is_err())
-                        .await
-                        .map_err(|err| err.into_error(FdbBindingError::new_custom_error))?;
-                    Ok::<_, FdbBindingError>(page)
-                }
-            })
-            .await
-            .expect("failed to read a page of profiling data");
-
-        read += page.transactions.len();
-        for tx in &page.transactions {
-            aggregator.record(tx);
-        }
-        for skipped in &page.skipped {
-            match skipped.reason {
-                SkipReason::Decode(_) => decode_errors += 1,
-                SkipReason::BrokenChunks => broken_chunks += 1,
-                _ => {}
-            }
-        }
-
-        cursor = page.next;
-        if page.exhausted {
-            break;
-        }
-    }
-
-    println!("transactions read: {read}");
-    println!(
-        "transactions skipped: {} ({decode_errors} decode error(s), {broken_chunks} broken chunk(s))",
-        decode_errors + broken_chunks
-    );
-
-    println!("\ntop {TOP_N} read keys:");
-    for (key, count) in aggregator.reads().top_keys(TOP_N) {
-        println!("  {count:>8}  {}", Bytes::from(key));
-    }
-
-    println!("\ntop {TOP_N} read ranges:");
-    for (range, count) in aggregator.reads().top_ranges(TOP_N) {
-        println!(
-            "  {count:>8}  {} .. {}",
-            Bytes::from(range.begin),
-            Bytes::from(range.end)
-        );
-    }
-
-    println!("\ntop {TOP_N} written keys:");
-    for (key, count) in aggregator.writes().top_keys(TOP_N) {
-        println!("  {count:>8}  {}", Bytes::from(key));
-    }
-
-    println!("\n{BUCKET_COUNT} read buckets:");
-    for bucket in aggregator.reads().buckets(BUCKET_COUNT) {
-        println!("  {:>8}  {}", bucket.count, Bytes::from(bucket.start));
-    }
-}
diff --git a/bindings/rust/foundationdb-profiling/src/aggregate.rs b/bindings/rust/foundationdb-profiling/src/aggregate.rs
deleted file mode 100644
index 43c41bb6137..00000000000
--- a/bindings/rust/foundationdb-profiling/src/aggregate.rs
+++ /dev/null
@@ -1,606 +0,0 @@
-//! Aggregated read/write counts over profiled transactions.
-//!
-//! [`Aggregator`] mirrors the Python `transaction_profiling_analyzer.py` `ReadCounter` /
-//! `WriteCounter`: it counts which keys and ranges transactions read and wrote, so a
-//! caller can find hot keys or split the keyspace into buckets of approximately equal
-//! traffic. It does not resolve shard addresses (`ShardFinder` in the Python tool): that
-//! is a separate, caller-side concern.
-
-use crate::event::{Event, KeyRange, Mutation};
-use crate::reader::ProfiledTransaction;
-use std::collections::BTreeMap;
-use tracing::instrument;
-
-/// `MutationRef::Type` codes that write a single key (`param1`): the plain and atomic
-/// mutations a client can send in a commit
-/// (`fdbclient/include/fdbclient/CommitTransaction.h`). Deliberately an allowlist, not a
-/// range check: `MutationRef::Type` also has codes a client commit never carries
-/// (`DebugKeyRange`, `DebugKey`, `NoOp`, `AvailableForReuse`, the `Reserved_For_*` codes,
-/// `Encrypted`), and `SetVersionstampedKey`, whose `param1` holds an unfilled versionstamp
-/// placeholder rather than the real key, so it is left out on purpose.
-const SINGLE_KEY_WRITE_TYPES: [u8; 14] = [
-    Mutation::SET_VALUE,
-    Mutation::ADD_VALUE,
-    Mutation::AND,
-    Mutation::OR,
-    Mutation::XOR,
-    Mutation::APPEND_IF_FITS,
-    Mutation::MAX,
-    Mutation::MIN,
-    Mutation::SET_VERSIONSTAMPED_VALUE,
-    Mutation::BYTE_MIN,
-    Mutation::BYTE_MAX,
-    Mutation::MIN_V2,
-    Mutation::AND_V2,
-    Mutation::COMPARE_AND_CLEAR,
-];
-
-/// Counts keys and ranges read and written by recorded transactions.
-///
-/// Only successful operations are counted: `Get`/`GetRange`/`Commit` events, never
-/// `GetError`/`GetRangeError`/`CommitError`. This mirrors the Python `ReadCounter` and
-/// `WriteCounter`, which only ever process `transaction_info.gets`, `.get_ranges` and
-/// `.commit`, and never the `error_*` lists, since a failed operation never touched the
-/// key or range it targeted. See [`Aggregator::writes`] for which mutation types count as
-/// writes.
-#[derive(Debug, Clone, Default, PartialEq)]
-pub struct Aggregator {
-    reads: KeyCounts,
-    writes: KeyCounts,
-}
-
-impl Aggregator {
-    /// Records every event of one profiled transaction.
-    #[instrument(level = "debug", skip_all, fields(events = tx.events.len()))]
-    pub fn record(&mut self, tx: &ProfiledTransaction) {
-        for event in &tx.events {
-            self.record_event(event);
-        }
-    }
-
-    /// Records one event.
-    ///
-    /// See the [`Aggregator`] docs for which events and mutation types count.
-    #[instrument(level = "trace", skip_all)]
-    pub fn record_event(&mut self, event: &Event) {
-        match event {
-            Event::Get(get) => self.reads.insert_key(&get.key),
-            Event::GetRange(get_range) => self.reads.insert_range(get_range.range.clone()),
-            Event::Commit(commit) => {
-                for mutation in &commit.request.mutations {
-                    if mutation.mutation_type == Mutation::CLEAR_RANGE {
-                        self.writes.insert_range(KeyRange {
-                            begin: mutation.param1.clone(),
-                            end: mutation.param2.clone(),
-                        });
-                    } else if SINGLE_KEY_WRITE_TYPES.contains(&mutation.mutation_type) {
-                        self.writes.insert_key(&mutation.param1);
-                    }
-                }
-            }
-            Event::GetVersion(_)
-            | Event::GetError(_)
-            | Event::GetRangeError(_)
-            | Event::CommitError(_) => {}
-        }
-    }
-
-    /// Keys and ranges read by `Get` and `GetRange` events.
-    #[instrument(level = "trace", skip_all)]
-    pub fn reads(&self) -> &KeyCounts {
-        &self.reads
-    }
-
-    /// Keys and ranges written by the mutations of successful `Commit` events.
-    ///
-    /// A `ClearRange` mutation counts as a range write, `param1` to `param2`. An allowlist
-    /// of client write mutation types counts as a single-key write by `param1`:
-    /// `SetValue`, `AddValue`, and the atomic ops `And`, `Or`, `Xor`, `AppendIfFits`,
-    /// `Max`, `Min`, `SetVersionstampedValue`, `ByteMin`, `ByteMax`, `MinV2`, `AndV2` and
-    /// `CompareAndClear`. Everything else is ignored: `SetVersionstampedKey` (its
-    /// `param1` holds an unfilled versionstamp placeholder, not the real key), the
-    /// server-only debug/reserved mutation types, and unknown codes.
-    ///
-    /// This is wider than the Python `WriteCounter`, which only counts `SetValue` and
-    /// `AddValue` and drops every other mutation type, including `ClearRange`.
-    #[instrument(level = "trace", skip_all)]
-    pub fn writes(&self) -> &KeyCounts {
-        &self.writes
-    }
-}
-
-/// Per-key and per-range hit counts, as returned by [`Aggregator::reads`] and
-/// [`Aggregator::writes`].
-#[derive(Debug, Clone, Default, PartialEq)]
-pub struct KeyCounts {
-    keys: BTreeMap<Vec<u8>, u64>,
-    ranges: BTreeMap<KeyRange, u64>,
-}
-
-impl KeyCounts {
-    fn insert_key(&mut self, key: &[u8]) {
-        *self.keys.entry(key.to_vec()).or_insert(0) += 1;
-    }
-
-    fn insert_range(&mut self, range: KeyRange) {
-        *self.ranges.entry(range).or_insert(0) += 1;
-    }
-
-    /// Total number of recorded hits, single keys and ranges combined.
-    #[instrument(level = "trace", skip(self))]
-    pub fn total(&self) -> u64 {
-        let key_total: u64 = self.keys.values().sum();
-        let range_total: u64 = self.ranges.values().sum();
-        key_total + range_total
-    }
-
-    /// The `n` most frequently hit single keys, descending by count, ties broken by key
-    /// ascending.
-    #[instrument(level = "trace", skip(self))]
-    pub fn top_keys(&self, n: usize) -> Vec<(Vec<u8>, u64)> {
-        let mut entries: Vec<(Vec<u8>, u64)> =
-            self.keys.iter().map(|(k, v)| (k.clone(), *v)).collect();
-        entries.sort_by(|a, b| b.1.cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
-        entries.truncate(n);
-        entries
-    }
-
-    /// The `n` most frequently hit ranges, descending by count, ties broken by range
-    /// ascending (begin, then end).
-    #[instrument(level = "trace", skip(self))]
-    pub fn top_ranges(&self, n: usize) -> Vec<(KeyRange, u64)> {
-        let mut entries: Vec<(KeyRange, u64)> =
-            self.ranges.iter().map(|(k, v)| (k.clone(), *v)).collect();
-        entries.sort_by(|a, b| b.1.cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
-        entries.truncate(n);
-        entries
-    }
-
-    /// Splits the keyspace into up to `n` buckets of approximately equal hit count, like
-    /// `ReadCounter.get_range_boundaries` / `WriteCounter.get_range_boundaries` in the
-    /// Python tool (minus its `ShardFinder` address resolution, and the "intersecting"
-    /// count it additionally reports for ranges that span a bucket boundary, which is a
-    /// display-only detail this crate does not expose).
-    ///
-    /// A bucket's range is `[bucket.start, next_bucket.start)`; the last bucket extends to
-    /// the end of the keyspace. Returns fewer than `n` buckets when there are fewer than
-    /// `n` distinct starting positions, and an empty vector for `n == 0` or an empty
-    /// counter.
-    #[instrument(level = "trace", skip(self))]
-    pub fn buckets(&self, n: usize) -> Vec<Bucket> {
-        if n == 0 {
-            return Vec::new();
-        }
-
-        // Every recorded key or range contributes one hit at its starting position: a
-        // single key at itself, a range at its begin. This is exactly the Python
-        // `opened_this_range` counter, which is what decides where boundaries fall.
-        let mut starts: BTreeMap<&[u8], u64> = BTreeMap::new();
-        for (key, count) in &self.keys {
-            *starts.entry(key.as_slice()).or_insert(0) += count;
-        }
-        for (range, count) in &self.ranges {
-            *starts.entry(range.begin.as_slice()).or_insert(0) += count;
-        }
-
-        let total: u64 = starts.values().sum();
-        if total == 0 {
-            return Vec::new();
-        }
-
-        // Floored at 1: when `n` exceeds the amount of distinct traffic, the Python
-        // tool's `range_size` (an integer division) truncates to 0, which then cuts a
-        // boundary before any key is ever assigned to it. Flooring instead yields one
-        // bucket per distinct starting position, the sensible reading of "n buckets" when
-        // there is less traffic than that to split.
-        let bucket_size = (total / n as u64).max(1);
-
-        let mut out = Vec::new();
-        let mut current_start: Option<Vec<u8>> = None;
-        let mut current_count: u64 = 0;
-        for (&start, &count) in &starts {
-            // Once one more bucket would reach `n`, stop cutting: the last bucket absorbs
-            // whatever remains, so `buckets` never returns more than `n` of them.
-            if current_count >= bucket_size && out.len() + 1 < n {
-                if let Some(start) = current_start.take() {
-                    out.push(Bucket {
-                        start,
-                        count: current_count,
-                    });
-                }
-                current_count = 0;
-            }
-            current_count += count;
-            if current_start.is_none() {
-                current_start = Some(start.to_vec());
-            }
-        }
-        if current_count > 0 {
-            if let Some(start) = current_start {
-                out.push(Bucket {
-                    start,
-                    count: current_count,
-                });
-            }
-        }
-        out
-    }
-}
-
-/// One boundary of an approximately equal-count keyspace split, from [`KeyCounts::buckets`].
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct Bucket {
-    /// Inclusive start of the bucket. The bucket extends to the next bucket's `start`, or
-    /// to the end of the keyspace for the last bucket.
-    pub start: Vec<u8>,
-    /// Number of read or write hits starting in this bucket.
-    pub count: u64,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::event::{
-        Commit, CommitError, CommitRequest, EventHeader, Get, GetError, GetRange, GetRangeError,
-        GetVersion, Mutation,
-    };
-
-    fn header() -> EventHeader {
-        EventHeader {
-            start_timestamp: 0.0,
-            dc_id: Vec::new(),
-            tenant: None,
-        }
-    }
-
-    fn get(key: &[u8]) -> Event {
-        Event::Get(Get {
-            header: header(),
-            latency: 0.0,
-            value_size: 0,
-            key: key.to_vec(),
-        })
-    }
-
-    fn get_range(begin: &[u8], end: &[u8]) -> Event {
-        Event::GetRange(GetRange {
-            header: header(),
-            latency: 0.0,
-            range_size: 0,
-            range: KeyRange {
-                begin: begin.to_vec(),
-                end: end.to_vec(),
-            },
-        })
-    }
-
-    fn get_error(key: &[u8]) -> Event {
-        Event::GetError(GetError {
-            header: header(),
-            error_code: 1009,
-            key: key.to_vec(),
-        })
-    }
-
-    fn get_range_error(begin: &[u8], end: &[u8]) -> Event {
-        Event::GetRangeError(GetRangeError {
-            header: header(),
-            error_code: 1009,
-            range: KeyRange {
-                begin: begin.to_vec(),
-                end: end.to_vec(),
-            },
-        })
-    }
-
-    fn commit_request(mutations: Vec<Mutation>) -> CommitRequest {
-        CommitRequest {
-            read_conflict_ranges: Vec::new(),
-            write_conflict_ranges: Vec::new(),
-            mutations,
-            read_snapshot: 0,
-            report_conflicting_keys: false,
-            lock_aware: false,
-            span_context: None,
-        }
-    }
-
-    fn commit(mutations: Vec<Mutation>) -> Event {
-        Event::Commit(Commit {
-            header: header(),
-            latency: 0.0,
-            num_mutations: mutations.len() as i32,
-            commit_bytes: 0,
-            commit_version: 0,
-            request: commit_request(mutations),
-        })
-    }
-
-    fn commit_error(mutations: Vec<Mutation>) -> Event {
-        Event::CommitError(CommitError {
-            header: header(),
-            error_code: 1020,
-            request: commit_request(mutations),
-        })
-    }
-
-    fn mutation(mutation_type: u8, param1: &[u8], param2: &[u8]) -> Mutation {
-        Mutation {
-            mutation_type,
-            param1: param1.to_vec(),
-            param2: param2.to_vec(),
-        }
-    }
-
-    /// A code in the `MutationRef::Type` range that is not a client write op: server-only
-    /// debug mutation, not in the allowlist.
-    const NO_OP: u8 = 5;
-    /// Past `Encrypted` (23), the last type the C++ client defines.
-    const UNKNOWN_MUTATION_TYPE: u8 = 250;
-
-    #[test]
-    fn reads_and_writes_are_split_and_only_successes_count() {
-        let mut agg = Aggregator::default();
-        for event in [
-            get(b"a"),
-            get_range(b"b", b"c"),
-            get_error(b"ignored"),
-            get_range_error(b"ig", b"nored"),
-            Event::GetVersion(GetVersion {
-                header: header(),
-                latency: 0.0,
-                priority: 0,
-                read_version: 0,
-            }),
-            commit(vec![mutation(Mutation::SET_VALUE, b"w", b"v")]),
-            commit_error(vec![mutation(Mutation::SET_VALUE, b"ignored-write", b"v")]),
-        ] {
-            agg.record_event(&event);
-        }
-
-        assert_eq!(agg.reads().total(), 2);
-        assert_eq!(agg.reads().top_keys(10), vec![(b"a".to_vec(), 1)]);
-        assert_eq!(
-            agg.reads().top_ranges(10),
-            vec![(
-                KeyRange {
-                    begin: b"b".to_vec(),
-                    end: b"c".to_vec()
-                },
-                1
-            )]
-        );
-        assert_eq!(agg.writes().total(), 1);
-        assert_eq!(agg.writes().top_keys(10), vec![(b"w".to_vec(), 1)]);
-        assert!(agg.writes().top_ranges(10).is_empty());
-    }
-
-    #[test]
-    fn record_loops_record_event_over_transaction_events() {
-        let mut agg = Aggregator::default();
-        let tx = ProfiledTransaction {
-            version: 1,
-            versionstamp: [0u8; 10],
-            id: [0u8; 16],
-            protocol_version: crate::event::ProtocolVersion::V7_4,
-            events: vec![get(b"a"), get(b"a"), commit(vec![])],
-        };
-        agg.record(&tx);
-        assert_eq!(agg.reads().top_keys(10), vec![(b"a".to_vec(), 2)]);
-        assert_eq!(agg.writes().total(), 0);
-    }
-
-    #[test]
-    fn write_mutation_types() {
-        let mut agg = Aggregator::default();
-        agg.record_event(&commit(vec![
-            mutation(Mutation::SET_VALUE, b"set", b"v"),
-            mutation(Mutation::ADD_VALUE, b"add", b"1"),
-            // Every other known atomic op counts too, not just SetValue/AddValue: wider
-            // than the Python WriteCounter.
-            mutation(Mutation::AND, b"anded", b"mask"),
-            mutation(Mutation::SET_VERSIONSTAMPED_VALUE, b"svv", b"v"),
-            mutation(Mutation::CLEAR_RANGE, b"c", b"c\x00"),
-            // Placeholder key (unfilled versionstamp): never counted.
-            mutation(Mutation::SET_VERSIONSTAMPED_KEY, b"placeholder", b"v"),
-            // In the MutationRef::Type range but not a client write op: not in the
-            // allowlist, ignored.
-            mutation(NO_OP, b"noop", b"v"),
-            // Past the last mutation type the C++ client defines: ignored.
-            mutation(UNKNOWN_MUTATION_TYPE, b"future", b"v"),
-        ]));
-
-        let writes = agg.writes();
-        assert_eq!(writes.total(), 5);
-        assert_eq!(
-            writes.top_keys(10),
-            vec![
-                (b"add".to_vec(), 1),
-                (b"anded".to_vec(), 1),
-                (b"set".to_vec(), 1),
-                (b"svv".to_vec(), 1),
-            ]
-        );
-        assert_eq!(
-            writes.top_ranges(10),
-            vec![(
-                KeyRange {
-                    begin: b"c".to_vec(),
-                    end: b"c\x00".to_vec()
-                },
-                1
-            )]
-        );
-    }
-
-    #[test]
-    fn top_keys_orders_by_count_then_key_ascending() {
-        let mut counts = KeyCounts::default();
-        for (key, hits) in [(b"z" as &[u8], 3), (b"a", 3), (b"m", 5), (b"b", 1)] {
-            for _ in 0..hits {
-                counts.insert_key(key);
-            }
-        }
-        assert_eq!(
-            counts.top_keys(10),
-            vec![
-                (b"m".to_vec(), 5),
-                (b"a".to_vec(), 3),
-                (b"z".to_vec(), 3),
-                (b"b".to_vec(), 1),
-            ]
-        );
-        assert_eq!(counts.top_keys(0), Vec::new());
-        assert_eq!(counts.top_keys(2).len(), 2);
-    }
-
-    #[test]
-    fn top_ranges_orders_by_count_then_range_ascending() {
-        let mut counts = KeyCounts::default();
-        let r = |b: &[u8], e: &[u8]| KeyRange {
-            begin: b.to_vec(),
-            end: e.to_vec(),
-        };
-        for (range, hits) in [(r(b"y", b"z"), 2), (r(b"a", b"b"), 2), (r(b"m", b"n"), 4)] {
-            for _ in 0..hits {
-                counts.insert_range(range.clone());
-            }
-        }
-        assert_eq!(
-            counts.top_ranges(10),
-            vec![(r(b"m", b"n"), 4), (r(b"a", b"b"), 2), (r(b"y", b"z"), 2)]
-        );
-    }
-
-    #[test]
-    fn buckets_empty_counter_is_empty() {
-        let counts = KeyCounts::default();
-        assert_eq!(counts.buckets(4), Vec::new());
-        assert_eq!(counts.buckets(0), Vec::new());
-    }
-
-    #[test]
-    fn buckets_n_zero_is_empty_even_with_data() {
-        let mut counts = KeyCounts::default();
-        counts.insert_key(b"a");
-        assert_eq!(counts.buckets(0), Vec::new());
-    }
-
-    #[test]
-    fn buckets_split_approximately_evenly() {
-        let mut counts = KeyCounts::default();
-        // 8 hits spread over 4 distinct keys, split into 2 buckets of ~4.
-        for key in [b"a" as &[u8], b"b", b"c", b"d"] {
-            counts.insert_key(key);
-            counts.insert_key(key);
-        }
-        let buckets = counts.buckets(2);
-        assert_eq!(
-            buckets,
-            vec![
-                Bucket {
-                    start: b"a".to_vec(),
-                    count: 4
-                },
-                Bucket {
-                    start: b"c".to_vec(),
-                    count: 4
-                },
-            ]
-        );
-        let total: u64 = buckets.iter().map(|b| b.count).sum();
-        assert_eq!(total, counts.total());
-    }
-
-    #[test]
-    fn buckets_n_larger_than_distinct_keys_yields_one_bucket_per_key() {
-        let mut counts = KeyCounts::default();
-        counts.insert_key(b"a");
-        counts.insert_key(b"b");
-        counts.insert_key(b"c");
-
-        let buckets = counts.buckets(10);
-        assert_eq!(
-            buckets,
-            vec![
-                Bucket {
-                    start: b"a".to_vec(),
-                    count: 1
-                },
-                Bucket {
-                    start: b"b".to_vec(),
-                    count: 1
-                },
-                Bucket {
-                    start: b"c".to_vec(),
-                    count: 1
-                },
-            ]
-        );
-    }
-
-    #[test]
-    fn buckets_never_returns_more_than_n() {
-        // 10 keys with 1 hit each: bucket_size = 10 / 3 = 3, which would cut a 4th bucket
-        // (3, 3, 3, 1) if the last one didn't absorb the remainder instead.
-        let mut counts = KeyCounts::default();
-        for key in [
-            b"a" as &[u8],
-            b"b",
-            b"c",
-            b"d",
-            b"e",
-            b"f",
-            b"g",
-            b"h",
-            b"i",
-            b"j",
-        ] {
-            counts.insert_key(key);
-        }
-        let buckets = counts.buckets(3);
-        assert_eq!(
-            buckets,
-            vec![
-                Bucket {
-                    start: b"a".to_vec(),
-                    count: 3
-                },
-                Bucket {
-                    start: b"d".to_vec(),
-                    count: 3
-                },
-                Bucket {
-                    start: b"g".to_vec(),
-                    count: 4
-                },
-            ]
-        );
-        let total: u64 = buckets.iter().map(|b| b.count).sum();
-        assert_eq!(total, counts.total());
-    }
-
-    #[test]
-    fn buckets_range_contributes_at_its_begin() {
-        let mut counts = KeyCounts::default();
-        counts.insert_range(KeyRange {
-            begin: b"a".to_vec(),
-            end: b"z".to_vec(),
-        });
-        counts.insert_key(b"m");
-        let buckets = counts.buckets(2);
-        assert_eq!(
-            buckets,
-            vec![
-                Bucket {
-                    start: b"a".to_vec(),
-                    count: 1
-                },
-                Bucket {
-                    start: b"m".to_vec(),
-                    count: 1
-                },
-            ]
-        );
-    }
-}
diff --git a/bindings/rust/foundationdb-profiling/src/decode.rs b/bindings/rust/foundationdb-profiling/src/decode.rs
deleted file mode 100644
index 3cd59a323e3..00000000000
--- a/bindings/rust/foundationdb-profiling/src/decode.rs
+++ /dev/null
@@ -1,943 +0,0 @@
-//! Decoding of reassembled profiling blobs into typed [`Event`]s.
-//!
-//! A blob is what the C++ client writes with `BinaryWriter(IncludeVersion())` for one sampled
-//! transaction: a little-endian `u64` protocol version followed by events serialized back to
-//! back. Each event starts with its `EventType` as a little-endian `i32`, then the shared
-//! `Event` fields and the event-specific ones. Byte strings are a little-endian `u32` length
-//! followed by the bytes, `Optional<T>` is a presence byte followed by `T`, vectors are a
-//! little-endian `u32` count followed by the elements.
-//!
-//! Reference: `fdbclient/include/fdbclient/ClientLogEvents.h` and `CommitTransactionRef` /
-//! `MutationRef::serialize` in `fdbclient/include/fdbclient/CommitTransaction.h`.
-
-use crate::event::{
-    Commit, CommitError, CommitRequest, Event, EventHeader, Get, GetError, GetRange, GetRangeError,
-    GetVersion, KeyRange, Mutation, ProtocolVersion, SpanContext,
-};
-use tracing::instrument;
-
-/// Errors returned by [`decode_events`].
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
-#[non_exhaustive]
-pub enum DecodeError {
-    /// The blob ended before a field could be read.
-    #[error("unexpected end of blob at offset {offset}: needed {needed} bytes, {remaining} left")]
-    UnexpectedEof {
-        /// Offset in the blob where the read started.
-        offset: usize,
-        /// Number of bytes the read needed.
-        needed: usize,
-        /// Number of bytes left in the blob.
-        remaining: usize,
-    },
-    /// The blob was written with a protocol version this crate does not decode.
-    #[error("unsupported protocol version {0:#018x}")]
-    UnsupportedProtocolVersion(u64),
-    /// An event carries a type code unknown to this crate.
-    #[error("unknown event type {0}")]
-    UnknownEventType(i32),
-    /// A conflict range uses the single-key encoding with a begin key not ending in `\x00`.
-    #[error("malformed key range at offset {offset}")]
-    MalformedKeyRange {
-        /// Offset in the blob where the key range starts.
-        offset: usize,
-    },
-    /// A mutation's checksum suffix could not be removed (`param2` shorter than the
-    /// checksum, and accumulative checksum index when present).
-    #[error("malformed mutation at offset {offset}")]
-    MalformedMutation {
-        /// Offset in the blob where the mutation starts.
-        offset: usize,
-    },
-}
-
-const EVENT_GET_VERSION: i32 = 0;
-const EVENT_GET: i32 = 1;
-const EVENT_GET_RANGE: i32 = 2;
-const EVENT_COMMIT: i32 = 3;
-const EVENT_ERROR_GET: i32 = 4;
-const EVENT_ERROR_GET_RANGE: i32 = 5;
-const EVENT_ERROR_COMMIT: i32 = 6;
-
-const CHECKSUM_FLAG_MASK: u8 = 0x80;
-const ACCUMULATIVE_CHECKSUM_INDEX_FLAG_MASK: u8 = 0x40;
-const CHECKSUM_LEN: usize = 4;
-const ACCUMULATIVE_CHECKSUM_INDEX_LEN: usize = 2;
-
-/// Minimum encoded size of a key range (two empty byte strings).
-const MIN_KEY_RANGE_LEN: usize = 8;
-/// Minimum encoded size of a mutation (type byte plus two empty byte strings).
-const MIN_MUTATION_LEN: usize = 9;
-
-/// Decodes one reassembled profiling blob (all chunks of one sampled transaction,
-/// concatenated) into its protocol version and events, in write order.
-///
-/// Only blobs written by 7.1 to 7.4 clients are supported. Never panics on malformed input,
-/// and allocations are bounded by the blob length.
-#[instrument(level = "trace", skip_all, fields(blob_len = blob.len()))]
-pub fn decode_events(blob: &[u8]) -> Result<(ProtocolVersion, Vec<Event>), DecodeError> {
-    let mut reader = Reader::new(blob);
-    let version = ProtocolVersion(reader.u64()?);
-    if !is_supported(version) {
-        return Err(DecodeError::UnsupportedProtocolVersion(version.0));
-    }
-    let mut events = Vec::new();
-    while !reader.is_empty() {
-        events.push(reader.event(version)?);
-    }
-    Ok((version, events))
-}
-
-fn is_supported(version: ProtocolVersion) -> bool {
-    matches!(
-        version,
-        ProtocolVersion::V7_1
-            | ProtocolVersion::V7_2
-            | ProtocolVersion::V7_3
-            | ProtocolVersion::V7_4
-    )
-}
-
-/// 7.2 switched the commit span context from `Optional<UID>` to `Optional<SpanContext>`
-/// (`hasOTELSpanContext`).
-fn has_otel_span_context(version: ProtocolVersion) -> bool {
-    version.0 >= ProtocolVersion::V7_2.0
-}
-
-struct Reader<'a> {
-    buf: &'a [u8],
-    pos: usize,
-}
-
-impl<'a> Reader<'a> {
-    fn new(buf: &'a [u8]) -> Self {
-        Reader { buf, pos: 0 }
-    }
-
-    fn remaining(&self) -> usize {
-        self.buf.len() - self.pos
-    }
-
-    fn is_empty(&self) -> bool {
-        self.remaining() == 0
-    }
-
-    fn take(&mut self, n: usize) -> Result<&'a [u8], DecodeError> {
-        match self.buf.get(self.pos..).and_then(|rest| rest.get(..n)) {
-            Some(bytes) => {
-                self.pos += n;
-                Ok(bytes)
-            }
-            None => Err(DecodeError::UnexpectedEof {
-                offset: self.pos,
-                needed: n,
-                remaining: self.remaining(),
-            }),
-        }
-    }
-
-    fn array<const N: usize>(&mut self) -> Result<[u8; N], DecodeError> {
-        let mut out = [0u8; N];
-        out.copy_from_slice(self.take(N)?);
-        Ok(out)
-    }
-
-    fn u8(&mut self) -> Result<u8, DecodeError> {
-        Ok(self.array::<1>()?[0])
-    }
-
-    fn bool(&mut self) -> Result<bool, DecodeError> {
-        Ok(self.u8()? != 0)
-    }
-
-    fn u32(&mut self) -> Result<u32, DecodeError> {
-        Ok(u32::from_le_bytes(self.array()?))
-    }
-
-    fn i32(&mut self) -> Result<i32, DecodeError> {
-        Ok(i32::from_le_bytes(self.array()?))
-    }
-
-    fn u64(&mut self) -> Result<u64, DecodeError> {
-        Ok(u64::from_le_bytes(self.array()?))
-    }
-
-    fn i64(&mut self) -> Result<i64, DecodeError> {
-        Ok(i64::from_le_bytes(self.array()?))
-    }
-
-    fn f64(&mut self) -> Result<f64, DecodeError> {
-        Ok(f64::from_le_bytes(self.array()?))
-    }
-
-    /// Length-prefixed byte string. The length is checked against the remaining bytes
-    /// before anything is allocated.
-    fn bytes(&mut self) -> Result<Vec<u8>, DecodeError> {
-        let len = self.u32()? as usize;
-        Ok(self.take(len)?.to_vec())
-    }
-
-    fn key_range(&mut self) -> Result<KeyRange, DecodeError> {
-        Ok(KeyRange {
-            begin: self.bytes()?,
-            end: self.bytes()?,
-        })
-    }
-
-    /// Count-prefixed vector. The initial capacity is capped by what the remaining bytes can
-    /// hold, so a garbage count cannot trigger a huge allocation.
-    fn vec<T>(
-        &mut self,
-        min_elem_len: usize,
-        mut elem: impl FnMut(&mut Self) -> Result<T, DecodeError>,
-    ) -> Result<Vec<T>, DecodeError> {
-        let count = self.u32()? as usize;
-        let mut out = Vec::with_capacity(count.min(self.remaining() / min_elem_len));
-        for _ in 0..count {
-            out.push(elem(self)?);
-        }
-        Ok(out)
-    }
-
-    fn header(&mut self) -> Result<EventHeader, DecodeError> {
-        let start_timestamp = self.f64()?;
-        let dc_id = self.bytes()?;
-        let tenant = if self.bool()? {
-            Some(self.bytes()?)
-        } else {
-            None
-        };
-        Ok(EventHeader {
-            start_timestamp,
-            dc_id,
-            tenant,
-        })
-    }
-
-    fn event(&mut self, version: ProtocolVersion) -> Result<Event, DecodeError> {
-        let event_type = self.i32()?;
-        if !(EVENT_GET_VERSION..=EVENT_ERROR_COMMIT).contains(&event_type) {
-            return Err(DecodeError::UnknownEventType(event_type));
-        }
-        let header = self.header()?;
-        let event = match event_type {
-            EVENT_GET_VERSION => Event::GetVersion(GetVersion {
-                header,
-                latency: self.f64()?,
-                priority: self.u32()?,
-                read_version: self.i64()?,
-            }),
-            EVENT_GET => Event::Get(Get {
-                header,
-                latency: self.f64()?,
-                value_size: self.i32()?,
-                key: self.bytes()?,
-            }),
-            EVENT_GET_RANGE => Event::GetRange(GetRange {
-                header,
-                latency: self.f64()?,
-                range_size: self.i32()?,
-                range: self.key_range()?,
-            }),
-            EVENT_COMMIT => Event::Commit(Commit {
-                header,
-                latency: self.f64()?,
-                num_mutations: self.i32()?,
-                commit_bytes: self.i32()?,
-                commit_version: self.i64()?,
-                request: self.commit_request(version)?,
-            }),
-            EVENT_ERROR_GET => Event::GetError(GetError {
-                header,
-                error_code: self.i32()?,
-                key: self.bytes()?,
-            }),
-            EVENT_ERROR_GET_RANGE => Event::GetRangeError(GetRangeError {
-                header,
-                error_code: self.i32()?,
-                range: self.key_range()?,
-            }),
-            EVENT_ERROR_COMMIT => Event::CommitError(CommitError {
-                header,
-                error_code: self.i32()?,
-                request: self.commit_request(version)?,
-            }),
-            other => return Err(DecodeError::UnknownEventType(other)),
-        };
-        Ok(event)
-    }
-
-    /// A serialized `KeyRangeRef`. Mirrors its deserializer: the single-key range
-    /// `[k, k\x00)` is written as `(k\x00, "")` and expanded back here.
-    fn conflict_range(&mut self) -> Result<KeyRange, DecodeError> {
-        let offset = self.pos;
-        let mut range = self.key_range()?;
-        if range.end.is_empty() && !range.begin.is_empty() {
-            if range.begin.last() != Some(&0) {
-                return Err(DecodeError::MalformedKeyRange { offset });
-            }
-            range.end = range.begin.clone();
-            range.begin.pop();
-        }
-        Ok(range)
-    }
-
-    fn commit_request(&mut self, version: ProtocolVersion) -> Result<CommitRequest, DecodeError> {
-        let read_conflict_ranges = self.vec(MIN_KEY_RANGE_LEN, Self::conflict_range)?;
-        let write_conflict_ranges = self.vec(MIN_KEY_RANGE_LEN, Self::conflict_range)?;
-        let mutations = self.vec(MIN_MUTATION_LEN, Self::mutation)?;
-        let read_snapshot = self.i64()?;
-        let report_conflicting_keys = self.bool()?;
-        let lock_aware = self.bool()?;
-        let span_context = if self.bool()? {
-            Some(self.span_context(version)?)
-        } else {
-            None
-        };
-        Ok(CommitRequest {
-            read_conflict_ranges,
-            write_conflict_ranges,
-            mutations,
-            read_snapshot,
-            report_conflicting_keys,
-            lock_aware,
-            span_context,
-        })
-    }
-
-    fn span_context(&mut self, version: ProtocolVersion) -> Result<SpanContext, DecodeError> {
-        let trace_id = [self.u64()?, self.u64()?];
-        if has_otel_span_context(version) {
-            Ok(SpanContext {
-                trace_id,
-                span_id: self.u64()?,
-                flags: self.u8()?,
-            })
-        } else {
-            Ok(SpanContext {
-                trace_id,
-                span_id: 0,
-                flags: 0,
-            })
-        }
-    }
-
-    /// Mirrors the deserializing branch of `MutationRef::serialize`.
-    fn mutation(&mut self) -> Result<Mutation, DecodeError> {
-        let offset = self.pos;
-        let mut mutation_type = self.u8()?;
-        let mut param1 = self.bytes()?;
-        let mut param2 = self.bytes()?;
-        let malformed = DecodeError::MalformedMutation { offset };
-
-        if mutation_type & CHECKSUM_FLAG_MASK != 0 {
-            let mut suffix = CHECKSUM_LEN;
-            if mutation_type & ACCUMULATIVE_CHECKSUM_INDEX_FLAG_MASK != 0 {
-                suffix += ACCUMULATIVE_CHECKSUM_INDEX_LEN;
-            }
-            let len = param2.len().checked_sub(suffix).ok_or(malformed)?;
-            param2.truncate(len);
-            mutation_type &= !(CHECKSUM_FLAG_MASK | ACCUMULATIVE_CHECKSUM_INDEX_FLAG_MASK);
-        }
-
-        // A single-key clear `[k, k\x00)` is written as `(ClearRange, k\x00, "")`. Like the
-        // C++ deserializer, a `param1` not ending in `\x00` is only traced as an error, not
-        // treated as fatal: the mutation is still expanded, dropping its last byte.
-        if mutation_type == Mutation::CLEAR_RANGE && param2.is_empty() && !param1.is_empty() {
-            if param1.last() != Some(&0) {
-                tracing::warn!(
-                    offset,
-                    param1 = ?param1,
-                    "single-key clear range mutation with param1 not ending in \\x00"
-                );
-            }
-            param2 = param1.clone();
-            param1.pop();
-        }
-
-        Ok(Mutation {
-            mutation_type,
-            param1,
-            param2,
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const P: &[u8] = b"fdbrs_prof_fixture/";
-
-    fn key(suffix: &[u8]) -> Vec<u8> {
-        [P, suffix].concat()
-    }
-
-    /// Minimal writer following the C++ `BinaryWriter` layout, to build test blobs.
-    #[derive(Default)]
-    struct W(Vec<u8>);
-
-    impl W {
-        fn version(v: ProtocolVersion) -> Self {
-            let mut w = W::default();
-            w.u64(v.0);
-            w
-        }
-        fn u8(&mut self, v: u8) -> &mut Self {
-            self.0.push(v);
-            self
-        }
-        fn u32(&mut self, v: u32) -> &mut Self {
-            self.0.extend_from_slice(&v.to_le_bytes());
-            self
-        }
-        fn i32(&mut self, v: i32) -> &mut Self {
-            self.0.extend_from_slice(&v.to_le_bytes());
-            self
-        }
-        fn u64(&mut self, v: u64) -> &mut Self {
-            self.0.extend_from_slice(&v.to_le_bytes());
-            self
-        }
-        fn i64(&mut self, v: i64) -> &mut Self {
-            self.0.extend_from_slice(&v.to_le_bytes());
-            self
-        }
-        fn f64(&mut self, v: f64) -> &mut Self {
-            self.0.extend_from_slice(&v.to_le_bytes());
-            self
-        }
-        fn bytes(&mut self, v: &[u8]) -> &mut Self {
-            self.u32(v.len() as u32);
-            self.0.extend_from_slice(v);
-            self
-        }
-        fn header(
-            &mut self,
-            event_type: i32,
-            ts: f64,
-            dc: &[u8],
-            tenant: Option<&[u8]>,
-        ) -> &mut Self {
-            self.i32(event_type).f64(ts).bytes(dc);
-            match tenant {
-                Some(t) => self.u8(1).bytes(t),
-                None => self.u8(0),
-            }
-        }
-        /// Commit request body with one read range, one write range, one set mutation.
-        fn commit_request(&mut self, span: Option<&[u8]>) -> &mut Self {
-            self.u32(1).bytes(&key(b"r")).bytes(&key(b"s"));
-            self.u32(1).bytes(&key(b"w")).bytes(&key(b"x"));
-            self.u32(1).u8(0).bytes(&key(b"k")).bytes(b"v");
-            self.i64(42).u8(1).u8(0);
-            match span {
-                Some(s) => {
-                    self.u8(1);
-                    self.0.extend_from_slice(s);
-                    self
-                }
-                None => self.u8(0),
-            }
-        }
-    }
-
-    fn header(ts: f64) -> EventHeader {
-        EventHeader {
-            start_timestamp: ts,
-            dc_id: Vec::new(),
-            tenant: None,
-        }
-    }
-
-    fn expected_request(span_context: Option<SpanContext>) -> CommitRequest {
-        CommitRequest {
-            read_conflict_ranges: vec![KeyRange {
-                begin: key(b"r"),
-                end: key(b"s"),
-            }],
-            write_conflict_ranges: vec![KeyRange {
-                begin: key(b"w"),
-                end: key(b"x"),
-            }],
-            mutations: vec![Mutation {
-                mutation_type: 0,
-                param1: key(b"k"),
-                param2: b"v".to_vec(),
-            }],
-            read_snapshot: 42,
-            report_conflicting_keys: true,
-            lock_aware: false,
-            span_context,
-        }
-    }
-
-    /// One blob with every event type, in type order.
-    fn all_events_blob() -> Vec<u8> {
-        let mut w = W::version(ProtocolVersion::V7_4);
-        w.header(0, 1.0, b"dc1", Some(b"tenant"))
-            .f64(0.5)
-            .u32(2)
-            .i64(100);
-        w.header(1, 2.0, b"", None)
-            .f64(0.25)
-            .i32(7)
-            .bytes(&key(b"a"));
-        w.header(2, 3.0, b"", None)
-            .f64(0.125)
-            .i32(99)
-            .bytes(&key(b"a"))
-            .bytes(&key(b"z"));
-        w.header(3, 4.0, b"", None)
-            .f64(1.5)
-            .i32(1)
-            .i32(30)
-            .i64(200)
-            .commit_request(None);
-        w.header(4, 5.0, b"", None).i32(1007).bytes(&key(b"g"));
-        w.header(5, 6.0, b"", None)
-            .i32(1009)
-            .bytes(&key(b"b"))
-            .bytes(&key(b"e"));
-        w.header(6, 7.0, b"", None).i32(1020).commit_request(None);
-        w.0
-    }
-
-    #[test]
-    fn decodes_every_event_type() {
-        let (version, events) = decode_events(&all_events_blob()).unwrap();
-        assert_eq!(version, ProtocolVersion::V7_4);
-        assert_eq!(
-            events,
-            vec![
-                Event::GetVersion(GetVersion {
-                    header: EventHeader {
-                        start_timestamp: 1.0,
-                        dc_id: b"dc1".to_vec(),
-                        tenant: Some(b"tenant".to_vec()),
-                    },
-                    latency: 0.5,
-                    priority: 2,
-                    read_version: 100,
-                }),
-                Event::Get(Get {
-                    header: header(2.0),
-                    latency: 0.25,
-                    value_size: 7,
-                    key: key(b"a"),
-                }),
-                Event::GetRange(GetRange {
-                    header: header(3.0),
-                    latency: 0.125,
-                    range_size: 99,
-                    range: KeyRange {
-                        begin: key(b"a"),
-                        end: key(b"z"),
-                    },
-                }),
-                Event::Commit(Commit {
-                    header: header(4.0),
-                    latency: 1.5,
-                    num_mutations: 1,
-                    commit_bytes: 30,
-                    commit_version: 200,
-                    request: expected_request(None),
-                }),
-                Event::GetError(GetError {
-                    header: header(5.0),
-                    error_code: 1007,
-                    key: key(b"g"),
-                }),
-                Event::GetRangeError(GetRangeError {
-                    header: header(6.0),
-                    error_code: 1009,
-                    range: KeyRange {
-                        begin: key(b"b"),
-                        end: key(b"e"),
-                    },
-                }),
-                Event::CommitError(CommitError {
-                    header: header(7.0),
-                    error_code: 1020,
-                    request: expected_request(None),
-                }),
-            ]
-        );
-        assert_eq!(events[3].header().start_timestamp, 4.0);
-    }
-
-    #[test]
-    fn span_context_is_uid_in_7_1_and_otel_from_7_2() {
-        let mut uid = Vec::new();
-        uid.extend_from_slice(&1u64.to_le_bytes());
-        uid.extend_from_slice(&2u64.to_le_bytes());
-        let mut otel = uid.clone();
-        otel.extend_from_slice(&3u64.to_le_bytes());
-        otel.push(1);
-
-        let cases = [
-            (ProtocolVersion::V7_1, &uid, 0, 0),
-            (ProtocolVersion::V7_2, &otel, 3, 1),
-            (ProtocolVersion::V7_3, &otel, 3, 1),
-            (ProtocolVersion::V7_4, &otel, 3, 1),
-        ];
-        for (version, span, span_id, flags) in cases {
-            let mut w = W::version(version);
-            w.header(6, 1.0, b"", None)
-                .i32(1020)
-                .commit_request(Some(span));
-            let (_, events) = decode_events(&w.0).unwrap();
-            let expected = Some(SpanContext {
-                trace_id: [1, 2],
-                span_id,
-                flags,
-            });
-            assert_eq!(
-                events,
-                vec![Event::CommitError(CommitError {
-                    header: header(1.0),
-                    error_code: 1020,
-                    request: expected_request(expected),
-                })],
-                "{version:?}"
-            );
-        }
-    }
-
-    /// Commit event whose request carries the given raw conflict range and mutation bytes.
-    fn commit_with(range: &[u8], mutation: &[u8]) -> Vec<u8> {
-        let mut w = W::version(ProtocolVersion::V7_4);
-        w.header(3, 1.0, b"", None).f64(0.0).i32(1).i32(1).i64(1);
-        w.u32(0).u32(1);
-        w.0.extend_from_slice(range);
-        w.u32(1);
-        w.0.extend_from_slice(mutation);
-        w.i64(0).u8(0).u8(0).u8(0);
-        w.0
-    }
-
-    fn commit_request_of(blob: &[u8]) -> Result<CommitRequest, DecodeError> {
-        match decode_events(blob)?.1.pop() {
-            Some(Event::Commit(c)) => Ok(c.request),
-            other => panic!("unexpected {other:?}"),
-        }
-    }
-
-    fn range_bytes(begin: &[u8], end: &[u8]) -> Vec<u8> {
-        let mut w = W::default();
-        w.bytes(begin).bytes(end);
-        w.0
-    }
-
-    fn mutation_bytes(t: u8, p1: &[u8], p2: &[u8]) -> Vec<u8> {
-        let mut w = W::default();
-        w.u8(t).bytes(p1).bytes(p2);
-        w.0
-    }
-
-    #[test]
-    fn expands_single_key_encodings() {
-        let k0 = key(b"k\x00");
-        let req = commit_request_of(&commit_with(
-            &range_bytes(&k0, b""),
-            &mutation_bytes(1, &k0, b""),
-        ))
-        .unwrap();
-        let single = KeyRange {
-            begin: key(b"k"),
-            end: k0.clone(),
-        };
-        assert_eq!(req.write_conflict_ranges, vec![single]);
-        assert_eq!(
-            req.mutations,
-            vec![Mutation {
-                mutation_type: 1,
-                param1: key(b"k"),
-                param2: k0,
-            }]
-        );
-    }
-
-    #[test]
-    fn strips_mutation_checksums() {
-        let range = range_bytes(b"a", b"b");
-        let expected = Mutation {
-            mutation_type: 0,
-            param1: key(b"k"),
-            param2: b"value".to_vec(),
-        };
-        // checksum only
-        let m = mutation_bytes(0x80, &key(b"k"), b"value\x01\x02\x03\x04");
-        let req = commit_request_of(&commit_with(&range, &m)).unwrap();
-        assert_eq!(req.mutations, vec![expected.clone()]);
-        // checksum + accumulative checksum index
-        let m = mutation_bytes(0xC0, &key(b"k"), b"value\x01\x02\x03\x04\x05\x06");
-        let req = commit_request_of(&commit_with(&range, &m)).unwrap();
-        assert_eq!(req.mutations, vec![expected]);
-        // single-key clear with checksum: param2 is empty plus the checksum
-        let k0 = key(b"k\x00");
-        let m = mutation_bytes(0x81, &k0, b"\x01\x02\x03\x04");
-        let req = commit_request_of(&commit_with(&range, &m)).unwrap();
-        assert_eq!(
-            req.mutations,
-            vec![Mutation {
-                mutation_type: 1,
-                param1: key(b"k"),
-                param2: k0,
-            }]
-        );
-    }
-
-    #[test]
-    fn rejects_malformed_ranges_and_mutations() {
-        let good_range = range_bytes(b"a", b"b");
-        let err = commit_request_of(&commit_with(
-            &range_bytes(b"k", b""),
-            &mutation_bytes(0, b"k", b"v"),
-        ));
-        assert!(matches!(err, Err(DecodeError::MalformedKeyRange { .. })));
-        let err = commit_request_of(&commit_with(
-            &good_range,
-            &mutation_bytes(0x80, b"k", b"abc"),
-        ));
-        assert!(matches!(err, Err(DecodeError::MalformedMutation { .. })));
-        let err = commit_request_of(&commit_with(
-            &good_range,
-            &mutation_bytes(0xC0, b"k", b"abcde"),
-        ));
-        assert!(matches!(err, Err(DecodeError::MalformedMutation { .. })));
-    }
-
-    /// Mirrors `MutationRef::serialize`: a single-key clear whose `param1` does not end in
-    /// `\x00` is only traced as an error server-side, not treated as fatal. The mutation is
-    /// still expanded, same as a well-formed single-key clear.
-    #[test]
-    fn expands_single_key_clear_with_bad_param1_instead_of_erroring() {
-        let good_range = range_bytes(b"a", b"b");
-        let req =
-            commit_request_of(&commit_with(&good_range, &mutation_bytes(1, b"k", b""))).unwrap();
-        assert_eq!(
-            req.mutations,
-            vec![Mutation {
-                mutation_type: 1,
-                param1: Vec::new(),
-                param2: b"k".to_vec(),
-            }]
-        );
-    }
-
-    #[test]
-    fn rejects_unsupported_versions_and_unknown_events() {
-        for v in [
-            0x0FDB_00B0_6301_0001u64, // 6.3
-            0x0FDB_00B0_7001_0001,    // 7.0
-            0x0FDB_00B0_7500_0000,    // unknown future
-            0,
-        ] {
-            assert_eq!(
-                decode_events(&v.to_le_bytes()),
-                Err(DecodeError::UnsupportedProtocolVersion(v))
-            );
-        }
-        let mut w = W::version(ProtocolVersion::V7_4);
-        w.i32(7);
-        assert_eq!(decode_events(&w.0), Err(DecodeError::UnknownEventType(7)));
-        let mut w = W::version(ProtocolVersion::V7_4);
-        w.i32(-1);
-        assert_eq!(decode_events(&w.0), Err(DecodeError::UnknownEventType(-1)));
-    }
-
-    #[test]
-    fn empty_event_list_is_ok() {
-        let blob = ProtocolVersion::V7_1.0.to_le_bytes();
-        assert_eq!(
-            decode_events(&blob),
-            Ok((ProtocolVersion::V7_1, Vec::new()))
-        );
-    }
-
-    #[test]
-    fn every_truncation_errors_without_panic() {
-        let blob = all_events_blob();
-        let (_, full) = decode_events(&blob).unwrap();
-        for len in 0..blob.len() {
-            match decode_events(&blob[..len]) {
-                Ok((_, events)) => assert!(events.len() < full.len(), "len {len}"),
-                Err(DecodeError::UnexpectedEof {
-                    offset,
-                    needed,
-                    remaining,
-                }) => {
-                    assert!(offset <= len && remaining < needed, "len {len}");
-                }
-                Err(e) => panic!("len {len}: unexpected {e:?}"),
-            }
-        }
-    }
-
-    #[test]
-    fn huge_lengths_and_counts_do_not_allocate() {
-        // a key length of u32::MAX
-        let mut w = W::version(ProtocolVersion::V7_4);
-        w.header(1, 1.0, b"", None).f64(0.0).i32(0).u32(u32::MAX);
-        assert!(matches!(
-            decode_events(&w.0),
-            Err(DecodeError::UnexpectedEof { needed, .. }) if needed == u32::MAX as usize
-        ));
-        // conflict range and mutation counts of u32::MAX
-        for prefix_vectors in 0..3 {
-            let mut w = W::version(ProtocolVersion::V7_4);
-            w.header(6, 1.0, b"", None).i32(1020);
-            for _ in 0..prefix_vectors {
-                w.u32(0);
-            }
-            w.u32(u32::MAX).bytes(b"a").bytes(b"b");
-            assert!(matches!(
-                decode_events(&w.0),
-                Err(DecodeError::UnexpectedEof { .. })
-            ));
-        }
-    }
-
-    #[test]
-    fn random_garbage_never_panics() {
-        // xorshift64, deterministic
-        let mut state = 0x9E37_79B9_7F4A_7C15u64;
-        let mut next = move || {
-            state ^= state << 13;
-            state ^= state >> 7;
-            state ^= state << 17;
-            state
-        };
-        let valid = all_events_blob();
-        for i in 0..20_000 {
-            let blob = if i % 2 == 0 {
-                // pure garbage after a valid version
-                let mut blob = ProtocolVersion::V7_4.0.to_le_bytes().to_vec();
-                let len = (next() % 256) as usize;
-                blob.extend((0..len).map(|_| next() as u8));
-                blob
-            } else {
-                // a valid blob with a few corrupted bytes
-                let mut blob = valid.clone();
-                for _ in 0..(1 + next() % 4) {
-                    let pos = 8 + (next() as usize) % (blob.len() - 8);
-                    blob[pos] = next() as u8;
-                }
-                blob
-            };
-            let _ = decode_events(&blob);
-        }
-    }
-
-    const COMMIT_FIXTURE: &[u8] = include_bytes!("../tests/fixtures/commit_7_4.bin");
-    const COMMIT_ERROR_FIXTURE: &[u8] = include_bytes!("../tests/fixtures/commit_error_7_4.bin");
-
-    /// Captured from a 7.4.6 cluster: get, get_range, then set/clear/clear_range/atomic add
-    /// in one committed transaction.
-    #[test]
-    fn decodes_real_commit_fixture() {
-        let (version, events) = decode_events(COMMIT_FIXTURE).unwrap();
-        assert_eq!(version, ProtocolVersion::V7_4);
-        assert_eq!(events.len(), 4);
-        for e in &events {
-            assert!(e.header().dc_id.is_empty());
-            assert_eq!(e.header().tenant, None);
-            assert!(e.header().start_timestamp > 1.7e9);
-        }
-        let Event::GetVersion(grv) = &events[0] else {
-            panic!("{:?}", events[0])
-        };
-        assert_eq!((grv.priority, grv.read_version), (0, 228403251085));
-        let Event::Get(get) = &events[1] else {
-            panic!("{:?}", events[1])
-        };
-        assert_eq!(
-            (get.key.as_slice(), get.value_size),
-            (key(b"a").as_slice(), 0)
-        );
-        let Event::GetRange(range) = &events[2] else {
-            panic!("{:?}", events[2])
-        };
-        assert_eq!(
-            range.range,
-            KeyRange {
-                begin: key(b"a\x00"),
-                end: key(b"z"),
-            }
-        );
-        let Event::Commit(commit) = &events[3] else {
-            panic!("{:?}", events[3])
-        };
-        assert_eq!(commit.num_mutations, 5);
-        assert_eq!(commit.commit_bytes, 415);
-        assert_eq!(commit.commit_version, 228403870263);
-        let req = &commit.request;
-        assert_eq!(req.read_snapshot, 228403251085);
-        assert!(!req.report_conflicting_keys && !req.lock_aware);
-        assert_eq!(req.span_context, None);
-        let r = |b: &[u8], e: &[u8]| KeyRange {
-            begin: key(b),
-            end: key(e),
-        };
-        assert_eq!(req.read_conflict_ranges, vec![r(b"a", b"z")]);
-        assert_eq!(
-            req.write_conflict_ranges,
-            vec![r(b"a", b"a\x00"), r(b"b", b"b\x00"), r(b"c", b"d")]
-        );
-        let m = |t: u8, p1: Vec<u8>, p2: Vec<u8>| Mutation {
-            mutation_type: t,
-            param1: p1,
-            param2: p2,
-        };
-        assert_eq!(
-            req.mutations,
-            vec![
-                m(1, key(b"b"), key(b"b\x00")),
-                m(1, key(b"c"), key(b"counter")),
-                m(1, key(b"counter\x00"), key(b"d")),
-                m(0, key(b"a"), b"value-a".to_vec()),
-                // the add on a key cleared in the same transaction is folded into a set
-                m(0, key(b"counter"), 1i64.to_le_bytes().to_vec()),
-            ]
-        );
-    }
-
-    /// Captured from a 7.4.6 cluster: a transaction that read a key another transaction
-    /// then wrote, failing its commit with `not_committed`.
-    #[test]
-    fn decodes_real_commit_error_fixture() {
-        let (version, events) = decode_events(COMMIT_ERROR_FIXTURE).unwrap();
-        assert_eq!(version, ProtocolVersion::V7_4);
-        assert_eq!(events.len(), 3);
-        assert!(matches!(events[0], Event::GetVersion(_)));
-        let Event::Get(get) = &events[1] else {
-            panic!("{:?}", events[1])
-        };
-        assert_eq!(get.key, key(b"conflict"));
-        let Event::CommitError(err) = &events[2] else {
-            panic!("{:?}", events[2])
-        };
-        assert_eq!(err.error_code, 1020);
-        let req = &err.request;
-        assert_eq!(
-            req.read_conflict_ranges[0],
-            KeyRange {
-                begin: key(b"conflict"),
-                end: key(b"conflict\x00"),
-            }
-        );
-        assert!(req.write_conflict_ranges.contains(&KeyRange {
-            begin: key(b"other"),
-            end: key(b"other\x00"),
-        }));
-        assert_eq!(
-            req.mutations,
-            vec![Mutation {
-                mutation_type: 0,
-                param1: key(b"other"),
-                param2: b"y".to_vec(),
-            }]
-        );
-    }
-}
diff --git a/bindings/rust/foundationdb-profiling/src/event.rs b/bindings/rust/foundationdb-profiling/src/event.rs
deleted file mode 100644
index 898e9a610c0..00000000000
--- a/bindings/rust/foundationdb-profiling/src/event.rs
+++ /dev/null
@@ -1,258 +0,0 @@
-//! Typed client profiling events.
-//!
-//! These types mirror the `FdbClientLogEvents` structures written by the FoundationDB
-//! C++ client (`fdbclient/include/fdbclient/ClientLogEvents.h`) for protocol versions
-//! 7.1 and later. They are produced by [`crate::decode_events`].
-
-/// FoundationDB protocol version stored at the start of every profiling blob.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-pub struct ProtocolVersion(pub u64);
-
-impl ProtocolVersion {
-    /// Protocol version written by 7.1 clients.
-    pub const V7_1: ProtocolVersion = ProtocolVersion(0x0FDB_00B0_7101_0000);
-    /// Protocol version written by 7.2 clients.
-    pub const V7_2: ProtocolVersion = ProtocolVersion(0x0FDB_00B0_7200_0000);
-    /// Protocol version written by 7.3 clients.
-    pub const V7_3: ProtocolVersion = ProtocolVersion(0x0FDB_00B0_7300_0000);
-    /// Protocol version written by 7.4 clients.
-    pub const V7_4: ProtocolVersion = ProtocolVersion(0x0FDB_00B0_7400_0000);
-}
-
-/// A key range `[begin, end)`.
-#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
-pub struct KeyRange {
-    /// Inclusive start key.
-    pub begin: Vec<u8>,
-    /// Exclusive end key.
-    pub end: Vec<u8>,
-}
-
-/// Fields shared by every event (`FdbClientLogEvents::Event`).
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct EventHeader {
-    /// Client-side start time of the operation, in seconds since the unix epoch.
-    pub start_timestamp: f64,
-    /// Datacenter id of the client, empty when unset.
-    pub dc_id: Vec<u8>,
-    /// Tenant name, when the operation ran in a tenant.
-    pub tenant: Option<Vec<u8>>,
-}
-
-/// One profiling event of a sampled transaction.
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub enum Event {
-    /// Read version acquisition (`GET_VERSION_LATENCY`).
-    GetVersion(GetVersion),
-    /// Point read (`GET_LATENCY`).
-    Get(Get),
-    /// Range read (`GET_RANGE_LATENCY`).
-    GetRange(GetRange),
-    /// Successful commit (`COMMIT_LATENCY`).
-    Commit(Commit),
-    /// Failed point read (`ERROR_GET`).
-    GetError(GetError),
-    /// Failed range read (`ERROR_GET_RANGE`).
-    GetRangeError(GetRangeError),
-    /// Failed commit (`ERROR_COMMIT`).
-    CommitError(CommitError),
-}
-
-impl Event {
-    /// Returns the header shared by all event kinds.
-    #[tracing::instrument(level = "trace", skip_all)]
-    pub fn header(&self) -> &EventHeader {
-        match self {
-            Event::GetVersion(e) => &e.header,
-            Event::Get(e) => &e.header,
-            Event::GetRange(e) => &e.header,
-            Event::Commit(e) => &e.header,
-            Event::GetError(e) => &e.header,
-            Event::GetRangeError(e) => &e.header,
-            Event::CommitError(e) => &e.header,
-        }
-    }
-}
-
-/// Read version acquisition (`EventGetVersion_V3`).
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct GetVersion {
-    /// Common event fields.
-    pub header: EventHeader,
-    /// Latency in seconds.
-    pub latency: f64,
-    /// `TransactionPriorityType`: 0 default, 1 batch, 2 immediate.
-    pub priority: u32,
-    /// The read version obtained.
-    pub read_version: i64,
-}
-
-/// Point read (`EventGet`).
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct Get {
-    /// Common event fields.
-    pub header: EventHeader,
-    /// Latency in seconds.
-    pub latency: f64,
-    /// Size in bytes of the returned value.
-    pub value_size: i32,
-    /// The key read.
-    pub key: Vec<u8>,
-}
-
-/// Range read (`EventGetRange`).
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct GetRange {
-    /// Common event fields.
-    pub header: EventHeader,
-    /// Latency in seconds.
-    pub latency: f64,
-    /// Size in bytes of the returned key-values.
-    pub range_size: i32,
-    /// The range read.
-    pub range: KeyRange,
-}
-
-/// Successful commit (`EventCommit_V2`).
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct Commit {
-    /// Common event fields.
-    pub header: EventHeader,
-    /// Latency in seconds.
-    pub latency: f64,
-    /// Number of mutations.
-    pub num_mutations: i32,
-    /// Size in bytes of the commit.
-    pub commit_bytes: i32,
-    /// Version at which the transaction committed.
-    pub commit_version: i64,
-    /// The commit request sent to the proxies.
-    pub request: CommitRequest,
-}
-
-/// Failed point read (`EventGetError`).
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct GetError {
-    /// Common event fields.
-    pub header: EventHeader,
-    /// FoundationDB error code.
-    pub error_code: i32,
-    /// The key read.
-    pub key: Vec<u8>,
-}
-
-/// Failed range read (`EventGetRangeError`).
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct GetRangeError {
-    /// Common event fields.
-    pub header: EventHeader,
-    /// FoundationDB error code.
-    pub error_code: i32,
-    /// The range read.
-    pub range: KeyRange,
-}
-
-/// Failed commit (`EventCommitError`).
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct CommitError {
-    /// Common event fields.
-    pub header: EventHeader,
-    /// FoundationDB error code (e.g. 1020 `not_committed` on conflict).
-    pub error_code: i32,
-    /// The commit request sent to the proxies.
-    pub request: CommitRequest,
-}
-
-/// The serialized part of a `CommitTransactionRequest` (its `CommitTransactionRef`).
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct CommitRequest {
-    /// Read conflict ranges.
-    pub read_conflict_ranges: Vec<KeyRange>,
-    /// Write conflict ranges.
-    pub write_conflict_ranges: Vec<KeyRange>,
-    /// Mutations, in commit order.
-    pub mutations: Vec<Mutation>,
-    /// Read version the transaction used for conflict detection.
-    pub read_snapshot: i64,
-    /// Whether the client asked for conflicting keys to be reported.
-    pub report_conflicting_keys: bool,
-    /// Whether the transaction was lock aware.
-    pub lock_aware: bool,
-    /// Tracing span context attached to the commit, if any.
-    pub span_context: Option<SpanContext>,
-}
-
-/// A mutation (`MutationRef`), normalized like the C++ deserializer does.
-///
-/// The optional mutation checksum and accumulative checksum index (7.4+, only when the
-/// client enables them) are stripped from `param2` and their flag bits cleared from
-/// `mutation_type`. A single-key clear, which the wire encodes compactly, is expanded back
-/// to `ClearRange(key, key + \x00)`.
-#[derive(Debug, Clone, PartialEq, Eq, Hash)]
-pub struct Mutation {
-    /// `MutationRef::Type` code (0 SetValue, 1 ClearRange, 2 AddValue, ...).
-    pub mutation_type: u8,
-    /// Key, or range begin for ClearRange.
-    pub param1: Vec<u8>,
-    /// Value/operand, or range end for ClearRange.
-    pub param2: Vec<u8>,
-}
-
-impl Mutation {
-    /// `MutationRef::Type::SetValue`.
-    pub const SET_VALUE: u8 = 0;
-    /// `MutationRef::Type::ClearRange`.
-    pub const CLEAR_RANGE: u8 = 1;
-    /// `MutationRef::Type::AddValue`.
-    pub const ADD_VALUE: u8 = 2;
-    /// `MutationRef::Type::And`.
-    pub const AND: u8 = 6;
-    /// `MutationRef::Type::Or`.
-    pub const OR: u8 = 7;
-    /// `MutationRef::Type::Xor`.
-    pub const XOR: u8 = 8;
-    /// `MutationRef::Type::AppendIfFits`.
-    pub const APPEND_IF_FITS: u8 = 9;
-    /// `MutationRef::Type::Max`.
-    pub const MAX: u8 = 12;
-    /// `MutationRef::Type::Min`.
-    pub const MIN: u8 = 13;
-    /// `MutationRef::Type::SetVersionstampedKey`.
-    pub const SET_VERSIONSTAMPED_KEY: u8 = 14;
-    /// `MutationRef::Type::SetVersionstampedValue`.
-    pub const SET_VERSIONSTAMPED_VALUE: u8 = 15;
-    /// `MutationRef::Type::ByteMin`.
-    pub const BYTE_MIN: u8 = 16;
-    /// `MutationRef::Type::ByteMax`.
-    pub const BYTE_MAX: u8 = 17;
-    /// `MutationRef::Type::MinV2`.
-    pub const MIN_V2: u8 = 18;
-    /// `MutationRef::Type::AndV2`.
-    pub const AND_V2: u8 = 19;
-    /// `MutationRef::Type::CompareAndClear`.
-    pub const COMPARE_AND_CLEAR: u8 = 20;
-}
-
-/// Tracing span context attached to a commit (`SpanContext`).
-///
-/// Protocol 7.1 only carries a 16 byte trace id (`Optional<UID>`): `span_id` and `flags`
-/// are then 0, as in the C++ deserializer. 7.2+ carries all three fields.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-pub struct SpanContext {
-    /// Trace id, as the two 64-bit halves of a `UID` (`first`, `second`).
-    pub trace_id: [u64; 2],
-    /// Span id.
-    pub span_id: u64,
-    /// `TraceFlags` (bit 0: sampled).
-    pub flags: u8,
-}
diff --git a/bindings/rust/foundationdb-profiling/src/lib.rs b/bindings/rust/foundationdb-profiling/src/lib.rs
deleted file mode 100644
index 6a0fe80ce7d..00000000000
--- a/bindings/rust/foundationdb-profiling/src/lib.rs
+++ /dev/null
@@ -1,159 +0,0 @@
-//! Read FoundationDB client transaction profiling data.
-//!
-//! When client profiling is enabled (`fdbcli> profile client set <rate> <size limit>`),
-//! every FoundationDB client samples transactions at the given rate and records their
-//! operations (read version, gets, range reads, commits and their errors). Every
-//! `CSI_STATUS_DELAY` (10 seconds by default) the client flushes the recorded
-//! transactions into the system keyspace under [`PROFILE_PREFIX`]
-//! (`\xff\x02/fdbClientInfo/client_latency/`), split in chunks keyed by versionstamp and
-//! transaction id. See the [transaction profiler documentation].
-//!
-//! This crate turns that keyspace into typed [`Event`]s. It does no I/O and depends on no
-//! version of the FoundationDB bindings: the application reads the rows with its own
-//! client, in its own transaction and retry loop, and hands them to
-//! [`ProfileScanner::read_page`], which reassembles and decodes the chunks of one page,
-//! decides where the page stops, and returns a resumable [`Cursor`]. Only records
-//! written by 7.1+ clients are decoded (see [`decode_events`]).
-//!
-//! # Example
-//!
-//! With the `foundationdb` crate:
-//!
-//! ```no_run
-//! use foundationdb::options::TransactionOption;
-//! use foundationdb::{ClientBudget, Database, FdbBindingError, KeySelector, RangeOption};
-//! use foundationdb_profiling::{Cursor, Page, ProfileScanner};
-//! use futures_util::TryStreamExt;
-//! use std::time::Duration;
-//!
-//! # async fn example(db: &Database) -> Result<(), FdbBindingError> {
-//! let scanner = ProfileScanner::new();
-//! let cursor = Cursor::beginning();
-//! let page: Page = db
-//!     .run(|trx, _| {
-//!         let scanner = scanner.clone();
-//!         let cursor = cursor.clone();
-//!         async move {
-//!             // Options are the caller's job: this crate never sets any.
-//!             trx.set_option(TransactionOption::ReadSystemKeys)?;
-//!             // Bound every page, well under the 5 second transaction lifetime.
-//!             trx.set_client_budget(ClientBudget {
-//!                 time_limit: Some(Duration::from_secs(2)),
-//!                 ..ClientBudget::default()
-//!             });
-//!             let range = scanner.range(&cursor);
-//!             let opt = RangeOption::from((
-//!                 KeySelector::first_greater_or_equal(range.begin.as_slice()),
-//!                 KeySelector::first_greater_or_equal(range.end.as_slice()),
-//!             ));
-//!             let rows = trx
-//!                 .get_ranges_keyvalues(opt, true)
-//!                 .map_ok(|kv| (kv.key().to_vec(), kv.value().to_vec()));
-//!             let page = scanner
-//!                 .read_page(&cursor, rows, || trx.check_client_budget().is_err())
-//!                 .await
-//!                 // FoundationDB errors go back to the retry loop, other errors are
-//!                 // boxed as a custom error.
-//!                 .map_err(|err| err.into_error(FdbBindingError::new_custom_error))?;
-//!             Ok::<_, FdbBindingError>(page)
-//!         }
-//!     })
-//!     .await?;
-//! for tx in &page.transactions {
-//!     println!("{} {:?}: {} events", tx.version, tx.id, tx.events.len());
-//! }
-//! // Persist `page.next.as_bytes()` to resume from there later.
-//! # Ok(())
-//! # }
-//! ```
-//!
-//! See `examples/top_keys.rs` for a runnable end-to-end example that pages through the
-//! whole keyspace and prints the hottest keys, ranges and write hot spots.
-//!
-//! # The caller's contract
-//!
-//! For each page, the caller reads exactly [`ProfileScanner::range`] of the page's
-//! cursor: forward, with snapshot reads and no row limit, both ends as
-//! `first_greater_or_equal` key selectors, and gives [`ProfileScanner::read_page`] the
-//! rows as a [`Stream`](futures_core::Stream) of `Result<(key, value), E>`. A row
-//! outside that range or out of key order fails the page with
-//! [`ScanError::InvalidRows`], and a stream error comes back as [`ScanError::Source`] so
-//! the caller can hand it to its retry loop.
-//!
-//! On that transaction:
-//!
-//! - `TransactionOption::ReadSystemKeys` (or its equivalent) is required, the data lives
-//!   in the system keyspace.
-//! - `TransactionOption::ReadLockAware` is required if the cluster may be locked (for
-//!   instance a DR secondary).
-//!
-//! # Bounding a page: the stop check
-//!
-//! The `should_stop` closure given to [`ProfileScanner::read_page`] is required, and is
-//! the only place where the caller bounds a page: a transaction budget as above, a row
-//! count, anything. [`ProfileScanner::read_page`] calls it after every row and stops as
-//! soon as it returns `true`; otherwise the page reads to the end of its range. Without
-//! a real bound, a large range can outlive the transaction and hit
-//! `transaction_too_old`. Base the check on a caller-pluggable clock rather than the
-//! wall clock when the code must be reproducible, for instance under simulation.
-//!
-//! # Paging and tailing
-//!
-//! [`Page::next`] is always a valid place to resume from, and [`Page::exhausted`] tells
-//! whether the page reached the end of its range (`false` when the stop check stopped
-//! it). To read a range in several transactions, loop on [`ProfileScanner::read_page`]
-//! with `cursor = page.next` until [`Page::exhausted`]: every transaction is returned
-//! once over the sequence of pages, even when the client wrote its chunks in two commits
-//! with other records in between, and even when a page stops between them: the next
-//! page resumes at the first chunk of the oldest incomplete record. A record is lost
-//! (reported as [`SkipReason::BrokenChunks`]) only when the stop check does not let a
-//! single page read from its cursor to the end of the records that overlap it (in
-//! practice, a single record cannot be read from the cursor before the caller says
-//! stop): the records still incomplete at that stop are broken, and the page still
-//! advances.
-//!
-//! To tail the keyspace, persist `page.next` ([`Cursor::as_bytes`] /
-//! [`Cursor::from_bytes`]) and keep polling from it: an exhausted page's cursor picks up
-//! the records flushed after it, including the second half of a record split across two
-//! commits. [`Cursor::at_version`] starts at a commit version, and
-//! [`ProfileScanner::end_version`] bounds a page by one. A transaction whose chunks
-//! straddle `end_version` is not returned by that bounded read, the cursor stays on its
-//! first chunk.
-//!
-//! Note that the version of a record is the one at which the client flushed it, some time
-//! after the profiled transaction ran.
-//!
-//! # When profiling data is flushed
-//!
-//! The C++ client records a sampled transaction's events when its native transaction is
-//! destroyed. With the `foundationdb` Rust bindings, that happens when the `Transaction`
-//! (or the `RetryableTransaction` of a `Database::run` closure) is dropped. In particular a
-//! `TransactionCommitError` owns the transaction and keeps it alive until the error is
-//! dropped (or recovered with `on_error`), so holding on to such errors delays the
-//! profiling data of the failed transaction. The data then reaches the keyspace at the
-//! client's next flush, up to `CSI_STATUS_DELAY` later.
-//!
-//! # Aggregation
-//!
-//! [`Aggregator`] counts the keys and ranges read and written by the transactions of one
-//! or more pages, like the Python `transaction_profiling_analyzer`.
-//!
-//! [transaction profiler documentation]: https://apple.github.io/foundationdb/transaction-profiler-analyzer.html
-
-#![warn(missing_docs)]
-
-mod aggregate;
-mod decode;
-mod event;
-mod reader;
-
-pub use aggregate::{Aggregator, Bucket, KeyCounts};
-pub use decode::{DecodeError, decode_events};
-pub use event::{
-    Commit, CommitError, CommitRequest, Event, EventHeader, Get, GetError, GetRange, GetRangeError,
-    GetVersion, KeyRange, Mutation, ProtocolVersion, SpanContext,
-};
-pub use reader::{
-    Cursor, InvalidCursor, PROFILE_PREFIX, Page, ProfileScanner, ProfiledTransaction, ScanError,
-    ScanRange, SkipReason, Skipped,
-};
diff --git a/bindings/rust/foundationdb-profiling/src/reader.rs b/bindings/rust/foundationdb-profiling/src/reader.rs
deleted file mode 100644
index ca4d4d15d77..00000000000
--- a/bindings/rust/foundationdb-profiling/src/reader.rs
+++ /dev/null
@@ -1,1664 +0,0 @@
-//! Paged, resumable reading of the client profiling keyspace.
-//!
-//! Every sampled transaction is stored as one or more chunks under
-//! `\xff\x02/fdbClientInfo/client_latency/`. A chunk key is laid out as:
-//!
-//! ```text
-//! PREFIX | versionstamp (10) | '/' | transaction id (16) | '/' | chunk (4, BE) | total (4, BE) | '/' | user id ...
-//! ```
-//!
-//! [`ProfileScanner::read_page`] consumes the rows of [`ProfileScanner::range`], read by
-//! the caller, reassembles the chunks of each transaction, decodes them with
-//! [`decode_events`] and returns a [`Page`] with a [`Cursor`] to resume from.
-
-use crate::decode::{DecodeError, decode_events};
-use crate::event::{Event, ProtocolVersion};
-use futures_core::Stream;
-use std::collections::HashMap;
-use std::future::poll_fn;
-use std::pin::pin;
-use tracing::instrument;
-
-/// Prefix of the client profiling keyspace.
-///
-/// Defined by the [C++ client](https://github.com/apple/foundationdb/blob/main/contrib/transaction_profiling_analyzer/transaction_profiling_analyzer.py#L421).
-pub const PROFILE_PREFIX: &[u8; 32] = b"\xff\x02/fdbClientInfo/client_latency/";
-
-/// Exclusive end of the client profiling keyspace (`strinc(PROFILE_PREFIX)`).
-const PROFILE_END: &[u8; 32] = b"\xff\x02/fdbClientInfo/client_latency0";
-
-const VERSIONSTAMP_LEN: usize = 10;
-const ID_LEN: usize = 16;
-const VERSIONSTAMP_START: usize = PROFILE_PREFIX.len();
-const VERSIONSTAMP_END: usize = VERSIONSTAMP_START + VERSIONSTAMP_LEN;
-const ID_START: usize = VERSIONSTAMP_END + 1;
-const ID_END: usize = ID_START + ID_LEN;
-const CHUNK_START: usize = ID_END + 1;
-const TOTAL_START: usize = CHUNK_START + 4;
-/// Shortest chunk key the [`Assembler`] can parse: everything up to the total chunk
-/// count.
-const MIN_KEY_LEN: usize = TOTAL_START + 4;
-
-/// Opaque, resumable and persistable position in the profiling keyspace: the key the next
-/// page starts reading from.
-///
-/// Persist it with [`Cursor::as_bytes`] and restore it with [`Cursor::from_bytes`] to
-/// resume reading later, for instance to tail the keyspace.
-#[derive(Debug, Clone, PartialEq, Eq, Hash)]
-pub struct Cursor {
-    /// Inclusive begin key of the next read, starts with [`PROFILE_PREFIX`].
-    key: Vec<u8>,
-}
-
-/// Bytes given to [`Cursor::from_bytes`] are not a serialized [`Cursor`].
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
-#[error("invalid profiling cursor")]
-pub struct InvalidCursor;
-
-impl Cursor {
-    /// Cursor at the beginning of the profiling keyspace.
-    #[instrument(level = "trace")]
-    pub fn beginning() -> Self {
-        Cursor {
-            key: PROFILE_PREFIX.to_vec(),
-        }
-    }
-
-    /// Cursor at the first record with a commit version greater than or equal to
-    /// `version`.
-    ///
-    /// The version is the one at which the profiling record was written by the client,
-    /// which is some time (up to the client's flush interval) after the profiled
-    /// transaction ran. Negative versions are treated as 0.
-    #[instrument(level = "trace")]
-    pub fn at_version(version: i64) -> Self {
-        Cursor {
-            key: version_key(version),
-        }
-    }
-
-    /// Serialized form of the cursor, to persist it.
-    #[instrument(level = "trace", skip_all)]
-    pub fn as_bytes(&self) -> &[u8] {
-        &self.key
-    }
-
-    /// Restores a cursor persisted with [`Cursor::as_bytes`].
-    ///
-    /// # Errors
-    ///
-    /// Returns [`InvalidCursor`] when `bytes` is not a serialized cursor.
-    #[instrument(level = "trace", skip_all, fields(len = bytes.len()))]
-    pub fn from_bytes(bytes: Vec<u8>) -> Result<Self, InvalidCursor> {
-        if bytes.starts_with(PROFILE_PREFIX) {
-            Ok(Cursor { key: bytes })
-        } else {
-            Err(InvalidCursor)
-        }
-    }
-
-    /// Inclusive begin key of the next read.
-    fn key(&self) -> &[u8] {
-        &self.key
-    }
-}
-
-/// `PROFILE_PREFIX | version (8, BE) | \x00\x00`: the first key of that version.
-fn version_key(version: i64) -> Vec<u8> {
-    let mut key = PROFILE_PREFIX.to_vec();
-    key.extend_from_slice(&version.max(0).to_be_bytes());
-    key.extend_from_slice(b"\x00\x00");
-    key
-}
-
-/// The key right after `key`.
-fn key_after(key: &[u8]) -> Vec<u8> {
-    [key, b"\x00"].concat()
-}
-
-/// Builds pages of profiling data from the rows its caller reads.
-///
-/// Holds no connection and does no I/O: the caller reads [`range`](Self::range) with its
-/// own FoundationDB client and hands the rows to [`read_page`](Self::read_page).
-#[derive(Debug, Clone, Default)]
-pub struct ProfileScanner {
-    end_version: Option<i64>,
-}
-
-/// The key range the caller must read for one page, see [`ProfileScanner::range`].
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ScanRange {
-    /// Inclusive begin key.
-    pub begin: Vec<u8>,
-    /// Exclusive end key.
-    pub end: Vec<u8>,
-}
-
-/// Error of [`ProfileScanner::read_page`].
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum ScanError<E> {
-    /// The row stream failed. Map it back to the caller's error, for instance to the
-    /// `FdbError` of a range read so that the caller's retry loop handles it.
-    #[error(transparent)]
-    Source(E),
-    /// The stream yielded a row outside [`ProfileScanner::range`], or a key not strictly
-    /// greater than the previous one: the caller did not read the range as required.
-    #[error("profiling row {key:?} is outside the scanned range or not after the previous row")]
-    InvalidRows {
-        /// Key of the offending row.
-        key: Vec<u8>,
-    },
-}
-
-impl<E> ScanError<E> {
-    /// Converts this error into the caller's error type: a stream error through `From`,
-    /// any other error boxed and passed to `custom`.
-    ///
-    /// The boxed error does not depend on `E`: it is a [`ScanError<std::convert::Infallible>`]
-    /// carrying the same variant data.
-    ///
-    /// With fdb-rs: `.map_err(|e| e.into_error(FdbBindingError::new_custom_error))?`, so a
-    /// failed range read reaches `db.run` as the original `FdbError` and is retried.
-    #[instrument(level = "trace", skip_all)]
-    pub fn into_error<T: From<E>>(
-        self,
-        custom: impl FnOnce(Box<dyn std::error::Error + Send + Sync>) -> T,
-    ) -> T {
-        match self {
-            ScanError::Source(err) => T::from(err),
-            ScanError::InvalidRows { key } => {
-                custom(Box::new(
-                    ScanError::<std::convert::Infallible>::InvalidRows { key },
-                ))
-            }
-        }
-    }
-}
-
-impl ProfileScanner {
-    /// A scanner with no [`end_version`](Self::end_version).
-    #[must_use]
-    #[instrument(level = "trace")]
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    /// Exclusive upper bound on the record commit version read by a page. Unset (the
-    /// default) reads to the end of the keyspace.
-    #[must_use]
-    #[instrument(level = "trace", skip_all)]
-    pub fn end_version(self, version: i64) -> Self {
-        ProfileScanner {
-            end_version: Some(version),
-        }
-    }
-
-    /// The key range the caller must read for the page starting at `cursor`, and give to
-    /// [`read_page`](Self::read_page): forward, with snapshot reads and no row limit,
-    /// from `begin` (inclusive) to `end` (exclusive), both as `first_greater_or_equal`
-    /// key selectors. The range is empty when `cursor` is at or past
-    /// [`end_version`](Self::end_version).
-    #[instrument(level = "trace", skip_all)]
-    pub fn range(&self, cursor: &Cursor) -> ScanRange {
-        let begin = cursor.key().to_vec();
-        let end = match self.end_version {
-            Some(version) => version_key(version),
-            None => PROFILE_END.to_vec(),
-        };
-        // never an inverted range
-        let end = end.max(begin.clone());
-        ScanRange { begin, end }
-    }
-}
-
-/// One sampled transaction, reassembled and decoded.
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct ProfiledTransaction {
-    /// Commit version of the profiling record (the first 8 bytes of `versionstamp`).
-    pub version: i64,
-    /// Versionstamp of the first chunk of the profiling record. The client can write the
-    /// chunks of one transaction in several commits, the later ones then carry greater
-    /// versionstamps.
-    pub versionstamp: [u8; 10],
-    /// Transaction id chosen by the client that sampled the transaction.
-    pub id: [u8; 16],
-    /// Protocol version of the client that wrote the record.
-    pub protocol_version: ProtocolVersion,
-    /// Events of the transaction, in the order the client recorded them.
-    pub events: Vec<Event>,
-}
-
-/// A transaction that could not be returned.
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct Skipped {
-    /// Versionstamp of the first chunk read of the profiling record.
-    pub versionstamp: [u8; 10],
-    /// Transaction id chosen by the client that sampled the transaction.
-    pub id: [u8; 16],
-    /// Why it was skipped.
-    pub reason: SkipReason,
-}
-
-/// Why a transaction was [`Skipped`].
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub enum SkipReason {
-    /// All chunks were read but the reassembled blob did not decode.
-    Decode(DecodeError),
-    /// Chunks are missing, out of order or inconsistent, or the page was stopped before
-    /// they were all read, so the blob could not be reassembled.
-    BrokenChunks,
-}
-
-/// Result of [`ProfileScanner::read_page`].
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct Page {
-    /// Decoded transactions, in the order they completed (the key of their last chunk).
-    pub transactions: Vec<ProfiledTransaction>,
-    /// Transactions that could not be returned, in the order they were detected.
-    pub skipped: Vec<Skipped>,
-    /// Where to resume. Always valid, also to tail the keyspace once `exhausted`.
-    pub next: Cursor,
-    /// Whether the row stream ended, that is the end of the range (`end_version` or the
-    /// end of the keyspace) was reached. `false` when the caller's stop check stopped
-    /// the page.
-    pub exhausted: bool,
-}
-
-impl ProfileScanner {
-    /// Builds one page of profiled transactions from `rows`, the rows of
-    /// [`range(cursor)`](Self::range) read by the caller, stopping when `should_stop`
-    /// says so.
-    ///
-    /// `rows` must yield exactly the key-value pairs of [`range(cursor)`](Self::range),
-    /// read forward, with snapshot reads and no row limit: every row inside the range,
-    /// in strictly increasing key order. A row outside the range or out of order fails
-    /// the page with [`ScanError::InvalidRows`]; an error of the stream fails it with
-    /// [`ScanError::Source`]. The stream ending means the end of the range was reached,
-    /// and the page is [`exhausted`](Page::exhausted).
-    ///
-    /// `should_stop` is where the caller bounds the page (a transaction budget, a row
-    /// count, anything): it is called after every row, and the page stops as soon as it
-    /// returns `true`, without polling `rows` again. Then:
-    ///
-    /// - With no transaction pending (all the chunks read so far belong to complete or
-    ///   broken transactions), [`Page::next`] points right after the last row.
-    /// - Otherwise [`Page::next`] points at the first chunk of the oldest pending
-    ///   transaction, before every transaction the page completed after it, which the
-    ///   page drops and the next one reads again. Such a transaction is returned whole
-    ///   by a later page, even when its chunks were written in two commits with other
-    ///   rows in between.
-    /// - When that position is `cursor` itself (a single transaction cannot be read from
-    ///   `cursor` before the caller says stop), the pending transactions are reported as
-    ///   [`SkipReason::BrokenChunks`] and [`Page::next`] points right after the last
-    ///   row, so every stopped page advances the cursor.
-    ///
-    /// Each transaction is returned once over a sequence of pages that each resume from
-    /// the previous [`Page::next`]; one is lost only in the last case above. The client
-    /// may write the chunks of one transaction in two consecutive commits (when a flush
-    /// exceeds the transaction size limit), with rows of other transactions in between.
-    /// When the range ends while such a transaction is still incomplete (its second
-    /// commit is not written yet, or lies beyond [`end_version`](Self::end_version)),
-    /// [`Page::next`] also points at its first chunk: a bounded read never returns such
-    /// a transaction, an unbounded read from that cursor does once it is complete.
-    ///
-    /// A chunk whose earlier chunks are missing is reported as
-    /// [`SkipReason::BrokenChunks`], once per transaction id and page, including chunks
-    /// of a transaction that began before the cursor the scan started from
-    /// ([`Cursor::beginning`], [`Cursor::at_version`]). A transaction that fails to
-    /// decode is reported in [`Page::skipped`] and does not fail the page.
-    ///
-    /// # Errors
-    ///
-    /// [`ScanError::Source`] with the stream's error, [`ScanError::InvalidRows`] when the
-    /// rows do not follow the contract above.
-    #[instrument(
-        level = "debug",
-        skip_all,
-        fields(
-            end_version = ?self.end_version,
-            rows,
-            transactions,
-            skipped,
-            exhausted,
-        )
-    )]
-    pub async fn read_page<S, K, V, E>(
-        &self,
-        cursor: &Cursor,
-        rows: S,
-        mut should_stop: impl FnMut() -> bool,
-    ) -> Result<Page, ScanError<E>>
-    where
-        S: Stream<Item = Result<(K, V), E>>,
-        K: AsRef<[u8]>,
-        V: AsRef<[u8]>,
-    {
-        let range = self.range(cursor);
-        let mut assembler = Assembler::new(cursor);
-        let mut rows = pin!(rows);
-        let mut read = 0usize;
-        let page = loop {
-            let Some(row) = poll_fn(|cx| rows.as_mut().poll_next(cx)).await else {
-                break assembler.finish(false);
-            };
-            let (key, value) = row.map_err(ScanError::Source)?;
-            let key = key.as_ref();
-            let in_order = assembler.last_key.as_deref().is_none_or(|last| key > last);
-            if key < range.begin.as_slice() || key >= range.end.as_slice() || !in_order {
-                return Err(ScanError::InvalidRows { key: key.to_vec() });
-            }
-            assembler.push(key, value.as_ref());
-            read += 1;
-            if should_stop() {
-                break assembler.finish(true);
-            }
-        };
-
-        let span = tracing::Span::current();
-        span.record("rows", read);
-        span.record("transactions", page.transactions.len());
-        span.record("skipped", page.skipped.len());
-        span.record("exhausted", page.exhausted);
-        Ok(page)
-    }
-}
-
-fn version_of(versionstamp: &[u8; 10]) -> i64 {
-    let mut version = [0u8; 8];
-    version.copy_from_slice(&versionstamp[..8]);
-    i64::from_be_bytes(version)
-}
-
-/// The fields of a chunk key.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-struct ChunkKey {
-    versionstamp: [u8; 10],
-    id: [u8; 16],
-    chunk: u32,
-    total: u32,
-}
-
-impl ChunkKey {
-    /// Parses a chunk key by offsets, ignoring what follows the total chunk count.
-    /// Returns `None` for a key that is too short or has misplaced separators.
-    fn parse(key: &[u8]) -> Option<Self> {
-        if key.len() < MIN_KEY_LEN
-            || !key.starts_with(PROFILE_PREFIX)
-            || key[VERSIONSTAMP_END] != b'/'
-            || key[ID_END] != b'/'
-        {
-            return None;
-        }
-        let mut versionstamp = [0u8; VERSIONSTAMP_LEN];
-        versionstamp.copy_from_slice(&key[VERSIONSTAMP_START..VERSIONSTAMP_END]);
-        let mut id = [0u8; ID_LEN];
-        id.copy_from_slice(&key[ID_START..ID_END]);
-        let be = |start: usize| {
-            let mut n = [0u8; 4];
-            n.copy_from_slice(&key[start..start + 4]);
-            u32::from_be_bytes(n)
-        };
-        Some(ChunkKey {
-            versionstamp,
-            id,
-            chunk: be(CHUNK_START),
-            total: be(TOTAL_START),
-        })
-    }
-}
-
-/// A reassembly outcome of the [`Assembler`].
-#[derive(Debug, Clone, PartialEq, Eq)]
-enum Assembled {
-    /// Every chunk of a transaction, concatenated.
-    Complete {
-        versionstamp: [u8; 10],
-        id: [u8; 16],
-        blob: Vec<u8>,
-    },
-    /// A transaction whose chunks could not be reassembled.
-    Broken {
-        versionstamp: [u8; 10],
-        id: [u8; 16],
-    },
-}
-
-/// An [`Assembled`] outcome with the keys of the rows it was made of.
-#[derive(Debug)]
-struct Output {
-    /// Key of the first row of the transaction read by this page.
-    first_key: Vec<u8>,
-    /// Key of the last row of the transaction read by this page: the one that produced
-    /// the outcome, or a later chunk of a broken transaction.
-    last_key: Vec<u8>,
-    assembled: Assembled,
-}
-
-/// A multi-chunk transaction being reassembled.
-#[derive(Debug)]
-struct Partial {
-    /// Key of its first chunk.
-    first_key: Vec<u8>,
-    id: [u8; 16],
-    /// Versionstamp of its first chunk.
-    versionstamp: [u8; 10],
-    /// Versionstamp of its last chunk so far.
-    last_versionstamp: [u8; 10],
-    total: u32,
-    next_chunk: u32,
-    /// Concatenated chunk values so far. Grows by the actual chunk lengths only, never by
-    /// the untrusted total chunk count.
-    blob: Vec<u8>,
-}
-
-/// Builds one [`Page`] from the rows of its range, fed in key order. Pure, no I/O:
-/// [`ProfileScanner::read_page`] feeds it the caller's rows and tells it where it stopped.
-///
-/// A multi-chunk transaction starts at chunk 1 and its chunks come in order 1..=total,
-/// with the same id and total and non-decreasing versionstamps: the client may write them
-/// in two commits, so rows of other transactions can sit in between. Anything else
-/// drops the partial buffer and reports the transaction as [`Assembled::Broken`], once
-/// per id until a new chunk 1 of that id.
-#[derive(Debug)]
-struct Assembler {
-    /// Where the page started.
-    start: Cursor,
-    /// Pending transactions by id.
-    partials: HashMap<[u8; 16], Partial>,
-    /// Ids reported as broken, with the index of their report in `outputs`, so that their
-    /// remaining chunks are consumed silently. A new chunk 1 of the id removes it.
-    broken: HashMap<[u8; 16], usize>,
-    /// Outcomes, in the order they were produced.
-    outputs: Vec<Output>,
-    /// Last row fed.
-    last_key: Option<Vec<u8>>,
-}
-
-impl Assembler {
-    fn new(start: &Cursor) -> Self {
-        Assembler {
-            start: start.clone(),
-            partials: HashMap::new(),
-            broken: HashMap::new(),
-            outputs: Vec::new(),
-            last_key: None,
-        }
-    }
-
-    /// Feeds one row.
-    fn push(&mut self, key: &[u8], value: &[u8]) {
-        self.last_key = Some(key.to_vec());
-        match ChunkKey::parse(key) {
-            Some(parsed) => self.process(parsed, key, value),
-            None => tracing::warn!(key = ?key, "ignoring unparseable profiling key"),
-        }
-    }
-
-    /// Processes a parsed row.
-    fn process(&mut self, parsed: ChunkKey, key: &[u8], value: &[u8]) {
-        if let Some(mut partial) = self.partials.remove(&parsed.id) {
-            if parsed.total == partial.total
-                && parsed.chunk == partial.next_chunk
-                && parsed.versionstamp >= partial.last_versionstamp
-            {
-                partial.blob.extend_from_slice(value);
-                if parsed.chunk == partial.total {
-                    self.outputs.push(Output {
-                        first_key: partial.first_key,
-                        last_key: key.to_vec(),
-                        assembled: Assembled::Complete {
-                            versionstamp: partial.versionstamp,
-                            id: parsed.id,
-                            blob: partial.blob,
-                        },
-                    });
-                    return;
-                }
-                // chunk < total, so this cannot overflow
-                partial.next_chunk += 1;
-                partial.last_versionstamp = parsed.versionstamp;
-                self.partials.insert(parsed.id, partial);
-                return;
-            }
-            self.report_broken(partial.first_key, partial.versionstamp, parsed.id, key);
-        }
-
-        if parsed.chunk == 1 && parsed.total >= 1 {
-            // a new transaction under this id, its chunks are no longer those of a broken one
-            self.broken.remove(&parsed.id);
-        }
-        if parsed.chunk == 1 && parsed.total == 1 {
-            self.outputs.push(Output {
-                first_key: key.to_vec(),
-                last_key: key.to_vec(),
-                assembled: Assembled::Complete {
-                    versionstamp: parsed.versionstamp,
-                    id: parsed.id,
-                    blob: value.to_vec(),
-                },
-            });
-            return;
-        }
-        if parsed.chunk == 1 && parsed.total > 1 {
-            self.partials.insert(
-                parsed.id,
-                Partial {
-                    first_key: key.to_vec(),
-                    id: parsed.id,
-                    versionstamp: parsed.versionstamp,
-                    last_versionstamp: parsed.versionstamp,
-                    total: parsed.total,
-                    next_chunk: 2,
-                    blob: value.to_vec(),
-                },
-            );
-        } else {
-            self.report_broken(key.to_vec(), parsed.versionstamp, parsed.id, key);
-        }
-    }
-
-    /// Reports `id` as broken, unless it already is: then `key` becomes the last row of
-    /// that report.
-    fn report_broken(
-        &mut self,
-        first_key: Vec<u8>,
-        versionstamp: [u8; 10],
-        id: [u8; 16],
-        key: &[u8],
-    ) {
-        if let Some(&index) = self.broken.get(&id) {
-            if let Some(output) = self.outputs.get_mut(index) {
-                output.last_key = key.to_vec();
-            }
-            return;
-        }
-        self.broken.insert(id, self.outputs.len());
-        self.outputs.push(Output {
-            first_key,
-            last_key: key.to_vec(),
-            assembled: Assembled::Broken { versionstamp, id },
-        });
-    }
-
-    /// Where the next page resumes to read again the transaction whose first chunk is at
-    /// `cut`: lowers `cut` to the first key of every outcome whose last row is at or after
-    /// it, up to a fixed point. Returns the cut and the indexes of those outcomes, which
-    /// the next page reports instead.
-    fn cut(&self, mut cut: Vec<u8>) -> (Vec<u8>, Vec<usize>) {
-        let mut by_last: Vec<usize> = (0..self.outputs.len()).collect();
-        by_last.sort_by(|&a, &b| self.outputs[b].last_key.cmp(&self.outputs[a].last_key));
-        let mut dropped = Vec::new();
-        for index in by_last {
-            let output = &self.outputs[index];
-            if output.last_key < cut {
-                break;
-            }
-            dropped.push(index);
-            if output.first_key < cut {
-                cut = output.first_key.clone();
-            }
-        }
-        (cut, dropped)
-    }
-
-    /// Builds the page. `stopped` tells whether the caller's check stopped it right after
-    /// its last row, rather than the end of its range.
-    ///
-    /// Pending transactions are left to the next page: it resumes at the
-    /// [`cut`](Self::cut) before them and reads them again. When the page was stopped and
-    /// that cut would not advance past the cursor, it resumes after the last row and
-    /// breaks them instead. With nothing pending, it resumes after the last row.
-    fn finish(mut self, stopped: bool) -> Page {
-        let mut pending: Vec<Partial> = std::mem::take(&mut self.partials).into_values().collect();
-        pending.sort_by(|a, b| a.first_key.cmp(&b.first_key));
-        let after_last = match &self.last_key {
-            Some(last) => key_after(last),
-            None => self.start.key().to_vec(),
-        };
-
-        let mut kept = vec![true; self.outputs.len()];
-        let cut = match pending.first() {
-            None => None,
-            Some(oldest) => {
-                let (cut, dropped) = self.cut(oldest.first_key.clone());
-                if stopped && cut.as_slice() <= self.start.key() {
-                    // a cut at the cursor would not progress: break the pending ones
-                    None
-                } else {
-                    for &index in &dropped {
-                        kept[index] = false;
-                    }
-                    tracing::debug!(
-                        pending = pending.len(),
-                        left_to_next_page = dropped.len(),
-                        stopped,
-                        "page ended with incomplete transactions"
-                    );
-                    Some(cut)
-                }
-            }
-        };
-        let next = match cut {
-            Some(cut) => cut,
-            None => {
-                // the page resumes after its last row: what is still pending cannot be
-                // reassembled (with no cut, only a stopped page has pending ones)
-                for partial in pending {
-                    tracing::debug!("breaking incomplete transaction at a stop");
-                    self.outputs.push(Output {
-                        last_key: partial.first_key.clone(),
-                        first_key: partial.first_key,
-                        assembled: Assembled::Broken {
-                            versionstamp: partial.versionstamp,
-                            id: partial.id,
-                        },
-                    });
-                    kept.push(true);
-                }
-                after_last
-            }
-        };
-
-        let mut transactions = Vec::new();
-        let mut skipped = Vec::new();
-        for (output, kept) in self.outputs.into_iter().zip(kept) {
-            if !kept {
-                continue;
-            }
-            match output.assembled {
-                Assembled::Complete {
-                    versionstamp,
-                    id,
-                    blob,
-                } => match decode_events(&blob) {
-                    Ok((protocol_version, events)) => transactions.push(ProfiledTransaction {
-                        version: version_of(&versionstamp),
-                        versionstamp,
-                        id,
-                        protocol_version,
-                        events,
-                    }),
-                    Err(err) => {
-                        tracing::debug!(error = %err, "skipping undecodable transaction");
-                        skipped.push(Skipped {
-                            versionstamp,
-                            id,
-                            reason: SkipReason::Decode(err),
-                        })
-                    }
-                },
-                Assembled::Broken { versionstamp, id } => {
-                    tracing::debug!("skipping transaction with broken chunks");
-                    skipped.push(Skipped {
-                        versionstamp,
-                        id,
-                        reason: SkipReason::BrokenChunks,
-                    })
-                }
-            }
-        }
-
-        Page {
-            transactions,
-            skipped,
-            next: Cursor { key: next },
-            exhausted: !stopped,
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use futures_util::{FutureExt, StreamExt, stream};
-    use std::cell::Cell;
-    use std::collections::BTreeSet;
-    use std::convert::Infallible;
-    use std::io;
-
-    fn vs(version: u64, batch: u16) -> [u8; 10] {
-        let mut out = [0u8; 10];
-        out[..8].copy_from_slice(&version.to_be_bytes());
-        out[8..].copy_from_slice(&batch.to_be_bytes());
-        out
-    }
-
-    fn id(n: u8) -> [u8; 16] {
-        [b'0' + n; 16]
-    }
-
-    fn key(versionstamp: [u8; 10], id: [u8; 16], chunk: u32, total: u32) -> Vec<u8> {
-        let mut key = PROFILE_PREFIX.to_vec();
-        key.extend_from_slice(&versionstamp);
-        key.push(b'/');
-        key.extend_from_slice(&id);
-        key.push(b'/');
-        key.extend_from_slice(&chunk.to_be_bytes());
-        key.extend_from_slice(&total.to_be_bytes());
-        key.extend_from_slice(b"/user-id");
-        key
-    }
-
-    type Row = (Vec<u8>, Vec<u8>);
-    type Rows = Vec<Row>;
-
-    /// Feeds all rows from the beginning, returns the outcomes and the first key of the
-    /// oldest pending transaction.
-    fn reassemble(rows: &[(Vec<u8>, Vec<u8>)]) -> (Vec<Assembled>, Option<Vec<u8>>) {
-        let mut assembler = Assembler::new(&Cursor::beginning());
-        for (k, v) in rows {
-            assembler.push(k, v);
-        }
-        let pending = assembler
-            .partials
-            .values()
-            .map(|p| p.first_key.clone())
-            .min();
-        let out = assembler.outputs.into_iter().map(|o| o.assembled).collect();
-        (out, pending)
-    }
-
-    fn complete(versionstamp: [u8; 10], id: [u8; 16], blob: &[u8]) -> Assembled {
-        Assembled::Complete {
-            versionstamp,
-            id,
-            blob: blob.to_vec(),
-        }
-    }
-
-    fn broken(versionstamp: [u8; 10], id: [u8; 16]) -> Assembled {
-        Assembled::Broken { versionstamp, id }
-    }
-
-    fn never() -> impl FnMut() -> bool {
-        || false
-    }
-
-    fn always() -> impl FnMut() -> bool {
-        || true
-    }
-
-    /// Stops at every `k`-th check.
-    fn every(k: usize) -> impl FnMut() -> bool {
-        let mut checks = 0;
-        move || {
-            checks += 1;
-            checks % k == 0
-        }
-    }
-
-    /// Stops after the `n`-th row of the page.
-    fn after(n: usize) -> impl FnMut() -> bool {
-        let mut checks = 0;
-        move || {
-            checks += 1;
-            checks >= n
-        }
-    }
-
-    /// Stops pseudo-randomly, about once every `m` checks, with a state shared by every
-    /// page so that consecutive pages stop at different rows.
-    fn random(state: &Cell<u64>, m: u64) -> impl FnMut() -> bool + '_ {
-        move || {
-            let next = state
-                .get()
-                .wrapping_mul(6_364_136_223_846_793_005)
-                .wrapping_add(1_442_695_040_888_963_407);
-            state.set(next);
-            (next >> 33) % m == 0
-        }
-    }
-
-    /// Runs `read_page` over `rows`, which must be ready (no I/O in these tests).
-    fn read<E>(
-        scanner: &ProfileScanner,
-        cursor: &Cursor,
-        rows: Vec<Result<Row, E>>,
-        should_stop: impl FnMut() -> bool,
-    ) -> Result<Page, ScanError<E>> {
-        scanner
-            .read_page(cursor, stream::iter(rows), should_stop)
-            .now_or_never()
-            .expect("a ready stream completes the page in one poll")
-    }
-
-    /// Runs one page over the sorted `rows`, feeding the ones of its range like a caller
-    /// honoring the contract of `read_page`.
-    fn run_page(rows: &Rows, cursor: &Cursor, should_stop: impl FnMut() -> bool) -> Page {
-        let scanner = ProfileScanner::new();
-        let range = scanner.range(cursor);
-        let rows = rows
-            .iter()
-            .filter(|(k, _)| *k >= range.begin && *k < range.end)
-            .cloned()
-            .map(Ok::<_, Infallible>)
-            .collect();
-        match read(&scanner, cursor, rows, should_stop) {
-            Ok(page) => page,
-            Err(err) => panic!("{err}"),
-        }
-    }
-
-    /// Runs pages until exhausted, each with a fresh stop check, returns every reported
-    /// transaction and skip.
-    fn run_pages<C: FnMut() -> bool>(
-        rows: &Rows,
-        mut should_stop: impl FnMut() -> C,
-    ) -> (Vec<ProfiledTransaction>, Vec<Skipped>) {
-        let mut cursor = Cursor::beginning();
-        let (mut txs, mut skipped) = (Vec::new(), Vec::new());
-        for _ in 0..10_000 {
-            let page = run_page(rows, &cursor, should_stop());
-            txs.extend(page.transactions);
-            skipped.extend(page.skipped);
-            let next = Cursor::from_bytes(page.next.as_bytes().to_vec()).unwrap();
-            assert_eq!(next, page.next);
-            if page.exhausted {
-                return (txs, skipped);
-            }
-            assert!(next.key() > cursor.key(), "no progress");
-            cursor = next;
-        }
-        panic!("pages never exhausted");
-    }
-
-    /// A valid blob with no event, split in `n` chunks.
-    fn blob_chunks(n: usize) -> Vec<Vec<u8>> {
-        let blob = ProtocolVersion::V7_4.0.to_le_bytes();
-        let size = blob.len().div_ceil(n);
-        let mut chunks: Vec<Vec<u8>> = blob.chunks(size).map(<[u8]>::to_vec).collect();
-        chunks.resize(n, Vec::new());
-        chunks
-    }
-
-    /// Rows of a transaction whose chunks are spread over the given versionstamps.
-    fn txn(id_n: u8, stamps: &[[u8; 10]]) -> Rows {
-        let total = stamps.len() as u32;
-        blob_chunks(stamps.len())
-            .into_iter()
-            .zip(stamps)
-            .enumerate()
-            .map(|(i, (chunk, stamp))| (key(*stamp, id(id_n), i as u32 + 1, total), chunk))
-            .collect()
-    }
-
-    fn txn_ids(txs: &[ProfiledTransaction]) -> Vec<[u8; 16]> {
-        txs.iter().map(|t| t.id).collect()
-    }
-
-    fn skipped_ids(skipped: &[Skipped]) -> Vec<[u8; 16]> {
-        skipped.iter().map(|s| s.id).collect()
-    }
-
-    #[test]
-    fn parses_real_key_layout() {
-        let k = key(vs(7, 1), id(1), 2, 3);
-        assert_eq!(
-            ChunkKey::parse(&k),
-            Some(ChunkKey {
-                versionstamp: vs(7, 1),
-                id: id(1),
-                chunk: 2,
-                total: 3,
-            })
-        );
-        // the tail after the chunk fields is ignored, and may be absent
-        assert!(ChunkKey::parse(&k[..MIN_KEY_LEN]).is_some());
-        for len in 0..MIN_KEY_LEN {
-            assert_eq!(ChunkKey::parse(&k[..len]), None, "len {len}");
-        }
-        let mut bad = k.clone();
-        bad[VERSIONSTAMP_END] = b'x';
-        assert_eq!(ChunkKey::parse(&bad), None);
-    }
-
-    #[test]
-    fn single_and_multi_chunk() {
-        let (out, pending) = reassemble(&[
-            (key(vs(1, 0), id(1), 1, 1), b"one".to_vec()),
-            (key(vs(1, 0), id(2), 1, 3), b"ab".to_vec()),
-            (key(vs(1, 0), id(2), 2, 3), b"cd".to_vec()),
-            (key(vs(1, 0), id(2), 3, 3), b"e".to_vec()),
-        ]);
-        assert_eq!(
-            out,
-            vec![
-                complete(vs(1, 0), id(1), b"one"),
-                complete(vs(1, 0), id(2), b"abcde")
-            ]
-        );
-        assert_eq!(pending, None);
-    }
-
-    #[test]
-    fn straddling_transaction_with_other_rows_in_between() {
-        // id 1 has chunks 1-2 in the first commit and chunk 3 in the second one, with
-        // rows of other transactions of both commits in between.
-        let (out, pending) = reassemble(&[
-            (key(vs(1, 0), id(1), 1, 3), b"a".to_vec()),
-            (key(vs(1, 0), id(1), 2, 3), b"b".to_vec()),
-            (key(vs(1, 0), id(2), 1, 1), b"B".to_vec()),
-            (key(vs(2, 0), id(0), 1, 1), b"Z".to_vec()),
-            (key(vs(2, 0), id(1), 3, 3), b"c".to_vec()),
-            (key(vs(2, 0), id(3), 1, 1), b"D".to_vec()),
-        ]);
-        assert_eq!(
-            out,
-            vec![
-                complete(vs(1, 0), id(2), b"B"),
-                complete(vs(2, 0), id(0), b"Z"),
-                complete(vs(1, 0), id(1), b"abc"),
-                complete(vs(2, 0), id(3), b"D"),
-            ]
-        );
-        assert_eq!(pending, None);
-    }
-
-    #[test]
-    fn straddler_with_many_rows_in_between_completes() {
-        let mut rows: Rows = vec![(key(vs(1, 0), id(1), 1, 2), b"a".to_vec())];
-        for batch in 1..=5000 {
-            rows.push((key(vs(1, batch), id(2), 1, 1), vec![0; 100]));
-        }
-        rows.push((key(vs(2, 0), id(1), 2, 2), b"b".to_vec()));
-        let (out, pending) = reassemble(&rows);
-        assert_eq!(out.len(), 5001);
-        assert!(out.iter().all(|o| matches!(o, Assembled::Complete { .. })));
-        assert_eq!(out.last(), Some(&complete(vs(1, 0), id(1), b"ab")));
-        assert_eq!(pending, None);
-    }
-
-    #[test]
-    fn interleaved_transactions_both_complete() {
-        let (out, _) = reassemble(&[
-            (key(vs(1, 0), id(1), 1, 2), b"a".to_vec()),
-            (key(vs(1, 0), id(2), 1, 2), b"x".to_vec()),
-            (key(vs(2, 0), id(1), 2, 2), b"b".to_vec()),
-            (key(vs(2, 0), id(2), 2, 2), b"y".to_vec()),
-        ]);
-        assert_eq!(
-            out,
-            vec![
-                complete(vs(1, 0), id(1), b"ab"),
-                complete(vs(1, 0), id(2), b"xy")
-            ]
-        );
-    }
-
-    #[test]
-    fn missing_chunk_is_broken_once() {
-        let (out, pending) = reassemble(&[
-            (key(vs(1, 0), id(1), 1, 4), b"a".to_vec()),
-            (key(vs(1, 0), id(1), 2, 4), b"b".to_vec()),
-            (key(vs(1, 0), id(1), 4, 4), b"d".to_vec()),
-            (key(vs(1, 0), id(2), 1, 1), b"B".to_vec()),
-        ]);
-        assert_eq!(
-            out,
-            vec![broken(vs(1, 0), id(1)), complete(vs(1, 0), id(2), b"B")]
-        );
-        assert_eq!(pending, None);
-    }
-
-    #[test]
-    fn orphan_chunks_are_broken_once() {
-        let (out, _) = reassemble(&[
-            (key(vs(1, 0), id(1), 2, 3), b"b".to_vec()),
-            (key(vs(1, 0), id(1), 3, 3), b"c".to_vec()),
-            (key(vs(1, 0), id(2), 1, 1), b"B".to_vec()),
-        ]);
-        assert_eq!(
-            out,
-            vec![broken(vs(1, 0), id(1)), complete(vs(1, 0), id(2), b"B")]
-        );
-    }
-
-    #[test]
-    fn out_of_order_or_inconsistent_chunks_are_broken() {
-        let (out, _) = reassemble(&[
-            (key(vs(1, 0), id(1), 1, 3), b"a".to_vec()),
-            (key(vs(1, 0), id(1), 3, 3), b"c".to_vec()),
-            (key(vs(1, 0), id(1), 2, 3), b"b".to_vec()),
-        ]);
-        assert_eq!(out, vec![broken(vs(1, 0), id(1))]);
-        // other total
-        let (out, _) = reassemble(&[
-            (key(vs(1, 0), id(1), 1, 2), b"a".to_vec()),
-            (key(vs(1, 0), id(1), 2, 3), b"b".to_vec()),
-        ]);
-        assert_eq!(out, vec![broken(vs(1, 0), id(1))]);
-        // decreasing versionstamp (only possible with rows fed out of key order)
-        let (out, _) = reassemble(&[
-            (key(vs(2, 0), id(1), 1, 2), b"a".to_vec()),
-            (key(vs(1, 0), id(1), 2, 2), b"b".to_vec()),
-        ]);
-        assert_eq!(out, vec![broken(vs(2, 0), id(1))]);
-    }
-
-    #[test]
-    fn chunk_one_restarts_a_pending_transaction() {
-        let (out, _) = reassemble(&[
-            (key(vs(1, 0), id(1), 1, 2), b"a".to_vec()),
-            (key(vs(2, 0), id(1), 1, 2), b"x".to_vec()),
-            (key(vs(2, 0), id(1), 2, 2), b"y".to_vec()),
-        ]);
-        assert_eq!(
-            out,
-            vec![broken(vs(1, 0), id(1)), complete(vs(2, 0), id(1), b"xy")]
-        );
-    }
-
-    #[test]
-    fn nonsense_chunk_numbers_are_broken() {
-        for (chunk, total) in [(0, 0), (0, 1), (1, 0), (2, 1), (u32::MAX, u32::MAX)] {
-            let (out, _) = reassemble(&[(key(vs(1, 0), id(1), chunk, total), b"a".to_vec())]);
-            assert_eq!(out, vec![broken(vs(1, 0), id(1))], "{chunk}/{total}");
-        }
-        // a huge total does not allocate for it
-        let k = key(vs(1, 0), id(1), 1, u32::MAX);
-        let (out, pending) = reassemble(&[(k.clone(), b"a".to_vec())]);
-        assert_eq!(out, vec![]);
-        assert_eq!(pending, Some(k));
-    }
-
-    #[test]
-    fn reused_id_that_breaks_again_is_reported_again() {
-        let (out, pending) = reassemble(&[
-            (key(vs(1, 0), id(1), 1, 3), b"a".to_vec()),
-            (key(vs(1, 0), id(1), 3, 3), b"c".to_vec()),
-            (key(vs(2, 0), id(1), 1, 3), b"a".to_vec()),
-            (key(vs(2, 0), id(1), 3, 3), b"c".to_vec()),
-            (key(vs(3, 0), id(1), 1, 1), b"x".to_vec()),
-            (key(vs(4, 0), id(1), 2, 2), b"y".to_vec()),
-        ]);
-        assert_eq!(
-            out,
-            vec![
-                broken(vs(1, 0), id(1)),
-                broken(vs(2, 0), id(1)),
-                complete(vs(3, 0), id(1), b"x"),
-                broken(vs(4, 0), id(1)),
-            ]
-        );
-        assert_eq!(pending, None);
-    }
-
-    #[test]
-    fn unparseable_keys_are_consumed_without_output() {
-        let short = [PROFILE_PREFIX.as_slice(), b"short"].concat();
-        let (out, pending) = reassemble(&[(short, b"x".to_vec())]);
-        assert_eq!(out, vec![]);
-        assert_eq!(pending, None);
-    }
-
-    #[test]
-    fn should_stop_is_called_after_every_row_and_stops_reading() {
-        let v1 = vs(1, 0);
-        let mut rows: Rows = txn(1, &[v1, v1, v1]);
-        rows.extend(txn(2, &[v1]));
-        rows.sort();
-        let mut checks = 0;
-        let page = run_page(&rows, &Cursor::beginning(), || {
-            checks += 1;
-            false
-        });
-        assert_eq!(checks, rows.len());
-        assert!(page.exhausted);
-
-        // the page stops at the first `true`, without reading further
-        let polled = Cell::new(0);
-        let stream = stream::iter(rows.clone()).map(|row| {
-            polled.set(polled.get() + 1);
-            Ok::<_, Infallible>(row)
-        });
-        let page = ProfileScanner::new()
-            .read_page(&Cursor::beginning(), stream, after(3))
-            .now_or_never()
-            .unwrap()
-            .unwrap();
-        assert_eq!(polled.get(), 3);
-        assert!(!page.exhausted);
-        assert_eq!(txn_ids(&page.transactions), vec![id(1)]);
-        assert_eq!(page.next.key(), key_after(&rows[2].0).as_slice());
-    }
-
-    #[test]
-    fn stop_with_nothing_pending_resumes_after_the_row() {
-        let mut rows: Rows = Vec::new();
-        for n in 0..3u8 {
-            rows.extend(txn(n, &[vs(1, 0)]));
-        }
-        rows.sort();
-        let page = run_page(&rows, &Cursor::beginning(), after(2));
-        assert!(!page.exhausted);
-        assert_eq!(txn_ids(&page.transactions), vec![id(0), id(1)]);
-        assert_eq!(page.next.key(), key_after(&rows[1].0).as_slice());
-    }
-
-    #[test]
-    fn stop_while_straddler_is_pending_cuts_before_it() {
-        let (v1, v2) = (vs(1, 0), vs(2, 0));
-        let mut rows: Rows = txn(0, &[v1]);
-        rows.extend(txn(1, &[v1, v2]));
-        rows.extend(txn(2, &[v1]));
-        rows.extend(txn(3, &[v2]));
-        rows.sort();
-        // id 0, id 1 chunk 1, id 2, id 1 chunk 2, id 3: stop right after id 2
-        let page = run_page(&rows, &Cursor::beginning(), after(3));
-        assert!(!page.exhausted);
-        // id 2 completed after id 1's first chunk: left to the next page
-        assert_eq!(txn_ids(&page.transactions), vec![id(0)]);
-        assert!(page.skipped.is_empty());
-        assert_eq!(page.next.key(), rows[1].0.as_slice());
-
-        // the next page returns the straddler whole, and id 2 once
-        let page = run_page(&rows, &page.next, never());
-        assert!(page.exhausted);
-        assert_eq!(txn_ids(&page.transactions), vec![id(2), id(1), id(3)]);
-        assert!(page.skipped.is_empty());
-    }
-
-    #[test]
-    fn stop_at_the_cursor_with_a_pending_record_breaks_it_and_progresses() {
-        let (v1, v2) = (vs(1, 0), vs(2, 0));
-        let mut rows: Rows = txn(1, &[v1, v2]);
-        rows.extend(txn(2, &[v1]));
-        rows.extend(txn(3, &[v2]));
-        rows.sort();
-        // id 1 chunk 1, id 2, id 1 chunk 2, id 3
-        let cursor = Cursor::from_bytes(rows[0].0.clone()).unwrap();
-        for stop in [1, 2] {
-            let page = run_page(&rows, &cursor, after(stop));
-            assert!(!page.exhausted);
-            assert_eq!(txn_ids(&page.transactions), &[id(2)][..stop - 1]);
-            assert_eq!(skipped_ids(&page.skipped), vec![id(1)]);
-            assert_eq!(page.skipped[0].reason, SkipReason::BrokenChunks);
-            assert_eq!(page.skipped[0].versionstamp, v1);
-            assert_eq!(page.next.key(), key_after(&rows[stop - 1].0).as_slice());
-        }
-
-        // the rest of id 1 shows up again as broken on the next page
-        let page = run_page(
-            &rows,
-            &Cursor::from_bytes(key_after(&rows[1].0)).unwrap(),
-            never(),
-        );
-        assert!(page.exhausted);
-        assert_eq!(txn_ids(&page.transactions), vec![id(3)]);
-        assert_eq!(skipped_ids(&page.skipped), vec![id(1)]);
-        assert_eq!(page.skipped[0].versionstamp, v2);
-    }
-
-    #[test]
-    fn lost_chunk_is_read_again_then_broken_when_stopped_at_the_cursor() {
-        let v1 = vs(1, 0);
-        // id 1 never gets its third chunk
-        let mut rows: Rows = txn(1, &[v1, v1, v1]);
-        rows.truncate(2);
-        rows.extend(txn(2, &[v1, v1, v1]));
-        rows.sort();
-        // the stop leaves id 1 pending: the page resumes at it to read it again
-        let page = run_page(&rows, &Cursor::beginning(), after(2));
-        assert!(!page.exhausted);
-        assert!(page.transactions.is_empty());
-        assert!(page.skipped.is_empty());
-        assert_eq!(page.next.key(), rows[0].0.as_slice());
-
-        // from there, the cut would not advance: id 1 is broken and the page moves on
-        let page = run_page(&rows, &page.next, after(2));
-        assert!(!page.exhausted);
-        assert!(page.transactions.is_empty());
-        assert_eq!(skipped_ids(&page.skipped), vec![id(1)]);
-        assert_eq!(page.next.key(), key_after(&rows[1].0).as_slice());
-
-        let page = run_page(&rows, &page.next, never());
-        assert!(page.exhausted);
-        assert_eq!(txn_ids(&page.transactions), vec![id(2)]);
-
-        // at the end of the range, the page resumes at the pending transaction
-        let lost: Rows = rows[..2].to_vec();
-        let page = run_page(&lost, &Cursor::beginning(), never());
-        assert!(page.exhausted);
-        assert!(page.skipped.is_empty());
-        assert_eq!(page.next.key(), lost[0].0.as_slice());
-    }
-
-    /// id 0 (one chunk), then id 1 (three contiguous chunks), then id 2 (one chunk).
-    fn big_record_rows() -> Rows {
-        let v1 = vs(1, 0);
-        let mut rows: Rows = txn(0, &[v1]);
-        rows.extend(txn(1, &[v1, v1, v1]));
-        rows.extend(txn(2, &[v1]));
-        rows.sort();
-        rows
-    }
-
-    #[test]
-    fn big_record_interrupted_by_a_stop_is_returned_whole_by_next_page() {
-        let rows = big_record_rows();
-        // stopped on id 1's first or second chunk
-        for stop in [2, 3] {
-            let page = run_page(&rows, &Cursor::beginning(), after(stop));
-            assert!(!page.exhausted);
-            assert_eq!(txn_ids(&page.transactions), vec![id(0)], "stop {stop}");
-            assert!(page.skipped.is_empty(), "stop {stop}");
-            assert_eq!(page.next.key(), rows[1].0.as_slice(), "stop {stop}");
-
-            let page = run_page(&rows, &page.next, never());
-            assert!(page.exhausted);
-            assert_eq!(txn_ids(&page.transactions), vec![id(1), id(2)]);
-            assert!(page.skipped.is_empty());
-        }
-    }
-
-    #[test]
-    fn stop_before_one_record_is_read_from_the_cursor_breaks_it_and_progresses() {
-        let rows = big_record_rows();
-        let cursor = Cursor::from_bytes(rows[1].0.clone()).unwrap();
-        let page = run_page(&rows, &cursor, always());
-        assert!(!page.exhausted);
-        assert!(page.transactions.is_empty());
-        assert_eq!(skipped_ids(&page.skipped), vec![id(1)]);
-        assert_eq!(page.next.key(), key_after(&rows[1].0).as_slice());
-
-        // its remaining chunks are reported again, by each page that reads them
-        let page = run_page(&rows, &page.next, always());
-        assert_eq!(page.next.key(), key_after(&rows[2].0).as_slice());
-        assert_eq!(skipped_ids(&page.skipped), vec![id(1)]);
-        let (txs, skipped) = run_pages(&rows, always);
-        assert_eq!(txn_ids(&txs), vec![id(0), id(2)]);
-        assert_eq!(skipped_ids(&skipped), vec![id(1); 3]);
-    }
-
-    #[test]
-    fn end_of_range_with_pending_straddler_cuts_before_it() {
-        let (v1, v2, v3) = (vs(1, 0), vs(2, 0), vs(3, 0));
-        let mut rows: Rows = Vec::new();
-        rows.extend(txn(0, &[v1])); // Z, before everything
-        rows.extend(txn(1, &[v1, v2])); // T1, starts before P, completes after it
-        rows.extend(txn(2, &[v1, v3])); // P, its second commit is not written yet
-        rows.extend(txn(3, &[v1])); // A, between P's chunk 1 and T1's chunk 2
-        rows.extend(txn(4, &[v2])); // C, after everything
-        rows.sort();
-        let t1_first = rows[1].0.clone();
-        let written: Rows = rows
-            .iter()
-            .filter(|(k, _)| k[VERSIONSTAMP_START..] < v3[..])
-            .cloned()
-            .collect();
-
-        let page = run_page(&written, &Cursor::beginning(), never());
-        assert!(page.exhausted);
-        // T1 completes after P's first chunk: dropped with everything after it, and the
-        // cut goes back to T1's first chunk
-        assert_eq!(txn_ids(&page.transactions), vec![id(0)]);
-        assert!(page.skipped.is_empty());
-        assert_eq!(page.next.key(), t1_first.as_slice());
-
-        // once P's second commit is written, the next page returns the rest once
-        let next = run_page(&rows, &page.next, never());
-        assert!(next.exhausted);
-        let mut got = txn_ids(&next.transactions);
-        got.sort();
-        assert_eq!(got, vec![id(1), id(2), id(3), id(4)]);
-        assert!(next.skipped.is_empty());
-
-        // a bounded read that never sees P's second commit keeps the same cursor
-        let again = run_page(&written, &page.next, never());
-        assert!(again.exhausted);
-        assert!(again.transactions.is_empty());
-        assert_eq!(again.next, page.next);
-
-        // same through end_version, and with a stop on T1's second chunk
-        let scanner = ProfileScanner::new().end_version(3);
-        let bounded = |cursor: &Cursor, should_stop: &mut dyn FnMut() -> bool| {
-            let range = scanner.range(cursor);
-            let rows = rows
-                .iter()
-                .filter(|(k, _)| *k >= range.begin && *k < range.end)
-                .cloned()
-                .map(Ok::<_, Infallible>)
-                .collect();
-            read(&scanner, cursor, rows, should_stop).unwrap()
-        };
-        let page = bounded(&Cursor::beginning(), &mut never());
-        assert_eq!(txn_ids(&page.transactions), vec![id(0)]);
-        assert_eq!(page.next.key(), t1_first.as_slice());
-        let stop_on_t1 = written
-            .iter()
-            .position(|(k, _)| k[ID_START..ID_END] == id(1) && k[VERSIONSTAMP_START..] >= v2[..])
-            .unwrap()
-            + 1;
-        let page = bounded(&Cursor::beginning(), &mut after(stop_on_t1));
-        assert!(!page.exhausted);
-        assert_eq!(txn_ids(&page.transactions), vec![id(0)]);
-        assert_eq!(page.next.key(), t1_first.as_slice());
-    }
-
-    #[test]
-    fn end_of_range_cut_also_drops_broken_reports_read_again() {
-        let (v1, v2) = (vs(1, 0), vs(2, 0));
-        let mut rows: Rows = Vec::new();
-        rows.extend(txn(1, &[v1, v2])); // pending at the end of the range
-        rows.push((key(v1, id(2), 2, 3), Vec::new())); // orphan chunks of id 2
-        rows.push((key(v2, id(2), 3, 3), Vec::new()));
-        rows.sort();
-        let written: Rows = rows
-            .iter()
-            .filter(|(k, _)| !(k[VERSIONSTAMP_START..] >= v2[..] && k[ID_START..ID_END] == id(1)))
-            .cloned()
-            .collect();
-        let page = run_page(&written, &Cursor::beginning(), never());
-        // id 2's report is left to the next page, which reads its chunks again
-        assert!(page.skipped.is_empty());
-        assert_eq!(page.next.key(), rows[0].0.as_slice());
-        let page = run_page(&rows, &page.next, never());
-        assert_eq!(txn_ids(&page.transactions), vec![id(1)]);
-        assert_eq!(skipped_ids(&page.skipped), vec![id(2)]);
-    }
-
-    /// Checks that `txs` and `skipped` hold every id of `all` once: returned at most once,
-    /// otherwise reported broken.
-    fn assert_each_once(
-        all: &BTreeSet<[u8; 16]>,
-        (txs, skipped): (Vec<ProfiledTransaction>, Vec<Skipped>),
-        context: &str,
-    ) -> BTreeSet<[u8; 16]> {
-        let returned: BTreeSet<_> = txn_ids(&txs).into_iter().collect();
-        assert_eq!(returned.len(), txs.len(), "twice: {context}");
-        assert!(
-            skipped.iter().all(|s| s.reason == SkipReason::BrokenChunks),
-            "{context}"
-        );
-        let broken: BTreeSet<_> = skipped_ids(&skipped).into_iter().collect();
-        // lost only by being broken by a stop
-        assert!(returned.is_disjoint(&broken), "{context}");
-        assert_eq!(
-            &returned.union(&broken).copied().collect::<BTreeSet<_>>(),
-            all,
-            "{context}"
-        );
-        broken
-    }
-
-    #[test]
-    fn paging_returns_every_transaction_at_most_once() {
-        let (v1, v2, v3) = (vs(1, 0), vs(2, 0), vs(3, 0));
-        let mut rows: Rows = Vec::new();
-        rows.extend(txn(1, &[v1, v1, v2]));
-        rows.extend(txn(2, &[v1]));
-        rows.extend(txn(3, &[v1, v2]));
-        rows.extend(txn(4, &[v2]));
-        rows.extend(txn(5, &[v2, v2]));
-        rows.extend(txn(6, &[v2, v3, v3]));
-        rows.extend(txn(7, &[v3]));
-        rows.extend(txn(8, &[v3, v3, v3]));
-        rows.extend(txn(9, &[v3]));
-        rows.sort();
-        let all: BTreeSet<[u8; 16]> = (1..=9).map(id).collect();
-
-        let (txs, skipped) = run_pages(&rows, never);
-        assert!(skipped.is_empty());
-        assert_eq!(txs.len(), all.len());
-        assert_eq!(txn_ids(&txs).into_iter().collect::<BTreeSet<_>>(), all);
-
-        for k in 1..=rows.len() {
-            assert_each_once(&all, run_pages(&rows, || every(k)), &format!("every {k}"));
-            let broken =
-                assert_each_once(&all, run_pages(&rows, || after(k)), &format!("after {k}"));
-            if k == rows.len() {
-                // a page long enough to read everything from any cursor loses nothing
-                assert!(broken.is_empty());
-            }
-        }
-        for m in 2..=6 {
-            for seed in 0..50 {
-                let state = Cell::new(seed);
-                assert_each_once(
-                    &all,
-                    run_pages(&rows, || random(&state, m)),
-                    &format!("random m {m} seed {seed}"),
-                );
-            }
-        }
-    }
-
-    #[test]
-    fn paging_single_chunk_transactions_returns_each_exactly_once() {
-        let mut rows: Rows = Vec::new();
-        for n in 0..9u8 {
-            rows.extend(txn(n, &[vs(u64::from(n / 3), 0)]));
-        }
-        rows.sort();
-        let expected: Vec<_> = (0..9).map(id).collect();
-        for k in 1..=5 {
-            let (txs, skipped) = run_pages(&rows, || every(k));
-            assert!(skipped.is_empty(), "every {k}");
-            let mut got = txn_ids(&txs);
-            got.sort();
-            assert_eq!(got, expected, "every {k}");
-        }
-        for seed in 0..50 {
-            let state = Cell::new(seed);
-            let (txs, skipped) = run_pages(&rows, || random(&state, 3));
-            assert!(skipped.is_empty(), "seed {seed}");
-            let mut got = txn_ids(&txs);
-            got.sort();
-            assert_eq!(got, expected, "seed {seed}");
-        }
-    }
-
-    #[test]
-    fn invalid_rows_are_rejected() {
-        let scanner = ProfileScanner::new();
-        let (a, b) = (key(vs(1, 0), id(1), 1, 1), key(vs(2, 0), id(2), 1, 1));
-        let ok = |k: &Vec<u8>| Ok::<_, Infallible>((k.clone(), Vec::new()));
-        let invalid = |result: Result<Page, ScanError<Infallible>>| match result {
-            Err(ScanError::InvalidRows { key }) => key,
-            other => panic!("{other:?}"),
-        };
-        // out of order, and a repeated key
-        let rows = vec![ok(&b), ok(&a)];
-        assert_eq!(
-            invalid(read(&scanner, &Cursor::beginning(), rows, never())),
-            a
-        );
-        let rows = vec![ok(&a), ok(&a)];
-        assert_eq!(
-            invalid(read(&scanner, &Cursor::beginning(), rows, never())),
-            a
-        );
-        // before the cursor
-        let rows = vec![ok(&a)];
-        assert_eq!(
-            invalid(read(&scanner, &Cursor::at_version(2), rows, never())),
-            a
-        );
-        // at or past end_version, and outside the keyspace
-        let rows = vec![ok(&a), ok(&b)];
-        let bounded = scanner.clone().end_version(2);
-        assert_eq!(
-            invalid(read(&bounded, &Cursor::beginning(), rows, never())),
-            b
-        );
-        let rows = vec![ok(&PROFILE_END.to_vec())];
-        assert_eq!(
-            invalid(read(&scanner, &Cursor::beginning(), rows, never())),
-            PROFILE_END.to_vec()
-        );
-        let outside = b"\xff\x02/other".to_vec();
-        let rows = vec![ok(&outside)];
-        assert_eq!(
-            invalid(read(&scanner, &Cursor::beginning(), rows, never())),
-            outside
-        );
-    }
-
-    #[test]
-    fn source_error_is_propagated() {
-        let rows = vec![
-            Ok((key(vs(1, 0), id(1), 1, 1), Vec::new())),
-            Err("boom"),
-            Ok((key(vs(2, 0), id(2), 1, 1), Vec::new())),
-        ];
-        match read(&ProfileScanner::new(), &Cursor::beginning(), rows, never()) {
-            Err(ScanError::Source("boom")) => {}
-            other => panic!("{other:?}"),
-        }
-    }
-
-    /// A caller's error type, the way `FdbBindingError` looks from `into_error`'s point of
-    /// view: a `From` impl for the stream's error, and a catch-all for anything boxed.
-    #[derive(Debug)]
-    enum TargetError {
-        Source(io::Error),
-        Custom(Box<dyn std::error::Error + Send + Sync>),
-    }
-
-    impl From<io::Error> for TargetError {
-        fn from(err: io::Error) -> Self {
-            TargetError::Source(err)
-        }
-    }
-
-    #[test]
-    fn into_error_maps_source_through_from() {
-        let err: ScanError<io::Error> = ScanError::Source(io::Error::other("boom"));
-        match err.into_error(TargetError::Custom) {
-            TargetError::Source(err) => assert_eq!(err.to_string(), "boom"),
-            other => panic!("{other:?}"),
-        }
-    }
-
-    #[test]
-    fn into_error_boxes_invalid_rows_for_custom() {
-        let key = b"row-key".to_vec();
-        let err: ScanError<io::Error> = ScanError::InvalidRows { key: key.clone() };
-        match err.into_error(TargetError::Custom) {
-            TargetError::Custom(boxed) => {
-                // the message is preserved, with the key readable in it
-                assert_eq!(
-                    boxed.to_string(),
-                    format!(
-                        "profiling row {key:?} is outside the scanned range or not after the previous row"
-                    )
-                );
-                // and the original variant, still carrying the key, downcasts out of it
-                match boxed
-                    .downcast_ref::<ScanError<Infallible>>()
-                    .expect("boxed error downcasts to ScanError<Infallible>")
-                {
-                    ScanError::InvalidRows { key: got } => assert_eq!(got, &key),
-                    other => panic!("{other:?}"),
-                }
-            }
-            other => panic!("{other:?}"),
-        }
-    }
-
-    #[test]
-    fn range_is_the_cursor_to_end_version_and_never_inverted() {
-        let scanner = ProfileScanner::new();
-        let cursor = Cursor::at_version(5);
-        assert_eq!(
-            scanner.range(&cursor),
-            ScanRange {
-                begin: cursor.as_bytes().to_vec(),
-                end: PROFILE_END.to_vec(),
-            }
-        );
-        let bounded = scanner.end_version(7);
-        assert_eq!(bounded.range(&cursor).end, Cursor::at_version(7).as_bytes());
-        // at or past end_version, the range is empty and the page keeps the cursor
-        for version in [7, 9] {
-            let cursor = Cursor::at_version(version);
-            let range = bounded.range(&cursor);
-            assert_eq!(range.begin, cursor.as_bytes());
-            assert_eq!(range.end, range.begin);
-            let page = read(
-                &bounded,
-                &cursor,
-                Vec::<Result<_, Infallible>>::new(),
-                always(),
-            )
-            .unwrap();
-            assert!(page.exhausted);
-            assert_eq!(page.next, cursor);
-        }
-    }
-
-    #[test]
-    fn empty_range_keeps_the_cursor() {
-        let cursor = Cursor::at_version(42);
-        let page = run_page(&Vec::new(), &cursor, always());
-        assert!(page.exhausted);
-        assert_eq!(page.next, cursor);
-    }
-
-    #[test]
-    fn page_decodes_and_reports_skips() {
-        let valid = ProtocolVersion::V7_4.0.to_le_bytes().to_vec();
-        let rows: Rows = vec![
-            (key(vs(5, 0), id(1), 1, 1), valid),
-            (key(vs(5, 0), id(2), 2, 2), Vec::new()),
-            (key(vs(5, 0), id(3), 1, 1), b"garbage".to_vec()),
-        ];
-        let page = run_page(&rows, &Cursor::beginning(), never());
-        assert_eq!(
-            page.transactions,
-            vec![ProfiledTransaction {
-                version: 5,
-                versionstamp: vs(5, 0),
-                id: id(1),
-                protocol_version: ProtocolVersion::V7_4,
-                events: vec![],
-            }]
-        );
-        assert_eq!(page.skipped.len(), 2);
-        assert_eq!(page.skipped[0].reason, SkipReason::BrokenChunks);
-        assert!(matches!(page.skipped[1].reason, SkipReason::Decode(_)));
-        assert_eq!(page.next.key(), key_after(&rows[2].0).as_slice());
-        assert!(page.exhausted);
-    }
-
-    #[test]
-    fn cursor_round_trip_and_validation() {
-        let a = key(vs(1, 0), id(1), 1, 2);
-        for cursor in [
-            Cursor::beginning(),
-            Cursor::at_version(0),
-            Cursor::at_version(123_456),
-            Cursor::from_bytes(a.clone()).unwrap(),
-        ] {
-            assert_eq!(
-                Cursor::from_bytes(cursor.as_bytes().to_vec()),
-                Ok(cursor.clone())
-            );
-        }
-        assert_eq!(Cursor::beginning().as_bytes(), PROFILE_PREFIX);
-        assert_eq!(Cursor::at_version(-5), Cursor::at_version(0));
-        let v7 = [PROFILE_PREFIX.as_slice(), &7i64.to_be_bytes(), b"\x00\x00"].concat();
-        assert_eq!(Cursor::at_version(7).as_bytes(), v7.as_slice());
-
-        let garbage: Vec<Vec<u8>> = vec![
-            Vec::new(),
-            b"nope".to_vec(),
-            PROFILE_PREFIX[..PROFILE_PREFIX.len() - 1].to_vec(),
-            b"\xff\xff".to_vec(),
-            // the former two-key format
-            [&[1u8, 0, 0, 0, 32][..], PROFILE_PREFIX, PROFILE_PREFIX].concat(),
-        ];
-        for bytes in garbage {
-            assert_eq!(
-                Cursor::from_bytes(bytes.clone()),
-                Err(InvalidCursor),
-                "{bytes:?}"
-            );
-        }
-    }
-}
diff --git a/bindings/rust/foundationdb-profiling/tests/decode_all.rs b/bindings/rust/foundationdb-profiling/tests/decode_all.rs
deleted file mode 100644
index 36e203b50a5..00000000000
--- a/bindings/rust/foundationdb-profiling/tests/decode_all.rs
+++ /dev/null
@@ -1,542 +0,0 @@
-//! Decodes every transaction currently in the client profiling keyspace, as a check that
-//! the decoder handles real client-written data, not just the fixtures and the small
-//! scenarios `read_page.rs` writes itself.
-//!
-//! The C++ client only flushes sampled transactions every `CSI_STATUS_DELAY` (10 seconds
-//! by default) and drops whatever is still queued at process exit, so a short `cargo test
-//! -p foundationdb` run is not a dependable source of profiling data on its own. This test
-//! therefore generates its own varied traffic (gets, a range read, a plain set, a clear, a
-//! clear range, several atomic ops, a commit conflict, and a best-effort read error) under
-//! a unique key prefix before decoding, so it always has something of its own to find. It
-//! enables client profiling itself (and restores the previous setting) when it finds it
-//! disabled, the way `read_page.rs` does, so it also works against a fresh local cluster.
-//! On CI, `.github/workflows/profiling.yml` already enables profiling cluster-wide and
-//! runs the `foundationdb` crate's test suite first as extra background traffic. It is
-//! `#[ignore]`d so that a plain `cargo test -p foundationdb-profiling` does not depend on a
-//! live cluster.
-
-use foundationdb::options::{MutationType, TransactionOption};
-use foundationdb::tuple::pack;
-use foundationdb::{ClientBudget, Database, FdbBindingError, KeySelector, RangeOption};
-use foundationdb_profiling::{
-    Aggregator, Cursor, Event, Mutation, Page, ProfileScanner, ProfiledTransaction, SkipReason,
-};
-use futures_util::{FutureExt, TryStreamExt};
-use std::collections::BTreeMap;
-use std::panic::AssertUnwindSafe;
-use std::time::{Duration, SystemTime};
-
-/// Upper bound on the number of pages read, so a bug that never exhausts the range fails
-/// fast instead of hanging.
-const MAX_PAGES: usize = 100_000;
-/// How long to wait, and how many times, for our own traffic to be flushed and show up in
-/// a page starting at the version read before we wrote anything.
-const MARKER_POLL_INTERVAL: Duration = Duration::from_secs(2);
-const MARKER_POLL_ATTEMPTS: usize = 30;
-
-const SAMPLE_RATE_KEY: &[u8] =
-    b"\xff\xff/global_config/config/fdb_client_info/client_txn_sample_rate";
-const SIZE_LIMIT_KEY: &[u8] =
-    b"\xff\xff/global_config/config/fdb_client_info/client_txn_size_limit";
-
-#[tokio::test]
-#[ignore = "needs a live cluster, see profiling.yml"]
-async fn decode_all_client_latency_transactions() {
-    let db = Database::default().expect("database");
-    let nanos = SystemTime::now()
-        .duration_since(SystemTime::UNIX_EPOCH)
-        .unwrap()
-        .as_nanos();
-    let prefix = format!("fdbrs_profiling_decode_all/{}_{nanos}/", std::process::id()).into_bytes();
-
-    let previous = read_profiling_config(&db).await;
-    let restore_profiling = previous.0.is_none();
-    if restore_profiling {
-        set_profiling_config(&db, Some(pack(&1.0f64)), Some(pack(&-1i64))).await;
-        // The client picks up a global config change asynchronously; give it a moment
-        // before generating traffic, so the very first transaction is not sampled out.
-        tokio::time::sleep(MARKER_POLL_INTERVAL).await;
-    }
-
-    let result = AssertUnwindSafe(run(&db, prefix.clone()))
-        .catch_unwind()
-        .await;
-
-    if restore_profiling {
-        set_profiling_config(&db, previous.0, previous.1).await;
-    }
-    cleanup(&db, &prefix).await;
-
-    if let Err(panic) = result {
-        std::panic::resume_unwind(panic);
-    }
-}
-
-/// Generates the test's own traffic, waits for it to show up, then decodes and checks the
-/// whole profiling keyspace.
-async fn run(db: &Database, prefix: Vec<u8>) {
-    let start = read_version(db).await;
-    let markers = generate_traffic(db, prefix).await;
-    wait_for_markers(db, start, &markers.prefix).await;
-    scan_and_assert(db, &markers).await;
-}
-
-/// Unique keys and ranges used to positively identify our own traffic among everything
-/// else that may be in the profiling keyspace (other tests, other CI traffic).
-struct Markers {
-    prefix: Vec<u8>,
-    hit_key: Vec<u8>,
-    miss_key: Vec<u8>,
-    range: (Vec<u8>, Vec<u8>),
-    set_key: Vec<u8>,
-    clear_key: Vec<u8>,
-    clear_range: (Vec<u8>, Vec<u8>),
-    add_key: Vec<u8>,
-    max_key: Vec<u8>,
-    byte_min_key: Vec<u8>,
-    versionstamp_key: Vec<u8>,
-    conflict_key: Vec<u8>,
-    too_old_key: Vec<u8>,
-}
-
-impl Markers {
-    fn new(prefix: Vec<u8>) -> Self {
-        let key = |name: &str| [prefix.as_slice(), name.as_bytes()].concat();
-        Markers {
-            hit_key: key("hit"),
-            miss_key: key("miss"),
-            range: (key("range/"), key("range0")),
-            set_key: key("set"),
-            clear_key: key("clear"),
-            clear_range: (key("clear_range/"), key("clear_range0")),
-            add_key: key("add"),
-            max_key: key("max"),
-            byte_min_key: key("byte_min"),
-            versionstamp_key: key("versionstamp"),
-            conflict_key: key("conflict"),
-            too_old_key: key("too_old"),
-            prefix,
-        }
-    }
-
-    /// Marks off which of our own scenarios a decoded event belongs to.
-    fn record(&self, event: &Event, found: &mut Found) {
-        match event {
-            Event::Get(g) if g.key == self.hit_key => found.hit = true,
-            Event::Get(g) if g.key == self.miss_key => found.miss = true,
-            Event::GetRange(gr)
-                if gr.range.begin == self.range.0 && gr.range.end == self.range.1 =>
-            {
-                found.range = true;
-            }
-            Event::GetError(e) if e.key == self.too_old_key && e.error_code == 1007 => {
-                found.too_old = true;
-            }
-            Event::Commit(c) => {
-                for mutation in &c.request.mutations {
-                    self.record_mutation(mutation, found);
-                }
-            }
-            Event::CommitError(c) if c.error_code == 1020 => {
-                if c.request
-                    .mutations
-                    .iter()
-                    .any(|m| m.param1 == self.conflict_key)
-                {
-                    found.conflict = true;
-                }
-            }
-            _ => {}
-        }
-    }
-
-    fn record_mutation(&self, m: &Mutation, found: &mut Found) {
-        if m.mutation_type == Mutation::SET_VALUE && m.param1 == self.set_key {
-            found.set = true;
-        } else if m.mutation_type == Mutation::CLEAR_RANGE && m.param1 == self.clear_key {
-            found.clear = true;
-        } else if m.mutation_type == Mutation::CLEAR_RANGE
-            && m.param1 == self.clear_range.0
-            && m.param2 == self.clear_range.1
-        {
-            found.clear_range = true;
-        } else if m.mutation_type == Mutation::ADD_VALUE && m.param1 == self.add_key {
-            found.add = true;
-        } else if m.mutation_type == Mutation::MAX && m.param1 == self.max_key {
-            found.max = true;
-        } else if m.mutation_type == Mutation::BYTE_MIN && m.param1 == self.byte_min_key {
-            found.byte_min = true;
-        } else if m.mutation_type == Mutation::SET_VERSIONSTAMPED_VALUE
-            && m.param1 == self.versionstamp_key
-        {
-            found.versionstamp = true;
-        }
-    }
-}
-
-/// Which of the marker scenarios have been seen decoded so far.
-#[derive(Default)]
-struct Found {
-    hit: bool,
-    miss: bool,
-    range: bool,
-    set: bool,
-    clear: bool,
-    clear_range: bool,
-    add: bool,
-    max: bool,
-    byte_min: bool,
-    versionstamp: bool,
-    conflict: bool,
-    /// Best-effort: a freshly started cluster may still have version 1 inside its MVCC
-    /// window, in which case the read never errors. Never asserted on its own.
-    too_old: bool,
-}
-
-impl Found {
-    /// Names of the scenarios (other than the best-effort read error) not yet observed.
-    fn missing(&self) -> Vec<&'static str> {
-        let checks: [(&str, bool); 11] = [
-            ("get (hit)", self.hit),
-            ("get (miss)", self.miss),
-            ("get_range", self.range),
-            ("set", self.set),
-            ("clear", self.clear),
-            ("clear_range", self.clear_range),
-            ("atomic add", self.add),
-            ("atomic max", self.max),
-            ("atomic byte_min", self.byte_min),
-            ("atomic set_versionstamped_value", self.versionstamp),
-            ("commit conflict", self.conflict),
-        ];
-        checks
-            .into_iter()
-            .filter(|(_, ok)| !ok)
-            .map(|(name, _)| name)
-            .collect()
-    }
-}
-
-/// Writes the test's own traffic: gets (hit and miss), a range read, a plain set, a clear,
-/// a clear range, atomic add/max/byte_min/set_versionstamped_value, one commit conflict,
-/// and a best-effort read error. Every transaction is dropped as soon as it is done with
-/// (committed, or explicitly dropped for read-only ones), since the C++ client only
-/// records a sampled transaction's events when its native transaction is destroyed.
-async fn generate_traffic(db: &Database, prefix: Vec<u8>) -> Markers {
-    let m = Markers::new(prefix);
-
-    // get: hit and miss.
-    let trx = db.create_trx().expect("trx");
-    trx.set(&m.hit_key, b"present");
-    trx.commit().await.expect("commit hit seed");
-
-    let trx = db.create_trx().expect("trx");
-    trx.get(&m.hit_key, false).await.expect("get hit");
-    drop(trx);
-
-    let trx = db.create_trx().expect("trx");
-    let miss = trx.get(&m.miss_key, false).await.expect("get miss");
-    assert!(miss.is_none(), "miss key unexpectedly present");
-    drop(trx);
-
-    // get_range.
-    let trx = db.create_trx().expect("trx");
-    trx.set(&[m.range.0.as_slice(), b"x"].concat(), b"v");
-    trx.commit().await.expect("commit range seed");
-
-    let trx = db.create_trx().expect("trx");
-    let range = RangeOption::from((m.range.0.clone(), m.range.1.clone()));
-    trx.get_range(&range, 1, false).await.expect("get_range");
-    drop(trx);
-
-    // set.
-    let trx = db.create_trx().expect("trx");
-    trx.set(&m.set_key, b"set-value");
-    trx.commit().await.expect("commit set");
-
-    // clear (single key).
-    let trx = db.create_trx().expect("trx");
-    trx.set(&m.clear_key, b"to-clear");
-    trx.commit().await.expect("commit clear seed");
-    let trx = db.create_trx().expect("trx");
-    trx.clear(&m.clear_key);
-    trx.commit().await.expect("commit clear");
-
-    // clear_range.
-    let trx = db.create_trx().expect("trx");
-    trx.set(&m.clear_range.0, b"v");
-    trx.commit().await.expect("commit clear_range seed");
-    let trx = db.create_trx().expect("trx");
-    trx.clear_range(&m.clear_range.0, &m.clear_range.1);
-    trx.commit().await.expect("commit clear_range");
-
-    // atomic ops.
-    let trx = db.create_trx().expect("trx");
-    trx.atomic_op(&m.add_key, &1i64.to_le_bytes(), MutationType::Add);
-    trx.commit().await.expect("commit add");
-
-    let trx = db.create_trx().expect("trx");
-    trx.atomic_op(&m.max_key, &1i64.to_le_bytes(), MutationType::Max);
-    trx.commit().await.expect("commit max");
-
-    let trx = db.create_trx().expect("trx");
-    trx.atomic_op(&m.byte_min_key, b"m", MutationType::ByteMin);
-    trx.commit().await.expect("commit byte_min");
-
-    let trx = db.create_trx().expect("trx");
-    // Versionstamp placeholder (10 zero bytes) plus the little-endian offset (0) pointing
-    // at it: any valid transform works, this test does not read the value back.
-    let mut versionstamped_value = vec![0u8; 10];
-    versionstamped_value.extend_from_slice(&0i32.to_le_bytes());
-    trx.atomic_op(
-        &m.versionstamp_key,
-        &versionstamped_value,
-        MutationType::SetVersionstampedValue,
-    );
-    trx.commit().await.expect("commit versionstamped value");
-
-    // One commit conflict: the reader reads the key, the writer commits a change to it
-    // first, then the reader's own commit fails with not_committed (1020).
-    let reader = db.create_trx().expect("trx");
-    reader
-        .get(&m.conflict_key, false)
-        .await
-        .expect("get conflict key");
-    let writer = db.create_trx().expect("trx");
-    writer.set(&m.conflict_key, b"writer");
-    writer.commit().await.expect("commit writer");
-    reader.set(&m.conflict_key, b"reader");
-    let conflict_result = reader.commit().await;
-    match &conflict_result {
-        Err(e) if e.code() == 1020 => {}
-        other => panic!("expected a commit conflict (error 1020), got {other:?}"),
-    }
-    drop(conflict_result);
-
-    // Best-effort read error: a read version far enough in the past to have left the MVCC
-    // window gives transaction_too_old (1007). Not asserted here: on a cluster started
-    // just for this test run, version 1 may still be inside the window.
-    let trx = db.create_trx().expect("trx");
-    trx.set_read_version(1);
-    let _ = trx.get(&m.too_old_key, false).await;
-    drop(trx);
-
-    m
-}
-
-/// Polls `read_page` from `start` until a transaction touching `prefix` shows up, or gives
-/// up after [`MARKER_POLL_ATTEMPTS`]. The scan that follows checks the actual outcome.
-async fn wait_for_markers(db: &Database, start: i64, prefix: &[u8]) {
-    let cursor = Cursor::at_version(start);
-    for attempt in 0..MARKER_POLL_ATTEMPTS {
-        let page = read_one_page(db, &cursor).await;
-        if page
-            .transactions
-            .iter()
-            .any(|tx| transaction_touches_prefix(tx, prefix))
-        {
-            return;
-        }
-        if attempt + 1 < MARKER_POLL_ATTEMPTS {
-            tokio::time::sleep(MARKER_POLL_INTERVAL).await;
-        }
-    }
-}
-
-fn transaction_touches_prefix(tx: &ProfiledTransaction, prefix: &[u8]) -> bool {
-    tx.events
-        .iter()
-        .any(|event| transaction_touches_prefix_event(event, prefix))
-}
-
-fn transaction_touches_prefix_event(event: &Event, prefix: &[u8]) -> bool {
-    match event {
-        Event::Get(g) => g.key.starts_with(prefix),
-        Event::GetRange(gr) => {
-            gr.range.begin.starts_with(prefix) || gr.range.end.starts_with(prefix)
-        }
-        Event::GetError(e) => e.key.starts_with(prefix),
-        Event::GetRangeError(e) => {
-            e.range.begin.starts_with(prefix) || e.range.end.starts_with(prefix)
-        }
-        Event::Commit(c) => c
-            .request
-            .mutations
-            .iter()
-            .any(|m| m.param1.starts_with(prefix)),
-        Event::CommitError(c) => c
-            .request
-            .mutations
-            .iter()
-            .any(|m| m.param1.starts_with(prefix)),
-        Event::GetVersion(_) => false,
-        _ => false,
-    }
-}
-
-/// Decodes the whole profiling keyspace and checks it: no decode errors, and every one of
-/// our own marker scenarios (other than the best-effort read error) was decoded.
-async fn scan_and_assert(db: &Database, markers: &Markers) {
-    let mut cursor = Cursor::beginning();
-    let mut aggregator = Aggregator::default();
-    let mut total_transactions = 0usize;
-    let mut event_counts: BTreeMap<&'static str, usize> = BTreeMap::new();
-    let mut decode_errors = Vec::new();
-    let mut broken_chunks = 0usize;
-    let mut found = Found::default();
-
-    for _ in 0..MAX_PAGES {
-        let page = read_one_page(db, &cursor).await;
-
-        for tx in &page.transactions {
-            total_transactions += 1;
-            for event in &tx.events {
-                *event_counts.entry(event_name(event)).or_insert(0) += 1;
-                markers.record(event, &mut found);
-            }
-            aggregator.record(tx);
-        }
-        for skipped in &page.skipped {
-            match &skipped.reason {
-                SkipReason::Decode(err) => {
-                    decode_errors.push((skipped.versionstamp, skipped.id, err.clone()));
-                }
-                SkipReason::BrokenChunks => {
-                    broken_chunks += 1;
-                    println!(
-                        "broken chunks: versionstamp={:?} id={:?}",
-                        skipped.versionstamp, skipped.id
-                    );
-                }
-                _ => {}
-            }
-        }
-
-        cursor = page.next;
-        if page.exhausted {
-            break;
-        }
-    }
-
-    println!("transactions decoded: {total_transactions}");
-    println!("broken chunks skipped: {broken_chunks}");
-    println!("event counts:");
-    for (name, count) in &event_counts {
-        println!("  {name}: {count}");
-    }
-    println!("reads total: {}", aggregator.reads().total());
-    println!("writes total: {}", aggregator.writes().total());
-
-    if !decode_errors.is_empty() {
-        for (versionstamp, id, err) in &decode_errors {
-            println!("decode error: versionstamp={versionstamp:?} id={id:?} error={err}");
-        }
-        panic!(
-            "{} transaction(s) failed to decode, see printed ids/errors above",
-            decode_errors.len()
-        );
-    }
-    assert!(
-        total_transactions >= 1,
-        "no transactions were read; is client profiling enabled and has the cluster served traffic?"
-    );
-
-    let missing = found.missing();
-    assert!(
-        missing.is_empty(),
-        "marker transaction(s) were not decoded: {missing:?}"
-    );
-    if !found.too_old {
-        println!("note: the best-effort transaction_too_old marker was not observed, skipping it");
-    }
-}
-
-/// Reads one page bounded by a 2 second time budget, like the crate docs example.
-async fn read_one_page(db: &Database, cursor: &Cursor) -> Page {
-    let scanner = ProfileScanner::new();
-    db.run(|trx, _| {
-        let scanner = scanner.clone();
-        let cursor = cursor.clone();
-        async move {
-            trx.set_option(TransactionOption::ReadSystemKeys)?;
-            trx.set_client_budget(ClientBudget {
-                time_limit: Some(Duration::from_secs(2)),
-                ..ClientBudget::default()
-            });
-            let range = scanner.range(&cursor);
-            let opt = RangeOption::from((
-                KeySelector::first_greater_or_equal(range.begin.as_slice()),
-                KeySelector::first_greater_or_equal(range.end.as_slice()),
-            ));
-            let rows = trx
-                .get_ranges_keyvalues(opt, true)
-                .map_ok(|kv| (kv.key().to_vec(), kv.value().to_vec()));
-            let page = scanner
-                .read_page(&cursor, rows, || trx.check_client_budget().is_err())
-                .await
-                .map_err(|err| err.into_error(FdbBindingError::new_custom_error))?;
-            Ok::<_, FdbBindingError>(page)
-        }
-    })
-    .await
-    .expect("read_page")
-}
-
-async fn read_version(db: &Database) -> i64 {
-    let trx = db.create_trx().expect("trx");
-    trx.get_read_version().await.expect("read version")
-}
-
-async fn read_profiling_config(db: &Database) -> (Option<Vec<u8>>, Option<Vec<u8>>) {
-    db.run(|trx, _| async move {
-        let rate = trx.get(SAMPLE_RATE_KEY, false).await?.map(|v| v.to_vec());
-        let size = trx.get(SIZE_LIMIT_KEY, false).await?.map(|v| v.to_vec());
-        Ok::<_, FdbBindingError>((rate, size))
-    })
-    .await
-    .expect("read profiling config")
-}
-
-/// Writes the global profiling configuration, `None` meaning `default` (what
-/// `fdbcli> profile client set default default` writes).
-async fn set_profiling_config(db: &Database, rate: Option<Vec<u8>>, size: Option<Vec<u8>>) {
-    let rate = rate.unwrap_or_else(|| pack(&f64::INFINITY));
-    let size = size.unwrap_or_else(|| pack(&-1i64));
-    db.run(|trx, _| {
-        let (rate, size) = (rate.clone(), size.clone());
-        async move {
-            trx.set_option(TransactionOption::SpecialKeySpaceEnableWrites)?;
-            trx.set(SAMPLE_RATE_KEY, &rate);
-            trx.set(SIZE_LIMIT_KEY, &size);
-            Ok::<_, FdbBindingError>(())
-        }
-    })
-    .await
-    .expect("set profiling config");
-}
-
-async fn cleanup(db: &Database, prefix: &[u8]) {
-    let end = [prefix, b"\xff".as_slice()].concat();
-    db.run(|trx, _| {
-        let (begin, end) = (prefix.to_vec(), end.clone());
-        async move {
-            trx.clear_range(&begin, &end);
-            Ok::<_, FdbBindingError>(())
-        }
-    })
-    .await
-    .expect("cleanup");
-}
-
-fn event_name(event: &Event) -> &'static str {
-    match event {
-        Event::GetVersion(_) => "GetVersion",
-        Event::Get(_) => "Get",
-        Event::GetRange(_) => "GetRange",
-        Event::Commit(_) => "Commit",
-        Event::GetError(_) => "GetError",
-        Event::GetRangeError(_) => "GetRangeError",
-        Event::CommitError(_) => "CommitError",
-        _ => "Unknown",
-    }
-}
diff --git a/bindings/rust/foundationdb-profiling/tests/fixtures/commit_7_4.bin b/bindings/rust/foundationdb-profiling/tests/fixtures/commit_7_4.bin
deleted file mode 100644
index 366b66e092401b0734e86484c48a85b3e24c018a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 614
zcmZQzU?|zZaGRe22!hLW?)j{}<p^R!zyW)E5Tlp<sjexIW(4BXjp&MWGr@{PfRbq`
zNkzr+1x5L3@oAYAC8b5F`iV?H@&4`TntrH&HHqTT#DK%JDrTStuDxic9Vn==X9Y^k
z2RhKa>K)vzI1EX|Ar3Yir;C8*GvJU+0?FZWaxxCvQa~<d#A_lW4z0;jK&@E9Iyt{I
ruOzjIQ5vr_E{CSzl1O9+npc*XQ<|!q$bjE!4v?RK7zALc2FL^epF6B=

diff --git a/bindings/rust/foundationdb-profiling/tests/fixtures/commit_error_7_4.bin b/bindings/rust/foundationdb-profiling/tests/fixtures/commit_error_7_4.bin
deleted file mode 100644
index 6a799e6c1a68472aef6222a01c44b5e8a761233d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 312
zcmZQzU?|zZaGRe22r4HieDqm+%MrwefE8NyAVz~~v5_f|W(4AMlhGA@5C<!g21=%-
zBo!6M7Zl~E#iwOfl#~{w>L=&trR8KMm#_h)izO5h7W`pmU|<3Y%HY=rlx1KL1LFVs
z!Or@IO&uNEHQ&G4`bvz=Ghu%LSQcc8BoJe<J-;L)wFs;TzY!pxF-YJs1Eio577jo*
E035+n!T<mO

diff --git a/bindings/rust/foundationdb-profiling/tests/read_page.rs b/bindings/rust/foundationdb-profiling/tests/read_page.rs
deleted file mode 100644
index e25df873c49..00000000000
--- a/bindings/rust/foundationdb-profiling/tests/read_page.rs
+++ /dev/null
@@ -1,336 +0,0 @@
-//! Integration tests of `ProfileScanner::read_page` against a live cluster.
-//!
-//! The test enables client profiling for the whole cluster (sample rate 1.0, like
-//! `fdbcli> profile client set 1.0 default`), writes a few transactions, waits for the
-//! client to flush them, reads them back, then restores the previous profiling settings
-//! and clears the keys it wrote. Everything runs in a single test so that no other test
-//! can switch profiling off under it.
-
-use foundationdb::options::TransactionOption;
-use foundationdb::tuple::pack;
-use foundationdb::{ClientBudget, Database, FdbBindingError, KeySelector, RangeOption};
-use foundationdb_profiling::{
-    Cursor, Event, Page, ProfileScanner, ProfiledTransaction, SkipReason,
-};
-use futures_util::{FutureExt, TryStreamExt};
-use std::collections::BTreeSet;
-use std::panic::AssertUnwindSafe;
-use std::time::{Duration, SystemTime};
-
-const SAMPLE_RATE_KEY: &[u8] =
-    b"\xff\xff/global_config/config/fdb_client_info/client_txn_sample_rate";
-const SIZE_LIMIT_KEY: &[u8] =
-    b"\xff\xff/global_config/config/fdb_client_info/client_txn_size_limit";
-
-/// Number of profiled transactions written by the test.
-const TXNS: usize = 5;
-/// Value size of each write, so the records span several range read batches.
-const VALUE_LEN: usize = 2048;
-
-type Id = ([u8; 10], [u8; 16]);
-
-#[tokio::test]
-async fn read_page_against_live_cluster() {
-    let db = Database::default().expect("database");
-    let nanos = SystemTime::now()
-        .duration_since(SystemTime::UNIX_EPOCH)
-        .unwrap()
-        .as_nanos();
-    let prefix = format!("fdbrs_profiling_test/{}_{nanos}/", std::process::id()).into_bytes();
-
-    let previous = read_profiling_config(&db).await;
-    set_profiling_config(&db, Some(pack(&1.0f64)), Some(pack(&-1i64))).await;
-
-    let result = AssertUnwindSafe(scenarios(&db, &prefix))
-        .catch_unwind()
-        .await;
-
-    set_profiling_config(&db, previous.0, previous.1).await;
-    let end = [prefix.as_slice(), b"\xff"].concat();
-    db.run(|trx, _| {
-        let (begin, end) = (prefix.clone(), end.clone());
-        async move {
-            trx.clear_range(&begin, &end);
-            Ok::<_, FdbBindingError>(())
-        }
-    })
-    .await
-    .expect("cleanup");
-
-    if let Err(panic) = result {
-        std::panic::resume_unwind(panic);
-    }
-}
-
-async fn scenarios(db: &Database, prefix: &[u8]) {
-    let start = read_version(db).await;
-    let ours = write_and_wait(db, prefix, start).await;
-    let max_version = ours.iter().map(|t| t.version).max().unwrap();
-    let end_version = max_version + 1;
-
-    // decoded contents of our transactions
-    for (i, tx) in ours.iter().enumerate() {
-        let key = test_key(prefix, i);
-        assert!(
-            matches!(tx.events.first(), Some(Event::GetVersion(_))),
-            "{tx:?}"
-        );
-        assert!(
-            tx.events
-                .iter()
-                .any(|e| matches!(e, Event::Get(g) if g.key == key))
-        );
-        let commit = tx
-            .events
-            .iter()
-            .find_map(|e| match e {
-                Event::Commit(c) => Some(c),
-                _ => None,
-            })
-            .expect("commit event");
-        assert_eq!(commit.request.mutations.len(), 1);
-        assert_eq!(commit.request.mutations[0].mutation_type, 0);
-        assert_eq!(commit.request.mutations[0].param1, key);
-        assert_eq!(commit.request.mutations[0].param2.len(), VALUE_LEN);
-    }
-
-    // one big page over a fixed window
-    let window_cursor = Cursor::at_version(start);
-    let window_scanner = ProfileScanner::new().end_version(end_version);
-    let full = page(db, &window_scanner, &window_cursor, Stop::Time).await;
-    assert!(full.exhausted);
-    let all = ids(&full.transactions);
-    for tx in &ours {
-        assert!(all.contains(&(tx.versionstamp, tx.id)));
-    }
-    assert!(full.transactions.iter().all(|t| t.version < end_version));
-
-    // pagination through the caller's budget: a tiny, deterministic byte budget is
-    // exceeded as soon as the first batch is read, so every page stops after its first
-    // row; and through a row count
-    let byte_budget = Stop::Budget(ClientBudget {
-        max_bytes_read: Some(1),
-        ..ClientBudget::default()
-    });
-    for stop in [byte_budget, Stop::Rows(2), Stop::Rows(3)] {
-        paginate(db, &window_scanner, &window_cursor, stop, &all, &ours).await;
-    }
-
-    // end_version is exclusive, at_version inclusive
-    let mut versions: Vec<i64> = ours.iter().map(|t| t.version).collect();
-    versions.sort();
-    let split = versions[versions.len() / 2];
-    let before = page(
-        db,
-        &window_scanner.clone().end_version(split),
-        &window_cursor,
-        Stop::Time,
-    )
-    .await;
-    assert!(before.exhausted);
-    assert!(before.transactions.iter().all(|t| t.version < split));
-    let after = page(db, &window_scanner, &Cursor::at_version(split), Stop::Time).await;
-    assert!(after.transactions.iter().all(|t| t.version >= split));
-    let mut both = ids(&before.transactions);
-    both.extend(ids(&after.transactions));
-    assert_eq!(both, all);
-    for tx in &ours {
-        let in_before = before.transactions.iter().any(|t| t.id == tx.id);
-        assert_eq!(in_before, tx.version < split);
-    }
-}
-
-fn test_key(prefix: &[u8], i: usize) -> Vec<u8> {
-    [prefix, format!("{i}").as_bytes()].concat()
-}
-
-/// Writes the test transactions and waits until all of them are flushed, rewriting the
-/// ones not seen yet (the new sample rate reaches the client asynchronously).
-async fn write_and_wait(db: &Database, prefix: &[u8], start: i64) -> Vec<ProfiledTransaction> {
-    let mut found: Vec<Option<ProfiledTransaction>> = vec![None; TXNS];
-    for _round in 0..6 {
-        for (i, slot) in found.iter().enumerate() {
-            if slot.is_none() {
-                let key = test_key(prefix, i);
-                db.run(|trx, _| {
-                    let key = key.clone();
-                    async move {
-                        trx.get(&key, false).await?;
-                        trx.set(&key, &[b'v'; VALUE_LEN]);
-                        Ok::<_, FdbBindingError>(())
-                    }
-                })
-                .await
-                .expect("write");
-            }
-        }
-        // the client flushes every CSI_STATUS_DELAY (10s)
-        for _ in 0..15 {
-            tokio::time::sleep(Duration::from_secs(1)).await;
-            let cursor = Cursor::at_version(start);
-            let scanner = ProfileScanner::new();
-            let p = page(db, &scanner, &cursor, Stop::Time).await;
-            for tx in p.transactions {
-                for (i, slot) in found.iter_mut().enumerate() {
-                    let key = test_key(prefix, i);
-                    let ours = tx
-                        .events
-                        .iter()
-                        .any(|e| matches!(e, Event::Get(g) if g.key == key));
-                    if ours && slot.is_none() {
-                        *slot = Some(tx.clone());
-                    }
-                }
-            }
-            if found.iter().all(Option::is_some) {
-                return found.into_iter().flatten().collect();
-            }
-        }
-    }
-    panic!("profiling data was not flushed: {found:?}");
-}
-
-/// How the caller bounds a page.
-#[derive(Debug, Clone)]
-enum Stop {
-    /// A 2 second time budget, like the crate docs example.
-    Time,
-    /// This client budget.
-    Budget(ClientBudget),
-    /// This many rows.
-    Rows(usize),
-}
-
-/// Reads one page in one `db.run`, the way the crate docs describe it.
-async fn page(db: &Database, scanner: &ProfileScanner, cursor: &Cursor, stop: Stop) -> Page {
-    db.run(|trx, _| {
-        let scanner = scanner.clone();
-        let cursor = cursor.clone();
-        let stop = stop.clone();
-        async move {
-            trx.set_option(TransactionOption::ReadSystemKeys)?;
-            let (budget, max_rows) = match stop {
-                Stop::Time => (
-                    ClientBudget {
-                        time_limit: Some(Duration::from_secs(2)),
-                        ..ClientBudget::default()
-                    },
-                    None,
-                ),
-                Stop::Budget(budget) => (budget, None),
-                Stop::Rows(rows) => (ClientBudget::default(), Some(rows)),
-            };
-            trx.set_client_budget(budget);
-            let range = scanner.range(&cursor);
-            let opt = RangeOption::from((
-                KeySelector::first_greater_or_equal(range.begin.as_slice()),
-                KeySelector::first_greater_or_equal(range.end.as_slice()),
-            ));
-            let rows = trx
-                .get_ranges_keyvalues(opt, true)
-                .map_ok(|kv| (kv.key().to_vec(), kv.value().to_vec()));
-            let mut read = 0;
-            let should_stop = || {
-                read += 1;
-                trx.check_client_budget().is_err() || max_rows.is_some_and(|max| read >= max)
-            };
-            let page = scanner
-                .read_page(&cursor, rows, should_stop)
-                .await
-                .map_err(|err| err.into_error(FdbBindingError::new_custom_error))?;
-            Ok::<_, FdbBindingError>(page)
-        }
-    })
-    .await
-    .expect("read_page")
-}
-
-/// Pages through the window with `stop` until exhausted, and checks that the pages
-/// return every transaction of `all` once: at most once each, all of ours (single row
-/// records) exactly once, and any other one missing only by being reported broken.
-async fn paginate(
-    db: &Database,
-    scanner: &ProfileScanner,
-    start: &Cursor,
-    stop: Stop,
-    all: &BTreeSet<Id>,
-    ours: &[ProfiledTransaction],
-) {
-    let mut cursor = start.clone();
-    let mut returned = Vec::new();
-    let mut broken = BTreeSet::new();
-    let mut stops = 0;
-    let mut exhausted = false;
-    for _ in 0..10_000 {
-        let p = page(db, scanner, &cursor, stop.clone()).await;
-        returned.extend(p.transactions);
-        for skipped in p.skipped {
-            assert_eq!(skipped.reason, SkipReason::BrokenChunks, "{stop:?}");
-            broken.insert(skipped.id);
-        }
-        // round trip through the persisted form
-        let restored = Cursor::from_bytes(p.next.as_bytes().to_vec()).expect("valid cursor");
-        assert_eq!(restored, p.next);
-        if p.exhausted {
-            exhausted = true;
-            break;
-        }
-        assert!(
-            restored.as_bytes() > cursor.as_bytes(),
-            "no progress {stop:?}"
-        );
-        cursor = restored;
-        stops += 1;
-    }
-    assert!(exhausted, "pages never exhausted {stop:?}");
-    assert!(stops > 0, "the window fits in one page {stop:?}");
-    let got = ids(&returned);
-    assert_eq!(got.len(), returned.len(), "returned twice {stop:?}");
-    for tx in ours {
-        assert!(got.contains(&(tx.versionstamp, tx.id)), "{stop:?}");
-    }
-    for id in all.difference(&got) {
-        assert!(
-            broken.contains(&id.1),
-            "{id:?} lost without a report {stop:?}"
-        );
-    }
-    assert!(got.is_subset(all), "{stop:?}");
-}
-
-fn ids(txs: &[ProfiledTransaction]) -> BTreeSet<Id> {
-    txs.iter().map(|t| (t.versionstamp, t.id)).collect()
-}
-
-async fn read_version(db: &Database) -> i64 {
-    let trx = db.create_trx().expect("trx");
-    trx.get_read_version().await.expect("read version")
-}
-
-async fn read_profiling_config(db: &Database) -> (Option<Vec<u8>>, Option<Vec<u8>>) {
-    db.run(|trx, _| async move {
-        let rate = trx.get(SAMPLE_RATE_KEY, false).await?.map(|v| v.to_vec());
-        let size = trx.get(SIZE_LIMIT_KEY, false).await?.map(|v| v.to_vec());
-        Ok::<_, FdbBindingError>((rate, size))
-    })
-    .await
-    .expect("read profiling config")
-}
-
-/// Writes the global profiling configuration, `None` meaning `default` (what
-/// `fdbcli> profile client set default default` writes).
-async fn set_profiling_config(db: &Database, rate: Option<Vec<u8>>, size: Option<Vec<u8>>) {
-    let rate = rate.unwrap_or_else(|| pack(&f64::INFINITY));
-    let size = size.unwrap_or_else(|| pack(&-1i64));
-    db.run(|trx, _| {
-        let (rate, size) = (rate.clone(), size.clone());
-        async move {
-            trx.set_option(TransactionOption::SpecialKeySpaceEnableWrites)?;
-            trx.set(SAMPLE_RATE_KEY, &rate);
-            trx.set(SIZE_LIMIT_KEY, &size);
-            Ok::<_, FdbBindingError>(())
-        }
-    })
-    .await
-    .expect("set profiling config");
-}
diff --git a/bindings/rust/foundationdb-recipes-simulation/Cargo.toml b/bindings/rust/foundationdb-recipes-simulation/Cargo.toml
deleted file mode 100644
index d72a13191f9..00000000000
--- a/bindings/rust/foundationdb-recipes-simulation/Cargo.toml
+++ /dev/null
@@ -1,22 +0,0 @@
-[package]
-name = "foundationdb-recipes-simulation"
-version = "0.1.0"
-edition = "2024"
-publish = false
-description = "Simulation workloads for FoundationDB recipes"
-license = "MIT OR Apache-2.0"
-
-[dependencies]
-foundationdb = { path = "../foundationdb", default-features = false, features = ["recipes", "fdb-7_4", "uuid"] }
-foundationdb-simulation = { path = "../foundationdb-simulation", features = ["fdb-7_4"] }
-futures = "0.3"
-
-[features]
-default = ["embedded-fdb-include"]
-embedded-fdb-include = [
-    "foundationdb/embedded-fdb-include",
-    "foundationdb-simulation/embedded-fdb-include",
-]
-
-[lib]
-crate-type = ["cdylib"]
diff --git a/bindings/rust/foundationdb-recipes-simulation/README.md b/bindings/rust/foundationdb-recipes-simulation/README.md
deleted file mode 100644
index 3916d134e30..00000000000
--- a/bindings/rust/foundationdb-recipes-simulation/README.md
+++ /dev/null
@@ -1,94 +0,0 @@
-# FoundationDB recipes simulation
-
-This crate runs deterministic FoundationDB simulator workloads for recipes.
-Its leader-election workload exercises the poll-based `LeaderElection` recipe
-composed with `RankedRegister` fencing.
-
-## Running
-
-```bash
-./scripts/run_leader_election_simulation.sh
-./scripts/run_leader_election_simulation.sh 50
-```
-
-The script builds the release workload and runs the one canonical polling
-configuration. Its argument is the total number of runs, so `50` means exactly
-50 runs. Each run prints a generated 32-bit seed and writes to an isolated
-trace directory. Passing directories are deleted; a failing directory is kept
-and the script prints an exact reproduction command. To reproduce a seed
-directly:
-
-```bash
-fdbserver -r simulation \
-  -f foundationdb-recipes-simulation/test_poll_leader_election.toml \
-  -b on --trace-format json -L target/traces --logsize 1GiB --seed <SEED>
-```
-
-## CI campaigns
-
-CI runs 1 worker x 10 seeds for ordinary pull requests and pushes to `main`.
-Changes to the leader-election or RankedRegister recipes, simulation code, or
-the runner use 4 workers x 50 seeds. The nightly and manually dispatched
-campaigns, plus pull requests labelled `leader-election-correctness`, use 4
-workers x 200 seeds. Failed runs retain their trace directory as a workflow
-artifact.
-
-## Leader-election workload
-
-One serializable durable key contains a monotonic revision, optional owner, and
-persisted lease duration. Revisions never decrease. Clients use heterogeneous
-configured durations, but followers wait only the duration persisted with their
-exact unchanged observation.
-
-Each client deterministically selects one swarm profile from the workload RNG:
-standard (40 operations, 2-second lease base), contention (160 operations,
-1-second lease base), or suspicion (80 operations, 3-second lease base).
-`operationCount` and `suspicionSecs` remain optional workload overrides for
-focused runs; the canonical configuration leaves both unset so clients use the
-swarm defaults. Setup traces and metrics report the selected profile and the
-effective operation count and lease base. The `swarm_profile` metric maps
-standard, contention, and suspicion to 0, 1, and 2 respectively.
-
-Each `db.run` attempt obtains `attempt_started_at` from simulated monotonic time
-as its first action, then sets `AutomaticIdempotency` and calls `poll`. After a
-successful outer run, follower observations are adopted with a fresh simulated
-time. Failed poll and resign paths discard local state and rotate to a fresh
-caller incarnation. Time is never persisted or used to order commits.
-
-Clients autonomously select a weighted mix of normal polls and adversarial
-resigns, observers, stale-token actions, pauses, duration changes, delayed
-post-commit local-state adoption, and local incarnation loss. A deterministic
-swarm bitset enables optional operation families. The delayed-adoption family
-selects sub-lease, exact-lease, and over-lease simulated delays from the
-workload RNG before `db.run`. It delays only a new or reset follower
-observation, using its persisted lease duration, after a successful run and
-before calling `PollResult::into_next_state`. Every leader poll co-commits
-`RankedRegister::read(rank)`, protected `write(rank, payload)`, and its
-operation log entry. Leadership alone is not authority.
-
-The completion phase biases execution toward boundary, stale-token,
-duration-reset, fencing, and delayed-adoption coverage that a short autonomous
-run might otherwise miss. Delayed-adoption metrics report successful delays in
-each of the three duration classes. Replay requires an over-lease delayed
-observation followed by a poll before that observation's adoption-based expiry.
-
-## Commit-order oracle
-
-Every simulated poll, resign, observer, and stale write is co-logged in its
-transaction. Log keys begin with an incomplete versionstamp, so the final range
-is ordered by actual commit order. Entries include durable prior/current state,
-caller local input, attempt time, configured duration, transition, fencing
-write evidence, and payload identity.
-
-During `check`, client 0 reads the entire operation log, public election state,
-and ranked-register write rank and value in one transaction at one read version.
-It replays from revision zero, no owner, and no protected value. The oracle
-enforces commit order, unique logical operations, exact local-state adoption,
-and public snapshot agreement. It tracks observed coverage for:
-
-- before, exact, and after persisted-duration expiry, including foreign takeover;
-- stale renewal, stale renewal after rank advance, exact resignation, delayed
-  stale resignation, and stale resignation after takeover;
-- follower reset after a renewal changes persisted duration;
-- rejected rank-zero and post-advance stale writes; and
-- a same-transaction fenced protected write for every leader poll.
diff --git a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/mod.rs b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/mod.rs
deleted file mode 100644
index 1ff689fb409..00000000000
--- a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/mod.rs
+++ /dev/null
@@ -1,13 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Deterministic simulation of poll-based, fenced leader election.
-
-mod types;
-mod workload;
-
-pub use workload::LeaderElectionWorkload;
diff --git a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/types.rs b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/types.rs
deleted file mode 100644
index 72025f4b491..00000000000
--- a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/types.rs
+++ /dev/null
@@ -1,86 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Commit-log types for the leader-lease simulation.
-
-use std::time::Duration;
-
-use foundationdb::tuple::Versionstamp;
-
-pub(crate) const OP_POLL: i64 = 0;
-pub(crate) const OP_RESIGN: i64 = 1;
-pub(crate) const OP_OBSERVE: i64 = 2;
-pub(crate) const OP_STALE_WRITE: i64 = 3;
-
-pub(crate) const LOCAL_UNKNOWN: i64 = 0;
-pub(crate) const LOCAL_OBSERVATION: i64 = 1;
-pub(crate) const LOCAL_LEADERSHIP: i64 = 2;
-
-pub(crate) const TRANSITION_ACQUIRED: i64 = 0;
-pub(crate) const TRANSITION_RENEWED: i64 = 1;
-pub(crate) const TRANSITION_TOOK_OVER: i64 = 2;
-pub(crate) const TRANSITION_REACQUIRED: i64 = 3;
-pub(crate) const TRANSITION_FOLLOWED: i64 = 4;
-pub(crate) const TRANSITION_NONE: i64 = 5;
-
-/// One durable election state exposed by the recipe's public API.
-#[derive(Debug, Clone, PartialEq, Eq, Default)]
-pub(crate) struct DurableState {
-    pub(crate) rank: u64,
-    pub(crate) owner: Option<String>,
-    pub(crate) lease_duration: Option<Duration>,
-}
-
-/// Caller-owned state supplied to an operation, represented without recipe
-/// private fields so commit-order replay can independently validate it.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) enum LocalInput {
-    Unknown,
-    Observation {
-        owner: String,
-        rank: u64,
-        lease_duration: Duration,
-        observed_at: Duration,
-    },
-    Leadership {
-        participant: String,
-        rank: u64,
-        lease_duration: Duration,
-        renewed_at: Duration,
-    },
-}
-
-/// One versionstamp-ordered simulation operation.
-#[derive(Debug)]
-pub(crate) struct LogEntry {
-    pub(crate) versionstamp: Versionstamp,
-    pub(crate) client_id: i32,
-    pub(crate) incarnation: u64,
-    pub(crate) op_num: u64,
-    pub(crate) kind: i64,
-    pub(crate) actor: String,
-    pub(crate) prior: DurableState,
-    pub(crate) current: DurableState,
-    pub(crate) local_input: LocalInput,
-    pub(crate) tracks_local_state: bool,
-    pub(crate) attempt_started_at: Duration,
-    pub(crate) configured_lease_duration: Duration,
-    pub(crate) planned_adoption_delay: Option<Duration>,
-    pub(crate) transition: i64,
-    pub(crate) result: bool,
-    pub(crate) requested_write_rank: u64,
-    pub(crate) observed_write_rank: u64,
-    pub(crate) observed_value: Option<Vec<u8>>,
-    pub(crate) protected_write_committed: bool,
-    pub(crate) payload: Vec<u8>,
-}
-
-pub(crate) struct Snapshot {
-    pub(crate) election: DurableState,
-    pub(crate) protected_rank: u64,
-    pub(crate) protected_value: Option<Vec<u8>>,
-}
diff --git a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs b/bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs
deleted file mode 100644
index 3444d49f824..00000000000
--- a/bindings/rust/foundationdb-recipes-simulation/src/leader_election/workload.rs
+++ /dev/null
@@ -1,2835 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Deterministic workload and independent commit-order oracle for leader leases.
-
-use std::{
-    collections::{BTreeMap, BTreeSet},
-    time::Duration,
-};
-
-use foundationdb::{
-    FdbBindingError, RangeOption,
-    options::{MutationType, TransactionOption},
-    recipes::{
-        leader_election::{
-            ElectionState, LeaderElection, Leadership, LocalState, ParticipantId, PollOutcome,
-            PollTransition,
-        },
-        ranked_register::{Rank, RankedRegister, RankedRegisterError},
-    },
-    tuple::{Subspace, Versionstamp, pack, unpack},
-};
-use foundationdb_simulation::{
-    Metric, Metrics, RustWorkload, Severity, SimDatabase, SingleRustWorkload, WorkloadContext,
-    details,
-};
-use futures::TryStreamExt;
-
-use super::types::{
-    DurableState, LOCAL_LEADERSHIP, LOCAL_OBSERVATION, LOCAL_UNKNOWN, LocalInput, LogEntry,
-    OP_OBSERVE, OP_POLL, OP_RESIGN, OP_STALE_WRITE, Snapshot, TRANSITION_ACQUIRED,
-    TRANSITION_FOLLOWED, TRANSITION_NONE, TRANSITION_REACQUIRED, TRANSITION_RENEWED,
-    TRANSITION_TOOK_OVER,
-};
-
-const OPTIONAL_RESIGN: u32 = 1;
-const OPTIONAL_OBSERVER: u32 = 2;
-const OPTIONAL_PAUSE: u32 = 4;
-const OPTIONAL_DELAYED_ADOPTION: u32 = 8;
-const RACE_PARTICIPANT_PREFIX: &str = "race\0";
-
-// `complete_witnesses` deterministically drives these paths after the swarm finishes.
-const FORCED_WITNESS_COUNT: usize = 9;
-// The remaining paths depend on earlier swarm state or simulated timing.
-const PROBABILISTIC_WITNESS_COUNT: usize = 7;
-// `WorkloadContext::now()` crosses the simulator's f64 boundary. Preserve the replay's exact
-// state eligibility checks while accepting its demonstrated one-nanosecond round-trip loss.
-const SIMULATED_TIME_ROUND_TRIP_TOLERANCE: Duration = Duration::from_nanos(1);
-// The deterministic completion tail must renew before its lease can expire under any simulator
-// time jump. Its one-second renewal reaches `Duration::MAX` while remaining strictly larger.
-const COMPLETION_RENEWAL_BASE_LEASE_DURATION: Duration = Duration::new(u64::MAX - 1, 999_999_999);
-
-#[derive(Clone, Copy)]
-enum SwarmProfile {
-    Standard,
-    Contention,
-    Suspicion,
-}
-
-impl SwarmProfile {
-    fn from_random(random: u32) -> Self {
-        match random % 3 {
-            0 => Self::Standard,
-            1 => Self::Contention,
-            _ => Self::Suspicion,
-        }
-    }
-
-    fn name(self) -> &'static str {
-        match self {
-            Self::Standard => "standard",
-            Self::Contention => "contention",
-            Self::Suspicion => "suspicion",
-        }
-    }
-
-    fn metric_value(self) -> f64 {
-        match self {
-            Self::Standard => 0.0,
-            Self::Contention => 1.0,
-            Self::Suspicion => 2.0,
-        }
-    }
-
-    fn operation_count(self) -> usize {
-        match self {
-            Self::Standard => 40,
-            Self::Contention => 160,
-            Self::Suspicion => 80,
-        }
-    }
-
-    fn lease_base_secs(self) -> u64 {
-        match self {
-            Self::Standard => 2,
-            Self::Contention => 1,
-            Self::Suspicion => 3,
-        }
-    }
-}
-
-pub struct LeaderElectionWorkload {
-    context: WorkloadContext,
-    client_id: i32,
-    profile: SwarmProfile,
-    operation_count: usize,
-    lease_base_secs: u64,
-    lease_duration: Duration,
-    election_subspace: Subspace,
-    register_subspace: Subspace,
-    log_subspace: Subspace,
-    completion_ready_subspace: Subspace,
-    race_subspace: Subspace,
-    participant: ParticipantId,
-    incarnation: u64,
-    local_state: LocalState,
-    last_leadership: Option<Leadership>,
-    stale_leadership: Option<Leadership>,
-    stale_rank: Option<Rank>,
-    zero_stale_write_completed: bool,
-    stale_actions_completed: bool,
-    expiry_pause_completed: bool,
-    normal_weight: u32,
-    adversarial_weight: u32,
-    op_num: u64,
-    swarm: u32,
-    poll_count: u64,
-    leader_count: u64,
-    run_errors: u64,
-    delayed_adoption_count: u64,
-    delayed_adoption_sub_lease_count: u64,
-    delayed_adoption_exact_lease_count: u64,
-    delayed_adoption_over_lease_count: u64,
-    completion_run_errors: u64,
-    coordinated_race_completed: bool,
-    coordinated_race_contenders: usize,
-}
-
-impl SingleRustWorkload for LeaderElectionWorkload {
-    fn new(_name: String, context: WorkloadContext) -> Self {
-        let client_id = context.client_id();
-        let profile = SwarmProfile::from_random(context.rnd());
-        let operation_count = context
-            .get_option("operationCount")
-            .unwrap_or(profile.operation_count());
-        let lease_base_secs = context
-            .get_option("suspicionSecs")
-            .unwrap_or(profile.lease_base_secs());
-        let lease_duration = Duration::from_secs(lease_base_secs + u64::from(context.rnd() % 3));
-        debug_assert!(ParticipantId::new("").is_err());
-        let process_id = context.get_process_id();
-        let participant_text = match context.rnd() % 4 {
-            0 => format!("participant-{client_id}-{process_id}"),
-            1 => format!("participant\0{client_id}-{process_id}"),
-            2 => format!("participant-λ-{client_id}-{process_id}"),
-            _ => format!("participant-{client_id}-{process_id}-{}", "x".repeat(128)),
-        };
-        let participant =
-            ParticipantId::new(participant_text).expect("generated participant IDs are non-empty");
-
-        Self {
-            client_id,
-            profile,
-            operation_count,
-            lease_base_secs,
-            lease_duration,
-            election_subspace: Subspace::all().subspace(&("leader-lease",)),
-            register_subspace: Subspace::all().subspace(&("leader-lease-register",)),
-            log_subspace: Subspace::all().subspace(&("leader-lease-log",)),
-            completion_ready_subspace: Subspace::all()
-                .subspace(&("leader-lease-completion-ready",)),
-            race_subspace: Subspace::all().subspace(&("leader-lease-race",)),
-            participant,
-            incarnation: 0,
-            local_state: LocalState::unknown(),
-            last_leadership: None,
-            stale_leadership: None,
-            stale_rank: None,
-            zero_stale_write_completed: false,
-            stale_actions_completed: false,
-            expiry_pause_completed: false,
-            normal_weight: 50 + context.rnd() % 21,
-            adversarial_weight: 20 + context.rnd() % 21,
-            op_num: 0,
-            swarm: context.rnd(),
-            poll_count: 0,
-            leader_count: 0,
-            run_errors: 0,
-            delayed_adoption_count: 0,
-            delayed_adoption_sub_lease_count: 0,
-            delayed_adoption_exact_lease_count: 0,
-            delayed_adoption_over_lease_count: 0,
-            completion_run_errors: 0,
-            coordinated_race_completed: false,
-            coordinated_race_contenders: 0,
-            context,
-        }
-    }
-}
-
-impl RustWorkload for LeaderElectionWorkload {
-    async fn setup(&mut self, _db: SimDatabase) {
-        self.context.trace(
-            Severity::Info,
-            "LeaderLeaseSetup",
-            details![
-                "Layer" => "Rust",
-                "Client" => self.client_id,
-                "Profile" => self.profile.name(),
-                "OperationCount" => self.operation_count,
-                "LeaseBaseSecs" => self.lease_base_secs,
-                "LeaseSecs" => self.lease_duration.as_secs(),
-                "Protocol" => "poll-lease-fenced-ranked-register"
-            ],
-        );
-    }
-
-    async fn start(&mut self, db: SimDatabase) {
-        let register = RankedRegister::new(self.register_subspace.clone());
-
-        for round in 0..self.operation_count {
-            let operation_weight = self.context.rnd() % 100;
-            let duration_change = operation_weight
-                >= self.normal_weight + 4 * self.adversarial_weight / 5
-                && operation_weight < self.normal_weight + self.adversarial_weight;
-            let election = LeaderElection::new(
-                self.election_subspace.clone(),
-                if duration_change {
-                    self.lease_duration_for_round(round)
-                } else {
-                    self.lease_duration
-                },
-            )
-            .expect("generated lease duration is non-zero");
-            let run_normal_poll =
-                round == 0 || operation_weight < self.normal_weight || duration_change;
-            let mut forced_expiry_pause = false;
-
-            if run_normal_poll {
-                self.poll_count += 1;
-                let op_num = self.next_op_num();
-                let adoption_delay = self.random_adoption_delay();
-                let poll = run_poll(
-                    &db,
-                    election.clone(),
-                    register.clone(),
-                    self.log_subspace.clone(),
-                    self.participant.clone(),
-                    self.local_state.clone(),
-                    true,
-                    &self.context,
-                    self.client_id,
-                    self.incarnation,
-                    op_num,
-                    adoption_delay,
-                )
-                .await;
-
-                let mut exercise_zero_stale_write = false;
-                match poll {
-                    Ok(poll) => {
-                        if let Some(delay) = poll.adoption_delay {
-                            self.record_delayed_adoption(delay);
-                        }
-                        self.local_state = poll.next_state;
-                        if let Some(leadership) = poll.leadership {
-                            if let Some(previous) = self
-                                .last_leadership
-                                .as_ref()
-                                .filter(|previous| previous.rank() < leadership.rank())
-                                .cloned()
-                            {
-                                self.stale_rank = Some(previous.rank());
-                                self.stale_leadership = Some(previous);
-                            }
-                            self.last_leadership = Some(leadership);
-                            self.leader_count += 1;
-                            forced_expiry_pause = !self.expiry_pause_completed;
-                            exercise_zero_stale_write = !self.zero_stale_write_completed;
-                        }
-                    }
-                    Err(error) => {
-                        self.run_diagnostic("PollRunFailed", op_num, error);
-                        self.replace_incarnation("poll-error");
-                    }
-                }
-
-                if exercise_zero_stale_write {
-                    let stale_write_op = self.next_op_num();
-                    match run_stale_write(
-                        &db,
-                        election.clone(),
-                        register.clone(),
-                        self.log_subspace.clone(),
-                        self.participant.as_str().to_owned(),
-                        Rank::ZERO,
-                        simulated_now(&self.context),
-                        self.client_id,
-                        self.incarnation,
-                        stale_write_op,
-                    )
-                    .await
-                    {
-                        Ok(true) => self.protocol_error(
-                            "ZeroRankStaleWriteCommitted",
-                            stale_write_op,
-                            "a rank-zero ranked-register write committed after leadership began",
-                        ),
-                        Ok(false) => self.zero_stale_write_completed = true,
-                        Err(error) => {
-                            self.run_diagnostic("ZeroRankStaleWriteFailed", stale_write_op, error)
-                        }
-                    }
-                }
-            }
-
-            if self.swarm & OPTIONAL_OBSERVER != 0
-                && operation_weight >= self.normal_weight
-                && operation_weight < self.normal_weight + self.adversarial_weight / 3
-            {
-                let op_num = self.next_op_num();
-                if let Err(error) = run_observer(
-                    &db,
-                    election.clone(),
-                    self.log_subspace.clone(),
-                    self.participant.as_str().to_owned(),
-                    self.lease_duration,
-                    simulated_now(&self.context),
-                    self.client_id,
-                    self.incarnation,
-                    op_num,
-                )
-                .await
-                {
-                    self.run_diagnostic("ObserverRunFailed", op_num, error);
-                }
-            }
-
-            if self.swarm & OPTIONAL_RESIGN != 0
-                && operation_weight >= self.normal_weight + self.adversarial_weight / 3
-                && operation_weight < self.normal_weight + 2 * self.adversarial_weight / 3
-            {
-                if let Some(leadership) = self.local_state.leadership().cloned() {
-                    let op_num = self.next_op_num();
-                    match run_resign(
-                        &db,
-                        election.clone(),
-                        self.log_subspace.clone(),
-                        leadership,
-                        simulated_now(&self.context),
-                        self.client_id,
-                        self.incarnation,
-                        true,
-                        op_num,
-                    )
-                    .await
-                    {
-                        Ok(true) => {
-                            self.local_state = LocalState::unknown();
-                            self.force_foreign_takeover(
-                                &db,
-                                &register,
-                                election.lease_duration(),
-                                (self.swarm & OPTIONAL_DELAYED_ADOPTION != 0)
-                                    .then_some(AdoptionDelay::Longer),
-                            )
-                            .await;
-                        }
-                        Ok(false) => {}
-                        Err(error) => {
-                            self.run_diagnostic("ResignRunFailed", op_num, error);
-                            self.replace_incarnation("resign-error");
-                        }
-                    }
-                }
-            }
-
-            if operation_weight >= self.normal_weight + 2 * self.adversarial_weight / 3
-                && operation_weight < self.normal_weight + 4 * self.adversarial_weight / 5
-                && !self.stale_actions_completed
-            {
-                if let (Some(stale_leadership), Some(stale_rank)) =
-                    (self.stale_leadership.clone(), self.stale_rank)
-                {
-                    self.exercise_stale_tokens(&db, &register, stale_leadership, stale_rank)
-                        .await;
-                }
-            }
-
-            if operation_weight >= self.normal_weight + self.adversarial_weight {
-                self.replace_incarnation("dropped");
-                self.context.trace(
-                    Severity::Info,
-                    "LeaderLeaseLostLocalState",
-                    details!["Client" => self.client_id, "Round" => round],
-                );
-            }
-
-            if round % 3 == 0 {
-                if let Err(error) =
-                    continuous_snapshot_check(&db, election.clone(), register.clone()).await
-                {
-                    if error.get_fdb_error().is_some() {
-                        self.run_diagnostic("ContinuousSnapshotFailed", self.op_num, error);
-                    } else {
-                        self.protocol_error(
-                            "ContinuousSnapshotInvariantFailed",
-                            self.op_num,
-                            "one-transaction public snapshot violated structural invariants",
-                        );
-                    }
-                }
-            }
-
-            let boundary_pause = forced_expiry_pause
-                || (self.swarm & OPTIONAL_PAUSE != 0
-                    && operation_weight >= self.normal_weight + 4 * self.adversarial_weight / 5
-                    && operation_weight < self.normal_weight + self.adversarial_weight);
-            if boundary_pause {
-                if forced_expiry_pause {
-                    self.expiry_pause_completed = true;
-                }
-                let target = match &self.local_state {
-                    LocalState::Observation(observation) => observation
-                        .first_observed_at()
-                        .saturating_add(observation.lease_duration())
-                        .saturating_add(Duration::from_millis(1)),
-                    LocalState::Leadership(leadership) => leadership
-                        .last_renewed_at()
-                        .saturating_add(leadership.lease_duration())
-                        .saturating_add(Duration::from_millis(1)),
-                    LocalState::Unknown => {
-                        simulated_now(&self.context).saturating_add(Duration::from_millis(1))
-                    }
-                };
-                delay_until(&self.context, target).await;
-                continue;
-            }
-            delay_until(&self.context, self.inter_round_target(round)).await;
-        }
-
-        self.write_completion_ready_marker(&db).await;
-        self.wait_for_completion_ready_markers(&db).await;
-        self.coordinated_takeover_race(&db, &register).await;
-        if self.client_id != 0 {
-            return;
-        }
-        let run_errors_before_completion = self.run_errors;
-        self.complete_witnesses(db, register).await;
-        self.completion_run_errors = self.run_errors - run_errors_before_completion;
-    }
-
-    async fn check(&mut self, db: SimDatabase) {
-        if self.client_id != 0 {
-            return;
-        }
-
-        let log_subspace = self.log_subspace.clone();
-        let election = LeaderElection::new(self.election_subspace.clone(), self.lease_duration)
-            .expect("configured lease duration is non-zero");
-        let register = RankedRegister::new(self.register_subspace.clone());
-        let result = db
-            .run(|txn, _maybe_committed| {
-                let log_subspace = log_subspace.clone();
-                let election = election.clone();
-                let register = register.clone();
-                async move {
-                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                    let read_version = txn.get_read_version().await?;
-                    let key_values: Vec<_> = txn
-                        .get_ranges_keyvalues(RangeOption::from(log_subspace.range()), false)
-                        .try_collect()
-                        .await
-                        .map_err(FdbBindingError::from)?;
-                    let mut entries = Vec::with_capacity(key_values.len());
-                    for key_value in key_values {
-                        entries.push(decode_log_entry(
-                            &log_subspace,
-                            key_value.key(),
-                            key_value.value(),
-                        )?);
-                    }
-                    let election = durable_from_public(
-                        election.state(&txn).await.map_err(FdbBindingError::from)?,
-                    );
-                    let protected = register
-                        .read(&txn, Rank::ZERO)
-                        .await
-                        .map_err(ranked_register_error)?;
-                    Ok::<_, FdbBindingError>((
-                        read_version,
-                        entries,
-                        Snapshot {
-                            election,
-                            protected_rank: protected.write_rank().as_u64(),
-                            protected_value: protected.into_value(),
-                        },
-                    ))
-                }
-            })
-            .await;
-
-        match result {
-            Ok((read_version, entries, snapshot)) => match replay(&entries, &snapshot) {
-                Ok(coverage)
-                    if (!coverage.forced_missing.is_empty() && self.completion_run_errors == 0)
-                        || !self.coordinated_race_completed
-                        || !coverage.saw_coordinated_race
-                        || coverage.coordinated_race_contenders
-                            != self.coordinated_race_contenders =>
-                {
-                    self.context.trace(
-                        Severity::Error,
-                        "LeaderLeaseForcedWitnessMissing",
-                        details![
-                            "ReadVersion" => read_version,
-                            "Entries" => entries.len(),
-                            "ForcedWitnessesObserved" => coverage.forced_observed,
-                            "ForcedWitnessesMissing" => coverage.forced_missing.join(", "),
-                            "ProbabilisticWitnessesObserved" => coverage.probabilistic_observed,
-                            "ProbabilisticWitnessesMissing" => coverage.probabilistic_missing.join(", "),
-                            "CoordinatedRaceCompleted" => self.coordinated_race_completed,
-                            "CoordinatedRaceObserved" => coverage.saw_coordinated_race,
-                            "CoordinatedRaceContenders" => coverage.coordinated_race_contenders,
-                            "ExpectedCoordinatedRaceContenders" => self.coordinated_race_contenders,
-                        ],
-                    )
-                }
-                Ok(coverage)
-                    if !coverage.forced_missing.is_empty()
-                        || !coverage.probabilistic_missing.is_empty()
-                        || !self.coordinated_race_completed =>
-                {
-                    self.context.trace(
-                        Severity::Warn,
-                        "LeaderLeaseCoverageIncomplete",
-                        details![
-                            "ReadVersion" => read_version,
-                            "Entries" => entries.len(),
-                            "CompletionRunErrors" => self.completion_run_errors,
-                            "ForcedWitnessesObserved" => coverage.forced_observed,
-                            "ForcedWitnessesMissing" => coverage.forced_missing.join(", "),
-                            "ProbabilisticWitnessesObserved" => coverage.probabilistic_observed,
-                            "ProbabilisticWitnessesMissing" => coverage.probabilistic_missing.join(", "),
-                            "CoordinatedRaceCompleted" => self.coordinated_race_completed,
-                            "CoordinatedRaceObserved" => coverage.saw_coordinated_race,
-                            "CoordinatedRaceContenders" => coverage.coordinated_race_contenders,
-                            "ExpectedCoordinatedRaceContenders" => self.coordinated_race_contenders,
-                        ],
-                    )
-                }
-                Ok(coverage) => self.context.trace(
-                    Severity::Info,
-                    "LeaderLeaseCheckPassed",
-                    details![
-                        "ReadVersion" => read_version,
-                        "Entries" => entries.len(),
-                        "ForcedWitnessesObserved" => coverage.forced_observed,
-                        "ProbabilisticWitnessesObserved" => coverage.probabilistic_observed,
-                        "CoordinatedRaceObserved" => coverage.saw_coordinated_race,
-                        "CoordinatedRaceContenders" => coverage.coordinated_race_contenders,
-                        "ExpectedCoordinatedRaceContenders" => self.coordinated_race_contenders,
-                    ],
-                ),
-                Err(error) => self.context.trace(
-                    Severity::Error,
-                    "LeaderLeaseInvariantFailed",
-                    details!["ReadVersion" => read_version, "Error" => error],
-                ),
-            },
-            Err(error) => self.context.trace(
-                Severity::Error,
-                "LeaderLeaseCheckReadFailed",
-                details!["Error" => format!("{error:?}")],
-            ),
-        }
-    }
-
-    fn get_metrics(&self, mut out: Metrics<'_>) {
-        out.extend([
-            Metric::val("swarm_profile", self.profile.metric_value()),
-            Metric::val("operation_count", self.operation_count as f64),
-            Metric::val("lease_base_secs", self.lease_base_secs as f64),
-            Metric::val("poll_count", self.poll_count as f64),
-            Metric::val("leader_count", self.leader_count as f64),
-            Metric::val("run_errors", self.run_errors as f64),
-            Metric::val("delayed_adoption_count", self.delayed_adoption_count as f64),
-            Metric::val(
-                "delayed_adoption_sub_lease_count",
-                self.delayed_adoption_sub_lease_count as f64,
-            ),
-            Metric::val(
-                "delayed_adoption_exact_lease_count",
-                self.delayed_adoption_exact_lease_count as f64,
-            ),
-            Metric::val(
-                "delayed_adoption_over_lease_count",
-                self.delayed_adoption_over_lease_count as f64,
-            ),
-            Metric::val("completion_run_errors", self.completion_run_errors as f64),
-            Metric::val(
-                "coordinated_race_completed",
-                if self.coordinated_race_completed {
-                    1.0
-                } else {
-                    0.0
-                },
-            ),
-            Metric::val(
-                "coordinated_race_contenders",
-                self.coordinated_race_contenders as f64,
-            ),
-        ]);
-    }
-
-    fn get_check_timeout(&self) -> f64 {
-        5000.0
-    }
-}
-
-impl LeaderElectionWorkload {
-    async fn write_completion_ready_marker(&mut self, db: &SimDatabase) {
-        let completion_ready_subspace = self.completion_ready_subspace.clone();
-        self.write_phase_marker(db, &completion_ready_subspace, "ready", b"ready")
-            .await;
-    }
-
-    async fn wait_for_completion_ready_markers(&mut self, db: &SimDatabase) {
-        let completion_ready_subspace = self.completion_ready_subspace.clone();
-        self.wait_for_phase_markers(db, &completion_ready_subspace, "ready")
-            .await;
-    }
-
-    async fn completion_barrier_delay(&self) {
-        if let Err(error) = self.context.delay(Duration::from_millis(1)).await {
-            self.context.trace(
-                Severity::Warn,
-                "CompletionBarrierDelayFailed",
-                details!["Client" => self.client_id, "Error" => format!("{error:?}")],
-            );
-        }
-    }
-
-    async fn write_phase_marker(
-        &mut self,
-        db: &SimDatabase,
-        marker_subspace: &Subspace,
-        phase: &str,
-        value: &[u8],
-    ) {
-        let key = marker_subspace.pack(&(phase, self.client_id));
-
-        loop {
-            let result = db
-                .run(|txn, _maybe_committed| {
-                    let key = key.clone();
-                    let value = value.to_vec();
-                    async move {
-                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                        txn.set(&key, &value);
-                        Ok::<_, FdbBindingError>(())
-                    }
-                })
-                .await;
-            match result {
-                Ok(()) => return,
-                Err(error) => self.run_diagnostic("PhaseMarkerWriteFailed", self.op_num, error),
-            }
-
-            self.completion_barrier_delay().await;
-        }
-    }
-
-    async fn wait_for_phase_markers(
-        &mut self,
-        db: &SimDatabase,
-        marker_subspace: &Subspace,
-        phase: &str,
-    ) {
-        let client_count = self.context.client_count();
-
-        loop {
-            let marker_subspace = marker_subspace.clone();
-            let phase = phase.to_owned();
-            let ready = db
-                .run(|txn, _maybe_committed| {
-                    let marker_subspace = marker_subspace.clone();
-                    let phase = phase.clone();
-                    async move {
-                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                        for client_id in 0..client_count {
-                            if txn
-                                .get(&marker_subspace.pack(&(phase.as_str(), client_id)), false)
-                                .await?
-                                .is_none()
-                            {
-                                return Ok::<_, FdbBindingError>(false);
-                            }
-                        }
-                        Ok(true)
-                    }
-                })
-                .await;
-            match ready {
-                Ok(true) => return,
-                Ok(false) => {}
-                Err(error) => self.run_diagnostic("PhaseMarkerReadFailed", self.op_num, error),
-            }
-
-            self.completion_barrier_delay().await;
-        }
-    }
-
-    async fn phase_statuses(
-        &mut self,
-        db: &SimDatabase,
-        marker_subspace: &Subspace,
-        phase: &str,
-    ) -> Vec<Vec<u8>> {
-        let client_count = self.context.client_count();
-
-        loop {
-            let marker_subspace = marker_subspace.clone();
-            let phase = phase.to_owned();
-            let statuses = db
-                .run(|txn, _maybe_committed| {
-                    let marker_subspace = marker_subspace.clone();
-                    let phase = phase.clone();
-                    async move {
-                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                        let mut statuses = Vec::with_capacity(client_count as usize);
-                        for client_id in 0..client_count {
-                            statuses.push(
-                                txn.get(&marker_subspace.pack(&(phase.as_str(), client_id)), false)
-                                    .await?
-                                    .map(|value| value.to_vec())
-                                    .unwrap_or_default(),
-                            );
-                        }
-                        Ok::<_, FdbBindingError>(statuses)
-                    }
-                })
-                .await;
-            match statuses {
-                Ok(statuses) => return statuses,
-                Err(error) => self.run_diagnostic("PhaseStatusReadFailed", self.op_num, error),
-            }
-
-            self.completion_barrier_delay().await;
-        }
-    }
-
-    async fn coordinated_takeover_race(&mut self, db: &SimDatabase, register: &RankedRegister) {
-        let race_subspace = self.race_subspace.clone();
-        self.replace_incarnation("race");
-        let initial_poll_op = self.next_op_num();
-        let initial_race_poll = run_poll(
-            db,
-            LeaderElection::new(self.election_subspace.clone(), self.lease_duration)
-                .expect("configured lease duration is non-zero"),
-            register.clone(),
-            self.log_subspace.clone(),
-            self.participant.clone(),
-            self.local_state.clone(),
-            true,
-            &self.context,
-            self.client_id,
-            self.incarnation,
-            initial_poll_op,
-            None,
-        )
-        .await;
-        let initial_poll_failed = match initial_race_poll {
-            Ok(poll) => {
-                self.local_state = poll.next_state;
-                false
-            }
-            Err(error) => {
-                self.run_diagnostic("RaceInitialPollFailed", initial_poll_op, error);
-                self.replace_incarnation("race-initial-poll-error");
-                true
-            }
-        };
-        self.write_phase_marker(db, &race_subspace, "observed", b"ready")
-            .await;
-        self.wait_for_phase_markers(db, &race_subspace, "observed")
-            .await;
-
-        let observation = self.local_state.observation().cloned();
-        if let Some(observation) = observation.as_ref() {
-            delay_until(
-                &self.context,
-                observation
-                    .first_observed_at()
-                    .saturating_add(observation.lease_duration()),
-            )
-            .await;
-        }
-        self.write_phase_marker(db, &race_subspace, "expired", b"ready")
-            .await;
-        self.wait_for_phase_markers(db, &race_subspace, "expired")
-            .await;
-
-        let status: &[u8] = if initial_poll_failed {
-            b"error"
-        } else if let Some(observation) = observation {
-            let stale_rank = observation.rank();
-            let race_poll_op = self.next_op_num();
-            let race_poll = run_poll(
-                db,
-                LeaderElection::new(self.election_subspace.clone(), self.lease_duration)
-                    .expect("configured lease duration is non-zero"),
-                register.clone(),
-                self.log_subspace.clone(),
-                self.participant.clone(),
-                self.local_state.clone(),
-                true,
-                &self.context,
-                self.client_id,
-                self.incarnation,
-                race_poll_op,
-                None,
-            )
-            .await;
-            match race_poll {
-                Ok(poll) => {
-                    self.local_state = poll.next_state;
-                    let stale_write_op = self.next_op_num();
-                    match run_stale_write(
-                        db,
-                        LeaderElection::new(self.election_subspace.clone(), self.lease_duration)
-                            .expect("configured lease duration is non-zero"),
-                        register.clone(),
-                        self.log_subspace.clone(),
-                        self.participant.as_str().to_owned(),
-                        stale_rank,
-                        simulated_now(&self.context),
-                        self.client_id,
-                        self.incarnation,
-                        stale_write_op,
-                    )
-                    .await
-                    {
-                        Ok(false) => b"contended",
-                        Ok(true) => {
-                            self.protocol_error(
-                                "RaceStaleWriteCommitted",
-                                stale_write_op,
-                                "a takeover contender committed at the predecessor rank",
-                            );
-                            b"error"
-                        }
-                        Err(error) => {
-                            self.run_diagnostic("RaceStaleWriteFailed", stale_write_op, error);
-                            b"error"
-                        }
-                    }
-                }
-                Err(error) => {
-                    self.run_diagnostic("RacePollFailed", race_poll_op, error);
-                    self.replace_incarnation("race-poll-error");
-                    b"error"
-                }
-            }
-        } else {
-            b"incumbent"
-        };
-        self.write_phase_marker(db, &race_subspace, "done", status)
-            .await;
-        self.wait_for_phase_markers(db, &race_subspace, "done")
-            .await;
-
-        if self.client_id == 0 {
-            let statuses = self.phase_statuses(db, &race_subspace, "done").await;
-            self.coordinated_race_contenders = statuses
-                .iter()
-                .filter(|status| *status == b"contended")
-                .count();
-            self.coordinated_race_completed = self.coordinated_race_contenders >= 2
-                && statuses.iter().all(|status| status != b"error");
-        }
-    }
-
-    async fn force_foreign_takeover(
-        &mut self,
-        db: &SimDatabase,
-        register: &RankedRegister,
-        follower_duration: Duration,
-        adoption_delay: Option<AdoptionDelay>,
-    ) {
-        let foreign = ParticipantId::new(format!(
-            "foreign\0λ-{}-{}-{}",
-            self.client_id,
-            self.context.get_process_id(),
-            self.incarnation,
-        ))
-        .expect("generated foreign participant is non-empty");
-        let foreign_duration = follower_duration + Duration::from_secs(2);
-        let foreign_election =
-            LeaderElection::new(self.election_subspace.clone(), foreign_duration)
-                .expect("foreign lease duration is non-zero");
-        let foreign_op = self.next_op_num();
-        let foreign_poll = run_poll(
-            db,
-            foreign_election,
-            register.clone(),
-            self.log_subspace.clone(),
-            foreign,
-            LocalState::unknown(),
-            false,
-            &self.context,
-            self.client_id,
-            self.incarnation,
-            foreign_op,
-            None,
-        )
-        .await;
-        let foreign_poll = match foreign_poll {
-            Ok(poll) => poll,
-            Err(error) => {
-                self.run_diagnostic("ForeignTakeoverPollFailed", foreign_op, error);
-                return;
-            }
-        };
-        let Some(predecessor) = foreign_poll.leadership else {
-            return;
-        };
-
-        self.local_state = LocalState::unknown();
-        let _ = self
-            .poll_once(db, register, follower_duration, adoption_delay)
-            .await;
-        let Some(observation) = self.local_state.observation().cloned() else {
-            return;
-        };
-        if observation.owner().as_str() == self.participant.as_str()
-            || observation.lease_duration() != predecessor.lease_duration()
-        {
-            return;
-        }
-        let before = observation
-            .first_observed_at()
-            .saturating_add(observation.lease_duration())
-            .saturating_sub(Duration::from_millis(1));
-        delay_until(&self.context, before).await;
-        let _ = self.poll_once(db, register, follower_duration, None).await;
-        let exact = observation
-            .first_observed_at()
-            .saturating_add(observation.lease_duration());
-        delay_until(&self.context, exact).await;
-        let takeover = self.poll_once(db, register, follower_duration, None).await;
-        if takeover.is_some_and(|leadership| leadership.rank() > predecessor.rank()) {
-            self.exercise_stale_tokens(db, register, predecessor.clone(), predecessor.rank())
-                .await;
-        }
-    }
-}
-
-impl LeaderElectionWorkload {
-    fn inter_round_target(&self, round: usize) -> Duration {
-        let (anchor, lease_duration) = match &self.local_state {
-            LocalState::Observation(observation) => (
-                observation.first_observed_at(),
-                observation.lease_duration(),
-            ),
-            LocalState::Leadership(leadership) => {
-                (leadership.last_renewed_at(), leadership.lease_duration())
-            }
-            LocalState::Unknown => (simulated_now(&self.context), self.lease_duration),
-        };
-        let offset = match (self.swarm as usize + round) % 3 {
-            0 => lease_duration / 2,
-            1 => lease_duration,
-            _ => lease_duration.saturating_add(Duration::from_millis(1)),
-        };
-        anchor.saturating_add(offset)
-    }
-
-    fn lease_duration_for_round(&self, round: usize) -> Duration {
-        self.lease_duration
-            + Duration::from_secs(u64::from((self.swarm.wrapping_add(round as u32)) % 3))
-    }
-
-    fn next_op_num(&mut self) -> u64 {
-        let op_num = self.op_num;
-        self.op_num += 1;
-        op_num
-    }
-
-    fn random_adoption_delay(&self) -> Option<AdoptionDelay> {
-        (self.swarm & OPTIONAL_DELAYED_ADOPTION != 0)
-            .then(|| AdoptionDelay::from_random(self.context.rnd()))
-    }
-
-    fn record_delayed_adoption(&mut self, delay: AdoptionDelay) {
-        self.delayed_adoption_count += 1;
-        match delay {
-            AdoptionDelay::Shorter => self.delayed_adoption_sub_lease_count += 1,
-            AdoptionDelay::Exact => self.delayed_adoption_exact_lease_count += 1,
-            AdoptionDelay::Longer => self.delayed_adoption_over_lease_count += 1,
-        }
-    }
-
-    fn run_diagnostic(&mut self, event: &str, op_num: u64, error: FdbBindingError) {
-        self.run_errors += 1;
-        self.context.trace(
-            Severity::Warn,
-            event,
-            details![
-                "Client" => self.client_id,
-                "OpNum" => op_num,
-                "Error" => format!("{error:?}"),
-                "MaybeCommitted" => error.get_fdb_error().is_some_and(|error| error.is_maybe_committed())
-            ],
-        );
-    }
-
-    fn protocol_error(&self, event: &str, op_num: u64, error: &str) {
-        self.context.trace(
-            Severity::Error,
-            event,
-            details!["Client" => self.client_id, "OpNum" => op_num, "Error" => error],
-        );
-    }
-
-    fn replace_incarnation(&mut self, label: &str) {
-        self.incarnation += 1;
-        self.participant = ParticipantId::new(format!(
-            "{label}\0λ-{}-{}-{}",
-            self.client_id,
-            self.context.get_process_id(),
-            self.incarnation,
-        ))
-        .expect("generated incarnation ID is non-empty");
-        self.local_state = LocalState::unknown();
-        self.last_leadership = None;
-        self.stale_leadership = None;
-        self.stale_rank = None;
-    }
-
-    async fn poll_once(
-        &mut self,
-        db: &SimDatabase,
-        register: &RankedRegister,
-        lease_duration: Duration,
-        adoption_delay: Option<AdoptionDelay>,
-    ) -> Option<Leadership> {
-        let election = LeaderElection::new(self.election_subspace.clone(), lease_duration)
-            .expect("completion lease duration is non-zero");
-        let op_num = self.next_op_num();
-        let result = run_poll(
-            db,
-            election,
-            register.clone(),
-            self.log_subspace.clone(),
-            self.participant.clone(),
-            self.local_state.clone(),
-            true,
-            &self.context,
-            self.client_id,
-            self.incarnation,
-            op_num,
-            adoption_delay,
-        )
-        .await;
-        match result {
-            Ok(poll) => {
-                if let Some(delay) = poll.adoption_delay {
-                    self.record_delayed_adoption(delay);
-                }
-                self.local_state = poll.next_state;
-                if let Some(leadership) = poll.leadership {
-                    if let Some(previous) = self
-                        .last_leadership
-                        .as_ref()
-                        .filter(|previous| previous.rank() < leadership.rank())
-                        .cloned()
-                    {
-                        self.stale_leadership = Some(previous.clone());
-                        self.stale_rank = Some(previous.rank());
-                    }
-                    self.last_leadership = Some(leadership.clone());
-                    Some(leadership)
-                } else {
-                    None
-                }
-            }
-            Err(error) => {
-                self.run_diagnostic("CompletionPollFailed", op_num, error);
-                self.replace_incarnation("completion-poll-error");
-                None
-            }
-        }
-    }
-
-    async fn exercise_stale_tokens(
-        &mut self,
-        db: &SimDatabase,
-        register: &RankedRegister,
-        stale_leadership: Leadership,
-        stale_rank: Rank,
-    ) {
-        let election = LeaderElection::new(self.election_subspace.clone(), self.lease_duration)
-            .expect("configured lease duration is non-zero");
-        let stale_poll_op = self.next_op_num();
-        match run_poll(
-            db,
-            election.clone(),
-            register.clone(),
-            self.log_subspace.clone(),
-            self.participant.clone(),
-            LocalState::Leadership(stale_leadership.clone()),
-            false,
-            &self.context,
-            self.client_id,
-            self.incarnation,
-            stale_poll_op,
-            None,
-        )
-        .await
-        {
-            Ok(poll) if poll.transition == PollTransition::Renewed => self.protocol_error(
-                "StaleRenewSucceeded",
-                stale_poll_op,
-                "a stale leadership token changed durable state",
-            ),
-            Ok(_) => {}
-            Err(error) => self.run_diagnostic("StaleRenewRunFailed", stale_poll_op, error),
-        }
-
-        delay_until(
-            &self.context,
-            stale_leadership
-                .last_renewed_at()
-                .saturating_add(stale_leadership.lease_duration())
-                .saturating_add(Duration::from_millis(1)),
-        )
-        .await;
-
-        let stale_resign_op = self.next_op_num();
-        match run_resign(
-            db,
-            election.clone(),
-            self.log_subspace.clone(),
-            stale_leadership,
-            simulated_now(&self.context),
-            self.client_id,
-            self.incarnation,
-            false,
-            stale_resign_op,
-        )
-        .await
-        {
-            Ok(true) => self.protocol_error(
-                "StaleResignSucceeded",
-                stale_resign_op,
-                "a stale leadership token released durable state",
-            ),
-            Ok(false) => {}
-            Err(error) => self.run_diagnostic("StaleResignRunFailed", stale_resign_op, error),
-        }
-
-        let stale_write_op = self.next_op_num();
-        match run_stale_write(
-            db,
-            election,
-            register.clone(),
-            self.log_subspace.clone(),
-            self.participant.as_str().to_owned(),
-            stale_rank,
-            simulated_now(&self.context),
-            self.client_id,
-            self.incarnation,
-            stale_write_op,
-        )
-        .await
-        {
-            Ok(true) => self.protocol_error(
-                "StaleWriteCommitted",
-                stale_write_op,
-                "a strictly stale ranked-register write committed",
-            ),
-            Ok(false) => self.stale_actions_completed = true,
-            Err(error) => self.run_diagnostic("StaleWriteRunFailed", stale_write_op, error),
-        }
-    }
-
-    async fn complete_witnesses(&mut self, db: SimDatabase, register: RankedRegister) {
-        self.replace_incarnation("replacement");
-
-        for phase in 0..3 {
-            let lease_duration = self.lease_duration_for_round(self.operation_count + phase);
-            let adoption_delay = AdoptionDelay::for_completion_phase(phase);
-            if let Some(first) = self
-                .poll_once(&db, &register, lease_duration, Some(adoption_delay))
-                .await
-            {
-                let renewal_duration =
-                    self.lease_duration_for_round(self.operation_count + phase + 1);
-                if let Some(renewed) = self
-                    .poll_once(&db, &register, renewal_duration, Some(adoption_delay))
-                    .await
-                {
-                    if first.rank() < renewed.rank() {
-                        self.exercise_stale_tokens(&db, &register, first.clone(), first.rank())
-                            .await;
-                    }
-                    let resignation_election =
-                        LeaderElection::new(self.election_subspace.clone(), renewal_duration)
-                            .expect("completion lease duration is non-zero");
-                    let resign_op = self.next_op_num();
-                    match run_resign(
-                        &db,
-                        resignation_election,
-                        self.log_subspace.clone(),
-                        renewed,
-                        simulated_now(&self.context),
-                        self.client_id,
-                        self.incarnation,
-                        true,
-                        resign_op,
-                    )
-                    .await
-                    {
-                        Ok(true) => {
-                            self.local_state = LocalState::unknown();
-                            self.force_foreign_takeover(
-                                &db,
-                                &register,
-                                renewal_duration,
-                                Some(adoption_delay),
-                            )
-                            .await;
-                        }
-                        Ok(false) => self.context.trace(
-                            Severity::Info,
-                            "ExactResignContended",
-                            details!["Client" => self.client_id, "OpNum" => resign_op],
-                        ),
-                        Err(error) => {
-                            self.run_diagnostic("ExactResignFailed", resign_op, error);
-                            self.replace_incarnation("exact-resign-error");
-                        }
-                    }
-                }
-                self.replace_incarnation("completion-reset");
-                let _ = self
-                    .poll_once(&db, &register, renewal_duration, Some(adoption_delay))
-                    .await;
-            }
-
-            if let Some(observation) = self.local_state.observation().cloned() {
-                let before_expiry = observation
-                    .first_observed_at()
-                    .saturating_add(observation.lease_duration())
-                    .saturating_sub(Duration::from_millis(1));
-                let _ = delay_until(&self.context, before_expiry).await;
-                let _ = self
-                    .poll_once(&db, &register, lease_duration, Some(adoption_delay))
-                    .await;
-                let exact_expiry = observation
-                    .first_observed_at()
-                    .saturating_add(observation.lease_duration());
-                let _ = delay_until(&self.context, exact_expiry).await;
-                let _ = self
-                    .poll_once(&db, &register, lease_duration, Some(adoption_delay))
-                    .await;
-            }
-
-            if let Some(leadership) = self.local_state.leadership().cloned() {
-                let after_expiry = leadership
-                    .last_renewed_at()
-                    .saturating_add(leadership.lease_duration())
-                    .saturating_add(Duration::from_millis(1));
-                let _ = delay_until(&self.context, after_expiry).await;
-                let _ = self
-                    .poll_once(&db, &register, lease_duration, Some(adoption_delay))
-                    .await;
-            }
-        }
-
-        let witness_lease_duration = self.lease_duration_for_round(self.operation_count + 3);
-        self.replace_incarnation("final-delayed-adoption");
-        let _ = self
-            .poll_once(
-                &db,
-                &register,
-                witness_lease_duration,
-                Some(AdoptionDelay::Longer),
-            )
-            .await;
-        if self.local_state.leadership().is_some() {
-            self.replace_incarnation("final-delayed-adoption-follower");
-            let _ = self
-                .poll_once(
-                    &db,
-                    &register,
-                    witness_lease_duration,
-                    Some(AdoptionDelay::Longer),
-                )
-                .await;
-        }
-        if self.local_state.observation().is_some() {
-            let _ = self
-                .poll_once(&db, &register, witness_lease_duration, None)
-                .await;
-        }
-
-        self.force_exact_resign_and_follower_duration_reset(&db, &register)
-            .await;
-    }
-
-    async fn force_exact_resign_and_follower_duration_reset(
-        &mut self,
-        db: &SimDatabase,
-        register: &RankedRegister,
-    ) {
-        self.replace_incarnation("final-exact-resign");
-        let lease_duration = COMPLETION_RENEWAL_BASE_LEASE_DURATION;
-        let leadership = loop {
-            if let Some(leadership) = self.poll_once(db, register, lease_duration, None).await {
-                break leadership;
-            }
-            if let Some(observation) = self.local_state.observation().cloned() {
-                delay_until(
-                    &self.context,
-                    observation
-                        .first_observed_at()
-                        .saturating_add(observation.lease_duration())
-                        .saturating_add(SIMULATED_TIME_ROUND_TRIP_TOLERANCE),
-                )
-                .await;
-            } else {
-                // `poll_once` resets to a fresh unknown incarnation on a run error. Yield before
-                // retrying that incarnation so repeated run errors cannot form a busy loop.
-                self.completion_barrier_delay().await;
-            }
-        };
-
-        let renewal_duration = leadership
-            .lease_duration()
-            .saturating_add(Duration::from_secs(1));
-        let leader_incarnation = self.incarnation;
-        let Some(renewed) = self.poll_once(db, register, renewal_duration, None).await else {
-            return;
-        };
-
-        self.replace_incarnation("final-duration-reset-follower");
-        let _ = self.poll_once(db, register, renewal_duration, None).await;
-
-        let resign_op = self.next_op_num();
-        let resignation_election =
-            LeaderElection::new(self.election_subspace.clone(), renewal_duration)
-                .expect("completion lease duration is non-zero");
-        match run_resign(
-            db,
-            resignation_election,
-            self.log_subspace.clone(),
-            renewed,
-            simulated_now(&self.context),
-            self.client_id,
-            leader_incarnation,
-            true,
-            resign_op,
-        )
-        .await
-        {
-            Ok(true) => {}
-            Ok(false) => self.protocol_error(
-                "FinalExactResignContended",
-                resign_op,
-                "the deterministic exact-resignation witness was contended",
-            ),
-            Err(error) => self.run_diagnostic("FinalExactResignFailed", resign_op, error),
-        }
-    }
-}
-
-struct PollRun {
-    next_state: LocalState,
-    leadership: Option<Leadership>,
-    transition: PollTransition,
-    adoption_delay: Option<AdoptionDelay>,
-}
-
-#[derive(Clone, Copy)]
-enum AdoptionDelay {
-    Shorter,
-    Exact,
-    Longer,
-}
-
-impl AdoptionDelay {
-    fn from_random(random: u32) -> Self {
-        match random % 3 {
-            0 => Self::Shorter,
-            1 => Self::Exact,
-            _ => Self::Longer,
-        }
-    }
-
-    fn duration(self, lease_duration: Duration) -> Duration {
-        match self {
-            Self::Shorter => lease_duration / 2,
-            Self::Exact => lease_duration,
-            Self::Longer => lease_duration.saturating_add(Duration::from_millis(1)),
-        }
-    }
-
-    fn for_completion_phase(phase: usize) -> Self {
-        [Self::Shorter, Self::Exact, Self::Longer][phase]
-    }
-}
-
-#[derive(Clone)]
-enum LocalExpectation {
-    Exact(LocalInput),
-    AdoptedObservation {
-        owner: String,
-        rank: u64,
-        lease_duration: Duration,
-        not_before: Duration,
-        planned_adoption_delay: Option<Duration>,
-    },
-}
-
-struct CoverageReport {
-    forced_observed: usize,
-    forced_missing: Vec<&'static str>,
-    probabilistic_observed: usize,
-    probabilistic_missing: Vec<&'static str>,
-    saw_coordinated_race: bool,
-    coordinated_race_contenders: usize,
-}
-
-#[derive(Default)]
-struct ReplayWitnesses {
-    saw_expiry: bool,
-    saw_foreign_takeover: bool,
-    last_takeover_rank: Option<u64>,
-    saw_before_expiry: bool,
-    saw_exact_expiry: bool,
-    saw_after_expiry: bool,
-    saw_stale_renew: bool,
-    saw_stale_renew_after_advance: bool,
-    saw_stale_resign: bool,
-    saw_delayed_stale_resign: bool,
-    saw_stale_resign_after_takeover: bool,
-    saw_exact_resign: bool,
-    saw_stale_write: bool,
-    saw_zero_rank_stale_write: bool,
-    saw_post_advance_stale_write: bool,
-    renewal_with_new_duration_rank: Option<u64>,
-    saw_follower_duration_reset: bool,
-    saw_delayed_observation_adoption: bool,
-    race_predecessor: Option<(String, u64, Duration)>,
-    race_contenders: BTreeSet<String>,
-    race_winner: Option<String>,
-    race_stale_writers: BTreeSet<String>,
-}
-
-async fn continuous_snapshot_check(
-    db: &SimDatabase,
-    election: LeaderElection,
-    register: RankedRegister,
-) -> Result<(), FdbBindingError> {
-    let snapshot = db
-        .run(|txn, _maybe_committed| {
-            let election = election.clone();
-            let register = register.clone();
-            async move {
-                txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                let election =
-                    durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
-                let protected = register
-                    .read(&txn, Rank::ZERO)
-                    .await
-                    .map_err(ranked_register_error)?;
-                Ok::<_, FdbBindingError>((
-                    election,
-                    protected.write_rank().as_u64(),
-                    protected.into_value(),
-                ))
-            }
-        })
-        .await?;
-    let (election, protected_rank, protected_value) = snapshot;
-    let valid_election = match election.rank {
-        0 => election.owner.is_none() && election.lease_duration.is_none(),
-        _ => election
-            .lease_duration
-            .is_some_and(|duration| !duration.is_zero()),
-    };
-    let valid_register =
-        protected_rank <= election.rank && (protected_rank == 0) == protected_value.is_none();
-    if valid_election && valid_register {
-        Ok(())
-    } else {
-        Err(log_error("invalid public election/register snapshot"))
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-async fn run_poll(
-    db: &SimDatabase,
-    election: LeaderElection,
-    register: RankedRegister,
-    log_subspace: Subspace,
-    participant: ParticipantId,
-    local_state: LocalState,
-    tracks_local_state: bool,
-    context: &WorkloadContext,
-    client_id: i32,
-    incarnation: u64,
-    op_num: u64,
-    adoption_delay: Option<AdoptionDelay>,
-) -> Result<PollRun, FdbBindingError> {
-    let payload = protected_payload(participant.as_str(), op_num);
-    let configured_lease_duration = election.lease_duration();
-    let (poll, attempt_started_at, planned_adoption_delay) = db
-        .run(|txn, _maybe_committed| {
-            let election = election.clone();
-            let register = register.clone();
-            let log_subspace = log_subspace.clone();
-            let participant = participant.clone();
-            let local_state = local_state.clone();
-            let payload = payload.clone();
-            let context = context.clone();
-            async move {
-                let attempt_started_at = simulated_now(&context);
-                txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                let prior =
-                    durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
-                let local_token = local_input(&local_state);
-                let poll = election
-                    .poll(&txn, &participant, &local_state, attempt_started_at)
-                    .await
-                    .map_err(FdbBindingError::from)?;
-                let transition = transition_code(poll.outcome().transition());
-                let leader = matches!(poll.outcome(), PollOutcome::Leader { .. });
-                let (requested_write_rank, observed_write_rank, observed_value, write_committed) =
-                    if let PollOutcome::Leader { rank, .. } = poll.outcome() {
-                        let read = register
-                            .read(&txn, *rank)
-                            .await
-                            .map_err(ranked_register_error)?;
-                        let write = register
-                            .write(&txn, *rank, &payload)
-                            .await
-                            .map_err(ranked_register_error)?;
-                        (
-                            rank.as_u64(),
-                            read.write_rank().as_u64(),
-                            read.into_value(),
-                            write.is_committed(),
-                        )
-                    } else {
-                        (0, 0, None, false)
-                    };
-                let current =
-                    durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
-                let planned_adoption_delay =
-                    planned_follower_adoption_delay(&poll, &local_state, adoption_delay);
-                write_log(
-                    &txn,
-                    &log_subspace,
-                    client_id,
-                    incarnation,
-                    op_num,
-                    OP_POLL,
-                    participant.as_str(),
-                    &prior,
-                    &current,
-                    &local_token,
-                    tracks_local_state,
-                    attempt_started_at,
-                    configured_lease_duration,
-                    planned_adoption_delay,
-                    transition,
-                    leader,
-                    requested_write_rank,
-                    observed_write_rank,
-                    observed_value.as_deref(),
-                    write_committed,
-                    if leader { &payload } else { &[] },
-                );
-                Ok::<_, FdbBindingError>((poll, attempt_started_at, planned_adoption_delay))
-            }
-        })
-        .await?;
-    let adoption_delay = match (adoption_delay, planned_adoption_delay) {
-        (Some(delay), Some(duration)) => match context.delay(duration).await {
-            Ok(()) => Some(delay),
-            Err(error) => return Err(FdbBindingError::from(error)),
-        },
-        _ => None,
-    };
-    let adopted_at =
-        simulated_now(context).max(attempt_started_at.saturating_add(Duration::from_nanos(1)));
-    let transition = poll.outcome().transition();
-    let next_state = poll.into_next_state(adopted_at);
-    Ok(PollRun {
-        leadership: next_state.leadership().cloned(),
-        next_state,
-        transition,
-        adoption_delay,
-    })
-}
-
-fn planned_follower_adoption_delay(
-    poll: &foundationdb::recipes::leader_election::PollResult,
-    local_state: &LocalState,
-    adoption_delay: Option<AdoptionDelay>,
-) -> Option<Duration> {
-    let PollOutcome::Follower {
-        owner,
-        rank,
-        lease_duration,
-    } = poll.outcome()
-    else {
-        return None;
-    };
-    let is_new_or_reset = !matches!(
-        local_state,
-        LocalState::Observation(observation)
-            if observation.owner() == owner
-                && observation.rank() == *rank
-                && observation.lease_duration() == *lease_duration
-    );
-    if is_new_or_reset {
-        adoption_delay.map(|delay| delay.duration(*lease_duration))
-    } else {
-        None
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-async fn run_resign(
-    db: &SimDatabase,
-    election: LeaderElection,
-    log_subspace: Subspace,
-    leadership: Leadership,
-    now: Duration,
-    client_id: i32,
-    incarnation: u64,
-    tracks_local_state: bool,
-    op_num: u64,
-) -> Result<bool, FdbBindingError> {
-    let configured_lease_duration = election.lease_duration();
-    db.run(|txn, _maybe_committed| {
-        let election = election.clone();
-        let log_subspace = log_subspace.clone();
-        let leadership = leadership.clone();
-        async move {
-            txn.set_option(TransactionOption::AutomaticIdempotency)?;
-            let prior =
-                durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
-            let result = election
-                .resign(&txn, &leadership)
-                .await
-                .map_err(FdbBindingError::from)?
-                .is_resigned();
-            let current =
-                durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
-            let actor = leadership.participant().as_str().to_owned();
-            let local_token = local_input(&LocalState::Leadership(leadership.clone()));
-            write_log(
-                &txn,
-                &log_subspace,
-                client_id,
-                incarnation,
-                op_num,
-                OP_RESIGN,
-                &actor,
-                &prior,
-                &current,
-                &local_token,
-                tracks_local_state,
-                now,
-                configured_lease_duration,
-                None,
-                TRANSITION_NONE,
-                result,
-                0,
-                0,
-                None,
-                false,
-                &[],
-            );
-            Ok::<_, FdbBindingError>(result)
-        }
-    })
-    .await
-}
-
-#[allow(clippy::too_many_arguments)]
-async fn run_observer(
-    db: &SimDatabase,
-    election: LeaderElection,
-    log_subspace: Subspace,
-    actor: String,
-    configured_lease_duration: Duration,
-    now: Duration,
-    client_id: i32,
-    incarnation: u64,
-    op_num: u64,
-) -> Result<(), FdbBindingError> {
-    db.run(|txn, _maybe_committed| {
-        let election = election.clone();
-        let log_subspace = log_subspace.clone();
-        let actor = actor.clone();
-        async move {
-            txn.set_option(TransactionOption::AutomaticIdempotency)?;
-            let state =
-                durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
-            write_log(
-                &txn,
-                &log_subspace,
-                client_id,
-                incarnation,
-                op_num,
-                OP_OBSERVE,
-                &actor,
-                &state,
-                &state,
-                &LocalInput::Unknown,
-                false,
-                now,
-                configured_lease_duration,
-                None,
-                TRANSITION_NONE,
-                true,
-                0,
-                0,
-                None,
-                false,
-                &[],
-            );
-            Ok::<_, FdbBindingError>(())
-        }
-    })
-    .await
-}
-
-#[allow(clippy::too_many_arguments)]
-async fn run_stale_write(
-    db: &SimDatabase,
-    election: LeaderElection,
-    register: RankedRegister,
-    log_subspace: Subspace,
-    actor: String,
-    stale_rank: Rank,
-    now: Duration,
-    client_id: i32,
-    incarnation: u64,
-    op_num: u64,
-) -> Result<bool, FdbBindingError> {
-    let configured_lease_duration = election.lease_duration();
-    let payload = format!("stale:{actor}:{op_num}").into_bytes();
-    db.run(|txn, _maybe_committed| {
-        let election = election.clone();
-        let register = register.clone();
-        let log_subspace = log_subspace.clone();
-        let actor = actor.clone();
-        let payload = payload.clone();
-        async move {
-            txn.set_option(TransactionOption::AutomaticIdempotency)?;
-            let state =
-                durable_from_public(election.state(&txn).await.map_err(FdbBindingError::from)?);
-            let write = register
-                .write(&txn, stale_rank, &payload)
-                .await
-                .map_err(ranked_register_error)?;
-            let readback = register
-                .read(&txn, Rank::ZERO)
-                .await
-                .map_err(ranked_register_error)?;
-            let readback_rank = readback.write_rank().as_u64();
-            let readback_value = readback.into_value();
-            write_log(
-                &txn,
-                &log_subspace,
-                client_id,
-                incarnation,
-                op_num,
-                OP_STALE_WRITE,
-                &actor,
-                &state,
-                &state,
-                &LocalInput::Unknown,
-                false,
-                now,
-                configured_lease_duration,
-                None,
-                TRANSITION_NONE,
-                write.is_committed(),
-                stale_rank.as_u64(),
-                readback_rank,
-                readback_value.as_deref(),
-                write.is_committed(),
-                &payload,
-            );
-            Ok::<_, FdbBindingError>(write.is_committed())
-        }
-    })
-    .await
-}
-
-#[allow(clippy::too_many_arguments)]
-fn write_log(
-    txn: &foundationdb::Transaction,
-    log_subspace: &Subspace,
-    client_id: i32,
-    incarnation: u64,
-    op_num: u64,
-    kind: i64,
-    actor: &str,
-    prior: &DurableState,
-    current: &DurableState,
-    local: &LocalInput,
-    tracks_local_state: bool,
-    attempt_started_at: Duration,
-    configured_lease_duration: Duration,
-    planned_adoption_delay: Option<Duration>,
-    transition: i64,
-    result: bool,
-    requested_write_rank: u64,
-    observed_write_rank: u64,
-    observed_value: Option<&[u8]>,
-    protected_write_committed: bool,
-    payload: &[u8],
-) {
-    let key = log_subspace.pack_with_versionstamp(&(
-        Versionstamp::incomplete(0),
-        client_id,
-        incarnation,
-        op_num,
-    ));
-    let value = pack(&(
-        kind,
-        actor,
-        durable_wire(prior),
-        durable_wire(current),
-        local_wire(local),
-        tracks_local_state,
-        duration_wire(attempt_started_at),
-        duration_wire(configured_lease_duration),
-        optional_duration_wire(planned_adoption_delay),
-        transition,
-        result,
-        (
-            requested_write_rank,
-            observed_write_rank,
-            observed_value.is_some(),
-            observed_value.unwrap_or(&[]),
-            protected_write_committed,
-            payload,
-        ),
-    ));
-    txn.atomic_op(&key, &value, MutationType::SetVersionstampedKey);
-}
-
-fn decode_log_entry(
-    log_subspace: &Subspace,
-    key: &[u8],
-    value: &[u8],
-) -> Result<LogEntry, FdbBindingError> {
-    let (versionstamp, client_id, incarnation, op_num): (Versionstamp, i32, u64, u64) =
-        log_subspace
-            .unpack(key)
-            .map_err(FdbBindingError::PackError)?;
-    let (
-        kind,
-        actor,
-        prior,
-        current,
-        local,
-        tracks_local_state,
-        attempt_started_at,
-        configured_lease_duration,
-        planned_adoption_delay,
-        transition,
-        result,
-        (
-            requested_write_rank,
-            observed_write_rank,
-            observed_has_value,
-            observed_value,
-            protected_write_committed,
-            payload,
-        ),
-    ): LogWire = unpack(value).map_err(FdbBindingError::PackError)?;
-    Ok(LogEntry {
-        versionstamp,
-        client_id,
-        incarnation,
-        op_num,
-        kind,
-        actor,
-        prior: durable_from_wire(prior)?,
-        current: durable_from_wire(current)?,
-        local_input: local_from_wire(local)?,
-        tracks_local_state,
-        attempt_started_at: duration_from_wire(attempt_started_at)?,
-        configured_lease_duration: duration_from_wire(configured_lease_duration)?,
-        planned_adoption_delay: optional_duration_from_wire(planned_adoption_delay)?,
-        transition,
-        result,
-        requested_write_rank,
-        observed_write_rank,
-        observed_value: optional_value(observed_has_value, observed_value)?,
-        protected_write_committed,
-        payload,
-    })
-}
-
-type DurationWire = (u64, u32);
-type OptionalDurationWire = (bool, u64, u32);
-type DurableWire = (u64, bool, String, bool, u64, u32);
-type LocalWire = (i64, bool, String, u64, bool, u64, u32, u64, u32);
-type ProtectedWire = (u64, u64, bool, Vec<u8>, bool, Vec<u8>);
-type LogWire = (
-    i64,
-    String,
-    DurableWire,
-    DurableWire,
-    LocalWire,
-    bool,
-    DurationWire,
-    DurationWire,
-    OptionalDurationWire,
-    i64,
-    bool,
-    ProtectedWire,
-);
-
-fn replay(entries: &[LogEntry], snapshot: &Snapshot) -> Result<CoverageReport, String> {
-    let mut seen = BTreeSet::new();
-    let mut local_states = BTreeMap::new();
-    let mut previous_versionstamp = None;
-    let mut election = DurableState::default();
-    let mut protected_rank = 0;
-    let mut protected_value = None;
-    let mut witnesses = ReplayWitnesses::default();
-
-    for entry in entries {
-        if !entry.versionstamp.is_complete()
-            || previous_versionstamp
-                .as_ref()
-                .is_some_and(|previous| previous >= &entry.versionstamp)
-        {
-            return Err("operation log is not strictly commit ordered".to_owned());
-        }
-        previous_versionstamp = Some(entry.versionstamp.clone());
-        if entry.actor.is_empty()
-            || !seen.insert((entry.actor.clone(), entry.incarnation, entry.op_num))
-        {
-            return Err(format!(
-                "invalid logical operation ({}, {})",
-                entry.actor, entry.op_num
-            ));
-        }
-        if entry.prior != election {
-            return Err(format!(
-                "operation ({}, {}) prior state {:?} differs from replay {:?}",
-                entry.client_id, entry.op_num, entry.prior, election
-            ));
-        }
-        if entry.configured_lease_duration.is_zero() {
-            return Err(format!(
-                "operation ({}, {}) configured zero lease",
-                entry.client_id, entry.op_num
-            ));
-        }
-        let delayed_observation = validate_local_input(entry, &local_states)?;
-
-        match entry.kind {
-            OP_POLL => replay_poll(
-                entry,
-                &mut election,
-                &mut protected_rank,
-                &mut protected_value,
-                &mut witnesses,
-                delayed_observation,
-            )?,
-            OP_RESIGN => replay_resign(entry, &mut election, &mut witnesses)?,
-            OP_OBSERVE => {
-                if entry.current != election
-                    || entry.local_input != LocalInput::Unknown
-                    || entry.transition != TRANSITION_NONE
-                    || !entry.result
-                    || has_protected_effect(entry)
-                {
-                    return Err(format!(
-                        "observer ({}, {}) changed state",
-                        entry.client_id, entry.op_num
-                    ));
-                }
-            }
-            OP_STALE_WRITE => {
-                if entry.current != election
-                    || entry.local_input != LocalInput::Unknown
-                    || entry.transition != TRANSITION_NONE
-                    || entry.result
-                    || entry.requested_write_rank >= election.rank
-                    || entry.observed_write_rank != protected_rank
-                    || entry.observed_value != protected_value
-                    || entry.protected_write_committed
-                    || entry.payload != stale_payload(&entry.actor, entry.op_num)
-                {
-                    return Err(format!(
-                        "stale write ({}, {}) was not rejected",
-                        entry.client_id, entry.op_num
-                    ));
-                }
-                witnesses.saw_stale_write = true;
-                if entry.requested_write_rank == 0 {
-                    witnesses.saw_zero_rank_stale_write = true;
-                } else {
-                    witnesses.saw_post_advance_stale_write = true;
-                }
-                record_race_stale_write(entry, &mut witnesses)?;
-            }
-            other => return Err(format!("unknown operation kind {other}")),
-        }
-        advance_local_state(entry, &election, &mut local_states)?;
-    }
-
-    if snapshot.election != election
-        || snapshot.protected_rank != protected_rank
-        || snapshot.protected_value != protected_value
-    {
-        return Err(
-            "final public election or ranked-register state differs from replay".to_owned(),
-        );
-    }
-    if protected_value.is_none() {
-        return Err("no fenced leader write committed".to_owned());
-    }
-    let mut forced_missing = Vec::new();
-    if !witnesses.saw_expiry {
-        forced_missing.push("expiry");
-    }
-    if !witnesses.saw_foreign_takeover {
-        forced_missing.push("foreign_takeover");
-    }
-    if !witnesses.saw_before_expiry {
-        forced_missing.push("before_expiry");
-    }
-    if !witnesses.saw_after_expiry {
-        forced_missing.push("after_expiry");
-    }
-    if !witnesses.saw_stale_renew {
-        forced_missing.push("stale_renew");
-    }
-    if !witnesses.saw_stale_write {
-        forced_missing.push("stale_write");
-    }
-    if !witnesses.saw_delayed_observation_adoption {
-        forced_missing.push("delayed_observation_adoption");
-    }
-    if !witnesses.saw_exact_resign {
-        forced_missing.push("exact_resign");
-    }
-    if !witnesses.saw_follower_duration_reset {
-        forced_missing.push("follower_duration_reset");
-    }
-    let mut probabilistic_missing = Vec::new();
-    if !witnesses.saw_exact_expiry {
-        probabilistic_missing.push("exact_expiry");
-    }
-    if !witnesses.saw_stale_renew_after_advance {
-        probabilistic_missing.push("stale_renew_after_advance");
-    }
-    if !witnesses.saw_stale_resign {
-        probabilistic_missing.push("stale_resign");
-    }
-    if !witnesses.saw_delayed_stale_resign {
-        probabilistic_missing.push("delayed_stale_resign");
-    }
-    if !witnesses.saw_stale_resign_after_takeover {
-        probabilistic_missing.push("stale_resign_after_takeover");
-    }
-    if !witnesses.saw_post_advance_stale_write {
-        probabilistic_missing.push("post_advance_stale_write");
-    }
-    if !witnesses.saw_zero_rank_stale_write {
-        probabilistic_missing.push("zero_rank_stale_write");
-    }
-    let saw_coordinated_race = witnesses.race_contenders.len() >= 2
-        && witnesses.race_winner.is_some()
-        && witnesses.race_stale_writers == witnesses.race_contenders;
-    Ok(CoverageReport {
-        forced_observed: FORCED_WITNESS_COUNT - forced_missing.len(),
-        forced_missing,
-        probabilistic_observed: PROBABILISTIC_WITNESS_COUNT - probabilistic_missing.len(),
-        probabilistic_missing,
-        saw_coordinated_race,
-        coordinated_race_contenders: witnesses.race_contenders.len(),
-    })
-}
-
-fn replay_poll(
-    entry: &LogEntry,
-    election: &mut DurableState,
-    protected_rank: &mut u64,
-    protected_value: &mut Option<Vec<u8>>,
-    witnesses: &mut ReplayWitnesses,
-    delayed_observation: bool,
-) -> Result<(), String> {
-    let leader = validate_reported_poll(entry, election)?;
-
-    if leader {
-        let expected_rank = election.rank.checked_add(1).ok_or("revision overflow")?;
-        let expected = DurableState {
-            rank: expected_rank,
-            owner: Some(entry.actor.clone()),
-            lease_duration: Some(entry.configured_lease_duration),
-        };
-        if entry.current != expected
-            || entry.requested_write_rank != expected_rank
-            || entry.observed_write_rank != *protected_rank
-            || entry.observed_value != *protected_value
-            || !entry.protected_write_committed
-            || entry.payload != protected_payload(&entry.actor, entry.op_num)
-        {
-            return Err(format!(
-                "leader poll ({}, {}) has invalid durable or fenced-write evidence",
-                entry.client_id, entry.op_num
-            ));
-        }
-        if matches!(
-            entry.transition,
-            TRANSITION_TOOK_OVER | TRANSITION_REACQUIRED
-        ) {
-            witnesses.saw_expiry = true;
-        }
-        if entry.transition == TRANSITION_TOOK_OVER {
-            witnesses.saw_foreign_takeover = true;
-            witnesses.last_takeover_rank = Some(expected.rank);
-        }
-        if entry.transition == TRANSITION_RENEWED
-            && election.lease_duration != expected.lease_duration
-        {
-            witnesses.renewal_with_new_duration_rank = Some(expected.rank);
-        }
-        if let LocalInput::Observation {
-            owner,
-            rank,
-            lease_duration,
-            observed_at,
-        } = &entry.local_input
-        {
-            if election.owner.as_deref() == Some(owner)
-                && election.rank == *rank
-                && election.lease_duration == Some(*lease_duration)
-            {
-                let elapsed = entry.attempt_started_at.saturating_sub(*observed_at);
-                match elapsed.cmp(lease_duration) {
-                    std::cmp::Ordering::Equal => witnesses.saw_exact_expiry = true,
-                    std::cmp::Ordering::Greater => witnesses.saw_after_expiry = true,
-                    std::cmp::Ordering::Less => {}
-                }
-            }
-        }
-        *election = expected;
-        *protected_rank = expected_rank;
-        *protected_value = Some(entry.payload.clone());
-    } else {
-        if entry.current != *election || has_protected_effect(entry) {
-            return Err(format!(
-                "follower poll ({}, {}) changed state",
-                entry.client_id, entry.op_num
-            ));
-        }
-        if let LocalInput::Observation {
-            owner,
-            rank,
-            lease_duration,
-            observed_at,
-        } = &entry.local_input
-        {
-            if election.owner.as_deref() == Some(owner)
-                && election.rank == *rank
-                && election.lease_duration == Some(*lease_duration)
-                && entry.attempt_started_at.saturating_sub(*observed_at) < *lease_duration
-            {
-                witnesses.saw_before_expiry = true;
-                if delayed_observation {
-                    witnesses.saw_delayed_observation_adoption = true;
-                }
-            }
-        }
-        if let LocalInput::Leadership {
-            participant,
-            rank,
-            lease_duration,
-            renewed_at,
-        } = &entry.local_input
-        {
-            if participant == &entry.actor {
-                witnesses.saw_stale_renew = true;
-                if election.owner.as_deref() == Some(entry.actor.as_str())
-                    && election.rank == *rank
-                    && election.lease_duration == Some(*lease_duration)
-                    && entry.attempt_started_at.saturating_sub(*renewed_at) >= *lease_duration
-                {
-                    witnesses.saw_after_expiry = true;
-                }
-                if *rank < election.rank {
-                    witnesses.saw_stale_renew_after_advance = true;
-                }
-            }
-        }
-    }
-    if !leader {
-        if let Some(changed_rank) = witnesses.renewal_with_new_duration_rank {
-            if election.rank == changed_rank
-                && matches!(
-                    &entry.local_input,
-                    LocalInput::Unknown | LocalInput::Leadership { .. }
-                )
-            {
-                witnesses.saw_follower_duration_reset = true;
-            }
-        }
-    }
-    record_race_takeover(entry, witnesses)?;
-    Ok(())
-}
-
-fn record_race_takeover(entry: &LogEntry, witnesses: &mut ReplayWitnesses) -> Result<(), String> {
-    let LocalInput::Observation {
-        owner,
-        rank,
-        lease_duration,
-        observed_at,
-    } = &entry.local_input
-    else {
-        return Ok(());
-    };
-    if !entry.actor.starts_with(RACE_PARTICIPANT_PREFIX)
-        || entry.attempt_started_at.saturating_sub(*observed_at) < *lease_duration
-    {
-        return Ok(());
-    }
-    let predecessor = (owner.clone(), *rank, *lease_duration);
-    if let Some(expected) = witnesses.race_predecessor.as_ref() {
-        if expected != &predecessor {
-            return Err("coordinated race contenders observed different predecessors".to_owned());
-        }
-    } else {
-        witnesses.race_predecessor = Some(predecessor);
-    }
-    if !witnesses.race_contenders.insert(entry.actor.clone()) {
-        return Err("coordinated race contender retried as a second logical operation".to_owned());
-    }
-    match (entry.transition, entry.result) {
-        (TRANSITION_TOOK_OVER, true) => {
-            if witnesses.race_winner.replace(entry.actor.clone()).is_some() {
-                return Err("coordinated race elected more than one winner".to_owned());
-            }
-        }
-        (TRANSITION_FOLLOWED, false) => {}
-        _ => return Err("coordinated race contender reported an invalid outcome".to_owned()),
-    }
-    Ok(())
-}
-
-fn record_race_stale_write(
-    entry: &LogEntry,
-    witnesses: &mut ReplayWitnesses,
-) -> Result<(), String> {
-    if !entry.actor.starts_with(RACE_PARTICIPANT_PREFIX) {
-        return Ok(());
-    }
-    let Some((_, predecessor_rank, _)) = witnesses.race_predecessor.as_ref() else {
-        return Err("coordinated race stale write lacks a predecessor".to_owned());
-    };
-    if entry.requested_write_rank != *predecessor_rank {
-        return Err("coordinated race stale write used the wrong rank".to_owned());
-    }
-    if !witnesses.race_stale_writers.insert(entry.actor.clone()) {
-        return Err("coordinated race contender issued multiple stale writes".to_owned());
-    }
-    Ok(())
-}
-
-fn replay_resign(
-    entry: &LogEntry,
-    election: &mut DurableState,
-    witnesses: &mut ReplayWitnesses,
-) -> Result<(), String> {
-    let LocalInput::Leadership {
-        participant,
-        rank,
-        lease_duration,
-        ..
-    } = &entry.local_input
-    else {
-        return Err(format!(
-            "resign ({}, {}) lacks leadership token",
-            entry.client_id, entry.op_num
-        ));
-    };
-    let matches = election.owner.as_deref() == Some(participant)
-        && election.rank == *rank
-        && election.lease_duration == Some(*lease_duration);
-    let expected = if matches {
-        DurableState {
-            rank: election.rank,
-            owner: None,
-            lease_duration: election.lease_duration,
-        }
-    } else {
-        election.clone()
-    };
-    if entry.transition != TRANSITION_NONE
-        || entry.result != matches
-        || entry.current != expected
-        || has_protected_effect(entry)
-    {
-        return Err(format!(
-            "resign ({}, {}) has invalid result",
-            entry.client_id, entry.op_num
-        ));
-    }
-    if !matches {
-        // An idempotent re-execution after an exact resignation is a safe no-op, like a stale
-        // resignation, so replay accepts either instead of requiring a durable change.
-        witnesses.saw_stale_resign = true;
-        if let LocalInput::Leadership {
-            renewed_at,
-            lease_duration,
-            ..
-        } = &entry.local_input
-        {
-            if entry.attempt_started_at.saturating_sub(*renewed_at) > *lease_duration {
-                witnesses.saw_delayed_stale_resign = true;
-            }
-        }
-        if witnesses
-            .last_takeover_rank
-            .is_some_and(|takeover_rank| *rank < takeover_rank)
-        {
-            witnesses.saw_stale_resign_after_takeover = true;
-        }
-    } else {
-        witnesses.saw_exact_resign = true;
-    }
-    *election = expected;
-    Ok(())
-}
-
-fn validate_local_input(
-    entry: &LogEntry,
-    local_states: &BTreeMap<(String, u64), LocalExpectation>,
-) -> Result<bool, String> {
-    if !entry.tracks_local_state {
-        return Ok(false);
-    }
-    let key = (entry.actor.clone(), entry.incarnation);
-    match local_states.get(&key) {
-        None if entry.local_input == LocalInput::Unknown => Ok(false),
-        None => Err(format!(
-            "incarnation ({}, {}) adopted local state without a prior poll",
-            entry.actor, entry.incarnation
-        )),
-        Some(LocalExpectation::Exact(expected)) if expected == &entry.local_input => Ok(false),
-        Some(LocalExpectation::AdoptedObservation {
-            owner,
-            rank,
-            lease_duration,
-            not_before,
-            planned_adoption_delay,
-        }) => match &entry.local_input {
-            LocalInput::Observation {
-                owner: actual_owner,
-                rank: actual_rank,
-                lease_duration: actual_duration,
-                observed_at,
-            } if actual_owner == owner
-                && actual_rank == rank
-                && actual_duration == lease_duration
-                && *observed_at > *not_before
-                && adopted_after_planned_delay(
-                    *observed_at,
-                    *not_before,
-                    planned_adoption_delay.unwrap_or_default(),
-                )
-                && *observed_at <= entry.attempt_started_at =>
-            {
-                Ok(planned_adoption_delay.is_some_and(|delay| delay > *lease_duration))
-            }
-            _ => Err(format!(
-                "incarnation ({}, {}) did not adopt its follower observation",
-                entry.actor, entry.incarnation
-            )),
-        },
-        Some(_) => Err(format!(
-            "incarnation ({}, {}) local state regressed or changed unexpectedly",
-            entry.actor, entry.incarnation
-        )),
-    }
-}
-
-fn adopted_after_planned_delay(
-    observed_at: Duration,
-    not_before: Duration,
-    planned_adoption_delay: Duration,
-) -> bool {
-    observed_at
-        >= not_before
-            .saturating_add(planned_adoption_delay)
-            .saturating_sub(SIMULATED_TIME_ROUND_TRIP_TOLERANCE)
-}
-
-fn advance_local_state(
-    entry: &LogEntry,
-    election: &DurableState,
-    local_states: &mut BTreeMap<(String, u64), LocalExpectation>,
-) -> Result<(), String> {
-    if !entry.tracks_local_state {
-        return Ok(());
-    }
-    let key = (entry.actor.clone(), entry.incarnation);
-    let next = match entry.kind {
-        OP_POLL if entry.result => {
-            if entry.planned_adoption_delay.is_some() {
-                return Err("leader poll planned a follower adoption delay".to_owned());
-            }
-            LocalExpectation::Exact(LocalInput::Leadership {
-                participant: entry.actor.clone(),
-                rank: election.rank,
-                lease_duration: election
-                    .lease_duration
-                    .ok_or_else(|| "leader poll lost lease duration".to_owned())?,
-                renewed_at: entry.attempt_started_at,
-            })
-        }
-        OP_POLL => match &entry.local_input {
-            LocalInput::Observation {
-                owner,
-                rank,
-                lease_duration,
-                ..
-            } if election.owner.as_deref() == Some(owner)
-                && election.rank == *rank
-                && election.lease_duration == Some(*lease_duration) =>
-            {
-                if entry.planned_adoption_delay.is_some() {
-                    return Err("preserved follower observation planned a delay".to_owned());
-                }
-                LocalExpectation::Exact(entry.local_input.clone())
-            }
-            _ => follower_observation_expectation(
-                election,
-                entry.attempt_started_at,
-                entry.planned_adoption_delay,
-            )?,
-        },
-        OP_RESIGN if entry.result => LocalExpectation::Exact(LocalInput::Unknown),
-        OP_RESIGN => LocalExpectation::Exact(entry.local_input.clone()),
-        _ => return Ok(()),
-    };
-    local_states.insert(key, next);
-    Ok(())
-}
-
-fn follower_observation_expectation(
-    election: &DurableState,
-    not_before: Duration,
-    planned_adoption_delay: Option<Duration>,
-) -> Result<LocalExpectation, String> {
-    Ok(LocalExpectation::AdoptedObservation {
-        owner: election
-            .owner
-            .clone()
-            .ok_or_else(|| "follower poll lost owner".to_owned())?,
-        rank: election.rank,
-        lease_duration: election
-            .lease_duration
-            .ok_or_else(|| "follower poll lost lease duration".to_owned())?,
-        not_before,
-        planned_adoption_delay,
-    })
-}
-
-fn validate_reported_poll(entry: &LogEntry, election: &DurableState) -> Result<bool, String> {
-    let valid = match entry.transition {
-        // A stale token may acquire a released election, but its new rank still fences the old
-        // leadership, so this is not a renewal.
-        TRANSITION_ACQUIRED => entry.result && election.owner.is_none(),
-        TRANSITION_RENEWED => {
-            if !matches!(&entry.local_input, LocalInput::Leadership { .. }) {
-                return Err(poll_transition_error(
-                    entry,
-                    "renewal lacks a leadership token",
-                ));
-            }
-            entry.result && renewal_enabled(entry, election)
-        }
-        TRANSITION_TOOK_OVER | TRANSITION_REACQUIRED => {
-            let LocalInput::Observation { owner, .. } = &entry.local_input else {
-                return Err(poll_transition_error(
-                    entry,
-                    "takeover lacks an observation",
-                ));
-            };
-            entry.result
-                && takeover_enabled(entry, election)
-                && match entry.transition {
-                    TRANSITION_TOOK_OVER => owner != &entry.actor,
-                    TRANSITION_REACQUIRED => owner == &entry.actor,
-                    _ => unreachable!(),
-                }
-        }
-        TRANSITION_FOLLOWED => {
-            !entry.result
-                && election.owner.is_some()
-                && !renewal_enabled(entry, election)
-                && !takeover_enabled(entry, election)
-        }
-        other => return Err(format!("unknown poll transition {other}")),
-    };
-    if valid {
-        Ok(entry.result)
-    } else {
-        Err(poll_transition_error(
-            entry,
-            "reported transition violates its safety preconditions",
-        ))
-    }
-}
-
-fn renewal_enabled(entry: &LogEntry, election: &DurableState) -> bool {
-    let LocalInput::Leadership {
-        participant,
-        rank,
-        lease_duration,
-        renewed_at,
-    } = &entry.local_input
-    else {
-        return false;
-    };
-    participant == &entry.actor
-        && election.owner.as_deref() == Some(entry.actor.as_str())
-        && election.rank == *rank
-        && election.lease_duration == Some(*lease_duration)
-        && entry.attempt_started_at.saturating_sub(*renewed_at) < *lease_duration
-}
-
-fn takeover_enabled(entry: &LogEntry, election: &DurableState) -> bool {
-    let LocalInput::Observation {
-        owner,
-        rank,
-        lease_duration,
-        observed_at,
-    } = &entry.local_input
-    else {
-        return false;
-    };
-    election.owner.as_deref() == Some(owner)
-        && election.rank == *rank
-        && election.lease_duration == Some(*lease_duration)
-        && entry.attempt_started_at.saturating_sub(*observed_at) >= *lease_duration
-}
-
-fn poll_transition_error(entry: &LogEntry, message: &str) -> String {
-    format!(
-        "poll ({}, {}) transition {} invalid: {message}",
-        entry.client_id, entry.op_num, entry.transition
-    )
-}
-
-fn has_protected_effect(entry: &LogEntry) -> bool {
-    entry.requested_write_rank != 0
-        || entry.observed_write_rank != 0
-        || entry.observed_value.is_some()
-        || entry.protected_write_committed
-        || !entry.payload.is_empty()
-}
-
-fn durable_from_public(state: ElectionState) -> DurableState {
-    DurableState {
-        rank: state.rank().as_u64(),
-        owner: state.owner().map(|owner| owner.as_str().to_owned()),
-        lease_duration: state.lease_duration(),
-    }
-}
-
-fn local_input(state: &LocalState) -> LocalInput {
-    match state {
-        LocalState::Unknown => LocalInput::Unknown,
-        LocalState::Observation(observation) => LocalInput::Observation {
-            owner: observation.owner().as_str().to_owned(),
-            rank: observation.rank().as_u64(),
-            lease_duration: observation.lease_duration(),
-            observed_at: observation.first_observed_at(),
-        },
-        LocalState::Leadership(leadership) => LocalInput::Leadership {
-            participant: leadership.participant().as_str().to_owned(),
-            rank: leadership.rank().as_u64(),
-            lease_duration: leadership.lease_duration(),
-            renewed_at: leadership.last_renewed_at(),
-        },
-    }
-}
-
-fn transition_code(transition: PollTransition) -> i64 {
-    match transition {
-        PollTransition::Acquired => TRANSITION_ACQUIRED,
-        PollTransition::Renewed => TRANSITION_RENEWED,
-        PollTransition::TookOver => TRANSITION_TOOK_OVER,
-        PollTransition::Reacquired => TRANSITION_REACQUIRED,
-        PollTransition::Followed => TRANSITION_FOLLOWED,
-    }
-}
-
-fn durable_wire(state: &DurableState) -> DurableWire {
-    let (has_lease_duration, lease_secs, lease_nanos) = match state.lease_duration {
-        Some(duration) => (true, duration.as_secs(), duration.subsec_nanos()),
-        None => (false, 0, 0),
-    };
-    (
-        state.rank,
-        state.owner.is_some(),
-        state.owner.as_deref().unwrap_or("").to_owned(),
-        has_lease_duration,
-        lease_secs,
-        lease_nanos,
-    )
-}
-
-fn durable_from_wire(wire: DurableWire) -> Result<DurableState, FdbBindingError> {
-    let (rank, has_owner, owner, has_lease, lease_secs, lease_nanos) = wire;
-    let owner = optional_owner(has_owner, owner)?;
-    let lease_duration = optional_duration(has_lease, lease_secs, lease_nanos)?;
-    Ok(DurableState {
-        rank,
-        owner,
-        lease_duration,
-    })
-}
-
-fn local_wire(local: &LocalInput) -> LocalWire {
-    match local {
-        LocalInput::Unknown => (LOCAL_UNKNOWN, false, String::new(), 0, false, 0, 0, 0, 0),
-        LocalInput::Observation {
-            owner,
-            rank,
-            lease_duration,
-            observed_at,
-        } => (
-            LOCAL_OBSERVATION,
-            true,
-            owner.clone(),
-            *rank,
-            true,
-            lease_duration.as_secs(),
-            lease_duration.subsec_nanos(),
-            observed_at.as_secs(),
-            observed_at.subsec_nanos(),
-        ),
-        LocalInput::Leadership {
-            participant,
-            rank,
-            lease_duration,
-            renewed_at,
-        } => (
-            LOCAL_LEADERSHIP,
-            true,
-            participant.clone(),
-            *rank,
-            true,
-            lease_duration.as_secs(),
-            lease_duration.subsec_nanos(),
-            renewed_at.as_secs(),
-            renewed_at.subsec_nanos(),
-        ),
-    }
-}
-
-fn local_from_wire(wire: LocalWire) -> Result<LocalInput, FdbBindingError> {
-    let (kind, has_actor, actor, rank, has_lease, lease_secs, lease_nanos, at_secs, at_nanos) =
-        wire;
-    let actor = optional_owner(has_actor, actor)?;
-    let lease_duration = optional_duration(has_lease, lease_secs, lease_nanos)?;
-    let at = duration_from_wire((at_secs, at_nanos))?;
-    match kind {
-        LOCAL_UNKNOWN
-            if actor.is_none() && rank == 0 && lease_duration.is_none() && at.is_zero() =>
-        {
-            Ok(LocalInput::Unknown)
-        }
-        LOCAL_OBSERVATION => Ok(LocalInput::Observation {
-            owner: actor.ok_or_else(|| log_error("observation has no owner"))?,
-            rank,
-            lease_duration: lease_duration.ok_or_else(|| log_error("observation has no lease"))?,
-            observed_at: at,
-        }),
-        LOCAL_LEADERSHIP => Ok(LocalInput::Leadership {
-            participant: actor.ok_or_else(|| log_error("leadership has no participant"))?,
-            rank,
-            lease_duration: lease_duration.ok_or_else(|| log_error("leadership has no lease"))?,
-            renewed_at: at,
-        }),
-        _ => Err(log_error("invalid caller-local input in operation log")),
-    }
-}
-
-fn duration_wire(duration: Duration) -> DurationWire {
-    (duration.as_secs(), duration.subsec_nanos())
-}
-
-fn duration_from_wire(wire: DurationWire) -> Result<Duration, FdbBindingError> {
-    if wire.1 >= 1_000_000_000 {
-        return Err(log_error("duration nanoseconds out of range"));
-    }
-    Ok(Duration::new(wire.0, wire.1))
-}
-
-fn optional_duration_wire(duration: Option<Duration>) -> OptionalDurationWire {
-    match duration {
-        Some(duration) => (true, duration.as_secs(), duration.subsec_nanos()),
-        None => (false, 0, 0),
-    }
-}
-
-fn optional_duration_from_wire(
-    wire: OptionalDurationWire,
-) -> Result<Option<Duration>, FdbBindingError> {
-    optional_duration(wire.0, wire.1, wire.2)
-}
-
-fn optional_duration(
-    present: bool,
-    secs: u64,
-    nanos: u32,
-) -> Result<Option<Duration>, FdbBindingError> {
-    if present {
-        Ok(Some(duration_from_wire((secs, nanos))?))
-    } else if secs == 0 && nanos == 0 {
-        Ok(None)
-    } else {
-        Err(log_error("absent duration has non-zero fields"))
-    }
-}
-
-fn optional_owner(present: bool, owner: String) -> Result<Option<String>, FdbBindingError> {
-    match (present, owner.is_empty()) {
-        (true, false) => Ok(Some(owner)),
-        (false, true) => Ok(None),
-        _ => Err(log_error("invalid optional owner in operation log")),
-    }
-}
-
-fn optional_value(present: bool, value: Vec<u8>) -> Result<Option<Vec<u8>>, FdbBindingError> {
-    match (present, value.is_empty()) {
-        (true, _) => Ok(Some(value)),
-        (false, true) => Ok(None),
-        (false, false) => Err(log_error("invalid optional value in operation log")),
-    }
-}
-
-fn protected_payload(actor: &str, op_num: u64) -> Vec<u8> {
-    format!("leader:{actor}:{op_num}").into_bytes()
-}
-
-fn stale_payload(actor: &str, op_num: u64) -> Vec<u8> {
-    format!("stale:{actor}:{op_num}").into_bytes()
-}
-
-async fn delay_until(context: &WorkloadContext, target: Duration) {
-    let _ = context
-        .delay(target.saturating_sub(simulated_now(context)))
-        .await;
-}
-
-fn simulated_now(context: &WorkloadContext) -> Duration {
-    Duration::from_secs_f64(context.now().max(0.0))
-}
-
-fn ranked_register_error(error: RankedRegisterError) -> FdbBindingError {
-    FdbBindingError::new_custom_error(Box::new(error))
-}
-
-#[cfg(test)]
-mod tests {
-    use std::time::Duration;
-
-    use super::{RACE_PARTICIPANT_PREFIX, adopted_after_planned_delay};
-
-    #[test]
-    fn race_prefix_matches_replacement_incarnations() {
-        assert!("race\0λ-0-0-1".starts_with(RACE_PARTICIPANT_PREFIX));
-        assert!(!r"race\0λ-0-0-1".starts_with(RACE_PARTICIPANT_PREFIX));
-    }
-
-    #[test]
-    fn delayed_adoption_tolerates_only_one_nanosecond_round_trip_loss() {
-        let not_before = Duration::from_secs(10);
-        let delay = Duration::from_secs(2);
-
-        assert!(adopted_after_planned_delay(
-            not_before + delay - Duration::from_nanos(1),
-            not_before,
-            delay,
-        ));
-        assert!(!adopted_after_planned_delay(
-            not_before + delay - Duration::from_nanos(2),
-            not_before,
-            delay,
-        ));
-    }
-}
-
-fn log_error(message: &str) -> FdbBindingError {
-    FdbBindingError::new_custom_error(Box::new(LogError(message.to_owned())))
-}
-
-#[derive(Debug)]
-struct LogError(String);
-
-impl std::fmt::Display for LogError {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter.write_str(&self.0)
-    }
-}
-
-impl std::error::Error for LogError {}
diff --git a/bindings/rust/foundationdb-recipes-simulation/src/lib.rs b/bindings/rust/foundationdb-recipes-simulation/src/lib.rs
deleted file mode 100644
index 207e6616f84..00000000000
--- a/bindings/rust/foundationdb-recipes-simulation/src/lib.rs
+++ /dev/null
@@ -1,13 +0,0 @@
-//! Simulation workloads for FoundationDB recipes
-//!
-//! This crate provides simulation workloads to test FoundationDB recipes
-//! under chaos conditions including network partitions, process failures,
-//! and cluster reconfigurations.
-
-mod leader_election;
-
-pub use leader_election::LeaderElectionWorkload;
-
-use foundationdb_simulation::register_workload;
-
-register_workload!(LeaderElectionWorkload);
diff --git a/bindings/rust/foundationdb-recipes-simulation/test_poll_leader_election.toml b/bindings/rust/foundationdb-recipes-simulation/test_poll_leader_election.toml
deleted file mode 100644
index a6e1bbec429..00000000000
--- a/bindings/rust/foundationdb-recipes-simulation/test_poll_leader_election.toml
+++ /dev/null
@@ -1,42 +0,0 @@
-# Poll-based, fenced leader-election simulation.
-#
-# Clients autonomously select standard, contention, or suspicion profiles while
-# exercising one durable (revision, optional owner, lease duration) state. Every
-# leader poll co-commits a RankedRegister read, protected write at its fencing
-# rank, and a versionstamp-ordered operation-log entry.
-
-# Production runs Redwood; the unconstrained random engine draw picked RocksDB on
-# most seeds at up to 49x the wall time of this forced choice, and never picked
-# redwood at all (measured 2026-07-31).
-[configuration]
-storageEngineType = 3
-# The simulated S3/HTTP mock adds 1-3 machines per datacenter and nothing here uses it.
-simHTTPServerEnabled = false
-
-[[test]]
-testTitle = 'PollLeaderElection'
-# Skip post-test urgent/regular checks and storage audits. The independent randomized background
-# consistency scan remains enabled.
-runConsistencyCheck = false
-
-  [[test.workload]]
-    testName = 'External'
-    useCAPI = true
-    libraryName = 'foundationdb_recipes_simulation'
-    workloadName = 'LeaderElectionWorkload'
-    libraryPath = './target/release'
-
-  [[test.workload]]
-    # Broad deterministic disruption exercises transaction retries and
-    # maybe-committed outcomes. The commit log, not issue order, is the oracle.
-    testName = 'RandomClogging'
-    testDuration = 45.0
-    swizzle = 2
-
-  [[test.workload]]
-    # Rebooted and error-recovered clients use fresh incarnations and local state.
-    testName = 'Attrition'
-    machinesToKill = 6
-    machinesToLeave = 2
-    reboot = true
-    testDuration = 45.0
diff --git a/bindings/rust/foundationdb-simulation-tracing/Cargo.toml b/bindings/rust/foundationdb-simulation-tracing/Cargo.toml
deleted file mode 100644
index 5a0b5e51391..00000000000
--- a/bindings/rust/foundationdb-simulation-tracing/Cargo.toml
+++ /dev/null
@@ -1,39 +0,0 @@
-[package]
-name = "foundationdb-simulation-tracing"
-version = "0.1.0"
-authors = [
-    "Pierre Zemb <contact@pierrezemb.fr>"
-]
-edition = "2024"
-description = """
-Forward tokio-tracing events into the FoundationDB simulator trace log
-"""
-license = "MIT/Apache-2.0"
-documentation = "https://docs.rs/foundationdb-simulation-tracing"
-repository = "https://github.com/apple/foundationdb"
-readme = "README.md"
-keywords = ["foundationdb", "simulation", "tracing"]
-
-[package.metadata.docs.rs]
-features = ["embedded-fdb-include", "fdb-7_4"]
-
-[dependencies]
-foundationdb-simulation = { version = "0.3.0", path = "../foundationdb-simulation", default-features = false }
-tracing-core = "0.1.36"
-tracing-subscriber = { version = "0.3.23", default-features = false, features = ["registry"] }
-
-[dev-dependencies]
-tracing = "0.1.44"
-foundationdb = { path = "../foundationdb", default-features = false, features = ["trace"] }
-
-[features]
-default = ["embedded-fdb-include"]
-fdb-7_1 = ["foundationdb-simulation/fdb-7_1"]
-fdb-7_3 = ["foundationdb-simulation/fdb-7_3"]
-fdb-7_4 = ["foundationdb-simulation/fdb-7_4"]
-embedded-fdb-include = ["foundationdb-simulation/embedded-fdb-include"]
-
-[[example]]
-name = "tracing_demo"
-path = "examples/tracing_demo/lib.rs"
-crate-type = ["cdylib"]
diff --git a/bindings/rust/foundationdb-simulation-tracing/README.md b/bindings/rust/foundationdb-simulation-tracing/README.md
deleted file mode 100644
index 53d3476d444..00000000000
--- a/bindings/rust/foundationdb-simulation-tracing/README.md
+++ /dev/null
@@ -1,104 +0,0 @@
-# foundationdb-simulation-tracing
-
-Forward tokio [`tracing`](https://docs.rs/tracing) events into the FoundationDB
-simulator trace log. Once installed, both your workload's own `tracing::info!`
-/ `warn!` / ... calls and the `foundationdb` SDK's internal retry-loop
-diagnostics (enabled by the SDK's `trace` feature) land in the simulator's
-`trace.*.json` files next to fdbserver's own events, instead of being lost.
-
-## Usage
-
-Call `install` from your workload factory and keep the returned guard alive by
-storing it in your workload struct. The guard unbinds the context when the
-workload is torn down, so no event can reach a freed context.
-
-```rust,ignore
-use foundationdb_simulation::{
-    RustWorkload, SimDatabase, SingleRustWorkload, WorkloadContext, register_workload,
-};
-use foundationdb_simulation_tracing::{TracingGuard, install};
-
-struct MyWorkload {
-    // keep the guard alive for the workload's lifetime
-    _tracing: TracingGuard,
-    context: WorkloadContext,
-}
-
-impl SingleRustWorkload for MyWorkload {
-    fn new(_name: String, context: WorkloadContext) -> Self {
-        let _tracing = install(&context);
-        Self { _tracing, context }
-    }
-}
-
-// impl RustWorkload for MyWorkload { ... }
-register_workload!(MyWorkload);
-```
-
-From then on, `tracing::info!(client = 0, "starting")` shows up in the trace log
-as a TraceEvent of type `RustTracingEvent`. Grep for it:
-
-```bash
-grep '"Type": *"RustTracingEvent"' target/traces/trace.*.json
-```
-
-By default, the bridge forwards `INFO`, `WARN`, and `ERROR` events. Set
-`FDB_SIM_TRACING_LEVEL=debug` (or `trace`) before the workload starts to include
-lower-level events and spans. The value is read once when the subscriber is
-installed.
-
-Each forwarded event carries `Target`, `File`, `Line`, and `Message` details
-(when present) followed by the event's own fields.
-
-## Span context
-
-The subscriber is built on `tracing-subscriber`'s `Registry`, so events fired
-inside a span carry that span's context. For an event with an enclosing span,
-the forwarded details also include:
-
-- `Span`: the name of the innermost span.
-- `SpanPath`: the span names from the root to the innermost span, joined with
-  `/` (for example `demo_transaction` or `outer/inner`).
-- the fields of every ancestor span, from root to leaf.
-
-Attach a span to an async block with the `tracing::Instrument` trait
-(`future.instrument(span)`) rather than `span.enter()`, which must not be held
-across an `.await`.
-
-Collision rule: an event's own field always wins over a span field of the same
-name. A span field is skipped when the key is already present in the details, so
-no duplicate key is produced for that case.
-
-## Severity mapping
-
-`tracing` levels map to FDB severities as follows:
-
-| `tracing` level | FDB `Severity` |
-|---|---|
-| `TRACE`, `DEBUG` | `Debug` |
-| `INFO` | `Info` |
-| `WARN` | `Warn` |
-| `ERROR` | `WarnAlways` |
-
-`ERROR` maps to `WarnAlways`, never to `Severity::Error`. In the simulator a
-`Severity::Error` event flags the whole run as failed, and a dependency's (or
-your own) `tracing::error!` must not silently kill a simulation. If you want to
-fail the run on purpose, call `context.trace(Severity::Error, ...)` directly.
-
-## Caveats
-
-- Last created workload wins: in a multi-client simulation every factory call
-  re-binds the current thread's context slot. All contexts write to the same
-  simulator trace stream, so attribution is cosmetic, and each guard only
-  clears the slot if it still holds its own binding.
-- Reserved keys: FDB capitalizes the first letter of every detail key, so a
-  field named `file`, `line`, `target`, or `message` collides with the meta
-  keys this crate prepends (and `type`, `time`, `machine`, ... collide with
-  TraceEvent's own reserved keys). Duplicate keys are kept as-is in the JSON.
-
-## Features
-
-One FDB version feature must be selected: `fdb-7_1`, `fdb-7_3`, or `fdb-7_4`.
-`embedded-fdb-include` (on by default) compiles without a local FoundationDB
-install. These simply forward to the matching `foundationdb-simulation`
-features.
diff --git a/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs b/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs
deleted file mode 100644
index 8829feba6d6..00000000000
--- a/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/lib.rs
+++ /dev/null
@@ -1,136 +0,0 @@
-use std::sync::atomic::{AtomicBool, Ordering};
-
-use foundationdb::{FdbBindingError, FdbError, tuple::Subspace};
-use foundationdb_simulation::{
-    Metric, Metrics, RustWorkload, SimDatabase, SingleRustWorkload, WorkloadContext,
-    register_workload,
-};
-use foundationdb_simulation_tracing::{TracingGuard, install};
-use tracing::Instrument;
-
-/// Demo workload that emits `tracing` events across its phases and forces one
-/// transaction conflict, so both the workload's own events and the SDK's
-/// retry-loop events land in the simulator trace log as `RustTracingEvent`.
-pub struct TracingDemoWorkload {
-    // Keep the tracing binding alive for as long as this workload exists.
-    _tracing: TracingGuard,
-    context: WorkloadContext,
-    client_id: i32,
-    committed: bool,
-}
-
-const DEMO_KEY: &[u8] = b"tracing_demo_key";
-
-impl SingleRustWorkload for TracingDemoWorkload {
-    fn new(_name: String, context: WorkloadContext) -> Self {
-        let _tracing = install(&context);
-        Self {
-            client_id: context.client_id(),
-            _tracing,
-            context,
-            committed: false,
-        }
-    }
-}
-
-impl RustWorkload for TracingDemoWorkload {
-    async fn setup(&mut self, _db: SimDatabase) {
-        tracing::info!(client = self.client_id, phase = "setup", "workload setup");
-        tracing::debug!(
-            client = self.client_id,
-            "debug-level event for severity filtering verification"
-        );
-    }
-
-    async fn start(&mut self, db: SimDatabase) {
-        tracing::info!(client = self.client_id, phase = "start", "workload start");
-        // Only a single client drives the transactions.
-        if self.client_id != 0 {
-            return;
-        }
-
-        let client_id = self.client_id;
-        let key = Subspace::all().pack(&DEMO_KEY);
-        // Interferes exactly once, on the first attempt, to force a single
-        // `not_committed` conflict so the SDK's retry events fire deterministically.
-        let interfere = AtomicBool::new(true);
-
-        // Wrap the retry loop in a span so forwarded events (including the SDK's
-        // own retry diagnostics) carry the Span/SpanPath and the `client` field.
-        // Attached with `.instrument` rather than `span.enter()` because the
-        // future is awaited.
-        let span = tracing::info_span!("demo_transaction", client = client_id);
-        let result = db
-            .run(|trx, _maybe_committed| {
-                let key = key.clone();
-                let db = &db;
-                let interfere = &interfere;
-                async move {
-                    // Establish a read conflict range on the key.
-                    let _ = trx.get(&key, false).await.map_err(FdbBindingError::from)?;
-
-                    if interfere.swap(false, Ordering::SeqCst) {
-                        // A competing transaction commits a write to the same key,
-                        // invalidating this transaction's read on commit.
-                        let other = db.create_trx().map_err(FdbBindingError::from)?;
-                        other.set(&key, b"competing");
-                        other
-                            .commit()
-                            .await
-                            .map_err(FdbError::from)
-                            .map_err(FdbBindingError::from)?;
-                        tracing::warn!(
-                            client = client_id,
-                            key = "tracing_demo_key",
-                            "injected a competing write to force a conflict"
-                        );
-                    }
-
-                    trx.set(&key, b"value");
-                    Ok(())
-                }
-            })
-            .instrument(span)
-            .await;
-
-        match result {
-            Ok(()) => {
-                self.committed = true;
-                tracing::info!(client = self.client_id, "transaction committed after retry");
-            }
-            Err(FdbBindingError::NonRetryableFdbError(error)) => {
-                tracing::error!(
-                    client = self.client_id,
-                    error_code = error.code(),
-                    "transaction failed"
-                );
-            }
-            Err(_) => {
-                tracing::error!(client = self.client_id, "transaction failed");
-            }
-        }
-    }
-
-    async fn check(&mut self, _db: SimDatabase) {
-        if self.client_id == 0 && !self.committed {
-            // Report the failure through the workload's own context so the run
-            // is flagged; the tracing bridge never emits Severity::Error.
-            self.context.trace(
-                foundationdb_simulation::Severity::Error,
-                "TracingDemoCommitFailed",
-                &[("Client", self.client_id.to_string())],
-            );
-        }
-        tracing::info!(client = self.client_id, phase = "check", "workload check");
-    }
-
-    fn get_metrics(&self, mut out: Metrics<'_>) {
-        out.extend([Metric::val("committed", self.committed as i32 as f64)]);
-    }
-
-    fn get_check_timeout(&self) -> f64 {
-        5000.0
-    }
-}
-
-register_workload!(TracingDemoWorkload);
diff --git a/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/test_tracing_demo.toml b/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/test_tracing_demo.toml
deleted file mode 100644
index 2347b21fcfc..00000000000
--- a/bindings/rust/foundationdb-simulation-tracing/examples/tracing_demo/test_tracing_demo.toml
+++ /dev/null
@@ -1,9 +0,0 @@
-[[test]]
-testTitle = 'TracingDemoWorkload'
-
-  [[test.workload]]
-    testName = 'External'
-    useCAPI = true
-    libraryName = 'tracing_demo'
-    workloadName = 'TracingDemoWorkload'
-    libraryPath = './target/release/examples'
diff --git a/bindings/rust/foundationdb-simulation-tracing/src/lib.rs b/bindings/rust/foundationdb-simulation-tracing/src/lib.rs
deleted file mode 100644
index fcb899fee27..00000000000
--- a/bindings/rust/foundationdb-simulation-tracing/src/lib.rs
+++ /dev/null
@@ -1,563 +0,0 @@
-#![warn(missing_docs)]
-#![doc = include_str!("../README.md")]
-
-use std::{
-    cell::RefCell,
-    env, fmt,
-    marker::PhantomData,
-    rc::Rc,
-    sync::{Once, atomic::AtomicU64},
-};
-
-use foundationdb_simulation::{Severity, WorkloadContext};
-use tracing_core::{
-    Dispatch, Event, Level, Subscriber,
-    field::{Field, Visit},
-    span::{Attributes, Id, Record},
-};
-use tracing_subscriber::{
-    Registry,
-    filter::{LevelFilter, LevelParseError},
-    layer::{Context, Layer, SubscriberExt},
-    registry::LookupSpan,
-};
-
-// The context bound to the current simulation thread. `WorkloadContext` is
-// `!Send`/`!Sync` (it wraps raw fdbserver pointers), so it never leaves the
-// thread it was installed on: events fired on any other thread find an empty
-// slot and are dropped. The slot also carries the install generation so an
-// older `TracingGuard` cannot clear a binding that a newer `install` replaced.
-thread_local! {
-    static SIM_CONTEXT: RefCell<Option<(WorkloadContext, u64)>> = const { RefCell::new(None) };
-}
-
-/// Monotonic install counter used to tell competing bindings apart.
-static GENERATION: AtomicU64 = AtomicU64::new(0);
-/// Guards the one-shot global subscriber registration.
-static INIT: Once = Once::new();
-/// Environment variable controlling the maximum level forwarded to fdbserver.
-const LEVEL_ENV: &str = "FDB_SIM_TRACING_LEVEL";
-
-/// Installs the global tracing subscriber (first call only, idempotent) and
-/// binds tracing events emitted on the current simulation thread to
-/// `context`'s trace log. Call from your workload factory
-/// (`SingleRustWorkload::new` / `RustWorkloadFactory::create`) and store the
-/// returned guard in your workload struct: when the guard drops (workload
-/// teardown), the binding is cleared, so no event can ever reach a freed
-/// context.
-///
-/// The subscriber is a [`tracing_subscriber::Registry`] with a forwarding
-/// [`tracing_subscriber::Layer`]. By default, it forwards `INFO` and above;
-/// set `FDB_SIM_TRACING_LEVEL` to `debug` or `trace` before the first call to
-/// override the level. Span context (names and fields) is captured and attached
-/// to each forwarded event.
-///
-/// If another global tracing subscriber is already installed, this prints a
-/// warning to stderr and forwarding stays disabled (events reach the
-/// pre-existing subscriber instead).
-// Not `#[instrument]`: the crate depends only on `tracing-core` /
-// `tracing-subscriber`, neither of which provides the attribute macro
-// (`#[instrument]` lives in `tracing`), and on the first call the subscriber
-// does not exist yet, so there would be nothing to record.
-#[must_use = "dropping the guard immediately unbinds the context, so tracing \
-              events would no longer be forwarded"]
-pub fn install(context: &WorkloadContext) -> TracingGuard {
-    let generation = GENERATION.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-    SIM_CONTEXT.with(|slot| {
-        *slot.borrow_mut() = Some((context.clone(), generation));
-    });
-    INIT.call_once(|| {
-        let subscriber = Registry::default()
-            .with(SimLayer)
-            .with(configured_level_filter());
-        if tracing_core::dispatcher::set_global_default(Dispatch::new(subscriber)).is_err() {
-            eprintln!(
-                "foundationdb-simulation-tracing: a global tracing subscriber is already \
-                 installed; simulator trace forwarding is disabled and events will reach the \
-                 pre-existing subscriber instead"
-            );
-        }
-    });
-    TracingGuard {
-        generation,
-        _thread_bound: PhantomData,
-    }
-}
-
-/// Reads the forwarding level once, while the global subscriber is installed.
-fn configured_level_filter() -> LevelFilter {
-    match env::var(LEVEL_ENV) {
-        Ok(value) => match parse_level_filter(Some(&value)) {
-            Ok(level) => level,
-            Err(error) => {
-                eprintln!(
-                    "foundationdb-simulation-tracing: invalid {LEVEL_ENV}={value:?} ({error}); \
-                     defaulting to info"
-                );
-                LevelFilter::INFO
-            }
-        },
-        Err(env::VarError::NotPresent) => LevelFilter::INFO,
-        Err(env::VarError::NotUnicode(value)) => {
-            eprintln!(
-                "foundationdb-simulation-tracing: invalid non-Unicode {LEVEL_ENV}={value:?}; \
-                 defaulting to info"
-            );
-            LevelFilter::INFO
-        }
-    }
-}
-
-fn parse_level_filter(value: Option<&str>) -> Result<LevelFilter, LevelParseError> {
-    value.unwrap_or("info").parse()
-}
-
-/// Clears the thread-local context slot on drop, but only if the slot still
-/// points at the context this guard was created for (a newer [`install`]
-/// wins). Keep it alive for as long as tracing events should be forwarded,
-/// typically by storing it in your workload struct.
-/// The guard must be dropped on the thread where it was installed.
-///
-/// ```compile_fail,E0277
-/// use foundationdb_simulation_tracing::TracingGuard;
-///
-/// fn move_guard_to_thread(guard: TracingGuard) {
-///     std::thread::spawn(move || drop(guard));
-/// }
-/// ```
-pub struct TracingGuard {
-    generation: u64,
-    _thread_bound: PhantomData<Rc<()>>,
-}
-
-impl Drop for TracingGuard {
-    fn drop(&mut self) {
-        SIM_CONTEXT.with(|slot| {
-            let mut slot = slot.borrow_mut();
-            if matches!(&*slot, Some((_, generation)) if *generation == self.generation) {
-                *slot = None;
-            }
-        });
-    }
-}
-
-/// Fields captured for a span, stored in its registry extensions so events
-/// fired inside the span can attach them. Keys and values are already
-/// NUL-sanitized.
-struct SpanFields(Vec<(String, String)>);
-
-/// `tracing_subscriber::Layer` that captures span fields into the registry and
-/// forwards every event to the thread-local simulation context. It holds no
-/// `WorkloadContext` (the registry owns all span state), so it stays
-/// `Send + Sync` as `Dispatch` requires.
-struct SimLayer;
-
-impl<S> Layer<S> for SimLayer
-where
-    S: Subscriber + for<'a> LookupSpan<'a>,
-{
-    fn on_new_span(&self, attrs: &Attributes<'_>, id: &Id, ctx: Context<'_, S>) {
-        let span = ctx.span(id).expect("span must exist for its id");
-        let mut visitor = DetailVisitor::default();
-        attrs.record(&mut visitor);
-        span.extensions_mut()
-            .insert(SpanFields(visitor.into_all_fields()));
-    }
-
-    fn on_record(&self, id: &Id, values: &Record<'_>, ctx: Context<'_, S>) {
-        let span = ctx.span(id).expect("span must exist for its id");
-        let mut extensions = span.extensions_mut();
-        if let Some(fields) = extensions.get_mut::<SpanFields>() {
-            let mut visitor = DetailVisitor::default();
-            values.record(&mut visitor);
-            for (key, value) in visitor.into_all_fields() {
-                if let Some(existing) = fields.0.iter_mut().find(|(k, _)| *k == key) {
-                    existing.1 = value;
-                } else {
-                    fields.0.push((key, value));
-                }
-            }
-        }
-    }
-
-    fn on_event(&self, event: &Event<'_>, ctx: Context<'_, S>) {
-        SIM_CONTEXT.with(|slot| {
-            let slot = slot.borrow();
-            let Some((context, _)) = slot.as_ref() else {
-                return;
-            };
-            let details = event_details(event, &ctx);
-            context.trace(
-                severity(event.metadata().level()),
-                "RustTracingEvent",
-                &details,
-            );
-        });
-    }
-}
-
-/// Builds the `(key, value)` details for an event: the `Target`/`File`/`Line`/
-/// `Message` meta keys, then the event's own fields, then span context (`Span`,
-/// `SpanPath`, and ancestor span fields from root to leaf). A span field is
-/// skipped when its key is already present, so an event field always wins over
-/// a span field of the same name.
-fn event_details<S>(event: &Event<'_>, ctx: &Context<'_, S>) -> Vec<(String, String)>
-where
-    S: Subscriber + for<'a> LookupSpan<'a>,
-{
-    let metadata = event.metadata();
-    let mut visitor = DetailVisitor::default();
-    event.record(&mut visitor);
-
-    let mut details: Vec<(String, String)> = Vec::with_capacity(visitor.fields.len() + 6);
-    details.push(("Target".to_owned(), sanitize(metadata.target())));
-    if let Some(file) = metadata.file() {
-        details.push(("File".to_owned(), sanitize(file)));
-    }
-    if let Some(line) = metadata.line() {
-        details.push(("Line".to_owned(), line.to_string()));
-    }
-    if let Some(message) = visitor.message {
-        details.push(("Message".to_owned(), message));
-    }
-    details.extend(visitor.fields);
-
-    if let Some(scope) = ctx.event_scope(event) {
-        // `from_root` yields the ancestors from the outermost span to the
-        // innermost, which is the order we want for both `Span` (the leaf) and
-        // `SpanPath` (root to leaf).
-        let spans: Vec<_> = scope.from_root().collect();
-        if let Some(leaf) = spans.last() {
-            details.push(("Span".to_owned(), sanitize(leaf.name())));
-        }
-        let path = spans
-            .iter()
-            .map(|span| span.name())
-            .collect::<Vec<_>>()
-            .join("/");
-        details.push(("SpanPath".to_owned(), sanitize(&path)));
-
-        // Append span fields from leaf to root, with skip-if-present, so a
-        // deeper span's field overrides a shallower one. Combined with event
-        // fields being added first, the precedence is event > innermost span >
-        // ... > root span.
-        for span in spans.iter().rev() {
-            let extensions = span.extensions();
-            if let Some(fields) = extensions.get::<SpanFields>() {
-                for (key, value) in &fields.0 {
-                    if !details.iter().any(|(existing, _)| existing == key) {
-                        details.push((key.clone(), value.clone()));
-                    }
-                }
-            }
-        }
-    }
-
-    details
-}
-
-/// Maps a `tracing` level to an FDB [`Severity`]. `ERROR` maps to
-/// [`Severity::WarnAlways`] rather than [`Severity::Error`] on purpose:
-/// `Severity::Error` flags the whole simulation as failed, and a dependency's
-/// `tracing::error!` must not kill a run. Failing a simulation stays an
-/// explicit `context.trace(Severity::Error, ...)`.
-fn severity(level: &Level) -> Severity {
-    if *level == Level::ERROR {
-        Severity::WarnAlways
-    } else if *level == Level::WARN {
-        Severity::Warn
-    } else if *level == Level::INFO {
-        Severity::Info
-    } else {
-        // TRACE and DEBUG
-        Severity::Debug
-    }
-}
-
-/// Strips NUL bytes so values survive the `CString` boundary in
-/// `WorkloadContext::trace` (a NUL would otherwise panic across `extern "C"`).
-fn sanitize(value: &str) -> String {
-    if value.contains('\0') {
-        value.chars().filter(|&c| c != '\0').collect()
-    } else {
-        value.to_owned()
-    }
-}
-
-/// Collects fields into `(key, value)` strings, pulling the field literally
-/// named `message` out separately (used for the event `Message` detail). Every
-/// key and value has NUL bytes stripped before it is stored.
-#[derive(Default)]
-struct DetailVisitor {
-    message: Option<String>,
-    fields: Vec<(String, String)>,
-}
-
-impl DetailVisitor {
-    fn push(&mut self, field: &Field, value: String) {
-        let value = sanitize(&value);
-        if field.name() == "message" {
-            self.message = Some(value);
-        } else {
-            self.fields.push((sanitize(field.name()), value));
-        }
-    }
-
-    /// Returns every captured field, folding a captured `message` back in as a
-    /// regular `message` field. Used for spans, where the `message` field (if
-    /// any) is just another field to carry.
-    fn into_all_fields(mut self) -> Vec<(String, String)> {
-        if let Some(message) = self.message {
-            self.fields.insert(0, ("message".to_owned(), message));
-        }
-        self.fields
-    }
-}
-
-impl Visit for DetailVisitor {
-    fn record_debug(&mut self, field: &Field, value: &dyn fmt::Debug) {
-        self.push(field, format!("{value:?}"));
-    }
-
-    fn record_str(&mut self, field: &Field, value: &str) {
-        self.push(field, value.to_owned());
-    }
-
-    fn record_i64(&mut self, field: &Field, value: i64) {
-        self.push(field, value.to_string());
-    }
-
-    fn record_u64(&mut self, field: &Field, value: u64) {
-        self.push(field, value.to_string());
-    }
-
-    fn record_i128(&mut self, field: &Field, value: i128) {
-        self.push(field, value.to_string());
-    }
-
-    fn record_u128(&mut self, field: &Field, value: u128) {
-        self.push(field, value.to_string());
-    }
-
-    fn record_f64(&mut self, field: &Field, value: f64) {
-        self.push(field, value.to_string());
-    }
-
-    fn record_bool(&mut self, field: &Field, value: bool) {
-        self.push(field, value.to_string());
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::sync::{Arc, Mutex};
-
-    use foundationdb_simulation::WorkloadContext;
-    use foundationdb_simulation::internals::FDBWorkloadContext;
-
-    use super::*;
-
-    /// A zeroed context is enough for guard tests: we only store it in the slot
-    /// and drop it, never calling any method that would dereference a pointer.
-    fn dummy_context() -> WorkloadContext {
-        // SAFETY: These guard tests only construct, clone, and drop the context;
-        // they never emit trace events or perform native context operations.
-        unsafe {
-            WorkloadContext::new(FDBWorkloadContext {
-                api_version: 1,
-                inner: std::ptr::null_mut(),
-                vt: std::ptr::null_mut(),
-            })
-        }
-    }
-
-    fn slot_generation() -> Option<u64> {
-        SIM_CONTEXT.with(|slot| slot.borrow().as_ref().map(|(_, generation)| *generation))
-    }
-
-    /// Shared slot the capture layer writes the forwarded details into.
-    type CapturedSlot = Arc<Mutex<Option<Vec<(String, String)>>>>;
-
-    /// Test layer that records the details `event_details` would forward, so we
-    /// can assert on them without a live `WorkloadContext`.
-    struct CaptureLayer(CapturedSlot);
-
-    impl<S> Layer<S> for CaptureLayer
-    where
-        S: Subscriber + for<'a> LookupSpan<'a>,
-    {
-        fn on_event(&self, event: &Event<'_>, ctx: Context<'_, S>) {
-            *self.0.lock().unwrap() = Some(event_details(event, &ctx));
-        }
-    }
-
-    /// Runs `emit` under a `Registry` stacked with `SimLayer` (so span fields
-    /// are captured) and a `CaptureLayer` (so we can read the forwarded
-    /// details), returning the details of the single emitted event.
-    fn capture(emit: impl FnOnce()) -> Vec<(String, String)> {
-        capture_with_filter(LevelFilter::INFO, emit).unwrap()
-    }
-
-    fn capture_with_filter(
-        level_filter: LevelFilter,
-        emit: impl FnOnce(),
-    ) -> Option<Vec<(String, String)>> {
-        let captured = Arc::new(Mutex::new(None));
-        let subscriber = Registry::default()
-            .with(SimLayer)
-            .with(CaptureLayer(captured.clone()))
-            .with(level_filter);
-        tracing_core::dispatcher::with_default(&Dispatch::new(subscriber), emit);
-        captured.lock().unwrap().take()
-    }
-
-    fn has(details: &[(String, String)], key: &str, value: &str) -> bool {
-        details.iter().any(|(k, v)| k == key && v == value)
-    }
-
-    #[test]
-    fn severity_mapping_never_errors() {
-        assert!(matches!(severity(&Level::TRACE), Severity::Debug));
-        assert!(matches!(severity(&Level::DEBUG), Severity::Debug));
-        assert!(matches!(severity(&Level::INFO), Severity::Info));
-        assert!(matches!(severity(&Level::WARN), Severity::Warn));
-        assert!(matches!(severity(&Level::ERROR), Severity::WarnAlways));
-    }
-
-    #[test]
-    fn debug_events_are_dropped_by_default_and_enabled_by_override() {
-        let default = parse_level_filter(None).unwrap();
-        assert!(capture_with_filter(default, || tracing::debug!("filtered")).is_none());
-
-        let debug = parse_level_filter(Some("debug")).unwrap();
-        let details = capture_with_filter(debug, || tracing::debug!("forwarded")).unwrap();
-        assert!(has(&details, "Message", "forwarded"));
-    }
-
-    #[test]
-    fn debug_spans_are_dropped_by_default() {
-        let details = capture(|| {
-            let span = tracing::debug_span!("filtered_span", client = 7);
-            let _entered = span.enter();
-            tracing::info!("visible event");
-        });
-
-        assert!(!details.iter().any(|(key, _)| key == "Span"));
-        assert!(!has(&details, "client", "7"));
-    }
-
-    #[test]
-    fn sanitize_strips_nul_bytes() {
-        assert_eq!(sanitize("a\0b\0c"), "abc");
-        assert_eq!(sanitize("clean"), "clean");
-        assert_eq!(sanitize("\0"), "");
-    }
-
-    #[test]
-    fn event_splits_message_from_fields() {
-        let details = capture(|| tracing::info!(client = 3, "hello world"));
-        assert!(has(&details, "Message", "hello world"));
-        assert!(has(&details, "client", "3"));
-    }
-
-    #[test]
-    fn event_treats_explicit_message_field_as_message() {
-        let details = capture(|| tracing::info!(message = "explicit", other = 1));
-        assert!(has(&details, "Message", "explicit"));
-        assert!(has(&details, "other", "1"));
-        assert!(!details.iter().any(|(key, _)| key == "message"));
-    }
-
-    #[test]
-    fn event_strips_nul_from_keys_and_values() {
-        let details = capture(|| tracing::info!(dirty = "a\0b", "mes\0sage"));
-        assert!(has(&details, "Message", "message"));
-        assert!(has(&details, "dirty", "ab"));
-    }
-
-    #[test]
-    fn event_in_span_carries_span_context() {
-        let details = capture(|| {
-            let span = tracing::info_span!("demo_span", client = 7);
-            let _entered = span.enter();
-            tracing::info!("inside the span");
-        });
-        assert!(has(&details, "Span", "demo_span"));
-        assert!(has(&details, "SpanPath", "demo_span"));
-        assert!(has(&details, "client", "7"));
-        assert!(has(&details, "Message", "inside the span"));
-    }
-
-    #[test]
-    fn nested_spans_produce_full_path() {
-        let details = capture(|| {
-            let outer = tracing::info_span!("outer", a = 1);
-            let _outer = outer.enter();
-            let inner = tracing::info_span!("inner", b = 2);
-            let _inner = inner.enter();
-            tracing::info!("deep event");
-        });
-        assert!(has(&details, "Span", "inner"));
-        assert!(has(&details, "SpanPath", "outer/inner"));
-        assert!(has(&details, "a", "1"));
-        assert!(has(&details, "b", "2"));
-    }
-
-    #[test]
-    fn event_field_wins_over_span_field() {
-        let details = capture(|| {
-            let span = tracing::info_span!("collision", shared = "from_span");
-            let _entered = span.enter();
-            tracing::info!(shared = "from_event", "msg");
-        });
-        let shared: Vec<_> = details.iter().filter(|(key, _)| key == "shared").collect();
-        assert_eq!(shared.len(), 1, "span field must be skipped on collision");
-        assert_eq!(shared[0].1, "from_event");
-    }
-
-    #[test]
-    fn innermost_span_field_wins_over_outer() {
-        let details = capture(|| {
-            let outer = tracing::info_span!("outer", shared = "from_outer");
-            let _outer = outer.enter();
-            let inner = tracing::info_span!("inner", shared = "from_inner");
-            let _inner = inner.enter();
-            tracing::info!("event without a shared field");
-        });
-        let shared: Vec<_> = details.iter().filter(|(key, _)| key == "shared").collect();
-        assert_eq!(
-            shared.len(),
-            1,
-            "outer span field must be skipped on collision"
-        );
-        assert_eq!(shared[0].1, "from_inner");
-    }
-
-    #[test]
-    fn guard_clears_slot_on_drop() {
-        let context = dummy_context();
-        {
-            let _guard = install(&context);
-            assert!(slot_generation().is_some());
-        }
-        assert_eq!(slot_generation(), None);
-    }
-
-    #[test]
-    fn newer_install_survives_older_guard_drop() {
-        let context = dummy_context();
-        let guard_a = install(&context);
-        let gen_a = slot_generation();
-        let guard_b = install(&context);
-        let gen_b = slot_generation();
-        assert_ne!(gen_a, gen_b);
-
-        // The older guard must leave the newer binding untouched.
-        drop(guard_a);
-        assert_eq!(slot_generation(), gen_b);
-
-        // The newer guard owns the current binding and clears it.
-        drop(guard_b);
-        assert_eq!(slot_generation(), None);
-    }
-}
diff --git a/bindings/rust/foundationdb-simulation/Cargo.toml b/bindings/rust/foundationdb-simulation/Cargo.toml
index 4ff290509cd..5162bef698e 100644
--- a/bindings/rust/foundationdb-simulation/Cargo.toml
+++ b/bindings/rust/foundationdb-simulation/Cargo.toml
@@ -1,6 +1,7 @@
 [package]
 name = "foundationdb-simulation"
 version = "0.3.0"
+publish = false
 authors = [
     "Eloi DEMOLIS <eloi.demolis@clever-cloud.com>",
     "Pierre Zemb <contact@pierrezemb.fr>"
@@ -10,20 +11,15 @@ description = """
 Embed Rust code within FoundationDB's simulation
 """
 license = "MIT/Apache-2.0"
-documentation = "https://docs.rs/foundationdb-simulation"
 repository = "https://github.com/apple/foundationdb"
 readme = "README.md"
 keywords = ["foundationdb", "simulation"]
 
-[package.metadata.docs.rs]
-features = ["embedded-fdb-include", "fdb-7_4"]
-
 [dependencies]
 foundationdb = { version = "0.11.0", path = "../foundationdb", default-features = false }
 foundationdb-sys = { version = "0.11.0", path = "../foundationdb-sys", default-features = false }
 
 [build-dependencies]
-cc = "1.2.65"
 bindgen = "0.73.2"
 
 [dev-dependencies]
@@ -32,11 +28,7 @@ loom = "0.7.2"
 
 [features]
 default = ["embedded-fdb-include"]
-cpp-abi = []
-fdb-7_1 = ["foundationdb/fdb-7_1", "foundationdb-sys/fdb-7_1", "cpp-abi"]
-fdb-7_3 = ["foundationdb/fdb-7_3", "foundationdb-sys/fdb-7_3", "cpp-abi"]
 fdb-7_4 = ["foundationdb/fdb-7_4", "foundationdb-sys/fdb-7_4"]
-fdb-docker = []
 embedded-fdb-include = [
     "foundationdb/embedded-fdb-include",
     "foundationdb-sys/embedded-fdb-include",
diff --git a/bindings/rust/foundationdb-simulation/README.md b/bindings/rust/foundationdb-simulation/README.md
index 696796171ee..2cb1c0e7d96 100644
--- a/bindings/rust/foundationdb-simulation/README.md
+++ b/bindings/rust/foundationdb-simulation/README.md
@@ -1,358 +1,131 @@
 # foundationdb-simulation
 
-This crate provides the tools to write Rust workloads that can be loaded and executed in the
-official FoundationDB simulator, allowing for rigorous and deterministic testing of Rust layers.
-
-> ⚠️ **The C API path requires fdbserver 7.4.6 or newer.** When built with `fdb-7_4` and
-> `useCAPI=true`, this crate targets the external-workload C ABI shipped in fdbserver **7.4.6**
-> (virtual tables, `api_version`, `WorkloadContext::delay`). That ABI change was not accompanied
-> by an `FDB_API_VERSION` bump, so running against 7.4.3 / 7.4.4 / 7.4.5 (older, incompatible C
-> ABI) SIGSEGVs at workload start. See
-> [issue #459](https://github.com/foundationdb-rs/foundationdb-rs/issues/459) and the version
-> compatibility note below.
-
-## How It Works
-
-FoundationDB's simulation framework includes an `ExternalWorkload` that can dynamically load a
-shared object at runtime. This shared object must expose specific symbols that the simulator calls
-to drive the workload.
-
-Originally, `ExternalWorkload` used a C++ interface. This is cumbersome because the C++ ABI is not
-stable and most languages do not interoperate with it easily. As of FoundationDB 7.4, the
-`ExternalWorkload` supports a pure C interface, which this crate targets. For backwards
-compatibility with FoundationDB 7.1 and 7.3, a C++ shim can be compiled to translate the C
-interface back to the C++ one.
-
-### For FoundationDB 7.4.6 and Newer (Recommended)
-
-- Uses a pure C API (FFI-safe).
-- **No need** to build inside the official FoundationDB Docker image.
-- Requires setting `useCAPI=true` in the test configuration file.
-- Results in faster build times and a simpler setup.
-
-> **fdbserver 7.4.6 or newer is required for the C API path** (`fdb-7_4` + `useCAPI=true`).
-> The external-workload C ABI gained virtual tables, an `api_version` field and
-> `WorkloadContext::delay` in fdbserver **7.4.6**, and this change was *not* accompanied by an
-> `FDB_API_VERSION` bump. Patch releases 7.4.3 / 7.4.4 / 7.4.5 ship the previous, incompatible C
-> ABI: loading a `fdb-7_4` workload there with `useCAPI=true` SIGSEGVs at workload start (see
-> [issue #459](https://github.com/foundationdb-rs/foundationdb-rs/issues/459)). To target 7.4.5 or
-> earlier, use a matching older crate release, or the C++ shim path below (which stays compatible
-> with the whole 7.4 series, except `WorkloadContext::delay`, which also requires 7.4.6).
-
-### For FoundationDB 7.1 and 7.3
-
-- Requires a C++ shim to bridge the C and C++ ABIs.
-- **Must** be built within the [official `foundationdb/build` Docker image](https://hub.docker.com/r/foundationdb/build)).
-- The linker must be set to `clang`.
-- Involves a more complex build process due to C++ ABI compatibility requirements.
-
-## Setup
-
-First, create a new Rust project with a library structure:
-
-```console
-.
-├── Cargo.toml
-└── src/
-    └── lib.rs
-```
-
-Next, add `foundationdb-simulation` to your `Cargo.toml` and configure your crate as `cdylib`
-as the `ExternalWorkload` expects a shared object.
-
-```toml
-[lib]
-name = "myworkload"
-crate-type = ["cdylib"]
-
-[dependencies]
-# Make sure to select the feature flag for your target FDB version.
-foundationdb-simulation = { version = "...", features = ["fdb-7_4"] } # or "fdb-7_1", "fdb-7_3"
-```
-
-## Compilation
-
-If you are targeting FoundationDB 7.1 or 7.3 (which require the C++ shim), you **must** compile
-your workload inside the official FoundationDB Docker image. Compiling outside of this environment
-will almost certainly lead to segmentation faults at runtime due to C++ ABI mismatches.
-
-Compile your workload using the standard Cargo commands. This will create a shared object in
-`./target/release/` (`./target/debug/`). The filename will be `lib<name>.so`, where `<name>` is
-the `name` you set in the `[lib]` section of your `Cargo.toml`. For example: `libmyworkload.so`.
-
-## Launching the Simulation
-
-The FoundationDB simulator is launched via the `fdbserver` binary with a TOML configuration file.
-
-```bash
-fdbserver -r simulation -f ./test_file.toml
-```
-
-Your test file must specify `testName=External` to use the `ExternalWorkload` framework.
-
-```toml
-testTitle = "MyRustTest"
-testName = "External"
-
-# The name passed to your workload factory
-workloadName = "MyWorkload" 
-
-# The path to the directory containing your .so file
-libraryPath = "./target/release/" 
-# The name of your library from Cargo.toml (without lib/.so)
-libraryName = "myworkload" 
-
-# Required for FDB 7.4+ when using the C API
-useCAPI = true
-
-# Custom options for your workload
-myCustomOption = 42
-```
-
-## Workload Definition
-
-FoundationDB workloads are defined by implementing the `RustWorkload` trait:
-
-```rust
-pub trait RustWorkload {
-    async fn setup(&mut self, db: SimDatabase);
-    async fn start(&mut self, db: SimDatabase);
-    async fn check(&mut self, db: SimDatabase);
-    fn get_metrics(&self, out: Metrics<'_>);
-    fn get_check_timeout(&self) -> f64;
+Optional support for Rust workloads loaded by FoundationDB's `ExternalWorkload`
+simulator. This crate uses the current `bindings/c/foundationdb/CWorkload.h`
+interface and exports its C workload factory. Workload configurations must set
+`useCAPI = true`.
+
+The build uses `CWorkload.h` from `FDB_INCLUDE_DIR` when set, or the canonical
+header in this source tree otherwise. Use headers and the C client library from
+the same FoundationDB build as the simulator. `FDB_CLIENT_LIB_PATH` selects the
+client library directory for Cargo builds. The `fdb-7_4` feature selects the
+client API used by the Rust binding; it does not select a historical simulator
+ABI.
+
+## Workloads
+
+Implement `RustWorkload` to provide asynchronous `setup`, `start`, and `check`
+phases, plus synchronous metrics and timeout callbacks. Implement
+`SingleRustWorkload` to construct one workload type and register it with
+`register_workload!`:
+
+```rust,ignore
+use foundationdb_simulation::{
+    Metrics, RustWorkload, SimDatabase, SingleRustWorkload, WorkloadContext,
+    register_workload,
+};
+
+struct MyWorkload {
+    context: WorkloadContext,
 }
-```
-
-The simulator expects the shared object to expose a factory that can create workload instances.
-This crate provides two traits to define these factories.
-
-For simple use cases where a single workload implementation is defined, you can implement the
-`SingleRustWorkload` trait directly on your `RustWorkload`.
-
-```rust
-pub trait SingleRustWorkload: RustWorkload {
-    const FDB_API_VERSION: u32;
-    fn new(name: String, context: WorkloadContext) -> Self;
-}
-```
-
-Then, register your workload with the corresponding `register_workload` macro.
-
-For more complex scenarios, where multiple workload implementations exist in a single shared
-object, you can define a separate factory that implements the `RustWorkloadFactory` trait. This
-allows selecting the implementation based on the workload name provided in the test configuration.
-
-```rust
-pub trait RustWorkloadFactory {
-    const FDB_API_VERSION: u32;
-    fn create(name: String, context: WorkloadContext) -> WrappedWorkload;
-}
-```
 
-The factory must be registered with the corresponding `register_factory` macro.
-
-> **Warning:** Do not use more than one "register macro" per project.
-
-See the `atomic` and `noop` implementations in the `examples/` directory for complete working examples.
-
-## The WorkloadContext
-
-The `WorkloadContext` passed at instantiation is the primary way to interact with the simulator.
-Contexts and environments created from them may be cloned, but their operations
-must run on the simulator thread that created the workload. Calls from another
-thread or after the registered workload is released panic before accessing the
-native context. Keeping a clone does not extend the native workload's lifetime.
-
-Raw context and string conversion entry points are unsafe. `WrappedWorkload` is
-an opaque owned value; factories create it with `RustWorkload::wrap()` rather
-than constructing a raw C workload or overriding its callback table.
-
-It provides several useful methods:
-
-- `trace(severity, name, details)`: Add a log entry to the FDB trace files.
-- `now()`: Get the current simulated time as a `f64`.
-- `rnd()`: Get a deterministic 32-bit random number.
-- `shared_random_number()`: Get a deterministic 64-bit random number (the same for all clients).
-- `client_id()`: Get the ID of the current client.
-- `client_count()`: Get the total number of clients in the simulation.
-- `get_option<T>(name)`: Get a custom configuration option from the test file.
-
-### Get options
-In the simulation configuration file you can add custom parameters to your workload.
-These parameters can be read with `WorkloadContext::get_option`. This method will first try to get
-the parameter value as a raw string and then convert it in a the type of your choice.
-If the parameter doesn't exist, its value is invalid or set to null, the function returns None.
-
-Example:
-
-```rust
 impl SingleRustWorkload for MyWorkload {
-    fn new(name: String, context: WorkloadContext) -> Self {
-        let my_custom_option: usize = context
-            .get_option("myCustomOption")
-            .unwrap();
-        Self { context, name, my_custom_option }
+    fn new(_name: String, context: WorkloadContext) -> Self {
+        Self { context }
     }
 }
-```
-
-### Tracing
 
-Use `WorkloadContext::trace` to log messages with a given severity and a map of string "details".
-A severity of `Severity::Error` will automatically stop the `fdbserver` process. The event
-name's first character is uppercased automatically, matching FDB's convention for event types.
-
-Every call to `trace` automatically adds a `RustWorkload="1"` detail to the event (unless you
-already supplied one), so a runner can grep all Rust-origin trace lines with a single token.
-When you trace with `Severity::Error`, the crate also adds a `RustFailure="1"` detail (unless
-you already supplied one). This lets a runner parsing the `fdbserver` trace logs distinguish a
-failure detected by the Rust workload from an FDB-internal Sev40 event, which will never carry
-this field.
-
-```rust
 impl RustWorkload for MyWorkload {
-    fn setup(&mut self, db: SimDatabase) {
-        self.context.trace(
-            Severity::Info,
-            "SuccessfullySetupWorkload",
-            details![
-                "Layer" => "Rust",
-                "Phase" => "setup",
-                "Name" => self.name,
-                "CustomOption" => self.my_custom_option,
-            ],
-        );
+    async fn setup(&mut self, _db: SimDatabase) {}
+    async fn start(&mut self, _db: SimDatabase) {
+        self.context
+            .delay(std::time::Duration::from_secs(1))
+            .await
+            .expect("simulated delay");
+    }
+    async fn check(&mut self, _db: SimDatabase) {}
+    fn get_metrics(&self, _out: Metrics<'_>) {}
+    fn get_check_timeout(&self) -> f64 {
+        30.0
     }
-    ...
 }
-```
-
-### Randomness
-
-To maintain determinism, all random numbers must be sourced from the simulator.
-Use `WorkloadContext::rnd()` or `WorkloadContext::shared_random_number()` for a shared seed.
-Do not use external entropy sources like `rand::thread_rng()`.
-
-# Workload Lifecycle
-
-## Instantiation
-
-Once the `fdbserver` process is ready, it loads your shared object and calls your workload factory
-to create instances. The simulator creates a random number of "clients," and your factory will be
-called once for each client.
-
-> **Note:** Contrary to the C++ `ExternalWorkload` which has separate `create` and `init` methods,
-> the `RustWorkload` is not created until the simulator's `init` phase.
-
-The `WorkloadContext` passed to your factory should be stored in your `RustWorkload`, as it is safe
-to use across phases and will not be provided again.
 
-## The setup, start, and check Phases
-
-These three phases run sequentially. The simulation will not begin the `start` phase until all
-clients have completed the `setup` phase, and so on.
-
-Each function is `async` and runs cooperatively alonside the `fdbserver`.
-As long as your function is executing, the `fdbserver` is paused to ensure determinism.
-You **must** yield control back to the simulator for any database operations to occur.
-Do not "busy wait" for a foundationdb function to return as it will deadlock.
-
-FoundationDB Simulation runs your async code on a custom future executor that integrates with
-the `fdbserver` event loop. It effectively turns your async fn into a sequence of cooperative
-steps, allowing the `fdbserver` to drive simulation events between awaits.
-
-- All foundationdb-rs async operations are compatible with this model.
-- Avoid using arbitrary async primitives from other crates (e.g., `tokio::sleep`).
-
-If the native tester releases the workload while a phase is suspended, its task is canceled
-before the workload is destroyed. Final metrics collection or a new phase also cancels a
-phase left pending after the tester abandoned its native waiter. Late wakes cannot restart
-it. Timeout queries during `check` use the value sampled just before that phase began;
-a timeout query before `check` cancels an abandoned setup/start before reading the workload.
-Phase futures and workload destructors still have a live context during this teardown. A native callback must not free
-a workload reentrantly while its user phase is actively being polled.
-
-`SimDatabase` is a borrowed native database represented by a Rust `Arc`. The phase guard
-releases the Rust allocation on completion and cancellation without releasing the native
-caller's database reference. Every strong and weak `SimDatabase` reference must be dropped
-by the end of the phase, including cancellation. Retaining one terminates the process before
-it can outlive the borrowed native handle.
-
-## Reporting Metrics
-
-At the end of the simulation, the `get_metrics` method is called for each client.
-Implement this method to report results.
-
-```rust
-fn get_metrics(&self, out: Metrics<'_>) {
-    // val metrics are summed across all clients
-    out.push(Metric::val("total_ops", self.ops as f64));
-    // avg metrics are averaged across all clients
-    out.push(Metric::avg("avg_latency", self.latency / self.ops.max(1) as f64));
-}
+register_workload!(MyWorkload);
 ```
 
-## LLVM code coverage for external workloads
+For a library containing several workload types, implement `RustWorkloadFactory`
+and use `register_factory!` instead. Register exactly one factory per shared
+library. Workload crates must set `crate-type = ["cdylib"]`.
 
-`cargo llvm-cov` can collect Rust coverage from an external workload and its Rust dependencies.
-The workload writes a profile after each completed `get_metrics` callback because `fdbserver`
-exits with `_exit`, which bypasses LLVM's normal process-exit profile writer. This is enabled only
-when `cargo llvm-cov` sets `cfg(coverage)`; regular builds are unchanged.
+The examples cover native operations without an application runtime:
 
-This example builds the existing atomic workload into an isolated target directory, writes a copy
-of its test configuration there, and points that copy at the instrumented shared object:
+- `noop`: factory dispatch, workload options, tracing, metrics, and simulated delay.
+- `atomic`: atomic mutations and a check against committed counter values.
+- `shared`: sharing a Rust future backed by the C client.
 
-Install `cargo-llvm-cov` and the `llvm-tools-preview` Rust component first. The Nix shell provides
-the LLVM tools, but does not currently provide the `cargo-llvm-cov` CLI.
+From `bindings/rust`, build and run the atomic example with the matching
+FoundationDB headers and client library available:
 
 ```bash
-nix develop
-
-export CARGO_TARGET_DIR="$PWD/target/simulation-coverage"
-export CARGO_LLVM_COV_TARGET_DIR="$CARGO_TARGET_DIR"
-source <(cargo llvm-cov show-env --sh --release)
-cargo llvm-cov clean --workspace
-
 cargo build --locked --release -p foundationdb-simulation --example atomic \
-  --features embedded-fdb-include,fdb-7_4
-
-config="$CARGO_TARGET_DIR/atomic-coverage.toml"
-sed "s#libraryPath = './target/release/examples'#libraryPath = '$CARGO_TARGET_DIR/release/examples'#" \
-  foundationdb-simulation/examples/atomic/test_file_74.toml > "$config"
-
-fdbserver -r simulation -f "$config" -b on --trace-format json
-
-cargo llvm-cov report --release --html --output-dir "$CARGO_TARGET_DIR/report"
-cargo llvm-cov report --release --lcov --output-path "$CARGO_TARGET_DIR/lcov.info"
+  --features fdb-7_4
+fdbserver -r simulation \
+  -f foundationdb-simulation/examples/atomic/test_file.toml \
+  -b on --trace-format json
 ```
 
-Keep the `LLVM_PROFILE_FILE` set by `show-env`, including its `%m` placeholder. A custom name
-without `%m` can overwrite earlier client snapshots. This prototype flushes only completed metrics
-callbacks, so a simulation failure or timeout before that callback has no profile-write guarantee.
-
-# Common Mistakes
-
-* **Compiling C++ shim outside of the Docker.** C++ ABI is extremely environment-dependent, not
-  compiling in the exact same environment as the other half of the interface will probably result
-  in segmentation faults or mangled strings that will trigger unrecoverable errors.
-
-* **Forgetting to read all options.** Any custom option in the configuration that is not read will
-  trigger a `Workload had invalid options.` error.
-
-* **Forgetting useCAPI=true.** If the `fdbserver` used supports the C API, you still need to add
-  explicitely this option, otherwise the `ExternalWorkload` will try to load the C++ symbol.
-
-* **Using pointers or references after a phase ends.** After each phase, the simulator may move or
-  deallocate memory. Any pointers or references to FoundationDB objects become invalid. You must
-  use the fresh `&mut self` and `db` references passed to the next phase. Storing `SimDatabase`,
-  `Transaction`, or `Future` objects across phases will lead to segmentation faults or other
-  undefined behavior.
-
-### Shared client API selection
-
-Workload libraries built against the current FoundationDB C headers and library
-can share an API selection only when both runtime and header versions match.
-Registration rejects incompatible or unverifiable selections before creating a
-workload. Historical headers do not expose the selection query and therefore
-cannot adopt another library's selection. The simulator retains ownership of the
-network and the database handles it passes into workload phases.
+The example configuration loads `target/release/examples/libatomic.so`. Adjust
+`libraryPath` if using a different Cargo target directory.
+
+## Simulator context
+
+`WorkloadContext` exposes the simulator's clock (`now`), deterministic random
+numbers (`rnd` and `shared_random_number`), delay futures, client IDs, workload
+options, and tracing. Use these instead of machine clocks, ambient randomness,
+or external timers so a simulation seed reproduces the workload.
+
+Read every custom option supplied in the TOML configuration; unread options make
+the native workload configuration invalid. `get_option<T>` returns `None` for a
+missing option or a value that cannot be parsed as `T`.
+
+Context clones do not extend the native workload's lifetime. Their operations
+panic before native access when called from another thread or after the
+registered workload is released. Raw context and string entry points are unsafe;
+factories construct an opaque `WrappedWorkload` through `RustWorkload::wrap()`.
+
+`context.trace(Severity::Error, ...)` fails the simulation. Traces capitalize the
+first character of event names and detail keys, and add `RustWorkload="1"`;
+error events also add `RustFailure="1"`. `Metric::val` values are summed across
+clients, while `Metric::avg` values are averaged. The `Metrics<'_>` sink is
+borrowed only for the metrics callback and must not escape it.
+
+## Scheduling and ownership
+
+The simulator drives phases cooperatively on its own thread. Await FoundationDB
+futures or `context.delay`; do not busy-wait or use timers from another async
+runtime. The executor drains queued Rust futures after native future callbacks.
+A wake from another thread is safe but needs a later owner-thread drain to make
+progress. See [executor details](docs/fdb_rt.md).
+
+Native workload release cancels a suspended phase before destroying the workload
+or invalidating its context. Final metrics collection or a new phase also cancels
+an abandoned phase. Late wakes cannot restart it. Timeout queries during `check`
+use the value sampled immediately before that phase; a timeout query before
+`check` cancels abandoned setup/start work before reading the timeout. Native
+callbacks must not free a workload reentrantly while its phase is being polled.
+
+`SimDatabase` represents a borrowed native database using a Rust `Arc`. All
+strong and weak database references, transactions, and database futures must be
+dropped by the end of their phase, including cancellation. The phase guard frees
+only the Rust allocation, preserving the native caller's database reference.
+Escaping database references terminate the process before they can outlive that
+native handle.
+
+Registration selects the client API through the shared C client. Libraries may
+share a selection only when their runtime and header versions match; incompatible
+or unverifiable selections fail before workload creation. The simulator retains
+ownership of the network and its database handles.
+
+When built under `cargo llvm-cov`, completed metrics callbacks flush their LLVM
+profiles because `fdbserver` can exit without running process-exit handlers. A
+failure before metrics collection does not guarantee a profile flush.
diff --git a/bindings/rust/foundationdb-simulation/build.rs b/bindings/rust/foundationdb-simulation/build.rs
index d7ddac337d0..bfe686426e2 100644
--- a/bindings/rust/foundationdb-simulation/build.rs
+++ b/bindings/rust/foundationdb-simulation/build.rs
@@ -1,82 +1,24 @@
 use std::{env, path::PathBuf};
 
-extern crate cc;
-
 fn main() {
     println!("cargo:rustc-check-cfg=cfg(coverage)");
     println!("cargo:rustc-check-cfg=cfg(fdb_simulation_loom)");
-
+    println!("cargo:rerun-if-env-changed=FDB_INCLUDE_DIR");
+
+    let include_dir = env::var_os("FDB_INCLUDE_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| {
+            PathBuf::from(env::var_os("CARGO_MANIFEST_DIR").unwrap()).join("../../c/foundationdb")
+        });
+    let header = include_dir.join("CWorkload.h");
+    println!("cargo:rerun-if-changed={}", header.display());
     let bindings = bindgen::Builder::default()
-        .header("src/headers/CWorkload.h")
+        .header(header.to_str().expect("UTF-8 workload header path"))
         .generate()
-        .expect("generate bindings");
+        .expect("generate workload bindings");
 
-    let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
+    let out_path = PathBuf::from(env::var_os("OUT_DIR").unwrap());
     bindings
         .write_to_file(out_path.join("bindings.rs"))
-        .expect("write bindings");
-
-    let _api_version: usize;
-
-    #[cfg(feature = "fdb-7_1")]
-    {
-        _api_version = 710;
-    }
-    #[cfg(feature = "fdb-7_3")]
-    {
-        _api_version = 730;
-    }
-    #[cfg(feature = "fdb-7_4")]
-    {
-        _api_version = 740;
-    }
-
-    #[cfg(feature = "cpp-abi")]
-    {
-        if cfg!(feature = "fdb-docker") {
-            if _api_version < 730 {
-                build_with_gcc(_api_version);
-            } else {
-                // FDB 7.3+ is built with clang, so we need to do the same, including the linker
-                build_with_clang(_api_version);
-            }
-        } else {
-            // The Cpp API is not FFI safe, not compiling in the exact same environment leads to undefined behavior
-            display_build_warnings();
-            build_with_gcc(_api_version);
-        }
-    }
-}
-
-#[allow(dead_code)]
-fn display_build_warnings() {
-    println!("cargo:warning=---------------------");
-    println!("cargo:warning=------ Warning ------");
-    println!("cargo:warning=---------------------");
-    println!(
-        "cargo:warning=Building the C++ bindings without the `fdb-docker` feature will be valid from Rust's perspective but not from C++ and FoundationDB"
-    );
-    println!("cargo:warning=Please follow the instructions in the associated README");
-}
-
-#[allow(dead_code)]
-fn build_with_gcc(api_version: usize) {
-    cc::Build::new()
-        .cpp(true)
-        .std("c++14")
-        .define("FDB_API_VERSION", api_version.to_string().as_str())
-        .file("src/CppWorkload.cpp")
-        .compile("ctx");
-}
-
-#[allow(dead_code)]
-fn build_with_clang(api_version: usize) {
-    cc::Build::new()
-        .compiler("clang")
-        .cpp_set_stdlib("c++")
-        .cpp(true)
-        .std("c++14")
-        .define("FDB_API_VERSION", api_version.to_string().as_str())
-        .file("src/CppWorkload.cpp")
-        .compile("ctx");
+        .expect("write workload bindings");
 }
diff --git a/bindings/rust/foundationdb-simulation/examples/atomic/Dockerfile b/bindings/rust/foundationdb-simulation/examples/atomic/Dockerfile
deleted file mode 100644
index 2662c7cfc69..00000000000
--- a/bindings/rust/foundationdb-simulation/examples/atomic/Dockerfile
+++ /dev/null
@@ -1,37 +0,0 @@
-# This Dockerfile is used to build the `atomic` example.
-# WARNING:
-# The build image is fairly large, so you need to have extra storage space on your CI
-FROM foundationdb/build:centos7-20240228040135-fc272dd89b
-ARG FDB_VERSION="7.3.27"
-ARG FDB_RS_FEATURE_VERSION="fdb-7_3"
-
-# Required to correctly build the example
-ENV RUSTC_LINKER=clang
-
-# Add source code and bump Rust version to stable
-RUN mkdir /root/fdb-rs
-COPY . /root/fdb-rs
-RUN /root/.cargo/bin/rustup update stable
-RUN /root/.cargo/bin/rustup default stable
-
-# Install libfdb
-ADD https://github.com/apple/foundationdb/releases/download/${FDB_VERSION}/foundationdb-clients-${FDB_VERSION}-1.el7.x86_64.rpm /tmp/foundationdb-clients-${FDB_VERSION}-1.el7.x86_64.rpm
-RUN rpm -i /tmp/foundationdb-clients-${FDB_VERSION}-1.el7.x86_64.rpm
-
-# Install fdbserver
-ADD https://github.com/apple/foundationdb/releases/download/${FDB_VERSION}/foundationdb-server-${FDB_VERSION}-1.el7.x86_64.rpm /tmp/foundationdb-server-${FDB_VERSION}-1.el7.x86_64.rpm
-RUN rpm -i /tmp/foundationdb-server-${FDB_VERSION}-1.el7.x86_64.rpm
-
-# Build the .so
-# The artifact will be at /root/fdb-rs/target/release/examples/libatomic.so
-RUN cd /root/fdb-rs && \
-    source /opt/rh/devtoolset-11/enable && \
-    source /root/.cargo/env && \
-    RUSTFLAGS="-C linker=clang" cargo build -p foundationdb-simulation --release --example atomic --features ${FDB_RS_FEATURE_VERSION},fdb-docker
-
-# In case you are running a seg fault, uncomment this to have the fdbserver debug
-# ADD https://github.com/apple/foundationdb/releases/download/${FDB_VERSION}/fdbserver.debug.x86_64.gz /tmp/fdbserver.debug.x86_64.gz
-# RUN gzip -d /tmp/fdbserver.debug.x86_64.gz
-
-WORKDIR /root/fdb-rs
-CMD ["/root/fdb-rs/scripts/simulation_entrypoint.sh", "20"]
\ No newline at end of file
diff --git a/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs b/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs
index ca285f08f96..786a59d95d8 100644
--- a/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs
+++ b/bindings/rust/foundationdb-simulation/examples/atomic/lib.rs
@@ -1,307 +1,108 @@
-use std::time::Duration;
-
 use foundationdb::{
-    BudgetExceeded, BudgetKind, ClientBudget, FdbBindingError, FdbResult, Transaction,
-    env::Environment,
+    FdbBindingError,
     options::{MutationType, TransactionOption},
-    tuple::Subspace,
 };
 use foundationdb_simulation::{
     Metric, Metrics, RustWorkload, Severity, SimDatabase, SingleRustWorkload, WorkloadContext,
     details, register_workload,
 };
 
+const COUNT_KEY: &[u8] = b"rust/atomic/count";
+
 pub struct AtomicWorkload {
     context: WorkloadContext,
     client_id: i32,
-    counter: AtomicCounter,
-    // how many transactions will be run
     expected_count: usize,
-    // how many transactions succeeded
     success_count: usize,
-    // how many transactions failed
     error_count: usize,
-    // how many maybe_committed transactions we encountered
     maybe_committed_count: usize,
-    // how much simulated time start() took
-    elapsed: Duration,
-    // how many rows the budgeted scan read before it stopped
-    scan_iterations: usize,
-    // the limit that scan tripped on, None if it never did
-    scan_outcome: Option<BudgetExceeded>,
-}
-
-const COUNT_KEY: &[u8] = b"count";
-
-// How many rows setup() writes, and the modulus of the budgeted scan.
-const ROW_COUNT: usize = 500;
-// What one scan attempt may spend, measured with the simulator clock. A simulated
-// read costs enough that this trips after a few dozen of them, well before the
-// five seconds FoundationDB gives a transaction.
-const TIME_LIMIT: Duration = Duration::from_secs(1);
-// Ends the scan even if the budget never trips, so the workload terminates.
-const MAX_ITERATIONS: usize = 100_000;
-
-/// The counter itself, reading time from the environment it was given instead of
-/// from the machine. It never sets transaction options: that belongs to the
-/// caller.
-struct AtomicCounter {
-    env: Environment,
-    subspace: Subspace,
-}
-
-impl AtomicCounter {
-    fn new(env: Environment, subspace: Subspace) -> Self {
-        Self { env, subspace }
-    }
-
-    /// The current reading of the environment clock, simulated time here.
-    fn now(&self) -> Duration {
-        self.env.clock().monotonic()
-    }
-
-    fn key(&self) -> Vec<u8> {
-        self.subspace.pack(&COUNT_KEY)
-    }
-
-    fn increment(&self, trx: &Transaction) {
-        let buf: [u8; 8] = 1i64.to_le_bytes();
-        trx.atomic_op(&self.key(), &buf, MutationType::Add);
-    }
-
-    fn decode_count(&self, bytes: &[u8]) -> usize {
-        i64::from_le_bytes(bytes[..8].try_into().unwrap()) as usize
-    }
-
-    /// The key of one of the rows the budgeted scan walks, kept apart from the
-    /// counter key.
-    fn row_key(&self, index: usize) -> Vec<u8> {
-        self.subspace.pack(&("rows", index as i64))
-    }
-
-    /// Reads one row, returning how many bytes came back.
-    ///
-    /// The await is where simulated time passes: the simulator decides the
-    /// latency of the storage round trip, and that is what moves the clock a time
-    /// budget is measured against.
-    async fn read_row(&self, trx: &Transaction, index: usize) -> FdbResult<usize> {
-        let value = trx.get(&self.row_key(index), false).await?;
-        Ok(value.map_or(0, |bytes| bytes.len()))
-    }
+    elapsed: f64,
 }
 
 impl SingleRustWorkload for AtomicWorkload {
     fn new(_name: String, context: WorkloadContext) -> Self {
-        // The same struct runs in production with `Environment::default()`, in tests
-        // with `Environment::with_seed(..)` and here with the simulator's
-        // `context.environment()`: only the environment swaps.
-        let counter = AtomicCounter::new(context.environment(), Subspace::all());
         Self {
             client_id: context.client_id(),
             expected_count: context.get_option("count").expect("Could not get count"),
             context,
-            counter,
             success_count: 0,
             error_count: 0,
             maybe_committed_count: 0,
-            elapsed: Duration::ZERO,
-            scan_iterations: 0,
-            scan_outcome: None,
+            elapsed: 0.0,
         }
     }
 }
 
 impl RustWorkload for AtomicWorkload {
     async fn setup(&mut self, db: SimDatabase) {
-        println!("rust_setup({})", self.client_id);
-        // Only use a single client
         if self.client_id == 0 {
-            // The rows the budgeted scan of start() walks.
-            let counter = &self.counter;
-            db.run(|trx, _maybe_committed| async move {
-                for index in 0..ROW_COUNT {
-                    trx.set(&counter.row_key(index), &(index as i64).to_le_bytes());
-                }
+            db.run(|trx, _| async move {
+                trx.clear(COUNT_KEY);
                 Ok::<_, FdbBindingError>(())
             })
             .await
-            .expect("could not write the rows to scan");
+            .expect("could not clear the counter");
         }
     }
+
     async fn start(&mut self, db: SimDatabase) {
-        println!("rust_start({})", self.client_id);
-        let started_at = self.counter.now();
-        // Only use a single client
+        let started_at = self.context.now();
         if self.client_id == 0 {
             for _ in 0..self.expected_count {
                 let trx = db.create_trx().expect("Could not create transaction");
-
-                // Enable idempotent txn
                 trx.set_option(TransactionOption::AutomaticIdempotency)
-                    .expect("could not setup automatic idempotency");
-
-                self.counter.increment(&trx);
-
+                    .expect("could not set automatic idempotency");
+                trx.atomic_op(COUNT_KEY, &1_i64.to_le_bytes(), MutationType::Add);
                 match trx.commit().await {
                     Ok(_) => self.success_count += 1,
-                    Err(err) => {
-                        if err.is_maybe_committed() {
-                            self.context.trace(
-                                Severity::Warn,
-                                "Detected an maybe_committed transactions with idempotency",
-                                details![
-                                    "Layer" => "Rust",
-                                    "Client" => self.client_id
-                                ],
-                            );
-                            self.maybe_committed_count += 1;
-                        } else {
-                            self.error_count += 1;
-                        }
-                    }
+                    Err(error) if error.is_maybe_committed() => self.maybe_committed_count += 1,
+                    Err(_) => self.error_count += 1,
                 }
-
-                self.context.trace(
-                    Severity::Info,
-                    "Successfully setup workload",
-                    details![
-                        "Layer" => "Rust",
-                        "Client" => self.client_id
-                    ],
-                );
             }
-
-            // The budgeted scan: one long loop of reads that the client budget is
-            // meant to end. db.run wraps it because buggify injects retryable read
-            // errors, and the budget is per attempt: a retry restarts the scan with
-            // a fresh allowance, which is exactly the semantics being demonstrated.
-            let counter = &self.counter;
-            let (iterations, outcome) = db
-                .run(|trx, _maybe_committed| async move {
-                    // Measuring the attempt with the simulator clock is what makes
-                    // the moment the budget trips part of the deterministic state
-                    // of the run.
-                    trx.set_client_budget(ClientBudget {
-                        time_limit: Some(TIME_LIMIT),
-                        clock: Some(counter.env.clock().clone()),
-                        ..ClientBudget::default()
-                    });
-
-                    let mut iterations = 0;
-                    let mut outcome = None;
-                    for index in 0..MAX_ITERATIONS {
-                        // Distinct keys matter: a key already read by this attempt
-                        // comes back from the read-your-writes cache without a
-                        // simulated round trip, so the clock would never move.
-                        counter
-                            .read_row(&trx, index % ROW_COUNT)
-                            .await
-                            .map_err(FdbBindingError::from)?;
-                        iterations += 1;
-
-                        // Exceeding the budget is the expected outcome, data rather
-                        // than a transactional error, so it leaves the closure as an
-                        // Ok and db.run does not retry it.
-                        if let Err(exceeded) = trx.check_client_budget() {
-                            outcome = Some(exceeded);
-                            break;
-                        }
-                    }
-
-                    Ok::<_, FdbBindingError>((iterations, outcome))
-                })
-                .await
-                .expect("could not run the budgeted scan");
-            self.scan_iterations = iterations;
-            self.scan_outcome = outcome;
         }
-        // Simulated time, so this is deterministic across runs of the same seed.
-        self.elapsed = self.counter.now() - started_at;
+        self.elapsed = self.context.now() - started_at;
     }
+
     async fn check(&mut self, db: SimDatabase) {
-        println!("rust_check({})", self.client_id);
         if self.client_id == 0 {
-            // even if buggify is off in checks, transactions can failed because of the randomized knob,
-            // so we need to wrap the check in a db.run
-            let counter = &self.counter;
             let count = db
-                .run(|trx, _maybe_committed| async move {
-                    match trx.get(&counter.key(), true).await {
-                        Err(e) => Err(FdbBindingError::from(e)),
-                        Ok(None) => Ok(0),
-                        Ok(Some(byte_count)) => Ok(counter.decode_count(&byte_count)),
-                    }
+                .run(|trx, _| async move {
+                    let bytes = trx.get(COUNT_KEY, true).await?;
+                    Ok::<_, FdbBindingError>(bytes.map_or(0, |value| {
+                        i64::from_le_bytes(value[..8].try_into().unwrap()) as usize
+                    }))
                 })
                 .await
-                .expect("could not check using db.run");
-
-            if self.success_count == count {
-                self.context.trace(
-                    Severity::Info,
-                    "Atomic count match",
-                    details![
-                        "Layer" => "Rust",
-                        "Client" => self.client_id,
-                        "Expected" => self.expected_count,
-                        "Found" => count,
-                        "CommittedCount" => self.success_count,
-                        "MaybeCommitted" => self.maybe_committed_count,
-                    ],
-                );
+                .expect("could not read the counter");
+            let severity = if self.success_count == count {
+                Severity::Info
             } else {
-                self.context.trace(
-                    Severity::Error,
-                    "Atomic count doesn't match",
-                    details![
-                        "Layer" => "Rust",
-                        "Client" => self.client_id,
-                        "Expected" => self.expected_count,
-                        "Found" => count,
-                        "CommittedCount" => self.success_count,
-                        "MaybeCommitted" => self.maybe_committed_count,
-                    ],
-                );
-            }
-
-            // A Severity::Error trace fails the simulation, so every way the budget
-            // could have failed to do its job is reported that way.
-            let (severity, message) = match self.scan_outcome {
-                Some(BudgetExceeded { kind, used, limit })
-                    if kind == BudgetKind::Time && used >= limit =>
-                {
-                    (Severity::Info, "Client budget tripped on time as expected")
-                }
-                Some(_) => (Severity::Error, "Client budget tripped on the wrong limit"),
-                None => (Severity::Error, "Client budget never tripped"),
+                Severity::Error
             };
-
             self.context.trace(
                 severity,
-                message,
+                "AtomicCountCheck",
                 details![
-                    "Layer" => "Rust",
                     "Client" => self.client_id,
-                    "Iterations" => self.scan_iterations,
-                    "Kind" => self.scan_outcome.map_or("none".to_string(), |e| e.kind.to_string()),
-                    "Used" => self.scan_outcome.map_or(0, |e| e.used),
-                    "Limit" => self.scan_outcome.map_or(0, |e| e.limit),
+                    "Expected" => self.success_count,
+                    "Found" => count,
+                    "MaybeCommitted" => self.maybe_committed_count
                 ],
             );
         }
     }
+
     fn get_metrics(&self, mut out: Metrics<'_>) {
-        println!("rust_get_metrics({})", self.client_id);
         out.extend([
             Metric::val("expected_count", self.expected_count as f64),
             Metric::val("success_count", self.success_count as f64),
             Metric::val("error_count", self.error_count as f64),
-            Metric::val("elapsed_simulated_seconds", self.elapsed.as_secs_f64()),
-            Metric::val("iterations", self.scan_iterations as f64),
-            Metric::val("used_ms", self.scan_outcome.map_or(0, |e| e.used) as f64),
+            Metric::val("maybe_committed_count", self.maybe_committed_count as f64),
+            Metric::val("elapsed_simulated_seconds", self.elapsed),
         ]);
     }
+
     fn get_check_timeout(&self) -> f64 {
-        println!("rust_get_check_timeout({})", self.client_id);
         5000.0
     }
 }
diff --git a/bindings/rust/foundationdb-simulation/examples/atomic/test_file_74.toml b/bindings/rust/foundationdb-simulation/examples/atomic/test_file.toml
similarity index 100%
rename from bindings/rust/foundationdb-simulation/examples/atomic/test_file_74.toml
rename to bindings/rust/foundationdb-simulation/examples/atomic/test_file.toml
diff --git a/bindings/rust/foundationdb-simulation/examples/atomic/test_file_73.toml b/bindings/rust/foundationdb-simulation/examples/atomic/test_file_73.toml
deleted file mode 100644
index d756d798e0f..00000000000
--- a/bindings/rust/foundationdb-simulation/examples/atomic/test_file_73.toml
+++ /dev/null
@@ -1,36 +0,0 @@
-[[test]]
-testTitle = 'AtomicWorkload'
-
-  [[test.workload]]
-    testName = 'External'
-    libraryName = 'atomic'
-    workloadName = 'AtomicWorkload'
-    libraryPath = './target/release/examples'
-    count = 50
-
-  [[test.workload]]
-    # Introduce network partitions
-    testName = 'RandomClogging'
-    testDuration = 30.0
-    # Unclog them in reversed order
-    swizzle = 1
-
-  [[test.workload]]
-    # Reboot processes
-    testName = 'Attrition'
-    machinesToKill = 10
-    machinesToLeave = 3
-    reboot = true
-    testDuration = 30.0
-
-  [[test.workload]]
-    # Introduce specific network partitions errors between proxies and tLogs
-    testName = 'Rollback'
-    testDuration = 30
-
-  [[test.workload]]
-    # Change configuration of the database
-    testName = 'ChangeConfig'
-    maxDelayBeforeChange = 30.0
-    # Move consensus-based processes around
-    coordinators = 'auto'
diff --git a/bindings/rust/foundationdb-simulation/examples/noop/lib.rs b/bindings/rust/foundationdb-simulation/examples/noop/lib.rs
index edb38e487f2..9e801b7326c 100644
--- a/bindings/rust/foundationdb-simulation/examples/noop/lib.rs
+++ b/bindings/rust/foundationdb-simulation/examples/noop/lib.rs
@@ -1,33 +1,14 @@
 use std::time::Duration;
 
-use foundationdb::env::Environment;
 use foundationdb_simulation::{
     Metric, Metrics, RustWorkload, RustWorkloadFactory, Severity, SimDatabase, WorkloadContext,
     WrappedWorkload, register_factory,
 };
 
-/// Measures elapsed time through the environment it was given, never through the
-/// machine clock.
-struct SimulatedStopwatch {
-    env: Environment,
-}
-
-impl SimulatedStopwatch {
-    fn new(env: Environment) -> Self {
-        Self { env }
-    }
-
-    /// A reading to compare with a later one, simulated time here.
-    fn mark(&self) -> Duration {
-        self.env.clock().monotonic()
-    }
-}
-
 struct NoopWorkload {
     name: String,
     client_id: i32,
     context: WorkloadContext,
-    stopwatch: SimulatedStopwatch,
 }
 
 impl RustWorkload for NoopWorkload {
@@ -46,13 +27,12 @@ impl RustWorkload for NoopWorkload {
             "Test",
             &[("Layer", "Rust"), ("Stage", "Start")],
         );
-        // Exercise WorkloadContext::delay (requires fdbserver 7.4.6+, the C API path).
-        let before = self.stopwatch.mark();
+        let before = self.context.now();
         self.context
             .delay(Duration::from_secs(1))
             .await
             .expect("delay future should resolve");
-        let after = self.stopwatch.mark();
+        let after = self.context.now();
         // The difference is simulated time, not machine time: the simulator decides
         // when the clock advances, so these readings are deterministic.
         println!(
@@ -82,15 +62,10 @@ impl RustWorkload for NoopWorkload {
 }
 impl NoopWorkload {
     fn new(name: String, client_id: i32, context: WorkloadContext) -> Self {
-        // The same struct runs in production with `Environment::default()`, in tests
-        // with `Environment::with_seed(..)` and here with the simulator's
-        // `context.environment()`: only the environment swaps.
-        let stopwatch = SimulatedStopwatch::new(context.environment());
         Self {
             name,
             client_id,
             context,
-            stopwatch,
         }
     }
 }
@@ -110,10 +85,6 @@ impl RustWorkloadFactory for NoopFactory {
             "my_c_option: {:?}",
             context.get_option::<String>("my_c_option")
         );
-        println!(
-            "my_c_option: {:?}",
-            context.get_option::<String>("my_c_option")
-        );
         match name.as_str() {
             "NoopWorkload" => NoopWorkload::new(name, client_id, context).wrap(),
             _ => panic!("Unknown workload name: {name}"),
diff --git a/bindings/rust/foundationdb-simulation/examples/shared/lib.rs b/bindings/rust/foundationdb-simulation/examples/shared/lib.rs
index 9c59c1951a3..047bcf60173 100644
--- a/bindings/rust/foundationdb-simulation/examples/shared/lib.rs
+++ b/bindings/rust/foundationdb-simulation/examples/shared/lib.rs
@@ -1,58 +1,28 @@
-use std::time::Duration;
-
-use foundationdb::env::Environment;
 use foundationdb_simulation::{
     Metrics, RustWorkload, SimDatabase, SingleRustWorkload, WorkloadContext, register_workload,
 };
 use futures_util::FutureExt;
 
-/// Tells at which simulated time a workload phase runs, reading the environment
-/// clock instead of the machine one.
-struct PhaseClock {
-    env: Environment,
-}
-
-impl PhaseClock {
-    fn new(env: Environment) -> Self {
-        Self { env }
-    }
-
-    fn now(&self) -> Duration {
-        self.env.clock().monotonic()
-    }
-}
-
 pub struct SharedWorkload {
     client_id: i32,
-    phase_clock: PhaseClock,
+    context: WorkloadContext,
 }
 
 impl SingleRustWorkload for SharedWorkload {
     fn new(_name: String, context: WorkloadContext) -> Self {
-        // The same struct runs in production with `Environment::default()`, in tests
-        // with `Environment::with_seed(..)` and here with the simulator's
-        // `context.environment()`: only the environment swaps.
         Self {
             client_id: context.client_id(),
-            phase_clock: PhaseClock::new(context.environment()),
+            context,
         }
     }
 }
 
 impl RustWorkload for SharedWorkload {
     async fn setup(&mut self, _db: SimDatabase) {
-        println!(
-            "rust_setup({}) at {:?}",
-            self.client_id,
-            self.phase_clock.now()
-        );
+        println!("rust_setup({}) at {:?}", self.client_id, self.context.now());
     }
     async fn start(&mut self, db: SimDatabase) {
-        println!(
-            "rust_start({}) at {:?}",
-            self.client_id,
-            self.phase_clock.now()
-        );
+        println!("rust_start({}) at {:?}", self.client_id, self.context.now());
         let trx = db.create_trx().expect("Could not create transaction");
         let future = trx.get_read_version();
         let shared = future.shared();
@@ -60,11 +30,7 @@ impl RustWorkload for SharedWorkload {
         println!("read_version({}) = {version:?}", self.client_id);
     }
     async fn check(&mut self, _db: SimDatabase) {
-        println!(
-            "rust_check({}) at {:?}",
-            self.client_id,
-            self.phase_clock.now()
-        );
+        println!("rust_check({}) at {:?}", self.client_id, self.context.now());
     }
     fn get_metrics(&self, mut _out: Metrics<'_>) {
         println!("rust_get_metrics({})", self.client_id);
diff --git a/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp b/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
deleted file mode 100644
index f01b5aab4f9..00000000000
--- a/bindings/rust/foundationdb-simulation/src/CppWorkload.cpp
+++ /dev/null
@@ -1,222 +0,0 @@
-// C++ to C bindings
-
-#include <cstring>
-#include <cstdint>
-
-#include "headers/CppWorkload.h"
-namespace capi {
-#include "headers/CWorkload.h"
-}
-
-#define WITH(C, M, ...) (C).vt->M((C).inner, ##__VA_ARGS__)
-
-namespace translator {
-extern "C" capi::FDBWorkload workloadCFactory(const char*, capi::FDBWorkloadContext);
-
-template <typename T>
-struct Wrapper {
-	T inner;
-};
-
-namespace metrics {
-void reserve(capi::OpaqueMetrics* c_metrics, int n) {
-	auto metrics = (std::vector<FDBPerfMetric>*)c_metrics;
-	metrics->reserve(metrics->size() + n);
-}
-void push(capi::OpaqueMetrics* c_metrics, capi::FDBMetric c_metric) {
-	auto metrics = (std::vector<FDBPerfMetric>*)c_metrics;
-	auto fmt = c_metric.fmt ? c_metric.fmt : "%.3g";
-	auto metric = FDBPerfMetric{
-		.name = std::string(c_metric.key),
-		.value = c_metric.val,
-		.averaged = c_metric.avg,
-		.format_code = std::string(fmt),
-	};
-	metrics->emplace_back(metric);
-}
-capi::FDBMetrics wrap(std::vector<FDBPerfMetric>* metrics) {
-	static capi::FDBMetrics::FDBMetrics_VT vt = {
-		.reserve = reserve,
-		.push = push,
-	};
-	return capi::FDBMetrics{
-		.inner = (capi::OpaqueMetrics*)metrics,
-		.vt = &vt,
-	};
-}
-} // namespace metrics
-
-namespace promise {
-void send(capi::OpaquePromise* c_promise, bool value) {
-	auto promise = (Wrapper<GenericPromise<bool>>*)c_promise;
-	promise->inner.send(value);
-}
-void free(capi::OpaquePromise* c_promise) {
-	auto promise = (Wrapper<GenericPromise<bool>>*)c_promise;
-	delete promise;
-}
-capi::FDBPromise wrap(GenericPromise<bool> promise) {
-	static capi::FDBPromise::FDBPromise_VT vt = {
-		.free = free,
-		.send = send,
-	};
-	auto wrapped = new Wrapper<GenericPromise<bool>>{ promise };
-	return capi::FDBPromise{
-		.inner = (capi::OpaquePromise*)wrapped,
-		.vt = &vt,
-	};
-}
-} // namespace promise
-
-namespace context {
-void trace(capi::OpaqueWorkloadContext* c_context,
-           capi::FDBSeverity c_severity,
-           const char* name,
-           const capi::FDBStringPair* c_details,
-           int n) {
-	auto context = (FDBWorkloadContext*)c_context;
-	FDBSeverity severity;
-	switch (c_severity) {
-	case capi::FDBSeverity_Debug:
-		severity = FDBSeverity::Debug;
-		break;
-	case capi::FDBSeverity_Info:
-		severity = FDBSeverity::Info;
-		break;
-	case capi::FDBSeverity_Warn:
-		severity = FDBSeverity::Warn;
-		break;
-	case capi::FDBSeverity_WarnAlways:
-		severity = FDBSeverity::WarnAlways;
-		break;
-	case capi::FDBSeverity_Error:
-		severity = FDBSeverity::Error;
-		break;
-	default:
-		severity = FDBSeverity::Error;
-		break;
-	}
-	std::vector<std::pair<std::string, std::string>> details;
-	details.reserve(n);
-	for (int i = 0; i < n; i++) {
-		details.emplace_back(std::pair<std::string, std::string>(c_details[i].key, c_details[i].val));
-	}
-	context->trace(severity, name, details);
-}
-uint64_t getProcessID(capi::OpaqueWorkloadContext* c_context) {
-	auto context = (FDBWorkloadContext*)c_context;
-	return context->getProcessID();
-}
-void setProcessID(capi::OpaqueWorkloadContext* c_context, uint64_t processID) {
-	auto context = (FDBWorkloadContext*)c_context;
-	return context->setProcessID(processID);
-}
-double now(capi::OpaqueWorkloadContext* c_context) {
-	auto context = (FDBWorkloadContext*)c_context;
-	return context->now();
-}
-uint32_t rnd(capi::OpaqueWorkloadContext* c_context) {
-	auto context = (FDBWorkloadContext*)c_context;
-	return context->rnd();
-}
-capi::FDBString getOption(capi::OpaqueWorkloadContext* c_context, const char* name, const char* defaultValue) {
-	static capi::FDBString::FDBString_VT vt = {
-		.free = (void (*)(const char*))free,
-	};
-	auto context = (FDBWorkloadContext*)c_context;
-	std::string value = context->getOption(name, std::string(defaultValue));
-	size_t len = value.length() + 1;
-	char* c_value = (char*)malloc(len);
-	memcpy(c_value, value.c_str(), len);
-	return capi::FDBString{
-		.inner = c_value,
-		.vt = &vt,
-	};
-}
-int clientId(capi::OpaqueWorkloadContext* c_context) {
-	auto context = (FDBWorkloadContext*)c_context;
-	return context->clientId();
-}
-int clientCount(capi::OpaqueWorkloadContext* c_context) {
-	auto context = (FDBWorkloadContext*)c_context;
-	return context->clientCount();
-}
-int64_t sharedRandomNumber(capi::OpaqueWorkloadContext* c_context) {
-	auto context = (FDBWorkloadContext*)c_context;
-	return context->sharedRandomNumber();
-}
-FDBFuture* delay(capi::OpaqueWorkloadContext* c_context, double seconds) {
-	auto context = (FDBWorkloadContext*)c_context;
-	return context->delay(seconds);
-}
-capi::FDBWorkloadContext wrap(FDBWorkloadContext* context) {
-	static capi::FDBWorkloadContext::FDBWorkloadContext_VT vt = {
-		.trace = trace,
-		.getProcessID = getProcessID,
-		.setProcessID = setProcessID,
-		.now = now,
-		.rnd = rnd,
-		.getOption = getOption,
-		.clientId = clientId,
-		.clientCount = clientCount,
-		.sharedRandomNumber = sharedRandomNumber,
-		.delay = delay,
-	};
-	return capi::FDBWorkloadContext{
-		.api_version = FDB_API_VERSION,
-		.inner = (capi::OpaqueWorkloadContext*)context,
-		.vt = &vt,
-	};
-}
-} // namespace context
-
-class Workload : public FDBWorkload {
-private:
-	capi::FDBWorkload workload{};
-	std::string name;
-
-public:
-	Workload(const std::string& name) : name(name) {}
-	virtual ~Workload() {
-		if (this->workload.inner)
-			WITH(this->workload, free);
-	}
-
-#if FDB_API_VERSION <= 730
-	std::string description() const override { return "unreachable"; }
-#endif
-
-	bool init(FDBWorkloadContext* context) override {
-		this->workload = translator::workloadCFactory(this->name.c_str(), context::wrap(context));
-		return true;
-	}
-	void setup(FDBDatabase* db, GenericPromise<bool> done) override {
-		return WITH(this->workload, setup, (capi::FDBDatabase*)db, promise::wrap(done));
-	}
-	void start(FDBDatabase* db, GenericPromise<bool> done) override {
-		return WITH(this->workload, start, (capi::FDBDatabase*)db, promise::wrap(done));
-	}
-	void check(FDBDatabase* db, GenericPromise<bool> done) override {
-		return WITH(this->workload, check, (capi::FDBDatabase*)db, promise::wrap(done));
-	}
-	void getMetrics(std::vector<FDBPerfMetric>& out) const override {
-		return WITH(this->workload, getMetrics, metrics::wrap(&out));
-	}
-	double getCheckTimeout() override { return WITH(this->workload, getCheckTimeout); }
-};
-} // namespace translator
-
-class CppWorkloadFactory : public FDBWorkloadFactory {
-public:
-	CppWorkloadFactory(FDBLogger* logger) : FDBWorkloadFactory() {
-		logger->trace(FDBSeverity::Info, "CppWorkloadFactory", {});
-	}
-
-	std::shared_ptr<FDBWorkload> create(const std::string& name) override {
-		return std::make_shared<translator::Workload>(name);
-	}
-};
-
-extern "C" FDBWorkloadFactory* workloadCppFactory(FDBLogger* logger) {
-	return new CppWorkloadFactory(logger);
-}
diff --git a/bindings/rust/foundationdb-simulation/src/bindings.rs b/bindings/rust/foundationdb-simulation/src/bindings.rs
index 4bddea8f5ac..846a1a02b55 100644
--- a/bindings/rust/foundationdb-simulation/src/bindings.rs
+++ b/bindings/rust/foundationdb-simulation/src/bindings.rs
@@ -106,7 +106,7 @@ macro_rules! details {
 // -----------------------------------------------------------------------------
 // Rust Types
 
-/// A simulator context shared by one workload and its environment handles.
+/// A simulator context shared by one workload and its cloned handles.
 ///
 /// Context operations panic outside the creating thread or after the registered
 /// workload is released. Cloning the context does not extend the native lifetime.
@@ -565,18 +565,16 @@ impl<'a> Metric<'a> {
 mod tests {
     use super::{Severity, capitalize_first_byte, prepare_trace_details, str_for_c};
 
+    use super::WorkloadContext;
+    use super::raw_bindings::*;
+    use crate::registration::register_workload_context;
+    use crate::{Metric, Metrics, RustWorkload, SimDatabase};
     use std::cell::Cell;
     use std::panic::{AssertUnwindSafe, catch_unwind};
     use std::sync::{
         Arc,
         atomic::{AtomicUsize, Ordering},
     };
-    use std::time::Duration;
-
-    use super::WorkloadContext;
-    use super::raw_bindings::*;
-    use crate::registration::register_workload_context;
-    use crate::{Metric, Metrics, RustWorkload, SimDatabase};
 
     struct NativeContext {
         calls: Arc<AtomicUsize>,
@@ -1272,7 +1270,7 @@ mod tests {
     }
 
     #[test]
-    fn environment_rejects_access_after_registered_workload_release() {
+    fn context_rejects_access_after_registered_workload_release() {
         let calls = Arc::new(AtomicUsize::new(0));
         let (native, raw) = native_context(calls.clone());
         let mut escaped = None;
@@ -1284,9 +1282,8 @@ mod tests {
             })
         };
         let context = escaped.unwrap();
-        let environment = context.environment();
-        assert_eq!(environment.clock().monotonic(), Duration::from_secs(12));
-        assert_eq!(environment.rng().next_u32(), 42);
+        assert_eq!(context.now(), 12.0);
+        assert_eq!(context.rnd(), 42);
         // SAFETY: These are the callbacks on the registered, live allocation.
         unsafe {
             assert_eq!((*workload.vt).getCheckTimeout.unwrap()(workload.inner), 7.0);
@@ -1299,8 +1296,7 @@ mod tests {
         );
         drop(native);
         assert!(catch_unwind(AssertUnwindSafe(|| context.now())).is_err());
-        assert!(catch_unwind(AssertUnwindSafe(|| environment.clock().wall())).is_err());
-        assert!(catch_unwind(AssertUnwindSafe(|| environment.rng().next_u64())).is_err());
+        assert!(catch_unwind(AssertUnwindSafe(|| context.rnd())).is_err());
         assert_eq!(
             calls.load(Ordering::Relaxed),
             3,
@@ -1309,31 +1305,32 @@ mod tests {
     }
 
     #[test]
-    fn environment_rejects_other_threads_without_consuming_randomness() {
+    fn context_rejects_other_threads_without_consuming_randomness() {
         let calls = Arc::new(AtomicUsize::new(0));
         let (_native, raw) = native_context(calls.clone());
         let mut escaped = None;
         // SAFETY: Native context stays alive through the same-thread free call.
         let workload = unsafe {
             register_workload_context(raw, |context| {
-                escaped = Some(context.environment());
+                escaped = Some(context);
                 TestWorkload(None).wrap()
             })
         };
-        let environment = escaped.unwrap();
-        let other_thread = environment.clone();
+        let context = escaped.unwrap();
+        let other_thread = context.clone();
         std::thread::spawn(move || {
-            assert!(catch_unwind(AssertUnwindSafe(|| other_thread.clock().monotonic())).is_err());
-            assert!(catch_unwind(AssertUnwindSafe(|| other_thread.rng().next_u32())).is_err());
+            assert!(catch_unwind(AssertUnwindSafe(|| other_thread.now())).is_err());
+            assert!(catch_unwind(AssertUnwindSafe(|| other_thread.rnd())).is_err());
         })
         .join()
         .unwrap();
         assert_eq!(calls.load(Ordering::Relaxed), 0);
-        assert_eq!(environment.rng().next_u64(), (42_u64 << 32) | 43);
+        assert_eq!(context.rnd(), 42);
+        assert_eq!(context.rnd(), 43);
         assert_eq!(calls.load(Ordering::Relaxed), 2);
         // SAFETY: This is the unique release of the registered allocation.
         unsafe { (*workload.vt).free.unwrap()(workload.inner) };
-        assert!(catch_unwind(AssertUnwindSafe(|| environment.rng().next_u32())).is_err());
+        assert!(catch_unwind(AssertUnwindSafe(|| context.rnd())).is_err());
         assert_eq!(calls.load(Ordering::Relaxed), 2);
     }
 
@@ -1346,14 +1343,14 @@ mod tests {
             catch_unwind(AssertUnwindSafe(|| unsafe {
                 // SAFETY: The native context outlives registration, which unwinds.
                 register_workload_context(raw, |context| {
-                    escaped = Some(context.environment());
+                    escaped = Some(context);
                     panic!("factory failed");
                 })
             }))
             .is_err()
         );
         drop(native);
-        assert!(catch_unwind(AssertUnwindSafe(|| escaped.unwrap().rng().next_u32())).is_err());
+        assert!(catch_unwind(AssertUnwindSafe(|| escaped.unwrap().rnd())).is_err());
         assert_eq!(calls.load(Ordering::Relaxed), 0);
     }
 
diff --git a/bindings/rust/foundationdb-simulation/src/env.rs b/bindings/rust/foundationdb-simulation/src/env.rs
deleted file mode 100644
index 9055fcf02d1..00000000000
--- a/bindings/rust/foundationdb-simulation/src/env.rs
+++ /dev/null
@@ -1,142 +0,0 @@
-//! Simulator-backed implementations of the [`foundationdb::env`] capabilities.
-//!
-//! A workload that reads the machine clock or draws from an ambient generator
-//! stops being reproducible, which defeats the point of running it in the
-//! simulator. [`SimClock`] and [`SimRng`] plug the simulated time and the
-//! deterministic generator of fdbserver into the [`Clock`] and [`Rng`] traits, so
-//! layer code written against an [`Environment`] replays identically from a
-//! seed.
-//!
-//! Build one from the [`WorkloadContext`] handed to your workload:
-//!
-//! ```ignore
-//! impl RustWorkload for MyWorkload {
-//!     fn new(name: String, context: WorkloadContext) -> Self {
-//!         Self {
-//!             env: context.environment(),
-//!             context,
-//!         }
-//!     }
-//! }
-//! ```
-//!
-//! # Lifetime and threads
-//!
-//! Handles share the workload's guarded context. Calls panic if the workload has
-//! been released or if they run outside the simulator thread that created it.
-//! An [`Environment`] may be cloned or moved, but accessing its clock or RNG on
-//! another thread is rejected before entering fdbserver.
-
-use std::fmt;
-use std::sync::Arc;
-use std::time::Duration;
-
-use foundationdb::env::{Clock, Environment, Rng};
-
-use crate::bindings::WorkloadContext;
-
-/// The [`Clock`] of a simulated workload, reading fdbserver's simulated time.
-///
-/// [`monotonic`](Clock::monotonic) is the simulated clock, which starts at zero
-/// and only moves when the simulator decides to advance it, so a run replays
-/// identically. [`wall`](Clock::wall) is that same reading: simulated wall time
-/// counts from the UNIX epoch at simulation start, second zero being the epoch.
-///
-/// Simulated wall time is therefore deterministic and, unlike a real machine
-/// clock, never jumps: a workload cannot exercise clock-skew handling this way.
-///
-/// See the [module documentation](self) for how long an instance stays valid.
-pub struct SimClock {
-    context: WorkloadContext,
-}
-
-impl SimClock {
-    /// Reads simulated time from `context`.
-    pub fn new(context: &WorkloadContext) -> Self {
-        Self {
-            context: context.clone(),
-        }
-    }
-}
-
-impl fmt::Debug for SimClock {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str("SimClock")
-    }
-}
-
-impl Clock for SimClock {
-    fn monotonic(&self) -> Duration {
-        // The simulated clock starts at zero and never goes backwards, but it is
-        // an f64 crossing the FFI boundary: clamp rather than panic.
-        Duration::from_secs_f64(self.context.now().max(0.0))
-    }
-
-    /// Simulated wall time counts from the UNIX epoch at simulation start, so
-    /// second zero is the epoch itself: only differences and orderings carry
-    /// meaning. It never jumps, so clock-skew handling cannot be exercised here.
-    fn wall(&self) -> Duration {
-        self.monotonic()
-    }
-}
-
-/// The [`Rng`] of a simulated workload, drawing from fdbserver's deterministic
-/// generator.
-///
-/// Every draw advances the simulator's own generator, so the values are part of
-/// the run's reproducible state: the same seed replays the same sequence, and
-/// drawing more or fewer values than a previous run changes what every later
-/// consumer sees.
-///
-/// A component that needs a large volume of randomness should draw one value
-/// here and seed a local generator with it, the pattern described in
-/// [`foundationdb::env`]. That keeps the simulator's sequence short and stable.
-///
-/// See the [module documentation](self) for how long an instance stays valid.
-pub struct SimRng {
-    context: WorkloadContext,
-}
-
-impl SimRng {
-    /// Draws from the deterministic generator of `context`.
-    pub fn new(context: &WorkloadContext) -> Self {
-        Self {
-            context: context.clone(),
-        }
-    }
-}
-
-impl fmt::Debug for SimRng {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str("SimRng")
-    }
-}
-
-impl Rng for SimRng {
-    /// Composes two 32-bit draws, so one call consumes two values of the
-    /// simulator's sequence.
-    fn next_u64(&self) -> u64 {
-        let high = self.context.rnd();
-        let low = self.context.rnd();
-        (u64::from(high) << 32) | u64::from(low)
-    }
-
-    /// One draw of the simulator's sequence, taken directly from the generator.
-    fn next_u32(&self) -> u32 {
-        self.context.rnd()
-    }
-}
-
-impl WorkloadContext {
-    /// The deterministic [`Environment`] of this workload: simulated time and
-    /// the simulator's generator.
-    ///
-    /// Pass it to the layers and recipes the workload exercises so that they
-    /// read time and randomness from the simulator instead of from the machine.
-    ///
-    /// Calls on the resulting clock and RNG panic after this workload is
-    /// released or outside its simulator thread.
-    pub fn environment(&self) -> Environment {
-        Environment::new(Arc::new(SimClock::new(self)), Arc::new(SimRng::new(self)))
-    }
-}
diff --git a/bindings/rust/foundationdb-simulation/src/headers/CWorkload.h b/bindings/rust/foundationdb-simulation/src/headers/CWorkload.h
deleted file mode 100644
index 76e8574ab28..00000000000
--- a/bindings/rust/foundationdb-simulation/src/headers/CWorkload.h
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
- * CWorkload.h
- *
- * This source file is part of the FoundationDB open source project
- *
- * Copyright 2013-2026 Apple Inc. and the FoundationDB project authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-#ifndef C_WORKLOAD_H
-#define C_WORKLOAD_H
-
-#include <stdint.h>
-#include <stdbool.h>
-
-#define FDB_WORKLOAD_API_VERSION 1
-
-typedef struct FDB_future FDBFuture;
-typedef struct FDB_database FDBDatabase;
-
-typedef struct Opaque_promise OpaquePromise;
-typedef struct Opaque_workload OpaqueWorkload;
-typedef struct Opaque_workloadContext OpaqueWorkloadContext;
-typedef struct Opaque_metrics OpaqueMetrics;
-
-// Pure C bindings, equivalent to the C++ bindings in `CppWorkload.h`
-// documented here: https://apple.github.io/foundationdb/client-testing.html.
-
-// API changes may add pointers at the end of the virtual tables (_VT)
-// It is advised to never dereference or copy these structures, only using them through a pointer.
-
-// Log severity levels.
-// FDBSeverity_Error automatically stops the simulation.
-typedef enum FDBSeverity {
-	FDBSeverity_Debug,
-	FDBSeverity_Info,
-	FDBSeverity_Warn,
-	FDBSeverity_WarnAlways,
-	FDBSeverity_Error,
-} FDBSeverity;
-
-// Key-value pair for logging additional details.
-typedef struct FDBStringPair {
-	const char* key;
-	const char* val;
-} FDBStringPair;
-
-// Metric entry for simulation statistics.
-// Values are either averaged or summed across clients based on the `avg` flag.
-// `fmt` is used to format the value, defaults to "%.3g" if null.
-typedef struct FDBMetric {
-	const char* key;
-	const char* fmt;
-	double val;
-	bool avg;
-} FDBMetric;
-
-// Wrapper around an owned C++ `string`.
-// The `free` function must be called on `inner` before releasing the string.
-typedef struct FDBString {
-	const char* inner;
-	struct FDBString_VT {
-		void (*free)(const char* inner);
-	}* vt;
-} FDBString;
-
-// Wrapper around a borrowed C++ `vector<FDBMetric>`.
-typedef struct FDBMetrics {
-	OpaqueMetrics* inner;
-	struct FDBMetrics_VT {
-		void (*reserve)(OpaqueMetrics* inner, int n);
-		void (*push)(OpaqueMetrics* inner, FDBMetric val);
-	}* vt;
-} FDBMetrics;
-
-// Wrapper around an owned C++ `GenericPromise<bool>`.
-// Calling `send` resolves the promise (the value is meaningless).
-// Calling `free` before resolving the promise triggers a "broken promise" error.
-typedef struct FDBPromise {
-	OpaquePromise* inner;
-	struct FDBPromise_VT {
-		void (*free)(OpaquePromise* inner);
-		void (*send)(OpaquePromise* inner, bool val);
-	}* vt;
-} FDBPromise;
-
-// Wrapper around a borrowed `ExternalWorkload`'s context.
-// All pointer-based arguments are borrowed and managed by the workload.
-typedef struct FDBWorkloadContext {
-	int api_version;
-	OpaqueWorkloadContext* inner;
-	struct FDBWorkloadContext_VT {
-		// Log a message with severity and optional details.
-		// `details` is an array of key-value pairs, and `n` specifies the array size.
-		void (*trace)(OpaqueWorkloadContext* inner,
-		              FDBSeverity sev,
-		              const char* name,
-		              const FDBStringPair* details,
-		              int n);
-		uint64_t (*getProcessID)(OpaqueWorkloadContext* inner);
-		void (*setProcessID)(OpaqueWorkloadContext* inner, uint64_t processID);
-		// Return the current simulated time in seconds (starts at zero).
-		double (*now)(OpaqueWorkloadContext* inner);
-		// Return a random number (different each time and for all clients).
-		uint32_t (*rnd)(OpaqueWorkloadContext* inner);
-		// Return an option by name, returning `defaultValue` if the option is not found.
-		// Return an option, consumming it, querying it again returns the empty string.
-		FDBString (*getOption)(OpaqueWorkloadContext* inner, const char* name, const char* defaultValue);
-		int (*clientId)(OpaqueWorkloadContext* inner);
-		int (*clientCount)(OpaqueWorkloadContext* inner);
-		// Return a random seed (same each time and for all clients).
-		int64_t (*sharedRandomNumber)(OpaqueWorkloadContext* inner);
-		// Return a future that will be ready after a given time. This internally uses TaskPriority::DefaultDelay.
-		FDBFuture* (*delay)(OpaqueWorkloadContext* inner, double seconds);
-	}* vt;
-} FDBWorkloadContext;
-
-// Interface for a workload implementation in C.
-//
-// Simulation stages (setup, start, and check) are executed sequentially.
-// A stage finishes when its associated promise is resolved. If a promise
-// is not resolved or freed, the simulation hangs.
-//
-// Workload functions should not block. If an operation must wait for database interaction,
-// it should initiate the action, register a callback, and return.
-typedef struct FDBWorkload {
-	int api_version;
-	OpaqueWorkload* inner;
-	struct FDBWorkload_VT {
-		void (*free)(OpaqueWorkload* inner);
-		void (*setup)(OpaqueWorkload* inner, FDBDatabase* db, FDBPromise done);
-		void (*start)(OpaqueWorkload* inner, FDBDatabase* db, FDBPromise done);
-		void (*check)(OpaqueWorkload* inner, FDBDatabase* db, FDBPromise done);
-		void (*getMetrics)(OpaqueWorkload* inner, FDBMetrics out);
-		// The timeout in simulated seconds for the check stage
-		double (*getCheckTimeout)(OpaqueWorkload* inner);
-	}* vt;
-} FDBWorkload;
-
-// The C workload entrypoint.
-// This function must return a valid instance of the `FDBWorkload` struct.
-// A specific implementation can be chosen based on the name passed.
-// The client C workload must be allocated, initialized and passed as pointer
-// in `inner`. It is advised to store the context alongside the workload as
-// it can't be retrieved later. No function pointer can be left null.
-FDBWorkload workloadCFactory(const char* name, FDBWorkloadContext context);
-
-#endif
diff --git a/bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h b/bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h
deleted file mode 100644
index 858b62543b8..00000000000
--- a/bindings/rust/foundationdb-simulation/src/headers/CppWorkload.h
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
- * CppWorkload.h
- *
- * This source file is part of the FoundationDB open source project
- *
- * Copyright 2013-2024 Apple Inc. and the FoundationDB project authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-#ifndef CPP_WORKLOAD_H
-#define CPP_WORKLOAD_H
-#include <string>
-#include <vector>
-#include <functional>
-#include <memory>
-#include <type_traits>
-#include <utility>
-
-#ifndef DLLEXPORT
-#if defined(_MSC_VER)
-#define DLLEXPORT __declspec(dllexport)
-#elif defined(__GNUG__)
-#define DLLEXPORT __attribute__((visibility("default")))
-#else
-#error Missing symbol export
-#endif
-#endif
-
-using FDBFuture = struct FDB_future;
-using FDBResult = struct FDB_result;
-using FDBDatabase = struct FDB_database;
-using FDBTransaction = struct FDB_transaction;
-
-enum class FDBSeverity { Debug, Info, Warn, WarnAlways, Error };
-
-class FDBLogger {
-public:
-	virtual void trace(FDBSeverity sev,
-	                   const std::string& name,
-	                   const std::vector<std::pair<std::string, std::string>>& details) = 0;
-};
-
-class FDBWorkloadContext : public FDBLogger {
-public:
-	virtual uint64_t getProcessID() const = 0;
-	virtual void setProcessID(uint64_t processID) = 0;
-	virtual double now() const = 0;
-	virtual uint32_t rnd() const = 0;
-	virtual bool getOption(const std::string& name, bool defaultValue) = 0;
-	virtual long getOption(const std::string& name, long defaultValue) = 0;
-	virtual unsigned long getOption(const std::string& name, unsigned long defaultValue) = 0;
-	virtual double getOption(const std::string& name, double defaultValue) = 0;
-	virtual std::string getOption(const std::string& name, std::string defaultValue) = 0;
-	virtual int clientId() const = 0;
-	virtual int clientCount() const = 0;
-	virtual int64_t sharedRandomNumber() const = 0;
-	virtual FDBFuture* delay(double seconds) const = 0;
-};
-
-struct FDBPromise {
-	virtual ~FDBPromise() = default;
-	virtual void send(void*) = 0;
-};
-
-template <class T>
-class GenericPromise {
-	std::shared_ptr<FDBPromise> impl;
-
-public:
-	template <class Ptr, std::enable_if_t<!std::is_same<std::decay_t<Ptr>, GenericPromise>::value, int> = 0>
-	explicit GenericPromise(Ptr&& impl) : impl(std::forward<Ptr>(impl)) {}
-	void send(T val) { impl->send(&val); }
-};
-
-struct FDBPerfMetric {
-	std::string name;
-	double value;
-	bool averaged;
-	std::string format_code = "%.3g";
-};
-
-class DLLEXPORT FDBWorkload {
-public:
-#if FDB_API_VERSION <= 730
-	virtual std::string description() const = 0;
-#endif
-	virtual bool init(FDBWorkloadContext* context) = 0;
-	virtual void setup(FDBDatabase* db, GenericPromise<bool> done) = 0;
-	virtual void start(FDBDatabase* db, GenericPromise<bool> done) = 0;
-	virtual void check(FDBDatabase* db, GenericPromise<bool> done) = 0;
-	virtual void getMetrics(std::vector<FDBPerfMetric>& out) const = 0;
-	virtual double getCheckTimeout() { return 3000; }
-};
-
-class DLLEXPORT FDBWorkloadFactory {
-public:
-	virtual std::shared_ptr<FDBWorkload> create(const std::string& name) = 0;
-};
-
-#endif
diff --git a/bindings/rust/foundationdb-simulation/src/lib.rs b/bindings/rust/foundationdb-simulation/src/lib.rs
index 8609204088a..228dea07001 100644
--- a/bindings/rust/foundationdb-simulation/src/lib.rs
+++ b/bindings/rust/foundationdb-simulation/src/lib.rs
@@ -16,7 +16,6 @@ use foundationdb::Database;
 use foundationdb_sys::FDBDatabase as FDBDatabaseAlias;
 
 mod bindings;
-pub mod env;
 mod fdb_rt;
 mod registration;
 
@@ -25,7 +24,6 @@ use bindings::{
     OpaqueWorkload, Promise,
 };
 pub use bindings::{Metric, Metrics, Severity, WorkloadContext};
-pub use env::{SimClock, SimRng};
 use fdb_rt::{TaskId, poll_pending_tasks};
 
 // -----------------------------------------------------------------------------
@@ -415,23 +413,6 @@ pub mod internals {
     pub use crate::bindings::{FDBWorkload, FDBWorkloadContext, str_from_c};
     pub use crate::fdb_rt::poll_pending_tasks;
     pub use crate::registration::register_workload_context;
-
-    #[cfg(feature = "cpp-abi")]
-    unsafe extern "C" {
-        pub fn workloadCppFactory(logger: *const u8) -> *const u8;
-    }
-
-    #[allow(non_snake_case)]
-    #[cfg(not(feature = "cpp-abi"))]
-    pub unsafe extern "C" fn workloadCppFactory(_logger: *const u8) -> *const u8 {
-        eprintln!(
-            "This Rust workload was compiled without the C++ shim adapter. To fix this, either:
-
-- Re-run the simulation with `useCAPI = true` (FoundationDB 7.4 or newer), or
-- Recompile the workload with FoundationDB versions prior to 7.4 or the `cpp-abi` feature"
-        );
-        std::process::exit(1);
-    }
 }
 
 /// Register a [RustWorkloadFactory].
@@ -469,10 +450,6 @@ macro_rules! register_factory {
                 })
             }
         }
-        #[unsafe(no_mangle)]
-        unsafe extern "C" fn workloadFactory(logger: *const u8) -> *const u8 {
-            unsafe { $crate::internals::workloadCppFactory(logger) }
-        }
     };
 }
 
@@ -513,9 +490,5 @@ macro_rules! register_workload {
                 })
             }
         }
-        #[unsafe(no_mangle)]
-        unsafe extern "C" fn workloadFactory(logger: *const u8) -> *const u8 {
-            unsafe { $crate::internals::workloadCppFactory(logger) }
-        }
     };
 }
diff --git a/bindings/rust/foundationdb/Cargo.toml b/bindings/rust/foundationdb/Cargo.toml
index 00b97463641..68277fae291 100644
--- a/bindings/rust/foundationdb/Cargo.toml
+++ b/bindings/rust/foundationdb/Cargo.toml
@@ -22,11 +22,9 @@ keywords = ["foundationdb", "kv"]
 categories = ["database"]
 
 [package.metadata.docs.rs]
-features = ["embedded-fdb-include", "fdb-7_4", "uuid", "recipes", "accounting"]
+features = ["embedded-fdb-include", "fdb-7_4", "uuid"]
 
 [features]
-# Optional client-side usage counters, budgets, and transaction metrics.
-accounting = []
 default = ["uuid"]
 uuid = ["dep:uuid", "foundationdb-tuple/uuid"]
 num-bigint = ["dep:num-bigint", "foundationdb-tuple/num-bigint"]
@@ -45,9 +43,6 @@ fdb-7_0 = ["foundationdb-sys/fdb-7_0", "foundationdb-gen/fdb-7_0"]
 fdb-7_1 = ["foundationdb-sys/fdb-7_1", "foundationdb-gen/fdb-7_1"]
 fdb-7_3 = ["foundationdb-sys/fdb-7_3", "foundationdb-gen/fdb-7_3"]
 fdb-7_4 = ["foundationdb-sys/fdb-7_4", "foundationdb-gen/fdb-7_4"]
-recipes = ["recipes-leader-election", "recipes-ranked-register"]
-recipes-leader-election = ["recipes-ranked-register"]
-recipes-ranked-register = []
 trace = ["tracing"]
 
 [build-dependencies]
@@ -71,9 +66,6 @@ tracing = { version = "0.1.44", optional = true }
 byteorder = "1.5.0"
 lazy_static = "1.5.0"
 tokio = { version = "1.52.3", features = ["full"] }
-sha2 = "0.11.0"
-data-encoding = "2.11.0"
-bytesize = "2.4"
 uuid = { version = "1.23.3", features = ["v4"] }
 futures-util = "0.3.32"
 tracing-subscriber = "0.3.23"
@@ -82,23 +74,3 @@ tracing-subscriber = "0.3.23"
 name = "api_version_library"
 crate-type = ["cdylib"]
 required-features = ["fdb-7_4"]
-
-[[test]]
-name = "budget"
-required-features = ["accounting"]
-
-[[test]]
-name = "metrics"
-required-features = ["accounting"]
-
-[[example]]
-name = "budgeted_scan"
-required-features = ["accounting"]
-
-[[example]]
-name = "instrumented"
-required-features = ["accounting"]
-
-[[example]]
-name = "conflict_reporting"
-required-features = ["accounting"]
diff --git a/bindings/rust/foundationdb/README.md b/bindings/rust/foundationdb/README.md
index f6ddf17e786..d1a61675cb4 100644
--- a/bindings/rust/foundationdb/README.md
+++ b/bindings/rust/foundationdb/README.md
@@ -50,13 +50,8 @@ This Rust crate is not tied to any Async Runtime.
 | `uuid`                 | Support for the uuid crate for Tuples                                          |
 | `num-bigint`           | Support for the bigint crate for Tuples                                        |
 | `trace`                | Enable tracing on transaction related operations                               |
-| `accounting`           | Opt in to transaction usage counters, client budgets, and metrics hooks         |
-| `recipes`              | Opt in to all distributed-system recipes                                        |
-| `recipes-leader-election` | Opt in to leader election and its ranked-register dependency                  |
-| `recipes-ranked-register` | Opt in to the ranked-register recipe independently                          |
 
-Only `uuid` is enabled by default. Accounting and recipes are independent opt-in
-extensions; ordinary transactions do not maintain Rust-side usage counters.
+Only `uuid` is enabled by default.
 
 ### Hello, World using the crate
 
@@ -106,18 +101,10 @@ async fn hello_world() -> foundationdb::FdbResult<()> {
 
 ## Additional notes
 
-### The class-scheduling tutorial
+### API examples
 
-The official FoundationDB's tutorial is called the [Class Scheduling](https://apple.github.io/foundationdb/class-scheduling.html). You can find the Rust version in the [examples](https://github.com/apple/foundationdb/tree/main/bindings/rust/foundationdb/examples).
-
-### The blob tutorial
-
-The official FoundationDB documentation provides also [another topic](https://apple.github.io/foundationdb/largeval.html#modeling-large-values)
-which is further discussed inside a [design recipe](https://apple.github.io/foundationdb/blob.html).
-A Rust implementation can be found [here](https://github.com/apple/foundationdb/tree/main/bindings/rust/foundationdb/examples/blob.rs).
-
-Another [example](https://github.com/apple/foundationdb/tree/main/bindings/rust/foundationdb/examples/blob-with-manifest.rs),
-explores how to use subspaces to attach metadata to our blob.
+The `examples/` directory demonstrates native operations, key selectors,
+versionstamps, and multiple client API versions.
 
 ### Must-read documentations
 
diff --git a/bindings/rust/foundationdb/examples/blob-with-manifest.rs b/bindings/rust/foundationdb/examples/blob-with-manifest.rs
deleted file mode 100644
index c1ba06bfc47..00000000000
--- a/bindings/rust/foundationdb/examples/blob-with-manifest.rs
+++ /dev/null
@@ -1,409 +0,0 @@
-use bytesize::ByteSize;
-use foundationdb::tuple::{PackError, Subspace, pack, unpack};
-use foundationdb::{Database, FdbBindingError, RangeOption};
-use futures::TryStreamExt;
-use sha2::{Digest, Sha256};
-use std::fmt::{Display, Formatter};
-use std::fs::File;
-use std::io::{Cursor, Read, Seek, SeekFrom};
-use uuid::Uuid;
-
-///
-/// This example is  concrete using of [blob example](./blob.rs)
-///
-/// The goal of this example is to create a simple blob storage system
-///
-/// As we can't predict the size of data, we'll create a system of data involving
-/// a manifest and a bunch of chunk of data.
-///
-/// The genuine idea would be to create a simple key => value entry and to store every bytes
-/// into it.
-///
-/// For example:
-///  my_file => <data>
-///
-/// This way doesn't allow to append metadata.
-///
-/// Caution : This example can't handle file of more than 10 MB.
-///
-/// The idea is to split the key between a manifest and a data
-///
-/// A manifest can be represent as:
-///     uuid              : the unique identifier through database
-///     name              : the name of the data
-///     size              : size of total data
-///     chunk size        : max chunk size
-///     number of chunks  : number of chunks of total data
-///
-/// As foundation DB can only store binary data, we have to pack our manifest.
-///
-/// This can be done through a tuple of data.
-///
-/// The foundation DB packing API is clever enough to keep the type of each field.
-///
-/// The "/" materialize the foundation subspace separator you can see it as "\x02"
-///
-/// This manifest will be stored as
-///
-/// <uuid>/_manifest => <manifest_data>
-///
-/// Then each chunk of data
-///
-/// <uuid>/_data/0 => <chunk_data_0>
-/// <uuid>/_data/1 => <chunk_data_1>
-/// <uuid>/_data/2 => <chunk_data_2>
-/// <uuid>/_data/3 => <chunk_data_3>
-/// ...
-/// <uuid>/_data/n => <chunk_data_n>
-///
-/// To get data from database we have to gather all chunk of data associated to defined uuid,
-/// we have to scan the database using the subspace of the uuid.
-///
-/// As all data is contained inside the <uuid>/_data subspace.
-///
-/// We can range between <uuid>/_data/\x00 and <uuid>/_data/\xff
-///
-/// \x00 is the minimal value that can be stored in subspace
-/// \xff is the maximal value that can be stored in subspace
-///
-/// So
-///     \x00 <= 0 < \xff
-///     \x00 <= 1 < \xff
-///     \x00 <= 2 < \xff
-///     ...
-///     \x00 <= n < \xff
-///
-///
-/// Thus foundation DB will retrieve keys/values:
-///
-///     <uuid>/_data/0 => <chunk_data_0>
-///     <uuid>/_data/1 => <chunk_data_1>
-///     <uuid>/_data/2 => <chunk_data_2>
-///     <uuid>/_data/3 => <chunk_data_3>
-///     ...
-///     <uuid>/_data/n => <chunk_data_n>
-///
-/// If we accumulate each chunk data, we gather the original data.
-///
-/// Finally, we have to check the correctness of our data.
-///
-/// As we have stored the manifest in the <uuid>/_manifest subspace
-///
-/// We can get this key/value.
-///
-/// Unpack the manifest_data to the type tuple and finally recreate our manifest containing
-/// the hex digest.
-///
-/// We can compute the checksum of data from database and compare it to the manifest digest.
-///
-/// Workflow:
-///
-/// 0 - Create keyspace and cleanup previous one
-/// 1 - Load bytes from image
-/// 2 - Compute checksum of input data
-/// 3 - Write bytes to database
-/// 4 - Read bytes from database
-/// 5 - Compute checksum of output data and verify correctness
-async fn clear_subspace(db: &Database, subspaces: Vec<&Subspace>) {
-    db.run(|transaction, _| {
-        let subspaces = subspaces.clone();
-        async move {
-            for subspace in subspaces {
-                transaction.clear_subspace_range(subspace)
-            }
-            Ok::<_, FdbBindingError>(())
-        }
-    })
-    .await
-    .expect("Unable to commit transaction");
-}
-
-fn sha256_hex_digest<R: Read>(mut reader: R) -> String {
-    let mut context = Sha256::new();
-    let mut buffer = [0_u8; 1024];
-
-    loop {
-        let count = reader.read(&mut buffer).expect("Unable to read buffer");
-
-        if count == 0_usize {
-            break;
-        }
-        context.update(&buffer[..count]);
-    }
-
-    let digest = context.finalize();
-
-    data_encoding::HEXLOWER.encode(digest.as_ref())
-}
-
-fn load_bytes_from_file(path: &str) -> (Vec<u8>, String) {
-    let mut file = File::open(path).expect("Unable to open path");
-    let mut buffer = [0_u8; 1024];
-    let mut data = vec![];
-
-    loop {
-        let count = file.read(&mut buffer).expect("Unable to read from file");
-        if count == 0_usize {
-            break;
-        }
-        data.extend(&buffer[..count].to_vec())
-    }
-    file.seek(SeekFrom::Start(0))
-        .expect("Unable to rewind file cursor");
-
-    let digest = sha256_hex_digest(&mut file);
-    (data, digest)
-}
-
-static CHUNK_SIZE: usize = 1024;
-
-/// Write slice of data to database using given subspace
-async fn write_data(db: &Database, subspace: &Subspace, data: &Vec<u8>) {
-    if data.is_empty() {
-        return;
-    }
-
-    db.run(|transaction, _| async move {
-        transaction.set(subspace.bytes(), data.as_slice());
-        Ok::<_, FdbBindingError>(())
-    })
-    .await
-    .expect("Unable to commit transaction");
-}
-
-/// Writes to database a slice of data chunked with to the given subspace
-/// If chunk size isn't provided **CHUNK_SIZE**
-async fn write_blob(
-    db: &Database,
-    subspace: &Subspace,
-    data: &[u8],
-    chunk_size: Option<usize>,
-) -> usize {
-    if data.is_empty() {
-        return 0;
-    }
-
-    db.run(|transaction, _| async move {
-        let chunk_size = chunk_size.unwrap_or(CHUNK_SIZE);
-
-        let mut chunk_number = 0;
-        data.chunks(chunk_size).for_each(|chunk| {
-            let start = chunk_number * chunk_size;
-            let end = start + chunk.len();
-
-            let key = subspace.pack(&(chunk_number));
-            transaction.set(&key, &data[start..end]);
-            chunk_number += 1;
-        });
-
-        Ok::<_, FdbBindingError>(chunk_number)
-    })
-    .await
-    .expect("Unable to commit transaction")
-}
-
-/// Read data from database
-async fn read_data(db: &Database, subspace: &Subspace) -> Option<Vec<u8>> {
-    db.run(|transaction, _| async move {
-        let get_result = transaction.get(subspace.bytes(), false).await?;
-        Ok::<_, FdbBindingError>(get_result.map(|data| data.to_vec()))
-    })
-    .await
-    .ok()
-    .flatten()
-}
-
-/// Gets data from database from the given subspace with specified key name.
-async fn read_blob(db: &Database, subspace: &Subspace) -> Vec<u8> {
-    db.run(|transaction, _| async move {
-        let range = RangeOption::from(subspace.range());
-        let mut data: Vec<u8> = vec![];
-        let mut stream = transaction.get_ranges_keyvalues(range, false);
-        while let Some(result) = stream.try_next().await? {
-            data.extend(result.value().iter());
-        }
-
-        Ok::<_, FdbBindingError>(data)
-    })
-    .await
-    .expect("Unable to read blob")
-}
-
-struct FileManifest {
-    name: String,
-    chunk_size: Option<usize>,
-    nb_chunks: usize,
-    digest: String,
-    size: usize,
-    uuid: Uuid,
-}
-
-impl FileManifest {
-    pub fn serialize(&self) -> Vec<u8> {
-        pack(&(
-            &self.name,
-            self.chunk_size,
-            self.nb_chunks,
-            &self.digest,
-            &self.size,
-            &self.uuid,
-        ))
-    }
-
-    pub fn try_deserialize(value: &[u8]) -> Result<Self, PackError> {
-        let (name, chunk_size, nb_chunks, digest, size, uuid): (
-            String,
-            Option<usize>,
-            usize,
-            String,
-            usize,
-            Uuid,
-        ) = unpack(value)?;
-
-        Ok(FileManifest {
-            name,
-            chunk_size,
-            nb_chunks,
-            digest,
-            size,
-            uuid,
-        })
-    }
-}
-
-impl Display for FileManifest {
-    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-        write!(
-            f,
-            "Manifest of data {}\n\t\tname: {}\n\t\tchecksum: {}\n\t\tsize: {}\n\t\tblock size: {}\n\t\tnumber of chunks: {}\n",
-            self.uuid,
-            self.name,
-            self.digest,
-            ByteSize(self.size as u64).display().si(),
-            ByteSize(self.chunk_size.unwrap_or(CHUNK_SIZE) as u64)
-                .display()
-                .si(),
-            self.nb_chunks
-        )
-    }
-}
-
-async fn populate_data(
-    db: &Database,
-    subspace: &Subspace,
-    file_names: &Vec<&str>,
-    chunk_sizes: &Vec<usize>,
-) -> Vec<Subspace> {
-    let mut files_subspace: Vec<Subspace> = vec![];
-
-    println!("--- Populate database");
-    for file_name in file_names {
-        println!("Writing file {file_name}");
-
-        let (data, digest) = load_bytes_from_file(file_name);
-
-        for chunk_size in chunk_sizes {
-            let uuid = Uuid::new_v4();
-
-            let subspace_file = subspace.subspace(&(uuid));
-            let subspace_data = subspace_file.subspace(&("_data"));
-            let subspace_manifest = subspace_file.subspace(&("_manifest"));
-
-            println!(
-                "\twith chunk of {}",
-                ByteSize(*chunk_size as u64).display().si()
-            );
-            let nb_chunks = write_blob(db, &subspace_data, &data, Some(*chunk_size)).await;
-
-            let manifest = FileManifest {
-                name: file_name.to_string(),
-                chunk_size: Some(*chunk_size),
-                nb_chunks,
-                digest: digest.clone(),
-                size: data.len(),
-                uuid,
-            }
-            .serialize();
-            write_data(db, &subspace_manifest, &manifest).await;
-
-            files_subspace.push(subspace_file);
-        }
-
-        let uuid = Uuid::new_v4();
-        let subspace_file = subspace.subspace(&(uuid));
-        let subspace_data = subspace_file.subspace(&("_data"));
-        let subspace_manifest = subspace_file.subspace(&("_manifest"));
-
-        let nb_chunks = write_blob(db, &subspace_data, &data, None).await;
-        let manifest = FileManifest {
-            name: file_name.to_string(),
-            chunk_size: None,
-            nb_chunks,
-            digest: digest.clone(),
-            size: data.len(),
-            uuid,
-        }
-        .serialize();
-        write_data(db, &subspace_manifest, &manifest).await;
-    }
-
-    files_subspace
-}
-
-async fn check_data_stored(db: &Database, files_subspaces: Vec<Subspace>) {
-    println!("\n--- Checking data stored");
-    for file_subspace in files_subspaces {
-        let manifest_subspace = file_subspace.subspace(&("_manifest"));
-        let data_subspace = file_subspace.subspace(&("_data"));
-        let manifest_data = read_data(db, &manifest_subspace)
-            .await
-            .expect("Unable to get manifest");
-        let manifest = FileManifest::try_deserialize(&manifest_data)
-            .expect("Unable to deserialize manifest data");
-
-        let data_from_database = read_blob(db, &data_subspace).await;
-
-        let data_from_database = Cursor::new(data_from_database);
-        let digest_data_from_database = sha256_hex_digest(data_from_database);
-
-        println!("{manifest}");
-        assert_eq!(digest_data_from_database, manifest.digest);
-        println!(
-            "\t Verify data integrity:\n\t\tfrom database hex digest : {}\n\t\treference hex digest     : {}\n",
-            manifest.digest, digest_data_from_database
-        );
-    }
-}
-
-#[tokio::main]
-async fn main() {
-    foundationdb::boot().expect("failed to initialize FoundationDB");
-    // The network is stopped and joined automatically at process exit, which is
-    // fine for tests and short-lived tools like this example. In a production
-    // application, prefer a clean teardown: the network thread is the event loop
-    // driving every transaction and you may still have on-going operations at
-    // exit time. Finish or cancel your work, drop the Database handles, then
-    // call `foundationdb::api::stop_network()` yourself (terminal: any
-    // FoundationDB use afterwards fails with error 2025).
-    let db = Database::new_compat(None)
-        .await
-        .expect("Unable to create database");
-    db.set_option(foundationdb::options::DatabaseOption::TransactionTimeout(
-        5000,
-    ))
-    .expect("failed to set transaction timeout");
-    db.set_option(foundationdb::options::DatabaseOption::TransactionRetryLimit(3))
-        .expect("failed to set transaction retry limit");
-
-    // Create the subspace handling image data
-    let images_subspace = Subspace::all().subspace(&("images"));
-
-    clear_subspace(&db, vec![&images_subspace]).await;
-
-    // define matrix of tests
-    let file_names = vec!["./assets/logo-400x400.png"];
-    let chunk_sizes = vec![500, 512, 1000, 2000, 4000, 10000, 20000];
-
-    let files = populate_data(&db, &images_subspace, &file_names, &chunk_sizes).await;
-    check_data_stored(&db, files).await;
-}
diff --git a/bindings/rust/foundationdb/examples/blob.rs b/bindings/rust/foundationdb/examples/blob.rs
deleted file mode 100644
index b190398077d..00000000000
--- a/bindings/rust/foundationdb/examples/blob.rs
+++ /dev/null
@@ -1,100 +0,0 @@
-use foundationdb::tuple::Subspace;
-use foundationdb::{Database, FdbBindingError, RangeOption};
-use futures::TryStreamExt;
-use rand::RngExt;
-use rand::distr::Uniform;
-
-/// The goal of this example is to store blob data as chunk of 1kB
-/// Retrieve these data then verify correctness
-async fn clear_subspace(db: &Database, subspace: &Subspace) {
-    db.run(|trx, _maybe_committed| async move {
-        trx.clear_subspace_range(subspace);
-        Ok::<_, FdbBindingError>(())
-    })
-    .await
-    .expect("Unable to commit transaction");
-}
-
-static CHUNK_SIZE: usize = 1024;
-async fn write_blob(db: &Database, subspace: &Subspace, data: &[u8]) {
-    db.run(|trx, _maybe_committed| async move {
-        let mut chunk_number = 0;
-        data.chunks(CHUNK_SIZE).for_each(|chunk| {
-            let start = chunk_number * CHUNK_SIZE;
-            let end = start + chunk.len();
-
-            let key = subspace.pack(&(start));
-            trx.set(&key, &data[start..end]);
-            chunk_number += 1;
-        });
-        Ok::<_, FdbBindingError>(())
-    })
-    .await
-    .expect("Unable to commit transaction");
-}
-
-async fn read_blob(db: &Database, subspace: &Subspace) -> Vec<u8> {
-    db.run(|trx, _maybe_committed| async move {
-        let range = RangeOption::from(subspace.range());
-
-        let mut data: Vec<u8> = vec![];
-        let mut stream = trx.get_ranges_keyvalues(range, false);
-        while let Some(result) = stream.try_next().await? {
-            data.extend(result.value().iter());
-        }
-
-        Ok::<_, FdbBindingError>(data)
-    })
-    .await
-    .expect("Unable to read blob")
-}
-
-async fn test_blob_storing(db: &Database, subspace: &Subspace, iteration: usize) {
-    // Generate random 10k bytes
-    let data: Vec<u8> = rand::rng()
-        .sample_iter(Uniform::new_inclusive(0, 255).expect("Unable to create random generator"))
-        .map(|x| x as u8)
-        .take(10000)
-        .collect();
-
-    // Create a subspace for iteration
-    let subspace = subspace.subspace(&(iteration));
-
-    // Write data as chunk of 1024
-    write_blob(db, &subspace, &data).await;
-
-    // Read data
-    let result = read_blob(db, &subspace).await;
-
-    // Check correctness
-    assert_eq!(&data, &result);
-}
-
-#[tokio::main]
-async fn main() {
-    foundationdb::boot().expect("failed to initialize FoundationDB");
-    // The network is stopped and joined automatically at process exit, which is
-    // fine for tests and short-lived tools like this example. In a production
-    // application, prefer a clean teardown: the network thread is the event loop
-    // driving every transaction and you may still have on-going operations at
-    // exit time. Finish or cancel your work, drop the Database handles, then
-    // call `foundationdb::api::stop_network()` yourself (terminal: any
-    // FoundationDB use afterwards fails with error 2025).
-    let db = Database::new_compat(None)
-        .await
-        .expect("Unable to create database");
-    db.set_option(foundationdb::options::DatabaseOption::TransactionTimeout(
-        5000,
-    ))
-    .expect("failed to set transaction timeout");
-    db.set_option(foundationdb::options::DatabaseOption::TransactionRetryLimit(3))
-        .expect("failed to set transaction retry limit");
-
-    let subspace = Subspace::all().subspace(&("example-blob"));
-    clear_subspace(&db, &subspace).await;
-
-    for i in 1..=100 {
-        println!("Iteration #{i}");
-        test_blob_storing(&db, &subspace, i).await;
-    }
-}
diff --git a/bindings/rust/foundationdb/examples/budgeted_scan.rs b/bindings/rust/foundationdb/examples/budgeted_scan.rs
deleted file mode 100644
index 7ffd5f76f03..00000000000
--- a/bindings/rust/foundationdb/examples/budgeted_scan.rs
+++ /dev/null
@@ -1,260 +0,0 @@
-//! Scanning a large range across several transactions, each one bounded by a
-//! [`ClientBudget`].
-//!
-//! FoundationDB transactions may not live longer than five seconds, so a scan
-//! that does not fit in one transaction has to be cut into pages, each page
-//! resuming where the previous one stopped. This example shows the pattern:
-//!
-//! * the closure sets a budget (2.5s, comfortably below the five second limit),
-//! * it reads batch after batch and checks the budget between batches,
-//! * when the budget is exhausted it *stops* instead of failing: the closure
-//!   returns the progress it made, and the transaction commits normally,
-//! * `main` reopens a transaction from the continuation key and keeps going
-//!   until the scan reports it reached the end of the range.
-//!
-//! There is deliberately no helper API for this: the budget is a client-side
-//! estimate you check where it makes sense for your workload, and what to do
-//! when it runs out (stop, commit partial work, checkpoint elsewhere) is an
-//! application decision.
-
-use std::time::{Duration, Instant};
-
-use foundationdb::options::StreamingMode;
-use foundationdb::*;
-use futures_util::TryStreamExt;
-
-/// Keys written by the setup, `PREFIX` .. `END`.
-const PREFIX: &[u8] = b"budgeted_scan/";
-const END: &[u8] = b"budgeted_scan0";
-
-/// Number of rows and value size of the data set. 4000 x 1 KiB is around 4 MiB,
-/// so a scan with a 1 MiB target per batch takes a handful of batches.
-const ROWS: usize = 4000;
-const VALUE_SIZE: usize = 1024;
-/// Rows written per setup transaction, to stay well below the 10 MiB
-/// transaction size limit.
-const ROWS_PER_SETUP_TRX: usize = 500;
-
-fn key_of(index: usize) -> Vec<u8> {
-    let mut key = PREFIX.to_vec();
-    key.extend_from_slice(format!("{index:08}").as_bytes());
-    key
-}
-
-/// What one budgeted transaction managed to do.
-struct Page {
-    /// Rows read by this transaction.
-    rows: usize,
-    /// Last key processed, or `None` if the page read nothing. The next
-    /// transaction resumes *after* it, with `first_greater_than`.
-    last_key: Option<Vec<u8>>,
-    /// `true` when the range was fully consumed, that is when the batch stream
-    /// ended on its own rather than the budget cutting it short.
-    complete: bool,
-}
-
-/// Scans from `after` (exclusive, `None` to start at the beginning of the
-/// range) for as long as `budget` allows.
-async fn scan_page(
-    db: &Database,
-    after: Option<Vec<u8>>,
-    budget: ClientBudget,
-) -> Result<Page, FdbBindingError> {
-    db.run(|trx, _maybe_committed| {
-        let after = after.clone();
-        let budget = budget.clone();
-        async move {
-            // Set the budget first: it starts a fresh accounting generation, and
-            // on a retry the new attempt gets the full allowance again.
-            trx.set_client_budget(budget);
-
-            let begin = match &after {
-                // Exclusive continuation: resume strictly after the last key we
-                // processed, so no row is read twice and none is skipped.
-                Some(last) => KeySelector::first_greater_than(last.as_slice()),
-                None => KeySelector::first_greater_or_equal(PREFIX),
-            };
-            let opt = RangeOption {
-                begin,
-                end: KeySelector::first_greater_or_equal(END),
-                // Serial asks the cluster for the largest batches it will send
-                // (around 80 KiB), which is what we want when the loop, not the
-                // batch size, is deciding when to stop. `target_bytes` is only
-                // an upper cap: it never grows a batch beyond what the mode
-                // asks for.
-                mode: StreamingMode::Serial,
-                target_bytes: 1 << 20,
-                ..RangeOption::default()
-            };
-
-            let mut rows = 0;
-            let mut last_key = None;
-            // The stream ending is the only proof the range is exhausted.
-            let mut complete = true;
-            let mut batches = trx.get_ranges(opt, false);
-
-            while let Some(batch) = batches.try_next().await? {
-                for kv in batch.iter() {
-                    rows += 1;
-                    last_key = Some(kv.key().to_vec());
-                }
-
-                // The budget is checked *between* batches, never inside one: the
-                // batch that was in flight when the budget expired still lands and
-                // is fully processed. Expect an overshoot of up to one batch, and
-                // in time, of however long that batch took to arrive: nothing here
-                // interrupts an await. Size the budget with that margin in mind
-                // (2.5s against a 5s transaction limit).
-                if let Err(exceeded) = trx.check_client_budget() {
-                    // Matched, not propagated with `?`. Returning the error would
-                    // abort the whole `db.run` and throw away both the work of
-                    // this page and the continuation key. Breaking instead lets
-                    // the closure return normally: the transaction commits and the
-                    // caller resumes from `last_key`.
-                    println!("    budget reached: {exceeded}");
-                    complete = false;
-                    break;
-                }
-            }
-
-            Ok::<_, FdbBindingError>(Page {
-                rows,
-                last_key,
-                complete,
-            })
-        }
-    })
-    .await
-}
-
-/// Runs the full scan, one transaction per page, and returns how many rows and
-/// how many transactions it took.
-async fn scan_all(db: &Database, budget: ClientBudget) -> Result<(usize, usize), FdbBindingError> {
-    let mut continuation = None;
-    let mut total_rows = 0;
-    let mut transactions = 0;
-
-    loop {
-        let page = scan_page(db, continuation.clone(), budget.clone()).await?;
-        transactions += 1;
-        total_rows += page.rows;
-        println!(
-            "  transaction {}: {} row(s), {} rows so far",
-            transactions, page.rows, total_rows
-        );
-
-        if page.complete {
-            break;
-        }
-        // A page cut short by the budget always has a continuation key, unless
-        // it read nothing at all, which means there was nothing left to read.
-        match page.last_key {
-            Some(last) => continuation = Some(last),
-            None => break,
-        }
-    }
-
-    Ok((total_rows, transactions))
-}
-
-async fn setup(db: &Database) -> Result<(), FdbBindingError> {
-    let value = vec![b'x'; VALUE_SIZE];
-
-    db.run(|trx, _| async move {
-        trx.clear_range(PREFIX, END);
-        Ok::<_, FdbBindingError>(())
-    })
-    .await?;
-
-    for chunk_start in (0..ROWS).step_by(ROWS_PER_SETUP_TRX) {
-        let value = value.clone();
-        db.run(move |trx, _| {
-            let value = value.clone();
-            async move {
-                for index in chunk_start..(chunk_start + ROWS_PER_SETUP_TRX).min(ROWS) {
-                    trx.set(&key_of(index), &value);
-                }
-                Ok::<_, FdbBindingError>(())
-            }
-        })
-        .await?;
-    }
-
-    Ok(())
-}
-
-async fn run_example() -> Result<(), FdbBindingError> {
-    let db = Database::default()?;
-
-    println!("Writing {ROWS} rows of {VALUE_SIZE} bytes...");
-    setup(&db).await?;
-
-    println!("Scanning with a 2.5s per-transaction budget:");
-    let started = Instant::now();
-    let (rows, transactions) = scan_all(
-        &db,
-        ClientBudget {
-            time_limit: Some(Duration::from_millis(2500)),
-            ..ClientBudget::default()
-        },
-    )
-    .await?;
-    println!(
-        "  {rows} row(s) in {transactions} transaction(s), {:?}",
-        started.elapsed()
-    );
-
-    // On a local cluster 4 MiB is read well within 2.5s, so the scan above ends
-    // in a single transaction. The same loop with a byte budget of half a
-    // mebibyte shows the continuation actually resuming, a few batches per
-    // transaction.
-    println!("Scanning again with a 512 KiB read budget, to force continuations:");
-    let (rows, transactions) = scan_all(
-        &db,
-        ClientBudget {
-            max_bytes_read: Some(512 * 1024),
-            ..ClientBudget::default()
-        },
-    )
-    .await?;
-    println!("  {rows} row(s) in {transactions} transaction(s)");
-
-    db.run(|trx, _| async move {
-        trx.clear_range(PREFIX, END);
-        Ok::<_, FdbBindingError>(())
-    })
-    .await?;
-
-    Ok(())
-}
-
-#[tokio::main]
-async fn main() {
-    foundationdb::boot().expect("failed to initialize FoundationDB");
-    // The network is stopped and joined automatically at process exit, which is
-    // fine for tests and short-lived tools like this example. In a production
-    // application, prefer a clean teardown: the network thread is the event loop
-    // driving every transaction and you may still have on-going operations at
-    // exit time. Finish or cancel your work, drop the Database handles, then
-    // call `foundationdb::api::stop_network()` yourself (terminal: any
-    // FoundationDB use afterwards fails with error 2025).
-
-    if let Err(e) = run_example().await {
-        eprintln!("Error: {e:?}");
-    }
-}
-
-/*
-// Expected output:
-//
-// Writing 4000 rows of 1024 bytes...
-// Scanning with a 2.5s per-transaction budget:
-//   transaction 1: 4000 row(s), 4000 rows so far
-//   4000 row(s) in 1 transaction(s), 12.147459ms
-// Scanning again with a 512 KiB read budget, to force continuations:
-//     budget reached: client budget exceeded (bytes read): used 549150 bytes, limit 524288 bytes. ...
-//   transaction 1: 525 row(s), 525 rows so far
-//   ...
-//   transaction 8: 325 row(s), 4000 rows so far
-//   4000 row(s) in 8 transaction(s)
-*/
diff --git a/bindings/rust/foundationdb/examples/class-scheduling.rs b/bindings/rust/foundationdb/examples/class-scheduling.rs
deleted file mode 100644
index 6c2891ba3e3..00000000000
--- a/bindings/rust/foundationdb/examples/class-scheduling.rs
+++ /dev/null
@@ -1,408 +0,0 @@
-// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
-// Copyright 2013-2018 Apple, Inc and the FoundationDB project authors.
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-#[macro_use]
-extern crate lazy_static;
-
-use std::borrow::Cow;
-use std::ops::Deref;
-use std::thread;
-
-use rand::rngs::ThreadRng;
-
-use rand::prelude::IndexedRandom;
-
-use foundationdb as fdb;
-use foundationdb::tuple::{Subspace, pack, unpack};
-use foundationdb::{
-    Database, FdbBindingError, FdbError, FdbResult, RangeOption, RetryableError, Transaction,
-};
-use futures::TryStreamExt;
-
-type Result<T> = std::result::Result<T, Error>;
-
-// The blessed layer-error pattern: one enum for the whole layer, carrying the
-// FdbError (and the retry loop's own FdbBindingError) as a source. The
-// `RetryableError` impl below makes `db.run` retry-transparent for wrapped
-// FdbErrors, and the caller gets this typed error back from `db.run`.
-#[derive(Debug)]
-enum Error {
-    NoRemainingSeats,
-    TooManyClasses,
-    Fdb(FdbError),
-    Binding(FdbBindingError),
-}
-
-impl std::fmt::Display for Error {
-    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
-        match self {
-            Error::NoRemainingSeats => write!(f, "No remaining seats"),
-            Error::TooManyClasses => write!(f, "Too many classes"),
-            Error::Fdb(e) => write!(f, "FoundationDB error: {e}"),
-            Error::Binding(e) => write!(f, "Retry loop error: {e}"),
-        }
-    }
-}
-
-impl std::error::Error for Error {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Error::Fdb(e) => Some(e),
-            Error::Binding(e) => Some(e),
-            Error::NoRemainingSeats | Error::TooManyClasses => None,
-        }
-    }
-}
-
-impl From<FdbError> for Error {
-    fn from(err: FdbError) -> Self {
-        Error::Fdb(err)
-    }
-}
-
-impl From<FdbBindingError> for Error {
-    fn from(err: FdbBindingError) -> Self {
-        Error::Binding(err)
-    }
-}
-
-// The default retry_decision walks source() and finds the wrapped FdbError.
-impl RetryableError for Error {}
-
-// Data model:
-// ("attends", student, class) = ""
-// ("class", class_name) = seatsLeft
-
-// Generate 1,620 classes like '9:00 chem for dummies'
-const LEVELS: &[&str] = &[
-    "intro",
-    "for dummies",
-    "remedial",
-    "101",
-    "201",
-    "301",
-    "mastery",
-    "lab",
-    "seminar",
-];
-
-const TYPES: &[&str] = &[
-    "chem", "bio", "cs", "geometry", "calc", "alg", "film", "music", "art", "dance",
-];
-
-const TIMES: &[&str] = &[
-    "2:00", "3:00", "4:00", "5:00", "6:00", "7:00", "8:00", "9:00", "10:00", "11:00", "12:00",
-    "13:00", "14:00", "15:00", "16:00", "17:00", "18:00", "19:00",
-];
-
-lazy_static! {
-    static ref ALL_CLASSES: Vec<String> = all_classes();
-}
-
-// TODO: make these tuples?
-fn all_classes() -> Vec<String> {
-    let mut class_names: Vec<String> = Vec::new();
-    for level in LEVELS {
-        for _type in TYPES {
-            for time in TIMES {
-                class_names.push(format!("{time} {_type} {level}"));
-            }
-        }
-    }
-
-    class_names
-}
-
-fn init_classes(trx: &Transaction, all_classes: &[String]) {
-    let class_subspace = Subspace::from("class");
-    for class in all_classes {
-        trx.set(&class_subspace.pack(class), &pack(&100_i64));
-    }
-}
-
-async fn init(db: &Database, all_classes: &[String]) {
-    db.run(|trx, _maybe_committed| async move {
-        trx.clear_subspace_range(&"attends".into());
-        trx.clear_subspace_range(&"class".into());
-        init_classes(&trx, all_classes);
-        Ok::<_, Error>(())
-    })
-    .await
-    .expect("failed to initialize data");
-}
-
-async fn get_available_classes(db: &Database) -> Vec<String> {
-    db.run(|trx, _maybe_committed| async move {
-        let range = RangeOption::from(&Subspace::from("class"));
-
-        let mut available_classes = Vec::<String>::new();
-        let mut stream = trx.get_ranges_keyvalues(range, false);
-        while let Some(key_value) = stream.try_next().await? {
-            let count: i64 = unpack(key_value.value()).expect("failed to decode count");
-
-            if count > 0 {
-                let class: String = unpack(key_value.key()).expect("failed to decode class");
-                available_classes.push(class);
-            }
-        }
-
-        Ok::<_, Error>(available_classes)
-    })
-    .await
-    .expect("failed to get classes")
-}
-
-async fn ditch_trx(trx: &Transaction, student: &str, class: &str) -> FdbResult<()> {
-    let attends_key = pack(&("attends", student, class));
-
-    // TODO: should get take an &Encode? current impl does encourage &[u8] reuse...
-    if trx.get(&attends_key, true).await?.is_none() {
-        return Ok(());
-    }
-
-    let class_key = pack(&("class", class));
-    let available_seats = trx
-        .get(&class_key, true)
-        .await?
-        .expect("class seats were not initialized");
-    let available_seats: i64 =
-        unpack::<i64>(available_seats.deref()).expect("failed to decode i64") + 1;
-
-    //println!("{} ditching class: {}", student, class);
-    trx.set(&class_key, &pack(&available_seats));
-    trx.clear(&attends_key);
-    Ok(())
-}
-
-async fn ditch(db: &Database, student: String, class: String) -> Result<()> {
-    db.run(move |trx, _maybe_committed| {
-        let student = student.clone();
-        let class = class.clone();
-        async move {
-            ditch_trx(&trx, &student, &class).await?;
-            Ok::<_, Error>(())
-        }
-    })
-    .await
-}
-
-async fn signup_trx(trx: &Transaction, student: &str, class: &str) -> Result<()> {
-    let attends_key = pack(&("attends", student, class));
-    if trx.get(&attends_key, true).await?.is_some() {
-        //println!("{} already taking class: {}", student, class);
-        return Ok(());
-    }
-
-    let class_key = pack(&("class", class));
-    let available_seats: i64 = unpack(
-        &trx.get(&class_key, true)
-            .await?
-            .expect("class seats were not initialized"),
-    )
-    .expect("failed to decode i64");
-
-    if available_seats <= 0 {
-        return Err(Error::NoRemainingSeats);
-    }
-
-    let attends_range = RangeOption::from(&("attends", &student).into());
-    let attends: Vec<_> = trx
-        .get_ranges_keyvalues(attends_range, false)
-        .try_collect()
-        .await?;
-    if attends.len() >= 5 {
-        return Err(Error::TooManyClasses);
-    }
-
-    //println!("{} taking class: {}", student, class);
-    trx.set(&class_key, &pack(&(available_seats - 1)));
-    trx.set(&attends_key, &pack(&""));
-
-    Ok(())
-}
-
-async fn signup(db: &Database, student: String, class: String) -> Result<()> {
-    db.run(move |trx, _maybe_committed| {
-        let student = student.clone();
-        let class = class.clone();
-        async move { signup_trx(&trx, &student, &class).await }
-    })
-    .await
-}
-
-async fn switch_classes(
-    db: &Database,
-    student_id: String,
-    old_class: String,
-    new_class: String,
-) -> Result<()> {
-    db.run(move |trx, _maybe_committed| {
-        let student_id = student_id.clone();
-        let old_class = old_class.clone();
-        let new_class = new_class.clone();
-        async move {
-            ditch_trx(&trx, &student_id, &old_class).await?;
-            signup_trx(&trx, &student_id, &new_class).await?;
-            Ok::<_, Error>(())
-        }
-    })
-    .await
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-enum Mood {
-    Add,
-    Ditch,
-    Switch,
-}
-
-async fn perform_op(
-    db: &Database,
-    rng: &mut ThreadRng,
-    mood: Mood,
-    student_id: &str,
-    all_classes: &[String],
-    my_classes: &mut Vec<String>,
-) -> Result<()> {
-    match mood {
-        Mood::Add => {
-            let class = all_classes.choose(rng).unwrap();
-            signup(db, student_id.to_string(), class.to_string()).await?;
-            my_classes.push(class.to_string());
-        }
-        Mood::Ditch => {
-            let class = all_classes.choose(rng).unwrap();
-            ditch(db, student_id.to_string(), class.to_string()).await?;
-            my_classes.retain(|s| s != class);
-        }
-        Mood::Switch => {
-            let old_class = my_classes.choose(rng).unwrap().to_string();
-            let new_class = all_classes.choose(rng).unwrap();
-            switch_classes(
-                db,
-                student_id.to_string(),
-                old_class.to_string(),
-                new_class.to_string(),
-            )
-            .await?;
-            my_classes.retain(|s| s != &old_class);
-            my_classes.push(new_class.to_string());
-        }
-    }
-    Ok(())
-}
-
-async fn simulate_students(student_id: usize, num_ops: usize) {
-    let db = Database::new_compat(None)
-        .await
-        .expect("failed to get database");
-    db.set_option(fdb::options::DatabaseOption::TransactionTimeout(5000))
-        .expect("failed to set transaction timeout");
-    db.set_option(fdb::options::DatabaseOption::TransactionRetryLimit(3))
-        .expect("failed to set transaction retry limit");
-
-    let student_id = format!("s{student_id}");
-    let mut rng = rand::rng();
-
-    let mut available_classes = Cow::Borrowed(&*ALL_CLASSES);
-    let mut my_classes = Vec::<String>::new();
-
-    for _ in 0..num_ops {
-        let mut moods = Vec::<Mood>::new();
-
-        if !my_classes.is_empty() {
-            moods.push(Mood::Ditch);
-            moods.push(Mood::Switch);
-        }
-
-        if my_classes.len() < 5 {
-            moods.push(Mood::Add);
-        }
-
-        let mood = moods.choose(&mut rng).copied().unwrap();
-
-        // on errors we recheck for available classes
-        if perform_op(
-            &db,
-            &mut rng,
-            mood,
-            &student_id,
-            &available_classes,
-            &mut my_classes,
-        )
-        .await
-        .is_err()
-        {
-            println!("getting available classes");
-            available_classes = Cow::Owned(get_available_classes(&db).await);
-        }
-    }
-}
-
-async fn run_sim(db: &Database, students: usize, ops_per_student: usize) {
-    let mut threads: Vec<(usize, thread::JoinHandle<()>)> = Vec::with_capacity(students);
-    for i in 0..students {
-        // TODO: ClusterInner has a mutable pointer reference, if thread-safe, mark that trait as Sync, then we can clone DB here...
-        threads.push((
-            i,
-            thread::spawn(move || {
-                futures::executor::block_on(simulate_students(i, ops_per_student));
-            }),
-        ));
-    }
-
-    // explicitly join...
-    for (id, thread) in threads {
-        thread.join().expect("failed to join thread");
-
-        let student_id = format!("s{id}");
-        let student_id_clone = student_id.clone();
-
-        db.run(move |trx, _maybe_committed| {
-            let student_id_inner = student_id_clone.clone();
-            async move {
-                let attends_range = RangeOption::from(&("attends", &student_id_inner).into());
-                let mut stream = trx.get_ranges_keyvalues(attends_range, false);
-                while let Some(key_value) = stream.try_next().await? {
-                    let (_, s, class) =
-                        unpack::<(String, String, String)>(key_value.key()).unwrap();
-                    assert_eq!(student_id_inner, s);
-
-                    println!("{student_id_inner} is taking: {class}");
-                }
-                Ok::<_, Error>(())
-            }
-        })
-        .await
-        .expect("get_ranges_keyvalues failed");
-    }
-
-    println!("Ran {} transactions", students * ops_per_student);
-}
-
-#[tokio::main]
-async fn main() {
-    fdb::boot().expect("failed to initialize FoundationDB");
-    // The network is stopped and joined automatically at process exit, which is
-    // fine for tests and short-lived tools like this example. In a production
-    // application, prefer a clean teardown: the network thread is the event loop
-    // driving every transaction and you may still have on-going operations at
-    // exit time. Finish or cancel your work, drop the Database handles, then
-    // call `foundationdb::api::stop_network()` yourself (terminal: any
-    // FoundationDB use afterwards fails with error 2025).
-    let db = fdb::Database::new_compat(None)
-        .await
-        .expect("failed to get database");
-    db.set_option(fdb::options::DatabaseOption::TransactionTimeout(5000))
-        .expect("failed to set transaction timeout");
-    db.set_option(fdb::options::DatabaseOption::TransactionRetryLimit(3))
-        .expect("failed to set transaction retry limit");
-    init(&db, &ALL_CLASSES).await;
-    println!("Initialized");
-    run_sim(&db, 10, 10).await;
-}
diff --git a/bindings/rust/foundationdb/examples/conflict_reporting.rs b/bindings/rust/foundationdb/examples/conflict_reporting.rs
deleted file mode 100644
index 47859d7efc8..00000000000
--- a/bindings/rust/foundationdb/examples/conflict_reporting.rs
+++ /dev/null
@@ -1,200 +0,0 @@
-//! This example demonstrates how to use custom [`RunnerHooks`] to observe
-//! the transaction retry loop lifecycle, including conflict reporting.
-//!
-//! It creates two transactions that conflict on the same key, showing
-//! the full hook lifecycle: commit error → conflicting keys → retry → success.
-//!
-//! The user hook is stacked with [`MetricsHooks`] in a tuple, so the same run
-//! also produces the per-attempt metrics report of `instrumented_run`.
-
-use foundationdb::options::TransactionOption;
-use foundationdb::runner::MetricsHooks;
-use foundationdb::*;
-use foundationdb_macros::cfg_api_versions;
-use std::sync::Arc;
-use std::sync::atomic::{AtomicU64, Ordering};
-
-/// Prints the write conflict ranges the attempt accumulated, which is what the
-/// resolver will check other transactions against.
-///
-/// Before the commit these are an approximate superset when versionstamped keys
-/// are used: the versionstamp is only resolved at commit time.
-///
-/// The `\xff\xff/transaction/write_conflict_range/` special keyspace exists from
-/// API version 630, hence the two variants below.
-#[cfg_api_versions(min = 630)]
-async fn print_write_conflict_ranges(trx: &Transaction, attempt: usize) -> FdbResult<()> {
-    let ranges = trx.write_conflict_ranges().await?;
-    println!(
-        "  before_commit (attempt {attempt}): {} write conflict range(s)",
-        ranges.len()
-    );
-    for range in &ranges {
-        println!(
-            "    {:?} .. {:?}",
-            String::from_utf8_lossy(range.begin()),
-            String::from_utf8_lossy(range.end()),
-        );
-    }
-    Ok(())
-}
-
-#[cfg_api_versions(min = 510, max = 620)]
-async fn print_write_conflict_ranges(_trx: &Transaction, _attempt: usize) -> FdbResult<()> {
-    Ok(())
-}
-
-/// A simple hook implementation that prints each lifecycle event.
-struct PrintHooks;
-
-impl RunnerHooks for PrintHooks {
-    fn on_attempt_start(&self, _trx: &Transaction, attempt: usize) {
-        println!("  on_attempt_start: attempt {attempt}");
-    }
-
-    /// Last point where the transaction can be inspected inside the attempt:
-    /// the write conflict ranges are complete here, while `conflicting_keys`
-    /// below only tells what actually clashed, and only once the commit failed.
-    async fn before_commit(&self, trx: &Transaction, attempt: usize) -> FdbResult<()> {
-        print_write_conflict_ranges(trx, attempt).await
-    }
-
-    async fn on_commit_error(&self, err: &TransactionCommitError, attempt: usize) -> FdbResult<()> {
-        let keys = err.conflicting_keys().await?;
-        println!(
-            "  on_commit_error (attempt {attempt}): {} range(s)",
-            keys.len()
-        );
-        for range in &keys {
-            println!(
-                "    {:?} .. {:?}",
-                String::from_utf8_lossy(range.begin()),
-                String::from_utf8_lossy(range.end()),
-            );
-        }
-        Ok(())
-    }
-
-    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
-        println!("  on_hook_error (attempt {attempt}): {}", err.message());
-    }
-
-    fn on_closure_error(&self, err: &FdbError, attempt: usize) {
-        println!("  on_closure_error (attempt {attempt}): {}", err.message());
-    }
-
-    fn on_error_duration(&self, ms: u64, attempt: usize) {
-        println!("  on_error_duration (attempt {attempt}): {ms}ms");
-    }
-
-    fn on_commit_success(&self, _committed: &TransactionCommitted, ms: u64, attempt: usize) {
-        println!("  on_commit_success (attempt {attempt}): committed in {ms}ms");
-    }
-
-    fn on_retry(&self, attempt: usize) {
-        println!("  on_retry: attempt {attempt} is over");
-    }
-
-    fn on_complete(&self) {
-        println!("  on_complete");
-    }
-}
-
-#[tokio::main]
-async fn main() {
-    foundationdb::boot().expect("failed to initialize FoundationDB");
-    // The network is stopped and joined automatically at process exit, which is
-    // fine for tests and short-lived tools like this example. In a production
-    // application, prefer a clean teardown: the network thread is the event loop
-    // driving every transaction and you may still have on-going operations at
-    // exit time. Finish or cancel your work, drop the Database handles, then
-    // call `foundationdb::api::stop_network()` yourself (terminal: any
-    // FoundationDB use afterwards fails with error 2025).
-
-    if let Err(e) = run_example().await {
-        eprintln!("Error: {e:?}");
-    }
-}
-
-async fn run_example() -> Result<(), FdbBindingError> {
-    let db = Database::default()?;
-    let attempt = Arc::new(AtomicU64::new(0));
-
-    println!("Running transaction with PrintHooks (forcing a conflict)...");
-
-    // Both hooks observe the same run: the metrics ones fill the report, the
-    // printing ones comment on it. Callbacks fire left to right.
-    let metrics = TransactionMetrics::new();
-    let hooks = (MetricsHooks::new(&metrics), PrintHooks);
-
-    db.run_with_hooks(&hooks, |trx, _| {
-        let attempt = attempt.clone();
-        async move {
-            let current = attempt.fetch_add(1, Ordering::SeqCst);
-
-            // Enable conflict reporting
-            trx.set_option(TransactionOption::ReportConflictingKeys)?;
-
-            // Read a key to establish a read conflict range
-            let _ = trx.get(b"example_conflict_key", false).await?;
-
-            if current == 0 {
-                // On first attempt, have another transaction write to the same key
-                let db2 = Database::default()?;
-                let other = db2.create_trx()?;
-                other.set(b"example_conflict_key", b"sneaky_write");
-                other
-                    .commit()
-                    .await
-                    .map_err(|e| FdbBindingError::NonRetryableFdbError(FdbError::from(e)))?;
-                println!("  (injected conflicting write)");
-            }
-
-            trx.set(b"example_conflict_key", b"my_value");
-            Ok::<_, FdbBindingError>(())
-        }
-    })
-    .await?;
-
-    let report = metrics.get_metrics_data();
-    println!("Transaction succeeded after conflict!");
-    println!(
-        "{} attempt(s), {} conflict(s), total usage: {:?}",
-        report.attempts.len(),
-        report.transaction.conflict_count,
-        report.total_usage(),
-    );
-    for attempt in &report.attempts {
-        println!(
-            "  attempt {}: {:?}, {} conflicting range(s)",
-            attempt.index,
-            attempt.outcome,
-            attempt.conflicting_keys.ranges().len(),
-        );
-    }
-
-    Ok(())
-}
-
-/*
-// Expected output:
-//
-// Running transaction with PrintHooks (forcing a conflict)...
-//   on_attempt_start: attempt 0
-//   (injected conflicting write)
-//   before_commit (attempt 0): 1 write conflict range(s)
-//     "example_conflict_key" .. "example_conflict_key\0"
-//   on_commit_error (attempt 0): 1 range(s)
-//     "example_conflict_key" .. "example_conflict_key\0"
-//   on_error_duration (attempt 0): 0ms
-//   on_retry: attempt 0 is over
-//   on_attempt_start: attempt 1
-//   before_commit (attempt 1): 1 write conflict range(s)
-//     "example_conflict_key" .. "example_conflict_key\0"
-//   on_commit_success (attempt 1): committed in 1ms
-//   on_complete
-// Transaction succeeded after conflict!
-// 2 attempt(s), 1 conflict(s), total usage: UsageSnapshot { .. }
-//   attempt 0: Retried { cause: FdbError { error_code: 1020 } }, 1 conflicting range(s)
-//   attempt 1: Committed, 0 conflicting range(s)
-*/
diff --git a/bindings/rust/foundationdb/examples/instrumented.rs b/bindings/rust/foundationdb/examples/instrumented.rs
deleted file mode 100644
index 105d74b3505..00000000000
--- a/bindings/rust/foundationdb/examples/instrumented.rs
+++ /dev/null
@@ -1,125 +0,0 @@
-//! This example demonstrates how to use the `instrumented_run` method to execute
-//! a transaction and receive a detailed metrics report upon completion.
-//!
-//! The `instrumented_run` method is a powerful tool for monitoring and debugging
-//! transaction performance, as it provides precise counters for operations, byte
-//! counts for reads and writes, timing information, and support for custom metrics.
-
-use foundationdb::{Database, FdbBindingError};
-
-#[tokio::main]
-async fn main() {
-    foundationdb::boot().expect("failed to initialize FoundationDB");
-    // The network is stopped and joined automatically at process exit, which is
-    // fine for tests and short-lived tools like this example. In a production
-    // application, prefer a clean teardown: the network thread is the event loop
-    // driving every transaction and you may still have on-going operations at
-    // exit time. Finish or cancel your work, drop the Database handles, then
-    // call `foundationdb::api::stop_network()` yourself (terminal: any
-    // FoundationDB use afterwards fails with error 2025).
-
-    // Run the instrumented example
-    if let Err(e) = instrumented_example().await {
-        eprintln!("Error running instrumented example: {e:?}");
-    }
-}
-
-async fn instrumented_example() -> Result<(), FdbBindingError> {
-    let db = Database::default()?;
-
-    println!("Running an instrumented transaction...");
-
-    // Use `instrumented_run` to execute a transaction and get metrics.
-    let result = db
-        .instrumented_run(|txn, _| async move {
-            // Perform a few simple operations
-            txn.set(b"instrumented_key", b"instrumented_value");
-            let _ = txn.get(b"instrumented_key", false).await?;
-
-            // Register a custom metric directly on the transaction
-            txn.set_custom_metric("operations_count", 1, &[("type", "write")]);
-
-            Ok(())
-        })
-        .await;
-
-    // Handle the result and print the metrics report
-    match result {
-        Ok((_, metrics)) => {
-            println!("Transaction successful!");
-            println!("--- Metrics Report ---");
-            println!("{metrics:#?}");
-            println!("----------------------");
-        }
-        Err((err, metrics)) => {
-            eprintln!("Transaction failed: {err:?}");
-            eprintln!("--- Metrics Report (on failure) ---");
-            println!("{metrics:#?}");
-            println!("-----------------------------------");
-            return Err(err);
-        }
-    }
-
-    Ok(())
-}
-
-/*
-// Example output:
-
-Running an instrumented transaction...
-Transaction successful!
---- Metrics Report ---
-MetricsReport {
-    attempts: [
-        AttemptMetrics {
-            index: 0,
-            usage: UsageSnapshot {
-                elapsed: 11.703552ms,
-                bytes_read: 34,
-                bytes_written: 34,
-                keys_values_fetched: 1,
-                call_get: 1,
-                call_get_range: 0,
-                call_set: 1,
-                call_clear: 0,
-                call_clear_range: 0,
-                call_atomic_op: 0,
-            },
-            custom_metrics: {
-                MetricKey {
-                    name: "operations_count",
-                    labels: [
-                        (
-                            "type",
-                            "write",
-                        ),
-                    ],
-                }: 1,
-            },
-            duration: Some(
-                11.701935ms,
-            ),
-            commit_duration: Some(
-                10.609832ms,
-            ),
-            grv_duration: None,
-            on_error_duration: None,
-            outcome: Committed,
-            conflicting_keys: NotRequested,
-            read_version: None,
-        },
-    ],
-    total_duration: Some(
-        11.726852ms,
-    ),
-    transaction: TransactionInfo {
-        retries: 0,
-        conflict_count: 0,
-        read_version: None,
-        commit_version: Some(
-            70442567195,
-        ),
-    },
-}
-----------------------
-*/
diff --git a/bindings/rust/foundationdb/examples/micro-queue.rs b/bindings/rust/foundationdb/examples/micro-queue.rs
deleted file mode 100644
index d055cad9521..00000000000
--- a/bindings/rust/foundationdb/examples/micro-queue.rs
+++ /dev/null
@@ -1,190 +0,0 @@
-use core::fmt;
-use std::error;
-
-use foundationdb::{Database, FdbBindingError, RangeOption, future::FdbValue, tuple::Subspace};
-use futures::StreamExt;
-use rand::{Rng, rngs::SmallRng};
-
-/// Clears subspaces of a database.
-///
-/// # Errors
-///
-/// If client failed to commit transaction.
-async fn clear_subspace(db: &Database, subspace: &Subspace) -> Result<(), FdbBindingError> {
-    db.run(|trx, _| async move {
-        trx.clear_subspace_range(subspace);
-        Ok(())
-    })
-    .await
-}
-
-/// Error returned on attempt to insert an item in a [`MicroQueue`]
-/// which length is [`usize::MAX`].
-#[derive(Debug)]
-pub struct Overflow;
-
-impl fmt::Display for Overflow {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str("queue is too long")
-    }
-}
-
-impl error::Error for Overflow {}
-
-/// First-in-first-out (FIFO) queue of UTF-8 strings, implemented as a layer on
-/// top of `FoundationDB`, after the [Java recipe](https://github.com/apple/foundationdb/blob/main/recipes/java-recipes/MicroQueue.java).
-pub struct MicroQueue {
-    db: Database,
-    queue: Subspace,
-    rng: SmallRng,
-}
-
-impl MicroQueue {
-    /// Creates a new, empty, queue in `prefix` [`Subspace`].
-    ///
-    /// # Errors
-    ///
-    /// * If client failed to clear `prefix` [`Subspace`]
-    pub async fn new(
-        db: Database,
-        prefix: impl Into<Vec<u8>> + Send + Sync + Unpin,
-    ) -> Result<Self, FdbBindingError> {
-        let queue = Subspace::from_bytes(prefix);
-        clear_subspace(&db, &queue).await?;
-        Ok(Self {
-            db,
-            queue,
-            rng: rand::make_rng(),
-        })
-    }
-
-    /// Get the last index in the queue.
-    ///
-    /// # Errors
-    ///
-    /// * If client failed to get [`FdbValues`](foundationdb::future::FdbValues)
-    ///   stored under `prefix` [`Subspace`].
-    /// * If client failed to commit transaction.
-    async fn last_index(&self) -> Result<usize, FdbBindingError> {
-        self.db
-            .run(|trx, _maybe_committed| async move {
-                Ok(trx
-                    .get_ranges_keyvalues(self.queue.range().into(), true)
-                    .count()
-                    .await)
-            })
-            .await
-    }
-
-    /// Add an element to the queue.
-    ///
-    /// # Errors
-    ///
-    /// * If client failed to get [`FdbValues`](foundationdb::future::FdbValues)
-    ///   stored under `prefix` [`Subspace`].
-    /// * If client failed to commit transaction.
-    /// * If the capacity of the queue is [`usize::MAX`].
-    pub async fn enqueue(&mut self, value: &str) -> Result<(), FdbBindingError> {
-        let index = self
-            .last_index()
-            .await?
-            .checked_add(1)
-            .ok_or_else(|| FdbBindingError::new_custom_error(Box::new(Overflow)))?;
-
-        let rands = {
-            // Create random seed to avoid conflicts.
-            let mut rands = [0_u8; 20];
-            self.rng.fill_bytes(&mut rands);
-            rands
-        };
-
-        let key = &self.queue.subspace(&(index, rands.as_slice()));
-
-        self.db
-            .run(|trx, _maybe_committed| async move {
-                trx.set(key.bytes(), value.as_bytes());
-                Ok(())
-            })
-            .await
-    }
-
-    /// Get the top element of the queue.
-    ///
-    /// # Errors
-    ///
-    /// * Upon failure to collect stream.
-    /// * If client failed to commit transaction.
-    async fn first_item(&self) -> Result<Option<FdbValue>, FdbBindingError> {
-        self.db
-            .run(|trx, _maybe_committed| async move {
-                trx.get_ranges_keyvalues(RangeOption::from(&self.queue).rev(), true)
-                    .next()
-                    .await
-                    .transpose()
-                    .map_err(Into::into)
-            })
-            .await
-    }
-
-    /// Remove the top element from the queue.
-    ///
-    /// # Errors
-    ///
-    /// * Upon failure to collect the stream of key values in `prefix` [`Subspace`].
-    /// * If client failed to commit transaction.
-    ///
-    /// # Panics
-    ///
-    /// * If value is corrupted (invalid UTF-8).
-    pub async fn dequeue(&mut self) -> Result<Option<String>, FdbBindingError> {
-        match self.first_item().await? {
-            None => Ok(None),
-            Some(fdb_value) => {
-                let key = fdb_value.key();
-                let value = std::str::from_utf8(fdb_value.value()).expect("valid UTF-8");
-                self.db
-                    .run(|trx, _maybe_committed| async move {
-                        trx.clear(key);
-                        Ok(Some(value.to_owned()))
-                    })
-                    .await
-            }
-        }
-    }
-}
-
-const LINE: [&str; 13] = [
-    "Alice", "Bob", "Carol", "Dave", "Eve", "Frank", "George", "Harry", "Ian", "Jack", "Liz",
-    "Mary", "Nathan",
-];
-
-#[tokio::main]
-async fn main() -> Result<(), FdbBindingError> {
-    // initialize FoundationDB Client API
-    foundationdb::boot().expect("failed to initialize FoundationDB");
-    // The network is stopped and joined automatically at process exit, which is
-    // fine for tests and short-lived tools like this example. In a production
-    // application, prefer a clean teardown: the network thread is the event loop
-    // driving every transaction and you may still have on-going operations at
-    // exit time. Finish or cancel your work, drop the Database handles, then
-    // call `foundationdb::api::stop_network()` yourself (terminal: any
-    // FoundationDB use afterwards fails with error 2025).
-
-    // attempt connection to FoundationDB
-    let db = Database::default()?;
-
-    // create a micro queue in `Q` subspace
-    let mut q = MicroQueue::new(db, "Q").await?;
-
-    // push values at the back of the queue
-    for value in LINE {
-        q.enqueue(value).await?;
-    }
-
-    // pop values from the front of the queue
-    while let Some(value) = q.dequeue().await? {
-        println!("{value}");
-    }
-
-    Ok(())
-}
diff --git a/bindings/rust/foundationdb/examples/simple-index.rs b/bindings/rust/foundationdb/examples/simple-index.rs
deleted file mode 100644
index 61ba1516bd0..00000000000
--- a/bindings/rust/foundationdb/examples/simple-index.rs
+++ /dev/null
@@ -1,220 +0,0 @@
-use foundationdb::tuple::{Subspace, TuplePack, unpack};
-use foundationdb::{Database, FdbBindingError, FdbResult, RangeOption, Transaction};
-use futures::TryStreamExt;
-use std::fmt::{Display, Formatter};
-
-#[derive(Default)]
-struct User {
-    id: String,
-    name: String,
-    zipcode: String,
-}
-
-impl Display for User {
-    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-        write!(
-            f,
-            "id => '{}', zipcode => '{}', name => '{}'",
-            self.id, self.zipcode, self.name
-        )
-    }
-}
-
-/// Cleanup any data from previous run
-async fn clear_subspaces(db: &Database, subspaces: &[Subspace]) {
-    db.run(|trx, _maybe_committed| async move {
-        // teardown, clear data from previous run
-        for subspace in subspaces {
-            trx.clear_subspace_range(subspace);
-        }
-        Ok::<_, FdbBindingError>(())
-    })
-    .await
-    .expect("Unable to commit transaction");
-}
-
-async fn create_user(
-    transaction: &Transaction,
-    id: &str,
-    zipcode: &str,
-    name: &str,
-    user_subspace: &Subspace,
-    zipcode_index_subspace: &Subspace,
-) {
-    let key = user_subspace.pack(&(id, zipcode));
-    let index = zipcode_index_subspace.pack(&(zipcode, id));
-
-    transaction.set(&key, &name.pack_to_vec());
-    transaction.set(&index, &[]);
-}
-
-async fn get_user(
-    user_subspace: &Subspace,
-    transaction: &Transaction,
-    user_id: &str,
-    zipcode: &str,
-) -> FdbResult<User> {
-    let key = user_subspace.pack(&(user_id, zipcode));
-
-    let user = transaction
-        .get(&key, false)
-        .await?
-        .expect("Could not found a row");
-
-    let name: String = unpack(&user).expect("Could not unpack");
-    Ok(User {
-        id: user_id.to_string(),
-        zipcode: zipcode.to_string(),
-        name,
-    })
-}
-
-async fn search_user_by_zipcode(
-    db: &Database,
-    user_subspace: &Subspace,
-    zipcode_index: &Subspace,
-    zipcode: &str,
-) -> Result<Vec<User>, FdbBindingError> {
-    db.run(|trx, _maybe_committed| async move {
-        // Create scanning zipcode index range
-        let begin = zipcode_index.pack(&(zipcode));
-
-        let mut end = zipcode_index.pack(&(zipcode));
-        end.pop();
-        end.push(255_u8);
-
-        let range = RangeOption::from((begin, end));
-
-        let mut users = vec![];
-        let mut stream = trx.get_ranges_keyvalues(range, false);
-        while let Some(result) = stream.try_next().await? {
-            let (zipcode, id): (String, String) = zipcode_index
-                .unpack(result.key())
-                .expect("Unable to unpack value from index");
-
-            let result_user = get_user(user_subspace, &trx, &id, &zipcode).await;
-
-            if let Ok(user) = result_user {
-                users.push(user);
-            }
-        }
-
-        Ok(users)
-    })
-    .await
-}
-
-#[tokio::main]
-async fn main() {
-    foundationdb::boot().expect("failed to initialize FoundationDB");
-    // The network is stopped and joined automatically at process exit, which is
-    // fine for tests and short-lived tools like this example. In a production
-    // application, prefer a clean teardown: the network thread is the event loop
-    // driving every transaction and you may still have on-going operations at
-    // exit time. Finish or cancel your work, drop the Database handles, then
-    // call `foundationdb::api::stop_network()` yourself (terminal: any
-    // FoundationDB use afterwards fails with error 2025).
-    let db = Database::new_compat(None)
-        .await
-        .expect("failed to get database");
-    db.set_option(foundationdb::options::DatabaseOption::TransactionTimeout(
-        5000,
-    ))
-    .expect("failed to set transaction timeout");
-    db.set_option(foundationdb::options::DatabaseOption::TransactionRetryLimit(3))
-        .expect("failed to set transaction retry limit");
-
-    let user_subspace = Subspace::from_bytes("user");
-    let zipcode_index_subspace = Subspace::from_bytes("zipcode_index");
-
-    clear_subspaces(
-        &db,
-        &[user_subspace.clone(), zipcode_index_subspace.clone()],
-    )
-    .await;
-
-    populate_users(&db, &user_subspace, &zipcode_index_subspace)
-        .await
-        .expect("Unable to populate database");
-
-    let users = search_user_by_zipcode(&db, &user_subspace, &zipcode_index_subspace, "205").await;
-
-    match users {
-        Ok(users) => users.iter().for_each(|user| println!("{user}")),
-        Err(e) => eprintln!("Error searching users: {e}"),
-    }
-}
-
-async fn populate_users(
-    db: &Database,
-    user_subspace: &Subspace,
-    zipcode_index_subspace: &Subspace,
-) -> Result<(), FdbBindingError> {
-    db.run(|trx, _maybe_committed| async move {
-        create_user(
-            &trx,
-            "001",
-            "20500",
-            "Barack",
-            user_subspace,
-            zipcode_index_subspace,
-        )
-        .await;
-        create_user(
-            &trx,
-            "002",
-            "20500",
-            "Michelle",
-            user_subspace,
-            zipcode_index_subspace,
-        )
-        .await;
-        create_user(
-            &trx,
-            "003",
-            "20500",
-            "Sasha",
-            user_subspace,
-            zipcode_index_subspace,
-        )
-        .await;
-        create_user(
-            &trx,
-            "004",
-            "20500",
-            "Malia",
-            user_subspace,
-            zipcode_index_subspace,
-        )
-        .await;
-        create_user(
-            &trx,
-            "005",
-            "20500",
-            "Bo",
-            user_subspace,
-            zipcode_index_subspace,
-        )
-        .await;
-        create_user(
-            &trx,
-            "101",
-            "SW1A 1AA",
-            "Elizabeth",
-            user_subspace,
-            zipcode_index_subspace,
-        )
-        .await;
-        create_user(
-            &trx,
-            "102",
-            "SW1A 1AA",
-            "Philip",
-            user_subspace,
-            zipcode_index_subspace,
-        )
-        .await;
-        Ok(())
-    })
-    .await
-}
diff --git a/bindings/rust/foundationdb/src/budget.rs b/bindings/rust/foundationdb/src/budget.rs
deleted file mode 100644
index 17b82fa3610..00000000000
--- a/bindings/rust/foundationdb/src/budget.rs
+++ /dev/null
@@ -1,685 +0,0 @@
-// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Per-attempt usage accounting and the client-side budget.
-//!
-//! Available with the `accounting` Cargo feature. Without it, transactions do
-//! not allocate accounting state or count operations and result bytes.
-//!
-//! <div class="warning">
-//!
-//! The budget is a **client-side feature of this Rust binding**, not a native
-//! FoundationDB limit. Nothing here is enforced by the cluster: the binding
-//! counts the bytes and calls that go through [`Transaction`](crate::Transaction)
-//! and compares them with the configured limits when you ask it to, with
-//! [`Transaction::check_client_budget`](crate::Transaction::check_client_budget).
-//! The numbers are therefore an **estimate**, checked *between* operations:
-//! a single operation can overshoot a limit, and reads that are still in flight
-//! are not counted yet.
-//!
-//! It is fully decoupled from
-//! [`TransactionOption::Timeout`](crate::options::TransactionOption::Timeout) and
-//! [`TransactionOption::SizeLimit`](crate::options::TransactionOption::SizeLimit),
-//! which are enforced by the C client. Use those to bound what the database
-//! does; use the budget to bound what your own code does before it reaches
-//! them.
-//!
-//! </div>
-//!
-//! # Per-attempt semantics
-//!
-//! With this feature enabled, accounting covers each *transaction attempt*: usage
-//! is reset whenever the transaction restarts (`on_error`, `reset`), while the
-//! configured limits survive and apply to the new attempt. A retried
-//! transaction therefore gets a fresh time and byte allowance, exactly like it
-//! gets a fresh read version.
-//!
-//! # Determinism and simulation
-//!
-//! The byte and call counters are deterministic: they depend only on the
-//! operations your code issues. [`ClientBudget::time_limit`] is not, unless you
-//! say where time comes from: give the budget a [`Clock`] with
-//! [`ClientBudget::with_clock`] and every elapsed time of the attempt is
-//! measured with it. Under FoundationDB's deterministic simulator, pass a clock
-//! backed by simulated time so that a run replays identically.
-//!
-//! Without one the [`WallClock`] is used, which is the right default outside
-//! simulation but makes time budgets non-reproducible: do not rely on them in a
-//! simulated workload. See [`crate::env`] for the whole picture.
-
-use std::collections::HashMap;
-use std::fmt;
-use std::sync::Arc;
-use std::sync::Mutex;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::Duration;
-
-use crate::env::{Clock, WallClock};
-use crate::metrics::MetricKey;
-
-/// Client-side limits applied to a single transaction attempt.
-///
-/// Each field is optional, `None` meaning "no limit". A default `ClientBudget`
-/// limits nothing.
-///
-/// See the [module documentation](self): these limits are computed by the
-/// binding from what it observes, not enforced by FoundationDB.
-///
-/// # Example
-///
-/// ```
-/// # use foundationdb::*;
-/// # use std::time::Duration;
-/// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
-/// # let db = Database::default()?;
-/// let trx = db.create_trx()?;
-/// trx.set_client_budget(ClientBudget {
-///     time_limit: Some(Duration::from_secs(2)),
-///     max_bytes_read: Some(10 * 1024 * 1024),
-///     ..ClientBudget::default()
-/// });
-/// # Ok(())
-/// # }
-/// ```
-#[derive(Debug, Clone, Default)]
-pub struct ClientBudget {
-    /// Maximum time an attempt may spend, measured from the start of the attempt
-    /// with the [`clock`](Self::clock) of this budget.
-    pub time_limit: Option<Duration>,
-    /// Maximum number of bytes read by an attempt, keys and values summed.
-    pub max_bytes_read: Option<u64>,
-    /// Maximum number of bytes written by an attempt, keys, values and mutation
-    /// parameters summed.
-    pub max_bytes_written: Option<u64>,
-    /// Where [`time_limit`](Self::time_limit) reads time from, `None` meaning
-    /// the [`WallClock`].
-    ///
-    /// Set it with [`with_clock`](Self::with_clock) to keep time budgets
-    /// deterministic, see the [module documentation](self).
-    pub clock: Option<Arc<dyn Clock>>,
-}
-
-impl ClientBudget {
-    /// Measures the attempts with `clock` instead of the [`WallClock`].
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(self, clock))
-    )]
-    pub fn with_clock(self, clock: impl Clock + 'static) -> Self {
-        Self {
-            clock: Some(Arc::new(clock)),
-            ..self
-        }
-    }
-
-    /// Checks `usage` against these limits, returning the first exceeded one.
-    pub(crate) fn check(&self, usage: &AttemptUsage) -> Result<(), BudgetExceeded> {
-        if let Some(limit) = self.time_limit {
-            let used = usage.elapsed().as_millis() as u64;
-            let limit = limit.as_millis() as u64;
-            if used > limit {
-                return Err(BudgetExceeded {
-                    kind: BudgetKind::Time,
-                    used,
-                    limit,
-                });
-            }
-        }
-
-        if let Some(limit) = self.max_bytes_read {
-            let used = usage.bytes_read();
-            if used > limit {
-                return Err(BudgetExceeded {
-                    kind: BudgetKind::BytesRead,
-                    used,
-                    limit,
-                });
-            }
-        }
-
-        if let Some(limit) = self.max_bytes_written {
-            let used = usage.bytes_written();
-            if used > limit {
-                return Err(BudgetExceeded {
-                    kind: BudgetKind::BytesWritten,
-                    used,
-                    limit,
-                });
-            }
-        }
-
-        Ok(())
-    }
-}
-
-/// Which [`ClientBudget`] limit was exceeded.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum BudgetKind {
-    /// [`ClientBudget::time_limit`], in milliseconds.
-    Time,
-    /// [`ClientBudget::max_bytes_read`], in bytes.
-    BytesRead,
-    /// [`ClientBudget::max_bytes_written`], in bytes.
-    BytesWritten,
-}
-
-impl fmt::Display for BudgetKind {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            BudgetKind::Time => write!(f, "time"),
-            BudgetKind::BytesRead => write!(f, "bytes read"),
-            BudgetKind::BytesWritten => write!(f, "bytes written"),
-        }
-    }
-}
-
-/// A [`ClientBudget`] limit was exceeded by the current transaction attempt.
-///
-/// `used` and `limit` are expressed in milliseconds for [`BudgetKind::Time`],
-/// in bytes otherwise.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct BudgetExceeded {
-    /// The limit that was exceeded.
-    pub kind: BudgetKind,
-    /// What the attempt used, milliseconds for [`BudgetKind::Time`], bytes
-    /// otherwise.
-    pub used: u64,
-    /// The configured limit, in the same unit as `used`.
-    pub limit: u64,
-}
-
-impl fmt::Display for BudgetExceeded {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let unit = match self.kind {
-            BudgetKind::Time => "ms",
-            BudgetKind::BytesRead | BudgetKind::BytesWritten => "bytes",
-        };
-        write!(
-            f,
-            "client budget exceeded ({}): used {} {}, limit {} {}. This is a client-side estimate of this binding, not a FoundationDB limit",
-            self.kind, self.used, unit, self.limit, unit
-        )
-    }
-}
-
-impl std::error::Error for BudgetExceeded {}
-
-/// Usage accounted for a single transaction attempt.
-///
-/// Counters are incremented by [`Transaction`](crate::Transaction) as
-/// operations are issued (writes) or resolved (reads). With `accounting`
-/// enabled, no metrics collector is required to get them.
-///
-/// A new instance is created for every attempt, see the
-/// [module documentation](self).
-///
-/// The application metrics recorded with
-/// [`Transaction::set_custom_metric`](crate::Transaction::set_custom_metric) are
-/// stored here too, and are therefore per-attempt as well. Their map is
-/// allocated on first use, so a transaction that never records one pays
-/// nothing. Without a metrics consumer collecting them (typically
-/// [`Database::instrumented_run`](crate::Database::instrumented_run)), they are
-/// simply dropped with the generation.
-#[derive(Debug)]
-pub struct AttemptUsage {
-    /// Where the elapsed time of this attempt is measured.
-    clock: Arc<dyn Clock>,
-    /// The monotonic reading taken when the attempt started.
-    started_at: Duration,
-    bytes_read: AtomicU64,
-    bytes_written: AtomicU64,
-    keys_values_fetched: AtomicU64,
-    call_get: AtomicU64,
-    call_get_range: AtomicU64,
-    call_set: AtomicU64,
-    call_clear: AtomicU64,
-    call_clear_range: AtomicU64,
-    call_atomic_op: AtomicU64,
-    /// Application metrics of this attempt, allocated on first use.
-    custom: Mutex<Option<HashMap<MetricKey, u64>>>,
-}
-
-impl Default for AttemptUsage {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl AttemptUsage {
-    /// Starts a new, empty accounting generation, measured with the
-    /// [`WallClock`].
-    pub fn new() -> Self {
-        Self::with_clock(None)
-    }
-
-    /// Starts a new, empty accounting generation measured with `clock`, or with
-    /// the [`WallClock`] when it is `None`.
-    pub(crate) fn with_clock(clock: Option<Arc<dyn Clock>>) -> Self {
-        let clock = clock.unwrap_or_else(|| Arc::new(WallClock::new()));
-        Self {
-            started_at: clock.monotonic(),
-            clock,
-            bytes_read: AtomicU64::new(0),
-            bytes_written: AtomicU64::new(0),
-            keys_values_fetched: AtomicU64::new(0),
-            call_get: AtomicU64::new(0),
-            call_get_range: AtomicU64::new(0),
-            call_set: AtomicU64::new(0),
-            call_clear: AtomicU64::new(0),
-            call_clear_range: AtomicU64::new(0),
-            call_atomic_op: AtomicU64::new(0),
-            custom: Mutex::new(None),
-        }
-    }
-
-    /// Time elapsed since the attempt started, measured with the clock the
-    /// attempt was stamped with.
-    ///
-    /// A clock that goes backwards yields zero rather than panicking.
-    pub fn elapsed(&self) -> Duration {
-        self.clock.monotonic().saturating_sub(self.started_at)
-    }
-
-    /// Bytes read so far, keys and values summed.
-    pub fn bytes_read(&self) -> u64 {
-        self.bytes_read.load(Ordering::Relaxed)
-    }
-
-    /// Bytes written so far, keys, values and mutation parameters summed.
-    pub fn bytes_written(&self) -> u64 {
-        self.bytes_written.load(Ordering::Relaxed)
-    }
-
-    /// Takes a consistent-enough copy of every counter.
-    ///
-    /// Counters are read one after the other without a lock, so a snapshot
-    /// taken while operations are completing may mix values from slightly
-    /// different instants.
-    pub fn snapshot(&self) -> UsageSnapshot {
-        UsageSnapshot {
-            elapsed: self.elapsed(),
-            bytes_read: self.bytes_read.load(Ordering::Relaxed),
-            bytes_written: self.bytes_written.load(Ordering::Relaxed),
-            keys_values_fetched: self.keys_values_fetched.load(Ordering::Relaxed),
-            call_get: self.call_get.load(Ordering::Relaxed),
-            call_get_range: self.call_get_range.load(Ordering::Relaxed),
-            call_set: self.call_set.load(Ordering::Relaxed),
-            call_clear: self.call_clear.load(Ordering::Relaxed),
-            call_clear_range: self.call_clear_range.load(Ordering::Relaxed),
-            call_atomic_op: self.call_atomic_op.load(Ordering::Relaxed),
-        }
-    }
-
-    /// Records a resolved `get` or `get_key`.
-    pub(crate) fn record_get(&self, bytes: u64, keys_values: u64) {
-        self.bytes_read.fetch_add(bytes, Ordering::Relaxed);
-        self.keys_values_fetched
-            .fetch_add(keys_values, Ordering::Relaxed);
-        self.call_get.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Records a resolved `get_range` batch.
-    pub(crate) fn record_get_range(&self, bytes: u64, keys_values: u64) {
-        self.bytes_read.fetch_add(bytes, Ordering::Relaxed);
-        self.keys_values_fetched
-            .fetch_add(keys_values, Ordering::Relaxed);
-        self.call_get_range.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Records a `set`.
-    pub(crate) fn record_set(&self, bytes: u64) {
-        self.bytes_written.fetch_add(bytes, Ordering::Relaxed);
-        self.call_set.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Records a `clear`.
-    pub(crate) fn record_clear(&self, bytes: u64) {
-        self.bytes_written.fetch_add(bytes, Ordering::Relaxed);
-        self.call_clear.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Records a `clear_range`.
-    pub(crate) fn record_clear_range(&self, bytes: u64) {
-        self.bytes_written.fetch_add(bytes, Ordering::Relaxed);
-        self.call_clear_range.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Records an `atomic_op`.
-    pub(crate) fn record_atomic_op(&self, bytes: u64) {
-        self.bytes_written.fetch_add(bytes, Ordering::Relaxed);
-        self.call_atomic_op.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Sets an application metric of this attempt, replacing any previous value.
-    pub(crate) fn set_custom(&self, key: MetricKey, value: u64) {
-        self.with_custom(|custom| {
-            custom.insert(key, value);
-        });
-    }
-
-    /// Adds `amount` to an application metric of this attempt, starting from
-    /// zero if it was not recorded yet.
-    pub(crate) fn increment_custom(&self, key: MetricKey, amount: u64) {
-        self.with_custom(|custom| {
-            *custom.entry(key).or_insert(0) += amount;
-        });
-    }
-
-    /// The application metrics recorded during this attempt.
-    pub fn custom_metrics(&self) -> HashMap<MetricKey, u64> {
-        self.custom
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .clone()
-            .unwrap_or_default()
-    }
-
-    fn with_custom<R>(&self, f: impl FnOnce(&mut HashMap<MetricKey, u64>) -> R) -> R {
-        let mut custom = self
-            .custom
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner());
-        f(custom.get_or_insert_with(HashMap::new))
-    }
-}
-
-/// A copy of the counters of a single transaction attempt, taken by
-/// [`AttemptUsage::snapshot`] or
-/// [`Transaction::attempt_usage`](crate::Transaction::attempt_usage).
-///
-/// Every byte count is a client-side estimate, see the
-/// [module documentation](self).
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
-pub struct UsageSnapshot {
-    /// Time elapsed since the attempt started.
-    pub elapsed: Duration,
-    /// Bytes read: for each resolved read, the key(s) requested plus the
-    /// key-values returned.
-    pub bytes_read: u64,
-    /// Bytes written: keys, values and mutation parameters handed to the
-    /// client. For `clear_range` only the two boundary keys are counted, **not**
-    /// the volume of data the range deletes.
-    pub bytes_written: u64,
-    /// Number of key-values returned by resolved reads.
-    pub keys_values_fetched: u64,
-    /// Number of `get` and `get_key` calls resolved.
-    pub call_get: u64,
-    /// Number of `get_range` batches resolved. A single `get_ranges` stream
-    /// counts once per underlying FoundationDB batch, not once per stream.
-    pub call_get_range: u64,
-    /// Number of `set` calls.
-    pub call_set: u64,
-    /// Number of `clear` calls.
-    pub call_clear: u64,
-    /// Number of `clear_range` calls.
-    pub call_clear_range: u64,
-    /// Number of `atomic_op` calls.
-    pub call_atomic_op: u64,
-}
-
-/// The accounting generation currently active on a transaction.
-///
-/// Operations clone the `Arc` out of the slot when they are **issued** and
-/// record into that clone when they complete. Starting a new attempt swaps the
-/// slot with a fresh [`AttemptUsage`] instead of zeroing the current one, so a
-/// read issued during attempt N that completes during attempt N+1 records into
-/// the counters of attempt N, which nobody reads anymore, and cannot pollute
-/// N+1.
-#[derive(Debug, Default)]
-pub(crate) struct UsageSlot(Mutex<Arc<AttemptUsage>>);
-
-impl UsageSlot {
-    /// The generation to record into for an operation issued now.
-    pub(crate) fn current(&self) -> Arc<AttemptUsage> {
-        self.0
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .clone()
-    }
-
-    /// Starts a fresh generation measured with `clock` (the [`WallClock`] when
-    /// `None`), leaving the previous one to the in-flight operations still
-    /// holding it.
-    pub(crate) fn begin(&self, clock: Option<Arc<dyn Clock>>) {
-        let mut slot = self
-            .0
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner());
-        *slot = Arc::new(AttemptUsage::with_clock(clock));
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// A clock the test moves by hand, in milliseconds.
-    #[derive(Debug, Clone, Default)]
-    struct FakeClock(Arc<AtomicU64>);
-
-    impl FakeClock {
-        fn set_millis(&self, millis: u64) {
-            self.0.store(millis, Ordering::Relaxed);
-        }
-    }
-
-    impl Clock for FakeClock {
-        fn monotonic(&self) -> Duration {
-            Duration::from_millis(self.0.load(Ordering::Relaxed))
-        }
-
-        fn wall(&self) -> Duration {
-            self.monotonic()
-        }
-    }
-
-    #[test]
-    fn budget_without_limits_never_fails() {
-        let usage = AttemptUsage::new();
-        usage.record_get(1_000_000, 10);
-        usage.record_set(1_000_000);
-
-        assert!(ClientBudget::default().check(&usage).is_ok());
-    }
-
-    #[test]
-    fn budget_allows_usage_up_to_the_limit() {
-        let budget = ClientBudget {
-            max_bytes_read: Some(10),
-            max_bytes_written: Some(10),
-            ..ClientBudget::default()
-        };
-
-        let usage = AttemptUsage::new();
-        usage.record_get(10, 1);
-        usage.record_set(10);
-
-        assert!(budget.check(&usage).is_ok());
-    }
-
-    #[test]
-    fn budget_reports_exceeded_bytes_read() {
-        let budget = ClientBudget {
-            max_bytes_read: Some(10),
-            ..ClientBudget::default()
-        };
-
-        let usage = AttemptUsage::new();
-        usage.record_get(7, 1);
-        assert!(budget.check(&usage).is_ok());
-        usage.record_get_range(5, 2);
-
-        let err = budget.check(&usage).unwrap_err();
-        assert_eq!(err.kind, BudgetKind::BytesRead);
-        assert_eq!(err.used, 12);
-        assert_eq!(err.limit, 10);
-        assert!(err.to_string().contains("client-side estimate"));
-    }
-
-    #[test]
-    fn budget_reports_exceeded_bytes_written() {
-        let budget = ClientBudget {
-            max_bytes_written: Some(4),
-            ..ClientBudget::default()
-        };
-
-        let usage = AttemptUsage::new();
-        usage.record_set(2);
-        usage.record_clear(1);
-        usage.record_clear_range(1);
-        assert!(budget.check(&usage).is_ok());
-        usage.record_atomic_op(1);
-
-        let err = budget.check(&usage).unwrap_err();
-        assert_eq!(err.kind, BudgetKind::BytesWritten);
-        assert_eq!(err.used, 5);
-        assert_eq!(err.limit, 4);
-    }
-
-    #[test]
-    fn budget_reports_exceeded_time() {
-        let clock = FakeClock::default();
-        clock.set_millis(1_000);
-
-        let budget = ClientBudget {
-            time_limit: Some(Duration::from_millis(20)),
-            ..ClientBudget::default()
-        }
-        .with_clock(clock.clone());
-
-        let usage = AttemptUsage::with_clock(budget.clock.clone());
-        clock.set_millis(1_020);
-        assert!(budget.check(&usage).is_ok(), "the limit itself is allowed");
-
-        clock.set_millis(1_035);
-
-        let err = budget.check(&usage).unwrap_err();
-        assert_eq!(err.kind, BudgetKind::Time);
-        assert_eq!(err.used, 35);
-        assert_eq!(err.limit, 20);
-        assert!(err.to_string().contains("client-side estimate"));
-    }
-
-    #[test]
-    fn elapsed_follows_a_custom_clock() {
-        let clock = FakeClock::default();
-        clock.set_millis(500);
-
-        let usage = AttemptUsage::with_clock(Some(Arc::new(clock.clone())));
-        assert_eq!(usage.elapsed(), Duration::ZERO);
-
-        clock.set_millis(700);
-        assert_eq!(usage.elapsed(), Duration::from_millis(200));
-        assert_eq!(usage.snapshot().elapsed, Duration::from_millis(200));
-    }
-
-    #[test]
-    fn a_clock_going_backwards_saturates_to_zero() {
-        let clock = FakeClock::default();
-        clock.set_millis(1_000);
-
-        let usage = AttemptUsage::with_clock(Some(Arc::new(clock.clone())));
-        clock.set_millis(10);
-
-        assert_eq!(usage.elapsed(), Duration::ZERO);
-    }
-
-    #[test]
-    fn a_new_generation_is_stamped_with_the_given_clock() {
-        let clock = FakeClock::default();
-        clock.set_millis(100);
-
-        let slot = UsageSlot::default();
-        let previous = slot.current();
-
-        slot.begin(Some(Arc::new(clock.clone())));
-        let current = slot.current();
-        clock.set_millis(160);
-
-        assert_eq!(current.elapsed(), Duration::from_millis(60));
-        // The previous generation keeps the wall clock it was stamped with.
-        assert!(previous.elapsed() < Duration::from_millis(60));
-    }
-
-    #[test]
-    fn snapshot_counts_every_operation() {
-        let usage = AttemptUsage::new();
-        usage.record_get(3, 1);
-        usage.record_get_range(7, 2);
-        usage.record_set(4);
-        usage.record_clear(5);
-        usage.record_clear_range(6);
-        usage.record_atomic_op(7);
-
-        let snapshot = usage.snapshot();
-        assert_eq!(snapshot.bytes_read, 10);
-        assert_eq!(snapshot.bytes_written, 22);
-        assert_eq!(snapshot.keys_values_fetched, 3);
-        assert_eq!(snapshot.call_get, 1);
-        assert_eq!(snapshot.call_get_range, 1);
-        assert_eq!(snapshot.call_set, 1);
-        assert_eq!(snapshot.call_clear, 1);
-        assert_eq!(snapshot.call_clear_range, 1);
-        assert_eq!(snapshot.call_atomic_op, 1);
-    }
-
-    #[test]
-    fn custom_metrics_are_scoped_to_the_generation() {
-        let slot = UsageSlot::default();
-        let key = MetricKey::new("documents", &[("kind", "user")]);
-
-        assert!(slot.current().custom_metrics().is_empty());
-
-        slot.current().set_custom(key.clone(), 2);
-        slot.current().increment_custom(key.clone(), 3);
-        assert_eq!(slot.current().custom_metrics().get(&key), Some(&5));
-
-        let previous = slot.current();
-        slot.begin(None);
-
-        assert!(slot.current().custom_metrics().is_empty());
-        assert_eq!(previous.custom_metrics().get(&key), Some(&5));
-    }
-
-    #[test]
-    fn a_new_generation_starts_empty() {
-        let slot = UsageSlot::default();
-        slot.current().record_set(42);
-        assert_eq!(slot.current().snapshot().bytes_written, 42);
-
-        slot.begin(None);
-
-        let snapshot = slot.current().snapshot();
-        assert_eq!(
-            UsageSnapshot {
-                elapsed: Duration::ZERO,
-                ..snapshot
-            },
-            UsageSnapshot::default()
-        );
-    }
-
-    #[test]
-    fn a_stale_generation_does_not_pollute_the_next_one() {
-        let slot = UsageSlot::default();
-
-        // An operation issued during the first attempt, still in flight.
-        let in_flight = slot.current();
-
-        slot.begin(None);
-        slot.current().record_get(10, 1);
-
-        // The stale operation completes and records into its own generation.
-        in_flight.record_get(999, 99);
-
-        let snapshot = slot.current().snapshot();
-        assert_eq!(snapshot.bytes_read, 10);
-        assert_eq!(snapshot.keys_values_fetched, 1);
-        assert_eq!(snapshot.call_get, 1);
-        assert_eq!(in_flight.snapshot().bytes_read, 999);
-    }
-}
diff --git a/bindings/rust/foundationdb/src/database.rs b/bindings/rust/foundationdb/src/database.rs
index 01a227c1058..9b6604033b1 100644
--- a/bindings/rust/foundationdb/src/database.rs
+++ b/bindings/rust/foundationdb/src/database.rs
@@ -20,16 +20,11 @@ use fdb_sys::if_cfg_api_versions;
 use foundationdb_macros::cfg_api_versions;
 use foundationdb_sys as fdb_sys;
 
-#[cfg(feature = "accounting")]
-use crate::metrics::{MetricsReport, TransactionMetrics};
 use crate::options;
-#[cfg(feature = "accounting")]
-use crate::runner::MetricsHooks;
-use crate::runner::{RunnerHooks, TransactionRunner};
 use crate::transaction::*;
 use crate::{FdbError, FdbResult, error};
 
-use crate::error::RetryableError;
+use crate::error::{FdbBindingError, find_fdb_error};
 use futures::prelude::*;
 
 /// Whether any earlier attempt in this run may have committed.
@@ -358,27 +353,16 @@ impl Database {
     ///
     /// # Typed closure errors
     ///
-    /// The closure error type `E` is generic: any type implementing
-    /// [`RetryableError`](crate::RetryableError) works, and the caller gets it
-    /// back typed. Errors are classified through
-    /// [`RetryableError::retry_decision`](crate::RetryableError::retry_decision):
-    /// by default any error that is, or wraps (through `source()`), an
-    /// [`FdbError`] is handed to `on_error`, which judges retryability and
-    /// applies backoff; [`RetryDecision::Retry`](crate::RetryDecision::Retry)
-    /// is routed through `on_error` with code 1020 (not_committed), so backoff
-    /// and [`options::TransactionOption::RetryLimit`] apply uniformly and
-    /// `MaybeCommitted` is left untouched. When retries are exhausted or the
-    /// error is not retryable, the original closure error is returned as-is.
+    /// The closure may return [`FdbBindingError`] or another error type that
+    /// preserves an [`FdbError`] in its [`source()`](std::error::Error::source)
+    /// chain. Native `on_error` decides whether to retry and applies backoff,
+    /// timeout, and retry limits. A fatal closure error or exhausted retry is
+    /// returned with its original type and context.
     ///
+    /// The error type must also implement `From<FdbBindingError>` so that
+    /// transaction creation, commit, and ownership errors can be returned.
     /// A closure that never names an error type is ambiguous; pin it on the
     /// tail expression, for example `Ok::<_, FdbBindingError>(value)`.
-    ///
-    /// # Hooks and retry policy
-    ///
-    /// This is [`runner()`](Self::runner) with its defaults: no hooks and the
-    /// native retry policy. Use the builder to observe the run with
-    /// [`RunnerHooks`] or to decide the retries with a
-    /// [`RetryPolicy`](crate::runner::RetryPolicy).
     #[cfg_attr(
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, closure))
@@ -387,105 +371,38 @@ impl Database {
     where
         F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
         Fut: Future<Output = Result<T, E>>,
-        E: RetryableError,
-    {
-        self.runner().run(closure).await
-    }
-
-    /// A builder for a transactional run, to plug [`RunnerHooks`] and a
-    /// [`RetryPolicy`](crate::runner::RetryPolicy) into it.
-    ///
-    /// ```no_run
-    /// # use foundationdb::*;
-    /// # struct Hooks;
-    /// # impl RunnerHooks for Hooks {}
-    /// # async fn example(db: &Database) -> Result<(), FdbBindingError> {
-    /// db.runner()
-    ///     .hooks(&Hooks)
-    ///     .run(|trx, _| async move {
-    ///         trx.set(b"key", b"value");
-    ///         Ok::<_, FdbBindingError>(())
-    ///     })
-    ///     .await
-    /// # }
-    /// ```
-    pub fn runner(&self) -> TransactionRunner<'_> {
-        TransactionRunner::new(self)
-    }
-
-    /// Runs a transactional function against this Database with retry logic and custom hooks.
-    ///
-    /// Sugar for `db.runner().hooks(hooks).run(closure)`. Stack several hooks
-    /// with a tuple: `db.run_with_hooks(&(first, second), closure)`.
-    ///
-    /// See [`RunnerHooks`] for what each hook observes and in which order.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(self, hooks, closure))
-    )]
-    pub async fn run_with_hooks<'a, F, Fut, T, E, H: RunnerHooks>(
-        &'a self,
-        hooks: &'a H,
-        closure: F,
-    ) -> Result<T, E>
-    where
-        F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
-        Fut: Future<Output = Result<T, E>>,
-        E: RetryableError,
-    {
-        self.runner().hooks(hooks).run(closure).await
-    }
-
-    /// Runs a transactional function against this Database with retry logic and metrics collection.
-    /// Available with the `accounting` Cargo feature.
-    /// The associated closure will be called until a non-retryable FDBError
-    /// is thrown or commit() returns success.
-    ///
-    /// This method is similar to `run()` but additionally collects and returns metrics about
-    /// the transaction execution, including operation counts, bytes read/written, and retry counts.
-    /// It is [`MetricsHooks`] plugged into [`runner()`](Self::runner): stack them
-    /// on your own hooks with `db.run_with_hooks(&(MetricsHooks::new(&metrics), my_hooks), closure)`
-    /// to get the same report out of a run you observe yourself.
-    ///
-    /// # Arguments
-    /// * `closure` - A function that takes a RetryableTransaction and MaybeCommitted flag and returns a Future
-    ///
-    /// # Returns
-    /// * `Result<(T, Metrics), (FdbBindingError, Metrics)>` - On success, returns the result of the transaction and collected metrics.
-    ///   On failure, returns the error and the metrics collected up to the point of failure.
-    ///
-    /// # Warning: retry
-    ///
-    /// It might retry indefinitely if the transaction is highly contentious. It is recommended to
-    /// set [`options::TransactionOption::RetryLimit`] or [`options::TransactionOption::Timeout`] on the transaction
-    /// if the task needs to be guaranteed to finish.
-    ///
-    /// # Warning: Maybe committed transactions
-    ///
-    /// As with other client/server databases, in some failure scenarios a client may be unable to determine
-    /// whether a transaction succeeded. The closure receives a [`MaybeCommitted`] flag indicating
-    /// whether any earlier attempt in this run may have committed. Once true, it stays true for
-    /// all subsequent attempts.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(self, closure))
-    )]
-    #[cfg(feature = "accounting")]
-    pub async fn instrumented_run<F, Fut, T, E>(
-        &self,
-        closure: F,
-    ) -> Result<(T, MetricsReport), (E, MetricsReport)>
-    where
-        F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
-        Fut: Future<Output = Result<T, E>>,
-        E: RetryableError,
+        E: std::error::Error + Send + Sync + 'static + From<FdbBindingError>,
     {
-        let metrics = TransactionMetrics::new();
-        let hooks = MetricsHooks::new(&metrics);
+        let mut transaction = self.create_retryable_trx().map_err(FdbBindingError::from)?;
+        let mut maybe_committed = false;
 
-        match self.runner().hooks(&hooks).run(closure).await {
-            Ok(value) => Ok((value, metrics.get_metrics_data())),
-            Err(err) => Err((err, metrics.get_metrics_data())),
+        loop {
+            let value =
+                match closure(transaction.clone(), MaybeCommitted::new(maybe_committed)).await {
+                    Ok(value) => value,
+                    Err(error) => {
+                        let Some(fdb_error) = find_fdb_error(&error) else {
+                            return Err(error);
+                        };
+                        // Later errors cannot resolve an earlier uncertain commit.
+                        maybe_committed |= fdb_error.is_maybe_committed();
+                        transaction = match transaction.on_error(fdb_error).await? {
+                            Ok(transaction) => transaction,
+                            Err(_) => return Err(error),
+                        };
+                        continue;
+                    }
+                };
+
+            match transaction.commit().await? {
+                Ok(_) => return Ok(value),
+                Err(error) => {
+                    maybe_committed |= error.is_maybe_committed();
+                    transaction = RetryableTransaction::new(
+                        error.on_error().await.map_err(FdbBindingError::from)?,
+                    );
+                }
+            }
         }
     }
 
diff --git a/bindings/rust/foundationdb/src/env.rs b/bindings/rust/foundationdb/src/env.rs
deleted file mode 100644
index faa7e7de231..00000000000
--- a/bindings/rust/foundationdb/src/env.rs
+++ /dev/null
@@ -1,373 +0,0 @@
-// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Pluggable sources for the effects that must stay deterministic under
-//! FoundationDB simulation: time and randomness.
-//!
-//! # Why control flow must not read ambient time or randomness
-//!
-//! The deterministic simulator virtualizes both: it decides what time it is and
-//! which pseudo-random choices are made, which is precisely what lets it replay
-//! a failing run from a seed. Code that calls `Instant::now()` or draws from a
-//! thread-local generator steps outside that control, so its behavior changes
-//! from run to run and a bug found in simulation cannot be reproduced.
-//!
-//! The way out is to take time and randomness as dependencies instead of
-//! reaching for them: [`Clock`] and [`Rng`], bundled in an [`Environment`].
-//! Production code uses [`WallClock`] and [`SeededRng`], which do the obvious
-//! thing. Simulation workloads pass implementations backed by the simulator,
-//! provided by the `foundationdb-simulation` crate.
-//!
-//! Ambient wall-clock time remains fine for purely observational output, metrics
-//! durations or log timestamps that nothing branches on.
-//!
-//! # Measure with monotonic, persist with wall
-//!
-//! [`Clock`] offers two readings and they are not interchangeable.
-//! [`Clock::monotonic`] never goes backwards but counts from an epoch private to
-//! that one instance, so it is the right and only choice for durations,
-//! deadlines, budgets and backoff. [`Clock::wall`] is a real timestamp, counted
-//! from the UNIX epoch, so it is the right choice for anything written to the
-//! database or compared across processes, at the cost of being able to jump when
-//! the machine clock is adjusted.
-//!
-//! Never persist a monotonic reading and never compare two of them coming from
-//! different [`Clock`] instances: the values are meaningless outside the
-//! instance that produced them.
-//!
-//! # Drawing a lot of randomness
-//!
-//! [`Rng`] is deliberately minimal, one `u64` per call through a shared
-//! reference. A component that needs a large volume of random data, or
-//! distributions this trait does not offer, should draw a single `u64` and use
-//! it to seed its own local generator (`rand_chacha::ChaCha8Rng::seed_from_u64`
-//! for instance). The run stays reproducible, since the seed came from the
-//! environment, and the heavy sampling stays local and fast.
-//!
-//! # Non-goals
-//!
-//! This module supplies *values*, never control over execution: there is no
-//! sleep and no spawn capability here. Under simulation the caller owns the
-//! schedule: it advances simulated time and re-invokes the deterministic unit of
-//! work. An asynchronous `Timer` capability is planned surface and is
-//! deliberately deferred, so do not work around its absence by sleeping on the
-//! ambient runtime inside code that must be simulable.
-//!
-//! # Known limitation
-//!
-//! Under simulation, wall time is derived from simulated time and therefore
-//! never jumps. Bugs that only appear when the machine clock is stepped by NTP,
-//! a leap second or an operator, cannot be exercised in simulation: exercise
-//! those with a purpose-built [`Clock`] in a unit test instead.
-
-use std::collections::hash_map::RandomState;
-use std::fmt;
-use std::hash::{BuildHasher, Hasher};
-use std::sync::Arc;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
-
-/// Where time comes from.
-///
-/// See the [module documentation](self) for why time is a dependency rather
-/// than something to reach for, and for the rule that decides between the two
-/// readings: measure with [`monotonic`](Self::monotonic), persist with
-/// [`wall`](Self::wall).
-pub trait Clock: fmt::Debug + Send + Sync {
-    /// A monotonic reading, for measuring how much time has passed.
-    ///
-    /// Successive readings never decrease, which makes this the reading to use
-    /// for elapsed times, deadlines, budgets and backoff.
-    ///
-    /// <div class="warning">
-    ///
-    /// The epoch is arbitrary and **private to this instance**. Never persist a
-    /// monotonic reading, and never compare readings taken from two different
-    /// `Clock` instances: only the difference between two readings of the *same*
-    /// instance carries meaning.
-    ///
-    /// </div>
-    fn monotonic(&self) -> Duration;
-
-    /// A wall-clock reading, time elapsed since the UNIX epoch.
-    ///
-    /// This is a real timestamp, comparable across processes and machines, so it
-    /// is the reading to persist in the database or put in a message. In
-    /// production it can jump forwards or backwards when the machine clock is
-    /// adjusted (NTP, a leap second, an operator), so never measure a duration
-    /// with it. Under simulation it is deterministic.
-    fn wall(&self) -> Duration;
-}
-
-/// Where pseudo-random values come from.
-///
-/// See the [module documentation](self) for why randomness is a dependency
-/// rather than something to reach for, and for the pattern to follow when a lot
-/// of randomness is needed.
-///
-/// <div class="warning">
-///
-/// Implementations are **not** cryptographically secure and must not be used to
-/// derive secrets, tokens or keys.
-///
-/// </div>
-pub trait Rng: fmt::Debug + Send + Sync {
-    /// The next value of the sequence, uniform over the whole `u64` range.
-    ///
-    /// This takes `&self` so that a generator can be shared: an implementation
-    /// advances its state through interior mutability.
-    fn next_u64(&self) -> u64;
-
-    /// The next value of the sequence, uniform over the whole `u32` range.
-    ///
-    /// The default implementation truncates [`next_u64`](Self::next_u64).
-    fn next_u32(&self) -> u32 {
-        self.next_u64() as u32
-    }
-}
-
-/// The [`Clock`] of production code, reading the clocks of the machine.
-///
-/// [`monotonic`](Clock::monotonic) counts from the moment the instance was
-/// built, so the first reading of a fresh `WallClock` is close to zero.
-#[derive(Debug, Clone)]
-pub struct WallClock {
-    anchor: Instant,
-}
-
-impl WallClock {
-    /// Builds a clock whose monotonic epoch is now.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug"))]
-    pub fn new() -> Self {
-        Self {
-            anchor: Instant::now(),
-        }
-    }
-}
-
-impl Default for WallClock {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl Clock for WallClock {
-    fn monotonic(&self) -> Duration {
-        self.anchor.elapsed()
-    }
-
-    fn wall(&self) -> Duration {
-        // A system clock set before 1970 is the only way this fails, and no
-        // caller can do anything useful with an error here.
-        SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .unwrap_or(Duration::ZERO)
-    }
-}
-
-/// The [`Rng`] of production code: SplitMix64, seeded once.
-///
-/// [`new`](Self::new) takes the seed, which makes the whole sequence
-/// reproducible: the same seed always yields the same values in the same order.
-/// [`Default`] takes its seed from the entropy the standard library uses to seed
-/// `HashMap`, which is best effort, unpredictable in practice but neither
-/// reproducible nor guaranteed by anything.
-///
-/// <div class="warning">
-///
-/// SplitMix64 is a fast statistical generator, **not** a cryptographic one.
-///
-/// </div>
-#[derive(Debug)]
-pub struct SeededRng {
-    state: AtomicU64,
-}
-
-/// The golden-ratio increment of SplitMix64.
-const SPLITMIX_GAMMA: u64 = 0x9E37_79B9_7F4A_7C15;
-
-impl SeededRng {
-    /// Builds a generator producing the sequence of `seed`, reproducibly.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug"))]
-    pub fn new(seed: u64) -> Self {
-        Self {
-            state: AtomicU64::new(seed),
-        }
-    }
-}
-
-impl Default for SeededRng {
-    fn default() -> Self {
-        Self::new(RandomState::new().build_hasher().finish())
-    }
-}
-
-impl Rng for SeededRng {
-    fn next_u64(&self) -> u64 {
-        // fetch_add hands back the state this call consumed and leaves the next
-        // one in place, so concurrent callers each finalize a distinct value.
-        let z = self.state.fetch_add(SPLITMIX_GAMMA, Ordering::Relaxed);
-        let z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
-        let z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
-        z ^ (z >> 31)
-    }
-}
-
-/// The effects a layer needs but must not reach for: time and randomness.
-///
-/// Cloning is cheap, both sources sit behind an `Arc`, so an `Environment` is
-/// meant to be passed by value into the layers and recipes that need it and kept
-/// alongside the [`Database`](crate::Database).
-///
-/// # Example
-///
-/// ```
-/// # use foundationdb::env::Environment;
-/// // Production: machine clock, generator seeded from entropy.
-/// let env = Environment::default();
-///
-/// // A reproducible run: the same seed replays the same sequence.
-/// let env = Environment::with_seed(42);
-/// let first = env.rng().next_u64();
-/// assert_eq!(Environment::with_seed(42).rng().next_u64(), first);
-/// ```
-#[derive(Clone, Debug)]
-pub struct Environment {
-    clock: Arc<dyn Clock>,
-    rng: Arc<dyn Rng>,
-}
-
-impl Environment {
-    /// Bundles a clock and a generator.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(clock, rng))
-    )]
-    pub fn new(clock: Arc<dyn Clock>, rng: Arc<dyn Rng>) -> Self {
-        Self { clock, rng }
-    }
-
-    /// The machine clock, with a generator replaying the sequence of `seed`.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug"))]
-    pub fn with_seed(seed: u64) -> Self {
-        Self::new(Arc::new(WallClock::new()), Arc::new(SeededRng::new(seed)))
-    }
-
-    /// The clock of this environment.
-    pub fn clock(&self) -> &Arc<dyn Clock> {
-        &self.clock
-    }
-
-    /// The pseudo-random generator of this environment.
-    pub fn rng(&self) -> &Arc<dyn Rng> {
-        &self.rng
-    }
-}
-
-impl Default for Environment {
-    fn default() -> Self {
-        Self::new(Arc::new(WallClock::new()), Arc::new(SeededRng::default()))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn take(rng: &SeededRng, count: usize) -> Vec<u64> {
-        (0..count).map(|_| rng.next_u64()).collect()
-    }
-
-    #[test]
-    fn the_same_seed_produces_the_same_sequence() {
-        let expected = take(&SeededRng::new(42), 16);
-
-        assert_eq!(take(&SeededRng::new(42), 16), expected);
-        assert!(
-            expected.windows(2).any(|pair| pair[0] != pair[1]),
-            "the sequence is constant: {expected:?}"
-        );
-    }
-
-    #[test]
-    fn different_seeds_produce_different_sequences() {
-        assert_ne!(take(&SeededRng::new(42), 16), take(&SeededRng::new(43), 16));
-    }
-
-    #[test]
-    fn next_u32_truncates_next_u64() {
-        let wide = SeededRng::new(7);
-        let narrow = SeededRng::new(7);
-
-        for _ in 0..16 {
-            assert_eq!(narrow.next_u32(), wide.next_u64() as u32);
-        }
-    }
-
-    #[test]
-    fn wall_clock_monotonic_never_goes_backwards() {
-        let clock = WallClock::new();
-
-        let mut previous = clock.monotonic();
-        for _ in 0..1_000 {
-            let now = clock.monotonic();
-            assert!(now >= previous, "{now:?} is before {previous:?}");
-            previous = now;
-        }
-    }
-
-    #[test]
-    fn wall_clock_wall_is_a_real_timestamp() {
-        // Any machine running this test has a clock set past 2020.
-        const YEAR_2020: Duration = Duration::from_secs(1_577_836_800);
-
-        assert!(WallClock::new().wall() > YEAR_2020);
-    }
-
-    #[test]
-    fn the_default_environment_is_usable() {
-        let env = Environment::default();
-
-        assert!(env.clock().monotonic() < Duration::from_secs(1));
-        let drawn: Vec<u64> = (0..4).map(|_| env.rng().next_u64()).collect();
-        assert!(drawn.windows(2).any(|pair| pair[0] != pair[1]));
-
-        // Cloning shares the very same sources.
-        let clone = env.clone();
-        assert!(Arc::ptr_eq(clone.clock(), env.clock()));
-        assert!(Arc::ptr_eq(clone.rng(), env.rng()));
-    }
-
-    #[test]
-    fn a_seeded_environment_replays_its_sequence() {
-        let expected: Vec<u64> = (0..8)
-            .map(|_| Environment::with_seed(99).rng().next_u64())
-            .collect();
-
-        // Every fresh environment restarts the same sequence.
-        assert!(expected.iter().all(|value| *value == expected[0]));
-
-        let env = Environment::with_seed(99);
-        assert_eq!(env.rng().next_u64(), expected[0]);
-        assert_ne!(
-            env.rng().next_u64(),
-            expected[0],
-            "the sequence must advance"
-        );
-    }
-
-    #[test]
-    fn debug_output_names_the_implementations() {
-        assert!(format!("{:?}", WallClock::new()).contains("WallClock"));
-        assert!(format!("{:?}", SeededRng::new(1)).contains("SeededRng"));
-
-        let debug = format!("{:?}", Environment::with_seed(1));
-        assert!(debug.contains("Environment"), "{debug}");
-        assert!(debug.contains("WallClock"), "{debug}");
-        assert!(debug.contains("SeededRng"), "{debug}");
-    }
-}
diff --git a/bindings/rust/foundationdb/src/error.rs b/bindings/rust/foundationdb/src/error.rs
index 2300a61ef37..98918c54e87 100644
--- a/bindings/rust/foundationdb/src/error.rs
+++ b/bindings/rust/foundationdb/src/error.rs
@@ -8,8 +8,6 @@
 
 //! Error types for the Fdb crate
 
-#[cfg(feature = "accounting")]
-use crate::budget::BudgetExceeded;
 use crate::directory::DirectoryError;
 use crate::options;
 use crate::tuple::PackError;
@@ -110,13 +108,6 @@ pub enum FdbBindingError {
     /// Never box a stringified error (`e.to_string().into()`): the conversion
     /// destroys the source chain, and a retryable error becomes fatal.
     CustomError(Box<dyn std::error::Error + Send + Sync>),
-    /// The client-side budget of the transaction attempt was exceeded, as
-    /// reported by [`crate::Transaction::check_client_budget`]
-    #[cfg(feature = "accounting")]
-    ClientBudgetExceeded(BudgetExceeded),
-    #[cfg(feature = "recipes-leader-election")]
-    /// Leader election specific error
-    LeaderElectionError(crate::recipes::leader_election::LeaderElectionError),
 }
 
 /// Walks an error's `source()` chain, returning the first `FdbError` found.
@@ -172,20 +163,6 @@ impl From<DirectoryError> for FdbBindingError {
     }
 }
 
-#[cfg(feature = "accounting")]
-impl From<BudgetExceeded> for FdbBindingError {
-    fn from(e: BudgetExceeded) -> Self {
-        Self::ClientBudgetExceeded(e)
-    }
-}
-
-#[cfg(feature = "recipes-leader-election")]
-impl From<crate::recipes::leader_election::LeaderElectionError> for FdbBindingError {
-    fn from(error: crate::recipes::leader_election::LeaderElectionError) -> Self {
-        Self::LeaderElectionError(error)
-    }
-}
-
 impl FdbBindingError {
     /// create a new custom error
     pub fn new_custom_error(e: Box<dyn std::error::Error + Send + Sync>) -> Self {
@@ -207,10 +184,6 @@ impl Debug for FdbBindingError {
                 write!(f, "Transaction user version allocator exhausted")
             }
             FdbBindingError::CustomError(err) => write!(f, "{err:?}"),
-            #[cfg(feature = "accounting")]
-            FdbBindingError::ClientBudgetExceeded(err) => write!(f, "{err}"),
-            #[cfg(feature = "recipes-leader-election")]
-            FdbBindingError::LeaderElectionError(err) => write!(f, "{err:?}"),
         }
     }
 }
@@ -229,114 +202,8 @@ impl std::error::Error for FdbBindingError {
             Self::DirectoryError(e) => Some(e),
             Self::PackError(e) => Some(e),
             Self::CustomError(e) => Some(e.as_ref()),
-            #[cfg(feature = "accounting")]
-            Self::ClientBudgetExceeded(e) => Some(e),
             Self::ReferenceToTransactionKept => None,
             Self::UserVersionExhausted => None,
-            #[cfg(feature = "recipes-leader-election")]
-            Self::LeaderElectionError(e) => Some(e),
-        }
-    }
-}
-
-/// What the retry loop of [`crate::Database::run`] does with a closure error.
-///
-/// Produced by [`RetryableError::retry_decision`]. In every case the C API
-/// remains the single retry governor: backoff, max retry delay and
-/// `TransactionOption::RetryLimit` are applied by `fdb_transaction_on_error`,
-/// never by a Rust-side budget.
-#[non_exhaustive]
-#[derive(Debug, Clone, Copy)]
-pub enum RetryDecision {
-    /// The error is, or wraps, this `FdbError`: hand it to `on_error` and let
-    /// the C API judge retryability.
-    Fdb(FdbError),
-    /// App-level retry request with no native error underneath (lock
-    /// contention, optimistic-concurrency conditions). Routed through
-    /// `on_error` with code 1020 (not_committed, retryable by definition), so
-    /// backoff and retry limits apply uniformly.
-    Retry,
-    /// Not retryable: the loop returns the original error to the caller as-is.
-    Fatal,
-}
-
-/// What the retry loop of [`crate::Database::run`] asks of a closure error.
-///
-/// The default `retry_decision` walks the `source()` chain looking for an
-/// [`FdbError`], so any error type that keeps its `FdbError` as a source (the
-/// idiomatic thiserror `#[from]`/`#[source]` pattern) is retry-transparent
-/// without overriding anything. Override only to add [`RetryDecision::Retry`]
-/// arms for app-level retry conditions.
-///
-/// The `From` bounds let the loop surface its own failures through your type:
-/// `From<FdbError>` supports `?` on `FdbResult` inside the closure, and
-/// `From<FdbBindingError>` carries loop-level failures such as
-/// [`FdbBindingError::ReferenceToTransactionKept`].
-///
-/// `FdbError` itself cannot implement this trait (there is no lossless
-/// `From<FdbBindingError> for FdbError`); use a wrapper type such as
-/// [`FdbBindingError`] or your own enum.
-///
-/// # Example
-///
-/// ```
-/// use foundationdb::{FdbBindingError, FdbError, RetryableError};
-///
-/// #[derive(Debug)]
-/// enum MyLayerError {
-///     Fdb(FdbError),
-///     Binding(FdbBindingError),
-///     InvalidDocument,
-/// }
-///
-/// impl std::fmt::Display for MyLayerError {
-///     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-///         write!(f, "{self:?}")
-///     }
-/// }
-///
-/// impl std::error::Error for MyLayerError {
-///     fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-///         match self {
-///             Self::Fdb(e) => Some(e),
-///             Self::Binding(e) => Some(e),
-///             Self::InvalidDocument => None,
-///         }
-///     }
-/// }
-///
-/// impl From<FdbError> for MyLayerError {
-///     fn from(e: FdbError) -> Self {
-///         Self::Fdb(e)
-///     }
-/// }
-///
-/// impl From<FdbBindingError> for MyLayerError {
-///     fn from(e: FdbBindingError) -> Self {
-///         Self::Binding(e)
-///     }
-/// }
-///
-/// // The default source() walk makes wrapped FdbErrors retryable.
-/// impl RetryableError for MyLayerError {}
-/// ```
-pub trait RetryableError:
-    std::error::Error + Send + Sync + Sized + 'static + From<FdbError> + From<FdbBindingError>
-{
-    /// Classifies this error for the retry loop.
-    fn retry_decision(&self) -> RetryDecision {
-        match find_fdb_error(self) {
-            Some(e) => RetryDecision::Fdb(e),
-            None => RetryDecision::Fatal,
-        }
-    }
-}
-
-impl RetryableError for FdbBindingError {
-    fn retry_decision(&self) -> RetryDecision {
-        match self.get_fdb_error() {
-            Some(e) => RetryDecision::Fdb(e),
-            None => RetryDecision::Fatal,
         }
     }
 }
diff --git a/bindings/rust/foundationdb/src/lib.rs b/bindings/rust/foundationdb/src/lib.rs
index ce5d903271a..61af11dbe69 100644
--- a/bindings/rust/foundationdb/src/lib.rs
+++ b/bindings/rust/foundationdb/src/lib.rs
@@ -12,16 +12,11 @@ use foundationdb_sys::if_cfg_api_versions;
 extern crate static_assertions;
 
 pub mod api;
-#[deny(missing_docs)]
-#[cfg(feature = "accounting")]
-pub mod budget;
 if_cfg_api_versions! {min = 510, max = 600 =>
     pub mod cluster;
 }
 mod database;
 pub mod directory;
-#[deny(missing_docs)]
-pub mod env;
 mod error;
 if_cfg_api_versions! {min = 700 =>
     #[deny(missing_docs)]
@@ -34,26 +29,10 @@ if_cfg_api_versions! {min = 710 =>
     pub mod mapped_key_values;
 }
 
-#[cfg(feature = "accounting")]
-pub mod metrics;
-
 /// Generated configuration types for use with the various `set_option` functions
 #[allow(clippy::all)]
 pub mod options;
 
-#[cfg(feature = "recipes-ranked-register")]
-pub mod recipes;
-
-// Re-export metrics types for convenience
-#[cfg(feature = "accounting")]
-pub use crate::metrics::{
-    AttemptMetrics, AttemptOutcome, ConflictKeys, MetricsReport, TransactionMetrics,
-};
-
-#[deny(missing_docs)]
-pub mod runner;
-
-pub mod timekeeper;
 mod transaction;
 mod tuple_ext;
 
@@ -66,18 +45,9 @@ if_cfg_api_versions! {min = 510, max = 600 =>
     pub use crate::cluster::Cluster;
 }
 
-#[cfg(feature = "accounting")]
-pub use crate::budget::{AttemptUsage, BudgetExceeded, BudgetKind, ClientBudget, UsageSnapshot};
 pub use crate::database::*;
-pub use crate::env::{Clock, Environment, Rng, SeededRng, WallClock};
-pub use crate::error::{FdbBindingError, RetryDecision, RetryableError};
-pub use crate::error::{FdbError, FdbResult};
+pub use crate::error::{FdbBindingError, FdbError, FdbResult};
 pub use crate::keyselector::*;
-#[cfg(feature = "accounting")]
-pub use crate::runner::MetricsHooks;
-pub use crate::runner::{
-    AttemptFailure, NativeRetryPolicy, RetryPolicy, RunnerHooks, TransactionRunner,
-};
 pub use crate::transaction::*;
 
 /// Initialize the FoundationDB Client API and start the network thread.
diff --git a/bindings/rust/foundationdb/src/metrics.rs b/bindings/rust/foundationdb/src/metrics.rs
deleted file mode 100644
index dc5d0f71b7f..00000000000
--- a/bindings/rust/foundationdb/src/metrics.rs
+++ /dev/null
@@ -1,634 +0,0 @@
-//! Per-attempt metrics collected by [`Database::instrumented_run`](crate::Database::instrumented_run).
-//!
-//! Available with the `accounting` Cargo feature.
-//!
-//! The report is a list of [`AttemptMetrics`], one per transaction attempt, in
-//! order: a retried transaction keeps everything it did in its earlier
-//! attempts. Operation counters come from the attempt's [`UsageSnapshot`], so
-//! instrumentation only adds the timings, the outcome and the aggregates on
-//! top of what the binding already counts.
-
-use crate::budget::{AttemptUsage, UsageSnapshot};
-use crate::error::FdbError;
-use crate::transaction::ConflictingKeyRange;
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex};
-use std::time::Duration;
-
-/// Label key-value pairs for metrics
-pub type Labels = Vec<(String, String)>;
-
-/// Unique key for a metric: name + labels
-#[derive(Clone, Hash, Eq, PartialEq, Debug)]
-pub struct MetricKey {
-    pub name: String,
-    pub labels: Labels,
-}
-
-impl MetricKey {
-    /// Create a new MetricKey
-    ///
-    /// # Arguments
-    /// * `name` - The name of the metric
-    /// * `labels` - Key-value pairs for labeling the metric
-    ///
-    /// # Returns
-    /// * `MetricKey` - A new MetricKey instance
-    pub fn new(name: &str, labels: &[(&str, &str)]) -> Self {
-        // Convert labels to owned strings
-        let mut sorted_labels: Labels = labels
-            .iter()
-            .map(|(k, v)| (k.to_string(), v.to_string()))
-            .collect();
-
-        // Sort labels by key to ensure consistent ordering
-        sorted_labels.sort_by(|a, b| a.0.cmp(&b.0));
-
-        Self {
-            name: name.to_string(),
-            labels: sorted_labels,
-        }
-    }
-}
-
-/// How a transaction attempt ended.
-///
-/// Marked non exhaustive: finer-grained failure reporting is expected to add
-/// variants.
-#[derive(Debug, Clone)]
-#[non_exhaustive]
-pub enum AttemptOutcome {
-    /// The attempt committed. For a run, only the last attempt can be in this
-    /// state.
-    Committed,
-    /// The attempt was retried, `cause` being the error handed to `on_error`.
-    /// A closure error asking for a retry without a native error underneath
-    /// surfaces here as code 1020 (`not_committed`).
-    Retried { cause: FdbError },
-    /// The attempt ended the run without committing: the error was not
-    /// retryable, or the retries were exhausted.
-    Failed,
-}
-
-/// The conflicting key ranges of a transaction attempt.
-///
-/// They are only read after a commit conflict, and only carry ranges when
-/// [`TransactionOption::ReportConflictingKeys`](crate::options::TransactionOption::ReportConflictingKeys)
-/// was set on the transaction.
-#[derive(Debug, Clone, Default)]
-pub enum ConflictKeys {
-    /// The attempt did not fail on a commit conflict, so nothing was read.
-    #[default]
-    NotRequested,
-    /// The special keyspace was read. The list is empty when
-    /// `ReportConflictingKeys` was not enabled.
-    Available(Vec<ConflictingKeyRange>),
-    /// The special keyspace read failed.
-    ReadFailed(FdbError),
-}
-
-impl ConflictKeys {
-    /// The conflicting ranges, empty unless they were read successfully.
-    pub fn ranges(&self) -> &[ConflictingKeyRange] {
-        match self {
-            ConflictKeys::Available(ranges) => ranges,
-            ConflictKeys::NotRequested | ConflictKeys::ReadFailed(_) => &[],
-        }
-    }
-}
-
-/// Everything recorded about a single transaction attempt.
-///
-/// One is pushed to [`MetricsReport::attempts`] when the attempt ends, so an
-/// attempt that was retried keeps its own counters, timings and custom metrics
-/// instead of being overwritten by the next one.
-#[derive(Debug, Clone)]
-pub struct AttemptMetrics {
-    /// Position of the attempt in the run, starting at 0.
-    pub index: usize,
-    /// Operation counters and bytes of the attempt. See [`crate::budget`] for
-    /// how precise they are.
-    pub usage: UsageSnapshot,
-    /// Application metrics recorded during the attempt with
-    /// [`Transaction::set_custom_metric`](crate::Transaction::set_custom_metric).
-    pub custom_metrics: HashMap<MetricKey, u64>,
-    /// Wall clock of the attempt, measured from its start to the end of its
-    /// work: the retry backoff performed by `on_error` is **not** included.
-    pub duration: Option<Duration>,
-    /// Time spent in `commit`, `None` if the attempt never reached it.
-    pub commit_duration: Option<Duration>,
-    /// Time spent waiting on `get_read_version`, `None` if it was never called.
-    /// The first completion of the attempt is kept.
-    pub grv_duration: Option<Duration>,
-    /// Time spent in `on_error`, backoff included. `None` if `on_error` did not
-    /// run, which is the case for the last attempt of a run.
-    pub on_error_duration: Option<Duration>,
-    /// How the attempt ended.
-    pub outcome: AttemptOutcome,
-    /// Conflicting key ranges, only read after a commit conflict.
-    pub conflicting_keys: ConflictKeys,
-    /// Read version of the attempt, recorded when
-    /// [`Transaction::get_read_version`](crate::Transaction::get_read_version)
-    /// is called. The binding never fetches it on its own.
-    pub read_version: Option<i64>,
-}
-
-/// Transaction-level information that spans attempts
-#[derive(Debug, Default, Clone)]
-pub struct TransactionInfo {
-    /// Number of retries performed, that is `attempts.len() - 1` for a
-    /// completed run
-    pub retries: u64,
-    /// Number of retries caused by commit conflicts (`not_committed`, error 1020)
-    pub conflict_count: u64,
-    /// Last read version observed, see [`AttemptMetrics::read_version`]
-    pub read_version: Option<i64>,
-    /// Commit version of the committed attempt
-    pub commit_version: Option<i64>,
-}
-
-/// The metrics of a whole `instrumented_run`: the detail of every attempt plus
-/// the aggregates that only make sense for the run as a whole.
-#[derive(Debug, Clone, Default)]
-pub struct MetricsReport {
-    /// One entry per transaction attempt, in order. Nothing is lost across
-    /// retries.
-    pub attempts: Vec<AttemptMetrics>,
-    /// Wall clock of the whole run, every attempt and backoff included.
-    pub total_duration: Option<Duration>,
-    /// Information that spans attempts.
-    pub transaction: TransactionInfo,
-}
-
-impl MetricsReport {
-    /// Sums the usage of every attempt, retries included.
-    ///
-    /// `elapsed` is the sum of the attempt durations, which is shorter than
-    /// [`total_duration`](Self::total_duration): the retry backoffs are not
-    /// part of any attempt.
-    pub fn total_usage(&self) -> UsageSnapshot {
-        self.attempts
-            .iter()
-            .fold(UsageSnapshot::default(), |mut total, attempt| {
-                let usage = &attempt.usage;
-                total.elapsed += usage.elapsed;
-                total.bytes_read += usage.bytes_read;
-                total.bytes_written += usage.bytes_written;
-                total.keys_values_fetched += usage.keys_values_fetched;
-                total.call_get += usage.call_get;
-                total.call_get_range += usage.call_get_range;
-                total.call_set += usage.call_set;
-                total.call_clear += usage.call_clear;
-                total.call_clear_range += usage.call_clear_range;
-                total.call_atomic_op += usage.call_atomic_op;
-                total
-            })
-    }
-
-    /// The attempt that ended the run, `None` if no attempt was ever started.
-    pub fn last_attempt(&self) -> Option<&AttemptMetrics> {
-        self.attempts.last()
-    }
-}
-
-/// The attempt currently being recorded.
-///
-/// Holds the accounting generation of the transaction, so that the attempt can
-/// be pushed to the report even after the transaction itself is gone (a
-/// non-retryable `on_error` consumes it), and the pieces that are known before
-/// the attempt ends.
-#[derive(Debug, Default)]
-struct OpenAttempt {
-    usage: Option<Arc<AttemptUsage>>,
-    duration: Option<Duration>,
-    commit_duration: Option<Duration>,
-    grv_duration: Option<Duration>,
-    conflicting_keys: ConflictKeys,
-    read_version: Option<i64>,
-}
-
-/// Collects the metrics of a transaction, attempt after attempt.
-///
-/// This is the handle shared between the transaction, the runner hooks and the
-/// caller: cloning it clones the handle, not the data. The recording methods
-/// are called by the binding as the transaction progresses, the report is read
-/// back with [`get_metrics_data`](Self::get_metrics_data).
-#[derive(Debug, Clone, Default)]
-pub struct TransactionMetrics {
-    /// The report being built.
-    pub metrics: Arc<Mutex<MetricsReport>>,
-    /// The attempt being recorded, pushed to the report when it ends.
-    open: Arc<Mutex<OpenAttempt>>,
-}
-
-impl TransactionMetrics {
-    /// Create a new instance of TransactionMetrics
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    fn report(&self) -> std::sync::MutexGuard<'_, MetricsReport> {
-        self.metrics
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-    }
-
-    fn open(&self) -> std::sync::MutexGuard<'_, OpenAttempt> {
-        self.open
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-    }
-
-    /// Starts recording a new attempt, on the accounting generation the
-    /// transaction just entered.
-    ///
-    /// Anything recorded on a previous attempt that was not ended with
-    /// [`finish_attempt`](Self::finish_attempt) is dropped: the transaction
-    /// restarted without reaching a conclusion, typically because
-    /// [`Transaction::set_client_budget`](crate::Transaction::set_client_budget)
-    /// or [`Transaction::reset`](crate::Transaction::reset) was called.
-    pub(crate) fn begin_attempt(&self, usage: Arc<AttemptUsage>) {
-        let mut open = self.open();
-
-        #[cfg(feature = "trace")]
-        if let Some(dropped) = open.usage.as_ref() {
-            // `elapsed` always moves, so the counters are what tells whether
-            // the attempt being dropped did anything worth reporting. Some
-            // activity is recorded straight on `OpenAttempt` instead of
-            // `AttemptUsage` (read version, conflicting keys, commit
-            // duration, grv duration), so it has to be checked too.
-            let snapshot = dropped.snapshot();
-            let idle = snapshot
-                == UsageSnapshot {
-                    elapsed: snapshot.elapsed,
-                    ..UsageSnapshot::default()
-                }
-                && dropped.custom_metrics().is_empty()
-                && open.read_version.is_none()
-                && open.duration.is_none()
-                && open.commit_duration.is_none()
-                && open.grv_duration.is_none()
-                && matches!(open.conflicting_keys, ConflictKeys::NotRequested);
-
-            if !idle {
-                tracing::warn!(
-                    "a new attempt was opened while the previous one was still open, its usage and custom metrics are dropped (set_client_budget or reset called mid-attempt)"
-                );
-            }
-        }
-
-        *open = OpenAttempt {
-            usage: Some(usage),
-            ..OpenAttempt::default()
-        };
-    }
-
-    /// Freezes the duration of the attempt at the current elapsed time, so that
-    /// what happens next (retry backoff, error handling) is not counted as part
-    /// of it. Later calls do not move it.
-    pub(crate) fn mark_attempt_end(&self) {
-        let mut open = self.open();
-        if open.duration.is_none() {
-            open.duration = open.usage.as_ref().map(|usage| usage.elapsed());
-        }
-    }
-
-    /// Records the time spent in `commit`, whatever its result, and ends the
-    /// attempt's work.
-    pub(crate) fn record_commit(&self, duration: Duration) {
-        let mut open = self.open();
-        open.commit_duration = Some(duration);
-        if open.duration.is_none() {
-            open.duration = open.usage.as_ref().map(|usage| usage.elapsed());
-        }
-    }
-
-    /// Records a GRV completion only while its issuing attempt is still open.
-    /// The first timing of that attempt is kept, even when the GRV failed.
-    pub(crate) fn record_grv(
-        &self,
-        usage: &Arc<AttemptUsage>,
-        duration: Duration,
-        version: Option<i64>,
-    ) {
-        let mut open = self.open();
-        if !open
-            .usage
-            .as_ref()
-            .is_some_and(|current| Arc::ptr_eq(current, usage))
-        {
-            return;
-        }
-        if open.grv_duration.is_none() {
-            open.grv_duration = Some(duration);
-        }
-        if let Some(version) = version {
-            open.read_version = Some(version);
-            self.report().transaction.read_version = Some(version);
-        }
-    }
-
-    /// Ends the current attempt and pushes it to the report.
-    ///
-    /// Does nothing when no attempt is being recorded, which makes it safe to
-    /// call on the exit paths of a runner that may already have ended it.
-    pub fn finish_attempt(&self, outcome: AttemptOutcome) {
-        let (usage, open) = {
-            let mut open = self.open();
-            match open.usage.take() {
-                // `usage` was taken above, so this leaves the scratch empty.
-                Some(usage) => (usage, std::mem::take(&mut *open)),
-                None => return,
-            }
-        };
-
-        let retried = matches!(outcome, AttemptOutcome::Retried { .. });
-
-        let mut report = self.report();
-        let index = report.attempts.len();
-        report.attempts.push(AttemptMetrics {
-            index,
-            usage: usage.snapshot(),
-            custom_metrics: usage.custom_metrics(),
-            duration: open.duration.or_else(|| Some(usage.elapsed())),
-            commit_duration: open.commit_duration,
-            grv_duration: open.grv_duration,
-            on_error_duration: None,
-            outcome,
-            conflicting_keys: open.conflicting_keys,
-            read_version: open.read_version,
-        });
-
-        if retried {
-            report.transaction.retries += 1;
-        }
-    }
-
-    /// Records the time spent in `on_error` for the attempt that just ended.
-    ///
-    /// The runner measures it after `on_error` returned, hence after the
-    /// attempt was pushed: it lands on the last attempt of the report.
-    pub fn set_on_error_duration(&self, duration: Duration) {
-        if let Some(attempt) = self.report().attempts.last_mut() {
-            attempt.on_error_duration = Some(duration);
-        }
-    }
-
-    /// Records the total duration of the run.
-    pub fn set_total_duration(&self, duration: Duration) {
-        self.report().total_duration = Some(duration);
-    }
-
-    /// Records the read version of the current attempt.
-    pub fn set_read_version(&self, version: i64) {
-        self.open().read_version = Some(version);
-        self.report().transaction.read_version = Some(version);
-    }
-
-    /// Records the commit version of the transaction.
-    pub fn set_commit_version(&self, version: i64) {
-        self.report().transaction.commit_version = Some(version);
-    }
-
-    /// Records the conflicting key ranges of the current attempt.
-    pub fn set_conflicting_keys(&self, keys: ConflictKeys) {
-        self.open().conflicting_keys = keys;
-    }
-
-    /// Increment the conflict counter
-    pub fn increment_conflict_count(&self) {
-        self.report().transaction.conflict_count += 1;
-    }
-
-    /// Get the number of retries
-    pub fn get_retries(&self) -> u64 {
-        self.report().transaction.retries
-    }
-
-    /// Returns a clone of the report built so far.
-    pub fn get_metrics_data(&self) -> MetricsReport {
-        self.report().clone()
-    }
-
-    /// Returns a clone of the transaction information.
-    pub fn get_transaction_info(&self) -> TransactionInfo {
-        self.report().transaction.clone()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::collections::HashSet;
-
-    #[test]
-    fn test_metric_key_equality() {
-        // Test that different combinations of the same labels are considered equal
-        let key1 = MetricKey::new("counter", &[("region", "us-west"), ("service", "api")]);
-        let key2 = MetricKey::new("counter", &[("service", "api"), ("region", "us-west")]);
-
-        // Same labels in different order should be considered equal
-        assert_eq!(key1, key2);
-
-        // Different label values should produce different keys
-        let key3 = MetricKey::new("counter", &[("region", "us-east"), ("service", "api")]);
-        assert_ne!(key1, key3);
-
-        // Different label keys should produce different keys
-        let key4 = MetricKey::new("counter", &[("zone", "us-west"), ("service", "api")]);
-        assert_ne!(key1, key4);
-
-        // Different metric names should produce different keys
-        let key5 = MetricKey::new("timer", &[("region", "us-west"), ("service", "api")]);
-        assert_ne!(key1, key5);
-    }
-
-    #[test]
-    fn test_metric_key_in_hashmap() {
-        let mut metrics = HashMap::new();
-
-        // Insert metrics with different label combinations
-        metrics.insert(
-            MetricKey::new("counter", &[("region", "us-west"), ("service", "api")]),
-            100,
-        );
-        metrics.insert(
-            MetricKey::new("counter", &[("region", "us-east"), ("service", "api")]),
-            200,
-        );
-        metrics.insert(
-            MetricKey::new("timer", &[("region", "us-west"), ("service", "api")]),
-            300,
-        );
-
-        // Verify we can retrieve metrics with the same label combinations
-        assert_eq!(
-            metrics.get(&MetricKey::new(
-                "counter",
-                &[("region", "us-west"), ("service", "api")]
-            )),
-            Some(&100)
-        );
-
-        // Verify we can retrieve metrics with labels in different order
-        assert_eq!(
-            metrics.get(&MetricKey::new(
-                "counter",
-                &[("service", "api"), ("region", "us-west")]
-            )),
-            Some(&100)
-        );
-
-        // Verify different label values produce different keys
-        assert_eq!(
-            metrics.get(&MetricKey::new(
-                "counter",
-                &[("region", "us-east"), ("service", "api")]
-            )),
-            Some(&200)
-        );
-
-        // Verify different metric names produce different keys
-        assert_eq!(
-            metrics.get(&MetricKey::new(
-                "timer",
-                &[("region", "us-west"), ("service", "api")]
-            )),
-            Some(&300)
-        );
-    }
-
-    #[test]
-    fn test_metric_key_label_order_independence() {
-        // Create a HashSet to verify uniqueness
-        let mut unique_keys = HashSet::new();
-
-        // Add keys with the same labels in different orders
-        unique_keys.insert(MetricKey::new(
-            "counter",
-            &[("a", "1"), ("b", "2"), ("c", "3")],
-        ));
-        unique_keys.insert(MetricKey::new(
-            "counter",
-            &[("a", "1"), ("c", "3"), ("b", "2")],
-        ));
-        unique_keys.insert(MetricKey::new(
-            "counter",
-            &[("b", "2"), ("a", "1"), ("c", "3")],
-        ));
-        unique_keys.insert(MetricKey::new(
-            "counter",
-            &[("b", "2"), ("c", "3"), ("a", "1")],
-        ));
-        unique_keys.insert(MetricKey::new(
-            "counter",
-            &[("c", "3"), ("a", "1"), ("b", "2")],
-        ));
-        unique_keys.insert(MetricKey::new(
-            "counter",
-            &[("c", "3"), ("b", "2"), ("a", "1")],
-        ));
-
-        // All permutations should be considered the same key
-        assert_eq!(unique_keys.len(), 1);
-    }
-
-    /// Every attempt keeps its own counters and custom metrics, and the report
-    /// aggregates them.
-    #[test]
-    fn attempts_are_recorded_one_by_one() {
-        let metrics = TransactionMetrics::new();
-        let key = MetricKey::new("documents", &[]);
-
-        // Nothing to push before an attempt is opened.
-        metrics.finish_attempt(AttemptOutcome::Failed);
-        assert!(metrics.get_metrics_data().attempts.is_empty());
-
-        let first = Arc::new(AttemptUsage::new());
-        metrics.begin_attempt(first.clone());
-        first.record_set(10);
-        first.increment_custom(key.clone(), 1);
-        metrics.record_commit(Duration::from_millis(3));
-        metrics.record_grv(&first, Duration::from_millis(5), Some(42));
-        metrics.record_grv(&first, Duration::from_millis(1), Some(42)); // first sample wins
-        metrics.finish_attempt(AttemptOutcome::Retried {
-            cause: FdbError::from_code(1020),
-        });
-        metrics.set_on_error_duration(Duration::from_millis(7));
-
-        let second = Arc::new(AttemptUsage::new());
-        metrics.begin_attempt(second.clone());
-        metrics.record_grv(&first, Duration::from_millis(20), Some(43));
-        second.record_set(4);
-        second.increment_custom(key.clone(), 2);
-        metrics.finish_attempt(AttemptOutcome::Committed);
-
-        // A second end is a no-op: an attempt is pushed exactly once.
-        metrics.finish_attempt(AttemptOutcome::Failed);
-
-        let report = metrics.get_metrics_data();
-        assert_eq!(report.attempts.len(), 2);
-        assert_eq!(report.transaction.retries, 1);
-        assert_eq!(report.transaction.read_version, Some(42));
-
-        let first = &report.attempts[0];
-        assert_eq!(first.index, 0);
-        assert_eq!(first.usage.bytes_written, 10);
-        assert_eq!(first.custom_metrics.get(&key), Some(&1));
-        assert_eq!(first.commit_duration, Some(Duration::from_millis(3)));
-        assert_eq!(first.grv_duration, Some(Duration::from_millis(5)));
-        assert_eq!(first.on_error_duration, Some(Duration::from_millis(7)));
-        assert!(matches!(
-            first.outcome,
-            AttemptOutcome::Retried { cause } if cause.code() == 1020
-        ));
-
-        let second = &report.attempts[1];
-        assert_eq!(second.index, 1);
-        assert_eq!(second.usage.bytes_written, 4);
-        assert_eq!(second.custom_metrics.get(&key), Some(&2));
-        assert!(second.commit_duration.is_none());
-        assert!(second.grv_duration.is_none());
-        assert!(second.read_version.is_none());
-        assert!(matches!(second.outcome, AttemptOutcome::Committed));
-
-        assert_eq!(report.total_usage().bytes_written, 14);
-        assert_eq!(report.total_usage().call_set, 2);
-    }
-
-    /// An attempt whose only activity was `set_read_version` (no counter
-    /// touched, no custom metric) must not be silently dropped: it should be
-    /// discarded the same way a busy attempt is when a new one starts before
-    /// `finish_attempt` was called, and the crate must keep working normally
-    /// afterwards. This covers the state side of the `idle` heuristic in
-    /// `begin_attempt`; the `#[cfg(feature = "trace")]` warning itself is not
-    /// asserted here as the crate has no test pattern capturing `tracing`
-    /// output content (see `tests/trace.rs`, which only checks the writer
-    /// doesn't panic).
-    #[test]
-    fn dropped_attempt_with_only_read_version_is_handled() {
-        let metrics = TransactionMetrics::new();
-
-        let first = Arc::new(AttemptUsage::new());
-        metrics.begin_attempt(first.clone());
-        metrics.set_read_version(42);
-
-        // A new attempt starts (e.g. `set_client_budget`/`reset`) without the
-        // first one ever reaching `finish_attempt`: it must be dropped
-        // cleanly, no panic.
-        let second = Arc::new(AttemptUsage::new());
-        metrics.begin_attempt(second.clone());
-        second.record_set(1);
-        metrics.finish_attempt(AttemptOutcome::Committed);
-
-        let report = metrics.get_metrics_data();
-        assert_eq!(report.attempts.len(), 1);
-        let only = &report.attempts[0];
-        assert_eq!(only.usage.bytes_written, 1);
-        assert!(matches!(only.outcome, AttemptOutcome::Committed));
-
-        // The read version set on the dropped attempt is still reflected at
-        // the transaction level.
-        assert_eq!(report.transaction.read_version, Some(42));
-    }
-}
diff --git a/bindings/rust/foundationdb/src/recipes/leader_election/algorithm.rs b/bindings/rust/foundationdb/src/recipes/leader_election/algorithm.rs
deleted file mode 100644
index df7d72645ad..00000000000
--- a/bindings/rust/foundationdb/src/recipes/leader_election/algorithm.rs
+++ /dev/null
@@ -1,427 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Transactional implementation of the Dynamo-style lease state machine.
-
-use crate::{
-    Transaction,
-    recipes::ranked_register::Rank,
-    tuple::{Subspace, pack, unpack},
-};
-use std::ops::Deref;
-use std::time::Duration;
-
-use super::types::PendingNextState;
-use super::{
-    ElectionState, LeaderElectionError, Leadership, LocalState, Observation, ParticipantId,
-    PollOutcome, PollResult, PollTransition, ResignOutcome, Result, keys::state_key,
-};
-
-const STATE_SCHEMA_VERSION: u64 = 1;
-
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
-struct DurableState {
-    revision: u64,
-    owner: Option<ParticipantId>,
-    lease_duration: Option<Duration>,
-}
-
-async fn read_state<T>(txn: &T, key: &[u8]) -> Result<DurableState>
-where
-    T: Deref<Target = Transaction>,
-{
-    let Some(value) = txn.get(key, false).await? else {
-        return Ok(DurableState::default());
-    };
-
-    decode_state(&value)
-}
-
-fn decode_state(value: &[u8]) -> Result<DurableState> {
-    let (
-        schema_version,
-        revision,
-        has_owner,
-        owner,
-        has_lease_duration,
-        lease_duration_secs,
-        lease_duration_subsec_nanos,
-    ): (u64, u64, bool, String, bool, u64, u32) = unpack(value)?;
-    if schema_version != STATE_SCHEMA_VERSION {
-        return Err(LeaderElectionError::InvalidState(format!(
-            "unknown durable state schema version {schema_version}, expected {STATE_SCHEMA_VERSION}"
-        )));
-    }
-    let owner = if has_owner {
-        Some(ParticipantId::new(owner)?)
-    } else if owner.is_empty() {
-        None
-    } else {
-        return Err(LeaderElectionError::InvalidState(
-            "released state contains an owner ID".to_owned(),
-        ));
-    };
-    if !has_lease_duration && (lease_duration_secs != 0 || lease_duration_subsec_nanos != 0) {
-        return Err(LeaderElectionError::InvalidState(
-            "missing lease duration has non-zero fields".to_owned(),
-        ));
-    }
-    if has_lease_duration && lease_duration_subsec_nanos >= 1_000_000_000 {
-        return Err(LeaderElectionError::InvalidState(
-            "lease duration subsecond nanos is out of range".to_owned(),
-        ));
-    }
-    let lease_duration =
-        has_lease_duration.then(|| Duration::new(lease_duration_secs, lease_duration_subsec_nanos));
-    if revision == 0 && (owner.is_some() || lease_duration.is_some()) {
-        return Err(LeaderElectionError::InvalidState(
-            "zero revision state is not empty".to_owned(),
-        ));
-    }
-    if revision > 0 && lease_duration.is_none() {
-        return Err(LeaderElectionError::InvalidState(
-            "created state has no lease duration".to_owned(),
-        ));
-    }
-    if lease_duration == Some(Duration::ZERO) {
-        return Err(LeaderElectionError::InvalidState(
-            "persisted lease duration is zero".to_owned(),
-        ));
-    }
-    Ok(DurableState {
-        revision,
-        owner,
-        lease_duration,
-    })
-}
-
-fn write_state<T>(txn: &T, key: &[u8], state: &DurableState)
-where
-    T: Deref<Target = Transaction>,
-{
-    txn.set(key, &encode_state(state));
-}
-
-fn encode_state(state: &DurableState) -> Vec<u8> {
-    let owner = state.owner.as_ref().map_or("", ParticipantId::as_str);
-    let (lease_duration_secs, lease_duration_subsec_nanos) =
-        state.lease_duration.map_or((0, 0), |duration| {
-            (duration.as_secs(), duration.subsec_nanos())
-        });
-    pack(&(
-        STATE_SCHEMA_VERSION,
-        state.revision,
-        state.owner.is_some(),
-        owner,
-        state.lease_duration.is_some(),
-        lease_duration_secs,
-        lease_duration_subsec_nanos,
-    ))
-}
-
-fn next_revision(state: &DurableState) -> Result<u64> {
-    state
-        .revision
-        .checked_add(1)
-        .ok_or(LeaderElectionError::RevisionExhausted)
-}
-
-fn same_observation(state: &DurableState, observation: &Observation) -> bool {
-    state.owner.as_ref() == Some(observation.owner())
-        && state.revision == observation.rank().as_u64()
-        && state.lease_duration == Some(observation.lease_duration())
-}
-
-fn valid_leadership(
-    state: &DurableState,
-    participant: &ParticipantId,
-    leadership: &Leadership,
-    now: Duration,
-) -> bool {
-    leadership.participant() == participant
-        && state.owner.as_ref() == Some(participant)
-        && state.revision == leadership.rank().as_u64()
-        && state.lease_duration == Some(leadership.lease_duration())
-        && now.saturating_sub(leadership.last_renewed_at()) < leadership.lease_duration()
-}
-
-fn leader_result<T>(
-    txn: &T,
-    key: &[u8],
-    state: &DurableState,
-    participant: &ParticipantId,
-    lease_duration: Duration,
-    attempt_started_at: Duration,
-    transition: PollTransition,
-) -> Result<PollResult>
-where
-    T: Deref<Target = Transaction>,
-{
-    let revision = next_revision(state)?;
-    let next_state = DurableState {
-        revision,
-        owner: Some(participant.clone()),
-        lease_duration: Some(lease_duration),
-    };
-    write_state(txn, key, &next_state);
-    let rank = Rank::from(revision);
-
-    #[cfg(feature = "trace")]
-    let action = match transition {
-        PollTransition::Acquired => "acquisition",
-        PollTransition::Renewed => "renewal",
-        PollTransition::TookOver => "takeover",
-        PollTransition::Reacquired => "reacquisition",
-        PollTransition::Followed => "follower",
-    };
-
-    #[cfg(feature = "trace")]
-    tracing::debug!(
-        poll_outcome = "leader",
-        poll_action = action,
-        participant = participant.as_str(),
-        revision,
-        takeover = transition == PollTransition::TookOver,
-        reacquisition = transition == PollTransition::Reacquired,
-        "leader-election poll staged in transaction"
-    );
-
-    Ok(PollResult::new(
-        PollOutcome::Leader { rank, transition },
-        PendingNextState::leadership(Leadership::new(
-            participant.clone(),
-            rank,
-            lease_duration,
-            attempt_started_at,
-        )),
-    ))
-}
-
-fn follower_result(
-    state: &DurableState,
-    previous: Option<&Observation>,
-    _reason: &'static str,
-) -> Result<PollResult> {
-    let owner = state.owner.clone().ok_or_else(|| {
-        LeaderElectionError::InvalidState(
-            "follower result requested from released state".to_owned(),
-        )
-    })?;
-    let lease_duration = state.lease_duration.ok_or_else(|| {
-        LeaderElectionError::InvalidState(
-            "follower result requested without lease duration".to_owned(),
-        )
-    })?;
-    let rank = Rank::from(state.revision);
-    let next_observation = match previous {
-        Some(previous) if same_observation(state, previous) => {
-            PendingNextState::preserve_observation(previous.clone())
-        }
-        Some(_) | None => PendingNextState::new_observation(owner.clone(), rank, lease_duration),
-    };
-
-    #[cfg(feature = "trace")]
-    tracing::debug!(
-        poll_outcome = "follower",
-        poll_reason = _reason,
-        owner = owner.as_str(),
-        revision = rank.as_u64(),
-        "leader-election poll observed owner"
-    );
-
-    let outcome = PollOutcome::Follower {
-        owner,
-        rank,
-        lease_duration,
-    };
-
-    Ok(PollResult::new(outcome, next_observation))
-}
-
-pub(crate) async fn poll<T>(
-    txn: &T,
-    subspace: &Subspace,
-    lease_duration: Duration,
-    participant: &ParticipantId,
-    local_state: &LocalState,
-    attempt_started_at: Duration,
-) -> Result<PollResult>
-where
-    T: Deref<Target = Transaction>,
-{
-    let key = state_key(subspace);
-    let state = read_state(txn, &key).await?;
-
-    match local_state {
-        LocalState::Leadership(leadership)
-            if valid_leadership(&state, participant, leadership, attempt_started_at) =>
-        {
-            leader_result(
-                txn,
-                &key,
-                &state,
-                participant,
-                lease_duration,
-                attempt_started_at,
-                PollTransition::Renewed,
-            )
-        }
-        LocalState::Observation(observation) if state.owner.is_some() => {
-            if same_observation(&state, observation)
-                && attempt_started_at.saturating_sub(observation.first_observed_at())
-                    >= observation.lease_duration()
-            {
-                let transition = if observation.owner() == participant {
-                    PollTransition::Reacquired
-                } else {
-                    PollTransition::TookOver
-                };
-                leader_result(
-                    txn,
-                    &key,
-                    &state,
-                    participant,
-                    lease_duration,
-                    attempt_started_at,
-                    transition,
-                )
-            } else {
-                follower_result(&state, Some(observation), "observation")
-            }
-        }
-        LocalState::Unknown if state.owner.is_some() => follower_result(&state, None, "unknown"),
-        LocalState::Leadership(_) if state.owner.is_some() => {
-            follower_result(&state, None, "leadership_not_renewable")
-        }
-        LocalState::Observation(_) | LocalState::Unknown | LocalState::Leadership(_) => {
-            leader_result(
-                txn,
-                &key,
-                &state,
-                participant,
-                lease_duration,
-                attempt_started_at,
-                PollTransition::Acquired,
-            )
-        }
-    }
-}
-
-pub(crate) async fn state<T>(txn: &T, subspace: &Subspace) -> Result<ElectionState>
-where
-    T: Deref<Target = Transaction>,
-{
-    let state = read_state(txn, &state_key(subspace)).await?;
-    Ok(ElectionState::new(
-        state.owner,
-        Rank::from(state.revision),
-        state.lease_duration,
-    ))
-}
-
-pub(crate) async fn resign<T>(
-    txn: &T,
-    subspace: &Subspace,
-    leadership: &Leadership,
-) -> Result<ResignOutcome>
-where
-    T: Deref<Target = Transaction>,
-{
-    let key = state_key(subspace);
-    let state = read_state(txn, &key).await?;
-    if state.owner.as_ref() != Some(leadership.participant())
-        || state.revision != leadership.rank().as_u64()
-        || state.lease_duration != Some(leadership.lease_duration())
-    {
-        #[cfg(feature = "trace")]
-        let rejection_reason = if state.owner.as_ref() != Some(leadership.participant()) {
-            "owner_changed"
-        } else if state.revision != leadership.rank().as_u64() {
-            "revision_changed"
-        } else {
-            "lease_duration_changed"
-        };
-        #[cfg(feature = "trace")]
-        tracing::debug!(
-            resign_outcome = "rejected",
-            resign_reason = rejection_reason,
-            participant = leadership.participant().as_str(),
-            leadership_revision = leadership.rank().as_u64(),
-            revision = state.revision,
-            "leader-election stale resignation rejected"
-        );
-        return Ok(ResignOutcome::Rejected);
-    }
-
-    let released = DurableState {
-        revision: state.revision,
-        owner: None,
-        lease_duration: state.lease_duration,
-    };
-    write_state(txn, &key, &released);
-    #[cfg(feature = "trace")]
-    tracing::debug!(
-        resign_outcome = "resigned",
-        revision = released.revision,
-        "leader-election resignation staged in transaction"
-    );
-    Ok(ResignOutcome::Resigned)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn durable_state_version_one_round_trips() {
-        let state = DurableState {
-            revision: 42,
-            owner: Some(ParticipantId::new("alice-incarnation").unwrap()),
-            lease_duration: Some(Duration::new(5, 123)),
-        };
-
-        assert_eq!(decode_state(&encode_state(&state)).unwrap(), state);
-    }
-
-    #[test]
-    fn maximum_participant_id_keeps_durable_state_below_fdb_value_limit() {
-        let owner =
-            ParticipantId::new("\0".repeat((ParticipantId::MAX_ENCODED_BYTES - 2) / 2)).unwrap();
-        assert_eq!(
-            pack(&owner.as_str()).len(),
-            ParticipantId::MAX_ENCODED_BYTES
-        );
-        let state = DurableState {
-            revision: u64::MAX,
-            owner: Some(owner),
-            lease_duration: Some(Duration::new(u64::MAX, 999_999_999)),
-        };
-
-        assert!(encode_state(&state).len() <= 100_000);
-    }
-
-    #[test]
-    fn unknown_durable_state_schema_version_is_rejected() {
-        let value = pack(&(2_u64, 1_u64, true, "alice", true, 5_u64, 0_u32));
-
-        assert!(matches!(
-            decode_state(&value),
-            Err(LeaderElectionError::InvalidState(message))
-                if message.contains("unknown durable state schema version 2")
-        ));
-    }
-
-    #[test]
-    fn untagged_six_field_durable_state_is_rejected() {
-        let value = pack(&(1_u64, true, "alice", true, 5_u64, 0_u32));
-
-        assert!(matches!(
-            decode_state(&value),
-            Err(LeaderElectionError::PackError(_))
-        ));
-    }
-}
diff --git a/bindings/rust/foundationdb/src/recipes/leader_election/errors.rs b/bindings/rust/foundationdb/src/recipes/leader_election/errors.rs
deleted file mode 100644
index 612ea555c76..00000000000
--- a/bindings/rust/foundationdb/src/recipes/leader_election/errors.rs
+++ /dev/null
@@ -1,150 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Error types returned by leader-election operations.
-
-use crate::tuple::PackError;
-use crate::{FdbBindingError, FdbError, RetryableError};
-use std::fmt;
-
-/// Leader-election-specific errors.
-///
-/// [`LeaderElectionError::Fdb`] retains the underlying FoundationDB error for
-/// the caller's transaction runner to classify. The other variants identify
-/// invalid local configuration, unsupported durable data, or a protocol limit.
-#[derive(Debug)]
-pub enum LeaderElectionError {
-    /// The durable state could not be decoded or violated a protocol invariant.
-    ///
-    /// Do not treat this as an unowned state. It can indicate corrupt data, an
-    /// incompatible schema, or data written outside this recipe.
-    InvalidState(String),
-    /// A [`ParticipantId`](super::ParticipantId) was empty.
-    ///
-    /// Empty text cannot distinguish a participating process incarnation.
-    InvalidParticipantId,
-    /// A [`ParticipantId`](super::ParticipantId) exceeds the encoded-size limit.
-    ///
-    /// The limit includes tuple encoding and NUL escaping, so it guarantees the
-    /// complete durable election state fits below FoundationDB's value limit.
-    ParticipantIdTooLarge {
-        /// Tuple-encoded participant ID size in bytes.
-        encoded_size: usize,
-        /// Maximum supported tuple-encoded participant ID size in bytes.
-        limit: usize,
-    },
-    /// A configured lease duration was zero.
-    ///
-    /// A zero duration would make every local validity interval immediately
-    /// expired, so [`super::LeaderElection::new`] rejects it.
-    InvalidLeaseDuration,
-    /// The durable revision reached `u64::MAX`.
-    ///
-    /// No further ownership transition can create a strictly newer fencing
-    /// rank in this election subspace.
-    RevisionExhausted,
-    /// An underlying FoundationDB read, write, or commit-related error occurred.
-    ///
-    /// Inspect the source error and let the enclosing transaction runner apply
-    /// its normal retry policy where appropriate.
-    Fdb(FdbError),
-    /// A transaction-runner error occurred.
-    Binding(Box<FdbBindingError>),
-    /// Failed to encode or decode the recipe's durable tuple state.
-    ///
-    /// On reads this can accompany malformed or incompatible durable data; on
-    /// writes it prevents staging the requested state change.
-    PackError(PackError),
-}
-
-impl fmt::Display for LeaderElectionError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::InvalidState(message) => write!(f, "Invalid leader election state: {message}"),
-            Self::InvalidParticipantId => write!(f, "Participant ID must not be empty"),
-            Self::ParticipantIdTooLarge {
-                encoded_size,
-                limit,
-            } => write!(
-                f,
-                "Encoded participant ID is {encoded_size} bytes, above the {limit}-byte limit"
-            ),
-            Self::InvalidLeaseDuration => write!(f, "Lease duration must not be zero"),
-            Self::RevisionExhausted => write!(f, "Leader-election revision is exhausted"),
-            Self::Fdb(error) => write!(f, "Database error: {error}"),
-            Self::Binding(error) => write!(f, "Retry loop error: {error}"),
-            Self::PackError(error) => write!(f, "Pack error: {error:?}"),
-        }
-    }
-}
-
-impl std::error::Error for LeaderElectionError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Self::Fdb(error) => Some(error),
-            Self::Binding(error) => Some(error.as_ref()),
-            Self::PackError(error) => Some(error),
-            Self::InvalidState(_)
-            | Self::InvalidParticipantId
-            | Self::ParticipantIdTooLarge { .. }
-            | Self::InvalidLeaseDuration
-            | Self::RevisionExhausted => None,
-        }
-    }
-}
-
-impl From<FdbError> for LeaderElectionError {
-    fn from(error: FdbError) -> Self {
-        Self::Fdb(error)
-    }
-}
-
-impl From<FdbBindingError> for LeaderElectionError {
-    fn from(error: FdbBindingError) -> Self {
-        Self::Binding(Box::new(error))
-    }
-}
-
-impl From<PackError> for LeaderElectionError {
-    fn from(error: PackError) -> Self {
-        Self::PackError(error)
-    }
-}
-
-/// The `source()` chain exposes wrapped FoundationDB errors, so the default
-/// retry decision is transparent to `Database::run`.
-impl RetryableError for LeaderElectionError {}
-
-/// Result type for [`super::LeaderElection`] operations.
-pub type Result<T> = std::result::Result<T, LeaderElectionError>;
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{RetryDecision, RetryableError};
-
-    #[test]
-    fn fdb_errors_are_retry_transparent() {
-        let error = LeaderElectionError::Fdb(FdbError::from_code(1020));
-
-        assert!(matches!(error.retry_decision(), RetryDecision::Fdb(_)));
-    }
-
-    #[test]
-    fn runner_errors_are_preserved() {
-        let error = LeaderElectionError::from(FdbBindingError::ReferenceToTransactionKept);
-
-        assert!(matches!(error, LeaderElectionError::Binding(_)));
-    }
-
-    #[test]
-    fn runner_error_source_chain_is_retry_transparent() {
-        let error = LeaderElectionError::from(FdbBindingError::from(FdbError::from_code(1020)));
-
-        assert!(matches!(error.retry_decision(), RetryDecision::Fdb(_)));
-    }
-}
diff --git a/bindings/rust/foundationdb/src/recipes/leader_election/keys.rs b/bindings/rust/foundationdb/src/recipes/leader_election/keys.rs
deleted file mode 100644
index 4b64f5ecea0..00000000000
--- a/bindings/rust/foundationdb/src/recipes/leader_election/keys.rs
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Key management for leader election.
-//!
-//! A single key holds the durable coordination state. It stores the relative
-//! lease duration, but no clock reading, absolute timestamp, renewal time, or
-//! expiry deadline. Takeover timing is a local caller concern.
-//!
-//! # Value schema
-//!
-//! ```text
-//! (schema_version: u64, revision: u64, has_owner: bool, owner: String,
-//!  has_lease_duration: bool, lease_duration_secs: u64,
-//!  lease_duration_subsec_nanos: u32)
-//! ```
-//!
-//! The schema version is decoded strictly. Untagged layouts from development
-//! versions of this recipe are unsupported: clear the election subspace before
-//! using this version of the recipe. The election revision is also the fencing
-//! rank for every paired ranked register, so clear those register subspaces
-//! before reuse as well. Leaving an older register fence in place rejects the
-//! new election's lower ranks.
-
-use crate::tuple::Subspace;
-
-const STATE_PREFIX: &str = "state";
-
-/// Returns the single durable election-state key.
-pub(crate) fn state_key(subspace: &Subspace) -> Vec<u8> {
-    subspace.pack(&(STATE_PREFIX,))
-}
diff --git a/bindings/rust/foundationdb/src/recipes/leader_election/mod.rs b/bindings/rust/foundationdb/src/recipes/leader_election/mod.rs
deleted file mode 100644
index 888cd2e6901..00000000000
--- a/bindings/rust/foundationdb/src/recipes/leader_election/mod.rs
+++ /dev/null
@@ -1,326 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Poll-based Dynamo-style leader leases with FoundationDB fencing.
-//!
-//! This recipe adapts the client-side timing model of the
-//! [Amazon DynamoDB lock client](https://aws.amazon.com/blogs/aws/new-amazon-dynamodb-lock-client/).
-//! A caller observes a durable owner record and uses elapsed time from its own
-//! monotonic clock to decide when that unchanged record is suspicious.
-//! FoundationDB's serializable transaction on one state key, not local time,
-//! resolves concurrent acquisition, renewal, reacquisition, and takeover.
-//! The protocol is Dynamo-inspired, not wire-compatible with the DynamoDB lock
-//! client.
-//!
-//! ## Durable state and local time
-//!
-//! Durable state contains an optional owner, a monotonically increasing
-//! revision, and the last persisted relative lease duration. It contains no
-//! wall-clock or monotonic-clock reading, last-renewed timestamp, deadline, or
-//! expiry. A released record retains its revision and duration, while a
-//! never-created record has revision zero and no duration.
-//!
-//! [`Leadership`](crate::recipes::leader_election::Leadership) and
-//! [`Observation`](crate::recipes::leader_election::Observation) are caller-local
-//! state. A leadership token may renew only while elapsed time on that caller's
-//! clock is below the duration stored in its exact durable revision. A follower
-//! waits the duration stored in its exact observation, never this handle's
-//! configured duration.
-//! If the observed owner, revision, or duration changes, the caller starts a
-//! new observation window. If it is unchanged, the original observation time
-//! is retained.
-//!
-//! Clocks are never persisted or compared across processes. They only measure
-//! elapsed time for the caller that recorded them. On process restart, use a
-//! fresh [`ParticipantId`](crate::recipes::leader_election::ParticipantId) and
-//! begin again with
-//! [`LocalState::Unknown`](crate::recipes::leader_election::LocalState::Unknown),
-//! so the new incarnation observes the durable state and waits anew before
-//! attempting takeover.
-//!
-//! ## Cutover from v0.11 durable state
-//!
-//! This release's durable state is intentionally incompatible with v0.11.
-//! v0.11 and new clients use different keys, so a mixed deployment is unsafe:
-//! each population can elect a leader without observing or fencing the other.
-//!
-//! Upgrade by a destructive cutover, not an in-place migration. Stop or
-//! quiesce every old participant and all protected work before starting the
-//! new deployment. Then allocate fresh subspaces or epochs for the new
-//! election, its [`RankedRegister`](crate::recipes::ranked_register::RankedRegister),
-//! and the protected sink or rank namespace. Only then start clients using
-//! this release. This recipe neither reads nor migrates v0.11 durable state.
-//!
-//! ## Poll lifecycle
-//!
-//! Call [`LeaderElection::poll`](crate::recipes::leader_election::LeaderElection::poll)
-//! inside the closure passed to
-//! [`Database::run`](crate::Database::run). Read `attempt_started_at` from the
-//! caller's monotonic clock immediately before each `poll` call, including
-//! every retry attempt. It controls renewal and takeover eligibility and stamps
-//! new leadership, so time spent reading, retrying, or committing only shortens
-//! local validity.
-//!
-//! A returned [`PollResult`](crate::recipes::leader_election::PollResult) is
-//! only prepared state. Adopt it with
-//! [`PollResult::into_next_state`](crate::recipes::leader_election::PollResult::into_next_state)
-//! after the outer `Database::run` succeeds. Use a fresh `adopted_at` reading
-//! then: it starts timing for a new or reset observation only after its durable
-//! read is known to have committed. An unchanged observation and a new
-//! leadership token retain their original attempt-local times. This prevents
-//! retries, cancellation, and unknown commits from authorizing work based on
-//! uncommitted caller-local state.
-//!
-//! The poll transaction reads and, for a leadership transition, writes the
-//! same durable key. FoundationDB conflict resolution serializes competing
-//! transitions. Local time only permits an attempted conditional takeover; it
-//! does not prove that the prior process stopped.
-//!
-//! ## Renewal cadence and fencing epochs
-//!
-//! Renew with substantial headroom before local expiry. A cadence around one
-//! third of a lease leaves more room than polling at half a lease for
-//! scheduling delay, transaction retries, and commit latency. Tune it to the
-//! application's latency budget. This is availability guidance, not a safety
-//! condition or a durable expiry.
-//!
-//! A successful acquisition, renewal, reacquisition, or takeover returns a
-//! fresh [`Rank`](crate::recipes::ranked_register::Rank). Each is a new fencing
-//! epoch, including renewal by the same participant. Once the newer rank is
-//! installed, protected work using an older rank, even from that same process,
-//! can be rejected. Leadership status alone never authorizes an unfenced
-//! external side effect.
-//!
-//! Ranks returned by this recipe are opaque durable revisions. Do not mix them
-//! with [`Rank::new`](crate::recipes::ranked_register::Rank::new) values in the
-//! same ranked register or rank space. A manually constructed rank can exceed
-//! every future election revision and permanently fence election-backed work.
-//!
-//! Correctness-sensitive FoundationDB work must use the rank with a
-//! [`RankedRegister`](crate::recipes::ranked_register::RankedRegister) in the
-//! same enclosing transaction. An external sink must atomically enforce the
-//! rank and reject older ranks. See the
-//! [`RankedRegister` composition example](crate::recipes::ranked_register#composing-with-leader-election)
-//! rather than treating a successful poll as sufficient authorization.
-//!
-//! ## Safety versus liveness
-//!
-//! Local expiry does not revoke durable ownership. It only prevents this caller
-//! from renewing with its local token and can lead a follower with an unchanged
-//! observation to attempt takeover. A failed or unavailable poll cannot renew
-//! leadership, so callers must stop protected work that depends on a stale
-//! local token. Fencing ranks, not timing alone, protect against a delayed or
-//! partitioned process.
-//!
-//! Do not rely on a background heartbeat that cannot interrupt, fence, or stop
-//! in-progress protected work. It can renew a lease, but the protected-work
-//! path must still stop when it cannot obtain and use a current fencing rank.
-//!
-//! ## Protocol walkthrough
-//!
-//! 1. Create a non-zero-duration
-//!    [`LeaderElection`](crate::recipes::leader_election::LeaderElection) and a
-//!    fresh [`ParticipantId`](crate::recipes::leader_election::ParticipantId)
-//!    for this process incarnation. Start with
-//!    [`LocalState::Unknown`](crate::recipes::leader_election::LocalState::Unknown).
-//! 2. Poll in a `Database::run` attempt. A released or never-created state
-//!    produces [`PollOutcome::Leader`](crate::recipes::leader_election::PollOutcome::Leader)
-//!    with [`PollTransition::Acquired`](crate::recipes::leader_election::PollTransition::Acquired).
-//!    After the outer transaction succeeds, adopt its
-//!    [`Leadership`](crate::recipes::leader_election::Leadership) through
-//!    [`PollResult::into_next_state`](crate::recipes::leader_election::PollResult::into_next_state).
-//! 3. A caller that sees another owner receives
-//!    [`PollOutcome::Follower`](crate::recipes::leader_election::PollOutcome::Follower).
-//!    Its next [`LocalState`](crate::recipes::leader_election::LocalState)
-//!    contains an [`Observation`](crate::recipes::leader_election::Observation)
-//!    of that exact owner, revision, duration, and local observation time.
-//!    Repeated polls preserve that time only while the durable record is
-//!    unchanged.
-//! 4. The current holder polls with its matching, locally unexpired
-//!    [`Leadership`](crate::recipes::leader_election::Leadership) and receives
-//!    [`PollTransition::Renewed`](crate::recipes::leader_election::PollTransition::Renewed)
-//!    with a new rank. An unchanged observation that has waited at least its
-//!    persisted duration permits
-//!    [`PollTransition::TookOver`](crate::recipes::leader_election::PollTransition::TookOver),
-//!    or [`PollTransition::Reacquired`](crate::recipes::leader_election::PollTransition::Reacquired)
-//!    when the observer is the same participant.
-//! 5. For every leader outcome, co-commit the protected FoundationDB work with
-//!    the returned [`Rank`](crate::recipes::ranked_register::Rank), including
-//!    [`RankedRegister::read`](crate::recipes::ranked_register::RankedRegister::read)
-//!    to install its fence. A later rank fences delayed work using every older
-//!    rank.
-//! 6. A holder may call
-//!    [`LeaderElection::resign`](crate::recipes::leader_election::LeaderElection::resign)
-//!    with its exact leadership token. The conditional release preserves the
-//!    revision, so the next acquisition receives a strictly newer rank. A stale
-//!    resignation is rejected.
-//! 7. If the outer run retries, fails, is cancelled, or has an unknown commit,
-//!    do not adopt its `PollResult`. The next successful run rediscovers the
-//!    durable state. After restart, discard all local state, generate a fresh
-//!    participant ID, and follow the observation path again.
-//!
-//! ## Caller responsibilities
-//!
-//! The caller owns scheduling, retry policy, transaction options, sleeping,
-//! randomization, background work, and caller-local state. This component does
-//! not call `Database::run`, retry, set transaction options, sleep, draw random
-//! values, start background work, or read wall-clock time.
-//!
-//! ## Further reading
-//!
-//! - [AWS Builders Library: Leader Election in Distributed Systems](https://aws.amazon.com/builders-library/leader-election-in-distributed-systems/)
-//! - [Martin Kleppmann: How to do distributed locking](https://martin.kleppmann.com/2016/02/08/how-to-do-distributed-locking.html)
-//! - Mike Burrows, "The Chubby Lock Service for Loosely-Coupled Distributed
-//!   Systems" (OSDI 2006).
-//! - Gregory Chockler and Dahlia Malkhi, "Active Disk Paxos with Infinitely
-//!   Many Processes" (PODC 2002).
-//! - Salman Niazi, Mahmoud Ismail, Gautier Berthou, and Jim Dowling, "Leader
-//!   Election Using NewSQL Database Systems" (DAIS 2015, LNCS 9038).
-//! - [AWS Labs: Amazon DynamoDB Lock Client](https://github.com/awslabs/amazon-dynamodb-lock-client)
-//! - [Apache ZooKeeper Recipes, GUID note](https://zookeeper.apache.org/doc/r3.5.5/recipes.html)
-
-mod algorithm;
-mod errors;
-mod keys;
-mod types;
-
-pub use errors::{LeaderElectionError, Result};
-pub use types::{
-    ElectionState, Leadership, LocalState, Observation, ParticipantId, PollOutcome, PollResult,
-    PollTransition, ResignOutcome,
-};
-
-use crate::{Transaction, tuple::Subspace};
-use std::ops::Deref;
-use std::time::Duration;
-
-/// A handle for one independently scoped leader lease.
-///
-/// `lease_duration` is this caller's non-zero desired duration. It is
-/// persisted on every successful acquisition, takeover, and renewal. Existing
-/// foreign records remain governed by their own persisted duration. The handle
-/// holds no caller-local state and performs no scheduling or retries.
-#[derive(Clone, Debug)]
-pub struct LeaderElection {
-    subspace: Subspace,
-    lease_duration: Duration,
-}
-
-impl LeaderElection {
-    /// Creates an election handle with the non-zero duration it will persist on
-    /// successful ownership changes.
-    ///
-    /// Constructing a handle does not read or initialize durable state.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(subspace))
-    )]
-    pub fn new(subspace: Subspace, lease_duration: Duration) -> Result<Self> {
-        if lease_duration.is_zero() {
-            return Err(LeaderElectionError::InvalidLeaseDuration);
-        }
-        Ok(Self {
-            subspace,
-            lease_duration,
-        })
-    }
-
-    /// Returns this handle's desired duration for its future owner records.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn lease_duration(&self) -> Duration {
-        self.lease_duration
-    }
-
-    /// Polls the durable lease state in the caller's transaction.
-    ///
-    /// A released state is acquired immediately. An exact, locally unexpired
-    /// [`Leadership`] token renews ownership with a fresh revision. A first or
-    /// changed [`Observation`] never steals; only an exact unchanged observation
-    /// may take over, or same-owner reacquire, after the observed record's
-    /// persisted duration. An expired or mismatched leadership token becomes
-    /// observation/reacquisition state and cannot renew directly.
-    ///
-    /// `attempt_started_at` must be read from the caller's monotonic clock
-    /// immediately before this call in each retry attempt. It is deliberately
-    /// before the durable read, making renewal and takeover decisions
-    /// conservative relative to read and commit delay. After the enclosing
-    /// `Database::run` succeeds, pass a fresh caller-clock reading to
-    /// [`PollResult::into_next_state`] to adopt the returned state.
-    ///
-    /// Renew well before the local deadline represented by [`Leadership`],
-    /// leaving headroom for scheduling delay, retries, and commit latency.
-    /// This affects availability only; it is not a durable expiry or safety
-    /// condition.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(
-            level = "debug",
-            skip(self, txn, participant, local_state),
-            fields(participant = participant.as_str())
-        )
-    )]
-    pub async fn poll<T>(
-        &self,
-        txn: &T,
-        participant: &ParticipantId,
-        local_state: &LocalState,
-        attempt_started_at: Duration,
-    ) -> Result<PollResult>
-    where
-        T: Deref<Target = Transaction>,
-    {
-        algorithm::poll(
-            txn,
-            &self.subspace,
-            self.lease_duration,
-            participant,
-            local_state,
-            attempt_started_at,
-        )
-        .await
-    }
-
-    /// Reads durable state without making any liveness or leadership-validity claim.
-    ///
-    /// This is a snapshot only. It does not create a local observation, permit
-    /// renewal or takeover, or authorize protected work.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(self, txn))
-    )]
-    pub async fn state<T>(&self, txn: &T) -> Result<ElectionState>
-    where
-        T: Deref<Target = Transaction>,
-    {
-        algorithm::state(txn, &self.subspace).await
-    }
-
-    /// Releases ownership only when `leadership` still exactly matches durable state.
-    ///
-    /// The revision and persisted duration remain, so a later acquisition has
-    /// a strictly newer fencing rank. A stale delayed resignation is rejected.
-    /// This conditional operation does not make a liveness claim and may be
-    /// used to relinquish an otherwise exact durable token after its local
-    /// renewal window has elapsed.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(
-            level = "debug",
-            skip(self, txn, leadership),
-            fields(
-                participant = leadership.participant().as_str(),
-                leadership_revision = leadership.rank().as_u64()
-            )
-        )
-    )]
-    pub async fn resign<T>(&self, txn: &T, leadership: &Leadership) -> Result<ResignOutcome>
-    where
-        T: Deref<Target = Transaction>,
-    {
-        algorithm::resign(txn, &self.subspace, leadership).await
-    }
-}
diff --git a/bindings/rust/foundationdb/src/recipes/leader_election/types.rs b/bindings/rust/foundationdb/src/recipes/leader_election/types.rs
deleted file mode 100644
index e3db8a89623..00000000000
--- a/bindings/rust/foundationdb/src/recipes/leader_election/types.rs
+++ /dev/null
@@ -1,549 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Public values exchanged with the Dynamo-style lease protocol.
-
-use super::{LeaderElectionError, Result};
-use crate::recipes::ranked_register::Rank;
-use std::time::Duration;
-
-/// Identifies one caller process incarnation participating in an election.
-///
-/// Keep one ID for the lifetime of a process incarnation, then use a fresh ID
-/// after restart. Reusing an ID across concurrent callers is protocol misuse:
-/// fencing ranks preserve durable data safety, but the callers cannot safely
-/// coordinate leadership or protected work as one incarnation.
-#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
-pub struct ParticipantId(String);
-
-impl ParticipantId {
-    /// Maximum tuple-encoded size of a process-incarnation ID.
-    ///
-    /// The limit includes the tuple string type code, terminator, and escaping
-    /// of embedded NUL bytes. It leaves enough space for the rest of the
-    /// durable election state below FoundationDB's 100,000-byte value limit.
-    pub const MAX_ENCODED_BYTES: usize = 95_000;
-
-    /// Creates a non-empty process-incarnation ID within the encoded-size limit.
-    ///
-    /// The value is persisted as the durable owner when this participant leads,
-    /// so it must distinguish a restarted process from its previous incarnation.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(value)))]
-    pub fn new(value: impl Into<String>) -> Result<Self> {
-        let value = value.into();
-        if value.is_empty() {
-            return Err(LeaderElectionError::InvalidParticipantId);
-        }
-        let encoded_size = value
-            .bytes()
-            .filter(|byte| *byte == 0)
-            .fold(value.len().saturating_add(2), |size, _| {
-                size.saturating_add(1)
-            });
-        if encoded_size > Self::MAX_ENCODED_BYTES {
-            return Err(LeaderElectionError::ParticipantIdTooLarge {
-                encoded_size,
-                limit: Self::MAX_ENCODED_BYTES,
-            });
-        }
-        Ok(Self(value))
-    }
-
-    /// Returns the caller-supplied process-incarnation ID as text.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn participant_id_accepts_the_encoded_size_limit() {
-        let value = "\0".repeat((ParticipantId::MAX_ENCODED_BYTES - 2) / 2);
-
-        assert!(ParticipantId::new(value).is_ok());
-    }
-
-    #[test]
-    fn participant_id_rejects_an_encoded_size_above_the_limit() {
-        let value = "\0".repeat(ParticipantId::MAX_ENCODED_BYTES / 2);
-
-        match ParticipantId::new(value) {
-            Err(LeaderElectionError::ParticipantIdTooLarge {
-                encoded_size,
-                limit,
-            }) => {
-                assert_eq!(encoded_size, ParticipantId::MAX_ENCODED_BYTES + 2);
-                assert_eq!(limit, ParticipantId::MAX_ENCODED_BYTES);
-            }
-            result => panic!("expected an oversized participant ID error, got {result:?}"),
-        }
-    }
-}
-
-/// Caller-owned state carried between successful outer transactions.
-///
-/// No variant is persisted or transferable to another process incarnation. Its
-/// timing values belong to the caller's monotonic clock. Replace it only with
-/// [`PollResult::into_next_state`] after the enclosing
-/// [`Database::run`](crate::Database::run) succeeds.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum LocalState {
-    /// No durable state has been adopted by this caller.
-    Unknown,
-    /// An exact durable owner record this caller is not authorized to renew.
-    ///
-    /// The preserved observation time can permit a conditional takeover only
-    /// if a later poll sees the same owner, revision, and lease duration.
-    Observation(Observation),
-    /// The exact durable owner record this caller may attempt to renew locally.
-    ///
-    /// It does not prove current durable ownership. A later poll must still
-    /// match the record and find this caller's local lease interval unexpired.
-    Leadership(Leadership),
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(super) enum PendingNextState {
-    PreservedObservation(Observation),
-    NewObservation {
-        owner: ParticipantId,
-        rank: Rank,
-        lease_duration: Duration,
-    },
-    Leadership(Leadership),
-}
-
-impl PendingNextState {
-    pub(super) fn preserve_observation(observation: Observation) -> Self {
-        Self::PreservedObservation(observation)
-    }
-
-    pub(super) fn new_observation(
-        owner: ParticipantId,
-        rank: Rank,
-        lease_duration: Duration,
-    ) -> Self {
-        Self::NewObservation {
-            owner,
-            rank,
-            lease_duration,
-        }
-    }
-
-    pub(super) fn leadership(leadership: Leadership) -> Self {
-        Self::Leadership(leadership)
-    }
-
-    fn into_local_state(self, adopted_at: Duration) -> LocalState {
-        // A new observation starts its timer only after the outer transaction
-        // commits; a preserved observation retains the timer already adopted.
-        match self {
-            Self::PreservedObservation(observation) => LocalState::Observation(observation),
-            Self::NewObservation {
-                owner,
-                rank,
-                lease_duration,
-            } => LocalState::Observation(Observation::new(owner, rank, lease_duration, adopted_at)),
-            Self::Leadership(leadership) => LocalState::Leadership(leadership),
-        }
-    }
-}
-
-impl LocalState {
-    /// Returns the initial state for a caller that has not adopted a poll result.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug"))]
-    pub fn unknown() -> Self {
-        Self::Unknown
-    }
-
-    /// Returns the adopted observation, if this caller is following an owner.
-    ///
-    /// `None` means either no state has been adopted or this caller holds a
-    /// local leadership token. It does not query durable state.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn observation(&self) -> Option<&Observation> {
-        match self {
-            Self::Observation(observation) => Some(observation),
-            Self::Unknown | Self::Leadership(_) => None,
-        }
-    }
-
-    /// Returns the adopted local leadership token, if any.
-    ///
-    /// The returned token is input to a later [`super::LeaderElection::poll`]
-    /// or [`super::LeaderElection::resign`] call, not proof that the caller
-    /// remains the durable owner.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn leadership(&self) -> Option<&Leadership> {
-        match self {
-            Self::Leadership(leadership) => Some(leadership),
-            Self::Unknown | Self::Observation(_) => None,
-        }
-    }
-}
-
-/// An exact durable owner record adopted after a successful outer transaction.
-///
-/// This records the owner, revision, and persisted duration observed together,
-/// plus the caller-clock instant at which that result was adopted. It is valid
-/// for takeover timing only while a later poll finds the same durable record.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct Observation {
-    owner: ParticipantId,
-    rank: Rank,
-    lease_duration: Duration,
-    first_observed_at: Duration,
-}
-
-impl Observation {
-    pub(crate) fn new(
-        owner: ParticipantId,
-        rank: Rank,
-        lease_duration: Duration,
-        first_observed_at: Duration,
-    ) -> Self {
-        Self {
-            owner,
-            rank,
-            lease_duration,
-            first_observed_at,
-        }
-    }
-
-    /// Returns the owner in the exact durable record this caller observed.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn owner(&self) -> &ParticipantId {
-        &self.owner
-    }
-
-    /// Returns the exact observed durable revision as a fencing rank.
-    ///
-    /// A changed rank makes this observation ineligible to authorize a
-    /// takeover, even if the owner text is unchanged.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn rank(&self) -> Rank {
-        self.rank
-    }
-
-    /// Returns the lease duration persisted with the observed revision.
-    ///
-    /// Followers use this value, rather than a handle's configured duration,
-    /// when deciding whether the unchanged record is old enough to challenge.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn lease_duration(&self) -> Duration {
-        self.lease_duration
-    }
-
-    /// Returns the caller-clock time when this observation was adopted.
-    ///
-    /// Compare it only with readings from the same caller's monotonic clock.
-    /// It is not a durable timestamp or a deadline for the observed owner.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn first_observed_at(&self) -> Duration {
-        self.first_observed_at
-    }
-}
-
-/// The exact durable owner record a caller may attempt to renew before local expiry.
-///
-/// It is caller-local evidence, not a lease granted by a durable clock: a poll
-/// must still verify the participant, rank, and persisted duration against
-/// durable state. A later successful leader poll, including renewal by this
-/// same participant, supersedes this token's fencing rank.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct Leadership {
-    participant: ParticipantId,
-    rank: Rank,
-    lease_duration: Duration,
-    last_renewed_at: Duration,
-}
-
-impl Leadership {
-    pub(crate) fn new(
-        participant: ParticipantId,
-        rank: Rank,
-        lease_duration: Duration,
-        last_renewed_at: Duration,
-    ) -> Self {
-        Self {
-            participant,
-            rank,
-            lease_duration,
-            last_renewed_at,
-        }
-    }
-
-    /// Returns the process incarnation this token identifies as owner.
-    ///
-    /// A renewal attempt additionally requires this to match the participant
-    /// passed to [`super::LeaderElection::poll`].
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn participant(&self) -> &ParticipantId {
-        &self.participant
-    }
-
-    /// Returns this token's durable revision as a fencing rank.
-    ///
-    /// A later successful leader poll supersedes this rank, including renewal
-    /// by the same participant.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn rank(&self) -> Rank {
-        self.rank
-    }
-
-    /// Returns the lease duration persisted with this token.
-    ///
-    /// It bounds local renewability from [`Self::last_renewed_at`], not the
-    /// durable owner's lifetime.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn lease_duration(&self) -> Duration {
-        self.lease_duration
-    }
-
-    /// Returns the caller-clock time supplied at the successful poll attempt's start.
-    ///
-    /// A renewal is locally eligible only while elapsed time from this value is
-    /// less than [`Self::lease_duration`]. It must be compared only with the
-    /// same caller's monotonic clock.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn last_renewed_at(&self) -> Duration {
-        self.last_renewed_at
-    }
-}
-
-/// The role and fencing rank prepared by one poll transaction attempt.
-///
-/// The rank may protect work staged in the same transaction, but it authorizes
-/// no committed or external work until the enclosing
-/// [`Database::run`](crate::Database::run) succeeds.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum PollOutcome {
-    /// The transaction staged this caller as owner with a fresh fencing rank.
-    ///
-    /// [`PollTransition`] classifies how that staged ownership was reached.
-    Leader {
-        rank: Rank,
-        transition: PollTransition,
-    },
-    /// A durable owner was observed, but no leadership transition was staged.
-    ///
-    /// The fields form the exact record used to produce the next
-    /// [`LocalState::Observation`].
-    Follower {
-        owner: ParticipantId,
-        rank: Rank,
-        lease_duration: Duration,
-    },
-}
-
-/// The state-machine transition classified by one poll attempt.
-///
-/// This is an outcome label, not separately persisted durable state. It is
-/// meaningful only with the [`PollOutcome`] produced by the committed outer
-/// transaction.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum PollTransition {
-    /// A released or never-created durable state was acquired immediately.
-    Acquired,
-    /// An exact, locally unexpired [`Leadership`] token was renewed.
-    Renewed,
-    /// An unchanged foreign [`Observation`] was replaced after its persisted duration.
-    TookOver,
-    /// An expired [`Observation`] of this same participant was acquired again.
-    Reacquired,
-    /// A durable owner was observed without a permitted leadership transition.
-    ///
-    /// This is returned for [`PollOutcome::Follower`] and never stages an
-    /// ownership mutation.
-    Followed,
-}
-
-impl PollOutcome {
-    /// Returns whether this attempt staged an ownership transition.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn is_leader(&self) -> bool {
-        matches!(self, Self::Leader { .. })
-    }
-
-    /// Returns the observed or newly staged durable revision as a fencing rank.
-    ///
-    /// Only [`Self::is_leader`] outcomes provide a new rank that can protect
-    /// work staged by this poll transaction.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn rank(&self) -> Rank {
-        match self {
-            Self::Leader { rank, .. } | Self::Follower { rank, .. } => *rank,
-        }
-    }
-
-    /// Returns the transition classification for this attempt.
-    ///
-    /// [`PollOutcome::Follower`] always reports [`PollTransition::Followed`].
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn transition(&self) -> PollTransition {
-        match self {
-            Self::Leader { transition, .. } => *transition,
-            Self::Follower { .. } => PollTransition::Followed,
-        }
-    }
-
-    /// Returns whether this attempt staged replacement of a foreign owner.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn is_takeover(&self) -> bool {
-        self.transition() == PollTransition::TookOver
-    }
-
-    /// Returns whether this attempt staged reacquisition of this participant's expired record.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn is_reacquisition(&self) -> bool {
-        self.transition() == PollTransition::Reacquired
-    }
-
-    /// Returns the observed owner when this attempt produced follower state.
-    ///
-    /// The owner is an observation, not an authorization for the caller.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn owner(&self) -> Option<&ParticipantId> {
-        match self {
-            Self::Follower { owner, .. } => Some(owner),
-            Self::Leader { .. } => None,
-        }
-    }
-
-    /// Returns the observed persisted lease duration when following.
-    ///
-    /// This duration is relevant to a later poll only with the matching
-    /// [`Observation`] adopted by [`PollResult::into_next_state`].
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn lease_duration(&self) -> Option<Duration> {
-        match self {
-            Self::Follower { lease_duration, .. } => Some(*lease_duration),
-            Self::Leader { .. } => None,
-        }
-    }
-}
-
-/// The result prepared by [`super::LeaderElection::poll`].
-///
-/// Keep this value inside the transaction callback until the enclosing
-/// [`Database::run`](crate::Database::run) succeeds. Before then, the
-/// transaction can retry, be cancelled, or fail to commit. On success, inspect
-/// [`Self::outcome`] and consume it with [`Self::into_next_state`] to carry
-/// caller-local validity into the next attempt.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct PollResult {
-    outcome: PollOutcome,
-    pending_next_state: PendingNextState,
-}
-
-impl PollResult {
-    pub(super) fn new(outcome: PollOutcome, pending_next_state: PendingNextState) -> Self {
-        Self {
-            outcome,
-            pending_next_state,
-        }
-    }
-
-    /// Returns the role and fencing rank prepared by this transaction attempt.
-    ///
-    /// See [`PollOutcome`] for when the rank is usable for protected work.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn outcome(&self) -> &PollOutcome {
-        &self.outcome
-    }
-
-    /// Consumes this result and returns the caller-local state for the next attempt.
-    ///
-    /// `adopted_at` must be read from the caller's monotonic clock after the
-    /// enclosing [`Database::run`](crate::Database::run) succeeds. It timestamps only a new or reset
-    /// observation; an unchanged observation and leadership token retain their
-    /// original attempt-local timestamps.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn into_next_state(self, adopted_at: Duration) -> LocalState {
-        self.pending_next_state.into_local_state(adopted_at)
-    }
-}
-
-/// A read-only snapshot of durable state for diagnostics and observability.
-///
-/// It makes no liveness, expiry, or leadership-validity claim. Use
-/// [`super::LeaderElection::poll`] with caller-owned [`LocalState`] for
-/// protocol decisions instead of deriving authority from this snapshot.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ElectionState {
-    owner: Option<ParticipantId>,
-    rank: Rank,
-    lease_duration: Option<Duration>,
-}
-
-impl ElectionState {
-    pub(crate) fn new(
-        owner: Option<ParticipantId>,
-        rank: Rank,
-        lease_duration: Option<Duration>,
-    ) -> Self {
-        Self {
-            owner,
-            rank,
-            lease_duration,
-        }
-    }
-
-    /// Returns the durable owner, if the observed state is not released.
-    ///
-    /// `Some` does not show whether that owner is running or locally renewable.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn owner(&self) -> Option<&ParticipantId> {
-        self.owner.as_ref()
-    }
-
-    /// Returns the durable revision as a fencing rank.
-    ///
-    /// A rank is retained after resignation so a later acquisition receives a
-    /// strictly newer fencing epoch.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn rank(&self) -> Rank {
-        self.rank
-    }
-
-    /// Returns the last persisted lease duration, if this state has been created.
-    ///
-    /// It is historical state, not a persisted expiration deadline.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn lease_duration(&self) -> Option<Duration> {
-        self.lease_duration
-    }
-}
-
-/// Result of a conditional resignation attempt.
-///
-/// It describes what the current transaction staged and is final only after
-/// the enclosing [`Database::run`](crate::Database::run) succeeds.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ResignOutcome {
-    /// The matching [`Leadership`] token staged a release in the current transaction.
-    Resigned,
-    /// The durable owner, revision, or persisted duration no longer matched.
-    ///
-    /// No release mutation was staged, preventing an old delayed resignation
-    /// from releasing a newer leader.
-    Rejected,
-}
-
-impl ResignOutcome {
-    /// Returns whether the current transaction staged the matching resignation.
-    ///
-    /// This is not proof of release until the outer transaction commits.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn is_resigned(&self) -> bool {
-        matches!(self, Self::Resigned)
-    }
-}
diff --git a/bindings/rust/foundationdb/src/recipes/mod.rs b/bindings/rust/foundationdb/src/recipes/mod.rs
deleted file mode 100644
index 1d01c48ec67..00000000000
--- a/bindings/rust/foundationdb/src/recipes/mod.rs
+++ /dev/null
@@ -1,38 +0,0 @@
-//! # FoundationDB Recipes
-//!
-//! This module provides high-level distributed system recipes for FoundationDB,
-//! similar to Apache Curator for ZooKeeper. These recipes implement common
-//! distributed system patterns and primitives on top of FoundationDB's
-//! transactional key-value store.
-//!
-//! ## Available Recipes
-//!
-//! - **Leader Election**: Distributed leader election mechanism that allows
-//!   multiple processes to coordinate and elect a single leader. This is useful
-//!   for implementing primary/secondary architectures, distributed task coordination,
-//!   and ensuring single-writer patterns in distributed systems.
-//!
-//! ## Usage
-//!
-//! Each recipe is behind its own feature flag to keep the core library lightweight.
-//! Enable the recipes you need in your `Cargo.toml`:
-//!
-//! ```toml
-//! [dependencies]
-//! foundationdb = { version = "*", features = ["recipes-leader-election"] }
-//! ```
-//!
-//! Or enable all recipes at once:
-//!
-//! ```toml
-//! [dependencies]
-//! foundationdb = { version = "*", features = ["recipes"] }
-//! ```
-
-/// Leader election recipe for distributed consensus
-#[cfg(feature = "recipes-leader-election")]
-pub mod leader_election;
-
-/// Ranked register recipe for Paxos-style ballot fencing
-#[cfg(feature = "recipes-ranked-register")]
-pub mod ranked_register;
diff --git a/bindings/rust/foundationdb/src/recipes/ranked_register/algorithm.rs b/bindings/rust/foundationdb/src/recipes/ranked_register/algorithm.rs
deleted file mode 100644
index 23c7273dba4..00000000000
--- a/bindings/rust/foundationdb/src/recipes/ranked_register/algorithm.rs
+++ /dev/null
@@ -1,305 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Ranked register algorithm
-//!
-//! Implements the core read/write/value operations from Chockler & Malkhi's
-//! "Active Disk Paxos with infinitely many processes" (PODC 2002, Section 5.1, Figure 3).
-//!
-//! All functions operate within a FoundationDB transaction for atomicity.
-
-use crate::{
-    RangeOption, Transaction,
-    tuple::{Subspace, pack, unpack},
-};
-use futures::TryStreamExt;
-use std::ops::Deref;
-
-use super::{
-    MAX_VALUE_CHUNK_BYTES,
-    errors::{RankedRegisterError, Result},
-    keys,
-    types::*,
-};
-
-const STATE_SCHEMA_VERSION: u64 = 1;
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
-struct MetadataState {
-    max_read_rank: Rank,
-    max_write_rank: Rank,
-}
-
-/// Reads versioned durable metadata. An absent key is the bottom state.
-async fn read_metadata<T>(txn: &T, key: &[u8]) -> Result<Option<MetadataState>>
-where
-    T: Deref<Target = Transaction>,
-{
-    let Some(value) = txn.get(key, false).await? else {
-        return Ok(None);
-    };
-
-    decode_metadata(&value).map(Some)
-}
-
-fn decode_metadata(value: &[u8]) -> Result<MetadataState> {
-    let (schema_version, max_read_rank, max_write_rank): (u64, u64, u64) =
-        unpack(value).map_err(|error| {
-            RankedRegisterError::InvalidState(format!(
-                "metadata does not match the versioned ranked-register schema: {error:?}"
-            ))
-        })?;
-    if schema_version != STATE_SCHEMA_VERSION {
-        return Err(RankedRegisterError::InvalidState(format!(
-            "unknown metadata schema version {schema_version}, expected {STATE_SCHEMA_VERSION}"
-        )));
-    }
-
-    Ok(MetadataState {
-        max_read_rank: Rank::from(max_read_rank),
-        max_write_rank: Rank::from(max_write_rank),
-    })
-}
-
-fn write_metadata<T>(txn: &T, key: &[u8], state: MetadataState)
-where
-    T: Deref<Target = Transaction>,
-{
-    txn.set(
-        key,
-        &pack(&(
-            STATE_SCHEMA_VERSION,
-            state.max_read_rank.as_u64(),
-            state.max_write_rank.as_u64(),
-        )),
-    );
-}
-
-/// Reads and validates all raw value chunks.
-async fn read_value<T>(txn: &T, subspace: &Subspace, has_metadata: bool) -> Result<Option<Vec<u8>>>
-where
-    T: Deref<Target = Transaction>,
-{
-    let value_subspace = keys::value_subspace(subspace);
-    let mut chunks = txn.get_ranges_keyvalues(RangeOption::from(&value_subspace), false);
-    let mut expected_index = 0_u64;
-    let mut value = Vec::new();
-    let mut has_chunks = false;
-
-    while let Some(chunk) = chunks.try_next().await? {
-        if !has_metadata {
-            return Err(RankedRegisterError::InvalidState(
-                "value chunks exist without register metadata".to_owned(),
-            ));
-        }
-
-        let index = decode_value_index(&value_subspace, chunk.key())?;
-        validate_value_index(expected_index, index)?;
-        expected_index = expected_index.checked_add(1).ok_or_else(|| {
-            RankedRegisterError::InvalidState(
-                "value chunk index sequence exceeds the supported u64 domain".to_owned(),
-            )
-        })?;
-        value.extend_from_slice(chunk.value());
-        has_chunks = true;
-    }
-
-    Ok(has_chunks.then_some(value))
-}
-
-fn decode_value_index(value_subspace: &Subspace, key: &[u8]) -> Result<u64> {
-    let (index,): (u64,) = value_subspace.unpack(key).map_err(|error| {
-        RankedRegisterError::InvalidState(format!("malformed value chunk key: {error:?}"))
-    })?;
-    Ok(index)
-}
-
-fn validate_value_index(expected: u64, actual: u64) -> Result<()> {
-    if actual != expected {
-        return Err(RankedRegisterError::InvalidState(format!(
-            "value chunk index {actual} is not the expected contiguous index {expected}"
-        )));
-    }
-    Ok(())
-}
-
-fn write_value<T>(txn: &T, subspace: &Subspace, value: &[u8]) -> Result<usize>
-where
-    T: Deref<Target = Transaction>,
-{
-    let value_subspace = keys::value_subspace(subspace);
-    txn.clear_subspace_range(&value_subspace);
-
-    if value.is_empty() {
-        txn.set(&keys::value_key(subspace, 0), value);
-        return Ok(1);
-    }
-
-    for (index, chunk) in value.chunks(MAX_VALUE_CHUNK_BYTES).enumerate() {
-        let index = u64::try_from(index).map_err(|_| {
-            RankedRegisterError::InvalidState(
-                "value requires more chunks than the supported u64 index domain".to_owned(),
-            )
-        })?;
-        txn.set(&keys::value_key(subspace, index), chunk);
-    }
-
-    Ok(value_chunk_count(value.len()))
-}
-
-fn value_chunk_count(value_len: usize) -> usize {
-    if value_len == 0 {
-        1
-    } else {
-        value_len / MAX_VALUE_CHUNK_BYTES + usize::from(value_len % MAX_VALUE_CHUNK_BYTES != 0)
-    }
-}
-
-/// Perform a ranked read on the register.
-///
-/// Updates `max_read_rank` if the given rank is higher than the current one,
-/// effectively installing a fence that prevents lower-ranked writes.
-/// Returns the current write rank and value.
-pub async fn read<T>(txn: &T, subspace: &Subspace, rank: Rank) -> Result<ReadResult>
-where
-    T: Deref<Target = Transaction>,
-{
-    let metadata_key = keys::state_key(subspace);
-    let maybe_state = read_metadata(txn, &metadata_key).await?;
-    let mut state = maybe_state.unwrap_or_default();
-    let value = read_value(txn, subspace, maybe_state.is_some()).await?;
-
-    if rank > state.max_read_rank {
-        #[cfg(feature = "trace")]
-        tracing::debug!(
-            register_action = "fence_installed",
-            rank = rank.as_u64(),
-            previous_max_read_rank = state.max_read_rank.as_u64(),
-            "ranked-register fence staged in transaction"
-        );
-        state.max_read_rank = rank;
-        write_metadata(txn, &metadata_key, state);
-    }
-
-    Ok(ReadResult {
-        write_rank: state.max_write_rank,
-        value,
-    })
-}
-
-/// Perform a ranked write on the register.
-///
-/// Commits the value only if:
-/// - `rank >= max_read_rank` (no higher-ranked read has installed a fence)
-/// - `rank > max_write_rank` (no equal-or-higher-ranked write has occurred)
-///
-/// Returns `Committed` if the write succeeds, `Aborted` otherwise.
-pub async fn write<T>(
-    txn: &T,
-    subspace: &Subspace,
-    rank: Rank,
-    value: &[u8],
-    max_value_bytes: Option<usize>,
-) -> Result<WriteResult>
-where
-    T: Deref<Target = Transaction>,
-{
-    if let Some(limit) = max_value_bytes.filter(|limit| value.len() > *limit) {
-        return Err(RankedRegisterError::ValueTooLarge {
-            value_size: value.len(),
-            limit,
-        });
-    }
-
-    let metadata_key = keys::state_key(subspace);
-    let maybe_state = read_metadata(txn, &metadata_key).await?;
-    let mut state = maybe_state.unwrap_or_default();
-
-    if rank < state.max_read_rank || rank <= state.max_write_rank {
-        #[cfg(feature = "trace")]
-        tracing::debug!(
-            register_action = "write_aborted",
-            rank = rank.as_u64(),
-            max_read_rank = state.max_read_rank.as_u64(),
-            max_write_rank = state.max_write_rank.as_u64(),
-            fenced_by_read = rank < state.max_read_rank,
-            fenced_by_write = rank <= state.max_write_rank,
-            "ranked-register write rejected by fencing rank"
-        );
-        return Ok(WriteResult::Aborted);
-    }
-
-    #[cfg(feature = "trace")]
-    let previous_max_write_rank = state.max_write_rank;
-    state.max_write_rank = rank;
-    write_metadata(txn, &metadata_key, state);
-    #[cfg(feature = "trace")]
-    let chunk_count = write_value(txn, subspace, value)?;
-    #[cfg(not(feature = "trace"))]
-    write_value(txn, subspace, value)?;
-
-    #[cfg(feature = "trace")]
-    tracing::debug!(
-        register_action = "write_staged",
-        rank = rank.as_u64(),
-        previous_max_read_rank = state.max_read_rank.as_u64(),
-        previous_max_write_rank = previous_max_write_rank.as_u64(),
-        value_bytes = value.len(),
-        value_chunks = chunk_count,
-        "ranked-register write staged in transaction"
-    );
-
-    Ok(WriteResult::Committed)
-}
-
-/// Read the current value without updating ranks.
-///
-/// This is a plain read for followers and observers. It does not update
-/// `max_read_rank`, so it installs no durable fence. As non-snapshot reads,
-/// metadata and value chunks add conflict ranges for this register.
-///
-/// Safe to call from any process at any time.
-pub async fn value<T>(txn: &T, subspace: &Subspace) -> Result<Option<Vec<u8>>>
-where
-    T: Deref<Target = Transaction>,
-{
-    let metadata_key = keys::state_key(subspace);
-    let maybe_state = read_metadata(txn, &metadata_key).await?;
-    read_value(txn, subspace, maybe_state.is_some()).await
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn value_chunk_count_preserves_empty_values() {
-        assert_eq!(value_chunk_count(0), 1);
-        assert_eq!(value_chunk_count(MAX_VALUE_CHUNK_BYTES), 1);
-        assert_eq!(value_chunk_count(MAX_VALUE_CHUNK_BYTES + 1), 2);
-    }
-
-    #[test]
-    fn non_contiguous_value_index_is_invalid_state() {
-        let error = validate_value_index(0, 1).expect_err("gapped value chunks must fail");
-        assert!(matches!(error, RankedRegisterError::InvalidState(_)));
-    }
-
-    #[test]
-    fn malformed_metadata_is_invalid_state() {
-        let error = decode_metadata(&pack(&(0_u64, 0_u64)))
-            .expect_err("untagged metadata must not be decoded");
-        assert!(matches!(error, RankedRegisterError::InvalidState(_)));
-    }
-
-    #[test]
-    fn unknown_metadata_version_is_invalid_state() {
-        let error = decode_metadata(&pack(&(STATE_SCHEMA_VERSION + 1, 0_u64, 0_u64)))
-            .expect_err("unknown schema versions must fail");
-        assert!(matches!(error, RankedRegisterError::InvalidState(_)));
-    }
-}
diff --git a/bindings/rust/foundationdb/src/recipes/ranked_register/errors.rs b/bindings/rust/foundationdb/src/recipes/ranked_register/errors.rs
deleted file mode 100644
index 427a1578274..00000000000
--- a/bindings/rust/foundationdb/src/recipes/ranked_register/errors.rs
+++ /dev/null
@@ -1,88 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Error types for the ranked register
-
-use crate::tuple::PackError;
-use crate::{FdbBindingError, FdbError, RetryableError};
-use std::fmt;
-
-/// Ranked register specific errors
-#[derive(Debug)]
-pub enum RankedRegisterError {
-    /// Database error
-    Fdb(FdbError),
-    /// Retry loop error
-    Binding(FdbBindingError),
-    /// Serialization error
-    PackError(PackError),
-    /// Invalid state encountered in the register
-    InvalidState(String),
-    /// The requested raw value exceeds this handle's configured limit.
-    ///
-    /// This is a non-retryable caller error. The limit is local configuration
-    /// and is never persisted in FoundationDB.
-    ValueTooLarge {
-        /// Requested raw value size in bytes.
-        value_size: usize,
-        /// Configured maximum raw value size in bytes.
-        limit: usize,
-    },
-}
-
-impl fmt::Display for RankedRegisterError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Fdb(e) => write!(f, "Database error: {e}"),
-            Self::Binding(e) => write!(f, "Retry loop error: {e}"),
-            Self::PackError(e) => write!(f, "Pack error: {e:?}"),
-            Self::InvalidState(msg) => write!(f, "Invalid state: {msg}"),
-            Self::ValueTooLarge { value_size, limit } => {
-                write!(
-                    f,
-                    "Register value is {value_size} bytes, above the {limit}-byte limit"
-                )
-            }
-        }
-    }
-}
-
-impl std::error::Error for RankedRegisterError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Self::Fdb(e) => Some(e),
-            Self::Binding(e) => Some(e),
-            Self::PackError(e) => Some(e),
-            Self::InvalidState(_) | Self::ValueTooLarge { .. } => None,
-        }
-    }
-}
-
-impl From<FdbError> for RankedRegisterError {
-    fn from(error: FdbError) -> Self {
-        Self::Fdb(error)
-    }
-}
-
-impl From<FdbBindingError> for RankedRegisterError {
-    fn from(error: FdbBindingError) -> Self {
-        Self::Binding(error)
-    }
-}
-
-impl From<PackError> for RankedRegisterError {
-    fn from(error: PackError) -> Self {
-        Self::PackError(error)
-    }
-}
-
-/// The `source()` chain exposes the wrapped `FdbError`, so the default
-/// `retry_decision` makes this error retry-transparent in `db.run`.
-impl RetryableError for RankedRegisterError {}
-
-/// Result type for ranked register operations
-pub type Result<T> = std::result::Result<T, RankedRegisterError>;
diff --git a/bindings/rust/foundationdb/src/recipes/ranked_register/keys.rs b/bindings/rust/foundationdb/src/recipes/ranked_register/keys.rs
deleted file mode 100644
index a9929c39e6e..00000000000
--- a/bindings/rust/foundationdb/src/recipes/ranked_register/keys.rs
+++ /dev/null
@@ -1,53 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Key management for the ranked register
-//!
-//! Each [`RankedRegister`](super::RankedRegister) stores versioned metadata at
-//! one key and its value in sequential child keys in its own [`Subspace`].
-//!
-//! # Key Schema
-//!
-//! ```text
-//! <subspace>/state       -> (schema_version: u64, max_read_rank: u64, max_write_rank: u64)
-//! <subspace>/value/<u64> -> raw value chunk
-//! ```
-//!
-//! Value chunks use consecutive indices starting at zero. Each is raw bytes,
-//! up to FoundationDB's exact 100,000-byte value limit. The metadata schema is
-//! decoded strictly. Older unversioned state is unsupported, so use a fresh
-//! subspace or clear an existing subspace before adopting this schema.
-//!
-//! Every ranked read or write for one subspace contends on this single key, so
-//! those updates serialize through FoundationDB conflicts. Model a keyed
-//! collection with one child subspace per logical key.
-
-use crate::tuple::Subspace;
-
-/// Key prefix for register state
-const STATE_PREFIX: &str = "state";
-const VALUE_PREFIX: &str = "value";
-
-/// Generate the key for the register state
-///
-/// Returns the single key where all register state is stored.
-///
-/// # Key Structure
-/// `<subspace>/state`
-pub fn state_key(subspace: &Subspace) -> Vec<u8> {
-    subspace.pack(&(STATE_PREFIX,))
-}
-
-/// Returns the child subspace containing raw value chunks.
-pub(crate) fn value_subspace(subspace: &Subspace) -> Subspace {
-    subspace.subspace(&(VALUE_PREFIX,))
-}
-
-/// Returns the key for one raw value chunk.
-pub(crate) fn value_key(subspace: &Subspace, index: u64) -> Vec<u8> {
-    value_subspace(subspace).pack(&(index,))
-}
diff --git a/bindings/rust/foundationdb/src/recipes/ranked_register/mod.rs b/bindings/rust/foundationdb/src/recipes/ranked_register/mod.rs
deleted file mode 100644
index aea8266e238..00000000000
--- a/bindings/rust/foundationdb/src/recipes/ranked_register/mod.rs
+++ /dev/null
@@ -1,283 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! # Ranked Register for FoundationDB
-//!
-//! A shared memory abstraction that encapsulates Paxos ballots, based on
-//! Chockler & Malkhi's "Active Disk Paxos with infinitely many processes"
-//! (PODC 2002). A ranked register is a mutable register with conflict detection
-//! via ranks, supporting unbounded processes with finite storage.
-//!
-//! Sections 4.2 and 4.3 of the paper use one logical ranked register. Section
-//! 5.1 implements it from one read-modify-write object, while Section 5.2 uses
-//! `n` registers as replicas to emulate one fault-tolerant logical register.
-//! This implementation is the single logical cell because FoundationDB already
-//! supplies replication and transactions. Multiple child-subspace registers are
-//! application sharding, not a replication requirement from the paper.
-//!
-//! ## Operations
-//!
-//! | Operation | Who | Effect |
-//! |-----------|-----|--------|
-//! | [`read(rank)`](crate::recipes::ranked_register::RankedRegister::read) | Leader | Raises max_read_rank only for a higher rank, returns current value |
-//! | [`write(rank, value)`](crate::recipes::ranked_register::RankedRegister::write) | Leader | Commits only if rank is high enough |
-//! | [`value()`](crate::recipes::ranked_register::RankedRegister::value) | Followers | Plain read, no fence installed |
-//!
-//! ## Addressing, schema, and capacity
-//!
-//! One [`RankedRegister`](crate::recipes::ranked_register::RankedRegister) owns
-//! one [`Subspace`](crate::tuple::Subspace). Its internal `"state"` key stores
-//! a versioned metadata tuple, while raw value bytes are stored in sequential
-//! `"value"/<u64 index>` child keys. For a keyed collection, derive a child
-//! subspace from each logical key before constructing the register:
-//!
-//! ```rust
-//! use foundationdb::{recipes::ranked_register::RankedRegister, tuple::Subspace};
-//!
-//! let registers = Subspace::all().subspace(&"document-registers");
-//! let document_id = "document-42";
-//! let register = RankedRegister::new(registers.subspace(&(document_id,)));
-//! # let _ = register;
-//! ```
-//!
-//! Each value chunk is raw bytes and may be exactly
-//! [`MAX_VALUE_CHUNK_BYTES`](crate::recipes::ranked_register::MAX_VALUE_CHUNK_BYTES)
-//! bytes. [`RankedRegister::new`](crate::recipes::ranked_register::RankedRegister::new)
-//! imposes no recipe aggregate limit, although
-//! FoundationDB transaction limits remain the backend boundary. Use
-//! [`RankedRegister::with_max_value_bytes`](crate::recipes::ranked_register::RankedRegister::with_max_value_bytes)
-//! to impose a local aggregate limit
-//! on one handle. That limit is never stored in FoundationDB, so all handles
-//! that write through the same subspace should use compatible limits.
-//!
-//! This schema is intentionally incompatible with ranked-register state from
-//! v0.11 and earlier. It does not decode the former unversioned tuple layout.
-//! Start with a fresh subspace, or clear an existing register subspace before
-//! using this version.
-//!
-//! Ranked reads and writes for one register contend on that single key and are
-//! serialized by FoundationDB conflicts. Use separate child subspaces to shard
-//! independently updated logical items.
-//!
-//! ## Rank domains
-//!
-//! A register rank space has one authority. Do not mix
-//! [`Rank::new`](crate::recipes::ranked_register::Rank::new) values with
-//! leader-election ranks or values issued by another rank allocator in the
-//! same register. A rank from a different domain can permanently fence valid
-//! future writes from the intended authority.
-//!
-//! Although the primitive stores one optional value, a successful ranked write
-//! can fence additional application-key writes staged in the same transaction.
-//! Stage those writes only when
-//! [`WriteResult::Committed`](crate::recipes::ranked_register::WriteResult::Committed)
-//! is returned. One rank can commit only once per register because each write
-//! requires a rank strictly greater than the stored maximum write rank.
-//!
-//! ## Composing with Leader Election
-//!
-//! The ranked register is designed to work with the leader election recipe.
-//! Every successful leader poll returns a fencing rank derived from the durable
-//! revision, providing automatic fencing against stale leaders. This includes
-//! same-owner renewal: installing the new rank fences delayed work using the
-//! prior rank from that same process.
-//!
-//! ```rust,no_run
-//! # #[cfg(feature = "recipes-leader-election")]
-//! # mod leader_election_example {
-//! # async fn example(db: &foundationdb::Database) -> Result<(), foundationdb::FdbBindingError> {
-//! use std::time::Duration;
-//!
-//! use foundationdb::{
-//!     env::{Clock, Environment},
-//!     options::TransactionOption,
-//!     recipes::{
-//!         leader_election::{LeaderElection, LocalState, ParticipantId, PollOutcome},
-//!         ranked_register::{RankedRegister, WriteResult},
-//!     },
-//!     tuple::Subspace,
-//!     FdbBindingError,
-//! };
-//!
-//! let election = LeaderElection::new(
-//!     Subspace::all().subspace(&"my-election"),
-//!     Duration::from_secs(10),
-//! )?;
-//! let register = RankedRegister::new(Subspace::all().subspace(&"my-state"));
-//! let participant = ParticipantId::new("process-incarnation")?;
-//! let local_state = LocalState::unknown();
-//! let env = Environment::default();
-//!
-//! // The application owns retries, options, scheduling, and local observation.
-//! let result = db.run(|txn, _maybe_committed| {
-//!     let election = election.clone();
-//!     let register = register.clone();
-//!     let participant = participant.clone();
-//!     let local_state = local_state.clone();
-//!     let env = env.clone();
-//!     async move {
-//!         txn.set_option(TransactionOption::AutomaticIdempotency)?;
-//!         let attempt_started_at = env.clock().monotonic();
-//!         let poll = election
-//!             .poll(&txn, &participant, &local_state, attempt_started_at)
-//!             .await?;
-//!         if let PollOutcome::Leader { rank, .. } = poll.outcome() {
-//!             register
-//!                 .read(&txn, *rank)
-//!                 .await
-//!                 .map_err(|error| FdbBindingError::new_custom_error(Box::new(error)))?;
-//!             let write_result = register
-//!                 .write(&txn, *rank, b"new_value")
-//!                 .await
-//!                 .map_err(|error| FdbBindingError::new_custom_error(Box::new(error)))?;
-//!             if write_result == WriteResult::Committed {
-//!                 txn.set(b"application-key", b"new_value");
-//!             }
-//!         }
-//!         Ok::<_, FdbBindingError>(poll)
-//!     }
-//! }).await?;
-//! // Adopt this only after db.run succeeded.
-//! let local_state = result.into_next_state(env.clock().monotonic());
-//! # let _ = local_state;
-//! # Ok(())
-//! # }
-//! # }
-//! ```
-//!
-//! ### Why This Works
-//!
-//! - Durable leader-election revisions increase monotonically
-//! - A renewal is a new fencing epoch, even for the same leader
-//! - `read(rank)` installs a fence at that fencing rank
-//! - Any write with a lower fencing rank is automatically rejected
-//! - `value()` is safe for followers, it never installs a fence
-
-mod algorithm;
-mod errors;
-mod keys;
-mod types;
-
-pub use errors::{RankedRegisterError, Result};
-pub use types::{Rank, ReadResult, RegisterState, WriteResult};
-
-use crate::{Transaction, tuple::Subspace};
-use std::ops::Deref;
-
-/// Maximum size of one raw register-value chunk.
-///
-/// This is FoundationDB's exact 100,000-byte value limit.
-pub const MAX_VALUE_CHUNK_BYTES: usize = 100_000;
-
-/// A ranked register backed by FoundationDB
-///
-/// Provides a mutable register with conflict detection via ranks.
-/// No initialization is needed — an absent key represents the bottom state
-/// (zero ranks, no value).
-///
-/// # Thread Safety
-///
-/// `RankedRegister` is [`Clone`], [`Send`], and [`Sync`]. It holds only a
-/// [`Subspace`] and can be safely shared across tasks.
-#[derive(Clone, Debug)]
-pub struct RankedRegister {
-    subspace: Subspace,
-    max_value_bytes: Option<usize>,
-}
-
-impl RankedRegister {
-    /// Create a new ranked register instance
-    ///
-    /// The subspace isolates this register from other data in the database.
-    /// No initialization step is required — the register starts in the
-    /// bottom state (zero ranks, no value) until the first write.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(subspace))
-    )]
-    pub fn new(subspace: Subspace) -> Self {
-        Self {
-            subspace,
-            max_value_bytes: None,
-        }
-    }
-
-    /// Create a ranked register with a local aggregate value-size limit.
-    ///
-    /// The limit applies only to writes through this handle. It is not durable
-    /// state, so use compatible limits for all writers of the same subspace.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(subspace))
-    )]
-    pub fn with_max_value_bytes(subspace: Subspace, limit: usize) -> Self {
-        Self {
-            subspace,
-            max_value_bytes: Some(limit),
-        }
-    }
-
-    /// Returns a reference to the underlying subspace
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn subspace(&self) -> &Subspace {
-        &self.subspace
-    }
-
-    /// Perform a ranked read
-    ///
-    /// Raises `max_read_rank` only when the given rank is higher, installing a
-    /// fence that prevents lower-ranked writes. A superseded rank returns the
-    /// current write rank and value without changing the installed fence.
-    ///
-    /// Used by the leader before writing to ensure consistency.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(self, txn))
-    )]
-    pub async fn read<T>(&self, txn: &T, rank: Rank) -> Result<ReadResult>
-    where
-        T: Deref<Target = Transaction>,
-    {
-        algorithm::read(txn, &self.subspace, rank).await
-    }
-
-    /// Perform a ranked write
-    ///
-    /// Commits the value only if:
-    /// - `rank >= max_read_rank` (no higher fence)
-    /// - `rank > max_write_rank` (no equal-or-higher write)
-    ///
-    /// Returns [`WriteResult::Committed`] or [`WriteResult::Aborted`].
-    /// Returns [`RankedRegisterError::ValueTooLarge`] when this handle has a
-    /// configured limit and `value` exceeds it.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(self, txn, value))
-    )]
-    pub async fn write<T>(&self, txn: &T, rank: Rank, value: &[u8]) -> Result<WriteResult>
-    where
-        T: Deref<Target = Transaction>,
-    {
-        algorithm::write(txn, &self.subspace, rank, value, self.max_value_bytes).await
-    }
-
-    /// Read the current value without updating ranks
-    ///
-    /// Safe for followers and observers: it installs no durable fence. Its
-    /// normal non-snapshot FoundationDB read still adds a conflict range for
-    /// this register key, so it can conflict with a concurrent leader write.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(self, txn))
-    )]
-    pub async fn value<T>(&self, txn: &T) -> Result<Option<Vec<u8>>>
-    where
-        T: Deref<Target = Transaction>,
-    {
-        algorithm::value(txn, &self.subspace).await
-    }
-}
diff --git a/bindings/rust/foundationdb/src/recipes/ranked_register/types.rs b/bindings/rust/foundationdb/src/recipes/ranked_register/types.rs
deleted file mode 100644
index 5130f7ddf7e..00000000000
--- a/bindings/rust/foundationdb/src/recipes/ranked_register/types.rs
+++ /dev/null
@@ -1,158 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Core data structures for the ranked register
-//!
-//! Implements the ranked register abstraction from Chockler & Malkhi's
-//! "Active Disk Paxos with infinitely many processes" (PODC 2002).
-
-use std::fmt;
-
-/// A rank value for ordering register operations
-///
-/// Encodes both a process identifier and a sequence number into a single `u64`.
-/// The high 32 bits hold the sequence number, and the low 32 bits hold the
-/// process ID. This ensures that ranks from the same process are ordered by
-/// sequence, and ties between different processes are broken by process ID.
-///
-/// # Encoding
-///
-/// ```text
-/// |--- sequence (32 bits) ---|--- process_id (32 bits) ---|
-/// ```
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Default)]
-pub struct Rank(u64);
-
-impl Rank {
-    /// The zero rank, representing the bottom/uninitialized state
-    pub const ZERO: Rank = Rank(0);
-
-    /// Create a new rank from a process ID and sequence number
-    ///
-    /// The sequence occupies the high 32 bits and the process ID the low 32 bits,
-    /// so ranks are ordered primarily by sequence, then by process ID.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug"))]
-    pub fn new(process_id: u32, sequence: u32) -> Self {
-        Self(((sequence as u64) << 32) | process_id as u64)
-    }
-
-    /// Returns the process ID component of this rank
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn process_id(&self) -> u32 {
-        self.0 as u32
-    }
-
-    /// Returns the sequence number component of this rank
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn sequence(&self) -> u32 {
-        (self.0 >> 32) as u32
-    }
-
-    /// Returns the raw `u64` representation
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn as_u64(&self) -> u64 {
-        self.0
-    }
-}
-
-impl From<u64> for Rank {
-    fn from(value: u64) -> Self {
-        Self(value)
-    }
-}
-
-impl fmt::Display for Rank {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(
-            f,
-            "Rank(seq={}, pid={})",
-            self.sequence(),
-            self.process_id()
-        )
-    }
-}
-
-/// Logical state of the ranked register
-///
-/// Tracks the maximum read and write ranks alongside the current value. The
-/// implementation stores metadata and value chunks separately.
-/// Private fields enforce invariants through the algorithm module.
-#[derive(Debug, Clone, PartialEq, Eq, Default)]
-pub struct RegisterState {
-    pub(crate) max_read_rank: Rank,
-    pub(crate) max_write_rank: Rank,
-    pub(crate) value: Option<Vec<u8>>,
-}
-
-impl RegisterState {
-    /// Returns the highest rank that has performed a read
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn max_read_rank(&self) -> Rank {
-        self.max_read_rank
-    }
-
-    /// Returns the highest rank that has successfully written
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn max_write_rank(&self) -> Rank {
-        self.max_write_rank
-    }
-
-    /// Returns the current value, if any
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn value(&self) -> Option<&[u8]> {
-        self.value.as_deref()
-    }
-}
-
-/// Result of a ranked read operation
-///
-/// Contains the write rank and value at the time of the read.
-/// The read also installs a fence at the given rank, preventing
-/// lower-ranked writes from succeeding.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ReadResult {
-    pub(crate) write_rank: Rank,
-    pub(crate) value: Option<Vec<u8>>,
-}
-
-impl ReadResult {
-    /// Returns the rank of the last successful write
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn write_rank(&self) -> Rank {
-        self.write_rank
-    }
-
-    /// Returns a reference to the current value, if any
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn value(&self) -> Option<&[u8]> {
-        self.value.as_deref()
-    }
-
-    /// Consumes self and returns the value
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn into_value(self) -> Option<Vec<u8>> {
-        self.value
-    }
-}
-
-/// Result of a ranked write operation
-#[must_use = "a committed write result controls whether co-staged application writes are valid"]
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum WriteResult {
-    /// The write was accepted (rank was high enough)
-    Committed,
-    /// The write was rejected (rank too low)
-    Aborted,
-}
-
-impl WriteResult {
-    /// Returns `true` if the write was committed
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn is_committed(&self) -> bool {
-        matches!(self, WriteResult::Committed)
-    }
-}
diff --git a/bindings/rust/foundationdb/src/runner.rs b/bindings/rust/foundationdb/src/runner.rs
deleted file mode 100644
index c147d570fcc..00000000000
--- a/bindings/rust/foundationdb/src/runner.rs
+++ /dev/null
@@ -1,863 +0,0 @@
-// Copyright 2026 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! The retry runner behind [`Database::run`](crate::Database::run).
-//!
-//! The runner is built from three independent pieces:
-//!
-//! * the **attempt**: run the closure on a transaction, then commit it. One
-//!   attempt does exactly one pass and never retries.
-//! * the **hooks** ([`RunnerHooks`]): purely observational callbacks fired
-//!   around each attempt. They cannot change what the runner decides.
-//! * the **policy** ([`RetryPolicy`]): the only thing that can change a
-//!   decision. It sees the failure and the decision the runner proposes, and
-//!   returns the decision to apply.
-//!
-//! They are assembled by [`TransactionRunner`], the builder returned by
-//! [`Database::runner`](crate::Database::runner):
-//!
-//! ```no_run
-//! # use foundationdb::*;
-//! # struct Hooks;
-//! # impl RunnerHooks for Hooks {}
-//! # async fn example(db: &Database) -> Result<(), FdbBindingError> {
-//! db.runner()
-//!     .hooks(&Hooks)
-//!     .run(|trx, _maybe_committed| async move {
-//!         trx.set(b"key", b"value");
-//!         Ok::<_, FdbBindingError>(())
-//!     })
-//!     .await?;
-//! # Ok(())
-//! # }
-//! ```
-//!
-//! # Retry semantics
-//!
-//! `fdb_transaction_on_error` remains the single retry governor: backoff, max
-//! retry delay and [`TransactionOption::RetryLimit`](crate::options::TransactionOption::RetryLimit)
-//! are applied by the C API, never by a Rust-side budget. A closure error asking
-//! for a retry without a native error underneath
-//! ([`RetryDecision::Retry`]) is routed through `on_error` with code 1020
-//! (`not_committed`) so that it obeys the same budget.
-
-#[cfg(feature = "accounting")]
-use std::time::Duration;
-use std::time::Instant;
-
-use crate::database::{Database, MaybeCommitted};
-use crate::error::{FdbBindingError, FdbError, FdbResult, RetryDecision, RetryableError};
-#[cfg(feature = "accounting")]
-use crate::metrics::{AttemptOutcome, ConflictKeys, TransactionMetrics};
-use crate::transaction::{
-    RetryableTransaction, Transaction, TransactionCommitError, TransactionCommitted,
-};
-
-/// `not_committed`: the retryable error code a [`RetryDecision::Retry`] is
-/// routed through.
-const NOT_COMMITTED: i32 = 1020;
-
-/// Observation points of the retry runner.
-///
-/// Hooks are **purely observational**: nothing they do or return changes what
-/// the runner decides. Use a [`RetryPolicy`] to influence retries. Every method
-/// has a no-op default, so an implementation only overrides what it needs.
-///
-/// # Ordering
-///
-/// Every callback receives the index of the attempt it belongs to, starting at
-/// `0`. With `accounting` enabled this matches the metrics report attempt index.
-/// Per attempt, in order:
-///
-/// 1. [`on_attempt_start`](Self::on_attempt_start)
-/// 2. the closure runs
-/// 3. if the closure succeeded: [`before_commit`](Self::before_commit), then
-///    the commit
-///    * commit succeeded: [`on_commit_success`](Self::on_commit_success), the
-///      run is over
-///    * commit failed: [`on_commit_error`](Self::on_commit_error), then
-///      `on_error`, then [`on_error_duration`](Self::on_error_duration) and
-///      [`on_retry`](Self::on_retry) if the transaction was retried
-/// 4. if the closure failed: [`on_closure_error`](Self::on_closure_error) (only
-///    when the error maps to an [`FdbError`], that is when the runner is about
-///    to call `on_error`), then `on_error`, then
-///    [`on_error_duration`](Self::on_error_duration) and
-///    [`on_retry`](Self::on_retry) if the transaction was retried
-///
-/// [`on_complete`](Self::on_complete) fires exactly once when the run returns:
-/// success, non-retryable error, exhausted retries or binding error. Canceling a
-/// run by dropping its future does not invoke this hook.
-///
-/// The two fallible hooks ([`before_commit`](Self::before_commit) and
-/// [`on_commit_error`](Self::on_commit_error)) never abort the runner: their
-/// error is reported to [`on_hook_error`](Self::on_hook_error) and the run
-/// continues exactly as if they had succeeded.
-///
-/// # Transaction access
-///
-/// Hooks see a `&Transaction`, never the clonable
-/// [`RetryableTransaction`]: a hook that could
-/// keep a reference to it would make the runner fail with
-/// [`FdbBindingError::ReferenceToTransactionKept`].
-///
-/// # Composition
-///
-/// [`RunnerHooks`] is implemented for `()` (no-op), `&H`, `Option<H>` (`None`
-/// is a no-op) and `(A, B)`, which nest for any arity: `(a, (b, c))`. In a
-/// tuple, callbacks fire left to right, and both sides always run even if the
-/// left one returned an error, the first error being the one reported.
-pub trait RunnerHooks {
-    /// Called when an attempt starts, before invoking the closure to construct
-    /// its future.
-    fn on_attempt_start(&self, _trx: &Transaction, _attempt: usize) {}
-
-    /// Called after the closure succeeded, before the transaction is committed.
-    ///
-    /// This is the last point where the transaction can be read or written
-    /// inside the attempt. Returning an error does **not** abort the commit: it
-    /// is reported through [`on_hook_error`](Self::on_hook_error) and the
-    /// transaction is committed anyway.
-    fn before_commit(
-        &self,
-        _trx: &Transaction,
-        _attempt: usize,
-    ) -> impl Future<Output = FdbResult<()>> + Send {
-        async { Ok(()) }
-    }
-
-    /// Called with the error of a hook that failed, right after it failed.
-    fn on_hook_error(&self, _err: &FdbError, _attempt: usize) {}
-
-    /// Called after a successful commit, with the time the commit took.
-    fn on_commit_success(
-        &self,
-        _committed: &TransactionCommitted,
-        _commit_duration_ms: u64,
-        _attempt: usize,
-    ) {
-    }
-
-    /// Called when the commit failed, **before** `on_error` resets the
-    /// transaction. This is the only window to read conflicting keys or inspect
-    /// the state of the failed attempt.
-    ///
-    /// It fires whatever the runner does next, including when the
-    /// [`RetryPolicy`] turns the failure into a fatal one. An error returned
-    /// here is reported through [`on_hook_error`](Self::on_hook_error) and
-    /// changes nothing else.
-    fn on_commit_error(
-        &self,
-        _err: &TransactionCommitError,
-        _attempt: usize,
-    ) -> impl Future<Output = FdbResult<()>> + Send {
-        async { Ok(()) }
-    }
-
-    /// Called when a closure error is about to be handed to `on_error`.
-    ///
-    /// A closure error classified as [`RetryDecision::Retry`] surfaces here as
-    /// a synthetic `FdbError` with code 1020 (`not_committed`). A fatal error
-    /// never reaches this hook.
-    fn on_closure_error(&self, _err: &FdbError, _attempt: usize) {}
-
-    /// Called after `on_error` returned, with the time it took, backoff
-    /// included.
-    fn on_error_duration(&self, _duration_ms: u64, _attempt: usize) {}
-
-    /// Called when the attempt is about to be retried, that is once `on_error`
-    /// accepted to retry it.
-    fn on_retry(&self, _attempt: usize) {}
-
-    /// Called exactly once when the run returns, whatever its outcome.
-    /// Dropping the run's future before it returns does not invoke this hook.
-    fn on_complete(&self) {}
-}
-
-impl RunnerHooks for () {}
-
-impl<H: RunnerHooks + Sync> RunnerHooks for &H {
-    fn on_attempt_start(&self, trx: &Transaction, attempt: usize) {
-        (*self).on_attempt_start(trx, attempt)
-    }
-
-    fn before_commit(
-        &self,
-        trx: &Transaction,
-        attempt: usize,
-    ) -> impl Future<Output = FdbResult<()>> + Send {
-        (*self).before_commit(trx, attempt)
-    }
-
-    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
-        (*self).on_hook_error(err, attempt)
-    }
-
-    fn on_commit_success(
-        &self,
-        committed: &TransactionCommitted,
-        commit_duration_ms: u64,
-        attempt: usize,
-    ) {
-        (*self).on_commit_success(committed, commit_duration_ms, attempt)
-    }
-
-    fn on_commit_error(
-        &self,
-        err: &TransactionCommitError,
-        attempt: usize,
-    ) -> impl Future<Output = FdbResult<()>> + Send {
-        (*self).on_commit_error(err, attempt)
-    }
-
-    fn on_closure_error(&self, err: &FdbError, attempt: usize) {
-        (*self).on_closure_error(err, attempt)
-    }
-
-    fn on_error_duration(&self, duration_ms: u64, attempt: usize) {
-        (*self).on_error_duration(duration_ms, attempt)
-    }
-
-    fn on_retry(&self, attempt: usize) {
-        (*self).on_retry(attempt)
-    }
-
-    fn on_complete(&self) {
-        (*self).on_complete()
-    }
-}
-
-impl<H: RunnerHooks + Sync> RunnerHooks for Option<H> {
-    fn on_attempt_start(&self, trx: &Transaction, attempt: usize) {
-        if let Some(hooks) = self {
-            hooks.on_attempt_start(trx, attempt);
-        }
-    }
-
-    async fn before_commit(&self, trx: &Transaction, attempt: usize) -> FdbResult<()> {
-        match self {
-            Some(hooks) => hooks.before_commit(trx, attempt).await,
-            None => Ok(()),
-        }
-    }
-
-    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
-        if let Some(hooks) = self {
-            hooks.on_hook_error(err, attempt);
-        }
-    }
-
-    fn on_commit_success(
-        &self,
-        committed: &TransactionCommitted,
-        commit_duration_ms: u64,
-        attempt: usize,
-    ) {
-        if let Some(hooks) = self {
-            hooks.on_commit_success(committed, commit_duration_ms, attempt);
-        }
-    }
-
-    async fn on_commit_error(&self, err: &TransactionCommitError, attempt: usize) -> FdbResult<()> {
-        match self {
-            Some(hooks) => hooks.on_commit_error(err, attempt).await,
-            None => Ok(()),
-        }
-    }
-
-    fn on_closure_error(&self, err: &FdbError, attempt: usize) {
-        if let Some(hooks) = self {
-            hooks.on_closure_error(err, attempt);
-        }
-    }
-
-    fn on_error_duration(&self, duration_ms: u64, attempt: usize) {
-        if let Some(hooks) = self {
-            hooks.on_error_duration(duration_ms, attempt);
-        }
-    }
-
-    fn on_retry(&self, attempt: usize) {
-        if let Some(hooks) = self {
-            hooks.on_retry(attempt);
-        }
-    }
-
-    fn on_complete(&self) {
-        if let Some(hooks) = self {
-            hooks.on_complete();
-        }
-    }
-}
-
-impl<A: RunnerHooks + Sync, B: RunnerHooks + Sync> RunnerHooks for (A, B) {
-    fn on_attempt_start(&self, trx: &Transaction, attempt: usize) {
-        self.0.on_attempt_start(trx, attempt);
-        self.1.on_attempt_start(trx, attempt);
-    }
-
-    async fn before_commit(&self, trx: &Transaction, attempt: usize) -> FdbResult<()> {
-        let first = self.0.before_commit(trx, attempt).await;
-        let second = self.1.before_commit(trx, attempt).await;
-        first.and(second)
-    }
-
-    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
-        self.0.on_hook_error(err, attempt);
-        self.1.on_hook_error(err, attempt);
-    }
-
-    fn on_commit_success(
-        &self,
-        committed: &TransactionCommitted,
-        commit_duration_ms: u64,
-        attempt: usize,
-    ) {
-        self.0
-            .on_commit_success(committed, commit_duration_ms, attempt);
-        self.1
-            .on_commit_success(committed, commit_duration_ms, attempt);
-    }
-
-    async fn on_commit_error(&self, err: &TransactionCommitError, attempt: usize) -> FdbResult<()> {
-        let first = self.0.on_commit_error(err, attempt).await;
-        let second = self.1.on_commit_error(err, attempt).await;
-        first.and(second)
-    }
-
-    fn on_closure_error(&self, err: &FdbError, attempt: usize) {
-        self.0.on_closure_error(err, attempt);
-        self.1.on_closure_error(err, attempt);
-    }
-
-    fn on_error_duration(&self, duration_ms: u64, attempt: usize) {
-        self.0.on_error_duration(duration_ms, attempt);
-        self.1.on_error_duration(duration_ms, attempt);
-    }
-
-    fn on_retry(&self, attempt: usize) {
-        self.0.on_retry(attempt);
-        self.1.on_retry(attempt);
-    }
-
-    fn on_complete(&self) {
-        self.0.on_complete();
-        self.1.on_complete();
-    }
-}
-
-/// Available with the `accounting` Cargo feature.
-///
-/// Hooks collecting a [`MetricsReport`](crate::metrics::MetricsReport) into a
-/// [`TransactionMetrics`].
-///
-/// They are what [`Database::instrumented_run`](crate::Database::instrumented_run)
-/// is made of, and can be stacked on any other hooks to get the same report out
-/// of a plain [`run`](crate::Database::run):
-///
-/// ```no_run
-/// # use foundationdb::*;
-/// # use foundationdb::runner::MetricsHooks;
-/// # struct MyHooks;
-/// # impl foundationdb::runner::RunnerHooks for MyHooks {}
-/// # async fn example(db: &Database) -> Result<(), FdbBindingError> {
-/// let metrics = TransactionMetrics::new();
-/// db.run_with_hooks(&(MetricsHooks::new(&metrics), MyHooks), |trx, _| async move {
-///     trx.set(b"key", b"value");
-///     Ok::<_, FdbBindingError>(())
-/// })
-/// .await?;
-///
-/// let report = metrics.get_metrics_data();
-/// # let _ = report;
-/// # Ok(())
-/// # }
-/// ```
-///
-/// The run is timed from the construction of the hooks, so build one per run.
-///
-/// The collector is attached to the transaction when the first attempt starts,
-/// which is what makes the counters of a plain `run` land in the report. A
-/// transaction only ever reports to one collector: stacking two `MetricsHooks`
-/// leaves the second one empty.
-#[cfg(feature = "accounting")]
-pub struct MetricsHooks {
-    metrics: TransactionMetrics,
-    start: Instant,
-}
-
-#[cfg(feature = "accounting")]
-impl MetricsHooks {
-    /// Collects the metrics of a run into `metrics`.
-    ///
-    /// The handle is cloned, so the caller keeps reading the report from its
-    /// own [`TransactionMetrics`] once the run is over.
-    pub fn new(metrics: &TransactionMetrics) -> Self {
-        Self {
-            metrics: metrics.clone(),
-            start: Instant::now(),
-        }
-    }
-}
-
-#[cfg(feature = "accounting")]
-impl RunnerHooks for MetricsHooks {
-    fn on_attempt_start(&self, trx: &Transaction, _attempt: usize) {
-        // Wires the collector onto the transaction the runner created, which is
-        // what makes the counters of every attempt land in the report. A no-op
-        // from the second attempt on: the transaction keeps its collector
-        // across retries.
-        trx.attach_metrics(&self.metrics);
-    }
-
-    async fn on_commit_error(
-        &self,
-        err: &TransactionCommitError,
-        _attempt: usize,
-    ) -> FdbResult<()> {
-        // not_committed (1020) = commit conflict
-        if err.code() == NOT_COMMITTED {
-            self.metrics.increment_conflict_count();
-        }
-        // Reading from the \xff\xff/transaction/conflicting_keys/ special keyspace is
-        // resolved client-side — no network round-trip to the cluster. The future still
-        // goes through the FDB network thread event loop, but the data comes from an
-        // in-memory map populated during the commit response. Returns empty if
-        // ReportConflictingKeys was not set.
-        match err.conflicting_keys().await {
-            Ok(keys) => {
-                self.metrics
-                    .set_conflicting_keys(ConflictKeys::Available(keys));
-                Ok(())
-            }
-            Err(read_error) => {
-                self.metrics
-                    .set_conflicting_keys(ConflictKeys::ReadFailed(read_error));
-                Err(read_error)
-            }
-        }
-    }
-
-    fn on_error_duration(&self, duration_ms: u64, _attempt: usize) {
-        // `on_error` already pushed the attempt it ended, so this lands on the
-        // last attempt of the report.
-        self.metrics
-            .set_on_error_duration(Duration::from_millis(duration_ms));
-    }
-
-    fn on_commit_success(
-        &self,
-        committed: &TransactionCommitted,
-        _commit_duration_ms: u64,
-        _attempt: usize,
-    ) {
-        // The attempt itself was pushed by `Transaction::commit`, which also
-        // recorded how long the commit took.
-        if let Ok(version) = committed.committed_version() {
-            self.metrics.set_commit_version(version);
-        }
-    }
-
-    fn on_complete(&self) {
-        // An attempt still open when the run ends is the one that failed:
-        // attempts that committed or were retried were pushed by the
-        // transaction itself, which makes this a no-op for them.
-        self.metrics.finish_attempt(AttemptOutcome::Failed);
-        self.metrics.set_total_duration(self.start.elapsed());
-    }
-}
-
-/// The failure a [`RetryPolicy`] is asked about.
-#[derive(Debug)]
-#[non_exhaustive]
-pub enum AttemptFailure<'a, E> {
-    /// The closure returned an error, the transaction was not committed.
-    Closure(&'a E),
-    /// The closure succeeded but the commit failed.
-    Commit(&'a TransactionCommitError),
-}
-
-/// Decides what the runner does with a failed attempt.
-///
-/// The runner classifies the failure on its own and passes its verdict as
-/// `proposed`; the policy returns the decision to apply, which is `proposed`
-/// itself unless it wants to override it:
-///
-/// * [`RetryDecision::Fatal`] ends the run and returns the original error, the
-///   one the closure produced or the commit error, never something the policy
-///   made up.
-/// * [`RetryDecision::Fdb`] hands that error to `fdb_transaction_on_error`,
-///   which judges retryability and applies the backoff.
-/// * [`RetryDecision::Retry`] does the same with code 1020 (`not_committed`),
-///   which is retryable by definition.
-///
-/// A policy cannot clear the [`MaybeCommitted`] flag handed to the closure:
-/// it accumulates the original errors from all attempts before the policy is
-/// consulted.
-///
-/// # Example: cap the number of attempts
-///
-/// ```
-/// use foundationdb::runner::{AttemptFailure, RetryPolicy};
-/// use foundationdb::{FdbBindingError, RetryDecision};
-///
-/// struct MaxAttempts(usize);
-///
-/// impl RetryPolicy<FdbBindingError> for MaxAttempts {
-///     fn decide(
-///         &self,
-///         _failure: AttemptFailure<'_, FdbBindingError>,
-///         proposed: RetryDecision,
-///         attempt: usize,
-///     ) -> RetryDecision {
-///         if attempt + 1 >= self.0 {
-///             RetryDecision::Fatal
-///         } else {
-///             proposed
-///         }
-///     }
-/// }
-/// ```
-pub trait RetryPolicy<E> {
-    /// Returns the decision to apply for `failure`, `proposed` being what the
-    /// runner would do on its own.
-    fn decide(
-        &self,
-        failure: AttemptFailure<'_, E>,
-        proposed: RetryDecision,
-        attempt: usize,
-    ) -> RetryDecision;
-}
-
-/// The default policy: it always applies what the runner proposes, leaving
-/// `fdb_transaction_on_error` the last word on retries.
-#[derive(Debug, Clone, Copy, Default)]
-pub struct NativeRetryPolicy;
-
-impl<E> RetryPolicy<E> for NativeRetryPolicy {
-    fn decide(
-        &self,
-        _failure: AttemptFailure<'_, E>,
-        proposed: RetryDecision,
-        _attempt: usize,
-    ) -> RetryDecision {
-        proposed
-    }
-}
-
-/// How a single attempt ended, carrying whatever still owns the transaction.
-enum Attempt<T, E> {
-    /// The closure succeeded and the transaction committed.
-    Committed {
-        committed: TransactionCommitted,
-        value: T,
-        commit_duration_ms: u64,
-    },
-    /// The closure failed, the transaction is untouched and can be retried.
-    ClosureFailed {
-        transaction: RetryableTransaction,
-        error: E,
-    },
-    /// The commit failed, the transaction is owned by the error.
-    CommitFailed(TransactionCommitError),
-    /// The runner could not get the transaction back from the closure.
-    BindingFailed(FdbBindingError),
-}
-
-/// Awaits the closure future and commits, without any retry logic.
-///
-/// The closure future is built by the caller so that the runner keeps owning
-/// the closure itself: an attempt that borrowed it would make every `run`
-/// future require `F: Sync`.
-async fn run_attempt<Fut, T, E, H>(
-    transaction: RetryableTransaction,
-    hooks: &H,
-    closure_result: Fut,
-    attempt: usize,
-) -> Attempt<T, E>
-where
-    Fut: Future<Output = Result<T, E>>,
-    H: RunnerHooks,
-{
-    let value = match closure_result.await {
-        Ok(value) => value,
-        Err(error) => return Attempt::ClosureFailed { transaction, error },
-    };
-
-    // Observational: a failing hook is reported, the commit happens anyway.
-    if let Err(hook_error) = hooks.before_commit(&transaction, attempt).await {
-        hooks.on_hook_error(&hook_error, attempt);
-    }
-
-    let now_commit = Instant::now();
-    match transaction.commit().await {
-        Ok(Ok(committed)) => Attempt::Committed {
-            committed,
-            value,
-            commit_duration_ms: now_commit.elapsed().as_millis() as u64,
-        },
-        Ok(Err(commit_error)) => Attempt::CommitFailed(commit_error),
-        Err(binding_error) => Attempt::BindingFailed(binding_error),
-    }
-}
-
-/// The retry loop: classification, policy, `on_error` and backoff on top of
-/// [`run_attempt`].
-///
-/// Wrapped by [`run_with_hooks`], which owns firing
-/// [`RunnerHooks::on_complete`] when the run returns.
-async fn retry_loop<F, Fut, T, E, H, P>(
-    initial_transaction: RetryableTransaction,
-    hooks: &H,
-    policy: &P,
-    closure: F,
-) -> Result<T, E>
-where
-    F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
-    Fut: Future<Output = Result<T, E>>,
-    E: RetryableError,
-    H: RunnerHooks,
-    P: RetryPolicy<E>,
-{
-    let mut maybe_committed = false;
-    let mut transaction = initial_transaction;
-    let mut attempt: usize = 0;
-
-    loop {
-        // The closure can issue operations while constructing its future.
-        hooks.on_attempt_start(&transaction, attempt);
-        let closure_result = closure(transaction.clone(), MaybeCommitted::new(maybe_committed));
-
-        let (retried_transaction, _fdb_err) =
-            match run_attempt(transaction, hooks, closure_result, attempt).await {
-                Attempt::Committed {
-                    committed,
-                    value,
-                    commit_duration_ms,
-                } => {
-                    hooks.on_commit_success(&committed, commit_duration_ms, attempt);
-
-                    #[cfg(feature = "trace")]
-                    tracing::info!(attempt, "success, returning result");
-
-                    return Ok(value);
-                }
-
-                Attempt::BindingFailed(binding_error) => {
-                    #[cfg(feature = "trace")]
-                    tracing::error!(attempt, "transaction reference kept, aborting transaction");
-
-                    return Err(E::from(binding_error));
-                }
-
-                Attempt::ClosureFailed { transaction, error } => {
-                    let proposed = error.retry_decision();
-                    // Later failures cannot resolve an earlier uncertain commit.
-                    // Preserve it regardless of the policy's replacement error.
-                    if let RetryDecision::Fdb(fdb_err) = proposed {
-                        maybe_committed |= fdb_err.is_maybe_committed();
-                    }
-
-                    let fdb_err =
-                        match policy.decide(AttemptFailure::Closure(&error), proposed, attempt) {
-                            RetryDecision::Fdb(fdb_err) => fdb_err,
-                            // Synthetic retryable code (1020, not_committed): backoff and
-                            // RetryLimit stay governed by fdb_transaction_on_error.
-                            RetryDecision::Retry => FdbError::from_code(NOT_COMMITTED),
-                            RetryDecision::Fatal => return Err(error),
-                        };
-                    hooks.on_closure_error(&fdb_err, attempt);
-
-                    let now_on_error = Instant::now();
-                    match transaction.on_error(fdb_err).await {
-                        Ok(Ok(transaction)) => {
-                            hooks.on_error_duration(
-                                now_on_error.elapsed().as_millis() as u64,
-                                attempt,
-                            );
-                            (transaction, fdb_err)
-                        }
-                        // Retries exhausted or non-retryable: return the original
-                        // closure error, which carries the caller's context.
-                        Ok(Err(_non_retryable)) => return Err(error),
-                        Err(binding_error) => return Err(E::from(binding_error)),
-                    }
-                }
-
-                Attempt::CommitFailed(commit_error) => {
-                    maybe_committed |= commit_error.is_maybe_committed();
-                    let proposed = RetryDecision::Fdb(*commit_error);
-
-                    // Fires before the policy is consulted: a hook reading the
-                    // conflicting keys must see them even when the run is about
-                    // to end.
-                    if let Err(hook_error) = hooks.on_commit_error(&commit_error, attempt).await {
-                        hooks.on_hook_error(&hook_error, attempt);
-                    }
-
-                    let fdb_err = match policy.decide(
-                        AttemptFailure::Commit(&commit_error),
-                        proposed,
-                        attempt,
-                    ) {
-                        RetryDecision::Fdb(fdb_err) => fdb_err,
-                        RetryDecision::Retry => FdbError::from_code(NOT_COMMITTED),
-                        RetryDecision::Fatal => {
-                            return Err(E::from(FdbBindingError::from(*commit_error)));
-                        }
-                    };
-
-                    // The transaction is taken out of the error so that the
-                    // error handed to `on_error` is the one the policy chose.
-                    let (transaction, _commit_err) = commit_error.into_parts();
-                    let now_on_error = Instant::now();
-                    match transaction.on_error(fdb_err).await {
-                        Ok(transaction) => {
-                            hooks.on_error_duration(
-                                now_on_error.elapsed().as_millis() as u64,
-                                attempt,
-                            );
-                            (RetryableTransaction::new(transaction), fdb_err)
-                        }
-                        Err(non_retryable) => {
-                            #[cfg(feature = "trace")]
-                            tracing::error!(
-                                attempt,
-                                error_code = non_retryable.code(),
-                                "could not commit, non retryable error"
-                            );
-
-                            return Err(E::from(FdbBindingError::from(non_retryable)));
-                        }
-                    }
-                }
-            };
-
-        #[cfg(feature = "trace")]
-        tracing::warn!(
-            attempt,
-            error_code = _fdb_err.code(),
-            "restarting transaction"
-        );
-
-        hooks.on_retry(attempt);
-        transaction = retried_transaction;
-        attempt += 1;
-    }
-}
-
-/// The retry runner: [`retry_loop`] plus the guarantee that
-/// [`RunnerHooks::on_complete`] fires exactly once when the run returns.
-#[cfg_attr(
-    feature = "trace",
-    tracing::instrument(level = "debug", skip(initial_transaction, hooks, policy, closure))
-)]
-pub(crate) async fn run_with_hooks<F, Fut, T, E, H, P>(
-    initial_transaction: RetryableTransaction,
-    hooks: &H,
-    policy: &P,
-    closure: F,
-) -> Result<T, E>
-where
-    F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
-    Fut: Future<Output = Result<T, E>>,
-    E: RetryableError,
-    H: RunnerHooks,
-    P: RetryPolicy<E>,
-{
-    let result = retry_loop(initial_transaction, hooks, policy, closure).await;
-    hooks.on_complete();
-    result
-}
-
-/// Builder for a transactional run, returned by
-/// [`Database::runner`](crate::Database::runner).
-///
-/// It assembles the [`RunnerHooks`] and the [`RetryPolicy`] of a single call to
-/// [`run`](Self::run): no hooks and [`NativeRetryPolicy`] by default. Both are
-/// borrowed, so the same hooks and policy can be reused across runs (mind
-/// `MetricsHooks` from the `accounting` feature, which times the run from its
-/// own construction).
-///
-/// ```no_run
-/// # use foundationdb::*;
-/// # async fn example(db: &Database) -> Result<(), FdbBindingError> {
-/// db.runner()
-///     .run(|trx, _| async move {
-///         trx.set(b"key", b"value");
-///         Ok::<_, FdbBindingError>(())
-///     })
-///     .await
-/// # }
-/// ```
-pub struct TransactionRunner<'a, H = (), P = NativeRetryPolicy> {
-    db: &'a Database,
-    hooks: &'a H,
-    policy: &'a P,
-}
-
-impl<'a> TransactionRunner<'a, (), NativeRetryPolicy> {
-    /// A runner on `db` with no hooks and the native retry policy.
-    pub(crate) fn new(db: &'a Database) -> Self {
-        Self {
-            db,
-            hooks: &(),
-            policy: &NativeRetryPolicy,
-        }
-    }
-}
-
-impl<'a, H, P> TransactionRunner<'a, H, P> {
-    /// Observes the run with `hooks`, replacing any hooks set before.
-    ///
-    /// Stack several of them with a tuple: `.hooks(&(first, second))`.
-    pub fn hooks<H2>(self, hooks: &'a H2) -> TransactionRunner<'a, H2, P> {
-        TransactionRunner {
-            db: self.db,
-            hooks,
-            policy: self.policy,
-        }
-    }
-
-    /// Decides the retries with `policy` instead of [`NativeRetryPolicy`].
-    pub fn retry_policy<P2>(self, policy: &'a P2) -> TransactionRunner<'a, H, P2> {
-        TransactionRunner {
-            db: self.db,
-            hooks: self.hooks,
-            policy,
-        }
-    }
-
-    /// Runs `closure` in a transaction, retrying it until it commits or the
-    /// error is fatal.
-    ///
-    /// See [`Database::run`](crate::Database::run) for the semantics of the
-    /// closure, its error type and the retries.
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(self, closure))
-    )]
-    pub async fn run<F, Fut, T, E>(self, closure: F) -> Result<T, E>
-    where
-        F: Fn(RetryableTransaction, MaybeCommitted) -> Fut,
-        Fut: Future<Output = Result<T, E>>,
-        E: RetryableError,
-        H: RunnerHooks,
-        P: RetryPolicy<E>,
-    {
-        let transaction = match self.db.create_retryable_trx() {
-            Ok(transaction) => transaction,
-            // The run is over before it started, but it did start: hooks that
-            // report on completion must still be called exactly once.
-            Err(err) => {
-                self.hooks.on_complete();
-                return Err(E::from(err));
-            }
-        };
-
-        run_with_hooks(transaction, self.hooks, self.policy, closure).await
-    }
-}
diff --git a/bindings/rust/foundationdb/src/timekeeper.rs b/bindings/rust/foundationdb/src/timekeeper.rs
deleted file mode 100644
index 1d610084068..00000000000
--- a/bindings/rust/foundationdb/src/timekeeper.rs
+++ /dev/null
@@ -1,101 +0,0 @@
-//! There is a key range called TimeKeeper in the system key space which stores a rolling history window
-//! of time to version mappings, with one data point every 10 seconds.
-//! It is not exposed via any user-facing API, though of course the data can be read by a user.
-//! It is not an official database feature and should not be relied on for anything where accuracy
-//! is critical as nothing prevents or detects system clock skew on the FDB process logging these data points.
-//!
-//! TimeKeeper is used by backup and restore to convert timestamps to approximate versions and versions
-//! to approximate timestamps to make reasoning about backup data and restore operations easier.
-//! Lookups work by finding the nearest value for the query version or timestamp, taking the equivalent other value,
-//! and then adding an adjustment estimate based on 1 million versions per 1 second.
-//! This logic accounts for arbitrary version advancement due to recovery, DR switch operations, or any other reason.
-//!
-//! [source](https://forums.foundationdb.org/t/versionstamp-as-absolute-time/2442/3)
-
-use crate::options::TransactionOption;
-use crate::{FdbBindingError, KeySelector, RangeOption, Transaction};
-use foundationdb_tuple::{pack, unpack};
-use futures::TryStreamExt;
-
-/// Timekeeper keys are stored in a special keyspace
-/// Can be found in the [Java implementation](https://github.com/FoundationDB/fdb-record-layer/blob/main/fdb-extensions/src/main/java/com/apple/foundationdb/system/SystemKeyspace.java#L80)
-const TIME_KEEPER_PREFIX: &[u8] = b"\xff\x02/timeKeeper/map/";
-
-/// Flavor about the mode of scanning
-pub enum HintMode {
-    /// The read version is ensure to be before the timestamp
-    BeforeTimestamp,
-    /// The read version is ensured to be after the timestamp
-    AfterTimestamp,
-}
-
-/// Try to get a version ID closer as possible as the asked timestamp
-///
-/// If no result are found, either your timestamp is in the future of the
-/// Timekeeper or the data has been rolled by fresh ones.
-///
-/// The layout os follow:
-///
-/// TIME_KEEPER_PREFIX/timestamp1 => read_version1
-/// TIME_KEEPER_PREFIX/timestamp2 => read_version2
-/// TIME_KEEPER_PREFIX/timestamp3 => read_version3
-///
-/// Each key are associated to a pack read version on 8 bytes
-/// compatible with an i64.
-///
-/// Timestamps are provided from unix time as seconds
-///
-/// Read failures are returned to the caller so that retryable errors can be
-/// handled by the transaction's retry loop. `None` means the read succeeded
-/// without finding a matching entry.
-pub async fn hint_version_from_timestamp(
-    trx: &Transaction,
-    unix_timestamp_as_seconds: u64,
-    mode: HintMode,
-    snapshot: bool,
-) -> Result<Option<u64>, FdbBindingError> {
-    // Timekeeper range keys are stored in /0x00/0x02 system namespace
-    // to be able to read this range, the transaction must have
-    // capabilities to read System Keys
-    trx.set_option(TransactionOption::ReadSystemKeys)?;
-    // The profiling should be used even when the Database has been locked
-    trx.set_option(TransactionOption::ReadLockAware)?;
-
-    // Timekeeper keys are defined has prefix/timestamp
-    let mut start_key_bytes = TIME_KEEPER_PREFIX.to_vec();
-    start_key_bytes.extend_from_slice(&pack(&unix_timestamp_as_seconds));
-    // we get the first key greater than this value because timekeeper doesn't tick
-    // each seconds but rather each 10 seconds but not each time
-    let start_key = KeySelector::first_greater_or_equal(start_key_bytes.clone());
-
-    // The end of the scan is the end of the timekeeper range
-    // but we won't scan it the whole range
-    let mut end_key_bytes = TIME_KEEPER_PREFIX.to_vec();
-    end_key_bytes.extend_from_slice(b"\xff");
-    let end_key = KeySelector::first_greater_than(end_key_bytes);
-
-    let mut range = match mode {
-        HintMode::AfterTimestamp => RangeOption::from((start_key, end_key)),
-        HintMode::BeforeTimestamp => {
-            let mut range = RangeOption::from((
-                KeySelector::first_greater_than(TIME_KEEPER_PREFIX),
-                start_key,
-            ));
-            range.reverse = true;
-            range
-        }
-    };
-    // No need to scan further than the next and previous key
-    range.limit = Some(1);
-
-    // We get the first key matching our start range bound
-    let result = trx.get_ranges_keyvalues(range, snapshot).try_next().await?;
-
-    // If any result then the value found will be the read version ID
-    if let Some(kv) = result {
-        let version = unpack(kv.value()).map_err(FdbBindingError::PackError)?;
-        return Ok(Some(version));
-    }
-    // otherwise timestamp too old or is future
-    Ok(None)
-}
diff --git a/bindings/rust/foundationdb/src/transaction.rs b/bindings/rust/foundationdb/src/transaction.rs
index 163e730a116..db97704adf2 100644
--- a/bindings/rust/foundationdb/src/transaction.rs
+++ b/bindings/rust/foundationdb/src/transaction.rs
@@ -16,19 +16,9 @@ use std::ops::{Deref, Range, RangeInclusive};
 use std::ptr::NonNull;
 use std::sync::Arc;
 use std::sync::atomic::{AtomicU32, Ordering};
-#[cfg(feature = "accounting")]
-use std::sync::{Mutex, OnceLock};
-#[cfg(feature = "accounting")]
-use std::time::Instant;
-
-#[cfg(feature = "accounting")]
-use crate::budget::{AttemptUsage, BudgetExceeded, ClientBudget, UsageSlot, UsageSnapshot};
-#[cfg(feature = "accounting")]
-use crate::env::Clock;
+
 use crate::future::*;
 use crate::keyselector::*;
-#[cfg(feature = "accounting")]
-use crate::metrics::{AttemptOutcome, MetricKey, TransactionMetrics};
 use crate::options;
 
 use crate::{FdbError, FdbResult, error};
@@ -235,16 +225,10 @@ impl TransactionCommitError {
     /// You should not call this method most of the times and use `Database::transact` which
     /// implements a retry loop strategy for you.
     ///
-    /// On success the transaction enters a new attempt. With `accounting`, its
-    /// usage restarts from zero and its client budget is kept. User versions
+    /// On success the transaction enters a new attempt. User versions
     /// allocated by [`Transaction::allocate_user_version`] are invalid for the
     /// new attempt, which starts allocating again at zero.
     pub fn on_error(self) -> impl Future<Output = FdbResult<Transaction>> {
-        #[cfg(feature = "accounting")]
-        self.tr.mark_attempt_end();
-        #[cfg(feature = "accounting")]
-        let cause = self.err;
-
         unsafe {
             FdbFuture::<()>::new(fdb_sys::fdb_transaction_on_error(
                 self.tr.inner.as_ptr(),
@@ -252,10 +236,6 @@ impl TransactionCommitError {
             ))
         }
         .map_ok(move |()| {
-            #[cfg(feature = "accounting")]
-            self.tr.end_attempt(AttemptOutcome::Retried { cause });
-            #[cfg(feature = "accounting")]
-            self.tr.begin_attempt_usage();
             self.tr.reset_user_version_allocator();
             self.tr
         })
@@ -286,16 +266,6 @@ impl TransactionCommitError {
         self.tr.reset();
         self.tr
     }
-
-    /// Splits the error into the transaction it failed on and the error itself,
-    /// without resetting anything.
-    ///
-    /// Used by the retry runner to hand `on_error` an error chosen by a
-    /// [`RetryPolicy`](crate::runner::RetryPolicy) rather than the commit error
-    /// itself.
-    pub(crate) fn into_parts(self) -> (Transaction, FdbError) {
-        (self.tr, self.err)
-    }
 }
 
 impl Deref for TransactionCommitError {
@@ -365,17 +335,6 @@ pub struct Transaction {
     // Order of fields should not be changed, because Rust drops field top-to-bottom, and
     // transaction should be dropped before cluster.
     inner: NonNull<fdb_sys::FDBTransaction>,
-    /// Metrics collector of the transaction, attached at creation or by a
-    /// runner hook, see [`Transaction::attach_metrics`]. Set at most once.
-    #[cfg(feature = "accounting")]
-    metrics: OnceLock<TransactionMetrics>,
-    /// Accounting of the current attempt, see [`crate::budget`].
-    #[cfg(feature = "accounting")]
-    usage: UsageSlot,
-    /// Client-side limits applied to the current attempt. Unlike `usage`, they
-    /// are configuration: they survive `on_error` and `reset`.
-    #[cfg(feature = "accounting")]
-    budget: Mutex<ClientBudget>,
     /// The next user version to issue for an incomplete versionstamp in the
     /// current transaction attempt.
     user_version: AtomicU32,
@@ -578,12 +537,6 @@ impl Transaction {
     pub(crate) fn new(inner: NonNull<fdb_sys::FDBTransaction>) -> Self {
         Self {
             inner,
-            #[cfg(feature = "accounting")]
-            metrics: OnceLock::new(),
-            #[cfg(feature = "accounting")]
-            usage: UsageSlot::default(),
-            #[cfg(feature = "accounting")]
-            budget: Mutex::new(ClientBudget::default()),
             user_version: AtomicU32::new(0),
         }
     }
@@ -620,190 +573,6 @@ impl Transaction {
     }
 }
 
-#[cfg(feature = "accounting")]
-impl Transaction {
-    /// Attaches a metrics collector to this transaction and opens its first
-    /// attempt on the accounting generation currently in use.
-    ///
-    /// A transaction collects metrics for at most one
-    /// [`TransactionMetrics`]: attaching a second one does nothing, the first
-    /// collector keeps receiving everything. This is what
-    /// [`MetricsHooks`](crate::runner::MetricsHooks) uses to wire itself onto a
-    /// transaction created by the runner.
-    pub(crate) fn attach_metrics(&self, metrics: &TransactionMetrics) {
-        if self.metrics.set(metrics.clone()).is_ok() {
-            self.open_metrics_attempt();
-        }
-    }
-
-    /// The metrics collector of the transaction, if one is attached.
-    fn metrics(&self) -> Option<&TransactionMetrics> {
-        self.metrics.get()
-    }
-
-    /// Points the metrics at the accounting generation of the current attempt,
-    /// so that whatever happens from now on is recorded there.
-    fn open_metrics_attempt(&self) {
-        if let Some(metrics) = self.metrics() {
-            metrics.begin_attempt(self.usage.current());
-        }
-    }
-
-    /// Freezes the duration of the current attempt: it is over, only the retry
-    /// machinery runs from here.
-    fn mark_attempt_end(&self) {
-        if let Some(metrics) = self.metrics() {
-            metrics.mark_attempt_end();
-        }
-    }
-
-    /// Pushes the current attempt to the metrics report.
-    fn end_attempt(&self, outcome: AttemptOutcome) {
-        if let Some(metrics) = self.metrics() {
-            metrics.finish_attempt(outcome);
-        }
-    }
-
-    /// The accounting generation an operation issued now must record into.
-    ///
-    /// Callers of asynchronous operations must capture it when the operation is
-    /// **issued** and record into that clone on completion, so that a future
-    /// outliving its attempt cannot pollute the next one.
-    fn usage(&self) -> Arc<AttemptUsage> {
-        self.usage.current()
-    }
-
-    /// Starts a fresh accounting generation measured with `clock`.
-    ///
-    /// This never touches the budget mutex: callers take the clock out of the
-    /// budget themselves, in the same critical section as whatever else they
-    /// need from it.
-    fn begin_attempt_with_clock(&self, clock: Option<Arc<dyn Clock>>) {
-        self.usage.begin(clock);
-        self.open_metrics_attempt();
-    }
-
-    /// Starts a fresh accounting generation for a new transaction attempt.
-    ///
-    /// Usage counters restart from zero and the elapsed time is measured from
-    /// here, with the clock of the current budget. The client budget, being
-    /// configuration, is left untouched.
-    ///
-    /// An instrumented transaction also starts recording a new attempt: call
-    /// [`end_attempt`](Self::end_attempt) first when the attempt that is ending
-    /// must appear in the report.
-    pub(crate) fn begin_attempt_usage(&self) {
-        let clock = self
-            .budget
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .clock
-            .clone();
-        self.begin_attempt_with_clock(clock);
-    }
-
-    /// Returns the usage accounted for the current transaction attempt.
-    ///
-    /// Available with `accounting`; no metrics collector is needed. The counters are
-    /// client-side estimates and are reset on every new attempt, see
-    /// [`crate::budget`].
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn attempt_usage(&self) -> UsageSnapshot {
-        self.usage().snapshot()
-    }
-
-    /// Sets the client-side budget of this transaction.
-    ///
-    /// The limits are **not** enforced by FoundationDB and not enforced
-    /// automatically: they are checked when you call
-    /// `check_client_budget`. See [`crate::budget`]
-    /// for what is counted and how precise it is.
-    ///
-    /// Setting a budget starts a fresh accounting generation, so the limits
-    /// apply to what happens from now on. They then survive `on_error` and
-    /// `reset`, and apply to each subsequent attempt with usage back at zero.
-    /// That generation, and every later one, is measured with the
-    /// [`clock`](ClientBudget::clock) of this budget.
-    ///
-    /// On an instrumented transaction, set the budget before doing anything
-    /// else: the new generation is also the one the metrics record into, so
-    /// operations performed before this call are not reported.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn set_client_budget(&self, budget: ClientBudget) {
-        // One critical section: store the budget and take its clock out, so the
-        // generation below cannot be stamped with the clock of a budget that a
-        // concurrent call has already replaced.
-        let clock = {
-            let mut slot = self
-                .budget
-                .lock()
-                .unwrap_or_else(|poisoned| poisoned.into_inner());
-            *slot = budget;
-            slot.clock.clone()
-        };
-        self.begin_attempt_with_clock(clock);
-    }
-
-    /// Removes every client-side limit of this transaction.
-    ///
-    /// Accounting keeps running: only the limits are dropped.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn clear_client_budget(&self) {
-        *self
-            .budget
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner()) = ClientBudget::default();
-    }
-
-    /// Checks the usage of the current attempt against the client-side budget.
-    ///
-    /// This is a synchronous, cheap check: a few atomic loads and one reading of
-    /// the [`clock`](ClientBudget::clock) of the budget, the wall clock by
-    /// default, no call to the database. Nothing calls it for you, so call it
-    /// between the operations of your transaction, typically inside a
-    /// [`Database::run`](crate::Database::run) closure where
-    /// [`FdbBindingError`](crate::FdbBindingError) makes `?` work:
-    ///
-    /// ```
-    /// # use foundationdb::*;
-    /// # use std::time::Duration;
-    /// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
-    /// # let db = Database::default()?;
-    /// # let keys: Vec<Vec<u8>> = vec![];
-    /// db.run(|trx, _| {
-    ///     let keys = keys.clone();
-    ///     async move {
-    ///         trx.set_client_budget(ClientBudget {
-    ///             max_bytes_read: Some(1024 * 1024),
-    ///             ..ClientBudget::default()
-    ///         });
-    ///         for key in keys {
-    ///             trx.get(&key, false).await?;
-    ///             trx.check_client_budget()?;
-    ///         }
-    ///         Ok::<_, FdbBindingError>(())
-    ///     }
-    /// })
-    /// .await?;
-    /// # Ok(())
-    /// # }
-    /// ```
-    ///
-    /// # Errors
-    ///
-    /// Returns the first [`BudgetExceeded`] limit found, checked in order:
-    /// time, bytes read, bytes written.
-    #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
-    pub fn check_client_budget(&self) -> Result<(), BudgetExceeded> {
-        let budget = self
-            .budget
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .clone();
-        budget.check(&self.usage())
-    }
-}
-
 impl Transaction {
     /// Called to set an option on an FDBTransaction.
     pub fn set_option(&self, opt: options::TransactionOption) -> FdbResult<()> {
@@ -863,9 +632,6 @@ impl Transaction {
                 fdb_len(value.len(), "value"),
             )
         }
-
-        #[cfg(feature = "accounting")]
-        self.usage().record_set((key.len() + value.len()) as u64);
     }
 
     /// Modify the database snapshot represented by transaction to remove the given key from the
@@ -890,9 +656,6 @@ impl Transaction {
                 fdb_len(key.len(), "key"),
             )
         }
-
-        #[cfg(feature = "accounting")]
-        self.usage().record_clear(key.len() as u64);
     }
 
     /// Reads a value from the database snapshot represented by transaction.
@@ -903,11 +666,6 @@ impl Transaction {
     ///
     /// * `key` - the name of the key to be looked up in the database
     /// * `snapshot` - `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
-    ///
-    /// With `accounting`, attempt usage is recorded when the future
-    /// resolves successfully, into the attempt that issued the read: a read
-    /// still in flight is not visible to
-    /// `check_client_budget` yet.
     #[cfg_attr(
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, key))
@@ -917,33 +675,14 @@ impl Transaction {
         key: &[u8],
         snapshot: bool,
     ) -> impl Future<Output = FdbResult<Option<FdbSlice>>> + Send + Sync + Unpin + use<> {
-        #[cfg(feature = "accounting")]
-        let usage = self.usage();
-        #[cfg(feature = "accounting")]
-        let lenght_key = key.len();
-
-        let future = unsafe {
+        unsafe {
             FdbFuture::<Option<FdbSlice>>::new(fdb_sys::fdb_transaction_get(
                 self.inner.as_ptr(),
                 key.as_ptr(),
                 fdb_len(key.len(), "key"),
                 fdb_bool(snapshot),
             ))
-        };
-        #[cfg(feature = "accounting")]
-        let future = future.map(move |result| {
-            if let Ok(value) = &result {
-                let (bytes_count, kv_fetched) = if let Some(values) = value {
-                    ((lenght_key + values.len()) as u64, 1)
-                } else {
-                    (lenght_key as u64, 0)
-                };
-
-                usage.record_get(bytes_count, kv_fetched);
-            }
-            result
-        });
-        future
+        }
     }
 
     /// Modify the database snapshot represented by transaction to perform the operation indicated
@@ -1002,10 +741,6 @@ impl Transaction {
                 op_type.code(),
             )
         }
-
-        #[cfg(feature = "accounting")]
-        self.usage()
-            .record_atomic_op((key.len() + param.len()) as u64);
     }
 
     /// Resolves a key selector against the keys in the database snapshot represented by
@@ -1018,10 +753,6 @@ impl Transaction {
     ///
     /// * `selector`: the key selector
     /// * `snapshot`: `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
-    ///
-    /// With `accounting`, this counts as a `get` of
-    /// the selector key plus the resolved key, recorded when the future
-    /// resolves successfully.
     #[cfg_attr(
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, selector, snapshot))
@@ -1032,12 +763,8 @@ impl Transaction {
         snapshot: bool,
     ) -> impl Future<Output = FdbResult<FdbSlice>> + Send + Sync + Unpin + use<> {
         let key = selector.key();
-        #[cfg(feature = "accounting")]
-        let usage = self.usage();
-        #[cfg(feature = "accounting")]
-        let length_key = key.len();
 
-        let future = unsafe {
+        unsafe {
             FdbFuture::<FdbSlice>::new(fdb_sys::fdb_transaction_get_key(
                 self.inner.as_ptr(),
                 key.as_ptr(),
@@ -1046,15 +773,7 @@ impl Transaction {
                 selector.offset(),
                 fdb_bool(snapshot),
             ))
-        };
-        #[cfg(feature = "accounting")]
-        let future = future.map(move |result| {
-            if let Ok(resolved_key) = &result {
-                usage.record_get((length_key + resolved_key.len()) as u64, 0);
-            }
-            result
-        });
-        future
+        }
     }
 
     /// Reads all key-value pairs in the database snapshot represented by transaction (potentially
@@ -1141,10 +860,6 @@ impl Transaction {
     /// * `iteration`: If opt.mode is Iterator, this parameter should start at 1 and be incremented
     ///   by 1 for each successive call while reading this range. In all other cases it is ignored.
     /// * `snapshot`: `true` if this is a [snapshot read](https://apple.github.io/foundationdb/api-c.html#snapshots)
-    ///
-    /// With `accounting`, each resolved batch counts
-    /// as one `call_get_range`: a full range scan through
-    /// [`get_ranges`](Self::get_ranges) counts once per underlying batch.
     #[cfg_attr(
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, opt, snapshot))
@@ -1154,51 +869,13 @@ impl Transaction {
         opt: &RangeOption,
         iteration: usize,
         snapshot: bool,
-    ) -> impl Future<Output = FdbResult<FdbValues>> + Send + Sync + Unpin + use<> {
-        self.get_range_impl(
-            opt,
-            iteration,
-            snapshot,
-            #[cfg(feature = "accounting")]
-            Some(self.usage()),
-        )
-    }
-
-    /// Same as [`get_range`](Self::get_range), but excluded from accounting.
-    ///
-    /// For reads the binding performs on behalf of the user, on the special
-    /// keyspace, which should neither consume the client budget nor show up in
-    /// the usage of the user's own operations.
-    pub(crate) fn get_range_unmetered(
-        &self,
-        opt: &RangeOption,
-        iteration: usize,
-        snapshot: bool,
-    ) -> impl Future<Output = FdbResult<FdbValues>> + Send + Sync + Unpin + use<> {
-        self.get_range_impl(
-            opt,
-            iteration,
-            snapshot,
-            #[cfg(feature = "accounting")]
-            None,
-        )
-    }
-
-    /// `usage` is the accounting generation to record into, `None` to skip
-    /// accounting entirely.
-    fn get_range_impl(
-        &self,
-        opt: &RangeOption,
-        iteration: usize,
-        snapshot: bool,
-        #[cfg(feature = "accounting")] usage: Option<Arc<AttemptUsage>>,
     ) -> impl Future<Output = FdbResult<FdbValues>> + Send + Sync + Unpin + use<> {
         let begin = &opt.begin;
         let end = &opt.end;
         let key_begin = begin.key();
         let key_end = end.key();
 
-        let future = unsafe {
+        unsafe {
             FdbFuture::<FdbValues>::new(fdb_sys::fdb_transaction_get_range(
                 self.inner.as_ptr(),
                 key_begin.as_ptr(),
@@ -1216,26 +893,7 @@ impl Transaction {
                 fdb_bool(snapshot),
                 fdb_bool(opt.reverse),
             ))
-        };
-        #[cfg(feature = "accounting")]
-        let future = future.map(move |result| {
-            if let (Some(usage), Ok(values)) = (usage.as_ref(), &result) {
-                let kv_fetched = values.len();
-                let mut bytes_count = 0;
-
-                for key_value in values.as_ref() {
-                    let key_len = key_value.key().len();
-                    let value_len = key_value.value().len();
-
-                    bytes_count += (key_len + value_len) as u64
-                }
-
-                usage.record_get_range(bytes_count, kv_fetched as u64);
-            };
-
-            result
-        });
-        future
+        }
     }
 
     /// Mapped Range is an experimental feature introduced in FDB 7.1.
@@ -1259,10 +917,6 @@ impl Transaction {
     /// More info can be found in the relevant [documentation](https://github.com/apple/foundationdb/wiki/Everything-about-GetMappedRange#input).
     ///
     /// This is the "raw" version, users are expected to use [Transaction::get_mapped_ranges]
-    ///
-    /// With `accounting`, a resolved batch counts as
-    /// one `call_get_range` and as the bytes of the primary key-values plus the
-    /// nested key-values returned by the secondary queries.
     #[cfg_api_versions(min = 710)]
     #[cfg_attr(
         feature = "trace",
@@ -1280,10 +934,7 @@ impl Transaction {
         let key_begin = begin.key();
         let key_end = end.key();
 
-        #[cfg(feature = "accounting")]
-        let usage = self.usage();
-
-        let future = unsafe {
+        unsafe {
             FdbFuture::<MappedKeyValues>::new(fdb_sys::fdb_transaction_get_mapped_range(
                 self.inner.as_ptr(),
                 key_begin.as_ptr(),
@@ -1303,31 +954,7 @@ impl Transaction {
                 fdb_bool(snapshot),
                 fdb_bool(opt.reverse),
             ))
-        };
-        #[cfg(feature = "accounting")]
-        let future = future.map(move |result| {
-            if let Ok(values) = &result {
-                let mut bytes_count = 0;
-                let mut kv_fetched = 0;
-
-                for mapped_key_value in values.as_ref() {
-                    bytes_count += (mapped_key_value.parent_key().len()
-                        + mapped_key_value.parent_value().len())
-                        as u64;
-                    kv_fetched += 1;
-
-                    for key_value in mapped_key_value.key_values() {
-                        bytes_count += (key_value.key().len() + key_value.value().len()) as u64;
-                        kv_fetched += 1;
-                    }
-                }
-
-                usage.record_get_range(bytes_count, kv_fetched);
-            }
-
-            result
-        });
-        future
+        }
     }
 
     /// Mapped Range is an experimental feature introduced in FDB 7.1.
@@ -1384,10 +1011,6 @@ impl Transaction {
     ///
     /// The modification affects the actual database only if transaction is later committed with
     /// `Transaction::commit`.
-    ///
-    /// With `accounting`, this counts as the two
-    /// boundary keys only: the volume of data actually deleted is unknown to
-    /// the client.
     #[cfg_attr(
         feature = "trace",
         tracing::instrument(level = "debug", skip(self, begin, end))
@@ -1402,10 +1025,6 @@ impl Transaction {
                 fdb_len(end.len(), "end"),
             )
         }
-
-        #[cfg(feature = "accounting")]
-        self.usage()
-            .record_clear_range((begin.len() + end.len()) as u64);
     }
 
     /// Get the estimated byte size of the key range based on the byte sample collected by FDB
@@ -1449,32 +1068,12 @@ impl Transaction {
     /// Normally, commit will wait for outstanding reads to return. However, if those reads were
     /// snapshot reads or the transaction option for disabling “read-your-writes” has been invoked,
     /// any outstanding reads will immediately return errors.
-    ///
-    /// On an instrumented transaction, the commit ends the current attempt: its
-    /// duration is recorded whatever the result, and a successful commit pushes
-    /// the attempt to the metrics report as
-    /// `AttemptOutcome::Committed`.
     #[cfg_attr(feature = "trace", tracing::instrument(level = "debug", skip(self)))]
     pub fn commit(self) -> impl Future<Output = TransactionResult> + Send + Sync + Unpin {
-        #[cfg(feature = "accounting")]
-        let metrics = self.metrics().cloned();
-        #[cfg(feature = "accounting")]
-        let started_at = Instant::now();
-
         unsafe { FdbFuture::<()>::new(fdb_sys::fdb_transaction_commit(self.inner.as_ptr())) }.map(
-            move |r| {
-                #[cfg(feature = "accounting")]
-                if let Some(metrics) = &metrics {
-                    metrics.record_commit(started_at.elapsed());
-                }
-                match r {
-                    Ok(()) => {
-                        #[cfg(feature = "accounting")]
-                        self.end_attempt(AttemptOutcome::Committed);
-                        Ok(TransactionCommitted { tr: self })
-                    }
-                    Err(err) => Err(TransactionCommitError { tr: self, err }),
-                }
+            move |r| match r {
+                Ok(()) => Ok(TransactionCommitted { tr: self }),
+                Err(err) => Err(TransactionCommitError { tr: self, err }),
             },
         )
     }
@@ -1492,8 +1091,7 @@ impl Transaction {
     /// You should not call this method most of the times and use `Database::transact` which
     /// implements a retry loop strategy for you.
     ///
-    /// On success the transaction enters a new attempt. With `accounting`, its
-    /// usage restarts from zero and its client budget is kept. User versions
+    /// On success the transaction enters a new attempt. User versions
     /// allocated by [`Self::allocate_user_version`] are invalid for the new
     /// attempt, which starts allocating again at zero.
     ///
@@ -1518,9 +1116,6 @@ impl Transaction {
         self,
         err: FdbError,
     ) -> impl Future<Output = (Transaction, FdbResult<()>)> + Send + Sync + Unpin {
-        #[cfg(feature = "accounting")]
-        self.mark_attempt_end();
-
         unsafe {
             FdbFuture::<()>::new(fdb_sys::fdb_transaction_on_error(
                 self.inner.as_ptr(),
@@ -1529,10 +1124,6 @@ impl Transaction {
         }
         .map(move |result| {
             if result.is_ok() {
-                #[cfg(feature = "accounting")]
-                self.end_attempt(AttemptOutcome::Retried { cause: err });
-                #[cfg(feature = "accounting")]
-                self.begin_attempt_usage();
                 self.reset_user_version_allocator();
             }
             (self, result)
@@ -1549,84 +1140,6 @@ impl Transaction {
         TransactionCancelled { tr: self }
     }
 
-    /// Records an application metric for the current attempt, replacing any
-    /// value previously recorded under the same name and labels.
-    ///
-    /// Custom metrics require `accounting`, like the attempt usage
-    /// counters, and scoped to the current attempt: a retry starts from an
-    /// empty set, and the values of the attempt that ended stay attached to it
-    /// in the report. Recording one on a transaction nobody collects metrics
-    /// from is free of consequence: the values are dropped along with the
-    /// attempt.
-    ///
-    /// # Arguments
-    /// * `name` - The name of the metric (e.g., "query_time", "cache_hits")
-    /// * `value` - The value to record
-    /// * `labels` - Key-value pairs for labeling the metric, allowing for dimensional metrics
-    ///   (e.g., `[("operation", "read"), ("region", "us-west")]`)
-    ///
-    /// # Example
-    /// ```
-    /// # use foundationdb::*;
-    /// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
-    /// # let db = Database::default()?;
-    /// let (_, metrics) = db
-    ///     .instrumented_run(|txn, _| async move {
-    ///         txn.set_custom_metric("documents_indexed", 42, &[("kind", "user")]);
-    ///         Ok::<_, FdbBindingError>(())
-    ///     })
-    ///     .await
-    ///     .map_err(|(err, _)| err)?;
-    ///
-    /// // The values are attached to the attempt that recorded them.
-    /// let attempt = metrics.attempts.last().expect("one attempt");
-    /// # let _ = attempt;
-    /// # Ok(())
-    /// # }
-    /// ```
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(self, labels))
-    )]
-    #[cfg(feature = "accounting")]
-    pub fn set_custom_metric(&self, name: &str, value: u64, labels: &[(&str, &str)]) {
-        self.usage().set_custom(MetricKey::new(name, labels), value);
-    }
-
-    /// Adds `amount` to an application metric of the current attempt, starting
-    /// from zero if it was not recorded yet.
-    ///
-    /// Same per-attempt semantics as [`set_custom_metric`](Self::set_custom_metric).
-    ///
-    /// # Arguments
-    /// * `name` - The name of the metric to increment (e.g., "requests", "bytes_processed")
-    /// * `amount` - The amount to increment the metric by
-    /// * `labels` - Key-value pairs for labeling the metric, allowing for dimensional metrics
-    ///   (e.g., `[("status", "success"), ("endpoint", "api/v1/users")]`)
-    ///
-    /// # Example
-    /// ```
-    /// # use foundationdb::*;
-    /// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
-    /// # let db = Database::default()?;
-    /// let txn = db.create_trx()?;
-    ///
-    /// txn.increment_custom_metric("cache_misses", 1, &[("cache", "user_data")]);
-    /// txn.increment_custom_metric("cache_misses", 1, &[("cache", "user_data")]);
-    /// // The metric of the current attempt is now 2.
-    /// # Ok(())
-    /// # }
-    /// ```
-    #[cfg_attr(
-        feature = "trace",
-        tracing::instrument(level = "debug", skip(self, labels))
-    )]
-    #[cfg(feature = "accounting")]
-    pub fn increment_custom_metric(&self, name: &str, amount: u64, labels: &[(&str, &str)]) {
-        self.usage()
-            .increment_custom(MetricKey::new(name, labels), amount);
-    }
-
     /// Returns a list of public network addresses as strings, one for each of the storage servers
     /// responsible for storing key_name and its associated value.
     pub fn get_addresses_for_key(
@@ -1740,31 +1253,14 @@ impl Transaction {
     /// to `get_*()` (including this one) and (unless causal consistency has been deliberately
     /// compromised by transaction options) is guaranteed to represent all transactions which were
     /// reported committed before that call.
-    ///
-    /// On an instrumented transaction, the version is recorded in the metrics of
-    /// the issuing attempt. A future polled after that attempt ends does not
-    /// update the report. The binding never fetches a read version on its own.
     pub fn get_read_version(
         &self,
     ) -> impl Future<Output = FdbResult<i64>> + Send + Sync + Unpin + use<> {
-        #[cfg(feature = "accounting")]
-        let recording = self
-            .metrics()
-            .map(|metrics| (metrics.clone(), self.usage(), Instant::now()));
-
-        let future = unsafe {
+        unsafe {
             FdbFuture::<i64>::new(fdb_sys::fdb_transaction_get_read_version(
                 self.inner.as_ptr(),
             ))
-        };
-        #[cfg(feature = "accounting")]
-        let future = future.map(move |result| {
-            if let Some((metrics, usage, started_at)) = recording {
-                metrics.record_grv(&usage, started_at.elapsed(), result.as_ref().ok().copied());
-            }
-            result
-        });
-        future
+        }
     }
 
     /// Sets the snapshot read version used by a transaction.
@@ -1834,16 +1330,11 @@ impl Transaction {
     /// It is not necessary to call `reset()` when handling an error with `on_error()` since the
     /// transaction has already been reset.
     ///
-    /// This starts a new attempt. With `accounting`, usage restarts from zero
-    /// and the client budget is kept. On an instrumented transaction, the
-    /// attempt being recorded is abandoned rather
-    /// than reported: it reached no conclusion. User versions allocated before
+    /// This starts a new attempt. User versions allocated before
     /// reset are invalid for the new attempt, which starts allocating again at
     /// zero.
     pub fn reset(&mut self) {
         unsafe { fdb_sys::fdb_transaction_reset(self.inner.as_ptr()) }
-        #[cfg(feature = "accounting")]
-        self.begin_attempt_usage();
         self.reset_user_version_allocator();
     }
 
@@ -1892,9 +1383,6 @@ impl Transaction {
     /// is therefore as slow as the slowest of them.
     /// </div>
     ///
-    /// The read itself is performed by the binding on your behalf: it is not
-    /// counted with `accounting` enabled and does not consume the client budget.
-    ///
     /// Only complete ranges are returned, see [`conflicting_keys`](Self::conflicting_keys).
     ///
     /// # Errors
@@ -1921,9 +1409,6 @@ impl Transaction {
     /// reported with its placeholder bytes.
     /// </div>
     ///
-    /// The read itself is performed by the binding on your behalf: it is not
-    /// counted with `accounting` enabled and does not consume the client budget.
-    ///
     /// Only complete ranges are returned, see [`conflicting_keys`](Self::conflicting_keys).
     ///
     /// # Errors
@@ -1938,9 +1423,7 @@ impl Transaction {
 
     /// Reads one conflict-range special keyspace to its end and parses it.
     ///
-    /// The reads go through the unmetered path: they are performed by the
-    /// binding itself and must not show up in the user's usage or budget. The
-    /// keyspace is paginated because a marker pair can straddle two batches,
+    /// The keyspace is paginated because a marker pair can straddle two batches,
     /// which [`ConflictRangeParser`] handles by carrying the open begin marker
     /// from one batch to the next.
     async fn read_conflict_range_keyspace(
@@ -1953,7 +1436,7 @@ impl Transaction {
         let mut iteration = 1;
 
         while let Some(opt) = next {
-            let values = self.get_range_unmetered(&opt, iteration, false).await?;
+            let values = self.get_range(&opt, iteration, false).await?;
             parser.feed(values.iter().map(|kv| (kv.key(), kv.value())));
             next = opt.next_range(&values);
             iteration += 1;
diff --git a/bindings/rust/foundationdb/tests/budget.rs b/bindings/rust/foundationdb/tests/budget.rs
deleted file mode 100644
index 16b4aaf6701..00000000000
--- a/bindings/rust/foundationdb/tests/budget.rs
+++ /dev/null
@@ -1,507 +0,0 @@
-// Copyright 2018 foundationdb-rs developers, https://github.com/Clikengo/foundationdb-rs/graphs/contributors
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-//! Per-attempt usage accounting and client-side budget, against a live cluster.
-
-use foundationdb::options::StreamingMode;
-use foundationdb::*;
-use std::sync::Arc;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::Duration;
-
-mod common;
-
-/// `transaction_too_old`, retryable, retried without any backoff.
-const TRANSACTION_TOO_OLD: i32 = 1007;
-
-/// A clock the test moves by hand, in milliseconds, standing in for the
-/// simulated time a workload would run on.
-#[derive(Debug, Clone, Default)]
-struct FakeClock(Arc<AtomicU64>);
-
-impl FakeClock {
-    fn set_millis(&self, millis: u64) {
-        self.0.store(millis, Ordering::Relaxed);
-    }
-}
-
-impl Clock for FakeClock {
-    fn monotonic(&self) -> Duration {
-        Duration::from_millis(self.0.load(Ordering::Relaxed))
-    }
-
-    fn wall(&self) -> Duration {
-        self.monotonic()
-    }
-}
-
-/// Writes are accounted as soon as they are issued, no commit needed.
-#[tokio::test]
-async fn usage_counts_writes() -> FdbResult<()> {
-    const KEY: &[u8] = b"test-budget-writes-key";
-    const VALUE: &[u8] = b"value";
-    const PARAM: &[u8] = b"\x01\x00\x00\x00\x00\x00\x00\x00";
-    const BEGIN: &[u8] = b"test-budget-writes-";
-    const END: &[u8] = b"test-budget-writes.";
-
-    let db = common::database().await?;
-    let trx = db.create_trx()?;
-
-    trx.set(KEY, VALUE);
-    trx.clear(KEY);
-    trx.clear_range(BEGIN, END);
-    trx.atomic_op(KEY, PARAM, options::MutationType::Add);
-
-    let usage = trx.attempt_usage();
-    assert_eq!(usage.call_set, 1);
-    assert_eq!(usage.call_clear, 1);
-    assert_eq!(usage.call_clear_range, 1);
-    assert_eq!(usage.call_atomic_op, 1);
-    assert_eq!(
-        usage.bytes_written,
-        (KEY.len() + VALUE.len() + KEY.len() + BEGIN.len() + END.len() + KEY.len() + PARAM.len())
-            as u64
-    );
-    assert_eq!(usage.bytes_read, 0);
-
-    Ok(())
-}
-
-/// Reads are accounted when their future resolves.
-#[tokio::test]
-async fn usage_counts_reads() -> FdbResult<()> {
-    const PREFIX: &[u8] = b"test-budget-reads-";
-    const MISSING: &[u8] = b"test-budget-reads-missing-key";
-    const VALUE: &[u8] = b"value";
-
-    let keys: Vec<Vec<u8>> = (0..3)
-        .map(|i| [PREFIX, format!("{i}").as_bytes()].concat())
-        .collect();
-
-    let db = common::database().await?;
-
-    {
-        let trx = db.create_trx()?;
-        trx.clear_range(PREFIX, b"test-budget-reads.");
-        for key in &keys {
-            trx.set(key, VALUE);
-        }
-        trx.commit().await.expect("failed to commit");
-    }
-
-    // get, on an existing then on a missing key.
-    let trx = db.create_trx()?;
-    trx.get(&keys[0], false).await?;
-    trx.get(MISSING, false).await?;
-
-    let usage = trx.attempt_usage();
-    assert_eq!(usage.call_get, 2);
-    assert_eq!(usage.keys_values_fetched, 1);
-    assert_eq!(
-        usage.bytes_read,
-        (keys[0].len() + VALUE.len() + MISSING.len()) as u64
-    );
-
-    // get_key counts as a get of the selector key plus the resolved key.
-    let trx = db.create_trx()?;
-    let selector = KeySelector::first_greater_or_equal(keys[0].as_slice());
-    let resolved = trx.get_key(&selector, false).await?;
-
-    let usage = trx.attempt_usage();
-    assert_eq!(usage.call_get, 1);
-    assert_eq!(usage.keys_values_fetched, 0);
-    assert_eq!(usage.bytes_read, (keys[0].len() + resolved.len()) as u64);
-
-    // get_range counts one call per resolved batch.
-    let trx = db.create_trx()?;
-    let opt = RangeOption {
-        mode: StreamingMode::WantAll,
-        ..RangeOption::from((PREFIX, b"test-budget-reads.".as_ref()))
-    };
-    let values = trx.get_range(&opt, 1, false).await?;
-    assert_eq!(values.len(), keys.len());
-
-    let usage = trx.attempt_usage();
-    assert_eq!(usage.call_get_range, 1);
-    assert_eq!(usage.call_get, 0);
-    assert_eq!(usage.keys_values_fetched, keys.len() as u64);
-    assert_eq!(
-        usage.bytes_read,
-        keys.iter().map(|k| (k.len() + VALUE.len()) as u64).sum()
-    );
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn budget_exceeded_on_bytes_written() -> FdbResult<()> {
-    const KEY: &[u8] = b"test-budget-bytes-written-key";
-    const VALUE: &[u8] = b"a-value-larger-than-the-limit";
-
-    let db = common::database().await?;
-    let trx = db.create_trx()?;
-
-    trx.set_client_budget(ClientBudget {
-        max_bytes_written: Some(8),
-        ..ClientBudget::default()
-    });
-    assert!(trx.check_client_budget().is_ok());
-
-    trx.set(KEY, VALUE);
-
-    let err = trx.check_client_budget().unwrap_err();
-    assert_eq!(err.kind, BudgetKind::BytesWritten);
-    assert_eq!(err.used, (KEY.len() + VALUE.len()) as u64);
-    assert_eq!(err.limit, 8);
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn budget_exceeded_on_bytes_read() -> FdbResult<()> {
-    const KEY: &[u8] = b"test-budget-bytes-read-key";
-    const VALUE: &[u8] = b"a-value-larger-than-the-limit";
-
-    let db = common::database().await?;
-
-    {
-        let trx = db.create_trx()?;
-        trx.set(KEY, VALUE);
-        trx.commit().await.expect("failed to commit");
-    }
-
-    let trx = db.create_trx()?;
-    trx.set_client_budget(ClientBudget {
-        max_bytes_read: Some(8),
-        ..ClientBudget::default()
-    });
-    assert!(trx.check_client_budget().is_ok());
-
-    trx.get(KEY, false).await?;
-
-    let err = trx.check_client_budget().unwrap_err();
-    assert_eq!(err.kind, BudgetKind::BytesRead);
-    assert_eq!(err.used, (KEY.len() + VALUE.len()) as u64);
-    assert_eq!(err.limit, 8);
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn budget_exceeded_on_time() -> FdbResult<()> {
-    let db = common::database().await?;
-    let trx = db.create_trx()?;
-
-    trx.set_client_budget(ClientBudget {
-        time_limit: Some(Duration::from_millis(20)),
-        ..ClientBudget::default()
-    });
-    assert!(trx.check_client_budget().is_ok());
-
-    tokio::time::sleep(Duration::from_millis(50)).await;
-
-    let err = trx.check_client_budget().unwrap_err();
-    assert_eq!(err.kind, BudgetKind::Time);
-    assert!(err.used >= 20, "used {} ms", err.used);
-    assert_eq!(err.limit, 20);
-
-    Ok(())
-}
-
-/// With a [`Clock`] the time limit no longer depends on how fast the machine
-/// is: the test advances time itself and the numbers are exact.
-#[tokio::test]
-async fn budget_exceeded_on_time_with_a_custom_clock() -> FdbResult<()> {
-    let db = common::database().await?;
-    let trx = db.create_trx()?;
-
-    let clock = FakeClock::default();
-    clock.set_millis(1_000);
-
-    trx.set_client_budget(
-        ClientBudget {
-            time_limit: Some(Duration::from_millis(20)),
-            ..ClientBudget::default()
-        }
-        .with_clock(clock.clone()),
-    );
-    assert!(trx.check_client_budget().is_ok());
-
-    // The limit itself is allowed, anything past it is not.
-    clock.set_millis(1_020);
-    assert!(trx.check_client_budget().is_ok());
-
-    clock.set_millis(1_050);
-
-    let err = trx.check_client_budget().unwrap_err();
-    assert_eq!(err.kind, BudgetKind::Time);
-    assert_eq!(err.used, 50);
-    assert_eq!(err.limit, 20);
-    assert_eq!(trx.attempt_usage().elapsed, Duration::from_millis(50));
-
-    Ok(())
-}
-
-/// The clock is configuration too: the generation a new attempt starts is
-/// measured with the clock of the budget, not with the wall clock.
-#[tokio::test]
-async fn the_clock_survives_a_new_attempt() -> FdbResult<()> {
-    let db = common::database().await?;
-    let mut trx = db.create_trx()?;
-
-    let clock = FakeClock::default();
-    clock.set_millis(1_000);
-
-    trx.set_client_budget(
-        ClientBudget {
-            time_limit: Some(Duration::from_millis(20)),
-            ..ClientBudget::default()
-        }
-        .with_clock(clock.clone()),
-    );
-
-    clock.set_millis(1_100);
-    assert!(trx.check_client_budget().is_err());
-
-    trx.reset();
-
-    // The new attempt was stamped at 1_100 ms, so it starts from zero.
-    assert_eq!(trx.attempt_usage().elapsed, Duration::ZERO);
-    assert!(trx.check_client_budget().is_ok());
-
-    clock.set_millis(1_130);
-
-    let err = trx.check_client_budget().unwrap_err();
-    assert_eq!(err.kind, BudgetKind::Time);
-    assert_eq!(err.used, 30);
-    assert_eq!(err.limit, 20);
-
-    // Same contract after an `on_error` restart.
-    let trx = trx
-        .on_error(FdbError::from_code(TRANSACTION_TOO_OLD))
-        .await?;
-    assert_eq!(trx.attempt_usage().elapsed, Duration::ZERO);
-
-    clock.set_millis(1_175);
-
-    let err = trx.check_client_budget().unwrap_err();
-    assert_eq!(err.kind, BudgetKind::Time);
-    assert_eq!(err.used, 45);
-    assert_eq!(err.limit, 20);
-
-    Ok(())
-}
-
-/// The budget is configuration, the usage is per-attempt: `on_error` keeps the
-/// former and resets the latter.
-#[tokio::test]
-async fn budget_survives_on_error_while_usage_resets() -> FdbResult<()> {
-    const KEY: &[u8] = b"test-budget-on-error-key";
-    const VALUE: &[u8] = b"a-value-larger-than-the-limit";
-
-    let db = common::database().await?;
-    let trx = db.create_trx()?;
-
-    trx.set_client_budget(ClientBudget {
-        max_bytes_written: Some(8),
-        ..ClientBudget::default()
-    });
-    trx.set(KEY, VALUE);
-    assert!(trx.check_client_budget().is_err());
-
-    let trx = trx
-        .on_error(FdbError::from_code(TRANSACTION_TOO_OLD))
-        .await?;
-
-    let usage = trx.attempt_usage();
-    assert_eq!(usage.bytes_written, 0);
-    assert_eq!(usage.call_set, 0);
-    assert!(
-        trx.check_client_budget().is_ok(),
-        "usage should have been reset by the new attempt"
-    );
-
-    // The limit is still armed for the new attempt.
-    trx.set(KEY, VALUE);
-    assert_eq!(
-        trx.check_client_budget().unwrap_err().kind,
-        BudgetKind::BytesWritten
-    );
-
-    Ok(())
-}
-
-/// Same contract for an explicit `reset`.
-#[tokio::test]
-async fn reset_starts_a_new_attempt() -> FdbResult<()> {
-    const KEY: &[u8] = b"test-budget-reset-key";
-    const VALUE: &[u8] = b"a-value-larger-than-the-limit";
-
-    let db = common::database().await?;
-    let mut trx = db.create_trx()?;
-
-    trx.set_client_budget(ClientBudget {
-        max_bytes_written: Some(8),
-        ..ClientBudget::default()
-    });
-    trx.set(KEY, VALUE);
-    assert!(trx.check_client_budget().is_err());
-
-    trx.reset();
-
-    assert_eq!(trx.attempt_usage().bytes_written, 0);
-    assert!(trx.check_client_budget().is_ok());
-
-    trx.clear_client_budget();
-    trx.set(KEY, VALUE);
-    assert!(trx.check_client_budget().is_ok());
-
-    Ok(())
-}
-
-/// An exceeded budget converts into an `FdbBindingError`, so `?` works inside a
-/// `run` closure, and it is not retried.
-#[tokio::test]
-async fn budget_exceeded_is_fatal_in_run() -> FdbResult<()> {
-    const KEY: &[u8] = b"test-budget-run-key";
-    const VALUE: &[u8] = b"a-value-larger-than-the-limit";
-
-    let db = common::database().await?;
-
-    let result: Result<(), FdbBindingError> = db
-        .run(|trx, _| async move {
-            trx.set_client_budget(ClientBudget {
-                max_bytes_written: Some(8),
-                ..ClientBudget::default()
-            });
-            trx.set(KEY, VALUE);
-            trx.check_client_budget()?;
-            Ok(())
-        })
-        .await;
-
-    match result {
-        Err(FdbBindingError::ClientBudgetExceeded(err)) => {
-            assert_eq!(err.kind, BudgetKind::BytesWritten);
-            assert!(err.to_string().contains("client-side estimate"));
-        }
-        other => panic!("expected a ClientBudgetExceeded error, got {other:?}"),
-    }
-
-    Ok(())
-}
-
-/// The pattern of `examples/budgeted_scan.rs`: a scan cut into pages by the
-/// budget, each page resuming exclusively after the last key of the previous
-/// one. Every row must be seen exactly once across the pages.
-#[tokio::test]
-async fn budgeted_scan_resumes_without_losing_or_repeating_rows() -> FdbResult<()> {
-    const PREFIX: &[u8] = b"test-budget-scan/";
-    const END: &[u8] = b"test-budget-scan0";
-    const ROWS: usize = 400;
-    const VALUE_SIZE: usize = 1024;
-
-    fn key_of(index: usize) -> Vec<u8> {
-        let mut key = PREFIX.to_vec();
-        key.extend_from_slice(format!("{index:05}").as_bytes());
-        key
-    }
-
-    let db = common::database().await?;
-
-    db.run(|trx, _| async move {
-        trx.clear_range(PREFIX, END);
-        for index in 0..ROWS {
-            trx.set(&key_of(index), &vec![b'x'; VALUE_SIZE]);
-        }
-        Ok::<_, FdbBindingError>(())
-    })
-    .await
-    .expect("setup");
-
-    let mut seen: Vec<Vec<u8>> = Vec::new();
-    let mut continuation: Option<Vec<u8>> = None;
-    let mut transactions = 0;
-
-    loop {
-        let after = continuation.clone();
-        // A budget smaller than one batch: each transaction reads a single
-        // batch, then stops on the check that follows it.
-        let (keys, complete) = db
-            .run(move |trx, _| {
-                let after = after.clone();
-                async move {
-                    trx.set_client_budget(ClientBudget {
-                        max_bytes_read: Some(1),
-                        ..ClientBudget::default()
-                    });
-
-                    let begin = match &after {
-                        Some(last) => KeySelector::first_greater_than(last.as_slice()),
-                        None => KeySelector::first_greater_or_equal(PREFIX),
-                    };
-                    let opt = RangeOption {
-                        begin,
-                        end: KeySelector::first_greater_or_equal(END),
-                        mode: StreamingMode::Serial,
-                        target_bytes: 1 << 20,
-                        ..RangeOption::default()
-                    };
-
-                    let mut keys: Vec<Vec<u8>> = Vec::new();
-                    let mut complete = true;
-                    let mut batches = trx.get_ranges(opt, false);
-                    while let Some(batch) =
-                        futures_util::TryStreamExt::try_next(&mut batches).await?
-                    {
-                        for kv in batch.iter() {
-                            keys.push(kv.key().to_vec());
-                        }
-                        // Matched, not propagated: the page is kept and the
-                        // caller resumes from its last key.
-                        if trx.check_client_budget().is_err() {
-                            complete = false;
-                            break;
-                        }
-                    }
-
-                    Ok::<_, FdbBindingError>((keys, complete))
-                }
-            })
-            .await
-            .expect("scan page");
-
-        transactions += 1;
-        let last = keys.last().cloned();
-        seen.extend(keys);
-
-        if complete {
-            break;
-        }
-        match last {
-            Some(last) => continuation = Some(last),
-            None => break,
-        }
-    }
-
-    assert!(
-        transactions > 1,
-        "the budget should have cut the scan into several transactions, got {transactions}"
-    );
-    assert_eq!(seen.len(), ROWS, "a row was lost or read twice");
-    let expected: Vec<Vec<u8>> = (0..ROWS).map(key_of).collect();
-    assert_eq!(seen, expected, "rows are not the expected ones, in order");
-
-    db.run(|trx, _| async move {
-        trx.clear_range(PREFIX, END);
-        Ok::<_, FdbBindingError>(())
-    })
-    .await
-    .expect("cleanup");
-
-    Ok(())
-}
diff --git a/bindings/rust/foundationdb/tests/conflict_ranges.rs b/bindings/rust/foundationdb/tests/conflict_ranges.rs
index 19ebbfc6178..22fe9d92a27 100644
--- a/bindings/rust/foundationdb/tests/conflict_ranges.rs
+++ b/bindings/rust/foundationdb/tests/conflict_ranges.rs
@@ -193,27 +193,32 @@ async fn many_conflict_ranges_are_fully_paginated() -> FdbResult<()> {
     Ok(())
 }
 
-/// Reading the conflict ranges is a binding-internal read: it must not move the
-/// usage counters of the attempt, nor consume the client budget.
+/// A failed transaction exposes the key that caused its commit conflict
+/// before the native error handler resets it.
 #[cfg_api_versions(min = 630)]
-#[cfg(feature = "accounting")]
 #[tokio::test]
-async fn reading_conflict_ranges_is_unmetered() -> FdbResult<()> {
-    const KEY: &[u8] = b"test-rcr-unmetered";
-
+async fn commit_error_reports_conflicting_key() -> FdbResult<()> {
+    const KEY: &[u8] = b"test-conflicting-key-direct";
     let db = common::database().await?;
-    let trx = db.create_trx()?;
-
-    trx.set(KEY, b"value");
-    let before = trx.attempt_usage();
-
-    trx.read_conflict_ranges().await?;
-    trx.write_conflict_ranges().await?;
-
-    let after = trx.attempt_usage();
-    assert_eq!(after.bytes_read, before.bytes_read);
-    assert_eq!(after.call_get_range, before.call_get_range);
-    assert_eq!(after.keys_values_fetched, before.keys_values_fetched);
-
+    let first = db.create_trx()?;
+    first.set_option(options::TransactionOption::ReportConflictingKeys)?;
+    first.get(KEY, false).await?;
+
+    let second = db.create_trx()?;
+    second.set(KEY, b"other");
+    second.commit().await.expect("second transaction commits");
+
+    first.set(KEY, b"first");
+    let error = first
+        .commit()
+        .await
+        .expect_err("first transaction conflicts");
+    assert_eq!(error.code(), 1020);
+    let ranges = error.conflicting_keys().await?;
+    assert!(
+        ranges
+            .iter()
+            .any(|range| KEY >= range.begin() && KEY < range.end())
+    );
     Ok(())
 }
diff --git a/bindings/rust/foundationdb/tests/error.rs b/bindings/rust/foundationdb/tests/error.rs
index 71b950980eb..e19d1238616 100644
--- a/bindings/rust/foundationdb/tests/error.rs
+++ b/bindings/rust/foundationdb/tests/error.rs
@@ -1,6 +1,6 @@
 use foundationdb::directory::DirectoryError;
 use foundationdb::tuple::hca::HcaError;
-use foundationdb::{FdbBindingError, FdbError, RetryDecision, RetryableError};
+use foundationdb::{FdbBindingError, FdbError};
 use std::fmt;
 
 #[test]
@@ -56,65 +56,6 @@ fn get_fdb_error_boxed_binding_error() {
     assert_eq!(err.get_fdb_error().map(|e| e.code()), Some(1020));
 }
 
-/// A layer error enum implementing RetryableError with the default
-/// source-walk classification.
-#[derive(Debug)]
-enum TypedLayerError {
-    Fdb(FdbError),
-    Binding(FdbBindingError),
-    Invalid,
-}
-
-impl fmt::Display for TypedLayerError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{self:?}")
-    }
-}
-
-impl std::error::Error for TypedLayerError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Self::Fdb(e) => Some(e),
-            Self::Binding(e) => Some(e),
-            Self::Invalid => None,
-        }
-    }
-}
-
-impl From<FdbError> for TypedLayerError {
-    fn from(e: FdbError) -> Self {
-        Self::Fdb(e)
-    }
-}
-
-impl From<FdbBindingError> for TypedLayerError {
-    fn from(e: FdbBindingError) -> Self {
-        Self::Binding(e)
-    }
-}
-
-impl RetryableError for TypedLayerError {}
-
-#[test]
-fn retry_decision_default_walk() {
-    let wrapped = TypedLayerError::Fdb(FdbError::from_code(1020));
-    match wrapped.retry_decision() {
-        RetryDecision::Fdb(e) => assert_eq!(e.code(), 1020),
-        other => panic!("expected Fdb decision, got {other:?}"),
-    }
-
-    let nested = TypedLayerError::Binding(FdbBindingError::from(FdbError::from_code(1020)));
-    match nested.retry_decision() {
-        RetryDecision::Fdb(e) => assert_eq!(e.code(), 1020),
-        other => panic!("expected Fdb decision, got {other:?}"),
-    }
-
-    match TypedLayerError::Invalid.retry_decision() {
-        RetryDecision::Fatal => {}
-        other => panic!("expected Fatal decision, got {other:?}"),
-    }
-}
-
 #[test]
 fn stringified_error_has_no_fdb_error() {
     // Stringifying an error destroys the source chain: there is no FdbError
diff --git a/bindings/rust/foundationdb/tests/leader_election_ranked_register.rs b/bindings/rust/foundationdb/tests/leader_election_ranked_register.rs
deleted file mode 100644
index 27760d5112b..00000000000
--- a/bindings/rust/foundationdb/tests/leader_election_ranked_register.rs
+++ /dev/null
@@ -1,1264 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://opensource.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT> or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-mod common;
-
-#[cfg(feature = "recipes-leader-election")]
-mod leader_election_tests {
-    use std::{
-        sync::{
-            Arc, Mutex,
-            atomic::{AtomicUsize, Ordering},
-        },
-        time::Duration,
-    };
-
-    use foundationdb::{
-        Database, FdbBindingError,
-        options::TransactionOption,
-        recipes::{
-            leader_election::{
-                LeaderElection, Leadership, LocalState, ParticipantId, PollOutcome, PollResult,
-                PollTransition, ResignOutcome,
-            },
-            ranked_register::{RankedRegister, RankedRegisterError, WriteResult},
-        },
-        tuple::Subspace,
-    };
-    use tokio::sync::Barrier;
-
-    fn participant(value: &str) -> ParticipantId {
-        ParticipantId::new(value).expect("test participant ID is valid")
-    }
-
-    fn register_error(error: RankedRegisterError) -> FdbBindingError {
-        FdbBindingError::new_custom_error(Box::new(error))
-    }
-
-    async fn setup_election(
-        db: &Database,
-        test_name: &str,
-        lease_duration: Duration,
-    ) -> Result<LeaderElection, FdbBindingError> {
-        let subspace = Subspace::all().subspace(&("leader_election_ranked_register", test_name));
-        let (begin, end) = subspace.range();
-        db.run(|txn, _| {
-            let begin = begin.clone();
-            let end = end.clone();
-            async move {
-                txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                txn.clear_range(&begin, &end);
-                Ok::<_, FdbBindingError>(())
-            }
-        })
-        .await?;
-        Ok(LeaderElection::new(subspace, lease_duration)?)
-    }
-
-    async fn setup_register(
-        db: &Database,
-        test_name: &str,
-    ) -> Result<RankedRegister, FdbBindingError> {
-        let subspace =
-            Subspace::all().subspace(&("leader_election_ranked_register_state", test_name));
-        let (begin, end) = subspace.range();
-        db.run(|txn, _| {
-            let begin = begin.clone();
-            let end = end.clone();
-            async move {
-                txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                txn.clear_range(&begin, &end);
-                Ok::<_, FdbBindingError>(())
-            }
-        })
-        .await?;
-        Ok(RankedRegister::new(subspace))
-    }
-
-    struct CompletedPoll {
-        result: PollResult,
-        next_state: LocalState,
-    }
-
-    #[derive(Clone)]
-    struct TestTime(Arc<Mutex<Duration>>);
-
-    impl TestTime {
-        fn new(now: Duration) -> Self {
-            Self(Arc::new(Mutex::new(now)))
-        }
-
-        fn monotonic(&self) -> Duration {
-            *self
-                .0
-                .lock()
-                .expect("test clock mutex must not be poisoned")
-        }
-
-        fn set(&self, now: Duration) {
-            *self
-                .0
-                .lock()
-                .expect("test clock mutex must not be poisoned") = now;
-        }
-    }
-
-    async fn poll(
-        db: &Database,
-        election: &LeaderElection,
-        participant: &ParticipantId,
-        local_state: &LocalState,
-        attempt_started_at: Duration,
-        adopted_at: Duration,
-    ) -> Result<CompletedPoll, FdbBindingError> {
-        let election = election.clone();
-        let participant = participant.clone();
-        let local_state = local_state.clone();
-        let time = TestTime::new(attempt_started_at);
-        db.run(|txn, _| {
-            let election = election.clone();
-            let participant = participant.clone();
-            let local_state = local_state.clone();
-            let time = time.clone();
-            async move {
-                txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                let attempt_started_at = time.monotonic();
-                Ok::<_, FdbBindingError>(
-                    election
-                        .poll(&txn, &participant, &local_state, attempt_started_at)
-                        .await?,
-                )
-            }
-        })
-        .await
-        .map(|result| {
-            time.set(adopted_at);
-            CompletedPoll {
-                next_state: result.clone().into_next_state(time.monotonic()),
-                result,
-            }
-        })
-    }
-
-    async fn state(
-        db: &Database,
-        election: &LeaderElection,
-    ) -> Result<foundationdb::recipes::leader_election::ElectionState, FdbBindingError> {
-        let election = election.clone();
-        db.run(|txn, _| {
-            let election = election.clone();
-            async move {
-                txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                Ok::<_, FdbBindingError>(election.state(&txn).await?)
-            }
-        })
-        .await
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    async fn service_poll(
-        db: &Database,
-        election: &LeaderElection,
-        register: &RankedRegister,
-        participant: &ParticipantId,
-        local_state: &LocalState,
-        attempt_started_at: Duration,
-        adopted_at: Duration,
-        value: &[u8],
-    ) -> Result<(CompletedPoll, Option<WriteResult>), FdbBindingError> {
-        let election = election.clone();
-        let register = register.clone();
-        let participant = participant.clone();
-        let local_state = local_state.clone();
-        let value = value.to_vec();
-        let time = TestTime::new(attempt_started_at);
-        db.run(|txn, _| {
-            let election = election.clone();
-            let register = register.clone();
-            let participant = participant.clone();
-            let local_state = local_state.clone();
-            let value = value.clone();
-            let time = time.clone();
-            async move {
-                txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                let attempt_started_at = time.monotonic();
-                let result = election
-                    .poll(&txn, &participant, &local_state, attempt_started_at)
-                    .await?;
-                let write = if let PollOutcome::Leader { rank, .. } = result.outcome() {
-                    register.read(&txn, *rank).await.map_err(register_error)?;
-                    Some(
-                        register
-                            .write(&txn, *rank, &value)
-                            .await
-                            .map_err(register_error)?,
-                    )
-                } else {
-                    None
-                };
-                Ok::<_, FdbBindingError>((result, write))
-            }
-        })
-        .await
-        .map(|(result, write)| {
-            time.set(adopted_at);
-            (
-                CompletedPoll {
-                    next_state: result.clone().into_next_state(time.monotonic()),
-                    result,
-                },
-                write,
-            )
-        })
-    }
-
-    fn leadership(state: &LocalState) -> Leadership {
-        state
-            .leadership()
-            .expect("leader result carries a leadership token")
-            .clone()
-    }
-
-    #[tokio::test]
-    async fn zero_duration_constructor_is_rejected() {
-        let subspace = Subspace::all().subspace(&("leader_election_ranked_register", "zero"));
-        assert!(LeaderElection::new(subspace, Duration::ZERO).is_err());
-    }
-
-    #[tokio::test]
-    async fn vacant_state_is_acquired_immediately() -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let election = setup_election(&db, "vacant", Duration::from_secs(5)).await?;
-        let alice = participant("alice-vacant");
-
-        let result = poll(
-            &db,
-            &election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        assert!(result.result.outcome().is_leader());
-        assert_eq!(
-            result.result.outcome().transition(),
-            PollTransition::Acquired
-        );
-        assert_eq!(result.result.outcome().rank().as_u64(), 1);
-        assert_eq!(
-            leadership(&result.next_state).lease_duration(),
-            Duration::from_secs(5)
-        );
-
-        let durable = state(&db, &election).await?;
-        assert_eq!(durable.owner(), Some(&alice));
-        assert_eq!(durable.rank().as_u64(), 1);
-        assert_eq!(durable.lease_duration(), Some(Duration::from_secs(5)));
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn exact_unexpired_renewal_publishes_fresh_rank_and_duration()
-    -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let initial = setup_election(&db, "renewal", Duration::from_secs(5)).await?;
-        let renewal = LeaderElection::new(
-            Subspace::all().subspace(&("leader_election_ranked_register", "renewal")),
-            Duration::from_secs(9),
-        )?;
-        let alice = participant("alice-renewal");
-        let acquired = poll(
-            &db,
-            &initial,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-
-        let renewed = poll(
-            &db,
-            &renewal,
-            &alice,
-            &acquired.next_state,
-            Duration::from_secs(1),
-            Duration::from_secs(1),
-        )
-        .await?;
-        assert_eq!(
-            renewed.result.outcome().transition(),
-            PollTransition::Renewed
-        );
-        assert_eq!(renewed.result.outcome().rank().as_u64(), 2);
-        assert_eq!(
-            leadership(&renewed.next_state).lease_duration(),
-            Duration::from_secs(9)
-        );
-
-        let durable = state(&db, &renewal).await?;
-        assert_eq!(durable.owner(), Some(&alice));
-        assert_eq!(durable.rank().as_u64(), 2);
-        assert_eq!(durable.lease_duration(), Some(Duration::from_secs(9)));
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn first_foreign_observation_cannot_steal() -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let election = setup_election(&db, "foreign_observation", Duration::from_secs(5)).await?;
-        let alice = participant("alice-foreign");
-        let bob = participant("bob-foreign");
-        poll(
-            &db,
-            &election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-
-        let observed = poll(
-            &db,
-            &election,
-            &bob,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        assert!(!observed.result.outcome().is_leader());
-        assert_eq!(
-            observed.result.outcome().transition(),
-            PollTransition::Followed
-        );
-        assert_eq!(
-            observed.result.outcome().lease_duration(),
-            Some(Duration::from_secs(5))
-        );
-        assert!(observed.next_state.observation().is_some());
-
-        let durable = state(&db, &election).await?;
-        assert_eq!(durable.owner(), Some(&alice));
-        assert_eq!(durable.rank().as_u64(), 1);
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn takeover_requires_exact_unchanged_observation_and_persisted_duration()
-    -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let alice_election = setup_election(&db, "takeover", Duration::from_secs(5)).await?;
-        let bob_election = LeaderElection::new(
-            Subspace::all().subspace(&("leader_election_ranked_register", "takeover")),
-            Duration::from_secs(3),
-        )?;
-        let alice = participant("alice-takeover");
-        let bob = participant("bob-takeover");
-        poll(
-            &db,
-            &alice_election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        let observed = poll(
-            &db,
-            &bob_election,
-            &bob,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-
-        let early = poll(
-            &db,
-            &bob_election,
-            &bob,
-            &observed.next_state,
-            Duration::from_secs(4),
-            Duration::from_secs(4),
-        )
-        .await?;
-        assert!(!early.result.outcome().is_leader());
-
-        let takeover = poll(
-            &db,
-            &bob_election,
-            &bob,
-            &early.next_state,
-            Duration::from_secs(5),
-            Duration::from_secs(5),
-        )
-        .await?;
-        assert!(takeover.result.outcome().is_leader());
-        assert_eq!(
-            takeover.result.outcome().transition(),
-            PollTransition::TookOver
-        );
-        assert_eq!(takeover.result.outcome().rank().as_u64(), 2);
-        assert_eq!(
-            leadership(&takeover.next_state).lease_duration(),
-            Duration::from_secs(3)
-        );
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn delayed_read_does_not_age_a_new_observation() -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let election = setup_election(&db, "delayed_observation", Duration::from_secs(5)).await?;
-        let alice = participant("alice-delayed-observation");
-        let bob = participant("bob-delayed-observation");
-        poll(
-            &db,
-            &election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-
-        let observed = poll(
-            &db,
-            &election,
-            &bob,
-            &LocalState::unknown(),
-            Duration::from_secs(1),
-            Duration::from_secs(100),
-        )
-        .await?;
-        assert_eq!(
-            observed
-                .next_state
-                .observation()
-                .expect("follower result carries an observation")
-                .first_observed_at(),
-            Duration::from_secs(100)
-        );
-
-        let early = poll(
-            &db,
-            &election,
-            &bob,
-            &observed.next_state,
-            Duration::from_secs(104),
-            Duration::from_secs(104),
-        )
-        .await?;
-        assert!(!early.result.outcome().is_leader());
-
-        let takeover = poll(
-            &db,
-            &election,
-            &bob,
-            &early.next_state,
-            Duration::from_secs(105),
-            Duration::from_secs(105),
-        )
-        .await?;
-        assert_eq!(
-            takeover.result.outcome().transition(),
-            PollTransition::TookOver
-        );
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn leadership_expires_from_attempt_start_not_later_adoption()
-    -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let election =
-            setup_election(&db, "leadership_attempt_start", Duration::from_secs(5)).await?;
-        let alice = participant("alice-leadership-attempt-start");
-
-        let acquired = poll(
-            &db,
-            &election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::from_secs(100),
-        )
-        .await?;
-        assert_eq!(
-            leadership(&acquired.next_state).last_renewed_at(),
-            Duration::ZERO
-        );
-
-        let expired = poll(
-            &db,
-            &election,
-            &alice,
-            &acquired.next_state,
-            Duration::from_secs(100),
-            Duration::from_secs(100),
-        )
-        .await?;
-        assert!(!expired.result.outcome().is_leader());
-        assert_eq!(
-            expired.result.outcome().transition(),
-            PollTransition::Followed
-        );
-        assert_eq!(expired.result.outcome().owner(), Some(&alice));
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn changed_revision_resets_observation() -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let election = setup_election(&db, "observation_reset", Duration::from_secs(5)).await?;
-        let alice = participant("alice-reset");
-        let bob = participant("bob-reset");
-        let acquired = poll(
-            &db,
-            &election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        let observed = poll(
-            &db,
-            &election,
-            &bob,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        let renewed = poll(
-            &db,
-            &election,
-            &alice,
-            &acquired.next_state,
-            Duration::from_secs(1),
-            Duration::from_secs(1),
-        )
-        .await?;
-        assert_eq!(renewed.result.outcome().rank().as_u64(), 2);
-
-        let reset = poll(
-            &db,
-            &election,
-            &bob,
-            &observed.next_state,
-            Duration::from_secs(10),
-            Duration::from_secs(10),
-        )
-        .await?;
-        assert!(!reset.result.outcome().is_leader());
-        let reset_observation = reset.next_state.observation().expect("observation reset");
-        assert_eq!(reset_observation.rank().as_u64(), 2);
-        assert_eq!(
-            reset_observation.first_observed_at(),
-            Duration::from_secs(10)
-        );
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn shorter_local_duration_honors_incumbent_persisted_duration()
-    -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let alice_election =
-            setup_election(&db, "persisted_duration", Duration::from_secs(10)).await?;
-        let bob_election = LeaderElection::new(
-            Subspace::all().subspace(&("leader_election_ranked_register", "persisted_duration")),
-            Duration::from_secs(1),
-        )?;
-        let alice = participant("alice-duration");
-        let bob = participant("bob-duration");
-        poll(
-            &db,
-            &alice_election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        let observed = poll(
-            &db,
-            &bob_election,
-            &bob,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-
-        let early = poll(
-            &db,
-            &bob_election,
-            &bob,
-            &observed.next_state,
-            Duration::from_secs(1),
-            Duration::from_secs(1),
-        )
-        .await?;
-        assert!(!early.result.outcome().is_leader());
-        assert_eq!(
-            early.result.outcome().lease_duration(),
-            Some(Duration::from_secs(10))
-        );
-
-        let takeover = poll(
-            &db,
-            &bob_election,
-            &bob,
-            &early.next_state,
-            Duration::from_secs(10),
-            Duration::from_secs(10),
-        )
-        .await?;
-        assert_eq!(
-            takeover.result.outcome().transition(),
-            PollTransition::TookOver
-        );
-        assert_eq!(
-            leadership(&takeover.next_state).lease_duration(),
-            Duration::from_secs(1)
-        );
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn expired_same_owner_first_observes_then_reacquires() -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let election = setup_election(&db, "reacquisition", Duration::from_secs(5)).await?;
-        let alice = participant("alice-reacquisition");
-        let acquired = poll(
-            &db,
-            &election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-
-        let expired = poll(
-            &db,
-            &election,
-            &alice,
-            &acquired.next_state,
-            Duration::from_secs(5),
-            Duration::from_secs(5),
-        )
-        .await?;
-        assert!(!expired.result.outcome().is_leader());
-        assert_eq!(
-            expired.result.outcome().transition(),
-            PollTransition::Followed
-        );
-        assert_eq!(expired.result.outcome().owner(), Some(&alice));
-
-        let reacquired = poll(
-            &db,
-            &election,
-            &alice,
-            &expired.next_state,
-            Duration::from_secs(10),
-            Duration::from_secs(10),
-        )
-        .await?;
-        assert!(reacquired.result.outcome().is_leader());
-        assert_eq!(
-            reacquired.result.outcome().transition(),
-            PollTransition::Reacquired
-        );
-        assert_eq!(reacquired.result.outcome().rank().as_u64(), 2);
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn stale_renewal_token_cannot_change_state() -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let election = setup_election(&db, "stale_renewal", Duration::from_secs(5)).await?;
-        let alice = participant("alice-stale-renewal");
-        let acquired = poll(
-            &db,
-            &election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        let renewed = poll(
-            &db,
-            &election,
-            &alice,
-            &acquired.next_state,
-            Duration::from_secs(1),
-            Duration::from_secs(1),
-        )
-        .await?;
-        assert_eq!(renewed.result.outcome().rank().as_u64(), 2);
-
-        let stale = poll(
-            &db,
-            &election,
-            &alice,
-            &acquired.next_state,
-            Duration::from_secs(2),
-            Duration::from_secs(2),
-        )
-        .await?;
-        assert!(!stale.result.outcome().is_leader());
-        assert_eq!(stale.result.outcome().rank().as_u64(), 2);
-        let durable = state(&db, &election).await?;
-        assert_eq!(durable.owner(), Some(&alice));
-        assert_eq!(durable.rank().as_u64(), 2);
-
-        let election_for_resign = election.clone();
-        let renewed_token = leadership(&renewed.next_state);
-        let resigned = db
-            .run(|txn, _| {
-                let election = election_for_resign.clone();
-                let token = renewed_token.clone();
-                async move {
-                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                    Ok::<_, FdbBindingError>(election.resign(&txn, &token).await?)
-                }
-            })
-            .await?;
-        assert_eq!(resigned, ResignOutcome::Resigned);
-
-        let reacquired_from_stale = poll(
-            &db,
-            &election,
-            &alice,
-            &acquired.next_state,
-            Duration::from_secs(3),
-            Duration::from_secs(3),
-        )
-        .await?;
-        assert!(reacquired_from_stale.result.outcome().is_leader());
-        assert_eq!(
-            reacquired_from_stale.result.outcome().transition(),
-            PollTransition::Acquired
-        );
-        assert_eq!(reacquired_from_stale.result.outcome().rank().as_u64(), 3);
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn exact_resignation_preserves_rank_and_duration_and_stale_is_rejected()
-    -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let alice_election = setup_election(&db, "resignation", Duration::from_secs(5)).await?;
-        let bob_election = LeaderElection::new(
-            Subspace::all().subspace(&("leader_election_ranked_register", "resignation")),
-            Duration::from_secs(3),
-        )?;
-        let alice = participant("alice-resignation");
-        let bob = participant("bob-resignation");
-        let acquired = poll(
-            &db,
-            &alice_election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        let alice_token = leadership(&acquired.next_state);
-
-        let election = alice_election.clone();
-        let token = alice_token.clone();
-        let resigned = db
-            .run(|txn, _| {
-                let election = election.clone();
-                let token = token.clone();
-                async move {
-                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                    Ok::<_, FdbBindingError>(election.resign(&txn, &token).await?)
-                }
-            })
-            .await?;
-        assert_eq!(resigned, ResignOutcome::Resigned);
-        let released = state(&db, &alice_election).await?;
-        assert_eq!(released.owner(), None);
-        assert_eq!(released.rank().as_u64(), 1);
-        assert_eq!(released.lease_duration(), Some(Duration::from_secs(5)));
-
-        let _bob_acquired = poll(
-            &db,
-            &bob_election,
-            &bob,
-            &LocalState::unknown(),
-            Duration::from_secs(1),
-            Duration::from_secs(1),
-        )
-        .await?;
-        let stale_election = alice_election.clone();
-        let stale_token = alice_token.clone();
-        let stale = db
-            .run(|txn, _| {
-                let election = stale_election.clone();
-                let token = stale_token.clone();
-                async move {
-                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                    Ok::<_, FdbBindingError>(election.resign(&txn, &token).await?)
-                }
-            })
-            .await?;
-        assert_eq!(stale, ResignOutcome::Rejected);
-        let durable = state(&db, &bob_election).await?;
-        assert_eq!(durable.owner(), Some(&bob));
-        assert_eq!(durable.rank().as_u64(), 2);
-        assert_eq!(durable.lease_duration(), Some(Duration::from_secs(3)));
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn takeover_conflicting_with_resignation_retries_safely() -> Result<(), FdbBindingError> {
-        let db = Arc::new(crate::common::database().await?);
-        let election = setup_election(&db, "resign_conflict", Duration::from_secs(5)).await?;
-        let alice = participant("alice-resign-conflict");
-        let bob = participant("bob-resign-conflict");
-        let acquired = poll(
-            &db,
-            &election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        let observed = poll(
-            &db,
-            &election,
-            &bob,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        let alice_token = leadership(&acquired.next_state);
-
-        let staged = Arc::new(Barrier::new(2));
-        let release = Arc::new(Barrier::new(2));
-        let attempts = Arc::new(AtomicUsize::new(0));
-        let resignation_db = db.clone();
-        let resignation_election = election.clone();
-        let resignation_token = alice_token.clone();
-        let resignation_staged = staged.clone();
-        let resignation_release = release.clone();
-        let resignation_attempts = attempts.clone();
-        let resignation = tokio::spawn(async move {
-            resignation_db
-                .run(|txn, _| {
-                    let election = resignation_election.clone();
-                    let token = resignation_token.clone();
-                    let staged = resignation_staged.clone();
-                    let release = resignation_release.clone();
-                    let first_attempt = resignation_attempts.fetch_add(1, Ordering::SeqCst) == 0;
-                    async move {
-                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                        let outcome = election.resign(&txn, &token).await?;
-                        if first_attempt {
-                            staged.wait().await;
-                            release.wait().await;
-                        }
-                        Ok::<_, FdbBindingError>(outcome)
-                    }
-                })
-                .await
-        });
-
-        staged.wait().await;
-        let takeover = poll(
-            &db,
-            &election,
-            &bob,
-            &observed.next_state,
-            Duration::from_secs(5),
-            Duration::from_secs(5),
-        )
-        .await?;
-        assert_eq!(
-            takeover.result.outcome().transition(),
-            PollTransition::TookOver
-        );
-        release.wait().await;
-
-        assert_eq!(
-            resignation
-                .await
-                .expect("resignation task must not panic")?,
-            ResignOutcome::Rejected
-        );
-        assert!(attempts.load(Ordering::SeqCst) >= 2);
-        let durable = state(&db, &election).await?;
-        assert_eq!(durable.owner(), Some(&bob));
-        assert_eq!(durable.rank().as_u64(), 2);
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn concurrent_unknown_polls_acquire_exactly_once() -> Result<(), FdbBindingError> {
-        let db = Arc::new(crate::common::database().await?);
-        let election = setup_election(&db, "concurrent_unknown", Duration::from_secs(5)).await?;
-        let alice = participant("alice-concurrent-unknown");
-        let bob = participant("bob-concurrent-unknown");
-        let staged = Arc::new(Barrier::new(3));
-        let alice_attempts = Arc::new(AtomicUsize::new(0));
-        let bob_attempts = Arc::new(AtomicUsize::new(0));
-
-        let alice_poll = {
-            let db = db.clone();
-            let election = election.clone();
-            let participant = alice.clone();
-            let staged = staged.clone();
-            let attempts = alice_attempts.clone();
-            tokio::spawn(async move {
-                db.run(|txn, _| {
-                    let election = election.clone();
-                    let participant = participant.clone();
-                    let staged = staged.clone();
-                    let first_attempt = attempts.fetch_add(1, Ordering::SeqCst) == 0;
-                    async move {
-                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                        let result = election
-                            .poll(&txn, &participant, &LocalState::unknown(), Duration::ZERO)
-                            .await?;
-                        if first_attempt {
-                            staged.wait().await;
-                        }
-                        Ok::<_, FdbBindingError>(result)
-                    }
-                })
-                .await
-            })
-        };
-        let bob_poll = {
-            let db = db.clone();
-            let election = election.clone();
-            let participant = bob.clone();
-            let staged = staged.clone();
-            let attempts = bob_attempts.clone();
-            tokio::spawn(async move {
-                db.run(|txn, _| {
-                    let election = election.clone();
-                    let participant = participant.clone();
-                    let staged = staged.clone();
-                    let first_attempt = attempts.fetch_add(1, Ordering::SeqCst) == 0;
-                    async move {
-                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                        let result = election
-                            .poll(&txn, &participant, &LocalState::unknown(), Duration::ZERO)
-                            .await?;
-                        if first_attempt {
-                            staged.wait().await;
-                        }
-                        Ok::<_, FdbBindingError>(result)
-                    }
-                })
-                .await
-            })
-        };
-
-        staged.wait().await;
-        let alice_result = alice_poll.await.expect("alice task must not panic")?;
-        let bob_result = bob_poll.await.expect("bob task must not panic")?;
-        let acquired = [(&alice, &alice_result), (&bob, &bob_result)]
-            .into_iter()
-            .find_map(|(participant, result)| {
-                (result.outcome().transition() == PollTransition::Acquired).then_some(participant)
-            })
-            .expect("one concurrent unknown poll must acquire");
-
-        assert_eq!(
-            [alice_result.outcome(), bob_result.outcome()]
-                .into_iter()
-                .filter(|outcome| outcome.transition() == PollTransition::Acquired)
-                .count(),
-            1
-        );
-        assert_eq!(
-            [alice_result.outcome(), bob_result.outcome()]
-                .into_iter()
-                .filter(|outcome| outcome.transition() == PollTransition::Followed)
-                .count(),
-            1
-        );
-        assert!(
-            alice_attempts.load(Ordering::SeqCst) >= 2 || bob_attempts.load(Ordering::SeqCst) >= 2,
-            "one conflicting poll must retry"
-        );
-        let durable = state(&db, &election).await?;
-        assert_eq!(durable.owner(), Some(acquired));
-        assert_eq!(durable.rank().as_u64(), 1);
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn retried_poll_adopts_only_committed_attempt_result() -> Result<(), FdbBindingError> {
-        let db = Arc::new(crate::common::database().await?);
-        let election = setup_election(&db, "retry_adoption", Duration::from_secs(5)).await?;
-        let alice = participant("alice-retry-adoption");
-        let bob = participant("bob-retry-adoption");
-        let acquired = poll(
-            &db,
-            &election,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-        let staged = Arc::new(Barrier::new(2));
-        let release = Arc::new(Barrier::new(2));
-        let attempts = Arc::new(AtomicUsize::new(0));
-        let time = TestTime::new(Duration::ZERO);
-        let bob_poll = {
-            let db = db.clone();
-            let election = election.clone();
-            let participant = bob.clone();
-            let staged = staged.clone();
-            let release = release.clone();
-            let attempts = attempts.clone();
-            let time = time.clone();
-            tokio::spawn(async move {
-                db.run(|txn, _| {
-                    let election = election.clone();
-                    let participant = participant.clone();
-                    let staged = staged.clone();
-                    let release = release.clone();
-                    let first_attempt = attempts.fetch_add(1, Ordering::SeqCst) == 0;
-                    let time = time.clone();
-                    async move {
-                        txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                        let result = election
-                            .poll(&txn, &participant, &LocalState::unknown(), time.monotonic())
-                            .await?;
-                        // A read-only transaction does not conflict-check its election read at
-                        // commit. This isolated marker makes the staged attempt a write
-                        // transaction, so Alice's renewal deterministically forces its retry.
-                        txn.set(
-                            b"leader_election_ranked_register/retry_adoption_marker",
-                            b"",
-                        );
-                        if first_attempt {
-                            staged.wait().await;
-                            release.wait().await;
-                        }
-                        Ok::<_, FdbBindingError>(result)
-                    }
-                })
-                .await
-            })
-        };
-
-        staged.wait().await;
-        let renewed = poll(
-            &db,
-            &election,
-            &alice,
-            &acquired.next_state,
-            Duration::from_secs(1),
-            Duration::from_secs(1),
-        )
-        .await?;
-        assert_eq!(renewed.result.outcome().rank().as_u64(), 2);
-        time.set(Duration::from_secs(10));
-        release.wait().await;
-
-        let result = bob_poll.await.expect("bob task must not panic")?;
-        assert!(attempts.load(Ordering::SeqCst) >= 2);
-        assert_eq!(result.outcome().transition(), PollTransition::Followed);
-        assert_eq!(result.outcome().rank().as_u64(), 2);
-        let next_state = result.into_next_state(time.monotonic());
-        let observation = next_state
-            .observation()
-            .expect("the committed retry must produce an observation");
-        assert_eq!(observation.rank().as_u64(), 2);
-        assert_eq!(observation.first_observed_at(), Duration::from_secs(10));
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn leader_poll_fences_ranked_register_and_stale_rank_is_rejected()
-    -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let alice_election = setup_election(&db, "ranked_register", Duration::from_secs(5)).await?;
-        let bob_election = LeaderElection::new(
-            Subspace::all().subspace(&("leader_election_ranked_register", "ranked_register")),
-            Duration::from_secs(5),
-        )?;
-        let register = setup_register(&db, "ranked_register").await?;
-        let alice = participant("alice-register");
-        let bob = participant("bob-register");
-
-        let (first, first_write) = service_poll(
-            &db,
-            &alice_election,
-            &register,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-            b"alice",
-        )
-        .await?;
-        assert_eq!(
-            first.result.outcome().transition(),
-            PollTransition::Acquired
-        );
-        assert_eq!(first_write, Some(WriteResult::Committed));
-        let observed = poll(
-            &db,
-            &bob_election,
-            &bob,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-        )
-        .await?;
-
-        let (takeover, takeover_write) = service_poll(
-            &db,
-            &bob_election,
-            &register,
-            &bob,
-            &observed.next_state,
-            Duration::from_secs(5),
-            Duration::from_secs(5),
-            b"bob",
-        )
-        .await?;
-        assert_eq!(
-            takeover.result.outcome().transition(),
-            PollTransition::TookOver
-        );
-        assert_eq!(takeover_write, Some(WriteResult::Committed));
-        assert!(takeover.result.outcome().rank() > first.result.outcome().rank());
-
-        let stale_rank = first.result.outcome().rank();
-        let register_ref = register.clone();
-        let stale_write = db
-            .run(|txn, _| {
-                let register = register_ref.clone();
-                async move {
-                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                    register
-                        .write(&txn, stale_rank, b"stale")
-                        .await
-                        .map_err(register_error)
-                }
-            })
-            .await?;
-        assert_eq!(stale_write, WriteResult::Aborted);
-
-        let register_ref = register.clone();
-        let current_rank = takeover.result.outcome().rank();
-        let (write_rank, value) = db
-            .run(|txn, _| {
-                let register = register_ref.clone();
-                async move {
-                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                    let read = register
-                        .read(&txn, current_rank)
-                        .await
-                        .map_err(register_error)?;
-                    Ok::<_, FdbBindingError>((read.write_rank(), read.into_value()))
-                }
-            })
-            .await?;
-        assert_eq!(write_rank, current_rank);
-        assert_eq!(value.as_deref(), Some(b"bob".as_slice()));
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn same_participant_renewal_self_fences_old_rank_writes() -> Result<(), FdbBindingError> {
-        let db = crate::common::database().await?;
-        let election = setup_election(&db, "self_fencing", Duration::from_secs(5)).await?;
-        let register = setup_register(&db, "self_fencing").await?;
-        let alice = participant("alice-self-fencing");
-
-        let (acquired, acquired_write) = service_poll(
-            &db,
-            &election,
-            &register,
-            &alice,
-            &LocalState::unknown(),
-            Duration::ZERO,
-            Duration::ZERO,
-            b"rank-one",
-        )
-        .await?;
-        assert_eq!(
-            acquired.result.outcome().transition(),
-            PollTransition::Acquired
-        );
-        assert_eq!(acquired_write, Some(WriteResult::Committed));
-
-        let (renewed, renewed_write) = service_poll(
-            &db,
-            &election,
-            &register,
-            &alice,
-            &acquired.next_state,
-            Duration::from_secs(1),
-            Duration::from_secs(1),
-            b"rank-two",
-        )
-        .await?;
-        assert_eq!(
-            renewed.result.outcome().transition(),
-            PollTransition::Renewed
-        );
-        assert_eq!(renewed_write, Some(WriteResult::Committed));
-        assert_eq!(renewed.result.outcome().rank().as_u64(), 2);
-
-        let stale_rank = acquired.result.outcome().rank();
-        let register_ref = register.clone();
-        let stale_write = db
-            .run(|txn, _| {
-                let register = register_ref.clone();
-                async move {
-                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                    register
-                        .write(&txn, stale_rank, b"stale")
-                        .await
-                        .map_err(register_error)
-                }
-            })
-            .await?;
-        assert_eq!(stale_write, WriteResult::Aborted);
-
-        let register_ref = register.clone();
-        let current_rank = renewed.result.outcome().rank();
-        let (write_rank, value) = db
-            .run(|txn, _| {
-                let register = register_ref.clone();
-                async move {
-                    txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                    let read = register
-                        .read(&txn, current_rank)
-                        .await
-                        .map_err(register_error)?;
-                    Ok::<_, FdbBindingError>((read.write_rank(), read.into_value()))
-                }
-            })
-            .await?;
-        assert_eq!(write_rank, current_rank);
-        assert_eq!(value.as_deref(), Some(b"rank-two".as_slice()));
-        Ok(())
-    }
-}
diff --git a/bindings/rust/foundationdb/tests/metrics.rs b/bindings/rust/foundationdb/tests/metrics.rs
deleted file mode 100644
index e5b51e604f6..00000000000
--- a/bindings/rust/foundationdb/tests/metrics.rs
+++ /dev/null
@@ -1,639 +0,0 @@
-use foundationdb::metrics::{AttemptOutcome, MetricKey, TransactionMetrics};
-use foundationdb::runner::{MetricsHooks, RunnerHooks};
-use foundationdb::*;
-mod common;
-use std::borrow::Cow;
-use std::sync::{Arc, Mutex};
-
-/// Tests a successful transaction using `instrumented_run`.
-///
-/// A run without retry reports exactly one attempt, holding the operations of
-/// the transaction and ending as committed.
-#[tokio::test]
-async fn instrumented_run_success() -> FdbResult<()> {
-    const KEY: &[u8] = b"test_metrics_success";
-    const VALUE: &[u8] = b"value";
-    const SUCCESS: u64 = 42;
-
-    let db = common::database().await?;
-
-    let (result, metrics) = db
-        .instrumented_run(|txn, _| async move {
-            txn.set(KEY, VALUE);
-            Ok::<_, FdbBindingError>(SUCCESS)
-        })
-        .await
-        .expect("transaction should succeed");
-
-    assert_eq!(result, SUCCESS);
-
-    assert_eq!(metrics.attempts.len(), 1);
-    let attempt = &metrics.attempts[0];
-    assert_eq!(attempt.index, 0);
-    assert_eq!(attempt.usage.call_set, 1);
-    assert_eq!(
-        attempt.usage.bytes_written,
-        (KEY.len() + VALUE.len()) as u64
-    );
-    assert!(matches!(attempt.outcome, AttemptOutcome::Committed));
-    assert!(attempt.commit_duration.is_some());
-    assert!(attempt.grv_duration.is_none());
-    assert!(attempt.on_error_duration.is_none());
-
-    let total = metrics.total_usage();
-    assert_eq!(total.call_set, 1);
-    assert_eq!(total.bytes_written, (KEY.len() + VALUE.len()) as u64);
-
-    assert_eq!(metrics.transaction.retries, 0);
-    assert!(metrics.total_duration.is_some());
-
-    Ok(())
-}
-
-/// Tests the retry mechanism of `instrumented_run`.
-///
-/// A forced retryable error gives one attempt per try: every attempt keeps its
-/// own counters and custom metrics instead of being wiped by the next one, and
-/// only the last one is committed.
-#[tokio::test]
-async fn instrumented_run_with_n_retries() -> FdbResult<()> {
-    const KEY: &[u8] = b"test_metrics_retry";
-    const VALUE: &[u8] = b"value";
-    const SUCCESS: u64 = 42;
-
-    // Number of retries we want to force
-    const EXPECTED_RETRIES: u64 = 3;
-
-    let db = common::database().await?;
-
-    // Use Arc<Mutex<>> to share and modify the counter across async calls
-    let attempt_counter = Arc::new(Mutex::new(0u64));
-
-    let (result, metrics) = db
-        .instrumented_run(|txn, _| {
-            let counter = attempt_counter.clone();
-            async move {
-                // Set a key to verify metrics
-                txn.set(KEY, VALUE);
-
-                // Increment the counter and check if we should still fail
-                let mut attempts = counter.lock().unwrap();
-                *attempts += 1;
-
-                // Each attempt tags itself, so a wiped attempt would show up.
-                txn.set_custom_metric("attempt_number", *attempts, &[("kind", "forced")]);
-
-                if *attempts <= EXPECTED_RETRIES {
-                    // Return a retryable error (not_committed) for the first N attempts
-                    Err(FdbBindingError::from(FdbError::from_code(1020)))
-                } else {
-                    // Succeed on attempt N+1
-                    Ok(SUCCESS)
-                }
-            }
-        })
-        .await
-        .expect("transaction should succeed after retries");
-
-    assert_eq!(result, SUCCESS);
-
-    // One attempt per try, nothing lost across the retries.
-    assert_eq!(metrics.attempts.len(), EXPECTED_RETRIES as usize + 1);
-    assert_eq!(metrics.transaction.retries, EXPECTED_RETRIES);
-
-    let custom_key = MetricKey::new("attempt_number", &[("kind", "forced")]);
-    for (index, attempt) in metrics.attempts.iter().enumerate() {
-        assert_eq!(attempt.index, index);
-
-        // The per-attempt usage is retained, not wiped by the following attempt.
-        assert_eq!(attempt.usage.call_set, 1, "attempt {index}");
-        assert_eq!(
-            attempt.usage.bytes_written,
-            (KEY.len() + VALUE.len()) as u64,
-            "attempt {index}"
-        );
-        assert_eq!(
-            attempt.custom_metrics.get(&custom_key).copied(),
-            Some(index as u64 + 1),
-            "attempt {index}"
-        );
-
-        let is_last = index == EXPECTED_RETRIES as usize;
-        match (&attempt.outcome, is_last) {
-            (AttemptOutcome::Committed, true) => {}
-            (AttemptOutcome::Retried { cause }, false) => {
-                assert_eq!(cause.code(), 1020, "attempt {index}");
-                assert!(
-                    attempt.on_error_duration.is_some(),
-                    "attempt {index} went through on_error"
-                );
-            }
-            (outcome, _) => panic!("unexpected outcome for attempt {index}: {outcome:?}"),
-        }
-    }
-
-    // Totals are the sum of the attempts.
-    let total = metrics.total_usage();
-    assert_eq!(total.call_set, EXPECTED_RETRIES + 1);
-    assert_eq!(
-        total.bytes_written,
-        (EXPECTED_RETRIES + 1) * (KEY.len() + VALUE.len()) as u64
-    );
-
-    // Verify the counter
-    let final_attempts = *attempt_counter.lock().unwrap();
-    assert_eq!(final_attempts, EXPECTED_RETRIES + 1);
-
-    Ok(())
-}
-
-/// Performs a comprehensive test of all counter metrics.
-///
-/// This test executes a single transaction that performs a variety of operations:
-/// - Multiple `SET` operations
-/// - A `GET` operation
-/// - A `GET_RANGE` operation
-/// - `CLEAR` and `CLEAR_RANGE` operations
-/// - An `ATOMIC_OP`
-///
-/// It then performs precise assertions on all relevant counter metrics, including
-/// operation counts, exact bytes written, and exact bytes read, ensuring they are
-/// all tracked correctly within a single attempt.
-#[tokio::test]
-async fn test_counter_metrics() -> FdbResult<()> {
-    let db = common::database().await?;
-
-    const PREFIX: &[u8] = b"test_counter_metrics_";
-    const SET_OPS: usize = 3;
-    let mut bytes_written: u64 = 0;
-    for i in 0..SET_OPS {
-        let key = format!("{}_key{}", std::str::from_utf8(PREFIX).unwrap(), i);
-        let value = format!("value{}", i);
-        bytes_written += (key.len() + value.len()) as u64;
-    }
-    // clear, clear_range and atomic_op of the closure below.
-    let clear_key = format!("{}_key2", std::str::from_utf8(PREFIX).unwrap());
-    let clear_range_begin = format!("{}_key1", std::str::from_utf8(PREFIX).unwrap());
-    let clear_range_end = format!("{}_key3", std::str::from_utf8(PREFIX).unwrap());
-    let atomic_key = format!("{}_atomic", std::str::from_utf8(PREFIX).unwrap());
-    bytes_written +=
-        (clear_key.len() + clear_range_begin.len() + clear_range_end.len() + atomic_key.len() + 8)
-            as u64;
-
-    let ((fetched_count, bytes_read), metrics) = match db
-        .instrumented_run(|txn, _| {
-            async move {
-                // 1. SET operations
-                for i in 0..SET_OPS {
-                    let key = format!("{}_key{}", std::str::from_utf8(PREFIX).unwrap(), i);
-                    let value = format!("value{}", i);
-                    txn.set(key.as_bytes(), value.as_bytes());
-                }
-
-                // 2. GET operation
-                let get_key = format!("{}_key1", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
-                let mut bytes_read_acc = 0;
-                if let Some(value_slice) = txn.get(&get_key, false).await? {
-                    bytes_read_acc += (get_key.len() + value_slice.len()) as u64;
-                }
-                let get_count = 1;
-
-                // 3. GET_RANGE operation
-                let range_begin =
-                    format!("{}_key", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
-                let range_end =
-                    format!("{}_key4", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
-                let range_option = RangeOption {
-                    begin: KeySelector::first_greater_or_equal(Cow::from(range_begin)),
-                    end: KeySelector::first_greater_or_equal(Cow::from(range_end)),
-                    limit: Some(100),
-                    ..Default::default()
-                };
-                let range_result = txn.get_range(&range_option, 1, false).await?;
-                for kv in range_result.iter() {
-                    bytes_read_acc += (kv.key().len() + kv.value().len()) as u64;
-                }
-
-                let range_count = range_result.len();
-
-                // 4. CLEAR operation
-                let clear_key =
-                    format!("{}_key2", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
-                txn.clear(&clear_key);
-
-                // 5. CLEAR_RANGE operation
-                let clear_range_begin =
-                    format!("{}_key1", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
-                let clear_range_end =
-                    format!("{}_key3", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
-                txn.clear_range(&clear_range_begin[..], &clear_range_end[..]);
-
-                // 6. ATOMIC operation (add)
-                let atomic_key =
-                    format!("{}_atomic", std::str::from_utf8(PREFIX).unwrap()).into_bytes();
-                txn.atomic_op(
-                    &atomic_key,
-                    &[1, 0, 0, 0, 0, 0, 0, 0],
-                    options::MutationType::Add,
-                );
-
-                Ok((get_count + range_count, bytes_read_acc))
-            }
-        })
-        .await
-    {
-        Ok(val) => val,
-        Err((err, _)) => match err {
-            FdbBindingError::NonRetryableFdbError(fdb_err) => return Err(fdb_err),
-            _ => panic!("Test failed with unexpected error type: {:?}", err),
-        },
-    };
-
-    // A single attempt: its usage is the whole story.
-    assert_eq!(metrics.attempts.len(), 1);
-    let usage = metrics.attempts[0].usage;
-
-    assert_eq!(
-        usage.call_set, SET_OPS as u64,
-        "Should have {} SET operations",
-        SET_OPS
-    );
-    assert_eq!(usage.call_get, 1, "Should have 1 GET operation");
-    assert_eq!(usage.call_get_range, 1, "Should have 1 GET_RANGE operation");
-
-    // Verify the number of key-values fetched matches our result count
-    assert_eq!(
-        usage.keys_values_fetched, fetched_count as u64,
-        "Should have fetched {} key-values",
-        fetched_count
-    );
-
-    assert_eq!(
-        usage.bytes_written, bytes_written,
-        "Should have written {} bytes",
-        bytes_written
-    );
-    assert_eq!(
-        usage.bytes_read, bytes_read,
-        "Should have read {} bytes",
-        bytes_read
-    );
-
-    assert_eq!(usage.call_clear, 1, "Should have 1 CLEAR operation");
-    assert_eq!(
-        usage.call_clear_range, 1,
-        "Should have 1 CLEAR_RANGE operation"
-    );
-    assert_eq!(usage.call_atomic_op, 1, "Should have 1 ATOMIC operation");
-
-    // Without a retry, the totals are that single attempt.
-    let total = metrics.total_usage();
-    assert_eq!(total.call_set, usage.call_set);
-    assert_eq!(total.call_get, usage.call_get);
-    assert_eq!(total.keys_values_fetched, usage.keys_values_fetched);
-    assert_eq!(total.bytes_read, usage.bytes_read);
-    assert_eq!(total.bytes_written, usage.bytes_written);
-    assert_eq!(total.call_clear, usage.call_clear);
-    assert_eq!(total.call_clear_range, usage.call_clear_range);
-    assert_eq!(total.call_atomic_op, usage.call_atomic_op);
-
-    // Verify transaction info
-    assert_eq!(metrics.transaction.retries, 0, "Should have no retries");
-    assert!(
-        metrics.transaction.commit_version.is_some(),
-        "Should have a commit version"
-    );
-
-    Ok(())
-}
-
-/// Tests the `TransactionInfo` fields within the metrics report.
-#[tokio::test]
-async fn test_transaction_info() -> FdbResult<()> {
-    let db = common::database().await?;
-
-    // read_version: recorded when the user asks for it, on the attempt and on
-    // the transaction information.
-    {
-        let metrics = TransactionMetrics::new();
-        let hooks = MetricsHooks::new(&metrics);
-
-        let read_version = db
-            .run_with_hooks(&hooks, |txn, _| {
-                let metrics = metrics.clone();
-                async move {
-                    let read_version = txn.get_read_version().await?;
-                    // Visible on the transaction information as soon as it is
-                    // read, without waiting for the run to end.
-                    assert_eq!(
-                        metrics.get_transaction_info().read_version,
-                        Some(read_version)
-                    );
-                    let again = txn.get_read_version().await?;
-                    assert_eq!(again, read_version);
-                    Ok::<_, FdbBindingError>(read_version)
-                }
-            })
-            .await
-            .expect("transaction should succeed");
-
-        let report = metrics.get_metrics_data();
-        assert_eq!(report.attempts.len(), 1);
-        assert_eq!(report.attempts[0].read_version, Some(read_version));
-        assert!(report.attempts[0].grv_duration.is_some());
-    }
-
-    // commit_version
-    {
-        let (_result, metrics) = db
-            .instrumented_run(|txn, _| async move {
-                txn.set(b"test_commit_version", b"value");
-                Ok::<_, FdbBindingError>(())
-            })
-            .await
-            .expect("Transaction failed");
-
-        assert!(metrics.transaction.commit_version.is_some());
-        // Not asked for, not fetched.
-        assert!(metrics.transaction.read_version.is_none());
-        assert!(metrics.attempts[0].grv_duration.is_none());
-    }
-
-    // retries
-    {
-        const EXPECTED_RETRIES: u64 = 2;
-
-        let attempt_counter = Arc::new(Mutex::new(0u64));
-
-        let (_, metrics) = db
-            .instrumented_run(|_txn, _| {
-                let counter = attempt_counter.clone();
-                async move {
-                    let mut attempts = counter.lock().unwrap();
-                    *attempts += 1;
-
-                    if *attempts <= EXPECTED_RETRIES {
-                        Err(FdbBindingError::from(FdbError::from_code(1020)))
-                    } else {
-                        Ok(())
-                    }
-                }
-            })
-            .await
-            .expect("Transaction should have succeeded after retries");
-
-        assert_eq!(metrics.transaction.retries, EXPECTED_RETRIES);
-        assert_eq!(metrics.attempts.len(), EXPECTED_RETRIES as usize + 1);
-    }
-
-    Ok(())
-}
-
-/// Completed native GRVs can be polled after the transaction has entered a new
-/// attempt. Their results remain usable, but must not populate its metrics.
-#[tokio::test]
-async fn retained_grv_does_not_record_into_a_later_attempt() -> FdbResult<()> {
-    let db = common::database().await?;
-
-    for retry in [false, true] {
-        let metrics = TransactionMetrics::new();
-        let hooks = MetricsHooks::new(&metrics);
-        let mut txn = db.create_trx()?;
-        hooks.on_attempt_start(&txn, 0);
-
-        let retained = txn.get_read_version();
-        // Both calls share the transaction's read version. Awaiting the second
-        // makes the first native result ready without polling its Rust wrapper.
-        let original_version = txn.get_read_version().await?;
-
-        if retry {
-            txn = txn.on_error(FdbError::from_code(1020)).await?;
-        } else {
-            txn.reset();
-        }
-        assert_eq!(retained.await?, original_version);
-        txn.commit().await.expect("empty attempt should commit");
-
-        let report = metrics.get_metrics_data();
-        assert_eq!(report.attempts.len(), if retry { 2 } else { 1 });
-        let current = report.last_attempt().expect("the new attempt was recorded");
-        assert!(current.grv_duration.is_none());
-        assert!(current.read_version.is_none());
-        assert_eq!(report.transaction.read_version, Some(original_version));
-    }
-
-    Ok(())
-}
-
-/// Setting a client budget mid-attempt starts a fresh accounting generation,
-/// and the attempt being recorded goes with it: only what happens after the call
-/// is reported.
-#[tokio::test]
-async fn set_client_budget_mid_attempt_drops_what_was_recorded() -> FdbResult<()> {
-    const KEY: &[u8] = b"test_metrics_budget_mid_attempt";
-    const VALUE: &[u8] = b"value";
-
-    let db = common::database().await?;
-
-    let (_, metrics) = db
-        .instrumented_run(|txn, _| async move {
-            txn.set(b"test_metrics_budget_before", VALUE);
-            txn.set_custom_metric("before_budget", 1, &[]);
-
-            txn.set_client_budget(ClientBudget::default());
-
-            txn.set(KEY, VALUE);
-            txn.set_custom_metric("after_budget", 1, &[]);
-            Ok::<_, FdbBindingError>(())
-        })
-        .await
-        .expect("transaction should succeed");
-
-    assert_eq!(metrics.attempts.len(), 1);
-    let attempt = &metrics.attempts[0];
-
-    // The write itself did happen, only its accounting was dropped.
-    assert_eq!(attempt.usage.call_set, 1);
-    assert_eq!(
-        attempt.usage.bytes_written,
-        (KEY.len() + VALUE.len()) as u64
-    );
-
-    assert!(
-        attempt
-            .custom_metrics
-            .contains_key(&MetricKey::new("after_budget", &[]))
-    );
-    assert!(
-        !attempt
-            .custom_metrics
-            .contains_key(&MetricKey::new("before_budget", &[]))
-    );
-
-    Ok(())
-}
-
-/// A run that never commits reports its last attempt as failed.
-#[tokio::test]
-async fn instrumented_run_failure_reports_the_last_attempt() -> FdbResult<()> {
-    let db = common::database().await?;
-
-    #[derive(Debug)]
-    struct Fatal;
-    impl std::fmt::Display for Fatal {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "fatal")
-        }
-    }
-    impl std::error::Error for Fatal {}
-
-    let (_err, metrics) = db
-        .instrumented_run(|txn, _| async move {
-            txn.set(b"test_metrics_failure", b"value");
-            // A custom error with no FdbError underneath is not retryable.
-            Err::<(), _>(FdbBindingError::new_custom_error(Box::new(Fatal)))
-        })
-        .await
-        .expect_err("transaction should fail");
-
-    assert_eq!(metrics.attempts.len(), 1);
-    let attempt = &metrics.attempts[0];
-    assert!(matches!(attempt.outcome, AttemptOutcome::Failed));
-    assert_eq!(attempt.usage.call_set, 1);
-    assert!(attempt.commit_duration.is_none(), "commit never ran");
-    assert_eq!(metrics.transaction.retries, 0);
-
-    Ok(())
-}
-
-/// Exhausting the retry limit consumes the transaction inside `on_error`: the
-/// attempt it was running must still be reported.
-#[tokio::test]
-async fn instrumented_run_reports_the_attempt_that_exhausted_the_retries() -> FdbResult<()> {
-    let db = common::database().await?;
-
-    let (_err, metrics) = db
-        .instrumented_run(|txn, _| async move {
-            txn.set_option(options::TransactionOption::RetryLimit(0))?;
-            txn.set(b"test_metrics_retry_limit", b"value");
-            Err::<(), _>(FdbBindingError::from(FdbError::from_code(1020)))
-        })
-        .await
-        .expect_err("the retry limit should be reached");
-
-    assert_eq!(metrics.attempts.len(), 1);
-    let attempt = &metrics.attempts[0];
-    assert!(matches!(attempt.outcome, AttemptOutcome::Failed));
-    assert_eq!(attempt.usage.call_set, 1);
-    assert_eq!(metrics.transaction.retries, 0);
-
-    Ok(())
-}
-
-/// Tests that the timings of the attempts are recorded.
-#[tokio::test]
-async fn test_time_metrics() -> FdbResult<()> {
-    let db = common::database().await?;
-
-    // A committed attempt has a duration and a commit duration, and never went
-    // through on_error.
-    {
-        let (_result, metrics) = db
-            .instrumented_run(|txn, _| async move {
-                for i in 0..10 {
-                    let key = format!("test_time_metrics_{}", i).into_bytes();
-                    txn.set(&key, b"value");
-                }
-                let _ = txn.get(b"test_time_metrics_0", false).await?;
-                Ok::<_, FdbBindingError>(())
-            })
-            .await
-            .expect("Transaction failed");
-
-        assert_eq!(metrics.attempts.len(), 1);
-        let attempt = &metrics.attempts[0];
-        assert!(attempt.duration.is_some(), "attempt duration");
-        assert!(attempt.commit_duration.is_some(), "commit duration");
-        assert!(
-            attempt.grv_duration.is_none(),
-            "get_read_version was not called"
-        );
-        assert!(attempt.on_error_duration.is_none(), "on_error did not run");
-        assert!(metrics.total_duration >= attempt.duration);
-    }
-
-    // A retried attempt has its on_error duration recorded, and its own
-    // duration excludes the retry backoff.
-    {
-        let attempt_counter = Arc::new(Mutex::new(0u64));
-        let (_, metrics) = db
-            .instrumented_run(|_txn, _| {
-                let counter = attempt_counter.clone();
-                async move {
-                    let mut attempts = counter.lock().unwrap();
-                    *attempts += 1;
-
-                    if *attempts == 1 {
-                        Err(FdbBindingError::from(FdbError::from_code(1020)))
-                    } else {
-                        Ok(())
-                    }
-                }
-            })
-            .await
-            .expect("Transaction should have succeeded after retry");
-
-        assert_eq!(metrics.attempts.len(), 2);
-        assert!(
-            metrics.attempts[0].on_error_duration.is_some(),
-            "Error handling time should be recorded"
-        );
-        assert!(metrics.attempts[1].on_error_duration.is_none());
-    }
-
-    Ok(())
-}
-
-/// Custom metrics recorded on the transaction are reported per attempt, and are
-/// infallible: an uninstrumented transaction simply drops them.
-#[tokio::test]
-async fn test_transaction_custom_metrics() -> Result<(), FdbBindingError> {
-    let db = common::database().await?;
-
-    // No metrics consumer: recording is a no-op, not an error.
-    let txn = db.create_trx()?;
-    txn.set_custom_metric("dropped", 1, &[]);
-    txn.increment_custom_metric("dropped", 1, &[]);
-    drop(txn);
-
-    let (_, metrics) = db
-        .instrumented_run(|txn, _| async move {
-            txn.set_custom_metric("txn_counter", 100, &[("operation", "read")]);
-            txn.set_custom_metric("txn_timer", 200, &[("component", "storage")]);
-
-            txn.increment_custom_metric("txn_incremented", 10, &[("type", "query")]);
-            txn.increment_custom_metric("txn_incremented", 15, &[("type", "query")]);
-
-            // Read a value to make sure the transaction does something
-            let _value = txn.get(b"test_key", false).await?;
-
-            Ok::<_, FdbBindingError>(())
-        })
-        .await
-        .map_err(|(err, _)| err)?;
-
-    assert_eq!(metrics.attempts.len(), 1);
-    let custom = &metrics.attempts[0].custom_metrics;
-
-    let key = MetricKey::new("txn_counter", &[("operation", "read")]);
-    assert_eq!(custom.get(&key).copied(), Some(100));
-
-    let key = MetricKey::new("txn_timer", &[("component", "storage")]);
-    assert_eq!(custom.get(&key).copied(), Some(200));
-
-    // Increments accumulate within the attempt.
-    let key = MetricKey::new("txn_incremented", &[("type", "query")]);
-    assert_eq!(custom.get(&key).copied(), Some(25));
-
-    Ok(())
-}
diff --git a/bindings/rust/foundationdb/tests/ranked_register.rs b/bindings/rust/foundationdb/tests/ranked_register.rs
deleted file mode 100644
index 66967f07078..00000000000
--- a/bindings/rust/foundationdb/tests/ranked_register.rs
+++ /dev/null
@@ -1,507 +0,0 @@
-// Copyright 2024 foundationdb-rs developers
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-mod common;
-
-#[cfg(feature = "recipes-ranked-register")]
-mod ranked_register_tests {
-    use std::sync::atomic::{AtomicU8, Ordering};
-
-    use foundationdb::{
-        Database, FdbBindingError, FdbError, RetryDecision, RetryableError,
-        options::TransactionOption,
-        recipes::ranked_register::{
-            MAX_VALUE_CHUNK_BYTES, Rank, RankedRegister, RankedRegisterError, WriteResult,
-        },
-        tuple::Subspace,
-    };
-
-    // RankedRegisterError implements RetryableError, so closures return it
-    // directly with plain `?` and the retry loop still recognizes wrapped
-    // FdbErrors through the source chain.
-
-    async fn setup_test(
-        db: &Database,
-        test_name: &str,
-    ) -> Result<RankedRegister, RankedRegisterError> {
-        let subspace = Subspace::all().subspace(&test_name);
-        let (from, to) = subspace.range();
-
-        let from_ref = &from;
-        let to_ref = &to;
-        db.run(|txn, _| async move {
-            txn.clear_range(from_ref, to_ref);
-            Ok::<_, RankedRegisterError>(())
-        })
-        .await?;
-
-        Ok(RankedRegister::new(subspace))
-    }
-
-    #[tokio::test]
-    async fn test_basic_write_and_read() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_basic_write_and_read").await?;
-
-        // Write with rank 1
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.write(&txn, Rank::from(1u64), b"hello").await?;
-                Ok::<_, RankedRegisterError>(r)
-            })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        // Read with rank 2 should return the value
-        let rr_ref = &rr;
-        let read_result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.read(&txn, Rank::from(2u64)).await?;
-                Ok::<_, RankedRegisterError>((r.write_rank(), r.into_value()))
-            })
-            .await?;
-        assert_eq!(read_result.0, Rank::from(1u64));
-        assert_eq!(read_result.1.as_deref(), Some(b"hello".as_slice()));
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_rank_fencing() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_rank_fencing").await?;
-
-        // Read with rank 10 installs a fence
-        let rr_ref = &rr;
-        db.run(|txn, _| async move {
-            rr_ref.read(&txn, Rank::from(10u64)).await?;
-            Ok::<_, RankedRegisterError>(())
-        })
-        .await?;
-
-        // Write with rank 5 should be aborted (below the fence)
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.write(&txn, Rank::from(5u64), b"blocked").await?;
-                Ok::<_, RankedRegisterError>(r)
-            })
-            .await?;
-        assert_eq!(result, WriteResult::Aborted);
-
-        // Write with rank 10 should succeed (equal to fence)
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.write(&txn, Rank::from(10u64), b"accepted").await?;
-                Ok::<_, RankedRegisterError>(r)
-            })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_write_ordering() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_write_ordering").await?;
-
-        // Write rank 1 value "A"
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.write(&txn, Rank::from(1u64), b"A").await?;
-                Ok::<_, RankedRegisterError>(r)
-            })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        // Write rank 2 value "B"
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.write(&txn, Rank::from(2u64), b"B").await?;
-                Ok::<_, RankedRegisterError>(r)
-            })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        // Read should return "B"
-        let rr_ref = &rr;
-        let read_result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.read(&txn, Rank::from(3u64)).await?;
-                Ok::<_, RankedRegisterError>(r.into_value())
-            })
-            .await?;
-        assert_eq!(read_result.as_deref(), Some(b"B".as_slice()));
-
-        // Write rank 1 value "C" should be aborted (max_write_rank is 2)
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.write(&txn, Rank::from(1u64), b"C").await?;
-                Ok::<_, RankedRegisterError>(r)
-            })
-            .await?;
-        assert_eq!(result, WriteResult::Aborted);
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_stale_write_rejected() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_stale_write_rejected").await?;
-
-        // Write with rank 5
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.write(&txn, Rank::from(5u64), b"initial").await?;
-                Ok::<_, RankedRegisterError>(r)
-            })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        // Read with rank 10 installs fence
-        let rr_ref = &rr;
-        db.run(|txn, _| async move {
-            rr_ref.read(&txn, Rank::from(10u64)).await?;
-            Ok::<_, RankedRegisterError>(())
-        })
-        .await?;
-
-        // Write with rank 7 should be aborted even though 7 > 5,
-        // because max_read_rank is 10
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.write(&txn, Rank::from(7u64), b"stale").await?;
-                Ok::<_, RankedRegisterError>(r)
-            })
-            .await?;
-        assert_eq!(result, WriteResult::Aborted);
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_follower_value_read() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_follower_value_read").await?;
-
-        // Write with rank 5
-        let rr_ref = &rr;
-        db.run(|txn, _| async move {
-            let _ = rr_ref.write(&txn, Rank::from(5u64), b"X").await?;
-            Ok::<_, RankedRegisterError>(())
-        })
-        .await?;
-
-        // value() returns "X"
-        let rr_ref = &rr;
-        let val = db
-            .run(|txn, _| async move {
-                let v = rr_ref.value(&txn).await?;
-                Ok::<_, RankedRegisterError>(v)
-            })
-            .await?;
-        assert_eq!(val.as_deref(), Some(b"X".as_slice()));
-
-        // Write with rank 10 should succeed (value() didn't install a fence)
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.write(&txn, Rank::from(10u64), b"Y").await?;
-                Ok::<_, RankedRegisterError>(r)
-            })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_empty_register() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_empty_register").await?;
-
-        // Read on fresh register
-        let rr_ref = &rr;
-        let read_result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.read(&txn, Rank::from(1u64)).await?;
-                Ok::<_, RankedRegisterError>((r.write_rank(), r.into_value()))
-            })
-            .await?;
-        assert_eq!(read_result.0, Rank::ZERO);
-        assert_eq!(read_result.1, None);
-
-        // value() on fresh register
-        let rr_ref = &rr;
-        let val = db
-            .run(|txn, _| async move {
-                let v = rr_ref.value(&txn).await?;
-                Ok::<_, RankedRegisterError>(v)
-            })
-            .await?;
-        assert_eq!(val, None);
-
-        // Write with rank 1 should succeed
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                let r = rr_ref.write(&txn, Rank::from(1u64), b"first").await?;
-                Ok::<_, RankedRegisterError>(r)
-            })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_multi_chunk_round_trip() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_multi_chunk_round_trip").await?;
-        let value = vec![0x5a; MAX_VALUE_CHUNK_BYTES + 1];
-        let value_ref = &value;
-
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), value_ref).await })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        let rr_ref = &rr;
-        let round_trip = db
-            .run(|txn, _| async move { rr_ref.value(&txn).await })
-            .await?;
-        assert_eq!(round_trip.as_deref(), Some(value.as_slice()));
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_empty_payload_is_present() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_empty_payload_is_present").await?;
-
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), b"").await })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        let rr_ref = &rr;
-        let value = db
-            .run(|txn, _| async move { rr_ref.value(&txn).await })
-            .await?;
-        assert_eq!(value.as_deref(), Some(b"".as_slice()));
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_shrinking_value_clears_stale_chunks() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_shrinking_value_clears_stale_chunks").await?;
-        let initial = vec![0x31; MAX_VALUE_CHUNK_BYTES * 2 + 1];
-        let initial_ref = &initial;
-
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), initial_ref).await })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(2_u64), b"small").await })
-            .await?;
-        assert_eq!(result, WriteResult::Committed);
-
-        let rr_ref = &rr;
-        let value = db
-            .run(|txn, _| async move { rr_ref.value(&txn).await })
-            .await?;
-        assert_eq!(value.as_deref(), Some(b"small".as_slice()));
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_configured_max_value_rejects_write() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let subspace = Subspace::all().subspace(&("test_configured_max_value_rejects_write",));
-        let rr = RankedRegister::with_max_value_bytes(subspace, 3);
-
-        let rr_ref = &rr;
-        let error = db
-            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), b"four").await })
-            .await
-            .expect_err("configured limit must reject oversized values");
-        assert!(matches!(
-            error,
-            RankedRegisterError::ValueTooLarge {
-                value_size: 4,
-                limit: 3,
-            }
-        ));
-        assert!(matches!(error.retry_decision(), RetryDecision::Fatal));
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_independent_handle_read_installs_fence() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let reader = setup_test(&db, "test_independent_handle_read_installs_fence").await?;
-        let writer = RankedRegister::new(reader.subspace().clone());
-
-        let reader_ref = &reader;
-        db.run(|txn, _| async move {
-            reader_ref.read(&txn, Rank::from(10_u64)).await?;
-            Ok::<_, RankedRegisterError>(())
-        })
-        .await?;
-
-        let writer_ref = &writer;
-        let result = db
-            .run(|txn, _| async move { writer_ref.write(&txn, Rank::from(9_u64), b"fenced").await })
-            .await?;
-        assert_eq!(result, WriteResult::Aborted);
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_equal_rank_recommit_is_aborted() -> Result<(), RankedRegisterError> {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_equal_rank_recommit_is_aborted").await?;
-
-        let rr_ref = &rr;
-        let first = db
-            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), b"first").await })
-            .await?;
-        assert_eq!(first, WriteResult::Committed);
-
-        let rr_ref = &rr;
-        let second = db
-            .run(|txn, _| async move { rr_ref.write(&txn, Rank::from(1_u64), b"second").await })
-            .await?;
-        assert_eq!(second, WriteResult::Aborted);
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn test_concurrent_writes_conflict_on_register_state() -> Result<(), RankedRegisterError>
-    {
-        let db = crate::common::database().await?;
-        let rr = setup_test(&db, "test_concurrent_writes_conflict_on_register_state").await?;
-        let barrier = std::sync::Arc::new(tokio::sync::Barrier::new(2));
-
-        let first = rr.clone();
-        let first_barrier = barrier.clone();
-        let first_write = db.run(|txn, _| {
-            let first = first.clone();
-            let barrier = first_barrier.clone();
-            async move {
-                txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                txn.set_option(TransactionOption::RetryLimit(0))?;
-                let result = first.write(&txn, Rank::from(1_u64), b"a").await?;
-                barrier.wait().await;
-                Ok::<_, RankedRegisterError>(result)
-            }
-        });
-        let second = rr.clone();
-        let second_barrier = barrier.clone();
-        let second_write = db.run(|txn, _| {
-            let second = second.clone();
-            let barrier = second_barrier.clone();
-            async move {
-                txn.set_option(TransactionOption::AutomaticIdempotency)?;
-                txn.set_option(TransactionOption::RetryLimit(0))?;
-                let result = second.write(&txn, Rank::from(1_u64), b"b").await?;
-                barrier.wait().await;
-                Ok::<_, RankedRegisterError>(result)
-            }
-        });
-        let (write_a, write_b) = tokio::join!(first_write, second_write);
-        assert_eq!(
-            usize::from(write_a.is_ok()) + usize::from(write_b.is_ok()),
-            1
-        );
-
-        let rr_ref = &rr;
-        let value = db
-            .run(|txn, _| async move { rr_ref.value(&txn).await })
-            .await?;
-        assert!(matches!(value.as_deref(), Some(b"a") | Some(b"b")));
-
-        Ok(())
-    }
-
-    /// Regression freezing the old anti-pattern this file used to demonstrate:
-    /// stringifying an error into CustomError destroys the source chain, so
-    /// even the chain-walking retry detection cannot rescue it. A retryable
-    /// FdbError flattened to a String is fatal; that is correct, documented
-    /// behavior, and the fix is rewriting the wrapping (as the helpers above
-    /// now do), not the detection.
-    #[tokio::test]
-    async fn stringified_error_is_not_retried() {
-        let db = crate::common::database().await.expect("failed to open db");
-        let attempt = AtomicU8::new(0);
-        let attempt_ref = &attempt;
-
-        let result: Result<(), FdbBindingError> = db
-            .run(|_txn, _| async move {
-                attempt_ref.fetch_add(1, Ordering::SeqCst);
-                let err = RankedRegisterError::Fdb(FdbError::from_code(1020));
-                Err(FdbBindingError::CustomError(err.to_string().into()))
-            })
-            .await;
-
-        assert!(result.is_err(), "stringified errors must stay fatal");
-        assert_eq!(
-            attempt.load(Ordering::SeqCst),
-            1,
-            "a stringified retryable error must not be retried"
-        );
-    }
-
-    /// With the blessed pattern, a retryable FdbError injected through the
-    /// recipe's own error type is retried and the operation completes.
-    #[tokio::test]
-    async fn injected_fdb_error_retries_through_recipe_error() {
-        let db = crate::common::database().await.expect("failed to open db");
-        let rr = setup_test(&db, "test_injected_retry")
-            .await
-            .expect("setup failed");
-        let attempt = AtomicU8::new(0);
-        let attempt_ref = &attempt;
-
-        let rr_ref = &rr;
-        let result = db
-            .run(|txn, _| async move {
-                if attempt_ref.fetch_add(1, Ordering::SeqCst) == 0 {
-                    return Err(RankedRegisterError::Fdb(FdbError::from_code(1020)));
-                }
-                let r = rr_ref.write(&txn, Rank::from(1u64), b"retried").await?;
-                Ok(r)
-            })
-            .await
-            .expect("injected retryable error must be retried");
-
-        assert_eq!(result, WriteResult::Committed);
-        assert!(attempt.load(Ordering::SeqCst) >= 2);
-    }
-}
diff --git a/bindings/rust/foundationdb/tests/run_retry.rs b/bindings/rust/foundationdb/tests/run_retry.rs
index 2424ab35ce2..005da0f8276 100644
--- a/bindings/rust/foundationdb/tests/run_retry.rs
+++ b/bindings/rust/foundationdb/tests/run_retry.rs
@@ -6,13 +6,12 @@
 // copied, modified, or distributed except according to those terms.
 
 //! Retry behavior of `Database::run` for closure errors that wrap an
-//! FdbError, request an app-level retry, or are fatal (#479).
+//! FdbError or are fatal (#479).
 
 use std::fmt;
 use std::sync::atomic::{AtomicBool, AtomicU8, Ordering};
 
-use foundationdb::runner::{AttemptFailure, RetryPolicy};
-use foundationdb::{FdbBindingError, FdbError, RetryDecision, RetryableError, options};
+use foundationdb::{FdbBindingError, FdbError, options};
 
 mod common;
 
@@ -35,11 +34,9 @@ impl std::error::Error for WrappedFdbError {
     }
 }
 
-/// A typed layer error with an app-level retry condition.
+/// A typed layer error preserving the native error as its source.
 #[derive(Debug)]
 enum RetryTestError {
-    /// App-level retry request, no native error underneath.
-    NeedsRetry,
     /// A domain error with no FdbError anywhere in its chain.
     InvalidDocument,
     Fdb(FdbError),
@@ -57,7 +54,7 @@ impl std::error::Error for RetryTestError {
         match self {
             Self::Fdb(e) => Some(e),
             Self::Binding(e) => Some(e),
-            Self::NeedsRetry | Self::InvalidDocument => None,
+            Self::InvalidDocument => None,
         }
     }
 }
@@ -74,16 +71,6 @@ impl From<FdbBindingError> for RetryTestError {
     }
 }
 
-impl RetryableError for RetryTestError {
-    fn retry_decision(&self) -> RetryDecision {
-        match self {
-            Self::NeedsRetry => RetryDecision::Retry,
-            Self::Fdb(e) => RetryDecision::Fdb(*e),
-            Self::InvalidDocument | Self::Binding(_) => RetryDecision::Fatal,
-        }
-    }
-}
-
 /// The end-to-end regression for #479: a retryable FdbError wrapped inside a
 /// layer error and boxed into CustomError is retried (port of the Go
 /// binding's TestErrorWrapping).
@@ -134,32 +121,10 @@ async fn run_retries_typed_wrapped_error() {
     assert_eq!(attempt.load(Ordering::SeqCst), 2);
 }
 
-/// RetryDecision::Retry re-runs the closure through on_error(1020).
-#[tokio::test]
-async fn run_retry_decision_reruns_closure() {
-    let db = common::database().await.expect("failed to open database");
-    let attempt = AtomicU8::new(0);
-    let attempt_ref = &attempt;
-
-    let result = db
-        .run(|trx, _| async move {
-            if attempt_ref.fetch_add(1, Ordering::SeqCst) == 0 {
-                return Err(RetryTestError::NeedsRetry);
-            }
-            trx.set(b"run_retry_decision", b"ok");
-            Ok(())
-        })
-        .await;
-
-    assert!(result.is_ok(), "Retry decision must re-run the closure");
-    assert_eq!(attempt.load(Ordering::SeqCst), 2);
-}
-
-/// RetryDecision::Retry is governed by the C API retry budget: with
-/// RetryLimit(n) the closure runs n + 1 times and exhaustion returns the
-/// ORIGINAL typed error, not a synthetic FdbError.
+/// Native RetryLimit exhausts the retries while preserving the typed closure
+/// error and its source, rather than replacing it with the on_error result.
 #[tokio::test]
-async fn run_retry_decision_honors_retry_limit() {
+async fn run_wrapped_error_honors_retry_limit() {
     let db = common::database().await.expect("failed to open database");
     let attempt = AtomicU8::new(0);
     let attempt_ref = &attempt;
@@ -169,14 +134,11 @@ async fn run_retry_decision_honors_retry_limit() {
         .run(|trx, _| async move {
             trx.set_option(options::TransactionOption::RetryLimit(retry_limit))?;
             attempt_ref.fetch_add(1, Ordering::SeqCst);
-            Err(RetryTestError::NeedsRetry)
+            Err(RetryTestError::from(FdbError::from_code(1020)))
         })
         .await;
 
-    assert!(
-        matches!(result, Err(RetryTestError::NeedsRetry)),
-        "exhaustion must return the original typed error, got {result:?}"
-    );
+    assert!(matches!(result, Err(RetryTestError::Fdb(e)) if e.code() == 1020));
     assert_eq!(attempt.load(Ordering::SeqCst) as i64, retry_limit + 1);
 }
 
@@ -298,48 +260,29 @@ async fn run_keeps_maybe_committed_after_commit_conflicts() {
     assert_eq!(attempt.load(Ordering::SeqCst), 3);
 }
 
-/// A [`RetryPolicy`] rewriting the decision cannot clear `MaybeCommitted`: the
-/// flag is computed from the original error, before the policy is consulted.
+/// A retained clone must not permit commit or reset while user code can still
+/// use the transaction. Exercise both the success and native-retry paths.
 #[tokio::test]
-async fn retry_policy_cannot_clear_maybe_committed() {
-    /// Turns every failure into a plain retry, which on its own would leave
-    /// `MaybeCommitted` untouched.
-    struct AlwaysRetry;
-
-    impl RetryPolicy<RetryTestError> for AlwaysRetry {
-        fn decide(
-            &self,
-            _failure: AttemptFailure<'_, RetryTestError>,
-            _proposed: RetryDecision,
-            _attempt: usize,
-        ) -> RetryDecision {
-            RetryDecision::Retry
-        }
-    }
-
+async fn run_rejects_retained_transaction_clones() {
     let db = common::database().await.expect("failed to open database");
-    let attempt = AtomicU8::new(0);
-    let attempt_ref = &attempt;
-    let seen = AtomicBool::new(false);
-    let seen_ref = &seen;
-
-    let result: Result<(), RetryTestError> = db
-        .runner()
-        .retry_policy(&AlwaysRetry)
-        .run(|trx, maybe_committed| async move {
-            if attempt_ref.fetch_add(1, Ordering::SeqCst) == 0 {
-                return Err(RetryTestError::from(FdbError::from_code(1021)));
-            }
-            seen_ref.store(maybe_committed.into(), Ordering::SeqCst);
-            trx.set(b"run_retry_policy_maybe_committed", b"ok");
-            Ok(())
-        })
-        .await;
-
-    assert!(result.is_ok(), "the policy must retry: {result:?}");
-    assert_eq!(attempt.load(Ordering::SeqCst), 2);
-    assert!(
-        seen.load(Ordering::SeqCst),
-        "the policy must not be able to clear maybe_committed"
-    );
+    for retry in [false, true] {
+        let retained = std::sync::Mutex::new(None);
+        let result: Result<(), FdbBindingError> = db
+            .run(|trx, _| {
+                *retained.lock().expect("retained transaction mutex") = Some(trx.clone());
+                async move {
+                    trx.set(b"run_retained_transaction", b"uncommitted");
+                    if retry {
+                        Err(FdbBindingError::from(FdbError::from_code(1020)))
+                    } else {
+                        Ok(())
+                    }
+                }
+            })
+            .await;
+        assert!(matches!(
+            result,
+            Err(FdbBindingError::ReferenceToTransactionKept)
+        ));
+    }
 }
diff --git a/bindings/rust/foundationdb/tests/runner_hooks.rs b/bindings/rust/foundationdb/tests/runner_hooks.rs
deleted file mode 100644
index 8eeb2e7f62d..00000000000
--- a/bindings/rust/foundationdb/tests/runner_hooks.rs
+++ /dev/null
@@ -1,663 +0,0 @@
-use foundationdb::*;
-#[allow(unused_imports)]
-use foundationdb_macros::cfg_api_versions;
-#[allow(unused_imports)]
-use std::sync::Arc;
-#[allow(unused_imports)]
-use std::sync::atomic::{AtomicU64, Ordering};
-
-mod common;
-
-/// Happy path: instrumented_run completes with metrics, no conflicts.
-#[cfg(feature = "accounting")]
-#[tokio::test]
-async fn test_happy_path_instrumented() -> FdbResult<()> {
-    let db = common::database().await?;
-
-    let (result, metrics) = db
-        .instrumented_run(|trx, _| async move {
-            trx.set(b"test_runner_hooks_happy", b"value");
-            Ok::<_, FdbBindingError>(42u64)
-        })
-        .await
-        .expect("transaction should succeed");
-
-    assert_eq!(result, 42);
-    assert_eq!(metrics.transaction.retries, 0);
-    assert_eq!(metrics.attempts.len(), 1);
-    assert!(metrics.attempts[0].conflicting_keys.ranges().is_empty());
-
-    Ok(())
-}
-
-/// Conflict path via instrumented_run: force a conflict and verify the
-/// conflicting keys of the conflicted attempt are populated when
-/// ReportConflictingKeys is enabled.
-///
-/// ReportConflictingKeys (option 712) was added in FDB 6.3.
-#[cfg_api_versions(min = 630)]
-#[cfg(feature = "accounting")]
-#[tokio::test]
-async fn test_conflict_reports_in_metrics() -> FdbResult<()> {
-    let db = common::database().await?;
-    let attempt = Arc::new(AtomicU64::new(0));
-
-    let (_, metrics) = db
-        .instrumented_run(|trx, _| {
-            let attempt = attempt.clone();
-            async move {
-                let current = attempt.fetch_add(1, Ordering::SeqCst);
-
-                // Enable conflict reporting
-                trx.set_option(options::TransactionOption::ReportConflictingKeys)?;
-
-                // Read a key to establish read conflict range
-                let _ = trx.get(b"test_conflict_metrics_key", false).await?;
-
-                if current == 0 {
-                    // On first attempt, write the same key from another transaction
-                    let db2 = Database::new_compat(None).await?;
-                    let other_trx = db2.create_trx()?;
-                    other_trx.set(b"test_conflict_metrics_key", b"other_value");
-                    other_trx
-                        .commit()
-                        .await
-                        .map_err(|e| FdbBindingError::NonRetryableFdbError(FdbError::from(e)))?;
-                }
-
-                trx.set(b"test_conflict_metrics_key", b"my_value");
-                Ok::<_, FdbBindingError>(())
-            }
-        })
-        .await
-        .expect("transaction should eventually succeed");
-
-    // Should have retried at least once
-    assert!(metrics.transaction.retries >= 1);
-    // Should have recorded at least one conflict
-    assert!(metrics.transaction.conflict_count >= 1);
-    // Conflicting keys should be populated on the attempt that conflicted
-    assert!(
-        metrics
-            .attempts
-            .iter()
-            .any(|attempt| !attempt.conflicting_keys.ranges().is_empty()),
-        "expected conflicting keys to be reported"
-    );
-
-    Ok(())
-}
-
-/// Direct API: use Transaction::conflicting_keys() on a TransactionCommitError.
-///
-/// ReportConflictingKeys (option 712) was added in FDB 6.3.
-#[cfg_api_versions(min = 630)]
-#[tokio::test]
-async fn test_conflict_keys_direct_api() -> FdbResult<()> {
-    let db = common::database().await?;
-
-    // Transaction A: read, then try to commit after B writes the same key
-    let trx_a = db.create_trx()?;
-    trx_a.set_option(options::TransactionOption::ReportConflictingKeys)?;
-    let _ = trx_a.get(b"test_conflict_direct_key", false).await?;
-
-    // Transaction B: write the same key and commit
-    let trx_b = db.create_trx()?;
-    trx_b.set(b"test_conflict_direct_key", b"b_value");
-    trx_b.commit().await.expect("trx B should commit");
-
-    // Transaction A: write something and try to commit — should conflict
-    trx_a.set(b"test_conflict_direct_key", b"a_value");
-    let commit_result = trx_a.commit().await;
-
-    match commit_result {
-        Ok(_committed) => {
-            // It's possible (though unlikely) that A commits successfully
-            // if the read version window doesn't overlap. That's fine.
-        }
-        Err(commit_error) => {
-            // Read conflicting keys before on_error resets the transaction
-            let conflicting = commit_error.conflicting_keys().await?;
-            for range in &conflicting {
-                eprintln!(
-                    "conflicting range: begin={:?} end={:?}",
-                    String::from_utf8_lossy(range.begin()),
-                    String::from_utf8_lossy(range.end()),
-                );
-            }
-            assert!(
-                !conflicting.is_empty(),
-                "expected conflicting keys on commit error"
-            );
-
-            // Verify the conflicting range includes our key
-            let key: &[u8] = b"test_conflict_direct_key";
-            let has_our_key = conflicting
-                .iter()
-                .any(|range| key >= range.begin() && key < range.end());
-            assert!(has_our_key, "conflicting range should contain our key");
-        }
-    }
-
-    Ok(())
-}
-
-// ---------------------------------------------------------------------------
-// Hook composition, ordering and lifecycle
-// ---------------------------------------------------------------------------
-
-#[cfg(feature = "accounting")]
-use foundationdb::runner::MetricsHooks;
-use foundationdb::runner::{AttemptFailure, RetryPolicy, RunnerHooks};
-use std::fmt;
-use std::sync::Mutex;
-
-/// A layer error with an app-level retry condition and a fatal domain error,
-/// the two cases a [`RetryPolicy`] is expected to arbitrate.
-#[derive(Debug)]
-enum HookTestError {
-    /// Carries a retryable FdbError, so the runner proposes `Fdb`.
-    Fdb(FdbError),
-    Binding(FdbBindingError),
-    /// No FdbError anywhere in the chain: the runner proposes `Fatal`.
-    Domain,
-}
-
-impl fmt::Display for HookTestError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{self:?}")
-    }
-}
-
-impl std::error::Error for HookTestError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Self::Fdb(e) => Some(e),
-            Self::Binding(e) => Some(e),
-            Self::Domain => None,
-        }
-    }
-}
-
-impl From<FdbError> for HookTestError {
-    fn from(e: FdbError) -> Self {
-        Self::Fdb(e)
-    }
-}
-
-impl From<FdbBindingError> for HookTestError {
-    fn from(e: FdbBindingError) -> Self {
-        Self::Binding(e)
-    }
-}
-
-impl RetryableError for HookTestError {}
-
-/// Records every callback it receives, tagged with the name of the hook, so a
-/// tuple of them shows both the lifecycle order and the order inside the tuple.
-struct RecordingHooks {
-    name: &'static str,
-    events: Arc<Mutex<Vec<String>>>,
-}
-
-impl RecordingHooks {
-    fn new(name: &'static str, events: &Arc<Mutex<Vec<String>>>) -> Self {
-        Self {
-            name,
-            events: events.clone(),
-        }
-    }
-
-    fn record(&self, event: &str) {
-        self.events
-            .lock()
-            .expect("events mutex")
-            .push(format!("{}:{event}", self.name));
-    }
-}
-
-impl RunnerHooks for RecordingHooks {
-    fn on_attempt_start(&self, _trx: &Transaction, attempt: usize) {
-        self.record(&format!("attempt_start:{attempt}"));
-    }
-
-    async fn before_commit(&self, _trx: &Transaction, attempt: usize) -> FdbResult<()> {
-        self.record(&format!("before_commit:{attempt}"));
-        Ok(())
-    }
-
-    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
-        self.record(&format!("hook_error:{}:{attempt}", err.code()));
-    }
-
-    fn on_commit_success(&self, _committed: &TransactionCommitted, _ms: u64, attempt: usize) {
-        self.record(&format!("commit_success:{attempt}"));
-    }
-
-    async fn on_commit_error(&self, err: &TransactionCommitError, attempt: usize) -> FdbResult<()> {
-        self.record(&format!("commit_error:{}:{attempt}", err.code()));
-        Ok(())
-    }
-
-    fn on_closure_error(&self, err: &FdbError, attempt: usize) {
-        self.record(&format!("closure_error:{}:{attempt}", err.code()));
-    }
-
-    fn on_error_duration(&self, _ms: u64, attempt: usize) {
-        self.record(&format!("error_duration:{attempt}"));
-    }
-
-    fn on_retry(&self, attempt: usize) {
-        self.record(&format!("retry:{attempt}"));
-    }
-
-    fn on_complete(&self) {
-        self.record("complete");
-    }
-}
-
-/// Hooks whose `before_commit` always fails, to check that the runner reports
-/// it and commits anyway.
-struct FailingBeforeCommit {
-    events: Arc<Mutex<Vec<String>>>,
-}
-
-impl RunnerHooks for FailingBeforeCommit {
-    async fn before_commit(&self, _trx: &Transaction, _attempt: usize) -> FdbResult<()> {
-        self.events
-            .lock()
-            .expect("events mutex")
-            .push("before_commit".to_string());
-        // transaction_timed_out, an error the transaction itself never hit.
-        Err(FdbError::from_code(1031))
-    }
-
-    fn on_hook_error(&self, err: &FdbError, attempt: usize) {
-        self.events
-            .lock()
-            .expect("events mutex")
-            .push(format!("hook_error:{}:{attempt}", err.code()));
-    }
-}
-
-/// Both hooks of a tuple fire, left to right, and the lifecycle order of a run
-/// that retries once is stable.
-#[tokio::test]
-async fn tuple_hooks_fire_left_to_right_in_lifecycle_order() {
-    let db = common::database().await.expect("failed to open database");
-    let events = Arc::new(Mutex::new(Vec::new()));
-    let hooks = (
-        RecordingHooks::new("a", &events),
-        RecordingHooks::new("b", &events),
-    );
-    let attempts = AtomicU64::new(0);
-    let attempts_ref = &attempts;
-
-    let result: Result<(), HookTestError> = db
-        .run_with_hooks(&hooks, |trx, _| {
-            let attempt = attempts_ref.fetch_add(1, Ordering::SeqCst);
-            events
-                .lock()
-                .expect("events mutex")
-                .push(format!("closure:{attempt}"));
-            async move {
-                if attempt == 0 {
-                    return Err(HookTestError::Fdb(FdbError::from_code(1020)));
-                }
-                trx.set(b"runner_hooks_tuple", b"ok");
-                Ok(())
-            }
-        })
-        .await;
-
-    assert!(result.is_ok(), "run should succeed on the second attempt");
-    let events = events.lock().expect("events mutex").clone();
-    assert_eq!(
-        events,
-        vec![
-            "a:attempt_start:0",
-            "b:attempt_start:0",
-            "closure:0",
-            "a:closure_error:1020:0",
-            "b:closure_error:1020:0",
-            "a:error_duration:0",
-            "b:error_duration:0",
-            "a:retry:0",
-            "b:retry:0",
-            "a:attempt_start:1",
-            "b:attempt_start:1",
-            "closure:1",
-            "a:before_commit:1",
-            "b:before_commit:1",
-            "a:commit_success:1",
-            "b:commit_success:1",
-            "a:complete",
-            "b:complete",
-        ],
-    );
-}
-
-/// `Option<H>`: `Some` behaves like the hooks themselves, `None` is a no-op.
-#[tokio::test]
-async fn option_hooks_are_a_noop_when_none() {
-    let db = common::database().await.expect("failed to open database");
-
-    let events = Arc::new(Mutex::new(Vec::new()));
-    let some = Some(RecordingHooks::new("some", &events));
-    db.run_with_hooks(&some, |trx, _| async move {
-        trx.set(b"runner_hooks_option_some", b"ok");
-        Ok::<_, FdbBindingError>(())
-    })
-    .await
-    .expect("run should succeed");
-
-    assert_eq!(
-        events.lock().expect("events mutex").clone(),
-        vec![
-            "some:attempt_start:0",
-            "some:before_commit:0",
-            "some:commit_success:0",
-            "some:complete",
-        ],
-    );
-
-    let none: Option<RecordingHooks> = None;
-    db.run_with_hooks(&none, |trx, _| async move {
-        trx.set(b"runner_hooks_option_none", b"ok");
-        Ok::<_, FdbBindingError>(())
-    })
-    .await
-    .expect("run should succeed without hooks");
-}
-
-/// A `before_commit` that fails is reported through `on_hook_error`, and the
-/// transaction is committed all the same.
-#[tokio::test]
-async fn before_commit_error_is_reported_but_does_not_abort_the_commit() {
-    let db = common::database().await.expect("failed to open database");
-    let events = Arc::new(Mutex::new(Vec::new()));
-    let hooks = FailingBeforeCommit {
-        events: events.clone(),
-    };
-
-    db.run_with_hooks(&hooks, |trx, _| async move {
-        trx.set(b"runner_hooks_before_commit", b"committed");
-        Ok::<_, FdbBindingError>(())
-    })
-    .await
-    .expect("the failing hook must not abort the run");
-
-    assert_eq!(
-        events.lock().expect("events mutex").clone(),
-        vec!["before_commit", "hook_error:1031:0"],
-    );
-
-    let value = db
-        .run(|trx, _| async move {
-            Ok::<_, FdbBindingError>(
-                trx.get(b"runner_hooks_before_commit", false)
-                    .await?
-                    .map(|slice| slice.to_vec()),
-            )
-        })
-        .await
-        .expect("read back");
-    assert_eq!(value.as_deref(), Some(b"committed".as_ref()));
-}
-
-/// `on_complete` fires exactly once on the fatal path, and the original error
-/// is returned.
-#[tokio::test]
-async fn on_complete_fires_once_on_the_fatal_path() {
-    let db = common::database().await.expect("failed to open database");
-    let events = Arc::new(Mutex::new(Vec::new()));
-    let hooks = RecordingHooks::new("h", &events);
-
-    let result: Result<(), HookTestError> = db
-        .run_with_hooks(&hooks, |_trx, _| async move { Err(HookTestError::Domain) })
-        .await;
-
-    assert!(matches!(result, Err(HookTestError::Domain)));
-    assert_eq!(
-        events.lock().expect("events mutex").clone(),
-        vec!["h:attempt_start:0", "h:complete"],
-    );
-}
-
-/// `on_complete` fires exactly once when the C API retry budget is exhausted.
-#[tokio::test]
-async fn on_complete_fires_once_when_retries_are_exhausted() {
-    let db = common::database().await.expect("failed to open database");
-    let events = Arc::new(Mutex::new(Vec::new()));
-    let hooks = RecordingHooks::new("h", &events);
-
-    let result: Result<(), HookTestError> = db
-        .run_with_hooks(&hooks, |trx, _| async move {
-            trx.set_option(options::TransactionOption::RetryLimit(1))?;
-            Err(HookTestError::Fdb(FdbError::from_code(1020)))
-        })
-        .await;
-
-    assert!(matches!(result, Err(HookTestError::Fdb(_))));
-    let events = events.lock().expect("events mutex").clone();
-    assert_eq!(
-        events.iter().filter(|event| *event == "h:complete").count(),
-        1,
-        "on_complete must fire exactly once, got {events:?}"
-    );
-    assert_eq!(
-        events.last().map(String::as_str),
-        Some("h:complete"),
-        "on_complete must be the last event, got {events:?}"
-    );
-    // RetryLimit(1): one retry, so two attempts.
-    assert!(events.contains(&"h:attempt_start:1".to_string()));
-    assert!(!events.contains(&"h:attempt_start:2".to_string()));
-}
-
-// ---------------------------------------------------------------------------
-// Retry policies
-// ---------------------------------------------------------------------------
-
-/// Stops the run once `max` attempts have been made, whatever the error.
-struct MaxAttempts {
-    max: usize,
-}
-
-impl RetryPolicy<HookTestError> for MaxAttempts {
-    fn decide(
-        &self,
-        _failure: AttemptFailure<'_, HookTestError>,
-        proposed: RetryDecision,
-        attempt: usize,
-    ) -> RetryDecision {
-        if attempt + 1 >= self.max {
-            RetryDecision::Fatal
-        } else {
-            proposed
-        }
-    }
-}
-
-/// Retries an app-level error the runner would consider fatal.
-struct RetryDomainErrors;
-
-impl RetryPolicy<HookTestError> for RetryDomainErrors {
-    fn decide(
-        &self,
-        failure: AttemptFailure<'_, HookTestError>,
-        proposed: RetryDecision,
-        _attempt: usize,
-    ) -> RetryDecision {
-        match failure {
-            AttemptFailure::Closure(HookTestError::Domain) => RetryDecision::Retry,
-            _ => proposed,
-        }
-    }
-}
-
-/// A policy capping the attempts ends the run with the original closure error,
-/// before the C API retry budget has anything to say.
-#[tokio::test]
-async fn retry_policy_can_cap_the_number_of_attempts() {
-    let db = common::database().await.expect("failed to open database");
-    let attempts = AtomicU64::new(0);
-    let attempts_ref = &attempts;
-    let policy = MaxAttempts { max: 3 };
-
-    let result: Result<(), HookTestError> = db
-        .runner()
-        .retry_policy(&policy)
-        .run(|_trx, _| async move {
-            attempts_ref.fetch_add(1, Ordering::SeqCst);
-            // Retryable on its own: only the policy can stop this run.
-            Err(HookTestError::Fdb(FdbError::from_code(1020)))
-        })
-        .await;
-
-    assert!(
-        matches!(result, Err(HookTestError::Fdb(e)) if e.code() == 1020),
-        "the original closure error must be returned, got {result:?}"
-    );
-    assert_eq!(attempts.load(Ordering::SeqCst), 3);
-}
-
-/// A policy can retry an error the runner classifies as fatal: it goes through
-/// `on_error` with code 1020, like a `RetryDecision::Retry` from the error
-/// itself would.
-#[tokio::test]
-async fn retry_policy_can_retry_an_otherwise_fatal_error() {
-    let db = common::database().await.expect("failed to open database");
-    let attempts = AtomicU64::new(0);
-    let attempts_ref = &attempts;
-    let events = Arc::new(Mutex::new(Vec::new()));
-    let hooks = RecordingHooks::new("h", &events);
-
-    let result: Result<(), HookTestError> = db
-        .runner()
-        .hooks(&hooks)
-        .retry_policy(&RetryDomainErrors)
-        .run(|trx, _| async move {
-            if attempts_ref.fetch_add(1, Ordering::SeqCst) == 0 {
-                return Err(HookTestError::Domain);
-            }
-            trx.set(b"runner_hooks_policy_retry", b"ok");
-            Ok(())
-        })
-        .await;
-
-    assert!(result.is_ok(), "the policy must force a retry: {result:?}");
-    assert_eq!(attempts.load(Ordering::SeqCst), 2);
-    let events = events.lock().expect("events mutex").clone();
-    assert!(
-        events.contains(&"h:closure_error:1020:0".to_string()),
-        "the fatal error must be routed through on_error(1020), got {events:?}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// MetricsHooks stacked on user hooks
-// ---------------------------------------------------------------------------
-
-/// The wiring case: metrics hooks stacked on a user hook through the plain
-/// `run_with_hooks` produce the same complete report as `instrumented_run`.
-#[cfg(feature = "accounting")]
-#[tokio::test]
-async fn metrics_hooks_stacked_on_user_hooks_produce_a_full_report() {
-    let db = common::database().await.expect("failed to open database");
-    let events = Arc::new(Mutex::new(Vec::new()));
-    let metrics = TransactionMetrics::new();
-    let hooks = (
-        MetricsHooks::new(&metrics),
-        RecordingHooks::new("user", &events),
-    );
-    let attempts = AtomicU64::new(0);
-    let attempts_ref = &attempts;
-
-    let result: Result<(), HookTestError> = db
-        .run_with_hooks(&hooks, |trx, _| {
-            let first = attempts_ref.fetch_add(1, Ordering::SeqCst) == 0;
-            // These operations start before the returned future is polled.
-            let read_version = trx.get_read_version();
-            trx.set(b"runner_hooks_metrics_stacked", b"value");
-            trx.set_custom_metric("stacked", 1, &[]);
-            async move {
-                let _ = read_version.await?;
-                let _ = trx.get(b"runner_hooks_metrics_stacked", false).await?;
-                if first {
-                    return Err(HookTestError::Fdb(FdbError::from_code(1020)));
-                }
-                Ok(())
-            }
-        })
-        .await;
-
-    assert!(result.is_ok(), "run should succeed: {result:?}");
-
-    let report = metrics.get_metrics_data();
-    assert_eq!(report.transaction.retries, 1);
-    assert_eq!(
-        report.attempts.len(),
-        report.transaction.retries as usize + 1,
-        "attempts are pushed exactly once per attempt: {report:#?}"
-    );
-    assert!(report.total_duration.is_some());
-    assert!(report.transaction.commit_version.is_some());
-
-    let first = &report.attempts[0];
-    assert_eq!(first.index, 0);
-    assert!(matches!(first.outcome, AttemptOutcome::Retried { .. }));
-    assert!(first.on_error_duration.is_some());
-    assert!(first.grv_duration.is_some());
-    assert!(first.read_version.is_some());
-    assert_eq!(first.usage.call_set, 1);
-    assert_eq!(first.usage.call_get, 1);
-    assert!(first.usage.bytes_written > 0);
-    assert_eq!(
-        first
-            .custom_metrics
-            .get(&metrics::MetricKey::new("stacked", &[])),
-        Some(&1),
-    );
-
-    let last = report.attempts.last().expect("a last attempt");
-    assert!(matches!(last.outcome, AttemptOutcome::Committed));
-    assert!(last.commit_duration.is_some());
-    assert!(last.grv_duration.is_some());
-    assert!(last.read_version.is_some());
-    assert_eq!(last.usage.call_set, 1);
-
-    // The user hook saw the same run.
-    let events = events.lock().expect("events mutex").clone();
-    assert_eq!(
-        events.first().map(String::as_str),
-        Some("user:attempt_start:0")
-    );
-    assert_eq!(events.last().map(String::as_str), Some("user:complete"));
-}
-
-/// A reference to hooks is itself hooks, and delegates to what it points at.
-#[tokio::test]
-async fn reference_hooks_delegate_to_the_hooks_they_point_at() {
-    let db = common::database().await.expect("failed to open database");
-    let events = Arc::new(Mutex::new(Vec::new()));
-    let hooks = RecordingHooks::new("ref", &events);
-    let by_reference = &hooks;
-
-    db.run_with_hooks(&by_reference, |trx, _| async move {
-        trx.set(b"runner_hooks_reference", b"ok");
-        Ok::<_, FdbBindingError>(())
-    })
-    .await
-    .expect("run should succeed");
-
-    assert_eq!(
-        events.lock().expect("events mutex").clone(),
-        vec![
-            "ref:attempt_start:0",
-            "ref:before_commit:0",
-            "ref:commit_success:0",
-            "ref:complete",
-        ],
-    );
-}
diff --git a/bindings/rust/foundationdb/tests/timekeeper.rs b/bindings/rust/foundationdb/tests/timekeeper.rs
deleted file mode 100644
index 479b366c1fb..00000000000
--- a/bindings/rust/foundationdb/tests/timekeeper.rs
+++ /dev/null
@@ -1,90 +0,0 @@
-use foundationdb::options::TransactionOption;
-use foundationdb::timekeeper::{HintMode, hint_version_from_timestamp};
-use foundationdb::{FdbBindingError, RangeOption};
-use std::time::SystemTime;
-
-mod common;
-
-#[tokio::test]
-async fn timekeeper_propagates_range_read_errors() -> Result<(), FdbBindingError> {
-    let database = common::database().await?;
-    let trx = database.create_trx()?;
-    trx.set_read_version(1);
-    trx.set_option(TransactionOption::ReadSystemKeys)?;
-    trx.set_option(TransactionOption::ReadLockAware)?;
-
-    let range = RangeOption::from((
-        b"\xff\x02/timeKeeper/map/".as_ref(),
-        b"\xff\x02/timeKeeper/map/\xff".as_ref(),
-    ));
-    let read_error = trx
-        .get_range(&range, 1, true)
-        .await
-        .err()
-        .expect("an obsolete read version must fail the range read");
-    assert_eq!(read_error.code(), 1007);
-
-    // The helper must return the range error, not fail while setting options.
-    trx.set_option(TransactionOption::ReadSystemKeys)?;
-    trx.set_option(TransactionOption::ReadLockAware)?;
-    let error = hint_version_from_timestamp(&trx, 0, HintMode::AfterTimestamp, true)
-        .await
-        .expect_err("a failed range read must not look like a missing timekeeper entry");
-    assert_eq!(error.get_fdb_error().unwrap().code(), read_error.code());
-    Ok(())
-}
-
-#[tokio::test]
-async fn timekeeper() {
-    let database = foundationdb::Database::new_compat(None)
-        .await
-        .expect("Unable to create database");
-    let now = SystemTime::now()
-        .duration_since(SystemTime::UNIX_EPOCH)
-        .expect("Unable to get timestamp")
-        .as_secs();
-    // Let some time passed in order to create a new timekeeper entry
-    tokio::time::sleep(std::time::Duration::from_secs(10)).await;
-    // A new transaction is needed because the one which get the read version has no
-    // knowledge about the new System Namespace Keyspace thus, further timekeeper
-    // keys are unknown for the first transaction.
-    // Creating a new one, make the first to be commited. The second will have the right
-    // timekeeper state.
-    let trx = database.create_trx().expect("Unable to create transaction");
-    let result = hint_version_from_timestamp(&trx, now, HintMode::AfterTimestamp, true)
-        .await
-        .expect("Unable to get hint version");
-    assert!(result.is_some());
-
-    // create a new transaction to fail getting read version in the future
-    let trx = database.create_trx().expect("Unable to create transaction");
-    let future_date = now + 50;
-    let result = hint_version_from_timestamp(&trx, future_date, HintMode::AfterTimestamp, true)
-        .await
-        .expect("Unable to get hint version");
-    assert!(result.is_none());
-
-    // create a new transaction to get the first read version greater than a long past timestamp
-    let trx = database.create_trx().expect("Unable to create transaction");
-    let past_date = 0;
-    let result = hint_version_from_timestamp(&trx, past_date, HintMode::AfterTimestamp, true)
-        .await
-        .expect("Unable to get hint version");
-    assert!(result.is_some());
-
-    // create a new transaction to get the first available read version
-    let trx = database.create_trx().expect("Unable to create transaction");
-    let future_date = now + 50;
-    let result = hint_version_from_timestamp(&trx, future_date, HintMode::BeforeTimestamp, true)
-        .await
-        .expect("Unable to get hint version");
-    assert!(result.is_some());
-
-    // create a new transaction to fail getting older read version
-    let trx = database.create_trx().expect("Unable to create transaction");
-    let past_date = 0;
-    let result = hint_version_from_timestamp(&trx, past_date, HintMode::BeforeTimestamp, true)
-        .await
-        .expect("Unable to get hint version");
-    assert!(result.is_none());
-}
diff --git a/bindings/rust/foundationdb/tests/tuple.rs b/bindings/rust/foundationdb/tests/tuple.rs
index 55245d5d159..565f41c5d18 100644
--- a/bindings/rust/foundationdb/tests/tuple.rs
+++ b/bindings/rust/foundationdb/tests/tuple.rs
@@ -14,9 +14,6 @@ use futures::StreamExt;
 use std::sync::{Arc, Barrier, Mutex};
 use std::thread;
 
-#[cfg(feature = "accounting")]
-use foundationdb::ClientBudget;
-
 mod common;
 
 #[tokio::test]
@@ -239,34 +236,6 @@ async fn commit_error_after_allocation(
     trx.commit().await.expect_err("transaction must conflict")
 }
 
-#[cfg(feature = "accounting")]
-#[tokio::test]
-async fn user_version_allocator_survives_budget_changes_and_does_not_affect_accounting()
--> Result<(), FdbBindingError> {
-    let db = common::database().await?;
-
-    let trx = db.create_trx()?;
-    assert_eq!(trx.allocate_user_version()?, 0);
-    trx.set_client_budget(ClientBudget::default());
-    assert_eq!(trx.allocate_user_version()?, 1);
-
-    let (version, metrics) = db
-        .instrumented_run(|trx, _| async move {
-            assert_eq!(trx.allocate_user_version()?, 0);
-            trx.allocate_user_version()
-        })
-        .await
-        .map_err(|(error, _metrics)| error)?;
-    assert_eq!(version, 1);
-    let usage = metrics.total_usage();
-    assert_eq!(usage.bytes_read, 0);
-    assert_eq!(usage.bytes_written, 0);
-    assert_eq!(usage.call_set, 0);
-    assert_eq!(usage.call_atomic_op, 0);
-
-    Ok(())
-}
-
 #[tokio::test]
 async fn user_version_allocator_runner_retry_restarts_and_keeps_clones_shared()
 -> Result<(), FdbBindingError> {
diff --git a/bindings/rust/foundationdb/tests/versionstamp.rs b/bindings/rust/foundationdb/tests/versionstamp.rs
index 124ddd6f356..bb6a5632c91 100644
--- a/bindings/rust/foundationdb/tests/versionstamp.rs
+++ b/bindings/rust/foundationdb/tests/versionstamp.rs
@@ -80,10 +80,6 @@ async fn check_versionstamped_mutations(version: i32) {
                 Some("versionstamped mutations require runtime API 520 or later")
             );
         }
-        #[cfg(feature = "accounting")]
-        assert_eq!(trx.attempt_usage().call_atomic_op, 0);
-        #[cfg(feature = "accounting")]
-        assert_eq!(trx.attempt_usage().bytes_written, 0);
         // Unsupported versionstamps do not prevent API 510 atomic operations.
         trx.atomic_op(&counter_key, &1_i64.to_le_bytes(), MutationType::Add);
         trx.commit().await.expect("commit API 510 atomic add");
diff --git a/bindings/rust/rust-toolchain.toml b/bindings/rust/rust-toolchain.toml
index d148a7a8f6b..f1db5f079b8 100644
--- a/bindings/rust/rust-toolchain.toml
+++ b/bindings/rust/rust-toolchain.toml
@@ -1,11 +1,3 @@
 [toolchain]
 channel = "1.85.1"
-components = [
-    "cargo",
-    "clippy",
-    "rust-src",
-    "rustc",
-    "rustfmt",
-    "rust-analyzer",
-    "llvm-tools-preview",
-]
+components = ["cargo", "clippy", "rustc", "rustfmt"]
diff --git a/bindings/rust/scripts/run_leader_election_simulation.sh b/bindings/rust/scripts/run_leader_election_simulation.sh
deleted file mode 100755
index 9a9647b703e..00000000000
--- a/bindings/rust/scripts/run_leader_election_simulation.sh
+++ /dev/null
@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-# Number of runs (default: 1, use 0 for infinite)
-MAX_ITERATIONS=${1:-1}
-# Bound one pathological seed while keeping its traces for diagnosis.
-SEED_TIMEOUT=${LEADER_ELECTION_SEED_TIMEOUT:-15m}
-
-# Create trace directory
-mkdir -p ./target/traces
-
-# Build in release mode
-echo "Building in release mode..."
-cargo build --release -p foundationdb-recipes-simulation
-
-TEST="foundationdb-recipes-simulation/test_poll_leader_election.toml"
-
-echo ""
-echo "=========================================="
-echo "Running: $TEST"
-echo "=========================================="
-
-iteration=1
-while [ "$MAX_ITERATIONS" -eq 0 ] || [ "$iteration" -le "$MAX_ITERATIONS" ]; do
-    config=$(basename "$TEST" .toml)
-    seed=$(((RANDOM << 17) | (RANDOM << 2) | (RANDOM & 3)))
-    trace_dir="./target/traces/${config}-iteration-${iteration}-seed-${seed}"
-    mkdir -p "$trace_dir"
-
-    echo "----------------------"
-    echo "Config: $TEST"
-    echo "Iteration: $iteration"
-    echo "Seed: $seed"
-    echo "Per-seed timeout: $SEED_TIMEOUT"
-    echo "----------------------"
-
-    if timeout --kill-after=1m "$SEED_TIMEOUT" \
-        fdbserver -r simulation -f "$TEST" -b on --trace-format json -L "$trace_dir" --logsize 1GiB --seed "$seed"; then
-        rm -rf -- "$trace_dir"
-        echo "Iteration $iteration passed"
-    else
-        status=$?
-        if [ "$status" -eq 124 ] || [ "$status" -eq 137 ]; then
-            echo "TIMED OUT after $SEED_TIMEOUT on iteration $iteration"
-        fi
-        echo "FAILED on iteration $iteration for $TEST"
-        echo "Seed: $seed"
-        echo "Traces: $trace_dir"
-        printf 'Reproduce: fdbserver -r simulation -f %q -b on --trace-format json -L %q --logsize 1GiB --seed %s\n' \
-            "$TEST" "$trace_dir" "$seed"
-        exit "$status"
-    fi
-    iteration=$((iteration + 1))
-done
-
-echo "PASSED: $TEST"
-
-echo ""
-echo "=========================================="
-echo "All tests passed!"
-echo "=========================================="
diff --git a/bindings/rust/scripts/simulation_entrypoint.sh b/bindings/rust/scripts/simulation_entrypoint.sh
deleted file mode 100755
index b388648f5f9..00000000000
--- a/bindings/rust/scripts/simulation_entrypoint.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/sh
-
-# Simulation needs libc++.so at runtime
-export LD_LIBRARY_PATH=/usr/local/lib/x86_64-unknown-linux-gnu
-
-START=1
-END=${1-1}
-for i in $(eval echo "{$START..$END}")
-do
-  echo "----------------------"
-  echo "----------------------"
-  echo "Running iteration $i"
-  echo "----------------------"
-  echo "----------------------"
-  if ! fdbserver -r simulation -f foundationdb-simulation/examples/atomic/test_file_73.toml -b on --trace-format json; then
-      cat trace*.json | grep Rust
-      exit 1;
-  else
-      # Removing traces about success run
-      rm trace*.json
-  fi
-
-done
diff --git a/bindings/rust/tests/current_headers.cmake b/bindings/rust/tests/current_headers.cmake
index 46785d4c8b3..151d598c893 100644
--- a/bindings/rust/tests/current_headers.cmake
+++ b/bindings/rust/tests/current_headers.cmake
@@ -11,6 +11,7 @@ file(MAKE_DIRECTORY ${OUTPUT_DIR})
 file(COPY
   ${fdb_source_dir}/bindings/c/foundationdb/fdb_c.h
   ${fdb_source_dir}/bindings/c/foundationdb/fdb_c_types.h
+  ${fdb_source_dir}/bindings/c/foundationdb/CWorkload.h
   ${fdb_source_dir}/fdbclient/vexillographer/fdb.options
   DESTINATION ${OUTPUT_DIR})
 configure_file(