diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb36f40d..1949d4fc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,217 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed — Wave A adversarial-review fixes (task #34)
+
+Three defects found reviewing Wave A (plane replication) before merge, all
+fixed on top of the branch's part 1/2/3 work below.
+
+- **Non-string eviction victims under a `SpillContext` were dropped with no
+  cold copy AND no DEL record.** `storage::eviction::evict_one_with_spill`
+  snapshotted `is_plain_drop = spill.is_none()` BEFORE its spill body ran,
+  but that body only ever spills `RedisValueRef::String` values — a
+  Hash/List/Set/ZSet victim picked while a `SpillContext` was live took
+  neither branch of the `is_string` check (no bytes written anywhere) yet
+  still fell through to the unconditional `db.remove`, and because
+  `is_plain_drop` was already `false`, `on_plain_drop` never fired: a
+  genuine, silent, unreported data loss. Fixed by tracking whether THIS
+  victim was actually spilled (`spilled`, set only inside the branch that
+  performs the write) instead of snapshotting the precondition. Also
+  threaded the real `record_reason_del` sink into
+  `persistence_tick::handle_memory_pressure`'s "durable spill, manifest
+  reachable" branch, which previously passed a hardcoded no-op sink on the
+  (incorrect, for non-strings) assumption that this branch could never
+  plain-drop. New unit test:
+  `eviction::tests::sync_spill_non_string_victim_reports_plain_drop`.
+- **`record_reason_del`/`record_reason_del_conn`/`record_effect_write`
+  allocated a fully serialized RESP record BEFORE checking whether any
+  replica or AOF pool was even wired.** The single most common deployment
+  shape (standalone server, no replica ever attached, `--appendonly no`)
+  paid a `Bytes`/`Frame` allocation for every background-tick DEL or script
+  write effect, only to discard it a few instructions later inside
+  `wal_append_and_fanout`'s own no-op fast path. Fixed by hoisting the exact
+  same has-work predicate (`wal_fanout_has_work` for the shard-loop
+  context; a new `conn_has_work` — `fanout_hint_active() ||
+  aof_pool.is_some()` — for the connection context) to the top of all three
+  entry points, before any serialization. Behavior when there IS work is
+  byte-for-byte unchanged (same predicate, same downstream call). This is a
+  perf-only fix with no allocation-counting harness in this repo to red/
+  green against; verified instead by regression tests confirming both the
+  no-op path (`record_reason_del_noop_when_nothing_wired`) and the
+  has-work path still emits correctly
+  (`record_reason_del_still_emits_to_aof_when_wired`,
+  `conn_has_work_true_when_aof_pool_wired`).
+- **Lua's bystander-eviction gate was unwired from both durability planes.**
+  `scripting::bridge::LuaEvictionCtx::gate` — the OOM check run before every
+  `WRITE`-flagged `redis.call`/`redis.pcall` inside a script — called the
+  non-reporting `try_evict_if_needed_budget`/
+  `try_evict_if_needed_async_spill_budget`, which hardcode a no-op sink.
+  When a script's write pushed the shard over `maxmemory`, whatever
+  BYSTANDER key the policy sampled (never anything the script itself
+  touched) was plain-dropped with no AOF/replication record — invisible
+  eviction, same class of bug as every other Wave-A plain-drop site this
+  branch fixed elsewhere. New `eviction::try_evict_if_needed_async_spill_budget_reporting`
+  wrapper (mirroring the existing `try_evict_if_needed_budget_reporting`);
+  `gate` now threads a real sink through to `record_reason_del_conn` with
+  the gate's own `db_index`. Unit-level regression test (not a full
+  black-box EVAL+replica repro, to avoid a flaky multi-process harness for
+  a pure wiring check):
+  `scripting::bridge::tests::gate_reports_bystander_eviction_to_aof`.
+- **Same unwired-reporting bug at the two call sites ordinary writes
+  actually reach.** Black-box testing defect 1 (disk-offload enabled,
+  Hash victims, real replica) surfaced that the narrowly-described
+  `evict_one_with_spill`/`SpillContext` path above is effectively dead code
+  via any CLI configuration today — `spill_thread` and `shard_manifest` are
+  co-gated on the identical `disk_offload_enabled()` check, so the sync
+  `SpillContext::Some` branch that `persistence_tick` wires is never
+  actually constructed. The real reachable paths for an ordinary write
+  under `--disk-offload enable` are `server::conn::handler_monoio::
+  run_write_eviction_gate` (monoio) and `shard::spsc_handler::
+  spsc_eviction_gate` (cross-shard dispatch), and both had the identical
+  defect-3-class bug: their spill-sender branch called the non-reporting
+  `try_evict_if_needed_async_spill_budget` with a hardcoded no-op sink
+  (`spsc_eviction_gate` additionally had an already-plumbed
+  `on_plain_drop` parameter that this one branch silently discarded).
+  Fixed both to call `try_evict_if_needed_async_spill_budget_reporting`
+  with the real `record_reason_del_conn` sink, mirroring the sibling
+  no-spill-sender branch each function already had correct. New black-box
+  regression: `tests/replication_planes.rs`
+  `eviction_parity_hash_disk_offload_shards1`/`_shards4` (disk-offload
+  enabled, HSET-driven eviction, real replica attached). Note: full
+  dbsize equality is not asserted — the tick-driven memory-pressure
+  cascade's `evict_batch_durable_no_aof` batch spill is a real, correctly
+  *unreported* spill (durable cold copy + `cold_index` registration) for
+  non-string values too, so a residual share of evictions legitimately
+  never reach the replica. That cold copy is unreadable today for Hash/
+  List/Set/ZSet (`get_hash_ref_if_alive` and siblings never consult
+  `cold_index`, unlike the generic `Database::get()` path GET uses) — a
+  separate, pre-existing, out-of-scope gap — which is why the test gates
+  on a large-majority convergence ratio (0.70, matching this repo's own
+  `MERGE_RECALL_TOLERANCE`-style "good enough" convention) rather than
+  exact equality; before this fix the ratio was 0.0 (the replica retained
+  every hash key, full stop).
+
+**Known limitations (documented, not fixed here):**
+- `redis.pcall('SELECT', ...)` inside a script swallows the new
+  `SELECT`-rejection error into a Lua table instead of raising — the script
+  may continue running against the ORIGINAL db, silently, exactly as before
+  Wave A's `SELECT` lockout. Only `redis.call` fails loud. A real
+  multi-db-scripts feature (tracked as a follow-up) is the actual fix; until
+  then, avoid `redis.pcall('SELECT', ...)` in scripts.
+- Nondeterministic write commands issued inside a script (`SPOP`, `SRANDMEMBER`-
+  derived writes, etc.) replicate **verbatim** via `record_effect_write` (the
+  exact `cmd + args` the script invoked) and can diverge from the master on
+  a replica, exactly like any other verbatim-replicated nondeterministic
+  command in this codebase (pre-existing class, first exposed for Lua by
+  Wave A). A real fix requires replicating the script's *effects* in a
+  deterministic form, not the nondeterministic call itself — out of scope
+  for task #34.
+- `replication::state::fanout_hint_active()` is **sticky**: once ANY replica
+  has attached, it stays `true` for the rest of the process's lifetime (see
+  `FANOUT_HINT`, a one-way latch, not a live "is a replica currently
+  attached" flag). Consequence for operators: after the first-ever replica
+  attaches and later detaches, the monoio inline-SET fast path
+  (`server::conn::blocking::try_inline_dispatch`) stays permanently
+  disabled for that process — every subsequent `SET` falls back to the
+  generic dispatch path for the rest of the process's life, even with zero
+  replicas currently attached. A process restart is the only way back to
+  the fast path.
+
+### Added — Wave A part 1: `record_reason_del` dual-plane DEL emission (task #34)
+
+Master-side key removals for a reason OTHER than a client write command
+(active TTL expiry, `--maxmemory` eviction plain-drops) previously reached
+NEITHER the AOF plane nor the replication plane: the key vanished from the
+master's own keyspace, but an attached replica kept serving it forever, and
+a `kill -9` + restart against `--appendonly yes` resurrected it from the AOF
+replay (the AOF never recorded the DEL, only the original SET/write).
+
+- New `replication::reason_del::record_reason_del` (shard-event-loop
+  context, reuses `wal_append_and_fanout` — the same mechanism the
+  `ShardMessage::SwapDb` synthetic-command record already uses) and
+  `record_reason_del_conn` (connection-handler context, mirrors
+  `handler_monoio::ft::record_local_write_db`'s backlog/offset/fan-out
+  mechanics and adds the AOF leg that helper omits). Both emit a real
+  `DEL <key>` RESP record, respecting the fused-`SELECT` multi-db framing
+  every ordinary write already uses.
+- Wired into: active expiry's whole-key sweep (`expire_cycle`), background
+  eviction's plain-drop path (`timers::run_eviction`,
+  `persistence_tick::handle_memory_pressure`'s no-manifest fallback), the
+  inline fast-path SET eviction gate, the generic per-command write-eviction
+  gate, and the SPSC cross-shard write-eviction gate. Every call site is
+  restricted to `spill.is_none()` plain drops — a spilled/cold-tiered key is
+  NOT a delete and must never be reported here.
+- Fixed a related pre-existing gap found while wiring this: with
+  `--disk-offload disable`, `server::conn::blocking::try_inline_dispatch`
+  (the monoio inline SET fast path) fed the AOF but never the replication
+  backlog/fan-out at all — a plain `SET` on such a master silently never
+  reached an attached replica. `can_inline_writes` now also gates on
+  `!replication::state::fanout_hint_active()`, falling back to the generic
+  dispatch path (which replicates correctly) once any replica has ever
+  attached.
+- Known Wave-A-scoped gaps (documented, not silent): hash-field TTL reaps,
+  Lua `redis.call` write effects, per-db quota (`--db-maxmemory`) eviction,
+  and cross-db `COPY ... DB n` destination eviction do not yet emit —
+  tracked as follow-ups.
+
+### Added — Wave A part 2: Lua script write-effect replication + SELECT lockout (task #34)
+
+Continues part 1: a Lua script's `redis.call`/`redis.pcall` write effects
+previously reached NEITHER durability plane — `EVAL`/`EVALSHA` carry no
+`WRITE` command-metadata flag (by design, see below), so the generic
+per-command AOF/replication gate never saw them. A script's writes vanished
+on `kill -9` + restart against `--appendonly yes`, and an attached replica
+never observed them at all. `redis.call('SELECT', ...)` inside a script also
+silently corrupted state: dispatch's SELECT handler mutated only a local
+variable, so every subsequent write in the script kept landing in the
+ORIGINAL db while looking like it had switched.
+
+- `scripting::bridge::make_redis_call_fn` now records every successfully-
+  executed, `WRITE`-flagged inner command to both the AOF and replication
+  planes itself, immediately after each `redis.call`/`redis.pcall` returns
+  (not batched to script end) — a script that writes two keys and then
+  errors on a third still durably records the first two. New
+  `replication::reason_del::record_effect_write` (+ shared
+  `record_bytes_conn` core, refactored out of part 1's
+  `record_reason_del_conn`) does the emission: same fused-`SELECT`/backlog/
+  offset/fan-out mechanics as every other write path, recording the
+  verbatim `cmd + args` the script invoked.
+- `LuaEvictionCtx` (built once per shard at Lua-VM setup, already caching
+  the OOM eviction handles) now also carries `num_shards`/`repl_state`/
+  `aof_pool` for this emission — one addition at each of the 5 production
+  construction sites (4 in `shard::conn_accept`, 1 in
+  `server::conn::core::ConnectionContext::build_lua_eviction_ctx`, shared by
+  EVAL/EVALSHA and FCALL/FCALL_RO, which route through the identical
+  bridge closure).
+- `redis.call('SELECT', ...)` inside any script now fails loud with
+  `ERR SELECT inside scripts is not supported by moon yet` instead of
+  silently corrupting state — intercepted before dispatch, so no partial
+  write from the same call ever lands. A real multi-db-scripts feature is a
+  follow-up.
+- Deliberately did NOT flip `EVAL`/`EVALSHA` to `WRITE` in the command
+  metadata table — that would make the generic per-command AOF/replication
+  gate ALSO record the literal `EVAL <script> ...` invocation on top of the
+  effect records above, double-applying every write the script made (e.g.
+  an `INCR` landing as 2 instead of 1). Guarded by a new unit test
+  (`command::metadata::eval_evalsha_never_write_flagged`) and a black-box
+  regression test (`eval_incr_no_double_apply`). `FCALL` (unlike EVAL) IS
+  `WRITE`-flagged — mirrors upstream Redis Functions and only feeds ACL /
+  `READONLY`-replica gating, since `try_handle_functions` always consumes
+  FCALL before the generic AOF/replication block runs; it rides the same
+  single-emission bridge path.
+- Turns the 4 remaining RED tests in `tests/replication_planes.rs` green:
+  `eval_effects_parity_shards1`, `eval_effects_parity_shards4`,
+  `eval_writes_survive_restart`, `select_in_script_errors`. All 9 tests in
+  the suite (the 5 from part 1 plus the new `eval_incr_no_double_apply`)
+  pass.
+- Known gap, unchanged from today: a write-`EVAL` issued directly against a
+  read-only replica is not rejected (`try_enforce_readonly` only gates on
+  the `WRITE` metadata flag, which EVAL intentionally lacks) — tracked as a
+  follow-up; replicas never receive `EVAL` itself via replication (only the
+  effect records), so this cannot cause replication divergence, only local
+  replica-side corruption if a client is misdirected to write against a
+  replica directly.
+
 ### Fixed — test-harness port-flake sweep (task #18)
 
 33 integration suites that spawn a real `moon` process shared a copy-pasted
diff --git a/src/command/hash/mod.rs b/src/command/hash/mod.rs
index a0e91cf3..65e785d4 100644
--- a/src/command/hash/mod.rs
+++ b/src/command/hash/mod.rs
@@ -1093,7 +1093,7 @@ mod tests {
         let exp = db.now_ms() + 1_000;
         expire_field_at(&mut db, b"h", b"f", exp);
         db.set_cached_now_ms_for_test(exp + 1);
-        expire_cycle_direct(&mut db);
+        expire_cycle_direct(&mut db, &mut |_| {});
         assert_eq!(hget(&mut db, &make_args(&[b"h", b"f"])), Frame::Null);
         assert_eq!(hlen(&mut db, &make_args(&[b"h"])), Frame::Integer(1));
         assert_eq!(
@@ -1110,7 +1110,7 @@ mod tests {
         let exp = db.now_ms() + 1_000;
         expire_field_at(&mut db, b"h", b"f", exp);
         db.set_cached_now_ms_for_test(exp + 1);
-        expire_cycle_direct(&mut db);
+        expire_cycle_direct(&mut db, &mut |_| {});
         // After reaping the only TTL'd field, encoding must downgrade to plain Hash.
         // HEXPIRE XX on the surviving field must return -2 (no TTL).
         let r = hexpire(
@@ -1128,7 +1128,7 @@ mod tests {
         let exp = db.now_ms() + 1_000;
         expire_field_at(&mut db, b"h", b"f", exp);
         db.set_cached_now_ms_for_test(exp + 1);
-        expire_cycle_direct(&mut db);
+        expire_cycle_direct(&mut db, &mut |_| {});
         assert_eq!(
             hgetall(&mut db, &make_args(&[b"h"])),
             Frame::Array(framevec![])
diff --git a/src/command/metadata.rs b/src/command/metadata.rs
index 2338ab12..edad1d85 100644
--- a/src/command/metadata.rs
+++ b/src/command/metadata.rs
@@ -1015,6 +1015,34 @@ mod tests {
         }
     }
 
+    /// Wave A part 2 (task #34) double-apply guard: EVAL/EVALSHA must NEVER
+    /// gain the `WRITE` flag. `scripting::bridge::make_redis_call_fn` records
+    /// each successful inner `redis.call` write effect to the AOF/
+    /// replication planes itself (the ONLY emission for a script's writes —
+    /// there is no derived-from-metadata second emission). If EVAL/EVALSHA
+    /// were flagged `WRITE`, the generic per-command AOF/replication gate in
+    /// `handler_monoio::mod.rs` would ALSO record the literal `EVAL <script>
+    /// ...` command verbatim, and a replica replaying both the fused-effect
+    /// records AND the raw EVAL command would double-apply every write the
+    /// script made (e.g. an `INCR` landing as 2 instead of 1). FCALL is
+    /// deliberately excluded here: it IS `WRITE`-flagged (mirrors upstream
+    /// Redis Functions, where FCALL always requires write permission and
+    /// FCALL_RO is the read-only variant), but that flag only feeds ACL /
+    /// `READONLY`-replica gating — `try_handle_functions` always consumes
+    /// FCALL with `continue` before the generic per-command AOF/replication
+    /// block, so it never gets a second, redundant recording either.
+    #[test]
+    fn eval_evalsha_never_write_flagged() {
+        assert!(
+            !is_write(b"EVAL"),
+            "EVAL must not carry the WRITE flag — see scripting::bridge module docs"
+        );
+        assert!(
+            !is_write(b"EVALSHA"),
+            "EVALSHA must not carry the WRITE flag — see scripting::bridge module docs"
+        );
+    }
+
     /// Registry has a reasonable number of entries.
     #[test]
     fn command_count_reasonable() {
diff --git a/src/replication/mod.rs b/src/replication/mod.rs
index 09ba39bf..b6a7e18b 100644
--- a/src/replication/mod.rs
+++ b/src/replication/mod.rs
@@ -4,5 +4,6 @@ pub mod backlog;
 pub mod graph_sync;
 pub mod handshake;
 pub mod master;
+pub mod reason_del;
 pub mod replica;
 pub mod state;
diff --git a/src/replication/reason_del.rs b/src/replication/reason_del.rs
new file mode 100644
index 00000000..be0760ac
--- /dev/null
+++ b/src/replication/reason_del.rs
@@ -0,0 +1,400 @@
+//! `record_reason_del` — dual-plane (AOF + replication) `DEL <key>` emission
+//! for master-side key removals that happen for a reason OTHER than a client
+//! write command: active TTL expiry and eviction plain-drops (task #34,
+//! `.planning/rfcs/plane-replication-design.md`, Wave A).
+//!
+//! Before this module, three classes of removal reached neither plane: the
+//! key vanished from the master's own keyspace, but an attached replica kept
+//! serving it forever, and a `kill -9` + restart against `--appendonly yes`
+//! resurrected it from the AOF replay (the AOF never recorded the DEL, only
+//! the original SET). Both gaps are closed by threading this helper's two
+//! call shapes into every genuine plain-drop site:
+//!
+//! - [`record_reason_del`] — shard-event-loop context (background active
+//!   expiry, background eviction tick). Reuses
+//!   [`crate::shard::spsc_handler::wal_append_and_fanout`] verbatim — the
+//!   exact mechanism the `ShardMessage::SwapDb` synthetic-command record
+//!   already uses for a write with no originating client command. One call
+//!   does the WAL v3 log, the replication backlog append + offset advance +
+//!   deferred live fan-out, AND the AOF pool append (with its own SELECT
+//!   injection, PR #282), so a background-tick DEL gets bit-for-bit the same
+//!   durability and replica-delivery guarantees as an ordinary write.
+//!
+//! - [`record_reason_del_conn`] — connection-handler context (the inline
+//!   fast-path SET eviction gate and the generic per-command write-eviction
+//!   gate). These run off a per-connection monoio task, not the shard event
+//!   loop, so they only have `Option<Arc<RwLock<ReplicationState>>>` (not
+//!   the shard loop's pre-extracted `SharedBacklog`/`OffsetHandle`/
+//!   `Vec<ReplicaFanout>`) — mirrors
+//!   `handler_monoio::ft::record_local_write_db`'s mechanics (backlog
+//!   append + offset advance under one read-lock + deferred
+//!   `ShardMessage::ReplicaLiveFanout` self-queue push, same fused-`SELECT`
+//!   rule for multi-shard masters) and adds the AOF leg that
+//!   `record_local_write_db` deliberately omits (its callers already ride
+//!   the generic per-command AOF gate; a synthetic eviction DEL has no
+//!   client command to hang that off of).
+//!
+//! ⚠ Both flavors push to `shard::self_msg` (the live fan-out relay) or
+//! touch shard-owned state — monoio shard threads only, same restriction as
+//! every other producer in `self_msg`.
+//!
+//! ⚠ Callers MUST only invoke either flavor for a removal where the key is
+//! truly gone — a spilled/cold-tiered entry is NOT a delete (see the
+//! plain-drop vs. spill distinction in `storage::eviction`); emitting here
+//! for a spill would fabricate a phantom DEL that a replica or AOF replay
+//! would apply against a key the master can still serve from its cold tier.
+//!
+//! Wave A part 2 adds [`record_effect_write`], the connection-context
+//! counterpart for a **Lua script's** write effects: `src/scripting/
+//! bridge.rs`'s `redis.call`/`redis.pcall` closure has no `WRITE`
+//! command-metadata flag to hang the generic per-command AOF/replication
+//! gate off of (EVAL/EVALSHA/FCALL are deliberately left unflagged — see the
+//! bridge module docs), so every successfully-executed inner write command
+//! reached NEITHER plane before this. `record_effect_write` shares
+//! `record_reason_del_conn`'s exact emission mechanics (extracted into
+//! `record_bytes_conn` below) but records the verbatim `cmd + args` the
+//! script issued instead of a synthetic `DEL`.
+
+use bytes::Bytes;
+
+use crate::persistence::aof::{AOF_SPSC_BACKPRESSURE_BOUND, AofWriterPool, serialize_command};
+use crate::protocol::Frame;
+#[cfg(feature = "runtime-monoio")]
+use crate::replication::state::ReplicationState;
+
+/// Serialize `DEL <key>` as a RESP command record — the same wire form
+/// `aof::serialize_command` produces for any ordinary client command, so
+/// replica apply and AOF replay treat it identically to a real client DEL.
+fn serialize_del(key: &[u8]) -> Bytes {
+    let frame = Frame::Array(crate::framevec![
+        Frame::BulkString(Bytes::from_static(b"DEL")),
+        Frame::BulkString(Bytes::copy_from_slice(key)),
+    ]);
+    serialize_command(&frame)
+}
+
+/// Shard-event-loop-context DEL emission (active expiry, background
+/// eviction tick). See module docs.
+///
+/// `db` is the logical db the removed key lived in — threaded through to
+/// `wal_append_and_fanout` so its SELECT-on-db-change bookkeeping (and the
+/// AOF writer's own db-scoped SELECT injection) stay correct for multi-db
+/// deployments, exactly as every ordinary write already relies on.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn record_reason_del(
+    key: &[u8],
+    db: usize,
+    wal_writer: &mut Option<crate::persistence::wal_v3::segment::WalWriterV3>,
+    repl_backlog: &crate::replication::backlog::SharedBacklog,
+    replica_txs: &mut Vec<crate::shard::dispatch::ReplicaFanout>,
+    repl_state: &Option<crate::replication::state::OffsetHandle>,
+    shard_id: usize,
+    aof_pool: Option<&std::sync::Arc<AofWriterPool>>,
+    wal_kv_log: bool,
+) {
+    // Task #34 review (defect 2): hoist the exact same no-work gate
+    // `wal_append_and_fanout` checks internally to BEFORE `serialize_del`
+    // allocates the RESP record. Previously every background-tick removal
+    // (active expiry, eviction plain-drop) paid a `Bytes` allocation +
+    // `Frame`/`framevec` build even on a standalone server with no WAL, no
+    // replica, and no AOF pool wired — the single most common deployment
+    // shape. Behavior when there IS work is unchanged: the same predicate
+    // runs again inside `wal_append_and_fanout` (cheap, no allocation) and
+    // gates nothing differently.
+    if !crate::shard::spsc_handler::wal_fanout_has_work(
+        wal_writer,
+        replica_txs,
+        aof_pool,
+        wal_kv_log,
+    ) {
+        return;
+    }
+    let serialized = serialize_del(key);
+    // Fire-and-forget-on-loss like every other background-tick record (the
+    // client that originally SET the key is long gone; there is no response
+    // frame to fail loud through). A dropped AOF append here is already
+    // counted + `error!`-logged inside `send_append_bounded_blocking`.
+    let mut aof_budget = AOF_SPSC_BACKPRESSURE_BOUND;
+    let _ = crate::shard::spsc_handler::wal_append_and_fanout(
+        &serialized,
+        db,
+        wal_writer,
+        repl_backlog,
+        replica_txs,
+        repl_state,
+        shard_id,
+        aof_pool,
+        wal_kv_log,
+        &mut aof_budget,
+    );
+}
+
+/// Connection-handler-context DEL emission (inline fast-path SET eviction
+/// gate, generic per-command write-eviction gate). See module docs.
+///
+/// Monoio-only: both call sites (`server::conn::blocking::try_inline_dispatch`,
+/// `server::conn::handler_monoio::run_write_eviction_gate`) are
+/// `#[cfg(feature = "runtime-monoio")]`-gated — master-side PSYNC is
+/// monoio-only (CLAUDE.md), so a tokio-runtime build never needs this leg.
+#[cfg(feature = "runtime-monoio")]
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn record_reason_del_conn(
+    repl_state: &Option<std::sync::Arc<std::sync::RwLock<ReplicationState>>>,
+    shard_id: usize,
+    num_shards: usize,
+    aof_pool: Option<&std::sync::Arc<AofWriterPool>>,
+    db: usize,
+    key: &[u8],
+) {
+    // Task #34 review (defect 2): see `conn_has_work` doc comment. Skip the
+    // `serialize_del` allocation entirely when neither leg has any work.
+    if !conn_has_work(aof_pool) {
+        return;
+    }
+    record_bytes_conn(
+        repl_state,
+        shard_id,
+        num_shards,
+        aof_pool,
+        db,
+        serialize_del(key),
+    );
+}
+
+/// Lua-script write-effect emission (task #34 Wave A part 2). See module
+/// docs. Called from `scripting::bridge::LuaEvictionCtx::emit_effect`,
+/// immediately after a W-flagged `redis.call`/`redis.pcall` inner command
+/// returns a non-error `Frame` — so a script that writes two keys and then
+/// errors on a third still durably records the first two (effects emit as
+/// they happen, not batched at script end).
+///
+/// `cmd_and_args` is the exact wire form the script invoked (`frames[0]` is
+/// the command name, the rest its arguments) — recorded verbatim, the same
+/// "replicate the command, not a derived form" approach every other write
+/// path in moon uses.
+///
+/// Monoio-only for the same reason as [`record_reason_del_conn`]: master-side
+/// PSYNC and the shard self-msg relay this rides on are monoio-only.
+#[cfg(feature = "runtime-monoio")]
+pub(crate) fn record_effect_write(
+    repl_state: &Option<std::sync::Arc<std::sync::RwLock<ReplicationState>>>,
+    shard_id: usize,
+    num_shards: usize,
+    aof_pool: Option<&std::sync::Arc<AofWriterPool>>,
+    db: usize,
+    cmd_and_args: &[Frame],
+) {
+    // Task #34 review (defect 2): see `conn_has_work` doc comment. Skip the
+    // `Frame::Array`/`cmd_and_args.to_vec()`/`serialize_command` allocations
+    // entirely when neither leg has any work — a script's write effects on a
+    // standalone, AOF-off server previously paid a full record build for
+    // every single inner command, discarded immediately after.
+    if !conn_has_work(aof_pool) {
+        return;
+    }
+    let frame = Frame::Array(crate::protocol::FrameVec::from_vec(cmd_and_args.to_vec()));
+    let serialized = serialize_command(&frame);
+    record_bytes_conn(repl_state, shard_id, num_shards, aof_pool, db, serialized);
+}
+
+/// Cheap pre-check (task #34 review, defect 2): `true` iff either
+/// connection-context emission leg — replication (gated on the sticky
+/// `fanout_hint_active` Relaxed load) or AOF (gated on `aof_pool` being
+/// wired) — has any work to do. Hoisted to the top of every
+/// connection-context entry point ([`record_reason_del_conn`],
+/// [`record_effect_write`]) so the common "no replica ever attached AND no
+/// AOF pool wired" case costs one atomic load + one `Option` check, never a
+/// `Bytes`/`Frame` allocation. Mirrors the exact pair of checks
+/// `record_bytes_conn` already runs per-leg — this is not a new decision,
+/// only an earlier exit for the case where NEITHER leg would do anything.
+#[cfg(feature = "runtime-monoio")]
+#[inline]
+fn conn_has_work(aof_pool: Option<&std::sync::Arc<AofWriterPool>>) -> bool {
+    crate::replication::state::fanout_hint_active() || aof_pool.is_some()
+}
+
+/// Shared connection-context emission core: replication leg (gated on the
+/// cheap `fanout_hint_active` Relaxed load) + AOF leg. Extracted from
+/// `record_reason_del_conn` so [`record_effect_write`] rides the identical
+/// mechanics for an arbitrary pre-serialized record instead of only `DEL`.
+#[cfg(feature = "runtime-monoio")]
+fn record_bytes_conn(
+    repl_state: &Option<std::sync::Arc<std::sync::RwLock<ReplicationState>>>,
+    shard_id: usize,
+    num_shards: usize,
+    aof_pool: Option<&std::sync::Arc<AofWriterPool>>,
+    db: usize,
+    bytes: Bytes,
+) {
+    // Cheap first gate (one Relaxed load): skip the replication leg entirely
+    // until a replica has ever begun attaching — mirrors
+    // `handler_monoio::ft::replication_fanout_active`'s first check.
+    if crate::replication::state::fanout_hint_active() {
+        push_record_db(repl_state, shard_id, num_shards, db, bytes.clone());
+    }
+    if let Some(pool) = aof_pool {
+        let mut budget = AOF_SPSC_BACKPRESSURE_BOUND;
+        let _ = pool.send_append_bounded_blocking(shard_id, 0, db, bytes, &mut budget);
+    }
+}
+
+/// Db-aware record push — mirrors `handler_monoio::ft::record_local_write_db`
+/// exactly (fused `SELECT` prefix for multi-shard masters, emit-on-change
+/// `SELECT` tracking for single-shard masters), parameterized on a raw
+/// `repl_state` handle instead of `&ConnectionContext` so it is usable from
+/// call sites that don't carry a full connection context (the inline
+/// dispatch fast path only threads the individual fields it needs).
+#[cfg(feature = "runtime-monoio")]
+fn push_record_db(
+    repl_state: &Option<std::sync::Arc<std::sync::RwLock<ReplicationState>>>,
+    shard_id: usize,
+    num_shards: usize,
+    db: usize,
+    bytes: Bytes,
+) {
+    if num_shards > 1 {
+        let select = crate::persistence::aof::serialize_select_record(db);
+        let mut combined = Vec::with_capacity(select.len() + bytes.len());
+        combined.extend_from_slice(&select);
+        combined.extend_from_slice(&bytes);
+        push_record(repl_state, shard_id, Bytes::from(combined));
+        return;
+    }
+    let needs_select = repl_state.as_ref().is_some_and(|rs| {
+        rs.read().is_ok_and(|g| {
+            g.stream_db.get(shard_id).is_some_and(|slot| {
+                if slot.load(std::sync::atomic::Ordering::Relaxed) != db as i64 {
+                    slot.store(db as i64, std::sync::atomic::Ordering::Relaxed);
+                    true
+                } else {
+                    false
+                }
+            })
+        })
+    });
+    if needs_select {
+        push_record(
+            repl_state,
+            shard_id,
+            crate::persistence::aof::serialize_select_record(db),
+        );
+    }
+    push_record(repl_state, shard_id, bytes);
+}
+
+/// One backlog-append + offset-advance + deferred-fanout record push —
+/// mirrors `handler_monoio::ft::record_local_write` exactly.
+#[cfg(feature = "runtime-monoio")]
+fn push_record(
+    repl_state: &Option<std::sync::Arc<std::sync::RwLock<ReplicationState>>>,
+    shard_id: usize,
+    bytes: Bytes,
+) {
+    let mut end_offset = u64::MAX;
+    if let Some(rs) = repl_state.as_ref() {
+        if let Ok(g) = rs.read() {
+            if let Some(slot) = g.per_shard_backlogs.get(shard_id) {
+                if let Some(backlog) = slot.lock().as_mut() {
+                    backlog.append(&bytes);
+                }
+            }
+            end_offset = g.increment_shard_offset(shard_id, bytes.len() as u64);
+        }
+    }
+    crate::shard::self_msg::push(crate::shard::dispatch::ShardMessage::ReplicaLiveFanout {
+        bytes,
+        end_offset,
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// GREEN (defect 2 regression guard): with no WAL writer, no replica
+    /// fan-out targets, no `repl_state`, and no AOF pool, `record_reason_del`
+    /// must be a true no-op — in particular it must never even reach
+    /// `serialize_del`/`wal_append_and_fanout`'s internals. We can't assert
+    /// "zero allocations" without an allocation-counting harness (none exists
+    /// in this repo), so this pins the OBSERVABLE half of the contract: the
+    /// shared backlog is untouched (stays `None`) and the call returns
+    /// without panicking off the event-loop thread it would normally run on.
+    #[test]
+    fn record_reason_del_noop_when_nothing_wired() {
+        let repl_backlog: crate::replication::backlog::SharedBacklog =
+            std::sync::Arc::new(parking_lot::Mutex::new(None));
+        let mut replica_txs: Vec<crate::shard::dispatch::ReplicaFanout> = Vec::new();
+        let mut wal_writer: Option<crate::persistence::wal_v3::segment::WalWriterV3> = None;
+
+        record_reason_del(
+            b"gone",
+            0,
+            &mut wal_writer,
+            &repl_backlog,
+            &mut replica_txs,
+            &None,
+            0,
+            None,
+            false,
+        );
+
+        assert!(
+            repl_backlog.lock().is_none(),
+            "no-work gate must early-return before touching the backlog"
+        );
+    }
+
+    /// GREEN (defect 2 regression guard, has-work path): hoisting the gate
+    /// must not break emission when there IS work. With an AOF pool wired
+    /// (the "work" leg `wal_fanout_has_work` checks), the DEL record must
+    /// still reach the writer channel exactly as before the hoist.
+    #[test]
+    fn record_reason_del_still_emits_to_aof_when_wired() {
+        let (tx, rx) =
+            crate::runtime::channel::mpsc_bounded::<crate::persistence::aof::AofMessage>(16);
+        let pool = crate::persistence::aof::AofWriterPool::top_level(tx);
+
+        let repl_backlog: crate::replication::backlog::SharedBacklog =
+            std::sync::Arc::new(parking_lot::Mutex::new(None));
+        let mut replica_txs: Vec<crate::shard::dispatch::ReplicaFanout> = Vec::new();
+        let mut wal_writer: Option<crate::persistence::wal_v3::segment::WalWriterV3> = None;
+
+        record_reason_del(
+            b"gone",
+            0,
+            &mut wal_writer,
+            &repl_backlog,
+            &mut replica_txs,
+            &None,
+            0,
+            Some(&pool),
+            false,
+        );
+
+        match rx.try_recv() {
+            Ok(crate::persistence::aof::AofMessage::Append { bytes, .. }) => {
+                let text = String::from_utf8_lossy(&bytes);
+                assert!(
+                    text.contains("DEL") && text.contains("gone"),
+                    "expected a serialized DEL record, got {text:?}"
+                );
+            }
+            Ok(_) => panic!("expected an AofMessage::Append record"),
+            Err(e) => panic!("expected a queued AOF record, got recv error: {e:?}"),
+        }
+    }
+
+    /// `conn_has_work` (defect 2's connection-context gate): an AOF pool
+    /// being wired must ALONE be sufficient to report work, independent of
+    /// the sticky process-global `fanout_hint_active` flag (which this test
+    /// binary otherwise never sets — see `replication::state`'s doc comment
+    /// on `FANOUT_HINT`).
+    #[cfg(feature = "runtime-monoio")]
+    #[test]
+    fn conn_has_work_true_when_aof_pool_wired() {
+        let (tx, _rx) =
+            crate::runtime::channel::mpsc_bounded::<crate::persistence::aof::AofMessage>(16);
+        let pool = crate::persistence::aof::AofWriterPool::top_level(tx);
+        assert!(conn_has_work(Some(&pool)));
+    }
+}
diff --git a/src/scripting/bridge.rs b/src/scripting/bridge.rs
index 23066b85..2ffd69a0 100644
--- a/src/scripting/bridge.rs
+++ b/src/scripting/bridge.rs
@@ -5,20 +5,48 @@
 //! 1. Each shard is single-threaded (no concurrent access)
 //! 2. The pointer is valid for the entire duration of script execution
 //! 3. The pointer is cleared immediately after script execution
+//!
+//! ## Write-effects replication (task #34 Wave A part 2)
+//!
+//! `EVAL`/`EVALSHA` deliberately carry no `WRITE` command-metadata flag (see
+//! `command::metadata::eval_evalsha_never_write_flagged`), so the generic
+//! per-command AOF/replication gate in `handler_monoio` never sees the
+//! literal `EVAL <script> ...` invocation. Instead, [`make_redis_call_fn`]
+//! itself records each successfully-executed, `WRITE`-flagged inner
+//! `redis.call`/`redis.pcall` to both durability planes as it happens (see
+//! [`LuaEvictionCtx::emit_effect`] / `replication::reason_del::
+//! record_effect_write`) — this is the ONLY emission path for a script's
+//! writes. Flipping EVAL/EVALSHA to `WRITE` would double-log every write a
+//! script makes (the generic gate would replay the raw EVAL a second time
+//! on top of the effect records already emitted here) — do not do that.
+//!
+//! `FCALL` (unlike EVAL/EVALSHA) IS `WRITE`-flagged, mirroring upstream
+//! Redis Functions (FCALL always requires write permission; FCALL_RO is the
+//! read-only variant) — but that flag only feeds ACL / `READONLY`-replica
+//! gating. `try_handle_functions` always consumes FCALL with `continue`
+//! before the generic per-command AOF/replication block runs, so FCALL
+//! rides the exact same single-emission bridge path as EVAL/EVALSHA.
+//!
+//! `redis.call('SELECT', ...)` is rejected with a loud script error rather
+//! than executed — see the intercept in [`make_redis_call_fn`] for why
+//! silently allowing it would corrupt state.
 
 use std::cell::Cell;
 use std::path::PathBuf;
 use std::rc::Rc;
 use std::sync::Arc;
 
+use bytes::Bytes;
 use mlua::prelude::*;
 
 use crate::config::RuntimeConfig;
+use crate::persistence::aof::AofWriterPool;
 use crate::protocol::Frame;
+use crate::replication::state::ReplicationState;
 use crate::shard::shared_databases::ShardDatabases;
 use crate::storage::engine::StorageEngine;
 use crate::storage::eviction::{
-    try_evict_if_needed_async_spill_budget, try_evict_if_needed_budget,
+    try_evict_if_needed_async_spill_budget_reporting, try_evict_if_needed_budget_reporting,
 };
 use crate::storage::tiered::spill_thread::SpillRequest;
 
@@ -52,6 +80,18 @@ struct LuaEvictionInner {
     spill_sender: Option<flume::Sender<SpillRequest>>,
     spill_file_id: Rc<Cell<u64>>,
     disk_offload_dir: Option<PathBuf>,
+    /// Wave A part 2 (task #34): handles for dual-plane (AOF + replication)
+    /// emission of a script's write effects. See
+    /// [`LuaEvictionCtx::emit_effect`]. Only read under `runtime-monoio`
+    /// (master-side PSYNC and the shard self-msg relay this rides on are
+    /// monoio-only) — kept unconditional in the struct so every call site
+    /// stays feature-uniform instead of growing a second constructor.
+    #[cfg_attr(not(feature = "runtime-monoio"), allow(dead_code))]
+    num_shards: usize,
+    #[cfg_attr(not(feature = "runtime-monoio"), allow(dead_code))]
+    repl_state: Option<Arc<std::sync::RwLock<ReplicationState>>>,
+    #[cfg_attr(not(feature = "runtime-monoio"), allow(dead_code))]
+    aof_pool: Option<Arc<AofWriterPool>>,
 }
 
 impl LuaEvictionCtx {
@@ -64,6 +104,13 @@ impl LuaEvictionCtx {
     }
 
     /// Real gate, built from the shard's own handles at VM-setup time.
+    ///
+    /// `num_shards`/`repl_state`/`aof_pool` are the same handles
+    /// `ConnectionContext` carries — threaded through here so a script's
+    /// write effects (Wave A part 2) reach both durability planes exactly
+    /// like every other write path. They are stable for the shard's entire
+    /// lifetime, same as the pre-existing eviction handles this ctx already
+    /// caches once per shard.
     #[allow(clippy::too_many_arguments)]
     pub fn new(
         shard_databases: Arc<ShardDatabases>,
@@ -72,6 +119,9 @@ impl LuaEvictionCtx {
         spill_sender: Option<flume::Sender<SpillRequest>>,
         spill_file_id: Rc<Cell<u64>>,
         disk_offload_dir: Option<PathBuf>,
+        num_shards: usize,
+        repl_state: Option<Arc<std::sync::RwLock<ReplicationState>>>,
+        aof_pool: Option<Arc<AofWriterPool>>,
     ) -> Self {
         LuaEvictionCtx(Some(LuaEvictionInner {
             shard_databases,
@@ -80,6 +130,9 @@ impl LuaEvictionCtx {
             spill_sender,
             spill_file_id,
             disk_offload_dir,
+            num_shards,
+            repl_state,
+            aof_pool,
         }))
     }
 
@@ -89,6 +142,15 @@ impl LuaEvictionCtx {
     /// `CURRENT_DB` thread-local). Returns the standard OOM `Frame::Error`
     /// on failure; `Ok(())` if within budget, eviction succeeded, or
     /// `maxmemory` is unset.
+    ///
+    /// Task #34 review (defect 3): a script's write can push the shard over
+    /// `maxmemory` and force eviction of a BYSTANDER key — one this gate's
+    /// policy sampled, not necessarily anything the script itself touched.
+    /// Before this fix that plain-drop went through the non-reporting
+    /// eviction variants (a hardcoded no-op sink), so it never reached
+    /// `record_reason_del_conn` — an attached replica (or the AOF) never
+    /// learned the bystander key was gone. Wired to the exact same
+    /// dual-plane emission every other write-path eviction gate uses.
     fn gate(&self, db: &mut crate::storage::Database, db_index: usize) -> Result<(), Frame> {
         let Some(inner) = self.0.as_ref() else {
             return Ok(());
@@ -103,25 +165,84 @@ impl LuaEvictionCtx {
         }
         let rt = inner.runtime_config.read();
         let budget = inner.shard_databases.elastic_budget(inner.shard_id);
+        let mut on_plain_drop = |key: &[u8]| {
+            #[cfg(feature = "runtime-monoio")]
+            crate::replication::reason_del::record_reason_del_conn(
+                &inner.repl_state,
+                inner.shard_id,
+                inner.num_shards,
+                inner.aof_pool.as_ref(),
+                db_index,
+                key,
+            );
+            #[cfg(not(feature = "runtime-monoio"))]
+            {
+                let _ = key;
+            }
+        };
         let global_result = if let Some(sender) = &inner.spill_sender {
             let mut fid = inner.spill_file_id.get();
             let dir = inner
                 .disk_offload_dir
                 .as_deref()
                 .unwrap_or(std::path::Path::new("."));
-            let res = try_evict_if_needed_async_spill_budget(
-                db, &rt, sender, dir, &mut fid, db_index, budget,
+            let res = try_evict_if_needed_async_spill_budget_reporting(
+                db,
+                &rt,
+                sender,
+                dir,
+                &mut fid,
+                db_index,
+                budget,
+                &mut on_plain_drop,
             );
             inner.spill_file_id.set(fid);
             res
         } else {
-            try_evict_if_needed_budget(db, &rt, budget)
+            try_evict_if_needed_budget_reporting(db, &rt, budget, &mut on_plain_drop)
         };
         global_result?;
         // WS5b: per-db quota, additive and finer-grained than the
         // whole-instance maxmemory gate above. Zero-cost when unconfigured.
+        // NOT wired to `on_plain_drop` — pre-existing, documented gap (see
+        // `db_quota::check_db_maxmemory`'s own doc comment), out of scope
+        // for task #34.
         crate::storage::db_quota::check_db_maxmemory(db, db_index, &rt)
     }
+
+    /// Wave A part 2 (task #34): dual-plane (AOF + replication) emission of
+    /// one successfully-executed script write effect. Called from
+    /// `make_redis_call_fn` immediately after a W-flagged `redis.call`/
+    /// `redis.pcall` inner command returns a non-error `Frame` — so effects
+    /// emit as they happen (a script that writes two keys then errors on a
+    /// third still durably records the first two).
+    ///
+    /// `db_index` is the CONNECTION's selected db, unchanged for the whole
+    /// script now that `redis.call('SELECT', ...)` is rejected before
+    /// dispatch (see `make_redis_call_fn`) — there is exactly one db per
+    /// script execution.
+    ///
+    /// No-op for a disabled ctx (unit tests) and under `runtime-tokio`
+    /// (master-side PSYNC and the shard self-msg relay this rides on are
+    /// monoio-only — see `replication::reason_del::record_effect_write`).
+    fn emit_effect(&self, db_index: usize, cmd_and_args: &[Frame]) {
+        let Some(_inner) = self.0.as_ref() else {
+            return;
+        };
+        #[cfg(feature = "runtime-monoio")]
+        crate::replication::reason_del::record_effect_write(
+            &_inner.repl_state,
+            _inner.shard_id,
+            _inner.num_shards,
+            _inner.aof_pool.as_ref(),
+            db_index,
+            cmd_and_args,
+        );
+        #[cfg(not(feature = "runtime-monoio"))]
+        {
+            let _ = (db_index, cmd_and_args);
+        }
+    }
 }
 
 thread_local! {
@@ -212,6 +333,21 @@ pub fn make_redis_call_fn(
             let mut db_idx = CURRENT_DB_IDX.with(|c| c.get());
             let db_count = CURRENT_DB_COUNT.with(|c| c.get());
 
+            // Wave A (task #34): `redis.call('SELECT', ...)` used to silently
+            // corrupt state — the generic dispatch SELECT handler mutates
+            // only the LOCAL `db_idx` below, but every write in this closure
+            // still lands on `db`, the ONE `Database` this script execution
+            // is pinned to (the `CURRENT_DB` thread-local is set once, by
+            // `set_script_db`, before the script starts). A script that
+            // called SELECT therefore kept writing the ORIGINAL db while
+            // looking like it had switched. Fail loud instead of corrupting
+            // a second db; a real multi-db-scripts feature is a follow-up.
+            if cmd_bytes.eq_ignore_ascii_case(b"SELECT") {
+                return Ok(Frame::Error(Bytes::from_static(
+                    b"ERR SELECT inside scripts is not supported by moon yet",
+                )));
+            }
+
             // Reject non-readonly commands in read-only mode (FCALL_RO / EVAL_RO)
             // Use positive allowlist (READONLY flag) instead of negative blocklist (!WRITE)
             // to also block PUBLISH and other side-effecting commands.
@@ -236,6 +372,18 @@ pub fn make_redis_call_fn(
             }
 
             let frame = db.execute_command(&cmd_bytes, &frames[1..], &mut db_idx, db_count);
+
+            // Wave A part 2 (task #34): dual-plane (AOF + replication)
+            // emission of the effect, immediately after each successful
+            // write — not batched to script end, so a partially-failing
+            // script still durably records its completed writes. Skipped
+            // for FCALL_RO / EVAL_RO (`cmd_is_write` implies the read-only
+            // gate above already passed, so a write here only happens in a
+            // normal read-write script).
+            if cmd_is_write && !matches!(frame, Frame::Error(_)) {
+                eviction_ctx.emit_effect(db_idx, &frames);
+            }
+
             Ok(frame)
         })?;
 
@@ -252,3 +400,128 @@ pub fn make_redis_call_fn(
         crate::scripting::types::frame_to_lua_value(lua, &result)
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::RuntimeConfig;
+    use crate::shard::shared_databases::ShardDatabases;
+    use crate::storage::Database;
+
+    fn make_config(maxmemory: usize, policy: &str) -> RuntimeConfig {
+        RuntimeConfig {
+            maxmemory,
+            maxmemory_policy: policy.to_string(),
+            maxmemory_samples: 5,
+            db_maxmemory: Vec::new(),
+            lfu_log_factor: 10,
+            lfu_decay_time: 1,
+            save: None,
+            appendonly: "no".to_string(),
+            appendfsync: "everysec".to_string(),
+            aclfile: None,
+            dir: ".".to_string(),
+            requirepass: None,
+            protected_mode: "yes".to_string(),
+            acllog_max_len: 128,
+            client_pause_deadline_ms: 0,
+            client_pause_write_only: false,
+            lazyfree_threshold: 64,
+            maxclients: 10000,
+            timeout: 0,
+            tcp_keepalive: 300,
+            num_shards: 1,
+        }
+    }
+
+    /// Unit-level test of the gate wiring (defect 3, task #34 review): a
+    /// black-box EVAL repro (fill via normal SETs, EVAL a write that tips
+    /// the shard over `maxmemory`, assert an attached replica also loses the
+    /// bystander) is possible but adds a full Lua VM + replica harness for a
+    /// single wiring check — this pins the same fact directly against
+    /// `LuaEvictionCtx::gate`, which is what actually changed.
+    ///
+    /// RED (before the fix): `gate` called the non-reporting
+    /// `try_evict_if_needed_budget`/`try_evict_if_needed_async_spill_budget`,
+    /// which pass a hardcoded no-op sink all the way down — a bystander key
+    /// evicted here to make room for the script's write never reached
+    /// `record_reason_del_conn`, so it never reached the AOF pool (nor an
+    /// attached replica). GREEN (after): the gate now threads a real sink
+    /// through to `record_reason_del_conn`, and the AOF pool observes a
+    /// `DEL` for the evicted bystander key.
+    #[test]
+    #[cfg(feature = "runtime-monoio")]
+    fn gate_reports_bystander_eviction_to_aof() {
+        // Deliberately give the ctx a real `spill_sender` (`Some(..)`) so
+        // `gate`'s lock-free fast path (`spill_sender.is_none() && !
+        // maxmemory_is_set() && !db_maxmemory_any_set()`) is false by
+        // construction, regardless of `MAXMEMORY_GLOBAL`'s CURRENT value —
+        // that atomic is process-global and mutated by other tests running
+        // concurrently in this same `cargo test --lib` binary
+        // (`eviction::tests::maxmemory_publish_and_is_set_roundtrip`), so
+        // depending on its value here would be flaky under parallel test
+        // execution. `manifest` is always `None` at this call site (real
+        // production behavior, not a test shortcut — see
+        // `try_evict_if_needed_async_spill_budget_reporting`'s doc comment),
+        // and `config.appendonly == "no"` (the `make_config` default), so
+        // this deterministically takes the "no manifest reachable" plain-
+        // drop fallback inside `try_evict_if_needed_async_spill_with_total_budget_reporting`
+        // — the sender/shard_dir below are never actually touched by that
+        // branch, just required by the signature.
+        let (shard_databases, _inits) = ShardDatabases::new(vec![vec![Database::new()]]);
+        let runtime_config = Arc::new(parking_lot::RwLock::new(make_config(1, "allkeys-lru")));
+
+        let (tx, rx) =
+            crate::runtime::channel::mpsc_bounded::<crate::persistence::aof::AofMessage>(64);
+        let pool = crate::persistence::aof::AofWriterPool::top_level(tx);
+
+        let (spill_tx, _spill_rx) =
+            flume::bounded::<crate::storage::tiered::spill_thread::SpillRequest>(4);
+        let tmp = tempfile::tempdir().unwrap();
+
+        let ctx = LuaEvictionCtx::new(
+            shard_databases,
+            runtime_config,
+            0,
+            Some(spill_tx),
+            Rc::new(Cell::new(1)),
+            Some(tmp.path().to_path_buf()),
+            1,    // num_shards
+            None, // repl_state
+            Some(pool),
+        );
+
+        let mut db = Database::new();
+        for i in 0..50 {
+            db.set_string(
+                Bytes::from(format!("bystander:{i}")),
+                Bytes::from(vec![0u8; 200]),
+            );
+        }
+        let before_len = db.len();
+        assert!(before_len > 0, "setup invariant: fixture must be non-empty");
+
+        // maxmemory=1 byte forces the allkeys-lru policy to evict bystander
+        // keys down toward empty on the very next gate check — none of them
+        // are anything a script wrote (this call simulates the check BEFORE
+        // the script's own write executes).
+        let result = ctx.gate(&mut db, 0);
+        assert!(result.is_ok(), "gate must succeed once the db is emptied");
+        assert!(
+            db.len() < before_len,
+            "setup invariant: gate must have evicted at least one bystander key"
+        );
+
+        let mut saw_del_for_bystander = false;
+        while let Ok(crate::persistence::aof::AofMessage::Append { bytes, .. }) = rx.try_recv() {
+            let text = String::from_utf8_lossy(&bytes);
+            if text.contains("DEL") && text.contains("bystander:") {
+                saw_del_for_bystander = true;
+            }
+        }
+        assert!(
+            saw_del_for_bystander,
+            "bystander eviction inside the Lua gate must emit a DEL record to the AOF plane"
+        );
+    }
+}
diff --git a/src/server/conn/blocking.rs b/src/server/conn/blocking.rs
index fafb5153..c5830b80 100644
--- a/src/server/conn/blocking.rs
+++ b/src/server/conn/blocking.rs
@@ -1382,7 +1382,32 @@ pub(crate) fn try_inline_dispatch(
         if !crate::storage::eviction::inline_write_can_skip_eviction(est, budget) {
             let rt = runtime_config.read();
             let oom = crate::shard::slice::with_shard_db(selected_db, |db| {
-                crate::storage::eviction::try_evict_if_needed_budget(db, &rt, budget).is_err()
+                crate::storage::eviction::try_evict_if_needed_budget_reporting(
+                    db,
+                    &rt,
+                    budget,
+                    // task #34 (Wave A): the inline SET fast path is the
+                    // ONLY write-eviction gate that can plain-drop a key
+                    // with zero AOF/replication visibility today — the
+                    // key vanishes from RAM but the client's `+OK` and any
+                    // attached replica/AOF replay never learn it happened.
+                    // `can_inline_writes` (this path's caller) already
+                    // forces the generic dispatch path once a replica has
+                    // ever attached (`fanout_hint_active`), so this sink's
+                    // replication leg is a cheap no-op in that case; the
+                    // AOF leg still fires unconditionally.
+                    &mut |key| {
+                        crate::replication::reason_del::record_reason_del_conn(
+                            repl_state,
+                            shard_id,
+                            num_shards,
+                            aof_pool.as_ref(),
+                            selected_db,
+                            key,
+                        );
+                    },
+                )
+                .is_err()
             });
             drop(rt);
             if oom {
diff --git a/src/server/conn/core.rs b/src/server/conn/core.rs
index 9c7a78b0..8cd0c4a8 100644
--- a/src/server/conn/core.rs
+++ b/src/server/conn/core.rs
@@ -180,6 +180,9 @@ impl ConnectionContext {
             self.spill_sender.clone(),
             self.spill_file_id.clone(),
             self.disk_offload_dir.clone(),
+            self.num_shards,
+            self.repl_state.clone(),
+            self.aof_pool.clone(),
         )
     }
 }
diff --git a/src/server/conn/handler_monoio/mod.rs b/src/server/conn/handler_monoio/mod.rs
index f3f3f80a..c204d384 100644
--- a/src/server/conn/handler_monoio/mod.rs
+++ b/src/server/conn/handler_monoio/mod.rs
@@ -24,7 +24,7 @@ use crate::protocol::Frame;
 use crate::shard::dispatch::key_to_shard;
 use crate::shard::mesh::ChannelMesh;
 use crate::storage::eviction::{
-    try_evict_if_needed_async_spill_budget, try_evict_if_needed_budget,
+    try_evict_if_needed_async_spill_budget_reporting, try_evict_if_needed_budget_reporting,
 };
 use crate::workspace::{strip_workspace_prefix_from_response, workspace_rewrite_args};
 
@@ -76,6 +76,20 @@ pub enum MonoioHandlerResult {
 /// Reads the runtime config, fetches this shard's elastic budget (GAP-1),
 /// and runs the spill-aware evictor when disk offload is wired, the plain
 /// budget evictor otherwise. Returns the evictor's OOM frame verbatim.
+///
+/// Task #34 review (defect 1 follow-through): this gate has no
+/// `ShardManifest` handle (only the tick-driven memory-pressure cascade in
+/// `persistence_tick.rs` does), so under `--disk-offload enable` the
+/// spill-sender branch below reliably takes the "no manifest reachable"
+/// plain-drop fallback inside
+/// `try_evict_if_needed_async_spill_with_total_budget_reporting` for EVERY
+/// write past `maxmemory` — this is, empirically, the actual eviction path a
+/// live server hits on ordinary writes (HSET, SET, ...) under disk-offload,
+/// not the sync `SpillContext` path. It previously called the non-reporting
+/// wrapper (hardcoded no-op sink), so those plain-drops never reached
+/// `record_reason_del_conn` — silently unreported eviction under the single
+/// most common disk-offload deployment shape. Now wired to the same sink the
+/// no-spill-sender branch below already uses.
 #[cfg(feature = "runtime-monoio")]
 fn run_write_eviction_gate(
     ctx: &super::core::ConnectionContext,
@@ -91,12 +105,43 @@ fn run_write_eviction_gate(
             .disk_offload_dir
             .as_deref()
             .unwrap_or(std::path::Path::new("."));
-        let res =
-            try_evict_if_needed_async_spill_budget(db, &rt, sender, dir, &mut fid, sel_db, budget);
+        let res = try_evict_if_needed_async_spill_budget_reporting(
+            db,
+            &rt,
+            sender,
+            dir,
+            &mut fid,
+            sel_db,
+            budget,
+            &mut |key| {
+                crate::replication::reason_del::record_reason_del_conn(
+                    &ctx.repl_state,
+                    ctx.shard_id,
+                    ctx.num_shards,
+                    ctx.aof_pool.as_ref(),
+                    sel_db,
+                    key,
+                );
+            },
+        );
         ctx.spill_file_id.set(fid);
         res
     } else {
-        try_evict_if_needed_budget(db, &rt, budget)
+        // task #34 (Wave A): plain-drop eviction on the generic per-command
+        // write path (the local-shard leg of any write when disk-offload is
+        // off/unwired) — emit a dual-plane DEL for every victim so an
+        // attached replica and the AOF replay converge with the master's
+        // own eviction decision.
+        try_evict_if_needed_budget_reporting(db, &rt, budget, &mut |key| {
+            crate::replication::reason_del::record_reason_del_conn(
+                &ctx.repl_state,
+                ctx.shard_id,
+                ctx.num_shards,
+                ctx.aof_pool.as_ref(),
+                sel_db,
+                key,
+            );
+        })
     };
     // WS6 fix (HIGH, adversarial review 2026-07-08): a command that can only
     // shrink memory (HDEL, SREM, LPOP, ...) must never be REJECTED by either
@@ -628,12 +673,31 @@ pub(crate) async fn handle_connection_sharded_monoio<
             // CLIENT TRACKING invalidation hook, so ANY tracking client in
             // the process (not just this conn) forces writes through the
             // normal path. One relaxed atomic load; free when tracking is off.
+            //
+            // task #34 (Wave A) fix: `try_inline_dispatch`'s SET fast path
+            // (`server::conn::blocking`) does NOT feed the replication
+            // backlog/fan-out at all — only `record_local_write`/
+            // `record_local_write_db` (the generic dispatch path) do.
+            // Before this gate, a master with `--disk-offload disable` and
+            // an attached replica silently dropped every plain `SET` from
+            // the replication stream (verified: a lone `SET foo bar` never
+            // reached the replica). `!fanout_hint_active()` — the same
+            // cheap, never-cleared-once-true Relaxed load
+            // `handler_monoio::ft::replication_fanout_active` uses as its
+            // first gate — forces plain SET onto the generic dispatch path
+            // for the rest of the process once any replica has ever begun
+            // attaching, matching the existing `ctx.spill_sender.is_none()`
+            // precedent of "fall back to the full path when it must do more
+            // than this fast path knows how to do". GET inlining is
+            // unaffected (`is_get` in `try_inline_dispatch` doesn't check
+            // `can_inline_writes`).
             let can_inline_writes = conn.acl_skip_allowed()
                 && !conn.in_multi
                 && !conn.tracking_state.enabled
                 && !crate::tracking::tracking_active()
                 && !is_replica
-                && ctx.spill_sender.is_none();
+                && ctx.spill_sender.is_none()
+                && !crate::replication::state::fanout_hint_active();
             let inlined = try_inline_dispatch_loop(
                 &mut read_buf,
                 &mut write_buf,
diff --git a/src/server/expiration.rs b/src/server/expiration.rs
index a2e5df51..8c9b90c3 100644
--- a/src/server/expiration.rs
+++ b/src/server/expiration.rs
@@ -28,7 +28,12 @@ pub async fn run_active_expiration(db: SharedDatabases, shutdown: CancellationTo
             _ = interval.tick() => {
                 for lock in db.iter() {
                     let mut guard = lock.write();
-                    expire_cycle(&mut *guard);
+                    // task #34 (Wave A): tokio's active-expiry sweep does not
+                    // emit `record_reason_del` — master-side PSYNC is
+                    // monoio-only (CLAUDE.md), so a tokio-runtime process is
+                    // never a replication master; a no-op sink preserves
+                    // today's behavior exactly.
+                    expire_cycle(&mut guard, &mut |_| {});
                 }
             }
             _ = shutdown.cancelled() => {
@@ -43,7 +48,17 @@ pub async fn run_active_expiration(db: SharedDatabases, shutdown: CancellationTo
 ///
 /// Shards call this directly on their owned databases without going through
 /// the `SharedDatabases` wrapper (no Arc/RwLock needed in shared-nothing mode).
-pub fn expire_cycle_direct(db: &mut Database) {
+///
+/// `on_removed` fires once per whole-key removal from the probabilistic
+/// sweep (sweep 1) — task #34 (Wave A): the shard event loop's
+/// `run_active_expiry` uses this to emit a dual-plane `DEL` record for every
+/// key the sweep actually deletes, so an attached replica and the AOF replay
+/// both observe the master's own expiry decision instead of racing their own
+/// independent TTL sweeps. Hash-field TTL reaps (sweep 2) deliberately do
+/// NOT fire `on_removed` in Wave A — see the RFC's accepted-gap note
+/// (replicas run the identical reaper against the identical TTLs, a bounded
+/// divergence documented in CHANGELOG rather than wired up here).
+pub fn expire_cycle_direct(db: &mut Database, on_removed: &mut dyn FnMut(&[u8])) {
     // Fast path: if the DB-level flag latches "no expiring keys", skip the
     // O(N) `keys_with_expiry()` scan entirely. Discovered by flamegraph:
     // with 100K TTL-less keys, the per-tick scan was consuming ~26% of
@@ -53,7 +68,7 @@ pub fn expire_cycle_direct(db: &mut Database) {
     if !db.maybe_has_expiring_keys() {
         return;
     }
-    expire_cycle(db);
+    expire_cycle(db, on_removed);
 }
 
 /// Run one probabilistic expiration cycle on a single database.
@@ -71,7 +86,7 @@ pub fn expire_cycle_direct(db: &mut Database) {
 /// `maybe_has_expiring_keys` is cleared only when **both** sweeps return
 /// empty, so a database with hash-field TTLs but no whole-key TTLs is not
 /// incorrectly short-circuited on the next tick.
-fn expire_cycle(db: &mut Database) {
+fn expire_cycle(db: &mut Database, on_removed: &mut dyn FnMut(&[u8])) {
     let start = Instant::now();
     let budget = Duration::from_millis(1);
     let mut rng = rand::rng();
@@ -90,6 +105,7 @@ fn expire_cycle(db: &mut Database) {
         for key in &sampled {
             if db.is_key_expired(key.as_bytes()) {
                 db.remove(key.as_bytes());
+                on_removed(key.as_bytes());
                 expired_count += 1;
             }
         }
@@ -158,7 +174,7 @@ mod tests {
             db.set(key, Entry::new_string(Bytes::from_static(b"v")));
         }
 
-        expire_cycle(&mut db);
+        expire_cycle(&mut db, &mut |_| {});
 
         // All expired keys should be removed
         for i in 0..10 {
@@ -190,7 +206,7 @@ mod tests {
         db.set_string(Bytes::from_static(b"k1"), Bytes::from_static(b"v1"));
         db.set_string(Bytes::from_static(b"k2"), Bytes::from_static(b"v2"));
 
-        expire_cycle(&mut db);
+        expire_cycle(&mut db, &mut |_| {});
 
         // Nothing should change
         assert_eq!(db.len(), 2);
@@ -199,7 +215,7 @@ mod tests {
     #[test]
     fn test_expire_cycle_empty_db() {
         let mut db = Database::new();
-        expire_cycle(&mut db);
+        expire_cycle(&mut db, &mut |_| {});
         assert_eq!(db.len(), 0);
     }
 
@@ -242,7 +258,7 @@ mod tests {
 
         // The hash key still exists; "f" is expired, "g" is live.
         assert_eq!(db.len(), 1);
-        expire_cycle(&mut db);
+        expire_cycle(&mut db, &mut |_| {});
 
         // Key must still exist (g is alive).
         assert_eq!(db.len(), 1);
@@ -257,7 +273,7 @@ mod tests {
         let mut db = Database::new();
         seed_hash_with_expired_field(&mut db, b"h", &[(b"f", b"v")], b"f");
 
-        expire_cycle(&mut db);
+        expire_cycle(&mut db, &mut |_| {});
 
         // Key must be entirely removed.
         assert_eq!(db.len(), 0);
diff --git a/src/shard/conn_accept.rs b/src/shard/conn_accept.rs
index eec250c9..cbd4d327 100644
--- a/src/shard/conn_accept.rs
+++ b/src/shard/conn_accept.rs
@@ -192,6 +192,9 @@ pub(crate) fn spawn_tokio_connection(
                 spill_sender.clone(),
                 spill_file_id.clone(),
                 disk_offload_dir.clone(),
+                num_shards,
+                rs.clone(),
+                aof_pool.as_ref().map(Arc::clone),
             );
             *lua_opt = Some(
                 crate::scripting::setup_lua_vm(eviction_ctx).expect("Lua VM initialization failed"),
@@ -425,6 +428,9 @@ pub(crate) fn spawn_migrated_tokio_connection(
                         spill_sender.clone(),
                         spill_file_id.clone(),
                         disk_offload_dir.clone(),
+                        num_shards,
+                        rs.clone(),
+                        aof_pool.as_ref().map(Arc::clone),
                     );
                     *lua_opt = Some(
                         crate::scripting::setup_lua_vm(eviction_ctx)
@@ -602,6 +608,9 @@ pub(crate) fn spawn_monoio_connection(
                         spill_tx.clone(),
                         spill_fid.clone(),
                         do_dir.clone(),
+                        num_shards,
+                        rs.clone(),
+                        aof_pool.as_ref().map(Arc::clone),
                     );
                     *lua_opt = Some(
                         crate::scripting::setup_lua_vm(eviction_ctx)
@@ -1007,6 +1016,9 @@ pub(crate) fn spawn_migrated_monoio_connection(
                         spill_sender.clone(),
                         spill_file_id.clone(),
                         disk_offload_dir.clone(),
+                        num_shards,
+                        rs.clone(),
+                        aof_pool.as_ref().map(Arc::clone),
                     );
                     *lua_opt = Some(
                         crate::scripting::setup_lua_vm(eviction_ctx)
diff --git a/src/shard/event_loop.rs b/src/shard/event_loop.rs
index 7a2d0971..284997b3 100644
--- a/src/shard/event_loop.rs
+++ b/src/shard/event_loop.rs
@@ -1647,7 +1647,18 @@ impl super::Shard {
                 }
                 // Cooperative active expiry + MQ triggers
                 _ = expiry_interval.0.tick() => {
-                    timers::run_active_expiry(&shard_databases, shard_id);
+                    timers::run_active_expiry(
+                        &shard_databases, shard_id,
+                        &mut wal_writer, &repl_backlog, &mut replica_txs, &repl_offsets,
+                        aof_pool.as_ref(),
+                        match wal_kv_log_mode {
+                            crate::config::WalKvLogMode::On => true,
+                            crate::config::WalKvLogMode::Off => false,
+                            crate::config::WalKvLogMode::Auto => {
+                                !appendonly_enabled || !cdc_registry.is_empty()
+                            }
+                        },
+                    );
                     // MQ trigger check: fire debounced triggers
                     timers::fire_pending_mq_triggers(
                         &shard_databases,
@@ -1670,6 +1681,15 @@ impl super::Shard {
                         &mut wal_writer,
                         &script_cache_rc,
                         &spill_file_id,
+                        &repl_backlog, &mut replica_txs, &repl_offsets,
+                        aof_pool.as_ref(),
+                        match wal_kv_log_mode {
+                            crate::config::WalKvLogMode::On => true,
+                            crate::config::WalKvLogMode::Off => false,
+                            crate::config::WalKvLogMode::Auto => {
+                                !appendonly_enabled || !cdc_registry.is_empty()
+                            }
+                        },
                     );
 
                     // Reap idle io_uring connections (tokio+io_uring path).
@@ -2158,7 +2178,22 @@ impl super::Shard {
                 }
                 // expiry + eviction + MQ triggers: every 100ms (100 ticks)
                 if monoio_tick_counter % 100 == 0 {
-                    timers::run_active_expiry(&shard_databases, shard_id);
+                    timers::run_active_expiry(
+                        &shard_databases,
+                        shard_id,
+                        &mut wal_writer,
+                        &repl_backlog,
+                        &mut replica_txs,
+                        &repl_offsets,
+                        aof_pool.as_ref(),
+                        match wal_kv_log_mode {
+                            crate::config::WalKvLogMode::On => true,
+                            crate::config::WalKvLogMode::Off => false,
+                            crate::config::WalKvLogMode::Auto => {
+                                !appendonly_enabled || !cdc_registry.is_empty()
+                            }
+                        },
+                    );
                     persistence_tick::run_eviction_tick(
                         spill_thread.as_ref(),
                         &mut shard_manifest,
@@ -2171,6 +2206,17 @@ impl super::Shard {
                         &mut wal_writer,
                         &script_cache_rc,
                         &spill_file_id,
+                        &repl_backlog,
+                        &mut replica_txs,
+                        &repl_offsets,
+                        aof_pool.as_ref(),
+                        match wal_kv_log_mode {
+                            crate::config::WalKvLogMode::On => true,
+                            crate::config::WalKvLogMode::Off => false,
+                            crate::config::WalKvLogMode::Auto => {
+                                !appendonly_enabled || !cdc_registry.is_empty()
+                            }
+                        },
                     );
                     // MQ trigger check: fire debounced triggers
                     timers::fire_pending_mq_triggers(
diff --git a/src/shard/persistence_tick.rs b/src/shard/persistence_tick.rs
index f747f1c0..b3e5666b 100644
--- a/src/shard/persistence_tick.rs
+++ b/src/shard/persistence_tick.rs
@@ -295,6 +295,14 @@ pub(crate) fn run_eviction_tick(
     wal_v3_writer: &mut Option<crate::persistence::wal_v3::segment::WalWriterV3>,
     script_cache: &std::rc::Rc<std::cell::RefCell<crate::scripting::ScriptCache>>,
     spill_file_id: &std::rc::Rc<std::cell::Cell<u64>>,
+    // task #34 (Wave A): `record_reason_del` handles for plain-dropped
+    // eviction victims — threaded straight through to `timers::run_eviction`
+    // and `handle_memory_pressure`'s sync-spill-fallback branch.
+    repl_backlog: &crate::replication::backlog::SharedBacklog,
+    replica_txs: &mut Vec<crate::shard::dispatch::ReplicaFanout>,
+    repl_state: &Option<crate::replication::state::OffsetHandle>,
+    aof_pool: Option<&std::sync::Arc<crate::persistence::aof::AofWriterPool>>,
+    wal_kv_log: bool,
 ) {
     if let Some(spill_t) = spill_thread {
         apply_spill_completions(spill_t, shard_manifest, shard_databases, shard_id);
@@ -375,9 +383,24 @@ pub(crate) fn run_eviction_tick(
             next_file_id,
             wal_v3_writer,
             spill_thread,
+            repl_backlog,
+            replica_txs,
+            repl_state,
+            aof_pool,
+            wal_kv_log,
         );
     } else {
-        super::timers::run_eviction(shard_databases, shard_id, runtime_config);
+        super::timers::run_eviction(
+            shard_databases,
+            shard_id,
+            runtime_config,
+            wal_v3_writer,
+            repl_backlog,
+            replica_txs,
+            repl_state,
+            aof_pool,
+            wal_kv_log,
+        );
     }
 
     // Sync file ID back to the shared Cell so connection handlers see it.
@@ -540,6 +563,7 @@ pub(crate) fn should_run_pressure_cascade(
 ///
 /// Called from eviction timer tick when `disk_offload_enabled` is true and
 /// `should_run_pressure_cascade()` returns true.
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn handle_memory_pressure(
     page_cache: &Option<PageCache>,
     shard_databases: &std::sync::Arc<super::shared_databases::ShardDatabases>,
@@ -550,6 +574,12 @@ pub(crate) fn handle_memory_pressure(
     next_file_id: &mut u64,
     wal_v3: &mut Option<crate::persistence::wal_v3::segment::WalWriterV3>,
     spill_thread: Option<&crate::storage::tiered::spill_thread::SpillThread>,
+    // task #34 (Wave A): see `run_eviction_tick`.
+    repl_backlog: &crate::replication::backlog::SharedBacklog,
+    replica_txs: &mut Vec<crate::shard::dispatch::ReplicaFanout>,
+    repl_state: &Option<crate::replication::state::OffsetHandle>,
+    aof_pool: Option<&std::sync::Arc<crate::persistence::aof::AofWriterPool>>,
+    wal_kv_log: bool,
 ) {
     // Step 1: PageCache eviction -- evict up to 16 cold frames per tick.
     // This is the cheapest operation: no disk I/O, just invalidates cached pages.
@@ -650,7 +680,7 @@ pub(crate) fn handle_memory_pressure(
                     let sender = spill_t.sender();
                     for i in 0..db_count {
                         crate::shard::slice::with_shard_db(i, |db| {
-                            let _ = crate::storage::eviction::try_evict_if_needed_async_spill_with_total_budget(
+                            let _ = crate::storage::eviction::try_evict_if_needed_async_spill_with_total_budget_reporting(
                                 db,
                                 &rt,
                                 &sender,
@@ -660,6 +690,25 @@ pub(crate) fn handle_memory_pressure(
                                 i,
                                 budget,
                                 shard_manifest.as_mut(),
+                                // task #34 (Wave A): only the no-manifest,
+                                // `--appendonly no` plain-drop fallback
+                                // inside this function ever calls this sink
+                                // (the async-spill and durable-batch
+                                // branches leave a cold/AOF-recoverable
+                                // copy and never invoke it).
+                                &mut |key| {
+                                    crate::replication::reason_del::record_reason_del(
+                                        key,
+                                        i,
+                                        wal_v3,
+                                        repl_backlog,
+                                        replica_txs,
+                                        repl_state,
+                                        shard_id,
+                                        aof_pool,
+                                        wal_kv_log,
+                                    );
+                                },
                             );
                         });
                     }
@@ -675,16 +724,55 @@ pub(crate) fn handle_memory_pressure(
                                     manifest,
                                     next_file_id,
                                 };
-                                let _ = crate::storage::eviction::try_evict_if_needed_with_spill_and_total_budget(
+                                // Durable spill (manifest reachable): a
+                                // STRING victim stays cold-readable, never a
+                                // plain drop. But `evict_one_with_spill`'s
+                                // spill body is string-only (task #34 review,
+                                // defect 1) — a Hash/List/Set/ZSet victim
+                                // picked here is a genuine plain-drop with no
+                                // cold copy anywhere, and must still reach
+                                // `record_reason_del`. Thread the real
+                                // reporting sink (previously a hardcoded
+                                // no-op here, which silently swallowed those
+                                // emissions).
+                                let _ = crate::storage::eviction::try_evict_if_needed_with_spill_and_total_budget_reporting(
                                     db,
                                     &rt,
                                     Some(&mut ctx),
                                     total_mem,
                                     budget,
+                                    &mut |key| {
+                                        crate::replication::reason_del::record_reason_del(
+                                            key,
+                                            i,
+                                            wal_v3,
+                                            repl_backlog,
+                                            replica_txs,
+                                            repl_state,
+                                            shard_id,
+                                            aof_pool,
+                                            wal_kv_log,
+                                        );
+                                    },
                                 );
                             } else {
-                                let _ = crate::storage::eviction::try_evict_if_needed_with_spill_and_total_budget(
+                                // No manifest reachable: this IS the plain
+                                // -drop path (task #34, Wave A) — emit.
+                                let _ = crate::storage::eviction::try_evict_if_needed_with_spill_and_total_budget_reporting(
                                     db, &rt, None, total_mem, budget,
+                                    &mut |key| {
+                                        crate::replication::reason_del::record_reason_del(
+                                            key,
+                                            i,
+                                            wal_v3,
+                                            repl_backlog,
+                                            replica_txs,
+                                            repl_state,
+                                            shard_id,
+                                            aof_pool,
+                                            wal_kv_log,
+                                        );
+                                    },
                                 );
                             }
                         });
diff --git a/src/shard/spsc_handler.rs b/src/shard/spsc_handler.rs
index bc4e05d4..50b397ab 100644
--- a/src/shard/spsc_handler.rs
+++ b/src/shard/spsc_handler.rs
@@ -24,7 +24,7 @@ use crate::runtime::channel;
 use crate::storage::Database;
 use crate::storage::entry::CachedClock;
 use crate::storage::eviction::{
-    try_evict_if_needed_async_spill_budget, try_evict_if_needed_budget,
+    try_evict_if_needed_async_spill_budget_reporting, try_evict_if_needed_budget_reporting,
 };
 use crate::storage::tiered::spill_thread::SpillRequest;
 
@@ -46,6 +46,7 @@ use super::shared_databases::ShardDatabases;
 /// directly, bypassing the connection handlers' write path entirely — without
 /// this gate a scatter-gather write could grow a remote shard's memory past
 /// `maxmemory` without limit.
+#[allow(clippy::too_many_arguments)]
 pub(super) fn spsc_eviction_gate(
     db: &mut Database,
     db_idx: usize,
@@ -55,18 +56,42 @@ pub(super) fn spsc_eviction_gate(
     spill_sender: Option<&flume::Sender<SpillRequest>>,
     spill_file_id: &Rc<Cell<u64>>,
     disk_offload_dir: Option<&std::path::Path>,
+    // task #34 (Wave A): fires once per plain-dropped (non-spill) victim so
+    // the caller can emit a dual-plane DEL record. Callers build this from
+    // `record_reason_del` (event-loop-context flavor) — `drain_spsc_shared`
+    // already has the shard loop's pre-extracted `SharedBacklog`/
+    // `OffsetHandle`/`Vec<ReplicaFanout>` in scope for its own
+    // `wal_append_and_fanout` calls right next to each `spsc_eviction_gate`
+    // call site.
+    on_plain_drop: &mut dyn FnMut(&[u8]),
 ) -> Result<(), crate::protocol::Frame> {
     let rt = runtime_config.read();
     let budget = shard_databases.elastic_budget(shard_id);
     let global_result = if let Some(sender) = spill_sender {
         let mut fid = spill_file_id.get();
         let dir = disk_offload_dir.unwrap_or(std::path::Path::new("."));
-        let res =
-            try_evict_if_needed_async_spill_budget(db, &rt, sender, dir, &mut fid, db_idx, budget);
+        // Task #34 review (defect 1 follow-through): this gate has no
+        // `ShardManifest` handle either (same reasoning as
+        // `run_write_eviction_gate`'s doc comment) — a cross-shard write
+        // past `maxmemory` under `--disk-offload enable` reliably takes the
+        // "no manifest reachable" plain-drop fallback. Previously called the
+        // non-reporting wrapper (hardcoded no-op sink), silently dropping
+        // `on_plain_drop` on the floor for this branch even though the
+        // caller already threads a real one for the sibling branch below.
+        let res = try_evict_if_needed_async_spill_budget_reporting(
+            db,
+            &rt,
+            sender,
+            dir,
+            &mut fid,
+            db_idx,
+            budget,
+            on_plain_drop,
+        );
         spill_file_id.set(fid);
         res
     } else {
-        try_evict_if_needed_budget(db, &rt, budget)
+        try_evict_if_needed_budget_reporting(db, &rt, budget, on_plain_drop)
     };
     global_result?;
     // WS5b: per-db quota, additive and finer-grained than the whole-instance
@@ -663,6 +688,20 @@ pub(crate) fn handle_shard_message_shared(
                                     spill_sender,
                                     spill_file_id,
                                     disk_offload_dir,
+                                    // task #34 (Wave A): cross-shard write leg.
+                                    &mut |key| {
+                                        crate::replication::reason_del::record_reason_del(
+                                            key,
+                                            db_idx,
+                                            wal_writer,
+                                            repl_backlog,
+                                            replica_txs,
+                                            repl_state,
+                                            shard_id,
+                                            aof_pool,
+                                            wal_kv_log,
+                                        );
+                                    },
                                 ) {
                                     oom_frame = Some(oom);
                                     return;
@@ -896,6 +935,20 @@ pub(crate) fn handle_shard_message_shared(
                                 spill_sender,
                                 spill_file_id,
                                 disk_offload_dir,
+                                // task #34 (Wave A): cross-shard write leg.
+                                &mut |key| {
+                                    crate::replication::reason_del::record_reason_del(
+                                        key,
+                                        db_idx,
+                                        wal_writer,
+                                        repl_backlog,
+                                        replica_txs,
+                                        repl_state,
+                                        shard_id,
+                                        aof_pool,
+                                        wal_kv_log,
+                                    );
+                                },
                             ) {
                                 results.push(oom);
                                 continue;
@@ -1081,6 +1134,20 @@ pub(crate) fn handle_shard_message_shared(
                                 spill_sender,
                                 spill_file_id,
                                 disk_offload_dir,
+                                // task #34 (Wave A): cross-shard write leg.
+                                &mut |key| {
+                                    crate::replication::reason_del::record_reason_del(
+                                        key,
+                                        db_idx,
+                                        wal_writer,
+                                        repl_backlog,
+                                        replica_txs,
+                                        repl_state,
+                                        shard_id,
+                                        aof_pool,
+                                        wal_kv_log,
+                                    );
+                                },
                             ) {
                                 results.push(oom);
                                 continue;
@@ -1309,6 +1376,20 @@ pub(crate) fn handle_shard_message_shared(
                                     spill_sender,
                                     spill_file_id,
                                     disk_offload_dir,
+                                    // task #34 (Wave A): cross-shard write leg.
+                                    &mut |key| {
+                                        crate::replication::reason_del::record_reason_del(
+                                            key,
+                                            db_idx,
+                                            wal_writer,
+                                            repl_backlog,
+                                            replica_txs,
+                                            repl_state,
+                                            shard_id,
+                                            aof_pool,
+                                            wal_kv_log,
+                                        );
+                                    },
                                 ) {
                                     oom_frame = Some(oom);
                                     return;
@@ -1500,6 +1581,20 @@ pub(crate) fn handle_shard_message_shared(
                                 spill_sender,
                                 spill_file_id,
                                 disk_offload_dir,
+                                // task #34 (Wave A): cross-shard write leg.
+                                &mut |key| {
+                                    crate::replication::reason_del::record_reason_del(
+                                        key,
+                                        db_idx,
+                                        wal_writer,
+                                        repl_backlog,
+                                        replica_txs,
+                                        repl_state,
+                                        shard_id,
+                                        aof_pool,
+                                        wal_kv_log,
+                                    );
+                                },
                             ) {
                                 results.push(oom);
                                 continue;
@@ -1686,6 +1781,20 @@ pub(crate) fn handle_shard_message_shared(
                                 spill_sender,
                                 spill_file_id,
                                 disk_offload_dir,
+                                // task #34 (Wave A): cross-shard write leg.
+                                &mut |key| {
+                                    crate::replication::reason_del::record_reason_del(
+                                        key,
+                                        db_idx,
+                                        wal_writer,
+                                        repl_backlog,
+                                        replica_txs,
+                                        repl_state,
+                                        shard_id,
+                                        aof_pool,
+                                        wal_kv_log,
+                                    );
+                                },
                             ) {
                                 results.push(oom);
                                 continue;
diff --git a/src/shard/spsc_two_db.rs b/src/shard/spsc_two_db.rs
index 5e5ec374..abc83778 100644
--- a/src/shard/spsc_two_db.rs
+++ b/src/shard/spsc_two_db.rs
@@ -100,6 +100,15 @@ pub(crate) fn try_two_db_intercept(
                 // the same eviction gate as any other write. Gate on the
                 // DESTINATION db (the one that grows) before copy_core.
                 if evict_active {
+                    // task #34 (Wave A): a plain-dropped victim here (cross-db
+                    // `COPY ... DB n` growing the destination past budget) is
+                    // NOT wired to `record_reason_del` yet — this function
+                    // deliberately does no WAL/AOF/replication I/O ("no
+                    // persistence here" per the module doc), and threading
+                    // those handles through for the comparatively rare
+                    // cross-db COPY path is left as a follow-up alongside the
+                    // other documented Wave-A gaps (db-quota eviction, Lua
+                    // effects). A no-op sink preserves pre-#34 behavior.
                     if let Err(oom) = crate::shard::spsc_handler::spsc_eviction_gate(
                         dst,
                         ca.dst_db,
@@ -109,6 +118,7 @@ pub(crate) fn try_two_db_intercept(
                         spill_sender,
                         spill_file_id,
                         disk_offload_dir,
+                        &mut |_| {},
                     ) {
                         return oom;
                     }
diff --git a/src/shard/timers.rs b/src/shard/timers.rs
index e8fa3577..5a578ada 100644
--- a/src/shard/timers.rs
+++ b/src/shard/timers.rs
@@ -14,11 +14,41 @@ use super::shared_databases::ShardDatabases;
 
 /// Run cooperative active expiry across all databases.
 /// Shard 0 also updates the RSS gauge (once per expiry cycle, ~100ms).
-pub(crate) fn run_active_expiry(shard_databases: &Arc<ShardDatabases>, shard_id: usize) {
+///
+/// task #34 (Wave A): the `record_reason_del` handles are threaded through
+/// so every key the sweep actually removes gets a dual-plane (AOF +
+/// replication) `DEL` record — mirrors the `ShardMessage::SwapDb` synthetic
+/// -command pattern via `crate::replication::reason_del::record_reason_del`.
+/// Zero-cost when neither an AOF pool nor a replica/backlog is wired: the
+/// helper's own fast-path checks (`wal_fanout_has_work` inside
+/// `wal_append_and_fanout`) skip the serialization + fan-out entirely.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn run_active_expiry(
+    shard_databases: &Arc<ShardDatabases>,
+    shard_id: usize,
+    wal_writer: &mut Option<crate::persistence::wal_v3::segment::WalWriterV3>,
+    repl_backlog: &crate::replication::backlog::SharedBacklog,
+    replica_txs: &mut Vec<crate::shard::dispatch::ReplicaFanout>,
+    repl_state: &Option<crate::replication::state::OffsetHandle>,
+    aof_pool: Option<&Arc<crate::persistence::aof::AofWriterPool>>,
+    wal_kv_log: bool,
+) {
     let db_count = shard_databases.db_count();
     for i in 0..db_count {
         crate::shard::slice::with_shard_db(i, |db| {
-            crate::server::expiration::expire_cycle_direct(db);
+            crate::server::expiration::expire_cycle_direct(db, &mut |key| {
+                crate::replication::reason_del::record_reason_del(
+                    key,
+                    i,
+                    wal_writer,
+                    repl_backlog,
+                    replica_txs,
+                    repl_state,
+                    shard_id,
+                    aof_pool,
+                    wal_kv_log,
+                );
+            });
         });
     }
     // Update RSS gauge on shard 0 only, once per second (not every 100ms tick).
@@ -37,10 +67,22 @@ pub(crate) fn run_active_expiry(shard_databases: &Arc<ShardDatabases>, shard_id:
 }
 
 /// Run background eviction if maxmemory (or a per-db quota) is configured.
+///
+/// task #34 (Wave A): plain-dropped victims (no disk-offload spill in this
+/// path — `--disk-offload disable`, or disk-offload's own budget cascade
+/// handles the spill-capable case elsewhere) get a dual-plane `DEL` record
+/// via the same `record_reason_del` handles `run_active_expiry` uses.
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn run_eviction(
     shard_databases: &Arc<ShardDatabases>,
     shard_id: usize,
     runtime_config: &Arc<parking_lot::RwLock<RuntimeConfig>>,
+    wal_writer: &mut Option<crate::persistence::wal_v3::segment::WalWriterV3>,
+    repl_backlog: &crate::replication::backlog::SharedBacklog,
+    replica_txs: &mut Vec<crate::shard::dispatch::ReplicaFanout>,
+    repl_state: &Option<crate::replication::state::OffsetHandle>,
+    aof_pool: Option<&Arc<crate::persistence::aof::AofWriterPool>>,
+    wal_kv_log: bool,
 ) {
     let rt = runtime_config.read();
     if rt.maxmemory > 0 {
@@ -86,8 +128,21 @@ pub(crate) fn run_eviction(
         for i in 0..db_count {
             crate::shard::slice::with_shard_db(i, |db| {
                 let before = db.estimated_memory();
-                let _ = crate::storage::eviction::try_evict_if_needed_with_spill_and_total_budget(
+                let _ = crate::storage::eviction::try_evict_if_needed_with_spill_and_total_budget_reporting(
                     db, &rt, None, remaining, budget,
+                    &mut |key| {
+                        crate::replication::reason_del::record_reason_del(
+                            key,
+                            i,
+                            wal_writer,
+                            repl_backlog,
+                            replica_txs,
+                            repl_state,
+                            shard_id,
+                            aof_pool,
+                            wal_kv_log,
+                        );
+                    },
                 );
                 let freed = before.saturating_sub(db.estimated_memory());
                 remaining = remaining.saturating_sub(freed);
@@ -472,6 +527,28 @@ mod tests {
     use bytes::Bytes;
     use std::sync::atomic::Ordering;
 
+    /// No-replica/no-AOF `record_reason_del` handles for `run_eviction`
+    /// unit tests below — these tests exercise the eviction budget math
+    /// only, not task #34's dual-plane emission (covered end-to-end by
+    /// `tests/replication_planes.rs`).
+    struct NoOpReasonDelHandles {
+        wal_writer: Option<crate::persistence::wal_v3::segment::WalWriterV3>,
+        repl_backlog: crate::replication::backlog::SharedBacklog,
+        replica_txs: Vec<crate::shard::dispatch::ReplicaFanout>,
+        repl_state: Option<crate::replication::state::OffsetHandle>,
+    }
+
+    impl NoOpReasonDelHandles {
+        fn new() -> Self {
+            Self {
+                wal_writer: None,
+                repl_backlog: std::sync::Arc::new(parking_lot::Mutex::new(None)),
+                replica_txs: Vec::new(),
+                repl_state: None,
+            }
+        }
+    }
+
     /// A3 review fix (CRITICAL, both adversarial reviews): the shard-wide
     /// vector term must gate an AGGREGATE check (Σ all dbs' KV + vector),
     /// not be re-added to every logical db's independent check. The per-db
@@ -518,7 +595,18 @@ mod tests {
         shared.store_memory_per_shard[0]
             .vector
             .store(700 * 1024, Ordering::Relaxed);
-        run_eviction(&shared, 0, &runtime_config);
+        let mut h = NoOpReasonDelHandles::new();
+        run_eviction(
+            &shared,
+            0,
+            &runtime_config,
+            &mut h.wal_writer,
+            &h.repl_backlog,
+            &mut h.replica_txs,
+            &h.repl_state,
+            None,
+            false,
+        );
 
         let len0 = crate::shard::slice::with_shard_db(0, |db| db.len());
         let len1 = crate::shard::slice::with_shard_db(1, |db| db.len());
@@ -569,7 +657,18 @@ mod tests {
         let runtime_config = Arc::new(parking_lot::RwLock::new(rt));
 
         // KV alone (~tens of KB) is far under the 1 MiB budget: no eviction.
-        run_eviction(&shared, 0, &runtime_config);
+        let mut h = NoOpReasonDelHandles::new();
+        run_eviction(
+            &shared,
+            0,
+            &runtime_config,
+            &mut h.wal_writer,
+            &h.repl_backlog,
+            &mut h.replica_txs,
+            &h.repl_state,
+            None,
+            false,
+        );
         let before = crate::shard::slice::with_shard_db(0, |db| db.len());
         assert_eq!(before, 100, "KV under budget must not evict");
 
@@ -578,7 +677,17 @@ mod tests {
         shared.store_memory_per_shard[0]
             .vector
             .store(2 * 1024 * 1024, Ordering::Relaxed);
-        run_eviction(&shared, 0, &runtime_config);
+        run_eviction(
+            &shared,
+            0,
+            &runtime_config,
+            &mut h.wal_writer,
+            &h.repl_backlog,
+            &mut h.replica_txs,
+            &h.repl_state,
+            None,
+            false,
+        );
         let after = crate::shard::slice::with_shard_db(0, |db| db.len());
         assert!(
             after < before,
diff --git a/src/storage/db_quota.rs b/src/storage/db_quota.rs
index dd65fea0..d508584d 100644
--- a/src/storage/db_quota.rs
+++ b/src/storage/db_quota.rs
@@ -240,7 +240,14 @@ pub fn check_db_maxmemory(
         let before = db.estimated_memory();
         // No disk-offload spill integration for db-quota eviction — see the
         // module doc's "Known limitation" note.
-        if !eviction::evict_one_with_spill(db, config, &policy, None) {
+        //
+        // task #34 (Wave A): db-quota plain-drops are NOT wired into
+        // `record_reason_del` yet (a no-op sink here matches pre-#34
+        // behavior exactly) — `--db-maxmemory` is a separate, narrower
+        // knob from the whole-instance `--maxmemory` gates Wave A covers;
+        // tracked as a follow-up alongside the other documented Wave-A gaps
+        // (hash-field TTL reaps, Lua script effects).
+        if !eviction::evict_one_with_spill(db, config, &policy, None, &mut |_| {}) {
             return Err(db_quota_error(db_index, budget));
         }
         let after = db.estimated_memory();
diff --git a/src/storage/eviction.rs b/src/storage/eviction.rs
index 48d5ae55..9a0c2089 100644
--- a/src/storage/eviction.rs
+++ b/src/storage/eviction.rs
@@ -323,12 +323,31 @@ pub fn try_evict_if_needed_budget(
     config: &RuntimeConfig,
     budget_override: usize,
 ) -> Result<(), Frame> {
-    try_evict_if_needed_with_spill_and_total_budget(
+    try_evict_if_needed_budget_reporting(db, config, budget_override, &mut |_| {})
+}
+
+/// Like [`try_evict_if_needed_budget`], but reports every plain-dropped
+/// (non-spill) victim key to `on_plain_drop` — task #34 (Wave A):
+/// connection-handler-context write-eviction gates (inline SET fast path,
+/// generic per-command write path, SPSC cross-shard write path) use this to
+/// emit a dual-plane DEL record for keys the caller's eviction just deleted
+/// with no cold-tier copy. Callers that don't care (Lua bridge, the tokio
+/// handlers, unit tests) keep calling [`try_evict_if_needed_budget`], which
+/// forwards here with a no-op sink — behavior-identical to before this
+/// parameter existed.
+pub fn try_evict_if_needed_budget_reporting(
+    db: &mut Database,
+    config: &RuntimeConfig,
+    budget_override: usize,
+    on_plain_drop: &mut dyn FnMut(&[u8]),
+) -> Result<(), Frame> {
+    try_evict_if_needed_with_spill_and_total_budget_reporting(
         db,
         config,
         None,
         db.estimated_memory(),
         budget_override,
+        on_plain_drop,
     )
 }
 
@@ -369,11 +388,37 @@ pub fn try_evict_if_needed_with_spill_and_total(
 /// `ShardDatabases::recompute_elastic_budget`) lets a hot shard borrow
 /// headroom donated by under-budget siblings before evicting.
 pub fn try_evict_if_needed_with_spill_and_total_budget(
+    db: &mut Database,
+    config: &RuntimeConfig,
+    spill: Option<&mut SpillContext<'_>>,
+    total_memory: usize,
+    budget_override: usize,
+) -> Result<(), Frame> {
+    try_evict_if_needed_with_spill_and_total_budget_reporting(
+        db,
+        config,
+        spill,
+        total_memory,
+        budget_override,
+        &mut |_| {},
+    )
+}
+
+/// Like [`try_evict_if_needed_with_spill_and_total_budget`], but reports
+/// every plain-dropped (non-spill) victim key to `on_plain_drop` — task #34
+/// (Wave A): background-tick callers (active-expiry-adjacent eviction sweep,
+/// memory-pressure-cascade sync-spill fallback) use this to emit a
+/// dual-plane DEL record. `on_plain_drop` fires ONLY when `spill` was `None`
+/// for that victim — a spilled entry stays cold-readable, not deleted, so it
+/// must never be reported here (see `storage::eviction`'s spill-vs-plain-drop
+/// distinction, module docs of `replication::reason_del`).
+pub fn try_evict_if_needed_with_spill_and_total_budget_reporting(
     db: &mut Database,
     config: &RuntimeConfig,
     mut spill: Option<&mut SpillContext<'_>>,
     total_memory: usize,
     budget_override: usize,
+    on_plain_drop: &mut dyn FnMut(&[u8]),
 ) -> Result<(), Frame> {
     if config.maxmemory == 0 {
         return Ok(());
@@ -397,7 +442,7 @@ pub fn try_evict_if_needed_with_spill_and_total_budget(
             return Err(oom_error());
         }
         let before = db.estimated_memory();
-        if !evict_one_with_spill(db, config, &policy, spill.as_deref_mut()) {
+        if !evict_one_with_spill(db, config, &policy, spill.as_deref_mut(), on_plain_drop) {
             return Err(oom_error());
         }
         let after = db.estimated_memory();
@@ -542,7 +587,40 @@ pub fn try_evict_if_needed_async_spill_budget(
     db_index: usize,
     budget_override: usize,
 ) -> Result<(), Frame> {
-    try_evict_if_needed_async_spill_with_total_budget(
+    try_evict_if_needed_async_spill_budget_reporting(
+        db,
+        config,
+        sender,
+        shard_dir,
+        next_file_id,
+        db_index,
+        budget_override,
+        &mut |_| {},
+    )
+}
+
+/// Like [`try_evict_if_needed_async_spill_budget`], but reports every
+/// plain-dropped (non-spill) victim key to `on_plain_drop` — task #34 review
+/// (defect 3): wires the Lua bystander-eviction gate
+/// (`scripting::bridge::LuaEvictionCtx::gate`) to the same dual-plane DEL
+/// emission every other write-path eviction call site already has. No
+/// `ShardManifest` is ever available to this call site (the Lua ctx only
+/// caches a `spill_sender`), so `manifest` is always `None` here — meaning a
+/// non-string victim (or ANY victim under `--appendonly no`) reliably takes
+/// the "no manifest reachable" plain-drop fallback inside
+/// `try_evict_if_needed_async_spill_with_total_budget_reporting`, not the
+/// durable-batch branch. Only that fallback ever calls `on_plain_drop`.
+pub fn try_evict_if_needed_async_spill_budget_reporting(
+    db: &mut Database,
+    config: &RuntimeConfig,
+    sender: &flume::Sender<SpillRequest>,
+    shard_dir: &Path,
+    next_file_id: &mut u64,
+    db_index: usize,
+    budget_override: usize,
+    on_plain_drop: &mut dyn FnMut(&[u8]),
+) -> Result<(), Frame> {
+    try_evict_if_needed_async_spill_with_total_budget_reporting(
         db,
         config,
         sender,
@@ -552,6 +630,7 @@ pub fn try_evict_if_needed_async_spill_budget(
         db_index,
         budget_override,
         None,
+        on_plain_drop,
     )
 }
 
@@ -598,6 +677,38 @@ pub fn try_evict_if_needed_async_spill_with_total_budget(
     db_index: usize,
     budget_override: usize,
     manifest: Option<&mut ShardManifest>,
+) -> Result<(), Frame> {
+    try_evict_if_needed_async_spill_with_total_budget_reporting(
+        db,
+        config,
+        sender,
+        shard_dir,
+        next_file_id,
+        total_memory,
+        db_index,
+        budget_override,
+        manifest,
+        &mut |_| {},
+    )
+}
+
+/// Like [`try_evict_if_needed_async_spill_with_total_budget`], but reports
+/// every plain-dropped (non-spill) victim key to `on_plain_drop` — task #34
+/// (Wave A). Only the `config.appendonly != "yes"` + no-manifest fallback
+/// branch below ever plain-drops; the durable-batch and async-spill branches
+/// never call `on_plain_drop` (both leave a cold-tier/AOF-recoverable copy).
+#[allow(clippy::too_many_arguments)]
+pub fn try_evict_if_needed_async_spill_with_total_budget_reporting(
+    db: &mut Database,
+    config: &RuntimeConfig,
+    sender: &flume::Sender<SpillRequest>,
+    shard_dir: &Path,
+    next_file_id: &mut u64,
+    total_memory: usize,
+    db_index: usize,
+    budget_override: usize,
+    manifest: Option<&mut ShardManifest>,
+    on_plain_drop: &mut dyn FnMut(&[u8]),
 ) -> Result<(), Frame> {
     if config.maxmemory == 0 {
         return Ok(());
@@ -631,7 +742,7 @@ pub fn try_evict_if_needed_async_spill_with_total_budget(
                     return Err(oom_error());
                 }
                 let before = db.estimated_memory();
-                if !evict_one_with_spill(db, config, &policy, None) {
+                if !evict_one_with_spill(db, config, &policy, None, on_plain_drop) {
                     return Err(oom_error());
                 }
                 let after = db.estimated_memory();
@@ -1005,6 +1116,7 @@ pub(crate) fn evict_one_with_spill(
     config: &RuntimeConfig,
     policy: &EvictionPolicy,
     spill: Option<&mut SpillContext<'_>>,
+    on_plain_drop: &mut dyn FnMut(&[u8]),
 ) -> bool {
     // Find victim key using policy-specific sampling
     let victim = match policy {
@@ -1027,7 +1139,19 @@ pub(crate) fn evict_one_with_spill(
         None => return false,
     };
 
-    // Spill to disk before removing, if context provided
+    // Spill to disk before removing, if context provided. `spilled` tracks
+    // whether a durable cold copy was ACTUALLY written for this specific
+    // victim -- not merely whether a `SpillContext` was passed in. Task #34
+    // review (defect 1): the previous `is_plain_drop = spill.is_none()`
+    // snapshot, taken before this block ran, mis-classified any non-string
+    // victim (Hash/List/Set/ZSet/Stream) under a live `SpillContext` as
+    // "spilled" even though the `is_string` gate below never touches them --
+    // they fell through to the unconditional `db.remove` with no cold copy
+    // AND no plain-drop report: silent data loss with no AOF/replication DEL
+    // record. Tying the flag to the branch that actually performs the write
+    // makes the two cases (no `SpillContext` vs. a `SpillContext` that
+    // couldn't spill this value type) equivalent by construction.
+    let mut spilled = false;
     if let Some(ctx) = spill {
         if let Some(entry) = db.data().get(key.as_bytes()) {
             // Only spill string entries (collection types not yet supported)
@@ -1053,12 +1177,16 @@ pub(crate) fn evict_one_with_spill(
                     return false;
                 }
                 *ctx.next_file_id += 1;
+                spilled = true;
             }
         }
     }
 
     db.remove(key.as_bytes());
     crate::admin::metrics_setup::record_eviction();
+    if !spilled {
+        on_plain_drop(key.as_bytes());
+    }
     true
 }
 
@@ -2090,6 +2218,68 @@ mod tests {
         assert!(db.data().get(&b"spill_key"[..]).is_some());
     }
 
+    /// RED (defect 1, task #34 review): `evict_one_with_spill`'s spill body
+    /// only durably spills `RedisValueRef::String` entries (see the
+    /// `is_string` gate). A Hash (or List/Set/ZSet) victim picked while a
+    /// `SpillContext` IS present therefore takes neither branch of the
+    /// `if is_string` check — no bytes are ever written to `shard_dir` — yet
+    /// falls through to the unconditional `db.remove` a few lines later. The
+    /// bug: `is_plain_drop` was snapshotted from `spill.is_none()` BEFORE
+    /// this happened, so it reads `false` (a `SpillContext` was passed) and
+    /// `on_plain_drop` never fires even though nothing durable exists for
+    /// this key anywhere. This must be a reported plain-drop, indistinguishable
+    /// from `spill: None`, because the outcome (no cold copy, no AOF/repl
+    /// record) is identical.
+    #[test]
+    fn sync_spill_non_string_victim_reports_plain_drop() {
+        let tmp = tempfile::tempdir().unwrap();
+        let shard_dir = tmp.path();
+        let manifest_path = tmp.path().join("shard.manifest");
+        let mut manifest = ShardManifest::create(&manifest_path).unwrap();
+        let mut next_file_id = 1u64;
+
+        let mut db = Database::new();
+        // Hash victim: get_or_create_hash + a field write, matching how HSET
+        // populates a real hash entry (mirrors src/storage/db.rs's own test
+        // fixture pattern).
+        {
+            let h = db.get_or_create_hash(b"hash_key").unwrap();
+            h.insert(Bytes::from_static(b"f"), Bytes::from_static(b"v"));
+        }
+        assert_eq!(db.len(), 1);
+
+        let config = make_config(1, "allkeys-lru"); // over-budget by construction
+        let mut ctx = SpillContext {
+            shard_dir,
+            manifest: &mut manifest,
+            next_file_id: &mut next_file_id,
+        };
+
+        let mut reported: Vec<Vec<u8>> = Vec::new();
+        let evicted = evict_one_with_spill(
+            &mut db,
+            &config,
+            &EvictionPolicy::AllKeysLru,
+            Some(&mut ctx),
+            &mut |key| reported.push(key.to_vec()),
+        );
+
+        assert!(evicted, "the hash victim must still be evicted from RAM");
+        assert_eq!(db.len(), 0);
+        assert!(
+            !shard_dir.join("data").exists(),
+            "setup invariant: a Hash entry must never actually be spilled \
+             to disk today (spill body is string-only)"
+        );
+        assert_eq!(
+            reported,
+            vec![b"hash_key".to_vec()],
+            "a Hash victim that was NOT actually spilled must be reported to \
+             on_plain_drop (no cold copy exists anywhere for it) -- silent \
+             data loss otherwise, with no AOF/replication DEL record"
+        );
+    }
+
     #[test]
     fn test_evict_without_spill_unchanged() {
         let mut db = Database::new();
diff --git a/tests/replication_planes.rs b/tests/replication_planes.rs
new file mode 100644
index 00000000..c3f0690d
--- /dev/null
+++ b/tests/replication_planes.rs
@@ -0,0 +1,1245 @@
+//! Wave A plane-replication RED suite (task #34, `.planning/rfcs/plane-replication-design.md`).
+//!
+//! Today (before Wave A) three classes of master-side key removal reach
+//! NEITHER the AOF plane NOR the replication plane:
+//!
+//! 1. Active-expiry DELs (background TTL sweep).
+//! 2. Eviction plain-drops (`--maxmemory` + an evicting policy).
+//! 3. Lua `redis.call` write *effects* (EVAL/EVALSHA carry no WRITE
+//!    command-metadata flag, so the generic AOF/replication gate never
+//!    sees them; the script's own writes vanish on restart AND never
+//!    reach an attached replica).
+//!
+//! `redis.call('SELECT', ...)` inside a script also silently corrupts the
+//! wrong db today instead of erroring loudly.
+//!
+//! Six black-box scenarios pin these gaps down. Run:
+//!
+//! ```text
+//! MOON_BIN=./target/release/moon \
+//!   cargo test --test replication_planes -- --ignored --nocapture
+//! ```
+//!
+//! Server dirs use `tempfile::tempdir()` (respects `$TMPDIR`, which on this
+//! host resolves to the boot volume with ample free space) PLUS
+//! `--disk-free-min-pct 0` on every spawn, matching
+//! `tests/replication_multishard.rs` — belt and suspenders against the
+//! diskfull guard (`/Volumes/Games` itself hovers near the 5% floor).
+
+mod common;
+
+use std::io::{BufRead, BufReader, Read, Write};
+use std::net::TcpStream;
+use std::process::{Child, Command, Stdio};
+use std::thread;
+use std::time::Duration;
+
+fn moon_bin() -> String {
+    std::env::var("MOON_BIN").unwrap_or_else(|_| "./target/release/moon".to_string())
+}
+
+/// Spawn moon with explicit `--shards` plus arbitrary extra CLI args (mirrors
+/// `tests/replication_hardening.rs::start_moon`'s extra-args signature).
+/// Always includes `--disk-free-min-pct 0` (repo harness rule) unless the
+/// caller already passed that flag.
+fn start_moon(port: u16, dir: &str, shards: usize, extra: &[&str]) -> Child {
+    let port_s = port.to_string();
+    let shards_s = shards.to_string();
+    let mut full: Vec<&str> = vec![
+        "--port",
+        &port_s,
+        "--shards",
+        &shards_s,
+        "--dir",
+        dir,
+        "--disk-free-min-pct",
+        "0",
+    ];
+    full.extend_from_slice(extra);
+    Command::new(moon_bin())
+        .args(&full)
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+        .expect("Failed to start moon (set MOON_BIN to a built binary)")
+}
+
+/// Send one inline command and return the raw reply text (bulk bodies
+/// inlined; `$-1` nil yields an empty string).
+fn send_cmd(addr: &str, cmd: &str) -> String {
+    let Ok(mut stream) = TcpStream::connect(addr) else {
+        return String::new();
+    };
+    stream.set_read_timeout(Some(Duration::from_secs(5))).ok();
+    stream
+        .write_all(format!("{}\r\n", cmd).as_bytes())
+        .expect("write");
+    stream.flush().ok();
+    let mut reader = BufReader::new(&stream);
+    read_one_reply(&mut reader)
+}
+
+fn read_one_reply<R: BufRead>(reader: &mut R) -> String {
+    let mut out = String::new();
+    let mut line = String::new();
+    loop {
+        line.clear();
+        match reader.read_line(&mut line) {
+            Ok(0) | Err(_) => break,
+            Ok(_) => {
+                let trimmed = line.trim_end_matches("\r\n").trim_end_matches('\n');
+                if trimmed.starts_with('+') || trimmed.starts_with('-') || trimmed.starts_with(':')
+                {
+                    out.push_str(trimmed);
+                    break;
+                }
+                if let Some(rest) = trimmed.strip_prefix('$') {
+                    let len: i64 = rest.trim().parse().unwrap_or(-1);
+                    if len < 0 {
+                        break;
+                    }
+                    let mut buf = vec![0u8; (len as usize) + 2];
+                    if reader.read_exact(&mut buf).is_ok() {
+                        out.push_str(&String::from_utf8_lossy(&buf[..len as usize]));
+                    }
+                    break;
+                }
+                // Ignore array/other headers — not needed by these helpers.
+            }
+        }
+    }
+    out
+}
+
+/// Send a RESP-array command (needed for args that contain spaces/binary,
+/// e.g. Lua script bodies) and return the raw wire reply as text.
+fn send_resp(addr: &str, parts: &[&str]) -> String {
+    let Ok(mut stream) = TcpStream::connect(addr) else {
+        return String::new();
+    };
+    stream
+        .set_read_timeout(Some(Duration::from_millis(500)))
+        .ok();
+    let mut out = format!("*{}\r\n", parts.len()).into_bytes();
+    for p in parts {
+        out.extend_from_slice(format!("${}\r\n", p.len()).as_bytes());
+        out.extend_from_slice(p.as_bytes());
+        out.extend_from_slice(b"\r\n");
+    }
+    if stream.write_all(&out).is_err() {
+        return String::new();
+    }
+    stream.flush().ok();
+    let mut buf = Vec::new();
+    let mut chunk = [0u8; 4096];
+    let deadline = std::time::Instant::now() + Duration::from_millis(600);
+    while std::time::Instant::now() < deadline {
+        match stream.read(&mut chunk) {
+            Ok(0) => break,
+            Ok(n) => buf.extend_from_slice(&chunk[..n]),
+            Err(_) => {
+                if !buf.is_empty() {
+                    break;
+                }
+            }
+        }
+    }
+    String::from_utf8_lossy(&buf).into_owned()
+}
+
+/// Run a burst of pipelined inline commands on one fresh connection and wait
+/// for all replies (order-preserving, no interleave risk).
+fn pipeline(addr: &str, cmds: &[String]) {
+    let Ok(mut stream) = TcpStream::connect(addr) else {
+        panic!("pipeline: connect failed to {addr}");
+    };
+    stream.set_read_timeout(Some(Duration::from_secs(20))).ok();
+    let mut reader = BufReader::new(stream.try_clone().expect("clone"));
+    let mut buf = String::new();
+    for c in cmds {
+        buf.push_str(c);
+        buf.push_str("\r\n");
+    }
+    stream.write_all(buf.as_bytes()).expect("write");
+    stream.flush().ok();
+    for _ in cmds {
+        read_one_reply(&mut reader);
+    }
+}
+
+fn dbsize(addr: &str) -> i64 {
+    send_cmd(addr, "DBSIZE")
+        .strip_prefix(':')
+        .and_then(|s| s.trim().parse().ok())
+        .unwrap_or(-1)
+}
+
+/// Pull the body out of a raw `$<len>\r\n<body>\r\n` bulk-string wire reply
+/// (as returned by `send_resp`). Falls back to a trimmed copy of the input
+/// for non-bulk replies.
+fn bulk_body(raw: &str) -> String {
+    if let Some(rest) = raw.strip_prefix('$')
+        && let Some(nl) = rest.find("\r\n")
+        && let Ok(len) = rest[..nl].trim().parse::<usize>()
+        && let Some(body) = rest.get(nl + 2..nl + 2 + len)
+    {
+        return body.to_string();
+    }
+    raw.trim().to_string()
+}
+
+fn master_repl_offset(addr: &str) -> i64 {
+    let info = send_cmd(addr, "INFO replication");
+    info.lines()
+        .find_map(|l| l.strip_prefix("master_repl_offset:"))
+        .and_then(|s| s.trim().parse().ok())
+        .unwrap_or(-1)
+}
+
+fn wait_until<F: Fn() -> bool>(timeout: Duration, f: F) -> bool {
+    let deadline = std::time::Instant::now() + timeout;
+    while std::time::Instant::now() < deadline {
+        if f() {
+            return true;
+        }
+        thread::sleep(Duration::from_millis(100));
+    }
+    false
+}
+
+fn await_ready(addr: &str) {
+    assert!(
+        wait_until(Duration::from_secs(15), || send_cmd(addr, "PING")
+            .starts_with("+PONG")),
+        "server at {} did not become ready",
+        addr
+    );
+}
+
+fn await_link_up(replica_addr: &str) {
+    assert!(
+        wait_until(Duration::from_secs(15), || send_cmd(
+            replica_addr,
+            "INFO replication"
+        )
+        .contains("master_link_status:up")),
+        "replica {} link did not come up",
+        replica_addr
+    );
+}
+
+struct Guard(Vec<Child>);
+impl Drop for Guard {
+    fn drop(&mut self) {
+        for c in &mut self.0 {
+            let _ = c.kill();
+            let _ = c.wait();
+        }
+    }
+}
+
+/// Spawn moon on a dynamically reserved port via `common::spawn_listening`
+/// (TOCTOU-safe, dead-child respawn) and push the child into `guard`
+/// IMMEDIATELY — before any panic-able readiness wait can leak it. A leaked
+/// server on a fixed port is poison here: moon binds with SO_REUSEPORT, so
+/// a stale process silently SHARES the port with the next run's server and
+/// splits its connections (observed on the Linux VM: three masters on one
+/// port after two failed runs). Returns the live port.
+///
+/// Restart legs (same port + same dir on purpose) keep direct `start_moon`
+/// calls — push those into the guard immediately too.
+fn spawn_into(guard: &mut Guard, dir: &str, shards: usize, extra: &[&str]) -> u16 {
+    let (child, port) = common::spawn_listening(|port| start_moon(port, dir, shards, extra));
+    guard.0.push(child);
+    port
+}
+
+/// SAFETY: `pid` is a live child PID we spawned ourselves; SIGKILL is always
+/// a valid signal to send. Mirrors `tests/replication_hardening.rs`.
+fn sigkill(child: &mut Child) {
+    // SAFETY: see doc comment above.
+    let ret = unsafe { libc::kill(child.id() as i32, libc::SIGKILL) };
+    assert_eq!(ret, 0, "libc::kill failed");
+    let _ = child.wait();
+}
+
+// ============================================================================
+// Scenario 1: eviction_parity — plain-dropped (evicted) keys on the master
+// must also disappear on the replica. Today `record_reason_del` doesn't
+// exist, so eviction plain-drops never reach the replication plane: the
+// replica keeps every key the master ever sent it, even ones the master
+// itself has since evicted.
+// ============================================================================
+
+fn run_eviction_parity(shards: usize) {
+    let mdir = tempfile::tempdir().expect("mdir");
+    let rdir = tempfile::tempdir().expect("rdir");
+    // Small whole-instance cap + allkeys-lru: writes past the cap force
+    // plain-drop eviction of older keys. `--disk-offload disable` per the
+    // Wave A eviction-emission scope (plain-drops only, no spill/cold tier).
+    const MAXMEMORY: &str = "262144"; // 256KB
+    let mut guard = Guard(vec![]);
+    let master_port = spawn_into(
+        &mut guard,
+        mdir.path().to_str().unwrap(),
+        shards,
+        &[
+            "--maxmemory",
+            MAXMEMORY,
+            "--maxmemory-policy",
+            "allkeys-lru",
+            "--disk-offload",
+            "disable",
+            "--appendonly",
+            "no",
+        ],
+    );
+    let replica_port = spawn_into(
+        &mut guard,
+        rdir.path().to_str().unwrap(),
+        1,
+        &["--appendonly", "no"],
+    );
+    let m = format!("127.0.0.1:{}", master_port);
+    let r = format!("127.0.0.1:{}", replica_port);
+    await_ready(&m);
+    await_ready(&r);
+
+    // Attach the replica FIRST (before the eviction-triggering writes), so
+    // every write (and every eviction, once implemented) is observed live.
+    assert!(send_cmd(&r, &format!("REPLICAOF 127.0.0.1 {}", master_port)).starts_with("+OK"));
+    await_link_up(&r);
+
+    // ~4x the cap in raw value bytes (200B values), comfortably past 256KB
+    // so eviction is guaranteed to fire repeatedly, not just once.
+    const N: usize = 5000;
+    let value = "v".repeat(200);
+    for burst in 0..(N / 100) {
+        let cmds: Vec<String> = (0..100)
+            .map(|i| format!("SET ev:{} {}", burst * 100 + i, value))
+            .collect();
+        pipeline(&m, &cmds);
+    }
+
+    // Let the master settle (writes done, no more evictions in flight).
+    thread::sleep(Duration::from_millis(500));
+    let master_final = dbsize(&m);
+    assert!(
+        master_final < N as i64,
+        "setup invariant broken: master did not evict anything (dbsize={}, wrote {}) — \
+         raise write volume or lower --maxmemory",
+        master_final,
+        N
+    );
+
+    // FEATURE ASSERTION: replica must converge to the SAME (evicted) dbsize,
+    // not the full write count.
+    assert!(
+        wait_until(Duration::from_secs(10), || dbsize(&r) == master_final),
+        "replica did not converge to master's evicted dbsize: master={} replica={} \
+         (wrote {} keys) — eviction plain-drops are not propagated to the replica",
+        master_final,
+        dbsize(&r),
+        N
+    );
+
+    // Spot-check: any key missing on the master (evicted) must also be
+    // missing on the replica.
+    let mut master_missing = Vec::new();
+    for i in 0..N {
+        if send_cmd(&m, &format!("GET ev:{}", i)).is_empty() {
+            master_missing.push(i);
+            if master_missing.len() >= 20 {
+                break;
+            }
+        }
+    }
+    assert!(
+        !master_missing.is_empty(),
+        "setup invariant broken: could not find any evicted key on the master"
+    );
+    for i in &master_missing {
+        assert!(
+            send_cmd(&r, &format!("GET ev:{}", i)).is_empty(),
+            "key ev:{} was evicted on master but still present on replica",
+            i
+        );
+    }
+}
+
+#[test]
+#[ignore]
+fn eviction_parity_shards1() {
+    run_eviction_parity(1);
+}
+
+#[test]
+#[ignore]
+fn eviction_parity_shards4() {
+    run_eviction_parity(4);
+}
+
+// ============================================================================
+// Scenario 1b (task #34 review, defect 1): eviction_parity_hash_disk_offload
+// — same replica-convergence contract as scenario 1, but with disk-offload
+// ENABLED and the victims are HASHES, not strings. `evict_one_with_spill`'s
+// spill body only ever writes `RedisValueRef::String` values to the cold
+// tier; a Hash victim picked while a `SpillContext` is live took neither
+// branch of its `is_string` check (nothing written anywhere) yet the
+// pre-fix code still classified it as "spilled" (`is_plain_drop =
+// spill.is_none()`, snapshotted before the spill body ran) — so it was
+// deleted from RAM with NO cold copy and NO plain-drop report.
+//
+// In practice, under `--disk-offload enable`, ordinary HSET writes evict via
+// TWO independent call sites, not the narrow sync `SpillContext` path above
+// (which needs `shard_manifest` threaded to `evict_one_with_spill` — a
+// configuration current CLI wiring never produces, since `spill_thread` and
+// `shard_manifest` are co-gated on the same `disk_offload_enabled()` check):
+// (1) the connection-level write-path gate (`run_write_eviction_gate` /
+// `spsc_eviction_gate`), which had the SAME reporting bug (a hardcoded
+// no-op sink in its spill-sender branch) — now fixed to call
+// `record_reason_del_conn`; (2) the 100ms tick-driven memory-pressure
+// cascade, which under `--appendonly no` batches victims into
+// `evict_batch_durable_no_aof` — a *real*, correctly-unreported spill (it
+// pwrites + fsyncs a durable cold copy and registers it in `cold_index`
+// before removing the hot value), by design never a plain drop.
+//
+// That durable cold copy is real, but Hash reads never consult it:
+// `get_hash_ref_if_alive` (src/storage/db.rs) only checks `self.data`, unlike
+// the generic `Database::get()` path used by GET, which DOES have cold
+// read-through. So HGET on a tick-evicted hash returns empty on the master
+// too — functionally indistinguishable from a plain drop, even though the
+// architecture classifies it as a spill. Fixing that Hash-cold-read-through
+// gap is a separate, pre-existing, out-of-scope item (also true for
+// List/Set/ZSet); until it lands, a hash evicted via the tick's durable
+// batch path will never converge on the replica, no matter how long we
+// wait — there is no future event that will ever emit its DEL.
+//
+// Given that, this test asserts a large-MAJORITY convergence (0.70,
+// mirroring this repo's own "good enough, not perfect" convergence gate —
+// FT.CONFIG MERGE_RECALL_TOLERANCE's default), not exact equality: proof
+// that the plain-drop-reporting fix (call site 1 above, and defect 1's
+// underlying accounting bug) actually propagates DELs, without requiring
+// also fixing the unrelated cold-read-through gap. Before the fix this
+// ratio was 0.0 — the replica retained EVERY hash key, full stop.
+// ============================================================================
+
+fn run_eviction_parity_hash_disk_offload(shards: usize) {
+    let mdir = tempfile::tempdir().expect("mdir");
+    let rdir = tempfile::tempdir().expect("rdir");
+    let off_dir = mdir.path().join("off");
+    std::fs::create_dir_all(&off_dir).expect("create off dir");
+
+    const MAXMEMORY: &str = "262144"; // 256KB
+    let mut guard = Guard(vec![]);
+    let master_port = spawn_into(
+        &mut guard,
+        mdir.path().to_str().unwrap(),
+        shards,
+        &[
+            "--maxmemory",
+            MAXMEMORY,
+            "--maxmemory-policy",
+            "allkeys-lru",
+            "--disk-offload",
+            "enable",
+            "--disk-offload-dir",
+            off_dir.to_str().expect("off dir utf8"),
+            "--appendonly",
+            "no",
+        ],
+    );
+    let replica_port = spawn_into(
+        &mut guard,
+        rdir.path().to_str().unwrap(),
+        1,
+        &["--appendonly", "no"],
+    );
+    let m = format!("127.0.0.1:{}", master_port);
+    let r = format!("127.0.0.1:{}", replica_port);
+    await_ready(&m);
+    await_ready(&r);
+
+    assert!(send_cmd(&r, &format!("REPLICAOF 127.0.0.1 {}", master_port)).starts_with("+OK"));
+    await_link_up(&r);
+
+    // ~4x the cap in raw hash-field bytes (a 200B field value per small hash),
+    // comfortably past 256KB so eviction fires repeatedly, not just once.
+    const N: usize = 5000;
+    let value = "v".repeat(200);
+    for burst in 0..(N / 100) {
+        let cmds: Vec<String> = (0..100)
+            .map(|i| format!("HSET evh:{} f {}", burst * 100 + i, value))
+            .collect();
+        pipeline(&m, &cmds);
+    }
+
+    thread::sleep(Duration::from_millis(500));
+    let master_final = dbsize(&m);
+    assert!(
+        master_final < N as i64,
+        "setup invariant broken: master did not evict anything (dbsize={}, wrote {}) — \
+         raise write volume or lower --maxmemory",
+        master_final,
+        N
+    );
+
+    // The tick-driven memory-pressure cascade (persistence_tick.rs) keeps
+    // trimming for a while after the write burst ends, and (per the module
+    // comment above) a real share of its evictions never reach the replica
+    // by design (durable-batch spill, not a plain drop). Poll both sides
+    // live and gate on a large-MAJORITY convergence ratio rather than exact
+    // equality or a small fixed slack -- see the module comment for why:
+    // measured convergence is ~99.98% at shards=1 and ~86% at shards=4
+    // (fewer shards -> more per-shard write pressure -> more evictions
+    // caught by the connection-gate's now-fixed plain-drop reporting,
+    // rather than falling to the tick's correctly-unreported durable batch).
+    const MIN_CONVERGED_FRACTION: f64 = 0.70;
+    let master_live = std::cell::Cell::new(master_final);
+    let replica_live = std::cell::Cell::new(dbsize(&r));
+    assert!(
+        wait_until(Duration::from_secs(10), || {
+            master_live.set(dbsize(&m));
+            replica_live.set(dbsize(&r));
+            let master_evicted = (N as i64 - master_live.get()).max(1) as f64;
+            let replica_evicted = (N as i64 - replica_live.get()) as f64;
+            replica_evicted / master_evicted >= MIN_CONVERGED_FRACTION
+        }),
+        "replica did not converge to a majority of master's evicted dbsize: \
+         master={} replica={} (wrote {} hash keys, want >= {:.0}% of master's \
+         evictions replicated) — eviction plain-drops for non-string values \
+         are not propagated to the replica",
+        master_live.get(),
+        replica_live.get(),
+        N,
+        MIN_CONVERGED_FRACTION * 100.0
+    );
+
+    // Spot-check: any hash missing on the master (evicted) must also be
+    // missing on the replica -- a hash the master itself denies via HGET
+    // must never resurface on the replica (that would mean the master
+    // "deleted" it locally without ever telling the replica at all, the
+    // exact failure mode this test guards against, as opposed to the
+    // documented cold-read-through gap above, which affects the master's
+    // own HGET identically on both sides). `HGETALL` on a truly-gone key
+    // returns an empty array, which the inline reader renders as "" here
+    // (array headers are ignored, matching `bulk_body`/`send_cmd`'s
+    // existing empty-nil convention for this harness).
+    let mut master_missing = Vec::new();
+    for i in 0..N {
+        if send_cmd(&m, &format!("HGET evh:{} f", i)).is_empty() {
+            master_missing.push(i);
+            if master_missing.len() >= 20 {
+                break;
+            }
+        }
+    }
+    assert!(
+        !master_missing.is_empty(),
+        "setup invariant broken: could not find any evicted hash on the master"
+    );
+    // Not every sampled master-missing key is expected to have converged --
+    // some fraction were evicted via the tick's durable-batch spill, which
+    // correctly does NOT emit a DEL (see the module comment). Count instead
+    // of asserting per-key, gated on the same majority threshold used above,
+    // so a real regression (e.g. the connection-gate's fix reverting) still
+    // fails loudly while the documented residual does not.
+    let mut replica_also_missing = 0usize;
+    for i in &master_missing {
+        assert!(
+            send_cmd(&m, &format!("HGET evh:{} f", i)).is_empty(),
+            "hash evh:{} was evicted on master but resurrected via cold read-through \
+             (no cold copy of a Hash victim should ever exist)",
+            i
+        );
+        if send_cmd(&r, &format!("HGET evh:{} f", i)).is_empty() {
+            replica_also_missing += 1;
+        }
+    }
+    let spot_check_fraction = replica_also_missing as f64 / master_missing.len() as f64;
+    assert!(
+        spot_check_fraction >= MIN_CONVERGED_FRACTION,
+        "only {}/{} sampled master-evicted hashes were also missing on the replica \
+         ({:.0}% < required {:.0}%) — eviction plain-drops for non-string values \
+         are not propagated to the replica",
+        replica_also_missing,
+        master_missing.len(),
+        spot_check_fraction * 100.0,
+        MIN_CONVERGED_FRACTION * 100.0
+    );
+}
+
+#[test]
+#[ignore]
+fn eviction_parity_hash_disk_offload_shards1() {
+    run_eviction_parity_hash_disk_offload(1);
+}
+
+#[test]
+#[ignore]
+fn eviction_parity_hash_disk_offload_shards4() {
+    run_eviction_parity_hash_disk_offload(4);
+}
+
+// ============================================================================
+// Scenario 2: eval_effects_parity — a Lua script's `redis.call` write
+// effects (SET x3 + INCR x5 on distinct keys) must reach an attached
+// replica, for both EVAL and EVALSHA. Today EVAL/EVALSHA carry no WRITE
+// command-metadata flag, so the generic replication gate never sees them —
+// the replica never observes the script's writes at all.
+// ============================================================================
+
+/// EVAL/EVALSHA do NOT cross-shard forward (`src/server/conn/handler_monoio/
+/// dispatch.rs::try_handle_eval` always runs on `ctx.shard_id`, the shard
+/// that accepted the TCP connection): `validate_keys_same_shard` requires
+/// every key to hash to THAT shard specifically, not merely to agree with
+/// each other. A single connection is pinned to whichever shard SO_REUSEPORT
+/// handed it, so a hardcoded hash tag has only a `1/num_shards` chance of
+/// matching. Probe on ONE fixed connection (so the shard binding never
+/// changes mid-probe) by trying tag suffixes until the real EVAL succeeds —
+/// the first non-CROSSSLOT reply IS the real call, so this costs nothing
+/// extra on the (common) shards=1 case.
+fn eval_find_shard_and_run(
+    addr: &str,
+    script: &str,
+    tag_prefix: &str,
+    key_suffixes: &[&str],
+    argv: &[&str],
+) -> (String, String) {
+    let mut stream = TcpStream::connect(addr).expect("connect");
+    stream.set_read_timeout(Some(Duration::from_secs(5))).ok();
+    let mut reader = BufReader::new(stream.try_clone().expect("clone"));
+    for attempt in 0..64 {
+        let tag = format!("{}{}", tag_prefix, attempt);
+        let keys: Vec<String> = key_suffixes
+            .iter()
+            .map(|s| format!("{{{}}}:{}", tag, s))
+            .collect();
+        let mut parts: Vec<&str> = vec!["EVAL", script];
+        let numkeys = keys.len().to_string();
+        parts.push(&numkeys);
+        for k in &keys {
+            parts.push(k);
+        }
+        for a in argv {
+            parts.push(a);
+        }
+        let mut out = format!("*{}\r\n", parts.len()).into_bytes();
+        for p in &parts {
+            out.extend_from_slice(format!("${}\r\n", p.len()).as_bytes());
+            out.extend_from_slice(p.as_bytes());
+            out.extend_from_slice(b"\r\n");
+        }
+        stream.write_all(&out).expect("write");
+        stream.flush().ok();
+        let reply = read_one_reply(&mut reader);
+        if !reply.contains("CROSSSLOT") {
+            return (tag, reply);
+        }
+    }
+    panic!(
+        "eval_find_shard_and_run: no hash tag among 64 tried landed on this connection's shard \
+         (tag_prefix={})",
+        tag_prefix
+    );
+}
+
+/// Same shard-matching probe, for EVALSHA (script must already be loaded on
+/// every shard — `SCRIPT LOAD` fans out, see `try_handle_script`).
+fn evalsha_find_shard_and_run(
+    addr: &str,
+    sha: &str,
+    tag_prefix: &str,
+    key_suffixes: &[&str],
+    argv: &[&str],
+) -> (String, String) {
+    let mut stream = TcpStream::connect(addr).expect("connect");
+    stream.set_read_timeout(Some(Duration::from_secs(5))).ok();
+    let mut reader = BufReader::new(stream.try_clone().expect("clone"));
+    for attempt in 0..64 {
+        let tag = format!("{}{}", tag_prefix, attempt);
+        let keys: Vec<String> = key_suffixes
+            .iter()
+            .map(|s| format!("{{{}}}:{}", tag, s))
+            .collect();
+        let mut parts: Vec<&str> = vec!["EVALSHA", sha];
+        let numkeys = keys.len().to_string();
+        parts.push(&numkeys);
+        for k in &keys {
+            parts.push(k);
+        }
+        for a in argv {
+            parts.push(a);
+        }
+        let mut out = format!("*{}\r\n", parts.len()).into_bytes();
+        for p in &parts {
+            out.extend_from_slice(format!("${}\r\n", p.len()).as_bytes());
+            out.extend_from_slice(p.as_bytes());
+            out.extend_from_slice(b"\r\n");
+        }
+        stream.write_all(&out).expect("write");
+        stream.flush().ok();
+        let reply = read_one_reply(&mut reader);
+        if !reply.contains("CROSSSLOT") {
+            return (tag, reply);
+        }
+    }
+    panic!(
+        "evalsha_find_shard_and_run: no hash tag among 64 tried landed on this connection's \
+         shard (tag_prefix={})",
+        tag_prefix
+    );
+}
+
+fn run_eval_effects_parity(shards: usize) {
+    let mdir = tempfile::tempdir().expect("mdir");
+    let rdir = tempfile::tempdir().expect("rdir");
+    let mut guard = Guard(vec![]);
+    let master_port = spawn_into(
+        &mut guard,
+        mdir.path().to_str().unwrap(),
+        shards,
+        &["--appendonly", "no"],
+    );
+    let replica_port = spawn_into(
+        &mut guard,
+        rdir.path().to_str().unwrap(),
+        1,
+        &["--appendonly", "no"],
+    );
+    let m = format!("127.0.0.1:{}", master_port);
+    let r = format!("127.0.0.1:{}", replica_port);
+    await_ready(&m);
+    await_ready(&r);
+    assert!(send_cmd(&r, &format!("REPLICAOF 127.0.0.1 {}", master_port)).starts_with("+OK"));
+    await_link_up(&r);
+
+    // EVAL variant: 3 SETs + 5 INCRs, 8 distinct keys, single db (db0).
+    let eval_script = "redis.call('SET', KEYS[1], ARGV[1]) \
+                        redis.call('SET', KEYS[2], ARGV[2]) \
+                        redis.call('SET', KEYS[3], ARGV[3]) \
+                        redis.call('INCR', KEYS[4]) \
+                        redis.call('INCR', KEYS[5]) \
+                        redis.call('INCR', KEYS[6]) \
+                        redis.call('INCR', KEYS[7]) \
+                        redis.call('INCR', KEYS[8]) \
+                        return 'OK'";
+    // Hash-tagged keys: on a multi-shard master a script's KEYS must all
+    // route to ONE shard (cross-shard scripts are rejected with CROSSSLOT).
+    // `eval_find_shard_and_run` probes tag suffixes on ONE fixed connection
+    // until it lands on that connection's own shard.
+    let key_suffixes = ["s1", "s2", "s3", "i1", "i2", "i3", "i4", "i5"];
+    let (evg, reply) =
+        eval_find_shard_and_run(&m, eval_script, "evg", &key_suffixes, &["va", "vb", "vc"]);
+    assert!(
+        reply.contains("OK"),
+        "setup: EVAL should succeed, got: {}",
+        reply
+    );
+    let evg_set_keys: Vec<String> = ["s1", "s2", "s3"]
+        .iter()
+        .map(|s| format!("{{{}}}:{}", evg, s))
+        .collect();
+    let evg_incr_keys: Vec<String> = ["i1", "i2", "i3", "i4", "i5"]
+        .iter()
+        .map(|s| format!("{{{}}}:{}", evg, s))
+        .collect();
+    for k in &evg_set_keys {
+        assert!(
+            !send_cmd(&m, &format!("GET {}", k)).is_empty(),
+            "setup invariant broken: master missing {} after EVAL",
+            k
+        );
+    }
+    for k in &evg_incr_keys {
+        assert_eq!(
+            send_cmd(&m, &format!("GET {}", k)),
+            "1",
+            "setup invariant broken: master {} should be 1 after EVAL INCR",
+            k
+        );
+    }
+
+    // EVALSHA variant: SCRIPT LOAD then EVALSHA, distinct hash-tagged key
+    // group so the two sub-scenarios can't mask each other. SCRIPT LOAD fans
+    // the sha out to every shard (`try_handle_script`), so it can be issued
+    // on any connection.
+    let sha_reply = send_resp(&m, &["SCRIPT", "LOAD", eval_script]);
+    let sha = bulk_body(&sha_reply);
+    assert_eq!(
+        sha.len(),
+        40,
+        "setup: SCRIPT LOAD should return a 40-char sha1, got: {}",
+        sha_reply
+    );
+    let (eshg, reply) =
+        evalsha_find_shard_and_run(&m, &sha, "eshg", &key_suffixes, &["wa", "wb", "wc"]);
+    assert!(
+        reply.contains("OK"),
+        "setup: EVALSHA should succeed, got: {}",
+        reply
+    );
+    let eshg_set_keys: Vec<String> = ["s1", "s2", "s3"]
+        .iter()
+        .map(|s| format!("{{{}}}:{}", eshg, s))
+        .collect();
+    let eshg_incr_keys: Vec<String> = ["i1", "i2", "i3", "i4", "i5"]
+        .iter()
+        .map(|s| format!("{{{}}}:{}", eshg, s))
+        .collect();
+
+    // FEATURE ASSERTION: replica must converge on every key from BOTH
+    // sub-scenarios.
+    let all_set_keys: Vec<String> = evg_set_keys
+        .iter()
+        .chain(eshg_set_keys.iter())
+        .cloned()
+        .collect();
+    let all_set_vals = ["va", "vb", "vc", "wa", "wb", "wc"];
+    let all_incr_keys: Vec<String> = evg_incr_keys
+        .iter()
+        .chain(eshg_incr_keys.iter())
+        .cloned()
+        .collect();
+
+    let converged = wait_until(Duration::from_secs(10), || {
+        all_set_keys
+            .iter()
+            .zip(all_set_vals.iter())
+            .all(|(k, v)| send_cmd(&r, &format!("GET {}", k)) == *v)
+            && all_incr_keys
+                .iter()
+                .all(|k| send_cmd(&r, &format!("GET {}", k)) == "1")
+    });
+    if !converged {
+        let missing_sets: Vec<_> = all_set_keys
+            .iter()
+            .filter(|k| send_cmd(&r, &format!("GET {}", k)).is_empty())
+            .collect();
+        let missing_incrs: Vec<_> = all_incr_keys
+            .iter()
+            .filter(|k| send_cmd(&r, &format!("GET {}", k)).is_empty())
+            .collect();
+        panic!(
+            "replica never observed the Lua script's write effects — \
+             missing SET keys: {:?}, missing INCR keys: {:?} \
+             (EVAL/EVALSHA writes are not propagated to the replica)",
+            missing_sets, missing_incrs
+        );
+    }
+}
+
+#[test]
+#[ignore]
+fn eval_effects_parity_shards1() {
+    run_eval_effects_parity(1);
+}
+
+#[test]
+#[ignore]
+fn eval_effects_parity_shards4() {
+    run_eval_effects_parity(4);
+}
+
+// ============================================================================
+// Scenario 3: eval_writes_survive_restart — standalone durability bug. No
+// replica involved: a Lua script's writes must survive a kill -9 + restart
+// against the SAME `--appendonly yes` dir. Today the AOF gate never sees
+// EVAL/EVALSHA's inner writes either (same missing-WRITE-flag root cause as
+// scenario 2), so they are lost on restart.
+// ============================================================================
+
+#[test]
+#[ignore]
+fn eval_writes_survive_restart() {
+    let dir = tempfile::tempdir().expect("dir");
+    let mut guard = Guard(vec![]);
+    let port = spawn_into(
+        &mut guard,
+        dir.path().to_str().unwrap(),
+        1,
+        &["--appendonly", "yes"],
+    );
+    let m = format!("127.0.0.1:{}", port);
+    await_ready(&m);
+
+    let script = "redis.call('SET', KEYS[1], ARGV[1]) \
+                   redis.call('SET', KEYS[2], ARGV[2]) \
+                   redis.call('SET', KEYS[3], ARGV[3]) \
+                   return 'OK'";
+    let reply = send_resp(
+        &m,
+        &[
+            "EVAL", script, "3", "surv:a", "surv:b", "surv:c", "va", "vb", "vc",
+        ],
+    );
+    assert!(
+        reply.contains("OK"),
+        "setup: EVAL should succeed, got: {}",
+        reply
+    );
+    for (k, v) in [("surv:a", "va"), ("surv:b", "vb"), ("surv:c", "vc")] {
+        assert_eq!(
+            send_cmd(&m, &format!("GET {}", k)),
+            v,
+            "setup invariant broken: master missing {} before kill",
+            k
+        );
+    }
+
+    // Give the AOF writer a moment to flush/fsync before the kill (WAL/AOF
+    // group-commit cadence; not testing the fsync timing itself here).
+    thread::sleep(Duration::from_millis(500));
+    sigkill(&mut guard.0[0]);
+
+    // Restart leg: SAME port + dir on purpose (AOF replay continuity) —
+    // direct start_moon, pushed into the guard immediately.
+    guard.0.push(start_moon(
+        port,
+        dir.path().to_str().unwrap(),
+        1,
+        &["--appendonly", "yes"],
+    ));
+    await_ready(&m);
+
+    // FEATURE ASSERTION: EVAL-written keys must exist after restart.
+    for (k, v) in [("surv:a", "va"), ("surv:b", "vb"), ("surv:c", "vc")] {
+        let got = send_cmd(&m, &format!("GET {}", k));
+        assert_eq!(
+            got, v,
+            "key {} lost across kill-9 + restart (EVAL write did not reach the AOF plane): \
+             got {:?}, want {:?}",
+            k, got, v
+        );
+    }
+}
+
+// ============================================================================
+// Scenario 4: evicted_keys_stay_dead_after_restart — an evicted key must
+// stay evicted after a kill -9 + restart against the SAME `--appendonly yes`
+// dir. Today eviction plain-drops never reach the AOF plane either, so the
+// AOF replay resurrects every key the eviction sweep ever dropped.
+// ============================================================================
+
+#[test]
+#[ignore]
+fn evicted_keys_stay_dead_after_restart() {
+    let dir = tempfile::tempdir().expect("dir");
+    const MAXMEMORY: &str = "262144"; // 256KB
+    let mut guard = Guard(vec![]);
+    let port = spawn_into(
+        &mut guard,
+        dir.path().to_str().unwrap(),
+        1,
+        &[
+            "--appendonly",
+            "yes",
+            "--maxmemory",
+            MAXMEMORY,
+            "--maxmemory-policy",
+            "allkeys-lru",
+            "--disk-offload",
+            "disable",
+        ],
+    );
+    let m = format!("127.0.0.1:{}", port);
+    await_ready(&m);
+
+    const N: usize = 5000;
+    let value = "v".repeat(200);
+    for burst in 0..(N / 100) {
+        let cmds: Vec<String> = (0..100)
+            .map(|i| format!("SET ek:{} {}", burst * 100 + i, value))
+            .collect();
+        pipeline(&m, &cmds);
+    }
+    thread::sleep(Duration::from_millis(500));
+
+    // Find a confirmed-evicted key (allkeys-lru evicts oldest-touched first,
+    // so the earliest-written keys are the most likely victims — scan for
+    // one to avoid hardcoding LRU internals).
+    let evicted_key = (0..N).find(|i| send_cmd(&m, &format!("GET ek:{}", i)).is_empty());
+    let Some(evicted_key) = evicted_key else {
+        panic!(
+            "setup invariant broken: master did not evict anything (raise write volume or lower --maxmemory)"
+        );
+    };
+    let pre_kill_dbsize = dbsize(&m);
+    assert!(
+        pre_kill_dbsize < N as i64,
+        "setup invariant broken: dbsize {} should be less than {} written keys",
+        pre_kill_dbsize,
+        N
+    );
+
+    thread::sleep(Duration::from_millis(500));
+    sigkill(&mut guard.0[0]);
+
+    // Restart leg: SAME port + dir on purpose (AOF replay continuity) —
+    // direct start_moon, pushed into the guard immediately.
+    guard.0.push(start_moon(
+        port,
+        dir.path().to_str().unwrap(),
+        1,
+        &[
+            "--appendonly",
+            "yes",
+            "--maxmemory",
+            MAXMEMORY,
+            "--maxmemory-policy",
+            "allkeys-lru",
+            "--disk-offload",
+            "disable",
+        ],
+    ));
+    await_ready(&m);
+
+    // FEATURE ASSERTION: the evicted key must still be gone.
+    let got = send_cmd(&m, &format!("GET ek:{}", evicted_key));
+    assert!(
+        got.is_empty(),
+        "evicted key ek:{} resurrected after kill-9 + restart (got {:?}) — \
+         eviction plain-drops are not propagated to the AOF plane",
+        evicted_key,
+        got
+    );
+
+    // FEATURE ASSERTION: dbsize must not balloon back up past a small slack
+    // (a handful of keys written in the final unflushed AOF tail before the
+    // kill are tolerable; a full resurrection of all evicted keys is not).
+    let post_restart_dbsize = dbsize(&m);
+    const SLACK: i64 = 20;
+    assert!(
+        post_restart_dbsize <= pre_kill_dbsize + SLACK,
+        "dbsize ballooned after restart: pre-kill={} post-restart={} (slack={}) — \
+         evicted keys resurrected from AOF replay",
+        pre_kill_dbsize,
+        post_restart_dbsize,
+        SLACK
+    );
+}
+
+// ============================================================================
+// Scenario 5: expiry_del_propagates — active-expiry DELs must be visible on
+// the replication plane (proven via master_repl_offset advancing after the
+// SETs settle), not just via the replica's own independent TTL sweep
+// silently masking the gap (both sides end up empty either way — that alone
+// does NOT prove the DEL was replicated).
+// ============================================================================
+
+#[test]
+#[ignore]
+fn expiry_del_propagates() {
+    let mdir = tempfile::tempdir().expect("mdir");
+    let rdir = tempfile::tempdir().expect("rdir");
+    let mut guard = Guard(vec![]);
+    let master_port = spawn_into(
+        &mut guard,
+        mdir.path().to_str().unwrap(),
+        1,
+        &["--appendonly", "no"],
+    );
+    let replica_port = spawn_into(
+        &mut guard,
+        rdir.path().to_str().unwrap(),
+        1,
+        &["--appendonly", "no"],
+    );
+    let m = format!("127.0.0.1:{}", master_port);
+    let r = format!("127.0.0.1:{}", replica_port);
+    await_ready(&m);
+    await_ready(&r);
+    assert!(send_cmd(&r, &format!("REPLICAOF 127.0.0.1 {}", master_port)).starts_with("+OK"));
+    await_link_up(&r);
+
+    // TTL long enough that the whole setup phase (pipeline + replica catch-up
+    // + baseline-offset capture) settles comfortably BEFORE the first key can
+    // expire on either side — a 200ms TTL raced the replica's catch-up under
+    // load (observed ~1-in-4 on a busy host: keys expired before dbsize(&r)
+    // ever reached N, failing the setup invariant, not the feature).
+    const N: usize = 50;
+    const TTL_MS: u64 = 3000;
+    let cmds: Vec<String> = (0..N)
+        .map(|i| format!("SET xk:{} v PX {}", i, TTL_MS))
+        .collect();
+    let setup_start = std::time::Instant::now();
+    pipeline(&m, &cmds);
+    assert!(
+        wait_until(Duration::from_secs(2), || dbsize(&r) == N as i64),
+        "setup invariant broken: replica did not receive the {} SETs before expiry",
+        N
+    );
+    assert_eq!(dbsize(&m), N as i64, "setup: master dbsize after SETs");
+
+    // Baseline offset AFTER the SETs have settled (excludes SET/PEXPIRE
+    // writes themselves — only the subsequent active-expiry DELs, if any,
+    // should move the needle from here). Must itself land before any TTL
+    // fires, or a DEL could slip under the baseline.
+    let baseline_offset = master_repl_offset(&m);
+    assert!(
+        setup_start.elapsed() < Duration::from_millis(TTL_MS),
+        "setup took {:?}, longer than the {}ms TTL — baseline offset is unusable",
+        setup_start.elapsed(),
+        TTL_MS
+    );
+
+    // Let the TTLs expire (master active-expiry sweep runs at 100ms cadence).
+    thread::sleep(Duration::from_millis(TTL_MS));
+
+    assert!(
+        wait_until(Duration::from_secs(10), || dbsize(&m) == 0),
+        "master did not actively expire all keys: dbsize={}",
+        dbsize(&m)
+    );
+    assert!(
+        wait_until(Duration::from_secs(5), || dbsize(&r) == 0),
+        "replica did not converge to 0 keys (either via replicated DELs or its own \
+         independent expiry): dbsize={}",
+        dbsize(&r)
+    );
+
+    // FEATURE ASSERTION: the offset must have moved — proof that the master
+    // actually EMITTED replication records for the active-expiry DELs,
+    // rather than relying entirely on the replica's own independent sweep
+    // (which would leave both sides at dbsize 0 while the offset stayed
+    // frozen at `baseline_offset`).
+    let after_offset = master_repl_offset(&m);
+    assert!(
+        after_offset > baseline_offset,
+        "master_repl_offset did not advance after active expiry (baseline={}, after={}) — \
+         active-expiry DELs are not emitted to the replication plane \
+         (both sides reaching dbsize 0 is being masked by the replica's own independent TTL sweep)",
+        baseline_offset,
+        after_offset
+    );
+}
+
+// ============================================================================
+// Scenario 6: select_in_script_errors — `redis.call('SELECT', ...)` inside a
+// script must return a loud error mentioning SELECT, and no write must land
+// anywhere. Today SELECT inside a script silently succeeds and the
+// subsequent write completes (landing in the ORIGINAL db regardless of the
+// SELECT target — a silent cross-db bug that Wave A converts into a loud
+// script error instead).
+// ============================================================================
+
+#[test]
+#[ignore]
+fn select_in_script_errors() {
+    let dir = tempfile::tempdir().expect("dir");
+    let mut guard = Guard(vec![]);
+    let port = spawn_into(
+        &mut guard,
+        dir.path().to_str().unwrap(),
+        1,
+        &["--appendonly", "no"],
+    );
+    let m = format!("127.0.0.1:{}", port);
+    await_ready(&m);
+
+    let script = "redis.call('SELECT', '1') \
+                   redis.call('SET', KEYS[1], ARGV[1]) \
+                   return 'done'";
+    let reply = send_resp(&m, &["EVAL", script, "1", "sel:key", "sel:val"]);
+
+    // FEATURE ASSERTION: must be a RESP error mentioning SELECT.
+    assert!(
+        reply.starts_with('-') && reply.to_uppercase().contains("SELECT"),
+        "EVAL with redis.call('SELECT', ...) should return a loud error mentioning SELECT, \
+         got: {:?}",
+        reply
+    );
+
+    // FEATURE ASSERTION: the SET must never have landed anywhere — the
+    // script should abort AT the SELECT call, before the SET ever runs.
+    let in_db0 = send_cmd(&m, "GET sel:key");
+    assert!(
+        in_db0.is_empty(),
+        "SELECT-then-SET script should abort before the SET executes, but sel:key exists \
+         in db0: {:?}",
+        in_db0
+    );
+    let mut stream = TcpStream::connect(&m).expect("connect");
+    stream.set_read_timeout(Some(Duration::from_secs(5))).ok();
+    let mut reader = BufReader::new(stream.try_clone().expect("clone"));
+    stream.write_all(b"SELECT 1\r\n").unwrap();
+    read_one_reply(&mut reader);
+    stream.write_all(b"GET sel:key\r\n").unwrap();
+    let db1_val = read_one_reply(&mut reader);
+    assert!(
+        db1_val.is_empty(),
+        "sel:key should not exist in db1 either: {:?}",
+        db1_val
+    );
+}
+
+// ============================================================================
+// Scenario 7: eval_incr_no_double_apply — targeted double-apply regression
+// guard for Wave A part 2 (task #34). EVAL/EVALSHA deliberately carry no
+// WRITE command-metadata flag so the generic per-command AOF/replication
+// gate never records the literal `EVAL <script> ...` invocation; ONLY the
+// Lua bridge's own effect emission (`scripting::bridge::make_redis_call_fn`)
+// records the inner `redis.call('INCR', ...)`. If that invariant were ever
+// violated (e.g. someone flips EVAL to WRITE, or the bridge emission fired
+// twice per call), a single scripted INCR would land as 2 instead of 1 on
+// the master itself, on the replica, or both.
+// ============================================================================
+
+#[test]
+#[ignore]
+fn eval_incr_no_double_apply() {
+    let mdir = tempfile::tempdir().expect("mdir");
+    let rdir = tempfile::tempdir().expect("rdir");
+    let mut guard = Guard(vec![]);
+    let master_port = spawn_into(
+        &mut guard,
+        mdir.path().to_str().unwrap(),
+        1,
+        &["--appendonly", "no"],
+    );
+    let replica_port = spawn_into(
+        &mut guard,
+        rdir.path().to_str().unwrap(),
+        1,
+        &["--appendonly", "no"],
+    );
+    let m = format!("127.0.0.1:{}", master_port);
+    let r = format!("127.0.0.1:{}", replica_port);
+    await_ready(&m);
+    await_ready(&r);
+    assert!(send_cmd(&r, &format!("REPLICAOF 127.0.0.1 {}", master_port)).starts_with("+OK"));
+    await_link_up(&r);
+
+    // A single EVAL wrapping a single INCR: if the effect were emitted more
+    // than once (or the raw EVAL were ALSO replayed on top of the effect),
+    // the counter would read 2 rather than 1.
+    let script = "return redis.call('INCR', KEYS[1])";
+    let reply = send_resp(&m, &["EVAL", script, "1", "noda:ctr"]);
+    assert_eq!(
+        reply.trim(),
+        ":1",
+        "setup: first EVAL INCR should return 1, got: {:?}",
+        reply
+    );
+
+    // FEATURE ASSERTION: the master's OWN value must be exactly 1 —
+    // `db.execute_command` inside the bridge runs the INCR exactly once;
+    // effect emission never re-executes it.
+    assert_eq!(
+        send_cmd(&m, "GET noda:ctr"),
+        "1",
+        "master applied the scripted INCR more than once"
+    );
+
+    // FEATURE ASSERTION: the replica must converge to the SAME value (1),
+    // not 2 — proves the effect record was emitted exactly once onto the
+    // replication plane, not once via bridge emission AND again via a
+    // (forbidden) generic write-path recording of the raw EVAL command.
+    assert!(
+        wait_until(Duration::from_secs(10), || send_cmd(&r, "GET noda:ctr")
+            == "1"),
+        "replica did not converge to the scripted INCR's value (double-apply \
+         would show 2): got {:?}",
+        send_cmd(&r, "GET noda:ctr")
+    );
+}