coven_core/

database.rs

//! The owned SQLite connection.
//!
//! coven owns one `rusqlite::Connection` together with the sync bookkeeping
//! beside it. Every database access — the host's app SQL, coven's bookkeeping,
//! changeset capture and apply — runs against that one connection, so access is
//! serialized.
//!
//! Hosts open coven with [`crate::Coven::builder`] and run app SQL through
//! [`crate::CovenHandle::sql`] or [`crate::CovenHandle::write`].

use std::collections::{BTreeMap, BTreeSet, HashMap};
use std::path::{Path, PathBuf};
use std::sync::Arc;

use rusqlite::{Connection, OptionalExtension};
use tracing::error;
use tracing::warn;

use crate::blob::decl::BlobDecls;
use crate::blob::locator::{BlobLocator, RemoteAudience, StoredBlobRef};
use crate::blob::{BlobRef, Provenance, RowBlobAuthority, RowBlobRef};
use crate::db::{
    apply_coven_schema, expected_coven_schema_manifest, is_reserved_table_name,
    live_coven_schema_manifest, CovenSchemaManifest, ExternalBlob, OutboxEntry, OutboxOperation,
    OutboxUploadState,
};
use crate::encryption::EncryptionService;
use crate::migration::{run_migrations_in_transaction, Migration, MigrationError};
use crate::sync::audience_package::{AudiencePackage, RowBlobLocatorBinding};
use crate::sync::circle::Audience;
use crate::sync::gate::{self, Gates};
use crate::sync::hlc::{Hlc, Timestamp, UpdatedAtStamper, HIGHWATER_STATE_KEY, MAX_FUTURE_SKEW_MS};
use crate::sync::membership::{
    AuthorHead, AuthorStreamId, MembershipEntry, MembershipEntryRef, MembershipHeadRef,
    SerialAuthorizationState, SerialMembershipState,
};
use crate::sync::provider::ProviderAdminState;
use crate::sync::remote_object::{
    remote_object_id, CandidateExclusiveObjectDomain, RemoteObjectRecord, SharedLiveSetObjectDomain,
};
use crate::sync::routing_contract::SyncRoutingContract;
use crate::sync::session::{quote_ident, SyncedTable};
use crate::sync::storage::{ExactObjectRef, PreparedExactObject, VersionToken, VersionedObject};
use crate::sync::store_commit::{
    ack_slot_prefix, commit_semantic_prefix, snapshot_image_semantic_prefix, snapshot_slot_prefix,
    CommitFrontier, ObjectHash, ResolvedStoreDeviceState, SnapshotImageRef, SnapshotMeta, StoreAck,
    StoreAckRef, StoreBatchCommit, StoreBatchCommitRef, StoreCommitCoord, StoreDeviceHead,
    StoreDeviceRegistration, StoreDeviceRegistrationRef, StoreDeviceStateRef, StoreProtocolRoot,
    StoreSerialHead, StoreSerialHeadState, StoreSerialPredecessor, StoreSnapshotRef,
    StreamActivationId, SERIAL_STREAM_ID,
};
use crate::write::{
    AffectedRow, PendingBranch, PendingBranchId, PendingWrite, PublishedPosition, WriteId,
    WriteReceipt, WriteResolution, WriteStatus,
};
use crate::WritePolicy;

pub const LOCAL_DEVICE_ID_STATE_KEY: &str = "local_device_id";
const HOST_DEVICE_ID_STATE_KEY: &str = "host_device_id";
pub const WRITE_POLICY_STATE_KEY: &str = "write_policy";
const SYNC_ROUTING_CONTRACT_STATE_KEY: &str = "sync_routing_contract";
pub const SYNC_ROUTING_HASH_STATE_KEY: &str = "sync_routing_hash";
const COVEN_SCHEMA_MANIFEST_STATE_KEY: &str = "coven_schema_manifest";
const COVEN_INITIALIZED_STATE_KEY: &str = "coven_initialized";
const COVEN_INITIALIZED_STATE_VALUE: &str = "1";
pub const SERIAL_MEMBERSHIP_STATE_KEY: &str = "serial_membership_state";
pub const SERIAL_KEY_GENERATION_STATE_KEY: &str = "serial_key_generation";
pub const SERIAL_PROVIDER_ADMIN_STATE_KEY: &str = "serial_provider_admin_state";
const SERIAL_CANDIDATE_ABANDONMENT_STATE_KEY: &str = "serial_candidate_abandonment";
const STORE_DEVICE_GENESIS_STATE_KEY: &str = "store_device_genesis_state";
const GATE_BASELINE_SCHEMA: &str = "coven_gate_empty";

fn load_store_device_genesis_state_on(
    conn: &Connection,
) -> Result<ResolvedStoreDeviceState, DbError> {
    let raw: String = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [STORE_DEVICE_GENESIS_STATE_KEY],
            |row| row.get(0),
        )
        .map_err(DbError::from)?;
    serde_json::from_str(&raw)
        .map_err(|error| DbError::Message(format!("parse Store device genesis state: {error}")))
}

fn store_serial_predecessor_on(
    conn: &Connection,
    commit: Option<&StoreBatchCommitRef>,
) -> Result<StoreSerialPredecessor, DbError> {
    if let Some(commit) = commit {
        return Ok(StoreSerialPredecessor::Commit(commit.clone()));
    }
    let root = required_store_root_authority_on(conn)?;
    let genesis = load_store_device_genesis_state_on(conn)?;
    let mut devices = genesis.devices.values();
    let Some(founder) = devices.next() else {
        return Err(DbError::Message(
            "Serial genesis must contain exactly one founder registration".to_string(),
        ));
    };
    if devices.next().is_some() {
        return Err(DbError::Message(
            "Serial genesis must contain exactly one founder registration".to_string(),
        ));
    }
    Ok(StoreSerialPredecessor::Genesis {
        root,
        founder_registration: founder.registration.clone(),
    })
}

fn load_store_device_snapshot_on(
    conn: &Connection,
    reference: &StoreBatchCommitRef,
) -> Result<ResolvedStoreDeviceState, DbError> {
    let exact = serde_json::to_string(reference)
        .map_err(|error| DbError::Message(format!("serialize Store commit ref: {error}")))?;
    let raw: String = conn
        .query_row(
            "SELECT state FROM store_device_state_snapshots WHERE commit_ref = ?1",
            [exact],
            |row| row.get(0),
        )
        .map_err(DbError::from)?;
    serde_json::from_str(&raw)
        .map_err(|error| DbError::Message(format!("parse Store device state snapshot: {error}")))
}

fn load_declared_store_device_state_on(
    conn: &Connection,
    reference: &StoreDeviceStateRef,
) -> Result<ResolvedStoreDeviceState, DbError> {
    let state = match reference {
        StoreDeviceStateRef::MergeConcurrent { frontier, .. } => {
            let CommitFrontier::MergeConcurrent(frontier) = frontier else {
                return Err(DbError::Message(
                    "Merge device state carries a Serial frontier".into(),
                ));
            };
            if frontier.is_empty() {
                load_store_device_genesis_state_on(conn)?
            } else {
                ResolvedStoreDeviceState::merge(
                    frontier
                        .values()
                        .map(|commit| load_store_device_snapshot_on(conn, commit))
                        .collect::<Result<Vec<_>, _>>()?,
                )
                .map_err(|error| DbError::Message(error.to_string()))?
            }
        }
        StoreDeviceStateRef::Serial { position, .. } => match position {
            StoreSerialPredecessor::Genesis { .. } => load_store_device_genesis_state_on(conn)?,
            StoreSerialPredecessor::Commit(commit) => load_store_device_snapshot_on(conn, commit)?,
        },
    };
    if state.state_hash != reference.state_hash() || state.recovery != reference.recovery() {
        return Err(DbError::Message(
            "declared Store device state differs from its exact predecessor snapshots".into(),
        ));
    }
    Ok(state)
}

fn authorize_host_sql(context: rusqlite::hooks::AuthContext<'_>) -> rusqlite::hooks::Authorization {
    use rusqlite::hooks::{AuthAction, Authorization};

    if context
        .database_name
        .is_some_and(|name| name.eq_ignore_ascii_case(GATE_BASELINE_SCHEMA))
        || matches!(
            context.action,
            AuthAction::Detach { database_name }
                if database_name.eq_ignore_ascii_case(GATE_BASELINE_SCHEMA)
        )
        || matches!(
            context.action,
            AuthAction::Pragma { pragma_name, .. }
                if pragma_name.eq_ignore_ascii_case("database_list")
        )
    {
        Authorization::Deny
    } else {
        Authorization::Allow
    }
}

/// An error from the owned database.
#[derive(Debug, thiserror::Error)]
pub enum DbError {
    #[error("database error: {0}")]
    Message(String),
    #[error("database error: Store protocol root hash is absent")]
    StoreRootHashMissing,
}

impl DbError {
    pub(crate) fn into_message(self) -> String {
        match self {
            Self::Message(message) => message,
            Self::StoreRootHashMissing => "Store protocol root hash is absent".to_string(),
        }
    }

    fn missing_store_root_hash() -> Self {
        Self::StoreRootHashMissing
    }
}

impl From<rusqlite::Error> for DbError {
    fn from(e: rusqlite::Error) -> Self {
        DbError::Message(e.to_string())
    }
}

/// Why opening the database failed. Splits a migration-ladder failure from every
/// other open-time database error so the [`MigrationError`] a host acts on —
/// [`MigrationError::SchemaTooNew`], whose remedy is "update the app" — stays
/// matchable at the open boundary instead of being flattened into a
/// [`DbError`] string.
#[derive(Debug, thiserror::Error)]
pub enum OpenError {
    #[error(transparent)]
    Migration(#[from] MigrationError),
    #[error(transparent)]
    Db(#[from] DbError),
}

#[derive(Clone)]
struct DatabaseState {
    write_policy: WritePolicy,
    hlc: Arc<Hlc>,
    synced_tables: Arc<Vec<SyncedTable>>,
    schema_version: u32,
    sync_routing_hash: ObjectHash,
    gates: Arc<Gates>,
    blob_decls: Arc<BlobDecls>,
    /// The host's blob-tombstone convergence window, read by the tombstone GC to
    /// age each tombstone's `deleted_at`. Host config carried here alongside
    /// `synced_tables` so the sync layer reads it from the one owner rather than
    /// threading a separately-passed copy that could diverge.
    blob_tombstone_grace: chrono::Duration,
    /// How many blob transfers each transfer loop runs at once, read by the upload
    /// drain and the pin loop (both hold `&Database`). Open-time host config carried
    /// here for the same single-owner reason as `blob_tombstone_grace`.
    transfer_limits: crate::blob::TransferLimits,
    /// Serializes complete membership-chain loads that share this database, so a
    /// load cannot return an older chain after another load commits a newer floor.
    membership_load: Arc<tokio::sync::Mutex<()>>,
    /// Serializes construction and execution of the one local membership mutation
    /// whose exact signed bytes are held in `outbound_membership_mutation`.
    membership_mutation: Arc<tokio::sync::Mutex<()>>,
    /// Serializes staging and publication of the one exact snapshot generation
    /// held in `outbound_store_snapshot`.
    snapshot_publication: Arc<tokio::sync::Mutex<()>>,
    /// Serializes the full durable-intent to filesystem-deletion to intent-removal
    /// operation across every clone of this database.
    local_blob_cleanup: Arc<tokio::sync::Mutex<()>>,
    ids: crate::id_provider::IdRef,
    write_statuses:
        Arc<std::sync::Mutex<HashMap<WriteId, tokio::sync::watch::Sender<WriteStatus>>>>,
    #[cfg(any(test, feature = "test-utils"))]
    test_pause_points: Arc<TestPausePoints<DatabaseTestPoint>>,
}

/// Test-only checkpoints reached by database operations whose ordering matters.
#[cfg(any(test, feature = "test-utils"))]
#[doc(hidden)]
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum DatabaseTestPoint {
    LocalBlobCleanupRequested,
    LocalBlobCleanupAcquired,
    LocalBlobCleanupBeforeFilesystem { namespace: String, blob_id: String },
    LocalBlobCleanupFinished,
    PullAfterRemoteCommit { device_id: String, seq: u64 },
}

#[cfg(any(test, feature = "test-utils"))]
struct ArmedTestPause<K> {
    point: K,
    reached: Arc<tokio::sync::Notify>,
    resume: Arc<tokio::sync::Notify>,
}

#[cfg(any(test, feature = "test-utils"))]
struct TestPauseState<K> {
    armed: Option<ArmedTestPause<K>>,
    observers: Vec<tokio::sync::mpsc::UnboundedSender<K>>,
}

#[cfg(any(test, feature = "test-utils"))]
struct TestPausePoints<K> {
    state: std::sync::Mutex<TestPauseState<K>>,
}

#[cfg(any(test, feature = "test-utils"))]
impl<K> Default for TestPausePoints<K> {
    fn default() -> Self {
        Self {
            state: std::sync::Mutex::new(TestPauseState {
                armed: None,
                observers: Vec::new(),
            }),
        }
    }
}

#[cfg(any(test, feature = "test-utils"))]
impl<K: Clone + PartialEq> TestPausePoints<K> {
    fn arm(&self, point: K) -> (Arc<tokio::sync::Notify>, Arc<tokio::sync::Notify>) {
        let reached = Arc::new(tokio::sync::Notify::new());
        let resume = Arc::new(tokio::sync::Notify::new());
        let prior = self
            .state
            .lock()
            .expect("database test pause mutex poisoned")
            .armed
            .replace(ArmedTestPause {
                point,
                reached: reached.clone(),
                resume: resume.clone(),
            });
        assert!(prior.is_none(), "database test pause already armed");
        (reached, resume)
    }

    fn observe(&self) -> tokio::sync::mpsc::UnboundedReceiver<K> {
        let (sender, receiver) = tokio::sync::mpsc::unbounded_channel();
        self.state
            .lock()
            .expect("database test pause mutex poisoned")
            .observers
            .push(sender);
        receiver
    }

    async fn reach(&self, point: K) {
        let pause = {
            let mut state = self
                .state
                .lock()
                .expect("database test pause mutex poisoned");
            state
                .observers
                .retain(|observer| observer.send(point.clone()).is_ok());
            if state
                .armed
                .as_ref()
                .is_some_and(|pause| pause.point == point)
            {
                state.armed.take()
            } else {
                None
            }
        };
        if let Some(pause) = pause {
            pause.reached.notify_one();
            pause.resume.notified().await;
        }
    }
}

/// The owned SQLite connection and the sync bookkeeping resolved beside it at
/// open. One connection thread owns this for the connection's whole life; every
/// database access runs against it, so access is serialized. Changeset capture is
/// per-transaction — [`Database::run_store_write_transaction_on`] attaches a
/// session for the span of one host write and drains it into the existing write records —
/// so no capture state lives on the core between calls.
///
/// `DatabaseCore` holds only `Send` fields (a `rusqlite::Connection`, which is
/// `Send`, plus `Arc`s and a `u32`), so it is `Send` by construction — the
/// connection thread receives it by value across a single `thread::spawn` with no
/// manual `unsafe impl`.
struct DatabaseCore {
    conn: Connection,
    hlc: Arc<Hlc>,
    synced_tables: Arc<Vec<SyncedTable>>,
    schema_version: u32,
    sync_routing_hash: ObjectHash,
    gates: Arc<Gates>,
    blob_decls: Arc<BlobDecls>,
    blob_tombstone_grace: chrono::Duration,
    transfer_limits: crate::blob::TransferLimits,
    write_policy: WritePolicy,
}

#[derive(Clone, Copy)]
enum CovenMetadataOpen {
    Detect,
    InitializeVerifiedSnapshot,
}

fn serialized_write_policy(write_policy: WritePolicy) -> Result<String, DbError> {
    serde_json::to_string(&write_policy)
        .map_err(|error| DbError::Message(format!("serialize Store write policy: {error}")))
}

fn initialize_write_policy(conn: &Connection, write_policy: WritePolicy) -> Result<(), DbError> {
    let serialized = serialized_write_policy(write_policy)?;
    conn.execute(
        "INSERT INTO protocol_state (key, value) VALUES (?1, ?2)",
        (WRITE_POLICY_STATE_KEY, serialized),
    )
    .map_err(DbError::from)?;
    Ok(())
}

fn protocol_state_exists(conn: &Connection) -> Result<bool, DbError> {
    conn.query_row(
        "SELECT EXISTS(\
             SELECT 1 FROM main.sqlite_schema \
             WHERE type = 'table' AND name = 'protocol_state'\
         )",
        [],
        |row| row.get(0),
    )
    .map_err(DbError::from)
}

fn has_coven_initialization_marker(conn: &Connection) -> Result<bool, DbError> {
    if !protocol_state_exists(conn)? {
        return Ok(false);
    }
    let marker = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [COVEN_INITIALIZED_STATE_KEY],
            |row| row.get::<_, String>(0),
        )
        .optional()
        .map_err(DbError::from)?;
    match marker.as_deref() {
        None => Ok(false),
        Some(COVEN_INITIALIZED_STATE_VALUE) => Ok(true),
        Some(value) => Err(DbError::Message(format!(
            "Store database has invalid Coven initialization marker {value:?}"
        ))),
    }
}

fn initialize_coven_metadata_on(
    conn: &Connection,
    write_policy: WritePolicy,
    sync_routing_contract: &SyncRoutingContract,
    install_routing_schema: bool,
) -> Result<(), DbError> {
    apply_coven_schema(conn).map_err(DbError::from)?;
    if install_routing_schema {
        crate::db::apply_coven_routing_schema(conn).map_err(DbError::from)?;
    }
    let schema_manifest = validate_live_coven_schema(conn, install_routing_schema)?;
    initialize_write_policy(conn, write_policy)?;
    let contract_json =
        String::from_utf8(sync_routing_contract.bytes().to_vec()).map_err(|error| {
            DbError::Message(format!("encode sync-routing contract metadata: {error}"))
        })?;
    conn.execute(
        "INSERT INTO protocol_state (key, value) VALUES (?1, ?2)",
        (SYNC_ROUTING_CONTRACT_STATE_KEY, contract_json),
    )
    .map_err(DbError::from)?;
    conn.execute(
        "INSERT INTO protocol_state (key, value) VALUES (?1, ?2)",
        (COVEN_SCHEMA_MANIFEST_STATE_KEY, schema_manifest),
    )
    .map_err(DbError::from)?;
    conn.execute(
        "INSERT INTO protocol_state (key, value) VALUES (?1, ?2)",
        (
            SYNC_ROUTING_HASH_STATE_KEY,
            sync_routing_contract.hash().to_string(),
        ),
    )
    .map_err(DbError::from)?;
    conn.execute(
        "INSERT INTO protocol_state (key, value) VALUES (?1, ?2)",
        (COVEN_INITIALIZED_STATE_KEY, COVEN_INITIALIZED_STATE_VALUE),
    )
    .map(|_| ())
    .map_err(DbError::from)
}

fn validate_live_coven_schema(conn: &Connection, include_routing: bool) -> Result<String, DbError> {
    let expected = expected_coven_schema_manifest(include_routing).map_err(DbError::from)?;
    let actual = live_coven_schema_manifest(conn).map_err(DbError::from)?;
    if actual != expected {
        return Err(DbError::Message(format!(
            "Coven schema does not match the current table, index, constraint, primary-key, STRICT, and WITHOUT ROWID declarations: expected {expected:?}, found {actual:?}"
        )));
    }
    serde_json::to_string(&expected)
        .map_err(|error| DbError::Message(format!("serialize Coven schema manifest: {error}")))
}

fn validate_initialized_coven_schema(
    conn: &Connection,
    include_routing: bool,
) -> Result<(), DbError> {
    let expected = expected_coven_schema_manifest(include_routing).map_err(DbError::from)?;
    let stored_json = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [COVEN_SCHEMA_MANIFEST_STATE_KEY],
            |row| row.get::<_, String>(0),
        )
        .optional()
        .map_err(DbError::from)?
        .ok_or_else(|| {
            DbError::Message(
                "Store database is missing required Coven schema manifest metadata".to_string(),
            )
        })?;
    let stored: CovenSchemaManifest = serde_json::from_str(&stored_json).map_err(|error| {
        DbError::Message(format!("Store Coven schema manifest is invalid: {error}"))
    })?;
    if stored != expected {
        return Err(DbError::Message(format!(
            "Store Coven schema manifest does not match the current schema: stored {stored:?}, current {expected:?}"
        )));
    }
    validate_live_coven_schema(conn, include_routing)?;
    Ok(())
}

fn load_coven_metadata(
    conn: &Connection,
    write_policy: WritePolicy,
) -> Result<SyncRoutingContract, DbError> {
    if !has_coven_initialization_marker(conn)? {
        return Err(DbError::Message(
            "Store database is missing required Coven initialization metadata".to_string(),
        ));
    }
    validate_write_policy(conn, write_policy)?;
    let contract_bytes = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [SYNC_ROUTING_CONTRACT_STATE_KEY],
            |row| row.get::<_, String>(0),
        )
        .optional()
        .map_err(DbError::from)?
        .ok_or_else(|| {
            DbError::Message(
                "Store database is missing required sync_routing_contract metadata".to_string(),
            )
        })?;
    let contract = SyncRoutingContract::from_bytes(contract_bytes.as_bytes()).map_err(|error| {
        DbError::Message(format!("Store sync-routing contract is invalid: {error}"))
    })?;
    let stored_hash = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [SYNC_ROUTING_HASH_STATE_KEY],
            |row| row.get::<_, String>(0),
        )
        .optional()
        .map_err(DbError::from)?
        .ok_or_else(|| {
            DbError::Message(
                "Store database is missing required sync_routing_hash metadata".to_string(),
            )
        })?;
    let stored_hash: ObjectHash = stored_hash.parse().map_err(|error| {
        DbError::Message(format!(
            "Store sync_routing_hash metadata is invalid: {error}"
        ))
    })?;
    if stored_hash != contract.hash() {
        return Err(DbError::Message(format!(
            "Store sync-routing contract hashes to {}, but metadata records {stored_hash}",
            contract.hash(),
        )));
    }
    Ok(contract)
}

fn validate_sync_routing_contract(
    pinned: &SyncRoutingContract,
    resolved: &SyncRoutingContract,
) -> Result<(), DbError> {
    if pinned.bytes() != resolved.bytes() || pinned.hash() != resolved.hash() {
        return Err(DbError::Message(format!(
            "Store sync-routing hash is {}, but open resolved {}",
            pinned.hash(),
            resolved.hash(),
        )));
    }
    Ok(())
}

fn validate_write_policy(conn: &Connection, requested: WritePolicy) -> Result<(), DbError> {
    let stored = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [WRITE_POLICY_STATE_KEY],
            |row| row.get::<_, String>(0),
        )
        .optional()
        .map_err(DbError::from)?
        .ok_or_else(|| {
            DbError::Message("Store database is missing required write_policy metadata".to_string())
        })?;
    let stored: WritePolicy = serde_json::from_str(&stored).map_err(|error| {
        DbError::Message(format!("Store write_policy metadata is invalid: {error}"))
    })?;
    if stored != requested {
        return Err(DbError::Message(format!(
            "Store write policy is {stored:?}, but open requested {requested:?}"
        )));
    }
    Ok(())
}

impl DatabaseCore {
    fn open(
        path: &Path,
        synced_tables: Vec<SyncedTable>,
        blob_tombstone_grace: chrono::Duration,
        transfer_limits: crate::blob::TransferLimits,
        write_policy: WritePolicy,
        hlc: Arc<Hlc>,
        migrations: &[Migration],
        metadata_open: CovenMetadataOpen,
    ) -> Result<(Self, DatabaseState, UpdatedAtStamper), OpenError> {
        let mut conn = open_connection(path)?;
        conn.pragma_update(None, "foreign_keys", "ON")
            .map_err(DbError::from)?;

        let initialized = match metadata_open {
            CovenMetadataOpen::InitializeVerifiedSnapshot => false,
            CovenMetadataOpen::Detect => {
                let initialized = has_coven_initialization_marker(&conn)?;
                if !initialized
                    && !live_coven_schema_manifest(&conn)
                        .map_err(DbError::from)?
                        .is_empty()
                {
                    return Err(DbError::Message(
                        "Store database contains Coven schema objects without the required initialization marker"
                            .to_string(),
                    )
                    .into());
                }
                initialized
            }
        };
        let pinned_routing_contract = initialized
            .then(|| load_coven_metadata(&conn, write_policy))
            .transpose()?;
        if let Some(pinned) = &pinned_routing_contract {
            validate_initialized_coven_schema(
                &conn,
                write_policy == WritePolicy::MergeConcurrent && pinned.has_scoped_graph(),
            )?;
        }
        let (schema_version, sync_routing_contract, gates, blob_decls) = {
            let tx = conn.transaction().map_err(DbError::from)?;
            let outcome = (|| -> Result<_, OpenError> {
                let schema_version = run_migrations_in_transaction(&tx, migrations)?;

                // The host ladder and routing validation share this transaction.
                // A pending migration that changes confidentiality topology cannot
                // leave either its DDL or `user_version` advance committed.
                validate_host_synced_tables(&tx, &synced_tables)?;
                let resolved = SyncRoutingContract::from_connection(&tx, &synced_tables)
                    .map_err(|error| DbError::Message(error.to_string()))?;
                if let Some(pinned) = &pinned_routing_contract {
                    validate_sync_routing_contract(pinned, &resolved)?;
                    validate_initialized_coven_schema(
                        &tx,
                        write_policy == WritePolicy::MergeConcurrent && resolved.has_scoped_graph(),
                    )?;
                } else {
                    initialize_coven_metadata_on(
                        &tx,
                        write_policy,
                        &resolved,
                        write_policy == WritePolicy::MergeConcurrent && resolved.has_scoped_graph(),
                    )?;
                }
                pin_host_device_id_on(&tx, hlc.device_id(), initialized)?;
                let gates = Gates::from_tables(&tx, &synced_tables)
                    .map_err(|error| DbError::Message(error.to_string()))?;
                let blob_decls = BlobDecls::from_tables(&tx, &synced_tables)
                    .map_err(|error| DbError::Message(error.to_string()))?;
                Ok((schema_version, resolved, gates, blob_decls))
            })();
            match outcome {
                Ok(initialized) => {
                    tx.commit().map_err(DbError::from)?;
                    initialized
                }
                Err(error) => return Err(error),
            }
        };
        let sync_routing_hash = sync_routing_contract.hash();
        // Seed the register clock so a restart cannot mint a stamp behind a value
        // already on disk. Floor = max(persisted high-water, max synced-row
        // `_updated_at`).
        let persisted = conn
            .query_row(
                "SELECT value FROM protocol_state WHERE key = ?1",
                [HIGHWATER_STATE_KEY],
                |r| r.get::<_, String>(0),
            )
            .optional()
            .map_err(DbError::from)?;
        seed_from(&hlc, persisted, "HLC high-water mark in protocol_state")?;
        let seed_wall_ms = hlc.wall_now_ms();
        let seed_bound_ms = seed_wall_ms.saturating_add(MAX_FUTURE_SKEW_MS);
        let on_disk = scan_max_updated_at(&conn, &synced_tables, seed_bound_ms)?;
        seed_from(&hlc, on_disk, "`_updated_at` in synced tables")?;

        let stamper = UpdatedAtStamper::new(hlc.clone());
        let synced_tables = Arc::new(synced_tables);
        let gates = Arc::new(gates);
        let blob_decls = Arc::new(blob_decls);
        blob_decls
            .install_cleanup_guards(&conn)
            .map_err(|e| DbError::Message(e.to_string()))?;
        gate::attach_empty_clone(&conn, &gates)
            .map_err(|error| DbError::Message(format!("install host transaction gate: {error}")))?;
        let core = DatabaseCore {
            conn,
            hlc,
            synced_tables,
            schema_version,
            sync_routing_hash,
            gates,
            blob_decls,
            blob_tombstone_grace,
            transfer_limits,
            write_policy,
        };
        let state = core.state();

        Ok((core, state, stamper))
    }

    /// Open the connection at `path` read-only: a `SQLITE_OPEN_READONLY`
    /// connection resolving the same gate/blob models a writer open resolves, but
    /// running no migration ladder and no schema/bookkeeping writes. It refuses a
    /// db a newer binary migrated past this one (the writer's `SchemaTooNew`
    /// policy), since its models must understand the on-disk schema. Backs
    /// [`Database::open_read_only`]; see it for why a reader takes no store lock.
    fn open_read_only(
        path: &Path,
        synced_tables: Vec<SyncedTable>,
        blob_tombstone_grace: chrono::Duration,
        transfer_limits: crate::blob::TransferLimits,
        write_policy: WritePolicy,
        hlc: Arc<Hlc>,
        migrations: &[Migration],
    ) -> Result<(Self, DatabaseState), OpenError> {
        let conn = open_connection_read_only(path)?;
        // `foreign_keys` is a per-connection runtime setting, not a write to the db
        // file, so it is allowed on a read-only connection; keeping it on matches the
        // writer's relational view. A read never inserts, so it enforces nothing new.
        conn.pragma_update(None, "foreign_keys", "ON")
            .map_err(DbError::from)?;
        // Open against the on-disk schema exactly as the writer left it: run no
        // migration ladder (that writes), but refuse a schema newer than this binary
        // knows — the same policy `run_migrations` applies — because the gate and blob
        // models below are resolved against a schema this binary must understand.
        let schema_version = crate::migration::ensure_schema_supported(&conn, migrations)?;

        // Reads only (PRAGMA table_info): assert the host tables the writer created
        // still present the synced-table contract, so a wrong schema fails loud at
        // open rather than mid-read.
        validate_host_synced_tables(&conn, &synced_tables)?;
        let pinned_routing_contract = load_coven_metadata(&conn, write_policy)?;
        validate_initialized_coven_schema(
            &conn,
            write_policy == WritePolicy::MergeConcurrent
                && pinned_routing_contract.has_scoped_graph(),
        )?;
        validate_host_device_id_on(&conn, hlc.device_id())?;
        let sync_routing_contract = SyncRoutingContract::from_connection(&conn, &synced_tables)
            .map_err(|error| DbError::Message(error.to_string()))?;
        validate_sync_routing_contract(&pinned_routing_contract, &sync_routing_contract)?;
        let sync_routing_hash = sync_routing_contract.hash();

        let synced_tables = Arc::new(synced_tables);

        // No register-clock seeding: a reader never mints an `_updated_at`, so it has
        // no stamp to keep ahead of on-disk values.
        let gates = Arc::new(
            Gates::from_tables(&conn, &synced_tables)
                .map_err(|e| DbError::Message(e.to_string()))?,
        );
        let blob_decls = Arc::new(
            BlobDecls::from_tables(&conn, &synced_tables)
                .map_err(|e| DbError::Message(e.to_string()))?,
        );
        let core = DatabaseCore {
            conn,
            hlc,
            synced_tables,
            schema_version,
            sync_routing_hash,
            gates,
            blob_decls,
            blob_tombstone_grace,
            transfer_limits,
            write_policy,
        };
        let state = core.state();
        Ok((core, state))
    }

    fn state(&self) -> DatabaseState {
        DatabaseState {
            write_policy: self.write_policy,
            hlc: self.hlc.clone(),
            synced_tables: self.synced_tables.clone(),
            schema_version: self.schema_version,
            sync_routing_hash: self.sync_routing_hash,
            gates: self.gates.clone(),
            blob_decls: self.blob_decls.clone(),
            blob_tombstone_grace: self.blob_tombstone_grace,
            transfer_limits: self.transfer_limits,
            membership_load: Arc::new(tokio::sync::Mutex::new(())),
            membership_mutation: Arc::new(tokio::sync::Mutex::new(())),
            snapshot_publication: Arc::new(tokio::sync::Mutex::new(())),
            local_blob_cleanup: Arc::new(tokio::sync::Mutex::new(())),
            ids: Arc::new(crate::id_provider::UuidProvider),
            write_statuses: Arc::new(std::sync::Mutex::new(HashMap::new())),
            #[cfg(any(test, feature = "test-utils"))]
            test_pause_points: Arc::new(TestPausePoints::default()),
        }
    }

    fn connection(&self) -> &Connection {
        &self.conn
    }
}

/// A unit of work for the connection thread: a caller's closure to run against
/// the owned core, or the sentinel the last [`Database`] clone sends as it drops
/// to stop the thread. A `Run` closure carries its own reply channel, so it
/// returns `()` — [`Database::on_connection_thread`] builds it to capture the
/// caller's result and send it back.
enum DbJob {
    Run(Box<dyn FnOnce(&mut DatabaseCore) + Send>),
    Stop,
}

/// The connection thread's send channel and join handle, shared by every
/// [`Database`] clone through an `Arc`. The last clone to drop shuts the thread
/// down and joins it, so the connection closes on the thread that owned it before
/// control returns to the dropper.
struct ConnectionThread {
    jobs: tokio::sync::mpsc::UnboundedSender<DbJob>,
    join: Option<std::thread::JoinHandle<()>>,
}

impl Drop for ConnectionThread {
    fn drop(&mut self) {
        // Reached only when the last `Database` clone drops — no other clone can
        // still be sending. Queue `Stop` behind whatever jobs are already in
        // flight so the thread drains them, exits, and drops the core (closing the
        // connection). A send error means the thread already stopped.
        let _ = self.jobs.send(DbJob::Stop);
        let handle = match self.join.take() {
            Some(handle) => handle,
            None => return,
        };
        if tokio::runtime::Handle::try_current().is_ok() {
            // A `Database` handle roams freely across async tasks, so this last
            // drop can land inside a runtime task. Joining here would block that
            // worker until the queue drains — the very stall this thread exists to
            // remove. Detach instead: the thread drains its queue, drops the core,
            // and exits on its own. Every queued job's effect is durable, so a
            // thread left unjoined loses nothing; only the deterministic close
            // moves off this task.
            drop(handle);
        } else {
            // Sync context — tests, process teardown — where there is no worker to
            // stall. Join for a deterministic shutdown: the connection is fully
            // closed before we return. Jobs run under `catch_unwind`, so the thread
            // never unwinds from a caller's closure; a join error is a real fault
            // (a panic in the core's own drop) and is surfaced, not swallowed.
            if handle.join().is_err() {
                error!("database connection thread panicked");
            }
        }
    }
}

/// Own the connection on this thread and run each queued job in send order until
/// `Stop`. The channel's FIFO is the serialization the `tokio::Mutex` used to
/// provide, and the connection never leaves this thread.
fn run_connection_thread(
    mut core: DatabaseCore,
    mut jobs: tokio::sync::mpsc::UnboundedReceiver<DbJob>,
) {
    while let Some(job) = jobs.blocking_recv() {
        match job {
            DbJob::Run(f) => f(&mut core),
            DbJob::Stop => break,
        }
    }
    // Loop exited: drop `core` here — closing the connection on the thread that
    // has owned it throughout.
}

/// A handle to the owned database. Cloneable; every clone sends work to the one
/// connection thread over the same channel, so access serializes as the channel's
/// FIFO.
#[derive(Clone)]
pub struct Database {
    thread: Arc<ConnectionThread>,
    state: DatabaseState,
}

pub(crate) struct PreparedStoreWrite {
    pub write_id: WriteId,
    pub changeset: Vec<u8>,
    pub partitions: PreparedStoreWritePartitions,
    pub inverse_changeset: Vec<u8>,
    pub base: StoreWriteBase,
    pub blob_facts: StoreWriteBlobFacts,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub(crate) struct PreparedStoreWritePartitions {
    pub store: Option<gate::AudiencePartition>,
    pub circles: Vec<gate::AudiencePartition>,
}

#[derive(Clone, Copy)]
enum StoreWriteRouting<'a> {
    Unscoped,
    MergeScoped(&'a EncryptionService),
    SerialScoped,
}

impl PreparedStoreWritePartitions {
    #[cfg(test)]
    pub(crate) fn iter(&self) -> impl Iterator<Item = &gate::AudiencePartition> {
        self.store.iter().chain(self.circles.iter())
    }
}

pub(crate) struct SerialStoreBranchPreparationWork {
    pub branch_id: PendingBranchId,
    pub base: Option<StoreBatchCommitRef>,
    pub writes: Vec<PreparedStoreWrite>,
}

#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "snake_case", deny_unknown_fields)]
pub(crate) enum StoreWriteBase {
    MergeConcurrent {
        dependencies: BTreeMap<String, StoreBatchCommitRef>,
    },
    Serial {
        branch_id: PendingBranchId,
        base: Option<StoreBatchCommitRef>,
    },
}

#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(crate) struct StoreWriteBlobFacts {
    pub blobs: Vec<StoreWriteBlobFact>,
}

#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(crate) struct StoreWriteBlobFact {
    pub table: String,
    pub row_id: String,
    pub row_stamp: String,
    pub column: String,
    pub blob: BlobRef,
    pub plaintext_size: u64,
    pub plaintext_hash: ObjectHash,
    pub external_path: Option<PathBuf>,
    pub previous: Option<StoreWriteRemoteBlob>,
}

#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(crate) struct StoreWriteRemoteBlob {
    pub authority: crate::sync::audience_package::PackageAudience,
    pub stored: StoredBlobRef,
}

impl StoreWriteBlobFact {
    fn identity_key(&self) -> (String, String, String, String) {
        (
            self.table.clone(),
            self.row_id.clone(),
            self.column.clone(),
            self.row_stamp.clone(),
        )
    }
}

#[derive(Debug, Clone)]
pub(crate) struct ExactProtocolObject<T> {
    pub value: T,
    pub bytes: Vec<u8>,
    pub object: ExactObjectRef,
    pub prepared: PreparedExactObject,
}

#[derive(Debug, Clone)]
pub(crate) struct CanonicalProtocolObject<T> {
    pub value: T,
    pub bytes: Vec<u8>,
}

pub(crate) struct PreparedProtocolObject<T> {
    pub value: T,
    pub prepared: PreparedExactObject,
}

#[derive(Debug, Clone)]
pub(crate) struct PreparedStoreWriteCommit {
    pub audiences: PreparedAudienceObjects,
    pub commit: ExactProtocolObject<StoreBatchCommit>,
    pub head: ExactProtocolObject<StoreDeviceHead>,
}

#[derive(Debug, Clone)]
pub(crate) struct BlockedMergeCandidate {
    pub commit: ExactProtocolObject<StoreBatchCommit>,
    pub head: ExactProtocolObject<StoreDeviceHead>,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(crate) enum MergeAbandonmentState {
    None,
    Prepared,
    Accepted,
    CandidateWon,
    OtherWon,
}

#[derive(Debug, Clone)]
pub(crate) struct PreparedSerialStoreWriteCommit {
    pub audiences: PreparedAudienceObjects,
    pub commit: ExactProtocolObject<StoreBatchCommit>,
}

#[derive(Debug, Clone)]
pub(crate) struct PreparedSerialStoreBranch {
    pub branch_id: PendingBranchId,
    pub base: Option<StoreBatchCommitRef>,
    pub base_head_bytes: Option<Vec<u8>>,
    pub base_head_version: Option<VersionToken>,
    pub writes: Vec<PreparedSerialStoreWriteCommit>,
    pub head: CanonicalProtocolObject<StoreSerialHead>,
}

#[derive(Debug, Clone)]
pub(crate) struct PreparedSerialCandidateAbandonment {
    pub branch_id: PendingBranchId,
    pub base: Option<StoreBatchCommitRef>,
    pub base_head: VersionedObject,
    pub authority: ExactProtocolObject<StoreBatchCommit>,
    pub head: CanonicalProtocolObject<StoreSerialHead>,
    pub original_head_bytes: Vec<u8>,
    durable_state: String,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum SerialBranchDiscardState {
    Local,
    Abandonment,
    Conflict,
}

#[derive(Debug, Clone)]
pub(crate) struct UnresolvedSerialBranch {
    pub branch_id: PendingBranchId,
    pub base: Option<StoreBatchCommitRef>,
    pub conflicted: bool,
}

#[derive(Debug, Clone)]
pub(crate) struct OutboundStoreAck {
    pub reference: StoreAckRef,
    pub ack: ExactProtocolObject<StoreAck>,
}

#[derive(Debug, Clone)]
pub(crate) struct PublishedStoreAck {
    pub reference: StoreAckRef,
    pub successor_slot: crate::storage::cloud::ObjectSlot,
}

#[derive(Debug, Clone)]
pub(crate) struct DurableFounderGraph {
    pub root: ExactProtocolObject<StoreProtocolRoot>,
    pub registration: ExactProtocolObject<StoreDeviceRegistration>,
    pub initial_ack: ExactProtocolObject<StoreAck>,
    pub initial_ack_ref: StoreAckRef,
    pub membership: DurableFounderMembership,
    pub registration_state: LocalDeviceRegistrationState,
}

#[derive(Debug, Clone)]
pub(crate) enum DurableFounderMembership {
    MergeConcurrent {
        entry: ExactProtocolObject<MembershipEntry>,
        entry_ref: MembershipEntryRef,
        head: ExactProtocolObject<AuthorHead>,
        head_ref: MembershipHeadRef,
    },
    Serial,
}

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "snake_case", deny_unknown_fields)]
enum DurableFounderMembershipJournal {
    MergeConcurrent {
        entry_ref: MembershipEntryRef,
        entry_bytes: Vec<u8>,
        entry_prepared: PreparedExactObject,
        head_ref: MembershipHeadRef,
        head_bytes: Vec<u8>,
        head_prepared: PreparedExactObject,
    },
    Serial,
}

impl DurableFounderMembershipJournal {
    fn from_graph(graph: &DurableFounderMembership) -> Self {
        match graph {
            DurableFounderMembership::MergeConcurrent {
                entry,
                entry_ref,
                head,
                head_ref,
            } => Self::MergeConcurrent {
                entry_ref: entry_ref.clone(),
                entry_bytes: entry.bytes.clone(),
                entry_prepared: entry.prepared.clone(),
                head_ref: head_ref.clone(),
                head_bytes: head.bytes.clone(),
                head_prepared: head.prepared.clone(),
            },
            DurableFounderMembership::Serial => Self::Serial,
        }
    }

    fn into_graph(self) -> Result<DurableFounderMembership, DbError> {
        match self {
            Self::MergeConcurrent {
                entry_ref,
                entry_bytes,
                entry_prepared,
                head_ref,
                head_bytes,
                head_prepared,
            } => {
                let entry_value: MembershipEntry =
                    serde_json::from_slice(&entry_bytes).map_err(|error| {
                        DbError::Message(format!("local founder membership entry: {error}"))
                    })?;
                let head_value: AuthorHead =
                    serde_json::from_slice(&head_bytes).map_err(|error| {
                        DbError::Message(format!("local founder membership head: {error}"))
                    })?;
                Ok(DurableFounderMembership::MergeConcurrent {
                    entry: ExactProtocolObject {
                        value: entry_value,
                        bytes: entry_bytes,
                        object: entry_prepared.reference().clone(),
                        prepared: entry_prepared,
                    },
                    entry_ref,
                    head: ExactProtocolObject {
                        value: head_value,
                        bytes: head_bytes,
                        object: head_prepared.reference().clone(),
                        prepared: head_prepared,
                    },
                    head_ref,
                })
            }
            Self::Serial => Ok(DurableFounderMembership::Serial),
        }
    }
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub(crate) enum FounderMembershipRefs {
    MergeConcurrent {
        entry: MembershipEntryRef,
        head: MembershipHeadRef,
    },
    Serial,
}

fn founder_graph_identity(graph: &DurableFounderGraph) -> ObjectHash {
    let membership = match &graph.membership {
        DurableFounderMembership::MergeConcurrent {
            entry,
            entry_ref,
            head,
            head_ref,
        } => serde_json::to_vec(&(
            entry_ref,
            &entry.bytes,
            &entry.prepared,
            head_ref,
            &head.bytes,
            &head.prepared,
        )),
        DurableFounderMembership::Serial => serde_json::to_vec(&"serial"),
    }
    .expect("founder membership graph serialization cannot fail");
    ObjectHash::digest(
        &serde_json::to_vec(&(
            &graph.root.bytes,
            &graph.root.prepared,
            &graph.registration.bytes,
            &graph.registration.prepared,
            &graph.initial_ack_ref,
            &graph.initial_ack.bytes,
            &graph.initial_ack.prepared,
            membership,
        ))
        .expect("founder graph serialization cannot fail"),
    )
}

fn load_store_root_authority_on(
    conn: &Connection,
) -> Result<Option<(crate::sync::store_commit::StoreRootRef, StoreProtocolRoot)>, DbError> {
    conn.query_row(
        "SELECT store_root_hash, store_protocol_root_bytes, store_root_object \
         FROM store_protocol_root_authority WHERE singleton = 1",
        [],
        |row| {
            Ok((
                row.get::<_, String>(0)?,
                row.get::<_, Vec<u8>>(1)?,
                row.get::<_, String>(2)?,
            ))
        },
    )
    .optional()
    .map_err(DbError::from)?
    .map(|(hash, bytes, object)| {
        let value = StoreProtocolRoot::parse(&bytes)
            .map_err(|error| DbError::Message(format!("Store root authority bytes: {error}")))?;
        let store_root_hash: ObjectHash = hash.parse().map_err(|error| {
            DbError::Message(format!("Store root authority semantic hash: {error}"))
        })?;
        let object: ExactObjectRef = serde_json::from_str(&object)
            .map_err(|error| DbError::Message(format!("Store root authority object: {error}")))?;
        if value.object_hash() != store_root_hash {
            return Err(DbError::Message(
                "Store root authority hash differs from its signed bytes".to_string(),
            ));
        }
        Ok((
            crate::sync::store_commit::StoreRootRef {
                store_root_id: value.descriptor.store_root_id(),
                store_root_hash,
                object,
            },
            value,
        ))
    })
    .transpose()
}

fn required_store_root_authority_on(
    conn: &Connection,
) -> Result<crate::sync::store_commit::StoreRootRef, DbError> {
    load_store_root_authority_on(conn)?
        .map(|(reference, _)| reference)
        .ok_or_else(|| DbError::Message("exact Store root authority is absent".to_string()))
}

fn install_store_root_authority_on(
    conn: &Connection,
    reference: &crate::sync::store_commit::StoreRootRef,
    bytes: &[u8],
) -> Result<(), DbError> {
    let value = StoreProtocolRoot::parse(bytes)
        .map_err(|error| DbError::Message(format!("install Store root authority: {error}")))?;
    if value.object_hash() != reference.store_root_hash {
        return Err(DbError::Message(
            "installed Store root reference differs from its signed bytes".to_string(),
        ));
    }
    let object = serde_json::to_string(&reference.object)
        .map_err(|error| DbError::Message(format!("serialize Store root authority: {error}")))?;
    let existing = load_store_root_authority_on(conn)?;
    if let Some((existing_reference, existing_value)) = existing {
        if existing_reference == *reference && existing_value == value {
            return Ok(());
        }
        return Err(DbError::Message(
            "database already trusts a different exact Store root".to_string(),
        ));
    }
    conn.execute(
        "INSERT INTO store_protocol_root_authority \
         (singleton, store_root_hash, store_protocol_root_bytes, store_root_object) \
         VALUES (1, ?1, ?2, ?3)",
        rusqlite::params![reference.store_root_hash.to_string(), bytes, object],
    )
    .map(|_| ())
    .map_err(DbError::from)
}

fn install_store_founder_state_on(
    conn: &Connection,
    root: &crate::sync::store_commit::StoreRootRef,
    founder_reference: &StoreDeviceRegistrationRef,
    founder: &StoreDeviceRegistration,
    founder_bytes: &[u8],
    genesis: &ResolvedStoreDeviceState,
) -> Result<(), DbError> {
    if founder.store_root != *root {
        return Err(DbError::Message(
            "Store founder registration belongs to another exact root".to_string(),
        ));
    }
    founder_reference
        .verify_registration(founder)
        .map_err(|error| DbError::Message(error.to_string()))?;
    if founder.to_bytes() != founder_bytes {
        return Err(DbError::Message(
            "Store founder registration differs from its exact bytes".to_string(),
        ));
    }
    let founder_authority = crate::sync::store_commit::StoreDeviceRegistrationActivation::Founder {
        root: root.clone(),
    };
    let founder_values = (
        founder_reference.registration_hash.to_string(),
        founder.author_pubkey.clone(),
        founder.device_signing_pubkey.clone(),
        founder_bytes.to_vec(),
        serde_json::to_string(founder_reference).map_err(|error| {
            DbError::Message(format!("serialize Store founder registration ref: {error}"))
        })?,
        serde_json::to_string(&founder_authority).map_err(|error| {
            DbError::Message(format!("serialize Store founder activation: {error}"))
        })?,
    );
    conn.execute(
        "INSERT INTO store_device_registration_activations
         (device_id, registration_hash, author_pubkey, device_signing_pubkey,
          registration_bytes, registration_object, activation_authority)
         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
         ON CONFLICT(device_id) DO NOTHING",
        rusqlite::params![
            founder.device_id.to_string(),
            &founder_values.0,
            &founder_values.1,
            &founder_values.2,
            &founder_values.3,
            &founder_values.4,
            &founder_values.5,
        ],
    )
    .map_err(DbError::from)?;
    let stored_founder: (String, String, String, Vec<u8>, String, String) = conn
        .query_row(
            "SELECT registration_hash, author_pubkey, device_signing_pubkey,
                    registration_bytes, registration_object, activation_authority
             FROM store_device_registration_activations WHERE device_id = ?1",
            [founder.device_id.to_string()],
            |row| {
                Ok((
                    row.get(0)?,
                    row.get(1)?,
                    row.get(2)?,
                    row.get(3)?,
                    row.get(4)?,
                    row.get(5)?,
                ))
            },
        )
        .map_err(DbError::from)?;
    if stored_founder != founder_values {
        return Err(DbError::Message(
            "Store founder activation differs from installed exact authority".to_string(),
        ));
    }
    let genesis = serde_json::to_string(genesis)
        .map_err(|error| DbError::Message(format!("serialize Store device genesis: {error}")))?;
    conn.execute(
        "INSERT OR IGNORE INTO protocol_state (key, value) VALUES (?1, ?2)",
        (STORE_DEVICE_GENESIS_STATE_KEY, &genesis),
    )
    .map_err(DbError::from)?;
    let stored_genesis: String = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [STORE_DEVICE_GENESIS_STATE_KEY],
            |row| row.get(0),
        )
        .map_err(DbError::from)?;
    if stored_genesis != genesis {
        return Err(DbError::Message(
            "Store device genesis differs from installed exact authority".to_string(),
        ));
    }
    Ok(())
}

fn validate_founder_graph(graph: &DurableFounderGraph) -> Result<(), DbError> {
    let root = StoreProtocolRoot::parse(&graph.root.bytes)
        .map_err(|error| DbError::Message(format!("founder Store root: {error}")))?;
    if root != graph.root.value
        || root.object_hash() != graph.root.value.object_hash()
        || graph.root.object != *graph.root.prepared.reference()
    {
        return Err(DbError::Message(
            "founder Store root differs from its prepared exact object".to_string(),
        ));
    }
    let root_ref = crate::sync::store_commit::StoreRootRef {
        store_root_id: root.descriptor.store_root_id(),
        store_root_hash: root.object_hash(),
        object: graph.root.object.clone(),
    };
    let registration = StoreDeviceRegistration::parse_at(
        &graph.registration.bytes,
        &root_ref,
        graph.registration.value.device_id,
    )
    .map_err(|error| DbError::Message(format!("founder Store registration: {error}")))?;
    if registration != graph.registration.value
        || graph.registration.object != *graph.registration.prepared.reference()
        || registration.author_pubkey != root.descriptor.founder_pubkey
        || graph.registration.object.slot() != &root.descriptor.founder_registration
        || registration.provider != root.descriptor.founder_provider_admin.provider
        || !matches!(
            registration.origin,
            crate::sync::store_commit::StoreDeviceRegistrationOrigin::Founder { .. }
        )
    {
        return Err(DbError::Message(
            "founder registration differs from its root or prepared exact object".to_string(),
        ));
    }
    let registration_ref = StoreDeviceRegistrationRef::from_registration(
        &registration,
        graph.registration.object.clone(),
    );
    let initial_ack = StoreAck::parse_at(
        &graph.initial_ack.bytes,
        root_ref.store_root_hash,
        &graph.initial_ack_ref,
        &registration,
    )
    .map_err(|error| DbError::Message(format!("founder initial acknowledgement: {error}")))?;
    if initial_ack != graph.initial_ack.value
        || graph.initial_ack_ref.revision != 1
        || graph.initial_ack_ref.object != graph.initial_ack.object
        || graph.initial_ack.object != *graph.initial_ack.prepared.reference()
        || initial_ack.predecessor.is_some()
        || initial_ack.author_registration != registration_ref
        || match (&root.descriptor.write_policy, &initial_ack.store_cut) {
            (
                crate::WritePolicy::MergeConcurrent,
                crate::sync::store_commit::StoreHistoryCut::MergeConcurrent(commits),
            ) => !commits.is_empty(),
            (
                crate::WritePolicy::Serial,
                crate::sync::store_commit::StoreHistoryCut::Serial(
                    crate::sync::store_commit::StoreSerialPredecessor::Genesis {
                        root: ack_root,
                        founder_registration,
                    },
                ),
            ) => ack_root != &root_ref || founder_registration != &registration_ref,
            _ => true,
        }
    {
        return Err(DbError::Message(
            "founder initial acknowledgement differs from its exact root graph".to_string(),
        ));
    }
    match (&root.descriptor.membership, &graph.membership) {
        (
            crate::sync::store_commit::StoreMembershipGenesis::MergeConcurrent { .. },
            DurableFounderMembership::MergeConcurrent {
                entry,
                entry_ref,
                head,
                head_ref,
            },
        ) => {
            let parsed_entry: MembershipEntry = serde_json::from_slice(&entry.bytes)
                .map_err(|error| DbError::Message(format!("founder membership entry: {error}")))?;
            if parsed_entry != entry.value
                || root
                    .descriptor
                    .validate_merge_founder_entry(&parsed_entry)
                    .is_err()
                || entry_ref.coord != parsed_entry.coord()
                || entry_ref.object != entry.object
                || entry.object != *entry.prepared.reference()
            {
                return Err(DbError::Message(
                    "founder membership entry differs from its root or exact reference".to_string(),
                ));
            }
            let parsed_head: AuthorHead = serde_json::from_slice(&head.bytes)
                .map_err(|error| DbError::Message(format!("founder membership head: {error}")))?;
            let anchor = parsed_entry.change.membership_anchor().ok_or_else(|| {
                DbError::Message("founder entry has no Store membership anchor".to_string())
            })?;
            let crate::sync::store_commit::GrantStreamAnchor::StoreMembership { first_slot } =
                anchor
            else {
                return Err(DbError::Message(
                    "founder membership entry uses a recovery anchor".to_string(),
                ));
            };
            if parsed_head != head.value
                || !parsed_head.verify(&registration)
                || parsed_head.author_registration != registration_ref
                || parsed_head.entry != *entry_ref
                || parsed_head.predecessor.is_some()
                || parsed_head.entry_coord() != parsed_entry.coord()
                || head_ref.coord != parsed_entry.coord()
                || head_ref.head_hash != parsed_head.head_hash()
                || head_ref.object != head.object
                || head.object != *head.prepared.reference()
                || head.object.slot() != &first_slot
                || parsed_head.successor.activation
                    != StreamActivationId::store_membership(
                        &root_ref,
                        &registration_ref,
                        &parsed_entry.author_owner_grant,
                        &crate::sync::store_commit::GrantStreamAnchor::StoreMembership {
                            first_slot: first_slot.clone(),
                        },
                    )
            {
                return Err(DbError::Message(
                    "founder membership head differs from its exact root graph".to_string(),
                ));
            }
        }
        (
            crate::sync::store_commit::StoreMembershipGenesis::Serial,
            DurableFounderMembership::Serial,
        ) => {}
        _ => {
            return Err(DbError::Message(
                "founder membership graph differs from the root policy".to_string(),
            ))
        }
    }
    Ok(())
}

fn consume_store_creation_probes_on(
    conn: &Connection,
    graph: &DurableFounderGraph,
) -> Result<(), DbError> {
    use crate::sync::provider::{
        ExactProbeProgress, ProviderProbeJournalRecord, SerialProbeProgress,
    };
    use crate::sync::store_protocol_root::{
        StoreCreationAttempt, StoreCreationProbeIds, STORE_CREATION_ATTEMPT_STATE_KEY,
    };

    let attempt_json: String = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [STORE_CREATION_ATTEMPT_STATE_KEY],
            |row| row.get(0),
        )
        .map_err(DbError::from)?;
    let attempt: StoreCreationAttempt = serde_json::from_str(&attempt_json)
        .map_err(|error| DbError::Message(format!("parse Store creation attempt: {error}")))?;
    let StoreCreationAttempt::FounderGraphReserved(graph_reservation) = attempt else {
        return Err(DbError::Message(
            "Store creation attempt has not reserved the complete founder graph".to_string(),
        ));
    };
    let reservation = &graph_reservation.descriptor;
    let descriptor = &graph.root.value.descriptor;
    let founder = reservation.membership.founder();
    let authority = &founder.root.authority;
    if authority.creation_id != descriptor.creation_id
        || authority.founder_grant != descriptor.founder_grant
        || authority.provider_admin_grant != descriptor.founder_provider_admin.grant_id
        || authority.binding.store != descriptor.provider
        || authority.binding.device != descriptor.founder_provider_admin.provider
        || authority.founder_pubkey != descriptor.founder_pubkey
        || authority.write_policy != descriptor.write_policy
        || authority.schema_version != descriptor.schema_version
        || authority.sync_routing_hash != descriptor.sync_routing_hash
        || founder.root.root_slot != descriptor.root_slot
        || founder.registration_slot != descriptor.founder_registration
        || &reservation.recovery_slot != descriptor.founder_recovery.first_slot()
        || match (&reservation.membership, &descriptor.membership) {
            (
                crate::sync::store_protocol_root::MembershipReservation::MergeConcurrent {
                    first_slot,
                    ..
                },
                crate::sync::store_commit::StoreMembershipGenesis::MergeConcurrent {
                    founder_membership,
                },
            ) => founder_membership.first_slot() != first_slot,
            (
                crate::sync::store_protocol_root::MembershipReservation::Serial { .. },
                crate::sync::store_commit::StoreMembershipGenesis::Serial,
            ) => false,
            _ => true,
        }
    {
        return Err(DbError::Message(
            "signed Store descriptor differs from its durable creation attempt".to_string(),
        ));
    }
    if graph.registration.value.store_commits != graph_reservation.store_commits
        || graph.registration.value.acknowledgements != graph_reservation.acknowledgements
        || graph.registration.value.snapshots != graph_reservation.snapshots
        || graph.initial_ack.value.last_sync != authority.founder_timestamp
        || graph.initial_ack.value.successor.next_slot != graph_reservation.next_ack_slot
        || match (&graph.membership, &graph_reservation.membership) {
            (
                DurableFounderMembership::MergeConcurrent { entry, head, .. },
                crate::sync::store_protocol_root::FounderMembershipPublicationReservation::MergeConcurrent {
                    next_head_slot,
                },
            ) => {
                entry.value.created_at != authority.founder_timestamp
                    || head.value.successor.next_slot != *next_head_slot
            }
            (
                DurableFounderMembership::Serial,
                crate::sync::store_protocol_root::FounderMembershipPublicationReservation::Serial,
            ) => false,
            _ => true,
        }
    {
        return Err(DbError::Message(
            "signed founder graph differs from its durable slot reservation".to_string(),
        ));
    }

    let load_probe = |probe_id: crate::sync::provider::ProviderProbeId| {
        let key = format!("provider_probe/{}", hex::encode(probe_id.as_bytes()));
        let value: String = conn
            .query_row(
                "SELECT value FROM protocol_state WHERE key = ?1",
                [&key],
                |row| row.get(0),
            )
            .map_err(DbError::from)?;
        let record = serde_json::from_str(&value)
            .map_err(|error| DbError::Message(format!("parse provider probe journal: {error}")))?;
        Ok::<_, DbError>((key, record))
    };
    let (exact_id, serial_id) = match authority.probes {
        StoreCreationProbeIds::MergeConcurrent { exact_slots } => (exact_slots, None),
        StoreCreationProbeIds::Serial {
            exact_slots,
            serial_coordination,
        } => (exact_slots, Some(serial_coordination)),
    };
    let (exact_key, exact) = load_probe(exact_id)?;
    let ProviderProbeJournalRecord::Exact(exact) = exact else {
        return Err(DbError::Message(
            "Store creation exact probe id names another probe kind".to_string(),
        ));
    };
    let ExactProbeProgress::ReceiptReady { receipt } = exact.progress else {
        return Err(DbError::Message(
            "Store creation exact probe has no terminal receipt".to_string(),
        ));
    };
    if receipt != descriptor.founder_provider_admin.capability.exact_slots {
        return Err(DbError::Message(
            "signed Store descriptor differs from its terminal exact probe".to_string(),
        ));
    }
    let mut consumed_keys = vec![exact_key];
    match (
        serial_id,
        &descriptor
            .founder_provider_admin
            .capability
            .serial_coordination,
    ) {
        (None, None) => {}
        (Some(probe_id), Some(expected)) => {
            let (key, serial) = load_probe(probe_id)?;
            let ProviderProbeJournalRecord::Serial(serial) = serial else {
                return Err(DbError::Message(
                    "Store creation serial probe id names another probe kind".to_string(),
                ));
            };
            let SerialProbeProgress::ReceiptReady { receipt } = serial.progress else {
                return Err(DbError::Message(
                    "Store creation serial probe has no terminal receipt".to_string(),
                ));
            };
            if &receipt != expected {
                return Err(DbError::Message(
                    "signed Store descriptor differs from its terminal serial probe".to_string(),
                ));
            }
            consumed_keys.push(key);
        }
        _ => {
            return Err(DbError::Message(
                "Store creation probe policy differs from the signed descriptor".to_string(),
            ))
        }
    }
    consumed_keys.push(STORE_CREATION_ATTEMPT_STATE_KEY.to_string());
    for key in consumed_keys {
        let deleted = conn
            .execute("DELETE FROM protocol_state WHERE key = ?1", [key])
            .map_err(DbError::from)?;
        if deleted != 1 {
            return Err(DbError::Message(
                "Store creation journal disappeared during typed consumption".to_string(),
            ));
        }
    }
    Ok(())
}

fn load_local_store_founder_graph_on(
    conn: &Connection,
) -> Result<Option<DurableFounderGraph>, DbError> {
    let owned_rows: i64 = conn
        .query_row(
            "SELECT EXISTS(SELECT 1 FROM local_store_protocol_root) \
                  + EXISTS(SELECT 1 FROM local_store_device_registration) \
                  + EXISTS(SELECT 1 FROM local_store_founder_graph)",
            [],
            |row| row.get(0),
        )
        .map_err(DbError::from)?;
    if owned_rows == 0 {
        return Ok(None);
    }
    if owned_rows != 3 {
        return Err(DbError::Message(
            "local Store founder graph is only partially durable".to_string(),
        ));
    }
    let raw = conn
        .query_row(
            "SELECT r.store_root_hash, r.store_protocol_root_bytes, r.prepared_object, \
                    d.device_id, d.registration_hash, d.registration_bytes, d.prepared_object, \
                    d.initial_ack_ref, d.initial_ack_bytes, d.initial_ack_prepared, d.state, \
                    g.membership_graph \
             FROM local_store_protocol_root r \
             CROSS JOIN local_store_device_registration d \
             CROSS JOIN local_store_founder_graph g \
             WHERE r.singleton = 1 AND d.singleton = 1 AND g.singleton = 1",
            [],
            |row| {
                Ok((
                    row.get::<_, String>(0)?,
                    row.get::<_, Vec<u8>>(1)?,
                    row.get::<_, String>(2)?,
                    row.get::<_, String>(3)?,
                    row.get::<_, String>(4)?,
                    row.get::<_, Vec<u8>>(5)?,
                    row.get::<_, String>(6)?,
                    row.get::<_, String>(7)?,
                    row.get::<_, Vec<u8>>(8)?,
                    row.get::<_, String>(9)?,
                    row.get::<_, String>(10)?,
                    row.get::<_, String>(11)?,
                ))
            },
        )
        .map_err(DbError::from)?;
    let (
        root_hash,
        root_bytes,
        root_prepared,
        device_id,
        registration_hash,
        registration_bytes,
        registration_prepared,
        initial_ack_ref,
        initial_ack_bytes,
        initial_ack_prepared,
        registration_state,
        membership_graph,
    ) = raw;
    let registration_state: LocalDeviceRegistrationState =
        serde_json::from_str(&registration_state).map_err(|error| {
            DbError::Message(format!("local registration journal state: {error}"))
        })?;
    let root_value = StoreProtocolRoot::parse(&root_bytes)
        .map_err(|error| DbError::Message(format!("local founder Store root: {error}")))?;
    let root_prepared: PreparedExactObject = serde_json::from_str(&root_prepared)
        .map_err(|error| DbError::Message(format!("local founder Store root object: {error}")))?;
    let store_root_hash: ObjectHash = root_hash
        .parse()
        .map_err(|error| DbError::Message(format!("local founder Store root hash: {error}")))?;
    if store_root_hash != root_value.object_hash() {
        return Err(DbError::Message(
            "local founder Store root hash differs from its bytes".to_string(),
        ));
    }
    let root_ref = crate::sync::store_commit::StoreRootRef {
        store_root_id: root_value.descriptor.store_root_id(),
        store_root_hash,
        object: root_prepared.reference().clone(),
    };
    let parsed_device_id = device_id
        .parse()
        .map_err(|error| DbError::Message(format!("local founder device id: {error}")))?;
    let registration_value =
        StoreDeviceRegistration::parse_at(&registration_bytes, &root_ref, parsed_device_id)
            .map_err(|error| {
                DbError::Message(format!("local founder Store registration: {error}"))
            })?;
    let parsed_registration_hash: ObjectHash = registration_hash.parse().map_err(|error| {
        DbError::Message(format!("local founder Store registration hash: {error}"))
    })?;
    if parsed_registration_hash != registration_value.registration_hash() {
        return Err(DbError::Message(
            "local founder registration hash differs from its bytes".to_string(),
        ));
    }
    let registration_prepared: PreparedExactObject = serde_json::from_str(&registration_prepared)
        .map_err(|error| {
        DbError::Message(format!("local founder registration object: {error}"))
    })?;
    let initial_ack_ref: StoreAckRef = serde_json::from_str(&initial_ack_ref)
        .map_err(|error| DbError::Message(format!("local founder initial ack ref: {error}")))?;
    let initial_ack_value = StoreAck::parse_at(
        &initial_ack_bytes,
        root_ref.store_root_hash,
        &initial_ack_ref,
        &registration_value,
    )
    .map_err(|error| DbError::Message(format!("local founder initial ack: {error}")))?;
    let initial_ack_prepared: PreparedExactObject = serde_json::from_str(&initial_ack_prepared)
        .map_err(|error| DbError::Message(format!("local founder initial ack object: {error}")))?;
    let membership = serde_json::from_str::<DurableFounderMembershipJournal>(&membership_graph)
        .map_err(|error| DbError::Message(format!("local founder membership graph: {error}")))?
        .into_graph()?;
    let graph = DurableFounderGraph {
        root: ExactProtocolObject {
            value: root_value,
            bytes: root_bytes,
            object: root_prepared.reference().clone(),
            prepared: root_prepared,
        },
        registration: ExactProtocolObject {
            value: registration_value,
            bytes: registration_bytes,
            object: registration_prepared.reference().clone(),
            prepared: registration_prepared,
        },
        initial_ack: ExactProtocolObject {
            value: initial_ack_value,
            bytes: initial_ack_bytes,
            object: initial_ack_prepared.reference().clone(),
            prepared: initial_ack_prepared,
        },
        initial_ack_ref,
        membership,
        registration_state,
    };
    validate_founder_graph(&graph)?;
    Ok(Some(graph))
}

/// The exact commit coordinate that first made a blob locator authoritative.
#[derive(Debug, Clone, PartialEq, Eq)]
pub(crate) struct BlobActivation {
    pub coord: StoreCommitCoord,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub(crate) struct PreparedAudiencePackage {
    remote_object_id: ObjectHash,
    package: AudiencePackage,
    semantic_bytes: Vec<u8>,
    stored_bytes: Vec<u8>,
    object: ExactObjectRef,
}

impl PreparedAudiencePackage {
    fn from_remote(remote: RemoteObjectRecord) -> Result<Self, DbError> {
        remote
            .validate()
            .map_err(|error| DbError::Message(format!("prepared remote package: {error}")))?;
        let is_package = match &remote {
            RemoteObjectRecord::CandidateCommit(_) | RemoteObjectRecord::RetainedAuthority(_) => {
                false
            }
            RemoteObjectRecord::CandidateExclusive(record) => matches!(
                record.identity.domain,
                CandidateExclusiveObjectDomain::StorePackage
                    | CandidateExclusiveObjectDomain::CirclePackage { .. }
            ),
            RemoteObjectRecord::SharedLiveSet(record) => matches!(
                record.identity.domain,
                SharedLiveSetObjectDomain::StorePackage | SharedLiveSetObjectDomain::CirclePackage
            ),
        };
        if !is_package {
            return Err(DbError::Message(
                "prepared package index references a non-package remote object".to_string(),
            ));
        }
        let remote_object_id = remote.object_id();
        let semantic_bytes = remote.bytes().canonical_semantic_bytes().to_vec();
        let object = remote.object().clone();
        let stored_bytes = remote
            .bytes()
            .stored()
            .inline_bytes()
            .ok_or_else(|| {
                DbError::Message("prepared package remote object is not inline".to_string())
            })?
            .to_vec();
        Self::new(remote_object_id, semantic_bytes, stored_bytes, object)
    }

    pub(crate) fn new(
        remote_object_id: ObjectHash,
        semantic_bytes: Vec<u8>,
        stored_bytes: Vec<u8>,
        object: ExactObjectRef,
    ) -> Result<Self, DbError> {
        let package = AudiencePackage::parse(&semantic_bytes)
            .map_err(|error| DbError::Message(format!("prepared audience package: {error}")))?;
        object.verify(&stored_bytes).map_err(|error| {
            DbError::Message(format!("prepared audience package stored bytes: {error}"))
        })?;
        Ok(Self {
            remote_object_id,
            package,
            semantic_bytes,
            stored_bytes,
            object,
        })
    }

    pub(crate) fn remote_object_id(&self) -> ObjectHash {
        self.remote_object_id
    }

    pub(crate) fn package(&self) -> &AudiencePackage {
        &self.package
    }

    pub(crate) fn semantic_bytes(&self) -> &[u8] {
        &self.semantic_bytes
    }

    pub(crate) fn stored_bytes(&self) -> &[u8] {
        &self.stored_bytes
    }

    pub(crate) fn object(&self) -> &ExactObjectRef {
        &self.object
    }
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub(crate) struct PreparedAudienceBlob {
    remote_object_id: ObjectHash,
    audience: RemoteAudience,
    blob: StoredBlobRef,
    spool_path: Option<PathBuf>,
}

impl PreparedAudienceBlob {
    pub(crate) fn from_remote(
        audience: RemoteAudience,
        expected_locator_hash: &str,
        remote: RemoteObjectRecord,
        spool_path: Option<PathBuf>,
    ) -> Result<Self, DbError> {
        remote
            .validate()
            .map_err(|error| DbError::Message(format!("prepared remote blob: {error}")))?;
        if !matches!(
            &remote,
            RemoteObjectRecord::SharedLiveSet(record)
                if record.identity.domain == SharedLiveSetObjectDomain::StoredBlob
        ) {
            return Err(DbError::Message(
                "prepared blob index references a non-blob remote object".to_string(),
            ));
        }
        let locator = BlobLocator::parse(remote.bytes().canonical_semantic_bytes())
            .map_err(|error| DbError::Message(format!("prepared blob locator: {error}")))?;
        if locator.locator_hash().to_string() != expected_locator_hash {
            return Err(DbError::Message(format!(
                "prepared blob locator hashes to {}, indexed as {expected_locator_hash}",
                locator.locator_hash()
            )));
        }
        if locator.audience() != audience {
            return Err(DbError::Message(format!(
                "prepared blob index audience {audience:?} differs from locator audience {:?}",
                locator.audience()
            )));
        }
        let requires_upload = matches!(
            &remote,
            RemoteObjectRecord::SharedLiveSet(record)
                if matches!(record.state, crate::sync::remote_object::OwnedObjectState::Prepared { .. })
        );
        if requires_upload && spool_path.is_none() {
            return Err(DbError::Message(
                "prepared blob awaiting upload has no local spool".to_string(),
            ));
        }
        if spool_path.as_ref().is_some_and(|path| !path.is_absolute()) {
            return Err(DbError::Message(
                "prepared blob local spool path is not absolute".to_string(),
            ));
        }
        let blob = StoredBlobRef::new(locator, remote.object().clone())
            .map_err(|error| DbError::Message(format!("prepared blob reference: {error}")))?;
        Ok(Self {
            remote_object_id: remote.object_id(),
            audience,
            blob,
            spool_path,
        })
    }

    pub(crate) fn remote_object_id(&self) -> ObjectHash {
        self.remote_object_id
    }

    pub(crate) fn audience(&self) -> &RemoteAudience {
        &self.audience
    }

    pub(crate) fn blob(&self) -> &StoredBlobRef {
        &self.blob
    }

    pub(crate) fn spool_path(&self) -> Option<&Path> {
        self.spool_path.as_deref()
    }
}

#[derive(Debug, Clone)]
pub(crate) struct PreparedAudienceObjects {
    pub packages: Vec<PreparedAudiencePackage>,
    pub blobs: Vec<PreparedAudienceBlob>,
}

pub(crate) struct PreparedRemoteObject {
    pub record: RemoteObjectRecord,
    pub spool_path: Option<PathBuf>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub(crate) enum MakeRemoteIntentState {
    Uploading,
    Cancelling,
    Publishing(WriteId),
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(crate) enum StoredBlobReferenceState {
    NotLiveRemote,
    LiveRemote,
    Unresolved,
}

fn validate_prepared_audience_blob_graph(
    object_ids: &std::collections::BTreeSet<ObjectHash>,
    audiences: &PreparedAudienceObjects,
) -> Result<(), DbError> {
    let mut indexed = std::collections::BTreeSet::new();
    for package in &audiences.packages {
        if !indexed.insert(package.remote_object_id()) {
            return Err(DbError::Message(
                "prepared audience objects contain a duplicate package body".to_string(),
            ));
        }
    }
    for blob in &audiences.blobs {
        if !indexed.insert(blob.remote_object_id()) {
            return Err(DbError::Message(
                "prepared audience objects contain a duplicate blob body".to_string(),
            ));
        }
    }
    if &indexed != object_ids {
        return Err(DbError::Message(
            "closed remote objects differ from package/blob indexes".to_string(),
        ));
    }
    validate_prepared_audience_blob_bindings(audiences)
}

fn validate_prepared_audience_blob_bindings(
    audiences: &PreparedAudienceObjects,
) -> Result<(), DbError> {
    for package in &audiences.packages {
        let audience = package.package().audience().remote_audience();
        for binding in package.package().blob_bindings() {
            if !audiences
                .blobs
                .iter()
                .any(|blob| blob.audience() == &audience && blob.blob() == binding.blob())
            {
                return Err(DbError::Message(
                    "prepared package blob binding has no exact blob index".to_string(),
                ));
            }
        }
    }
    for blob in &audiences.blobs {
        if !audiences.packages.iter().any(|package| {
            package.package().audience().remote_audience() == *blob.audience()
                && package
                    .package()
                    .blob_bindings()
                    .iter()
                    .any(|binding| binding.blob() == blob.blob())
        }) {
            return Err(DbError::Message(
                "prepared blob index has no exact package binding".to_string(),
            ));
        }
    }
    Ok(())
}

#[cfg(feature = "invariant-tests")]
#[doc(hidden)]
pub fn exercise_exact_outbound_blob_graph(
    circle: bool,
    include_body: bool,
    include_locator: bool,
    include_binding: bool,
) -> Result<(), String> {
    use crate::blob::BlobScope;
    use crate::storage::cloud::ObjectSlot;
    use crate::sync::audience_package::RowBlobLocatorBinding;
    use crate::sync::circle::CircleId;
    use crate::sync::circle_control::CircleControlCoord;
    use crate::sync::store_commit::{CandidateFamilyId, StoreCommitCoord};

    let store_root_hash = ObjectHash::digest(b"outbound-graph-store");
    let write_id = WriteId::from_generated("outbound-graph-write".to_string());
    let coord = StoreCommitCoord::Serial { sequence: 1 };
    let candidate_family = CandidateFamilyId::from_hash(ObjectHash::digest(b"outbound-family"));
    let remote_audience = if circle {
        RemoteAudience::Circle(CircleId::from_bytes([7; 16]))
    } else {
        RemoteAudience::Store
    };
    let uploader_bytes = b"outbound graph uploader registration";
    let uploader = StoreDeviceRegistrationRef {
        device_id: "01"
            .repeat(32)
            .parse::<crate::sync::store_commit::StoreDeviceId>()
            .map_err(|error| error.to_string())?,
        registration_hash: ObjectHash::digest(uploader_bytes),
        object: ExactObjectRef::new(
            ObjectSlot::logical("store-v1/registrations/outbound-graph.json".to_string())
                .map_err(|error| error.to_string())?,
            uploader_bytes.len() as u64,
            ObjectHash::digest(uploader_bytes),
        ),
    };
    let locator = BlobLocator::opaque(
        "media".to_string(),
        "blob-a".to_string(),
        uploader,
        remote_audience.clone(),
        BlobScope::Master,
        crate::KeyFingerprint::from_bytes([3; 8]),
        7,
        ObjectHash::digest(b"content"),
    )
    .map_err(|error| error.to_string())?;
    let stored_bytes = b"sealed-content".to_vec();
    let object = ExactObjectRef::new(
        ObjectSlot::logical(locator.semantic_key()).map_err(|error| error.to_string())?,
        stored_bytes.len() as u64,
        ObjectHash::digest(&stored_bytes),
    );
    let stored = StoredBlobRef::new(locator, object).map_err(|error| error.to_string())?;
    let bindings = if include_binding {
        vec![
            RowBlobLocatorBinding::new("items", "row-a", "stamp-a", "media_blob", stored.clone())
                .map_err(|error| error.to_string())?,
        ]
    } else {
        Vec::new()
    };
    let package = if let RemoteAudience::Circle(circle_id) = remote_audience {
        AudiencePackage::circle(
            store_root_hash,
            candidate_family,
            write_id.clone(),
            coord,
            1,
            circle_id,
            CircleControlCoord::Serial {
                author_pubkey: "author-a".to_string(),
                generation: 1,
                control_hash: ObjectHash::digest(b"circle-control"),
            },
            crate::KeyFingerprint::from_bytes([3; 8]),
            b"changeset".to_vec(),
            bindings,
        )
    } else {
        AudiencePackage::store(
            store_root_hash,
            candidate_family,
            write_id,
            coord,
            1,
            b"changeset".to_vec(),
            bindings,
        )
    }
    .map_err(|error| error.to_string())?;
    let package_bytes = package.to_bytes();
    let package_object = ExactObjectRef::new(
        ObjectSlot::logical("test/package".to_string()).map_err(|error| error.to_string())?,
        package_bytes.len() as u64,
        ObjectHash::digest(&package_bytes),
    );
    let package_id = ObjectHash::digest(b"package-record");
    let blob_id = ObjectHash::digest(b"blob-record");
    let packages = vec![PreparedAudiencePackage::new(
        package_id,
        package_bytes.clone(),
        package_bytes,
        package_object,
    )
    .map_err(|error| error.to_string())?];
    let blobs = if include_locator {
        vec![PreparedAudienceBlob {
            remote_object_id: blob_id,
            audience: remote_audience,
            blob: stored,
            spool_path: Some(PathBuf::from("/outbound-blob.spool")),
        }]
    } else {
        Vec::new()
    };
    let mut object_ids = std::collections::BTreeSet::from([package_id]);
    if include_body {
        object_ids.insert(blob_id);
    }
    validate_prepared_audience_blob_graph(&object_ids, &PreparedAudienceObjects { packages, blobs })
        .map_err(|error| error.to_string())
}

#[derive(Debug, Clone)]
pub(crate) struct DurableDeviceRegistration {
    pub device_id: crate::sync::store_commit::StoreDeviceId,
    pub registration_hash: ObjectHash,
    pub registration_bytes: Vec<u8>,
    pub prepared: PreparedExactObject,
    pub initial_ack_ref: StoreAckRef,
    pub initial_ack: ExactProtocolObject<StoreAck>,
    pub state: LocalDeviceRegistrationState,
}

#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "snake_case", deny_unknown_fields)]
pub(crate) enum LocalDeviceRegistrationState {
    Prepared,
    Created,
    Activated {
        authority: crate::sync::store_commit::StoreDeviceRegistrationActivation,
    },
    Retired {
        authority: crate::sync::store_commit::StoreDeviceRegistrationActivation,
        retirement: crate::sync::store_commit::StoreDeviceSelfRetirementRef,
    },
}

type PreparedLocalDeviceRegistrationRow =
    (String, String, Vec<u8>, String, String, Vec<u8>, String);
type LocalDeviceRegistrationJournalRow = (
    String,
    String,
    Vec<u8>,
    String,
    String,
    Vec<u8>,
    String,
    String,
);

impl DurableDeviceRegistration {
    pub(crate) fn is_activated(&self) -> bool {
        matches!(self.state, LocalDeviceRegistrationState::Activated { .. })
    }

    pub(crate) fn is_retired(&self) -> bool {
        matches!(self.state, LocalDeviceRegistrationState::Retired { .. })
    }
}

#[derive(Debug, Clone)]
pub(crate) struct DurableMembershipMutation {
    pub intent_hash: ObjectHash,
    pub plan_bytes: Vec<u8>,
    pub progress_bytes: Vec<u8>,
}

#[derive(Debug, Clone)]
pub(crate) struct DurableSnapshotPublication {
    pub reference: StoreSnapshotRef,
    pub meta: ExactProtocolObject<SnapshotMeta>,
    pub image: ExactProtocolObject<Vec<u8>>,
    pub blobs: Vec<PreparedSnapshotBlob>,
}

#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(crate) struct PreparedSnapshotBlob {
    pub bindings: Vec<RowBlobLocatorBinding>,
    pub authority: crate::sync::audience_package::PackageAudience,
    pub remote: RemoteObjectRecord,
    pub spool_path: Option<PathBuf>,
}

#[derive(Debug, Clone)]
pub(crate) struct PublishedStoreSnapshot {
    pub reference: StoreSnapshotRef,
    pub successor_slot: crate::storage::cloud::ObjectSlot,
    pub meta: SnapshotMeta,
}

pub(crate) struct StoreWritePreparation {
    pub write_id: WriteId,
    pub remote_objects: Vec<RemoteObjectRecord>,
    pub audiences: PreparedAudienceObjects,
    pub commit: PreparedProtocolObject<StoreBatchCommit>,
    pub head: PreparedProtocolObject<StoreDeviceHead>,
    pub local_cleanup: StoreBatchLocalCleanup,
    pub completion: StoreBatchCompletion,
}

pub(crate) struct MergeCandidateAbandonmentPreparation {
    pub write_id: WriteId,
    pub commit: PreparedProtocolObject<StoreBatchCommit>,
    pub head: PreparedProtocolObject<StoreDeviceHead>,
}

pub(crate) struct SerialCandidateAbandonmentPreparation {
    pub branch_id: PendingBranchId,
    pub candidate: StoreBatchCommitRef,
    pub commit: PreparedProtocolObject<StoreBatchCommit>,
    pub head: StoreSerialHead,
    pub original_head_bytes: Vec<u8>,
}

pub(crate) struct SerialStoreWritePreparation {
    pub branch_id: PendingBranchId,
    pub base: Option<StoreBatchCommitRef>,
    pub base_head_bytes: Option<Vec<u8>>,
    pub base_head_version: Option<VersionToken>,
    pub writes: Vec<SerialStoreWritePreparationEntry>,
    pub head: StoreSerialHead,
}

pub(crate) struct SerialStoreWritePreparationEntry {
    pub write_id: WriteId,
    pub remote_objects: Vec<RemoteObjectRecord>,
    pub audiences: PreparedAudienceObjects,
    pub commit: PreparedProtocolObject<StoreBatchCommit>,
    pub local_cleanup: StoreBatchLocalCleanup,
    pub completion: StoreBatchCompletion,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub(crate) struct CandidateCleanupObject {
    pub(crate) object: ExactObjectRef,
}

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "snake_case", deny_unknown_fields)]
enum PreparedStoreWriteState {
    MergeConcurrent {
        commit: DurablePreparedProtocolObject,
        head: DurablePreparedProtocolObject,
        local_cleanup: StoreBatchLocalCleanup,
        completion: StoreBatchCompletion,
    },
    MergeAbandonment {
        candidate_commit: DurablePreparedProtocolObject,
        candidate_head: DurablePreparedProtocolObject,
        authority_commit: DurablePreparedProtocolObject,
        authority_head: DurablePreparedProtocolObject,
        outcome: MergeAbandonmentOutcome,
        local_cleanup: StoreBatchLocalCleanup,
        completion: StoreBatchCompletion,
    },
    SerialPreparing,
    Serial {
        base_head_bytes: Option<Vec<u8>>,
        base_head_version: Option<VersionToken>,
        commit: DurablePreparedProtocolObject,
        tip_head_bytes: Option<Vec<u8>>,
        local_cleanup: StoreBatchLocalCleanup,
        completion: StoreBatchCompletion,
    },
}

#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "snake_case", deny_unknown_fields)]
enum MergeAbandonmentOutcome {
    Prepared,
    Accepted {
        authority: StoreBatchCommitRef,
    },
    Lost {
        winner_commit: StoreBatchCommitRef,
        winner_head: crate::sync::store_commit::StoreDeviceHeadRef,
    },
}

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
#[serde(deny_unknown_fields)]
struct DurableSerialCandidateAbandonment {
    branch_id: PendingBranchId,
    base: Option<StoreBatchCommitRef>,
    base_head: VersionedObject,
    candidate: StoreBatchCommitRef,
    commit: DurablePreparedProtocolObject,
    head_bytes: Vec<u8>,
    original_head_bytes: Vec<u8>,
}

struct PreparedSerialCandidate {
    commit: StoreBatchCommit,
    reference: StoreBatchCommitRef,
    canonical_signed_bytes: Vec<u8>,
}

struct PreparedMergeCandidate {
    commit: StoreBatchCommit,
    reference: StoreBatchCommitRef,
    canonical_signed_bytes: Vec<u8>,
    head: StoreDeviceHead,
    head_prepared: PreparedExactObject,
}

fn parse_prepared_merge_candidate_on(
    conn: &Connection,
    prepared: &PreparedStoreWriteState,
) -> Result<Option<PreparedMergeCandidate>, DbError> {
    let (commit, head) = match prepared {
        PreparedStoreWriteState::MergeConcurrent { commit, head, .. } => (commit, head),
        PreparedStoreWriteState::MergeAbandonment {
            candidate_commit,
            candidate_head,
            ..
        } => (candidate_commit, candidate_head),
        PreparedStoreWriteState::SerialPreparing | PreparedStoreWriteState::Serial { .. } => {
            return Ok(None);
        }
    };
    parse_prepared_merge_candidate_parts_on(conn, commit, head).map(Some)
}

fn parse_prepared_merge_candidate_parts_on(
    conn: &Connection,
    commit: &DurablePreparedProtocolObject,
    head: &DurablePreparedProtocolObject,
) -> Result<PreparedMergeCandidate, DbError> {
    let root = required_store_root_authority_on(conn)?;
    let unverified: StoreBatchCommit = serde_json::from_slice(&commit.semantic_bytes)
        .map_err(|error| DbError::Message(format!("signed Merge candidate: {error}")))?;
    let registration =
        load_activated_registration_on(conn, &root, &unverified.author_registration)?;
    let coord = StoreCommitCoord::MergeConcurrent {
        stream_id: AuthorStreamId::store_announcements(&root, &unverified.author_registration),
        sequence: unverified.seq(),
    };
    let value = StoreBatchCommit::parse_at(
        &commit.semantic_bytes,
        root.store_root_hash,
        &coord,
        &registration,
    )
    .map_err(|error| DbError::Message(format!("verify Merge candidate: {error}")))?;
    let reference =
        StoreBatchCommitRef::from_commit(&value, coord, commit.prepared.reference().clone())
            .map_err(|error| DbError::Message(error.to_string()))?;
    let head_value = StoreDeviceHead::parse_at(
        &head.semantic_bytes,
        root.store_root_hash,
        &registration,
        &reference,
    )
    .map_err(|error| DbError::Message(format!("verify Merge candidate head: {error}")))?;
    Ok(PreparedMergeCandidate {
        commit: value,
        reference,
        canonical_signed_bytes: commit.semantic_bytes.clone(),
        head: head_value,
        head_prepared: head.prepared.clone(),
    })
}

fn parse_prepared_merge_publication_on(
    conn: &Connection,
    prepared: &PreparedStoreWriteState,
) -> Result<Option<PreparedMergeCandidate>, DbError> {
    match prepared {
        PreparedStoreWriteState::MergeConcurrent { commit, head, .. } => {
            parse_prepared_merge_candidate_parts_on(conn, commit, head).map(Some)
        }
        PreparedStoreWriteState::MergeAbandonment {
            authority_commit,
            authority_head,
            ..
        } => parse_prepared_merge_candidate_parts_on(conn, authority_commit, authority_head)
            .map(Some),
        PreparedStoreWriteState::SerialPreparing | PreparedStoreWriteState::Serial { .. } => {
            Ok(None)
        }
    }
}

fn parse_prepared_serial_candidate(raw: &str) -> Result<Option<PreparedSerialCandidate>, DbError> {
    let prepared: PreparedStoreWriteState = serde_json::from_str(raw)
        .map_err(|error| DbError::Message(format!("prepared Serial candidate: {error}")))?;
    let PreparedStoreWriteState::Serial { commit, .. } = prepared else {
        return match prepared {
            PreparedStoreWriteState::SerialPreparing => Ok(None),
            PreparedStoreWriteState::MergeConcurrent { .. } => Err(DbError::Message(
                "MergeConcurrent publication reached Serial candidate state".to_string(),
            )),
            PreparedStoreWriteState::MergeAbandonment { .. } => Err(DbError::Message(
                "Merge abandonment reached Serial candidate state".to_string(),
            )),
            PreparedStoreWriteState::Serial { .. } => unreachable!(),
        };
    };
    let value: StoreBatchCommit = serde_json::from_slice(&commit.semantic_bytes)
        .map_err(|error| DbError::Message(format!("signed Serial candidate: {error}")))?;
    let reference = StoreBatchCommitRef::from_commit(
        &value,
        StoreCommitCoord::Serial {
            sequence: value.seq(),
        },
        commit.prepared.reference().clone(),
    )
    .map_err(|error| DbError::Message(error.to_string()))?;
    Ok(Some(PreparedSerialCandidate {
        commit: value,
        reference,
        canonical_signed_bytes: commit.semantic_bytes,
    }))
}

fn begin_merge_candidate_nonactivation_on(
    conn: &Connection,
    write_id: &WriteId,
    candidate: &PreparedMergeCandidate,
    winner_head: crate::sync::store_commit::StoreDeviceHeadRef,
    include_indexed_objects: bool,
) -> Result<(), DbError> {
    let nonactivation = crate::sync::remote_object::CandidateNonactivation {
        candidate: crate::sync::store_commit::StoreBatchCommitDeletionTarget {
            coord: candidate.reference.coord.clone(),
            object: candidate.reference.object.clone(),
            canonical_signed_bytes: candidate.canonical_signed_bytes.clone(),
        },
        proof: crate::sync::remote_object::CandidateNonactivationProof::MergeWinner { winner_head },
    };
    let mut object_ids = if include_indexed_objects {
        let mut statement = conn
            .prepare(
                "SELECT remote_object_id FROM store_write_packages WHERE write_id = ?1
                 UNION
                 SELECT remote_object_id FROM store_write_blobs WHERE write_id = ?1
                 ORDER BY remote_object_id",
            )
            .map_err(DbError::from)?;
        let object_ids = statement
            .query_map([write_id.as_str()], |row| row.get::<_, String>(0))
            .map_err(DbError::from)?
            .collect::<Result<Vec<_>, _>>()
            .map_err(DbError::from)?;
        drop(statement);
        object_ids
    } else {
        Vec::new()
    };
    object_ids.push(remote_object_id(candidate.head_prepared.reference()).to_string());
    for encoded in object_ids {
        let object_id: ObjectHash = encoded.parse().map_err(|error| {
            DbError::Message(format!("Merge conflict remote object id: {error}"))
        })?;
        let mut remote = load_remote_object_on(conn, object_id)?;
        remote
            .begin_candidate_nonactivation(nonactivation.clone())
            .map_err(|error| {
                DbError::Message(format!(
                    "record Merge candidate nonactivation for {object_id}: {error}"
                ))
            })?;
        update_remote_object_on(conn, object_id, &remote)?;
    }
    let commit_object_id = remote_object_id(&candidate.reference.object);
    let mut remote = load_remote_object_on(conn, commit_object_id)?;
    remote
        .begin_candidate_nonactivation(nonactivation)
        .map_err(|error| {
            DbError::Message(format!(
                "record Merge candidate commit nonactivation for {commit_object_id}: {error}"
            ))
        })?;
    update_remote_object_on(conn, commit_object_id, &remote)
}

fn merge_candidate_cleanup_targets_on(
    conn: &Connection,
    write_id: &WriteId,
    candidate: &PreparedMergeCandidate,
    include_indexed_objects: bool,
) -> Result<Vec<CandidateCleanupObject>, DbError> {
    let commit_remote = load_remote_object_on(conn, remote_object_id(&candidate.reference.object))?;
    if !matches!(
        &commit_remote,
        RemoteObjectRecord::CandidateCommit(record)
            if matches!(
                &record.state,
                crate::sync::remote_object::CandidateCommitState::CleanupPending {
                    proof: crate::sync::remote_object::CandidateNonactivationProof::MergeWinner { .. }
                } | crate::sync::remote_object::CandidateCommitState::AbsentVerified {
                    proof: crate::sync::remote_object::CandidateNonactivationProof::MergeWinner { .. }
                }
            )
    ) {
        return Err(DbError::Message(
            "Merge candidate has no durable winner proof".to_string(),
        ));
    }
    let mut cleanup = BTreeMap::new();
    if include_indexed_objects {
        let mut statement = conn
            .prepare(
                "SELECT remote_object_id FROM store_write_packages WHERE write_id = ?1
                 UNION
                 SELECT remote_object_id FROM store_write_blobs WHERE write_id = ?1",
            )
            .map_err(DbError::from)?;
        let encoded = statement
            .query_map([write_id.as_str()], |row| row.get::<_, String>(0))
            .map_err(DbError::from)?
            .collect::<Result<Vec<_>, _>>()
            .map_err(DbError::from)?;
        drop(statement);
        for encoded in encoded {
            let object_id: ObjectHash = encoded.parse().map_err(|error| {
                DbError::Message(format!("Merge cleanup remote object id: {error}"))
            })?;
            let remote = load_remote_object_on(conn, object_id)?;
            if let Some(object) = remote.cleanup_target() {
                cleanup.insert(
                    object.clone(),
                    CandidateCleanupObject {
                        object: object.clone(),
                    },
                );
            } else if !remote
                .candidate_cleanup_complete(&candidate.reference)
                .map_err(|error| DbError::Message(format!("Merge cleanup {object_id}: {error}")))?
            {
                return Err(DbError::Message(format!(
                    "Merge candidate object {object_id} has no cleanup transition"
                )));
            }
        }
    }
    let head_remote =
        load_remote_object_on(conn, remote_object_id(candidate.head_prepared.reference()))?;
    if !head_remote
        .candidate_cleanup_complete(&candidate.reference)
        .map_err(|error| DbError::Message(format!("Merge cleanup head: {error}")))?
    {
        return Err(DbError::Message(
            "Merge candidate head absence is not verified".to_string(),
        ));
    }
    let mut targets = Vec::new();
    for object in candidate_manifest_exact_objects(&candidate.commit) {
        if let Some(target) = cleanup.remove(object) {
            targets.push(target);
        }
    }
    if !cleanup.is_empty() {
        return Err(DbError::Message(
            "Merge cleanup contains an object outside the signed candidate manifest".to_string(),
        ));
    }
    if let Some(object) = commit_remote.cleanup_target() {
        targets.push(CandidateCleanupObject {
            object: object.clone(),
        });
    } else if !commit_remote
        .candidate_cleanup_complete(&candidate.reference)
        .map_err(|error| DbError::Message(format!("Merge cleanup commit: {error}")))?
    {
        return Err(DbError::Message(
            "Merge candidate commit cleanup is incomplete".to_string(),
        ));
    }
    Ok(targets)
}

fn remove_cleaned_merge_authority_on(
    tx: &rusqlite::Transaction<'_>,
    authority: &PreparedMergeCandidate,
) -> Result<(), DbError> {
    for object in [
        authority.reference.object.clone(),
        authority.head_prepared.reference().clone(),
    ] {
        let object_id = remote_object_id(&object);
        let remote = load_remote_object_on(tx, object_id)?;
        if !remote
            .candidate_cleanup_complete(&authority.reference)
            .map_err(|error| {
                DbError::Message(format!(
                    "validate abandoned authority cleanup for {object_id}: {error}"
                ))
            })?
        {
            return Err(DbError::Message(
                "losing Merge abandonment cleanup is incomplete".to_string(),
            ));
        }
        let removed = tx
            .execute(
                "DELETE FROM remote_objects WHERE object_id = ?1",
                [object_id.to_string()],
            )
            .map_err(DbError::from)?;
        if removed != 1 {
            return Err(DbError::Message(format!(
                "abandoned authority object {object_id} disappeared during removal"
            )));
        }
    }
    Ok(())
}

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
#[serde(deny_unknown_fields)]
struct DurablePreparedProtocolObject {
    semantic_bytes: Vec<u8>,
    prepared: PreparedExactObject,
}

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(crate) struct StoreBatchLocalCleanup {
    pub drops: Vec<crate::sync::service::DeferredLocalBlobDrop>,
}

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(crate) struct StoreBatchCompletion {}

fn validate_host_synced_tables(
    conn: &Connection,
    synced_tables: &[SyncedTable],
) -> Result<(), DbError> {
    // Which table owns each declared blob namespace, so a second table claiming an
    // already-owned namespace is caught here. A blob's namespace is part of its
    // address; two tables sharing one makes `row_for_blob_in_namespace` resolve to
    // whichever the hash map iterates first.
    let mut namespace_owner: HashMap<&str, &str> = HashMap::new();
    let mut table_by_sqlite_name: HashMap<String, &str> = HashMap::new();
    for table in synced_tables {
        let name = table.name();
        if name.is_empty() {
            return Err(DbError::Message(
                "synced table name must not be empty".to_string(),
            ));
        }
        if is_reserved_table_name(name) {
            return Err(DbError::Message(format!(
                "synced table {name:?} is reserved by coven"
            )));
        }
        let sqlite_name = name.to_ascii_lowercase();
        if let Some(prior) = table_by_sqlite_name.insert(sqlite_name, name) {
            return Err(DbError::Message(format!(
                "synced tables {prior:?} and {name:?} are declared as the same SQLite table more than once"
            )));
        }
        if let Some(live_name) = canonical_table_name(conn, name)? {
            if live_name != name {
                return Err(DbError::Message(format!(
                    "synced table {name:?} does not use the live schema's exact spelling {live_name:?}"
                )));
            }
        }
        validate_synced_table_contract(conn, name)?;
        validate_existing_row_identities(conn, table)?;
        if let Some(decl) = table.blob() {
            let namespace = decl.namespace.as_str();
            if let Some(prior) = namespace_owner.insert(namespace, name) {
                return Err(DbError::Message(format!(
                    "synced tables {prior:?} and {name:?} both declare blob namespace \
                     {namespace:?}; a namespace must be owned by exactly one table"
                )));
            }
        }
    }
    Ok(())
}

/// Return the live `main`-schema spelling SQLite resolves for `table`.
/// SQLite table identifiers compare case-insensitively, while coven dispatches
/// changesets by their exact table name, so open requires declarations to use
/// this canonical spelling.
fn canonical_table_name(conn: &Connection, table: &str) -> Result<Option<String>, DbError> {
    conn.query_row(
        "SELECT name FROM main.sqlite_schema \
         WHERE type = 'table' AND name = ?1 COLLATE NOCASE",
        [table],
        |row| row.get(0),
    )
    .optional()
    .map_err(DbError::from)
}

fn validate_existing_row_identities(conn: &Connection, table: &SyncedTable) -> Result<(), DbError> {
    if table.row_identity() == crate::sync::session::RowIdentity::SharedKey {
        return Ok(());
    }
    let sql = format!(
        "SELECT id FROM {}",
        crate::sync::session::quote_ident(table.name())
    );
    let mut statement = conn.prepare(&sql).map_err(DbError::from)?;
    let ids = statement
        .query_map([], |row| row.get::<_, String>(0))
        .map_err(DbError::from)?;
    for id in ids {
        let id = id.map_err(DbError::from)?;
        crate::sync::session::validate_row_identity(table.name(), table.row_identity(), &id)
            .map_err(|error| DbError::Message(error.to_string()))?;
    }
    Ok(())
}

/// One column of a table's `PRAGMA table_info`. `position` is the column ordinal
/// — the index a session changeset reports for that column, so the pk's position
/// is what the by-position apply path reads. `pk` is 0 for a non-key column or its
/// 1-based rank within the primary key.
struct ColumnInfo {
    position: i64,
    name: String,
    declared_type: String,
    not_null: bool,
    pk: i64,
}

/// Enforce the synced-table contract ([`crate::sync::session::SyncedTable`]) on
/// `table`'s live schema: the table declared STRICT; a single primary key
/// column, named `id`, declared TEXT, at column 0; and an `_updated_at` column
/// declared TEXT NOT NULL. A violation is an open error naming the table and the
/// requirement it broke, so the integrator learns it on their own device instead
/// of a peer's pull failing on the row.
fn validate_synced_table_contract(conn: &Connection, table: &str) -> Result<(), DbError> {
    match table_is_strict(conn, table)? {
        None => {
            return Err(DbError::Message(format!(
                "synced table {table:?} is declared in `synced_tables` but no migration \
                 creates it — add a `CREATE TABLE {table} (...) STRICT` to the schema \
                 migrations, or remove the declaration"
            )));
        }
        Some(false) => {
            return Err(DbError::Message(format!(
                "synced table {table:?} is not declared STRICT; the sync contract assumes typed \
                 columns (apply preserves storage classes peer-to-peer, LWW arbitration renders \
                 values to strings for comparison), which STRICT enforces at the insert — declare \
                 it STRICT: `CREATE TABLE {table} (...) STRICT`"
            )));
        }
        Some(true) => {}
    }

    let sql = format!(
        "PRAGMA table_info({})",
        crate::sync::session::quote_ident(table)
    );
    let mut stmt = conn.prepare(&sql).map_err(DbError::from)?;
    let mut columns = Vec::new();
    let rows = stmt
        .query_map([], |row| {
            Ok(ColumnInfo {
                position: row.get::<_, i64>(0)?,
                name: row.get::<_, String>(1)?,
                declared_type: row.get::<_, String>(2)?,
                not_null: row.get::<_, i64>(3)? != 0,
                pk: row.get::<_, i64>(5)?,
            })
        })
        .map_err(DbError::from)?;
    for row in rows {
        columns.push(row.map_err(DbError::from)?);
    }

    let pk_columns: Vec<&ColumnInfo> = columns.iter().filter(|c| c.pk > 0).collect();
    let pk = match pk_columns.as_slice() {
        [single] => *single,
        [] => {
            return Err(DbError::Message(format!(
                "synced table {table:?} has no primary key; the contract requires a single \
                 `id` TEXT primary key at column 0"
            )))
        }
        _ => {
            let names: Vec<&str> = pk_columns.iter().map(|c| c.name.as_str()).collect();
            return Err(DbError::Message(format!(
                "synced table {table:?} has a composite primary key {names:?}; the contract \
                 requires a single `id` TEXT primary key at column 0"
            )));
        }
    };
    if pk.name != "id" {
        return Err(DbError::Message(format!(
            "synced table {table:?} primary key is {:?}, not `id`; the contract requires the \
             primary key to be the `id` column",
            pk.name
        )));
    }
    if pk.position != 0 {
        return Err(DbError::Message(format!(
            "synced table {table:?} primary key `id` is at column {}, not column 0; the \
             contract requires `id` to be the first column",
            pk.position
        )));
    }
    if !declared_as_text(&pk.declared_type) {
        return Err(DbError::Message(format!(
            "synced table {table:?} primary key `id` is declared {:?}, not TEXT; the contract \
             requires an `id` TEXT primary key",
            pk.declared_type
        )));
    }

    let updated_at = columns
        .iter()
        .find(|c| c.name == "_updated_at")
        .ok_or_else(|| {
            DbError::Message(format!(
                "synced table {table:?} has no `_updated_at` column; the contract requires \
                 `_updated_at TEXT NOT NULL`"
            ))
        })?;
    if !declared_as_text(&updated_at.declared_type) {
        return Err(DbError::Message(format!(
            "synced table {table:?} column `_updated_at` is declared {:?}, not TEXT; the \
             contract requires `_updated_at TEXT NOT NULL`",
            updated_at.declared_type
        )));
    }
    if !updated_at.not_null {
        return Err(DbError::Message(format!(
            "synced table {table:?} column `_updated_at` is nullable; the contract requires \
             `_updated_at TEXT NOT NULL`"
        )));
    }

    Ok(())
}

/// Whether a `PRAGMA table_info` declared type is TEXT, case-insensitively. SQL
/// keywords are case-insensitive, so `text` and `TEXT` both satisfy the contract;
/// any other declared type (or none) does not.
fn declared_as_text(declared_type: &str) -> bool {
    declared_type.eq_ignore_ascii_case("TEXT")
}

/// Whether `table` (in the `main` schema) is declared STRICT, via `PRAGMA
/// table_list`'s `strict` column (SQLite 3.37+) — the schema-level flag itself,
/// not `sqlite_master.sql` text, which a hand-formatted `CREATE TABLE` could spell
/// many ways. `None` means the table doesn't exist in `main` at all — a declared
/// synced table no migration created — which the caller reports as its own
/// contract error rather than folding into "not STRICT".
fn table_is_strict(conn: &Connection, table: &str) -> Result<Option<bool>, DbError> {
    let sql = format!(
        "PRAGMA table_list({})",
        crate::sync::session::quote_ident(table)
    );
    let mut stmt = conn.prepare(&sql).map_err(DbError::from)?;
    let rows = stmt
        .query_map([], |row| {
            Ok((row.get::<_, String>(0)?, row.get::<_, i64>(5)?))
        })
        .map_err(DbError::from)?;
    for row in rows {
        let (schema, strict) = row.map_err(DbError::from)?;
        if schema == "main" {
            return Ok(Some(strict != 0));
        }
    }
    Ok(None)
}

struct PreparedCircleOperationRow {
    operation_id: String,
    circle_id: String,
    payload: Vec<u8>,
}

impl PreparedCircleOperationRow {
    fn from_journal(
        journal: crate::sync::circle_ops::CircleOperationJournal,
    ) -> Result<Self, DbError> {
        let operation_id = journal.operation_id.clone();
        let circle_id = journal.circle_id().to_string();
        let payload = serde_json::to_vec(&journal).map_err(|error| {
            DbError::Message(format!("serialize circle operation journal: {error}"))
        })?;
        Ok(Self {
            operation_id,
            circle_id,
            payload,
        })
    }
}

impl Database {
    pub(crate) fn id_provider(&self) -> &dyn crate::id_provider::IdProvider {
        self.state.ids.as_ref()
    }

    #[doc(hidden)]
    pub fn new_write_id(&self) -> WriteId {
        WriteId::from_generated(self.state.ids.new_id())
    }

    fn notify_write_status_in(
        statuses: &Arc<std::sync::Mutex<HashMap<WriteId, tokio::sync::watch::Sender<WriteStatus>>>>,
        write_id: &WriteId,
        status: WriteStatus,
    ) {
        let senders = statuses.lock().expect("write status mutex poisoned");
        if let Some(sender) = senders.get(write_id) {
            sender.send_replace(status);
        }
    }

    fn set_write_status_on(
        conn: &Connection,
        write_id: &WriteId,
        status: &WriteStatus,
    ) -> Result<(), DbError> {
        let status = serde_json::to_string(status)
            .map_err(|error| DbError::Message(format!("serialize write status: {error}")))?;
        let updated = conn
            .execute(
                "UPDATE store_writes SET status = ?2 WHERE write_id = ?1",
                rusqlite::params![write_id.as_str(), status],
            )
            .map_err(DbError::from)?;
        if updated != 1 {
            return Err(DbError::Message(format!("write {write_id} does not exist")));
        }
        Ok(())
    }

    pub(crate) async fn set_write_status(
        &self,
        write_id: &WriteId,
        status: WriteStatus,
    ) -> Result<(), DbError> {
        let stored_id = write_id.clone();
        let stored_status = status.clone();
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            Self::set_write_status_on(conn, &stored_id, &stored_status)?;
            Self::notify_write_status_in(&statuses, &stored_id, stored_status);
            Ok(())
        })
        .await
    }

    pub async fn write_status(&self, write_id: &WriteId) -> Result<WriteStatus, DbError> {
        let write_id = write_id.clone();
        self.call(move |conn| {
            let raw: String = conn
                .query_row(
                    "SELECT status FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            serde_json::from_str(&raw)
                .map_err(|error| DbError::Message(format!("write {write_id} status: {error}")))
        })
        .await
    }

    pub async fn pending_writes(&self) -> Result<Vec<PendingWrite>, DbError> {
        self.call(move |conn| {
            let mut statement = conn
                .prepare(
                    "SELECT write_id, status, affected_rows FROM store_writes
                     WHERE status IN ('\"pending\"', '\"publishing\"')
                        OR json_extract(status, '$.blocked') IS NOT NULL
                        OR json_extract(status, '$.conflict') IS NOT NULL
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, String>(1)?,
                        row.get::<_, String>(2)?,
                    ))
                })
                .map_err(DbError::from)?;
            rows.map(|row| {
                let (write_id, status, affected_rows) = row.map_err(DbError::from)?;
                Ok(PendingWrite {
                    write_id: WriteId::from_generated(write_id),
                    status: serde_json::from_str(&status).map_err(|error| {
                        DbError::Message(format!("pending write status: {error}"))
                    })?,
                    affected_rows: serde_json::from_str(&affected_rows).map_err(|error| {
                        DbError::Message(format!("pending affected rows: {error}"))
                    })?,
                })
            })
            .collect()
        })
        .await
    }

    /// Writes whose semantic publication fault requires an explicit host action.
    pub async fn blocked_writes(&self) -> Result<Vec<PendingWrite>, DbError> {
        Ok(self
            .pending_writes()
            .await?
            .into_iter()
            .filter(|write| matches!(write.status, WriteStatus::Blocked(_)))
            .collect())
    }

    /// Return one blocked write, or its whole Serial branch, to production
    /// publication. The next preparation attempt revalidates every captured fact;
    /// another semantic failure records a fresh `Blocked` status.
    pub async fn retry_blocked_write(&self, write_id: &WriteId) -> Result<Vec<WriteId>, DbError> {
        let write_id = write_id.clone();
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let (raw_status, raw_base, prepared): (String, String, Option<String>) = tx
                .query_row(
                    "SELECT status, base, prepared FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?)),
                )
                .map_err(DbError::from)?;
            let status: WriteStatus = serde_json::from_str(&raw_status)
                .map_err(|error| DbError::Message(format!("blocked write {write_id} status: {error}")))?;
            if !matches!(status, WriteStatus::Blocked(_)) {
                return Err(DbError::Message(format!("write {write_id} is not blocked")));
            }
            let base: StoreWriteBase = serde_json::from_str(&raw_base)
                .map_err(|error| DbError::Message(format!("blocked write {write_id} base: {error}")))?;

            let mut retried = Vec::new();
            match base {
                StoreWriteBase::MergeConcurrent { .. } => {
                    if let Some(raw_prepared) = prepared.as_deref() {
                        let prepared: PreparedStoreWriteState = serde_json::from_str(raw_prepared)
                            .map_err(|error| {
                                DbError::Message(format!("blocked write {write_id} preparation: {error}"))
                            })?;
                        if !matches!(prepared, PreparedStoreWriteState::MergeConcurrent { .. }) {
                            return Err(DbError::Message(format!(
                                "blocked MergeConcurrent write {write_id} has Serial preparation"
                            )));
                        }
                        let candidate = parse_prepared_merge_candidate_on(&tx, &prepared)?
                            .expect("matched Merge preparation")
                            .reference;
                        let remote =
                            load_remote_object_on(&tx, remote_object_id(&candidate.object))?;
                        if matches!(
                            remote,
                            RemoteObjectRecord::CandidateCommit(
                                crate::sync::remote_object::CandidateCommitRecord {
                                    state:
                                        crate::sync::remote_object::CandidateCommitState::CleanupPending {
                                            proof: crate::sync::remote_object::CandidateNonactivationProof::MergeWinner { .. }
                                        }
                                        | crate::sync::remote_object::CandidateCommitState::AbsentVerified {
                                            proof: crate::sync::remote_object::CandidateNonactivationProof::MergeWinner { .. }
                                        },
                                    ..
                                }
                            )
                        ) {
                            return Err(DbError::Message(format!(
                                "Merge write {write_id} has an irreversible winner and cannot be retried"
                            )));
                        }
                    }
                    let next = if prepared.is_some() {
                        WriteStatus::Publishing
                    } else {
                        WriteStatus::Pending
                    };
                    let next_json = serde_json::to_string(&next)
                        .map_err(|error| DbError::Message(format!("serialize retry status: {error}")))?;
                    let updated = tx
                        .execute(
                            "UPDATE store_writes SET status = ?2
                             WHERE write_id = ?1 AND json_extract(status, '$.blocked') IS NOT NULL",
                            rusqlite::params![write_id.as_str(), next_json],
                        )
                        .map_err(DbError::from)?;
                    if updated != 1 {
                        return Err(DbError::Message(format!(
                            "blocked write {write_id} changed during retry"
                        )));
                    }
                    retried.push((write_id, next));
                }
                StoreWriteBase::Serial {
                    branch_id,
                    base: branch_base,
                } => {
                    if prepared.is_some() {
                        return Err(DbError::Message(format!(
                            "blocked Serial branch {} retains publication preparation",
                            branch_id.first_write_id()
                        )));
                    }
                    let expected_base = StoreWriteBase::Serial {
                        branch_id: branch_id.clone(),
                        base: branch_base,
                    };
                    let mut statement = tx
                        .prepare(
                            "SELECT write_id, status, base, prepared FROM store_writes
                             WHERE base = ?1
                               AND status != '\"local_only\"'
                               AND json_extract(status, '$.published') IS NULL
                               AND json_extract(status, '$.resolved') IS NULL
                             ORDER BY ordinal",
                        )
                        .map_err(DbError::from)?;
                    let rows = statement
                        .query_map([&raw_base], |row| {
                            Ok((
                                row.get::<_, String>(0)?,
                                row.get::<_, String>(1)?,
                                row.get::<_, String>(2)?,
                                row.get::<_, Option<String>>(3)?,
                            ))
                        })
                        .map_err(DbError::from)?;
                    let mut branch_write_ids = Vec::new();
                    for row in rows {
                        let (stored_id, raw_status, raw_base, prepared) =
                            row.map_err(DbError::from)?;
                        let stored_base: StoreWriteBase = serde_json::from_str(&raw_base)
                            .map_err(|error| DbError::Message(format!("Serial retry base: {error}")))?;
                        if stored_base != expected_base {
                            return Err(DbError::Message(
                                "Serial database contains more than one unresolved branch"
                                    .to_string(),
                            ));
                        }
                        let stored_status: WriteStatus = serde_json::from_str(&raw_status)
                            .map_err(|error| DbError::Message(format!("Serial retry status: {error}")))?;
                        if !matches!(stored_status, WriteStatus::Pending | WriteStatus::Blocked(_))
                            || prepared.is_some()
                        {
                            return Err(DbError::Message(format!(
                                "Serial branch write {stored_id} is not pending or blocked without preparation"
                            )));
                        }
                        if matches!(stored_status, WriteStatus::Blocked(_)) {
                            branch_write_ids.push(WriteId::from_generated(stored_id));
                        }
                    }
                    drop(statement);
                    let pending = serde_json::to_string(&WriteStatus::Pending)
                        .map_err(|error| DbError::Message(format!("serialize retry status: {error}")))?;
                    for branch_write_id in branch_write_ids {
                        let updated = tx
                            .execute(
                                "UPDATE store_writes SET status = ?2
                                 WHERE write_id = ?1
                                   AND json_extract(status, '$.blocked') IS NOT NULL
                                   AND prepared IS NULL",
                                rusqlite::params![branch_write_id.as_str(), &pending],
                            )
                            .map_err(DbError::from)?;
                        if updated != 1 {
                            return Err(DbError::Message(format!(
                                "blocked Serial write {branch_write_id} changed during retry"
                            )));
                        }
                        retried.push((branch_write_id, WriteStatus::Pending));
                    }
                }
            }
            tx.commit().map_err(DbError::from)?;
            let retried_ids = retried
                .iter()
                .map(|(write_id, _)| write_id.clone())
                .collect();
            for (write_id, status) in retried {
                Self::notify_write_status_in(&statuses, &write_id, status);
            }
            Ok(retried_ids)
        })
        .await
    }

    /// Atomically reverse a blocked write and every later unpublished shared
    /// write whose working-row state depends on it.
    pub async fn discard_blocked_write(&self, write_id: &WriteId) -> Result<Vec<WriteId>, DbError> {
        let write_id = write_id.clone();
        let synced_tables = self.synced_tables().to_vec();
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let (raw_status, target_ordinal): (String, i64) = tx
                .query_row(
                    "SELECT status, ordinal FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let target_status: WriteStatus = serde_json::from_str(&raw_status)
                .map_err(|error| DbError::Message(format!("blocked write {write_id} status: {error}")))?;
            if !matches!(target_status, WriteStatus::Blocked(_)) {
                return Err(DbError::Message(format!("write {write_id} is not blocked")));
            }

            let mut statement = tx
                .prepare(
                    "SELECT write_id, status, inverse_changeset FROM store_writes
                     WHERE ordinal >= ?1
                       AND status != '\"local_only\"'
                       AND json_extract(status, '$.published') IS NULL
                       AND json_extract(status, '$.resolved') IS NULL
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([target_ordinal], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, String>(1)?,
                        row.get::<_, Vec<u8>>(2)?,
                    ))
                })
                .map_err(DbError::from)?;
            let mut discarded = Vec::new();
            for row in rows {
                let (stored_id, raw_status, inverse) = row.map_err(DbError::from)?;
                let status: WriteStatus = serde_json::from_str(&raw_status)
                    .map_err(|error| DbError::Message(format!("discard write status: {error}")))?;
                if !matches!(status, WriteStatus::Pending | WriteStatus::Blocked(_)) {
                    return Err(DbError::Message(format!(
                        "write {stored_id} after blocked write {write_id} has non-discardable status {status:?}"
                    )));
                }
                discarded.push((WriteId::from_generated(stored_id), inverse));
            }
            drop(statement);
            if discarded.first().map(|(stored_id, _)| stored_id) != Some(&write_id) {
                return Err(DbError::Message(format!(
                    "blocked write {write_id} is absent from its unpublished suffix"
                )));
            }
            let schema = Arc::new(crate::sync::conflict::TableSchema::from_db(
                &tx,
                &synced_tables,
            )?);
            for (_, inverse) in discarded.iter().rev() {
                let inverse = crate::sync::apply::ValidatedChangeset::new(
                    inverse,
                    schema.clone(),
                )
                .map_err(|error| DbError::Message(format!("invalid blocked-write inverse: {error}")))?;
                crate::sync::apply::apply_changeset_strict_on(&tx, inverse)
                    .map_err(|error| DbError::Message(format!("reverse blocked-write suffix: {error}")))?;
            }
            let discarded_ids: Vec<_> = discarded
                .into_iter()
                .map(|(write_id, _)| write_id)
                .collect();
            let resolution = WriteResolution::Discarded;
            Self::resolve_unpublished_writes_on(&tx, &discarded_ids, &resolution)?;
            tx.commit().map_err(DbError::from)?;
            let status = WriteStatus::Resolved(resolution);
            for discarded_id in &discarded_ids {
                Self::notify_write_status_in(&statuses, discarded_id, status.clone());
            }
            Ok(discarded_ids)
        })
        .await
    }

    pub async fn pending_branches(&self) -> Result<Option<PendingBranch>, DbError> {
        self.call(|conn| {
            let mut statement = conn
                .prepare(
                    "SELECT write_id, status, affected_rows, base FROM store_writes
                     WHERE status IN ('\"pending\"', '\"publishing\"')
                        OR json_extract(status, '$.blocked') IS NOT NULL
                        OR json_extract(status, '$.conflict') IS NOT NULL
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, String>(1)?,
                        row.get::<_, String>(2)?,
                        row.get::<_, String>(3)?,
                    ))
                })
                .map_err(DbError::from)?;
            let mut records = Vec::new();
            for row in rows {
                let (write_id, status, affected_rows, base) = row.map_err(DbError::from)?;
                records.push((
                    PendingWrite {
                        write_id: WriteId::from_generated(write_id),
                        status: serde_json::from_str(&status).map_err(|error| {
                            DbError::Message(format!("pending write status: {error}"))
                        })?,
                        affected_rows: serde_json::from_str(&affected_rows).map_err(|error| {
                            DbError::Message(format!("pending affected rows: {error}"))
                        })?,
                    },
                    serde_json::from_str::<StoreWriteBase>(&base).map_err(|error| {
                        DbError::Message(format!("pending write base: {error}"))
                    })?,
                ));
            }
            drop(statement);

            let mut conflict = None;
            let mut conflict_exact_base = None;
            for (write, base) in &records {
                let WriteStatus::Conflict(candidate) = &write.status else {
                    continue;
                };
                let StoreWriteBase::Serial {
                    branch_id,
                    base: stored_base,
                } = base
                else {
                    return Err(DbError::Message(
                        "MergeConcurrent base carries a Serial conflict".to_string(),
                    ));
                };
                let exact_base = store_serial_predecessor_on(conn, stored_base.as_ref())?;
                if branch_id != &candidate.branch_id || exact_base != candidate.base {
                    return Err(DbError::Message(
                        "Serial conflict status differs from its durable branch base".to_string(),
                    ));
                }
                match &conflict {
                    None => {
                        conflict = Some(candidate.clone());
                        conflict_exact_base = Some(stored_base.clone());
                    }
                    Some(existing) if existing == candidate => {}
                    Some(_) => {
                        return Err(DbError::Message(
                            "Serial database contains more than one conflict branch".to_string(),
                        ))
                    }
                }
            }
            let Some(conflict) = conflict else {
                return Ok(None);
            };
            let conflict = *conflict;
            let expected_base = StoreWriteBase::Serial {
                branch_id: conflict.branch_id.clone(),
                base: conflict_exact_base.expect("conflict row carries exact base"),
            };
            let mut writes = Vec::new();
            for (write, base) in records {
                if matches!(base, StoreWriteBase::MergeConcurrent { .. }) {
                    continue;
                }
                if base != expected_base {
                    return Err(DbError::Message(
                        "Serial database contains more than one unresolved branch".to_string(),
                    ));
                }
                if !matches!(
                    &write.status,
                    WriteStatus::Conflict(_) | WriteStatus::Pending
                ) {
                    return Err(DbError::Message(format!(
                        "conflicted Serial branch write {} has non-resolvable status {:?}",
                        write.write_id, write.status
                    )));
                }
                writes.push(write);
            }
            Ok(Some(PendingBranch {
                branch_id: conflict.branch_id,
                base: conflict.base,
                current: conflict.current,
                writes,
            }))
        })
        .await
    }

    pub async fn serial_branch_discard_state(
        &self,
        branch_id: &PendingBranchId,
    ) -> Result<SerialBranchDiscardState, DbError> {
        let branch_id = branch_id.clone();
        self.call(move |conn| {
            let abandonment: Option<String> = conn
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [SERIAL_CANDIDATE_ABANDONMENT_STATE_KEY],
                    |row| row.get(0),
                )
                .optional()
                .map_err(DbError::from)?;
            if let Some(abandonment) = abandonment {
                let abandonment: DurableSerialCandidateAbandonment =
                    serde_json::from_str(&abandonment).map_err(|error| {
                        DbError::Message(format!("Serial candidate abandonment: {error}"))
                    })?;
                if abandonment.branch_id != branch_id {
                    return Err(DbError::Message(
                        "another Serial branch owns candidate abandonment".to_string(),
                    ));
                }
                return Ok(SerialBranchDiscardState::Abandonment);
            }
            let mut statement = conn
                .prepare(
                    "SELECT base, status, prepared FROM store_writes
                     WHERE status != '\"local_only\"'
                       AND json_extract(status, '$.published') IS NULL
                       AND json_extract(status, '$.resolved') IS NULL
                       AND json_type(base, '$.serial') IS NOT NULL
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, String>(1)?,
                        row.get::<_, Option<String>>(2)?,
                    ))
                })
                .map_err(DbError::from)?
                .collect::<Result<Vec<_>, _>>()
                .map_err(DbError::from)?;
            drop(statement);
            if rows.is_empty() {
                return Err(DbError::Message("Serial branch is absent".to_string()));
            }
            let mut base = None;
            let mut saw_local = false;
            let mut saw_prepared = false;
            let mut saw_conflict = false;
            for (raw_base, raw_status, raw_prepared) in rows {
                let StoreWriteBase::Serial {
                    branch_id: stored_branch_id,
                    base: stored_base,
                } = serde_json::from_str(&raw_base).map_err(|error| {
                    DbError::Message(format!("Serial discard branch base: {error}"))
                })?
                else {
                    unreachable!("selected Serial base")
                };
                if stored_branch_id != branch_id {
                    return Err(DbError::Message(
                        "Serial database contains another unresolved branch".to_string(),
                    ));
                }
                if base.as_ref().is_some_and(|base| base != &stored_base) {
                    return Err(DbError::Message(
                        "Serial discard branch has inconsistent bases".to_string(),
                    ));
                }
                base.get_or_insert(stored_base);
                let status: WriteStatus = serde_json::from_str(&raw_status)
                    .map_err(|error| DbError::Message(format!("Serial discard status: {error}")))?;
                match status {
                    WriteStatus::Pending | WriteStatus::Blocked(_) if raw_prepared.is_none() => {
                        saw_local = true;
                    }
                    WriteStatus::Publishing if raw_prepared.is_some() => saw_prepared = true,
                    WriteStatus::Conflict(conflict) if conflict.branch_id == branch_id => {
                        saw_conflict = true;
                    }
                    other => {
                        return Err(DbError::Message(format!(
                            "Serial branch has non-discardable state {other:?}"
                        )));
                    }
                }
            }
            match (saw_local, saw_prepared, saw_conflict) {
                (true, false, false) => Ok(SerialBranchDiscardState::Local),
                (false, true, false) => Ok(SerialBranchDiscardState::Abandonment),
                (false, false, true) => {
                    base.expect("nonempty branch");
                    Ok(SerialBranchDiscardState::Conflict)
                }
                _ => Err(DbError::Message(
                    "Serial branch mixes incompatible discard states".to_string(),
                )),
            }
        })
        .await
    }

    pub async fn discard_local_serial_branch(
        &self,
        branch_id: PendingBranchId,
    ) -> Result<Vec<WriteId>, DbError> {
        let synced_tables = self.synced_tables().to_vec();
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let mut statement = tx
                .prepare(
                    "SELECT write_id, base, status, prepared, inverse_changeset
                     FROM store_writes
                     WHERE status != '\"local_only\"'
                       AND json_extract(status, '$.published') IS NULL
                       AND json_extract(status, '$.resolved') IS NULL
                       AND json_type(base, '$.serial') IS NOT NULL
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, String>(1)?,
                        row.get::<_, String>(2)?,
                        row.get::<_, Option<String>>(3)?,
                        row.get::<_, Vec<u8>>(4)?,
                    ))
                })
                .map_err(DbError::from)?
                .collect::<Result<Vec<_>, _>>()
                .map_err(DbError::from)?;
            drop(statement);
            if rows.is_empty() {
                return Err(DbError::Message("Serial branch is absent".to_string()));
            }
            let mut branch = Vec::new();
            for (write_id, raw_base, raw_status, prepared, inverse) in rows {
                let StoreWriteBase::Serial {
                    branch_id: stored_branch_id,
                    ..
                } = serde_json::from_str(&raw_base).map_err(|error| {
                    DbError::Message(format!("local Serial discard base: {error}"))
                })?
                else {
                    unreachable!("selected Serial base")
                };
                let status: WriteStatus = serde_json::from_str(&raw_status).map_err(|error| {
                    DbError::Message(format!("local Serial discard status: {error}"))
                })?;
                if stored_branch_id != branch_id
                    || !matches!(status, WriteStatus::Pending | WriteStatus::Blocked(_))
                    || prepared.is_some()
                {
                    return Err(DbError::Message(
                        "Serial branch is not locally discardable".to_string(),
                    ));
                }
                branch.push((WriteId::from_generated(write_id), inverse));
            }
            let schema = Arc::new(crate::sync::conflict::TableSchema::from_db(
                &tx,
                &synced_tables,
            )?);
            for (_, inverse) in branch.iter().rev() {
                let inverse = crate::sync::apply::ValidatedChangeset::new(inverse, schema.clone())
                    .map_err(|error| {
                        DbError::Message(format!("invalid Serial inverse: {error}"))
                    })?;
                crate::sync::apply::apply_changeset_strict_on(&tx, inverse)
                    .map_err(|error| DbError::Message(format!("reverse Serial branch: {error}")))?;
            }
            let write_ids = branch
                .into_iter()
                .map(|(write_id, _)| write_id)
                .collect::<Vec<_>>();
            let resolution = WriteResolution::Discarded;
            Self::resolve_unpublished_writes_on(&tx, &write_ids, &resolution)?;
            tx.commit().map_err(DbError::from)?;
            let status = WriteStatus::Resolved(resolution);
            for write_id in &write_ids {
                Self::notify_write_status_in(&statuses, write_id, status.clone());
            }
            Ok(write_ids)
        })
        .await
    }

    pub async fn conflicted_serial_branch_base(
        &self,
        branch_id: &PendingBranchId,
    ) -> Result<Option<StoreBatchCommitRef>, DbError> {
        let branch = self.unresolved_serial_branch().await?.ok_or_else(|| {
            DbError::Message(format!(
                "Serial branch {} does not exist",
                branch_id.first_write_id()
            ))
        })?;
        if &branch.branch_id != branch_id || !branch.conflicted {
            return Err(DbError::Message(format!(
                "Serial branch {} is not conflicted",
                branch_id.first_write_id()
            )));
        }
        Ok(branch.base)
    }

    pub(crate) async fn unresolved_serial_branch(
        &self,
    ) -> Result<Option<UnresolvedSerialBranch>, DbError> {
        self.call(|conn| {
            let mut statement = conn
                .prepare(
                    "SELECT base, status FROM store_writes
                     WHERE status != '\"local_only\"'
                       AND json_extract(status, '$.published') IS NULL
                       AND json_extract(status, '$.resolved') IS NULL
                       AND json_type(base, '$.serial') IS NOT NULL
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| {
                    Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?))
                })
                .map_err(DbError::from)?;
            let mut branch = None;
            for row in rows {
                let (raw_base, raw_status) = row.map_err(DbError::from)?;
                let StoreWriteBase::Serial { branch_id, base } = serde_json::from_str(&raw_base)
                    .map_err(|error| {
                        DbError::Message(format!("unresolved Serial base: {error}"))
                    })?
                else {
                    return Err(DbError::Message(
                        "MergeConcurrent base reached a Serial branch query".to_string(),
                    ));
                };
                let status: WriteStatus = serde_json::from_str(&raw_status).map_err(|error| {
                    DbError::Message(format!("unresolved Serial status: {error}"))
                })?;
                match &mut branch {
                    None => {
                        branch = Some(UnresolvedSerialBranch {
                            branch_id,
                            base,
                            conflicted: matches!(status, WriteStatus::Conflict(_)),
                        });
                    }
                    Some(existing) if existing.branch_id == branch_id && existing.base == base => {
                        existing.conflicted |= matches!(status, WriteStatus::Conflict(_));
                    }
                    Some(_) => {
                        return Err(DbError::Message(
                            "Serial database contains more than one unresolved branch".to_string(),
                        ));
                    }
                }
            }
            Ok(branch)
        })
        .await
    }

    pub async fn subscribe_write_status(
        &self,
        write_id: &WriteId,
    ) -> Result<tokio::sync::watch::Receiver<WriteStatus>, DbError> {
        let write_id = write_id.clone();
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            let raw: String = conn
                .query_row(
                    "SELECT status FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let current: WriteStatus = serde_json::from_str(&raw)
                .map_err(|error| DbError::Message(format!("write {write_id} status: {error}")))?;
            let mut senders = statuses.lock().expect("write status mutex poisoned");
            let sender = senders
                .entry(write_id)
                .or_insert_with(|| tokio::sync::watch::channel(current.clone()).0);
            sender.send_replace(current);
            Ok(sender.subscribe())
        })
        .await
    }

    /// Lock the complete membership load transaction for this database handle
    /// and every clone that shares its state.
    pub(crate) async fn lock_membership_load(&self) -> tokio::sync::OwnedMutexGuard<()> {
        self.state.membership_load.clone().lock_owned().await
    }

    pub(crate) async fn lock_membership_mutation(&self) -> tokio::sync::OwnedMutexGuard<()> {
        self.state.membership_mutation.clone().lock_owned().await
    }

    pub(crate) async fn lock_snapshot_publication(&self) -> tokio::sync::OwnedMutexGuard<()> {
        self.state.snapshot_publication.clone().lock_owned().await
    }

    pub(crate) async fn lock_local_blob_cleanup(&self) -> tokio::sync::OwnedMutexGuard<()> {
        self.state.local_blob_cleanup.clone().lock_owned().await
    }

    #[cfg(any(test, feature = "test-utils"))]
    #[doc(hidden)]
    pub fn arm_test_pause(
        &self,
        point: DatabaseTestPoint,
    ) -> (Arc<tokio::sync::Notify>, Arc<tokio::sync::Notify>) {
        self.state.test_pause_points.arm(point)
    }

    #[cfg(any(test, feature = "test-utils"))]
    #[doc(hidden)]
    pub fn observe_test_points(&self) -> tokio::sync::mpsc::UnboundedReceiver<DatabaseTestPoint> {
        self.state.test_pause_points.observe()
    }

    #[cfg(any(test, feature = "test-utils"))]
    pub(crate) async fn reach_test_point(&self, point: DatabaseTestPoint) {
        self.state.test_pause_points.reach(point).await;
    }

    /// Open and own the connection at `path`.
    ///
    /// Runs the host migration ladder and validates its final sync-routing
    /// contract in one transaction. A fresh database creates Coven metadata in
    /// that transaction; an initialized database commits only when the final
    /// contract exactly matches its pinned bytes. Then seeds the register clock
    /// from on-disk rows. Returns the handle plus the non-optional `_updated_at`
    /// stamper the host binds into every synced-row write.
    ///
    pub fn open(
        path: &Path,
        synced_tables: Vec<SyncedTable>,
        blob_tombstone_grace: chrono::Duration,
        transfer_limits: crate::blob::TransferLimits,
        write_policy: WritePolicy,
        device_id: String,
        migrations: &[Migration],
    ) -> Result<(Database, UpdatedAtStamper), OpenError> {
        let hlc =
            Hlc::try_new(device_id).map_err(|e| DbError::Message(format!("device_id {e}")))?;
        Self::open_with_hlc_and_coven_metadata(
            path,
            synced_tables,
            blob_tombstone_grace,
            transfer_limits,
            write_policy,
            Arc::new(hlc),
            migrations,
            CovenMetadataOpen::Detect,
        )
    }

    pub(crate) fn open_initialized_store(
        path: &Path,
        synced_tables: Vec<SyncedTable>,
        blob_tombstone_grace: chrono::Duration,
        transfer_limits: crate::blob::TransferLimits,
        write_policy: WritePolicy,
        device_id: String,
        migrations: &[Migration],
    ) -> Result<(Database, UpdatedAtStamper), OpenError> {
        let hlc =
            Hlc::try_new(device_id).map_err(|e| DbError::Message(format!("device_id {e}")))?;
        Self::open_with_hlc_and_coven_metadata(
            path,
            synced_tables,
            blob_tombstone_grace,
            transfer_limits,
            write_policy,
            Arc::new(hlc),
            migrations,
            CovenMetadataOpen::InitializeVerifiedSnapshot,
        )
    }

    /// Open with a caller-supplied register clock instead of a fresh
    /// system-wall-clock one. Lets a test inject an [`Hlc`] over a controlled
    /// wall clock to exercise the skew/restart-seeding guarantees, sharing the
    /// production open path (migration, seed, session) so the test drives the
    /// real unit.
    ///
    #[cfg(any(test, feature = "test-utils"))]
    pub(crate) fn open_with_hlc(
        path: &Path,
        synced_tables: Vec<SyncedTable>,
        blob_tombstone_grace: chrono::Duration,
        transfer_limits: crate::blob::TransferLimits,
        write_policy: WritePolicy,
        hlc: Arc<Hlc>,
        migrations: &[Migration],
    ) -> Result<(Database, UpdatedAtStamper), OpenError> {
        Self::open_with_hlc_and_coven_metadata(
            path,
            synced_tables,
            blob_tombstone_grace,
            transfer_limits,
            write_policy,
            hlc,
            migrations,
            CovenMetadataOpen::Detect,
        )
    }

    fn open_with_hlc_and_coven_metadata(
        path: &Path,
        synced_tables: Vec<SyncedTable>,
        blob_tombstone_grace: chrono::Duration,
        transfer_limits: crate::blob::TransferLimits,
        write_policy: WritePolicy,
        hlc: Arc<Hlc>,
        migrations: &[Migration],
        metadata_open: CovenMetadataOpen,
    ) -> Result<(Database, UpdatedAtStamper), OpenError> {
        let (core, state, stamper) = DatabaseCore::open(
            path,
            synced_tables,
            blob_tombstone_grace,
            transfer_limits,
            write_policy,
            hlc,
            migrations,
            metadata_open,
        )?;

        let database = {
            let (jobs_tx, jobs_rx) = tokio::sync::mpsc::unbounded_channel::<DbJob>();
            let join = std::thread::Builder::new()
                .name("coven-db".to_string())
                .spawn(move || run_connection_thread(core, jobs_rx))
                .map_err(|e| DbError::Message(format!("spawn database connection thread: {e}")))?;
            Database {
                thread: Arc::new(ConnectionThread {
                    jobs: jobs_tx,
                    join: Some(join),
                }),
                state,
            }
        };

        Ok((database, stamper))
    }

    /// Open the store at `path` read-only for a same-store secondary reader
    /// (e.g. a separate process reading while another holds the writer open).
    ///
    /// Distinct from [`Database::open`] in three ways, all so the reader never
    /// mutates shared state a concurrent writer owns: the connection is
    /// `SQLITE_OPEN_READONLY`; no migration ladder or bookkeeping DDL runs (it
    /// opens against the schema the writer left, and refuses one newer than this
    /// binary knows — the writer's `SchemaTooNew` policy); and it returns no
    /// stamper, because a reader mints no `_updated_at`. Reads are safe across
    /// processes because the writer opens the db in WAL mode, so a reader observes
    /// committed rows while the writer commits more.
    ///
    /// The caller takes no store open-lock for a read-only open: the exclusive
    /// advisory lock guards against a second *writer*, and a read-only connection
    /// cannot write, so multiple readers and one writer coexist under WAL.
    pub fn open_read_only(
        path: &Path,
        synced_tables: Vec<SyncedTable>,
        blob_tombstone_grace: chrono::Duration,
        transfer_limits: crate::blob::TransferLimits,
        write_policy: WritePolicy,
        device_id: String,
        migrations: &[Migration],
    ) -> Result<Database, OpenError> {
        let hlc =
            Hlc::try_new(device_id).map_err(|e| DbError::Message(format!("device_id {e}")))?;
        let (core, state) = DatabaseCore::open_read_only(
            path,
            synced_tables,
            blob_tombstone_grace,
            transfer_limits,
            write_policy,
            Arc::new(hlc),
            migrations,
        )?;
        let (jobs_tx, jobs_rx) = tokio::sync::mpsc::unbounded_channel::<DbJob>();
        let join = std::thread::Builder::new()
            .name("coven-db-ro".to_string())
            .spawn(move || run_connection_thread(core, jobs_rx))
            .map_err(|e| DbError::Message(format!("spawn database connection thread: {e}")))?;
        Ok(Database {
            thread: Arc::new(ConnectionThread {
                jobs: jobs_tx,
                join: Some(join),
            }),
            state,
        })
    }

    /// The host's declared synced-table set, the single owner of which tables
    /// participate in changeset sync. Each journaled write's capture session
    /// attaches exactly these, the register-clock seed scanned these, and the
    /// gate/apply operate over these — so the sync layer reads the set from here
    /// instead of carrying a separately-passed copy that could silently diverge.
    pub fn synced_tables(&self) -> &[SyncedTable] {
        &self.state.synced_tables
    }

    /// The host's blob-tombstone convergence window. The tombstone GC ages each
    /// tombstone's `deleted_at` against this to decide when a deleted blob may be
    /// erased. Fixed for this handle's life.
    pub fn blob_tombstone_grace(&self) -> chrono::Duration {
        self.state.blob_tombstone_grace
    }

    /// How many blob transfers each transfer loop may run at once. Read by the
    /// upload drain ([`crate::blob::upload::drain_uploads`]) and the pin loop
    /// ([`crate::blob::cache::pin`]). Fixed for this handle's life.
    pub fn transfer_limits(&self) -> crate::blob::TransferLimits {
        self.state.transfer_limits
    }

    pub fn write_policy(&self) -> WritePolicy {
        self.state.write_policy
    }

    /// The gate model resolved from the final synced table set and live schema at
    /// open. Fixed for this handle's life.
    #[doc(hidden)]
    pub fn gates(&self) -> Arc<Gates> {
        self.state.gates.clone()
    }

    /// Blob declarations resolved from the final synced table set and live schema at
    /// open. Fixed for this handle's life.
    #[doc(hidden)]
    pub fn blob_decls(&self) -> Arc<BlobDecls> {
        self.state.blob_decls.clone()
    }

    /// The applied synced-schema version — `PRAGMA user_version` after the
    /// migration ladder ran at open. This is the single source of the wire
    /// `schema_version`: every outgoing changeset is stamped with it, the pull
    /// gates compare incoming changesets and the min-floor against it, and the
    /// snapshot meta carries it. A device cannot stamp a version it has not
    /// migrated to. Cached because migrations run only at open, so the value is
    /// fixed for the handle's life.
    pub fn schema_version(&self) -> u32 {
        self.state.schema_version
    }

    /// Hash of the declarations and live schema shape that decide row routing
    /// and confidentiality for this Store.
    pub fn sync_routing_hash(&self) -> ObjectHash {
        self.state.sync_routing_hash
    }

    /// The shared register clock. coven's sync layer records pulled rows as its
    /// floor and stamps envelopes off it; it is the same `Arc<Hlc>` the stamper wraps.
    pub fn hlc(&self) -> Arc<Hlc> {
        self.state.hlc.clone()
    }

    pub fn stamper(&self) -> UpdatedAtStamper {
        UpdatedAtStamper::new(self.state.hlc.clone())
    }

    /// The receiver's current wall-clock millis, read from this database's
    /// register clock. The pull reads it once and passes it down to bound an
    /// incoming `_updated_at`'s physical component (a grossly-future stamp must not
    /// win last-writer-wins or ratchet the clock).
    pub(crate) fn receive_wall_ms(&self) -> u64 {
        self.state.hlc.wall_now_ms()
    }

    /// Run `f` against the connection and await the result.
    ///
    /// This is how coven runs bookkeeping, gating reads, raw test writes, and
    /// apply — anything that needs `&Connection`. Public host writes and coven
    /// transitions that mutate synced rows wrap their write in a
    /// [`Self::run_internal_store_write_transaction_on`] transaction (still through
    /// `call`) so it lands in the pending-changeset journal.
    ///
    /// Hands `f` to the connection thread and awaits its reply, so the SQL runs
    /// off the async executor.
    pub async fn call<F, R>(&self, f: F) -> Result<R, DbError>
    where
        F: FnOnce(&Connection) -> Result<R, DbError> + Send + 'static,
        R: Send + 'static,
    {
        self.on_connection_thread(move |core| f(core.connection()))
            .await
    }

    /// Send `f` to the connection thread, run it against the owned core there, and
    /// await its result. A panic in `f` is caught on the connection thread (so it
    /// cannot unwind the thread and take the connection with it) and resumed on
    /// this task, matching the pre-thread behavior where the closure panicked
    /// directly on the caller.
    ///
    /// Cancellation: once dispatched, `f` runs to completion on the connection
    /// thread regardless of whether the caller is still awaiting. If the caller is
    /// cancelled between the thread committing and this reply resolving, it never
    /// observes the result even though the effect landed — the same "the operation
    /// may have committed" contract any network call carries. This is deliberate:
    /// the durable database state is the source of truth, and a caller must treat
    /// a cancelled call as possibly-committed. Follow-ups that matter beyond that
    /// durable state — observer notifications, publish triggers — are not driven
    /// off this return value; the sync cycle re-derives them from durable state.
    async fn on_connection_thread<F, R>(&self, f: F) -> R
    where
        F: FnOnce(&mut DatabaseCore) -> R + Send + 'static,
        R: Send + 'static,
    {
        let (reply_tx, reply_rx) = tokio::sync::oneshot::channel();
        let job = DbJob::Run(Box::new(move |core| {
            let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| f(core)));
            // The caller may have been cancelled and dropped `reply_rx`; a failed
            // send is that normal outcome, not an error.
            let _ = reply_tx.send(outcome);
        }));
        if self.thread.jobs.send(job).is_err() {
            panic!("database connection thread stopped before a call completed");
        }
        match reply_rx.await {
            Ok(Ok(value)) => value,
            Ok(Err(panic)) => std::panic::resume_unwind(panic),
            Err(_) => {
                panic!("database connection thread dropped a call's reply without responding")
            }
        }
    }

    fn start_host_change_journal_on<'c>(
        conn: &'c Connection,
        synced_tables: &[SyncedTable],
    ) -> Result<rusqlite::session::Session<'c>, DbError> {
        attach_session(conn, synced_tables)
    }

    fn drain_host_change_journal_on(
        session: &mut rusqlite::session::Session<'_>,
    ) -> Result<Vec<u8>, DbError> {
        capture_changeset(session)
    }

    fn invert_changeset(changeset: &[u8]) -> Result<Vec<u8>, DbError> {
        if changeset.is_empty() {
            return Ok(Vec::new());
        }
        let mut inverse = Vec::new();
        rusqlite::session::invert_strm(&mut &changeset[..], &mut inverse).map_err(DbError::from)?;
        Ok(inverse)
    }

    fn run_host_sql_on<R, E>(conn: &Connection, f: impl FnOnce() -> Result<R, E>) -> Result<R, E>
    where
        E: From<DbError>,
    {
        conn.authorizer(Some(authorize_host_sql))
            .map_err(DbError::from)
            .map_err(E::from)?;
        let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(f));
        if let Err(error) = conn.authorizer(
            None::<fn(rusqlite::hooks::AuthContext<'_>) -> rusqlite::hooks::Authorization>,
        ) {
            panic!("failed to remove host SQL gate-baseline guard: {error}");
        }
        match outcome {
            Ok(result) => result,
            Err(panic) => std::panic::resume_unwind(panic),
        }
    }

    fn capture_host_changes_on<R, E>(
        conn: &Connection,
        synced_tables: &[SyncedTable],
        f: impl FnOnce() -> Result<R, E>,
    ) -> Result<(R, Vec<u8>), E>
    where
        E: From<DbError>,
    {
        let mut journal =
            Self::start_host_change_journal_on(conn, synced_tables).map_err(E::from)?;
        let value = Self::run_host_sql_on(conn, f)?;
        let captured = Self::drain_host_change_journal_on(&mut journal).map_err(E::from)?;
        crate::sync::session::validate_changeset_row_identities(&captured, synced_tables)
            .map_err(|error| DbError::Message(error.to_string()))
            .map_err(E::from)?;
        Ok((value, captured))
    }

    fn capture_store_write_blob_facts_on(
        tx: &rusqlite::Transaction<'_>,
        changeset: &[u8],
        blob_decls: &BlobDecls,
    ) -> Result<StoreWriteBlobFacts, DbError> {
        let changes = crate::changeset::walk(changeset)
            .map_err(|error| DbError::Message(format!("read Store write blobs: {error}")))?;
        let mut facts = BTreeMap::new();
        for change in changes {
            let Some(publication) = blob_decls
                .publication_blob_from_change(tx, &change)
                .map_err(|error| DbError::Message(format!("capture Store write blob: {error}")))?
            else {
                continue;
            };
            let plaintext_hash = publication.plaintext_hash.parse().map_err(|error| {
                DbError::Message(format!(
                    "capture Store write blob {}/{} plaintext hash: {error}",
                    publication.blob.namespace, publication.blob.id
                ))
            })?;
            let external_path = if publication.blob.provenance == Provenance::UserProvided {
                tx.query_row(
                    "SELECT path FROM local_blob_refs
                     WHERE table_name = ?1 AND row_id = ?2 AND column_name = ?3
                       AND row_stamp = ?4 AND namespace = ?5 AND blob_id = ?6",
                    rusqlite::params![
                        publication.table,
                        publication.row_id,
                        publication.column,
                        publication.row_stamp,
                        publication.blob.namespace,
                        publication.blob.id,
                    ],
                    |row| row.get::<_, String>(0),
                )
                .optional()
                .map_err(DbError::from)?
                .map(PathBuf::from)
            } else {
                None
            };
            let previous = previous_row_blob_for_write_on(
                tx,
                &publication.table,
                &publication.row_id,
                &publication.row_stamp,
                &publication.column,
                &publication.blob,
                publication.plaintext_size,
                plaintext_hash,
            )?;
            let fact = StoreWriteBlobFact {
                table: publication.table,
                row_id: publication.row_id,
                row_stamp: publication.row_stamp,
                column: publication.column,
                blob: publication.blob,
                plaintext_size: publication.plaintext_size,
                plaintext_hash,
                external_path,
                previous,
            };
            let key = fact.identity_key();
            if let Some(prior) = facts.insert(key.clone(), fact.clone()) {
                if prior != fact {
                    return Err(DbError::Message(format!(
                        "Store write gives row {}/{}/{} at {} conflicting blob facts",
                        key.0, key.1, key.2, key.3
                    )));
                }
            }
        }
        Ok(StoreWriteBlobFacts {
            blobs: facts.into_values().collect(),
        })
    }

    fn capture_partition_blob_facts_on(
        tx: &rusqlite::Transaction<'_>,
        partitions: &[gate::AudiencePartition],
        blob_decls: &BlobDecls,
    ) -> Result<StoreWriteBlobFacts, DbError> {
        let mut facts = BTreeMap::new();
        for partition in partitions {
            for fact in
                Self::capture_store_write_blob_facts_on(tx, &partition.changeset, blob_decls)?.blobs
            {
                let key = fact.identity_key();
                if let Some(prior) = facts.insert(key.clone(), fact.clone()) {
                    if prior != fact {
                        return Err(DbError::Message(format!(
                            "audience partitions give row {}/{}/{} at {} conflicting blob facts",
                            key.0, key.1, key.2, key.3
                        )));
                    }
                }
            }
        }
        Ok(StoreWriteBlobFacts {
            blobs: facts.into_values().collect(),
        })
    }

    fn partition_captured_write_on(
        tx: &rusqlite::Transaction<'_>,
        captured: &[u8],
        gates: &Gates,
        write_policy: WritePolicy,
        routing: StoreWriteRouting<'_>,
    ) -> Result<Vec<gate::AudiencePartition>, DbError> {
        match routing {
            StoreWriteRouting::MergeScoped(encryption) => {
                let store_root_hash = Self::required_store_root_hash_on(tx)?;
                let key = crate::sync::circle::derive_row_routing_key(encryption, store_root_hash)
                    .map_err(|error| {
                        DbError::Message(format!("derive row routing key: {error}"))
                    })?;
                let routing_changeset = gate::capture_routing_changes(tx, captured, gates, &key)
                    .map_err(|error| {
                        DbError::Message(format!("capture scoped routing changes: {error}"))
                    })?;
                gate::partition_outbound(tx, captured, &routing_changeset, gates, write_policy)
                    .map_err(|error| {
                        DbError::Message(format!("partition scoped host transaction: {error}"))
                    })
            }
            StoreWriteRouting::SerialScoped => gate::partition_outbound(
                tx,
                captured,
                &gate::RoutingChanges::empty(),
                gates,
                write_policy,
            )
            .map_err(|error| {
                DbError::Message(format!("partition scoped host transaction: {error}"))
            }),
            StoreWriteRouting::Unscoped => {
                let changeset = gate::gate_outbound(tx, captured, gates)
                    .map_err(|error| DbError::Message(format!("gate host transaction: {error}")))?;
                Ok((!changeset.is_empty())
                    .then_some(gate::AudiencePartition {
                        audience: crate::sync::circle::Audience::Store,
                        control: None,
                        changeset,
                    })
                    .into_iter()
                    .collect())
            }
        }
    }

    fn store_write_routing<'a>(
        gates: &Gates,
        write_policy: WritePolicy,
        routing_encryption: Option<&'a EncryptionService>,
    ) -> Result<StoreWriteRouting<'a>, DbError> {
        if !gates.has_scoped_graph() {
            return Ok(StoreWriteRouting::Unscoped);
        }
        match write_policy {
            WritePolicy::MergeConcurrent => routing_encryption
                .map(StoreWriteRouting::MergeScoped)
                .ok_or_else(|| {
                    DbError::Message(
                        "Merge scoped write requires the Store generation-1 routing key"
                            .to_string(),
                    )
                }),
            WritePolicy::Serial => Ok(StoreWriteRouting::SerialScoped),
        }
    }

    pub(crate) fn validate_store_write_routing(
        gates: &Gates,
        write_policy: WritePolicy,
        routing_encryption: Option<&EncryptionService>,
    ) -> Result<(), DbError> {
        Self::store_write_routing(gates, write_policy, routing_encryption).map(drop)
    }

    fn insert_store_write_on(
        tx: &rusqlite::Transaction<'_>,
        write_id: &WriteId,
        partitions: &[gate::AudiencePartition],
        inverse_changeset: &[u8],
        base: &StoreWriteBase,
        blob_facts: &StoreWriteBlobFacts,
        rows_changed: u64,
    ) -> Result<WriteStatus, DbError> {
        let affected_rows = if partitions.is_empty() {
            // A tripwire, not a routine event. An empty capture from a transaction
            // that also CHANGED NO ROWS is a pure read left on the write path —
            // warn so it gets moved to the journal-free read path
            // (`CovenHandle::sql_read`). An empty capture
            // from a transaction that DID change rows is a device-local-table
            // write (those tables aren't in the session) — a supported, routine
            // pattern that stays on `sql()` silently. The one case this misses:
            // a conditional write to a synced table that no-op'd this cycle (an
            // idempotent INSERT OR IGNORE re-run) also changed no rows and warns;
            // legitimate but rare, tolerated.
            if rows_changed == 0 {
                warn!("journaled sql transaction changed nothing; pure reads belong on sql_read");
                // Debug builds name the offender: the backtrace runs through the
                // host's monomorphized closure, whose symbol carries the call
                // site's module path. Captured only when the warn fires.
                #[cfg(debug_assertions)]
                warn!(
                    "zero-change sql transaction backtrace:\n{}",
                    std::backtrace::Backtrace::force_capture()
                );
            }
            Vec::new()
        } else {
            let mut affected = Vec::new();
            for partition in partitions {
                affected.extend(
                    crate::changeset::walk(&partition.changeset)
                        .map_err(|error| {
                            DbError::Message(format!("read affected write rows: {error}"))
                        })?
                        .into_iter()
                        .filter(|row| !gate::is_routing_table(&row.table))
                        .map(|row| {
                            let primary_key = row.pk().map(str::to_owned).ok_or_else(|| {
                                DbError::Message(format!(
                                    "shared write row in {:?} has no primary key",
                                    row.table
                                ))
                            })?;
                            Ok(AffectedRow {
                                table: row.table,
                                primary_key,
                            })
                        })
                        .collect::<Result<Vec<_>, DbError>>()?,
                );
            }
            affected.sort();
            affected.dedup();
            affected
        };
        let status = if partitions.is_empty() {
            WriteStatus::LocalOnly
        } else {
            WriteStatus::Pending
        };
        let base = serde_json::to_string(base)
            .map_err(|error| DbError::Message(format!("serialize pending Store base: {error}")))?;
        let status_json = serde_json::to_string(&status)
            .map_err(|error| DbError::Message(format!("serialize write status: {error}")))?;
        let affected_rows = serde_json::to_string(&affected_rows)
            .map_err(|error| DbError::Message(format!("serialize affected rows: {error}")))?;
        let blob_facts_json = serde_json::to_string(blob_facts).map_err(|error| {
            DbError::Message(format!("serialize Store write blob facts: {error}"))
        })?;
        let store_changeset = partitions
            .iter()
            .find(|partition| partition.audience == crate::sync::circle::Audience::Store)
            .map(|partition| partition.changeset.as_slice())
            .unwrap_or_default();
        tx.execute(
            "INSERT INTO store_writes
             (write_id, status, affected_rows, changeset, inverse_changeset, base, blob_facts)
             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
            rusqlite::params![
                write_id.as_str(),
                status_json,
                affected_rows,
                store_changeset,
                inverse_changeset,
                base,
                blob_facts_json,
            ],
        )
        .map_err(DbError::from)?;
        for partition in partitions {
            let audience = match partition.audience {
                crate::sync::circle::Audience::Store => "store".to_string(),
                crate::sync::circle::Audience::Local => {
                    return Err(DbError::Message(
                        "Local audience must not enter the durable outbound journal".to_string(),
                    ));
                }
                crate::sync::circle::Audience::Circle(circle_id) => circle_id.to_string(),
            };
            let control = partition
                .control
                .as_ref()
                .map(gate::CirclePartitionControl::stored_json);
            tx.execute(
                "INSERT INTO store_write_partitions
                 (write_id, audience, control_coord, changeset)
                 VALUES (?1, ?2, ?3, ?4)",
                rusqlite::params![write_id.as_str(), audience, control, partition.changeset,],
            )
            .map_err(DbError::from)?;
        }
        if status == WriteStatus::Pending {
            for fact in &blob_facts.blobs {
                if fact.blob.provenance != Provenance::HostProvided {
                    continue;
                }
                tx.execute(
                    "INSERT OR IGNORE INTO store_write_blob_leases
                     (write_id, namespace, blob_id) VALUES (?1, ?2, ?3)",
                    (write_id.as_str(), &fact.blob.namespace, &fact.blob.id),
                )
                .map_err(DbError::from)?;
            }
        }
        Ok(status)
    }

    pub fn run_store_write_transaction_on<R, E>(
        conn: &Connection,
        synced_tables: &[SyncedTable],
        gates: &Gates,
        blob_decls: &BlobDecls,
        write_policy: WritePolicy,
        routing_encryption: Option<&EncryptionService>,
        write_id: WriteId,
        f: impl FnOnce(&rusqlite::Transaction<'_>) -> Result<R, E>,
    ) -> Result<WriteReceipt<R>, E>
    where
        E: From<DbError>,
    {
        (|| {
            let routing = Self::store_write_routing(gates, write_policy, routing_encryption)
                .map_err(E::from)?;
            let changes_before = conn.total_changes();
            let tx = conn
                .unchecked_transaction()
                .map_err(DbError::from)
                .map_err(E::from)?;
            let (value, captured) = Self::capture_host_changes_on(&tx, synced_tables, || f(&tx))?;
            let partitions =
                Self::partition_captured_write_on(&tx, &captured, gates, write_policy, routing)
                    .map_err(E::from)?;
            let blob_facts = Self::capture_partition_blob_facts_on(&tx, &partitions, blob_decls)
                .map_err(E::from)?;
            let rows_changed = conn.total_changes().saturating_sub(changes_before);
            let local_stream_id = local_merge_stream_id_on(&tx).map_err(E::from)?;
            let inverse_changeset = Self::invert_changeset(&captured).map_err(E::from)?;
            let base = match write_policy {
                WritePolicy::MergeConcurrent => StoreWriteBase::MergeConcurrent {
                    dependencies: Self::materialized_frontier_on(&tx, local_stream_id.as_deref())
                        .map_err(E::from)?,
                },
                WritePolicy::Serial => {
                    let existing: Option<String> = tx
                        .query_row(
                            "SELECT base FROM store_writes
                             WHERE status != '\"local_only\"'
                               AND json_extract(status, '$.published') IS NULL
                               AND json_extract(status, '$.resolved') IS NULL
                               AND json_type(base, '$.serial') IS NOT NULL
                             ORDER BY ordinal LIMIT 1",
                            [],
                            |row| row.get(0),
                        )
                        .optional()
                        .map_err(DbError::from)
                        .map_err(E::from)?;
                    match existing {
                        Some(existing) => serde_json::from_str(&existing)
                            .map_err(|error| {
                                DbError::Message(format!("pending serial branch base: {error}"))
                            })
                            .map_err(E::from)?,
                        None => StoreWriteBase::Serial {
                            branch_id: PendingBranchId::from_first_write(write_id.clone()),
                            base: Self::latest_position_for_device_on(&tx, SERIAL_STREAM_ID)
                                .map_err(E::from)?,
                        },
                    }
                }
            };
            let status = Self::insert_store_write_on(
                &tx,
                &write_id,
                &partitions,
                &inverse_changeset,
                &base,
                &blob_facts,
                rows_changed,
            )
            .map_err(E::from)?;
            let pending_branch_id = match (&status, &base) {
                (WriteStatus::LocalOnly, _) | (_, StoreWriteBase::MergeConcurrent { .. }) => None,
                (_, StoreWriteBase::Serial { branch_id, .. }) => Some(branch_id.clone()),
            };
            tx.commit().map_err(DbError::from).map_err(E::from)?;
            Ok(WriteReceipt {
                value,
                write_id,
                status,
                pending_branch_id,
            })
        })()
    }

    pub fn run_internal_store_write_transaction_on<R, E>(
        conn: &Connection,
        synced_tables: &[SyncedTable],
        write_policy: WritePolicy,
        routing_encryption: Option<&EncryptionService>,
        write_id: WriteId,
        f: impl FnOnce(&rusqlite::Transaction<'_>) -> Result<R, E>,
    ) -> Result<R, E>
    where
        E: From<DbError>,
    {
        let gates = Gates::from_tables(conn, synced_tables)
            .map_err(|error| DbError::Message(error.to_string()))
            .map_err(E::from)?;
        let blob_decls = BlobDecls::from_tables(conn, synced_tables)
            .map_err(|error| DbError::Message(error.to_string()))
            .map_err(E::from)?;
        Self::run_store_write_transaction_on(
            conn,
            synced_tables,
            &gates,
            &blob_decls,
            write_policy,
            routing_encryption,
            write_id,
            f,
        )
        .map(|receipt| receipt.value)
    }

    pub(crate) async fn prepare_store_write(&self) -> Result<Option<PreparedStoreWrite>, DbError> {
        let write_policy = self.write_policy();
        self.call(move |conn| {
            let stored = conn
                .query_row(
                "SELECT write_id, changeset, inverse_changeset, base, blob_facts FROM store_writes
                 WHERE status = '\"pending\"'
                   AND ordinal = (
                       SELECT MIN(ordinal) FROM store_writes
                       WHERE status != '\"local_only\"'
                         AND json_extract(status, '$.published') IS NULL
                         AND json_extract(status, '$.resolved') IS NULL
                   )
                   AND NOT EXISTS (
                       SELECT 1 FROM store_writes WHERE prepared IS NOT NULL
                   )
                 ORDER BY ordinal LIMIT 1",
                [],
                |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, Vec<u8>>(1)?,
                        row.get::<_, Vec<u8>>(2)?,
                        row.get::<_, String>(3)?,
                        row.get::<_, String>(4)?,
                    ))
                },
            )
                .optional()
                .map_err(DbError::from)?;
            let Some((write_id, changeset, inverse_changeset, base, blob_facts)) = stored else {
                return Ok(None);
            };
            let partitions = Self::prepared_store_write_partitions_on(
                conn,
                &write_id,
                &changeset,
                write_policy,
            )?;
            Ok(Some(PreparedStoreWrite {
                write_id: WriteId::from_generated(write_id),
                changeset,
                partitions,
                inverse_changeset,
                base: serde_json::from_str(&base)
                    .map_err(|error| DbError::Message(format!("pending write base: {error}")))?,
                blob_facts: serde_json::from_str(&blob_facts).map_err(|error| {
                    DbError::Message(format!("pending write blob facts: {error}"))
                })?,
            }))
        })
        .await
    }

    fn prepared_store_write_partitions_on(
        conn: &Connection,
        write_id: &str,
        stored_store_changeset: &[u8],
        write_policy: WritePolicy,
    ) -> Result<PreparedStoreWritePartitions, DbError> {
        let mut statement = conn
            .prepare(
                "SELECT audience, control_coord, changeset
                 FROM store_write_partitions
                 WHERE write_id = ?1
                 ORDER BY CASE audience WHEN 'store' THEN 0 ELSE 1 END,
                          audience, control_coord",
            )
            .map_err(DbError::from)?;
        let rows = statement
            .query_map([write_id], |row| {
                Ok((
                    row.get::<_, String>(0)?,
                    row.get::<_, Option<String>>(1)?,
                    row.get::<_, Vec<u8>>(2)?,
                ))
            })
            .map_err(DbError::from)?;
        let mut store = None;
        let mut circles = Vec::new();
        for row in rows {
            let (audience, control, changeset) = row.map_err(DbError::from)?;
            if audience == "store" {
                if control.is_some() {
                    return Err(DbError::Message(format!(
                        "pending write {write_id} Store partition carries a Circle control"
                    )));
                }
                if store.is_some() {
                    return Err(DbError::Message(format!(
                        "pending write {write_id} carries more than one Store partition"
                    )));
                }
                store = Some(gate::AudiencePartition {
                    audience: crate::sync::circle::Audience::Store,
                    control: None,
                    changeset,
                });
                continue;
            }
            let circle_id = audience
                .parse::<crate::sync::circle::CircleId>()
                .map_err(|error| {
                    DbError::Message(format!(
                        "pending write {write_id} has invalid audience {audience:?}: {error}"
                    ))
                })?;
            let control_json = control.ok_or_else(|| {
                DbError::Message(format!(
                    "pending write {write_id} Circle {circle_id} has no control coordinate"
                ))
            })?;
            let control =
                gate::CirclePartitionControl::from_stored_json(control_json).map_err(|error| {
                    DbError::Message(format!(
                        "pending write {write_id} Circle {circle_id} control coordinate: {error}"
                    ))
                })?;
            let control_policy = match control.coordinate() {
                crate::sync::circle::CircleControlCoord::MergeConcurrent { .. } => {
                    WritePolicy::MergeConcurrent
                }
                crate::sync::circle::CircleControlCoord::Serial { .. } => WritePolicy::Serial,
            };
            if control_policy != write_policy {
                return Err(DbError::Message(format!(
                    "pending write {write_id} Circle {circle_id} control uses {control_policy:?}, database uses {write_policy:?}"
                )));
            }
            circles.push(gate::AudiencePartition {
                audience: crate::sync::circle::Audience::Circle(circle_id),
                control: Some(control),
                changeset,
            });
        }
        drop(statement);
        match &store {
            Some(partition) if partition.changeset != stored_store_changeset => {
                return Err(DbError::Message(format!(
                    "pending write {write_id} Store partition differs from store_writes.changeset"
                )));
            }
            None if !stored_store_changeset.is_empty() => {
                return Err(DbError::Message(format!(
                    "pending write {write_id} has a store_writes.changeset without a Store partition"
                )));
            }
            Some(_) | None => {}
        }
        if store.is_none() && circles.is_empty() {
            return Err(DbError::Message(format!(
                "pending write {write_id} has no durable audience partitions"
            )));
        }
        Ok(PreparedStoreWritePartitions { store, circles })
    }

    pub(crate) async fn reserve_serial_store_branch(
        &self,
    ) -> Result<Option<SerialStoreBranchPreparationWork>, DbError> {
        if self.write_policy() != WritePolicy::Serial {
            return Err(DbError::Message(
                "Serial branch reservation requires the Serial write policy".to_string(),
            ));
        }
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let mut statement = tx
                .prepare(
                    "SELECT write_id, changeset, inverse_changeset, base, blob_facts, status, prepared
                     FROM store_writes
                     WHERE status != '\"local_only\"'
                       AND json_extract(status, '$.published') IS NULL
                       AND json_extract(status, '$.resolved') IS NULL
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, Vec<u8>>(1)?,
                        row.get::<_, Vec<u8>>(2)?,
                        row.get::<_, String>(3)?,
                        row.get::<_, String>(4)?,
                        row.get::<_, String>(5)?,
                        row.get::<_, Option<String>>(6)?,
                    ))
                })
                .map_err(DbError::from)?;
            let mut records = Vec::new();
            for row in rows {
                records.push(row.map_err(DbError::from)?);
            }
            drop(statement);
            let Some(first) = records.first() else {
                tx.commit().map_err(DbError::from)?;
                return Ok(None);
            };
            let first_base: StoreWriteBase = serde_json::from_str(&first.3)
                .map_err(|error| DbError::Message(format!("pending Serial write base: {error}")))?;
            let StoreWriteBase::Serial { branch_id, base } = first_base else {
                return Err(DbError::Message(
                    "MergeConcurrent write exists in a Serial database".to_string(),
                ));
            };
            let preparing = serde_json::to_string(&PreparedStoreWriteState::SerialPreparing)
                .map_err(|error| DbError::Message(format!("serialize Serial reservation: {error}")))?;
            let publishing = serde_json::to_string(&WriteStatus::Publishing)
                .map_err(|error| DbError::Message(format!("serialize write status: {error}")))?;
            let mut writes = Vec::new();
            let mut newly_reserved = Vec::new();
            for (write_id, changeset, inverse_changeset, raw_base, blob_facts, status, prepared) in
                records
            {
                let parsed_base: StoreWriteBase = serde_json::from_str(&raw_base)
                    .map_err(|error| DbError::Message(format!("pending Serial write base: {error}")))?;
                if parsed_base
                    != (StoreWriteBase::Serial {
                        branch_id: branch_id.clone(),
                        base: base.clone(),
                    })
                {
                    break;
                }
                match (status.as_str(), prepared.as_deref()) {
                    ("\"pending\"", None) => {
                        let updated = tx
                            .execute(
                                "UPDATE store_writes SET status = ?2, prepared = ?3
                                 WHERE write_id = ?1 AND status = '\"pending\"' AND prepared IS NULL",
                                rusqlite::params![&write_id, &publishing, &preparing],
                            )
                            .map_err(DbError::from)?;
                        if updated != 1 {
                            return Err(DbError::Message(format!(
                                "Serial write {write_id} lost branch reservation"
                            )));
                        }
                        newly_reserved.push(WriteId::from_generated(write_id.clone()));
                    }
                    ("\"publishing\"", Some(stored)) if stored == preparing => {}
                    ("\"publishing\"", Some(_)) => {
                        tx.commit().map_err(DbError::from)?;
                        return Ok(None);
                    }
                    _ => {
                        tx.commit().map_err(DbError::from)?;
                        return Ok(None);
                    }
                }
                let partitions = Self::prepared_store_write_partitions_on(
                    &tx,
                    &write_id,
                    &changeset,
                    WritePolicy::Serial,
                )?;
                writes.push(PreparedStoreWrite {
                    write_id: WriteId::from_generated(write_id),
                    changeset,
                    partitions,
                    inverse_changeset,
                    base: parsed_base,
                    blob_facts: serde_json::from_str(&blob_facts).map_err(|error| {
                        DbError::Message(format!("pending Serial write blob facts: {error}"))
                    })?,
                });
            }
            if writes.is_empty() {
                return Err(DbError::Message("Serial branch reservation is empty".to_string()));
            }
            tx.commit().map_err(DbError::from)?;
            for write_id in newly_reserved {
                Self::notify_write_status_in(&statuses, &write_id, WriteStatus::Publishing);
            }
            Ok(Some(SerialStoreBranchPreparationWork {
                branch_id,
                base,
                writes,
            }))
        })
        .await
    }

    #[cfg(test)]
    pub(crate) async fn enqueue_store_changeset_for_test(
        &self,
        changeset: Vec<u8>,
    ) -> Result<(), DbError> {
        let write_id = self.new_write_id();
        let blob_decls = self.blob_decls();
        let write_policy = self.write_policy();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let local_stream_id = local_merge_stream_id_on(&tx)?;
            let base = match write_policy {
                WritePolicy::MergeConcurrent => StoreWriteBase::MergeConcurrent {
                    dependencies: Self::materialized_frontier_on(&tx, local_stream_id.as_deref())?,
                },
                WritePolicy::Serial => StoreWriteBase::Serial {
                    branch_id: PendingBranchId::from_first_write(write_id.clone()),
                    base: Self::latest_position_for_device_on(&tx, SERIAL_STREAM_ID)?,
                },
            };
            let inverse_changeset = Self::invert_changeset(&changeset)?;
            let partitions = vec![gate::AudiencePartition {
                audience: crate::sync::circle::Audience::Store,
                control: None,
                changeset,
            }];
            let blob_facts = Self::capture_partition_blob_facts_on(&tx, &partitions, &blob_decls)?;
            Self::insert_store_write_on(
                &tx,
                &write_id,
                &partitions,
                &inverse_changeset,
                &base,
                &blob_facts,
                1,
            )?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn prepare_store_write_commit(
        &self,
        stage: StoreWritePreparation,
    ) -> Result<(), DbError> {
        let write_id = stage.write_id.clone();
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let local_device_id: String = tx.query_row(
                "SELECT value FROM protocol_state WHERE key = ?1",
                [LOCAL_DEVICE_ID_STATE_KEY],
                |row| row.get(0),
            ).map_err(DbError::from)?;
            let root = required_store_root_authority_on(&tx)?;
            let (registration_bytes, registration_object): (Vec<u8>, String) = tx.query_row(
                "SELECT registration_bytes, registration_object \
                 FROM store_device_registration_activations WHERE device_id = ?1",
                [&local_device_id],
                |row| Ok((row.get(0)?, row.get(1)?)),
            ).map_err(DbError::from)?;
            let registration_ref: StoreDeviceRegistrationRef =
                serde_json::from_str(&registration_object).map_err(|error| {
                    DbError::Message(format!("prepared write exact registration ref: {error}"))
                })?;
            if registration_ref != stage.commit.value.author_registration
                || registration_ref != stage.head.value.author_registration
            {
                return Err(DbError::Message(
                    "prepared Store commit/head author registration differs from local activation"
                        .to_string(),
                ));
            }
            let registration = StoreDeviceRegistration::parse_at(
                &registration_bytes,
                &root,
                registration_ref.device_id,
            ).map_err(|error| DbError::Message(format!(
                "prepared write author registration: {error}"
            )))?;
            registration_ref.verify_registration(&registration)
                .map_err(|error| DbError::Message(error.to_string()))?;
            let stream_id = AuthorStreamId::store_announcements(&root, &registration_ref);
            let coord = StoreCommitCoord::MergeConcurrent {
                stream_id,
                sequence: stage.commit.value.seq(),
            };
            stage.commit.value.verify_at(root.store_root_hash, &coord, &registration)
                .map_err(|error| DbError::Message(format!(
                    "verify prepared Store commit: {error}"
                )))?;
            if stage.commit.value.write_id != stage.write_id {
                return Err(DbError::Message(
                    "prepared write id differs from signed commit".to_string(),
                ));
            }
            let commit_ref = StoreBatchCommitRef::from_commit(
                &stage.commit.value,
                coord,
                stage.commit.prepared.reference().clone(),
            ).map_err(|error| DbError::Message(error.to_string()))?;
            if stage.head.value.commit != commit_ref {
                return Err(DbError::Message(
                    "prepared Store head does not activate the exact prepared commit".to_string(),
                ));
            }
            StoreDeviceHead::parse_at(
                &stage.head.value.to_bytes(),
                root.store_root_hash,
                &registration,
                &commit_ref,
            ).map_err(|error| DbError::Message(format!(
                "verify prepared Store head: {error}"
            )))?;
            let (stored_changeset, stored_base, stored_status, stored_preparation): (
                Vec<u8>,
                String,
                String,
                Option<String>,
            ) = tx
                .query_row(
                    "SELECT changeset, base, status, prepared
                     FROM store_writes WHERE write_id = ?1",
                    [stage.write_id.as_str()],
                    |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
                )
                .map_err(DbError::from)?;
            if stored_status != "\"pending\"" || stored_preparation.is_some() {
                return Err(DbError::Message(format!(
                    "write {} is not an unprepared pending write",
                    stage.write_id
                )));
            }
            let partitions = Self::prepared_store_write_partitions_on(
                &tx,
                stage.write_id.as_str(),
                &stored_changeset,
                WritePolicy::MergeConcurrent,
            )?;
            let stored_base: StoreWriteBase =
                serde_json::from_str(&stored_base).map_err(|error| {
                    DbError::Message(format!("write {} base: {error}", stage.write_id))
                })?;
            let StoreWriteBase::MergeConcurrent {
                dependencies: stored_dependencies,
            } = stored_base
            else {
                return Err(DbError::Message(format!(
                    "serial write {} reached MergeConcurrent preparation",
                    stage.write_id
                )));
            };
            let stored_dependencies = CommitFrontier::from_refs(
                WritePolicy::MergeConcurrent,
                stored_dependencies,
            ).map_err(|error| DbError::Message(format!(
                "stored write dependencies: {error}"
            )))?;
            if stored_dependencies.merge_commits().map_err(|error| {
                DbError::Message(error.to_string())
            })? != stage.commit.value.merge_dependencies().map_err(|error| {
                DbError::Message(format!("prepared Store commit policy: {error}"))
            })? {
                return Err(DbError::Message(format!(
                    "prepared commit dependencies differ from write {}",
                    stage.write_id
                )));
            }
            let another_prepared: Option<String> = tx
                .query_row(
                    "SELECT write_id FROM store_writes
                     WHERE prepared IS NOT NULL AND write_id != ?1
                     ORDER BY ordinal LIMIT 1",
                    [stage.write_id.as_str()],
                    |row| row.get(0),
                )
                .optional()
                .map_err(DbError::from)?;
            if let Some(other_write_id) = another_prepared {
                return Err(DbError::Message(format!(
                    "write {other_write_id} already owns Store publication"
                )));
            }
            let durable_predecessor =
                Self::latest_position_for_device_on(&tx, &stream_id.to_string())?;
            let expected_seq = durable_predecessor
                .as_ref()
                .map_or(1, |reference| reference.coord.sequence().saturating_add(1));
            if stage.commit.value.seq() != expected_seq
                || stage.commit.value.order.predecessor() != durable_predecessor.as_ref()
            {
                return Err(DbError::Message(format!(
                    "outbound Store commit exact predecessor differs from durable {durable_predecessor:?}"
                )));
            }

            Self::persist_closed_write_objects_on(
                &tx,
                &stage.write_id,
                root.store_root_hash,
                &commit_ref,
                &stage.commit.value,
                stage.commit.prepared.stored_bytes(),
                &partitions,
                &stage.remote_objects,
                &stage.audiences,
            )?;
            let head_ref = crate::sync::store_commit::StoreDeviceHeadRef {
                head_hash: stage.head.value.head_hash(),
                object: stage.head.prepared.reference().clone(),
            };
            let head_remote = RemoteObjectRecord::candidate_activated_store_head(
                head_ref,
                stage.head.value.to_bytes(),
                stage.head.prepared.stored_bytes().to_vec(),
                commit_ref.clone(),
            )
            .map_err(|error| DbError::Message(format!("prepared Store head: {error}")))?;
            persist_exact_remote_object_on(&tx, &head_remote, "Store head")?;

            let prepared = PreparedStoreWriteState::MergeConcurrent {
                commit: DurablePreparedProtocolObject {
                    semantic_bytes: stage.commit.value.to_bytes(),
                    prepared: stage.commit.prepared,
                },
                head: DurablePreparedProtocolObject {
                    semantic_bytes: stage.head.value.to_bytes(),
                    prepared: stage.head.prepared,
                },
                local_cleanup: stage.local_cleanup,
                completion: stage.completion,
            };
            let prepared = serde_json::to_string(&prepared).map_err(|error| {
                DbError::Message(format!("serialize prepared Store write: {error}"))
            })?;
            let status = serde_json::to_string(&WriteStatus::Publishing)
                .map_err(|error| DbError::Message(format!("serialize write status: {error}")))?;
            let updated = tx
                .execute(
                    "UPDATE store_writes SET prepared = ?2, status = ?3
                     WHERE write_id = ?1 AND prepared IS NULL AND status = '\"pending\"'",
                    rusqlite::params![stage.write_id.as_str(), prepared, status],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(format!(
                    "write {} lost pending preparation ownership",
                    stage.write_id
                )));
            }
            tx.commit().map_err(DbError::from)?;
            Self::notify_write_status_in(&statuses, &write_id, WriteStatus::Publishing);
            Ok(())
        })
        .await
    }

    pub(crate) async fn prepare_merge_candidate_abandonment(
        &self,
        stage: MergeCandidateAbandonmentPreparation,
    ) -> Result<(), DbError> {
        if self.write_policy() != WritePolicy::MergeConcurrent {
            return Err(DbError::Message(
                "Merge candidate abandonment requires MergeConcurrent policy".to_string(),
            ));
        }
        let statuses = self.state.write_statuses.clone();
        let notified_write_id = stage.write_id.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let (raw_status, raw_prepared): (String, String) = tx
                .query_row(
                    "SELECT status, prepared FROM store_writes WHERE write_id = ?1",
                    [stage.write_id.as_str()],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let status: WriteStatus = serde_json::from_str(&raw_status)
                .map_err(|error| DbError::Message(format!("Merge abandonment status: {error}")))?;
            if !matches!(status, WriteStatus::Blocked(_)) {
                return Err(DbError::Message(format!(
                    "write {} is not blocked",
                    stage.write_id
                )));
            }
            let prepared: PreparedStoreWriteState = serde_json::from_str(&raw_prepared)
                .map_err(|error| DbError::Message(format!("prepared Merge candidate: {error}")))?;
            let PreparedStoreWriteState::MergeConcurrent {
                commit: candidate_commit,
                head: candidate_head,
                local_cleanup,
                completion,
            } = prepared
            else {
                return Err(DbError::Message(
                    "Merge abandonment requires one prepared candidate".to_string(),
                ));
            };
            let candidate =
                parse_prepared_merge_candidate_parts_on(&tx, &candidate_commit, &candidate_head)?;
            if candidate.commit.write_id != stage.write_id {
                return Err(DbError::Message(
                    "prepared Merge candidate differs from its write identity".to_string(),
                ));
            }
            let root = required_store_root_authority_on(&tx)?;
            let registration =
                load_activated_registration_on(&tx, &root, &candidate.commit.author_registration)?;
            stage
                .commit
                .value
                .verify_at(
                    root.store_root_hash,
                    &candidate.reference.coord,
                    &registration,
                )
                .map_err(|error| {
                    DbError::Message(format!("verify Merge abandonment commit: {error}"))
                })?;
            if stage.commit.value.write_id != stage.write_id
                || stage.commit.value.abandoned_candidates()
                    != [crate::sync::store_commit::CandidateCleanupManifest {
                        candidate: crate::sync::store_commit::StoreBatchCommitDeletionTarget {
                            coord: candidate.reference.coord.clone(),
                            object: candidate.reference.object.clone(),
                            canonical_signed_bytes: candidate.canonical_signed_bytes.clone(),
                        },
                    }]
            {
                return Err(DbError::Message(
                    "Merge abandonment does not name its exact prepared candidate".to_string(),
                ));
            }
            let authority_ref = StoreBatchCommitRef::from_commit(
                &stage.commit.value,
                candidate.reference.coord.clone(),
                stage.commit.prepared.reference().clone(),
            )
            .map_err(|error| DbError::Message(error.to_string()))?;
            if stage.head.value.commit != authority_ref
                || stage.head.prepared.reference().slot()
                    != candidate.head_prepared.reference().slot()
                || stage.head.value.successor != candidate.head.successor
                || stage.head.value.author_registration != candidate.commit.author_registration
            {
                return Err(DbError::Message(
                    "Merge abandonment head differs from the candidate competition point"
                        .to_string(),
                ));
            }
            StoreDeviceHead::parse_at(
                &stage.head.value.to_bytes(),
                root.store_root_hash,
                &registration,
                &authority_ref,
            )
            .map_err(|error| DbError::Message(format!("verify Merge abandonment head: {error}")))?;
            let authority_commit = RemoteObjectRecord::candidate_commit(
                authority_ref.clone(),
                stage.commit.value.to_bytes(),
                stage.commit.prepared.stored_bytes().to_vec(),
            )
            .map_err(|error| DbError::Message(format!("Merge abandonment commit: {error}")))?;
            persist_exact_remote_object_on(&tx, &authority_commit, "Merge abandonment commit")?;
            let authority_head_ref = crate::sync::store_commit::StoreDeviceHeadRef {
                head_hash: stage.head.value.head_hash(),
                object: stage.head.prepared.reference().clone(),
            };
            let authority_head = RemoteObjectRecord::candidate_activated_store_head(
                authority_head_ref,
                stage.head.value.to_bytes(),
                stage.head.prepared.stored_bytes().to_vec(),
                authority_ref,
            )
            .map_err(|error| DbError::Message(format!("Merge abandonment head: {error}")))?;
            persist_exact_remote_object_on(&tx, &authority_head, "Merge abandonment head")?;
            let replacement = PreparedStoreWriteState::MergeAbandonment {
                candidate_commit,
                candidate_head,
                authority_commit: DurablePreparedProtocolObject {
                    semantic_bytes: stage.commit.value.to_bytes(),
                    prepared: stage.commit.prepared,
                },
                authority_head: DurablePreparedProtocolObject {
                    semantic_bytes: stage.head.value.to_bytes(),
                    prepared: stage.head.prepared,
                },
                outcome: MergeAbandonmentOutcome::Prepared,
                local_cleanup,
                completion,
            };
            let replacement = serde_json::to_string(&replacement).map_err(|error| {
                DbError::Message(format!("serialize Merge abandonment: {error}"))
            })?;
            let publishing = serde_json::to_string(&WriteStatus::Publishing).map_err(|error| {
                DbError::Message(format!("serialize Merge abandonment status: {error}"))
            })?;
            let updated = tx
                .execute(
                    "UPDATE store_writes SET prepared = ?2, status = ?3
                     WHERE write_id = ?1 AND prepared = ?4
                       AND json_extract(status, '$.blocked') IS NOT NULL",
                    rusqlite::params![
                        stage.write_id.as_str(),
                        replacement,
                        publishing,
                        raw_prepared
                    ],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(
                    "blocked Merge candidate changed during abandonment preparation".to_string(),
                ));
            }
            tx.commit().map_err(DbError::from)?;
            Self::notify_write_status_in(&statuses, &notified_write_id, WriteStatus::Publishing);
            Ok(())
        })
        .await
    }

    pub(crate) async fn prepare_serial_candidate_abandonment(
        &self,
        stage: SerialCandidateAbandonmentPreparation,
    ) -> Result<(), DbError> {
        if self.write_policy() != WritePolicy::Serial {
            return Err(DbError::Message(
                "Serial candidate abandonment requires the Serial write policy".to_string(),
            ));
        }
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let existing: Option<String> = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [SERIAL_CANDIDATE_ABANDONMENT_STATE_KEY],
                    |row| row.get(0),
                )
                .optional()
                .map_err(DbError::from)?;
            if existing.is_some() {
                return Err(DbError::Message(
                    "a Serial candidate abandonment is already prepared".to_string(),
                ));
            }
            let (raw_base, raw_prepared): (String, String) = tx
                .query_row(
                    "SELECT base, prepared FROM store_writes
                     WHERE prepared IS NOT NULL AND status = '\"publishing\"'
                     ORDER BY ordinal LIMIT 1",
                    [],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let StoreWriteBase::Serial { branch_id, base } = serde_json::from_str(&raw_base)
                .map_err(|error| {
                    DbError::Message(format!("Serial abandonment branch base: {error}"))
                })?
            else {
                return Err(DbError::Message(
                    "Merge branch reached Serial candidate abandonment".to_string(),
                ));
            };
            if branch_id != stage.branch_id {
                return Err(DbError::Message(
                    "Serial abandonment names another pending branch".to_string(),
                ));
            }
            let prepared: PreparedStoreWriteState =
                serde_json::from_str(&raw_prepared).map_err(|error| {
                    DbError::Message(format!("prepared Serial abandonment candidate: {error}"))
                })?;
            let PreparedStoreWriteState::Serial {
                base_head_bytes,
                base_head_version,
                commit: candidate_commit,
                ..
            } = &prepared
            else {
                return Err(DbError::Message(
                    "Serial abandonment requires an exact prepared branch".to_string(),
                ));
            };
            let base_head = VersionedObject {
                bytes: base_head_bytes.clone().ok_or_else(|| {
                    DbError::Message(
                        "Serial abandonment base has no signed coordination head".to_string(),
                    )
                })?,
                version: base_head_version.clone().ok_or_else(|| {
                    DbError::Message(
                        "Serial abandonment base has no provider version receipt".to_string(),
                    )
                })?,
            };
            let candidate = parse_prepared_serial_candidate(&raw_prepared)?
                .expect("matched exact Serial candidate");
            if candidate.reference != stage.candidate {
                return Err(DbError::Message(
                    "Serial abandonment target differs from the branch first candidate".to_string(),
                ));
            }
            let root = required_store_root_authority_on(&tx)?;
            let registration =
                load_activated_registration_on(&tx, &root, &candidate.commit.author_registration)?;
            stage
                .commit
                .value
                .verify_at(
                    root.store_root_hash,
                    &candidate.reference.coord,
                    &registration,
                )
                .map_err(|error| {
                    DbError::Message(format!("verify Serial abandonment commit: {error}"))
                })?;
            if stage.commit.value.write_id != candidate.commit.write_id
                || stage.commit.value.order != candidate.commit.order
                || stage.commit.value.abandoned_candidates()
                    != [crate::sync::store_commit::CandidateCleanupManifest {
                        candidate: crate::sync::store_commit::StoreBatchCommitDeletionTarget {
                            coord: candidate.reference.coord.clone(),
                            object: candidate.reference.object.clone(),
                            canonical_signed_bytes: candidate.canonical_signed_bytes.clone(),
                        },
                    }]
            {
                return Err(DbError::Message(
                    "Serial abandonment does not replace its exact first candidate".to_string(),
                ));
            }
            let authority_ref = StoreBatchCommitRef::from_commit(
                &stage.commit.value,
                candidate.reference.coord.clone(),
                stage.commit.prepared.reference().clone(),
            )
            .map_err(|error| DbError::Message(error.to_string()))?;
            let parsed_head =
                StoreSerialHead::parse(&stage.head.to_bytes(), root.store_root_hash, &registration)
                    .map_err(|error| {
                        DbError::Message(format!("verify Serial abandonment head: {error}"))
                    })?;
            if parsed_head != stage.head
                || !matches!(
                    &stage.head.state,
                    StoreSerialHeadState::Commit {
                        author_registration,
                        commit,
                    } if author_registration == &candidate.commit.author_registration
                        && commit == &authority_ref
                )
            {
                return Err(DbError::Message(
                    "Serial abandonment head does not activate its exact authority".to_string(),
                ));
            }
            let (raw_tip_base, raw_tip_prepared): (String, String) = tx
                .query_row(
                    "SELECT base, prepared FROM store_writes
                     WHERE prepared IS NOT NULL AND status = '\"publishing\"'
                     ORDER BY ordinal DESC LIMIT 1",
                    [],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let StoreWriteBase::Serial {
                branch_id: tip_branch_id,
                base: tip_base,
            } = serde_json::from_str(&raw_tip_base).map_err(|error| {
                DbError::Message(format!("Serial abandonment tip branch base: {error}"))
            })?
            else {
                return Err(DbError::Message(
                    "Merge tip reached Serial candidate abandonment".to_string(),
                ));
            };
            let tip_prepared: PreparedStoreWriteState = serde_json::from_str(&raw_tip_prepared)
                .map_err(|error| {
                    DbError::Message(format!("prepared Serial abandonment tip: {error}"))
                })?;
            let PreparedStoreWriteState::Serial {
                tip_head_bytes: Some(tip_head_bytes),
                ..
            } = tip_prepared
            else {
                return Err(DbError::Message(
                    "Serial abandonment branch has no activating tip head".to_string(),
                ));
            };
            if tip_branch_id != branch_id
                || tip_base != base
                || tip_head_bytes != stage.original_head_bytes
            {
                return Err(DbError::Message(
                    "Serial abandonment original head differs from its prepared branch".to_string(),
                ));
            }
            let authority_remote = RemoteObjectRecord::candidate_commit(
                authority_ref,
                stage.commit.value.to_bytes(),
                stage.commit.prepared.stored_bytes().to_vec(),
            )
            .map_err(|error| DbError::Message(format!("Serial abandonment commit: {error}")))?;
            persist_exact_remote_object_on(&tx, &authority_remote, "Serial abandonment commit")?;
            let durable = DurableSerialCandidateAbandonment {
                branch_id,
                base,
                base_head,
                candidate: candidate.reference,
                commit: DurablePreparedProtocolObject {
                    semantic_bytes: stage.commit.value.to_bytes(),
                    prepared: stage.commit.prepared,
                },
                head_bytes: stage.head.to_bytes(),
                original_head_bytes: stage.original_head_bytes,
            };
            let durable = serde_json::to_string(&durable).map_err(|error| {
                DbError::Message(format!("serialize Serial candidate abandonment: {error}"))
            })?;
            tx.execute(
                "INSERT INTO protocol_state (key, value) VALUES (?1, ?2)",
                (SERIAL_CANDIDATE_ABANDONMENT_STATE_KEY, durable),
            )
            .map_err(DbError::from)?;
            if candidate_commit.prepared.reference() != &stage.candidate.object {
                return Err(DbError::Message(
                    "Serial abandonment candidate storage identity changed".to_string(),
                ));
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn prepare_serial_store_branch_commit(
        &self,
        stage: SerialStoreWritePreparation,
    ) -> Result<(), DbError> {
        if self.write_policy() != WritePolicy::Serial {
            return Err(DbError::Message(
                "Serial branch preparation requires the Serial write policy".to_string(),
            ));
        }
        if stage.writes.is_empty() {
            return Err(DbError::Message(
                "prepared Serial branch is empty".to_string(),
            ));
        }
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let local_device_id: String = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [LOCAL_DEVICE_ID_STATE_KEY],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let root = required_store_root_authority_on(&tx)?;
            let expected_base = StoreWriteBase::Serial {
                branch_id: stage.branch_id.clone(),
                base: stage.base.clone(),
            };
            if stage.base_head_bytes.is_some() != stage.base_head_version.is_some() {
                return Err(DbError::Message(
                    "Serial base head bytes and opaque version receipt must be present together"
                        .to_string(),
                ));
            }
            match stage.base_head_bytes.as_deref() {
                Some(bytes) => {
                    let unverified: StoreSerialHead = serde_json::from_slice(bytes)
                        .map_err(|error| DbError::Message(format!("Serial base head: {error}")))?;
                    let executor_ref = match &unverified.state {
                        StoreSerialHeadState::Genesis {
                            founder_registration,
                            ..
                        } => founder_registration,
                        StoreSerialHeadState::Commit {
                            author_registration,
                            ..
                        } => author_registration,
                    };
                    let executor = load_activated_registration_on(&tx, &root, executor_ref)?;
                    let verified = StoreSerialHead::parse(bytes, root.store_root_hash, &executor)
                        .map_err(|error| {
                        DbError::Message(format!("verify Serial base head: {error}"))
                    })?;
                    let base_ref = match verified.state {
                        StoreSerialHeadState::Genesis {
                            root: head_root,
                            founder_registration,
                        } => {
                            if head_root != root || founder_registration != executor_ref.clone() {
                                return Err(DbError::Message(
                                    "Serial genesis head differs from exact Store authority"
                                        .to_string(),
                                ));
                            }
                            None
                        }
                        StoreSerialHeadState::Commit { commit, .. } => Some(commit),
                    };
                    if base_ref != stage.base {
                        return Err(DbError::Message(
                            "Serial branch base differs from the exact observed head".to_string(),
                        ));
                    }
                }
                None if stage.base.is_some() => {
                    return Err(DbError::Message(
                        "Serial branch has a base commit without observed head evidence"
                            .to_string(),
                    ));
                }
                None => {}
            }
            let head_bytes = stage.head.to_bytes();
            let mut predecessor = stage.base.clone();
            let mut tip_ref = None;
            let mut tip_registration = None;
            for (index, write) in stage.writes.iter().enumerate() {
                if write.commit.value.write_id != write.write_id
                    || write.commit.value.author_registration.device_id.to_string()
                        != local_device_id
                {
                    return Err(DbError::Message(format!(
                        "prepared Serial write {} identity differs from its commit",
                        write.write_id
                    )));
                }
                let expected_seq = predecessor
                    .as_ref()
                    .map_or(1, |reference| reference.coord.sequence().saturating_add(1));
                let coord = StoreCommitCoord::Serial {
                    sequence: expected_seq,
                };
                let registration = load_activated_registration_on(
                    &tx,
                    &root,
                    &write.commit.value.author_registration,
                )?;
                write
                    .commit
                    .value
                    .verify_at(root.store_root_hash, &coord, &registration)
                    .map_err(|error| {
                        DbError::Message(format!("verify prepared Serial commit: {error}"))
                    })?;
                let order_matches = match (&predecessor, &write.commit.value.order) {
                    (
                        Some(expected),
                        crate::sync::store_commit::StoreCommitOrder::Serial {
                            predecessor: StoreSerialPredecessor::Commit(actual),
                            ..
                        },
                    ) => actual == expected,
                    (
                        None,
                        crate::sync::store_commit::StoreCommitOrder::Serial {
                            predecessor:
                                StoreSerialPredecessor::Genesis {
                                    root: commit_root,
                                    founder_registration,
                                },
                            ..
                        },
                    ) => {
                        commit_root == &root
                            && founder_registration == &write.commit.value.author_registration
                    }
                    _ => false,
                };
                if !order_matches {
                    return Err(DbError::Message(format!(
                        "prepared Serial commit {} has the wrong exact predecessor",
                        write.write_id
                    )));
                }
                let commit_ref = StoreBatchCommitRef::from_commit(
                    &write.commit.value,
                    coord,
                    write.commit.prepared.reference().clone(),
                )
                .map_err(|error| DbError::Message(error.to_string()))?;
                let (stored_changeset, stored_base, status, prepared): (
                    Vec<u8>,
                    String,
                    String,
                    String,
                ) = tx
                    .query_row(
                        "SELECT changeset, base, status, prepared FROM store_writes
                         WHERE write_id = ?1",
                        [write.write_id.as_str()],
                        |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
                    )
                    .map_err(DbError::from)?;
                let stored_base: StoreWriteBase = serde_json::from_str(&stored_base)
                    .map_err(|error| DbError::Message(format!("stored Serial base: {error}")))?;
                let stored_prepared: PreparedStoreWriteState = serde_json::from_str(&prepared)
                    .map_err(|error| {
                        DbError::Message(format!("stored Serial reservation: {error}"))
                    })?;
                if stored_base != expected_base
                    || status != "\"publishing\""
                    || !matches!(stored_prepared, PreparedStoreWriteState::SerialPreparing)
                {
                    return Err(DbError::Message(format!(
                        "Serial write {} no longer owns its exact branch reservation",
                        write.write_id
                    )));
                }
                let partitions = Self::prepared_store_write_partitions_on(
                    &tx,
                    write.write_id.as_str(),
                    &stored_changeset,
                    WritePolicy::Serial,
                )?;
                Self::persist_closed_write_objects_on(
                    &tx,
                    &write.write_id,
                    root.store_root_hash,
                    &commit_ref,
                    &write.commit.value,
                    write.commit.prepared.stored_bytes(),
                    &partitions,
                    &write.remote_objects,
                    &write.audiences,
                )?;
                let tip_head_bytes = (index + 1 == stage.writes.len()).then(|| head_bytes.clone());
                let durable = PreparedStoreWriteState::Serial {
                    base_head_bytes: stage.base_head_bytes.clone(),
                    base_head_version: stage.base_head_version.clone(),
                    commit: DurablePreparedProtocolObject {
                        semantic_bytes: write.commit.value.to_bytes(),
                        prepared: write.commit.prepared.clone(),
                    },
                    tip_head_bytes,
                    local_cleanup: write.local_cleanup.clone(),
                    completion: write.completion.clone(),
                };
                let durable = serde_json::to_string(&durable).map_err(|error| {
                    DbError::Message(format!("serialize prepared Serial write: {error}"))
                })?;
                let updated = tx
                    .execute(
                        "UPDATE store_writes SET prepared = ?2
                         WHERE write_id = ?1 AND status = '\"publishing\"'",
                        rusqlite::params![write.write_id.as_str(), durable],
                    )
                    .map_err(DbError::from)?;
                if updated != 1 {
                    return Err(DbError::Message(format!(
                        "Serial write {} lost exact preparation ownership",
                        write.write_id
                    )));
                }
                predecessor = Some(commit_ref.clone());
                tip_ref = Some(commit_ref);
                tip_registration = Some(registration);
            }
            let tip_ref = tip_ref.expect("nonempty checked above");
            let tip_registration = tip_registration.expect("nonempty checked above");
            let parsed_head =
                StoreSerialHead::parse(&head_bytes, root.store_root_hash, &tip_registration)
                    .map_err(|error| {
                        DbError::Message(format!("verify prepared Serial head: {error}"))
                    })?;
            let tip_author_ref = &stage
                .writes
                .last()
                .expect("nonempty checked above")
                .commit
                .value
                .author_registration;
            if parsed_head != stage.head
                || !matches!(
                    &stage.head.state,
                    StoreSerialHeadState::Commit {
                        author_registration,
                        commit,
                    } if author_registration == tip_author_ref
                        && commit == &tip_ref
                )
            {
                return Err(DbError::Message(
                    "prepared Serial head does not activate the exact branch tip".to_string(),
                ));
            }
            let reserved_count: i64 = tx
                .query_row(
                    "SELECT COUNT(*) FROM store_writes
                     WHERE status = '\"publishing\"' AND json_type(base, '$.serial') IS NOT NULL",
                    [],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            if reserved_count
                != i64::try_from(stage.writes.len()).map_err(|_| {
                    DbError::Message("Serial branch length exceeds SQLite integer".into())
                })?
            {
                return Err(DbError::Message(format!(
                    "prepared Serial branch contains {} writes but {reserved_count} are reserved",
                    stage.writes.len()
                )));
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    fn write_ids_matching_serial_base<I>(
        rows: I,
        expected_base: &StoreWriteBase,
    ) -> Result<Vec<WriteId>, DbError>
    where
        I: IntoIterator<Item = rusqlite::Result<(String, String)>>,
    {
        let mut write_ids = Vec::new();
        for row in rows {
            let (write_id, raw_base) = row.map_err(DbError::from)?;
            let stored_base: StoreWriteBase = serde_json::from_str(&raw_base)
                .map_err(|error| DbError::Message(format!("stored Serial base: {error}")))?;
            if &stored_base == expected_base {
                write_ids.push(WriteId::from_generated(write_id));
            }
        }
        Ok(write_ids)
    }

    pub(crate) async fn release_serial_store_branch_reservation(
        &self,
        branch_id: PendingBranchId,
        base: Option<StoreBatchCommitRef>,
        status: WriteStatus,
    ) -> Result<(), DbError> {
        if !matches!(status, WriteStatus::Pending | WriteStatus::Blocked(_)) {
            return Err(DbError::Message(
                "Serial preparation can only return a reservation to pending or blocked"
                    .to_string(),
            ));
        }
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let expected_base = StoreWriteBase::Serial { branch_id, base };
            let preparing = serde_json::to_string(&PreparedStoreWriteState::SerialPreparing)
                .map_err(|error| {
                    DbError::Message(format!("serialize Serial reservation: {error}"))
                })?;
            let status_json = serde_json::to_string(&status)
                .map_err(|error| DbError::Message(format!("serialize write status: {error}")))?;
            let mut statement = tx
                .prepare(
                    "SELECT write_id, base FROM store_writes
                     WHERE status = '\"publishing\"' AND prepared = ?1
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([&preparing], |row| {
                    Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?))
                })
                .map_err(DbError::from)?;
            let write_ids = Self::write_ids_matching_serial_base(rows, &expected_base)?;
            drop(statement);
            if write_ids.is_empty() {
                return Err(DbError::Message(
                    "reserved Serial branch disappeared during preparation".to_string(),
                ));
            }
            for write_id in &write_ids {
                let updated = tx
                    .execute(
                        "UPDATE store_writes SET status = ?2, prepared = NULL
                         WHERE write_id = ?1 AND status = '\"publishing\"' AND prepared = ?3",
                        rusqlite::params![write_id.as_str(), &status_json, &preparing],
                    )
                    .map_err(DbError::from)?;
                if updated != 1 {
                    return Err(DbError::Message(format!(
                        "reserved Serial write {write_id} disappeared during release"
                    )));
                }
            }
            tx.commit().map_err(DbError::from)?;
            for write_id in write_ids {
                Self::notify_write_status_in(&statuses, &write_id, status.clone());
            }
            Ok(())
        })
        .await
    }

    pub(crate) async fn oldest_prepared_store_write(
        &self,
    ) -> Result<Option<PreparedStoreWriteCommit>, DbError> {
        let loaded = self
            .call(|conn| {
                let row = conn
                    .query_row(
                        "SELECT write_id, changeset, base, prepared FROM store_writes
                 WHERE prepared IS NOT NULL
                   AND status = '\"publishing\"'
                 ORDER BY ordinal LIMIT 1",
                        [],
                        |row| {
                            Ok((
                                row.get::<_, String>(0)?,
                                row.get::<_, Vec<u8>>(1)?,
                                row.get::<_, String>(2)?,
                                row.get::<_, String>(3)?,
                            ))
                        },
                    )
                    .optional()
                    .map_err(DbError::from)?;
                row.map(|(write_id, stored_changeset, base, prepared)| {
                    let prepared: PreparedStoreWriteState = serde_json::from_str(&prepared)
                        .map_err(|error| {
                            DbError::Message(format!("prepared Store write: {error}"))
                        })?;
                    let (commit, head, graph_commit) = match &prepared {
                        PreparedStoreWriteState::MergeConcurrent { commit, head, .. } => {
                            (commit, head, None)
                        }
                        PreparedStoreWriteState::MergeAbandonment {
                            candidate_commit,
                            authority_commit,
                            authority_head,
                            ..
                        } => (authority_commit, authority_head, Some(candidate_commit)),
                        PreparedStoreWriteState::SerialPreparing
                        | PreparedStoreWriteState::Serial { .. } => {
                            return Err(DbError::Message(
                                "serial branch reached MergeConcurrent publication".to_string(),
                            ));
                        }
                    };
                    let write_id = WriteId::from_generated(write_id);
                    let unverified_commit: StoreBatchCommit =
                        serde_json::from_slice(&commit.semantic_bytes).map_err(|error| {
                            DbError::Message(format!("prepared Store commit: {error}"))
                        })?;
                    if unverified_commit.write_id != write_id {
                        return Err(DbError::Message(
                            "prepared write id differs from signed commit".to_string(),
                        ));
                    }
                    let root = required_store_root_authority_on(conn)?;
                    let registration_ref = &unverified_commit.author_registration;
                    let (registration_bytes, stored_registration_ref): (Vec<u8>, String) = conn
                        .query_row(
                            "SELECT registration_bytes, registration_object \
                         FROM store_device_registration_activations \
                         WHERE device_id = ?1 AND registration_hash = ?2",
                            (
                                registration_ref.device_id.to_string(),
                                registration_ref.registration_hash.to_string(),
                            ),
                            |row| Ok((row.get(0)?, row.get(1)?)),
                        )
                        .map_err(DbError::from)?;
                    let stored_registration_ref: StoreDeviceRegistrationRef =
                        serde_json::from_str(&stored_registration_ref).map_err(|error| {
                            DbError::Message(format!("prepared write registration ref: {error}"))
                        })?;
                    if stored_registration_ref != *registration_ref {
                        return Err(DbError::Message(
                            "prepared commit registration differs from its activation".to_string(),
                        ));
                    }
                    let registration = StoreDeviceRegistration::parse_at(
                        &registration_bytes,
                        &root,
                        registration_ref.device_id,
                    )
                    .map_err(|error| {
                        DbError::Message(format!("prepared write registration: {error}"))
                    })?;
                    let stream_id = AuthorStreamId::store_announcements(&root, registration_ref);
                    let coord = StoreCommitCoord::MergeConcurrent {
                        stream_id,
                        sequence: unverified_commit.seq(),
                    };
                    let commit_value = StoreBatchCommit::parse_at(
                        &commit.semantic_bytes,
                        root.store_root_hash,
                        &coord,
                        &registration,
                    )
                    .map_err(|error| {
                        DbError::Message(format!("verify prepared Store commit: {error}"))
                    })?;
                    let commit_ref = StoreBatchCommitRef::from_commit(
                        &commit_value,
                        coord,
                        commit.prepared.reference().clone(),
                    )
                    .map_err(|error| DbError::Message(error.to_string()))?;
                    let head_value = StoreDeviceHead::parse_at(
                        &head.semantic_bytes,
                        root.store_root_hash,
                        &registration,
                        &commit_ref,
                    )
                    .map_err(|error| {
                        DbError::Message(format!("verify prepared Store head: {error}"))
                    })?;
                    let base: StoreWriteBase = serde_json::from_str(&base).map_err(|error| {
                        DbError::Message(format!("prepared write base: {error}"))
                    })?;
                    let StoreWriteBase::MergeConcurrent { dependencies } = base else {
                        return Err(DbError::Message(
                            "serial base reached MergeConcurrent publication".to_string(),
                        ));
                    };
                    let dependencies =
                        CommitFrontier::from_refs(WritePolicy::MergeConcurrent, dependencies)
                            .map_err(|error| {
                                DbError::Message(format!("prepared dependency frontier: {error}"))
                            })?;
                    if dependencies
                        .merge_commits()
                        .map_err(|error| DbError::Message(error.to_string()))?
                        != commit_value.merge_dependencies().map_err(|error| {
                            DbError::Message(format!("prepared Store commit policy: {error}"))
                        })?
                    {
                        return Err(DbError::Message(
                            "prepared commit differs from its write dependency frontier"
                                .to_string(),
                        ));
                    }
                    let partitions = Self::prepared_store_write_partitions_on(
                        conn,
                        write_id.as_str(),
                        &stored_changeset,
                        WritePolicy::MergeConcurrent,
                    )?;
                    let audiences = load_prepared_audience_objects_on(conn, &write_id)?;
                    let graph_commit = match graph_commit {
                        Some(graph_commit) => {
                            let candidate = parse_prepared_merge_candidate_parts_on(
                                conn,
                                graph_commit,
                                match &prepared {
                                    PreparedStoreWriteState::MergeAbandonment {
                                        candidate_head,
                                        ..
                                    } => candidate_head,
                                    _ => unreachable!("matched Merge abandonment"),
                                },
                            )?;
                            candidate.commit
                        }
                        None => commit_value.clone(),
                    };
                    let expected_package_count =
                        usize::from(graph_commit.store_package().is_some())
                            .checked_add(graph_commit.circle_packages().len())
                            .ok_or_else(|| {
                                DbError::Message("package count overflow".to_string())
                            })?;
                    if audiences.packages.len() != expected_package_count
                        || audiences.packages.len()
                            != usize::from(partitions.store.is_some()) + partitions.circles.len()
                    {
                        return Err(DbError::Message(
                            "prepared package indexes do not exactly cover commit audiences"
                                .to_string(),
                        ));
                    }
                    for package in &audiences.packages {
                        let value = package.package();
                        if value.write_id() != &write_id
                            || value.commit_coord() != &commit_ref.coord
                            || value.candidate_family() != commit_value.candidate_family()
                        {
                            return Err(DbError::Message(
                                "indexed audience package differs from its exact commit"
                                    .to_string(),
                            ));
                        }
                        let expected_object = match value.audience() {
                            crate::sync::audience_package::PackageAudience::Store => {
                                graph_commit
                                    .verify_store_package(package.semantic_bytes())
                                    .map_err(|error| DbError::Message(error.to_string()))?;
                                &graph_commit
                                    .store_package()
                                    .as_ref()
                                    .expect("verified present")
                                    .object
                            }
                            crate::sync::audience_package::PackageAudience::Circle {
                                circle_id,
                                ..
                            } => {
                                graph_commit
                                    .verify_circle_package(*circle_id, package.semantic_bytes())
                                    .map_err(|error| DbError::Message(error.to_string()))?;
                                &graph_commit
                                    .circle_packages()
                                    .iter()
                                    .find(|entry| entry.circle_id == *circle_id)
                                    .expect("verified present")
                                    .package
                                    .object
                            }
                        };
                        if package.object() != expected_object {
                            return Err(DbError::Message(
                                "indexed audience package exact object differs from its commit"
                                    .to_string(),
                            ));
                        }
                    }
                    for package in &audiences.packages {
                        let audience = package.package().audience().remote_audience();
                        for binding in package.package().blob_bindings() {
                            if !audiences.blobs.iter().any(|blob| {
                                blob.audience() == &audience && blob.blob() == binding.blob()
                            }) {
                                return Err(DbError::Message(
                                    "prepared package blob binding has no exact blob index"
                                        .to_string(),
                                ));
                            }
                        }
                    }
                    for blob in &audiences.blobs {
                        if !audiences.packages.iter().any(|package| {
                            package.package().audience().remote_audience() == *blob.audience()
                                && package
                                    .package()
                                    .blob_bindings()
                                    .iter()
                                    .any(|binding| binding.blob() == blob.blob())
                        }) {
                            return Err(DbError::Message(
                                "prepared blob index has no exact package binding".to_string(),
                            ));
                        }
                    }
                    Ok(PreparedStoreWriteCommit {
                        audiences,
                        commit: ExactProtocolObject {
                            value: commit_value,
                            bytes: commit.semantic_bytes.clone(),
                            object: commit.prepared.reference().clone(),
                            prepared: commit.prepared.clone(),
                        },
                        head: ExactProtocolObject {
                            value: head_value,
                            bytes: head.semantic_bytes.clone(),
                            object: head.prepared.reference().clone(),
                            prepared: head.prepared.clone(),
                        },
                    })
                })
                .transpose()
            })
            .await?;
        if let Some(batch) = &loaded {
            for blob in &batch.audiences.blobs {
                if let Some(spool_path) = blob.spool_path() {
                    crate::local_blob::verify_exact_file(blob.blob().object(), spool_path)
                        .await
                        .map_err(|error| {
                            DbError::Message(format!("prepared blob spool: {error}"))
                        })?;
                }
            }
        }
        Ok(loaded)
    }

    pub(crate) async fn prepared_serial_store_branch(
        &self,
    ) -> Result<Option<PreparedSerialStoreBranch>, DbError> {
        let loaded = self
            .call(|conn| {
                let root = required_store_root_authority_on(conn)?;
                let mut statement = conn
                    .prepare(
                        "SELECT write_id, changeset, base, prepared FROM store_writes
                     WHERE prepared IS NOT NULL AND status = '\"publishing\"'
                     ORDER BY ordinal",
                    )
                    .map_err(DbError::from)?;
                let rows = statement
                    .query_map([], |row| {
                        Ok((
                            row.get::<_, String>(0)?,
                            row.get::<_, Vec<u8>>(1)?,
                            row.get::<_, String>(2)?,
                            row.get::<_, String>(3)?,
                        ))
                    })
                    .map_err(DbError::from)?
                    .collect::<Result<Vec<_>, _>>()
                    .map_err(DbError::from)?;
                drop(statement);
                let mut branch_id = None;
                let mut base = None;
                let mut base_head_bytes: Option<Option<Vec<u8>>> = None;
                let mut base_head_version: Option<Option<VersionToken>> = None;
                let mut writes = Vec::new();
                let mut head = None;
                let mut predecessor: Option<StoreBatchCommitRef> = None;
                for row in rows {
                    let (write_id, stored_changeset, raw_base, prepared) = row;
                    let prepared: PreparedStoreWriteState = serde_json::from_str(&prepared)
                        .map_err(|error| {
                            DbError::Message(format!("prepared Serial write: {error}"))
                        })?;
                    if matches!(prepared, PreparedStoreWriteState::SerialPreparing) {
                        if writes.is_empty() {
                            return Ok(None);
                        }
                        return Err(DbError::Message(
                            "Serial branch mixes reserved and exact prepared writes".to_string(),
                        ));
                    }
                    let PreparedStoreWriteState::Serial {
                        base_head_bytes: row_base_head_bytes,
                        base_head_version: row_base_head_version,
                        commit,
                        tip_head_bytes,
                        ..
                    } = prepared
                    else {
                        return Err(DbError::Message(
                            "MergeConcurrent write reached Serial publication".to_string(),
                        ));
                    };
                    let StoreWriteBase::Serial {
                        branch_id: row_branch_id,
                        base: row_base,
                    } = serde_json::from_str(&raw_base).map_err(|error| {
                        DbError::Message(format!("prepared Serial base: {error}"))
                    })?
                    else {
                        return Err(DbError::Message(
                            "MergeConcurrent base reached Serial publication".to_string(),
                        ));
                    };
                    if branch_id
                        .as_ref()
                        .is_some_and(|value| value != &row_branch_id)
                        || base.as_ref().is_some_and(|value| value != &row_base)
                        || base_head_bytes
                            .as_ref()
                            .is_some_and(|value| value != &row_base_head_bytes)
                        || base_head_version
                            .as_ref()
                            .is_some_and(|value| value != &row_base_head_version)
                    {
                        return Err(DbError::Message(
                            "prepared Serial writes do not share one branch base".to_string(),
                        ));
                    }
                    branch_id.get_or_insert(row_branch_id);
                    base.get_or_insert(row_base);
                    base_head_bytes.get_or_insert(row_base_head_bytes);
                    base_head_version.get_or_insert(row_base_head_version);
                    let unverified: StoreBatchCommit =
                        serde_json::from_slice(&commit.semantic_bytes).map_err(|error| {
                            DbError::Message(format!("prepared Serial commit: {error}"))
                        })?;
                    if unverified.write_id.as_str() != write_id {
                        return Err(DbError::Message(
                            "prepared Serial write id differs from signed commit".to_string(),
                        ));
                    }
                    if writes.is_empty() {
                        predecessor = base.as_ref().expect("first row stored base").clone();
                    }
                    let expected_sequence = predecessor
                        .as_ref()
                        .map_or(1, |reference| reference.coord.sequence().saturating_add(1));
                    let coord = StoreCommitCoord::Serial {
                        sequence: expected_sequence,
                    };
                    let registration = load_activated_registration_on(
                        conn,
                        &root,
                        &unverified.author_registration,
                    )?;
                    let commit_value = StoreBatchCommit::parse_at(
                        &commit.semantic_bytes,
                        root.store_root_hash,
                        &coord,
                        &registration,
                    )
                    .map_err(|error| {
                        DbError::Message(format!("verify prepared Serial commit: {error}"))
                    })?;
                    let order_matches = match (&predecessor, &commit_value.order) {
                        (
                            Some(expected),
                            crate::sync::store_commit::StoreCommitOrder::Serial {
                                predecessor: StoreSerialPredecessor::Commit(actual),
                                ..
                            },
                        ) => actual == expected,
                        (
                            None,
                            crate::sync::store_commit::StoreCommitOrder::Serial {
                                predecessor:
                                    StoreSerialPredecessor::Genesis {
                                        root: commit_root,
                                        founder_registration,
                                    },
                                ..
                            },
                        ) => {
                            commit_root == &root
                                && founder_registration == &commit_value.author_registration
                        }
                        _ => false,
                    };
                    if !order_matches {
                        return Err(DbError::Message(
                            "prepared Serial commit chain has a different exact predecessor"
                                .to_string(),
                        ));
                    }
                    let commit_ref = StoreBatchCommitRef::from_commit(
                        &commit_value,
                        coord,
                        commit.prepared.reference().clone(),
                    )
                    .map_err(|error| DbError::Message(error.to_string()))?;
                    let write_id = WriteId::from_generated(write_id);
                    let partitions = Self::prepared_store_write_partitions_on(
                        conn,
                        write_id.as_str(),
                        &stored_changeset,
                        WritePolicy::Serial,
                    )?;
                    let audiences = load_prepared_audience_objects_on(conn, &write_id)?;
                    Self::validate_loaded_write_objects(
                        &write_id,
                        &commit_ref,
                        &commit_value,
                        &partitions,
                        &audiences,
                    )?;
                    if let Some(head_bytes) = tip_head_bytes {
                        if head.is_some() {
                            return Err(DbError::Message(
                                "prepared Serial branch has more than one tip head".to_string(),
                            ));
                        }
                        let value = StoreSerialHead::parse(
                            &head_bytes,
                            root.store_root_hash,
                            &registration,
                        )
                        .map_err(|error| {
                            DbError::Message(format!("verify prepared Serial head: {error}"))
                        })?;
                        head = Some(CanonicalProtocolObject {
                            value,
                            bytes: head_bytes,
                        });
                    }
                    writes.push(PreparedSerialStoreWriteCommit {
                        audiences,
                        commit: ExactProtocolObject {
                            value: commit_value,
                            bytes: commit.semantic_bytes,
                            object: commit.prepared.reference().clone(),
                            prepared: commit.prepared,
                        },
                    });
                    predecessor = Some(commit_ref);
                }
                if writes.is_empty() {
                    return Ok(None);
                }
                let head = head.ok_or_else(|| {
                    DbError::Message(
                        "prepared Serial branch has no activating tip head".to_string(),
                    )
                })?;
                let tip_ref = predecessor.expect("nonempty branch has exact tip");
                let tip_author = &writes
                    .last()
                    .expect("nonempty branch")
                    .commit
                    .value
                    .author_registration;
                if !matches!(
                    &head.value.state,
                    StoreSerialHeadState::Commit {
                        author_registration,
                        commit,
                    } if author_registration == tip_author && commit == &tip_ref
                ) {
                    return Err(DbError::Message(
                        "prepared Serial head does not activate the exact final commit".to_string(),
                    ));
                }
                let base_value = base.expect("nonempty branch");
                let base_bytes = base_head_bytes.expect("nonempty branch");
                let base_version = base_head_version.expect("nonempty branch");
                if base_bytes.is_some() != base_version.is_some() {
                    return Err(DbError::Message(
                        "Serial base head bytes and opaque version receipt differ in presence"
                            .to_string(),
                    ));
                }
                match base_bytes.as_deref() {
                    Some(bytes) => {
                        let unverified: StoreSerialHead =
                            serde_json::from_slice(bytes).map_err(|error| {
                                DbError::Message(format!("stored Serial base head: {error}"))
                            })?;
                        let executor_ref = match &unverified.state {
                            StoreSerialHeadState::Genesis {
                                founder_registration,
                                ..
                            } => founder_registration,
                            StoreSerialHeadState::Commit {
                                author_registration,
                                ..
                            } => author_registration,
                        };
                        let executor = load_activated_registration_on(conn, &root, executor_ref)?;
                        let verified =
                            StoreSerialHead::parse(bytes, root.store_root_hash, &executor)
                                .map_err(|error| {
                                    DbError::Message(format!(
                                        "verify stored Serial base head: {error}"
                                    ))
                                })?;
                        let observed = match verified.state {
                            StoreSerialHeadState::Genesis {
                                root: observed_root,
                                ..
                            } => {
                                if observed_root != root {
                                    return Err(DbError::Message(
                                        "stored Serial genesis head has a different exact root"
                                            .to_string(),
                                    ));
                                }
                                None
                            }
                            StoreSerialHeadState::Commit { commit, .. } => Some(commit),
                        };
                        if observed != base_value {
                            return Err(DbError::Message(
                                "stored Serial base evidence differs from branch base".to_string(),
                            ));
                        }
                    }
                    None if base_value.is_some() => {
                        return Err(DbError::Message(
                            "stored Serial base commit has no head evidence".to_string(),
                        ));
                    }
                    None => {}
                }
                Ok(Some(PreparedSerialStoreBranch {
                    branch_id: branch_id.expect("nonempty branch"),
                    base: base_value,
                    base_head_bytes: base_bytes,
                    base_head_version: base_version,
                    writes,
                    head,
                }))
            })
            .await?;
        if let Some(branch) = &loaded {
            for write in &branch.writes {
                for blob in &write.audiences.blobs {
                    if let Some(spool_path) = blob.spool_path() {
                        crate::local_blob::verify_exact_file(blob.blob().object(), spool_path)
                            .await
                            .map_err(|error| {
                                DbError::Message(format!("prepared Serial blob spool: {error}"))
                            })?;
                    }
                }
            }
        }
        Ok(loaded)
    }

    pub(crate) async fn prepared_serial_candidate_abandonment(
        &self,
    ) -> Result<Option<PreparedSerialCandidateAbandonment>, DbError> {
        self.call(|conn| {
            let raw: Option<String> = conn
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [SERIAL_CANDIDATE_ABANDONMENT_STATE_KEY],
                    |row| row.get(0),
                )
                .optional()
                .map_err(DbError::from)?;
            let Some(raw) = raw else {
                return Ok(None);
            };
            let durable: DurableSerialCandidateAbandonment =
                serde_json::from_str(&raw).map_err(|error| {
                    DbError::Message(format!("prepared Serial candidate abandonment: {error}"))
                })?;
            let expected_base = serde_json::to_string(&StoreWriteBase::Serial {
                branch_id: durable.branch_id.clone(),
                base: durable.base.clone(),
            })
            .map_err(|error| {
                DbError::Message(format!("Serial abandonment branch base: {error}"))
            })?;
            let raw_prepared: String = conn
                .query_row(
                    "SELECT prepared FROM store_writes
                     WHERE base = ?1 AND prepared IS NOT NULL
                     ORDER BY ordinal LIMIT 1",
                    [expected_base.as_str()],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let parsed = parse_prepared_serial_candidate(&raw_prepared)?.ok_or_else(|| {
                DbError::Message("Serial abandonment target is not an exact candidate".to_string())
            })?;
            if parsed.reference != durable.candidate {
                return Err(DbError::Message(
                    "Serial abandonment target differs from its durable candidate".to_string(),
                ));
            }
            let prepared: PreparedStoreWriteState =
                serde_json::from_str(&raw_prepared).map_err(|error| {
                    DbError::Message(format!("Serial abandonment candidate state: {error}"))
                })?;
            let PreparedStoreWriteState::Serial {
                base_head_bytes,
                base_head_version,
                commit,
                ..
            } = prepared
            else {
                return Err(DbError::Message(
                    "Serial abandonment target is not an exact candidate".to_string(),
                ));
            };
            if base_head_bytes.as_deref() != Some(durable.base_head.bytes.as_slice())
                || base_head_version.as_ref() != Some(&durable.base_head.version)
            {
                return Err(DbError::Message(
                    "Serial abandonment differs from its durable branch base".to_string(),
                ));
            }
            let candidate = ExactProtocolObject {
                value: parsed.commit,
                bytes: parsed.canonical_signed_bytes,
                object: parsed.reference.object,
                prepared: commit.prepared,
            };
            let raw_tip_prepared: String = conn
                .query_row(
                    "SELECT prepared FROM store_writes
                     WHERE base = ?1 AND prepared IS NOT NULL
                     ORDER BY ordinal DESC LIMIT 1",
                    [expected_base],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let tip_prepared: PreparedStoreWriteState = serde_json::from_str(&raw_tip_prepared)
                .map_err(|error| {
                    DbError::Message(format!("Serial abandonment tip state: {error}"))
                })?;
            if !matches!(
                tip_prepared,
                PreparedStoreWriteState::Serial {
                    tip_head_bytes: Some(ref tip_head_bytes),
                    ..
                } if tip_head_bytes == &durable.original_head_bytes
            ) {
                return Err(DbError::Message(
                    "Serial abandonment original head differs from its durable branch tip"
                        .to_string(),
                ));
            }
            let root = required_store_root_authority_on(conn)?;
            let unverified: StoreBatchCommit =
                serde_json::from_slice(&durable.commit.semantic_bytes).map_err(|error| {
                    DbError::Message(format!("Serial abandonment commit: {error}"))
                })?;
            let registration =
                load_activated_registration_on(conn, &root, &unverified.author_registration)?;
            let value = StoreBatchCommit::parse_at(
                &durable.commit.semantic_bytes,
                root.store_root_hash,
                &durable.candidate.coord,
                &registration,
            )
            .map_err(|error| {
                DbError::Message(format!("verify Serial abandonment commit: {error}"))
            })?;
            let reference = StoreBatchCommitRef::from_commit(
                &value,
                durable.candidate.coord.clone(),
                durable.commit.prepared.reference().clone(),
            )
            .map_err(|error| DbError::Message(error.to_string()))?;
            if value.abandoned_candidates()
                != [crate::sync::store_commit::CandidateCleanupManifest {
                    candidate: crate::sync::store_commit::StoreBatchCommitDeletionTarget {
                        coord: durable.candidate.coord.clone(),
                        object: durable.candidate.object.clone(),
                        canonical_signed_bytes: candidate.bytes.clone(),
                    },
                }]
            {
                return Err(DbError::Message(
                    "durable Serial abandonment names another candidate".to_string(),
                ));
            }
            let head =
                StoreSerialHead::parse(&durable.head_bytes, root.store_root_hash, &registration)
                    .map_err(|error| {
                        DbError::Message(format!("verify Serial abandonment head: {error}"))
                    })?;
            if !matches!(
                &head.state,
                StoreSerialHeadState::Commit { commit, .. } if commit == &reference
            ) {
                return Err(DbError::Message(
                    "durable Serial abandonment head names another commit".to_string(),
                ));
            }
            let unverified_original: StoreSerialHead =
                serde_json::from_slice(&durable.original_head_bytes).map_err(|error| {
                    DbError::Message(format!("Serial abandonment original head: {error}"))
                })?;
            let original_author = match &unverified_original.state {
                StoreSerialHeadState::Commit {
                    author_registration,
                    ..
                } => author_registration,
                StoreSerialHeadState::Genesis { .. } => {
                    return Err(DbError::Message(
                        "Serial abandonment original head is not a commit".to_string(),
                    ));
                }
            };
            let original_registration =
                load_activated_registration_on(conn, &root, original_author)?;
            StoreSerialHead::parse(
                &durable.original_head_bytes,
                root.store_root_hash,
                &original_registration,
            )
            .map_err(|error| {
                DbError::Message(format!("verify Serial abandonment original head: {error}"))
            })?;
            Ok(Some(PreparedSerialCandidateAbandonment {
                branch_id: durable.branch_id,
                base: durable.base,
                base_head: durable.base_head,
                authority: ExactProtocolObject {
                    value,
                    bytes: durable.commit.semantic_bytes,
                    object: reference.object,
                    prepared: durable.commit.prepared,
                },
                head: CanonicalProtocolObject {
                    value: head,
                    bytes: durable.head_bytes,
                },
                original_head_bytes: durable.original_head_bytes,
                durable_state: raw,
            }))
        })
        .await
    }

    pub(crate) async fn latest_local_store_position(
        &self,
    ) -> Result<Option<StoreBatchCommitRef>, DbError> {
        let write_policy = self.write_policy();
        self.call(move |conn| {
            let stream_id = match write_policy {
                WritePolicy::MergeConcurrent => {
                    let (root, registration, _) = local_store_authority_on(conn)?;
                    AuthorStreamId::store_announcements(&root, &registration).to_string()
                }
                WritePolicy::Serial => SERIAL_STREAM_ID.to_string(),
            };
            Self::latest_position_for_device_on(conn, &stream_id)
        })
        .await
    }

    pub(crate) async fn complete_prepared_store_write(
        &self,
        accepted: StoreBatchCommitRef,
    ) -> Result<(), DbError> {
        let statuses = self.state.write_statuses.clone();
        let gates = self.state.gates.clone();
        let synced_tables = self.state.synced_tables.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let local_device_id: String = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [LOCAL_DEVICE_ID_STATE_KEY],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let prepared_count: i64 = tx
                .query_row(
                    "SELECT COUNT(*) FROM store_writes WHERE prepared IS NOT NULL",
                    [],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            if prepared_count != 1 {
                return Err(DbError::Message(format!(
                    "Store publication expected one prepared write, found {prepared_count}"
                )));
            }
            let (stored_write_id, raw_prepared): (String, String) = tx
                .query_row(
                    "SELECT write_id, prepared FROM store_writes
                     WHERE prepared IS NOT NULL ORDER BY ordinal LIMIT 1",
                    [],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let prepared: PreparedStoreWriteState = serde_json::from_str(&raw_prepared)
                .map_err(|error| DbError::Message(format!("prepared Store write: {error}")))?;
            if let PreparedStoreWriteState::MergeAbandonment {
                candidate_commit,
                candidate_head,
                authority_commit,
                authority_head,
                ..
            } = &prepared
            {
                let root = required_store_root_authority_on(&tx)?;
                let candidate =
                    parse_prepared_merge_candidate_parts_on(&tx, candidate_commit, candidate_head)?;
                let authority =
                    parse_prepared_merge_candidate_parts_on(&tx, authority_commit, authority_head)?;
                if authority.commit.write_id.as_str() != stored_write_id
                    || accepted != authority.reference
                    || !matches!(
                        &authority.commit.body,
                        crate::sync::store_commit::StoreCommitBody::AbandonCandidates { .. }
                    )
                {
                    return Err(DbError::Message(
                        "accepted Merge abandonment differs from its durable authority".to_string(),
                    ));
                }
                let registration = load_activated_registration_on(
                    &tx,
                    &root,
                    &authority.commit.author_registration,
                )?;
                StoreDeviceHead::parse_at(
                    &authority.head.to_bytes(),
                    root.store_root_hash,
                    &registration,
                    &accepted,
                )
                .map_err(|error| {
                    DbError::Message(format!("verify accepted Merge abandonment head: {error}"))
                })?;
                for object in [
                    authority_commit.prepared.reference(),
                    authority_head.prepared.reference(),
                ] {
                    let object_id = remote_object_id(object);
                    let remote = load_remote_object_on(&tx, object_id)?
                        .into_activated(&accepted)
                        .map_err(|error| {
                            DbError::Message(format!(
                                "activate Merge abandonment object {object_id}: {error}"
                            ))
                        })?;
                    update_remote_object_on(&tx, object_id, &remote)?;
                }
                let winner_head = crate::sync::store_commit::StoreDeviceHeadRef {
                    head_hash: authority.head.head_hash(),
                    object: authority.head_prepared.reference().clone(),
                };
                begin_merge_candidate_nonactivation_on(
                    &tx,
                    &WriteId::from_generated(stored_write_id.clone()),
                    &candidate,
                    winner_head.clone(),
                    true,
                )?;
                Self::record_materialized_commit_on(&tx, &authority.commit, &accepted)?;
                let mut completed_preparation = prepared.clone();
                let PreparedStoreWriteState::MergeAbandonment { outcome, .. } =
                    &mut completed_preparation
                else {
                    unreachable!("matched Merge abandonment")
                };
                *outcome = MergeAbandonmentOutcome::Accepted {
                    authority: accepted.clone(),
                };
                let completed_preparation =
                    serde_json::to_string(&completed_preparation).map_err(|error| {
                        DbError::Message(format!("serialize accepted Merge abandonment: {error}"))
                    })?;
                let updated = tx
                    .execute(
                        "UPDATE store_writes SET prepared = ?2
                         WHERE write_id = ?1 AND prepared = ?3",
                        rusqlite::params![
                            stored_write_id.as_str(),
                            completed_preparation,
                            raw_prepared
                        ],
                    )
                    .map_err(DbError::from)?;
                if updated != 1 {
                    return Err(DbError::Message(
                        "Merge abandonment changed during activation".to_string(),
                    ));
                }
                let blocked = WriteStatus::Blocked(crate::WriteBlock::InvalidProtocolState {
                    reason: format!(
                        "candidate abandonment {} is accepted; exact cleanup is pending",
                        winner_head.head_hash
                    ),
                });
                let write_id = authority.commit.write_id.clone();
                Self::set_write_status_on(&tx, &write_id, &blocked)?;
                tx.commit().map_err(DbError::from)?;
                Self::notify_write_status_in(&statuses, &write_id, blocked);
                return Ok(());
            }
            let PreparedStoreWriteState::MergeConcurrent {
                commit,
                head,
                local_cleanup,
                ..
            } = prepared
            else {
                return Err(DbError::Message(
                    "serial branch reached MergeConcurrent completion".to_string(),
                ));
            };
            let root = required_store_root_authority_on(&tx)?;
            let unverified: StoreBatchCommit = serde_json::from_slice(&commit.semantic_bytes)
                .map_err(|error| DbError::Message(format!("prepared Store commit: {error}")))?;
            let registration =
                load_activated_registration_on(&tx, &root, &unverified.author_registration)?;
            let expected_stream =
                AuthorStreamId::store_announcements(&root, &unverified.author_registration);
            if !matches!(
                accepted.coord,
                StoreCommitCoord::MergeConcurrent { stream_id, .. }
                    if stream_id == expected_stream
            ) || accepted.object != *commit.prepared.reference()
            {
                return Err(DbError::Message(
                    "accepted Merge head differs from the exact prepared commit".to_string(),
                ));
            }
            let commit_value = StoreBatchCommit::parse_at(
                &commit.semantic_bytes,
                root.store_root_hash,
                &accepted.coord,
                &registration,
            )
            .map_err(|error| DbError::Message(format!("outbound commit: {error}")))?;
            accepted
                .verify_commit(&commit_value)
                .map_err(|error| DbError::Message(error.to_string()))?;
            if commit_value.write_id.as_str() != stored_write_id {
                return Err(DbError::Message(
                    "prepared write id differs from signed commit".to_string(),
                ));
            }
            let write_id = commit_value.write_id.clone();
            let head_object_id = remote_object_id(head.prepared.reference());
            Self::activate_prepared_write_on(
                &tx,
                &gates,
                &synced_tables,
                &write_id,
                &commit_value,
                &accepted,
                local_cleanup,
                &[head_object_id],
            )?;
            let cleared = tx
                .execute(
                    "UPDATE store_writes SET prepared = NULL
                     WHERE write_id = ?1 AND prepared IS NOT NULL",
                    [stored_write_id.as_str()],
                )
                .map_err(DbError::from)?;
            if cleared != 1 {
                return Err(DbError::Message(
                    "prepared Store write disappeared".to_string(),
                ));
            }
            let status = WriteStatus::Published(Box::new(PublishedPosition::MergeConcurrent {
                device_id: local_device_id,
                commit: accepted.clone(),
            }));
            Self::set_write_status_on(&tx, &write_id, &status)?;
            tx.commit().map_err(DbError::from)?;
            Self::notify_write_status_in(&statuses, &write_id, status);
            Ok(())
        })
        .await
    }

    pub(crate) async fn mark_serial_branch_conflict(
        &self,
        branch_id: PendingBranchId,
        base: Option<StoreBatchCommitRef>,
        current: StoreSerialPredecessor,
    ) -> Result<(), DbError> {
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let expected_base = StoreWriteBase::Serial {
                branch_id: branch_id.clone(),
                base: base.clone(),
            };
            let conflict = crate::SerializationConflict {
                branch_id: branch_id.clone(),
                base: store_serial_predecessor_on(&tx, base.as_ref())?,
                current,
            };
            let status = WriteStatus::Conflict(Box::new(conflict));
            let status_json = serde_json::to_string(&status)
                .map_err(|error| DbError::Message(format!("serialize Serial conflict: {error}")))?;
            let mut statement = tx
                .prepare(
                    "SELECT write_id, base FROM store_writes
                     WHERE status != '\"local_only\"'
                       AND json_extract(status, '$.published') IS NULL
                       AND json_extract(status, '$.resolved') IS NULL
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| {
                    Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?))
                })
                .map_err(DbError::from)?;
            let write_ids = Self::write_ids_matching_serial_base(rows, &expected_base)?;
            drop(statement);
            if write_ids.is_empty() {
                return Err(DbError::Message(format!(
                    "Serial branch {:?} has no pending writes",
                    branch_id.first_write_id()
                )));
            }
            for write_id in &write_ids {
                let updated = tx
                    .execute(
                        "UPDATE store_writes SET status = ?2 WHERE write_id = ?1",
                        rusqlite::params![write_id.as_str(), &status_json],
                    )
                    .map_err(DbError::from)?;
                if updated != 1 {
                    return Err(DbError::Message(format!(
                        "Serial conflict write {write_id} disappeared"
                    )));
                }
            }
            tx.commit().map_err(DbError::from)?;
            for write_id in write_ids {
                Self::notify_write_status_in(&statuses, &write_id, status.clone());
            }
            Ok(())
        })
        .await
    }

    pub(crate) async fn mark_merge_candidate_conflict(
        &self,
        write_id: WriteId,
        winner_commit: StoreBatchCommitRef,
        winner_head: crate::sync::store_commit::StoreDeviceHeadRef,
    ) -> Result<(), DbError> {
        let statuses = self.state.write_statuses.clone();
        let notified_write_id = write_id.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let (raw_status, raw_prepared): (String, String) = tx
                .query_row(
                    "SELECT status, prepared FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let status: WriteStatus = serde_json::from_str(&raw_status)
                .map_err(|error| DbError::Message(format!("Merge candidate status: {error}")))?;
            if !matches!(status, WriteStatus::Publishing) {
                return Err(DbError::Message(format!(
                    "Merge candidate {write_id} is not publishing"
                )));
            }
            let prepared: PreparedStoreWriteState = serde_json::from_str(&raw_prepared)
                .map_err(|error| DbError::Message(format!("prepared Merge candidate: {error}")))?;
            let prepared_candidate = parse_prepared_merge_candidate_on(&tx, &prepared)?
                .ok_or_else(|| {
                    DbError::Message("Serial branch reached Merge candidate conflict".to_string())
                })?;
            let publication = parse_prepared_merge_publication_on(&tx, &prepared)?
                .expect("parsed Merge publication");
            if winner_head.object.slot() != publication.head_prepared.reference().slot()
                || winner_head.object == *publication.head_prepared.reference()
            {
                return Err(DbError::Message(
                    "Merge winner does not replace the prepared exact head slot".to_string(),
                ));
            }
            if prepared_candidate.commit.write_id != write_id {
                return Err(DbError::Message(
                    "prepared Merge graph differs from its write identity".to_string(),
                ));
            }
            if matches!(&prepared, PreparedStoreWriteState::MergeAbandonment { .. }) {
                begin_merge_candidate_nonactivation_on(
                    &tx,
                    &write_id,
                    &publication,
                    winner_head.clone(),
                    false,
                )?;
                if winner_commit != prepared_candidate.reference {
                    begin_merge_candidate_nonactivation_on(
                        &tx,
                        &write_id,
                        &prepared_candidate,
                        winner_head.clone(),
                        true,
                    )?;
                }
                let mut lost_preparation = prepared.clone();
                let PreparedStoreWriteState::MergeAbandonment { outcome, .. } =
                    &mut lost_preparation
                else {
                    unreachable!("matched Merge abandonment")
                };
                *outcome = MergeAbandonmentOutcome::Lost {
                    winner_commit: winner_commit.clone(),
                    winner_head: winner_head.clone(),
                };
                let lost_preparation =
                    serde_json::to_string(&lost_preparation).map_err(|error| {
                        DbError::Message(format!("serialize lost Merge abandonment: {error}"))
                    })?;
                let updated = tx
                    .execute(
                        "UPDATE store_writes SET prepared = ?2
                         WHERE write_id = ?1 AND prepared = ?3",
                        rusqlite::params![write_id.as_str(), lost_preparation, raw_prepared],
                    )
                    .map_err(DbError::from)?;
                if updated != 1 {
                    return Err(DbError::Message(
                        "Merge abandonment changed while recording its winner".to_string(),
                    ));
                }
            } else {
                begin_merge_candidate_nonactivation_on(
                    &tx,
                    &write_id,
                    &prepared_candidate,
                    winner_head.clone(),
                    true,
                )?;
            }
            let blocked = WriteStatus::Blocked(crate::WriteBlock::InvalidProtocolState {
                reason: format!(
                    "Merge successor slot is occupied by signed head {}",
                    winner_head.head_hash
                ),
            });
            Self::set_write_status_on(&tx, &write_id, &blocked)?;
            tx.commit().map_err(DbError::from)?;
            Self::notify_write_status_in(&statuses, &notified_write_id, blocked);
            Ok(())
        })
        .await
    }

    pub(crate) async fn exact_serial_predecessor(
        &self,
        commit: Option<StoreBatchCommitRef>,
    ) -> Result<StoreSerialPredecessor, DbError> {
        self.call(move |conn| store_serial_predecessor_on(conn, commit.as_ref()))
            .await
    }

    pub(crate) async fn complete_prepared_serial_branch(
        &self,
        accepted: VersionedObject,
    ) -> Result<u64, DbError> {
        let statuses = self.state.write_statuses.clone();
        let gates = self.state.gates.clone();
        let synced_tables = self.state.synced_tables.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let root = required_store_root_authority_on(&tx)?;
            let accepted_unverified: StoreSerialHead = serde_json::from_slice(&accepted.bytes)
                .map_err(|error| DbError::Message(format!("accepted Serial head: {error}")))?;
            let accepted_author_ref = match &accepted_unverified.state {
                StoreSerialHeadState::Commit {
                    author_registration,
                    ..
                } => author_registration,
                StoreSerialHeadState::Genesis { .. } => {
                    return Err(DbError::Message(
                        "prepared Serial branch cannot complete at a genesis head".to_string(),
                    ));
                }
            };
            let accepted_author = load_activated_registration_on(&tx, &root, accepted_author_ref)?;
            let accepted_head =
                StoreSerialHead::parse(&accepted.bytes, root.store_root_hash, &accepted_author)
                    .map_err(|error| {
                        DbError::Message(format!("verify accepted Serial head: {error}"))
                    })?;
            let accepted_tip = match &accepted_head.state {
                StoreSerialHeadState::Commit { commit, .. } => commit.clone(),
                StoreSerialHeadState::Genesis { .. } => unreachable!("rejected above"),
            };
            let mut statement = tx
                .prepare(
                    "SELECT write_id, prepared, base FROM store_writes
                     WHERE prepared IS NOT NULL AND status = '\"publishing\"'
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, String>(1)?,
                        row.get::<_, String>(2)?,
                    ))
                })
                .map_err(DbError::from)?
                .collect::<Result<Vec<_>, _>>()
                .map_err(DbError::from)?;
            drop(statement);
            let mut completed = Vec::new();
            let mut completed_base = None;
            let mut predecessor = None;
            let mut prepared_tip_head = None;
            for row in rows {
                let (stored_write_id, prepared, raw_base) = row;
                let stored_base: StoreWriteBase = serde_json::from_str(&raw_base)
                    .map_err(|error| DbError::Message(format!("prepared Serial base: {error}")))?;
                match &completed_base {
                    Some(expected) if expected != &stored_base => {
                        return Err(DbError::Message(
                            "prepared Serial branch contains inconsistent bases".to_string(),
                        ));
                    }
                    None => completed_base = Some(stored_base.clone()),
                    Some(_) => {}
                }
                let PreparedStoreWriteState::Serial {
                    commit,
                    tip_head_bytes,
                    local_cleanup,
                    ..
                } = serde_json::from_str(&prepared)
                    .map_err(|error| DbError::Message(format!("prepared Serial write: {error}")))?
                else {
                    return Err(DbError::Message(
                        "non-Serial write reached Serial completion".to_string(),
                    ));
                };
                let unverified: StoreBatchCommit = serde_json::from_slice(&commit.semantic_bytes)
                    .map_err(|error| {
                    DbError::Message(format!("prepared Serial commit: {error}"))
                })?;
                if predecessor.is_none() {
                    let StoreWriteBase::Serial { base, .. } = &stored_base else {
                        return Err(DbError::Message(
                            "Merge base reached Serial completion".to_string(),
                        ));
                    };
                    predecessor = base.clone();
                }
                let sequence = predecessor
                    .as_ref()
                    .map_or(1, |reference: &StoreBatchCommitRef| {
                        reference.coord.sequence().saturating_add(1)
                    });
                let coord = StoreCommitCoord::Serial { sequence };
                let registration =
                    load_activated_registration_on(&tx, &root, &unverified.author_registration)?;
                let commit_value = StoreBatchCommit::parse_at(
                    &commit.semantic_bytes,
                    root.store_root_hash,
                    &coord,
                    &registration,
                )
                .map_err(|error| DbError::Message(format!("outbound Serial commit: {error}")))?;
                let commit_ref = StoreBatchCommitRef::from_commit(
                    &commit_value,
                    coord,
                    commit.prepared.reference().clone(),
                )
                .map_err(|error| DbError::Message(error.to_string()))?;
                let order_matches = match (&predecessor, &commit_value.order) {
                    (
                        Some(expected),
                        crate::sync::store_commit::StoreCommitOrder::Serial {
                            predecessor: StoreSerialPredecessor::Commit(actual),
                            ..
                        },
                    ) => actual == expected,
                    (
                        None,
                        crate::sync::store_commit::StoreCommitOrder::Serial {
                            predecessor:
                                StoreSerialPredecessor::Genesis {
                                    root: commit_root,
                                    founder_registration,
                                },
                            ..
                        },
                    ) => {
                        commit_root == &root
                            && founder_registration == &commit_value.author_registration
                    }
                    _ => false,
                };
                if !order_matches {
                    return Err(DbError::Message(
                        "prepared Serial completion chain has a different exact predecessor"
                            .to_string(),
                    ));
                }
                if commit_value.write_id.as_str() != stored_write_id {
                    return Err(DbError::Message(
                        "prepared Serial write id differs from signed commit".to_string(),
                    ));
                }
                let write_id = commit_value.write_id.clone();
                Self::activate_prepared_write_on(
                    &tx,
                    &gates,
                    &synced_tables,
                    &write_id,
                    &commit_value,
                    &commit_ref,
                    local_cleanup,
                    &[],
                )?;
                let cleared = tx
                    .execute(
                        "UPDATE store_writes SET prepared = NULL WHERE write_id = ?1",
                        [write_id.as_str()],
                    )
                    .map_err(DbError::from)?;
                if cleared != 1 {
                    return Err(DbError::Message(format!(
                        "prepared Serial write {write_id} disappeared during completion"
                    )));
                }
                let status = WriteStatus::Published(Box::new(PublishedPosition::Serial {
                    commit: commit_ref.clone(),
                }));
                Self::set_write_status_on(&tx, &write_id, &status)?;
                if let Some(bytes) = tip_head_bytes {
                    if prepared_tip_head.replace(bytes).is_some() {
                        return Err(DbError::Message(
                            "prepared Serial branch has multiple tip heads".to_string(),
                        ));
                    }
                }
                predecessor = Some(commit_ref.clone());
                completed.push((write_id, status, commit_ref));
            }
            let Some((_, _, final_ref)) = completed.last() else {
                return Err(DbError::Message(
                    "prepared Serial branch is absent".to_string(),
                ));
            };
            if final_ref != &accepted_tip
                || prepared_tip_head.as_deref() != Some(accepted.bytes.as_slice())
            {
                return Err(DbError::Message(
                    "accepted Serial head differs from the exact prepared branch tip".to_string(),
                ));
            }
            tx.execute(
                "INSERT INTO serial_head_receipt \
                 (singleton, head_bytes, version_token, commit_ref) VALUES (1, ?1, ?2, ?3) \
                 ON CONFLICT(singleton) DO UPDATE SET \
                   head_bytes = excluded.head_bytes, \
                   version_token = excluded.version_token, \
                   commit_ref = excluded.commit_ref",
                (
                    &accepted.bytes,
                    serde_json::to_string(&accepted.version).map_err(|error| {
                        DbError::Message(format!("serialize Serial version receipt: {error}"))
                    })?,
                    serde_json::to_string(&accepted_tip).map_err(|error| {
                        DbError::Message(format!("serialize accepted Serial commit ref: {error}"))
                    })?,
                ),
            )
            .map_err(DbError::from)?;
            let completed_base = completed_base.ok_or_else(|| {
                DbError::Message("prepared Serial branch base is absent".to_string())
            })?;
            let suffix_first: Option<String> = tx
                .query_row(
                    "SELECT write_id FROM store_writes
                     WHERE status = '\"pending\"' AND prepared IS NULL AND base = ?1
                     ORDER BY ordinal LIMIT 1",
                    [serde_json::to_string(&completed_base).map_err(|error| {
                        DbError::Message(format!("serialize Serial base: {error}"))
                    })?],
                    |row| row.get(0),
                )
                .optional()
                .map_err(DbError::from)?;
            if let Some(suffix_first) = suffix_first {
                let rebased = StoreWriteBase::Serial {
                    branch_id: PendingBranchId::from_first_write(WriteId::from_generated(
                        suffix_first,
                    )),
                    base: Some(accepted_tip.clone()),
                };
                tx.execute(
                    "UPDATE store_writes SET base = ?2
                     WHERE status = '\"pending\"' AND prepared IS NULL AND base = ?1",
                    rusqlite::params![
                        serde_json::to_string(&completed_base).map_err(
                            |error| DbError::Message(format!(
                                "serialize completed Serial base: {error}"
                            ))
                        )?,
                        serde_json::to_string(&rebased).map_err(|error| DbError::Message(
                            format!("serialize rebased Serial suffix: {error}")
                        ))?,
                    ],
                )
                .map_err(DbError::from)?;
            }
            let count = u64::try_from(completed.len())
                .map_err(|_| DbError::Message("Serial completion count exceeds u64".to_string()))?;
            tx.commit().map_err(DbError::from)?;
            for (write_id, status, _) in completed {
                Self::notify_write_status_in(&statuses, &write_id, status);
            }
            Ok(count)
        })
        .await
    }

    fn validate_serial_candidate_cleanup_on(
        conn: &Connection,
        write_id: &WriteId,
        raw_prepared: Option<&str>,
    ) -> Result<(), DbError> {
        let Some(raw_prepared) = raw_prepared else {
            return Ok(());
        };
        let Some(candidate) = parse_prepared_serial_candidate(raw_prepared)? else {
            return Ok(());
        };
        let mut object_ids = vec![remote_object_id(&candidate.reference.object)];
        let mut statement = conn
            .prepare(
                "SELECT remote_object_id FROM store_write_packages WHERE write_id = ?1
                 UNION
                 SELECT remote_object_id FROM store_write_blobs WHERE write_id = ?1",
            )
            .map_err(DbError::from)?;
        let indexed = statement
            .query_map([write_id.as_str()], |row| row.get::<_, String>(0))
            .map_err(DbError::from)?
            .collect::<Result<Vec<_>, _>>()
            .map_err(DbError::from)?;
        drop(statement);
        for encoded in indexed {
            object_ids.push(encoded.parse().map_err(|error| {
                DbError::Message(format!("Serial cleanup remote object id: {error}"))
            })?);
        }
        for object_id in object_ids {
            let remote = load_remote_object_on(conn, object_id)?;
            if !remote
                .candidate_cleanup_complete(&candidate.reference)
                .map_err(|error| {
                    DbError::Message(format!(
                        "validate candidate cleanup for {object_id}: {error}"
                    ))
                })?
            {
                return Err(DbError::Message(format!(
                    "candidate cleanup for remote object {object_id} is incomplete"
                )));
            }
        }
        Ok(())
    }

    fn apply_serial_resolution_on(
        tx: &rusqlite::Transaction<'_>,
        synced_tables: &[SyncedTable],
        branch_id: &PendingBranchId,
        plan: crate::sync::store_pull::SerialResolutionPlan,
    ) -> Result<Vec<WriteId>, DbError> {
        let schema = Arc::new(crate::sync::conflict::TableSchema::from_db(
            tx,
            synced_tables,
        )?);
        let mut statement = tx
            .prepare(
                "SELECT write_id, status, inverse_changeset, base, prepared FROM store_writes
                 WHERE status != '\"local_only\"'
                   AND json_extract(status, '$.published') IS NULL
                   AND json_extract(status, '$.resolved') IS NULL
                   AND json_type(base, '$.serial') IS NOT NULL
                 ORDER BY ordinal",
            )
            .map_err(DbError::from)?;
        let rows = statement
            .query_map([], |row| {
                Ok((
                    row.get::<_, String>(0)?,
                    row.get::<_, String>(1)?,
                    row.get::<_, Vec<u8>>(2)?,
                    row.get::<_, String>(3)?,
                    row.get::<_, Option<String>>(4)?,
                ))
            })
            .map_err(DbError::from)?;
        let mut branch = Vec::new();
        let mut branch_base = None;
        let mut saw_conflict = false;
        for row in rows {
            let (write_id, status, inverse, raw_base, prepared) = row.map_err(DbError::from)?;
            let status: WriteStatus = serde_json::from_str(&status)
                .map_err(|error| DbError::Message(format!("Serial branch status: {error}")))?;
            let base: StoreWriteBase = serde_json::from_str(&raw_base)
                .map_err(|error| DbError::Message(format!("Serial branch base: {error}")))?;
            let StoreWriteBase::Serial {
                branch_id: stored_branch_id,
                base,
            } = base
            else {
                return Err(DbError::Message(
                    "MergeConcurrent base reached Serial resolution".to_string(),
                ));
            };
            if &stored_branch_id != branch_id {
                return Err(DbError::Message(
                    "Serial database contains more than one unresolved branch".to_string(),
                ));
            }
            match status {
                WriteStatus::Conflict(conflict) => {
                    if conflict.branch_id != stored_branch_id
                        || conflict.base != store_serial_predecessor_on(tx, base.as_ref())?
                    {
                        return Err(DbError::Message(
                            "Serial conflict status differs from its durable branch base"
                                .to_string(),
                        ));
                    }
                    saw_conflict = true;
                }
                WriteStatus::Pending if prepared.is_none() => {}
                status => {
                    return Err(DbError::Message(format!(
                        "conflicted Serial branch write {write_id} has non-resolvable status {status:?}"
                    )))
                }
            }
            Self::validate_serial_candidate_cleanup_on(
                tx,
                &WriteId::from_generated(write_id.clone()),
                prepared.as_deref(),
            )?;
            if branch_base.as_ref().is_some_and(|stored| stored != &base) {
                return Err(DbError::Message(
                    "Serial conflict branch has inconsistent bases".to_string(),
                ));
            }
            branch_base.get_or_insert(base);
            branch.push((WriteId::from_generated(write_id), inverse));
        }
        drop(statement);
        if branch.is_empty() || !saw_conflict {
            return Err(DbError::Message(format!(
                "Serial branch {} is not conflicted",
                branch_id.first_write_id()
            )));
        }
        let branch_base = branch_base.expect("nonempty branch has a base value");
        let durable_base = Self::latest_position_for_device_on(tx, SERIAL_STREAM_ID)?;
        if durable_base != branch_base {
            return Err(DbError::Message(format!(
                "local Serial position {durable_base:?} differs from branch base {branch_base:?}"
            )));
        }
        for (_, inverse) in branch.iter().rev() {
            let inverse = crate::sync::apply::ValidatedChangeset::new(inverse, schema.clone())
                .map_err(|error| DbError::Message(format!("invalid Serial inverse: {error}")))?;
            crate::sync::apply::apply_changeset_strict_on(tx, inverse)
                .map_err(|error| DbError::Message(format!("reverse Serial branch: {error}")))?;
        }
        let mut predecessor = branch_base;
        for resolution in plan.commits {
            let expected_seq = match predecessor.as_ref() {
                Some(reference) => reference.coord.sequence().checked_add(1).ok_or_else(|| {
                    DbError::Message("Serial resolution sequence overflow".to_string())
                })?,
                None => 1,
            };
            if resolution.commit.seq() != expected_seq
                || resolution.commit_ref.coord
                    != (StoreCommitCoord::Serial {
                        sequence: expected_seq,
                    })
                || resolution.commit.order.predecessor() != predecessor.as_ref()
            {
                return Err(DbError::Message(format!(
                    "Serial resolution commit {} does not follow the branch base",
                    resolution.commit.seq()
                )));
            }
            if let Some(package) = resolution.package {
                let changeset = crate::sync::apply::ValidatedChangeset::new(
                    package,
                    schema.clone(),
                )
                .map_err(|error| {
                    DbError::Message(format!("invalid Serial resolution changeset: {error}"))
                })?;
                crate::sync::apply::apply_changeset_strict_on(tx, changeset).map_err(|error| {
                    DbError::Message(format!(
                        "apply Serial resolution commit {}: {error}",
                        resolution.commit.seq()
                    ))
                })?;
                let blob_decls = BlobDecls::from_tables(tx, synced_tables)
                    .map_err(|error| DbError::Message(error.to_string()))?;
                for intent in resolution.cleanup {
                    crate::blob::local_cleanup::record_if_unreferenced_on(
                        tx,
                        &blob_decls,
                        &intent,
                    )?;
                }
            }
            Self::record_activated_store_device_registrations_on(
                tx,
                &resolution.commit,
                &resolution.registrations,
            )?;
            Self::record_verified_circle_activations_on(
                tx,
                &resolution.commit,
                &resolution.commit_ref,
                &resolution.circle_activations,
            )?;
            Self::record_materialized_serial_commit_on(
                tx,
                &resolution.commit,
                &resolution.commit_ref,
                &resolution.authorization_after,
            )?;
            predecessor = Some(resolution.commit_ref);
        }
        let head_commit = match plan.head.state {
            StoreSerialHeadState::Commit { commit, .. } => Some(commit),
            StoreSerialHeadState::Genesis { .. } => None,
        };
        if predecessor != head_commit {
            return Err(DbError::Message(
                "Serial resolution commits do not reach the verified global head".to_string(),
            ));
        }
        Ok(branch.into_iter().map(|(write_id, _)| write_id).collect())
    }

    fn resolve_unpublished_writes_on(
        tx: &rusqlite::Transaction<'_>,
        write_ids: &[WriteId],
        resolution: &WriteResolution,
    ) -> Result<(), DbError> {
        let status = WriteStatus::Resolved(resolution.clone());
        for write_id in write_ids {
            let raw_prepared: Option<String> = tx
                .query_row(
                    "SELECT prepared FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let mut removable = Vec::new();
            let mut candidate = None;
            if let Some(raw_prepared) = raw_prepared.as_deref() {
                let prepared: PreparedStoreWriteState = serde_json::from_str(raw_prepared)
                    .map_err(|error| {
                        DbError::Message(format!("resolved prepared write: {error}"))
                    })?;
                match &prepared {
                    PreparedStoreWriteState::MergeConcurrent { .. }
                    | PreparedStoreWriteState::MergeAbandonment { .. } => {
                        let merge = parse_prepared_merge_candidate_on(tx, &prepared)?
                            .expect("matched Merge preparation");
                        removable.push(remote_object_id(&merge.reference.object));
                        removable.push(remote_object_id(merge.head_prepared.reference()));
                        candidate = Some(merge.reference);
                    }
                    PreparedStoreWriteState::Serial { .. } => {
                        if let Some(serial) = parse_prepared_serial_candidate(raw_prepared)? {
                            removable.push(remote_object_id(&serial.reference.object));
                            candidate = Some(serial.reference);
                        }
                    }
                    PreparedStoreWriteState::SerialPreparing => {}
                }
            }
            let mut statement = tx
                .prepare(
                    "SELECT remote_object_id FROM store_write_packages WHERE write_id = ?1
                     UNION
                     SELECT remote_object_id FROM store_write_blobs WHERE write_id = ?1",
                )
                .map_err(DbError::from)?;
            let indexed = statement
                .query_map([write_id.as_str()], |row| row.get::<_, String>(0))
                .map_err(DbError::from)?
                .collect::<Result<Vec<_>, _>>()
                .map_err(DbError::from)?;
            drop(statement);
            for encoded in indexed {
                removable.push(encoded.parse().map_err(|error| {
                    DbError::Message(format!("resolved remote object id: {error}"))
                })?);
            }
            if let Some(candidate) = &candidate {
                for object_id in &removable {
                    let remote = load_remote_object_on(tx, *object_id)?;
                    if !remote
                        .candidate_cleanup_complete(candidate)
                        .map_err(|error| {
                            DbError::Message(format!(
                                "validate candidate cleanup for {object_id}: {error}"
                            ))
                        })?
                    {
                        return Err(DbError::Message(format!(
                            "candidate cleanup for remote object {object_id} is incomplete"
                        )));
                    }
                }
            }
            tx.execute(
                "DELETE FROM store_write_blob_leases WHERE write_id = ?1",
                [write_id.as_str()],
            )
            .map_err(DbError::from)?;
            tx.execute(
                "DELETE FROM store_write_packages WHERE write_id = ?1",
                [write_id.as_str()],
            )
            .map_err(DbError::from)?;
            tx.execute(
                "DELETE FROM store_write_blobs WHERE write_id = ?1",
                [write_id.as_str()],
            )
            .map_err(DbError::from)?;
            for object_id in removable {
                let remote = load_remote_object_on(tx, object_id)?;
                let absent = matches!(
                    remote,
                    RemoteObjectRecord::CandidateCommit(
                        crate::sync::remote_object::CandidateCommitRecord {
                            state:
                                crate::sync::remote_object::CandidateCommitState::AbsentVerified { .. },
                            ..
                        }
                    ) | RemoteObjectRecord::CandidateExclusive(
                        crate::sync::remote_object::CandidateObjectRecord {
                            state:
                                crate::sync::remote_object::CandidateObjectState::AbsentVerified { .. },
                            ..
                        }
                    ) | RemoteObjectRecord::RetainedAuthority(
                        crate::sync::remote_object::RetainedAuthorityRecord {
                            state:
                                crate::sync::remote_object::RetainedAuthorityObjectState::UncreatedVerified { .. },
                            ..
                        }
                    )
                );
                if absent {
                    tx.execute(
                        "DELETE FROM remote_objects WHERE object_id = ?1",
                        [object_id.to_string()],
                    )
                    .map_err(DbError::from)?;
                }
            }
            tx.execute(
                "UPDATE store_writes SET prepared = NULL WHERE write_id = ?1",
                [write_id.as_str()],
            )
            .map_err(DbError::from)?;
            Self::set_write_status_on(tx, write_id, &status)?;
        }
        Ok(())
    }

    #[doc(hidden)]
    pub async fn discard_pending_serial_branch(
        &self,
        branch_id: PendingBranchId,
        plan: crate::sync::store_pull::SerialResolutionPlan,
    ) -> Result<(), DbError> {
        let synced_tables = self.synced_tables().to_vec();
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let write_ids =
                Self::apply_serial_resolution_on(&tx, &synced_tables, &branch_id, plan)?;
            let resolution = WriteResolution::Discarded;
            Self::resolve_unpublished_writes_on(&tx, &write_ids, &resolution)?;
            tx.commit().map_err(DbError::from)?;
            let status = WriteStatus::Resolved(resolution);
            for write_id in write_ids {
                Self::notify_write_status_in(&statuses, &write_id, status.clone());
            }
            Ok(())
        })
        .await
    }

    #[doc(hidden)]
    pub async fn replace_pending_serial_branch<R, E, F>(
        &self,
        branch_id: PendingBranchId,
        plan: crate::sync::store_pull::SerialResolutionPlan,
        replacement_write_id: WriteId,
        f: F,
    ) -> Result<WriteReceipt<R>, E>
    where
        R: Send + 'static,
        E: From<DbError> + Send + 'static,
        F: FnOnce(&rusqlite::Transaction<'_>) -> Result<R, E> + Send + 'static,
    {
        let synced_tables = self.synced_tables().to_vec();
        let gates = self.gates();
        let blob_decls = self.blob_decls();
        let statuses = self.state.write_statuses.clone();
        let outcome = self
            .call(move |conn| {
                Ok((|| {
                    let tx = conn
                        .unchecked_transaction()
                        .map_err(DbError::from)
                        .map_err(E::from)?;
                    let old_write_ids =
                        Self::apply_serial_resolution_on(&tx, &synced_tables, &branch_id, plan)
                            .map_err(E::from)?;
                    let changes_before = tx.total_changes();
                    let (value, captured) =
                        Self::capture_host_changes_on(&tx, &synced_tables, || f(&tx))?;
                    let partitions = Self::partition_captured_write_on(
                        &tx,
                        &captured,
                        &gates,
                        WritePolicy::Serial,
                        StoreWriteRouting::SerialScoped,
                    )
                    .map_err(E::from)?;
                    let blob_facts =
                        Self::capture_partition_blob_facts_on(&tx, &partitions, &blob_decls)
                            .map_err(E::from)?;
                    let rows_changed = tx.total_changes().saturating_sub(changes_before);
                    let inverse_changeset = Self::invert_changeset(&captured).map_err(E::from)?;
                    let base = StoreWriteBase::Serial {
                        branch_id: PendingBranchId::from_first_write(replacement_write_id.clone()),
                        base: Self::latest_position_for_device_on(&tx, SERIAL_STREAM_ID)
                            .map_err(E::from)?,
                    };
                    let status = Self::insert_store_write_on(
                        &tx,
                        &replacement_write_id,
                        &partitions,
                        &inverse_changeset,
                        &base,
                        &blob_facts,
                        rows_changed,
                    )
                    .map_err(E::from)?;
                    let pending_branch_id = (!matches!(&status, WriteStatus::LocalOnly))
                        .then(|| PendingBranchId::from_first_write(replacement_write_id.clone()));
                    let resolution = WriteResolution::Replaced {
                        replacement: replacement_write_id.clone(),
                    };
                    Self::resolve_unpublished_writes_on(&tx, &old_write_ids, &resolution)
                        .map_err(E::from)?;
                    tx.commit().map_err(DbError::from).map_err(E::from)?;
                    let old_status = WriteStatus::Resolved(resolution);
                    for write_id in old_write_ids {
                        Self::notify_write_status_in(&statuses, &write_id, old_status.clone());
                    }
                    Ok(WriteReceipt {
                        value,
                        write_id: replacement_write_id,
                        status,
                        pending_branch_id,
                    })
                })())
            })
            .await
            .map_err(E::from)?;
        outcome
    }

    pub(crate) async fn latest_local_store_ack(
        &self,
    ) -> Result<Option<PublishedStoreAck>, DbError> {
        self.call(load_published_store_ack_on).await
    }

    pub(crate) async fn stage_store_ack(
        &self,
        ack: StoreAck,
        prepared: PreparedExactObject,
    ) -> Result<StoreAckRef, DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let (root, registration_ref, registration) = local_store_authority_on(&tx)?;
            if ack.author_registration != registration_ref {
                return Err(DbError::Message(
                    "staged Store acknowledgement author differs from local activation".to_string(),
                ));
            }
            let reference = StoreAckRef {
                revision: ack.revision,
                ack_hash: ack.ack_hash(),
                object: prepared.reference().clone(),
            };
            let verified = StoreAck::parse_at(
                &ack.to_bytes(),
                root.store_root_hash,
                &reference,
                &registration,
            )
            .map_err(|error| {
                DbError::Message(format!("verify staged Store acknowledgement: {error}"))
            })?;
            if verified != ack {
                return Err(DbError::Message(
                    "staged Store acknowledgement changed during exact verification".to_string(),
                ));
            }
            let previous = load_published_store_ack_on(&tx)?;
            let (expected_revision, expected_predecessor, expected_slot) = match &previous {
                Some(previous) => (
                    previous.reference.revision.checked_add(1).ok_or_else(|| {
                        DbError::Message("Store acknowledgement revision overflow".to_string())
                    })?,
                    Some(previous.reference.clone()),
                    previous.successor_slot.clone(),
                ),
                None => (1, None, store_ack_first_slot(&registration)?.clone()),
            };
            if ack.revision != expected_revision
                || ack.predecessor != expected_predecessor
                || prepared.reference().slot() != &expected_slot
            {
                return Err(DbError::Message(
                    "Store acknowledgement does not extend the exact local stream".to_string(),
                ));
            }
            if ack.successor.predecessor
                != previous
                    .as_ref()
                    .map(|value| value.reference.object.clone())
            {
                return Err(DbError::Message(
                    "Store acknowledgement successor names a different predecessor".to_string(),
                ));
            }
            let next_revision = ack.revision.checked_add(1).ok_or_else(|| {
                DbError::Message("Store acknowledgement revision overflow".to_string())
            })?;
            if ack.successor.activation
                != StreamActivationId::store_acknowledgements(&root, &registration_ref)
                || ack.successor.next_slot.logical_key()
                    != format!(
                        "{}.json",
                        ack_slot_prefix(&registration.device_id.to_string(), next_revision)
                    )
            {
                return Err(DbError::Message(
                    "Store acknowledgement successor is outside its activated exact stream"
                        .to_string(),
                ));
            }
            let ack_ref = serde_json::to_string(&reference).map_err(|error| {
                DbError::Message(format!(
                    "serialize exact Store acknowledgement ref: {error}"
                ))
            })?;
            let prepared = serde_json::to_string(&prepared).map_err(|error| {
                DbError::Message(format!("serialize prepared Store acknowledgement: {error}"))
            })?;
            tx.execute(
                "INSERT INTO outbound_store_acks \
                 (singleton, ack_ref, ack_bytes, prepared_object) \
                 VALUES (1, ?1, ?2, ?3)",
                rusqlite::params![ack_ref, ack.to_bytes(), prepared],
            )
            .map_err(DbError::from)?;
            tx.commit().map_err(DbError::from)?;
            Ok(reference)
        })
        .await
    }

    pub(crate) async fn oldest_outbound_store_ack(
        &self,
    ) -> Result<Option<OutboundStoreAck>, DbError> {
        self.call(load_outbound_store_ack_on).await
    }

    pub(crate) async fn complete_outbound_store_ack(
        &self,
        accepted: StoreAckRef,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let outbound = load_outbound_store_ack_on(&tx)?.ok_or_else(|| {
                DbError::Message("outbound Store acknowledgement is absent".to_string())
            })?;
            if outbound.reference != accepted {
                return Err(DbError::Message(
                    "accepted Store acknowledgement differs from the prepared exact object"
                        .to_string(),
                ));
            }
            let deleted = tx
                .execute(
                    "DELETE FROM outbound_store_acks WHERE singleton = 1 AND ack_ref = ?1",
                    [serde_json::to_string(&accepted).map_err(|error| {
                        DbError::Message(format!(
                            "serialize accepted Store acknowledgement ref: {error}"
                        ))
                    })?],
                )
                .map_err(DbError::from)?;
            if deleted != 1 {
                return Err(DbError::Message(
                    "outbound Store acknowledgement disappeared".to_string(),
                ));
            }
            let successor_slot = serde_json::to_string(&outbound.ack.value.successor.next_slot)
                .map_err(|error| {
                    DbError::Message(format!(
                        "serialize Store acknowledgement successor slot: {error}"
                    ))
                })?;
            tx.execute(
                "INSERT INTO published_store_acks (singleton, ack_ref, successor_slot) \
                 VALUES (1, ?1, ?2) \
                 ON CONFLICT(singleton) DO UPDATE SET \
                   ack_ref = excluded.ack_ref, successor_slot = excluded.successor_slot",
                (
                    serde_json::to_string(&accepted).map_err(|error| {
                        DbError::Message(format!(
                            "serialize published Store acknowledgement ref: {error}"
                        ))
                    })?,
                    successor_slot,
                ),
            )
            .map_err(DbError::from)?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn outbound_membership_mutation(
        &self,
    ) -> Result<Option<DurableMembershipMutation>, DbError> {
        self.call(|conn| {
            conn.query_row(
                "SELECT intent_hash, plan_bytes, progress_bytes \
                 FROM outbound_membership_mutation WHERE singleton = 1",
                [],
                |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, Vec<u8>>(1)?,
                        row.get::<_, Vec<u8>>(2)?,
                    ))
                },
            )
            .optional()
            .map_err(DbError::from)?
            .map(|(hash, plan_bytes, progress_bytes)| {
                let intent_hash: ObjectHash = hash.parse().map_err(|error| {
                    DbError::Message(format!("membership intent hash: {error}"))
                })?;
                if ObjectHash::digest(&plan_bytes) != intent_hash {
                    return Err(DbError::Message(
                        "membership intent hash differs from its exact plan bytes".to_string(),
                    ));
                }
                Ok(DurableMembershipMutation {
                    intent_hash,
                    plan_bytes,
                    progress_bytes,
                })
            })
            .transpose()
        })
        .await
    }

    pub(crate) async fn select_membership_author_stream(
        &self,
        author_pubkey: &str,
        author_owner_grant: &crate::sync::membership::MembershipGrantId,
        reusable: std::collections::BTreeSet<crate::sync::membership::AuthorStreamId>,
    ) -> Result<crate::sync::membership::AuthorStreamId, DbError> {
        self.select_causal_author_stream(
            format!("membership_author_stream/{author_pubkey}/{author_owner_grant}"),
            reusable,
        )
        .await
    }

    pub(crate) async fn select_causal_author_stream(
        &self,
        key: String,
        reusable: std::collections::BTreeSet<crate::sync::membership::AuthorStreamId>,
    ) -> Result<crate::sync::membership::AuthorStreamId, DbError> {
        let candidate = crate::sync::membership::AuthorStreamId::generate(self.id_provider());
        self.call(move |conn| {
            let existing = conn
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [&key],
                    |row| row.get::<_, String>(0),
                )
                .optional()
                .map_err(DbError::from)?
                .map(|value| {
                    value.parse().map_err(|error| {
                        DbError::Message(format!(
                            "membership author stream state is malformed: {error}"
                        ))
                    })
                })
                .transpose()?;
            if let Some(existing) = existing {
                if reusable.contains(&existing) {
                    return Ok(existing);
                }
            }
            let selected = reusable.iter().next_back().copied().unwrap_or(candidate);
            conn.execute(
                "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
                 ON CONFLICT(key) DO UPDATE SET value = excluded.value",
                rusqlite::params![key, selected.to_string()],
            )
            .map_err(DbError::from)?;
            Ok(selected)
        })
        .await
    }

    pub(crate) async fn stage_membership_mutation(
        &self,
        plan_bytes: Vec<u8>,
        progress_bytes: Vec<u8>,
    ) -> Result<ObjectHash, DbError> {
        self.call(move |conn| {
            let intent_hash = ObjectHash::digest(&plan_bytes);
            let existing = conn
                .query_row(
                    "SELECT intent_hash, plan_bytes FROM outbound_membership_mutation \
                     WHERE singleton = 1",
                    [],
                    |row| Ok((row.get::<_, String>(0)?, row.get::<_, Vec<u8>>(1)?)),
                )
                .optional()
                .map_err(DbError::from)?;
            if let Some((existing_hash, existing_plan)) = existing {
                if existing_hash == intent_hash.to_string() && existing_plan == plan_bytes {
                    return Ok(intent_hash);
                }
                return Err(DbError::Message(
                    "a different membership mutation is already pending".to_string(),
                ));
            }
            conn.execute(
                "INSERT INTO outbound_membership_mutation \
                 (singleton, intent_hash, plan_bytes, progress_bytes) \
                 VALUES (1, ?1, ?2, ?3)",
                rusqlite::params![intent_hash.to_string(), plan_bytes, progress_bytes],
            )
            .map_err(DbError::from)?;
            Ok(intent_hash)
        })
        .await
    }

    pub(crate) async fn update_membership_mutation_progress(
        &self,
        intent_hash: ObjectHash,
        progress_bytes: Vec<u8>,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let updated = conn
                .execute(
                    "UPDATE outbound_membership_mutation SET progress_bytes = ?1 \
                     WHERE singleton = 1 AND intent_hash = ?2",
                    rusqlite::params![progress_bytes, intent_hash.to_string()],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(
                    "membership mutation ownership row is absent or changed".to_string(),
                ));
            }
            Ok(())
        })
        .await
    }

    pub(crate) async fn complete_membership_mutation(
        &self,
        intent_hash: ObjectHash,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let deleted = conn
                .execute(
                    "DELETE FROM outbound_membership_mutation \
                     WHERE singleton = 1 AND intent_hash = ?1",
                    [intent_hash.to_string()],
                )
                .map_err(DbError::from)?;
            if deleted != 1 {
                return Err(DbError::Message(
                    "membership mutation ownership row is absent or changed".to_string(),
                ));
            }
            Ok(())
        })
        .await
    }

    pub(crate) async fn outbound_snapshot_publication(
        &self,
    ) -> Result<Option<DurableSnapshotPublication>, DbError> {
        let pending = self.call(load_outbound_store_snapshot_on).await?;
        if let Some(pending) = &pending {
            for blob in &pending.blobs {
                if let Some(spool_path) = &blob.spool_path {
                    crate::local_blob::verify_exact_file(blob.remote.object(), spool_path)
                        .await
                        .map_err(|error| {
                            DbError::Message(format!("prepared snapshot blob spool: {error}"))
                        })?;
                }
            }
        }
        Ok(pending)
    }

    pub(crate) async fn stage_snapshot_publication(
        &self,
        meta: SnapshotMeta,
        meta_prepared: PreparedExactObject,
        image_bytes: Vec<u8>,
        image_prepared: PreparedExactObject,
        blobs: Vec<PreparedSnapshotBlob>,
    ) -> Result<StoreSnapshotRef, DbError> {
        let synced_tables = self.synced_tables().to_vec();
        let gates = self.gates();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let (root, registration_ref, registration) = local_store_authority_on(&tx)?;
            if meta.author_registration != registration_ref {
                return Err(DbError::Message(
                    "staged Store snapshot author differs from local activation".to_string(),
                ));
            }
            if meta.image.object != *image_prepared.reference()
                || ObjectHash::digest(&image_bytes) != meta.image.image_hash
                || meta.image.object.slot().logical_key()
                    != format!(
                        "{}.db",
                        snapshot_image_semantic_prefix(
                            &registration.device_id.to_string(),
                            meta.image.image_hash,
                        )
                    )
            {
                return Err(DbError::Message(
                    "staged Store snapshot image differs from its exact reference".to_string(),
                ));
            }
            let reference = StoreSnapshotRef {
                sequence: meta.sequence,
                snapshot_hash: meta.snapshot_hash(),
                object: meta_prepared.reference().clone(),
            };
            let verified = SnapshotMeta::parse_at(
                &meta.to_bytes(),
                root.store_root_hash,
                &reference,
                &registration,
            )
            .map_err(|error| {
                DbError::Message(format!("verify staged Store snapshot metadata: {error}"))
            })?;
            if verified != meta {
                return Err(DbError::Message(
                    "staged Store snapshot changed during exact verification".to_string(),
                ));
            }
            let previous = load_published_store_snapshot_on(&tx)?;
            let (expected_sequence, expected_predecessor, expected_slot) = match &previous {
                Some(previous) => (
                    previous.reference.sequence.checked_add(1).ok_or_else(|| {
                        DbError::Message("Store snapshot sequence overflow".to_string())
                    })?,
                    Some(previous.reference.clone()),
                    previous.successor_slot.clone(),
                ),
                None => (1, None, store_snapshot_first_slot(&registration)?.clone()),
            };
            if meta.sequence != expected_sequence
                || meta.predecessor != expected_predecessor
                || meta_prepared.reference().slot() != &expected_slot
                || meta.successor.predecessor
                    != previous
                        .as_ref()
                        .map(|value| value.reference.object.clone())
            {
                return Err(DbError::Message(
                    "Store snapshot does not extend the exact local stream".to_string(),
                ));
            }
            let next_sequence = meta
                .sequence
                .checked_add(1)
                .ok_or_else(|| DbError::Message("Store snapshot sequence overflow".to_string()))?;
            if meta.successor.activation
                != StreamActivationId::store_snapshots(&root, &registration_ref)
                || meta.successor.next_slot.logical_key()
                    != format!(
                        "{}.json",
                        snapshot_slot_prefix(&registration.device_id.to_string(), next_sequence)
                    )
            {
                return Err(DbError::Message(
                    "Store snapshot successor is outside its activated exact stream".to_string(),
                ));
            }
            for blob in &blobs {
                validate_snapshot_blob_plan_on(conn, &gates, &synced_tables, &meta, blob)?;
            }
            tx.execute(
                "INSERT INTO outbound_store_snapshot \
                 (singleton, snapshot_ref, meta_prepared, image_ref, image_prepared, \
                  image_bytes, meta_bytes, blobs) \
                 VALUES (1, ?1, ?2, ?3, ?4, ?5, ?6, ?7)",
                rusqlite::params![
                    serde_json::to_string(&reference).map_err(|error| DbError::Message(
                        format!("serialize exact Store snapshot ref: {error}")
                    ))?,
                    serde_json::to_string(&meta_prepared).map_err(|error| DbError::Message(
                        format!("serialize prepared Store snapshot metadata: {error}")
                    ))?,
                    serde_json::to_string(&meta.image).map_err(|error| DbError::Message(
                        format!("serialize exact Store snapshot image ref: {error}")
                    ))?,
                    serde_json::to_string(&image_prepared).map_err(|error| DbError::Message(
                        format!("serialize prepared Store snapshot image: {error}")
                    ))?,
                    image_bytes,
                    meta.to_bytes(),
                    serde_json::to_string(&blobs).map_err(|error| DbError::Message(format!(
                        "serialize prepared Store snapshot blobs: {error}"
                    )))?,
                ],
            )
            .map_err(DbError::from)?;
            tx.commit().map_err(DbError::from)?;
            Ok(reference)
        })
        .await
    }

    pub(crate) async fn latest_local_store_snapshot(
        &self,
    ) -> Result<Option<PublishedStoreSnapshot>, DbError> {
        self.call(load_published_store_snapshot_on).await
    }

    pub(crate) async fn complete_snapshot_publication(
        &self,
        accepted: StoreSnapshotRef,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let outbound = load_outbound_store_snapshot_on(&tx)?
                .ok_or_else(|| DbError::Message("outbound Store snapshot is absent".to_string()))?;
            if outbound.reference != accepted {
                return Err(DbError::Message(
                    "accepted Store snapshot differs from the prepared exact object".to_string(),
                ));
            }
            for blob in &outbound.blobs {
                install_snapshot_blob_plan_on(&tx, blob)?;
                if let Some(path) = &blob.spool_path {
                    tx.execute(
                        "INSERT INTO snapshot_blob_spool_cleanup (path) VALUES (?1)
                         ON CONFLICT(path) DO NOTHING",
                        [path.to_string_lossy().as_ref()],
                    )
                    .map_err(DbError::from)?;
                }
            }
            let deleted = tx
                .execute(
                    "DELETE FROM outbound_store_snapshot \
                     WHERE singleton = 1 AND snapshot_ref = ?1",
                    [serde_json::to_string(&accepted).map_err(|error| {
                        DbError::Message(format!("serialize accepted Store snapshot ref: {error}"))
                    })?],
                )
                .map_err(DbError::from)?;
            if deleted != 1 {
                return Err(DbError::Message(
                    "outbound snapshot ownership row is absent or changed".to_string(),
                ));
            }
            tx.execute(
                "INSERT INTO published_store_snapshot \
                 (singleton, snapshot_ref, successor_slot, meta_bytes) VALUES (1, ?1, ?2, ?3) \
                 ON CONFLICT(singleton) DO UPDATE SET \
                   snapshot_ref = excluded.snapshot_ref, \
                   successor_slot = excluded.successor_slot, \
                   meta_bytes = excluded.meta_bytes",
                rusqlite::params![
                    serde_json::to_string(&accepted).map_err(|error| DbError::Message(format!(
                        "serialize published Store snapshot ref: {error}"
                    )))?,
                    serde_json::to_string(&outbound.meta.value.successor.next_slot).map_err(
                        |error| DbError::Message(format!(
                            "serialize Store snapshot successor slot: {error}"
                        ))
                    )?,
                    outbound.meta.bytes,
                ],
            )
            .map_err(DbError::from)?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn snapshot_blob_spool_cleanup_paths(&self) -> Result<Vec<PathBuf>, DbError> {
        self.call(|conn| {
            let mut statement = conn
                .prepare("SELECT path FROM snapshot_blob_spool_cleanup ORDER BY path")
                .map_err(DbError::from)?;
            let paths = statement
                .query_map([], |row| row.get::<_, String>(0))
                .map_err(DbError::from)?
                .map(|row| row.map(PathBuf::from).map_err(DbError::from))
                .collect();
            paths
        })
        .await
    }

    pub(crate) async fn complete_snapshot_blob_spool_cleanup(
        &self,
        path: &Path,
    ) -> Result<(), DbError> {
        let path = path.to_string_lossy().into_owned();
        self.call(move |conn| {
            let deleted = conn
                .execute(
                    "DELETE FROM snapshot_blob_spool_cleanup WHERE path = ?1",
                    [&path],
                )
                .map_err(DbError::from)?;
            if deleted != 1 {
                return Err(DbError::Message(
                    "snapshot blob spool cleanup ownership is absent".to_string(),
                ));
            }
            Ok(())
        })
        .await
    }

    pub async fn local_store_root_ref(
        &self,
    ) -> Result<Option<crate::sync::store_commit::StoreRootRef>, DbError> {
        self.call(|conn| {
            load_store_root_authority_on(conn)
                .map(|authority| authority.map(|(reference, _)| reference))
        })
        .await
    }

    pub(crate) async fn install_store_root_authority(
        &self,
        reference: crate::sync::store_commit::StoreRootRef,
        bytes: Vec<u8>,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            install_store_root_authority_on(&tx, &reference, &bytes)?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn install_store_owner_anchor(
        &self,
        root: crate::sync::store_commit::StoreRootRef,
        founder_reference: StoreDeviceRegistrationRef,
        founder: StoreDeviceRegistration,
        founder_bytes: Vec<u8>,
        genesis: ResolvedStoreDeviceState,
        owner: String,
        head_refs: Vec<crate::sync::membership::MembershipHeadRef>,
    ) -> Result<(), DbError> {
        if founder.author_pubkey != owner {
            return Err(DbError::Message(
                "Store founder registration author differs from the owner anchor".to_string(),
            ));
        }
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            install_store_founder_state_on(
                &tx,
                &root,
                &founder_reference,
                &founder,
                &founder_bytes,
                &genesis,
            )?;
            tx.execute(
                "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
                 ON CONFLICT(key) DO UPDATE SET value = excluded.value",
                rusqlite::params![crate::sync::membership_ops::OWNER_PUBKEY_STATE_KEY, owner,],
            )
            .map_err(DbError::from)?;
            for reference in &head_refs {
                crate::sync::membership_ops::upsert_head_cursor_on(&tx, reference)?;
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn local_store_founder_graph(
        &self,
    ) -> Result<Option<DurableFounderGraph>, DbError> {
        self.call(load_local_store_founder_graph_on).await
    }

    pub(crate) async fn stage_store_founder_graph(
        &self,
        graph: DurableFounderGraph,
    ) -> Result<(), DbError> {
        validate_founder_graph(&graph)?;
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            if let Some(existing) = load_local_store_founder_graph_on(&tx)? {
                validate_founder_graph(&existing)?;
                if founder_graph_identity(&existing) == founder_graph_identity(&graph) {
                    return Ok(());
                }
                return Err(DbError::Message(
                    "local Store founder graph already owns different exact objects".to_string(),
                ));
            }
            consume_store_creation_probes_on(&tx, &graph)?;
            tx.execute(
                "INSERT INTO local_store_protocol_root \
                 (singleton, store_root_hash, store_protocol_root_bytes, prepared_object) \
                 VALUES (1, ?1, ?2, ?3)",
                rusqlite::params![
                    graph.root.value.object_hash().to_string(),
                    graph.root.bytes,
                    serde_json::to_string(&graph.root.prepared).map_err(|error| {
                        DbError::Message(format!("serialize prepared Store root: {error}"))
                    })?,
                ],
            )
            .map_err(DbError::from)?;
            tx.execute(
                "INSERT INTO local_store_device_registration \
                 (singleton, device_id, registration_hash, registration_bytes, prepared_object, \
                  initial_ack_ref, initial_ack_bytes, initial_ack_prepared, state) \
                 VALUES (1, ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
                rusqlite::params![
                    graph.registration.value.device_id.to_string(),
                    graph.registration.value.registration_hash().to_string(),
                    graph.registration.bytes,
                    serde_json::to_string(&graph.registration.prepared).map_err(|error| {
                        DbError::Message(format!(
                            "serialize prepared founder registration: {error}"
                        ))
                    })?,
                    serde_json::to_string(&graph.initial_ack_ref).map_err(|error| {
                        DbError::Message(format!("serialize founder initial ack ref: {error}"))
                    })?,
                    graph.initial_ack.bytes,
                    serde_json::to_string(&graph.initial_ack.prepared).map_err(|error| {
                        DbError::Message(format!("serialize founder initial ack object: {error}"))
                    })?,
                    serde_json::to_string(&LocalDeviceRegistrationState::Prepared).map_err(
                        |error| DbError::Message(format!(
                            "serialize registration journal state: {error}"
                        ))
                    )?,
                ],
            )
            .map_err(DbError::from)?;
            tx.execute(
                "INSERT INTO local_store_founder_graph \
                 (singleton, membership_graph) VALUES (1, ?1)",
                rusqlite::params![serde_json::to_string(
                    &DurableFounderMembershipJournal::from_graph(&graph.membership,)
                )
                .map_err(|error| DbError::Message(format!(
                    "serialize founder membership graph: {error}"
                )))?,],
            )
            .map_err(DbError::from)?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn complete_store_founder_graph(
        &self,
        expected_root: crate::sync::store_commit::StoreRootRef,
        expected_registration: StoreDeviceRegistrationRef,
        expected_initial_ack: StoreAckRef,
        expected_membership: FounderMembershipRefs,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let graph = load_local_store_founder_graph_on(&tx)?.ok_or_else(|| {
                DbError::Message("local Store founder graph is absent".to_string())
            })?;
            let root = crate::sync::store_commit::StoreRootRef {
                store_root_id: graph.root.value.descriptor.store_root_id(),
                store_root_hash: graph.root.value.object_hash(),
                object: graph.root.object.clone(),
            };
            let registration = StoreDeviceRegistrationRef::from_registration(
                &graph.registration.value,
                graph.registration.object.clone(),
            );
            if root != expected_root
                || registration != expected_registration
                || graph.initial_ack_ref != expected_initial_ack
                || match (&graph.membership, &expected_membership) {
                    (
                        DurableFounderMembership::MergeConcurrent {
                            entry_ref,
                            head_ref,
                            ..
                        },
                        FounderMembershipRefs::MergeConcurrent { entry, head },
                    ) => entry_ref != entry || head_ref != head,
                    (DurableFounderMembership::Serial, FounderMembershipRefs::Serial) => false,
                    _ => true,
                }
            {
                return Err(DbError::Message(
                    "verified founder graph differs from its durable exact references".to_string(),
                ));
            }
            let founder_authority =
                crate::sync::store_commit::StoreDeviceRegistrationActivation::Founder {
                    root: root.clone(),
                };
            let device_genesis = ResolvedStoreDeviceState::founder(
                &root,
                registration.clone(),
                &graph.root.value.descriptor.founder_pubkey,
                graph.root.value.descriptor.founder_grant.clone(),
                &graph.root.value.descriptor.founder_recovery,
            )
            .map_err(|error| DbError::Message(error.to_string()))?;
            let device_genesis_json = serde_json::to_string(&device_genesis).map_err(|error| {
                DbError::Message(format!("serialize Store device genesis state: {error}"))
            })?;
            let device_id = registration.device_id.to_string();
            let registration_hash = registration.registration_hash.to_string();
            match &graph.registration_state {
                LocalDeviceRegistrationState::Prepared => {
                    return Err(DbError::Message(
                        "founder registration and initial acknowledgement are not exact-created"
                            .to_string(),
                    ));
                }
                LocalDeviceRegistrationState::Created => {}
                LocalDeviceRegistrationState::Activated { authority } => {
                    if authority != &founder_authority {
                        return Err(DbError::Message(
                            "founder registration journal carries another activation authority"
                                .to_string(),
                        ));
                    }
                    let installed = load_store_root_authority_on(&tx)?;
                    let stored: Option<(String, String, String)> = tx
                        .query_row(
                            "SELECT registration_object, activation_authority, registration_hash \
                             FROM store_device_registration_activations WHERE device_id = ?1",
                            [&device_id],
                            |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?)),
                        )
                        .optional()
                        .map_err(DbError::from)?;
                    let ack: Option<String> = tx
                        .query_row(
                            "SELECT ack_ref FROM published_store_acks WHERE singleton = 1",
                            [],
                            |row| row.get(0),
                        )
                        .optional()
                        .map_err(DbError::from)?;
                    let stored_device_genesis: Option<String> = tx
                        .query_row(
                            "SELECT value FROM protocol_state WHERE key = ?1",
                            [STORE_DEVICE_GENESIS_STATE_KEY],
                            |row| row.get(0),
                        )
                        .optional()
                        .map_err(DbError::from)?;
                    if installed
                        .as_ref()
                        .map(|(reference, value)| (reference, value))
                        != Some((&root, &graph.root.value))
                        || stored
                            != Some((
                                serde_json::to_string(&registration).map_err(|error| {
                                    DbError::Message(format!(
                                        "serialize founder registration ref: {error}"
                                    ))
                                })?,
                                serde_json::to_string(&founder_authority).map_err(|error| {
                                    DbError::Message(format!(
                                        "serialize founder authority: {error}"
                                    ))
                                })?,
                                registration.registration_hash.to_string(),
                            ))
                        || ack
                            != Some(serde_json::to_string(&graph.initial_ack_ref).map_err(
                                |error| {
                                    DbError::Message(format!("serialize founder ack ref: {error}"))
                                },
                            )?)
                        || stored_device_genesis.as_deref() != Some(&device_genesis_json)
                    {
                        return Err(DbError::Message(
                            "activated founder journal differs from installed exact authority"
                                .to_string(),
                        ));
                    }
                    return Ok(());
                }
                LocalDeviceRegistrationState::Retired { .. } => {
                    return Err(DbError::Message(
                        "founder graph cannot complete through a retired local registration".into(),
                    ));
                }
            }
            install_store_root_authority_on(&tx, &root, &graph.root.bytes)?;
            let activation = serde_json::to_string(
                &crate::sync::store_commit::StoreDeviceRegistrationActivation::Founder {
                    root: root.clone(),
                },
            )
            .map_err(|error| {
                DbError::Message(format!(
                    "serialize founder registration activation: {error}"
                ))
            })?;
            let journal_state = serde_json::to_string(&LocalDeviceRegistrationState::Activated {
                authority: founder_authority,
            })
            .map_err(|error| {
                DbError::Message(format!("serialize founder registration journal: {error}"))
            })?;
            let updated = tx
                .execute(
                    "UPDATE local_store_device_registration SET state = ?1 \
                     WHERE singleton = 1 AND device_id = ?2 AND registration_hash = ?3 \
                       AND initial_ack_ref = ?4 AND state = ?5",
                    rusqlite::params![
                        journal_state,
                        &device_id,
                        &registration_hash,
                        serde_json::to_string(&graph.initial_ack_ref).map_err(|error| {
                            DbError::Message(format!("serialize founder initial ack ref: {error}"))
                        })?,
                        serde_json::to_string(&LocalDeviceRegistrationState::Created).map_err(
                            |error| DbError::Message(format!(
                                "serialize created journal state: {error}"
                            ))
                        )?,
                    ],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(
                    "founder registration journal did not activate".to_string(),
                ));
            }
            tx.execute(
                "INSERT INTO store_device_registration_activations \
                 (device_id, registration_hash, author_pubkey, device_signing_pubkey, \
                  registration_bytes, registration_object, activation_authority) \
                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
                rusqlite::params![
                    &device_id,
                    &registration_hash,
                    graph.registration.value.author_pubkey,
                    graph.registration.value.device_signing_pubkey,
                    graph.registration.bytes,
                    serde_json::to_string(&registration).map_err(|error| {
                        DbError::Message(format!("serialize founder registration ref: {error}"))
                    })?,
                    activation,
                ],
            )
            .map_err(DbError::from)?;
            tx.execute(
                "INSERT INTO published_store_acks \
                 (singleton, ack_ref, successor_slot) VALUES (1, ?1, ?2)",
                rusqlite::params![
                    serde_json::to_string(&graph.initial_ack_ref).map_err(|error| {
                        DbError::Message(format!("serialize founder initial ack ref: {error}"))
                    })?,
                    serde_json::to_string(&graph.initial_ack.value.successor.next_slot).map_err(
                        |error| DbError::Message(format!(
                            "serialize founder ack successor: {error}"
                        ))
                    )?,
                ],
            )
            .map_err(DbError::from)?;
            for (key, value) in [
                (LOCAL_DEVICE_ID_STATE_KEY, device_id),
                (STORE_DEVICE_GENESIS_STATE_KEY, device_genesis_json),
            ] {
                tx.execute(
                    "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
                     ON CONFLICT(key) DO UPDATE SET value = excluded.value",
                    (key, value),
                )
                .map_err(DbError::from)?;
            }
            match &graph.membership {
                DurableFounderMembership::MergeConcurrent { head_ref, .. } => {
                    tx.execute(
                        "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
                         ON CONFLICT(key) DO UPDATE SET value = excluded.value",
                        (
                            crate::sync::membership_ops::OWNER_PUBKEY_STATE_KEY,
                            &graph.root.value.descriptor.founder_pubkey,
                        ),
                    )
                    .map_err(DbError::from)?;
                    crate::sync::membership_ops::upsert_head_cursor_on(&tx, head_ref)?;
                }
                DurableFounderMembership::Serial => {
                    let authorization = SerialAuthorizationState::from_founder(
                        &root,
                        &graph.root.value,
                        &registration,
                        &graph.registration.value,
                    )
                    .map_err(|error| DbError::Message(error.to_string()))?;
                    Self::install_serial_root_authorization_on(
                        &tx,
                        &graph.root.value.descriptor.founder_pubkey,
                        &authorization,
                    )?;
                }
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn latest_local_store_device_registration(
        &self,
    ) -> Result<Option<DurableDeviceRegistration>, DbError> {
        self.read_local_store_device_registration(
            "SELECT device_id, registration_hash, registration_bytes, prepared_object, \
                    initial_ack_ref, initial_ack_bytes, initial_ack_prepared, state \
             FROM local_store_device_registration WHERE singleton = 1",
        )
        .await
    }

    pub async fn export_activated_device_continuation(
        &self,
        identity_signer: &crate::keys::UserKeypair,
    ) -> Result<crate::sync::restore_code::ActivatedContinuation, DbError> {
        let durable = self
            .latest_local_store_device_registration()
            .await?
            .ok_or_else(|| DbError::Message("local Store device registration is absent".into()))?;
        let LocalDeviceRegistrationState::Activated { authority } = durable.state else {
            return Err(DbError::Message(
                "local Store device registration is not activated".into(),
            ));
        };
        let root = self
            .local_store_root_ref()
            .await?
            .ok_or_else(DbError::missing_store_root_hash)?;
        let registration = StoreDeviceRegistration::parse_at(
            &durable.registration_bytes,
            &root,
            durable.device_id,
        )
        .map_err(|error| DbError::Message(format!("local Store registration: {error}")))?;
        let registration_ref = StoreDeviceRegistrationRef::from_registration(
            &registration,
            durable.prepared.reference().clone(),
        );
        if registration_ref.registration_hash != durable.registration_hash {
            return Err(DbError::Message(
                "local Store registration hash differs from its exact object".into(),
            ));
        }
        let device_signer = registration
            .device_signer(identity_signer)
            .map_err(|error| DbError::Message(format!("local device signer: {error}")))?;
        let latest_ack = self
            .latest_local_store_ack()
            .await?
            .ok_or_else(|| DbError::Message("local Store acknowledgement is absent".into()))?;
        Ok(crate::sync::restore_code::ActivatedContinuation {
            identity_signing_secret: hex::encode(identity_signer.to_keypair_bytes()),
            device_signing_secret: hex::encode(device_signer.to_keypair_bytes()),
            registration: registration_ref,
            registration_bytes: durable.registration_bytes,
            registration_prepared: durable.prepared,
            initial_ack: durable.initial_ack_ref,
            initial_ack_bytes: durable.initial_ack.bytes,
            initial_ack_prepared: durable.initial_ack.prepared,
            activation: authority,
            latest_ack: latest_ack.reference,
            latest_snapshot: self
                .latest_local_store_snapshot()
                .await?
                .map(|snapshot| snapshot.reference),
            latest_position: self.latest_local_store_position().await?,
        })
    }

    pub async fn install_activated_device_continuation(
        &self,
        continuation: crate::sync::restore_code::ActivatedContinuation,
        identity_signer: &crate::keys::UserKeypair,
        device_signer: &crate::keys::UserKeypair,
        ack_chain: Vec<(StoreAckRef, StoreAck)>,
        latest_snapshot: Option<(StoreSnapshotRef, SnapshotMeta)>,
    ) -> Result<(), DbError> {
        let root = self
            .local_store_root_ref()
            .await?
            .ok_or_else(DbError::missing_store_root_hash)?;
        let registration = StoreDeviceRegistration::parse_at(
            &continuation.registration_bytes,
            &root,
            continuation.registration.device_id,
        )
        .map_err(|error| DbError::Message(format!("continued Store registration: {error}")))?;
        continuation
            .registration
            .verify_registration(&registration)
            .map_err(|error| DbError::Message(error.to_string()))?;
        let derived_device = registration
            .device_signer(identity_signer)
            .map_err(|error| DbError::Message(format!("continued device signer: {error}")))?;
        if derived_device.to_keypair_bytes() != device_signer.to_keypair_bytes()
            || continuation.registration_prepared.reference() != &continuation.registration.object
            || continuation.initial_ack_prepared.reference() != &continuation.initial_ack.object
        {
            return Err(DbError::Message(
                "continued device keys or exact registration objects differ".into(),
            ));
        }
        let initial_ack = StoreAck::parse_at(
            &continuation.initial_ack_bytes,
            root.store_root_hash,
            &continuation.initial_ack,
            &registration,
        )
        .map_err(|error| DbError::Message(format!("continued initial ack: {error}")))?;
        let Some((latest_ack_ref, latest_ack)) = ack_chain.first() else {
            return Err(DbError::Message(
                "continued acknowledgement chain is empty".into(),
            ));
        };
        if initial_ack.revision != 1
            || initial_ack.predecessor.is_some()
            || latest_ack.author_registration != continuation.registration
            || latest_ack_ref != &continuation.latest_ack
            || ack_chain.last().map(|(reference, _)| reference) != Some(&continuation.initial_ack)
            || ack_chain.windows(2).any(|pair| {
                pair[0].1.predecessor.as_ref() != Some(&pair[1].0)
                    || pair[0].0.revision != pair[0].1.revision
                    || pair[1].0.revision != pair[1].1.revision
            })
        {
            return Err(DbError::Message(
                "continued acknowledgement chain differs from its exact authority".into(),
            ));
        }
        let latest_successor_slot = latest_ack.successor.next_slot.clone();
        match (&continuation.latest_snapshot, &latest_snapshot) {
            (None, None) => {}
            (Some(expected), Some((reference, meta))) if expected == reference => {
                let verified = crate::sync::store_snapshot::verify_store_snapshot_bytes(
                    &root,
                    &continuation.registration,
                    &registration,
                    reference,
                    &meta.to_bytes(),
                )
                .map_err(|error| DbError::Message(error.to_string()))?;
                if verified != *meta {
                    return Err(DbError::Message(
                        "continued snapshot changed during exact verification".into(),
                    ));
                }
            }
            _ => {
                return Err(DbError::Message(
                    "continued snapshot stream differs from its exact authority".into(),
                ));
            }
        }

        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let activated = load_activated_registration_on(&tx, &root, &continuation.registration)?;
            if activated != registration {
                return Err(DbError::Message(
                    "continued registration differs from activated Store state".into(),
                ));
            }
            let stored_authority: String = tx
                .query_row(
                    "SELECT activation_authority FROM store_device_registration_activations \
                     WHERE device_id = ?1 AND registration_hash = ?2",
                    (
                        continuation.registration.device_id.to_string(),
                        continuation.registration.registration_hash.to_string(),
                    ),
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let stored_authority: crate::sync::store_commit::StoreDeviceRegistrationActivation =
                serde_json::from_str(&stored_authority).map_err(|error| {
                    DbError::Message(format!("continued activation authority: {error}"))
                })?;
            if stored_authority != continuation.activation {
                return Err(DbError::Message(
                    "continued registration has another activation authority".into(),
                ));
            }
            if let Some(position) = &continuation.latest_position {
                let stream_id = match &position.coord {
                    StoreCommitCoord::MergeConcurrent { stream_id, .. } => stream_id.to_string(),
                    StoreCommitCoord::Serial { .. } => SERIAL_STREAM_ID.to_string(),
                };
                let restored_position = Self::latest_position_for_device_on(&tx, &stream_id)?;
                if restored_position.as_ref() != Some(position) {
                    return Err(DbError::Message(
                        "continued device position is absent from restored history".into(),
                    ));
                }
            }
            let existing_local: i64 = tx
                .query_row(
                    "SELECT COUNT(*) FROM local_store_device_registration",
                    [],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let existing_ack: i64 = tx
                .query_row("SELECT COUNT(*) FROM published_store_acks", [], |row| {
                    row.get(0)
                })
                .map_err(DbError::from)?;
            let existing_snapshot: i64 = tx
                .query_row("SELECT COUNT(*) FROM published_store_snapshot", [], |row| {
                    row.get(0)
                })
                .map_err(DbError::from)?;
            let existing_device: Option<String> = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [LOCAL_DEVICE_ID_STATE_KEY],
                    |row| row.get(0),
                )
                .optional()
                .map_err(DbError::from)?;
            let state = serde_json::to_string(&LocalDeviceRegistrationState::Activated {
                authority: continuation.activation.clone(),
            })
            .map_err(|error| DbError::Message(format!("continued activation: {error}")))?;
            let expected_local = (
                continuation.registration.device_id.to_string(),
                continuation.registration.registration_hash.to_string(),
                continuation.registration_bytes.clone(),
                serde_json::to_string(&continuation.registration_prepared).map_err(|error| {
                    DbError::Message(format!("continued registration object: {error}"))
                })?,
                serde_json::to_string(&continuation.initial_ack).map_err(|error| {
                    DbError::Message(format!("continued initial ack ref: {error}"))
                })?,
                continuation.initial_ack_bytes.clone(),
                serde_json::to_string(&continuation.initial_ack_prepared).map_err(|error| {
                    DbError::Message(format!("continued initial ack object: {error}"))
                })?,
                state,
            );
            match existing_local {
                0 => {
                    tx.execute(
                        "INSERT INTO local_store_device_registration \
                         (singleton, device_id, registration_hash, registration_bytes, \
                          prepared_object, initial_ack_ref, initial_ack_bytes, \
                          initial_ack_prepared, state) \
                         VALUES (1, ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
                        rusqlite::params![
                            expected_local.0,
                            expected_local.1,
                            expected_local.2,
                            expected_local.3,
                            expected_local.4,
                            expected_local.5,
                            expected_local.6,
                            expected_local.7,
                        ],
                    )
                    .map_err(DbError::from)?;
                }
                1 => {
                    let actual = tx
                        .query_row(
                            "SELECT device_id, registration_hash, registration_bytes, \
                             prepared_object, initial_ack_ref, initial_ack_bytes, \
                             initial_ack_prepared, state FROM local_store_device_registration \
                             WHERE singleton = 1",
                            [],
                            |row| {
                                Ok((
                                    row.get::<_, String>(0)?,
                                    row.get::<_, String>(1)?,
                                    row.get::<_, Vec<u8>>(2)?,
                                    row.get::<_, String>(3)?,
                                    row.get::<_, String>(4)?,
                                    row.get::<_, Vec<u8>>(5)?,
                                    row.get::<_, String>(6)?,
                                    row.get::<_, String>(7)?,
                                ))
                            },
                        )
                        .map_err(DbError::from)?;
                    if actual != expected_local {
                        return Err(DbError::Message(
                            "restored local device state differs from continuation".into(),
                        ));
                    }
                }
                _ => {
                    return Err(DbError::Message(
                        "restored database carries multiple local device journals".into(),
                    ));
                }
            }
            match existing_ack {
                0 => {}
                1 => {
                    let (stored_ref, stored_successor): (String, String) = tx
                        .query_row(
                            "SELECT ack_ref, successor_slot FROM published_store_acks \
                             WHERE singleton = 1",
                            [],
                            |row| Ok((row.get(0)?, row.get(1)?)),
                        )
                        .map_err(DbError::from)?;
                    let stored_ref: StoreAckRef =
                        serde_json::from_str(&stored_ref).map_err(|error| {
                            DbError::Message(format!("restored acknowledgement: {error}"))
                        })?;
                    let Some((_, stored_ack)) = ack_chain
                        .iter()
                        .find(|(reference, _)| reference == &stored_ref)
                    else {
                        return Err(DbError::Message(
                            "restored acknowledgement is outside the continuation chain".into(),
                        ));
                    };
                    if stored_successor
                        != serde_json::to_string(&stored_ack.successor.next_slot).map_err(
                            |error| DbError::Message(format!("restored ack successor: {error}")),
                        )?
                    {
                        return Err(DbError::Message(
                            "restored acknowledgement successor differs from its signature".into(),
                        ));
                    }
                }
                _ => {
                    return Err(DbError::Message(
                        "restored database carries multiple local acknowledgements".into(),
                    ));
                }
            }
            match (existing_snapshot, latest_snapshot.as_ref()) {
                (0, None) => {}
                (0, Some((reference, meta))) => {
                    tx.execute(
                        "INSERT INTO published_store_snapshot \
                         (singleton, snapshot_ref, successor_slot, meta_bytes) \
                         VALUES (1, ?1, ?2, ?3)",
                        rusqlite::params![
                            serde_json::to_string(reference).map_err(|error| {
                                DbError::Message(format!(
                                    "serialize continued Store snapshot ref: {error}"
                                ))
                            })?,
                            serde_json::to_string(&meta.successor.next_slot).map_err(|error| {
                                DbError::Message(format!(
                                    "serialize continued Store snapshot successor: {error}"
                                ))
                            })?,
                            meta.to_bytes(),
                        ],
                    )
                    .map_err(DbError::from)?;
                }
                (1, Some((reference, meta))) => {
                    let actual: (String, String, Vec<u8>) = tx
                        .query_row(
                            "SELECT snapshot_ref, successor_slot, meta_bytes \
                             FROM published_store_snapshot WHERE singleton = 1",
                            [],
                            |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?)),
                        )
                        .map_err(DbError::from)?;
                    let expected = (
                        serde_json::to_string(reference).map_err(|error| {
                            DbError::Message(format!(
                                "serialize continued Store snapshot ref: {error}"
                            ))
                        })?,
                        serde_json::to_string(&meta.successor.next_slot).map_err(|error| {
                            DbError::Message(format!(
                                "serialize continued Store snapshot successor: {error}"
                            ))
                        })?,
                        meta.to_bytes(),
                    );
                    if actual != expected {
                        return Err(DbError::Message(
                            "restored local snapshot stream differs from continuation".into(),
                        ));
                    }
                }
                (1, None) => {
                    return Err(DbError::Message(
                        "restored database carries a snapshot outside the continuation".into(),
                    ));
                }
                _ => {
                    return Err(DbError::Message(
                        "restored database carries multiple local snapshots".into(),
                    ));
                }
            }
            let latest_ref = serde_json::to_string(&continuation.latest_ack)
                .map_err(|error| DbError::Message(format!("continued latest ack: {error}")))?;
            let latest_successor = serde_json::to_string(&latest_successor_slot)
                .map_err(|error| DbError::Message(format!("continued ack successor: {error}")))?;
            if existing_ack == 0 {
                tx.execute(
                    "INSERT INTO published_store_acks (singleton, ack_ref, successor_slot) \
                     VALUES (1, ?1, ?2)",
                    (&latest_ref, &latest_successor),
                )
                .map_err(DbError::from)?;
            } else {
                tx.execute(
                    "UPDATE published_store_acks SET ack_ref = ?1, successor_slot = ?2 \
                     WHERE singleton = 1",
                    (&latest_ref, &latest_successor),
                )
                .map_err(DbError::from)?;
            }
            match existing_device {
                Some(existing) if existing == continuation.registration.device_id.to_string() => {}
                Some(_) => {
                    return Err(DbError::Message(
                        "restored local device id differs from continuation".into(),
                    ));
                }
                None => {
                    tx.execute(
                        "INSERT INTO protocol_state (key, value) VALUES (?1, ?2)",
                        (
                            LOCAL_DEVICE_ID_STATE_KEY,
                            continuation.registration.device_id.to_string(),
                        ),
                    )
                    .map_err(DbError::from)?;
                }
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn complete_merge_owner_recovery(
        &self,
        commit: StoreBatchCommit,
        commit_ref: StoreBatchCommitRef,
        registration: StoreDeviceRegistration,
        authority: crate::sync::store_commit::StoreDeviceRegistrationActivation,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            Self::record_activated_store_device_registrations_on(
                &tx,
                &commit,
                &[(registration, authority)],
            )?;
            Self::record_materialized_commit_on(&tx, &commit, &commit_ref)?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn complete_serial_owner_recovery(
        &self,
        commit: StoreBatchCommit,
        commit_ref: StoreBatchCommitRef,
        registration: StoreDeviceRegistration,
        authority: crate::sync::store_commit::StoreDeviceRegistrationActivation,
        authorization: SerialAuthorizationState,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            Self::record_activated_store_device_registrations_on(
                &tx,
                &commit,
                &[(registration, authority)],
            )?;
            Self::record_materialized_serial_commit_on(&tx, &commit, &commit_ref, &authorization)?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn stage_local_store_device_registration(
        &self,
        registration: ExactProtocolObject<StoreDeviceRegistration>,
        initial_ack_ref: StoreAckRef,
        initial_ack: ExactProtocolObject<StoreAck>,
    ) -> Result<(), DbError> {
        let registration_ref = StoreDeviceRegistrationRef::from_registration(
            &registration.value,
            registration.object.clone(),
        );
        if registration.value.to_bytes() != registration.bytes
            || registration.object != *registration.prepared.reference()
            || initial_ack.value.to_bytes() != initial_ack.bytes
            || initial_ack.object != *initial_ack.prepared.reference()
            || initial_ack_ref.object != initial_ack.object
            || initial_ack_ref.ack_hash != initial_ack.value.ack_hash()
            || initial_ack_ref.revision != initial_ack.value.revision
            || initial_ack.value.author_registration != registration_ref
        {
            return Err(DbError::Message(
                "local registration staging graph contains mismatched exact objects".to_string(),
            ));
        }
        self.call(move |conn| {
            let root = required_store_root_authority_on(conn)?;
            if registration.value.store_root != root {
                return Err(DbError::Message(
                    "local registration staging graph belongs to another Store root".to_string(),
                ));
            }
            let prepared = serde_json::to_string(&registration.prepared).map_err(|error| {
                DbError::Message(format!("serialize prepared local registration: {error}"))
            })?;
            let ack_ref = serde_json::to_string(&initial_ack_ref).map_err(|error| {
                DbError::Message(format!("serialize local initial ack ref: {error}"))
            })?;
            let ack_prepared = serde_json::to_string(&initial_ack.prepared).map_err(|error| {
                DbError::Message(format!("serialize prepared local initial ack: {error}"))
            })?;
            let existing: Option<PreparedLocalDeviceRegistrationRow> = conn
                .query_row(
                    "SELECT device_id, registration_hash, registration_bytes, prepared_object, \
                            initial_ack_ref, initial_ack_bytes, initial_ack_prepared \
                     FROM local_store_device_registration WHERE singleton = 1",
                    [],
                    |row| {
                        Ok((
                            row.get(0)?,
                            row.get(1)?,
                            row.get(2)?,
                            row.get(3)?,
                            row.get(4)?,
                            row.get(5)?,
                            row.get(6)?,
                        ))
                    },
                )
                .optional()
                .map_err(DbError::from)?;
            let expected = (
                registration_ref.device_id.to_string(),
                registration_ref.registration_hash.to_string(),
                registration.bytes.clone(),
                prepared.clone(),
                ack_ref.clone(),
                initial_ack.bytes.clone(),
                ack_prepared.clone(),
            );
            match existing {
                Some(existing) if existing == expected => Ok(()),
                Some(_) => Err(DbError::Message(
                    "local registration journal already owns different exact objects".to_string(),
                )),
                None => conn
                    .execute(
                        "INSERT INTO local_store_device_registration \
                         (singleton, device_id, registration_hash, registration_bytes, \
                          prepared_object, initial_ack_ref, initial_ack_bytes, \
                          initial_ack_prepared, state) \
                         VALUES (1, ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
                        rusqlite::params![
                            expected.0,
                            expected.1,
                            expected.2,
                            expected.3,
                            expected.4,
                            expected.5,
                            expected.6,
                            serde_json::to_string(&LocalDeviceRegistrationState::Prepared)
                                .map_err(|error| DbError::Message(format!(
                                    "serialize local registration state: {error}"
                                )))?,
                        ],
                    )
                    .map(|_| ())
                    .map_err(DbError::from),
            }
        })
        .await
    }

    pub(crate) async fn install_existing_local_founder_device(
        &self,
        registration: ExactProtocolObject<StoreDeviceRegistration>,
        initial_ack_ref: StoreAckRef,
        initial_ack: ExactProtocolObject<StoreAck>,
    ) -> Result<(), DbError> {
        let registration_ref = StoreDeviceRegistrationRef::from_registration(
            &registration.value,
            registration.object.clone(),
        );
        if registration.value.to_bytes() != registration.bytes
            || registration.object != *registration.prepared.reference()
            || initial_ack.value.to_bytes() != initial_ack.bytes
            || initial_ack.object != *initial_ack.prepared.reference()
            || initial_ack_ref.object != initial_ack.object
            || initial_ack_ref.ack_hash != initial_ack.value.ack_hash()
            || initial_ack_ref.revision != 1
            || initial_ack.value.revision != 1
            || initial_ack.value.predecessor.is_some()
            || initial_ack.value.author_registration != registration_ref
        {
            return Err(DbError::Message(
                "existing founder device graph contains mismatched exact objects".to_string(),
            ));
        }
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let root = required_store_root_authority_on(&tx)?;
            let crate::sync::store_commit::StoreDeviceRegistrationOrigin::Founder { .. } =
                &registration.value.origin
            else {
                return Err(DbError::Message(
                    "existing local founder device has a non-founder origin".to_string(),
                ));
            };
            if registration.value.store_root != root {
                return Err(DbError::Message(
                    "existing local founder device belongs to another Store root".to_string(),
                ));
            }
            let activated = load_activated_registration_on(&tx, &root, &registration_ref)?;
            if activated != registration.value {
                return Err(DbError::Message(
                    "existing local founder device differs from its installed activation"
                        .to_string(),
                ));
            }
            let authority = crate::sync::store_commit::StoreDeviceRegistrationActivation::Founder {
                root: root.clone(),
            };
            let expected = (
                registration_ref.device_id.to_string(),
                registration_ref.registration_hash.to_string(),
                registration.bytes.clone(),
                serde_json::to_string(&registration.prepared).map_err(|error| {
                    DbError::Message(format!("serialize existing founder registration: {error}"))
                })?,
                serde_json::to_string(&initial_ack_ref).map_err(|error| {
                    DbError::Message(format!("serialize existing founder ack ref: {error}"))
                })?,
                initial_ack.bytes.clone(),
                serde_json::to_string(&initial_ack.prepared).map_err(|error| {
                    DbError::Message(format!("serialize existing founder ack object: {error}"))
                })?,
                serde_json::to_string(&LocalDeviceRegistrationState::Activated { authority })
                    .map_err(|error| {
                        DbError::Message(format!(
                            "serialize existing founder registration state: {error}"
                        ))
                    })?,
            );
            tx.execute(
                "INSERT INTO local_store_device_registration
                 (singleton, device_id, registration_hash, registration_bytes,
                  prepared_object, initial_ack_ref, initial_ack_bytes,
                  initial_ack_prepared, state)
                 VALUES (1, ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
                 ON CONFLICT(singleton) DO NOTHING",
                rusqlite::params![
                    &expected.0,
                    &expected.1,
                    &expected.2,
                    &expected.3,
                    &expected.4,
                    &expected.5,
                    &expected.6,
                    &expected.7,
                ],
            )
            .map_err(DbError::from)?;
            let stored: LocalDeviceRegistrationJournalRow = tx
                .query_row(
                    "SELECT device_id, registration_hash, registration_bytes, prepared_object,
                            initial_ack_ref, initial_ack_bytes, initial_ack_prepared, state
                     FROM local_store_device_registration WHERE singleton = 1",
                    [],
                    |row| {
                        Ok((
                            row.get(0)?,
                            row.get(1)?,
                            row.get(2)?,
                            row.get(3)?,
                            row.get(4)?,
                            row.get(5)?,
                            row.get(6)?,
                            row.get(7)?,
                        ))
                    },
                )
                .map_err(DbError::from)?;
            if stored != expected {
                return Err(DbError::Message(
                    "existing local founder journal owns different exact objects".to_string(),
                ));
            }
            let ack_ref = serde_json::to_string(&initial_ack_ref).map_err(|error| {
                DbError::Message(format!("serialize existing founder ack ref: {error}"))
            })?;
            let successor =
                serde_json::to_string(&initial_ack.value.successor.next_slot).map_err(|error| {
                    DbError::Message(format!("serialize existing founder ack successor: {error}"))
                })?;
            tx.execute(
                "INSERT INTO published_store_acks (singleton, ack_ref, successor_slot)
                 VALUES (1, ?1, ?2) ON CONFLICT(singleton) DO NOTHING",
                (&ack_ref, &successor),
            )
            .map_err(DbError::from)?;
            let stored_ack: (String, String) = tx
                .query_row(
                    "SELECT ack_ref, successor_slot FROM published_store_acks WHERE singleton = 1",
                    [],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            if stored_ack != (ack_ref, successor) {
                return Err(DbError::Message(
                    "existing local founder acknowledgement differs from exact cloud state"
                        .to_string(),
                ));
            }
            tx.execute(
                "INSERT INTO protocol_state (key, value) VALUES (?1, ?2)
                 ON CONFLICT(key) DO NOTHING",
                (LOCAL_DEVICE_ID_STATE_KEY, &expected.0),
            )
            .map_err(DbError::from)?;
            let stored_device_id: String = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [LOCAL_DEVICE_ID_STATE_KEY],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            if stored_device_id != expected.0 {
                return Err(DbError::Message(
                    "existing local founder device id conflicts with installed state".to_string(),
                ));
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn stage_owner_recovery_registration(
        &self,
        registration: ExactProtocolObject<StoreDeviceRegistration>,
        initial_ack_ref: StoreAckRef,
        initial_ack: ExactProtocolObject<StoreAck>,
        activation: crate::sync::store_commit::StoreDeviceRegistrationActivation,
    ) -> Result<bool, DbError> {
        let (
            crate::sync::store_commit::StoreDeviceRegistrationOrigin::Recovery {
                recovery_id: origin_recovery_id,
                recovery_slot,
                owner_grant,
                ..
            },
            crate::sync::store_commit::StoreDeviceRegistrationActivation::Recovery {
                recovery_id: activation_recovery_id,
                node,
            },
        ) = (&registration.value.origin, &activation)
        else {
            return Err(DbError::Message(
                "Owner recovery journal requires one Recovery registration authority".into(),
            ));
        };
        if origin_recovery_id != activation_recovery_id
            || node.object.slot() != recovery_slot
            || node.owner_grant != *owner_grant
        {
            return Err(DbError::Message(
                "Owner recovery registration differs from its activation authority".into(),
            ));
        }
        let registration_ref = StoreDeviceRegistrationRef::from_registration(
            &registration.value,
            registration.object.clone(),
        );
        if registration.value.to_bytes() != registration.bytes
            || registration.object != *registration.prepared.reference()
            || initial_ack.value.to_bytes() != initial_ack.bytes
            || initial_ack.object != *initial_ack.prepared.reference()
            || initial_ack_ref.object != initial_ack.object
            || initial_ack_ref.ack_hash != initial_ack.value.ack_hash()
            || initial_ack_ref.revision != 1
            || initial_ack.value.predecessor.is_some()
            || initial_ack.value.author_registration != registration_ref
        {
            return Err(DbError::Message(
                "Owner recovery registration graph contains mismatched exact objects".into(),
            ));
        }
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let root = required_store_root_authority_on(&tx)?;
            if registration.value.store_root != root {
                return Err(DbError::Message(
                    "Owner recovery registration belongs to another Store root".into(),
                ));
            }
            let exact_registration_ref =
                serde_json::to_string(&registration_ref).map_err(|error| {
                    DbError::Message(format!("Owner recovery registration ref: {error}"))
                })?;
            let exact_activation = serde_json::to_string(&activation).map_err(|error| {
                DbError::Message(format!("Owner recovery activation authority: {error}"))
            })?;
            let activated = tx
                .query_row(
                    "SELECT registration_hash, registration_bytes, registration_object, \
                            activation_authority \
                     FROM store_device_registration_activations WHERE device_id = ?1",
                    [registration_ref.device_id.to_string()],
                    |row| {
                        Ok((
                            row.get::<_, String>(0)?,
                            row.get::<_, Vec<u8>>(1)?,
                            row.get::<_, String>(2)?,
                            row.get::<_, String>(3)?,
                        ))
                    },
                )
                .optional()
                .map_err(DbError::from)?;
            let activated = match activated {
                None => false,
                Some(existing)
                    if existing
                        == (
                            registration_ref.registration_hash.to_string(),
                            registration.bytes.clone(),
                            exact_registration_ref,
                            exact_activation,
                        ) =>
                {
                    true
                }
                Some(_) => {
                    return Err(DbError::Message(
                        "Owner recovery device already has different exact activation authority"
                            .into(),
                    ));
                }
            };
            tx.execute("DELETE FROM local_store_device_registration", [])
                .map_err(DbError::from)?;
            tx.execute("DELETE FROM published_store_acks", [])
                .map_err(DbError::from)?;
            tx.execute(
                "DELETE FROM protocol_state WHERE key = ?1",
                [LOCAL_DEVICE_ID_STATE_KEY],
            )
            .map_err(DbError::from)?;
            tx.execute(
                "INSERT INTO local_store_device_registration \
                 (singleton, device_id, registration_hash, registration_bytes, \
                  prepared_object, initial_ack_ref, initial_ack_bytes, \
                  initial_ack_prepared, state) \
                 VALUES (1, ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
                rusqlite::params![
                    registration_ref.device_id.to_string(),
                    registration_ref.registration_hash.to_string(),
                    registration.bytes,
                    serde_json::to_string(&registration.prepared).map_err(|error| {
                        DbError::Message(format!("Owner recovery registration object: {error}"))
                    })?,
                    serde_json::to_string(&initial_ack_ref).map_err(|error| {
                        DbError::Message(format!("Owner recovery initial ack ref: {error}"))
                    })?,
                    initial_ack.bytes,
                    serde_json::to_string(&initial_ack.prepared).map_err(|error| {
                        DbError::Message(format!("Owner recovery initial ack object: {error}"))
                    })?,
                    serde_json::to_string(&if activated {
                        LocalDeviceRegistrationState::Activated {
                            authority: activation,
                        }
                    } else {
                        LocalDeviceRegistrationState::Prepared
                    })
                    .map_err(|error| DbError::Message(format!(
                        "Owner recovery journal state: {error}"
                    )))?,
                ],
            )
            .map_err(DbError::from)?;
            if activated {
                tx.execute(
                    "INSERT INTO protocol_state (key, value) VALUES (?1, ?2)",
                    (
                        LOCAL_DEVICE_ID_STATE_KEY,
                        registration_ref.device_id.to_string(),
                    ),
                )
                .map_err(DbError::from)?;
                tx.execute(
                    "INSERT INTO published_store_acks (singleton, ack_ref, successor_slot) \
                     VALUES (1, ?1, ?2)",
                    rusqlite::params![
                        serde_json::to_string(&initial_ack_ref).map_err(|error| {
                            DbError::Message(format!(
                                "Owner recovery published initial ack ref: {error}"
                            ))
                        })?,
                        serde_json::to_string(&initial_ack.value.successor.next_slot).map_err(
                            |error| DbError::Message(format!(
                                "Owner recovery initial ack successor: {error}"
                            ))
                        )?,
                    ],
                )
                .map_err(DbError::from)?;
            }
            tx.commit().map_err(DbError::from)?;
            Ok(activated)
        })
        .await
    }

    pub(crate) async fn stage_local_store_device_retirement(
        &self,
        payload: Vec<u8>,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let existing: Option<(Vec<u8>, i64)> = conn
                .query_row(
                    "SELECT payload, published FROM local_store_device_retirement WHERE singleton = 1",
                    [],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .optional()
                .map_err(DbError::from)?;
            match existing {
                Some((existing, _)) if existing == payload => Ok(()),
                Some(_) => Err(DbError::Message(
                    "local Store device retirement already owns different exact objects".into(),
                )),
                None => conn
                    .execute(
                        "INSERT INTO local_store_device_retirement (singleton, payload, published) VALUES (1, ?1, 0)",
                        [payload],
                    )
                    .map(|_| ())
                    .map_err(DbError::from),
            }
        })
        .await
    }

    pub(crate) async fn local_store_device_retirement(
        &self,
    ) -> Result<Option<(Vec<u8>, bool)>, DbError> {
        self.call(|conn| {
            conn.query_row(
                "SELECT payload, published FROM local_store_device_retirement WHERE singleton = 1",
                [],
                |row| Ok((row.get::<_, Vec<u8>>(0)?, row.get::<_, i64>(1)? != 0)),
            )
            .optional()
            .map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn complete_local_store_device_retirement(
        &self,
        expected_payload: Vec<u8>,
        retirement: crate::sync::store_commit::StoreDeviceSelfRetirementRef,
        commit: StoreBatchCommit,
        commit_ref: StoreBatchCommitRef,
        serial_authorization: Option<SerialAuthorizationState>,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let (payload, published): (Vec<u8>, i64) = tx
                .query_row(
                    "SELECT payload, published FROM local_store_device_retirement WHERE singleton = 1",
                    [],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            if payload != expected_payload {
                return Err(DbError::Message(
                    "local Store device retirement changed exact ownership".into(),
                ));
            }
            if published == 1 {
                return Ok(());
            }
            match serial_authorization {
                Some(authorization) => Self::record_materialized_serial_commit_on(
                    &tx,
                    &commit,
                    &commit_ref,
                    &authorization,
                )?,
                None => Self::record_materialized_commit_on(&tx, &commit, &commit_ref)?,
            }
            let state: String = tx
                .query_row(
                    "SELECT state FROM local_store_device_registration WHERE singleton = 1",
                    [],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let LocalDeviceRegistrationState::Activated { authority } =
                serde_json::from_str(&state).map_err(|error| {
                    DbError::Message(format!("parse active registration journal: {error}"))
                })?
            else {
                return Err(DbError::Message(
                    "only an activated local registration can retire".into(),
                ));
            };
            tx.execute(
                "UPDATE local_store_device_registration SET state = ?1 WHERE singleton = 1",
                [serde_json::to_string(&LocalDeviceRegistrationState::Retired {
                    authority,
                    retirement,
                })
                .map_err(|error| DbError::Message(format!("serialize retired registration: {error}")))?],
            )
            .map_err(DbError::from)?;
            tx.execute(
                "UPDATE local_store_device_retirement SET published = 1 WHERE singleton = 1 AND published = 0",
                [],
            )
            .map_err(DbError::from)?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn oldest_unpublished_store_device_registration(
        &self,
    ) -> Result<Option<DurableDeviceRegistration>, DbError> {
        self.read_local_store_device_registration(
            "SELECT device_id, registration_hash, registration_bytes, prepared_object, \
                    initial_ack_ref, initial_ack_bytes, initial_ack_prepared, state \
             FROM local_store_device_registration WHERE singleton = 1 AND state = '\"prepared\"'",
        )
        .await
    }

    async fn read_local_store_device_registration(
        &self,
        sql: &'static str,
    ) -> Result<Option<DurableDeviceRegistration>, DbError> {
        self.call(move |conn| {
            conn.query_row(sql, [], |row| {
                Ok((
                    row.get::<_, String>(0)?,
                    row.get::<_, String>(1)?,
                    row.get::<_, Vec<u8>>(2)?,
                    row.get::<_, String>(3)?,
                    row.get::<_, String>(4)?,
                    row.get::<_, Vec<u8>>(5)?,
                    row.get::<_, String>(6)?,
                    row.get::<_, String>(7)?,
                ))
            })
            .optional()
            .map_err(DbError::from)?
            .map(
                |(device_id, hash, bytes, prepared, ack_ref, ack_bytes, ack_prepared, state)| {
                    let device_id = device_id.parse().map_err(|error| {
                        DbError::Message(format!("local Store device id: {error}"))
                    })?;
                    let prepared: PreparedExactObject =
                        serde_json::from_str(&prepared).map_err(|error| {
                            DbError::Message(format!(
                                "local Store device registration prepared object: {error}"
                            ))
                        })?;
                    let registration = StoreDeviceRegistration::parse_at(
                        &bytes,
                        &required_store_root_authority_on(conn)?,
                        device_id,
                    )
                    .map_err(|error| {
                        DbError::Message(format!("local Store device registration: {error}"))
                    })?;
                    let initial_ack_ref: StoreAckRef =
                        serde_json::from_str(&ack_ref).map_err(|error| {
                            DbError::Message(format!(
                                "local Store initial acknowledgement ref: {error}"
                            ))
                        })?;
                    let initial_ack_value = StoreAck::parse_at(
                        &ack_bytes,
                        registration.store_root.store_root_hash,
                        &initial_ack_ref,
                        &registration,
                    )
                    .map_err(|error| {
                        DbError::Message(format!("local Store initial acknowledgement: {error}"))
                    })?;
                    let initial_ack_prepared: PreparedExactObject =
                        serde_json::from_str(&ack_prepared).map_err(|error| {
                            DbError::Message(format!("local Store initial ack object: {error}"))
                        })?;
                    Ok(DurableDeviceRegistration {
                        device_id,
                        registration_hash: hash.parse().map_err(|error| {
                            DbError::Message(format!(
                                "local Store device registration hash: {error}"
                            ))
                        })?,
                        registration_bytes: bytes,
                        prepared,
                        initial_ack_ref,
                        initial_ack: ExactProtocolObject {
                            value: initial_ack_value,
                            bytes: ack_bytes,
                            object: initial_ack_prepared.reference().clone(),
                            prepared: initial_ack_prepared,
                        },
                        state: serde_json::from_str(&state).map_err(|error| {
                            DbError::Message(format!(
                                "local Store registration journal state: {error}"
                            ))
                        })?,
                    })
                },
            )
            .transpose()
        })
        .await
    }

    pub(crate) async fn mark_local_store_device_registration_created(
        &self,
        registration: ExactProtocolObject<StoreDeviceRegistration>,
        initial_ack: StoreAckRef,
        initial_ack_object: ExactProtocolObject<StoreAck>,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let registration_ref = StoreDeviceRegistrationRef::from_registration(
                &registration.value,
                registration.object.clone(),
            );
            if registration_ref.object != *registration.prepared.reference()
                || initial_ack.object != *initial_ack_object.prepared.reference()
            {
                return Err(DbError::Message(
                    "created registration refs differ from their prepared objects".to_string(),
                ));
            }
            let durable: (Vec<u8>, String, String, Vec<u8>, String, String) = tx
                .query_row(
                    "SELECT registration_bytes, prepared_object, initial_ack_ref, \
                            initial_ack_bytes, initial_ack_prepared, state \
                     FROM local_store_device_registration \
                     WHERE singleton = 1 AND device_id = ?1 AND registration_hash = ?2",
                    (
                        registration_ref.device_id.to_string(),
                        registration_ref.registration_hash.to_string(),
                    ),
                    |row| {
                        Ok((
                            row.get(0)?,
                            row.get(1)?,
                            row.get(2)?,
                            row.get(3)?,
                            row.get(4)?,
                            row.get(5)?,
                        ))
                    },
                )
                .map_err(DbError::from)?;
            let stored_registration_prepared: PreparedExactObject =
                serde_json::from_str(&durable.1).map_err(|error| {
                    DbError::Message(format!("stored registration object: {error}"))
                })?;
            let stored_ack_ref: StoreAckRef = serde_json::from_str(&durable.2)
                .map_err(|error| DbError::Message(format!("stored initial ack ref: {error}")))?;
            let stored_ack_prepared: PreparedExactObject = serde_json::from_str(&durable.4)
                .map_err(|error| DbError::Message(format!("stored initial ack object: {error}")))?;
            if registration_ref.object != *stored_registration_prepared.reference()
                || registration.prepared.reference() != stored_registration_prepared.reference()
                || registration.prepared.stored_bytes()
                    != stored_registration_prepared.stored_bytes()
                || registration.bytes != durable.0
                || initial_ack != stored_ack_ref
                || initial_ack_object.prepared.reference() != stored_ack_prepared.reference()
                || initial_ack_object.prepared.stored_bytes() != stored_ack_prepared.stored_bytes()
                || initial_ack_object.bytes != durable.3
            {
                return Err(DbError::Message(
                    "created registration differs from its complete durable exact objects"
                        .to_string(),
                ));
            }
            let prepared = serde_json::to_string(&LocalDeviceRegistrationState::Prepared).map_err(
                |error| DbError::Message(format!("serialize prepared journal: {error}")),
            )?;
            let created = serde_json::to_string(&LocalDeviceRegistrationState::Created)
                .map_err(|error| DbError::Message(format!("serialize created journal: {error}")))?;
            let updated = tx
                .execute(
                    "UPDATE local_store_device_registration SET state = ?1 \
                     WHERE singleton = 1 AND device_id = ?2 AND registration_hash = ?3 \
                       AND initial_ack_ref = ?4 AND state = ?5",
                    rusqlite::params![
                        created,
                        registration_ref.device_id.to_string(),
                        registration_ref.registration_hash.to_string(),
                        serde_json::to_string(&initial_ack).map_err(|error| {
                            DbError::Message(format!("serialize initial ack ref: {error}"))
                        })?,
                        prepared,
                    ],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                let already: Option<String> = tx
                    .query_row(
                        "SELECT state FROM local_store_device_registration \
                         WHERE singleton = 1 AND device_id = ?1 AND registration_hash = ?2",
                        (
                            registration_ref.device_id.to_string(),
                            registration_ref.registration_hash.to_string(),
                        ),
                        |row| row.get(0),
                    )
                    .optional()
                    .map_err(DbError::from)?;
                if already.as_deref() != Some(created.as_str()) {
                    return Err(DbError::Message(
                        "local registration journal is absent or differs from the created object"
                            .to_string(),
                    ));
                }
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    fn required_store_root_hash_on(conn: &Connection) -> Result<ObjectHash, DbError> {
        load_store_root_authority_on(conn)?
            .map(|(reference, _)| reference.store_root_hash)
            .ok_or_else(DbError::missing_store_root_hash)
    }

    #[cfg(test)]
    pub(crate) async fn required_store_root_hash(&self) -> Result<ObjectHash, DbError> {
        self.call(Self::required_store_root_hash_on).await
    }

    pub async fn get_protocol_state(&self, key: &str) -> Result<Option<String>, DbError> {
        let key = key.to_string();
        self.call(move |conn| {
            conn.query_row(
                "SELECT value FROM protocol_state WHERE key = ?1",
                [key],
                |r| r.get::<_, String>(0),
            )
            .optional()
            .map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn begin_store_creation_attempt(
        &self,
        initialized: crate::sync::store_protocol_root::StoreCreationAttempt,
    ) -> Result<crate::sync::store_protocol_root::StoreCreationAttempt, DbError> {
        let value = serde_json::to_string(&initialized).map_err(|error| {
            DbError::Message(format!("serialize Store creation attempt: {error}"))
        })?;
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            tx.execute(
                "INSERT OR IGNORE INTO protocol_state (key, value) VALUES (?1, ?2)",
                (
                    crate::sync::store_protocol_root::STORE_CREATION_ATTEMPT_STATE_KEY,
                    &value,
                ),
            )
            .map_err(DbError::from)?;
            let actual: String = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [crate::sync::store_protocol_root::STORE_CREATION_ATTEMPT_STATE_KEY],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            tx.commit().map_err(DbError::from)?;
            serde_json::from_str(&actual)
                .map_err(|error| DbError::Message(format!("parse Store creation attempt: {error}")))
        })
        .await
    }

    pub(crate) async fn load_store_creation_attempt(
        &self,
    ) -> Result<Option<crate::sync::store_protocol_root::StoreCreationAttempt>, DbError> {
        self.call(move |conn| {
            let value = conn
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [crate::sync::store_protocol_root::STORE_CREATION_ATTEMPT_STATE_KEY],
                    |row| row.get::<_, String>(0),
                )
                .optional()
                .map_err(DbError::from)?;
            value
                .map(|value| {
                    serde_json::from_str(&value).map_err(|error| {
                        DbError::Message(format!("parse Store creation attempt: {error}"))
                    })
                })
                .transpose()
        })
        .await
    }

    pub(crate) async fn advance_store_creation_attempt(
        &self,
        previous: crate::sync::store_protocol_root::StoreCreationAttempt,
        next: crate::sync::store_protocol_root::StoreCreationAttempt,
    ) -> Result<(), DbError> {
        let previous = serde_json::to_string(&previous).map_err(|error| {
            DbError::Message(format!("serialize Store creation predecessor: {error}"))
        })?;
        let next = serde_json::to_string(&next).map_err(|error| {
            DbError::Message(format!("serialize Store creation successor: {error}"))
        })?;
        self.call(move |conn| {
            let changed = conn
                .execute(
                    "UPDATE protocol_state SET value = ?1 WHERE key = ?2 AND value = ?3",
                    (
                        &next,
                        crate::sync::store_protocol_root::STORE_CREATION_ATTEMPT_STATE_KEY,
                        &previous,
                    ),
                )
                .map_err(DbError::from)?;
            if changed != 1 {
                return Err(DbError::Message(
                    "Store creation attempt advance lost its exact predecessor".to_string(),
                ));
            }
            Ok(())
        })
        .await
    }

    pub(crate) async fn load_provider_probe_journal(
        &self,
        probe_id: crate::sync::provider::ProviderProbeId,
    ) -> Result<Option<crate::sync::provider::ProviderProbeJournalRecord>, DbError> {
        let key = format!("provider_probe/{}", hex::encode(probe_id.as_bytes()));
        self.call(move |conn| {
            let value = conn
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [key],
                    |row| row.get::<_, String>(0),
                )
                .optional()
                .map_err(DbError::from)?;
            value
                .map(|value| {
                    serde_json::from_str(&value).map_err(|error| {
                        DbError::Message(format!("parse provider probe journal: {error}"))
                    })
                })
                .transpose()
        })
        .await
    }

    pub(crate) async fn begin_provider_probe_journal(
        &self,
        prepared: crate::sync::provider::ProviderProbeJournalRecord,
    ) -> Result<crate::sync::provider::ProviderProbeJournalRecord, DbError> {
        prepared.validate_begin().map_err(|error| {
            DbError::Message(format!("invalid provider probe journal beginning: {error}"))
        })?;
        let key = format!(
            "provider_probe/{}",
            hex::encode(prepared.probe_id().as_bytes())
        );
        let value = serde_json::to_string(&prepared).map_err(|error| {
            DbError::Message(format!("serialize provider probe journal: {error}"))
        })?;
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            tx.execute(
                "INSERT OR IGNORE INTO protocol_state (key, value) VALUES (?1, ?2)",
                (&key, &value),
            )
            .map_err(DbError::from)?;
            let actual: String = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [&key],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            tx.commit().map_err(DbError::from)?;
            serde_json::from_str(&actual)
                .map_err(|error| DbError::Message(format!("parse provider probe journal: {error}")))
        })
        .await
    }

    pub(crate) async fn advance_provider_probe_journal(
        &self,
        previous: crate::sync::provider::ProviderProbeJournalRecord,
        next: crate::sync::provider::ProviderProbeJournalRecord,
    ) -> Result<(), DbError> {
        previous.validate_transition(&next).map_err(|error| {
            DbError::Message(format!("invalid provider probe journal advance: {error}"))
        })?;
        let key = format!(
            "provider_probe/{}",
            hex::encode(previous.probe_id().as_bytes())
        );
        let previous = serde_json::to_string(&previous).map_err(|error| {
            DbError::Message(format!("serialize provider probe journal: {error}"))
        })?;
        let next = serde_json::to_string(&next).map_err(|error| {
            DbError::Message(format!("serialize provider probe journal: {error}"))
        })?;
        self.call(move |conn| {
            let changed = conn
                .execute(
                    "UPDATE protocol_state SET value = ?1 WHERE key = ?2 AND value = ?3",
                    (&next, &key, &previous),
                )
                .map_err(DbError::from)?;
            if changed != 1 {
                return Err(DbError::Message(
                    "provider probe journal advance lost its exact predecessor".to_string(),
                ));
            }
            Ok(())
        })
        .await
    }

    pub(crate) async fn prepare_device_join_challenge_publication(
        &self,
        challenge: crate::sync::provider::CrossPrincipalProbeChallenge,
    ) -> Result<crate::sync::provider::DeviceJoinChallengePublicationRecord, DbError> {
        use crate::sync::provider::{
            DeviceJoinChallengePublicationProgress, DeviceJoinChallengePublicationRecord,
        };

        let key = format!(
            "device_join_challenge_publication/{}",
            hex::encode(challenge.probe_id.as_bytes())
        );
        let prepared = DeviceJoinChallengePublicationRecord {
            challenge,
            progress: DeviceJoinChallengePublicationProgress::Prepared,
        };
        let value = serde_json::to_string(&prepared).map_err(|error| {
            DbError::Message(format!(
                "serialize device join challenge publication: {error}"
            ))
        })?;
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            tx.execute(
                "INSERT OR IGNORE INTO protocol_state (key, value) VALUES (?1, ?2)",
                (&key, &value),
            )
            .map_err(DbError::from)?;
            let actual: String = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [&key],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            tx.commit().map_err(DbError::from)?;
            let actual: DeviceJoinChallengePublicationRecord = serde_json::from_str(&actual)
                .map_err(|error| {
                    DbError::Message(format!("parse device join challenge publication: {error}"))
                })?;
            if actual.challenge != prepared.challenge {
                return Err(DbError::Message(
                    "device join challenge probe id was reused with different bytes".to_string(),
                ));
            }
            Ok(actual)
        })
        .await
    }

    pub(crate) async fn publish_device_join_challenge(
        &self,
        authorization: crate::sync::provider::DeviceJoinChallengePublicationAuthorization,
        challenge: crate::sync::provider::CrossPrincipalProbeChallenge,
    ) -> Result<(), DbError> {
        use crate::sync::provider::{
            DeviceJoinChallengePublicationProgress, DeviceJoinChallengePublicationRecord,
        };

        let key = format!(
            "device_join_challenge_publication/{}",
            hex::encode(challenge.probe_id.as_bytes())
        );
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let previous_json: String = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [&key],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let previous: DeviceJoinChallengePublicationRecord =
                serde_json::from_str(&previous_json).map_err(|error| {
                    DbError::Message(format!("parse device join challenge publication: {error}"))
                })?;
            if previous.challenge != challenge {
                return Err(DbError::Message(
                    "device join challenge publication differs from prepared bytes".to_string(),
                ));
            }
            match &previous.progress {
                DeviceJoinChallengePublicationProgress::Prepared => {
                    let next = DeviceJoinChallengePublicationRecord {
                        challenge,
                        progress: DeviceJoinChallengePublicationProgress::Published {
                            authorization,
                        },
                    };
                    let next_json = serde_json::to_string(&next).map_err(|error| {
                        DbError::Message(format!(
                            "serialize device join challenge publication: {error}"
                        ))
                    })?;
                    let changed = tx
                        .execute(
                            "UPDATE protocol_state SET value = ?1 WHERE key = ?2 AND value = ?3",
                            (&next_json, &key, &previous_json),
                        )
                        .map_err(DbError::from)?;
                    if changed != 1 {
                        return Err(DbError::Message(
                            "device join challenge publication lost its exact predecessor"
                                .to_string(),
                        ));
                    }
                }
                DeviceJoinChallengePublicationProgress::Published {
                    authorization: existing,
                } if existing == &authorization => {}
                DeviceJoinChallengePublicationProgress::Published { .. } => {
                    return Err(DbError::Message(
                        "device join challenge publication authorization changed".to_string(),
                    ));
                }
                DeviceJoinChallengePublicationProgress::ProducerClosed { .. }
                | DeviceJoinChallengePublicationProgress::CancelledBeforeCreate { .. } => {
                    return Err(DbError::Message(
                        "device join challenge producer is closed".to_string(),
                    ));
                }
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn close_published_device_join_challenge(
        &self,
        authorization: crate::sync::provider::DeviceJoinChallengePublicationAuthorization,
        challenge: crate::sync::provider::CrossPrincipalProbeChallenge,
    ) -> Result<(), DbError> {
        use crate::sync::provider::{
            DeviceJoinChallengePublicationProgress, DeviceJoinChallengePublicationRecord,
        };

        let key = format!(
            "device_join_challenge_publication/{}",
            hex::encode(challenge.probe_id.as_bytes())
        );
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let previous_json: String = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [&key],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let previous: DeviceJoinChallengePublicationRecord =
                serde_json::from_str(&previous_json).map_err(|error| {
                    DbError::Message(format!("parse device join challenge publication: {error}"))
                })?;
            if previous.challenge != challenge {
                return Err(DbError::Message(
                    "device join challenge closure differs from prepared bytes".to_string(),
                ));
            }
            match &previous.progress {
                DeviceJoinChallengePublicationProgress::Published {
                    authorization: existing,
                } if existing == &authorization => {
                    let next = DeviceJoinChallengePublicationRecord {
                        challenge,
                        progress: DeviceJoinChallengePublicationProgress::ProducerClosed {
                            authorization,
                        },
                    };
                    let next_json = serde_json::to_string(&next).map_err(|error| {
                        DbError::Message(format!(
                            "serialize device join challenge closure: {error}"
                        ))
                    })?;
                    let changed = tx
                        .execute(
                            "UPDATE protocol_state SET value = ?1 WHERE key = ?2 AND value = ?3",
                            (&next_json, &key, &previous_json),
                        )
                        .map_err(DbError::from)?;
                    if changed != 1 {
                        return Err(DbError::Message(
                            "device join challenge closure lost its exact predecessor".to_string(),
                        ));
                    }
                }
                DeviceJoinChallengePublicationProgress::ProducerClosed {
                    authorization: existing,
                } if existing == &authorization => {}
                _ => {
                    return Err(DbError::Message(
                        "device join challenge cannot close from its current state".to_string(),
                    ));
                }
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn cancel_unpublished_device_join_challenge(
        &self,
        authorization: crate::sync::provider::DeviceJoinChallengePublicationAuthorization,
        challenge: crate::sync::provider::CrossPrincipalProbeChallenge,
        cancellation: crate::sync::store_commit::DeviceJoinOutcomeRef,
    ) -> Result<(), DbError> {
        use crate::sync::provider::{
            DeviceJoinChallengePublicationProgress, DeviceJoinChallengePublicationRecord,
        };

        if cancellation.attempt() != &authorization.attempt {
            return Err(DbError::Message(
                "device join challenge cancellation names another attempt".to_string(),
            ));
        }
        let key = format!(
            "device_join_challenge_publication/{}",
            hex::encode(challenge.probe_id.as_bytes())
        );
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let previous_json: String = tx
                .query_row(
                    "SELECT value FROM protocol_state WHERE key = ?1",
                    [&key],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let previous: DeviceJoinChallengePublicationRecord =
                serde_json::from_str(&previous_json).map_err(|error| {
                    DbError::Message(format!("parse device join challenge publication: {error}"))
                })?;
            if previous.challenge != challenge {
                return Err(DbError::Message(
                    "device join challenge cancellation differs from prepared bytes".to_string(),
                ));
            }
            match &previous.progress {
                DeviceJoinChallengePublicationProgress::Prepared => {
                    let next = DeviceJoinChallengePublicationRecord {
                        challenge,
                        progress: DeviceJoinChallengePublicationProgress::CancelledBeforeCreate {
                            authorization,
                            cancellation,
                        },
                    };
                    let next_json = serde_json::to_string(&next).map_err(|error| {
                        DbError::Message(format!(
                            "serialize device join challenge cancellation: {error}"
                        ))
                    })?;
                    let changed = tx
                        .execute(
                            "UPDATE protocol_state SET value = ?1 WHERE key = ?2 AND value = ?3",
                            (&next_json, &key, &previous_json),
                        )
                        .map_err(DbError::from)?;
                    if changed != 1 {
                        return Err(DbError::Message(
                            "device join challenge cancellation lost its exact predecessor"
                                .to_string(),
                        ));
                    }
                }
                DeviceJoinChallengePublicationProgress::CancelledBeforeCreate {
                    authorization: existing_authorization,
                    cancellation: existing_cancellation,
                } if existing_authorization == &authorization
                    && existing_cancellation == &cancellation => {}
                _ => {
                    return Err(DbError::Message(
                        "device join challenge cannot cancel before create from its current state"
                            .to_string(),
                    ));
                }
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub async fn set_protocol_state(&self, key: &str, value: &str) -> Result<(), DbError> {
        let (key, value) = (key.to_string(), value.to_string());
        self.call(move |conn| {
            conn.execute(
                "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
                 ON CONFLICT(key) DO UPDATE SET value = excluded.value",
                (key, value),
            )
            .map(|_| ())
            .map_err(DbError::from)
        })
        .await
    }

    pub async fn delete_protocol_state(&self, key: &str) -> Result<(), DbError> {
        let key = key.to_string();
        self.call(move |conn| {
            conn.execute("DELETE FROM protocol_state WHERE key = ?1", [key])
                .map(|_| ())
                .map_err(DbError::from)
        })
        .await
    }

    /// `namespace`'s device-local cache-size budget in bytes, or `None` if the host
    /// has not set one for it. `None` means unlimited — eviction is off for that
    /// namespace and its cache grows without bound; the host opts a namespace into a
    /// budget by calling [`Self::set_cache_budget`]. Budgets are per namespace so a
    /// small namespace (`covers`) is never wiped by pressure from a big one
    /// (`release_files`): each evicts against its own budget. Stored as a single
    /// decimal value under [`crate::blob::cache::cache_budget_state_key`] in
    /// `protocol_state` (config, not per-blob accounting — the cache's truth is still the
    /// folder on disk).
    pub async fn get_cache_budget(&self, namespace: &str) -> Result<Option<u64>, DbError> {
        let key = crate::blob::cache::cache_budget_state_key(namespace);
        match self.get_protocol_state(&key).await? {
            Some(raw) => raw.parse::<u64>().map(Some).map_err(|e| {
                DbError::Message(format!(
                    "cache budget for {namespace:?} in protocol_state is not a byte count: {e}"
                ))
            }),
            None => Ok(None),
        }
    }

    /// Set `namespace`'s device-local cache-size budget in bytes. Once set, a populate
    /// into that namespace's cache that pushes `storage/cache/<namespace>/` over this
    /// total evicts its oldest files (by mtime) back under it; `pinned/` is never
    /// counted or touched, and another namespace's files are never walked. Stored
    /// under [`crate::blob::cache::cache_budget_state_key`] in `protocol_state`.
    pub async fn set_cache_budget(&self, namespace: &str, max_bytes: u64) -> Result<(), DbError> {
        let key = crate::blob::cache::cache_budget_state_key(namespace);
        self.set_protocol_state(&key, &max_bytes.to_string()).await
    }

    // ---- Materialized Store commit ledger ----

    pub(crate) async fn insert_circle_operation(
        &self,
        journal: crate::sync::circle_ops::CircleOperationJournal,
    ) -> Result<(), DbError> {
        let row = PreparedCircleOperationRow::from_journal(journal)?;
        self.call(move |conn| {
            conn.execute(
                "INSERT INTO circle_operations (operation_id, circle_id, payload)
                 VALUES (?1, ?2, ?3)",
                rusqlite::params![row.operation_id, row.circle_id, row.payload],
            )
            .map(|_| ())
            .map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn circle_operation(
        &self,
        circle_id: crate::sync::circle::CircleId,
    ) -> Result<Option<crate::sync::circle_ops::CircleOperationJournal>, DbError> {
        let circle_id = circle_id.to_string();
        self.call(move |conn| {
            conn.query_row(
                "SELECT payload FROM circle_operations WHERE circle_id = ?1",
                [circle_id],
                |row| row.get::<_, Vec<u8>>(0),
            )
            .optional()
            .map_err(DbError::from)?
            .map(|payload| {
                serde_json::from_slice(&payload).map_err(|error| {
                    DbError::Message(format!("parse circle operation journal: {error}"))
                })
            })
            .transpose()
        })
        .await
    }

    pub(crate) async fn oldest_pending_circle_operation(
        &self,
    ) -> Result<Option<crate::sync::circle_ops::CircleOperationJournal>, DbError> {
        self.call(|conn| {
            let mut statement = conn
                .prepare("SELECT payload FROM circle_operations ORDER BY rowid")
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| row.get::<_, Vec<u8>>(0))
                .map_err(DbError::from)?;
            for payload in rows {
                let payload = payload.map_err(DbError::from)?;
                let journal: crate::sync::circle_ops::CircleOperationJournal =
                    serde_json::from_slice(&payload).map_err(|error| {
                        DbError::Message(format!("parse circle operation journal: {error}"))
                    })?;
                if matches!(
                    journal.status,
                    crate::sync::circle::CircleOperationState::Pending
                ) {
                    return Ok(Some(journal));
                }
            }
            Ok(None)
        })
        .await
    }

    #[doc(hidden)]
    pub async fn discard_blocked_circle_operation(
        &self,
        circle_id: crate::sync::circle::CircleId,
    ) -> Result<(), DbError> {
        let circle_id = circle_id.to_string();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let payload = tx
                .query_row(
                    "SELECT payload FROM circle_operations WHERE circle_id = ?1",
                    [&circle_id],
                    |row| row.get::<_, Vec<u8>>(0),
                )
                .optional()
                .map_err(DbError::from)?;
            let Some(payload) = payload else {
                tx.commit().map_err(DbError::from)?;
                return Ok(());
            };
            let journal: crate::sync::circle_ops::CircleOperationJournal =
                serde_json::from_slice(&payload).map_err(|error| {
                    DbError::Message(format!("parse circle operation journal: {error}"))
                })?;
            match journal.status {
                crate::sync::circle::CircleOperationState::Pending => {
                    return Err(DbError::Message(format!(
                        "pending circle operation {circle_id} cannot be discarded"
                    )));
                }
                crate::sync::circle::CircleOperationState::Blocked { .. } => {}
            }
            let deleted = tx
                .execute(
                    "DELETE FROM circle_operations WHERE circle_id = ?1",
                    [&circle_id],
                )
                .map_err(DbError::from)?;
            if deleted != 1 {
                return Err(DbError::Message(format!(
                    "blocked circle operation {circle_id} disappeared during discard"
                )));
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub async fn get_circle_operations(
        &self,
    ) -> Result<Vec<crate::sync::circle::CircleOperationInfo>, DbError> {
        self.call(|conn| {
            let mut statement = conn
                .prepare("SELECT payload FROM circle_operations ORDER BY rowid")
                .map_err(DbError::from)?;
            let operations = statement
                .query_map([], |row| row.get::<_, Vec<u8>>(0))
                .map_err(DbError::from)?
                .map(|payload| {
                    let payload = payload.map_err(DbError::from)?;
                    let journal: crate::sync::circle_ops::CircleOperationJournal =
                        serde_json::from_slice(&payload).map_err(|error| {
                            DbError::Message(format!("parse circle operation journal: {error}"))
                        })?;
                    let circle_id = journal.circle_id();
                    Ok(crate::sync::circle::CircleOperationInfo {
                        circle_id,
                        name: journal.creation.metadata.name,
                        state: journal.status,
                    })
                })
                .collect();
            operations
        })
        .await
    }

    pub async fn get_circles(
        &self,
        identity_pubkey: &str,
    ) -> Result<Vec<crate::sync::circle::CircleInfo>, DbError> {
        let identity_pubkey = identity_pubkey.to_string();
        self.call(move |conn| {
            let mut statement = conn
                .prepare(
                    "SELECT activation.circle_id, activation.control_bytes,
                            metadata.metadata_bytes, roster.roster_bytes
                     FROM circle_control_activations AS activation
                     JOIN circle_access_cache AS access
                       ON access.circle_id = activation.circle_id
                      AND access.control_coord = activation.control_coord
                     JOIN circle_metadata_cache AS metadata
                       ON metadata.circle_id = activation.circle_id
                      AND metadata.control_coord = activation.control_coord
                     JOIN circle_roster_cache AS roster
                       ON roster.circle_id = activation.circle_id
                      AND roster.control_coord = activation.control_coord
                     WHERE access.disposition = 'active'
                     ORDER BY activation.circle_id, activation.seq",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, Vec<u8>>(1)?,
                        row.get::<_, Vec<u8>>(2)?,
                        row.get::<_, Vec<u8>>(3)?,
                    ))
                })
                .map_err(DbError::from)?;
            let mut circles = Vec::new();
            for row in rows {
                let (circle_id, control_bytes, metadata_bytes, roster_bytes) =
                    row.map_err(DbError::from)?;
                let circle_id: crate::sync::circle::CircleId =
                    circle_id.parse().map_err(|error| {
                        DbError::Message(format!("parse activated circle id: {error}"))
                    })?;
                let control: crate::sync::circle::CircleControl =
                    serde_json::from_slice(&control_bytes).map_err(|error| {
                        DbError::Message(format!("parse activated circle control: {error}"))
                    })?;
                let metadata: crate::sync::circle::CircleMetadata =
                    serde_json::from_slice(&metadata_bytes).map_err(|error| {
                        DbError::Message(format!("parse activated circle metadata: {error}"))
                    })?;
                let roster: crate::sync::circle::CircleMaterializedRoster =
                    serde_json::from_slice(&roster_bytes).map_err(|error| {
                        DbError::Message(format!("parse activated circle roster: {error}"))
                    })?;
                if !control.verify()
                    || !metadata.verify()
                    || !roster.verify()
                    || control.circle_id != circle_id
                    || metadata.circle_id != circle_id
                    || match &control.metadata {
                        crate::sync::circle::CircleMetadataStateRef::MergeConcurrent {
                            selected,
                            state_hash,
                            ..
                        } => {
                            selected != &metadata.coord() || *state_hash != metadata.metadata_hash()
                        }
                        crate::sync::circle::CircleMetadataStateRef::Serial { current } => {
                            current != &metadata.coord()
                        }
                    }
                    || match &control.roster {
                        crate::sync::circle::CircleRosterStateRef::MergeConcurrent {
                            state_hash,
                            ..
                        }
                        | crate::sync::circle::CircleRosterStateRef::Serial { state_hash } => {
                            *state_hash != roster.state_hash()
                        }
                    }
                {
                    return Err(DbError::Message(format!(
                        "activated circle {circle_id} has inconsistent cached state"
                    )));
                }
                let role = roster
                    .members()
                    .get(&identity_pubkey)
                    .copied()
                    .ok_or_else(|| {
                        DbError::Message(format!(
                            "activated circle {circle_id} excludes the local identity"
                        ))
                    })?;
                circles.push(crate::sync::circle::CircleInfo {
                    id: circle_id,
                    name: metadata.name,
                    role,
                });
            }
            Ok(circles)
        })
        .await
    }

    pub(crate) async fn circle_publication_context(
        &self,
        circle_id: crate::sync::circle::CircleId,
        expected_control: crate::sync::circle::CircleControlCoord,
    ) -> Result<(EncryptionService, crate::KeyFingerprint), DbError> {
        self.call(move |conn| {
            let control_coord = serde_json::to_string(&expected_control).map_err(|error| {
                DbError::Message(format!("serialize Circle publication coordinate: {error}"))
            })?;
            let (control_bytes, access_bytes): (Vec<u8>, Vec<u8>) = conn
                .query_row(
                    "SELECT activation.control_bytes, access.access_bytes
                     FROM circle_control_activations AS activation
                     JOIN circle_access_cache AS access
                       ON access.circle_id = activation.circle_id
                      AND access.control_coord = activation.control_coord
                     WHERE activation.circle_id = ?1
                       AND activation.control_coord = ?2
                       AND access.disposition = 'active'",
                    (circle_id.to_string(), control_coord),
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let control: crate::sync::circle::CircleControl =
                serde_json::from_slice(&control_bytes).map_err(|error| {
                    DbError::Message(format!("parse Circle publication control: {error}"))
                })?;
            let access: crate::sync::circle::CircleAccessLeaf =
                serde_json::from_slice(&access_bytes).map_err(|error| {
                    DbError::Message(format!("parse Circle publication access: {error}"))
                })?;
            if !control.verify()
                || control.circle_id != circle_id
                || control.coord() != expected_control
                || !access.verify_signature()
                || access.circle_id != circle_id
                || access.epoch_id != control.epoch_id
            {
                return Err(DbError::Message(format!(
                    "Circle {circle_id} publication authority differs from its exact activation"
                )));
            }
            let crate::sync::circle::CircleAccessDisposition::Active {
                keyring,
                key_fingerprint,
                roster,
            } = access.disposition
            else {
                return Err(DbError::Message(format!(
                    "Circle {circle_id} has no active publication key"
                )));
            };
            if key_fingerprint != control.key_fingerprint || roster != control.roster {
                return Err(DbError::Message(format!(
                    "Circle {circle_id} publication key differs from its exact control"
                )));
            }
            let encryption = EncryptionService::from(
                crate::encryption::MasterKeyring::from_serialized(&keyring).map_err(|error| {
                    DbError::Message(format!("parse Circle publication keyring: {error}"))
                })?,
            );
            if encryption.seal_key_fingerprint() != key_fingerprint {
                return Err(DbError::Message(format!(
                    "Circle {circle_id} publication key fingerprint is invalid"
                )));
            }
            Ok((encryption, key_fingerprint))
        })
        .await
    }

    pub(crate) async fn update_circle_operation(
        &self,
        journal: crate::sync::circle_ops::CircleOperationJournal,
    ) -> Result<(), DbError> {
        let row = PreparedCircleOperationRow::from_journal(journal)?;
        self.call(move |conn| {
            let updated = conn
                .execute(
                    "UPDATE circle_operations SET payload = ?3
                     WHERE operation_id = ?1 AND circle_id = ?2",
                    rusqlite::params![row.operation_id, row.circle_id, row.payload],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(
                    "circle operation disappeared during publication".to_string(),
                ));
            }
            Ok(())
        })
        .await
    }

    pub(crate) async fn block_circle_operation(
        &self,
        circle_id: crate::sync::circle::CircleId,
        reason: String,
    ) -> Result<(), DbError> {
        let mut journal = self
            .circle_operation(circle_id)
            .await?
            .ok_or_else(|| DbError::Message(format!("circle operation {circle_id} is absent")))?;
        journal.status = crate::sync::circle::CircleOperationState::Blocked { reason };
        self.update_circle_operation(journal).await
    }

    pub(crate) async fn activate_circle_operation(
        &self,
        journal: crate::sync::circle_ops::CircleOperationJournal,
        identity: &crate::keys::UserKeypair,
    ) -> Result<(), DbError> {
        let identity = identity.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            if !matches!(
                journal.status,
                crate::sync::circle::CircleOperationState::Pending
            ) {
                return Err(DbError::Message(
                    "blocked circle operation cannot activate".to_string(),
                ));
            }
            let creation = &journal.creation;
            let resolved_roster = creation.resolved_roster();
            if !creation.control.verify()
                || !creation.metadata.verify()
                || !resolved_roster.verify()
            {
                return Err(DbError::Message(
                    "circle operation contains invalid signed objects".to_string(),
                ));
            }
            let unverified_commit: StoreBatchCommit = serde_json::from_slice(&journal.commit_bytes)
                .map_err(|error| DbError::Message(format!("parse circle Store commit: {error}")))?;
            let root = required_store_root_authority_on(&tx)?;
            let author =
                load_activated_registration_on(&tx, &root, &unverified_commit.author_registration)?;
            let verify_commit = || {
                let commit = StoreBatchCommit::parse_at(
                    &journal.commit_bytes,
                    root.store_root_hash,
                    &journal.commit_ref.coord,
                    &author,
                )
                .map_err(|error| {
                    DbError::Message(format!("verify circle Store commit: {error}"))
                })?;
                journal
                    .commit_ref
                    .verify_commit(&commit)
                    .map_err(|error| DbError::Message(error.to_string()))?;
                if journal.commit_ref.object.slot().logical_key()
                    != commit_semantic_prefix(
                        commit.candidate_family(),
                        &match &journal.commit_ref.coord {
                            StoreCommitCoord::MergeConcurrent { stream_id, .. } => {
                                stream_id.to_string()
                            }
                            StoreCommitCoord::Serial { .. } => SERIAL_STREAM_ID.to_string(),
                        },
                        commit.seq(),
                        commit.commit_hash(),
                    ) + ".json"
                {
                    return Err(DbError::Message(
                        "circle commit exact object occupies a different semantic slot".to_string(),
                    ));
                }
                let [control_ref] = commit.circle_controls() else {
                    return Err(DbError::Message(
                        "circle creation Store commit is not an exact control-only batch"
                            .to_string(),
                    ));
                };
                let expected_ref = creation.control_ref(control_ref.objects().clone());
                if control_ref != &expected_ref
                    || commit.store_package().is_some()
                    || !commit.circle_packages().is_empty()
                    || commit.control().is_some()
                    || !commit.device_registrations().is_empty()
                {
                    return Err(DbError::Message(
                        "circle creation Store commit is not an exact control-only batch"
                            .to_string(),
                    ));
                }
                let activation = crate::sync::circle_ops::verify_local_circle_activation(
                    &journal,
                    &journal.commit_ref,
                    &commit,
                    &author,
                    &identity,
                )
                .map_err(|error| DbError::Message(error.to_string()))?;
                Ok((commit, activation))
            };
            let (commit, activation) = match &journal.policy {
                crate::sync::circle_ops::CircleOperationPolicy::MergeConcurrent { head } => {
                    let (commit, activation) = verify_commit()?;
                    let parsed = StoreDeviceHead::parse_at(
                        &head.to_bytes(),
                        commit.store_root_hash,
                        &author,
                        &journal.commit_ref,
                    )
                    .map_err(|error| {
                        DbError::Message(format!("verify circle activation head: {error}"))
                    })?;
                    if parsed.commit != journal.commit_ref {
                        return Err(DbError::Message(
                            "circle activation head names a different commit".to_string(),
                        ));
                    }
                    Self::record_materialized_commit_on(&tx, &commit, &journal.commit_ref)?;
                    (commit, activation)
                }
                crate::sync::circle_ops::CircleOperationPolicy::Serial {
                    head,
                    authorization,
                    ..
                } => {
                    let (commit, activation) = verify_commit()?;
                    let parsed =
                        StoreSerialHead::parse(&head.to_bytes(), commit.store_root_hash, &author)
                            .map_err(|error| {
                            DbError::Message(format!("verify circle Serial head: {error}"))
                        })?;
                    if !matches!(
                        parsed.state,
                        StoreSerialHeadState::Commit { ref commit, .. }
                            if commit == &journal.commit_ref
                    ) {
                        return Err(DbError::Message(
                            "circle Serial head names a different commit".to_string(),
                        ));
                    }
                    Self::record_materialized_serial_commit_on(
                        &tx,
                        &commit,
                        &journal.commit_ref,
                        authorization,
                    )?;
                    (commit, activation)
                }
            };
            Self::record_verified_circle_activations_on(
                &tx,
                &commit,
                &journal.commit_ref,
                &[activation],
            )?;
            let deleted = tx
                .execute(
                    "DELETE FROM circle_operations WHERE operation_id = ?1 AND circle_id = ?2",
                    rusqlite::params![journal.operation_id, creation.circle_id.to_string()],
                )
                .map_err(DbError::from)?;
            if deleted != 1 {
                return Err(DbError::Message(
                    "circle operation disappeared during activation".to_string(),
                ));
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn materialized_frontier(
        &self,
    ) -> Result<BTreeMap<String, StoreBatchCommitRef>, DbError> {
        self.call(|conn| Self::materialized_frontier_on(conn, None))
            .await
    }

    pub(crate) async fn exact_materialized_ref(
        &self,
        stream_id: &str,
        sequence: u64,
    ) -> Result<Option<StoreBatchCommitRef>, DbError> {
        let stream_id = stream_id.to_string();
        self.call(move |conn| Self::materialized_commit_ref_on(conn, &stream_id, sequence))
            .await
    }

    pub(crate) async fn snapshot_coverage_frontier(&self) -> Result<CommitFrontier, DbError> {
        let policy = self.write_policy();
        self.call(move |conn| {
            let mut stmt = conn
                .prepare("SELECT device_id, seq, commit_ref FROM snapshot_coverage")
                .map_err(DbError::from)?;
            let rows = stmt
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, i64>(1)?,
                        row.get::<_, String>(2)?,
                    ))
                })
                .map_err(DbError::from)?;
            let mut frontier = BTreeMap::new();
            for row in rows {
                let (device_id, seq, reference) = row.map_err(DbError::from)?;
                let seq = Self::sequence_from_sqlite(&device_id, seq)?;
                let reference = Self::parse_stored_commit_ref(&device_id, seq, &reference)?;
                frontier.insert(device_id.clone(), reference);
            }
            CommitFrontier::from_refs(policy, frontier)
                .map_err(|error| DbError::Message(format!("snapshot coverage frontier: {error}")))
        })
        .await
    }

    pub(crate) fn materialized_frontier_on(
        conn: &Connection,
        exclude_device: Option<&str>,
    ) -> Result<BTreeMap<String, StoreBatchCommitRef>, DbError> {
        let mut frontier = BTreeMap::new();
        let mut stmt = conn
            .prepare(
                "SELECT m.device_id, m.seq, m.commit_ref \
                 FROM materialized_commits m \
                 JOIN (SELECT device_id, MAX(seq) AS seq FROM materialized_commits \
                       GROUP BY device_id) latest \
                   ON latest.device_id = m.device_id AND latest.seq = m.seq",
            )
            .map_err(DbError::from)?;
        let rows = stmt
            .query_map([], |row| {
                Ok((
                    row.get::<_, String>(0)?,
                    row.get::<_, i64>(1)?,
                    row.get::<_, String>(2)?,
                ))
            })
            .map_err(DbError::from)?;
        for row in rows {
            let (device_id, seq, reference) = row.map_err(DbError::from)?;
            if exclude_device == Some(device_id.as_str()) {
                continue;
            }
            let seq = Self::sequence_from_sqlite(&device_id, seq)?;
            frontier.insert(
                device_id.clone(),
                Self::parse_stored_commit_ref(&device_id, seq, &reference)?,
            );
        }

        let mut coverage = conn
            .prepare("SELECT device_id, seq, commit_ref FROM snapshot_coverage")
            .map_err(DbError::from)?;
        let rows = coverage
            .query_map([], |row| {
                Ok((
                    row.get::<_, String>(0)?,
                    row.get::<_, i64>(1)?,
                    row.get::<_, String>(2)?,
                ))
            })
            .map_err(DbError::from)?;
        for row in rows {
            let (device_id, seq, reference) = row.map_err(DbError::from)?;
            if exclude_device == Some(device_id.as_str()) {
                continue;
            }
            let seq = Self::sequence_from_sqlite(&device_id, seq)?;
            let reference = Self::parse_stored_commit_ref(&device_id, seq, &reference)?;
            if frontier
                .get(&device_id)
                .is_none_or(|current| current.coord.sequence() < reference.coord.sequence())
            {
                frontier.insert(device_id, reference);
            }
        }
        Ok(frontier)
    }

    fn parse_stored_commit_ref(
        stream_id: &str,
        sequence: u64,
        encoded: &str,
    ) -> Result<StoreBatchCommitRef, DbError> {
        let reference: StoreBatchCommitRef = serde_json::from_str(encoded)
            .map_err(|error| DbError::Message(format!("stored exact Store commit ref: {error}")))?;
        let coordinate_matches = match &reference.coord {
            StoreCommitCoord::Serial { sequence: declared } => {
                stream_id == SERIAL_STREAM_ID && *declared == sequence
            }
            StoreCommitCoord::MergeConcurrent {
                stream_id: declared,
                sequence: declared_sequence,
            } => declared.to_string() == stream_id && *declared_sequence == sequence,
        };
        if !coordinate_matches {
            return Err(DbError::Message(format!(
                "stored exact Store commit ref differs from {stream_id}/{sequence}"
            )));
        }
        Ok(reference)
    }

    pub(crate) fn materialized_commit_ref_on(
        conn: &Connection,
        stream_id: &str,
        sequence: u64,
    ) -> Result<Option<StoreBatchCommitRef>, DbError> {
        let seq = Self::sequence_to_sqlite(stream_id, sequence)?;
        conn.query_row(
            "SELECT commit_ref FROM materialized_commits WHERE device_id = ?1 AND seq = ?2",
            (stream_id, seq),
            |row| row.get::<_, String>(0),
        )
        .optional()
        .map_err(DbError::from)?
        .map(|encoded| Self::parse_stored_commit_ref(stream_id, sequence, &encoded))
        .transpose()
    }

    fn latest_position_for_device_on(
        conn: &Connection,
        device_id: &str,
    ) -> Result<Option<StoreBatchCommitRef>, DbError> {
        let materialized = conn
            .query_row(
                "SELECT seq, commit_ref FROM materialized_commits
                 WHERE device_id = ?1 ORDER BY seq DESC LIMIT 1",
                [device_id],
                |row| Ok((row.get::<_, i64>(0)?, row.get::<_, String>(1)?)),
            )
            .optional()
            .map_err(DbError::from)?;
        let coverage = conn
            .query_row(
                "SELECT seq, commit_ref FROM snapshot_coverage WHERE device_id = ?1",
                [device_id],
                |row| Ok((row.get::<_, i64>(0)?, row.get::<_, String>(1)?)),
            )
            .optional()
            .map_err(DbError::from)?;
        let references = [materialized, coverage]
            .into_iter()
            .flatten()
            .map(|(seq, reference)| {
                let seq = Self::sequence_from_sqlite(device_id, seq)?;
                Self::parse_stored_commit_ref(device_id, seq, &reference)
            })
            .collect::<Result<Vec<_>, DbError>>()?;
        if references.len() == 2
            && references[0].coord.sequence() == references[1].coord.sequence()
            && references[0] != references[1]
        {
            return Err(DbError::Message(format!(
                "materialized ledger and snapshot coverage fork {device_id:?} at sequence {}",
                references[0].coord.sequence()
            )));
        }
        Ok(references
            .into_iter()
            .max_by_key(|reference| reference.coord.sequence()))
    }

    pub(crate) fn record_activated_store_device_registrations_on(
        conn: &Connection,
        commit: &StoreBatchCommit,
        registrations: &[(
            StoreDeviceRegistration,
            crate::sync::store_commit::StoreDeviceRegistrationActivation,
        )],
    ) -> Result<(), DbError> {
        if registrations.len() != commit.device_registrations().len() {
            return Err(DbError::Message(
                "Store device registration activation count differs from the signed commit"
                    .to_string(),
            ));
        }
        for signed in commit.device_registrations() {
            let (registration, authority) = registrations
                .iter()
                .find(|(registration, _)| registration.device_id == signed.registration.device_id)
                .ok_or_else(|| {
                    DbError::Message(format!(
                        "Store commit is missing registration bytes for {}",
                        signed.registration.device_id
                    ))
                })?;
            signed
                .registration
                .verify_registration(registration)
                .map_err(|error| DbError::Message(error.to_string()))?;
            if registration.store_root.store_root_hash != commit.store_root_hash {
                return Err(DbError::Message(format!(
                    "Store registration {} belongs to a different Store",
                    registration.device_id
                )));
            }
            let expected_authority = match (&registration.origin, &signed.authority) {
                (
                    crate::sync::store_commit::StoreDeviceRegistrationOrigin::Join {
                        attempt_id: origin_attempt,
                        outcome_slot,
                        ..
                    },
                    crate::sync::store_commit::StoreDeviceRegistrationActivationRef::Join {
                        attempt_id,
                        outcome,
                    },
                ) if origin_attempt == attempt_id && outcome_slot == outcome.slot() => {
                    crate::sync::store_commit::StoreDeviceRegistrationActivation::Join {
                        attempt_id: *attempt_id,
                        outcome: outcome.clone(),
                    }
                }
                (
                    crate::sync::store_commit::StoreDeviceRegistrationOrigin::Recovery {
                        recovery_id: origin_recovery,
                        recovery_slot,
                        ..
                    },
                    crate::sync::store_commit::StoreDeviceRegistrationActivationRef::Recovery {
                        recovery_id,
                        node,
                    },
                ) if origin_recovery == recovery_id && recovery_slot == node.slot() => {
                    crate::sync::store_commit::StoreDeviceRegistrationActivation::Recovery {
                        recovery_id: *recovery_id,
                        node: node.clone(),
                    }
                }
                _ => {
                    return Err(DbError::Message(format!(
                        "Store registration {} origin differs from its signed activation authority",
                        registration.device_id
                    )))
                }
            };
            if authority != &expected_authority {
                return Err(DbError::Message(format!(
                    "verified Store registration {} authority differs from the signed commit",
                    registration.device_id
                )));
            }
            let registration_bytes = registration.to_bytes();
            let registration_object =
                serde_json::to_string(&signed.registration).map_err(|error| {
                    DbError::Message(format!("serialize Store registration exact ref: {error}"))
                })?;
            let activation_authority = serde_json::to_string(authority).map_err(|error| {
                DbError::Message(format!("serialize Store registration authority: {error}"))
            })?;
            let inserted = conn
                .execute(
                    "INSERT INTO store_device_registration_activations
                     (device_id, registration_hash, author_pubkey, device_signing_pubkey,
                      registration_bytes, registration_object, activation_authority)
                     VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
                     ON CONFLICT(device_id) DO NOTHING",
                    rusqlite::params![
                        registration.device_id.to_string(),
                        signed.registration.registration_hash.to_string(),
                        registration.author_pubkey,
                        registration.device_signing_pubkey,
                        registration_bytes,
                        registration_object,
                        activation_authority,
                    ],
                )
                .map_err(DbError::from)?;
            if inserted == 0 {
                let existing: (String, Vec<u8>, String, String) = conn
                    .query_row(
                        "SELECT registration_hash, registration_bytes, registration_object,
                                activation_authority
                         FROM store_device_registration_activations WHERE device_id = ?1",
                        [registration.device_id.to_string()],
                        |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
                    )
                    .map_err(DbError::from)?;
                if existing
                    != (
                        signed.registration.registration_hash.to_string(),
                        registration.to_bytes(),
                        serde_json::to_string(&signed.registration).map_err(|error| {
                            DbError::Message(format!(
                                "serialize Store registration exact ref: {error}"
                            ))
                        })?,
                        serde_json::to_string(authority).map_err(|error| {
                            DbError::Message(format!(
                                "serialize Store registration authority: {error}"
                            ))
                        })?,
                    )
                {
                    return Err(DbError::Message(format!(
                        "Store device {} already has a different one-shot registration",
                        registration.device_id
                    )));
                }
            }
            let local: Option<LocalDeviceRegistrationJournalRow> = conn
                .query_row(
                    "SELECT device_id, registration_hash, registration_bytes, prepared_object, \
                            initial_ack_ref, initial_ack_bytes, initial_ack_prepared, state \
                     FROM local_store_device_registration WHERE singleton = 1",
                    [],
                    |row| {
                        Ok((
                            row.get(0)?,
                            row.get(1)?,
                            row.get(2)?,
                            row.get(3)?,
                            row.get(4)?,
                            row.get(5)?,
                            row.get(6)?,
                            row.get(7)?,
                        ))
                    },
                )
                .optional()
                .map_err(DbError::from)?;
            let Some((
                local_device,
                local_hash,
                local_bytes,
                local_prepared,
                local_ack_ref,
                local_ack_bytes,
                local_ack_prepared,
                local_state,
            )) = local
            else {
                continue;
            };
            if local_device != registration.device_id.to_string() {
                continue;
            }
            let local_prepared: PreparedExactObject = serde_json::from_str(&local_prepared)
                .map_err(|error| DbError::Message(format!("local registration object: {error}")))?;
            let local_ack_ref: StoreAckRef = serde_json::from_str(&local_ack_ref)
                .map_err(|error| DbError::Message(format!("local initial ack ref: {error}")))?;
            let local_ack_prepared: PreparedExactObject = serde_json::from_str(&local_ack_prepared)
                .map_err(|error| DbError::Message(format!("local initial ack object: {error}")))?;
            if local_hash != signed.registration.registration_hash.to_string()
                || local_bytes != registration.to_bytes()
                || local_prepared.reference() != &signed.registration.object
                || local_ack_prepared.reference() != &local_ack_ref.object
            {
                return Err(DbError::Message(
                    "activating commit differs from the complete local registration ref"
                        .to_string(),
                ));
            }
            let ack = StoreAck::parse_at(
                &local_ack_bytes,
                registration.store_root.store_root_hash,
                &local_ack_ref,
                registration,
            )
            .map_err(|error| DbError::Message(format!("local initial ack: {error}")))?;
            if ack.revision != 1
                || ack.predecessor.is_some()
                || local_ack_prepared
                    .reference()
                    .verify(local_ack_prepared.stored_bytes())
                    .is_err()
            {
                return Err(DbError::Message(
                    "local registration journal does not carry an initial acknowledgement"
                        .to_string(),
                ));
            }
            let state: LocalDeviceRegistrationState =
                serde_json::from_str(&local_state).map_err(|error| {
                    DbError::Message(format!("local registration journal: {error}"))
                })?;
            let activated_state = LocalDeviceRegistrationState::Activated {
                authority: authority.clone(),
            };
            match state {
                LocalDeviceRegistrationState::Prepared => {
                    return Err(DbError::Message(
                        "Store commit cannot activate a registration before exact creation"
                            .to_string(),
                    ));
                }
                LocalDeviceRegistrationState::Created => {
                    let updated = conn
                        .execute(
                            "UPDATE local_store_device_registration SET state = ?1 \
                             WHERE singleton = 1 AND device_id = ?2 AND registration_hash = ?3 \
                               AND initial_ack_ref = ?4 AND state = ?5",
                            rusqlite::params![
                                serde_json::to_string(&activated_state).map_err(|error| {
                                    DbError::Message(format!(
                                        "serialize activated journal: {error}"
                                    ))
                                })?,
                                local_device,
                                local_hash,
                                serde_json::to_string(&local_ack_ref).map_err(|error| {
                                    DbError::Message(format!(
                                        "serialize local initial ack: {error}"
                                    ))
                                })?,
                                serde_json::to_string(&LocalDeviceRegistrationState::Created)
                                    .map_err(|error| DbError::Message(format!(
                                        "serialize created journal: {error}"
                                    )))?,
                            ],
                        )
                        .map_err(DbError::from)?;
                    if updated != 1 {
                        return Err(DbError::Message(
                            "local registration journal changed during activation".to_string(),
                        ));
                    }
                    conn.execute(
                        "INSERT INTO published_store_acks (singleton, ack_ref, successor_slot) \
                         VALUES (1, ?1, ?2)",
                        rusqlite::params![
                            serde_json::to_string(&local_ack_ref).map_err(|error| {
                                DbError::Message(format!(
                                    "serialize activated initial ack: {error}"
                                ))
                            })?,
                            serde_json::to_string(&ack.successor.next_slot).map_err(|error| {
                                DbError::Message(format!(
                                    "serialize activated ack successor: {error}"
                                ))
                            })?,
                        ],
                    )
                    .map_err(DbError::from)?;
                    conn.execute(
                        "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
                         ON CONFLICT(key) DO UPDATE SET value = excluded.value",
                        (
                            LOCAL_DEVICE_ID_STATE_KEY,
                            registration.device_id.to_string(),
                        ),
                    )
                    .map_err(DbError::from)?;
                }
                LocalDeviceRegistrationState::Activated {
                    authority: existing,
                } if existing == *authority => {
                    let stored_ack: (String, String) = conn
                        .query_row(
                            "SELECT ack_ref, successor_slot FROM published_store_acks \
                             WHERE singleton = 1",
                            [],
                            |row| Ok((row.get(0)?, row.get(1)?)),
                        )
                        .map_err(DbError::from)?;
                    let local_device_id: Option<String> = conn
                        .query_row(
                            "SELECT value FROM protocol_state WHERE key = ?1",
                            [LOCAL_DEVICE_ID_STATE_KEY],
                            |row| row.get(0),
                        )
                        .optional()
                        .map_err(DbError::from)?;
                    if stored_ack.0
                        != serde_json::to_string(&local_ack_ref).map_err(|error| {
                            DbError::Message(format!("serialize replayed initial ack: {error}"))
                        })?
                        || stored_ack.1
                            != serde_json::to_string(&ack.successor.next_slot).map_err(|error| {
                                DbError::Message(format!(
                                    "serialize replayed ack successor: {error}"
                                ))
                            })?
                        || local_device_id.as_deref() != Some(local_device.as_str())
                    {
                        return Err(DbError::Message(
                            "activated local journal differs from its exact initial ack"
                                .to_string(),
                        ));
                    }
                }
                LocalDeviceRegistrationState::Activated { .. } => {
                    return Err(DbError::Message(
                        "local registration already has another exact activation authority"
                            .to_string(),
                    ));
                }
                LocalDeviceRegistrationState::Retired { .. } => {
                    return Err(DbError::Message(
                        "retired local registration cannot be activated again".to_string(),
                    ));
                }
            }
        }
        Ok(())
    }

    #[cfg(test)]
    pub(crate) async fn activated_store_device_registrations(
        &self,
    ) -> Result<Vec<StoreDeviceRegistration>, DbError> {
        Ok(self
            .activated_store_device_registration_records()
            .await?
            .into_iter()
            .map(|(_, registration)| registration)
            .collect())
    }

    pub(crate) async fn store_device_state_for_order(
        &self,
        order: &crate::sync::store_commit::StoreCommitOrder,
    ) -> Result<(StoreDeviceStateRef, ResolvedStoreDeviceState), DbError> {
        let order = order.clone();
        self.call(move |conn| {
            let genesis = load_store_device_genesis_state_on(conn)?;
            match order {
                crate::sync::store_commit::StoreCommitOrder::MergeConcurrent {
                    predecessor,
                    dependencies,
                    ..
                } => {
                    let mut frontier = dependencies;
                    if let Some(predecessor) = predecessor {
                        let StoreCommitCoord::MergeConcurrent { stream_id, .. } = predecessor.coord
                        else {
                            return Err(DbError::Message(
                                "Merge predecessor has a Serial coordinate".to_string(),
                            ));
                        };
                        if frontier
                            .insert(stream_id, predecessor.clone())
                            .is_some_and(|current| current != predecessor)
                        {
                            return Err(DbError::Message(
                                "Merge predecessor differs from the same-stream dependency"
                                    .to_string(),
                            ));
                        }
                    }
                    let state = if frontier.is_empty() {
                        genesis
                    } else {
                        ResolvedStoreDeviceState::merge(
                            frontier
                                .values()
                                .map(|reference| load_store_device_snapshot_on(conn, reference))
                                .collect::<Result<Vec<_>, _>>()?,
                        )
                        .map_err(|error| DbError::Message(error.to_string()))?
                    };
                    let reference = StoreDeviceStateRef::merge_concurrent(
                        CommitFrontier::MergeConcurrent(frontier),
                        &state,
                    )
                    .map_err(|error| DbError::Message(error.to_string()))?;
                    Ok((reference, state))
                }
                crate::sync::store_commit::StoreCommitOrder::Serial { predecessor, .. } => {
                    let state = match &predecessor {
                        StoreSerialPredecessor::Genesis { .. } => genesis,
                        StoreSerialPredecessor::Commit(reference) => {
                            load_store_device_snapshot_on(conn, reference)?
                        }
                    };
                    let reference = StoreDeviceStateRef::serial(predecessor, &state)
                        .map_err(|error| DbError::Message(error.to_string()))?;
                    Ok((reference, state))
                }
            }
        })
        .await
    }

    pub(crate) async fn activated_store_device_registration_records(
        &self,
    ) -> Result<Vec<(StoreDeviceRegistrationRef, StoreDeviceRegistration)>, DbError> {
        let root = self
            .local_store_root_ref()
            .await?
            .ok_or_else(DbError::missing_store_root_hash)?;
        self.call(move |conn| {
            let mut statement = conn
                .prepare(
                    "SELECT device_id, registration_hash, registration_bytes,
                            registration_object
                     FROM store_device_registration_activations ORDER BY device_id",
                )
                .map_err(DbError::from)?;
                let rows = statement
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, String>(1)?,
                        row.get::<_, Vec<u8>>(2)?,
                        row.get::<_, String>(3)?,
                    ))
                })
                .map_err(DbError::from)?;
            rows
                .map(|row| {
                    let (device_id, registration_hash, bytes, object) =
                        row.map_err(DbError::from)?;
                    let device_id = device_id.parse().map_err(|error| {
                        DbError::Message(format!("activated Store device id: {error}"))
                    })?;
                    let registration_hash = registration_hash.parse().map_err(|error| {
                        DbError::Message(format!(
                            "activated Store device registration hash: {error}"
                        ))
                    })?;
                    let reference: StoreDeviceRegistrationRef =
                        serde_json::from_str(&object).map_err(|error| {
                        DbError::Message(format!(
                            "activated Store device exact reference: {error}"
                        ))
                    })?;
                    if reference.device_id != device_id
                        || reference.registration_hash != registration_hash
                    {
                        return Err(DbError::Message(
                            "activated Store registration columns differ from its exact reference"
                                .to_string(),
                        ));
                    }
                    let registration = StoreDeviceRegistration::parse_at(&bytes, &root, device_id)
                        .map_err(|error| {
                            DbError::Message(format!(
                                "activated Store device registration {device_id}: {error}"
                            ))
                        })?;
                    reference.verify_registration(&registration).map_err(|error| {
                        DbError::Message(format!(
                            "activated Store device registration {device_id} exact reference: {error}"
                        ))
                    })?;
                    Ok((reference, registration))
                })
                .collect::<Result<Vec<_>, DbError>>()
        })
        .await
    }

    pub(crate) async fn activated_store_device_registration(
        &self,
        reference: StoreDeviceRegistrationRef,
    ) -> Result<StoreDeviceRegistration, DbError> {
        let root = self.local_store_root_ref().await?.ok_or_else(|| {
            DbError::Message("Store root is absent while loading an activated device".to_string())
        })?;
        self.call(move |conn| load_activated_registration_on(conn, &root, &reference))
            .await
    }

    pub(crate) async fn local_blob_write_authority(
        &self,
    ) -> Result<(StoreDeviceRegistrationRef, StoreDeviceRegistration), DbError> {
        self.call(|conn| {
            local_store_authority_on(conn)
                .map(|(_, reference, registration)| (reference, registration))
        })
        .await
    }

    pub(crate) async fn activated_store_device_registration_with_authority(
        &self,
        reference: StoreDeviceRegistrationRef,
    ) -> Result<
        (
            StoreDeviceRegistration,
            crate::sync::store_commit::StoreDeviceRegistrationActivation,
        ),
        DbError,
    > {
        let root = self.local_store_root_ref().await?.ok_or_else(|| {
            DbError::Message("Store root is absent while loading an activated device".to_string())
        })?;
        self.call(move |conn| {
            let registration = load_activated_registration_on(conn, &root, &reference)?;
            let authority: String = conn
                .query_row(
                    "SELECT activation_authority FROM store_device_registration_activations \
                     WHERE device_id = ?1 AND registration_hash = ?2",
                    (
                        reference.device_id.to_string(),
                        reference.registration_hash.to_string(),
                    ),
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let authority = serde_json::from_str(&authority).map_err(|error| {
                DbError::Message(format!("activated Store registration authority: {error}"))
            })?;
            Ok((registration, authority))
        })
        .await
    }

    pub(crate) async fn activated_store_device_registration_for_device(
        &self,
        device_id: crate::sync::store_commit::StoreDeviceId,
    ) -> Result<
        Option<(
            StoreDeviceRegistrationRef,
            StoreDeviceRegistration,
            crate::sync::store_commit::StoreDeviceRegistrationActivation,
        )>,
        DbError,
    > {
        let root = self.local_store_root_ref().await?.ok_or_else(|| {
            DbError::Message("Store root is absent while loading an activated device".to_string())
        })?;
        self.call(move |conn| {
            let stored: Option<(String, String)> = conn
                .query_row(
                    "SELECT registration_object, activation_authority \
                     FROM store_device_registration_activations WHERE device_id = ?1",
                    [device_id.to_string()],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .optional()
                .map_err(DbError::from)?;
            let Some((reference, authority)) = stored else {
                return Ok(None);
            };
            let reference: StoreDeviceRegistrationRef =
                serde_json::from_str(&reference).map_err(|error| {
                    DbError::Message(format!("activated Store registration ref: {error}"))
                })?;
            if reference.device_id != device_id {
                return Err(DbError::Message(
                    "activated Store registration row names another device".to_string(),
                ));
            }
            let registration = load_activated_registration_on(conn, &root, &reference)?;
            let authority = serde_json::from_str(&authority).map_err(|error| {
                DbError::Message(format!("activated Store registration authority: {error}"))
            })?;
            Ok(Some((reference, registration, authority)))
        })
        .await
    }

    pub(crate) fn record_materialized_commit_on(
        conn: &Connection,
        commit: &StoreBatchCommit,
        commit_ref: &StoreBatchCommitRef,
    ) -> Result<(), DbError> {
        commit_ref
            .verify_commit(commit)
            .map_err(|error| DbError::Message(error.to_string()))?;
        let stored_registration: String = conn
            .query_row(
                "SELECT registration_object FROM store_device_registration_activations \
                 WHERE device_id = ?1 AND registration_hash = ?2",
                (
                    commit.author_registration.device_id.to_string(),
                    commit.author_registration.registration_hash.to_string(),
                ),
                |row| row.get(0),
            )
            .map_err(DbError::from)?;
        let stored_registration: StoreDeviceRegistrationRef =
            serde_json::from_str(&stored_registration).map_err(|error| {
                DbError::Message(format!("materialized author registration ref: {error}"))
            })?;
        if stored_registration != commit.author_registration {
            return Err(DbError::Message(
                "materialized commit author registration differs from its activation".to_string(),
            ));
        }
        let root = required_store_root_authority_on(conn)?;
        if root.store_root_hash != commit.store_root_hash {
            return Err(DbError::Message(
                "materialized commit belongs to a different Store root".to_string(),
            ));
        }
        let expected_stream =
            AuthorStreamId::store_announcements(&root, &commit.author_registration);
        let (stream_id, sequence) = match commit_ref.coord {
            StoreCommitCoord::MergeConcurrent {
                stream_id,
                sequence,
            } if stream_id == expected_stream => (stream_id.to_string(), sequence),
            StoreCommitCoord::MergeConcurrent { .. } => {
                return Err(DbError::Message(
                    "Merge materialization stream differs from its exact author registration"
                        .to_string(),
                ));
            }
            StoreCommitCoord::Serial { sequence } => (SERIAL_STREAM_ID.to_string(), sequence),
        };
        if sequence != commit.seq() || commit_ref.coord.policy() != commit.policy() {
            return Err(DbError::Message(
                "materialization coordinate differs from its signed commit".to_string(),
            ));
        }
        let predecessor = if commit.seq() == 1 {
            None
        } else if let Some(reference) =
            Self::materialized_commit_ref_on(conn, &stream_id, commit.seq() - 1)?
        {
            Some(reference)
        } else {
            conn.query_row(
                "SELECT commit_ref FROM snapshot_coverage \
                 WHERE device_id = ?1 AND seq = ?2",
                (
                    &stream_id,
                    Self::sequence_to_sqlite(&stream_id, commit.seq() - 1)?,
                ),
                |row| row.get::<_, String>(0),
            )
            .optional()
            .map_err(DbError::from)?
            .map(|reference| {
                serde_json::from_str(&reference).map_err(|error| {
                    DbError::Message(format!("snapshot coverage exact commit ref: {error}"))
                })
            })
            .transpose()?
        };
        if predecessor.as_ref() != commit.order.predecessor() {
            return Err(DbError::Message(format!(
                "Store commit {}/{} names predecessor {:?}, durable predecessor is {:?}",
                stream_id,
                commit.seq(),
                commit.order.predecessor(),
                predecessor
            )));
        }
        let mut device_state = load_declared_store_device_state_on(conn, &commit.device_state)?;
        let recovery_author = commit.device_registrations().iter().find_map(|activation| {
            if activation.registration != commit.author_registration {
                return None;
            }
            let crate::sync::store_commit::StoreDeviceRegistrationActivationRef::Recovery {
                node,
                ..
            } = &activation.authority
            else {
                return None;
            };
            let registration =
                load_activated_registration_on(conn, &root, &activation.registration).ok()?;
            let crate::sync::store_commit::StoreDeviceRegistrationOrigin::Recovery {
                owner_grant,
                ..
            } = registration.origin
            else {
                return None;
            };
            Some((
                activation.registration.clone(),
                crate::sync::store_commit::OwnerRecoveryCursor {
                    owner_grant,
                    position: crate::sync::store_commit::OwnerRecoveryPosition::At {
                        node: node.clone(),
                    },
                },
            ))
        });
        if let Some((registration, recovery)) = &recovery_author {
            device_state = device_state
                .activate_registration(registration.clone(), Some(recovery.clone()))
                .map_err(|error| DbError::Message(error.to_string()))?;
        }
        let active_author = device_state
            .devices
            .get(&commit.author_registration.device_id)
            .is_some_and(|record| {
                record.registration == commit.author_registration
                    && matches!(
                        record.status,
                        crate::sync::store_commit::StoreDeviceStatus::Active
                    )
            });
        if !active_author {
            return Err(DbError::Message(
                "materialized commit author is not active at its exact predecessor state".into(),
            ));
        }
        for activation in commit.device_registrations() {
            if recovery_author
                .as_ref()
                .is_some_and(|(registration, _)| registration == &activation.registration)
            {
                continue;
            }
            device_state = device_state
                .activate_registration(activation.registration.clone(), None)
                .map_err(|error| DbError::Message(error.to_string()))?;
        }
        for retirement in commit.device_retirements() {
            device_state = device_state
                .self_retire(retirement.clone())
                .map_err(|error| DbError::Message(error.to_string()))?;
        }
        let seq = Self::sequence_to_sqlite(&stream_id, commit.seq())?;
        let commit_ref_json = serde_json::to_string(commit_ref).map_err(|error| {
            DbError::Message(format!("serialize exact Store commit ref: {error}"))
        })?;
        conn.execute(
            "INSERT INTO store_device_state_snapshots (commit_ref, state) VALUES (?1, ?2)",
            rusqlite::params![
                &commit_ref_json,
                serde_json::to_string(&device_state).map_err(|error| {
                    DbError::Message(format!(
                        "serialize materialized Store device state: {error}"
                    ))
                })?,
            ],
        )
        .map_err(DbError::from)?;
        conn.execute(
            "INSERT INTO materialized_commits (device_id, seq, commit_ref) \
             VALUES (?1, ?2, ?3)",
            (&stream_id, seq, commit_ref_json),
        )
        .map(|_| ())
        .map_err(DbError::from)
    }

    pub(crate) fn record_verified_circle_activations_on(
        conn: &Connection,
        commit: &StoreBatchCommit,
        commit_ref: &StoreBatchCommitRef,
        activations: &[crate::sync::circle_ops::VerifiedCircleReference],
    ) -> Result<(), DbError> {
        if activations.len() != commit.circle_controls().len() {
            return Err(DbError::Message(
                "verified circle activations do not cover every control reference".to_string(),
            ));
        }
        commit_ref
            .verify_commit(commit)
            .map_err(|error| DbError::Message(error.to_string()))?;
        let stream_id = match &commit_ref.coord {
            StoreCommitCoord::MergeConcurrent { stream_id, .. } => stream_id.to_string(),
            StoreCommitCoord::Serial { .. } => SERIAL_STREAM_ID.to_string(),
        };
        let seq = Self::sequence_to_sqlite(&stream_id, commit_ref.coord.sequence())?;
        for activation in activations {
            if !commit.circle_controls().contains(&activation.reference)
                || activation.reference.circle_id() != activation.circle_id
                || activation.reference.control() != &activation.control.coord
                || !activation.control.verify()
            {
                return Err(DbError::Message(
                    "verified circle activation differs from Store control reference".to_string(),
                ));
            }
            let circle_id = activation.circle_id.to_string();
            if let Some(access) = &activation.local_access {
                let leaf = &access.leaf.value;
                if activation
                    .control
                    .value
                    .owners
                    .binary_search(&leaf.owner_pubkey)
                    .is_err()
                {
                    return Err(DbError::Message(format!(
                        "circle {circle_id} local access signer is not a control Owner"
                    )));
                }
                match (&leaf.disposition, &access.active) {
                    (crate::sync::circle::CircleAccessDisposition::Active { .. }, Some(_))
                    | (crate::sync::circle::CircleAccessDisposition::Inactive, None) => {}
                    _ => {
                        return Err(DbError::Message(format!(
                            "circle {circle_id} access state differs from its disposition"
                        )));
                    }
                }
            }
            let mut statement = conn
                .prepare(
                    "SELECT control_bytes FROM circle_control_activations
                     WHERE circle_id = ?1",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([&circle_id], |row| row.get::<_, Vec<u8>>(0))
                .map_err(DbError::from)?;
            let mut existing_controls = Vec::new();
            for bytes in rows {
                let bytes = bytes.map_err(DbError::from)?;
                let control: crate::sync::circle::CircleControl = serde_json::from_slice(&bytes)
                    .map_err(|error| {
                        DbError::Message(format!("parse activated circle control: {error}"))
                    })?;
                existing_controls.push(control);
            }
            drop(statement);
            match activation.control.value.order.previous_control_hash() {
                None if !existing_controls.is_empty() => {
                    return Err(DbError::Message(format!(
                        "circle {circle_id} already has a founder control"
                    )));
                }
                None => {}
                Some(previous_hash) => {
                    let previous = existing_controls
                        .iter()
                        .find(|control| control.control_hash() == previous_hash)
                        .ok_or_else(|| {
                            DbError::Message(format!(
                                "circle {circle_id} control predecessor {previous_hash} is absent"
                            ))
                        })?;
                    if previous.store_root_hash != activation.control.value.store_root_hash
                        || previous.circle_id != activation.circle_id
                        || previous
                            .owners
                            .binary_search(&activation.control.value.author_pubkey)
                            .is_err()
                        || activation.control.value.order.ordinal()
                            != previous.order.ordinal().checked_add(1).ok_or_else(|| {
                                DbError::Message("circle control ordinal overflow".to_string())
                            })?
                    {
                        return Err(DbError::Message(format!(
                            "circle {circle_id} control does not extend its authorized predecessor"
                        )));
                    }
                }
            }
            let control_coord =
                serde_json::to_string(&activation.control.coord).map_err(|error| {
                    DbError::Message(format!("serialize circle control coordinate: {error}"))
                })?;
            conn.execute(
                "INSERT INTO circle_control_activations
                 (circle_id, control_coord, stream_id, seq, commit_hash, control_bytes)
                 VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
                rusqlite::params![
                    &circle_id,
                    &control_coord,
                    stream_id,
                    seq,
                    commit.commit_hash().to_string(),
                    &activation.control.bytes,
                ],
            )
            .map_err(DbError::from)?;
            let Some(access) = &activation.local_access else {
                continue;
            };
            let disposition = match access.leaf.value.disposition {
                crate::sync::circle::CircleAccessDisposition::Active { .. } => "active",
                crate::sync::circle::CircleAccessDisposition::Inactive => "inactive",
            };
            conn.execute(
                "INSERT INTO circle_access_cache
                 (circle_id, control_coord, owner_pubkey, disposition, access_bytes)
                 VALUES (?1, ?2, ?3, ?4, ?5)",
                rusqlite::params![
                    &circle_id,
                    &control_coord,
                    &access.leaf.value.owner_pubkey,
                    disposition,
                    &access.leaf.bytes,
                ],
            )
            .map_err(DbError::from)?;
            if let Some(active) = &access.active {
                let roster_bytes = serde_json::to_vec(&active.roster).map_err(|error| {
                    DbError::Message(format!("serialize activated circle roster: {error}"))
                })?;
                conn.execute(
                    "INSERT INTO circle_roster_cache (circle_id, control_coord, roster_bytes)
                     VALUES (?1, ?2, ?3)",
                    rusqlite::params![&circle_id, &control_coord, roster_bytes,],
                )
                .map_err(DbError::from)?;
                let metadata_bytes = serde_json::to_vec(&active.metadata).map_err(|error| {
                    DbError::Message(format!("serialize activated circle metadata: {error}"))
                })?;
                conn.execute(
                    "INSERT INTO circle_metadata_cache
                     (circle_id, control_coord, metadata_bytes) VALUES (?1, ?2, ?3)",
                    rusqlite::params![&circle_id, &control_coord, metadata_bytes,],
                )
                .map_err(DbError::from)?;
            }
        }
        Ok(())
    }

    pub(crate) fn record_materialized_serial_commit_on(
        conn: &Connection,
        commit: &StoreBatchCommit,
        commit_ref: &StoreBatchCommitRef,
        authorization: &SerialAuthorizationState,
    ) -> Result<(), DbError> {
        if commit.policy() != WritePolicy::Serial {
            return Err(DbError::Message(
                "Serial membership state cannot accompany a MergeConcurrent commit".to_string(),
            ));
        }
        Self::record_materialized_commit_on(conn, commit, commit_ref)?;
        let membership = serde_json::to_string(&authorization.membership).map_err(|error| {
            DbError::Message(format!("serialize Serial membership state: {error}"))
        })?;
        let provider_admin =
            serde_json::to_string(&authorization.provider_admin).map_err(|error| {
                DbError::Message(format!(
                    "serialize Serial provider administrator state: {error}"
                ))
            })?;
        conn.execute(
            "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
             ON CONFLICT(key) DO UPDATE SET value = excluded.value",
            (SERIAL_MEMBERSHIP_STATE_KEY, membership),
        )
        .map_err(DbError::from)?;
        conn.execute(
            "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
             ON CONFLICT(key) DO UPDATE SET value = excluded.value",
            (SERIAL_PROVIDER_ADMIN_STATE_KEY, provider_admin),
        )
        .map_err(DbError::from)?;
        conn.execute(
            "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
             ON CONFLICT(key) DO UPDATE SET value = excluded.value",
            (
                SERIAL_KEY_GENERATION_STATE_KEY,
                authorization.key_generation.to_string(),
            ),
        )
        .map(|_| ())
        .map_err(DbError::from)
    }

    pub async fn serial_membership_state(&self) -> Result<Option<SerialMembershipState>, DbError> {
        let Some(raw) = self.get_protocol_state(SERIAL_MEMBERSHIP_STATE_KEY).await? else {
            return Ok(None);
        };
        serde_json::from_str(&raw)
            .map(Some)
            .map_err(|error| DbError::Message(format!("parse Serial membership state: {error}")))
    }

    pub async fn serial_authorization_state(
        &self,
    ) -> Result<Option<SerialAuthorizationState>, DbError> {
        let membership = self.get_protocol_state(SERIAL_MEMBERSHIP_STATE_KEY).await?;
        let provider_admin = self
            .get_protocol_state(SERIAL_PROVIDER_ADMIN_STATE_KEY)
            .await?;
        let key_generation = self
            .get_protocol_state(SERIAL_KEY_GENERATION_STATE_KEY)
            .await?;
        match (membership, provider_admin, key_generation) {
            (None, None, None) => Ok(None),
            (Some(membership), Some(provider_admin), Some(key_generation)) => {
                let membership = serde_json::from_str(&membership).map_err(|error| {
                    DbError::Message(format!("parse Serial membership state: {error}"))
                })?;
                let provider_admin: ProviderAdminState = serde_json::from_str(&provider_admin)
                    .map_err(|error| {
                        DbError::Message(format!(
                            "parse Serial provider administrator state: {error}"
                        ))
                    })?;
                let key_generation = key_generation.parse::<u64>().map_err(|error| {
                    DbError::Message(format!("parse Serial key generation: {error}"))
                })?;
                Ok(Some(SerialAuthorizationState {
                    membership,
                    provider_admin,
                    key_generation,
                }))
            }
            _ => Err(DbError::Message(
                "Serial authorization state is only partially durable".to_string(),
            )),
        }
    }

    pub async fn serial_key_generation(&self) -> Result<Option<u64>, DbError> {
        let Some(raw) = self
            .get_protocol_state(SERIAL_KEY_GENERATION_STATE_KEY)
            .await?
        else {
            return Ok(None);
        };
        raw.parse::<u64>()
            .map(Some)
            .map_err(|error| DbError::Message(format!("parse Serial key generation: {error}")))
    }

    fn install_serial_root_authorization_on(
        conn: &Connection,
        founder_pubkey: &str,
        authorization: &SerialAuthorizationState,
    ) -> Result<(), DbError> {
        if Self::latest_position_for_device_on(conn, SERIAL_STREAM_ID)?.is_some() {
            return Err(DbError::Message(
                "cannot install founder-only Serial authorization after a materialized commit"
                    .to_string(),
            ));
        }
        let existing_state: i64 = conn
            .query_row(
                "SELECT COUNT(*) FROM protocol_state WHERE key IN (?1, ?2, ?3, ?4)",
                rusqlite::params![
                    crate::sync::membership_ops::OWNER_PUBKEY_STATE_KEY,
                    SERIAL_MEMBERSHIP_STATE_KEY,
                    SERIAL_KEY_GENERATION_STATE_KEY,
                    SERIAL_PROVIDER_ADMIN_STATE_KEY,
                ],
                |row| row.get(0),
            )
            .map_err(DbError::from)?;
        if existing_state != 0 {
            return Err(DbError::Message(
                "cannot install founder-only Serial authorization over existing state".to_string(),
            ));
        }
        let membership = serde_json::to_string(&authorization.membership).map_err(|error| {
            DbError::Message(format!(
                "serialize Serial founder membership state: {error}"
            ))
        })?;
        let provider_admin =
            serde_json::to_string(&authorization.provider_admin).map_err(|error| {
                DbError::Message(format!(
                    "serialize Serial founder provider administrator state: {error}"
                ))
            })?;
        for (key, value) in [
            (
                crate::sync::membership_ops::OWNER_PUBKEY_STATE_KEY,
                founder_pubkey.to_string(),
            ),
            (SERIAL_MEMBERSHIP_STATE_KEY, membership),
            (SERIAL_PROVIDER_ADMIN_STATE_KEY, provider_admin),
            (
                SERIAL_KEY_GENERATION_STATE_KEY,
                authorization.key_generation.to_string(),
            ),
        ] {
            conn.execute(
                "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
                 ON CONFLICT(key) DO UPDATE SET value = excluded.value",
                (key, value),
            )
            .map_err(DbError::from)?;
        }
        Ok(())
    }

    pub(crate) async fn install_serial_root_authorization(
        &self,
        founder_pubkey: String,
        authorization: SerialAuthorizationState,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            Self::install_serial_root_authorization_on(&tx, &founder_pubkey, &authorization)?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn materialize_serial_control_commit(
        &self,
        commit: StoreBatchCommit,
        commit_ref: StoreBatchCommitRef,
        authorization_after: SerialAuthorizationState,
    ) -> Result<(), DbError> {
        if commit.control().is_none() || commit.store_package().is_some() {
            return Err(DbError::Message(
                "Serial control materialization requires a control-only Store batch".to_string(),
            ));
        }
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            Self::record_materialized_serial_commit_on(
                &tx,
                &commit,
                &commit_ref,
                &authorization_after,
            )?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn install_serial_authorization_at_position(
        &self,
        expected: StoreBatchCommitRef,
        authorization: SerialAuthorizationState,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let actual = Self::latest_position_for_device_on(&tx, SERIAL_STREAM_ID)?;
            if actual.as_ref() != Some(&expected) {
                return Err(DbError::Message(format!(
                    "cannot install Serial authorization at {expected:?}; durable position is {actual:?}"
                )));
            }
            let membership = serde_json::to_string(&authorization.membership).map_err(|error| {
                DbError::Message(format!("serialize Serial membership state: {error}"))
            })?;
            let provider_admin = serde_json::to_string(&authorization.provider_admin).map_err(
                |error| {
                    DbError::Message(format!(
                        "serialize Serial provider administrator state: {error}"
                    ))
                },
            )?;
            tx.execute(
                "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
                 ON CONFLICT(key) DO UPDATE SET value = excluded.value",
                (SERIAL_MEMBERSHIP_STATE_KEY, membership),
            )
            .map_err(DbError::from)?;
            tx.execute(
                "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
                 ON CONFLICT(key) DO UPDATE SET value = excluded.value",
                (SERIAL_PROVIDER_ADMIN_STATE_KEY, provider_admin),
            )
            .map_err(DbError::from)?;
            tx.execute(
                "INSERT INTO protocol_state (key, value) VALUES (?1, ?2) \
                 ON CONFLICT(key) DO UPDATE SET value = excluded.value",
                (
                    SERIAL_KEY_GENERATION_STATE_KEY,
                    authorization.key_generation.to_string(),
                ),
            )
            .map_err(DbError::from)?;
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn install_bootstrap_state(
        &self,
        coverage: &CommitFrontier,
        snapshot: PublishedStoreSnapshot,
        store_root: crate::sync::store_objects::VerifiedObject<StoreProtocolRoot>,
        founder: crate::sync::store_objects::VerifiedObject<StoreDeviceRegistration>,
    ) -> Result<(), DbError> {
        if store_root.value.to_bytes() != store_root.bytes
            || store_root.value.object_hash() != store_root.semantic_hash
        {
            return Err(DbError::Message(
                "bootstrap Store root differs from its verified object".to_string(),
            ));
        }
        let store_root_ref = crate::sync::store_commit::StoreRootRef {
            store_root_id: store_root.value.descriptor.store_root_id(),
            store_root_hash: store_root.semantic_hash,
            object: store_root.object,
        };
        let founder_reference =
            StoreDeviceRegistrationRef::from_registration(&founder.value, founder.object.clone());
        if founder.semantic_hash != founder_reference.registration_hash {
            return Err(DbError::Message(
                "bootstrap founder semantic hash differs from its exact registration".to_string(),
            ));
        }
        let genesis = ResolvedStoreDeviceState::founder(
            &store_root_ref,
            founder_reference.clone(),
            &store_root.value.descriptor.founder_pubkey,
            store_root.value.descriptor.founder_grant.clone(),
            &store_root.value.descriptor.founder_recovery,
        )
        .map_err(|error| DbError::Message(error.to_string()))?;
        if coverage.policy() != self.write_policy() {
            return Err(DbError::Message(format!(
                "snapshot coverage uses {:?}, database uses {:?}",
                coverage.policy(),
                self.write_policy()
            )));
        }
        if snapshot.meta.coverage != *coverage
            || snapshot.meta.store_root_hash != store_root_ref.store_root_hash
            || snapshot.meta.snapshot_hash() != snapshot.reference.snapshot_hash
            || snapshot.meta.successor.next_slot != snapshot.successor_slot
        {
            return Err(DbError::Message(
                "bootstrap snapshot state differs from its exact signed metadata".to_string(),
            ));
        }
        let coverage = coverage.clone().into_refs();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            validate_snapshot_object_owners_on(&tx, &store_root_ref, &snapshot.meta)?;
            install_store_root_authority_on(&tx, &store_root_ref, &store_root.bytes)?;
            install_store_founder_state_on(
                &tx,
                &store_root_ref,
                &founder_reference,
                &founder.value,
                &founder.bytes,
                &genesis,
            )?;
            tx.execute("DELETE FROM snapshot_coverage", [])
                .map_err(DbError::from)?;
            for (stream_id, reference) in coverage {
                let encoded = serde_json::to_string(&reference).map_err(|error| {
                    DbError::Message(format!("serialize snapshot exact commit ref: {error}"))
                })?;
                tx.execute(
                    "INSERT INTO snapshot_coverage \
                     (device_id, seq, commit_ref, snapshot_hash) VALUES (?1, ?2, ?3, ?4)",
                    (
                        &stream_id,
                        Self::sequence_to_sqlite(&stream_id, reference.coord.sequence())?,
                        encoded,
                        snapshot.reference.snapshot_hash.to_string(),
                    ),
                )
                .map_err(DbError::from)?;
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn install_device_join_bootstrap(
        &self,
        root: crate::sync::store_commit::StoreRootRef,
        plan: crate::sync::store_pull::DeviceJoinBootstrapPlan,
    ) -> Result<(), DbError> {
        if plan.coverage.policy() != self.write_policy() {
            return Err(DbError::Message(
                "device join bootstrap cut differs from the database write policy".to_string(),
            ));
        }
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let installed_root = required_store_root_authority_on(&tx)?;
            if installed_root != root || plan.founder.store_root != root {
                return Err(DbError::Message(
                    "device join bootstrap root differs from the installed exact root".to_string(),
                ));
            }
            install_store_founder_state_on(
                &tx,
                &root,
                &plan.founder_reference,
                &plan.founder,
                &plan.founder_bytes,
                &plan.genesis,
            )?;

            let coverage_refs = match plan.coverage.clone() {
                crate::sync::store_commit::StoreHistoryCut::MergeConcurrent(frontier) => frontier
                    .into_iter()
                    .map(|(stream_id, reference)| (stream_id.to_string(), reference))
                    .collect::<BTreeMap<_, _>>(),
                crate::sync::store_commit::StoreHistoryCut::Serial(
                    StoreSerialPredecessor::Commit(reference),
                ) => BTreeMap::from([(SERIAL_STREAM_ID.to_string(), reference)]),
                crate::sync::store_commit::StoreHistoryCut::Serial(
                    StoreSerialPredecessor::Genesis { .. },
                ) => BTreeMap::new(),
            };
            let mut coverage = BTreeMap::new();
            for (stream_id, reference) in coverage_refs {
                let sequence = reference.coord.sequence();
                let materialized = Self::materialized_commit_ref_on(&tx, &stream_id, sequence)?;
                if materialized.as_ref().is_some_and(|stored| stored != &reference) {
                    return Err(DbError::Message(format!(
                        "device join bootstrap conflicts with materialized commit at {stream_id}/{sequence}"
                    )));
                }
                let snapshot = tx
                    .query_row(
                        "SELECT commit_ref FROM snapshot_coverage
                         WHERE device_id = ?1 AND seq = ?2",
                        (
                            &stream_id,
                            Self::sequence_to_sqlite(&stream_id, sequence)?,
                        ),
                        |row| row.get::<_, String>(0),
                    )
                    .optional()
                    .map_err(DbError::from)?
                    .map(|encoded| Self::parse_stored_commit_ref(&stream_id, sequence, &encoded))
                    .transpose()?;
                if snapshot.as_ref().is_some_and(|stored| stored != &reference) {
                    return Err(DbError::Message(format!(
                        "device join bootstrap conflicts with snapshot coverage at {stream_id}/{sequence}"
                    )));
                }
                coverage.insert(
                    stream_id,
                    (reference, materialized.is_some() || snapshot.is_some()),
                );
            }

            for prepared in &plan.commits {
                let stream_id = match &prepared.reference.coord {
                    StoreCommitCoord::MergeConcurrent { stream_id, .. } => stream_id.to_string(),
                    StoreCommitCoord::Serial { .. } => SERIAL_STREAM_ID.to_string(),
                };
                let already_represented = coverage.get(&stream_id).is_some_and(
                    |(reference, represented)| {
                        *represented
                            && prepared.reference.coord.sequence()
                                <= reference.coord.sequence()
                    },
                );
                if !already_represented
                    && (prepared.commit.store_package().is_some()
                        || !prepared.commit.circle_packages().is_empty())
                {
                    return Err(DbError::Message(format!(
                        "device join bootstrap cannot advance over unmaterialized row data at {stream_id}/{}",
                        prepared.reference.coord.sequence()
                    )));
                }
            }

            for prepared in plan.commits {
                let stream_id = match &prepared.reference.coord {
                    StoreCommitCoord::MergeConcurrent { stream_id, .. } => stream_id.to_string(),
                    StoreCommitCoord::Serial { .. } => SERIAL_STREAM_ID.to_string(),
                };
                if coverage.get(&stream_id).is_some_and(|(reference, represented)| {
                    *represented
                        && prepared.reference.coord.sequence() <= reference.coord.sequence()
                }) {
                    continue;
                }
                if let Some(existing) = Self::materialized_commit_ref_on(
                    &tx,
                    &stream_id,
                    prepared.reference.coord.sequence(),
                )? {
                    if existing != prepared.reference {
                        return Err(DbError::Message(format!(
                            "device join bootstrap conflicts at {stream_id}/{}",
                            prepared.reference.coord.sequence()
                        )));
                    }
                    continue;
                }
                Self::record_activated_store_device_registrations_on(
                    &tx,
                    &prepared.commit,
                    &prepared.registrations,
                )?;
                Self::record_materialized_commit_on(&tx, &prepared.commit, &prepared.reference)?;
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    fn sequence_from_sqlite(device_id: &str, value: i64) -> Result<u64, DbError> {
        let value = u64::try_from(value).map_err(|_| {
            DbError::Message(format!(
                "Store position for {device_id:?} contains negative sequence {value}"
            ))
        })?;
        if value == 0 {
            return Err(DbError::Message(format!(
                "Store position for {device_id:?} contains sequence zero"
            )));
        }
        Ok(value)
    }

    fn sequence_to_sqlite(device_id: &str, value: u64) -> Result<i64, DbError> {
        if value == 0 {
            return Err(DbError::Message(format!(
                "Store position for {device_id:?} cannot use sequence zero"
            )));
        }
        i64::try_from(value).map_err(|_| {
            DbError::Message(format!(
                "Store position for {device_id:?} exceeds SQLite INTEGER"
            ))
        })
    }

    pub(crate) fn persist_prepared_audience_objects_on(
        conn: &Connection,
        write_id: &WriteId,
        packages: &[PreparedAudiencePackage],
        blobs: &[PreparedAudienceBlob],
    ) -> Result<(), DbError> {
        let package_audiences = packages
            .iter()
            .map(|prepared| {
                if prepared.package().write_id() != write_id {
                    return Err(DbError::Message(format!(
                        "prepared audience package write {} differs from journal write {write_id}",
                        prepared.package().write_id()
                    )));
                }
                Ok(prepared.package().audience().remote_audience())
            })
            .collect::<Result<std::collections::BTreeSet<_>, DbError>>()?;
        if package_audiences.len() != packages.len() {
            return Err(DbError::Message(format!(
                "write {write_id} has duplicate prepared package audiences"
            )));
        }
        for prepared in packages {
            let audience = prepared.package().audience().remote_audience();
            validate_remote_object_on(
                conn,
                prepared.remote_object_id(),
                prepared.object(),
                prepared.semantic_bytes(),
                RemoteStoredRepresentationRef::Inline(prepared.stored_bytes()),
            )?;
            conn.execute(
                "INSERT INTO store_write_packages
                 (write_id, audience, remote_object_id)
                 VALUES (?1, ?2, ?3)
                 ON CONFLICT(write_id, audience) DO NOTHING",
                rusqlite::params![
                    write_id.as_str(),
                    remote_audience_to_db(&audience),
                    prepared.remote_object_id().to_string(),
                ],
            )
            .map_err(DbError::from)?;
            validate_prepared_package_on(conn, write_id, prepared)?;
        }
        for prepared in blobs {
            if !package_audiences.contains(prepared.audience()) {
                return Err(DbError::Message(format!(
                    "write {write_id} has a prepared blob for {:?} without that audience's package",
                    prepared.audience()
                )));
            }
            let locator = prepared.blob().locator();
            validate_remote_object_on(
                conn,
                prepared.remote_object_id(),
                prepared.blob().object(),
                &locator.to_bytes(),
                RemoteStoredRepresentationRef::Blob,
            )?;
            let locator_hash = locator.locator_hash();
            let spool_path = prepared
                .spool_path()
                .map(|path| {
                    path.to_str().map(str::to_string).ok_or_else(|| {
                        DbError::Message("prepared blob spool path is not UTF-8".to_string())
                    })
                })
                .transpose()?;
            conn.execute(
                "INSERT INTO store_write_blobs
                 (write_id, audience, locator_hash, remote_object_id, spool_path)
                 VALUES (?1, ?2, ?3, ?4, ?5)
                 ON CONFLICT(write_id, audience, remote_object_id) DO NOTHING",
                rusqlite::params![
                    write_id.as_str(),
                    remote_audience_to_db(prepared.audience()),
                    locator_hash.to_string(),
                    prepared.remote_object_id().to_string(),
                    spool_path,
                ],
            )
            .map_err(DbError::from)?;
            validate_prepared_blob_on(conn, write_id, prepared)?;
        }
        Ok(())
    }

    fn persist_closed_write_objects_on(
        conn: &Connection,
        write_id: &WriteId,
        store_root_hash: ObjectHash,
        commit_ref: &StoreBatchCommitRef,
        commit: &StoreBatchCommit,
        commit_stored_bytes: &[u8],
        partitions: &PreparedStoreWritePartitions,
        remote_objects: &[RemoteObjectRecord],
        audiences: &PreparedAudienceObjects,
    ) -> Result<(), DbError> {
        let mut object_ids = std::collections::BTreeSet::new();
        for remote in remote_objects {
            remote
                .validate()
                .map_err(|error| DbError::Message(format!("prepared remote object: {error}")))?;
            if !object_ids.insert(remote.object_id()) {
                return Err(DbError::Message(
                    "prepared write contains a duplicate remote object".to_string(),
                ));
            }
        }
        validate_prepared_audience_blob_graph(&object_ids, audiences)?;
        for remote in remote_objects {
            let object_id = remote.object_id();
            let existing = conn
                .query_row(
                    "SELECT state FROM remote_objects WHERE object_id = ?1",
                    [object_id.to_string()],
                    |row| row.get::<_, String>(0),
                )
                .optional()
                .map_err(DbError::from)?;
            let persisted = match existing {
                Some(state) => {
                    let existing: RemoteObjectRecord = serde_json::from_str(&state).map_err(
                        |error| {
                            DbError::Message(format!(
                                "prepared remote object {object_id} has invalid closed state: {error}"
                            ))
                        },
                    )?;
                    merge_prepared_remote_object(existing, remote, commit_ref)?
                }
                None => remote.clone(),
            };
            let state = serde_json::to_string(&persisted).map_err(|error| {
                DbError::Message(format!("serialize closed remote object: {error}"))
            })?;
            conn.execute(
                "INSERT INTO remote_objects (object_id, state) VALUES (?1, ?2)
                 ON CONFLICT(object_id) DO UPDATE SET state = excluded.state",
                (object_id.to_string(), state),
            )
            .map_err(DbError::from)?;
        }
        let commit_remote = RemoteObjectRecord::candidate_commit(
            commit_ref.clone(),
            commit.to_bytes(),
            commit_stored_bytes.to_vec(),
        )
        .map_err(|error| DbError::Message(format!("prepared candidate commit: {error}")))?;
        persist_exact_remote_object_on(conn, &commit_remote, "candidate commit")?;
        let expected_partition_count = usize::from(partitions.store.is_some())
            .checked_add(partitions.circles.len())
            .ok_or_else(|| DbError::Message("audience partition count overflow".to_string()))?;
        if audiences.packages.len() != expected_partition_count {
            return Err(DbError::Message(
                "prepared audience packages do not cover every write partition".to_string(),
            ));
        }
        let mut indexed = std::collections::BTreeSet::new();
        for package in &audiences.packages {
            let value = package.package();
            if value.store_root_hash() != store_root_hash
                || value.write_id() != write_id
                || value.commit_coord() != &commit_ref.coord
                || value.candidate_family() != commit.candidate_family()
            {
                return Err(DbError::Message(
                    "prepared audience package differs from its exact Store commit".to_string(),
                ));
            }
            match value.audience() {
                crate::sync::audience_package::PackageAudience::Store => {
                    let partition = partitions.store.as_ref().ok_or_else(|| {
                        DbError::Message(
                            "prepared Store package has no Store partition".to_string(),
                        )
                    })?;
                    if value.changeset() != partition.changeset {
                        return Err(DbError::Message(
                            "prepared Store package changeset differs from its partition"
                                .to_string(),
                        ));
                    }
                    commit
                        .verify_store_package(package.semantic_bytes())
                        .map_err(|error| DbError::Message(error.to_string()))?;
                }
                crate::sync::audience_package::PackageAudience::Circle { circle_id, .. } => {
                    let partition = partitions
                        .circles
                        .iter()
                        .find(|partition| partition.audience == Audience::Circle(*circle_id))
                        .ok_or_else(|| {
                            DbError::Message(format!(
                                "prepared Circle package {circle_id} has no partition"
                            ))
                        })?;
                    if value.changeset() != partition.changeset {
                        return Err(DbError::Message(format!(
                            "prepared Circle package {circle_id} changeset differs from its partition"
                        )));
                    }
                    commit
                        .verify_circle_package(*circle_id, package.semantic_bytes())
                        .map_err(|error| DbError::Message(error.to_string()))?;
                }
            }
            indexed.insert(package.remote_object_id());
        }
        indexed.extend(
            audiences
                .blobs
                .iter()
                .map(PreparedAudienceBlob::remote_object_id),
        );
        debug_assert_eq!(indexed, object_ids);
        Self::persist_prepared_audience_objects_on(
            conn,
            write_id,
            &audiences.packages,
            &audiences.blobs,
        )
    }

    fn validate_loaded_write_objects(
        write_id: &WriteId,
        commit_ref: &StoreBatchCommitRef,
        commit: &StoreBatchCommit,
        partitions: &PreparedStoreWritePartitions,
        audiences: &PreparedAudienceObjects,
    ) -> Result<(), DbError> {
        let expected_package_count = usize::from(commit.store_package().is_some())
            .checked_add(commit.circle_packages().len())
            .ok_or_else(|| DbError::Message("package count overflow".to_string()))?;
        let partition_count = usize::from(partitions.store.is_some())
            .checked_add(partitions.circles.len())
            .ok_or_else(|| DbError::Message("audience partition count overflow".to_string()))?;
        if audiences.packages.len() != expected_package_count
            || audiences.packages.len() != partition_count
        {
            return Err(DbError::Message(
                "prepared package indexes do not exactly cover commit audiences".to_string(),
            ));
        }
        for package in &audiences.packages {
            let value = package.package();
            if value.write_id() != write_id
                || value.commit_coord() != &commit_ref.coord
                || value.candidate_family() != commit.candidate_family()
            {
                return Err(DbError::Message(
                    "indexed audience package differs from its exact commit".to_string(),
                ));
            }
            let expected_object = match value.audience() {
                crate::sync::audience_package::PackageAudience::Store => {
                    commit
                        .verify_store_package(package.semantic_bytes())
                        .map_err(|error| DbError::Message(error.to_string()))?;
                    &commit
                        .store_package()
                        .as_ref()
                        .expect("verified present")
                        .object
                }
                crate::sync::audience_package::PackageAudience::Circle { circle_id, .. } => {
                    commit
                        .verify_circle_package(*circle_id, package.semantic_bytes())
                        .map_err(|error| DbError::Message(error.to_string()))?;
                    &commit
                        .circle_packages()
                        .iter()
                        .find(|entry| entry.circle_id == *circle_id)
                        .expect("verified present")
                        .package
                        .object
                }
            };
            if package.object() != expected_object {
                return Err(DbError::Message(
                    "indexed audience package exact object differs from its commit".to_string(),
                ));
            }
            value
                .validate_blob_uploader(&commit.author_registration)
                .map_err(|error| DbError::Message(error.to_string()))?;
        }
        validate_prepared_audience_blob_bindings(audiences)
    }

    fn activate_prepared_write_on(
        conn: &Connection,
        gates: &Gates,
        synced_tables: &[SyncedTable],
        write_id: &WriteId,
        commit: &StoreBatchCommit,
        commit_ref: &StoreBatchCommitRef,
        local_cleanup: StoreBatchLocalCleanup,
        additional_object_ids: &[ObjectHash],
    ) -> Result<(), DbError> {
        commit_ref
            .verify_commit(commit)
            .map_err(|error| DbError::Message(error.to_string()))?;
        let audiences = load_prepared_audience_objects_on(conn, write_id)?;
        for package in &audiences.packages {
            package
                .package()
                .validate_blob_uploader(&commit.author_registration)
                .map_err(|error| DbError::Message(error.to_string()))?;
        }
        let mut object_ids = std::collections::BTreeSet::new();
        object_ids.insert(remote_object_id(&commit_ref.object));
        object_ids.extend(
            audiences
                .packages
                .iter()
                .map(PreparedAudiencePackage::remote_object_id),
        );
        object_ids.extend(
            audiences
                .blobs
                .iter()
                .map(PreparedAudienceBlob::remote_object_id),
        );
        object_ids.extend(additional_object_ids.iter().copied());
        for object_id in object_ids {
            let remote = load_remote_object_on(conn, object_id)?
                .into_activated(commit_ref)
                .map_err(|error| {
                    DbError::Message(format!("activate remote object {object_id}: {error}"))
                })?;
            let state = serde_json::to_string(&remote).map_err(|error| {
                DbError::Message(format!("serialize activated remote object: {error}"))
            })?;
            let updated = conn
                .execute(
                    "UPDATE remote_objects SET state = ?2 WHERE object_id = ?1",
                    (object_id.to_string(), state),
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(format!(
                    "remote object {object_id} disappeared during activation"
                )));
            }
        }
        let activation = BlobActivation {
            coord: commit_ref.coord.clone(),
        };
        let mut consumed_uploads = 0;
        for package in &audiences.packages {
            let winning_rows = crate::sync::apply::current_winning_rows(
                conn,
                synced_tables,
                package.package().changeset(),
            )?;
            Self::install_winning_blob_bindings_on(
                conn,
                gates,
                synced_tables,
                package.package(),
                &activation,
                &winning_rows,
            )?;
            for binding in package.package().blob_bindings() {
                if consume_created_upload_handoff_on(conn, package.package(), binding)? {
                    consumed_uploads += 1;
                }
            }
        }
        match Self::make_remote_publication_root_on(conn, write_id)? {
            Some((root_table, root_id)) => {
                if consumed_uploads == 0 {
                    return Err(DbError::Message(format!(
                        "make_remote publication {write_id} for {root_table:?}/{root_id:?} contains no Created upload handoff"
                    )));
                }
                let remaining: i64 = conn
                    .query_row(
                        "SELECT COUNT(*) FROM cloud_outbox
                         WHERE operation = 'upload' AND root_table = ?1 AND root_id = ?2",
                        (&root_table, &root_id),
                        |row| row.get(0),
                    )
                    .map_err(DbError::from)?;
                if remaining != 0 {
                    return Err(DbError::Message(format!(
                        "make_remote publication {write_id} left {remaining} upload handoff(s) for {root_table:?}/{root_id:?}"
                    )));
                }
                Self::complete_make_remote_publication_on(conn, write_id)?;
            }
            None if consumed_uploads != 0 => {
                return Err(DbError::Message(format!(
                    "Store write {write_id} consumed Created upload handoffs without a make_remote publication intent"
                )));
            }
            None => {}
        }
        Self::record_materialized_commit_on(conn, commit, commit_ref)?;
        for drop in local_cleanup.drops {
            conn.execute(
                "INSERT INTO published_blob_drop_intents
                 (seq, namespace, blob_id, size, disposition)
                 VALUES (?1, ?2, ?3, ?4, ?5)
                 ON CONFLICT(seq, namespace, blob_id) DO NOTHING",
                rusqlite::params![
                    Self::sequence_to_sqlite(
                        &match &commit_ref.coord {
                            StoreCommitCoord::MergeConcurrent { stream_id, .. } => {
                                stream_id.to_string()
                            }
                            StoreCommitCoord::Serial { .. } => SERIAL_STREAM_ID.to_string(),
                        },
                        commit_ref.coord.sequence(),
                    )?,
                    drop.namespace,
                    drop.id,
                    i64::try_from(drop.size).map_err(|_| DbError::Message(
                        "outbound local cleanup size exceeds SQLite integer".to_string()
                    ))?,
                    drop.disposition.as_db(),
                ],
            )
            .map_err(DbError::from)?;
        }
        conn.execute(
            "DELETE FROM store_write_packages WHERE write_id = ?1",
            [write_id.as_str()],
        )
        .map_err(DbError::from)?;
        conn.execute(
            "DELETE FROM store_write_blobs WHERE write_id = ?1",
            [write_id.as_str()],
        )
        .map_err(DbError::from)?;
        conn.execute(
            "DELETE FROM store_write_blob_leases WHERE write_id = ?1",
            [write_id.as_str()],
        )
        .map_err(DbError::from)?;
        Ok(())
    }

    #[cfg(test)]
    pub(crate) async fn prepared_audience_objects(
        &self,
        write_id: &WriteId,
    ) -> Result<PreparedAudienceObjects, DbError> {
        let write_id = write_id.clone();
        let loaded = self
            .call(move |conn| load_prepared_audience_objects_on(conn, &write_id))
            .await?;

        let mut verified_blobs = Vec::with_capacity(loaded.blobs.len());
        for prepared in loaded.blobs {
            if let Some(spool_path) = prepared.spool_path() {
                crate::local_blob::verify_exact_file(prepared.blob().object(), spool_path)
                    .await
                    .map_err(|error| DbError::Message(format!("prepared blob spool: {error}")))?;
            }
            verified_blobs.push(prepared);
        }
        Ok(PreparedAudienceObjects {
            packages: loaded.packages,
            blobs: verified_blobs,
        })
    }

    pub(crate) async fn prepared_remote_objects(
        &self,
        write_id: &WriteId,
    ) -> Result<Vec<PreparedRemoteObject>, DbError> {
        let write_id = write_id.clone();
        self.call(move |conn| {
            let mut statement = conn
                .prepare(
                    "SELECT remote_object_id, NULL AS spool_path
                     FROM store_write_packages WHERE write_id = ?1
                     UNION
                     SELECT remote_object_id, spool_path
                     FROM store_write_blobs WHERE write_id = ?1
                     ORDER BY remote_object_id",
                )
                .map_err(DbError::from)?;
            let ids = statement
                .query_map([write_id.as_str()], |row| {
                    Ok((row.get::<_, String>(0)?, row.get::<_, Option<String>>(1)?))
                })
                .map_err(DbError::from)?
                .collect::<Result<Vec<_>, _>>()
                .map_err(DbError::from)?;
            ids.into_iter()
                .map(|(encoded, spool_path)| {
                    let id = encoded.parse().map_err(|error| {
                        DbError::Message(format!("prepared remote object id: {error}"))
                    })?;
                    Ok(PreparedRemoteObject {
                        record: load_remote_object_on(conn, id)?,
                        spool_path: spool_path.map(PathBuf::from),
                    })
                })
                .collect()
        })
        .await
    }

    pub(crate) async fn mark_remote_object_uploaded(
        &self,
        expected: RemoteObjectRecord,
    ) -> Result<RemoteObjectRecord, DbError> {
        self.call(move |conn| mark_remote_object_uploaded_on(conn, expected))
            .await
    }

    pub(crate) async fn mark_candidate_commit_uploaded(
        &self,
        commit: StoreBatchCommitRef,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let object_id = remote_object_id(&commit.object);
            let current = load_remote_object_on(conn, object_id)?;
            if !matches!(
                &current,
                RemoteObjectRecord::CandidateCommit(record) if record.identity == commit
            ) {
                return Err(DbError::Message(format!(
                    "remote object {object_id} is not the exact candidate commit"
                )));
            }
            mark_remote_object_uploaded_on(conn, current)?;
            Ok(())
        })
        .await
    }

    pub(crate) async fn mark_store_head_uploaded(
        &self,
        head: crate::sync::store_commit::StoreDeviceHeadRef,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let object_id = remote_object_id(&head.object);
            let current = load_remote_object_on(conn, object_id)?;
            if !matches!(
                &current,
                RemoteObjectRecord::RetainedAuthority(record)
                    if matches!(
                        &record.identity.domain,
                        crate::sync::remote_object::RetainedAuthorityObjectDomain::StoreDeviceHead {
                            reference
                        } if reference == &head
                    )
            ) {
                return Err(DbError::Message(format!(
                    "remote object {object_id} is not the exact prepared Store head"
                )));
            }
            mark_remote_object_uploaded_on(conn, current)?;
            Ok(())
        })
        .await
    }

    pub(crate) async fn blocked_merge_candidate(
        &self,
        write_id: WriteId,
    ) -> Result<Option<BlockedMergeCandidate>, DbError> {
        self.call(move |conn| {
            let row: Option<(String, Option<String>)> = conn
                .query_row(
                    "SELECT status, prepared FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .optional()
                .map_err(DbError::from)?;
            let Some((raw_status, raw_prepared)) = row else {
                return Err(DbError::Message(format!("write {write_id} is absent")));
            };
            let status: WriteStatus = serde_json::from_str(&raw_status).map_err(|error| {
                DbError::Message(format!("blocked Merge candidate status: {error}"))
            })?;
            if !matches!(status, WriteStatus::Blocked(_)) {
                return Err(DbError::Message(format!("write {write_id} is not blocked")));
            }
            let Some(raw_prepared) = raw_prepared else {
                return Ok(None);
            };
            let prepared: PreparedStoreWriteState =
                serde_json::from_str(&raw_prepared).map_err(|error| {
                    DbError::Message(format!("blocked Merge candidate preparation: {error}"))
                })?;
            let PreparedStoreWriteState::MergeConcurrent { .. } = &prepared else {
                return match prepared {
                    PreparedStoreWriteState::MergeAbandonment { .. } => Ok(None),
                    PreparedStoreWriteState::SerialPreparing
                    | PreparedStoreWriteState::Serial { .. } => Err(DbError::Message(
                        "Serial state reached Merge candidate abandonment".to_string(),
                    )),
                    PreparedStoreWriteState::MergeConcurrent { .. } => unreachable!(),
                };
            };
            let candidate = parse_prepared_merge_candidate_on(conn, &prepared)?
                .expect("matched Merge preparation");
            if candidate.commit.write_id != write_id {
                return Err(DbError::Message(
                    "blocked Merge candidate differs from its write identity".to_string(),
                ));
            }
            Ok(Some(BlockedMergeCandidate {
                commit: ExactProtocolObject {
                    value: candidate.commit,
                    bytes: candidate.canonical_signed_bytes,
                    object: candidate.reference.object.clone(),
                    prepared: match &prepared {
                        PreparedStoreWriteState::MergeConcurrent { commit, .. } => {
                            commit.prepared.clone()
                        }
                        _ => unreachable!("matched Merge preparation"),
                    },
                },
                head: ExactProtocolObject {
                    value: candidate.head,
                    bytes: match &prepared {
                        PreparedStoreWriteState::MergeConcurrent { head, .. } => {
                            head.semantic_bytes.clone()
                        }
                        _ => unreachable!("matched Merge preparation"),
                    },
                    object: candidate.head_prepared.reference().clone(),
                    prepared: candidate.head_prepared,
                },
            }))
        })
        .await
    }

    #[doc(hidden)]
    pub async fn merge_candidate_abandonment_required(
        &self,
        write_id: &WriteId,
    ) -> Result<bool, DbError> {
        if !matches!(
            self.merge_abandonment_state(write_id).await?,
            MergeAbandonmentState::None
        ) {
            return Ok(true);
        }
        Ok(self
            .blocked_merge_candidate(write_id.clone())
            .await?
            .is_some())
    }

    pub(crate) async fn merge_abandonment_state(
        &self,
        write_id: &WriteId,
    ) -> Result<MergeAbandonmentState, DbError> {
        let write_id = write_id.clone();
        self.call(move |conn| {
            let raw_prepared: Option<String> = conn
                .query_row(
                    "SELECT prepared FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let Some(raw_prepared) = raw_prepared else {
                return Ok(MergeAbandonmentState::None);
            };
            let prepared: PreparedStoreWriteState =
                serde_json::from_str(&raw_prepared).map_err(|error| {
                    DbError::Message(format!("prepared Merge abandonment: {error}"))
                })?;
            let PreparedStoreWriteState::MergeAbandonment {
                candidate_commit,
                candidate_head,
                outcome,
                ..
            } = &prepared
            else {
                return Ok(MergeAbandonmentState::None);
            };
            let candidate =
                parse_prepared_merge_candidate_parts_on(conn, candidate_commit, candidate_head)?;
            Ok(match outcome {
                MergeAbandonmentOutcome::Prepared => MergeAbandonmentState::Prepared,
                MergeAbandonmentOutcome::Accepted { .. } => MergeAbandonmentState::Accepted,
                MergeAbandonmentOutcome::Lost { winner_commit, .. }
                    if winner_commit == &candidate.reference =>
                {
                    MergeAbandonmentState::CandidateWon
                }
                MergeAbandonmentOutcome::Lost { .. } => MergeAbandonmentState::OtherWon,
            })
        })
        .await
    }

    pub(crate) async fn resume_winning_merge_candidate(
        &self,
        write_id: WriteId,
    ) -> Result<(), DbError> {
        let statuses = self.state.write_statuses.clone();
        let notified_write_id = write_id.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let (raw_status, raw_prepared): (String, String) = tx
                .query_row(
                    "SELECT status, prepared FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let status: WriteStatus = serde_json::from_str(&raw_status).map_err(|error| {
                DbError::Message(format!("winning Merge candidate status: {error}"))
            })?;
            if !matches!(status, WriteStatus::Blocked(_)) {
                return Err(DbError::Message(
                    "winning Merge candidate is not blocked".to_string(),
                ));
            }
            let prepared: PreparedStoreWriteState =
                serde_json::from_str(&raw_prepared).map_err(|error| {
                    DbError::Message(format!("winning Merge candidate preparation: {error}"))
                })?;
            let PreparedStoreWriteState::MergeAbandonment {
                candidate_commit,
                candidate_head,
                authority_commit,
                authority_head,
                outcome: MergeAbandonmentOutcome::Lost { winner_commit, .. },
                local_cleanup,
                completion,
            } = prepared
            else {
                return Err(DbError::Message(
                    "Merge abandonment did not lose to its prepared candidate".to_string(),
                ));
            };
            let candidate =
                parse_prepared_merge_candidate_parts_on(&tx, &candidate_commit, &candidate_head)?;
            if winner_commit != candidate.reference {
                return Err(DbError::Message(
                    "Merge abandonment winner is another candidate".to_string(),
                ));
            }
            let authority =
                parse_prepared_merge_candidate_parts_on(&tx, &authority_commit, &authority_head)?;
            remove_cleaned_merge_authority_on(&tx, &authority)?;
            let replacement = PreparedStoreWriteState::MergeConcurrent {
                commit: candidate_commit,
                head: candidate_head,
                local_cleanup,
                completion,
            };
            let replacement = serde_json::to_string(&replacement).map_err(|error| {
                DbError::Message(format!("serialize winning Merge candidate: {error}"))
            })?;
            let publishing = serde_json::to_string(&WriteStatus::Publishing).map_err(|error| {
                DbError::Message(format!("serialize winning Merge status: {error}"))
            })?;
            let updated = tx
                .execute(
                    "UPDATE store_writes SET prepared = ?2, status = ?3
                     WHERE write_id = ?1 AND prepared = ?4",
                    rusqlite::params![write_id.as_str(), replacement, publishing, raw_prepared],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(
                    "Merge abandonment changed while restoring its winner".to_string(),
                ));
            }
            tx.commit().map_err(DbError::from)?;
            Self::notify_write_status_in(&statuses, &notified_write_id, WriteStatus::Publishing);
            Ok(())
        })
        .await
    }

    pub(crate) async fn finish_lost_merge_abandonment(
        &self,
        write_id: WriteId,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let (raw_status, raw_prepared): (String, String) = tx
                .query_row(
                    "SELECT status, prepared FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let status: WriteStatus = serde_json::from_str(&raw_status).map_err(|error| {
                DbError::Message(format!("lost Merge abandonment status: {error}"))
            })?;
            if !matches!(status, WriteStatus::Blocked(_)) {
                return Err(DbError::Message(
                    "lost Merge abandonment is not blocked".to_string(),
                ));
            }
            let prepared: PreparedStoreWriteState =
                serde_json::from_str(&raw_prepared).map_err(|error| {
                    DbError::Message(format!("lost Merge abandonment preparation: {error}"))
                })?;
            let PreparedStoreWriteState::MergeAbandonment {
                candidate_commit,
                candidate_head,
                authority_commit,
                authority_head,
                outcome: MergeAbandonmentOutcome::Lost { winner_commit, .. },
                local_cleanup,
                completion,
            } = prepared
            else {
                return Err(DbError::Message(
                    "Merge abandonment has no third-candidate winner".to_string(),
                ));
            };
            let candidate =
                parse_prepared_merge_candidate_parts_on(&tx, &candidate_commit, &candidate_head)?;
            if winner_commit == candidate.reference {
                return Err(DbError::Message(
                    "original candidate won the Merge abandonment race".to_string(),
                ));
            }
            let authority =
                parse_prepared_merge_candidate_parts_on(&tx, &authority_commit, &authority_head)?;
            remove_cleaned_merge_authority_on(&tx, &authority)?;
            let replacement = PreparedStoreWriteState::MergeConcurrent {
                commit: candidate_commit,
                head: candidate_head,
                local_cleanup,
                completion,
            };
            let replacement = serde_json::to_string(&replacement).map_err(|error| {
                DbError::Message(format!("serialize lost Merge candidate: {error}"))
            })?;
            let updated = tx
                .execute(
                    "UPDATE store_writes SET prepared = ?2
                     WHERE write_id = ?1 AND status = ?3 AND prepared = ?4",
                    rusqlite::params![write_id.as_str(), replacement, raw_status, raw_prepared],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(
                    "Merge abandonment changed while removing its losing authority".to_string(),
                ));
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    #[doc(hidden)]
    pub async fn merge_candidate_cleanup_pending(
        &self,
        write_id: &WriteId,
    ) -> Result<bool, DbError> {
        let write_id = write_id.clone();
        self.call(move |conn| {
            let raw_prepared: Option<String> = conn
                .query_row(
                    "SELECT prepared FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let Some(raw_prepared) = raw_prepared else {
                return Ok(false);
            };
            let prepared: PreparedStoreWriteState = serde_json::from_str(&raw_prepared)
                .map_err(|error| DbError::Message(format!("prepared Merge cleanup: {error}")))?;
            let Some(candidate) = parse_prepared_merge_candidate_on(conn, &prepared)? else {
                return Ok(false);
            };
            let cleanup_pending = |candidate: &PreparedMergeCandidate| -> Result<bool, DbError> {
                let remote = load_remote_object_on(
                    conn,
                    remote_object_id(&candidate.reference.object),
                )?;
                Ok(matches!(
                    remote,
                    RemoteObjectRecord::CandidateCommit(
                        crate::sync::remote_object::CandidateCommitRecord {
                            state:
                                crate::sync::remote_object::CandidateCommitState::CleanupPending {
                                    proof: crate::sync::remote_object::CandidateNonactivationProof::MergeWinner { .. }
                                },
                            ..
                        }
                    )
                ))
            };
            match &prepared {
                PreparedStoreWriteState::MergeConcurrent { .. } => cleanup_pending(&candidate),
                PreparedStoreWriteState::MergeAbandonment {
                    outcome,
                    authority_commit,
                    authority_head,
                    ..
                } => {
                    let authority = parse_prepared_merge_candidate_parts_on(
                        conn,
                        authority_commit,
                        authority_head,
                    )?;
                    match outcome {
                        MergeAbandonmentOutcome::Prepared => Ok(false),
                        MergeAbandonmentOutcome::Accepted { .. } => cleanup_pending(&candidate),
                        MergeAbandonmentOutcome::Lost { winner_commit, .. } => Ok(
                            (winner_commit != &candidate.reference && cleanup_pending(&candidate)?)
                                || cleanup_pending(&authority)?,
                        ),
                    }
                }
                PreparedStoreWriteState::SerialPreparing
                | PreparedStoreWriteState::Serial { .. } => Ok(false),
            }
        })
        .await
    }

    pub(crate) async fn merge_candidate_cleanup_targets(
        &self,
        write_id: WriteId,
    ) -> Result<Vec<CandidateCleanupObject>, DbError> {
        self.call(move |conn| {
            let (raw_status, raw_prepared): (String, String) = conn
                .query_row(
                    "SELECT status, prepared FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let status: WriteStatus = serde_json::from_str(&raw_status)
                .map_err(|error| DbError::Message(format!("Merge cleanup status: {error}")))?;
            if !matches!(status, WriteStatus::Blocked(_)) {
                return Err(DbError::Message(format!(
                    "Merge cleanup write {write_id} is not blocked"
                )));
            }
            let prepared: PreparedStoreWriteState = serde_json::from_str(&raw_prepared)
                .map_err(|error| DbError::Message(format!("prepared Merge cleanup: {error}")))?;
            let Some(candidate) = parse_prepared_merge_candidate_on(conn, &prepared)? else {
                return Err(DbError::Message(
                    "Serial state reached Merge candidate cleanup".to_string(),
                ));
            };
            match &prepared {
                PreparedStoreWriteState::MergeConcurrent { .. } => {
                    merge_candidate_cleanup_targets_on(conn, &write_id, &candidate, true)
                }
                PreparedStoreWriteState::MergeAbandonment {
                    outcome,
                    authority_commit,
                    authority_head,
                    ..
                } => {
                    let authority = parse_prepared_merge_candidate_parts_on(
                        conn,
                        authority_commit,
                        authority_head,
                    )?;
                    let mut targets = Vec::new();
                    match outcome {
                        MergeAbandonmentOutcome::Prepared => {
                            return Err(DbError::Message(
                                "Merge abandonment has no accepted winner".to_string(),
                            ));
                        }
                        MergeAbandonmentOutcome::Accepted { .. } => {
                            targets.extend(merge_candidate_cleanup_targets_on(
                                conn, &write_id, &candidate, true,
                            )?);
                        }
                        MergeAbandonmentOutcome::Lost { winner_commit, .. } => {
                            if winner_commit != &candidate.reference {
                                targets.extend(merge_candidate_cleanup_targets_on(
                                    conn, &write_id, &candidate, true,
                                )?);
                            }
                            targets.extend(merge_candidate_cleanup_targets_on(
                                conn, &write_id, &authority, false,
                            )?);
                        }
                    }
                    Ok(targets)
                }
                PreparedStoreWriteState::SerialPreparing
                | PreparedStoreWriteState::Serial { .. } => unreachable!("parsed Merge cleanup"),
            }
        })
        .await
    }

    pub(crate) async fn adopt_alternate_merge_head(
        &self,
        write_id: WriteId,
        winner: StoreDeviceHead,
        winner_prepared: PreparedExactObject,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let (raw_status, raw_prepared): (String, String) = tx
                .query_row(
                    "SELECT status, prepared FROM store_writes WHERE write_id = ?1",
                    [write_id.as_str()],
                    |row| Ok((row.get(0)?, row.get(1)?)),
                )
                .map_err(DbError::from)?;
            let status: WriteStatus = serde_json::from_str(&raw_status).map_err(|error| {
                DbError::Message(format!("alternate Merge head status: {error}"))
            })?;
            if !matches!(status, WriteStatus::Publishing) {
                return Err(DbError::Message(format!(
                    "Merge candidate {write_id} is not publishing"
                )));
            }
            let prepared: PreparedStoreWriteState = serde_json::from_str(&raw_prepared)
                .map_err(|error| DbError::Message(format!("prepared Merge candidate: {error}")))?;
            let publication = parse_prepared_merge_publication_on(&tx, &prepared)?
                .ok_or_else(|| {
                    DbError::Message(
                        "Serial branch reached alternate Merge head adoption".to_string(),
                    )
                })?;
            if winner_prepared.reference().slot()
                != publication.head_prepared.reference().slot()
                || winner_prepared.reference() == publication.head_prepared.reference()
            {
                return Err(DbError::Message(
                    "alternate Merge head does not replace the prepared exact slot".to_string(),
                ));
            }
            let root = required_store_root_authority_on(&tx)?;
            let registration = load_activated_registration_on(
                &tx,
                &root,
                &publication.commit.author_registration,
            )?;
            let candidate = publication.reference;
            let verified_winner = StoreDeviceHead::parse_at(
                &winner.to_bytes(),
                root.store_root_hash,
                &registration,
                &candidate,
            )
            .map_err(|error| DbError::Message(format!("verify alternate Merge head: {error}")))?;
            if verified_winner != winner || winner.commit != candidate {
                return Err(DbError::Message(
                    "alternate Merge head does not activate the prepared commit".to_string(),
                ));
            }
            let old_object_id = remote_object_id(publication.head_prepared.reference());
            let old_remote = load_remote_object_on(&tx, old_object_id)?;
            if !matches!(
                &old_remote,
                RemoteObjectRecord::RetainedAuthority(record)
                    if matches!(
                        &record.identity.domain,
                        crate::sync::remote_object::RetainedAuthorityObjectDomain::StoreDeviceHead { .. }
                    ) && matches!(
                        &record.state,
                        crate::sync::remote_object::RetainedAuthorityObjectState::Prepared {
                            ownership
                        } if ownership.pending == BTreeSet::from([candidate.clone()])
                    )
            ) {
                return Err(DbError::Message(
                    "prepared Merge head lost its candidate ownership".to_string(),
                ));
            }
            let removed = tx
                .execute(
                    "DELETE FROM remote_objects WHERE object_id = ?1",
                    [old_object_id.to_string()],
                )
                .map_err(DbError::from)?;
            if removed != 1 {
                return Err(DbError::Message(
                    "prepared Merge head disappeared during replacement".to_string(),
                ));
            }
            let winner_ref = crate::sync::store_commit::StoreDeviceHeadRef {
                head_hash: winner.head_hash(),
                object: winner_prepared.reference().clone(),
            };
            let mut winner_remote = RemoteObjectRecord::candidate_activated_store_head(
                winner_ref,
                winner.to_bytes(),
                winner_prepared.stored_bytes().to_vec(),
                candidate,
            )
            .map_err(|error| DbError::Message(format!("alternate Merge head: {error}")))?;
            winner_remote.mark_uploaded_verified().map_err(|error| {
                DbError::Message(format!("mark alternate Merge head uploaded: {error}"))
            })?;
            persist_exact_remote_object_on(&tx, &winner_remote, "alternate Merge head")?;
            let replacement_head = DurablePreparedProtocolObject {
                semantic_bytes: winner.to_bytes(),
                prepared: winner_prepared,
            };
            let replacement = match prepared {
                PreparedStoreWriteState::MergeConcurrent {
                    commit,
                    local_cleanup,
                    completion,
                    ..
                } => PreparedStoreWriteState::MergeConcurrent {
                    commit,
                    head: replacement_head,
                    local_cleanup,
                    completion,
                },
                PreparedStoreWriteState::MergeAbandonment {
                    candidate_commit,
                    candidate_head,
                    authority_commit,
                    outcome,
                    local_cleanup,
                    completion,
                    ..
                } => PreparedStoreWriteState::MergeAbandonment {
                    candidate_commit,
                    candidate_head,
                    authority_commit,
                    authority_head: replacement_head,
                    outcome,
                    local_cleanup,
                    completion,
                },
                PreparedStoreWriteState::SerialPreparing
                | PreparedStoreWriteState::Serial { .. } => {
                    unreachable!("parsed Merge publication")
                }
            };
            let replacement = serde_json::to_string(&replacement).map_err(|error| {
                DbError::Message(format!("serialize alternate Merge preparation: {error}"))
            })?;
            let updated = tx
                .execute(
                    "UPDATE store_writes SET prepared = ?2
                     WHERE write_id = ?1 AND status = '\"publishing\"' AND prepared = ?3",
                    rusqlite::params![write_id.as_str(), replacement, raw_prepared],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(
                    "prepared Merge write changed during head replacement".to_string(),
                ));
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn prepare_serial_candidate_cleanup(
        &self,
        branch_id: PendingBranchId,
        plan: &crate::sync::store_pull::SerialResolutionPlan,
    ) -> Result<Vec<CandidateCleanupObject>, DbError> {
        let accepted_refs = plan
            .commits
            .iter()
            .map(|commit| commit.commit_ref.clone())
            .collect::<Vec<_>>();
        let accepted_commits = plan
            .commits
            .iter()
            .map(|commit| commit.commit.clone())
            .collect::<Vec<_>>();
        let head = plan.head.clone();
        let head_bytes = plan.head_object.bytes.clone();
        let observed_version_hash =
            ObjectHash::digest(plan.head_object.version.cloud().as_provider().as_bytes());
        self.call(move |conn| {
            if head.to_bytes() != head_bytes {
                return Err(DbError::Message(
                    "Serial cleanup head bytes differ from the verified head".to_string(),
                ));
            }
            let mut statement = conn
                .prepare(
                    "SELECT write_id, base, status, prepared FROM store_writes
                     WHERE status != '\"local_only\"'
                       AND json_extract(status, '$.published') IS NULL
                       AND json_extract(status, '$.resolved') IS NULL
                       AND json_type(base, '$.serial') IS NOT NULL
                     ORDER BY ordinal",
                )
                .map_err(DbError::from)?;
            let rows = statement
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, String>(1)?,
                        row.get::<_, String>(2)?,
                        row.get::<_, Option<String>>(3)?,
                    ))
                })
                .map_err(DbError::from)?
                .collect::<Result<Vec<_>, _>>()
                .map_err(DbError::from)?;
            drop(statement);
            let mut branch_base = None;
            let mut prepared = Vec::new();
            for (write_id, raw_base, raw_status, raw_prepared) in rows {
                let base: StoreWriteBase = serde_json::from_str(&raw_base).map_err(|error| {
                    DbError::Message(format!("Serial cleanup branch base: {error}"))
                })?;
                let StoreWriteBase::Serial {
                    branch_id: stored_branch_id,
                    base,
                } = base
                else {
                    return Err(DbError::Message(
                        "MergeConcurrent base reached Serial candidate cleanup".to_string(),
                    ));
                };
                if stored_branch_id != branch_id {
                    return Err(DbError::Message(
                        "Serial database contains more than one unresolved branch".to_string(),
                    ));
                }
                let status: WriteStatus = serde_json::from_str(&raw_status).map_err(|error| {
                    DbError::Message(format!("Serial cleanup branch status: {error}"))
                })?;
                if !matches!(
                    status,
                    WriteStatus::Conflict(ref conflict) if conflict.branch_id == branch_id
                ) {
                    return Err(DbError::Message(format!(
                        "Serial cleanup write {write_id} is not conflicted"
                    )));
                }
                if branch_base.as_ref().is_some_and(|stored| stored != &base) {
                    return Err(DbError::Message(
                        "Serial cleanup branch has inconsistent bases".to_string(),
                    ));
                }
                branch_base.get_or_insert(base);
                let Some(raw_prepared) = raw_prepared else {
                    continue;
                };
                if let Some(candidate) = parse_prepared_serial_candidate(&raw_prepared)? {
                    prepared.push((
                        WriteId::from_generated(write_id),
                        candidate.commit,
                        candidate.reference,
                        candidate.canonical_signed_bytes,
                    ));
                }
            }
            if prepared.is_empty() {
                return Ok(Vec::new());
            }
            let branch_base = branch_base.expect("prepared branch has a base");
            if accepted_refs.is_empty() || accepted_refs.len() != accepted_commits.len() {
                return Err(DbError::Message(
                    "Serial candidate cleanup requires a nonempty accepted suffix".to_string(),
                ));
            }
            let mut accepted_predecessor = branch_base.clone();
            for (reference, commit) in accepted_refs.iter().zip(&accepted_commits) {
                reference
                    .verify_commit(commit)
                    .map_err(|error| DbError::Message(error.to_string()))?;
                if commit.order.predecessor() != accepted_predecessor.as_ref() {
                    return Err(DbError::Message(
                        "accepted Serial cleanup suffix has a broken exact predecessor"
                            .to_string(),
                    ));
                }
                accepted_predecessor = Some(reference.clone());
            }
            if !matches!(
                head.state,
                StoreSerialHeadState::Commit { ref commit, .. }
                    if Some(commit) == accepted_refs.last()
            ) {
                return Err(DbError::Message(
                    "Serial cleanup head does not name the accepted suffix tip".to_string(),
                ));
            }
            let mut losing_predecessor = branch_base.clone();
            let mut losing_targets = Vec::with_capacity(prepared.len());
            for (_, commit, reference, bytes) in &prepared {
                if commit.order.predecessor() != losing_predecessor.as_ref() {
                    return Err(DbError::Message(
                        "losing Serial candidates have a broken exact predecessor chain"
                            .to_string(),
                    ));
                }
                losing_targets.push(
                    crate::sync::remote_object::StoreBatchCommitDeletionTarget {
                        coord: reference.coord.clone(),
                        object: reference.object.clone(),
                        canonical_signed_bytes: bytes.clone(),
                    },
                );
                losing_predecessor = Some(reference.clone());
            }
            if accepted_refs.first() == prepared.first().map(|(_, _, reference, _)| reference) {
                return Err(DbError::Message(
                    "accepted Serial suffix begins with the losing candidate".to_string(),
                ));
            }
            let suffix = crate::sync::remote_object::SerialAcceptedSuffix {
                predecessor: branch_base,
                commits: accepted_refs,
                canonical_signed_head_bytes: head_bytes,
                observed_version_hash,
            };
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let mut exclusive_cleanup = Vec::new();
            let mut commit_cleanup = Vec::new();
            for (index, (write_id, commit, reference, _)) in prepared.iter().enumerate() {
                let proof = crate::sync::remote_object::CandidateNonactivationProof::SerialImmediateSuccessor {
                    accepted_suffix: suffix.clone(),
                    losing_prefix: losing_targets[..=index].to_vec(),
                };
                let nonactivation = crate::sync::remote_object::CandidateNonactivation {
                    candidate: losing_targets[index].clone(),
                    proof,
                };
                let mut object_statement = tx
                    .prepare(
                        "SELECT remote_object_id FROM store_write_packages WHERE write_id = ?1
                         UNION
                         SELECT remote_object_id FROM store_write_blobs WHERE write_id = ?1
                         ORDER BY remote_object_id",
                    )
                    .map_err(DbError::from)?;
                let object_ids = object_statement
                    .query_map([write_id.as_str()], |row| row.get::<_, String>(0))
                    .map_err(DbError::from)?
                    .collect::<Result<Vec<_>, _>>()
                    .map_err(DbError::from)?;
                drop(object_statement);
                let mut manifest_cleanup = BTreeSet::new();
                for encoded in object_ids {
                    let object_id: ObjectHash = encoded.parse().map_err(|error| {
                        DbError::Message(format!("Serial cleanup remote object id: {error}"))
                    })?;
                    let mut remote = load_remote_object_on(&tx, object_id)?;
                    remote
                        .begin_candidate_nonactivation(nonactivation.clone())
                        .map_err(|error| {
                            DbError::Message(format!(
                                "record candidate nonactivation for {object_id}: {error}"
                            ))
                        })?;
                    if let Some(object) = remote.cleanup_target() {
                        manifest_cleanup.insert(object.clone());
                    }
                    update_remote_object_on(&tx, object_id, &remote)?;
                }
                for object in candidate_manifest_exact_objects(commit) {
                    if manifest_cleanup.remove(object) {
                        exclusive_cleanup.push(CandidateCleanupObject {
                            object: object.clone(),
                        });
                    }
                }
                if !manifest_cleanup.is_empty() {
                    return Err(DbError::Message(format!(
                        "candidate cleanup for write {write_id} contains an object outside its signed manifest"
                    )));
                }
                let commit_object_id = remote_object_id(&reference.object);
                let mut remote = load_remote_object_on(&tx, commit_object_id)?;
                remote
                    .begin_candidate_nonactivation(nonactivation)
                    .map_err(|error| {
                        DbError::Message(format!(
                            "record candidate commit nonactivation for {commit_object_id}: {error}"
                        ))
                    })?;
                if let Some(object) = remote.cleanup_target() {
                    commit_cleanup.push(CandidateCleanupObject {
                        object: object.clone(),
                    });
                }
                update_remote_object_on(&tx, commit_object_id, &remote)?;
            }
            tx.commit().map_err(DbError::from)?;
            exclusive_cleanup.extend(commit_cleanup);
            Ok(exclusive_cleanup)
        })
        .await
    }

    pub(crate) async fn prepare_serial_abandonment_authority_cleanup(
        &self,
        plan: &crate::sync::store_pull::SerialResolutionPlan,
    ) -> Result<Option<CandidateCleanupObject>, DbError> {
        let prepared = self
            .prepared_serial_candidate_abandonment()
            .await?
            .ok_or_else(|| {
                DbError::Message("Serial candidate abandonment is not prepared".to_string())
            })?;
        let accepted_refs = plan
            .commits
            .iter()
            .map(|commit| commit.commit_ref.clone())
            .collect::<Vec<_>>();
        if accepted_refs.is_empty() {
            return Err(DbError::Message(
                "Serial abandonment cleanup requires an accepted successor".to_string(),
            ));
        }
        let authority_ref = StoreBatchCommitRef::from_commit(
            &prepared.authority.value,
            StoreCommitCoord::Serial {
                sequence: prepared.authority.value.seq(),
            },
            prepared.authority.object.clone(),
        )
        .map_err(|error| DbError::Message(error.to_string()))?;
        if accepted_refs.first() == Some(&authority_ref) {
            return Ok(None);
        }
        let head_bytes = plan.head_object.bytes.clone();
        if plan.head.to_bytes() != head_bytes
            || !matches!(
                &plan.head.state,
                StoreSerialHeadState::Commit { commit, .. }
                    if Some(commit) == accepted_refs.last()
            )
        {
            return Err(DbError::Message(
                "Serial abandonment cleanup head differs from its accepted suffix".to_string(),
            ));
        }
        let mut predecessor = prepared.base.clone();
        for commit in &plan.commits {
            commit
                .commit_ref
                .verify_commit(&commit.commit)
                .map_err(|error| DbError::Message(error.to_string()))?;
            if commit.commit.order.predecessor() != predecessor.as_ref() {
                return Err(DbError::Message(
                    "Serial abandonment accepted suffix has a broken predecessor".to_string(),
                ));
            }
            predecessor = Some(commit.commit_ref.clone());
        }
        let authority_target = crate::sync::store_commit::StoreBatchCommitDeletionTarget {
            coord: authority_ref.coord.clone(),
            object: authority_ref.object.clone(),
            canonical_signed_bytes: prepared.authority.bytes.clone(),
        };
        let suffix = crate::sync::remote_object::SerialAcceptedSuffix {
            predecessor: prepared.base,
            commits: accepted_refs,
            canonical_signed_head_bytes: head_bytes,
            observed_version_hash: ObjectHash::digest(
                plan.head_object.version.cloud().as_provider().as_bytes(),
            ),
        };
        let expected_state = prepared.durable_state;
        self.call(move |conn| {
            let state_matches: bool = conn
                .query_row(
                    "SELECT EXISTS(
                         SELECT 1 FROM protocol_state WHERE key = ?1 AND value = ?2
                     )",
                    rusqlite::params![SERIAL_CANDIDATE_ABANDONMENT_STATE_KEY, expected_state],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            if !state_matches {
                return Err(DbError::Message(
                    "Serial abandonment durable state changed before authority cleanup"
                        .to_string(),
                ));
            }
            let object_id = remote_object_id(&authority_ref.object);
            let mut remote = load_remote_object_on(conn, object_id)?;
            remote
                .begin_candidate_nonactivation(
                    crate::sync::remote_object::CandidateNonactivation {
                        candidate: authority_target.clone(),
                        proof: crate::sync::remote_object::CandidateNonactivationProof::SerialImmediateSuccessor {
                            accepted_suffix: suffix,
                            losing_prefix: vec![authority_target],
                        },
                    },
                )
                .map_err(|error| {
                    DbError::Message(format!(
                        "record Serial abandonment nonactivation for {object_id}: {error}"
                    ))
                })?;
            let target = remote.cleanup_target().cloned();
            update_remote_object_on(conn, object_id, &remote)?;
            Ok(target.map(|object| CandidateCleanupObject { object }))
        })
        .await
    }

    pub(crate) async fn discard_serial_branch_after_abandonment(
        &self,
        branch_id: PendingBranchId,
        plan: crate::sync::store_pull::SerialResolutionPlan,
    ) -> Result<(), DbError> {
        let prepared = self
            .prepared_serial_candidate_abandonment()
            .await?
            .ok_or_else(|| {
                DbError::Message("Serial candidate abandonment is not prepared".to_string())
            })?;
        if prepared.branch_id != branch_id {
            return Err(DbError::Message(
                "Serial abandonment belongs to another branch".to_string(),
            ));
        }
        let authority_ref = StoreBatchCommitRef::from_commit(
            &prepared.authority.value,
            StoreCommitCoord::Serial {
                sequence: prepared.authority.value.seq(),
            },
            prepared.authority.object.clone(),
        )
        .map_err(|error| DbError::Message(error.to_string()))?;
        let authority_accepted = plan
            .commits
            .first()
            .is_some_and(|commit| commit.commit_ref == authority_ref);
        let expected_state = prepared.durable_state;
        let synced_tables = self.synced_tables().to_vec();
        let statuses = self.state.write_statuses.clone();
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let write_ids =
                Self::apply_serial_resolution_on(&tx, &synced_tables, &branch_id, plan)?;
            let object_id = remote_object_id(&authority_ref.object);
            let remote = load_remote_object_on(&tx, object_id)?;
            if authority_accepted {
                let retained = remote.into_activated(&authority_ref).map_err(|error| {
                    DbError::Message(format!("activate Serial abandonment authority: {error}"))
                })?;
                update_remote_object_on(&tx, object_id, &retained)?;
            } else {
                if !remote
                    .candidate_cleanup_complete(&authority_ref)
                    .map_err(|error| {
                        DbError::Message(format!(
                            "validate Serial abandonment authority cleanup: {error}"
                        ))
                    })?
                {
                    return Err(DbError::Message(
                        "Serial abandonment authority cleanup is incomplete".to_string(),
                    ));
                }
                let removed = tx
                    .execute(
                        "DELETE FROM remote_objects WHERE object_id = ?1",
                        [object_id.to_string()],
                    )
                    .map_err(DbError::from)?;
                if removed != 1 {
                    return Err(DbError::Message(
                        "Serial abandonment authority disappeared during removal".to_string(),
                    ));
                }
            }
            let removed = tx
                .execute(
                    "DELETE FROM protocol_state WHERE key = ?1 AND value = ?2",
                    rusqlite::params![SERIAL_CANDIDATE_ABANDONMENT_STATE_KEY, expected_state],
                )
                .map_err(DbError::from)?;
            if removed != 1 {
                return Err(DbError::Message(
                    "Serial abandonment durable state disappeared".to_string(),
                ));
            }
            let resolution = WriteResolution::Discarded;
            Self::resolve_unpublished_writes_on(&tx, &write_ids, &resolution)?;
            tx.commit().map_err(DbError::from)?;
            let status = WriteStatus::Resolved(resolution);
            for write_id in write_ids {
                Self::notify_write_status_in(&statuses, &write_id, status.clone());
            }
            Ok(())
        })
        .await
    }

    pub(crate) async fn remove_losing_serial_abandonment_authority(&self) -> Result<(), DbError> {
        let prepared = self
            .prepared_serial_candidate_abandonment()
            .await?
            .ok_or_else(|| {
                DbError::Message("Serial candidate abandonment is not prepared".to_string())
            })?;
        let authority_ref = StoreBatchCommitRef::from_commit(
            &prepared.authority.value,
            StoreCommitCoord::Serial {
                sequence: prepared.authority.value.seq(),
            },
            prepared.authority.object.clone(),
        )
        .map_err(|error| DbError::Message(error.to_string()))?;
        let expected_state = prepared.durable_state;
        self.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            let object_id = remote_object_id(&authority_ref.object);
            let remote = load_remote_object_on(&tx, object_id)?;
            if !remote
                .candidate_cleanup_complete(&authority_ref)
                .map_err(|error| {
                    DbError::Message(format!(
                        "validate losing Serial abandonment cleanup: {error}"
                    ))
                })?
            {
                return Err(DbError::Message(
                    "losing Serial abandonment cleanup is incomplete".to_string(),
                ));
            }
            let removed = tx
                .execute(
                    "DELETE FROM remote_objects WHERE object_id = ?1",
                    [object_id.to_string()],
                )
                .map_err(DbError::from)?;
            if removed != 1 {
                return Err(DbError::Message(
                    "losing Serial abandonment authority disappeared".to_string(),
                ));
            }
            let removed = tx
                .execute(
                    "DELETE FROM protocol_state WHERE key = ?1 AND value = ?2",
                    rusqlite::params![SERIAL_CANDIDATE_ABANDONMENT_STATE_KEY, expected_state],
                )
                .map_err(DbError::from)?;
            if removed != 1 {
                return Err(DbError::Message(
                    "Serial abandonment durable state disappeared".to_string(),
                ));
            }
            tx.commit().map_err(DbError::from)
        })
        .await
    }

    pub(crate) async fn mark_candidate_cleanup_absent(
        &self,
        object: ExactObjectRef,
    ) -> Result<(), DbError> {
        self.call(move |conn| {
            let object_id = remote_object_id(&object);
            let mut remote = load_remote_object_on(conn, object_id)?;
            if remote.cleanup_target() != Some(&object) {
                return Err(DbError::Message(format!(
                    "remote object {object_id} is not awaiting exact cleanup"
                )));
            }
            remote.mark_absent_verified().map_err(|error| {
                DbError::Message(format!("mark candidate {object_id} absent: {error}"))
            })?;
            update_remote_object_on(conn, object_id, &remote)
        })
        .await
    }

    /// Install only blob bindings whose exact row stamp won the enclosing
    /// changeset. The caller owns the transaction, so app rows, locator facts,
    /// and the materialized commit position either all commit or all roll back.
    pub(crate) fn install_winning_blob_bindings_on(
        conn: &Connection,
        gates: &Gates,
        synced_tables: &[SyncedTable],
        package: &AudiencePackage,
        activation: &BlobActivation,
        winning_rows: &[crate::sync::apply::WinningRow],
    ) -> Result<usize, DbError> {
        if package.commit_coord() != &activation.coord {
            return Err(DbError::Message(format!(
                "blob activation {:?} does not match audience package {:?}",
                activation.coord,
                package.commit_coord()
            )));
        }

        let package_audience = package.audience().remote_audience();
        for winner in winning_rows {
            let Some(table) = synced_tables
                .iter()
                .find(|table| table.name() == winner.table)
            else {
                return Err(DbError::Message(format!(
                    "winning changeset row names undeclared table {:?}",
                    winner.table
                )));
            };
            let Some(declaration) = table.blob() else {
                continue;
            };
            match winner.row_stamp.as_deref() {
                Some(row_stamp) => conn.execute(
                    "DELETE FROM row_blob_locators
                     WHERE table_name = ?1 AND row_id = ?2 AND column_name = ?3
                       AND row_stamp <> ?4",
                    rusqlite::params![
                        winner.table,
                        winner.row_id,
                        declaration.id_column,
                        row_stamp,
                    ],
                ),
                None => conn.execute(
                    "DELETE FROM row_blob_locators
                     WHERE table_name = ?1 AND row_id = ?2 AND column_name = ?3",
                    rusqlite::params![winner.table, winner.row_id, declaration.id_column],
                ),
            }
            .map_err(DbError::from)?;
        }
        let mut installed = 0;
        for binding in package.blob_bindings() {
            let Some(table) = synced_tables
                .iter()
                .find(|table| table.name() == binding.table())
            else {
                return Err(DbError::Message(format!(
                    "blob binding names undeclared table {:?}",
                    binding.table()
                )));
            };
            let declaration = table.blob().ok_or_else(|| {
                DbError::Message(format!(
                    "blob binding names table {:?}, which has no blob declaration",
                    binding.table()
                ))
            })?;
            if binding.column() != declaration.id_column {
                return Err(DbError::Message(format!(
                    "blob binding column {:?} does not match declared blob-id column {:?} on table {:?}",
                    binding.column(), declaration.id_column, binding.table()
                )));
            }

            let Some(row) = live_blob_row(conn, binding.table(), binding.row_id(), declaration)?
            else {
                continue;
            };
            if row.stamp != binding.row_stamp() {
                continue;
            }

            let live_audience =
                gate::live_row_audience(conn, gates, binding.table(), binding.row_id()).map_err(
                    |error| {
                        DbError::Message(format!(
                            "resolve winning blob row audience for {:?}/{:?}: {error}",
                            binding.table(),
                            binding.row_id()
                        ))
                    },
                )?;
            let live_audience = RemoteAudience::try_from(live_audience).map_err(|error| {
                DbError::Message(format!(
                    "winning blob row {:?}/{:?} is not remote: {error}",
                    binding.table(),
                    binding.row_id()
                ))
            })?;
            if live_audience != package_audience {
                return Err(DbError::Message(format!(
                    "winning blob row {:?}/{:?} belongs to {:?}, but its package belongs to {:?}",
                    binding.table(),
                    binding.row_id(),
                    live_audience,
                    package_audience
                )));
            }
            validate_live_blob_row(binding, declaration, &row, &live_audience)?;

            let locator = binding.blob().locator();
            let locator_hash = locator.locator_hash();
            let remote_object_id = remote_object_id(binding.blob().object());
            let remote = load_remote_object_on(conn, remote_object_id)?;
            if !remote.is_activated_stored_blob() {
                return Err(DbError::Message(format!(
                    "blob locator {locator_hash} does not reference an activated uploaded blob"
                )));
            }
            validate_remote_object_on(
                conn,
                remote_object_id,
                binding.blob().object(),
                &locator.to_bytes(),
                RemoteStoredRepresentationRef::Blob,
            )?;
            conn.execute(
                "INSERT INTO blob_locators
                 (remote_object_id, locator_hash)
                 VALUES (?1, ?2)
                 ON CONFLICT(remote_object_id) DO NOTHING",
                rusqlite::params![remote_object_id.to_string(), locator_hash.to_string(),],
            )
            .map_err(DbError::from)?;
            validate_stored_locator_on(conn, binding.blob())?;

            let audience_authority =
                serde_json::to_string(package.audience()).map_err(|error| {
                    DbError::Message(format!("serialize row blob audience authority: {error}"))
                })?;
            conn.execute(
                "INSERT INTO row_blob_locators
                 (table_name, row_id, column_name, row_stamp, audience_authority, remote_object_id)
                 VALUES (?1, ?2, ?3, ?4, ?5, ?6)
                 ON CONFLICT(table_name, row_id, column_name, row_stamp) DO NOTHING",
                rusqlite::params![
                    binding.table(),
                    binding.row_id(),
                    binding.column(),
                    binding.row_stamp(),
                    audience_authority,
                    remote_object_id.to_string(),
                ],
            )
            .map_err(DbError::from)?;
            validate_stored_row_binding_on(conn, binding, package.audience(), remote_object_id)?;
            installed += 1;
        }
        Ok(installed)
    }

    pub(crate) fn install_pulled_blob_activations_on(
        conn: &Connection,
        package: &AudiencePackage,
        owner: &StoreBatchCommitRef,
    ) -> Result<(), DbError> {
        if package.commit_coord() != &owner.coord {
            return Err(DbError::Message(
                "pulled blob package coordinate differs from its activating commit".to_string(),
            ));
        }
        for binding in package.blob_bindings() {
            let stored = binding.blob();
            let object_id = remote_object_id(stored.object());
            let exists: bool = conn
                .query_row(
                    "SELECT EXISTS(SELECT 1 FROM remote_objects WHERE object_id = ?1)",
                    [object_id.to_string()],
                    |row| row.get(0),
                )
                .map_err(DbError::from)?;
            let remote = if exists {
                let mut remote = load_remote_object_on(conn, object_id)?;
                remote
                    .merge_blob_activation(stored, owner)
                    .map_err(|error| {
                        DbError::Message(format!(
                            "merge pulled blob activation {object_id}: {error}"
                        ))
                    })?;
                remote
            } else {
                RemoteObjectRecord::activated_blob(stored, owner.clone()).map_err(|error| {
                    DbError::Message(format!(
                        "construct pulled blob activation {object_id}: {error}"
                    ))
                })?
            };
            let state = serde_json::to_string(&remote).map_err(|error| {
                DbError::Message(format!("serialize pulled blob activation: {error}"))
            })?;
            conn.execute(
                "INSERT INTO remote_objects (object_id, state) VALUES (?1, ?2) \
                 ON CONFLICT(object_id) DO UPDATE SET state = excluded.state",
                rusqlite::params![object_id.to_string(), state],
            )
            .map_err(DbError::from)?;
        }
        Ok(())
    }

    pub async fn row_blob_ref(&self, table: &str, row_id: &str) -> Result<RowBlobRef, DbError> {
        let table = self
            .synced_tables()
            .iter()
            .find(|candidate| candidate.name() == table)
            .cloned()
            .ok_or_else(|| DbError::Message(format!("undeclared synced table {table:?}")))?;
        if table.blob().is_none() {
            return Err(DbError::Message(format!(
                "synced table {:?} has no blob declaration",
                table.name()
            )));
        }
        let row_id = row_id.to_string();
        let gates = self.gates();
        self.call(move |conn| Self::row_blob_ref_on(conn, &gates, &table, &row_id))
            .await
    }

    pub async fn validate_row_blob_ref(&self, reference: &RowBlobRef) -> Result<(), DbError> {
        let current = self
            .row_blob_ref(reference.table(), reference.row_id())
            .await?;
        if &current != reference {
            return Err(DbError::Message(format!(
                "row blob reference {:?}/{:?}/{:?} at {:?} is stale",
                reference.table(),
                reference.row_id(),
                reference.column(),
                reference.row_stamp()
            )));
        }
        Ok(())
    }

    pub async fn row_blob_refs_for_root(
        &self,
        root_table: &str,
        root_id: &str,
    ) -> Result<Vec<RowBlobRef>, DbError> {
        let root_table = root_table.to_string();
        let root_id = root_id.to_string();
        let gates = self.gates();
        let tables = self.synced_tables().to_vec();
        self.call(move |conn| {
            Self::row_blob_refs_for_root_on(conn, &gates, &tables, &root_table, &root_id)
        })
        .await
    }

    pub(crate) fn row_blob_refs_for_root_on(
        conn: &Connection,
        gates: &Gates,
        tables: &[SyncedTable],
        root_table: &str,
        root_id: &str,
    ) -> Result<Vec<RowBlobRef>, DbError> {
        let mut rows = gates
            .subtree_rows(conn, root_table, root_id)
            .map_err(|error| DbError::Message(error.to_string()))?
            .into_iter()
            .collect::<Vec<_>>();
        rows.sort();
        let tables = tables
            .iter()
            .map(|table| (table.name(), table))
            .collect::<BTreeMap<_, _>>();
        rows.into_iter()
            .filter_map(|(table_name, row_id)| {
                tables
                    .get(table_name.as_str())
                    .filter(|table| table.blob().is_some())
                    .map(|table| Self::row_blob_ref_on(conn, gates, table, &row_id))
            })
            .collect()
    }

    pub(crate) fn upload_entries_for_rows_on(
        conn: &Connection,
        rows: &[RowBlobRef],
    ) -> Result<Vec<OutboxEntry>, DbError> {
        rows.iter()
            .filter_map(|row| {
                match upload_entry_for_identity_on(
                    conn,
                    row.table(),
                    row.row_id(),
                    row.column(),
                    row.row_stamp(),
                ) {
                    Ok(Some(entry)) => Some(Ok(entry)),
                    Ok(None) => None,
                    Err(error) => Some(Err(error)),
                }
            })
            .collect()
    }

    pub(crate) fn upload_entries_for_root_on(
        conn: &Connection,
        gates: &Gates,
        tables: &[SyncedTable],
        root_table: &str,
        root_id: &str,
    ) -> Result<Vec<OutboxEntry>, DbError> {
        let rows = Self::row_blob_refs_for_root_on(conn, gates, tables, root_table, root_id)?;
        Self::upload_entries_for_rows_on(conn, &rows)
    }

    pub(crate) fn stored_blob_reference_state_on(
        conn: &Connection,
        gates: &Gates,
        tables: &[SyncedTable],
        stored: &StoredBlobRef,
    ) -> Result<StoredBlobReferenceState, DbError> {
        let exact_object_id = remote_object_id(stored.object()).to_string();
        let mut statement = conn
            .prepare(
                "SELECT table_name, row_id, row_stamp FROM row_blob_locators
                 WHERE remote_object_id = ?1",
            )
            .map_err(DbError::from)?;
        let bindings = statement
            .query_map([exact_object_id], |row| {
                Ok((
                    row.get::<_, String>(0)?,
                    row.get::<_, String>(1)?,
                    row.get::<_, String>(2)?,
                ))
            })
            .map_err(DbError::from)?
            .collect::<Result<Vec<_>, _>>()
            .map_err(DbError::from)?;
        drop(statement);
        let mut unresolved = false;
        for (table_name, row_id, row_stamp) in bindings {
            let table = tables
                .iter()
                .find(|candidate| candidate.name() == table_name)
                .ok_or_else(|| {
                    DbError::Message(format!(
                        "stored blob binding names undeclared table {table_name:?}"
                    ))
                })?;
            let declaration = table.blob().ok_or_else(|| {
                DbError::Message(format!(
                    "stored blob binding names table {table_name:?} without a blob declaration"
                ))
            })?;
            let Some(live) = live_blob_row(conn, &table_name, &row_id, declaration)? else {
                continue;
            };
            if live.stamp != row_stamp {
                continue;
            }
            match gates
                .root_kept_of(conn, &table_name, &row_id)
                .map_err(|error| DbError::Message(error.to_string()))?
            {
                Some(false) => continue,
                None => {
                    unresolved = true;
                    continue;
                }
                Some(true) => {}
            }
            let reference = Self::row_blob_ref_on(conn, gates, table, &row_id)?;
            if matches!(reference.authority(), RowBlobAuthority::Remote(_))
                && reference.stored() == Some(stored)
            {
                return Ok(StoredBlobReferenceState::LiveRemote);
            }
        }
        Ok(if unresolved {
            StoredBlobReferenceState::Unresolved
        } else {
            StoredBlobReferenceState::NotLiveRemote
        })
    }

    pub(crate) fn row_blob_ref_on(
        conn: &Connection,
        gates: &Gates,
        table: &SyncedTable,
        row_id: &str,
    ) -> Result<RowBlobRef, DbError> {
        let declaration = table.blob().ok_or_else(|| {
            DbError::Message(format!(
                "synced table {:?} has no blob declaration",
                table.name()
            ))
        })?;
        let row = live_blob_row(conn, table.name(), row_id, declaration)?.ok_or_else(|| {
            DbError::Message(format!(
                "blob-bearing row {:?}/{row_id:?} does not exist",
                table.name()
            ))
        })?;
        let audience =
            gate::live_row_audience(conn, gates, table.name(), row_id).map_err(|error| {
                DbError::Message(format!(
                    "resolve blob row audience for {:?}/{row_id:?}: {error}",
                    table.name()
                ))
            })?;
        let (authority, stored) = match RemoteAudience::try_from(audience.clone()) {
            Err(_) if audience == Audience::Local => (RowBlobAuthority::Local, None),
            Err(error) => {
                return Err(DbError::Message(format!(
                    "blob row {:?}/{row_id:?} has invalid audience: {error}",
                    table.name()
                )));
            }
            Ok(remote_audience) => {
                let installed: Option<(String, String)> = conn
                    .query_row(
                        "SELECT binding.audience_authority, locator.remote_object_id
                         FROM row_blob_locators AS binding
                         JOIN blob_locators AS locator
                           ON locator.remote_object_id = binding.remote_object_id
                         WHERE binding.table_name = ?1
                           AND binding.row_id = ?2
                           AND binding.column_name = ?3
                           AND binding.row_stamp = ?4",
                        rusqlite::params![table.name(), row_id, declaration.id_column, row.stamp,],
                        |row| Ok((row.get(0)?, row.get(1)?)),
                    )
                    .optional()
                    .map_err(DbError::from)?;
                let exact = if let Some((authority_json, remote_object_id)) = installed {
                    let package_authority: crate::sync::audience_package::PackageAudience =
                        serde_json::from_str(&authority_json).map_err(|error| {
                            DbError::Message(format!(
                                "remote blob row {:?}/{row_id:?} has invalid audience authority: {error}",
                                table.name()
                            ))
                        })?;
                    let remote_object_id = remote_object_id.parse().map_err(|error| {
                        DbError::Message(format!(
                            "remote blob row {:?}/{row_id:?} has invalid prepared object id: {error}",
                            table.name()
                        ))
                    })?;
                    let remote = load_remote_object_on(conn, remote_object_id)?;
                    if !remote.is_activated_stored_blob() {
                        return Err(DbError::Message(format!(
                            "remote blob row {:?}/{row_id:?} references a blob without activated ownership",
                            table.name()
                        )));
                    }
                    let locator = BlobLocator::parse(remote.bytes().canonical_semantic_bytes())
                        .map_err(|error| {
                            DbError::Message(format!(
                                "remote blob row {:?}/{row_id:?} has invalid locator: {error}",
                                table.name()
                            ))
                        })?;
                    let stored = StoredBlobRef::new(locator, remote.object().clone()).map_err(
                        |error| {
                            DbError::Message(format!(
                                "remote blob row {:?}/{row_id:?} has invalid stored blob reference: {error}",
                                table.name()
                            ))
                        },
                    )?;
                    Some((package_authority, stored))
                } else {
                    created_upload_handoff_on(
                        conn,
                        table.name(),
                        row_id,
                        &declaration.id_column,
                        &row.stamp,
                    )?
                    .map(|handoff| (handoff.authority, handoff.stored))
                };
                let Some((package_authority, stored)) = exact else {
                    return RowBlobRef::new(
                        table.name().to_string(),
                        row_id.to_string(),
                        row.stamp,
                        declaration.id_column.clone(),
                        BlobRef {
                            namespace: declaration.namespace.clone(),
                            id: row.blob_id,
                            scope: declaration.scope.clone(),
                            cloud_path: row.cloud_path,
                            provenance: declaration.provenance,
                            fill: declaration.fill,
                        },
                        row.plaintext_size,
                        row.plaintext_hash,
                        RowBlobAuthority::PendingRemote(remote_audience),
                        None,
                    )
                    .map_err(DbError::Message);
                };
                if package_authority.remote_audience() != remote_audience {
                    return Err(DbError::Message(format!(
                        "remote blob row {:?}/{row_id:?} has audience authority {:?}, expected {remote_audience:?}",
                        table.name(), package_authority
                    )));
                }
                validate_live_blob_locator(
                    table.name(),
                    row_id,
                    &declaration.id_column,
                    &row.stamp,
                    &stored,
                    declaration,
                    &row,
                    &remote_audience,
                )?;
                (RowBlobAuthority::Remote(package_authority), Some(stored))
            }
        };
        let blob = BlobRef {
            namespace: declaration.namespace.clone(),
            id: row.blob_id.clone(),
            scope: declaration.scope.clone(),
            cloud_path: row.cloud_path.clone(),
            provenance: declaration.provenance,
            fill: declaration.fill,
        };
        RowBlobRef::new(
            table.name().to_string(),
            row_id.to_string(),
            row.stamp,
            declaration.id_column.clone(),
            blob,
            row.plaintext_size,
            row.plaintext_hash,
            authority,
            stored,
        )
        .map_err(DbError::Message)
    }

    // ---- Row-bound blob outbox ----

    pub fn enqueue_upload_on(
        conn: &Connection,
        root_table: &str,
        root_id: &str,
        row: &RowBlobRef,
        source_path: &Path,
        retain_pinned: bool,
        created_at: &str,
    ) -> Result<(), DbError> {
        if row.authority() != &RowBlobAuthority::Local || row.stored().is_some() {
            return Err(DbError::Message(
                "cloud upload requires an exact Local row blob reference".to_string(),
            ));
        }
        let source_path = source_path.to_str().ok_or_else(|| {
            DbError::Message(format!(
                "blob source path for {}/{}/{} is not UTF-8: {source_path:?}",
                row.table(),
                row.row_id(),
                row.column()
            ))
        })?;
        let encoded = serde_json::to_string(row)
            .map_err(|error| DbError::Message(format!("serialize row blob ref: {error}")))?;
        let pending = serde_json::to_string(&OutboxUploadState::Pending).map_err(|error| {
            DbError::Message(format!("serialize pending blob upload state: {error}"))
        })?;
        conn.execute(
            "INSERT INTO cloud_outbox
             (operation, table_name, row_id, column_name, row_stamp, root_table, root_id,
              row_ref, upload_state, source_path, retain_pinned, created_at)
             VALUES ('upload', ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11)
             ON CONFLICT(operation, table_name, row_id, column_name, row_stamp) DO UPDATE SET
               root_table = excluded.root_table,
               root_id = excluded.root_id,
               source_path = excluded.source_path,
               retain_pinned = excluded.retain_pinned,
               attempt_count = 0,
               last_error = NULL,
               last_attempt_at = NULL
             WHERE cloud_outbox.row_ref = excluded.row_ref
               AND cloud_outbox.root_table = excluded.root_table
               AND cloud_outbox.root_id = excluded.root_id",
            rusqlite::params![
                row.table(),
                row.row_id(),
                row.column(),
                row.row_stamp(),
                root_table,
                root_id,
                encoded,
                pending,
                source_path,
                retain_pinned,
                created_at,
            ],
        )
        .map_err(DbError::from)
        .and_then(|changed| {
            if changed == 1 {
                Ok(())
            } else {
                Err(DbError::Message(format!(
                    "upload outbox identity {}/{}/{}/{} carries different row facts",
                    row.table(),
                    row.row_id(),
                    row.column(),
                    row.row_stamp()
                )))
            }
        })
    }

    pub async fn mark_cloud_upload_prepared(
        &self,
        entry: &OutboxEntry,
        authority: crate::sync::audience_package::PackageAudience,
        stored: StoredBlobRef,
        spool_path: PathBuf,
    ) -> Result<(), DbError> {
        let OutboxOperation::Upload { row, state, .. } = &entry.operation else {
            return Err(DbError::Message(
                "only an upload outbox entry can own a prepared blob".to_string(),
            ));
        };
        if state != &OutboxUploadState::Pending {
            return Err(DbError::Message(
                "blob upload is already prepared".to_string(),
            ));
        }
        let locator = stored.locator();
        if locator.namespace() != row.blob().namespace
            || locator.blob_id() != row.blob().id
            || locator.plaintext_size() != row.plaintext_size()
            || locator.plaintext_hash() != row.plaintext_hash()
            || locator
                .scope()
                .is_some_and(|scope| scope != &row.blob().scope)
        {
            return Err(DbError::Message(
                "prepared blob differs from its exact Local row version".to_string(),
            ));
        }
        if locator.audience() != authority.remote_audience() {
            return Err(DbError::Message(
                "prepared blob audience differs from its package authority".to_string(),
            ));
        }
        let prepared = OutboxUploadState::Prepared {
            authority,
            stored,
            spool_path,
        };
        let prepared_json = serde_json::to_string(&prepared).map_err(|error| {
            DbError::Message(format!("serialize prepared blob upload: {error}"))
        })?;
        let pending_json = serde_json::to_string(&OutboxUploadState::Pending)
            .map_err(|error| DbError::Message(format!("serialize pending blob upload: {error}")))?;
        let id = entry.id;
        let table = row.table().to_string();
        let row_id = row.row_id().to_string();
        let column = row.column().to_string();
        let row_stamp = row.row_stamp().to_string();
        self.call(move |conn| {
            let updated = conn
                .execute(
                    "UPDATE cloud_outbox SET upload_state = ?1
                     WHERE id = ?2 AND operation = 'upload' AND table_name = ?3
                       AND row_id = ?4 AND column_name = ?5 AND row_stamp = ?6
                       AND upload_state = ?7",
                    rusqlite::params![
                        prepared_json,
                        id,
                        table,
                        row_id,
                        column,
                        row_stamp,
                        pending_json,
                    ],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(
                    "upload outbox entry changed before prepared-object handoff".to_string(),
                ));
            }
            Ok(())
        })
        .await
    }

    pub async fn mark_cloud_upload_created(&self, entry: &OutboxEntry) -> Result<(), DbError> {
        let OutboxOperation::Upload { row, state, .. } = &entry.operation else {
            return Err(DbError::Message(
                "only a prepared upload outbox entry can record cloud creation".to_string(),
            ));
        };
        let OutboxUploadState::Prepared {
            authority,
            stored,
            spool_path,
        } = state
        else {
            return Err(DbError::Message(
                "cloud creation requires a prepared upload object".to_string(),
            ));
        };
        let created_json = serde_json::to_string(&OutboxUploadState::Created {
            authority: authority.clone(),
            stored: stored.clone(),
            spool_path: spool_path.clone(),
        })
        .map_err(|error| DbError::Message(format!("serialize created blob upload: {error}")))?;
        let prepared_json = serde_json::to_string(state).map_err(|error| {
            DbError::Message(format!("serialize prepared blob upload identity: {error}"))
        })?;
        let id = entry.id;
        let table = row.table().to_string();
        let row_id = row.row_id().to_string();
        let column = row.column().to_string();
        let row_stamp = row.row_stamp().to_string();
        self.call(move |conn| {
            let updated = conn
                .execute(
                    "UPDATE cloud_outbox SET upload_state = ?1
                     WHERE id = ?2 AND operation = 'upload' AND table_name = ?3
                       AND row_id = ?4 AND column_name = ?5 AND row_stamp = ?6
                       AND upload_state = ?7",
                    rusqlite::params![
                        created_json,
                        id,
                        table,
                        row_id,
                        column,
                        row_stamp,
                        prepared_json,
                    ],
                )
                .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(
                    "upload outbox entry changed before cloud-created handoff".to_string(),
                ));
            }
            Ok(())
        })
        .await
    }

    pub fn enqueue_delete_on(
        conn: &Connection,
        stored: &StoredBlobRef,
        created_at: &str,
    ) -> Result<(), DbError> {
        let encoded = serde_json::to_string(stored)
            .map_err(|error| DbError::Message(format!("serialize stored blob ref: {error}")))?;
        conn.execute(
            "INSERT INTO cloud_outbox (operation, stored_ref, created_at)
             VALUES ('delete', ?1, ?2)
             ON CONFLICT(stored_ref) DO UPDATE SET
               created_at = excluded.created_at,
               attempt_count = 0,
               last_error = NULL,
               last_attempt_at = NULL",
            (encoded, created_at),
        )
        .map(|_| ())
        .map_err(DbError::from)
    }

    pub async fn get_pending_cloud_uploads(&self) -> Result<Vec<OutboxEntry>, DbError> {
        self.pending_outbox("upload").await
    }

    pub async fn get_pending_cloud_deletes(&self) -> Result<Vec<OutboxEntry>, DbError> {
        self.pending_outbox("delete").await
    }

    async fn pending_outbox(&self, operation: &'static str) -> Result<Vec<OutboxEntry>, DbError> {
        self.call(move |conn| {
            let mut statement = conn
                .prepare(
                    "SELECT id, operation, row_ref, stored_ref, source_path, retain_pinned,
                            upload_state, attempt_count, last_attempt_at, root_table, root_id
                     FROM cloud_outbox WHERE operation = ?1 ORDER BY id",
                )
                .map_err(DbError::from)?;
            let entries = statement
                .query_map([operation], row_to_outbox_entry)
                .map_err(DbError::from)?
                .collect::<Result<Vec<_>, _>>()
                .map_err(DbError::from)?;
            Ok(entries)
        })
        .await
    }

    pub async fn remove_cloud_outbox_entry(&self, entry: &OutboxEntry) -> Result<(), DbError> {
        let entry = entry.clone();
        self.call(move |conn| Self::remove_cloud_outbox_entry_on(conn, &entry))
            .await
    }

    pub(crate) fn remove_cloud_outbox_entry_on(
        conn: &Connection,
        entry: &OutboxEntry,
    ) -> Result<(), DbError> {
        let identity = outbox_identity(&entry.operation)?;
        let removed = match identity {
            OutboxIdentity::Upload {
                table,
                row_id,
                column,
                row_stamp,
            } => conn.execute(
                "DELETE FROM cloud_outbox WHERE id = ?1 AND operation = 'upload'
                 AND table_name = ?2 AND row_id = ?3 AND column_name = ?4 AND row_stamp = ?5",
                rusqlite::params![entry.id, table, row_id, column, row_stamp],
            ),
            OutboxIdentity::Stored { operation, stored } => conn.execute(
                "DELETE FROM cloud_outbox WHERE id = ?1 AND operation = ?2 AND stored_ref = ?3",
                rusqlite::params![entry.id, operation, stored],
            ),
        }
        .map_err(DbError::from)?;
        if removed != 1 {
            return Err(DbError::Message(
                "cloud outbox entry changed before exact dequeue".to_string(),
            ));
        }
        Ok(())
    }

    pub(crate) fn finish_cancelled_upload_on(
        conn: &Connection,
        entry: &OutboxEntry,
    ) -> Result<bool, DbError> {
        let OutboxOperation::Upload {
            root_table,
            root_id,
            ..
        } = &entry.operation
        else {
            return Err(DbError::Message(
                "make_remote cleanup requires an upload entry".to_string(),
            ));
        };
        if !matches!(
            Self::make_remote_intent_state(conn, root_table, root_id)?,
            Some(MakeRemoteIntentState::Cancelling)
        ) {
            return Err(DbError::Message(format!(
                "make_remote cleanup for {root_table:?}/{root_id:?} lost cancellation ownership"
            )));
        }
        Self::remove_cloud_outbox_entry_on(conn, entry)?;
        let remaining: i64 = conn
            .query_row(
                "SELECT COUNT(*) FROM cloud_outbox
                 WHERE operation = 'upload' AND root_table = ?1 AND root_id = ?2",
                (root_table, root_id),
                |row| row.get(0),
            )
            .map_err(DbError::from)?;
        if remaining != 0 {
            return Ok(false);
        }
        let removed = conn
            .execute(
                "DELETE FROM blob_make_remote_intents
                 WHERE root_table = ?1 AND root_id = ?2 AND state = 'cancelling'",
                (root_table, root_id),
            )
            .map_err(DbError::from)?;
        if removed != 1 {
            return Err(DbError::Message(format!(
                "make_remote cancellation {root_table:?}/{root_id:?} changed before completion"
            )));
        }
        Ok(true)
    }

    pub async fn record_cloud_outbox_failure(
        &self,
        entry: &OutboxEntry,
        error: &str,
        attempted_at: &str,
    ) -> Result<(), DbError> {
        let id = entry.id;
        let identity = outbox_identity(&entry.operation)?;
        let error = error.to_string();
        let attempted_at = attempted_at.to_string();
        self.call(move |conn| {
            let updated = match identity {
                OutboxIdentity::Upload {
                    table,
                    row_id,
                    column,
                    row_stamp,
                } => conn.execute(
                    "UPDATE cloud_outbox SET attempt_count = attempt_count + 1,
                     last_error = ?1, last_attempt_at = ?2
                     WHERE id = ?3 AND operation = 'upload' AND table_name = ?4
                       AND row_id = ?5 AND column_name = ?6 AND row_stamp = ?7",
                    rusqlite::params![error, attempted_at, id, table, row_id, column, row_stamp],
                ),
                OutboxIdentity::Stored { operation, stored } => conn.execute(
                    "UPDATE cloud_outbox SET attempt_count = attempt_count + 1,
                     last_error = ?1, last_attempt_at = ?2
                     WHERE id = ?3 AND operation = ?4 AND stored_ref = ?5",
                    rusqlite::params![error, attempted_at, id, operation, stored],
                ),
            }
            .map_err(DbError::from)?;
            if updated != 1 {
                return Err(DbError::Message(
                    "cloud outbox entry changed before failure recording".to_string(),
                ));
            }
            Ok(())
        })
        .await
    }

    pub async fn reset_cloud_outbox_backoff(&self) -> Result<(), DbError> {
        self.call(|conn| {
            conn.execute(
                "UPDATE cloud_outbox SET last_attempt_at = NULL WHERE attempt_count > 0",
                [],
            )
            .map(|_| ())
            .map_err(DbError::from)
        })
        .await
    }

    // ---- Local blob refs (external user files) ----

    pub fn register_external_blob_on(
        conn: &Connection,
        reference: &RowBlobRef,
        path: &Path,
    ) -> Result<(), DbError> {
        if reference.authority() != &RowBlobAuthority::Local || reference.stored().is_some() {
            return Err(DbError::Message(
                "external file requires an exact Local row blob reference".to_string(),
            ));
        }
        let path = path.to_str().ok_or_else(|| {
            DbError::Message(format!("external blob path is not UTF-8: {path:?}"))
        })?;
        let size = i64::try_from(reference.plaintext_size()).map_err(|_| {
            DbError::Message("external blob plaintext size exceeds SQLite INTEGER".to_string())
        })?;
        conn.execute(
            "INSERT INTO local_blob_refs
             (table_name, row_id, column_name, row_stamp, namespace, blob_id,
              path, plaintext_size, plaintext_hash)
             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
             ON CONFLICT(table_name, row_id, column_name, row_stamp) DO UPDATE SET
               namespace = excluded.namespace,
               blob_id = excluded.blob_id,
               path = excluded.path,
               plaintext_size = excluded.plaintext_size,
               plaintext_hash = excluded.plaintext_hash",
            rusqlite::params![
                reference.table(),
                reference.row_id(),
                reference.column(),
                reference.row_stamp(),
                &reference.blob().namespace,
                &reference.blob().id,
                path,
                size,
                reference.plaintext_hash().to_string(),
            ],
        )
        .map(|_| ())
        .map_err(DbError::from)
    }

    pub fn clear_external_blob_on(
        conn: &Connection,
        reference: &RowBlobRef,
    ) -> Result<(), DbError> {
        conn.execute(
            "DELETE FROM local_blob_refs WHERE table_name = ?1 AND row_id = ?2
             AND column_name = ?3 AND row_stamp = ?4",
            rusqlite::params![
                reference.table(),
                reference.row_id(),
                reference.column(),
                reference.row_stamp(),
            ],
        )
        .map(|_| ())
        .map_err(DbError::from)
    }

    pub fn insert_make_remote_intent_on(
        conn: &Connection,
        root_table: &str,
        root_id: &str,
        retain_pinned: bool,
    ) -> Result<(), DbError> {
        conn.execute(
            "INSERT INTO blob_make_remote_intents
             (root_table, root_id, retain_pinned, state, write_id)
             VALUES (?1, ?2, ?3, 'uploading', NULL)
             ON CONFLICT(root_table, root_id) DO UPDATE SET
               retain_pinned = excluded.retain_pinned
             WHERE blob_make_remote_intents.state = 'uploading'",
            (root_table, root_id, retain_pinned),
        )
        .map_err(DbError::from)
        .and_then(|changed| {
            if changed == 1 {
                Ok(())
            } else {
                Err(DbError::Message(format!(
                    "make_remote for {root_table:?}/{root_id:?} is already publishing"
                )))
            }
        })
    }

    #[cfg(test)]
    pub(crate) fn make_remote_intent_exists(
        conn: &Connection,
        root_table: &str,
        root_id: &str,
    ) -> Result<bool, DbError> {
        conn.query_row(
            "SELECT 1 FROM blob_make_remote_intents WHERE root_table = ?1 AND root_id = ?2",
            (root_table, root_id),
            |_| Ok(()),
        )
        .optional()
        .map(|value| value.is_some())
        .map_err(DbError::from)
    }

    pub(crate) fn make_remote_intent_state(
        conn: &Connection,
        root_table: &str,
        root_id: &str,
    ) -> Result<Option<MakeRemoteIntentState>, DbError> {
        let encoded = conn
            .query_row(
                "SELECT state, write_id FROM blob_make_remote_intents
                 WHERE root_table = ?1 AND root_id = ?2",
                (root_table, root_id),
                |row| Ok((row.get::<_, String>(0)?, row.get::<_, Option<String>>(1)?)),
            )
            .optional()
            .map_err(DbError::from)?;
        encoded
            .map(|(state, write_id)| match (state.as_str(), write_id) {
                ("uploading", None) => Ok(MakeRemoteIntentState::Uploading),
                ("cancelling", None) => Ok(MakeRemoteIntentState::Cancelling),
                ("publishing", Some(write_id)) => Ok(MakeRemoteIntentState::Publishing(
                    WriteId::from_generated(write_id),
                )),
                _ => Err(DbError::Message(format!(
                    "make_remote intent {root_table:?}/{root_id:?} has invalid state {state:?}"
                ))),
            })
            .transpose()
    }

    pub(crate) fn mark_make_remote_cancelling_on(
        conn: &Connection,
        root_table: &str,
        root_id: &str,
    ) -> Result<(), DbError> {
        let updated = conn
            .execute(
                "UPDATE blob_make_remote_intents SET state = 'cancelling'
                 WHERE root_table = ?1 AND root_id = ?2 AND state = 'uploading'",
                (root_table, root_id),
            )
            .map_err(DbError::from)?;
        if updated == 1 {
            conn.execute(
                "UPDATE cloud_outbox
                 SET attempt_count = 0, last_error = NULL, last_attempt_at = NULL
                 WHERE operation = 'upload' AND root_table = ?1 AND root_id = ?2",
                (root_table, root_id),
            )
            .map_err(DbError::from)?;
            return Ok(());
        }
        if matches!(
            Self::make_remote_intent_state(conn, root_table, root_id)?,
            Some(MakeRemoteIntentState::Cancelling)
        ) {
            return Ok(());
        }
        Err(DbError::Message(format!(
            "make_remote intent {root_table:?}/{root_id:?} cannot enter cancellation"
        )))
    }

    pub fn mark_make_remote_publishing_on(
        conn: &Connection,
        root_table: &str,
        root_id: &str,
        write_id: &WriteId,
    ) -> Result<(), DbError> {
        let updated = conn
            .execute(
                "UPDATE blob_make_remote_intents SET state = 'publishing', write_id = ?3
                 WHERE root_table = ?1 AND root_id = ?2 AND state = 'uploading'",
                (root_table, root_id, write_id.as_str()),
            )
            .map_err(DbError::from)?;
        if updated != 1 {
            return Err(DbError::Message(format!(
                "make_remote intent {root_table:?}/{root_id:?} changed before publication"
            )));
        }
        Ok(())
    }

    pub fn complete_make_remote_publication_on(
        conn: &Connection,
        write_id: &WriteId,
    ) -> Result<(), DbError> {
        let removed = conn
            .execute(
                "DELETE FROM blob_make_remote_intents
                 WHERE write_id = ?1 AND state = 'publishing'",
                [write_id.as_str()],
            )
            .map_err(DbError::from)?;
        if removed != 1 {
            return Err(DbError::Message(format!(
                "make_remote publication {write_id} changed before activation"
            )));
        }
        Ok(())
    }

    pub(crate) fn make_remote_publication_root_on(
        conn: &Connection,
        write_id: &WriteId,
    ) -> Result<Option<(String, String)>, DbError> {
        conn.query_row(
            "SELECT root_table, root_id FROM blob_make_remote_intents
             WHERE write_id = ?1 AND state = 'publishing'",
            [write_id.as_str()],
            |row| Ok((row.get(0)?, row.get(1)?)),
        )
        .optional()
        .map_err(DbError::from)
    }

    pub fn make_remote_intent_retain_pinned(
        conn: &Connection,
        root_table: &str,
        root_id: &str,
    ) -> Result<Option<bool>, DbError> {
        conn.query_row(
            "SELECT retain_pinned FROM blob_make_remote_intents
             WHERE root_table = ?1 AND root_id = ?2",
            (root_table, root_id),
            |row| row.get(0),
        )
        .optional()
        .map_err(DbError::from)
    }

    pub(crate) async fn external_blob_for_row(
        &self,
        reference: &RowBlobRef,
    ) -> Result<Option<ExternalBlob>, DbError> {
        let table = reference.table().to_string();
        let row_id = reference.row_id().to_string();
        let column = reference.column().to_string();
        let row_stamp = reference.row_stamp().to_string();
        let namespace = reference.blob().namespace.clone();
        let blob_id = reference.blob().id.clone();
        let expected_size = reference.plaintext_size();
        let expected_hash = reference.plaintext_hash();
        self.call(move |conn| {
            let row = conn
                .query_row(
                    "SELECT path, plaintext_size, plaintext_hash, namespace, blob_id
                     FROM local_blob_refs
                     WHERE table_name = ?1 AND row_id = ?2 AND column_name = ?3
                       AND row_stamp = ?4",
                    rusqlite::params![table, row_id, column, row_stamp],
                    |row| {
                        Ok((
                            row.get::<_, String>(0)?,
                            row.get::<_, i64>(1)?,
                            row.get::<_, String>(2)?,
                            row.get::<_, String>(3)?,
                            row.get::<_, String>(4)?,
                        ))
                    },
                )
                .optional()
                .map_err(DbError::from)?;
            let Some((path, size, hash, stored_namespace, stored_blob_id)) = row else {
                return Ok(None);
            };
            let size = u64::try_from(size).map_err(|_| {
                DbError::Message(format!("external blob {blob_id} has negative size"))
            })?;
            let hash: ObjectHash = hash.parse().map_err(|error| {
                DbError::Message(format!("external blob {blob_id} hash: {error}"))
            })?;
            if size != expected_size
                || hash != expected_hash
                || stored_namespace != namespace
                || stored_blob_id != blob_id
            {
                return Err(DbError::Message(format!(
                    "external blob row {table}/{row_id}/{column} differs from its row reference"
                )));
            }
            Ok(Some(ExternalBlob {
                path: PathBuf::from(path),
                size,
            }))
        })
        .await
    }
}

fn validate_snapshot_object_owners_on(
    conn: &Connection,
    root: &crate::sync::store_commit::StoreRootRef,
    meta: &SnapshotMeta,
) -> Result<(), DbError> {
    let expected = crate::sync::remote_object::SnapshotObjectOwner {
        activation: StreamActivationId::store_snapshots(root, &meta.author_registration),
        sequence: meta.sequence,
    };
    if meta.successor.activation != expected.activation {
        return Err(DbError::Message(
            "verified snapshot successor differs from its author stream activation".to_string(),
        ));
    }
    validate_snapshot_object_owner_records_on(conn, &expected)
}

fn validate_snapshot_object_owner_records_on(
    conn: &Connection,
    expected: &crate::sync::remote_object::SnapshotObjectOwner,
) -> Result<(), DbError> {
    let mut statement = conn
        .prepare("SELECT object_id FROM remote_objects ORDER BY object_id")
        .map_err(DbError::from)?;
    let object_ids = statement
        .query_map([], |row| row.get::<_, String>(0))
        .map_err(DbError::from)?
        .collect::<Result<Vec<_>, _>>()
        .map_err(DbError::from)?;
    drop(statement);
    for object_id in object_ids {
        let parsed = object_id.parse().map_err(|error| {
            DbError::Message(format!("snapshot remote object id {object_id:?}: {error}"))
        })?;
        let remote = load_remote_object_on(conn, parsed)?;
        for owner in remote.snapshot_owners() {
            if owner != expected {
                return Err(DbError::Message(format!(
                    "snapshot remote object {object_id} belongs to a different snapshot stream activation or sequence"
                )));
            }
        }
    }
    Ok(())
}

fn validate_snapshot_blob_plan_on(
    conn: &Connection,
    gates: &Gates,
    synced_tables: &[SyncedTable],
    meta: &SnapshotMeta,
    blob: &PreparedSnapshotBlob,
) -> Result<(), DbError> {
    blob.remote
        .validate()
        .map_err(|error| DbError::Message(format!("snapshot remote blob: {error}")))?;
    let expected_owner = crate::sync::remote_object::SnapshotObjectOwner {
        activation: meta.successor.activation,
        sequence: meta.sequence,
    };
    let owners = blob.remote.snapshot_owners().collect::<Vec<_>>();
    if owners != [&expected_owner] {
        return Err(DbError::Message(
            "snapshot blob owner differs from the verified snapshot stream activation".to_string(),
        ));
    }
    if blob.bindings.is_empty()
        || blob.bindings.iter().any(|binding| {
            binding.blob().object() != blob.remote.object()
                || binding.blob().locator().audience() != blob.authority.remote_audience()
        })
        || blob
            .spool_path
            .as_ref()
            .is_some_and(|path| !path.is_absolute())
    {
        return Err(DbError::Message(
            "snapshot blob plan has inconsistent exact references".to_string(),
        ));
    }
    for binding in &blob.bindings {
        let table = synced_tables
            .iter()
            .find(|table| table.name() == binding.table())
            .ok_or_else(|| {
                DbError::Message(format!(
                    "snapshot blob names undeclared table {:?}",
                    binding.table()
                ))
            })?;
        let declaration = table.blob().ok_or_else(|| {
            DbError::Message(format!(
                "snapshot blob names table {:?} without a blob declaration",
                table.name()
            ))
        })?;
        let row =
            live_blob_row(conn, table.name(), binding.row_id(), declaration)?.ok_or_else(|| {
                DbError::Message(format!(
                    "snapshot blob row {:?}/{:?} is absent",
                    table.name(),
                    binding.row_id()
                ))
            })?;
        let audience = gate::live_row_audience(conn, gates, table.name(), binding.row_id())
            .map_err(|error| DbError::Message(error.to_string()))?;
        let audience = RemoteAudience::try_from(audience)
            .map_err(|error| DbError::Message(error.to_string()))?;
        validate_live_blob_locator(
            binding.table(),
            binding.row_id(),
            binding.column(),
            binding.row_stamp(),
            binding.blob(),
            declaration,
            &row,
            &audience,
        )?;
    }
    Ok(())
}

fn install_snapshot_blob_plan_on(
    conn: &Connection,
    blob: &PreparedSnapshotBlob,
) -> Result<(), DbError> {
    let object_id = blob.remote.object_id();
    let exists: bool = conn
        .query_row(
            "SELECT EXISTS(SELECT 1 FROM remote_objects WHERE object_id = ?1)",
            [object_id.to_string()],
            |row| row.get(0),
        )
        .map_err(DbError::from)?;
    let merged = if exists {
        let mut existing = load_remote_object_on(conn, object_id)?;
        for owner in blob.remote.snapshot_owners() {
            existing
                .merge_snapshot_owner(blob.bindings[0].blob(), owner.clone())
                .map_err(|error| DbError::Message(format!("merge snapshot blob owner: {error}")))?;
        }
        existing
    } else {
        blob.remote.clone()
    };
    let encoded = serde_json::to_string(&merged)
        .map_err(|error| DbError::Message(format!("serialize snapshot blob: {error}")))?;
    conn.execute(
        "INSERT INTO remote_objects (object_id, state) VALUES (?1, ?2)
         ON CONFLICT(object_id) DO UPDATE SET state = excluded.state",
        rusqlite::params![object_id.to_string(), encoded],
    )
    .map_err(DbError::from)?;
    conn.execute(
        "INSERT INTO blob_locators (remote_object_id, locator_hash) VALUES (?1, ?2)
         ON CONFLICT(remote_object_id) DO NOTHING",
        rusqlite::params![
            object_id.to_string(),
            blob.bindings[0].blob().locator().locator_hash().to_string(),
        ],
    )
    .map_err(DbError::from)?;
    validate_stored_locator_on(conn, blob.bindings[0].blob())?;
    let authority = serde_json::to_string(&blob.authority)
        .map_err(|error| DbError::Message(format!("serialize snapshot blob authority: {error}")))?;
    for binding in &blob.bindings {
        conn.execute(
            "INSERT INTO row_blob_locators
         (table_name, row_id, column_name, row_stamp, audience_authority, remote_object_id)
         VALUES (?1, ?2, ?3, ?4, ?5, ?6)
         ON CONFLICT(table_name, row_id, column_name, row_stamp) DO NOTHING",
            rusqlite::params![
                binding.table(),
                binding.row_id(),
                binding.column(),
                binding.row_stamp(),
                authority,
                object_id.to_string(),
            ],
        )
        .map_err(DbError::from)?;
        validate_stored_row_binding_on(conn, binding, &blob.authority, object_id)?;
    }
    Ok(())
}

enum OutboxIdentity {
    Upload {
        table: String,
        row_id: String,
        column: String,
        row_stamp: String,
    },
    Stored {
        operation: &'static str,
        stored: String,
    },
}

fn upload_entry_for_identity_on(
    conn: &Connection,
    table: &str,
    row_id: &str,
    column: &str,
    row_stamp: &str,
) -> Result<Option<OutboxEntry>, DbError> {
    conn.query_row(
        "SELECT id, operation, row_ref, stored_ref, source_path, retain_pinned,
                upload_state, attempt_count, last_attempt_at, root_table, root_id
         FROM cloud_outbox
         WHERE operation = 'upload' AND table_name = ?1 AND row_id = ?2
           AND column_name = ?3 AND row_stamp = ?4",
        rusqlite::params![table, row_id, column, row_stamp],
        row_to_outbox_entry,
    )
    .optional()
    .map_err(DbError::from)
}

fn consume_created_upload_handoff_on(
    conn: &Connection,
    package: &AudiencePackage,
    binding: &RowBlobLocatorBinding,
) -> Result<bool, DbError> {
    let Some(entry) = upload_entry_for_identity_on(
        conn,
        binding.table(),
        binding.row_id(),
        binding.column(),
        binding.row_stamp(),
    )?
    else {
        return Ok(false);
    };
    let OutboxOperation::Upload {
        row,
        state: OutboxUploadState::Created {
            authority, stored, ..
        },
        ..
    } = &entry.operation
    else {
        return Err(DbError::Message(format!(
            "activated blob binding {}/{}/{} at {} has an upload that is not Created",
            binding.table(),
            binding.row_id(),
            binding.column(),
            binding.row_stamp()
        )));
    };
    if row.table() != binding.table()
        || row.row_id() != binding.row_id()
        || row.column() != binding.column()
        || row.row_stamp() != binding.row_stamp()
        || authority != package.audience()
        || stored != binding.blob()
    {
        return Err(DbError::Message(format!(
            "activated blob binding {}/{}/{} at {} differs from its Created upload handoff",
            binding.table(),
            binding.row_id(),
            binding.column(),
            binding.row_stamp()
        )));
    }
    Database::remove_cloud_outbox_entry_on(conn, &entry)?;
    Ok(true)
}

fn created_upload_handoff_on(
    conn: &Connection,
    table: &str,
    row_id: &str,
    column: &str,
    row_stamp: &str,
) -> Result<Option<StoreWriteRemoteBlob>, DbError> {
    let Some(entry) = upload_entry_for_identity_on(conn, table, row_id, column, row_stamp)? else {
        return Ok(None);
    };
    let OutboxOperation::Upload { row, state, .. } = entry.operation else {
        return Err(DbError::Message(
            "upload identity query returned a non-upload operation".to_string(),
        ));
    };
    if row.table() != table
        || row.row_id() != row_id
        || row.column() != column
        || row.row_stamp() != row_stamp
    {
        return Err(DbError::Message(format!(
            "upload outbox row facts differ from identity {table}/{row_id}/{column} at {row_stamp}"
        )));
    }
    match state {
        OutboxUploadState::Created {
            authority, stored, ..
        } => Ok(Some(StoreWriteRemoteBlob { authority, stored })),
        OutboxUploadState::Pending | OutboxUploadState::Prepared { .. } => Ok(None),
    }
}

fn outbox_identity(operation: &OutboxOperation) -> Result<OutboxIdentity, DbError> {
    match operation {
        OutboxOperation::Upload { row, .. } => Ok(OutboxIdentity::Upload {
            table: row.table().to_string(),
            row_id: row.row_id().to_string(),
            column: row.column().to_string(),
            row_stamp: row.row_stamp().to_string(),
        }),
        OutboxOperation::Delete { stored } => Ok(OutboxIdentity::Stored {
            operation: "delete",
            stored: serde_json::to_string(stored).map_err(|error| {
                DbError::Message(format!("serialize stored blob outbox identity: {error}"))
            })?,
        }),
    }
}

fn row_to_outbox_entry(row: &rusqlite::Row<'_>) -> rusqlite::Result<OutboxEntry> {
    fn invalid(index: usize, message: String) -> rusqlite::Error {
        rusqlite::Error::FromSqlConversionFailure(
            index,
            rusqlite::types::Type::Text,
            Box::new(std::io::Error::new(
                std::io::ErrorKind::InvalidData,
                message,
            )),
        )
    }

    let tag: String = row.get(1)?;
    let operation = match tag.as_str() {
        "upload" => {
            let encoded: String = row.get(2)?;
            let reference: RowBlobRef =
                serde_json::from_str(&encoded).map_err(|error| invalid(2, error.to_string()))?;
            let source_path: String = row.get(4)?;
            let state_json: String = row.get(6)?;
            let state: OutboxUploadState =
                serde_json::from_str(&state_json).map_err(|error| invalid(6, error.to_string()))?;
            if let OutboxUploadState::Prepared {
                authority, stored, ..
            }
            | OutboxUploadState::Created {
                authority, stored, ..
            } = &state
            {
                let locator = stored.locator();
                if locator.namespace() != reference.blob().namespace
                    || locator.blob_id() != reference.blob().id
                    || locator.plaintext_size() != reference.plaintext_size()
                    || locator.plaintext_hash() != reference.plaintext_hash()
                    || locator
                        .scope()
                        .is_some_and(|scope| scope != &reference.blob().scope)
                {
                    return Err(invalid(
                        6,
                        "prepared upload differs from its exact row version".to_string(),
                    ));
                }
                if locator.audience() != authority.remote_audience() {
                    return Err(invalid(
                        6,
                        "upload package authority differs from its stored locator".to_string(),
                    ));
                }
            }
            OutboxOperation::Upload {
                root_table: row.get(9)?,
                root_id: row.get(10)?,
                row: reference,
                source_path: PathBuf::from(source_path),
                retain_pinned: row.get(5)?,
                state,
            }
        }
        "delete" => {
            let encoded: String = row.get(3)?;
            let stored: StoredBlobRef =
                serde_json::from_str(&encoded).map_err(|error| invalid(3, error.to_string()))?;
            OutboxOperation::Delete { stored }
        }
        _ => {
            return Err(invalid(
                1,
                format!("invalid cloud outbox operation {tag:?}"),
            ))
        }
    };
    Ok(OutboxEntry {
        id: row.get(0)?,
        attempt_count: row.get(7)?,
        last_attempt_at: row.get(8)?,
        operation,
    })
}

fn local_store_authority_on(
    conn: &Connection,
) -> Result<
    (
        crate::sync::store_commit::StoreRootRef,
        StoreDeviceRegistrationRef,
        StoreDeviceRegistration,
    ),
    DbError,
> {
    let root = required_store_root_authority_on(conn)?;
    let device_id: String = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [LOCAL_DEVICE_ID_STATE_KEY],
            |row| row.get(0),
        )
        .map_err(DbError::from)?;
    let (bytes, encoded): (Vec<u8>, String) = conn
        .query_row(
            "SELECT registration_bytes, registration_object \
             FROM store_device_registration_activations WHERE device_id = ?1",
            [&device_id],
            |row| Ok((row.get(0)?, row.get(1)?)),
        )
        .map_err(DbError::from)?;
    let reference: StoreDeviceRegistrationRef =
        serde_json::from_str(&encoded).map_err(|error| {
            DbError::Message(format!("local Store registration exact ref: {error}"))
        })?;
    if reference.device_id.to_string() != device_id {
        return Err(DbError::Message(
            "local Store device state differs from its activated registration".to_string(),
        ));
    }
    let registration = StoreDeviceRegistration::parse_at(&bytes, &root, reference.device_id)
        .map_err(|error| DbError::Message(format!("local Store registration: {error}")))?;
    reference
        .verify_registration(&registration)
        .map_err(|error| DbError::Message(error.to_string()))?;
    Ok((root, reference, registration))
}

fn local_merge_stream_id_on(conn: &Connection) -> Result<Option<String>, DbError> {
    let local_device_id = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [LOCAL_DEVICE_ID_STATE_KEY],
            |row| row.get::<_, String>(0),
        )
        .optional()
        .map_err(DbError::from)?;
    let Some(_) = local_device_id else {
        return Ok(None);
    };
    let (root, reference, _) = local_store_authority_on(conn)?;
    Ok(Some(
        AuthorStreamId::store_announcements(&root, &reference).to_string(),
    ))
}

fn pin_host_device_id_on(
    conn: &Connection,
    expected: &str,
    initialized: bool,
) -> Result<(), DbError> {
    if initialized {
        return validate_host_device_id_on(conn, expected);
    }
    conn.execute(
        "INSERT INTO protocol_state (key, value) VALUES (?1, ?2)",
        (HOST_DEVICE_ID_STATE_KEY, expected),
    )
    .map(|_| ())
    .map_err(DbError::from)
}

fn validate_host_device_id_on(conn: &Connection, expected: &str) -> Result<(), DbError> {
    let stored = conn
        .query_row(
            "SELECT value FROM protocol_state WHERE key = ?1",
            [HOST_DEVICE_ID_STATE_KEY],
            |row| row.get::<_, String>(0),
        )
        .optional()
        .map_err(DbError::from)?
        .ok_or_else(|| DbError::Message("Coven host device identity is absent".to_string()))?;
    if stored != expected {
        return Err(DbError::Message(format!(
            "Coven host device identity is {stored:?}, not configured identity {expected:?}"
        )));
    }
    Ok(())
}

fn store_ack_first_slot(
    registration: &StoreDeviceRegistration,
) -> Result<&crate::storage::cloud::ObjectSlot, DbError> {
    match &registration.acknowledgements {
        crate::sync::store_commit::DeviceStreamAnchor::StoreAcknowledgements { first_slot } => {
            Ok(first_slot)
        }
        _ => Err(DbError::Message(
            "local Store registration has no acknowledgement stream anchor".to_string(),
        )),
    }
}

fn store_snapshot_first_slot(
    registration: &StoreDeviceRegistration,
) -> Result<&crate::storage::cloud::ObjectSlot, DbError> {
    match &registration.snapshots {
        crate::sync::store_commit::DeviceStreamAnchor::StoreSnapshots { first_slot } => {
            Ok(first_slot)
        }
        _ => Err(DbError::Message(
            "local Store registration has no snapshot stream anchor".to_string(),
        )),
    }
}

fn load_published_store_ack_on(conn: &Connection) -> Result<Option<PublishedStoreAck>, DbError> {
    conn.query_row(
        "SELECT ack_ref, successor_slot FROM published_store_acks WHERE singleton = 1",
        [],
        |row| Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?)),
    )
    .optional()
    .map_err(DbError::from)?
    .map(|(reference, successor_slot)| {
        let reference: StoreAckRef = serde_json::from_str(&reference).map_err(|error| {
            DbError::Message(format!("published Store acknowledgement ref: {error}"))
        })?;
        if reference.revision == 0 {
            return Err(DbError::Message(
                "published Store acknowledgement uses revision zero".to_string(),
            ));
        }
        Ok(PublishedStoreAck {
            reference,
            successor_slot: serde_json::from_str(&successor_slot).map_err(|error| {
                DbError::Message(format!(
                    "published Store acknowledgement successor slot: {error}"
                ))
            })?,
        })
    })
    .transpose()
}

fn load_outbound_store_ack_on(conn: &Connection) -> Result<Option<OutboundStoreAck>, DbError> {
    conn.query_row(
        "SELECT ack_ref, ack_bytes, prepared_object \
         FROM outbound_store_acks WHERE singleton = 1",
        [],
        |row| {
            Ok((
                row.get::<_, String>(0)?,
                row.get::<_, Vec<u8>>(1)?,
                row.get::<_, String>(2)?,
            ))
        },
    )
    .optional()
    .map_err(DbError::from)?
    .map(|(reference, bytes, prepared)| {
        let reference: StoreAckRef = serde_json::from_str(&reference).map_err(|error| {
            DbError::Message(format!("outbound Store acknowledgement ref: {error}"))
        })?;
        let prepared: PreparedExactObject = serde_json::from_str(&prepared).map_err(|error| {
            DbError::Message(format!("outbound prepared Store acknowledgement: {error}"))
        })?;
        if prepared.reference() != &reference.object {
            return Err(DbError::Message(
                "outbound Store acknowledgement ref differs from its prepared object".to_string(),
            ));
        }
        let (root, author_ref, author) = local_store_authority_on(conn)?;
        let value = StoreAck::parse_at(&bytes, root.store_root_hash, &reference, &author).map_err(
            |error| DbError::Message(format!("outbound Store acknowledgement: {error}")),
        )?;
        if value.author_registration != author_ref {
            return Err(DbError::Message(
                "outbound Store acknowledgement author differs from local activation".to_string(),
            ));
        }
        Ok(OutboundStoreAck {
            reference,
            ack: ExactProtocolObject {
                value,
                bytes,
                object: prepared.reference().clone(),
                prepared,
            },
        })
    })
    .transpose()
}

fn load_published_store_snapshot_on(
    conn: &Connection,
) -> Result<Option<PublishedStoreSnapshot>, DbError> {
    conn.query_row(
        "SELECT snapshot_ref, successor_slot, meta_bytes \
         FROM published_store_snapshot WHERE singleton = 1",
        [],
        |row| {
            Ok((
                row.get::<_, String>(0)?,
                row.get::<_, String>(1)?,
                row.get::<_, Vec<u8>>(2)?,
            ))
        },
    )
    .optional()
    .map_err(DbError::from)?
    .map(|(reference, successor_slot, bytes)| {
        let reference: StoreSnapshotRef = serde_json::from_str(&reference)
            .map_err(|error| DbError::Message(format!("published Store snapshot ref: {error}")))?;
        let successor_slot = serde_json::from_str(&successor_slot).map_err(|error| {
            DbError::Message(format!("published Store snapshot successor slot: {error}"))
        })?;
        let (root, author_ref, author) = local_store_authority_on(conn)?;
        let meta = SnapshotMeta::parse_at(&bytes, root.store_root_hash, &reference, &author)
            .map_err(|error| DbError::Message(format!("published Store snapshot: {error}")))?;
        if meta.author_registration != author_ref || meta.successor.next_slot != successor_slot {
            return Err(DbError::Message(
                "published Store snapshot differs from its local stream state".to_string(),
            ));
        }
        Ok(PublishedStoreSnapshot {
            reference,
            successor_slot,
            meta,
        })
    })
    .transpose()
}

fn load_outbound_store_snapshot_on(
    conn: &Connection,
) -> Result<Option<DurableSnapshotPublication>, DbError> {
    conn.query_row(
        "SELECT snapshot_ref, meta_prepared, image_ref, image_prepared, image_bytes, meta_bytes, blobs \
         FROM outbound_store_snapshot WHERE singleton = 1",
        [],
        |row| {
            Ok((
                row.get::<_, String>(0)?,
                row.get::<_, String>(1)?,
                row.get::<_, String>(2)?,
                row.get::<_, String>(3)?,
                row.get::<_, Vec<u8>>(4)?,
                row.get::<_, Vec<u8>>(5)?,
                row.get::<_, String>(6)?,
            ))
        },
    )
    .optional()
    .map_err(DbError::from)?
    .map(
        |(reference, meta_prepared, image_reference, image_prepared, image_bytes, meta_bytes, blobs)| {
            let reference: StoreSnapshotRef =
                serde_json::from_str(&reference).map_err(|error| {
                    DbError::Message(format!("outbound Store snapshot ref: {error}"))
                })?;
            let meta_prepared: PreparedExactObject =
                serde_json::from_str(&meta_prepared).map_err(|error| {
                    DbError::Message(format!(
                        "outbound prepared Store snapshot metadata: {error}"
                    ))
                })?;
            let image_reference: SnapshotImageRef = serde_json::from_str(&image_reference)
                .map_err(|error| {
                    DbError::Message(format!("outbound Store snapshot image ref: {error}"))
                })?;
            let image_prepared: PreparedExactObject = serde_json::from_str(&image_prepared)
                .map_err(|error| {
                    DbError::Message(format!("outbound prepared Store snapshot image: {error}"))
                })?;
            let blobs: Vec<PreparedSnapshotBlob> = serde_json::from_str(&blobs).map_err(|error| {
                DbError::Message(format!("outbound prepared Store snapshot blobs: {error}"))
            })?;
            if meta_prepared.reference() != &reference.object
                || image_prepared.reference() != &image_reference.object
                || ObjectHash::digest(&image_bytes) != image_reference.image_hash
            {
                return Err(DbError::Message(
                    "outbound Store snapshot exact references differ from prepared bytes"
                        .to_string(),
                ));
            }
            let (root, author_ref, author) = local_store_authority_on(conn)?;
            let meta =
                SnapshotMeta::parse_at(&meta_bytes, root.store_root_hash, &reference, &author)
                    .map_err(|error| {
                        DbError::Message(format!("outbound Store snapshot: {error}"))
                    })?;
            if meta.author_registration != author_ref || meta.image != image_reference {
                return Err(DbError::Message(
                    "outbound Store snapshot metadata differs from its exact image".to_string(),
                ));
            }
            Ok(DurableSnapshotPublication {
                reference,
                meta: ExactProtocolObject {
                    value: meta,
                    bytes: meta_bytes,
                    object: meta_prepared.reference().clone(),
                    prepared: meta_prepared,
                },
                image: ExactProtocolObject {
                    value: image_bytes.clone(),
                    bytes: image_bytes,
                    object: image_prepared.reference().clone(),
                    prepared: image_prepared,
                },
                blobs,
            })
        },
    )
    .transpose()
}

struct LiveBlobRow {
    stamp: String,
    blob_id: String,
    plaintext_size: u64,
    plaintext_hash: ObjectHash,
    cloud_path: Option<String>,
}

fn live_blob_row(
    conn: &Connection,
    table: &str,
    row_id: &str,
    declaration: &crate::sync::session::BlobDecl,
) -> Result<Option<LiveBlobRow>, DbError> {
    let cloud_path = declaration
        .cloud_path_column
        .as_deref()
        .map(quote_ident)
        .unwrap_or_else(|| "NULL".to_string());
    let sql = format!(
        "SELECT {}, {}, {}, {}, {} FROM {} WHERE {} = ?1",
        quote_ident(&declaration.id_column),
        quote_ident(&declaration.size_column),
        quote_ident(&declaration.hash_column),
        cloud_path,
        quote_ident("_updated_at"),
        quote_ident(table),
        quote_ident("id"),
    );
    let raw = conn
        .query_row(&sql, [row_id], |row| {
            Ok((
                row.get::<_, String>(0)?,
                row.get::<_, i64>(1)?,
                row.get::<_, String>(2)?,
                row.get::<_, Option<String>>(3)?,
                row.get::<_, String>(4)?,
            ))
        })
        .optional()
        .map_err(DbError::from)?;
    let Some((blob_id, plaintext_size, plaintext_hash, cloud_path, stamp)) = raw else {
        return Ok(None);
    };
    let plaintext_size = u64::try_from(plaintext_size).map_err(|_| {
        DbError::Message(format!(
            "winning blob row {:?}/{:?} has negative plaintext size {plaintext_size}",
            table, row_id
        ))
    })?;
    let plaintext_hash = plaintext_hash.parse().map_err(|error| {
        DbError::Message(format!(
            "winning blob row {:?}/{:?} has invalid plaintext hash: {error}",
            table, row_id
        ))
    })?;
    Ok(Some(LiveBlobRow {
        stamp,
        blob_id,
        plaintext_size,
        plaintext_hash,
        cloud_path,
    }))
}

fn validate_live_blob_row(
    binding: &RowBlobLocatorBinding,
    declaration: &crate::sync::session::BlobDecl,
    row: &LiveBlobRow,
    live_audience: &RemoteAudience,
) -> Result<(), DbError> {
    validate_live_blob_locator(
        binding.table(),
        binding.row_id(),
        binding.column(),
        binding.row_stamp(),
        binding.blob(),
        declaration,
        row,
        live_audience,
    )
}

#[allow(clippy::too_many_arguments)]
fn validate_live_blob_locator(
    table: &str,
    row_id: &str,
    column: &str,
    row_stamp: &str,
    stored: &StoredBlobRef,
    declaration: &crate::sync::session::BlobDecl,
    row: &LiveBlobRow,
    live_audience: &RemoteAudience,
) -> Result<(), DbError> {
    let locator = stored.locator();
    let invalid = locator.namespace() != declaration.namespace
        || locator.blob_id() != row.blob_id
        || locator.plaintext_size() != row.plaintext_size
        || locator.plaintext_hash() != row.plaintext_hash
        || &locator.audience() != live_audience
        || locator
            .scope()
            .is_some_and(|scope| scope != &declaration.scope)
        || locator
            .cloud_path()
            .is_some_and(|path| row.cloud_path.as_deref() != Some(path));
    if invalid {
        return Err(DbError::Message(format!(
            "blob locator does not match winning row values for {:?}/{:?}/{:?} at {:?}",
            table, row_id, column, row_stamp
        )));
    }
    Ok(())
}

fn validate_stored_locator_on(conn: &Connection, expected: &StoredBlobRef) -> Result<(), DbError> {
    let locator_hash = expected.locator().locator_hash().to_string();
    let expected_remote_object_id = remote_object_id(expected.object());
    let stored_locator_hash: String = conn
        .query_row(
            "SELECT locator_hash FROM blob_locators WHERE remote_object_id = ?1",
            [expected_remote_object_id.to_string()],
            |row| row.get(0),
        )
        .map_err(DbError::from)?;
    if stored_locator_hash != locator_hash {
        return Err(DbError::Message(format!(
            "stored blob object {expected_remote_object_id} is indexed under locator {stored_locator_hash}, expected {locator_hash}"
        )));
    }
    let remote = load_remote_object_on(conn, expected_remote_object_id)?;
    if !remote.is_activated_stored_blob() {
        return Err(DbError::Message(format!(
            "stored blob locator {locator_hash} does not reference activated ownership"
        )));
    }
    let locator =
        BlobLocator::parse(remote.bytes().canonical_semantic_bytes()).map_err(|error| {
            DbError::Message(format!(
                "stored blob locator {locator_hash} is invalid: {error}"
            ))
        })?;
    let actual = StoredBlobRef::new(locator, remote.object().clone()).map_err(|error| {
        DbError::Message(format!(
            "stored blob reference {locator_hash} is invalid: {error}"
        ))
    })?;
    if &actual != expected {
        return Err(DbError::Message(format!(
            "blob object {expected_remote_object_id} differs from its exact stored reference"
        )));
    }
    Ok(())
}

fn validate_stored_row_binding_on(
    conn: &Connection,
    binding: &RowBlobLocatorBinding,
    expected_authority: &crate::sync::audience_package::PackageAudience,
    expected_remote_object_id: ObjectHash,
) -> Result<(), DbError> {
    let (audience_authority, remote_object_id): (String, String) = conn
        .query_row(
            "SELECT audience_authority, remote_object_id FROM row_blob_locators
             WHERE table_name = ?1 AND row_id = ?2 AND column_name = ?3 AND row_stamp = ?4",
            rusqlite::params![
                binding.table(),
                binding.row_id(),
                binding.column(),
                binding.row_stamp(),
            ],
            |row| Ok((row.get(0)?, row.get(1)?)),
        )
        .map_err(DbError::from)?;
    let actual_authority: crate::sync::audience_package::PackageAudience =
        serde_json::from_str(&audience_authority).map_err(|error| {
            DbError::Message(format!("parse stored row blob audience authority: {error}"))
        })?;
    if &actual_authority != expected_authority
        || remote_object_id != expected_remote_object_id.to_string()
    {
        return Err(DbError::Message(format!(
            "row blob binding {:?}/{:?}/{:?} at {:?} is already bound to different exact content",
            binding.table(),
            binding.row_id(),
            binding.column(),
            binding.row_stamp()
        )));
    }
    Ok(())
}

fn load_prepared_audience_objects_on(
    conn: &Connection,
    write_id: &WriteId,
) -> Result<PreparedAudienceObjects, DbError> {
    let mut package_statement = conn
        .prepare(
            "SELECT remote_object_id FROM store_write_packages
             WHERE write_id = ?1 ORDER BY audience",
        )
        .map_err(DbError::from)?;
    let package_ids = package_statement
        .query_map([write_id.as_str()], |row| row.get::<_, String>(0))
        .map_err(DbError::from)?
        .collect::<Result<Vec<_>, _>>()
        .map_err(DbError::from)?;
    let mut blob_statement = conn
        .prepare(
            "SELECT remote_object_id, audience, locator_hash, spool_path FROM store_write_blobs
             WHERE write_id = ?1 ORDER BY audience, remote_object_id",
        )
        .map_err(DbError::from)?;
    let blob_rows = blob_statement
        .query_map([write_id.as_str()], |row| {
            Ok((
                row.get::<_, String>(0)?,
                row.get::<_, String>(1)?,
                row.get::<_, String>(2)?,
                row.get::<_, Option<String>>(3)?,
            ))
        })
        .map_err(DbError::from)?
        .collect::<Result<Vec<_>, _>>()
        .map_err(DbError::from)?;
    let packages = package_ids
        .into_iter()
        .map(|encoded| {
            let object_id = encoded
                .parse()
                .map_err(|error| DbError::Message(format!("stored remote object id: {error}")))?;
            PreparedAudiencePackage::from_remote(load_remote_object_on(conn, object_id)?)
        })
        .collect::<Result<Vec<_>, DbError>>()?;
    let blobs = blob_rows
        .into_iter()
        .map(|(encoded, audience, locator_hash, spool_path)| {
            let object_id = encoded
                .parse()
                .map_err(|error| DbError::Message(format!("stored remote object id: {error}")))?;
            PreparedAudienceBlob::from_remote(
                parse_remote_audience_db(&audience)?,
                &locator_hash,
                load_remote_object_on(conn, object_id)?,
                spool_path.map(PathBuf::from),
            )
        })
        .collect::<Result<Vec<_>, DbError>>()?;
    Ok(PreparedAudienceObjects { packages, blobs })
}

fn load_activated_registration_on(
    conn: &Connection,
    root: &crate::sync::store_commit::StoreRootRef,
    reference: &StoreDeviceRegistrationRef,
) -> Result<StoreDeviceRegistration, DbError> {
    let (bytes, encoded): (Vec<u8>, String) = conn
        .query_row(
            "SELECT registration_bytes, registration_object \
             FROM store_device_registration_activations \
             WHERE device_id = ?1 AND registration_hash = ?2",
            (
                reference.device_id.to_string(),
                reference.registration_hash.to_string(),
            ),
            |row| Ok((row.get(0)?, row.get(1)?)),
        )
        .map_err(DbError::from)?;
    let stored: StoreDeviceRegistrationRef = serde_json::from_str(&encoded)
        .map_err(|error| DbError::Message(format!("activated Store registration ref: {error}")))?;
    if stored != *reference {
        return Err(DbError::Message(
            "activated Store registration differs from its exact reference".to_string(),
        ));
    }
    let registration = StoreDeviceRegistration::parse_at(&bytes, root, reference.device_id)
        .map_err(|error| DbError::Message(format!("activated Store registration: {error}")))?;
    reference
        .verify_registration(&registration)
        .map_err(|error| DbError::Message(error.to_string()))?;
    Ok(registration)
}

#[allow(clippy::too_many_arguments)]
pub(crate) fn previous_row_blob_for_write_on(
    conn: &Connection,
    table: &str,
    row_id: &str,
    row_stamp: &str,
    column: &str,
    blob: &BlobRef,
    plaintext_size: u64,
    plaintext_hash: ObjectHash,
) -> Result<Option<StoreWriteRemoteBlob>, DbError> {
    if let Some(handoff) = created_upload_handoff_on(conn, table, row_id, column, row_stamp)? {
        let locator = handoff.stored.locator();
        if locator.namespace() != blob.namespace
            || locator.blob_id() != blob.id
            || locator.plaintext_size() != plaintext_size
            || locator.plaintext_hash() != plaintext_hash
            || locator.scope().is_some_and(|scope| scope != &blob.scope)
        {
            return Err(DbError::Message(format!(
                "created upload {table}/{row_id}/{column} at {row_stamp} differs from its captured row"
            )));
        }
        return Ok(Some(handoff));
    }
    let raw = conn
        .query_row(
            "SELECT row_blob_locators.audience_authority, blob_locators.remote_object_id
             FROM row_blob_locators
             JOIN blob_locators USING (remote_object_id)
             WHERE table_name = ?1 AND row_id = ?2 AND column_name = ?3
             ORDER BY row_stamp DESC LIMIT 1",
            rusqlite::params![table, row_id, column],
            |row| Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?)),
        )
        .optional()
        .map_err(DbError::from)?;
    let Some((authority, object_id)) = raw else {
        return Ok(None);
    };
    let authority: crate::sync::audience_package::PackageAudience =
        serde_json::from_str(&authority)
            .map_err(|error| DbError::Message(format!("prior row blob authority: {error}")))?;
    let object_id = object_id
        .parse()
        .map_err(|error| DbError::Message(format!("prior row blob object id: {error}")))?;
    let remote = load_remote_object_on(conn, object_id)?;
    if !remote.is_activated_stored_blob() {
        return Err(DbError::Message(format!(
            "prior row blob {table}/{row_id}/{column} is not activated"
        )));
    }
    let locator = BlobLocator::parse(remote.bytes().canonical_semantic_bytes())
        .map_err(|error| DbError::Message(format!("prior row blob locator: {error}")))?;
    if locator.namespace() != blob.namespace
        || locator.blob_id() != blob.id
        || locator.plaintext_size() != plaintext_size
        || locator.plaintext_hash() != plaintext_hash
        || locator.scope().is_some_and(|scope| scope != &blob.scope)
    {
        return Ok(None);
    }
    if locator.audience() != authority.remote_audience() {
        return Err(DbError::Message(format!(
            "prior row blob {table}/{row_id}/{column} authority differs from its locator"
        )));
    }
    let stored = StoredBlobRef::new(locator, remote.object().clone())
        .map_err(|error| DbError::Message(format!("prior row blob reference: {error}")))?;
    Ok(Some(StoreWriteRemoteBlob { authority, stored }))
}

fn remote_audience_to_db(audience: &RemoteAudience) -> String {
    match audience {
        RemoteAudience::Store => "store".to_string(),
        RemoteAudience::Circle(circle_id) => circle_id.to_string(),
    }
}

fn parse_remote_audience_db(value: &str) -> Result<RemoteAudience, DbError> {
    if value == "store" {
        return Ok(RemoteAudience::Store);
    }
    value.parse().map(RemoteAudience::Circle).map_err(|error| {
        DbError::Message(format!("invalid stored blob audience {value:?}: {error}"))
    })
}

enum RemoteStoredRepresentationRef<'a> {
    Inline(&'a [u8]),
    Blob,
}

fn candidate_manifest_exact_objects(commit: &StoreBatchCommit) -> Vec<&ExactObjectRef> {
    let mut objects = Vec::new();
    for candidate in &commit.candidate_objects.objects {
        match candidate {
            crate::sync::store_commit::CandidateExclusiveObjectRef::StorePackage(reference) => {
                objects.push(&reference.object);
            }
            crate::sync::store_commit::CandidateExclusiveObjectRef::CirclePackage(reference) => {
                objects.push(&reference.package.object);
            }
            crate::sync::store_commit::CandidateExclusiveObjectRef::CircleAccess {
                access, ..
            } => {
                objects.push(&access.leaf.object);
                objects.push(&access.envelope.object);
            }
            crate::sync::store_commit::CandidateExclusiveObjectRef::SelfRetirement(reference) => {
                objects.push(&reference.object);
            }
        }
    }
    objects
}

fn validate_remote_object_on(
    conn: &Connection,
    object_id: ObjectHash,
    expected_object: &ExactObjectRef,
    expected_semantic_bytes: &[u8],
    expected_stored: RemoteStoredRepresentationRef<'_>,
) -> Result<(), DbError> {
    let remote = load_remote_object_on(conn, object_id)?;
    let stored = remote.bytes().stored();
    let stored_matches = match expected_stored {
        RemoteStoredRepresentationRef::Inline(expected) => stored.inline_bytes() == Some(expected),
        RemoteStoredRepresentationRef::Blob => stored.inline_bytes().is_none(),
    };
    if remote.object() != expected_object
        || remote.bytes().canonical_semantic_bytes() != expected_semantic_bytes
        || !stored_matches
    {
        return Err(DbError::Message(format!(
            "prepared remote object {object_id} differs from its semantic index"
        )));
    }
    Ok(())
}

fn load_remote_object_on(
    conn: &Connection,
    object_id: ObjectHash,
) -> Result<RemoteObjectRecord, DbError> {
    let state: String = conn
        .query_row(
            "SELECT state FROM remote_objects WHERE object_id = ?1",
            [object_id.to_string()],
            |row| row.get(0),
        )
        .map_err(DbError::from)?;
    let remote: RemoteObjectRecord = serde_json::from_str(&state).map_err(|error| {
        DbError::Message(format!(
            "prepared remote object {object_id} has invalid closed state: {error}"
        ))
    })?;
    remote.validate().map_err(|error| {
        DbError::Message(format!("prepared remote object {object_id}: {error}"))
    })?;
    let actual = remote_object_id(remote.object());
    if actual != object_id {
        return Err(DbError::Message(format!(
            "prepared remote object key is {object_id}, exact reference hashes to {actual}"
        )));
    }
    Ok(remote)
}

fn persist_exact_remote_object_on(
    conn: &Connection,
    remote: &RemoteObjectRecord,
    domain: &str,
) -> Result<(), DbError> {
    remote
        .validate()
        .map_err(|error| DbError::Message(format!("prepared {domain}: {error}")))?;
    let object_id = remote.object_id();
    let existing = conn
        .query_row(
            "SELECT state FROM remote_objects WHERE object_id = ?1",
            [object_id.to_string()],
            |row| row.get::<_, String>(0),
        )
        .optional()
        .map_err(DbError::from)?;
    if let Some(existing) = existing {
        let existing: RemoteObjectRecord = serde_json::from_str(&existing).map_err(|error| {
            DbError::Message(format!(
                "prepared {domain} {object_id} has invalid closed state: {error}"
            ))
        })?;
        if existing != *remote {
            return Err(DbError::Message(format!(
                "prepared {domain} {object_id} already has different closed state"
            )));
        }
        return Ok(());
    }
    let state = serde_json::to_string(remote)
        .map_err(|error| DbError::Message(format!("serialize prepared {domain}: {error}")))?;
    conn.execute(
        "INSERT INTO remote_objects (object_id, state) VALUES (?1, ?2)",
        (object_id.to_string(), state),
    )
    .map_err(DbError::from)?;
    Ok(())
}

fn update_remote_object_on(
    conn: &Connection,
    object_id: ObjectHash,
    remote: &RemoteObjectRecord,
) -> Result<(), DbError> {
    remote
        .validate()
        .map_err(|error| DbError::Message(format!("remote object {object_id}: {error}")))?;
    if remote.object_id() != object_id {
        return Err(DbError::Message(format!(
            "remote object {object_id} changed its exact identity"
        )));
    }
    let state = serde_json::to_string(remote)
        .map_err(|error| DbError::Message(format!("serialize remote object: {error}")))?;
    let updated = conn
        .execute(
            "UPDATE remote_objects SET state = ?2 WHERE object_id = ?1",
            (object_id.to_string(), state),
        )
        .map_err(DbError::from)?;
    if updated != 1 {
        return Err(DbError::Message(format!(
            "remote object {object_id} disappeared during state transition"
        )));
    }
    Ok(())
}

fn mark_remote_object_uploaded_on(
    conn: &Connection,
    expected: RemoteObjectRecord,
) -> Result<RemoteObjectRecord, DbError> {
    let object_id = expected.object_id();
    let current = load_remote_object_on(conn, object_id)?;
    if current != expected {
        return Err(DbError::Message(format!(
            "remote object {object_id} changed before upload completion"
        )));
    }
    let expected_json = serde_json::to_string(&expected)
        .map_err(|error| DbError::Message(format!("serialize expected remote object: {error}")))?;
    let mut uploaded = current;
    uploaded.mark_uploaded_verified().map_err(|error| {
        DbError::Message(format!("mark remote object {object_id} uploaded: {error}"))
    })?;
    let uploaded_json = serde_json::to_string(&uploaded)
        .map_err(|error| DbError::Message(format!("serialize uploaded remote object: {error}")))?;
    let updated = conn
        .execute(
            "UPDATE remote_objects SET state = ?3
             WHERE object_id = ?1 AND state = ?2",
            (object_id.to_string(), expected_json, uploaded_json),
        )
        .map_err(DbError::from)?;
    if updated != 1 {
        return Err(DbError::Message(format!(
            "remote object {object_id} lost upload ownership"
        )));
    }
    Ok(uploaded)
}

fn merge_prepared_remote_object(
    existing: RemoteObjectRecord,
    proposed: &RemoteObjectRecord,
    owner: &StoreBatchCommitRef,
) -> Result<RemoteObjectRecord, DbError> {
    use crate::sync::remote_object::{OwnedObjectState, SharedLiveSetObjectDomain};

    if &existing == proposed {
        return Ok(existing);
    }
    let (
        RemoteObjectRecord::SharedLiveSet(mut existing),
        RemoteObjectRecord::SharedLiveSet(proposed),
    ) = (existing, proposed)
    else {
        return Err(DbError::Message(format!(
            "remote object {} already has different closed state",
            proposed.object_id()
        )));
    };
    if existing.identity.domain != SharedLiveSetObjectDomain::StoredBlob
        || proposed.identity.domain != SharedLiveSetObjectDomain::StoredBlob
        || existing.identity != proposed.identity
        || existing.bytes != proposed.bytes
    {
        return Err(DbError::Message(format!(
            "stored blob object {} already has different identity or bytes",
            remote_object_id(&proposed.identity.object)
        )));
    }
    let proposed_has_owner = match &proposed.state {
        OwnedObjectState::Prepared { ownership } => ownership.pending.contains(owner),
        OwnedObjectState::UploadedVerified { ownership } => ownership.pending.contains(owner),
        OwnedObjectState::RetirementPending { .. } => false,
    };
    if !proposed_has_owner {
        return Err(DbError::Message(format!(
            "stored blob object {} does not name its preparing commit",
            remote_object_id(&proposed.identity.object)
        )));
    }
    let proposed_uploaded = matches!(&proposed.state, OwnedObjectState::UploadedVerified { .. });
    match &mut existing.state {
        OwnedObjectState::Prepared { ownership } => {
            ownership.pending.insert(owner.clone());
            if proposed_uploaded {
                existing.state = OwnedObjectState::UploadedVerified {
                    ownership: crate::sync::remote_object::SharedObjectOwnership {
                        pending: ownership.pending.clone(),
                        activated: std::collections::BTreeSet::new(),
                        nonactivated: ownership.nonactivated.clone(),
                    },
                };
            }
        }
        OwnedObjectState::UploadedVerified { ownership } => {
            ownership.pending.insert(owner.clone());
        }
        OwnedObjectState::RetirementPending { former_candidates } => {
            let ownership = crate::sync::remote_object::PendingCandidateOwnership {
                pending: std::collections::BTreeSet::from([owner.clone()]),
                nonactivated: former_candidates.clone(),
            };
            existing.state = if proposed_uploaded {
                OwnedObjectState::UploadedVerified {
                    ownership: crate::sync::remote_object::SharedObjectOwnership {
                        pending: ownership.pending,
                        activated: std::collections::BTreeSet::new(),
                        nonactivated: ownership.nonactivated,
                    },
                }
            } else {
                OwnedObjectState::Prepared { ownership }
            };
        }
    }
    let merged = RemoteObjectRecord::SharedLiveSet(existing);
    merged.validate().map_err(|error| {
        DbError::Message(format!(
            "merged stored blob object {}: {error}",
            merged.object_id()
        ))
    })?;
    Ok(merged)
}

fn validate_prepared_package_on(
    conn: &Connection,
    write_id: &WriteId,
    expected: &PreparedAudiencePackage,
) -> Result<(), DbError> {
    let audience = expected.package().audience().remote_audience();
    let remote_object_id: String = conn
        .query_row(
            "SELECT remote_object_id
             FROM store_write_packages
             WHERE write_id = ?1 AND audience = ?2",
            rusqlite::params![write_id.as_str(), remote_audience_to_db(&audience)],
            |row| row.get(0),
        )
        .map_err(DbError::from)?;
    let remote_object_id = remote_object_id.parse().map_err(|error| {
        DbError::Message(format!(
            "stored prepared remote object id is invalid: {error}"
        ))
    })?;
    let actual =
        PreparedAudiencePackage::from_remote(load_remote_object_on(conn, remote_object_id)?)?;
    if actual.package != expected.package
        || actual.semantic_bytes != expected.semantic_bytes
        || actual.stored_bytes != expected.stored_bytes
        || actual.object != expected.object
        || actual.remote_object_id != expected.remote_object_id
    {
        return Err(DbError::Message(format!(
            "write {write_id} audience {audience:?} already has different prepared package bytes"
        )));
    }
    Ok(())
}

fn validate_prepared_blob_on(
    conn: &Connection,
    write_id: &WriteId,
    expected: &PreparedAudienceBlob,
) -> Result<(), DbError> {
    let locator_hash = expected.blob().locator().locator_hash();
    let remote_object_id = expected.remote_object_id();
    let (stored_locator_hash, spool_path): (String, Option<String>) = conn
        .query_row(
            "SELECT locator_hash, spool_path
             FROM store_write_blobs
             WHERE write_id = ?1 AND audience = ?2 AND remote_object_id = ?3",
            rusqlite::params![
                write_id.as_str(),
                remote_audience_to_db(expected.audience()),
                remote_object_id.to_string(),
            ],
            |row| Ok((row.get(0)?, row.get(1)?)),
        )
        .map_err(DbError::from)?;
    if stored_locator_hash != locator_hash.to_string() {
        return Err(DbError::Message(format!(
            "write {write_id} audience {:?} exact object {remote_object_id} is indexed under locator {stored_locator_hash}, expected {locator_hash}",
            expected.audience()
        )));
    }
    let actual = PreparedAudienceBlob::from_remote(
        expected.audience().clone(),
        &locator_hash.to_string(),
        load_remote_object_on(conn, remote_object_id)?,
        spool_path.map(PathBuf::from),
    )?;
    if actual.blob() != expected.blob()
        || actual.spool_path() != expected.spool_path()
        || actual.remote_object_id() != expected.remote_object_id()
    {
        return Err(DbError::Message(format!(
            "write {write_id} audience {:?} exact object {remote_object_id} already has different prepared blob bytes",
            expected.audience()
        )));
    }
    Ok(())
}

fn seed_from(hlc: &Hlc, value: Option<String>, context: &str) -> Result<(), DbError> {
    if let Some(stamp) = value {
        let floor = Timestamp::parse(&stamp)
            .ok_or_else(|| DbError::Message(format!("corrupt {context}: {stamp:?}")))?;
        hlc.seed(&floor);
    }
    Ok(())
}

/// Greatest `_updated_at` within the restart seed's honest future bound, scanned
/// across every synced table. A registered table that does not exist is a host
/// integration error and surfaces as `Err`.
fn scan_max_updated_at(
    conn: &Connection,
    synced_tables: &[SyncedTable],
    seed_bound_ms: u64,
) -> Result<Option<String>, DbError> {
    let mut overall: Option<String> = None;
    let seed_bound = format!("{seed_bound_ms:013}");
    for t in synced_tables {
        let sql = format!(
            "SELECT MAX(_updated_at) FROM {} WHERE substr(_updated_at, 1, 13) <= ?1",
            crate::sync::session::quote_ident(t.name())
        );
        let value: Option<String> = conn
            .query_row(&sql, [&seed_bound], |r| r.get::<_, Option<String>>(0))
            .map_err(|e| {
                DbError::Message(format!(
                    "register-floor scan over synced table {}: {e}",
                    t.name()
                ))
            })?;
        if let Some(v) = value {
            overall = Some(match overall {
                Some(cur) if cur >= v => cur,
                _ => v,
            });
        }
    }
    Ok(overall)
}

/// Create a capture session and attach every synced table, so a journaled
/// transaction records changes to exactly those tables.
fn attach_session<'c>(
    conn: &'c Connection,
    synced_tables: &[SyncedTable],
) -> Result<rusqlite::session::Session<'c>, DbError> {
    let mut session = rusqlite::session::Session::new(conn)
        .map_err(|e| DbError::Message(format!("failed to create capture session: {e}")))?;
    for t in synced_tables {
        session.attach(Some(t.name())).map_err(|e| {
            DbError::Message(format!(
                "failed to attach synced table {} to session: {e}",
                t.name()
            ))
        })?;
    }
    Ok(session)
}

/// Drain a journal session's recorded changes into a changeset. The caller drops
/// the session right after (it lives only for the span of one journaled
/// transaction), so there is nothing to reset.
fn capture_changeset(session: &mut rusqlite::session::Session<'_>) -> Result<Vec<u8>, DbError> {
    let mut buf = Vec::new();
    session
        .changeset_strm(&mut buf)
        .map(|()| buf)
        .map_err(DbError::from)
}

fn open_connection(path: &Path) -> Result<Connection, DbError> {
    let conn = Connection::open(path).map_err(DbError::from)?;
    // WAL so a read-only connection in another process can read committed rows while
    // this writer commits. The mode is stored in the db header and persists, so a
    // later read-only open finds the db already in WAL.
    conn.query_row("PRAGMA journal_mode = WAL", [], |_| Ok(()))
        .map_err(DbError::from)?;
    Ok(conn)
}

/// Open a `SQLITE_OPEN_READONLY` connection for [`Database::open_read_only`].
/// `NO_MUTEX` because coven serializes every access
/// on its one connection thread; the connection sets no journal mode (a read-only
/// connection cannot, and the writer already put the db in WAL).
fn open_connection_read_only(path: &Path) -> Result<Connection, DbError> {
    use rusqlite::OpenFlags;
    let flags = OpenFlags::SQLITE_OPEN_READ_ONLY
        | OpenFlags::SQLITE_OPEN_NO_MUTEX
        | OpenFlags::SQLITE_OPEN_URI;
    Connection::open_with_flags(path, flags).map_err(DbError::from)
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::blob::BLOB_TOMBSTONE_GRACE;

    fn notes_migration() -> Migration {
        Migration::sql(
            1,
            "notes",
            "CREATE TABLE notes (
                id TEXT PRIMARY KEY,
                body TEXT NOT NULL,
                _updated_at TEXT NOT NULL
            ) STRICT;",
        )
    }

    fn things_migration() -> Migration {
        Migration::sql(
            1,
            "things",
            "CREATE TABLE things (
                id TEXT PRIMARY KEY,
                body TEXT NOT NULL,
                _updated_at TEXT NOT NULL
            ) STRICT;",
        )
    }

    fn things_table(identity: crate::sync::session::RowIdentity) -> SyncedTable {
        SyncedTable::new("things", identity)
    }

    fn scoped_things_migration() -> Migration {
        Migration::sql(
            1,
            "scoped things",
            "CREATE TABLE things (
                id TEXT PRIMARY KEY,
                audience TEXT,
                body TEXT NOT NULL,
                _updated_at TEXT NOT NULL
            ) STRICT;",
        )
    }

    fn scoped_things_table() -> SyncedTable {
        SyncedTable::new("things", crate::sync::session::RowIdentity::SharedKey)
            .scoped_by("audience")
    }

    fn exact_blob_binding(row_id: &str, stamp: &str, bytes: &[u8]) -> RowBlobLocatorBinding {
        let plaintext_hash = ObjectHash::digest(bytes);
        let uploader_bytes = b"database test uploader registration";
        let uploader = crate::sync::store_commit::StoreDeviceRegistrationRef {
            device_id: "aa".repeat(32).parse().expect("valid test device id"),
            registration_hash: ObjectHash::digest(uploader_bytes),
            object: ExactObjectRef::new(
                crate::storage::cloud::ObjectSlot::logical(
                    "store-v1/devices/database-test-uploader.json".to_string(),
                )
                .expect("valid uploader registration slot"),
                uploader_bytes.len() as u64,
                ObjectHash::digest(uploader_bytes),
            ),
        };
        let locator = BlobLocator::browsable(
            "images",
            row_id,
            uploader,
            format!("photos/{row_id}.bin"),
            bytes.len() as u64,
            plaintext_hash,
        )
        .expect("valid locator");
        let stored = b"stored representation".to_vec();
        let slot = crate::storage::cloud::ObjectSlot::logical(locator.semantic_key())
            .expect("valid exact slot");
        let object = ExactObjectRef::new(slot, stored.len() as u64, ObjectHash::digest(&stored));
        RowBlobLocatorBinding::new(
            "photos",
            row_id,
            stamp,
            "id",
            StoredBlobRef::new(locator, object).expect("valid stored blob"),
        )
        .expect("valid row binding")
    }

    #[test]
    fn snapshot_blob_owner_rejects_other_activation_and_sequence() {
        let conn = Connection::open_in_memory().expect("open snapshot owner database");
        apply_coven_schema(&conn).expect("apply snapshot owner schema");
        let binding = exact_blob_binding(
            "snapshot-owner-photo",
            "0000000001000-0000-owner",
            b"snapshot owner bytes",
        );
        let expected = crate::sync::remote_object::SnapshotObjectOwner {
            activation: StreamActivationId::from_hash(ObjectHash::digest(
                b"verified snapshot activation",
            )),
            sequence: 7,
        };
        let install = |owner: crate::sync::remote_object::SnapshotObjectOwner| {
            conn.execute("DELETE FROM remote_objects", [])
                .expect("clear snapshot owner");
            let remote = RemoteObjectRecord::snapshot_activated_blob(binding.blob(), owner)
                .expect("build snapshot-owned blob");
            conn.execute(
                "INSERT INTO remote_objects (object_id, state) VALUES (?1, ?2)",
                rusqlite::params![
                    remote.object_id().to_string(),
                    serde_json::to_string(&remote).expect("serialize snapshot-owned blob"),
                ],
            )
            .expect("install snapshot-owned blob");
        };

        install(expected.clone());
        validate_snapshot_object_owner_records_on(&conn, &expected)
            .expect("verified snapshot owner matches");

        install(crate::sync::remote_object::SnapshotObjectOwner {
            activation: StreamActivationId::from_hash(ObjectHash::digest(
                b"other snapshot activation",
            )),
            sequence: expected.sequence,
        });
        assert!(validate_snapshot_object_owner_records_on(&conn, &expected).is_err());

        install(crate::sync::remote_object::SnapshotObjectOwner {
            activation: expected.activation,
            sequence: expected.sequence + 1,
        });
        assert!(validate_snapshot_object_owner_records_on(&conn, &expected).is_err());
    }

    fn local_row_blob(row_id: &str, stamp: &str, bytes: &[u8]) -> RowBlobRef {
        let binding = exact_blob_binding(row_id, stamp, bytes);
        let locator = binding.blob().locator();
        RowBlobRef::new(
            "photos".to_string(),
            row_id.to_string(),
            stamp.to_string(),
            "id".to_string(),
            BlobRef {
                namespace: locator.namespace().to_string(),
                id: locator.blob_id().to_string(),
                scope: crate::blob::BlobScope::Master,
                cloud_path: locator.cloud_path().map(str::to_string),
                provenance: Provenance::HostProvided,
                fill: crate::blob::CacheFill::CacheLazy,
            },
            locator.plaintext_size(),
            locator.plaintext_hash(),
            RowBlobAuthority::Local,
            None,
        )
        .expect("valid Local row blob")
    }

    fn open_outbox_database(device_id: &str) -> Database {
        Database::open(
            Path::new(":memory:"),
            Vec::new(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            device_id.to_string(),
            &[],
        )
        .expect("open outbox database")
        .0
    }

    fn test_candidate_family() -> crate::sync::store_commit::CandidateFamilyId {
        crate::sync::store_commit::CandidateFamilyId::from_hash(ObjectHash::digest(
            b"database test candidate family",
        ))
    }

    fn test_commit_coord() -> StoreCommitCoord {
        StoreCommitCoord::MergeConcurrent {
            stream_id: crate::sync::membership::AuthorStreamId::from_bytes([7; 32]),
            sequence: 1,
        }
    }

    fn test_commit_ref() -> StoreBatchCommitRef {
        let coord = test_commit_coord();
        let commit_hash = ObjectHash::digest(b"database test commit");
        let StoreCommitCoord::MergeConcurrent { stream_id, .. } = &coord else {
            unreachable!("database test coordinate is MergeConcurrent")
        };
        let slot = crate::storage::cloud::ObjectSlot::logical(format!(
            "{}.json",
            commit_semantic_prefix(
                test_candidate_family(),
                &stream_id.to_string(),
                coord.sequence(),
                commit_hash,
            )
        ))
        .expect("valid database test commit slot");
        StoreBatchCommitRef {
            coord,
            commit_hash,
            object: ExactObjectRef::new(slot, 1, ObjectHash::digest(b"x")),
        }
    }

    #[tokio::test]
    async fn upload_retry_preserves_prepared_object_handoff() {
        let db = open_outbox_database("prepared-upload-retry");
        let row = local_row_blob("photo", "0000000001000-0000-a", b"photo bytes");
        let initial_row = row.clone();
        db.call(move |conn| {
            Database::enqueue_upload_on(
                conn,
                "photos",
                "photo",
                &initial_row,
                Path::new("/source/first"),
                false,
                "2026-07-16T10:00:00Z",
            )
        })
        .await
        .expect("enqueue upload");

        let entry = db
            .get_pending_cloud_uploads()
            .await
            .expect("read upload")
            .pop()
            .expect("upload entry");
        let stored = exact_blob_binding("photo", "0000000001000-0000-a", b"photo bytes")
            .blob()
            .clone();
        let spool_path = PathBuf::from("/spool/prepared");
        db.mark_cloud_upload_prepared(
            &entry,
            crate::sync::audience_package::PackageAudience::Store,
            stored.clone(),
            spool_path.clone(),
        )
        .await
        .expect("record prepared object");

        db.call(move |conn| {
            Database::enqueue_upload_on(
                conn,
                "photos",
                "photo",
                &row,
                Path::new("/source/retried"),
                true,
                "2026-07-16T10:01:00Z",
            )
        })
        .await
        .expect("retry upload command");

        let entries = db
            .get_pending_cloud_uploads()
            .await
            .expect("read retried upload");
        assert_eq!(entries.len(), 1);
        assert_eq!(
            entries[0].operation,
            OutboxOperation::Upload {
                root_table: "photos".to_string(),
                root_id: "photo".to_string(),
                row: local_row_blob("photo", "0000000001000-0000-a", b"photo bytes"),
                source_path: PathBuf::from("/source/retried"),
                retain_pinned: true,
                state: OutboxUploadState::Prepared {
                    authority: crate::sync::audience_package::PackageAudience::Store,
                    stored,
                    spool_path,
                },
            }
        );
        db.mark_cloud_upload_created(&entries[0])
            .await
            .expect("record exact cloud creation");
        let created = db
            .get_pending_cloud_uploads()
            .await
            .expect("read Created upload");
        let OutboxOperation::Upload { state, .. } = &created[0].operation else {
            panic!("upload query returned a non-upload operation");
        };
        assert!(matches!(
            state,
            OutboxUploadState::Created {
                authority: crate::sync::audience_package::PackageAudience::Store,
                ..
            }
        ));
    }

    #[tokio::test]
    async fn repeated_exact_delete_resets_retry_state_without_duplication() {
        let db = open_outbox_database("repeat-delete");
        let stored = exact_blob_binding("photo", "0000000001000-0000-a", b"photo bytes")
            .blob()
            .clone();
        let delete_stored = stored.clone();
        db.call(move |conn| {
            Database::enqueue_delete_on(conn, &delete_stored, "2026-07-16T10:00:00Z")
        })
        .await
        .expect("enqueue delete");
        let failed = db
            .get_pending_cloud_deletes()
            .await
            .expect("read pending delete")
            .pop()
            .expect("delete entry");
        db.record_cloud_outbox_failure(&failed, "provider unavailable", "2026-07-16T10:00:30Z")
            .await
            .expect("record delete failure");
        let retry_stored = stored.clone();
        db.call(move |conn| {
            Database::enqueue_delete_on(conn, &retry_stored, "2026-07-16T10:01:00Z")
        })
        .await
        .expect("repeat exact delete");

        let deletes = db.get_pending_cloud_deletes().await.expect("read deletes");
        assert_eq!(deletes.len(), 1);
        assert_eq!(deletes[0].attempt_count, 0);
        assert_eq!(deletes[0].last_attempt_at, None);
        assert_eq!(deletes[0].operation, OutboxOperation::Delete { stored });
    }

    #[tokio::test]
    async fn exact_deletes_for_distinct_objects_remain_distinct() {
        let db = open_outbox_database("distinct-deletes");
        let first = exact_blob_binding("photo-a", "0000000001000-0000-a", b"photo a")
            .blob()
            .clone();
        let second = exact_blob_binding("photo-b", "0000000001000-0000-a", b"photo b")
            .blob()
            .clone();
        db.call(move |conn| Database::enqueue_delete_on(conn, &first, "2026-07-16T10:00:00Z"))
            .await
            .expect("enqueue first delete");
        db.call(move |conn| Database::enqueue_delete_on(conn, &second, "2026-07-16T10:01:00Z"))
            .await
            .expect("enqueue second delete");

        let deletes = db.get_pending_cloud_deletes().await.expect("read deletes");
        assert_eq!(deletes.len(), 2);
        assert_ne!(deletes[0].operation, deletes[1].operation);
    }

    fn blob_binding_table() -> SyncedTable {
        SyncedTable::new("photos", crate::sync::session::RowIdentity::SharedKey).carries_blob(
            crate::sync::session::BlobDecl::new(
                "images",
                Provenance::HostProvided,
                crate::blob::CacheFill::CacheLazy,
            )
            .with_cloud_path_column("cloud_path"),
        )
    }

    fn insert_blob_row(conn: &Connection, row_id: &str, stamp: &str, bytes: &[u8]) {
        conn.execute(
            "INSERT INTO photos (id, size, hash, cloud_path, _updated_at)
             VALUES (?1, ?2, ?3, ?4, ?5)",
            rusqlite::params![
                row_id,
                bytes.len() as i64,
                ObjectHash::digest(bytes).to_string(),
                format!("photos/{row_id}.bin"),
                stamp,
            ],
        )
        .expect("insert blob row");
    }

    #[test]
    fn blob_bindings_install_only_for_exact_winning_row_stamps() {
        let mut conn = Connection::open_in_memory().expect("open");
        apply_coven_schema(&conn).expect("apply coven schema");
        conn.execute_batch(
            "CREATE TABLE photos (
                id TEXT PRIMARY KEY,
                size INTEGER NOT NULL,
                hash TEXT NOT NULL,
                cloud_path TEXT NOT NULL,
                _updated_at TEXT NOT NULL
            ) STRICT;",
        )
        .expect("create photos");
        let table = blob_binding_table();
        let tables = vec![table];
        let gates = Gates::from_tables(&conn, &tables).expect("build gates");
        insert_blob_row(&conn, "winner", "0000000001000-0000-a", b"winner bytes");
        insert_blob_row(&conn, "loser", "0000000002000-0000-b", b"loser bytes");

        let package = AudiencePackage::store(
            ObjectHash::digest(b"root"),
            test_candidate_family(),
            WriteId::from_generated("write-1".to_string()),
            test_commit_coord(),
            1,
            Vec::new(),
            vec![
                exact_blob_binding("winner", "0000000001000-0000-a", b"winner bytes"),
                exact_blob_binding("loser", "0000000001000-0000-b", b"loser bytes"),
            ],
        )
        .expect("build package");
        let activation = BlobActivation {
            coord: test_commit_coord(),
        };

        let tx = conn.transaction().expect("begin");
        Database::install_pulled_blob_activations_on(&tx, &package, &test_commit_ref())
            .expect("install pulled blob activation");
        let winning_rows = [crate::sync::apply::WinningRow {
            table: "photos".to_string(),
            row_id: "winner".to_string(),
            row_stamp: Some("0000000001000-0000-a".to_string()),
        }];
        assert_eq!(
            Database::install_winning_blob_bindings_on(
                &tx,
                &gates,
                &tables,
                &package,
                &activation,
                &winning_rows,
            )
            .expect("install winning binding"),
            1
        );
        tx.commit().expect("commit");

        assert_eq!(
            conn.query_row("SELECT count(*) FROM blob_locators", [], |row| row
                .get::<_, i64>(0))
                .expect("count locators"),
            1
        );
        assert_eq!(
            conn.query_row("SELECT row_id FROM row_blob_locators", [], |row| row
                .get::<_, String>(0))
                .expect("read binding"),
            "winner"
        );
        let resolved = Database::row_blob_ref_on(&conn, &gates, &tables[0], "winner")
            .expect("resolve exact row blob reference");
        assert_eq!(resolved.row_stamp(), "0000000001000-0000-a");
        assert_eq!(
            resolved.plaintext_hash(),
            ObjectHash::digest(b"winner bytes")
        );
        assert_eq!(
            resolved
                .stored()
                .expect("remote row carries exact locator")
                .locator()
                .blob_id(),
            "winner"
        );
    }

    #[test]
    fn mismatched_blob_values_roll_back_locator_installation_with_rows() {
        let mut conn = Connection::open_in_memory().expect("open");
        apply_coven_schema(&conn).expect("apply coven schema");
        conn.execute_batch(
            "CREATE TABLE photos (
                id TEXT PRIMARY KEY,
                size INTEGER NOT NULL,
                hash TEXT NOT NULL,
                cloud_path TEXT NOT NULL,
                _updated_at TEXT NOT NULL
            ) STRICT;",
        )
        .expect("create photos");
        let tables = vec![blob_binding_table()];
        let gates = Gates::from_tables(&conn, &tables).expect("build gates");
        insert_blob_row(&conn, "photo", "0000000001000-0000-a", b"actual bytes");
        let package = AudiencePackage::store(
            ObjectHash::digest(b"root"),
            test_candidate_family(),
            WriteId::from_generated("write-1".to_string()),
            test_commit_coord(),
            1,
            Vec::new(),
            vec![exact_blob_binding(
                "photo",
                "0000000001000-0000-a",
                b"different bytes",
            )],
        )
        .expect("build package");
        let activation = BlobActivation {
            coord: test_commit_coord(),
        };

        let tx = conn.transaction().expect("begin");
        Database::install_pulled_blob_activations_on(&tx, &package, &test_commit_ref())
            .expect("install pulled blob activation");
        let winning_rows = [crate::sync::apply::WinningRow {
            table: "photos".to_string(),
            row_id: "photo".to_string(),
            row_stamp: Some("0000000001000-0000-a".to_string()),
        }];
        let error = Database::install_winning_blob_bindings_on(
            &tx,
            &gates,
            &tables,
            &package,
            &activation,
            &winning_rows,
        )
        .expect_err("mismatched locator must fail");
        assert!(error
            .to_string()
            .contains("does not match winning row values"));
        tx.rollback().expect("roll back");
        assert_eq!(
            conn.query_row("SELECT count(*) FROM blob_locators", [], |row| row
                .get::<_, i64>(0))
                .expect("count locators"),
            0
        );
    }

    fn assert_coven_schema_mutation_is_rejected(
        name: &str,
        tables: Vec<SyncedTable>,
        write_policy: crate::WritePolicy,
        migrations: Vec<Migration>,
        mutate: impl FnOnce(&Connection),
    ) {
        let directory = tempfile::tempdir().expect("temp dir");
        let path = directory.path().join(format!("{name}.sqlite"));
        let (database, _) = Database::open(
            &path,
            tables.clone(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            write_policy,
            "schema-seed".to_string(),
            &migrations,
        )
        .expect("seed database");
        drop(database);

        let conn = Connection::open(&path).expect("open database for schema mutation");
        mutate(&conn);
        drop(conn);

        let writer_error = match Database::open(
            &path,
            tables.clone(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            write_policy,
            "schema-writer".to_string(),
            &migrations,
        ) {
            Ok(_) => panic!("writer must reject Coven schema mutation {name}"),
            Err(error) => error.to_string(),
        };
        assert!(
            writer_error.contains("Coven schema"),
            "{name}: {writer_error}"
        );

        let reader_error = match Database::open_read_only(
            &path,
            tables,
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            write_policy,
            "schema-reader".to_string(),
            &migrations,
        ) {
            Ok(_) => panic!("read-only open must reject Coven schema mutation {name}"),
            Err(error) => error.to_string(),
        };
        assert!(
            reader_error.contains("Coven schema"),
            "{name}: {reader_error}"
        );

        let conn = Connection::open(&path).expect("inspect rejected database");
        let host_device_id: String = conn
            .query_row(
                "SELECT value FROM protocol_state WHERE key = ?1",
                [HOST_DEVICE_ID_STATE_KEY],
                |row| row.get(0),
            )
            .expect("host device id");
        assert_eq!(host_device_id, "schema-seed", "{name} was rewritten");
    }

    #[tokio::test]
    async fn required_store_root_hash_rejects_missing_and_malformed_exact_authority() {
        let (db, _) = Database::open(
            Path::new(":memory:"),
            vec![SyncedTable::new(
                "notes",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "required-store-root".to_string(),
            &[notes_migration()],
        )
        .expect("open database");

        let missing = db
            .required_store_root_hash()
            .await
            .expect_err("missing Store root must fail");
        assert!(matches!(missing, DbError::StoreRootHashMissing));

        db.call(|conn| {
            conn.execute(
                "INSERT INTO store_protocol_root_authority
                 (singleton, store_root_hash, store_protocol_root_bytes, store_root_object)
                 VALUES (1, ?1, X'00', '{}')",
                ["00".repeat(32)],
            )
            .map(|_| ())
            .map_err(DbError::from)
        })
        .await
        .expect("write malformed exact Store root authority");
        let malformed = db
            .required_store_root_hash()
            .await
            .expect_err("malformed Store root must fail");
        assert!(matches!(
            malformed,
            DbError::Message(reason) if !reason.is_empty()
        ));

        db.call(|conn| {
            conn.execute("DELETE FROM store_protocol_root_authority", [])
                .map(|_| ())
                .map_err(DbError::from)
        })
        .await
        .expect("remove malformed authority");
        let signer = crate::keys::UserKeypair::generate();
        let founder_provider_admin =
            crate::sync::test_helpers::test_founder_provider_admin("required-store-root");
        let descriptor = crate::sync::store_commit::StoreCreationDescriptor {
            version: crate::sync::store_commit::STORE_PROTOCOL_VERSION,
            creation_id: crate::sync::store_commit::StoreCreationId::from_nonce(
                "required-store-root",
            ),
            provider: crate::sync::storage::StoreProviderBinding::S3 {
                endpoint: crate::sync::storage::S3EndpointBinding::Custom {
                    origin: "https://test.invalid".to_string(),
                },
                region: "test-region".to_string(),
                bucket: "required-store-root-bucket".to_string(),
                key_prefix: None,
            },
            schema_version: db.schema_version(),
            sync_routing_hash: db.sync_routing_hash(),
            write_policy: crate::WritePolicy::MergeConcurrent,
            founder_pubkey: crate::keys::public_key_hex(&signer),
            founder_grant: crate::sync::test_helpers::test_membership_grant_id(
                "required-store-root founder",
            ),
            root_slot: crate::storage::cloud::ObjectSlot::logical(
                crate::sync::store_commit::STORE_PROTOCOL_ROOT_LOGICAL_KEY.to_string(),
            )
            .expect("valid Store root slot"),
            founder_registration: crate::storage::cloud::ObjectSlot::logical(
                "store-v1/test/required-store-root/registration.json".to_string(),
            )
            .expect("valid founder registration slot"),
            founder_provider_admin,
            membership: crate::sync::store_commit::StoreMembershipGenesis::MergeConcurrent {
                founder_membership: crate::sync::store_commit::GrantStreamAnchor::StoreMembership {
                    first_slot: crate::storage::cloud::ObjectSlot::logical(
                        "store-v1/test/required-store-root/membership/1.json".to_string(),
                    )
                    .expect("valid membership slot"),
                },
            },
            founder_recovery: crate::sync::store_commit::GrantStreamAnchor::OwnerRecovery {
                first_slot: crate::storage::cloud::ObjectSlot::logical(
                    "store-v1/test/required-store-root/recovery/1.json".to_string(),
                )
                .expect("valid recovery slot"),
            },
        };
        let root = crate::sync::store_commit::StoreProtocolRoot::signed(descriptor, &signer)
            .expect("sign Store root authority");
        let bytes = root.to_bytes();
        let expected = root.object_hash();
        let reference = crate::sync::store_commit::StoreRootRef {
            store_root_id: root.descriptor.store_root_id(),
            store_root_hash: expected,
            object: ExactObjectRef::new(
                crate::storage::cloud::ObjectSlot::logical(
                    "store-v1/store-protocol-root/required-store-root.json".to_string(),
                )
                .expect("valid Store root slot"),
                bytes.len() as u64,
                ObjectHash::digest(&bytes),
            ),
        };
        db.install_store_root_authority(reference, bytes)
            .await
            .expect("install exact Store root authority");
        assert_eq!(db.required_store_root_hash().await.unwrap(), expected);
    }

    #[test]
    fn fresh_open_rolls_back_host_schema_and_coven_metadata_when_routing_is_invalid() {
        let directory = tempfile::tempdir().expect("temp dir");
        let path = directory.path().join("fresh-routing-failure.sqlite");
        let result = Database::open(
            &path,
            vec![things_table(crate::sync::session::RowIdentity::SharedKey)],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "fresh-routing-failure".to_string(),
            &[Migration::sql(
                1,
                "invalid routing",
                "CREATE TABLE local_parents (id TEXT PRIMARY KEY) STRICT;
                 CREATE TABLE things (
                    id TEXT PRIMARY KEY,
                    local_parent_id TEXT NOT NULL REFERENCES local_parents(id),
                    _updated_at TEXT NOT NULL
                 ) STRICT;",
            )],
        );
        let error = match result {
            Ok(_) => panic!("fresh open must reject a synced-to-local foreign key"),
            Err(error) => error.to_string(),
        };
        assert!(error.contains("local_parents"), "{error}");

        let conn = Connection::open(&path).expect("inspect rolled-back database");
        let user_version: i64 = conn
            .query_row("PRAGMA user_version", [], |row| row.get(0))
            .expect("user version");
        let durable_tables: i64 = conn
            .query_row(
                "SELECT COUNT(*) FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%'",
                [],
                |row| row.get(0),
            )
            .expect("durable tables");
        assert_eq!(user_version, 0);
        assert_eq!(durable_tables, 0);
    }

    #[test]
    fn initialized_open_commits_ordinary_migration_without_changing_routing_contract() {
        let directory = tempfile::tempdir().expect("temp dir");
        let path = directory.path().join("ordinary-migration.sqlite");
        let migrations = [things_migration()];
        let (database, _) = Database::open(
            &path,
            vec![things_table(crate::sync::session::RowIdentity::SharedKey)],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "ordinary-first-open".to_string(),
            &migrations,
        )
        .expect("initial open");
        let pinned_hash = database.sync_routing_hash();
        drop(database);

        let migrations = [
            things_migration(),
            Migration::sql(
                2,
                "ordinary column and index",
                "ALTER TABLE things ADD COLUMN ordinary TEXT DEFAULT 'ordinary';
                 CREATE INDEX things_ordinary ON things(ordinary);",
            ),
        ];
        let (database, _) = Database::open(
            &path,
            vec![things_table(crate::sync::session::RowIdentity::SharedKey)],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "ordinary-first-open".to_string(),
            &migrations,
        )
        .expect("ordinary migration open");
        assert_eq!(database.schema_version(), 2);
        assert_eq!(database.sync_routing_hash(), pinned_hash);
        drop(database);

        let conn = Connection::open(&path).expect("inspect migrated database");
        let ordinary_ordinal: i64 = conn
            .query_row(
                "SELECT cid FROM pragma_table_info('things') WHERE name = 'ordinary'",
                [],
                |row| row.get(0),
            )
            .expect("ordinary column");
        assert_eq!(ordinary_ordinal, 3);
    }

    #[test]
    fn initialized_open_rolls_back_routing_migration_and_user_version() {
        let directory = tempfile::tempdir().expect("temp dir");
        let path = directory.path().join("routing-migration.sqlite");
        let v1 = || {
            Migration::sql(
                1,
                "gated things",
                "CREATE TABLE things (
                    id TEXT PRIMARY KEY,
                    audience TEXT COLLATE BINARY NOT NULL,
                    _updated_at TEXT NOT NULL
                 ) STRICT;",
            )
        };
        let table = || {
            SyncedTable::new("things", crate::sync::session::RowIdentity::SharedKey)
                .gated_by("audience")
        };
        let (database, _) = Database::open(
            &path,
            vec![table()],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "routing-first-open".to_string(),
            &[v1()],
        )
        .expect("initial open");
        drop(database);

        let v2 = Migration::sql(
            2,
            "change audience collation",
            "CREATE TABLE things_next (
                id TEXT PRIMARY KEY,
                audience TEXT COLLATE NOCASE NOT NULL,
                _updated_at TEXT NOT NULL
             ) STRICT;
             INSERT INTO things_next SELECT * FROM things;
             DROP TABLE things;
             ALTER TABLE things_next RENAME TO things;",
        );
        let result = Database::open(
            &path,
            vec![table()],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "routing-first-open".to_string(),
            &[v1(), v2],
        );
        let error = match result {
            Ok(_) => panic!("routing migration must not commit"),
            Err(error) => error.to_string(),
        };
        assert!(error.contains("sync-routing hash"), "{error}");

        let conn = Connection::open(&path).expect("inspect rolled-back migration");
        let user_version: i64 = conn
            .query_row("PRAGMA user_version", [], |row| row.get(0))
            .expect("user version");
        let things_next: i64 = conn
            .query_row(
                "SELECT COUNT(*) FROM sqlite_schema WHERE type = 'table' AND name = 'things_next'",
                [],
                |row| row.get(0),
            )
            .expect("things_next presence");
        let (_, collation, _, _, _) = conn
            .column_metadata(None::<&str>, "things", "audience")
            .expect("audience metadata");
        assert_eq!(user_version, 1);
        assert_eq!(things_next, 0);
        assert_eq!(collation.unwrap().to_bytes(), b"BINARY");
    }

    #[test]
    fn writer_and_read_only_open_reject_every_coven_schema_shape_change_without_rewriting() {
        let cases = [
            ("missing-table", "DROP TABLE published_store_acks;"),
            (
                "changed-primary-key-and-constraints",
                "DROP TABLE published_store_acks;
                 CREATE TABLE published_store_acks (
                    revision INTEGER,
                    ack_hash TEXT NOT NULL,
                    PRIMARY KEY (ack_hash)
                 ) STRICT;",
            ),
            (
                "unexpected-index",
                "CREATE INDEX coven_unexpected_store_write_status ON store_writes(status);",
            ),
            (
                "missing-strict",
                "DROP TABLE local_cleanup_intents;
                 CREATE TABLE local_cleanup_intents (
                    namespace TEXT NOT NULL,
                    blob_id TEXT NOT NULL,
                    PRIMARY KEY (namespace, blob_id)
                 );",
            ),
            (
                "missing-without-rowid",
                "DROP TABLE _coven_audience;
                 CREATE TABLE _coven_audience (
                    routing_id TEXT PRIMARY KEY,
                    circle_id TEXT,
                    _updated_at TEXT NOT NULL
                 ) STRICT;",
            ),
        ];

        for (name, mutation) in cases {
            assert_coven_schema_mutation_is_rejected(
                name,
                vec![scoped_things_table()],
                crate::WritePolicy::MergeConcurrent,
                vec![scoped_things_migration()],
                |conn| {
                    conn.execute_batch(mutation).expect("mutate Coven schema");
                },
            );
        }
    }

    #[test]
    fn writer_and_read_only_open_reject_unexpected_policy_specific_coven_tables() {
        assert_coven_schema_mutation_is_rejected(
            "unexpected-routing",
            vec![things_table(crate::sync::session::RowIdentity::SharedKey)],
            crate::WritePolicy::Serial,
            vec![things_migration()],
            |conn| {
                crate::db::apply_coven_routing_schema(conn)
                    .expect("add inapplicable routing tables");
            },
        );
    }

    #[test]
    fn first_open_rolls_back_host_migration_when_gate_model_is_invalid() {
        let directory = tempfile::tempdir().expect("temp dir");
        let path = directory.path().join("invalid-gate-migration.sqlite");
        let migration = Migration::sql(
            1,
            "composite gate relation",
            "CREATE TABLE parents (
                id TEXT PRIMARY KEY,
                code TEXT NOT NULL,
                shared INTEGER NOT NULL,
                _updated_at TEXT NOT NULL,
                UNIQUE (id, code)
             ) STRICT;
             CREATE TABLE children (
                id TEXT PRIMARY KEY,
                parent_id TEXT NOT NULL,
                parent_code TEXT NOT NULL,
                _updated_at TEXT NOT NULL,
                FOREIGN KEY (parent_id, parent_code) REFERENCES parents(id, code)
             ) STRICT;",
        );
        let tables = vec![
            SyncedTable::new("parents", crate::sync::session::RowIdentity::SharedKey)
                .gated_by("shared"),
            SyncedTable::new("children", crate::sync::session::RowIdentity::SharedKey),
        ];

        let error = match Database::open(
            &path,
            tables,
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "invalid-gate-open".to_string(),
            &[migration],
        ) {
            Ok(_) => panic!("an invalid gate model must reject the open"),
            Err(error) => error,
        };
        assert!(
            error.to_string().contains("composite foreign key"),
            "{error}"
        );

        let conn = Connection::open(&path).expect("inspect rejected database");
        let user_version: i64 = conn
            .query_row("PRAGMA user_version", [], |row| row.get(0))
            .expect("user version");
        assert_eq!(user_version, 0);
        let host_tables: i64 = conn
            .query_row(
                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name IN ('parents', 'children')",
                [],
                |row| row.get(0),
            )
            .expect("host table count");
        assert_eq!(host_tables, 0);
    }

    #[test]
    fn sqlite_session_representation_preserves_upsert_but_loses_primary_key_update_intent() {
        let conn = Connection::open_in_memory().expect("open");
        conn.execute_batch(
            "CREATE TABLE things (
                id TEXT PRIMARY KEY,
                body TEXT NOT NULL,
                _updated_at TEXT NOT NULL
             ) STRICT;
             INSERT INTO things VALUES ('old', 'base', '0000000001000-0000-writer');",
        )
        .expect("schema and seed");
        let tables = vec![things_table(crate::sync::session::RowIdentity::SharedKey)];

        let mut primary_key_session = attach_session(&conn, &tables).expect("attach session");
        let primary_key_tx = conn.unchecked_transaction().expect("transaction");
        primary_key_tx
            .execute(
                "UPDATE things SET id = 'new', _updated_at = '0000000002000-0000-writer' WHERE id = 'old'",
                [],
            )
            .expect("update primary key");
        let primary_key_changes =
            capture_changeset(&mut primary_key_session).expect("capture primary-key update");
        drop(primary_key_tx);
        drop(primary_key_session);
        let primary_key_changes =
            crate::changeset::walk(&primary_key_changes).expect("walk primary-key update");
        assert_eq!(
            primary_key_changes
                .iter()
                .map(|change| (change.op, change.pk()))
                .collect::<Vec<_>>(),
            vec![
                (crate::changeset::ChangeOp::Insert, Some("new")),
                (crate::changeset::ChangeOp::Delete, Some("old")),
            ]
        );

        let mut upsert_session = attach_session(&conn, &tables).expect("attach session");
        let upsert_tx = conn.unchecked_transaction().expect("transaction");
        upsert_tx
            .execute(
                "INSERT INTO things VALUES ('old', 'upserted', '0000000003000-0000-writer')
                 ON CONFLICT(id) DO UPDATE SET
                    body = excluded.body,
                    _updated_at = excluded._updated_at",
                [],
            )
            .expect("same-id upsert");
        let upsert_changes = capture_changeset(&mut upsert_session).expect("capture upsert");
        drop(upsert_tx);
        let upsert_changes = crate::changeset::walk(&upsert_changes).expect("walk upsert");
        assert_eq!(upsert_changes.len(), 1);
        assert_eq!(upsert_changes[0].op, crate::changeset::ChangeOp::Update);
        assert_eq!(upsert_changes[0].pk(), Some("old"));
    }

    #[test]
    fn writer_and_read_only_open_reject_existing_invalid_independent_uuid() {
        let writer_error = match Database::open(
            Path::new(":memory:"),
            vec![things_table(
                crate::sync::session::RowIdentity::IndependentUuid,
            )],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "invalid-uuid-writer".to_string(),
            &[Migration::sql(
                1,
                "things",
                "CREATE TABLE things (
                    id TEXT PRIMARY KEY,
                    body TEXT NOT NULL,
                    _updated_at TEXT NOT NULL
                 ) STRICT;
                 INSERT INTO things VALUES ('2', 'invalid', '0000000001000-0000-seed');",
            )],
        ) {
            Ok(_) => panic!("writer open must reject an existing non-UUID id"),
            Err(error) => error.to_string(),
        };
        assert!(
            writer_error.contains("things") && writer_error.contains("\"2\""),
            "writer error identifies the table and value: {writer_error}",
        );

        let dir = tempfile::tempdir().expect("temp dir");
        let path = dir.path().join("read-only-invalid.sqlite");
        let (writer, _) = Database::open(
            &path,
            vec![things_table(crate::sync::session::RowIdentity::SharedKey)],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "invalid-uuid-seed".to_string(),
            &[Migration::sql(
                1,
                "things",
                "CREATE TABLE things (
                    id TEXT PRIMARY KEY,
                    body TEXT NOT NULL,
                    _updated_at TEXT NOT NULL
                 ) STRICT;
                 INSERT INTO things VALUES ('2', 'invalid', '0000000001000-0000-seed');",
            )],
        )
        .expect("seed database under its declared SharedKey contract");
        drop(writer);

        let reader_error = match Database::open_read_only(
            &path,
            vec![things_table(
                crate::sync::session::RowIdentity::IndependentUuid,
            )],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "invalid-uuid-reader".to_string(),
            &[things_migration()],
        ) {
            Ok(_) => panic!("read-only open must reject an existing non-UUID id"),
            Err(error) => error.to_string(),
        };
        assert!(
            reader_error.contains("things") && reader_error.contains("\"2\""),
            "reader error identifies the table and value: {reader_error}",
        );
    }

    #[test]
    fn database_open_rejects_duplicate_synced_table_declarations() {
        let error = match Database::open(
            Path::new(":memory:"),
            vec![
                things_table(crate::sync::session::RowIdentity::SharedKey),
                things_table(crate::sync::session::RowIdentity::IndependentUuid),
            ],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "duplicate-things".to_string(),
            &[things_migration()],
        ) {
            Ok(_) => panic!("one table cannot have two identity declarations"),
            Err(error) => error.to_string(),
        };
        assert!(
            error.contains("things") && error.contains("declared"),
            "{error}"
        );
    }

    #[tokio::test]
    async fn invalid_host_identity_rolls_back_rows_and_preserves_existing_write() {
        let tables = vec![things_table(
            crate::sync::session::RowIdentity::IndependentUuid,
        )];
        let (db, _) = Database::open(
            Path::new(":memory:"),
            tables.clone(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "invalid-host-identity".to_string(),
            &[things_migration()],
        )
        .expect("open");
        let existing_changeset = vec![0x45, 0x58, 0x41, 0x43, 0x54];
        let existing_for_insert = existing_changeset.clone();
        db.call(move |conn| {
            conn.execute(
                "INSERT INTO store_writes
                 (write_id, status, affected_rows, changeset, inverse_changeset, base, blob_facts)
                 VALUES (
                    'existing-write', '\"pending\"', '[]', ?1, ?1,
                    '{\"merge_concurrent\":{\"dependencies\":{}}}',
                    '{\"blobs\":[]}'
                 )",
                [existing_for_insert],
            )
            .map(|_| ())
            .map_err(DbError::from)
        })
        .await
        .expect("seed existing write records");

        let write_id = db.new_write_id();
        let result = db
            .call(move |conn| {
                Database::run_internal_store_write_transaction_on(
                    conn,
                    &tables,
                    crate::WritePolicy::MergeConcurrent,
                    None,
                    write_id,
                    |tx| {
                        tx.execute(
                            "INSERT INTO things VALUES (?1, 'valid', '0000000002000-0000-writer')",
                            ["f47ac10b-58cc-4372-a567-0e02b2c3d479"],
                        )?;
                        tx.execute(
                        "INSERT INTO things VALUES ('2', 'invalid', '0000000002001-0000-writer')",
                        [],
                    )?;
                        Ok::<_, DbError>(())
                    },
                )
            })
            .await;
        let error = result.expect_err("invalid UUID must reject the host transaction");
        assert!(error.to_string().contains("things") && error.to_string().contains("2"));

        db.call(move |conn| {
            let row_count: i64 = conn
                .query_row("SELECT COUNT(*) FROM things", [], |row| row.get(0))
                .map_err(DbError::from)?;
            let pending = conn
                .prepare("SELECT changeset FROM store_writes ORDER BY ordinal")
                .and_then(|mut statement| {
                    statement
                        .query_map([], |row| row.get::<_, Vec<u8>>(0))?
                        .collect::<rusqlite::Result<Vec<_>>>()
                })
                .map_err(DbError::from)?;
            assert_eq!(row_count, 0);
            assert_eq!(pending, vec![existing_changeset]);
            Ok(())
        })
        .await
        .expect("inspect rollback");
    }

    #[tokio::test]
    async fn valid_identity_changes_updates_and_upserts_succeed_but_invalid_new_uuid_rolls_back() {
        let tables = vec![things_table(
            crate::sync::session::RowIdentity::IndependentUuid,
        )];
        let (db, _) = Database::open(
            Path::new(":memory:"),
            tables.clone(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "host-identity-changes".to_string(),
            &[things_migration()],
        )
        .expect("open");
        let original = "f47ac10b-58cc-4372-a567-0e02b2c3d479";
        db.call(move |conn| {
            conn.execute(
                "INSERT INTO things VALUES (?1, 'base', '0000000001000-0000-writer')",
                [original],
            )
            .map(|_| ())
            .map_err(DbError::from)
        })
        .await
        .expect("seed row");

        let update_tables = tables.clone();
        let renamed = "01890a5d-ac96-774b-bcce-b302099c3f74";
        let update_write_id = db.new_write_id();
        db.call(move |conn| {
            Database::run_internal_store_write_transaction_on(
                conn,
                &update_tables,
                crate::WritePolicy::MergeConcurrent,
                None,
                update_write_id,
                |tx| {
                tx.execute(
                    "UPDATE things SET id = ?1, _updated_at = '0000000002000-0000-writer' WHERE id = ?2",
                    [renamed, original],
                )?;
                Ok::<_, DbError>(())
                },
            )
        })
        .await
        .expect("valid primary-key change succeeds");

        let replace_tables = tables.clone();
        let replaced = "8b1a9953-c461-4e20-8c66-826115d53552";
        let replace_write_id = db.new_write_id();
        db.call(move |conn| {
            Database::run_internal_store_write_transaction_on(
                conn,
                &replace_tables,
                crate::WritePolicy::MergeConcurrent,
                None,
                replace_write_id,
                |tx| {
                    tx.execute("DELETE FROM things WHERE id = ?1", [renamed])?;
                    tx.execute(
                        "INSERT INTO things VALUES (?1, 'replaced', '0000000003000-0000-writer')",
                        [replaced],
                    )?;
                    Ok::<_, DbError>(())
                },
            )
        })
        .await
        .expect("explicit delete and insert succeeds");

        let ordinary_tables = tables.clone();
        let ordinary_write_id = db.new_write_id();
        db.call(move |conn| {
            Database::run_internal_store_write_transaction_on(
                conn,
                &ordinary_tables,
                crate::WritePolicy::MergeConcurrent,
                None,
                ordinary_write_id,
                |tx| {
                tx.execute(
                    "UPDATE things SET body = 'ordinary', _updated_at = '0000000004000-0000-writer' WHERE id = ?1",
                    [replaced],
                )?;
                tx.execute(
                    "INSERT INTO things VALUES (?1, 'upserted', '0000000005000-0000-writer')
                     ON CONFLICT(id) DO UPDATE SET body = excluded.body, _updated_at = excluded._updated_at",
                    [replaced],
                )?;
                Ok::<_, DbError>(())
                },
            )
        })
        .await
        .expect("ordinary update and same-id upsert succeed");

        let pending_before = db
            .call(|conn| {
                conn.prepare("SELECT changeset FROM store_writes ORDER BY ordinal")
                    .and_then(|mut statement| {
                        statement
                            .query_map([], |row| row.get::<_, Vec<u8>>(0))?
                            .collect::<rusqlite::Result<Vec<_>>>()
                    })
                    .map_err(DbError::from)
            })
            .await
            .expect("read existing write records");
        assert_eq!(pending_before.len(), 3);

        let invalid_tables = tables;
        let invalid_write_id = db.new_write_id();
        let invalid = db
            .call(move |conn| {
                Database::run_internal_store_write_transaction_on(
                    conn,
                    &invalid_tables,
                    crate::WritePolicy::MergeConcurrent,
                    None,
                    invalid_write_id,
                    |tx| {
                        tx.execute(
                            "UPDATE things SET id = 'not-a-uuid', _updated_at = '0000000006000-0000-writer' WHERE id = ?1",
                            [replaced],
                        )?;
                        Ok::<_, DbError>(())
                    },
                )
            })
            .await;
        let error = invalid.expect_err("invalid new UUID rejects the primary-key change");
        assert!(error.to_string().contains("not-a-uuid"));

        db.call(move |conn| {
            let row = conn
                .query_row("SELECT id, body FROM things", [], |row| {
                    Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?))
                })
                .map_err(DbError::from)?;
            let pending_after = conn
                .prepare("SELECT changeset FROM store_writes ORDER BY ordinal")
                .and_then(|mut statement| {
                    statement
                        .query_map([], |row| row.get::<_, Vec<u8>>(0))?
                        .collect::<rusqlite::Result<Vec<_>>>()
                })
                .map_err(DbError::from)?;
            assert_eq!(row, (replaced.to_string(), "upserted".to_string()));
            assert_eq!(pending_after, pending_before);
            Ok(())
        })
        .await
        .expect("invalid identity change rolls back row and write records");
    }

    /// A SQL closure that blocks for a while must not stall other tasks on the
    /// same runtime, because jobs run on the dedicated connection thread rather
    /// than the async executor. On a current-thread runtime the scheduler has to
    /// poll the spawned DB call before it can resume us; if that call ran its
    /// blocking closure inline on the executor thread, this single `yield_now`
    /// would not return until the closure finished. With the closure on its own
    /// thread we resume immediately, long before it completes.
    #[tokio::test]
    async fn slow_db_call_does_not_block_the_executor() {
        use std::time::{Duration, Instant};

        let (db, _stamper) = Database::open(
            Path::new(":memory:"),
            Vec::new(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "liveness".to_string(),
            &[],
        )
        .expect("open database");

        let slow_db = db.clone();
        let slow = tokio::spawn(async move {
            slow_db
                .call(|conn| {
                    std::thread::sleep(Duration::from_millis(500));
                    conn.query_row("SELECT 1", [], |r| r.get::<_, i64>(0))
                        .map_err(DbError::from)
                })
                .await
        });

        let start = Instant::now();
        tokio::task::yield_now().await;
        let stalled = start.elapsed();

        assert!(
            stalled < Duration::from_millis(250),
            "unrelated task stalled {stalled:?} behind the slow DB call — the executor was blocked",
        );

        let value = slow
            .await
            .expect("slow DB task joins")
            .expect("slow DB call succeeds");
        assert_eq!(value, 1, "the slow DB call still returns its result");
    }

    #[tokio::test]
    async fn prepared_audience_objects_reload_the_same_verified_bytes_and_spool() {
        let (db, _stamper) = Database::open(
            Path::new(":memory:"),
            Vec::new(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "prepared-audience-objects".to_string(),
            &[],
        )
        .expect("open database");
        let write_id = WriteId::from_generated("write-1".to_string());
        let stored_write_id = write_id.clone();
        db.call(move |conn| {
            let base = serde_json::to_string(&StoreWriteBase::MergeConcurrent {
                dependencies: BTreeMap::new(),
            })
            .expect("serialize base");
            conn.execute(
                "INSERT INTO store_writes
                 (write_id, status, affected_rows, changeset, inverse_changeset, base, blob_facts)
                 VALUES (?1, '\"pending\"', '[]', X'', X'', ?2, '{\"blobs\":[]}')",
                rusqlite::params![stored_write_id.as_str(), base],
            )
            .map(|_| ())
            .map_err(DbError::from)
        })
        .await
        .expect("seed write");

        let binding = exact_blob_binding("photo", "0000000001000-0000-a", b"photo bytes");
        let second_object = ExactObjectRef::new(
            crate::storage::cloud::ObjectSlot::opaque(
                binding.blob().locator().semantic_key(),
                "database-test-second-physical-object".to_string(),
            )
            .expect("second blob slot"),
            binding.blob().object().stored_size(),
            binding.blob().object().stored_hash(),
        );
        let second_blob = StoredBlobRef::new(binding.blob().locator().clone(), second_object)
            .expect("second exact object for the same locator");
        let second_binding = RowBlobLocatorBinding::new(
            "photos",
            "photo-copy",
            "0000000001000-0000-a",
            "id",
            second_blob.clone(),
        )
        .expect("second row binding");
        let package = AudiencePackage::store(
            ObjectHash::digest(b"root"),
            test_candidate_family(),
            write_id.clone(),
            test_commit_coord(),
            1,
            b"changeset".to_vec(),
            vec![binding.clone(), second_binding],
        )
        .expect("build package");
        let semantic = package.to_bytes();
        let stored_package = b"stored package representation".to_vec();
        let StoreCommitCoord::MergeConcurrent { stream_id, .. } = test_commit_coord() else {
            unreachable!("database test commit is MergeConcurrent")
        };
        let package_slot = crate::storage::cloud::ObjectSlot::logical(format!(
            "{}.pkg",
            crate::sync::store_commit::package_semantic_prefix(
                test_candidate_family(),
                &stream_id.to_string(),
                1,
                ObjectHash::digest(&semantic),
            )
        ))
        .expect("package slot");
        let package_object = ExactObjectRef::new(
            package_slot,
            stored_package.len() as u64,
            ObjectHash::digest(&stored_package),
        );
        let owner_commit_hash = ObjectHash::digest(b"owner commit semantic bytes");
        let owner_object = ExactObjectRef::new(
            crate::storage::cloud::ObjectSlot::logical(format!(
                "{}.json",
                commit_semantic_prefix(
                    test_candidate_family(),
                    &stream_id.to_string(),
                    1,
                    owner_commit_hash,
                )
            ))
            .expect("owner commit slot"),
            1,
            ObjectHash::digest(b"owner commit"),
        );
        let owner = StoreBatchCommitRef {
            coord: test_commit_coord(),
            commit_hash: owner_commit_hash,
            object: owner_object,
        };
        let package_remote = crate::sync::remote_object::RemoteObjectRecord::CandidateExclusive(
            crate::sync::remote_object::CandidateObjectRecord {
                identity: crate::sync::remote_object::CandidateExclusiveTarget {
                    family: package.candidate_family(),
                    domain:
                        crate::sync::remote_object::CandidateExclusiveObjectDomain::StorePackage,
                    semantic_hash: ObjectHash::digest(&semantic),
                    object: package_object.clone(),
                },
                bytes: crate::sync::remote_object::RemoteObjectBytes::inline(
                    semantic.clone(),
                    stored_package.clone(),
                    package_object.clone(),
                )
                .expect("package remote bytes"),
                state: crate::sync::remote_object::CandidateObjectState::Prepared {
                    ownership: crate::sync::remote_object::PendingCandidateOwnership {
                        pending: std::collections::BTreeSet::from([owner.clone()]),
                        nonactivated: Vec::new(),
                    },
                },
            },
        );
        let package_remote_id = package_remote.object_id();
        let prepared_package = PreparedAudiencePackage::new(
            package_remote_id,
            semantic,
            stored_package.clone(),
            package_object.clone(),
        )
        .expect("prepare package");

        let directory = tempfile::tempdir().expect("temp dir");
        let spool = directory.path().join("blob.spool");
        crate::local_blob::write_atomic_durable(&spool, b"stored representation")
            .await
            .expect("write spool");
        let blob_remote = crate::sync::remote_object::RemoteObjectRecord::SharedLiveSet(
            crate::sync::remote_object::SharedObjectRecord {
                identity: crate::sync::remote_object::SharedLiveSetObjectRef {
                    domain: crate::sync::remote_object::SharedLiveSetObjectDomain::StoredBlob,
                    semantic_hash: ObjectHash::digest(&binding.blob().locator().to_bytes()),
                    object: binding.blob().object().clone(),
                },
                bytes: crate::sync::remote_object::RemoteObjectBytes::blob(
                    binding.blob().locator().to_bytes(),
                    binding.blob().object().clone(),
                )
                .expect("blob remote bytes"),
                state: crate::sync::remote_object::OwnedObjectState::Prepared {
                    ownership: crate::sync::remote_object::PendingCandidateOwnership {
                        pending: std::collections::BTreeSet::from([owner.clone()]),
                        nonactivated: Vec::new(),
                    },
                },
            },
        );
        let blob_remote_id = blob_remote.object_id();
        let prepared_blob = PreparedAudienceBlob {
            remote_object_id: blob_remote_id,
            audience: RemoteAudience::Store,
            blob: binding.blob().clone(),
            spool_path: Some(spool.clone()),
        };
        let second_blob_remote = crate::sync::remote_object::RemoteObjectRecord::SharedLiveSet(
            crate::sync::remote_object::SharedObjectRecord {
                identity: crate::sync::remote_object::SharedLiveSetObjectRef {
                    domain: crate::sync::remote_object::SharedLiveSetObjectDomain::StoredBlob,
                    semantic_hash: ObjectHash::digest(&second_blob.locator().to_bytes()),
                    object: second_blob.object().clone(),
                },
                bytes: crate::sync::remote_object::RemoteObjectBytes::blob(
                    second_blob.locator().to_bytes(),
                    second_blob.object().clone(),
                )
                .expect("second blob remote bytes"),
                state: crate::sync::remote_object::OwnedObjectState::Prepared {
                    ownership: crate::sync::remote_object::PendingCandidateOwnership {
                        pending: std::collections::BTreeSet::from([owner]),
                        nonactivated: Vec::new(),
                    },
                },
            },
        );
        let second_blob_remote_id = second_blob_remote.object_id();
        let second_prepared_blob = PreparedAudienceBlob {
            remote_object_id: second_blob_remote_id,
            audience: RemoteAudience::Store,
            blob: second_blob,
            spool_path: Some(spool.clone()),
        };
        let persisted_write_id = write_id.clone();
        let package_state = serde_json::to_string(&package_remote).expect("package remote state");
        let blob_state = serde_json::to_string(&blob_remote).expect("blob remote state");
        let second_blob_state =
            serde_json::to_string(&second_blob_remote).expect("second blob remote state");
        db.call(move |conn| {
            let tx = conn.unchecked_transaction().map_err(DbError::from)?;
            tx.execute(
                "INSERT INTO remote_objects (object_id, state) VALUES (?1, ?2)",
                rusqlite::params![package_remote_id.to_string(), package_state],
            )
            .map_err(DbError::from)?;
            tx.execute(
                "INSERT INTO remote_objects (object_id, state) VALUES (?1, ?2)",
                rusqlite::params![blob_remote_id.to_string(), blob_state],
            )
            .map_err(DbError::from)?;
            tx.execute(
                "INSERT INTO remote_objects (object_id, state) VALUES (?1, ?2)",
                rusqlite::params![second_blob_remote_id.to_string(), second_blob_state],
            )
            .map_err(DbError::from)?;
            Database::persist_prepared_audience_objects_on(
                &tx,
                &persisted_write_id,
                &[prepared_package],
                &[prepared_blob, second_prepared_blob],
            )?;
            tx.commit().map_err(DbError::from)
        })
        .await
        .expect("persist prepared objects");

        let reloaded = db
            .prepared_audience_objects(&write_id)
            .await
            .expect("reload prepared objects");
        assert_eq!(reloaded.packages.len(), 1);
        assert_eq!(reloaded.packages[0].package(), &package);
        assert_eq!(reloaded.packages[0].remote_object_id(), package_remote_id);
        assert_eq!(reloaded.blobs.len(), 2);
        let reloaded_ids = reloaded
            .blobs
            .iter()
            .map(PreparedAudienceBlob::remote_object_id)
            .collect::<std::collections::BTreeSet<_>>();
        assert_eq!(
            reloaded_ids,
            std::collections::BTreeSet::from([blob_remote_id, second_blob_remote_id])
        );
        assert!(reloaded
            .blobs
            .iter()
            .all(|blob| blob.spool_path() == Some(spool.as_path())));
        assert_eq!(
            reloaded
                .blobs
                .iter()
                .map(|blob| blob.blob().locator().locator_hash())
                .collect::<std::collections::BTreeSet<_>>()
                .len(),
            1,
            "same-locator exact objects survive persistence independently",
        );
    }

    /// Dropping the last handle from inside a runtime task must not block that
    /// task on the connection thread's queue, and a job already dispatched must
    /// still run to completion. The drop detaches the thread in async context, so
    /// it returns at once; the detached thread finishes the queued job (its effect
    /// is durable) and exits on its own.
    #[tokio::test]
    async fn dropping_last_handle_in_async_context_does_not_stall_but_job_still_lands() {
        use std::time::{Duration, Instant};

        let dir = tempfile::tempdir().expect("temp dir");
        let db_path = dir.path().join("db.sqlite");
        let marker = dir.path().join("marker");

        let (db, _stamper) = Database::open(
            &db_path,
            Vec::new(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "drop-async".to_string(),
            &[],
        )
        .expect("open");

        // Dispatch a slow job to the connection thread, then release the clone
        // tied to it so the job is in flight with no handle awaiting it: spawn the
        // call, let it dispatch, then abort the task so its `Database` clone drops
        // while the job still runs. The job writes a marker file when it finishes.
        let job_db = db.clone();
        let job_marker = marker.clone();
        let task = tokio::spawn(async move {
            let _ = job_db
                .call(move |_conn| {
                    std::thread::sleep(Duration::from_millis(300));
                    std::fs::write(&job_marker, b"landed")
                        .map_err(|e| DbError::Message(e.to_string()))
                })
                .await;
        });
        tokio::task::yield_now().await;
        task.abort();
        let _ = task.await;

        // `db` is now the last clone; dropping it inside this runtime task must
        // detach (not join) so it returns without waiting out the queued job.
        let drop_start = Instant::now();
        drop(db);
        let drop_elapsed = drop_start.elapsed();
        assert!(
            drop_elapsed < Duration::from_millis(200),
            "dropping the last handle stalled {drop_elapsed:?} — it joined the connection thread \
             instead of detaching",
        );

        // The detached thread still runs the already-dispatched job to completion.
        let deadline = Instant::now() + Duration::from_secs(5);
        while !marker.exists() {
            assert!(
                Instant::now() < deadline,
                "the dispatched job's effect never landed after the last handle dropped",
            );
            tokio::time::sleep(Duration::from_millis(10)).await;
        }
    }

    #[tokio::test]
    async fn database_open_rejects_empty_device_id() {
        let result = Database::open(
            Path::new(":memory:"),
            Vec::new(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            String::new(),
            &[],
        );
        let error = match result {
            Ok(_) => panic!("empty device_id must be rejected"),
            Err(error) => error.to_string(),
        };

        assert!(
            error.contains("device_id") && error.contains("empty"),
            "error names the empty device id: {error}",
        );
    }

    #[test]
    fn host_sql_authorizer_is_removed_after_success_error_and_panic() {
        let conn = Connection::open_in_memory().expect("open");
        conn.execute_batch(
            "ATTACH ':memory:' AS coven_gate_empty; \
             CREATE TABLE coven_gate_empty.baseline (id TEXT PRIMARY KEY) STRICT; \
             INSERT INTO coven_gate_empty.baseline VALUES ('guarded');",
        )
        .expect("attach guarded schema");
        let assert_guard_removed = || {
            let id: String = conn
                .query_row("SELECT id FROM coven_gate_empty.baseline", [], |row| {
                    row.get(0)
                })
                .expect("internal SQL can address the baseline after host SQL");
            assert_eq!(id, "guarded");
        };

        Database::run_host_sql_on(&conn, || Ok::<_, DbError>(())).expect("successful host SQL");
        assert_guard_removed();

        let error =
            Database::run_host_sql_on(&conn, || Err::<(), _>(DbError::Message("host".into())));
        assert!(error.is_err());
        assert_guard_removed();

        let panic = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
            Database::run_host_sql_on(&conn, || -> Result<(), DbError> { panic!("host panic") })
                .expect("panicking host SQL closure never returns");
        }));
        assert!(panic.is_err());
        assert_guard_removed();
    }

    #[tokio::test]
    async fn database_open_rejects_host_declared_reserved_tables() {
        for table_name in ["cloud_outbox", "protocol_state"] {
            let result = Database::open(
                Path::new(":memory:"),
                vec![SyncedTable::new(
                    table_name,
                    crate::sync::session::RowIdentity::SharedKey,
                )],
                BLOB_TOMBSTONE_GRACE,
                crate::blob::TransferLimits::serial(),
                crate::WritePolicy::MergeConcurrent,
                format!("reserved-{table_name}"),
                &[notes_migration()],
            );
            let error = match result {
                Ok(_) => panic!("reserved table {table_name} must be rejected"),
                Err(error) => error.to_string(),
            };

            assert!(
                error.contains(table_name),
                "error names reserved table {table_name}: {error}",
            );
        }
    }

    #[tokio::test]
    async fn database_open_rejects_empty_synced_table_name() {
        let result = Database::open(
            Path::new(":memory:"),
            vec![SyncedTable::new(
                "",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "empty-synced-table".to_string(),
            &[notes_migration()],
        );
        let error = match result {
            Ok(_) => panic!("empty synced table name must be rejected"),
            Err(error) => error.to_string(),
        };

        assert!(
            error.contains("empty"),
            "error names empty synced table: {error}",
        );
    }

    #[tokio::test]
    async fn database_open_accepts_normal_host_synced_table() {
        Database::open(
            Path::new(":memory:"),
            vec![SyncedTable::new(
                "notes",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "normal-synced-table".to_string(),
            &[notes_migration()],
        )
        .expect("normal host table opens");
    }

    /// Open with a single host migration and the given synced-table set, expecting
    /// the contract validation to refuse the open. Returns the error text so a test
    /// asserts it names the offending table and the violated requirement.
    fn open_contract_error(
        migration_sql: &'static str,
        tables: Vec<SyncedTable>,
        device_id: &str,
    ) -> String {
        let result = Database::open(
            Path::new(":memory:"),
            tables,
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            device_id.to_string(),
            &[Migration::sql(1, "contract", migration_sql)],
        );
        match result {
            Ok(_) => panic!("open must reject the synced-table contract violation"),
            Err(error) => error.to_string(),
        }
    }

    #[tokio::test]
    async fn database_open_rejects_integer_primary_key() {
        let error = open_contract_error(
            "CREATE TABLE things (id INTEGER PRIMARY KEY, _updated_at TEXT NOT NULL) STRICT;",
            vec![SyncedTable::new(
                "things",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            "integer-pk",
        );
        assert!(
            error.contains("things") && error.contains("TEXT"),
            "error names the table and the TEXT requirement: {error}",
        );
    }

    #[tokio::test]
    async fn database_open_rejects_primary_key_not_at_column_zero() {
        let error = open_contract_error(
            "CREATE TABLE things (body TEXT NOT NULL, id TEXT PRIMARY KEY, \
             _updated_at TEXT NOT NULL) STRICT;",
            vec![SyncedTable::new(
                "things",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            "pk-not-first",
        );
        assert!(
            error.contains("things") && error.contains("column 0"),
            "error names the table and the column-0 requirement: {error}",
        );
    }

    #[tokio::test]
    async fn database_open_rejects_primary_key_named_other_than_id() {
        let error = open_contract_error(
            "CREATE TABLE things (thing_id TEXT PRIMARY KEY, _updated_at TEXT NOT NULL) STRICT;",
            vec![SyncedTable::new(
                "things",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            "pk-misnamed",
        );
        assert!(
            error.contains("things") && error.contains("`id`"),
            "error names the table and the `id` requirement: {error}",
        );
    }

    #[tokio::test]
    async fn database_open_rejects_composite_primary_key() {
        let error = open_contract_error(
            "CREATE TABLE things (id TEXT NOT NULL, part TEXT NOT NULL, \
             _updated_at TEXT NOT NULL, PRIMARY KEY (id, part)) STRICT;",
            vec![SyncedTable::new(
                "things",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            "composite-pk",
        );
        assert!(
            error.contains("things") && error.contains("composite"),
            "error names the table and the single-primary-key requirement: {error}",
        );
    }

    #[tokio::test]
    async fn database_open_rejects_nullable_updated_at() {
        let error = open_contract_error(
            "CREATE TABLE things (id TEXT PRIMARY KEY, _updated_at TEXT) STRICT;",
            vec![SyncedTable::new(
                "things",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            "nullable-updated-at",
        );
        assert!(
            error.contains("things") && error.contains("_updated_at"),
            "error names the table and the `_updated_at` requirement: {error}",
        );
    }

    #[tokio::test]
    async fn database_open_rejects_non_strict_synced_table() {
        let error = open_contract_error(
            "CREATE TABLE things (id TEXT PRIMARY KEY, _updated_at TEXT NOT NULL);",
            vec![SyncedTable::new(
                "things",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            "non-strict",
        );
        assert!(
            error.contains("things") && error.contains("STRICT"),
            "error names the table and the STRICT requirement: {error}",
        );
    }

    #[tokio::test]
    async fn database_open_rejects_declared_table_no_migration_creates() {
        let error = open_contract_error(
            "CREATE TABLE other (id TEXT PRIMARY KEY, _updated_at TEXT NOT NULL) STRICT;",
            vec![SyncedTable::new(
                "things",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            "declared-never-created",
        );
        assert!(
            error.contains("things") && error.contains("no migration creates it"),
            "error says the declared table was never created: {error}",
        );
    }

    #[tokio::test]
    async fn database_open_rejects_synced_table_spelling_that_differs_from_live_schema() {
        let error = open_contract_error(
            "CREATE TABLE things (id TEXT PRIMARY KEY, _updated_at TEXT NOT NULL) STRICT;",
            vec![SyncedTable::new(
                "Things",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            "case-variant-table-name",
        );
        assert!(
            error.contains("Things") && error.contains("things") && error.contains("exact"),
            "error names both spellings and requires the live spelling: {error}",
        );
    }

    #[tokio::test]
    async fn database_open_rejects_case_variant_duplicate_synced_tables() {
        let error = open_contract_error(
            "CREATE TABLE things (id TEXT PRIMARY KEY, _updated_at TEXT NOT NULL) STRICT;",
            vec![
                SyncedTable::new("things", crate::sync::session::RowIdentity::SharedKey),
                SyncedTable::new("THINGS", crate::sync::session::RowIdentity::IndependentUuid),
            ],
            "case-variant-duplicate-table",
        );
        assert!(
            error.contains("things")
                && error.contains("THINGS")
                && error.contains("more than once"),
            "error names both duplicate declarations: {error}",
        );
    }

    #[tokio::test]
    async fn database_open_accepts_strict_synced_table() {
        Database::open(
            Path::new(":memory:"),
            vec![SyncedTable::new(
                "things",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "strict-synced-table".to_string(),
            &[Migration::sql(
                1,
                "contract",
                "CREATE TABLE things (id TEXT PRIMARY KEY, _updated_at TEXT NOT NULL) STRICT;",
            )],
        )
        .expect("a STRICT synced table satisfying the rest of the contract opens");
    }

    #[tokio::test]
    async fn database_open_ignores_undeclared_non_strict_local_table() {
        // `things` is declared and STRICT; `scratch` is a host-local table never
        // passed to `synced_tables` — its own business, not coven's, so it stays
        // non-strict with no open error.
        Database::open(
            Path::new(":memory:"),
            vec![SyncedTable::new(
                "things",
                crate::sync::session::RowIdentity::SharedKey,
            )],
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "undeclared-local-table".to_string(),
            &[Migration::sql(
                1,
                "contract",
                "CREATE TABLE things (id TEXT PRIMARY KEY, _updated_at TEXT NOT NULL) STRICT; \
                 CREATE TABLE scratch (id INTEGER PRIMARY KEY, note TEXT);",
            )],
        )
        .expect("an undeclared non-strict local table is not coven's business");
    }

    #[tokio::test]
    async fn database_open_rejects_duplicate_blob_namespace() {
        let blob = |namespace| {
            crate::sync::session::BlobDecl::new(
                namespace,
                crate::blob::Provenance::HostProvided,
                crate::blob::CacheFill::CacheLazy,
            )
        };
        let error = open_contract_error(
            "CREATE TABLE covers (id TEXT PRIMARY KEY, size INTEGER NOT NULL, \
             hash TEXT, _updated_at TEXT NOT NULL) STRICT;\
             CREATE TABLE thumbs (id TEXT PRIMARY KEY, size INTEGER NOT NULL, \
             hash TEXT, _updated_at TEXT NOT NULL) STRICT;",
            vec![
                SyncedTable::new("covers", crate::sync::session::RowIdentity::SharedKey)
                    .carries_blob(blob("images")),
                SyncedTable::new("thumbs", crate::sync::session::RowIdentity::SharedKey)
                    .carries_blob(blob("images")),
            ],
            "dup-namespace",
        );
        assert!(
            error.contains("covers") && error.contains("thumbs") && error.contains("images"),
            "error names both tables and the shared blob namespace: {error}",
        );
    }

    #[tokio::test]
    async fn fresh_open_requires_each_make_remote_intent_to_name_retain_pinned() {
        let (db, _stamper) = Database::open(
            Path::new(":memory:"),
            Vec::new(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::MergeConcurrent,
            "test-device".to_string(),
            &[],
        )
        .expect("open database");

        let column = db
            .call(|conn| {
                let mut stmt = conn
                    .prepare("PRAGMA table_info(blob_make_remote_intents)")
                    .map_err(DbError::from)?;
                let rows = stmt
                    .query_map([], |row| {
                        Ok((
                            row.get::<_, String>(1)?,
                            row.get::<_, i64>(3)?,
                            row.get::<_, Option<String>>(4)?,
                        ))
                    })
                    .map_err(DbError::from)?;
                for row in rows {
                    let (name, notnull, default_value) = row.map_err(DbError::from)?;
                    if name == "retain_pinned" {
                        return Ok(Some((notnull, default_value)));
                    }
                }
                Ok(None)
            })
            .await
            .expect("read make_remote intent schema")
            .expect("retain_pinned column exists");

        assert_eq!(column.0, 1, "retain_pinned must be NOT NULL");
        assert_eq!(
            column.1, None,
            "retain_pinned must be supplied by every make_remote intent",
        );
    }

    #[tokio::test]
    async fn serial_pending_branch_survives_reopen_with_exact_base_and_inverses() {
        let temp = tempfile::tempdir().expect("temporary Store");
        let path = temp.path().join("serial.db");
        let tables = vec![SyncedTable::new(
            "notes",
            crate::sync::session::RowIdentity::SharedKey,
        )];
        let migrations = vec![notes_migration()];
        let (db, _) = Database::open(
            &path,
            tables.clone(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::Serial,
            "serial-device".to_string(),
            &migrations,
        )
        .expect("open serial Store");
        for (write_id, sql) in [
            (
                "serial-write-1",
                "INSERT INTO notes VALUES ('n1', 'first', '0000000001000-0000-serial')",
            ),
            (
                "serial-write-2",
                "UPDATE notes SET body = 'second', _updated_at = '0000000002000-0000-serial' WHERE id = 'n1'",
            ),
        ] {
            let tables = tables.clone();
            let write_id = WriteId::from_generated(write_id.to_string());
            db.call(move |conn| {
                Database::run_internal_store_write_transaction_on(
                    conn,
                    &tables,
                    crate::WritePolicy::Serial,
                    None,
                    write_id,
                    |tx| tx.execute_batch(sql).map_err(DbError::from),
                )
            })
            .await
            .expect("commit provisional serial write");
        }
        drop(db);

        let (reopened, _) = Database::open(
            &path,
            tables,
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            crate::WritePolicy::Serial,
            "serial-device".to_string(),
            &migrations,
        )
        .expect("reopen serial Store");
        let rows = reopened
            .call(|conn| {
                let mut statement = conn
                    .prepare(
                        "SELECT write_id, inverse_changeset, base
                         FROM store_writes ORDER BY ordinal",
                    )
                    .map_err(DbError::from)?;
                let rows = statement
                    .query_map([], |row| {
                        Ok((
                            row.get::<_, String>(0)?,
                            row.get::<_, Vec<u8>>(1)?,
                            row.get::<_, String>(2)?,
                        ))
                    })
                    .map_err(DbError::from)?
                    .collect::<Result<Vec<_>, _>>()
                    .map_err(DbError::from)?;
                Ok(rows)
            })
            .await
            .expect("read reopened branch");
        assert_eq!(rows.len(), 2);
        for (write_id, inverse, base) in rows {
            assert!(!inverse.is_empty(), "{write_id} retains its inverse");
            let base: StoreWriteBase = serde_json::from_str(&base).expect("serial base");
            assert_eq!(
                base,
                StoreWriteBase::Serial {
                    branch_id: PendingBranchId::from_first_write(WriteId::from_generated(
                        "serial-write-1".to_string(),
                    )),
                    base: None,
                }
            );
        }
    }

    const RESTART_CIRCLE_ID: &str = "aaaaaaaaaaaaaaaaaaaaaaaaaa";

    fn restart_circle_coord(policy: WritePolicy) -> String {
        match policy {
            WritePolicy::MergeConcurrent => serde_json::json!({
                "merge_concurrent": {
                    "device_id": "restart-control-device",
                    "stream_id": "55".repeat(32),
                    "author_pubkey": "restart-owner",
                    "author_owner_grant": "11".repeat(32),
                    "seq": 1,
                    "control_hash": "22".repeat(32)
                }
            }),
            WritePolicy::Serial => serde_json::json!({
                "serial": {
                    "author_pubkey": "restart-owner",
                    "generation": 1,
                    "control_hash": "33".repeat(32)
                }
            }),
        }
        .to_string()
    }

    async fn capture_scoped_write_then_reopen(
        policy: WritePolicy,
        name: &str,
    ) -> (
        tempfile::TempDir,
        Database,
        Vec<(String, Option<String>, Vec<u8>)>,
    ) {
        let temp = tempfile::tempdir().expect("temporary scoped Store");
        let path = temp.path().join(format!("{name}.db"));
        let tables =
            vec![
                SyncedTable::new("accounts", crate::sync::session::RowIdentity::SharedKey)
                    .scoped_by("audience"),
            ];
        let migrations = vec![Migration::sql(
            1,
            "accounts",
            "CREATE TABLE accounts (
                id TEXT PRIMARY KEY,
                audience TEXT,
                _updated_at TEXT NOT NULL
             ) STRICT;",
        )];
        let (db, _) = Database::open(
            &path,
            tables.clone(),
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            policy,
            format!("{name}-device"),
            &migrations,
        )
        .expect("open scoped Store");
        crate::sync::test_helpers::TestStore::create(
            &db,
            name,
            crate::keys::UserKeypair::generate(),
        )
        .await
        .expect("install exact scoped Store authority");
        let control = restart_circle_coord(policy);
        db.call(move |conn| {
            conn.execute(
                "INSERT INTO circle_control_activations
                 (circle_id, control_coord, stream_id, seq, commit_hash, control_bytes)
                 VALUES (?1, ?2, 'restart-control-device', 1, ?3, X'01')",
                (RESTART_CIRCLE_ID, &control, "44".repeat(32)),
            )
            .map_err(DbError::from)?;
            conn.execute(
                "INSERT INTO circle_access_cache
                 (circle_id, control_coord, owner_pubkey, disposition, access_bytes)
                 VALUES (?1, ?2, 'restart-owner', 'active', X'02')",
                (RESTART_CIRCLE_ID, &control),
            )
            .map(|_| ())
            .map_err(DbError::from)
        })
        .await
        .expect("seed active Circle authority");

        let gates = db.gates();
        let blob_decls = db.blob_decls();
        let write_id = db.new_write_id();
        let routing =
            (policy == WritePolicy::MergeConcurrent).then(|| EncryptionService::from_key([7; 32]));
        let capture_tables = tables.clone();
        db.call(move |conn| {
            Database::run_store_write_transaction_on(
                conn,
                &capture_tables,
                &gates,
                &blob_decls,
                policy,
                routing.as_ref(),
                write_id,
                |tx| {
                    tx.execute(
                        "INSERT INTO accounts (id, audience, _updated_at)
                         VALUES ('store-account', NULL, '0000000001000-0000-restart')",
                        [],
                    )?;
                    tx.execute(
                        "INSERT INTO accounts (id, audience, _updated_at)
                         VALUES ('circle-account', ?1, '0000000001001-0000-restart')",
                        [RESTART_CIRCLE_ID],
                    )?;
                    Ok::<_, DbError>(())
                },
            )
        })
        .await
        .expect("capture Store and Circle partitions");
        let expected = db
            .call(|conn| {
                conn.prepare(
                    "SELECT audience, control_coord, changeset
                     FROM store_write_partitions
                     ORDER BY CASE audience WHEN 'store' THEN 0 ELSE 1 END,
                              audience, control_coord",
                )
                .and_then(|mut statement| {
                    statement
                        .query_map([], |row| {
                            Ok((
                                row.get::<_, String>(0)?,
                                row.get::<_, Option<String>>(1)?,
                                row.get::<_, Vec<u8>>(2)?,
                            ))
                        })?
                        .collect::<rusqlite::Result<Vec<_>>>()
                })
                .map_err(DbError::from)
            })
            .await
            .expect("read exact persisted audience partitions");
        assert_eq!(expected.len(), 2);
        drop(db);

        let (reopened, _) = Database::open(
            &path,
            tables,
            BLOB_TOMBSTONE_GRACE,
            crate::blob::TransferLimits::serial(),
            policy,
            format!("{name}-device"),
            &migrations,
        )
        .expect("reopen scoped Store");
        (temp, reopened, expected)
    }

    fn assert_prepared_partitions(
        actual: &PreparedStoreWritePartitions,
        expected: &[(String, Option<String>, Vec<u8>)],
    ) {
        let actual = actual
            .iter()
            .map(|partition| {
                let audience = match partition.audience {
                    crate::sync::circle::Audience::Store => "store".to_string(),
                    crate::sync::circle::Audience::Circle(circle) => circle.to_string(),
                    crate::sync::circle::Audience::Local => {
                        panic!("Local audience entered Store preparation")
                    }
                };
                (
                    audience,
                    partition.control.as_ref().map(|control| {
                        let parsed = serde_json::from_str(control.stored_json())
                            .expect("parse stored control");
                        assert_eq!(control.coordinate(), &parsed);
                        control.stored_json().to_string()
                    }),
                    partition.changeset.clone(),
                )
            })
            .collect::<Vec<_>>();
        assert_eq!(actual, expected);
    }

    #[tokio::test]
    async fn merge_preparation_reloads_exact_scoped_partitions_after_restart() {
        let (_temp, reopened, expected) =
            capture_scoped_write_then_reopen(WritePolicy::MergeConcurrent, "merge-restart").await;
        let prepared = reopened
            .prepare_store_write()
            .await
            .expect("prepare restarted Merge write")
            .expect("pending Merge write");

        assert_prepared_partitions(&prepared.partitions, &expected);
    }

    #[tokio::test]
    async fn serial_preparation_reloads_exact_scoped_partitions_after_restart() {
        let (_temp, reopened, expected) =
            capture_scoped_write_then_reopen(WritePolicy::Serial, "serial-restart").await;
        let branch = reopened
            .reserve_serial_store_branch()
            .await
            .expect("reserve restarted Serial branch")
            .expect("pending Serial branch");
        assert_eq!(branch.writes.len(), 1);

        assert_prepared_partitions(&branch.writes[0].partitions, &expected);
    }
}