@hraness/oh 0.2.3

package/src/sqlite/port.test.ts

@@ -0,0 +1,127 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { createKnowledgeGraphRecordV1 } from "../graph";
+import {
+  createOhStoreBindingV1,
+  OH_CANONICAL_STORE_PROFILE_V1,
+  OH_WORKING_STORE_PROFILE_V1,
+  OhProfileError,
+  OhPurgedSpaceError,
+} from "../store";
+import { createOhSqliteStoreAuthorityV1 } from "./port";
+import { OhSqliteStore } from "./store";
+
+const roots: string[] = [];
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { force: true, recursive: true })));
+});
+
+async function databasePath(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), "oh-port-test-"));
+  roots.push(root);
+  return join(root, "oh.sqlite");
+}
+
+const entity = (key: string, name: string, dependencies: readonly string[] = []) =>
+  createKnowledgeGraphRecordV1({ dependencies, key, kind: "entity", v: 1, value: { name } });
+
+describe("promise-based SQLite store port", () => {
+  test("reads exact historical heads and paginates a feed through a pinned head", async () => {
+    const authority = createOhSqliteStoreAuthorityV1({ path: ":memory:",
+      profile: OH_WORKING_STORE_PROFILE_V1, realmId: "realm:history", spaceId: "history" });
+    const first = await authority.store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+      record: entity("entity:a", "A"), v: 1 }], expectedHead: await authority.store.head(),
+      instant: "2026-08-29T12:00:00.000Z", operationId: "op_a" });
+    await authority.store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+      record: entity("entity:b", "B"), v: 1 }], expectedHead: await authority.store.head(),
+      instant: "2026-08-29T12:01:00.000Z", operationId: "op_b" });
+    const third = await authority.store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+      record: entity("entity:c", "C"), v: 1 }], expectedHead: await authority.store.head(),
+      instant: "2026-08-29T12:02:00.000Z", operationId: "op_c" });
+
+    const firstSnapshot = await authority.store.snapshot({ head: {
+      operationSha256: first.operationSha256, sequence: first.sequence } });
+    expect(firstSnapshot.records.map(({ key }) => key)).toEqual(["entity:a"]);
+    const page = await authority.store.changesSince({ operationSha256: null, sequence: 0 }, {
+      limit: 2, through: { operationSha256: third.operationSha256, sequence: third.sequence },
+    });
+    expect(page.operations.map(({ operationId }) => operationId)).toEqual(["op_a", "op_b"]);
+    expect(page.hasMore).toBe(true);
+    const final = await authority.store.changesSince(page.to, { limit: 2,
+      through: { operationSha256: third.operationSha256, sequence: third.sequence } });
+    expect(final.operations.map(({ operationId }) => operationId)).toEqual(["op_c"]);
+    expect(final.hasMore).toBe(false);
+    await authority.store.close();
+  });
+
+  test("exports a verified closure from the exact requested head", async () => {
+    const authority = createOhSqliteStoreAuthorityV1({ path: ":memory:",
+      profile: OH_WORKING_STORE_PROFILE_V1, realmId: "realm:closure", spaceId: "closure" });
+    const parent = entity("entity:parent", "Parent");
+    const child = entity("entity:child", "Child", [parent.key]);
+    await authority.store.commit({ actorId: "agent.test", changes: [
+      { kind: "put", record: child, v: 1 }, { kind: "put", record: parent, v: 1 },
+    ], expectedHead: await authority.store.head(), operationId: "op_closure" });
+    const closure = await authority.store.exportDependencyClosure({ roots: [child.key] });
+    expect(closure.records.map(({ key }) => key)).toEqual([child.key, parent.key].sort());
+    expect(closure.binding.bindingSha256).toBe(authority.store.binding.bindingSha256);
+    await authority.store.close();
+  });
+
+  test("persists an exact realm binding and rejects a different profile on reopen", async () => {
+    const path = await databasePath();
+    const canonical = createOhSqliteStoreAuthorityV1({ path, profile: OH_CANONICAL_STORE_PROFILE_V1,
+      realmId: "realm:canonical", spaceId: "same" });
+    await canonical.store.close();
+    expect(() => createOhSqliteStoreAuthorityV1({ path, profile: OH_WORKING_STORE_PROFILE_V1,
+      realmId: "realm:working", spaceId: "same" })).toThrow(OhProfileError);
+  });
+
+  test("keeps purge on host control, deletes all working payload rows, and leaves a receipt", async () => {
+    const path = await databasePath();
+    const authority = createOhSqliteStoreAuthorityV1({ path, profile: OH_WORKING_STORE_PROFILE_V1,
+      realmId: "realm:purge", spaceId: "purge" });
+    expect("purgeWorkingSpace" in authority.store).toBe(false);
+    await authority.store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+      record: entity("entity:private", "Private"), v: 1 }], expectedHead: await authority.store.head(),
+      operationId: "op_private" });
+    const receipt = await authority.host.purgeWorkingSpace({ purgedAt: "2026-08-29T13:00:00.000Z" });
+    expect(receipt.priorHead.sequence).toBe(1);
+    expect(await authority.host.purgeWorkingSpace({ purgedAt: "2026-08-29T13:00:00.000Z" })).toEqual(receipt);
+
+    const database = new OhSqliteStore({ path, spaceId: "other" });
+    for (const table of ["oh_operations", "oh_operation_records", "oh_records", "oh_dependencies",
+      "oh_search_documents", "oh_sync_outbox", "oh_sync_state", "oh_space_bindings", "oh_spaces"]) {
+      const where = table === "oh_operation_records"
+        ? "operation_sha256 IN (SELECT operation_sha256 FROM oh_operations WHERE space_id = 'purge')"
+        : "space_id = 'purge'";
+      const count = database.database.query<{ count: number }, []>(`SELECT count(*) AS count FROM ${table} WHERE ${where}`).get()?.count;
+      expect(count, table).toBe(0);
+    }
+    expect(database.database.query<{ count: number }, []>(
+      "SELECT count(*) AS count FROM oh_space_purges WHERE space_id = 'purge'",
+    ).get()?.count).toBe(1);
+    database.close();
+    expect(() => new OhSqliteStore({ path, spaceId: "purge" })).toThrow(OhPurgedSpaceError);
+  });
+
+  test("never gives canonical profiles a destructive host capability", async () => {
+    const authority = createOhSqliteStoreAuthorityV1({ path: ":memory:",
+      profile: OH_CANONICAL_STORE_PROFILE_V1, realmId: "realm:canonical", spaceId: "canonical" });
+    await expect(authority.host.purgeWorkingSpace({})).rejects.toThrow(OhProfileError);
+    await authority.store.close();
+  });
+
+  test("refuses operation replication for a bound working profile", () => {
+    const store = new OhSqliteStore({ path: ":memory:", spaceId: "local-only" });
+    store.bind(createOhStoreBindingV1({ profile: OH_WORKING_STORE_PROFILE_V1,
+      realmId: "realm:local-only", spaceId: "local-only", v: 1 }));
+    expect(() => store.exportOperations()).toThrow(OhProfileError);
+    expect(() => store.importOperation({})).toThrow(OhProfileError);
+    expect(store.verifyReplay()).toMatchObject({ operations: 0, records: 0 });
+    store.close();
+  });
+});

package/src/sqlite/port.ts

@@ -0,0 +1,120 @@
+import { canonicalJson } from "../canonical";
+import {
+  createOhStoreBindingV1,
+  OH_CANONICAL_STORE_PROFILE_V1,
+  OhProfileError,
+  parseOhStoreProfileV1,
+  type OhChangesPageV1,
+  type OhCommitInputV1,
+  type OhDependencyClosureV1,
+  type OhHeadRefV1,
+  type OhHeadV1,
+  type OhSnapshotV1,
+  type OhSpacePurgeReceiptV1,
+  type OhStoreAuthorityV1,
+  type OhStoreBindingV1,
+  type OhStoreHostControlV1,
+  type OhStoreProfileV1,
+  type OhStoreV1,
+  type OhStoreVerificationV1,
+} from "../store";
+import type { OhOperationV1 } from "../operation";
+import type { OhSqliteDatabase } from "./driver";
+import { OhSqliteStore } from "./store";
+
+export type OhSqliteStoreAuthorityOptionsV1 = Readonly<{
+  database?: OhSqliteDatabase;
+  path?: string;
+  profile?: OhStoreProfileV1;
+  realmId?: string;
+  spaceId?: string;
+}>;
+
+export class OhSqliteStorePortV1 implements OhStoreV1 {
+  readonly binding: OhStoreBindingV1;
+  readonly #authority: OhSqliteStore;
+
+  constructor(authority: OhSqliteStore, binding: OhStoreBindingV1) {
+    const persisted = authority.bind(binding);
+    if (canonicalJson(persisted) !== canonicalJson(binding)) {
+      throw new OhProfileError("The SQLite authority returned a different store binding.");
+    }
+    this.#authority = authority;
+    this.binding = persisted;
+  }
+
+  async head(): Promise<OhHeadV1> {
+    return this.#authority.head();
+  }
+
+  async snapshot(options: Readonly<{
+    head?: OhHeadRefV1;
+    maximumRecords?: number;
+  }> = {}): Promise<OhSnapshotV1> {
+    return this.#authority.snapshotAtHead(options);
+  }
+
+  async changesSince(
+    from: OhHeadRefV1,
+    options: Readonly<{ limit?: number; through?: OhHeadRefV1 }> = {},
+  ): Promise<OhChangesPageV1> {
+    return this.#authority.changesSince(from, options);
+  }
+
+  async commit(input: OhCommitInputV1): Promise<OhOperationV1> {
+    return this.#authority.commit(input);
+  }
+
+  async exportDependencyClosure(input: Readonly<{
+    head?: OhHeadRefV1;
+    maximumRecords?: number;
+    roots: readonly string[];
+  }>): Promise<OhDependencyClosureV1> {
+    return this.#authority.exportDependencyClosure({ binding: this.binding, ...input });
+  }
+
+  async verify(): Promise<OhStoreVerificationV1> {
+    const verified = this.#authority.verifyReplay();
+    return { head: verified.head, integrity: "verified", operations: verified.operations,
+      records: verified.records, v: 1 };
+  }
+
+  async close(): Promise<void> {
+    this.#authority.close();
+  }
+}
+
+/**
+ * Binds a Bun SQLite authority to the promise-based store port. Retain the
+ * returned `host` object in trusted control-plane code; pass only `store` to
+ * ordinary consumers.
+ */
+export function createOhSqliteStoreAuthorityV1(
+  options: OhSqliteStoreAuthorityOptionsV1 = {},
+): OhStoreAuthorityV1 {
+  const profile = parseOhStoreProfileV1(options.profile ?? OH_CANONICAL_STORE_PROFILE_V1);
+  if (profile === null) throw new TypeError("Invalid SQLite store profile.");
+  const spaceId = options.spaceId ?? "default";
+  const binding = createOhStoreBindingV1({ profile,
+    realmId: options.realmId ?? `realm:${spaceId}`, spaceId, v: 1 });
+  const authority = new OhSqliteStore({
+    ...(options.database === undefined ? {} : { database: options.database }),
+    ...(options.path === undefined ? {} : { path: options.path }),
+    spaceId,
+  });
+  const store = new OhSqliteStorePortV1(authority, binding);
+  let purge: OhSpacePurgeReceiptV1 | null = null;
+  const host: OhStoreHostControlV1 = Object.freeze({
+    binding,
+    purgeWorkingSpace: async (input: Readonly<{ purgedAt?: string }>) => {
+      if (profile.profileKind !== "working" || !profile.capabilities.wholeSpacePurge) {
+        throw new OhProfileError("This host handle is not bound to a purgeable working profile.");
+      }
+      if (purge !== null) return purge;
+      purge = authority.purgeWorkingSpace(binding, input.purgedAt);
+      authority.close();
+      return purge;
+    },
+  });
+  return Object.freeze({ host, store });
+}

package/src/sqlite/runtime.test.ts

@@ -0,0 +1,68 @@
+import { describe, expect, test } from "bun:test";
+
+import { createOhSqliteRuntime } from "./runtime";
+
+describe("Bun SQLite runtime initialization", () => {
+  test("selects Homebrew SQLite before constructing the first database", () => {
+    const events: string[] = [];
+    const library = "/opt/homebrew/opt/sqlite/lib/libsqlite3.dylib";
+    const runtime = createOhSqliteRuntime({
+      exists: (path) => {
+        events.push(`exists:${path}`);
+        return path === library;
+      },
+      open: (path, options) => {
+        events.push(`open:${path}:${String(options.create)}:${String(options.strict)}`);
+        return { path };
+      },
+      platform: "darwin",
+      setCustomSQLite: (path) => {
+        events.push(`set:${path}`);
+        return true;
+      },
+    });
+
+    expect(runtime.customLibrary).toBe(library);
+    expect(events).toEqual([`exists:${library}`, `set:${library}`]);
+    expect(runtime.open("authority.sqlite")).toEqual({ path: "authority.sqlite" });
+    expect(events).toEqual([
+      `exists:${library}`,
+      `set:${library}`,
+      "open:authority.sqlite:true:true",
+    ]);
+  });
+
+  test("falls back across standard macOS paths without trying duplicates", () => {
+    const attempted: string[] = [];
+    const appleSilicon = "/opt/homebrew/opt/sqlite/lib/libsqlite3.dylib";
+    const intel = "/usr/local/opt/sqlite/lib/libsqlite3.dylib";
+    const runtime = createOhSqliteRuntime({
+      exists: () => true,
+      open: () => ({}),
+      platform: "darwin",
+      setCustomSQLite: (path) => {
+        attempted.push(path);
+        return path === intel;
+      },
+    });
+
+    expect(attempted).toEqual([appleSilicon, intel]);
+    expect(runtime.customLibrary).toBe(intel);
+  });
+
+  test("does not inspect or configure custom libraries outside macOS", () => {
+    let inspected = false;
+    let configured = false;
+    const runtime = createOhSqliteRuntime({
+      exists: () => { inspected = true; return true; },
+      open: (path) => path,
+      platform: "linux",
+      setCustomSQLite: () => { configured = true; return true; },
+    });
+
+    expect(runtime.customLibrary).toBeNull();
+    expect(inspected).toBe(false);
+    expect(configured).toBe(false);
+    expect(runtime.open(":memory:")).toBe(":memory:");
+  });
+});

package/src/sqlite/runtime.ts

@@ -0,0 +1,53 @@
+type SqliteOpenOptions = Readonly<{ create: true; strict: true }>;
+
+const MACOS_SQLITE_LIBRARY_CANDIDATES = Object.freeze([
+  "/opt/homebrew/opt/sqlite/lib/libsqlite3.dylib",
+  "/usr/local/opt/sqlite/lib/libsqlite3.dylib",
+]);
+
+export type OhSqliteRuntimeDependencies<TDatabase> = Readonly<{
+  exists: (path: string) => boolean;
+  open: (path: string, options: SqliteOpenOptions) => TDatabase;
+  platform: NodeJS.Platform;
+  setCustomSQLite: (path: string) => boolean;
+}>;
+
+export type OhSqliteRuntime<TDatabase> = Readonly<{
+  customLibrary: string | null;
+  open: (path: string) => TDatabase;
+}>;
+
+function macosSqliteLibraryCandidates(): readonly string[] {
+  return MACOS_SQLITE_LIBRARY_CANDIDATES;
+}
+
+/**
+ * Bun can replace macOS' extension-disabled system SQLite only before the first
+ * Database is constructed. Creating the opener here makes that ordering an
+ * invariant rather than leaving optional semantic backends to configure it
+ * after the authoritative store is already open.
+ */
+export function createOhSqliteRuntime<TDatabase>(
+  dependencies: OhSqliteRuntimeDependencies<TDatabase>,
+): OhSqliteRuntime<TDatabase> {
+  let customLibrary: string | null = null;
+  if (dependencies.platform === "darwin") {
+    for (const candidate of macosSqliteLibraryCandidates()) {
+      if (!dependencies.exists(candidate)) continue;
+      try {
+        if (!dependencies.setCustomSQLite(candidate)) continue;
+        customLibrary = candidate;
+        break;
+      } catch {
+        // SQLite may already be loaded by another consumer. Oh remains usable
+        // without extensions; the optional semantic backend will report its
+        // own precise availability error when opened.
+      }
+    }
+  }
+
+  return Object.freeze({
+    customLibrary,
+    open: (path: string) => dependencies.open(path, { create: true, strict: true }),
+  });
+}

package/src/sqlite/store.test.ts

@@ -0,0 +1,295 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { createKnowledgeGraphRecordV1 } from "../graph";
+import { createOhStoreBindingV1, OH_WORKING_STORE_PROFILE_V1 } from "../store";
+import { OhConflictError, OhDependencyError, OhIntegrityError, OhSqliteStore } from "./store";
+
+const roots: string[] = [];
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { force: true, recursive: true })));
+});
+
+async function databasePath(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), "oh-store-test-"));
+  roots.push(root);
+  return join(root, "oh.sqlite");
+}
+
+const record = (key: string, name: string, dependencies: readonly string[] = []) =>
+  createKnowledgeGraphRecordV1({ dependencies, key, kind: "entity", v: 1, value: { name } });
+
+describe("Oh SQLite authority", () => {
+  test("commits, reopens, searches, and reproduces the exact head by replay", async () => {
+    const path = await databasePath();
+    const store = new OhSqliteStore({ path });
+    const first = record("entity:ada", "Ada Lovelace");
+    const operation = store.commit({ actorId: "agent.test", changes: [{ kind: "put", record: first, v: 1 }],
+      expectedHead: store.head(), instant: "2026-08-27T12:00:00.000Z", operationId: "op_first" });
+    expect(operation.sequence).toBe(1);
+    expect(store.searchKeyword("Lovelace")[0]?.key).toBe(first.key);
+    expect(store.verifyReplay()).toMatchObject({ operations: 1, records: 1, sqliteIntegrity: "ok" });
+    store.close();
+
+    const reopened = new OhSqliteStore({ path });
+    expect(reopened.get(first.key)).toEqual(first);
+    expect(reopened.verifyReplay().head.operationSha256).toBe(operation.operationSha256);
+    reopened.close();
+  });
+
+  test("enforces compare-and-swap across independent connections", async () => {
+    const path = await databasePath();
+    const first = new OhSqliteStore({ path });
+    const second = new OhSqliteStore({ path });
+    const stale = second.head();
+    first.commit({ actorId: "agent.one", changes: [{ kind: "put", record: record("entity:first", "First"), v: 1 }],
+      expectedHead: first.head(), operationId: "op_one" });
+    expect(() => second.commit({ actorId: "agent.two", changes: [{ kind: "put", record: record("entity:second", "Second"), v: 1 }],
+      expectedHead: stale, operationId: "op_two" })).toThrow(OhConflictError);
+    expect(second.head().sequence).toBe(1);
+    first.close(); second.close();
+  });
+
+  test("makes operation IDs idempotent but never aliases different content", () => {
+    const store = new OhSqliteStore({ path: ":memory:" });
+    const input = { actorId: "agent.test", changes: [{ kind: "put" as const, record: record("entity:a", "A"), v: 1 as const }],
+      expectedHead: store.head(), operationId: "op_retry" };
+    const first = store.commit(input);
+    expect(store.commit(input)).toEqual(first);
+    expect(() => store.commit({ ...input, changes: [{ kind: "put", record: record("entity:a", "Other"), v: 1 }] }))
+      .toThrow(OhConflictError);
+    expect(store.log()).toHaveLength(1);
+    store.close();
+  });
+
+  test("rejects orphaned and cross-space rows as idempotent operations", () => {
+    const changes = [{ kind: "put" as const, record: record("entity:orphan", "Orphan"), v: 1 as const }];
+    const source = new OhSqliteStore({ path: ":memory:", spaceId: "orphan-target" });
+    const operation = source.commit({ actorId: "agent.test", changes, expectedHead: source.head(),
+      operationId: "op_orphan" });
+    const target = new OhSqliteStore({ path: ":memory:", spaceId: "orphan-target" });
+    target.database.query(`INSERT INTO oh_operations(operation_sha256, space_id, sequence,
+      operation_id, parent_operation_sha256, graph_revision_sha256, records_sha256,
+      operation_json, instant) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
+      operation.operationSha256, operation.spaceId, operation.sequence, operation.operationId,
+      operation.parentOperationSha256, operation.graphRevisionSha256, operation.recordsSha256,
+      JSON.stringify(operation), operation.instant,
+    );
+    expect(() => target.commit({ actorId: operation.actorId, changes, expectedHead: target.head(),
+      operationId: operation.operationId })).toThrow(OhIntegrityError);
+    expect(() => target.importOperation(operation)).toThrow(OhIntegrityError);
+    expect(target.head().sequence).toBe(0);
+    source.close(); target.close();
+
+    const alienSource = new OhSqliteStore({ path: ":memory:", spaceId: "alien-source" });
+    const alien = alienSource.commit({ actorId: "agent.test", changes, expectedHead: alienSource.head(),
+      operationId: "op_alien" });
+    const alienTarget = new OhSqliteStore({ path: ":memory:", spaceId: "alien-target" });
+    alienTarget.database.query(`INSERT INTO oh_operations(operation_sha256, space_id, sequence,
+      operation_id, parent_operation_sha256, graph_revision_sha256, records_sha256,
+      operation_json, instant) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
+      alien.operationSha256, alienTarget.spaceId, alien.sequence, alien.operationId,
+      alien.parentOperationSha256, alien.graphRevisionSha256, alien.recordsSha256,
+      JSON.stringify(alien), alien.instant,
+    );
+    alienTarget.database.query(`UPDATE oh_spaces SET generation = 1, head_operation_sha256 = ?,
+      graph_revision_sha256 = ?, records_sha256 = ?, sequence = 1 WHERE space_id = ?`).run(
+      alien.operationSha256, alien.graphRevisionSha256, alien.recordsSha256, alienTarget.spaceId,
+    );
+    expect(() => alienTarget.commit({ actorId: alien.actorId, changes,
+      expectedHead: alienTarget.head(), operationId: alien.operationId })).toThrow(OhIntegrityError);
+    alienSource.close(); alienTarget.close();
+  });
+
+  test("refuses to advance a space whose duplicated binding or current head drifted", () => {
+    const store = new OhSqliteStore({ path: ":memory:", spaceId: "authority-drift" });
+    const binding = createOhStoreBindingV1({ profile: OH_WORKING_STORE_PROFILE_V1,
+      realmId: "realm:authority-drift", spaceId: store.spaceId, v: 1 });
+    store.bind(binding);
+    store.database.query("UPDATE oh_space_bindings SET realm_id = ? WHERE space_id = ?")
+      .run("realm:alien", store.spaceId);
+    expect(() => store.binding()).toThrow(OhIntegrityError);
+    store.database.query("UPDATE oh_space_bindings SET realm_id = ? WHERE space_id = ?")
+      .run(binding.realmId, store.spaceId);
+    store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+      record: record("entity:one", "One"), v: 1 }], expectedHead: store.head(), operationId: "op_one" });
+    store.database.query("UPDATE oh_spaces SET graph_revision_sha256 = ? WHERE space_id = ?")
+      .run("f".repeat(64), store.spaceId);
+    const drifted = store.head();
+    expect(() => store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+      record: record("entity:two", "Two"), v: 1 }], expectedHead: drifted,
+    operationId: "op_two" })).toThrow(OhIntegrityError);
+    expect(store.head().sequence).toBe(1);
+    store.close();
+  });
+
+  test("checks final dependency closure before changing durable state", () => {
+    const store = new OhSqliteStore({ path: ":memory:" });
+    expect(() => store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+      record: record("entity:child", "Child", ["entity:missing"]), v: 1 }],
+      expectedHead: store.head(), operationId: "op_missing" })).toThrow(OhDependencyError);
+    expect(store.head().sequence).toBe(0);
+    const parent = record("entity:parent", "Parent");
+    const child = record("entity:child", "Child", [parent.key]);
+    store.commit({ actorId: "agent.test", changes: [{ kind: "put", record: child, v: 1 },
+      { kind: "put", record: parent, v: 1 }], expectedHead: store.head(), operationId: "op_both" });
+    expect(() => store.commit({ actorId: "agent.test", changes: [{ key: parent.key, kind: "tombstone",
+      priorSha256: parent.recordSha256, v: 1 }], expectedHead: store.head(), operationId: "op_bad_delete" }))
+      .toThrow(OhDependencyError);
+    expect(store.head().sequence).toBe(1);
+    store.close();
+  });
+
+  test("rolls an interrupted write back atomically", () => {
+    const store = new OhSqliteStore({ path: ":memory:" });
+    store.database.exec(`CREATE TRIGGER test_abort_record BEFORE INSERT ON oh_records
+      BEGIN SELECT RAISE(ABORT, 'simulated interruption'); END`);
+    expect(() => store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+      record: record("entity:a", "A"), v: 1 }], expectedHead: store.head(), operationId: "op_crash" })).toThrow();
+    store.database.exec("DROP TRIGGER test_abort_record");
+    expect(store.head().sequence).toBe(0);
+    expect(store.log()).toHaveLength(0);
+    expect(store.verifyReplay()).toMatchObject({ operations: 0, records: 0 });
+    store.close();
+  });
+
+  test("detects materialized-state tampering", () => {
+    const store = new OhSqliteStore({ path: ":memory:" });
+    store.commit({ actorId: "agent.test", changes: [{ kind: "put", record: record("entity:a", "A"), v: 1 }],
+      expectedHead: store.head(), operationId: "op_one" });
+    store.database.query("UPDATE oh_records SET record_json = ? WHERE space_id = ? AND record_key = ?")
+      .run('{"dependencies":[],"key":"entity:a","kind":"entity","recordSha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","v":1,"value":{"name":"A"}}', store.spaceId, "entity:a");
+    expect(() => store.verifyReplay()).toThrow(OhIntegrityError);
+    store.close();
+  });
+
+  test("verifies dependency and operation-record materializations", () => {
+    const store = new OhSqliteStore({ path: ":memory:" });
+    const parent = record("entity:parent", "Parent");
+    const child = record("entity:child", "Child", [parent.key]);
+    const operation = store.commit({ actorId: "agent.test", changes: [
+      { kind: "put", record: child, v: 1 }, { kind: "put", record: parent, v: 1 },
+    ], expectedHead: store.head(), operationId: "op_materialized" });
+    store.database.query("DELETE FROM oh_dependencies WHERE space_id = ?").run(store.spaceId);
+    expect(() => store.verifyReplay()).toThrow("Materialized dependencies");
+    store.database.query("INSERT INTO oh_dependencies(space_id, record_key, dependency_key) VALUES (?, ?, ?)")
+      .run(store.spaceId, child.key, parent.key);
+    store.database.query("DELETE FROM oh_operation_records WHERE operation_sha256 = ?").run(operation.operationSha256);
+    expect(() => store.verifyReplay()).toThrow("Materialized operation records");
+    store.close();
+  });
+
+  test("verifies duplicated operation columns against canonical envelopes", () => {
+    const store = new OhSqliteStore({ path: ":memory:" });
+    store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+      record: record("entity:a", "A"), v: 1 }], expectedHead: store.head(), operationId: "op_columns" });
+    store.database.query("UPDATE oh_operations SET operation_id = ? WHERE space_id = ?")
+      .run("op_alien", store.spaceId);
+    expect(() => store.verifyReplay()).toThrow(OhIntegrityError);
+    store.close();
+  });
+
+  test("checks canonical operation bytes beyond the export batch ceiling", () => {
+    const store = new OhSqliteStore({ path: ":memory:" });
+    for (let index = 0; index < 1001; index += 1) {
+      store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+        record: record("entity:a", `A ${index}`), v: 1 }], expectedHead: store.head(),
+        operationId: `op_${String(index).padStart(4, "0")}` });
+    }
+    store.database.query(`UPDATE oh_operations SET operation_json = ' ' || operation_json
+      WHERE space_id = ? AND sequence = 1`).run(store.spaceId);
+    expect(() => store.verifyReplay()).toThrow(OhIntegrityError);
+    store.close();
+  });
+
+  test("never reports a feed page that omits its tail or hides a bad sentinel", () => {
+    const tail = new OhSqliteStore({ path: ":memory:", spaceId: "feed-tail" });
+    for (let index = 1; index <= 3; index += 1) {
+      tail.commit({ actorId: "agent.test", changes: [{ kind: "put",
+        record: record(`entity:tail-${index}`, `Tail ${index}`), v: 1 }], expectedHead: tail.head(),
+      operationId: `op_tail_${index}` });
+    }
+    tail.database.exec("PRAGMA foreign_keys = OFF");
+    tail.database.query("DELETE FROM oh_operations WHERE space_id = ? AND sequence = 3").run(tail.spaceId);
+    tail.database.exec("PRAGMA foreign_keys = ON");
+    expect(() => tail.changesSince({ operationSha256: null, sequence: 0 }, { limit: 3 }))
+      .toThrow(OhIntegrityError);
+    tail.close();
+
+    const sentinel = new OhSqliteStore({ path: ":memory:", spaceId: "feed-sentinel" });
+    for (let index = 1; index <= 3; index += 1) {
+      sentinel.commit({ actorId: "agent.test", changes: [{ kind: "put",
+        record: record(`entity:sentinel-${index}`, `Sentinel ${index}`), v: 1 }],
+      expectedHead: sentinel.head(), operationId: `op_sentinel_${index}` });
+    }
+    sentinel.database.exec("PRAGMA foreign_keys = OFF");
+    sentinel.database.query("DELETE FROM oh_operations WHERE space_id = ? AND sequence = 2")
+      .run(sentinel.spaceId);
+    sentinel.database.exec("PRAGMA foreign_keys = ON");
+    expect(() => sentinel.changesSince({ operationSha256: null, sequence: 0 }, { limit: 1 }))
+      .toThrow(OhIntegrityError);
+    sentinel.close();
+  });
+
+  test("rolls a working-space purge back when a payload delete is masked", () => {
+    const store = new OhSqliteStore({ path: ":memory:", spaceId: "purge-postcondition" });
+    const binding = createOhStoreBindingV1({ profile: OH_WORKING_STORE_PROFILE_V1,
+      realmId: "realm:purge-postcondition", spaceId: store.spaceId, v: 1 });
+    store.bind(binding);
+    store.commit({ actorId: "agent.test", changes: [{ kind: "put",
+      record: record("entity:private", "Private"), v: 1 }], expectedHead: store.head(),
+    operationId: "op_private" });
+    store.database.exec(`CREATE TRIGGER mask_private_operation_delete BEFORE DELETE ON oh_operations
+      BEGIN SELECT RAISE(IGNORE); END`);
+    store.database.exec(`CREATE TRIGGER mask_private_space_delete BEFORE DELETE ON oh_spaces
+      BEGIN SELECT RAISE(IGNORE); END`);
+    expect(() => store.purgeWorkingSpace(binding, "2026-08-29T13:00:00.000Z"))
+      .toThrow(OhIntegrityError);
+    expect(store.database.query<{ count: number }, []>(
+      "SELECT count(*) AS count FROM oh_space_purges").get()?.count).toBe(0);
+    expect(store.get("entity:private")).not.toBeNull();
+    expect(store.head().sequence).toBe(1);
+    store.close();
+  });
+
+  test("cross-checks every stored purge receipt column before refusing resurrection", () => {
+    const store = new OhSqliteStore({ path: ":memory:", spaceId: "purge-columns" });
+    const binding = createOhStoreBindingV1({ profile: OH_WORKING_STORE_PROFILE_V1,
+      realmId: "realm:purge-columns", spaceId: store.spaceId, v: 1 });
+    store.bind(binding);
+    store.purgeWorkingSpace(binding, "2026-08-29T13:00:00.000Z");
+    store.database.query("UPDATE oh_space_purges SET prior_sequence = 99 WHERE space_id = ?")
+      .run(store.spaceId);
+    expect(() => store.ensureSpace()).toThrow(OhIntegrityError);
+    store.close();
+  });
+
+  test("imports an exact operation once and rejects a fork", () => {
+    const source = new OhSqliteStore({ path: ":memory:" });
+    const target = new OhSqliteStore({ path: ":memory:" });
+    const operation = source.commit({ actorId: "agent.test", changes: [{ kind: "put", record: record("entity:a", "A"), v: 1 }],
+      expectedHead: source.head(), operationId: "op_one" });
+    expect(target.importOperation(operation).imported).toBe(true);
+    expect(target.importOperation(operation).imported).toBe(false);
+    const fork = source.commit({ actorId: "agent.test", changes: [{ kind: "put", record: record("entity:b", "B"), v: 1 }],
+      expectedHead: source.head(), operationId: "op_two" });
+    target.commit({ actorId: "agent.other", changes: [{ kind: "put", record: record("entity:c", "C"), v: 1 }],
+      expectedHead: target.head(), operationId: "op_other" });
+    expect(() => target.importOperation(fork)).toThrow(OhConflictError);
+    source.close(); target.close();
+  });
+
+  test("keeps a thousand-record batch bounded", () => {
+    const store = new OhSqliteStore({ path: ":memory:" });
+    const changes = Array.from({ length: 1000 }, (_, index) => ({ kind: "put" as const,
+      record: record(`entity:item-${String(index).padStart(4, "0")}`, `Item ${index}`), v: 1 as const }));
+    const started = performance.now();
+    store.commit({ actorId: "agent.test", changes, expectedHead: store.head(), operationId: "op_batch" });
+    expect(store.snapshotRecords()).toHaveLength(1000);
+    expect(() => store.snapshotRecords(65_537)).toThrow("65536");
+    expect(performance.now() - started).toBeLessThan(5000);
+    store.close();
+  });
+});