@korajs/store 1.0.0-beta.12 → 1.0.0-beta.14

package/dist/adapters/indexeddb.cjs

@@ -21,7 +21,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/errors.ts
-var import_core, AdapterError, StoreNotOpenError, WorkerTimeoutError, NoLeaderError, PersistenceError;
+var import_core, AdapterError, StorageDurabilityError, SchemaVersionAheadError, StoreNotOpenError, WorkerTimeoutError, NoLeaderError, LeaderUnresponsiveError, BridgeTerminatedError, RequestAbortedError, StorageBackendMismatchError, PersistenceError;
 var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
@@ -32,6 +32,32 @@ var init_errors = __esm({
         this.name = "AdapterError";
       }
     };
+    StorageDurabilityError = class extends import_core.KoraError {
+      constructor(dbName, phase, reason) {
+        super(
+          `Database "${dbName}" has no durable storage (${reason} during ${phase}); writes are refused so they are not silently lost on reload. Close other tabs or apps using this origin's storage and reload, or set allowNonDurable: true to accept in-memory storage.`,
+          "STORAGE_DURABILITY_LOST",
+          { dbName, phase, reason }
+        );
+        this.name = "StorageDurabilityError";
+      }
+    };
+    SchemaVersionAheadError = class extends import_core.KoraError {
+      constructor(dbName, storedVersion, codeVersion) {
+        super(
+          `Database "${dbName}" is at schema version ${storedVersion}, newer than this build's schema version ${codeVersion}: a newer build of the app already migrated it. It was not opened and nothing in it changed. Run the newer build (reload while online, or accept the update); never lower schema.version in a deployed app.`,
+          "SCHEMA_VERSION_AHEAD",
+          { dbName, storedVersion, codeVersion }
+        );
+        this.dbName = dbName;
+        this.storedVersion = storedVersion;
+        this.codeVersion = codeVersion;
+        this.name = "SchemaVersionAheadError";
+      }
+      dbName;
+      storedVersion;
+      codeVersion;
+    };
     StoreNotOpenError = class extends import_core.KoraError {
       constructor() {
         super("Store is not open. Call store.open() before performing operations.", "STORE_NOT_OPEN");
@@ -49,13 +75,50 @@ var init_errors = __esm({
       }
     };
     NoLeaderError = class extends import_core.KoraError {
-      constructor(operation) {
+      constructor(operation, message = `No live leader tab is answering multi-tab storage RPC for operation "${operation}"`, code = "NO_LEADER", context = {}) {
+        super(message, code, { operation, ...context });
+        this.name = "NoLeaderError";
+      }
+    };
+    LeaderUnresponsiveError = class extends NoLeaderError {
+      constructor(operation, silentMs, requestId) {
         super(
-          `No live leader tab is answering multi-tab storage RPC for operation "${operation}"`,
-          "NO_LEADER",
-          { operation }
+          operation,
+          `The leader tab stopped responding (no heartbeat for ${silentMs}ms) during "${operation}". The request may or may not have been applied; retry it with the same requestId and the leader de-duplicates it.`,
+          "LEADER_UNRESPONSIVE",
+          { silentMs, requestId, retriable: true }
         );
-        this.name = "NoLeaderError";
+        this.name = "LeaderUnresponsiveError";
+      }
+    };
+    BridgeTerminatedError = class extends import_core.KoraError {
+      constructor(operation, reason) {
+        super(
+          `Storage request "${operation}" was interrupted (${reason}); retry it against the new storage leader.`,
+          "BRIDGE_TERMINATED",
+          { operation, reason, retriable: true }
+        );
+        this.name = "BridgeTerminatedError";
+      }
+    };
+    RequestAbortedError = class extends import_core.KoraError {
+      constructor(operation, requestId) {
+        super(
+          `Storage request "${operation}" was aborted by the caller. A write may already have reached the leader; retry with the same requestId to stay idempotent.`,
+          "REQUEST_ABORTED",
+          { operation, requestId }
+        );
+        this.name = "RequestAbortedError";
+      }
+    };
+    StorageBackendMismatchError = class extends import_core.KoraError {
+      constructor(dbName, recorded, requested, reason) {
+        super(
+          `Database "${dbName}" is stored in ${recorded}, but this session can only use ${requested} (${reason}). Kora will not start a separate empty copy; reload in a browser profile where ${recorded} is available.`,
+          "STORAGE_BACKEND_MISMATCH",
+          { dbName, recorded, requested, reason }
+        );
+        this.name = "StorageBackendMismatchError";
       }
     };
     PersistenceError = class extends import_core.KoraError {
@@ -130,16 +193,21 @@ var init_sqlite_wasm_channel = __esm({
       /**
        * @param workerUrl - URL to the sqlite-wasm-worker script
        * @param timeoutMs - Timeout for worker responses in milliseconds (default: 30000)
+       * @param options - Status event listener
        */
-      constructor(workerUrl, timeoutMs = 3e4) {
+      constructor(workerUrl, timeoutMs = 3e4, options = {}) {
         this.timeoutMs = timeoutMs;
         this.worker = new Worker(workerUrl, { type: "module" });
         this.worker.onmessage = (event) => {
-          const response = event.data;
-          const entry = this.pending.get(response.id);
+          const message = event.data;
+          if (message.type === "event") {
+            options.onEvent?.(message.event);
+            return;
+          }
+          const entry = this.pending.get(message.id);
           if (entry) {
-            this.pending.delete(response.id);
-            entry.resolve(response);
+            this.pending.delete(message.id);
+            entry.resolve(message);
           }
         };
         this.worker.onerror = (event) => {
@@ -150,7 +218,17 @@ var init_sqlite_wasm_channel = __esm({
           }
         };
       }
-      async send(request) {
+      /** True once {@link terminate} ran. */
+      isTerminated() {
+        return this.terminated;
+      }
+      /** Post a request without awaiting a response (fire-and-forget control messages). */
+      post(request, clientId) {
+        if (this.terminated) return;
+        const message = { ...request, id: this.nextId++, clientId };
+        this.worker.postMessage(message);
+      }
+      async send(request, clientId, options = {}) {
         if (this.terminated) {
           return {
             id: request.id,
@@ -160,23 +238,40 @@ var init_sqlite_wasm_channel = __esm({
           };
         }
         const id = this.nextId++;
-        const req = { ...request, id };
+        const message = { ...request, id, clientId };
+        const timeoutMs = options.timeoutMs ?? this.timeoutMs;
+        const signal = options.signal;
+        if (signal?.aborted) {
+          throw new RequestAbortedError(request.type, request.requestId ?? String(id));
+        }
         return new Promise((resolve, reject) => {
-          const timer = setTimeout(() => {
+          const timer = Number.isFinite(timeoutMs) ? setTimeout(() => {
             this.pending.delete(id);
-            reject(new WorkerTimeoutError(req.type, this.timeoutMs));
-          }, this.timeoutMs);
+            cleanup();
+            reject(new WorkerTimeoutError(message.type, timeoutMs));
+          }, timeoutMs) : void 0;
+          const onAbort = () => {
+            this.pending.delete(id);
+            cleanup();
+            reject(new RequestAbortedError(request.type, request.requestId ?? String(id)));
+          };
+          const cleanup = () => {
+            if (timer !== void 0) clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+          };
+          signal?.addEventListener("abort", onAbort, { once: true });
           this.pending.set(id, {
+            type: request.type,
             resolve: (response) => {
-              clearTimeout(timer);
+              cleanup();
               resolve(response);
             },
             reject: (error) => {
-              clearTimeout(timer);
+              cleanup();
               reject(error);
             }
           });
-          this.worker.postMessage(req);
+          this.worker.postMessage(message);
         });
       }
       terminate() {
@@ -185,7 +280,7 @@ var init_sqlite_wasm_channel = __esm({
         this.worker.terminate();
         for (const [id, entry] of this.pending) {
           this.pending.delete(id);
-          entry.reject(new Error("Worker terminated"));
+          entry.reject(new BridgeTerminatedError(entry.type, "worker terminated"));
         }
       }
     };
@@ -200,9 +295,81 @@ __export(indexeddb_exports, {
 module.exports = __toCommonJS(indexeddb_exports);
 
 // src/adapters/indexeddb-adapter.ts
-var import_core3 = require("@korajs/core");
 init_errors();
 
+// src/migrations/schema-ceiling.ts
+function storedSchemaVersion(rows) {
+  const value = Number(rows[0]?.value ?? 0);
+  return Number.isFinite(value) ? value : 0;
+}
+var STORED_SCHEMA_VERSION_SQL = "SELECT value FROM _kora_meta WHERE key = 'schema_version'";
+
+// src/adapters/database-dump.ts
+var import_core2 = require("@korajs/core");
+init_errors();
+function ensureSafeIdentifier(identifier) {
+  if (!/^[a-zA-Z0-9_]+$/.test(identifier)) {
+    throw new PersistenceError(`Unsafe SQL identifier: ${identifier}`, {
+      code: "UNSAFE_IDENTIFIER",
+      identifier
+    });
+  }
+  return identifier;
+}
+async function exportDump(query) {
+  const tableRows = await query(
+    "SELECT name, sql FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'"
+  );
+  const tables = [];
+  for (const tableRow of tableRows) {
+    const tableName = ensureSafeIdentifier(tableRow.name);
+    const columns = await query(`PRAGMA table_info(${(0, import_core2.quoteIdent)(tableName)})`);
+    const rows = await query(`SELECT * FROM ${(0, import_core2.quoteIdent)(tableName)}`);
+    tables.push({
+      name: tableName,
+      ...typeof tableRow.sql === "string" ? { sql: tableRow.sql } : {},
+      columns: columns.map((column) => column.name),
+      rows
+    });
+  }
+  return { tables };
+}
+function restoreDumpStatements(dump, _createMissingTables = true) {
+  const statements = [];
+  for (const table of dump.tables) {
+    const name = (0, import_core2.quoteIdent)(ensureSafeIdentifier(table.name));
+    const create = createTableIfNotExists(table.name, table.sql);
+    if (create) {
+      statements.push({ sql: create });
+    } else {
+      const columns = table.columns.map((column) => (0, import_core2.quoteIdent)(ensureSafeIdentifier(column)));
+      if (columns.length === 0) continue;
+      statements.push({ sql: `CREATE TABLE IF NOT EXISTS ${name} (${columns.join(", ")})` });
+    }
+    statements.push({ sql: `DELETE FROM ${name}` });
+    for (const row of table.rows) {
+      const columns = table.columns.filter(
+        (column) => Object.prototype.hasOwnProperty.call(row, column)
+      );
+      if (columns.length === 0) continue;
+      const quotedColumns = columns.map((column) => (0, import_core2.quoteIdent)(ensureSafeIdentifier(column))).join(", ");
+      statements.push({
+        sql: `INSERT INTO ${name} (${quotedColumns}) VALUES (${columns.map(() => "?").join(", ")})`,
+        params: columns.map((column) => row[column])
+      });
+    }
+  }
+  return statements;
+}
+function createTableIfNotExists(tableName, sql) {
+  if (typeof sql !== "string" || sql.includes(";")) return null;
+  const match = /^\s*CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?("?)([A-Za-z0-9_]+)\1\s*\(/i.exec(
+    sql
+  );
+  if (!match || match[2] !== tableName) return null;
+  return `CREATE TABLE IF NOT EXISTS ${(0, import_core2.quoteIdent)(tableName)} ${sql.slice(match[0].length - 1)}`;
+}
+
 // src/adapters/indexeddb-persistence-scheduler.ts
 var DEFAULT_DEBOUNCE_MS = 500;
 var IndexedDbPersistenceScheduler = class {
@@ -212,6 +379,15 @@ var IndexedDbPersistenceScheduler = class {
   timer = null;
   inFlight = null;
   disposed = false;
+  /**
+   * Mutation generations (RT-35): `scheduled` counts schedule() calls (one per committed
+   * write), `persisted` is the generation the last SUCCESSFUL snapshot covered. A
+   * snapshot covers every generation scheduled before it started.
+   */
+  scheduledGeneration = 0;
+  persistedGeneration = 0;
+  /** Error of the last snapshot attempt, cleared by the next success. */
+  lastFlushError = null;
   onVisibilityChange;
   constructor(options) {
     this.debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;
@@ -229,6 +405,7 @@ var IndexedDbPersistenceScheduler = class {
   /** Schedule a debounced snapshot write. */
   schedule() {
     if (this.disposed) return;
+    this.scheduledGeneration++;
     if (this.debounceMs <= 0) {
       void this.flushNow();
       return;
@@ -241,22 +418,75 @@ var IndexedDbPersistenceScheduler = class {
       void this.flushNow();
     }, this.debounceMs);
   }
-  /** Cancel any pending debounce and persist immediately. */
+  /**
+   * Cancel any pending debounce and persist immediately. Resolves only when a snapshot
+   * taken after every write scheduled so far was written (STORE-7): a snapshot already in
+   * flight may predate the latest writes, so the call waits for it and then writes again
+   * while anything is still dirty. A failed snapshot ends the loop (the failure is
+   * reported through `onError`; {@link flushBarrier} is the variant that rejects).
+   */
   async flushNow() {
     if (this.disposed) return;
     if (this.timer !== null) {
       clearTimeout(this.timer);
       this.timer = null;
     }
-    if (this.inFlight) {
-      await this.inFlight;
-      return;
+    let mustRun = this.inFlight === null;
+    for (; ; ) {
+      if (this.inFlight) {
+        await this.inFlight;
+        continue;
+      }
+      if (!mustRun && this.persistedGeneration >= this.scheduledGeneration) return;
+      mustRun = false;
+      this.inFlight = this.runFlush();
+      try {
+        await this.inFlight;
+      } finally {
+        this.inFlight = null;
+      }
+      if (this.lastFlushError !== null) return;
     }
-    this.inFlight = this.runFlush();
-    try {
-      await this.inFlight;
-    } finally {
-      this.inFlight = null;
+  }
+  /** Whether a write was scheduled that no successful snapshot covers yet. */
+  isDirty() {
+    return this.persistedGeneration < this.scheduledGeneration;
+  }
+  /**
+   * Durability barrier (RT-35): resolve once every write scheduled before this call is
+   * in a snapshot persisted to IndexedDB. A snapshot already in flight may predate the
+   * latest write, so the barrier waits for it and then writes a fresh one when needed.
+   * Rejects when the snapshot cannot be written: the caller must treat the writes as
+   * not durable (for example, not upload them yet).
+   */
+  async flushBarrier() {
+    const target = this.scheduledGeneration;
+    if (this.persistedGeneration >= target) return;
+    if (this.disposed) {
+      throw new Error("IndexedDB persistence was disposed before the writes were persisted");
+    }
+    if (this.timer !== null) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    for (let round = 0; round < 3 && this.persistedGeneration < target; round++) {
+      if (this.inFlight) {
+        try {
+          await this.inFlight;
+        } catch {
+        }
+        continue;
+      }
+      this.inFlight = this.runFlush();
+      try {
+        await this.inFlight;
+      } finally {
+        this.inFlight = null;
+      }
+      if (this.persistedGeneration < target) break;
+    }
+    if (this.persistedGeneration < target) {
+      throw this.lastFlushError instanceof Error ? this.lastFlushError : new Error("IndexedDB snapshot was not persisted");
     }
   }
   dispose() {
@@ -270,18 +500,30 @@ var IndexedDbPersistenceScheduler = class {
     }
   }
   async runFlush() {
+    const generation = this.scheduledGeneration;
     try {
       await this.flush();
+      this.persistedGeneration = Math.max(this.persistedGeneration, generation);
+      this.lastFlushError = null;
     } catch (error) {
+      this.lastFlushError = error;
       this.onError?.(error);
     }
   }
 };
 
 // src/adapters/sqlite-wasm-adapter.ts
-var import_core2 = require("@korajs/core");
+var import_core3 = require("@korajs/core");
 init_errors();
 
+// src/adapters/opfs-names.ts
+function leaderLockName(dbName) {
+  return `kora-leader-${dbName}`;
+}
+function storageChannelName(dbName) {
+  return `kora-storage-${dbName}`;
+}
+
 // src/multi-tab/tab-storage.ts
 init_errors();
 var RPC_REQUEST = "kora-worker-request";
@@ -289,14 +531,16 @@ var RPC_RESPONSE = "kora-worker-response";
 var CLIENT_LEAVE = "kora-client-leave";
 var LEADER_PING = "kora-leader-ping";
 var LEADER_PONG = "kora-leader-pong";
-var DEFAULT_LIVENESS_PROBE_MS = 2e3;
-var DEFAULT_TRANSACTION_IDLE_TIMEOUT_MS = 1e4;
+var LEADER_HEARTBEAT = "kora-leader-heartbeat";
+var DEFAULT_HEARTBEAT_MS = 1e3;
+var MISSED_BEATS_UNRESPONSIVE = 3;
+var MISSED_BEATS_ABSENT = 2;
 function isMultiTabStorageSupported() {
   return typeof globalThis !== "undefined" && typeof BroadcastChannel !== "undefined" && typeof navigator !== "undefined" && typeof navigator.locks?.request === "function";
 }
 async function acquireTabStorageSession(dbName, options) {
-  const channelName = `kora-storage-${dbName}`;
-  const lockName = `kora-leader-${dbName}`;
+  const channelName = storageChannelName(dbName);
+  const lockName = leaderLockName(dbName);
   if (!isMultiTabStorageSupported()) {
     return { role: "leader", channelName };
   }
@@ -344,51 +588,6 @@ function startFollowerSession(channelName, lockName, options) {
     }
   };
 }
-function startLeaderRpcRelay(channelName, bridge) {
-  const channel = new BroadcastChannel(channelName);
-  const onMessage = (event) => {
-    const data = event.data;
-    if (data?.type === LEADER_PING) {
-      channel.postMessage({ type: LEADER_PONG });
-      return;
-    }
-    if (data?.type === CLIENT_LEAVE) {
-      if (hasReclaimClient(bridge)) {
-        bridge.reclaimClient(data.clientId, "client-left");
-      }
-      return;
-    }
-    if (data?.type !== RPC_REQUEST) {
-      return;
-    }
-    void bridge.send(data.request, data.clientId).then((response) => {
-      const msg = {
-        type: RPC_RESPONSE,
-        requestId: data.requestId,
-        response
-      };
-      channel.postMessage(msg);
-    }).catch((error) => {
-      const message = error instanceof Error ? error.message : "Worker RPC failed";
-      const msg = {
-        type: RPC_RESPONSE,
-        requestId: data.requestId,
-        response: {
-          id: data.request.id,
-          type: "error",
-          message,
-          code: "LEADER_RPC_ERROR"
-        }
-      };
-      channel.postMessage(msg);
-    });
-  };
-  channel.addEventListener("message", onMessage);
-  return () => {
-    channel.removeEventListener("message", onMessage);
-    channel.close();
-  };
-}
 var FollowerBroadcastBridge = class {
   channel;
   clientId = createClientId();
@@ -397,17 +596,28 @@ var FollowerBroadcastBridge = class {
   };
   pending = /* @__PURE__ */ new Map();
   timeoutMs;
-  livenessProbeMs;
+  heartbeatMs;
   terminated = false;
-  constructor(channelName, timeoutMs = 3e4, livenessProbeMs = DEFAULT_LIVENESS_PROBE_MS) {
+  lastHeardAt = 0;
+  heardSinceWatch = false;
+  watchdog;
+  /**
+   * @param channelName - Storage channel of the database
+   * @param timeoutMs - Hard ceiling per request (default 30s)
+   * @param heartbeatMs - Expected leader heartbeat interval, also the watchdog tick
+   */
+  constructor(channelName, timeoutMs = 3e4, heartbeatMs = DEFAULT_HEARTBEAT_MS) {
     this.timeoutMs = timeoutMs;
-    this.livenessProbeMs = Math.min(livenessProbeMs, timeoutMs);
+    this.heartbeatMs = Math.max(10, Math.min(heartbeatMs, timeoutMs));
     this.channel = new BroadcastChannel(channelName);
     if (typeof addEventListener === "function") {
       addEventListener("pagehide", this.onPageHide);
     }
     this.channel.addEventListener("message", (event) => {
       const data = event.data;
+      if (data?.type === LEADER_HEARTBEAT || data?.type === LEADER_PONG || data?.type === RPC_RESPONSE) {
+        this.markHeard();
+      }
       if (data?.type !== RPC_RESPONSE) {
         return;
       }
@@ -422,7 +632,7 @@ var FollowerBroadcastBridge = class {
    * Readiness handshake: resolves `true` as soon as a live leader answers a ping,
    * or `false` if none answers within the budget. The adapter calls this before
    * its first RPC so a follower created before a leader relay is live retries the
-   * handshake instead of firing into the void and waiting out the full timeout.
+   * handshake instead of firing into the void.
    */
   async waitForLeader(timeoutMs = 3e3, attempts = 3) {
     const perAttempt = Math.max(50, Math.floor(timeoutMs / Math.max(1, attempts)));
@@ -460,7 +670,7 @@ var FollowerBroadcastBridge = class {
       this.channel.postMessage({ type: LEADER_PING });
     });
   }
-  async send(request) {
+  async send(request, _clientId, options = {}) {
     if (this.terminated) {
       return {
         id: request.id,
@@ -469,34 +679,42 @@ var FollowerBroadcastBridge = class {
         code: "BRIDGE_TERMINATED"
       };
     }
-    const requestId = createClientId();
+    const requestId = request.requestId ?? createClientId();
+    const signal = options.signal;
+    if (signal?.aborted) {
+      throw new RequestAbortedError(request.type, requestId);
+    }
     const msg = {
       type: RPC_REQUEST,
       requestId,
       clientId: this.clientId,
-      request
+      request: { ...request, requestId }
     };
+    const timeoutMs = options.timeoutMs ?? this.timeoutMs;
     return new Promise((resolve, reject) => {
+      let timer;
+      const onAbort = () => {
+        settle(() => reject(new RequestAbortedError(request.type, requestId)));
+      };
       const settle = (fn) => {
-        clearTimeout(timer);
-        clearTimeout(probe);
+        if (timer !== void 0) clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
         this.pending.delete(requestId);
+        this.stopWatchdogIfIdle();
         fn();
       };
-      const timer = setTimeout(() => {
-        settle(() => reject(new WorkerTimeoutError(`follower-rpc:${request.type}`, this.timeoutMs)));
-      }, this.timeoutMs);
-      const probe = setTimeout(() => {
-        void this.pingLeader(this.livenessProbeMs).then((alive) => {
-          if (!alive && this.pending.has(requestId)) {
-            settle(() => reject(new NoLeaderError(`follower-rpc:${request.type}`)));
-          }
-        });
-      }, this.livenessProbeMs);
+      if (Number.isFinite(timeoutMs)) {
+        timer = setTimeout(() => {
+          settle(() => reject(new WorkerTimeoutError(`follower-rpc:${request.type}`, timeoutMs)));
+        }, timeoutMs);
+      }
+      signal?.addEventListener("abort", onAbort, { once: true });
       this.pending.set(requestId, {
+        type: request.type,
         resolve: (response) => settle(() => resolve(response)),
         reject: (error) => settle(() => reject(error))
       });
+      this.startWatchdog();
       this.channel.postMessage(msg);
     });
   }
@@ -510,198 +728,63 @@ var FollowerBroadcastBridge = class {
       removeEventListener("pagehide", this.onPageHide);
     }
     this.channel.close();
-    for (const [, entry] of this.pending) {
-      entry.reject(new Error("Follower bridge terminated"));
+    for (const [, entry] of [...this.pending]) {
+      entry.reject(new BridgeTerminatedError(entry.type, "follower bridge terminated"));
     }
     this.pending.clear();
+    this.stopWatchdog();
   }
-  leaveLeader() {
-    try {
-      const message = {
-        type: CLIENT_LEAVE,
-        clientId: this.clientId
-      };
-      this.channel.postMessage(message);
-    } catch {
-    }
-  }
-};
-var TransactionSerializingWorkerBridge = class {
-  inner;
-  leaderClientId = createClientId();
-  transactionIdleTimeoutMs;
-  queue = [];
-  activeTransactionClient = null;
-  abortedClients = /* @__PURE__ */ new Set();
-  transactionIdleTimer = null;
-  reclaiming = false;
-  processing = false;
-  terminated = false;
-  constructor(inner, transactionIdleTimeoutMs = DEFAULT_TRANSACTION_IDLE_TIMEOUT_MS) {
-    this.inner = inner;
-    this.transactionIdleTimeoutMs = transactionIdleTimeoutMs;
+  markHeard() {
+    this.lastHeardAt = Date.now();
+    this.heardSinceWatch = true;
   }
-  send(request, clientId = this.leaderClientId) {
-    if (this.terminated) {
-      return Promise.resolve({
-        id: request.id,
-        type: "error",
-        message: "Worker has been terminated",
-        code: "WORKER_TERMINATED"
-      });
-    }
-    if (this.abortedClients.has(clientId)) {
-      if (request.type === "begin") {
-        this.abortedClients.delete(clientId);
-      } else {
-        return Promise.resolve({
-          id: request.id,
-          type: "error",
-          message: "Previous transaction was aborted because the client stopped sending requests.",
-          code: "TRANSACTION_ABORTED"
-        });
-      }
-    }
-    return new Promise((resolve, reject) => {
-      this.queue.push({ clientId, request, resolve, reject });
-      void this.processQueue();
-    });
+  startWatchdog() {
+    if (this.watchdog !== void 0) return;
+    const now = Date.now();
+    this.heardSinceWatch = now - this.lastHeardAt < this.heartbeatMs * 2;
+    if (!this.heardSinceWatch) this.lastHeardAt = now;
+    this.watchdog = setInterval(() => this.checkLiveness(), this.heartbeatMs);
   }
-  terminate() {
-    if (this.terminated) {
-      return;
-    }
-    this.terminated = true;
-    this.clearTransactionIdleTimer();
-    this.inner.terminate();
-    const pending = this.queue.splice(0);
-    for (const entry of pending) {
-      entry.reject(new Error("Worker terminated"));
-    }
+  stopWatchdogIfIdle() {
+    if (this.pending.size === 0) this.stopWatchdog();
   }
-  reclaimClient(clientId, reason) {
-    if (this.terminated) {
-      return;
+  stopWatchdog() {
+    if (this.watchdog !== void 0) {
+      clearInterval(this.watchdog);
+      this.watchdog = void 0;
     }
-    void this.reclaimClientNow(clientId, reason);
   }
-  async processQueue() {
-    if (this.processing || this.reclaiming) {
+  checkLiveness() {
+    if (this.pending.size === 0) {
+      this.stopWatchdog();
       return;
     }
-    this.processing = true;
-    try {
-      while (!this.terminated) {
-        const index = this.nextRunnableIndex();
-        if (index === -1) {
-          return;
-        }
-        const [entry] = this.queue.splice(index, 1);
-        if (!entry) {
-          return;
-        }
-        try {
-          const response = await this.inner.send(entry.request);
-          this.recordTransactionState(entry, response);
-          entry.resolve(response);
-        } catch (error) {
-          this.resetFailedTransaction(entry);
-          entry.reject(error instanceof Error ? error : new Error(String(error)));
-        }
-      }
-    } finally {
-      this.processing = false;
-      if (!this.terminated && !this.reclaiming && this.nextRunnableIndex() !== -1) {
-        void this.processQueue();
+    const silentMs = Date.now() - this.lastHeardAt;
+    const heard = this.heardSinceWatch;
+    const limit = this.heartbeatMs * (heard ? MISSED_BEATS_UNRESPONSIVE : MISSED_BEATS_ABSENT);
+    if (silentMs >= limit) {
+      for (const [requestId, entry] of [...this.pending]) {
+        entry.reject(
+          heard ? new LeaderUnresponsiveError(`follower-rpc:${entry.type}`, silentMs, requestId) : new NoLeaderError(`follower-rpc:${entry.type}`)
+        );
       }
-    }
-  }
-  nextRunnableIndex() {
-    if (this.queue.length === 0) {
-      return -1;
-    }
-    if (this.activeTransactionClient === null) {
-      return 0;
-    }
-    return this.queue.findIndex((entry) => entry.clientId === this.activeTransactionClient);
-  }
-  recordTransactionState(entry, response) {
-    if (response.type === "error") {
-      this.resetFailedTransaction(entry);
-      return;
-    }
-    if (entry.request.type === "begin") {
-      this.activeTransactionClient = entry.clientId;
-      this.armTransactionIdleTimer(entry.clientId);
       return;
     }
-    if (this.activeTransactionClient === entry.clientId) {
-      this.armTransactionIdleTimer(entry.clientId);
-    }
-    if (this.activeTransactionClient === entry.clientId && (entry.request.type === "commit" || entry.request.type === "rollback")) {
-      this.activeTransactionClient = null;
-      this.clearTransactionIdleTimer();
-    }
-  }
-  resetFailedTransaction(entry) {
-    if (this.activeTransactionClient === entry.clientId) {
-      this.activeTransactionClient = null;
-      this.clearTransactionIdleTimer();
-    }
-  }
-  armTransactionIdleTimer(clientId) {
-    this.clearTransactionIdleTimer();
-    this.transactionIdleTimer = setTimeout(() => {
-      void this.reclaimClientNow(clientId, "transaction-idle-timeout");
-    }, this.transactionIdleTimeoutMs);
-  }
-  clearTransactionIdleTimer() {
-    if (this.transactionIdleTimer) {
-      clearTimeout(this.transactionIdleTimer);
-      this.transactionIdleTimer = null;
+    if (silentMs >= this.heartbeatMs) {
+      this.channel.postMessage({ type: LEADER_PING });
     }
   }
-  async reclaimClientNow(clientId, reason) {
-    if (this.reclaiming || this.activeTransactionClient !== clientId) {
-      return;
-    }
-    this.reclaiming = true;
-    this.clearTransactionIdleTimer();
-    this.activeTransactionClient = null;
-    this.abortedClients.add(clientId);
-    this.rejectQueuedClientRequests(clientId, reason);
+  leaveLeader() {
     try {
-      const response = await this.inner.send({ id: 0, type: "rollback" });
-      if (response.type === "error") {
-      }
+      const message = {
+        type: CLIENT_LEAVE,
+        clientId: this.clientId
+      };
+      this.channel.postMessage(message);
     } catch {
-    } finally {
-      this.reclaiming = false;
-      if (!this.terminated && this.nextRunnableIndex() !== -1) {
-        void this.processQueue();
-      }
-    }
-  }
-  rejectQueuedClientRequests(clientId, reason) {
-    const keep = [];
-    for (const entry of this.queue) {
-      if (entry.clientId === clientId) {
-        entry.resolve({
-          id: entry.request.id,
-          type: "error",
-          message: `Transaction client was reclaimed: ${reason}`,
-          code: "TRANSACTION_ABORTED"
-        });
-      } else {
-        keep.push(entry);
-      }
     }
-    this.queue = keep;
   }
 };
-function hasReclaimClient(bridge) {
-  return typeof bridge.reclaimClient === "function";
-}
 function createClientId() {
   if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
     return crypto.randomUUID();
@@ -711,100 +794,510 @@ function createClientId() {
 
 // src/adapters/sqlite-wasm-adapter.ts
 init_sqlite_wasm_channel();
-var warnedSharedWorkerDeprecated = false;
-var SqliteWasmAdapter = class {
-  bridge = null;
-  opened = false;
-  mutex = new Mutex();
-  injectedBridge;
-  workerUrl;
-  sharedWorkerUrl;
-  workerResponseTimeoutMs;
-  dbName;
-  emitter;
-  tabSession = null;
-  emitNonPersistentDiagnostic;
-  storageOpenState = null;
-  /** Retained so a follower promoted to leader can re-open its own worker. */
-  schema = null;
-  promoting = false;
-  constructor(options = {}) {
-    this.injectedBridge = options.bridge;
-    this.workerUrl = options.workerUrl;
-    this.sharedWorkerUrl = options.sharedWorkerUrl;
-    this.workerResponseTimeoutMs = options.workerResponseTimeoutMs ?? 3e4;
-    this.dbName = options.dbName ?? "kora-db";
-    this.emitter = options.emitter;
-    this.emitNonPersistentDiagnostic = options.emitNonPersistentDiagnostic ?? true;
+
+// src/adapters/sqlite-wasm-persistence.ts
+init_errors();
+var IDB_DATABASE_NAME = "kora-persistence";
+var IDB_STORE_NAME = "databases";
+var IDB_VERSION = 1;
+var DUMP_SUFFIX = "::dump";
+function isIndexedDbQuotaError(error) {
+  if (error instanceof DOMException && error.name === "QuotaExceededError") {
+    return true;
   }
-  async open(schema) {
-    if (this.opened) return;
-    const ddlStatements = (0, import_core2.generateFullDDL)(schema);
-    if (this.injectedBridge) {
-      this.bridge = this.injectedBridge;
-      const response = await this.openCurrentBridge(ddlStatements);
-      this.reportStorageMode(response.data);
-      this.opened = true;
-      return;
-    }
-    if (this.workerUrl) {
-      this.warnSharedWorkerDeprecated();
-      await this.openDurableWorkerBridge(schema);
-      const response = await this.openCurrentBridge(ddlStatements);
-      this.reportStorageMode(response.data);
-      this.opened = true;
-      return;
-    }
-    throw new AdapterError(
-      'SqliteWasmAdapter requires either a bridge (for testing) or a workerUrl (for browsers). Pass { bridge: new MockWorkerBridge() } for tests, or { workerUrl: "/worker.js" } for browsers.'
-    );
+  if (error instanceof PersistenceError && error.context?.quotaExceeded === true) {
+    return true;
   }
-  async openDurableWorkerBridge(schema) {
-    if (!this.workerUrl) {
-      throw new AdapterError("Durable SQLite WASM storage requires workerUrl.");
-    }
-    this.schema = schema;
-    this.tabSession = await acquireTabStorageSession(this.dbName, {
-      onPromote: () => {
-        void this.promoteToLeader();
-      }
-    });
-    const { WebWorkerBridge: WebWorkerBridge2 } = await Promise.resolve().then(() => (init_sqlite_wasm_channel(), sqlite_wasm_channel_exports));
-    if (this.tabSession.role === "leader") {
-      const workerBridge = new TransactionSerializingWorkerBridge(
-        new WebWorkerBridge2(this.workerUrl, this.workerResponseTimeoutMs)
-      );
-      this.tabSession.stopRelay = startLeaderRpcRelay(this.tabSession.channelName, workerBridge);
-      this.bridge = workerBridge;
-      return;
-    }
-    const followerBridge = new FollowerBroadcastBridge(
-      this.tabSession.channelName,
-      this.workerResponseTimeoutMs
-    );
-    this.bridge = followerBridge;
+  if (error instanceof Error && /quota/i.test(error.message)) {
+    return true;
+  }
+  return false;
+}
+function rejectWithIdbError(reject, message, context, event) {
+  const domError = event.target?.error;
+  if (domError && isIndexedDbQuotaError(domError)) {
+    reject(
+      new PersistenceError(message, {
+        ...context,
+        quotaExceeded: true,
+        cause: domError.message
+      })
+    );
+    return;
+  }
+  reject(new PersistenceError(message, context));
+}
+function openIdb() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(IDB_DATABASE_NAME, IDB_VERSION);
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(IDB_STORE_NAME)) {
+        db.createObjectStore(IDB_STORE_NAME);
+      }
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(
+      new PersistenceError(
+        `Failed to open IndexedDB: ${request.error?.message ?? "unknown error"}`,
+        { database: IDB_DATABASE_NAME }
+      )
+    );
+  });
+}
+async function saveToIndexedDB(dbName, data) {
+  const idb = await openIdb();
+  try {
+    await new Promise((resolve, reject) => {
+      const tx = idb.transaction(IDB_STORE_NAME, "readwrite");
+      const store = tx.objectStore(IDB_STORE_NAME);
+      store.put(data, dbName);
+      tx.oncomplete = () => resolve();
+      tx.onerror = (event) => rejectWithIdbError(
+        reject,
+        `Failed to save database "${dbName}" to IndexedDB`,
+        { dbName },
+        event
+      );
+    });
+  } finally {
+    idb.close();
+  }
+}
+async function saveDumpToIndexedDB(dbName, dump) {
+  const idb = await openIdb();
+  try {
+    await new Promise((resolve, reject) => {
+      const tx = idb.transaction(IDB_STORE_NAME, "readwrite");
+      const store = tx.objectStore(IDB_STORE_NAME);
+      store.put(dump, `${dbName}${DUMP_SUFFIX}`);
+      tx.oncomplete = () => resolve();
+      tx.onerror = (event) => rejectWithIdbError(
+        reject,
+        `Failed to save dump for database "${dbName}"`,
+        { dbName },
+        event
+      );
+    });
+  } finally {
+    idb.close();
+  }
+}
+async function loadFromIndexedDB(dbName) {
+  const idb = await openIdb();
+  try {
+    return await new Promise((resolve, reject) => {
+      const tx = idb.transaction(IDB_STORE_NAME, "readonly");
+      const store = tx.objectStore(IDB_STORE_NAME);
+      const request = store.get(dbName);
+      request.onsuccess = () => {
+        const result = request.result;
+        if (result instanceof Uint8Array) {
+          resolve(result);
+        } else if (result) {
+          resolve(new Uint8Array(result));
+        } else {
+          resolve(null);
+        }
+      };
+      request.onerror = () => reject(
+        new PersistenceError(`Failed to load database "${dbName}" from IndexedDB`, { dbName })
+      );
+    });
+  } finally {
+    idb.close();
+  }
+}
+async function loadDumpFromIndexedDB(dbName) {
+  const idb = await openIdb();
+  try {
+    return await new Promise((resolve, reject) => {
+      const tx = idb.transaction(IDB_STORE_NAME, "readonly");
+      const store = tx.objectStore(IDB_STORE_NAME);
+      const request = store.get(`${dbName}${DUMP_SUFFIX}`);
+      request.onsuccess = () => {
+        resolve(request.result ?? null);
+      };
+      request.onerror = () => reject(
+        new PersistenceError(`Failed to load dump for database "${dbName}" from IndexedDB`, {
+          dbName
+        })
+      );
+    });
+  } finally {
+    idb.close();
+  }
+}
+async function deleteSnapshotFromIndexedDB(dbName) {
+  const idb = await openIdb();
+  try {
+    await new Promise((resolve, reject) => {
+      const tx = idb.transaction(IDB_STORE_NAME, "readwrite");
+      const store = tx.objectStore(IDB_STORE_NAME);
+      store.delete(dbName);
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(
+        new PersistenceError(`Failed to delete database snapshot "${dbName}" from IndexedDB`, {
+          dbName
+        })
+      );
+    });
+  } finally {
+    idb.close();
+  }
+}
+async function deleteFromIndexedDB(dbName) {
+  const idb = await openIdb();
+  try {
+    await new Promise((resolve, reject) => {
+      const tx = idb.transaction(IDB_STORE_NAME, "readwrite");
+      const store = tx.objectStore(IDB_STORE_NAME);
+      store.delete(dbName);
+      store.delete(`${dbName}${DUMP_SUFFIX}`);
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(
+        new PersistenceError(`Failed to delete database "${dbName}" from IndexedDB`, { dbName })
+      );
+    });
+  } finally {
+    idb.close();
+  }
+}
+
+// src/adapters/storage-manifest.ts
+var MANIFEST_DB_NAME = "kora-manifest";
+var MANIFEST_STORE = "databases";
+var MANIFEST_VERSION = 1;
+function isManifestAvailable() {
+  return typeof indexedDB !== "undefined";
+}
+function openManifest() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(MANIFEST_DB_NAME, MANIFEST_VERSION);
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(MANIFEST_STORE)) {
+        db.createObjectStore(MANIFEST_STORE, { keyPath: "dbName" });
+      }
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error ?? new Error("Failed to open the Kora storage manifest"));
+  });
+}
+async function withStore(mode, run) {
+  const db = await openManifest();
+  try {
+    return await new Promise((resolve, reject) => {
+      const tx = db.transaction(MANIFEST_STORE, mode);
+      const request = run(tx.objectStore(MANIFEST_STORE));
+      let result;
+      if (request) {
+        request.onsuccess = () => {
+          result = request.result;
+        };
+      }
+      tx.oncomplete = () => resolve(result);
+      tx.onerror = () => reject(tx.error ?? new Error("Kora storage manifest transaction failed"));
+      tx.onabort = () => reject(tx.error ?? new Error("Kora storage manifest transaction aborted"));
+    });
+  } finally {
+    db.close();
+  }
+}
+function isRecord(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value;
+  return typeof record.dbName === "string" && (record.backend === "opfs" || record.backend === "indexeddb");
+}
+async function readManifestRecord(dbName) {
+  if (!isManifestAvailable()) return null;
+  const value = await withStore("readonly", (store) => store.get(dbName));
+  return isRecord(value) ? value : null;
+}
+async function recordDatabase(entry) {
+  if (!isManifestAvailable()) return;
+  const existing = await readManifestRecord(entry.dbName);
+  const now = Date.now();
+  const record = {
+    dbName: entry.dbName,
+    backend: entry.backend,
+    ...entry.poolName ? { poolName: entry.poolName } : {},
+    createdAt: existing?.createdAt ?? now,
+    lastOpenedAt: now
+  };
+  await withStore("readwrite", (store) => store.put(record));
+}
+
+// src/adapters/sqlite-wasm-adapter.ts
+var warnedSharedWorkerDeprecated = false;
+function createGate() {
+  let open = () => {
+  };
+  const promise = new Promise((resolve) => {
+    open = resolve;
+  });
+  return { promise, open };
+}
+var SqliteWasmAdapter = class {
+  bridge = null;
+  /** The dedicated worker this tab runs while it is the database's leader. */
+  ownWorker = null;
+  opened = false;
+  mutex = new Mutex();
+  injectedBridge;
+  workerUrl;
+  sharedWorkerUrl;
+  workerResponseTimeoutMs;
+  dbName;
+  emitter;
+  tabSession = null;
+  emitNonPersistentDiagnostic;
+  storageOpenState = null;
+  /** Retained so a follower promoted to leader can re-open its own worker. */
+  schema = null;
+  promoting = false;
+  closing = false;
+  suspended = false;
+  /** Requests wait here while leadership changes hands (promotion, resume). */
+  gate = null;
+  removeLifecycleListeners = null;
+  allowNonDurable;
+  deferOpenDurabilityCheck;
+  releaseOnFreeze;
+  storage;
+  skipBackendRecord;
+  /** Set when this adapter lost (or never had) durable storage; writes are refused. */
+  durabilityLoss = null;
+  onLeaderWorkerOpened;
+  constructor(options = {}) {
+    this.injectedBridge = options.bridge;
+    this.workerUrl = options.workerUrl;
+    this.sharedWorkerUrl = options.sharedWorkerUrl;
+    this.workerResponseTimeoutMs = options.workerResponseTimeoutMs ?? 3e4;
+    this.dbName = options.dbName ?? "kora-db";
+    this.emitter = options.emitter;
+    this.emitNonPersistentDiagnostic = options.emitNonPersistentDiagnostic ?? true;
+    this.allowNonDurable = options.allowNonDurable ?? false;
+    this.deferOpenDurabilityCheck = options.deferOpenDurabilityCheck ?? false;
+    this.releaseOnFreeze = options.releaseOnFreeze ?? true;
+    this.storage = options.storage ?? "opfs";
+    this.skipBackendRecord = options.skipBackendRecord ?? false;
+    this.onLeaderWorkerOpened = options.onLeaderWorkerOpened;
+  }
+  async open(schema) {
+    if (this.opened) return;
+    const ddlStatements = (0, import_core3.generateFullDDL)(schema);
+    if (this.injectedBridge) {
+      this.bridge = this.injectedBridge;
+      const response = await this.openCurrentBridge(ddlStatements);
+      this.reportStorageMode(response.data);
+      this.enforceDurability("open");
+      this.opened = true;
+      return;
+    }
+    if (this.workerUrl) {
+      this.warnSharedWorkerDeprecated();
+      this.schema = schema;
+      try {
+        const response = await this.attachAndOpen(ddlStatements);
+        this.reportStorageMode(response.data);
+        this.enforceDurability("open");
+        await this.afterLeaderOpen(response.data);
+        this.opened = true;
+      } catch (error) {
+        await this.teardown();
+        throw error;
+      }
+      return;
+    }
+    throw new AdapterError(
+      'SqliteWasmAdapter requires either a bridge (for testing) or a workerUrl (for browsers). Pass { bridge: new MockWorkerBridge() } for tests, or { workerUrl: "/worker.js" } for browsers.'
+    );
+  }
+  /**
+   * Join the database as leader (own worker) or follower (RPC to the leader's
+   * worker), then open it. The open waits, without a timeout, while another
+   * holder still has the storage; the worker reports that as a blocking state.
+   */
+  async attachAndOpen(ddlStatements) {
+    const workerUrl = this.workerUrl;
+    if (!workerUrl) {
+      throw new AdapterError("Durable SQLite WASM storage requires workerUrl.");
+    }
+    const session = await acquireTabStorageSession(this.dbName, {
+      onPromote: () => {
+        void this.promoteToLeader();
+      }
+    });
+    this.tabSession = session;
+    if (session.role === "leader") {
+      const { WebWorkerBridge: WebWorkerBridge2 } = await Promise.resolve().then(() => (init_sqlite_wasm_channel(), sqlite_wasm_channel_exports));
+      const worker = new WebWorkerBridge2(workerUrl, this.workerResponseTimeoutMs, {
+        onEvent: (event) => this.onWorkerEvent(event)
+      });
+      this.ownWorker = worker;
+      this.bridge = worker;
+      const response = await this.openLeaderWorker(worker, ddlStatements);
+      this.installLifecycleListeners();
+      return response;
+    }
+    const followerBridge = new FollowerBroadcastBridge(
+      session.channelName,
+      this.workerResponseTimeoutMs
+    );
+    this.bridge = followerBridge;
     this.emitter?.emit({
       type: "store:db-name-collision",
       dbName: this.dbName,
       message: `Another runtime on this origin is already using database "${this.dbName}"; this runtime is sharing it as a follower. If these are separate apps, give each a distinct store name.`
     });
     await followerBridge.waitForLeader();
+    this.installLifecycleListeners();
+    return this.checkedOpen(followerBridge, ddlStatements);
+  }
+  /** Open the database in this tab's own worker and start serving followers. */
+  async openLeaderWorker(worker, ddlStatements) {
+    const hook = this.onLeaderWorkerOpened;
+    if (!hook) {
+      const pending = this.checkedOpen(worker, ddlStatements);
+      worker.post({ id: 0, type: "serve", channelName: this.tabSession?.channelName ?? "" });
+      return pending;
+    }
+    const response = await this.checkedOpen(worker, ddlStatements);
+    await runWorkerTransaction(worker, hook);
+    worker.post({ id: 0, type: "serve", channelName: this.tabSession?.channelName ?? "" });
+    return response;
   }
-  async openCurrentBridge(ddlStatements) {
-    const response = await this.sendRequest({
-      id: 0,
-      type: "open",
-      ddlStatements,
-      dbName: this.dbName
-    });
+  /**
+   * Whether this runtime owns the database's worker: the storage leader in a browser,
+   * or any adapter with an injected bridge (tests, Node). A follower tab relays every
+   * request to the leader's worker (STORE-6).
+   */
+  isLeader() {
+    if (this.injectedBridge) return true;
+    return this.tabSession?.role === "leader";
+  }
+  async checkedOpen(bridge, ddlStatements) {
+    const response = await bridge.send(
+      {
+        id: 0,
+        type: "open",
+        ddlStatements,
+        dbName: this.dbName,
+        ...this.storage === "memory" ? { storage: "memory" } : {}
+      },
+      void 0,
+      { timeoutMs: Number.POSITIVE_INFINITY }
+    );
     if (response.type === "error") {
       throw new AdapterError(`Failed to open database: ${response.message}`, {
         code: response.code,
-        dbName: this.dbName
+        dbName: this.dbName,
+        ...response.context ?? {}
       });
     }
     return response;
   }
+  async openCurrentBridge(ddlStatements) {
+    const bridge = this.bridge;
+    if (!bridge) throw new StoreNotOpenError();
+    return this.checkedOpen(bridge, ddlStatements);
+  }
+  onWorkerEvent(event) {
+    if (!this.emitter) return;
+    const holder = event.resource === "legacy-pool" ? "the shared OPFS pool used by older Kora versions (a tab running an older version of this app may still be open)" : "another tab or worker that is still releasing it";
+    if (event.kind === "storage-blocked") {
+      this.emitter.emit({
+        type: "store:storage-blocked",
+        dbName: this.dbName,
+        resource: event.resource,
+        state: "waiting",
+        message: `Database "${this.dbName}" is waiting for ${holder}. Close other tabs of this app if this persists; Kora will not fall back to non-durable storage.`
+      });
+      return;
+    }
+    this.emitter.emit({
+      type: "store:storage-blocked",
+      dbName: this.dbName,
+      resource: event.resource,
+      state: "resolved",
+      waitedMs: event.waitedMs,
+      message: `Database "${this.dbName}" obtained its storage after waiting ${event.waitedMs}ms.`
+    });
+  }
+  /**
+   * Leader-only bookkeeping after a durable open: report a legacy-pool
+   * migration, move an IndexedDB-held copy into OPFS explicitly (never two
+   * disjoint copies), and record OPFS as this database's backend.
+   */
+  async afterLeaderOpen(data) {
+    if (!this.ownWorker || this.skipBackendRecord || this.storageOpenState?.persistent !== true) {
+      return;
+    }
+    const info = typeof data === "object" && data !== null ? data : {};
+    if (info.migratedFromLegacy === true) {
+      this.emitter?.emit({
+        type: "store:storage-migrated",
+        dbName: this.dbName,
+        from: "legacy-opfs-pool",
+        to: "opfs",
+        message: `Database "${this.dbName}" moved from the shared pre-1.0 OPFS pool into its own pool.`
+      });
+    }
+    if (!isManifestAvailable()) return;
+    let recordedBackend = null;
+    try {
+      recordedBackend = (await readManifestRecord(this.dbName))?.backend ?? null;
+    } catch (error) {
+      console.warn(`[kora] Could not read the storage manifest for "${this.dbName}":`, error);
+    }
+    if (recordedBackend === "indexeddb") {
+      const dump = await loadDumpFromIndexedDB(this.dbName);
+      if (dump) {
+        await this.applyDumpThroughWorker(this.ownWorker, dump);
+      }
+      this.emitter?.emit({
+        type: "store:storage-migrated",
+        dbName: this.dbName,
+        from: "indexeddb",
+        to: "opfs",
+        message: `Database "${this.dbName}" moved from IndexedDB into OPFS.`
+      });
+    }
+    try {
+      await recordDatabase({
+        dbName: this.dbName,
+        backend: "opfs",
+        ...this.storageOpenState.poolName ? { poolName: this.storageOpenState.poolName } : {}
+      });
+      if (recordedBackend === "indexeddb") {
+        await deleteFromIndexedDB(this.dbName);
+      }
+    } catch (error) {
+      console.warn(`[kora] Could not update the storage manifest for "${this.dbName}":`, error);
+    }
+  }
+  async applyDumpThroughWorker(worker, dump) {
+    const check = async (request, what) => {
+      const response = await worker.send(request);
+      if (response.type === "error") {
+        throw new AdapterError(`${what} failed: ${response.message}`, { dbName: this.dbName });
+      }
+    };
+    await check({ id: 0, type: "begin" }, "BEGIN IndexedDB import");
+    try {
+      for (const statement of restoreDumpStatements(dump)) {
+        await check(
+          { id: 0, type: "execute", sql: statement.sql, params: statement.params },
+          "IndexedDB import"
+        );
+      }
+      await check({ id: 0, type: "commit" }, "COMMIT IndexedDB import");
+    } catch (error) {
+      await worker.send({ id: 0, type: "rollback" }).catch(() => void 0);
+      throw error;
+    }
+  }
   /**
    * Surface a `store:opfs-unavailable` diagnostic when the worker reported that
    * persistence silently degraded to an in-memory database, so a data-loss
@@ -816,7 +1309,7 @@ var SqliteWasmAdapter = class {
     if (!this.emitNonPersistentDiagnostic || !this.emitter || !this.storageOpenState) {
       return;
     }
-    if (this.storageOpenState.persistent === false) {
+    if (this.storageOpenState.persistent === false && this.storage === "opfs") {
       const reason = this.storageOpenState.fallbackReason ?? "unsupported";
       this.emitter.emit({
         type: "store:opfs-unavailable",
@@ -829,6 +1322,42 @@ var SqliteWasmAdapter = class {
   getStorageOpenState() {
     return this.storageOpenState;
   }
+  /**
+   * Durable or loud, never silent (NEW-STORE-6). When the open or a promotion
+   * ended on non-persistent storage and the app did not opt into that, emit the
+   * blocking `store:durability-lost` event and refuse every later write. A
+   * bridge that reports no mode (the Node mock) is not judged.
+   */
+  enforceDurability(phase, failure) {
+    if (this.allowNonDurable) return;
+    if (phase === "open" && this.deferOpenDurabilityCheck && !failure) return;
+    let reason;
+    if (failure) {
+      reason = failure.reason;
+    } else if (this.storageOpenState?.persistent === false) {
+      reason = this.storageOpenState.fallbackReason ?? "unsupported";
+    } else {
+      this.durabilityLoss = null;
+      return;
+    }
+    this.durabilityLoss = { phase, reason };
+    this.emitter?.emit({
+      type: "store:durability-lost",
+      dbName: this.dbName,
+      phase,
+      reason,
+      message: `Database "${this.dbName}" has no durable storage (${reason} during ${phase}); writes are refused until the app reloads with durable storage.${failure ? ` ${failure.message}` : ""}`
+    });
+  }
+  guardDurableWrite() {
+    if (this.durabilityLoss) {
+      throw new StorageDurabilityError(
+        this.dbName,
+        this.durabilityLoss.phase,
+        this.durabilityLoss.reason
+      );
+    }
+  }
   warnSharedWorkerDeprecated() {
     if (!this.sharedWorkerUrl || warnedSharedWorkerDeprecated) {
       return;
@@ -838,71 +1367,255 @@ var SqliteWasmAdapter = class {
       "[kora] sharedWorkerUrl is deprecated and ignored: SharedWorker-hosted SQLite cannot use OPFS and is never durable. Kora uses the durable dedicated-worker leader/follower path for multi-tab storage."
     );
   }
+  /**
+   * Close the database. A leader closes the database file and releases the OPFS
+   * pool inside its worker, terminates the worker, and only then releases the
+   * tab leader lock, so the next leader never races a still-running worker for
+   * the file handles (NEW-STORE-10). A follower just leaves.
+   */
   async close() {
-    if (!this.bridge) return;
+    if (!this.bridge && !this.tabSession) return;
+    this.closing = true;
     try {
-      await this.sendRequest({ id: 0, type: "close" });
+      if (this.injectedBridge && this.bridge) {
+        await this.bridge.send({ id: 0, type: "close" });
+      } else if (this.ownWorker && !this.ownWorker.isTerminated()) {
+        const response = await this.ownWorker.send({ id: 0, type: "close" }, void 0, { timeoutMs: 5e3 }).catch((error) => ({
+          id: 0,
+          type: "error",
+          message: error instanceof Error ? error.message : String(error),
+          code: "CLOSE_FAILED"
+        }));
+        if (response.type === "error") {
+          console.warn(`[kora] Closing "${this.dbName}" in its worker failed:`, response.message);
+        }
+      }
     } finally {
-      this.tabSession?.stopRelay?.();
-      this.tabSession?.cancelPromotionWatch?.();
-      if (this.tabSession?.releaseLock) {
-        await this.tabSession.releaseLock();
+      await this.teardown();
+      this.closing = false;
+    }
+  }
+  /**
+   * Release everything this adapter holds, in ownership order: lifecycle
+   * listeners, then the worker (which holds the OPFS pool and its Web Lock),
+   * then the tab leader lock or queued promotion request.
+   */
+  async teardown() {
+    this.removeLifecycleListeners?.();
+    this.removeLifecycleListeners = null;
+    const session = this.tabSession;
+    this.tabSession = null;
+    session?.stopRelay?.();
+    this.bridge?.terminate();
+    this.bridge = null;
+    this.ownWorker = null;
+    if (session) {
+      if (session.releaseLock) {
+        await session.releaseLock();
       }
-      this.tabSession = null;
-      this.bridge.terminate();
-      this.bridge = null;
-      this.opened = false;
+      session.cancelPromotionWatch?.();
     }
+    this.opened = false;
+    this.suspended = false;
+    const gate = this.gate;
+    this.gate = null;
+    gate?.open();
   }
   /**
    * Promotes a follower to leader after the previous leader released the storage
-   * lock (its tab closed or crashed). The lock is only granted once the old leader
-   * is gone, so opening our own worker here is safe from the OPFS single-writer
-   * rule. In-flight follower RPCs are rejected and left to the caller / reactive
-   * layer to retry against the new leader.
+   * lock (its tab closed, crashed, or suspended on freeze). The new worker waits
+   * on the pool's Web Lock and handles, so it never races the previous worker.
+   * Requests issued during the hand-off wait for it; requests that were in
+   * flight to the old leader fail with a retriable `BridgeTerminatedError`.
    */
   async promoteToLeader() {
-    if (this.promoting || !this.opened || this.workerUrl === void 0 || this.schema === null) {
+    if (this.promoting || this.closing || !this.opened || this.workerUrl === void 0 || this.schema === null) {
       return;
     }
     this.promoting = true;
-    const { WebWorkerBridge: WebWorkerBridge2 } = await Promise.resolve().then(() => (init_sqlite_wasm_channel(), sqlite_wasm_channel_exports));
-    const workerBridge = new TransactionSerializingWorkerBridge(
-      new WebWorkerBridge2(this.workerUrl, this.workerResponseTimeoutMs)
-    );
-    const previousBridge = this.bridge;
-    this.bridge = workerBridge;
-    if (this.tabSession) {
-      this.tabSession.role = "leader";
-      this.tabSession.stopRelay = startLeaderRpcRelay(this.tabSession.channelName, workerBridge);
+    const gate = createGate();
+    this.gate = gate;
+    try {
+      const { WebWorkerBridge: WebWorkerBridge2 } = await Promise.resolve().then(() => (init_sqlite_wasm_channel(), sqlite_wasm_channel_exports));
+      if (this.closing || !this.opened) return;
+      const worker = new WebWorkerBridge2(this.workerUrl, this.workerResponseTimeoutMs, {
+        onEvent: (event) => this.onWorkerEvent(event)
+      });
+      const previousBridge = this.bridge;
+      this.bridge = worker;
+      this.ownWorker = worker;
+      if (this.tabSession) {
+        this.tabSession.role = "leader";
+      }
+      previousBridge?.terminate();
+      const ddlStatements = (0, import_core3.generateFullDDL)(this.schema);
+      let response;
+      try {
+        response = await this.openLeaderWorker(worker, ddlStatements);
+      } catch (error) {
+        this.storageOpenState = { persistent: false, mode: "memory" };
+        this.enforceDurability("promotion", {
+          reason: "open-failed",
+          message: error instanceof Error ? error.message : String(error)
+        });
+        return;
+      }
+      this.storageOpenState = parseStorageOpenState(response.data) ?? this.storageOpenState;
+      this.enforceDurability("promotion");
+      try {
+        await this.afterLeaderOpen(response.data);
+      } catch (error) {
+        this.enforceDurability("promotion", {
+          reason: "open-failed",
+          message: error instanceof Error ? error.message : String(error)
+        });
+      }
+    } finally {
+      this.promoting = false;
+      if (this.gate === gate) this.gate = null;
+      gate.open();
     }
-    previousBridge?.terminate();
-    const ddlStatements = (0, import_core2.generateFullDDL)(this.schema);
-    await this.sendRequest({ id: 0, type: "open", ddlStatements, dbName: this.dbName });
   }
-  async execute(sql, params) {
+  /**
+   * Page Lifecycle: a frozen or bfcached page cannot run, so it must not keep
+   * other tabs waiting on its storage. Leaders terminate their worker (freeing
+   * the OPFS pool) and then release the leader lock, so a visible tab is
+   * promoted; followers withdraw their queued lock request so a frozen tab is
+   * never granted leadership it cannot use. Never uses Web Locks `steal`.
+   */
+  installLifecycleListeners() {
+    if (!this.releaseOnFreeze || this.removeLifecycleListeners) return;
+    if (typeof addEventListener !== "function" || typeof document === "undefined") return;
+    const onFreeze = () => this.suspend();
+    const onPageHide = () => this.suspend();
+    const onResume = () => {
+      void this.resume();
+    };
+    const onPageShow = (event) => {
+      if (event.persisted) void this.resume();
+    };
+    document.addEventListener("freeze", onFreeze);
+    document.addEventListener("resume", onResume);
+    addEventListener("pagehide", onPageHide);
+    addEventListener("pageshow", onPageShow);
+    this.removeLifecycleListeners = () => {
+      document.removeEventListener("freeze", onFreeze);
+      document.removeEventListener("resume", onResume);
+      removeEventListener("pagehide", onPageHide);
+      removeEventListener("pageshow", onPageShow);
+    };
+  }
+  /** Synchronous by necessity: a `freeze` handler gets no further turns. */
+  suspend() {
+    if (!this.opened || this.suspended || this.closing || this.promoting) return;
+    this.suspended = true;
+    this.gate = createGate();
+    const session = this.tabSession;
+    this.tabSession = null;
+    this.bridge?.terminate();
+    this.bridge = null;
+    this.ownWorker = null;
+    if (session) {
+      void session.releaseLock?.();
+      session.cancelPromotionWatch?.();
+    }
+  }
+  async resume() {
+    if (!this.suspended || this.closing || this.schema === null) return;
+    const gate = this.gate;
+    try {
+      const response = await this.attachAndOpen((0, import_core3.generateFullDDL)(this.schema));
+      this.reportStorageMode(response.data);
+      this.enforceDurability("promotion");
+      await this.afterLeaderOpen(response.data);
+    } catch (error) {
+      this.enforceDurability("promotion", {
+        reason: "open-failed",
+        message: error instanceof Error ? error.message : String(error)
+      });
+    } finally {
+      this.suspended = false;
+      if (this.gate === gate) this.gate = null;
+      gate?.open();
+    }
+  }
+  /**
+   * Non-transactional write. Takes the same mutex as {@link transaction}, so it
+   * never lands inside this tab's open transaction and is never rolled back
+   * with it (STORE-8). Inside a transaction callback, use the `tx` handle.
+   */
+  async execute(sql, params, options) {
     this.guardOpen();
-    const response = await this.sendRequest({ id: 0, type: "execute", sql, params });
-    if (response.type === "error") {
-      throw new AdapterError(`Execute failed: ${response.message}`, { sql, params });
+    this.guardDurableWrite();
+    const release = await this.mutex.acquire();
+    try {
+      const response = await this.sendRequest(
+        {
+          id: 0,
+          type: "execute",
+          sql,
+          params,
+          ...options?.requestId ? { requestId: options.requestId } : {}
+        },
+        options?.signal ? { signal: options.signal } : void 0
+      );
+      if (response.type === "error") {
+        throw new AdapterError(`Execute failed: ${response.message}`, { sql, params });
+      }
+    } finally {
+      release();
     }
   }
-  async query(sql, params) {
+  /**
+   * Non-transactional read. Waits for this tab's open transaction to finish, so
+   * it never observes uncommitted (possibly rolled-back) rows (STORE-8).
+   */
+  async query(sql, params, options) {
     this.guardOpen();
-    const response = await this.sendRequest({ id: 0, type: "query", sql, params });
-    if (response.type === "error") {
-      throw new AdapterError(`Query failed: ${response.message}`, { sql, params });
+    const release = await this.mutex.acquire();
+    try {
+      const response = await this.sendRequest(
+        {
+          id: 0,
+          type: "query",
+          sql,
+          params,
+          ...options?.requestId ? { requestId: options.requestId } : {}
+        },
+        options?.signal ? { signal: options.signal } : void 0
+      );
+      if (response.type === "error") {
+        throw new AdapterError(`Query failed: ${response.message}`, { sql, params });
+      }
+      return response.data ?? [];
+    } finally {
+      release();
     }
-    return response.data ?? [];
   }
   async transaction(fn) {
     this.guardOpen();
+    this.guardDurableWrite();
     const release = await this.mutex.acquire();
+    let txBridge = null;
+    const sendInSpan = async (request) => {
+      if (txBridge === null || this.bridge !== txBridge) {
+        throw new BridgeTerminatedError(request.type, "storage leader changed during transaction");
+      }
+      return txBridge.send(request);
+    };
     try {
-      await this.sendChecked({ id: 0, type: "begin" }, "BEGIN transaction");
+      while (this.gate) {
+        await this.gate.promise;
+      }
+      txBridge = this.bridge;
+      if (!txBridge) throw new StoreNotOpenError();
+      const begin = await sendInSpan({ id: 0, type: "begin" });
+      if (begin.type === "error") {
+        throw new AdapterError(`BEGIN transaction failed: ${begin.message}`);
+      }
       const tx = {
         execute: async (sql, params) => {
-          const response = await this.sendRequest({ id: 0, type: "execute", sql, params });
+          const response = await sendInSpan({ id: 0, type: "execute", sql, params });
           if (response.type === "error") {
             throw new AdapterError(`Transaction execute failed: ${response.message}`, {
               sql,
@@ -911,7 +1624,7 @@ var SqliteWasmAdapter = class {
           }
         },
         query: async (sql, params) => {
-          const response = await this.sendRequest({ id: 0, type: "query", sql, params });
+          const response = await sendInSpan({ id: 0, type: "query", sql, params });
           if (response.type === "error") {
             throw new AdapterError(`Transaction query failed: ${response.message}`, { sql, params });
           }
@@ -919,10 +1632,15 @@ var SqliteWasmAdapter = class {
         }
       };
       await fn(tx);
-      await this.sendChecked({ id: 0, type: "commit" }, "COMMIT transaction");
+      const commit = await sendInSpan({ id: 0, type: "commit" });
+      if (commit.type === "error") {
+        throw new AdapterError(`COMMIT transaction failed: ${commit.message}`);
+      }
     } catch (error) {
       try {
-        await this.sendRequest({ id: 0, type: "rollback" });
+        if (txBridge && this.bridge === txBridge) {
+          await txBridge.send({ id: 0, type: "rollback" });
+        }
       } catch {
       }
       throw error;
@@ -932,6 +1650,7 @@ var SqliteWasmAdapter = class {
   }
   async migrate(from, to, migration) {
     this.guardOpen();
+    this.guardDurableWrite();
     const release = await this.mutex.acquire();
     try {
       await this.sendChecked({ id: 0, type: "begin" }, "BEGIN migration");
@@ -965,36 +1684,50 @@ var SqliteWasmAdapter = class {
    */
   async exportDatabase() {
     this.guardOpen();
-    const response = await this.sendRequest({ id: 0, type: "export" });
-    if (response.type === "error") {
-      throw new AdapterError(`Export failed: ${response.message}`, {
-        code: response.code,
-        context: response.context
-      });
+    const release = await this.mutex.acquire();
+    try {
+      const response = await this.sendRequest({ id: 0, type: "export" });
+      if (response.type === "error") {
+        throw new AdapterError(`Export failed: ${response.message}`, {
+          code: response.code,
+          context: response.context
+        });
+      }
+      return response.data;
+    } finally {
+      release();
     }
-    return response.data;
   }
   /**
    * Import a serialized database snapshot.
    */
   async importDatabase(data) {
     this.guardOpen();
-    const response = await this.sendRequest({ id: 0, type: "import", data });
-    if (response.type === "error") {
-      throw new AdapterError(`Import failed: ${response.message}`);
+    this.guardDurableWrite();
+    const release = await this.mutex.acquire();
+    try {
+      const response = await this.sendRequest({ id: 0, type: "import", data });
+      if (response.type === "error") {
+        throw new AdapterError(`Import failed: ${response.message}`);
+      }
+    } finally {
+      release();
     }
   }
   guardOpen() {
-    if (!this.opened || !this.bridge) {
+    if (!this.opened || !this.bridge && !this.gate) {
       throw new StoreNotOpenError();
     }
   }
-  async sendRequest(request) {
+  async sendRequest(request, options) {
+    while (this.gate) {
+      await this.gate.promise;
+    }
     const bridge = this.bridge;
     if (!bridge) {
       throw new StoreNotOpenError();
     }
-    return bridge.send(request);
+    return bridge.send(request, void 0, options);
   }
   async sendChecked(request, description) {
     const response = await this.sendRequest(request);
@@ -1003,6 +1736,34 @@ var SqliteWasmAdapter = class {
     }
   }
 };
+async function runWorkerTransaction(worker, fn) {
+  const send = async (request, what) => {
+    const response = await worker.send(request);
+    if (response.type === "error") {
+      throw new AdapterError(`${what} failed: ${response.message}`, {
+        code: response.code,
+        ...request.type === "execute" || request.type === "query" ? { sql: request.sql } : {}
+      });
+    }
+    return response;
+  };
+  await send({ id: 0, type: "begin" }, "BEGIN");
+  try {
+    await fn({
+      execute: async (sql, params) => {
+        await send({ id: 0, type: "execute", sql, params }, "Leader open execute");
+      },
+      query: async (sql, params) => {
+        const response = await send({ id: 0, type: "query", sql, params }, "Leader open query");
+        return response.data ?? [];
+      }
+    });
+    await send({ id: 0, type: "commit" }, "COMMIT");
+  } catch (error) {
+    await worker.send({ id: 0, type: "rollback" }).catch(() => void 0);
+    throw error;
+  }
+}
 function parseStorageOpenState(data) {
   if (typeof data !== "object" || data === null) {
     return null;
@@ -1014,162 +1775,12 @@ function parseStorageOpenState(data) {
   return {
     persistent: mode.persistent,
     mode: mode.persistent ? "opfs" : "memory",
-    ...mode.fallbackReason ? { fallbackReason: mode.fallbackReason } : {}
+    ...mode.fallbackReason ? { fallbackReason: mode.fallbackReason } : {},
+    ...typeof mode.poolName === "string" ? { poolName: mode.poolName } : {},
+    ...typeof mode.journalMode === "string" ? { journalMode: mode.journalMode } : {}
   };
 }
 
-// src/adapters/sqlite-wasm-persistence.ts
-init_errors();
-var IDB_DATABASE_NAME = "kora-persistence";
-var IDB_STORE_NAME = "databases";
-var IDB_VERSION = 1;
-var DUMP_SUFFIX = "::dump";
-function isIndexedDbQuotaError(error) {
-  if (error instanceof DOMException && error.name === "QuotaExceededError") {
-    return true;
-  }
-  if (error instanceof PersistenceError && error.context?.quotaExceeded === true) {
-    return true;
-  }
-  if (error instanceof Error && /quota/i.test(error.message)) {
-    return true;
-  }
-  return false;
-}
-function rejectWithIdbError(reject, message, context, event) {
-  const domError = event.target?.error;
-  if (domError && isIndexedDbQuotaError(domError)) {
-    reject(
-      new PersistenceError(message, {
-        ...context,
-        quotaExceeded: true,
-        cause: domError.message
-      })
-    );
-    return;
-  }
-  reject(new PersistenceError(message, context));
-}
-function openIdb() {
-  return new Promise((resolve, reject) => {
-    const request = indexedDB.open(IDB_DATABASE_NAME, IDB_VERSION);
-    request.onupgradeneeded = () => {
-      const db = request.result;
-      if (!db.objectStoreNames.contains(IDB_STORE_NAME)) {
-        db.createObjectStore(IDB_STORE_NAME);
-      }
-    };
-    request.onsuccess = () => resolve(request.result);
-    request.onerror = () => reject(
-      new PersistenceError(
-        `Failed to open IndexedDB: ${request.error?.message ?? "unknown error"}`,
-        { database: IDB_DATABASE_NAME }
-      )
-    );
-  });
-}
-async function saveToIndexedDB(dbName, data) {
-  const idb = await openIdb();
-  try {
-    await new Promise((resolve, reject) => {
-      const tx = idb.transaction(IDB_STORE_NAME, "readwrite");
-      const store = tx.objectStore(IDB_STORE_NAME);
-      store.put(data, dbName);
-      tx.oncomplete = () => resolve();
-      tx.onerror = (event) => rejectWithIdbError(
-        reject,
-        `Failed to save database "${dbName}" to IndexedDB`,
-        { dbName },
-        event
-      );
-    });
-  } finally {
-    idb.close();
-  }
-}
-async function saveDumpToIndexedDB(dbName, dump) {
-  const idb = await openIdb();
-  try {
-    await new Promise((resolve, reject) => {
-      const tx = idb.transaction(IDB_STORE_NAME, "readwrite");
-      const store = tx.objectStore(IDB_STORE_NAME);
-      store.put(dump, `${dbName}${DUMP_SUFFIX}`);
-      tx.oncomplete = () => resolve();
-      tx.onerror = (event) => rejectWithIdbError(
-        reject,
-        `Failed to save dump for database "${dbName}"`,
-        { dbName },
-        event
-      );
-    });
-  } finally {
-    idb.close();
-  }
-}
-async function loadFromIndexedDB(dbName) {
-  const idb = await openIdb();
-  try {
-    return await new Promise((resolve, reject) => {
-      const tx = idb.transaction(IDB_STORE_NAME, "readonly");
-      const store = tx.objectStore(IDB_STORE_NAME);
-      const request = store.get(dbName);
-      request.onsuccess = () => {
-        const result = request.result;
-        if (result instanceof Uint8Array) {
-          resolve(result);
-        } else if (result) {
-          resolve(new Uint8Array(result));
-        } else {
-          resolve(null);
-        }
-      };
-      request.onerror = () => reject(
-        new PersistenceError(`Failed to load database "${dbName}" from IndexedDB`, { dbName })
-      );
-    });
-  } finally {
-    idb.close();
-  }
-}
-async function loadDumpFromIndexedDB(dbName) {
-  const idb = await openIdb();
-  try {
-    return await new Promise((resolve, reject) => {
-      const tx = idb.transaction(IDB_STORE_NAME, "readonly");
-      const store = tx.objectStore(IDB_STORE_NAME);
-      const request = store.get(`${dbName}${DUMP_SUFFIX}`);
-      request.onsuccess = () => {
-        resolve(request.result ?? null);
-      };
-      request.onerror = () => reject(
-        new PersistenceError(`Failed to load dump for database "${dbName}" from IndexedDB`, {
-          dbName
-        })
-      );
-    });
-  } finally {
-    idb.close();
-  }
-}
-async function deleteSnapshotFromIndexedDB(dbName) {
-  const idb = await openIdb();
-  try {
-    await new Promise((resolve, reject) => {
-      const tx = idb.transaction(IDB_STORE_NAME, "readwrite");
-      const store = tx.objectStore(IDB_STORE_NAME);
-      store.delete(dbName);
-      tx.oncomplete = () => resolve();
-      tx.onerror = () => reject(
-        new PersistenceError(`Failed to delete database snapshot "${dbName}" from IndexedDB`, {
-          dbName
-        })
-      );
-    });
-  } finally {
-    idb.close();
-  }
-}
-
 // src/adapters/indexeddb-adapter.ts
 var IndexedDbAdapter = class {
   inner;
@@ -1177,14 +1788,29 @@ var IndexedDbAdapter = class {
   emitter;
   scheduler;
   storageOpenState = null;
+  options;
+  /** True in browsers (a real worker), where the backend choice is recorded. */
+  usesRealWorker;
   constructor(options = {}) {
+    this.options = options;
     this.dbName = options.dbName ?? "kora-db";
     this.emitter = options.emitter;
+    this.usesRealWorker = !options.bridge && options.workerUrl !== void 0;
     this.inner = new SqliteWasmAdapter({
       bridge: options.bridge,
       workerUrl: options.workerUrl,
       dbName: this.dbName,
-      workerResponseTimeoutMs: options.workerResponseTimeoutMs
+      workerResponseTimeoutMs: options.workerResponseTimeoutMs,
+      // The inner SQLite database is in memory by design: this adapter makes it
+      // durable by persisting snapshots to IndexedDB, so the inner adapter must
+      // not refuse writes as non-durable, and must never touch OPFS (which would
+      // create a second, disjoint copy of the data).
+      allowNonDurable: true,
+      storage: "memory",
+      skipBackendRecord: true,
+      // A browser leader restores the snapshot into its own fresh worker database
+      // before serving other tabs (first open and promotion, STORE-6).
+      onLeaderWorkerOpened: (tx) => this.restoreDumpIfFresh(tx)
     });
     this.scheduler = new IndexedDbPersistenceScheduler({
       debounceMs: options.persistenceDebounceMs,
@@ -1193,19 +1819,91 @@ var IndexedDbAdapter = class {
     });
   }
   async open(schema) {
+    const tracksBackend = this.usesRealWorker && isManifestAvailable();
+    const recorded = tracksBackend ? await readManifestRecord(this.dbName).catch(() => null) : null;
+    const carried = recorded?.backend === "opfs" ? await this.readOpfsCopy(schema) : null;
     await this.inner.open(schema);
     this.storageOpenState = { persistent: true, mode: "indexeddb" };
-    const persisted = await loadFromIndexedDB(this.dbName);
-    if (!persisted) {
-      await this.restoreFromDumpFallback();
+    if (carried && this.inner.isLeader()) {
+      await this.inner.transaction(async (tx) => {
+        await markRestored(tx);
+      });
+      await this.applyDump(carried);
+      await this.scheduler.flushNow();
+      await recordDatabase({ dbName: this.dbName, backend: "indexeddb" });
+      this.emitter?.emit({
+        type: "store:storage-migrated",
+        dbName: this.dbName,
+        from: "opfs",
+        to: "indexeddb",
+        message: `Database "${this.dbName}" moved from OPFS into IndexedDB because OPFS is not usable in this session.`
+      });
       return;
     }
+    if (this.inner.isLeader()) {
+      await this.restoreIfFresh();
+    }
+    const stored = storedSchemaVersion(
+      await this.inner.query(STORED_SCHEMA_VERSION_SQL)
+    );
+    if (stored > schema.version) {
+      this.scheduler.dispose();
+      await this.inner.close().catch(() => void 0);
+      throw new SchemaVersionAheadError(this.dbName, stored, schema.version);
+    }
+    if (tracksBackend) {
+      await recordDatabase({ dbName: this.dbName, backend: "indexeddb" }).catch(
+        (error) => console.warn(`[kora] Could not record the storage backend of "${this.dbName}":`, error)
+      );
+    }
+  }
+  /**
+   * Read the OPFS copy of this database through a short-lived SQLite WASM
+   * adapter (as leader, or as a follower of a tab that has it open). Refuses
+   * loudly when OPFS cannot be read, instead of starting an empty copy.
+   */
+  async readOpfsCopy(schema) {
+    const reader = new SqliteWasmAdapter({
+      dbName: this.dbName,
+      workerUrl: this.options.workerUrl,
+      workerResponseTimeoutMs: this.options.workerResponseTimeoutMs,
+      skipBackendRecord: true,
+      releaseOnFreeze: false
+    });
     try {
-      await this.inner.importDatabase(persisted);
-    } catch {
-      await this.restoreFromDumpFallback();
+      await reader.open(schema);
+      if (reader.getStorageOpenState()?.persistent !== true) {
+        throw new StorageBackendMismatchError(
+          this.dbName,
+          "OPFS",
+          "IndexedDB",
+          `OPFS reported ${reader.getStorageOpenState()?.fallbackReason ?? "no durable storage"}`
+        );
+      }
+      let dump = { tables: [] };
+      await reader.transaction(async (tx) => {
+        dump = await exportDump((sql, params) => tx.query(sql, params));
+      });
+      return dump;
+    } catch (error) {
+      if (error instanceof StorageBackendMismatchError) throw error;
+      throw new StorageBackendMismatchError(
+        this.dbName,
+        "OPFS",
+        "IndexedDB",
+        error instanceof Error ? error.message : String(error)
+      );
+    } finally {
+      await reader.close().catch(() => void 0);
     }
   }
+  async applyDump(dump) {
+    await this.inner.transaction(async (tx) => {
+      for (const statement of restoreDumpStatements(dump)) {
+        await tx.execute(statement.sql, statement.params);
+      }
+    });
+  }
   async close() {
     await this.scheduler.flushNow();
     this.scheduler.dispose();
@@ -1236,6 +1934,15 @@ var IndexedDbAdapter = class {
   async flushPersistence() {
     await this.scheduler.flushNow();
   }
+  /**
+   * Durability barrier (RT-35): resolves once every write committed before the call is
+   * in a snapshot persisted to IndexedDB, and rejects when the snapshot cannot be
+   * written. Sync calls it before an operation leaves the device, so the server never
+   * holds an operation this device could lose on reload.
+   */
+  async ensureDurable() {
+    await this.scheduler.flushBarrier();
+  }
   async writeSnapshot() {
     const dump = await this.exportDump();
     await saveDumpToIndexedDB(this.dbName, dump);
@@ -1267,59 +1974,58 @@ var IndexedDbAdapter = class {
       code: quotaExceeded ? "QUOTA_EXCEEDED" : code
     });
   }
-  async restoreFromDumpFallback() {
-    const dump = await loadDumpFromIndexedDB(this.dbName);
-    if (!dump) return;
-    for (const table of dump.tables) {
-      const name = ensureSafeIdentifier(table.name);
-      await this.inner.execute(`DELETE FROM ${(0, import_core3.quoteIdent)(name)}`);
-      if (table.rows.length === 0) continue;
-      for (const row of table.rows) {
-        const columns = table.columns.filter(
-          (column) => Object.prototype.hasOwnProperty.call(row, column)
-        );
-        if (columns.length === 0) continue;
-        const placeholders = columns.map(() => "?").join(", ");
-        const quotedColumns = columns.map((column) => (0, import_core3.quoteIdent)(ensureSafeIdentifier(column))).join(", ");
-        const values = columns.map((column) => row[column]);
-        await this.inner.execute(
-          `INSERT INTO ${(0, import_core3.quoteIdent)(name)} (${quotedColumns}) VALUES (${placeholders})`,
-          values
-        );
+  /**
+   * Restore the persisted snapshot into the worker database unless one was restored
+   * into it already (this adapter or another one sharing the worker). The binary
+   * snapshot (Node / test workers that support export) is imported whole; the JSON dump
+   * (browsers) is restored in one transaction.
+   */
+  async restoreIfFresh() {
+    const persisted = await loadFromIndexedDB(this.dbName);
+    if (persisted) {
+      const fresh = { value: false };
+      await this.inner.transaction(async (tx) => {
+        fresh.value = !await isRestored(tx);
+      });
+      if (!fresh.value) return;
+      try {
+        await this.inner.importDatabase(persisted);
+        await this.inner.transaction(markRestored);
+        return;
+      } catch {
       }
     }
+    await this.inner.transaction((tx) => this.restoreDumpIfFresh(tx));
   }
-  async exportDump() {
-    const tableRows = await this.inner.query(
-      "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'"
-    );
-    const tables = [];
-    for (const tableRow of tableRows) {
-      const tableName = ensureSafeIdentifier(tableRow.name);
-      const columns = await this.inner.query(
-        `PRAGMA table_info(${(0, import_core3.quoteIdent)(tableName)})`
-      );
-      const columnNames = columns.map((column) => column.name);
-      const rows = await this.inner.query(
-        `SELECT * FROM ${(0, import_core3.quoteIdent)(tableName)}`
-      );
-      tables.push({
-        name: tableName,
-        columns: columnNames,
-        rows
-      });
+  /** In `tx`: restore the JSON dump when no snapshot was restored into this database. */
+  async restoreDumpIfFresh(tx) {
+    if (await isRestored(tx)) return;
+    await markRestored(tx);
+    const dump = await loadDumpFromIndexedDB(this.dbName);
+    if (!dump) return;
+    for (const statement of restoreDumpStatements(dump)) {
+      await tx.execute(statement.sql, statement.params);
     }
-    return { tables };
   }
-};
-function ensureSafeIdentifier(identifier) {
-  if (!/^[a-zA-Z0-9_]+$/.test(identifier)) {
-    throw new PersistenceError(`Unsafe SQL identifier: ${identifier}`, {
-      code: "UNSAFE_IDENTIFIER",
-      identifier
+  /** A consistent snapshot: every table is read inside one transaction (STORE-7). */
+  async exportDump() {
+    let dump = { tables: [] };
+    await this.inner.transaction(async (tx) => {
+      dump = await exportDump((sql, params) => tx.query(sql, params));
     });
+    return dump;
   }
-  return identifier;
+};
+var RESTORED_MARKER = "_kora_idb_restored";
+async function isRestored(tx) {
+  const rows = await tx.query(
+    "SELECT name FROM sqlite_temp_master WHERE type = 'table' AND name = ?",
+    [RESTORED_MARKER]
+  );
+  return rows.length > 0;
+}
+async function markRestored(tx) {
+  await tx.execute(`CREATE TEMP TABLE IF NOT EXISTS ${RESTORED_MARKER} (restored INTEGER)`);
 }
 function isUnsupportedWorkerExport(error) {
   return error instanceof AdapterError && error.context?.code === "EXPORT_NOT_SUPPORTED";