@sekiban/dcb-runtime 0.2.0

package/dist/store/D1EventStore.js

@@ -0,0 +1,1111 @@
+import { decayedLagEstimateMs } from "../safeWindow";
+import { appendG69AdmissionAttempt } from "../diagnostics/G69AdmissionAttempt";
+import { resolveDeliveryIdentity } from "../eventIdentity";
+import { assertSortableUniqueId } from "../allocator/SortableUniqueId";
+import { CANONICAL_UTC_TIMESTAMP_PATTERN, isRfc4122Uuid, isUuidV7, serializedEventMetadata } from "../eventRecord";
+import { CanonicalEventIdentityConflictError, } from "./types";
+/** A contradictory EventId identity is a typed fail-closed outcome. */
+export class D1IdentityConflictError extends CanonicalEventIdentityConflictError {
+    beforeMutation;
+    constructor(message, beforeMutation = false) {
+        super("d1", "", message);
+        this.name = "D1IdentityConflictError";
+        this.beforeMutation = beforeMutation;
+    }
+}
+function asString(value, name) {
+    if (typeof value !== "string")
+        throw new Error(`D1 ${name} was not a string`);
+    return value;
+}
+function nullableString(value, name) {
+    return value === null ? null : asString(value, name);
+}
+function asNumber(value, name) {
+    const number = typeof value === "number" ? value : Number(value);
+    if (!Number.isSafeInteger(number))
+        throw new Error(`D1 ${name} was not a safe integer`);
+    return number;
+}
+function errorText(error) {
+    return (error instanceof Error ? error.message : String(error)).slice(0, 256);
+}
+function sortedUnique(values) {
+    return [...new Set(values)].sort((left, right) => binaryCompare(left, right));
+}
+function equalStrings(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+/** Reject an envelope whose declared source facts cannot describe this tag copy. */
+function assertCompletenessEnvelope(message) {
+    const facts = message.completeness;
+    const declared = sortedUnique(message.eventTags);
+    if (!equalStrings(declared, sortedUnique(facts.declaredTagSet))) {
+        throw new D1IdentityConflictError(`EventId ${message.eventId} declared tag set differs from its source obligation`);
+    }
+    if (facts.localCommittedMembership.length !== 1) {
+        throw new D1IdentityConflictError(`EventId ${message.eventId} source obligation has no exact local membership`);
+    }
+    const membership = facts.localCommittedMembership[0];
+    if (membership.serviceId !== message.serviceId || membership.eventId !== message.eventId || membership.tag !== message.tag) {
+        throw new D1IdentityConflictError(`EventId ${message.eventId} source obligation membership differs from its delivery envelope`);
+    }
+}
+/** V1 SUIDs and path names are opaque bytewise ordinals, never locale/numeric values. */
+export function binaryCompare(left, right) {
+    const leftBytes = new TextEncoder().encode(left);
+    const rightBytes = new TextEncoder().encode(right);
+    const shared = Math.min(leftBytes.length, rightBytes.length);
+    for (let index = 0; index < shared; index += 1) {
+        const difference = leftBytes[index] - rightBytes[index];
+        if (difference !== 0)
+            return difference;
+    }
+    return leftBytes.length - rightBytes.length;
+}
+function asStringArray(value, name) {
+    const decoded = typeof value === "string" ? JSON.parse(value) : value;
+    if (!Array.isArray(decoded) || !decoded.every((entry) => typeof entry === "string")) {
+        throw new Error(`D1 ${name} was not a string array`);
+    }
+    return [...decoded];
+}
+function eventFrom(row, arrivals) {
+    const serviceId = asString(row.service_id, "service_id");
+    const eventId = asString(row.event_id, "event_id");
+    const tags = asStringArray(row.event_tags, "event_tags");
+    return {
+        serviceId,
+        id: eventId,
+        eventId,
+        sortableUniqueId: asString(row.suid, "suid"),
+        suid: asString(row.suid, "suid"),
+        payload: asString(row.payload, "payload"),
+        tags,
+        eventTags: tags,
+        eventType: asString(row.event_type, "event_type"),
+        timestamp: asString(row.timestamp, "timestamp"),
+        causationId: nullableString(row.causation_id, "causation_id"),
+        correlationId: nullableString(row.correlation_id, "correlation_id"),
+        executedUser: nullableString(row.executed_user, "executed_user"),
+        provenance: "g32",
+        ...(typeof row.event_digest === "string" && row.event_digest.length > 0 ? { eventDigest: row.event_digest } : {}),
+        firstArrivedAt: asNumber(row.first_arrived_at, "first_arrived_at"),
+        lastArrivedAt: asNumber(row.last_arrived_at, "last_arrived_at"),
+        maxDeliveryLagMs: asNumber(row.max_delivery_lag_ms, "max_delivery_lag_ms"),
+        arrivals: arrivals.map((arrival) => ({
+            serviceId: asString(arrival.service_id, "arrival.service_id"),
+            eventId: asString(arrival.event_id, "arrival.event_id"),
+            tag: asString(arrival.tag, "arrival.tag"),
+            enqueuedAt: asNumber(arrival.enqueued_at, "arrival.enqueued_at"),
+            arrivedAt: asNumber(arrival.arrived_at, "arrival.arrived_at"),
+            lagMs: asNumber(arrival.lag_ms, "arrival.lag_ms"),
+        })),
+    };
+}
+function pendingFrom(row) {
+    return {
+        serviceId: asString(row.service_id, "service_id"),
+        eventId: asString(row.event_id, "event_id"),
+        attemptId: asString(row.attempt_id, "attempt_id"),
+        suid: asString(row.suid, "suid"),
+        expectedPaths: asStringArray(row.expected_paths, "expected_paths"),
+        observedPaths: asStringArray(row.observed_paths, "observed_paths"),
+        firstObservedAt: asNumber(row.first_observed_at, "first_observed_at"),
+        lagBoundMs: asNumber(row.lag_bound_ms, "lag_bound_ms"),
+    };
+}
+function findingFrom(row) {
+    const classification = asString(row.classification, "classification");
+    if (classification !== "MISSING_STABLE" && classification !== "EXCLUDED_AUDITED" && classification !== "RESOLVED_LATE") {
+        throw new Error("D1 finding classification was invalid");
+    }
+    return {
+        serviceId: asString(row.service_id, "service_id"),
+        eventId: asString(row.event_id, "event_id"),
+        path: asString(row.path, "path"),
+        classification,
+        firstObservedAt: asNumber(row.first_observed_at, "first_observed_at"),
+        lagBoundMs: asNumber(row.lag_bound_ms, "lag_bound_ms"),
+        observedAt: asNumber(row.observed_at, "observed_at"),
+    };
+}
+function incidentClassification(value) {
+    const classification = asString(value, "classification");
+    if (classification !== "SUID_COLLISION" && classification !== "ORDER_VIOLATION" && classification !== "LINEAGE_MISMATCH" && classification !== "ORDERING_DETECTOR_UNKNOWN") {
+        throw new Error("D1 delivery incident classification was invalid");
+    }
+    return classification;
+}
+function optionalString(value, name) {
+    if (value === null || value === undefined)
+        return undefined;
+    return asString(value, name);
+}
+function incidentFrom(row) {
+    return {
+        serviceId: asString(row.service_id, "service_id"),
+        identityKey: asString(row.identity_key, "identity_key"),
+        classification: incidentClassification(row.classification),
+        suid: optionalString(row.suid, "suid"),
+        existingEventId: optionalString(row.existing_event_id, "existing_event_id"),
+        incomingEventId: optionalString(row.incoming_event_id, "incoming_event_id"),
+        eventId: optionalString(row.event_id, "event_id"),
+        boundLineageId: optionalString(row.bound_lineage_id, "bound_lineage_id"),
+        incomingLineageId: optionalString(row.incoming_lineage_id, "incoming_lineage_id"),
+        observedAt: asNumber(row.observed_at, "observed_at"),
+    };
+}
+function checkpointFrom(row) {
+    return {
+        serviceId: asString(row.service_id, "service_id"),
+        projectionId: asString(row.projection_id, "projection_id"),
+        lastSuid: asString(row.last_suid, "last_suid"),
+        stateJson: asString(row.state_json, "state_json"),
+        version: asNumber(row.version, "version"),
+        updatedAt: asNumber(row.updated_at, "updated_at"),
+    };
+}
+function collisionIdentity(serviceId, suid, existingEventId, incomingEventId) {
+    const [first, second] = [existingEventId, incomingEventId].sort(binaryCompare);
+    return `SUID_COLLISION|${serviceId}|${suid}|${first}|${second}`;
+}
+function lineageIdentity(serviceId, boundLineageId, incomingLineageId) {
+    return `LINEAGE_MISMATCH|${serviceId}|${boundLineageId}|${incomingLineageId}`;
+}
+function jsonArray(values) {
+    return JSON.stringify(sortedUnique(values));
+}
+/** Normal delivery has fixed serialized metadata; the fenced import lane may retain C# nulls. */
+function metadataForDelivery(message, deliverySource) {
+    const serialized = serializedEventMetadata(message.eventId);
+    if (deliverySource !== "import") {
+        if (message.causationId !== serialized.causationId ||
+            message.correlationId !== serialized.correlationId ||
+            message.executedUser !== serialized.executedUser) {
+            throw new D1IdentityConflictError(`EventId ${message.eventId} metadata must use the serialized C# constants`);
+        }
+        return serialized;
+    }
+    const values = [message.causationId, message.correlationId, message.executedUser];
+    if (!values.every((value) => value === null || typeof value === "string")) {
+        throw new D1IdentityConflictError(`EventId ${message.eventId} import metadata must be string or null`);
+    }
+    const allNull = values.every((value) => value === null);
+    const allSerialized = message.causationId === serialized.causationId &&
+        message.correlationId === serialized.correlationId && message.executedUser === serialized.executedUser;
+    if (!allNull && !allSerialized) {
+        throw new D1IdentityConflictError(`EventId ${message.eventId} import metadata must be all null or serialized constants`);
+    }
+    return {
+        causationId: message.causationId,
+        correlationId: message.correlationId,
+        executedUser: message.executedUser,
+    };
+}
+/**
+ * Cloudflare D1 PipelineStore implementation.
+ *
+ * All schema changes live in migrations/d1. Writes that span several tables
+ * are one predeclared D1 batch; there is no interactive transaction or
+ * TypeScript read/branch between statements in the durable mutation.
+ */
+export class D1EventStore {
+    database;
+    options;
+    initialized = false;
+    constructor(database, options = {}) {
+        this.database = database;
+        this.options = options;
+    }
+    async initialize() {
+        if (this.initialized)
+            return;
+        // A read verifies the binding without attempting runtime DDL. The
+        // versioned migration is the only schema authority.
+        await this.database.prepare("SELECT 1 AS migration_binding").all();
+        this.initialized = true;
+    }
+    async recordDelivery(message, arrivedAt, deliverySource = "queue", attemptContext) {
+        this.ready();
+        const mutationAttemptId = `admission-${crypto.randomUUID()}`;
+        let result;
+        let failure;
+        try {
+            result = await this.recordDeliveryCore(message, arrivedAt, deliverySource, mutationAttemptId);
+        }
+        catch (error) {
+            failure = { error };
+        }
+        const retryReason = failure === undefined ? null : errorText(failure.error);
+        // A canonical identity rejection is a complete fail-before-batch
+        // boundary: not even diagnostic-table INSERT/trim work may be scheduled
+        // for this invocation. Other outcomes retain the diagnostic-only receipt,
+        // but it remains outside the awaited delivery turn and invocation-owned.
+        const suppressDiagnostic = failure?.error instanceof D1IdentityConflictError && failure.error.beforeMutation;
+        if (!suppressDiagnostic) {
+            const diagnostic = Promise.resolve().then(() => this.bestEffortG69AdmissionAttempt(message, arrivedAt, deliverySource, attemptContext, mutationAttemptId, result, failure, retryReason));
+            if (attemptContext?.waitUntil !== undefined)
+                attemptContext.waitUntil(diagnostic);
+            else
+                void diagnostic;
+        }
+        if (failure !== undefined)
+            throw failure.error;
+        return result;
+    }
+    async recordDeliveryCore(message, arrivedAt, deliverySource = "queue", mutationAttemptId = `admission-${crypto.randomUUID()}`) {
+        this.ready();
+        // G44 source facts belong to a Tag outbox obligation.  The fenced G22
+        // bootstrap import path has no Tag source partition to acknowledge, so it
+        // must not manufacture a receipt or turn an import record into scanner
+        // authority.  Normal Queue/fast delivery remains fail-closed on the full
+        // source envelope.
+        const requiresGlobalReceipt = deliverySource !== "import";
+        if (requiresGlobalReceipt)
+            assertCompletenessEnvelope(message);
+        const identity = resolveDeliveryIdentity(message, deliverySource);
+        assertSortableUniqueId(message.suid);
+        const acceptsImportedId = deliverySource === "import";
+        if (!(acceptsImportedId ? isRfc4122Uuid(message.eventId) : isUuidV7(message.eventId))) {
+            throw new D1IdentityConflictError(`EventId ${message.eventId} is not an ${acceptsImportedId ? "RFC 4122 UUID" : "UUID v7"}`);
+        }
+        try {
+            JSON.parse(message.payload);
+        }
+        catch {
+            throw new D1IdentityConflictError(`EventId ${message.eventId} payload is not JSON text`);
+        }
+        const timestamp = message.timestamp ?? new Date(arrivedAt).toISOString();
+        // C# DateTimeOffset's round-trip representation carries seven fractional
+        // digits.  Values authored by the TS commit worker use milliseconds, but
+        // imported C# records must retain their exact UTC representation too.
+        if (!CANONICAL_UTC_TIMESTAMP_PATTERN.test(timestamp)) {
+            throw new D1IdentityConflictError(`EventId ${message.eventId} timestamp is not canonical UTC ISO-8601`);
+        }
+        const metadata = metadataForDelivery(message, deliverySource);
+        // This is the pre-existing correctness preflight for canonical identity
+        // conflicts. It is not G69 diagnostic work: it must remain before the
+        // durable batch so a conflicting replay cannot write incidents, receipts,
+        // or event-arrival state.
+        const storedBefore = await this.eventById(message.serviceId, message.eventId);
+        const incomingEventType = identity.key;
+        const eventTags = [...message.eventTags];
+        const tagsJson = JSON.stringify(eventTags);
+        if (storedBefore !== undefined && (storedBefore.eventType !== incomingEventType ||
+            storedBefore.suid !== message.suid ||
+            storedBefore.payload !== message.payload ||
+            JSON.stringify(storedBefore.eventTags) !== tagsJson ||
+            (requiresGlobalReceipt && storedBefore.eventDigest !== undefined && storedBefore.eventDigest !== message.completeness.eventDigest) ||
+            storedBefore.timestamp !== timestamp ||
+            storedBefore.causationId !== metadata.causationId ||
+            storedBefore.correlationId !== metadata.correlationId ||
+            storedBefore.executedUser !== metadata.executedUser)) {
+            throw new D1IdentityConflictError(`EventId ${message.eventId} conflicts with its canonical event identity`, true);
+        }
+        const lagMs = Math.max(0, arrivedAt - message.enqueuedAt);
+        const statements = [
+            this.database.prepare(`INSERT INTO serialized_dcb_allocator_bindings (service_id, allocator_lineage_id, bound_at)
+         VALUES (?, ?, ?)
+         ON CONFLICT (service_id) DO NOTHING`).bind(message.serviceId, message.allocatorLineageId, arrivedAt),
+            // Binding mismatch is recorded in the same batch before any event path.
+            this.database.prepare(`INSERT INTO serialized_dcb_delivery_incidents
+           (service_id, identity_key, classification, bound_lineage_id, incoming_lineage_id, observed_at)
+         SELECT service_id,
+                'LINEAGE_MISMATCH|' || service_id || '|' || allocator_lineage_id || '|' || ?,
+                'LINEAGE_MISMATCH', allocator_lineage_id, ?, ?
+           FROM serialized_dcb_allocator_bindings
+          WHERE service_id = ? AND allocator_lineage_id <> ?
+         ON CONFLICT (service_id, identity_key) DO NOTHING`).bind(message.allocatorLineageId, message.allocatorLineageId, arrivedAt, message.serviceId, message.allocatorLineageId),
+            // G31 needs a target-SUID point gate even though a rejected lineage
+            // delivery has no dcb_events row. Keep this compact alias
+            // separate from the historical incident identity used by operators.
+            this.database.prepare(`INSERT INTO serialized_dcb_wait_target_incidents
+           (service_id, suid, classification, event_id, observed_at)
+         SELECT ?, ?, 'LINEAGE_MISMATCH', ?, ?
+          WHERE EXISTS (
+            SELECT 1 FROM serialized_dcb_allocator_bindings
+             WHERE service_id = ? AND allocator_lineage_id <> ?
+          )
+         ON CONFLICT (service_id, suid, classification) DO NOTHING`).bind(message.serviceId, message.suid, message.eventId, arrivedAt, message.serviceId, message.allocatorLineageId),
+            // SUID collision is a typed incident rather than a UNIQUE exception.
+            this.database.prepare(`INSERT INTO serialized_dcb_delivery_incidents
+           (service_id, identity_key, classification, suid, existing_event_id, incoming_event_id, observed_at)
+         SELECT "ServiceId",
+                'SUID_COLLISION|' || "ServiceId" || '|' || "SortableUniqueId" || '|' ||
+                  CASE WHEN "Id" < ? THEN "Id" ELSE ? END || '|' ||
+                  CASE WHEN "Id" < ? THEN ? ELSE "Id" END,
+                'SUID_COLLISION', "SortableUniqueId", "Id", ?, ?
+          FROM dcb_events
+          WHERE "ServiceId" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY AND "Id" <> ?
+            AND NOT EXISTS (
+              SELECT 1 FROM serialized_dcb_allocator_bindings
+               WHERE service_id = ? AND allocator_lineage_id <> ?
+            )
+          LIMIT 1
+         ON CONFLICT (service_id, identity_key) DO NOTHING`).bind(message.eventId, message.eventId, message.eventId, message.eventId, message.eventId, arrivedAt, message.serviceId, message.suid, message.eventId, message.serviceId, message.allocatorLineageId),
+            this.database.prepare(`INSERT INTO serialized_dcb_wait_target_incidents
+           (service_id, suid, classification, event_id, observed_at)
+         SELECT ?, ?, 'SUID_COLLISION', ?, ?
+          WHERE EXISTS (
+          SELECT 1 FROM dcb_events
+             WHERE "ServiceId" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+               AND "Id" <> ?
+          )
+            AND NOT EXISTS (
+              SELECT 1 FROM serialized_dcb_allocator_bindings
+               WHERE service_id = ? AND allocator_lineage_id <> ?
+            )
+         ON CONFLICT (service_id, suid, classification) DO NOTHING`).bind(message.serviceId, message.suid, message.eventId, arrivedAt, message.serviceId, message.suid, message.eventId, message.serviceId, message.allocatorLineageId),
+            this.database.prepare(`INSERT INTO dcb_events
+           ("ServiceId", "Id", "SortableUniqueId", "EventType", "Payload", "Tags", "Timestamp", "CausationId", "CorrelationId", "ExecutedUser", "EventDigest")
+         SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+          WHERE NOT EXISTS (
+            SELECT 1 FROM serialized_dcb_allocator_bindings
+             WHERE service_id = ? AND allocator_lineage_id <> ?
+          )
+            AND NOT EXISTS (
+              SELECT 1 FROM dcb_events
+               WHERE "ServiceId" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY AND "Id" <> ?
+            )
+         ON CONFLICT ("ServiceId", "Id") DO NOTHING`).bind(message.serviceId, message.eventId, message.suid, incomingEventType, message.payload, tagsJson, timestamp, metadata.causationId, metadata.correlationId, metadata.executedUser, requiresGlobalReceipt ? message.completeness.eventDigest : null, message.serviceId, message.allocatorLineageId, message.serviceId, message.suid, message.eventId),
+            // Source discoverability is part of the same atomic global admission
+            // batch as the event, membership, and receipt.  A local Tag commit can
+            // therefore return without a D1 registry probe; until this batch
+            // succeeds, G44 has no source authority for the obligation and remains
+            // fail-closed.  Import delivery deliberately does not manufacture a
+            // Tag source partition.
+            this.database.prepare(`INSERT INTO serialized_dcb_source_partitions
+           (service_id, partition_tag, last_obligation_sequence, registered_at)
+         SELECT ?, ?, ?, ?
+          WHERE ? = 1 AND EXISTS (
+            SELECT 1 FROM dcb_events
+             WHERE "ServiceId" = ? AND "Id" = ? AND "EventDigest" = ?
+          )
+         ON CONFLICT (service_id, partition_tag) DO UPDATE
+           SET last_obligation_sequence = MAX(
+                 serialized_dcb_source_partitions.last_obligation_sequence,
+                 excluded.last_obligation_sequence
+               ),
+               registered_at = excluded.registered_at`).bind(message.serviceId, message.tag, message.completeness.obligationSequence, arrivedAt, requiresGlobalReceipt ? 1 : 0, message.serviceId, message.eventId, message.completeness.eventDigest),
+            // The global declared event, this tag-side committed membership, and
+            // the source-obligation receipt are one D1 atomic batch. A Queue ack or
+            // a receipt without this join never becomes source acknowledgement.
+            this.database.prepare(`INSERT INTO serialized_dcb_global_memberships
+           (service_id, event_id, partition_tag, event_digest, committed_at)
+         SELECT ?, ?, ?, ?, ?
+          WHERE ? = 1 AND EXISTS (
+            SELECT 1 FROM dcb_events
+             WHERE "ServiceId" = ? AND "Id" = ? AND "EventDigest" = ?
+          )
+         ON CONFLICT (service_id, event_id, partition_tag) DO NOTHING`).bind(message.serviceId, message.eventId, message.tag, message.completeness.eventDigest, arrivedAt, requiresGlobalReceipt ? 1 : 0, message.serviceId, message.eventId, message.completeness.eventDigest),
+            this.database.prepare(`INSERT INTO serialized_dcb_global_receipts
+           (service_id, partition_tag, obligation_sequence, event_id, event_digest, membership_tag, received_at)
+         SELECT ?, ?, ?, ?, ?, ?, ?
+          WHERE ? = 1 AND EXISTS (
+            SELECT 1 FROM serialized_dcb_global_memberships
+             WHERE service_id = ? AND event_id = ? AND partition_tag = ? AND event_digest = ?
+          )
+         ON CONFLICT (service_id, partition_tag, obligation_sequence) DO NOTHING`).bind(message.serviceId, message.tag, message.completeness.obligationSequence, message.eventId, message.completeness.eventDigest, message.tag, arrivedAt, requiresGlobalReceipt ? 1 : 0, message.serviceId, message.eventId, message.tag, message.completeness.eventDigest),
+            this.database.prepare(`INSERT INTO dcb_event_ops
+           ("ServiceId", "Id", "AttemptId", "FirstAdmissionAttemptId", "LastAdmissionAttemptId", "AllocatorLineageId", "FirstArrivedAt", "LastArrivedAt", "MaxDeliveryLagMs", "FirstArrivedSource", "LastArrivedSource")
+         SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+          WHERE EXISTS (
+            SELECT 1 FROM dcb_events
+             WHERE "ServiceId" = ? AND "Id" = ?
+               AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+               AND "Payload" = ? AND "EventType" = ? AND "Tags" = ?
+          )
+         ON CONFLICT ("ServiceId", "Id") DO UPDATE
+           SET "FirstArrivedAt" = MIN(dcb_event_ops."FirstArrivedAt", excluded."FirstArrivedAt"),
+               "LastArrivedAt" = MAX(dcb_event_ops."LastArrivedAt", excluded."LastArrivedAt"),
+               "MaxDeliveryLagMs" = MAX(dcb_event_ops."MaxDeliveryLagMs", excluded."MaxDeliveryLagMs"),
+               "FirstAdmissionAttemptId" = COALESCE(dcb_event_ops."FirstAdmissionAttemptId", excluded."FirstAdmissionAttemptId"),
+               "LastAdmissionAttemptId" = excluded."LastAdmissionAttemptId",
+               "FirstArrivedSource" = dcb_event_ops."FirstArrivedSource",
+               "LastArrivedSource" = CASE
+                 WHEN excluded."LastArrivedAt" > dcb_event_ops."LastArrivedAt" THEN excluded."LastArrivedSource"
+                 ELSE dcb_event_ops."LastArrivedSource"
+               END`).bind(message.serviceId, message.eventId, message.attemptId, mutationAttemptId, mutationAttemptId, message.allocatorLineageId, arrivedAt, arrivedAt, lagMs, deliverySource, deliverySource, message.serviceId, message.eventId, message.suid, message.payload, incomingEventType, tagsJson),
+            this.database.prepare(`INSERT INTO serialized_dcb_event_arrivals
+           (service_id, event_id, tag, enqueued_at, arrived_at, lag_ms)
+         SELECT ?, ?, ?, ?, ?, ?
+          WHERE EXISTS (
+            SELECT 1 FROM dcb_events
+             WHERE "ServiceId" = ? AND "Id" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+               AND "Payload" = ? AND "EventType" = ? AND "Tags" = ?
+          )
+            AND NOT EXISTS (
+              SELECT 1 FROM serialized_dcb_allocator_bindings
+               WHERE service_id = ? AND allocator_lineage_id <> ?
+            )
+            AND NOT EXISTS (
+              SELECT 1 FROM dcb_events collision
+               WHERE collision."ServiceId" = ? AND collision."SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+                 AND collision."Id" <> ?
+            )
+         ON CONFLICT (service_id, event_id, tag) DO UPDATE
+           SET enqueued_at = MIN(serialized_dcb_event_arrivals.enqueued_at, excluded.enqueued_at),
+               arrived_at = MAX(serialized_dcb_event_arrivals.arrived_at, excluded.arrived_at),
+               lag_ms = MAX(serialized_dcb_event_arrivals.lag_ms, excluded.lag_ms)`).bind(message.serviceId, message.eventId, message.tag, message.enqueuedAt, arrivedAt, lagMs, message.serviceId, message.eventId, message.suid, message.payload, incomingEventType, tagsJson, message.serviceId, message.allocatorLineageId, message.serviceId, message.suid, message.eventId),
+            this.database.prepare(`INSERT INTO serialized_dcb_lag_estimates (service_id, estimate_ms, observed_at)
+         SELECT ?, ?, ?
+          WHERE ? = 'queue'
+            AND NOT EXISTS (
+            SELECT 1 FROM serialized_dcb_allocator_bindings
+             WHERE service_id = ? AND allocator_lineage_id <> ?
+          )
+            AND NOT EXISTS (
+            SELECT 1 FROM dcb_events collision
+               WHERE collision."ServiceId" = ? AND collision."SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+                 AND collision."Id" <> ?
+            )
+            AND NOT EXISTS (
+              SELECT 1 FROM dcb_events contradictory
+               WHERE contradictory."ServiceId" = ? AND contradictory."Id" = ?
+                 AND (contradictory."SortableUniqueId" COLLATE BINARY <> ? COLLATE BINARY
+                   OR contradictory."Payload" <> ? OR contradictory."EventType" <> ?
+                   OR contradictory."Tags" <> ?)
+            )
+            AND NOT EXISTS (
+              SELECT 1 FROM dcb_events prior
+               WHERE prior."ServiceId" = ? AND prior."SortableUniqueId" COLLATE BINARY > ? COLLATE BINARY
+            )
+         ON CONFLICT (service_id) DO UPDATE
+            SET estimate_ms = MAX(
+              MAX(serialized_dcb_lag_estimates.estimate_ms -
+                  MAX(0, excluded.observed_at - serialized_dcb_lag_estimates.observed_at), 0),
+              excluded.estimate_ms
+            ),
+                observed_at = excluded.observed_at`).bind(message.serviceId, lagMs, arrivedAt, deliverySource, message.serviceId, message.allocatorLineageId, message.serviceId, message.suid, message.eventId, message.serviceId, message.eventId, message.suid, message.payload, incomingEventType, tagsJson, message.serviceId, message.suid),
+        ];
+        await this.batch("recordDelivery", statements);
+        const binding = await this.lineageBinding(message.serviceId);
+        if (binding !== undefined && binding !== message.allocatorLineageId) {
+            const incident = await this.incidentByIdentity(message.serviceId, lineageIdentity(message.serviceId, binding, message.allocatorLineageId));
+            if (incident === undefined)
+                throw new Error("D1 lineage incident was not durable");
+            return { outcome: "lineage-mismatch", kind: "lineage-mismatch", incident };
+        }
+        const collision = await this.collisionEvent(message.serviceId, message.suid, message.eventId);
+        if (collision !== undefined) {
+            const identity = collisionIdentity(message.serviceId, message.suid, collision, message.eventId);
+            const incident = await this.incidentByIdentity(message.serviceId, identity);
+            if (incident === undefined)
+                throw new Error("D1 SUID collision incident was not durable");
+            return { outcome: "suid-collision", kind: "suid-collision", incident };
+        }
+        const stored = await this.eventById(message.serviceId, message.eventId);
+        if (stored === undefined)
+            throw new Error("D1 event delivery did not produce a durable row");
+        if (stored.suid !== message.suid ||
+            stored.payload !== message.payload ||
+            JSON.stringify(stored.eventTags) !== tagsJson ||
+            stored.eventType !== incomingEventType ||
+            (requiresGlobalReceipt && stored.eventDigest !== message.completeness.eventDigest) ||
+            stored.timestamp !== timestamp ||
+            stored.causationId !== metadata.causationId ||
+            stored.correlationId !== metadata.correlationId ||
+            stored.executedUser !== metadata.executedUser) {
+            throw new D1IdentityConflictError(`EventId ${message.eventId} conflicts with its durable D1 identity`);
+        }
+        if (requiresGlobalReceipt) {
+            const receipt = await this.readGlobalReceiptJoin(message);
+            if (receipt === undefined) {
+                throw new Error(`D1 event ${message.eventId} has no readable global receipt/membership join`);
+            }
+        }
+        // Mutation-owned admission evidence is diagnostic. It is read by the
+        // invocation-lifetime receipt after this core result is returned, never
+        // on the awaited delivery path. Without a pre-read, duplicate status is
+        // deliberately unverified here; the off-path receipt may classify it
+        // from mutation-owned attempt identities.
+        return {
+            outcome: "stored",
+            kind: "stored",
+            event: stored,
+            mutationEvidence: "unverified",
+        };
+    }
+    async readGlobalReceiptJoin(message) {
+        this.ready();
+        const row = await this.database.prepare(`SELECT receipt.service_id, receipt.partition_tag, receipt.obligation_sequence,
+              receipt.event_id, receipt.event_digest, receipt.membership_tag, receipt.received_at
+         FROM serialized_dcb_global_receipts AS receipt
+         JOIN serialized_dcb_global_memberships AS membership
+           ON membership.service_id = receipt.service_id
+          AND membership.event_id = receipt.event_id
+          AND membership.partition_tag = receipt.membership_tag
+          AND membership.event_digest = receipt.event_digest
+         JOIN dcb_events AS event
+           ON event."ServiceId" = receipt.service_id
+          AND event."Id" = receipt.event_id
+          AND event."EventDigest" = receipt.event_digest
+        WHERE receipt.service_id = ?
+          AND receipt.partition_tag = ?
+          AND receipt.obligation_sequence = ?
+          AND receipt.event_id = ?
+          AND receipt.event_digest = ?
+          AND receipt.membership_tag = ?`).bind(message.serviceId, message.tag, message.completeness.obligationSequence, message.eventId, message.completeness.eventDigest, message.tag).first();
+        if (row === null || row === undefined)
+            return undefined;
+        return {
+            serviceId: asString(row.service_id, "global_receipt.service_id"),
+            partitionTag: asString(row.partition_tag, "global_receipt.partition_tag"),
+            obligationSequence: asNumber(row.obligation_sequence, "global_receipt.obligation_sequence"),
+            eventId: asString(row.event_id, "global_receipt.event_id"),
+            eventDigest: asString(row.event_digest, "global_receipt.event_digest"),
+            membershipTag: asString(row.membership_tag, "global_receipt.membership_tag"),
+            receivedAt: asNumber(row.received_at, "global_receipt.received_at"),
+        };
+    }
+    async readAllEvents(serviceId, since) {
+        this.ready();
+        // The empty cursor is the internal "before the first event" sentinel.
+        // Every externally supplied cursor is a C#-shape SUID.
+        if (since.length !== 0)
+            assertSortableUniqueId(since);
+        const rows = await this.rows(`SELECT e."ServiceId" AS service_id, e."Id" AS event_id,
+              e."SortableUniqueId" AS suid, e."Payload" AS payload,
+              e."EventType" AS event_type, e."Tags" AS event_tags,
+              e."EventDigest" AS event_digest,
+              e."Timestamp" AS timestamp, e."CausationId" AS causation_id,
+              e."CorrelationId" AS correlation_id, e."ExecutedUser" AS executed_user,
+              COALESCE(o."FirstArrivedAt", 0) AS first_arrived_at,
+              COALESCE(o."LastArrivedAt", 0) AS last_arrived_at,
+              COALESCE(o."MaxDeliveryLagMs", 0) AS max_delivery_lag_ms
+         FROM dcb_events e LEFT JOIN dcb_event_ops o
+           ON o."ServiceId" = e."ServiceId" AND o."Id" = e."Id"
+        WHERE e."ServiceId" = ? AND e."SortableUniqueId" COLLATE BINARY > ? COLLATE BINARY
+        ORDER BY e."SortableUniqueId" COLLATE BINARY ASC, e."Id" COLLATE BINARY ASC`, serviceId, since);
+        return Promise.all(rows.map((row) => this.eventFromRow(row)));
+    }
+    /**
+     * G69 strict-order detector: find an event admitted after a projection
+     * checkpoint whose opaque SUID is lower than that checkpoint. A replay of
+     * an event already known before the checkpoint is deliberately excluded by
+     * FirstArrivedAt, so the detector reports new lower-SUID admission rather
+     * than ordinary Queue redelivery.
+     */
+    async findLateLowerSuid(serviceId, checkpointSuid, checkpointUpdatedAt) {
+        const evidence = await this.findLateLowerSuidEvidence(serviceId, checkpointSuid, checkpointUpdatedAt);
+        return evidence.kind === "late-lower-suid" ? evidence.event : undefined;
+    }
+    async findLateLowerSuidEvidence(serviceId, checkpointSuid, checkpointUpdatedAt, generation) {
+        const detectorStartedAt = Date.now();
+        const finish = (result) => ({ ...result, durationMs: Math.max(0, Date.now() - detectorStartedAt) });
+        this.ready();
+        // Generation ownership is enforced at the MV/quarantine boundary; the
+        // source evidence itself is generation-independent and must remain
+        // auditable across a generation transition. A malformed generation is
+        // still an untrusted clock/context observation, never a reason to open a
+        // quarantine.
+        if (generation !== undefined && (!Number.isSafeInteger(generation) || generation < 0)) {
+            return finish({ kind: "unknown", reason: "generation-invalid" });
+        }
+        if (checkpointSuid.length === 0)
+            return finish({ kind: "miss" });
+        if (!Number.isSafeInteger(checkpointUpdatedAt) || checkpointUpdatedAt < 0) {
+            return finish({ kind: "unknown", reason: "checkpoint-clock-invalid" });
+        }
+        try {
+            assertSortableUniqueId(checkpointSuid);
+            // The old detector materialized every lower-SUID row and then issued an
+            // event lookup for each candidate. Keep the proven-wins ordering, but
+            // make the normal path bounded: each classification is a single LIMIT 1
+            // indexed source/arrival probe, followed by at most one event read.
+            const proven = await this.database.prepare(`SELECT e."Id" AS event_id
+           FROM dcb_events e
+           JOIN dcb_event_ops o
+             ON o."ServiceId" = e."ServiceId" AND o."Id" = e."Id"
+          WHERE e."ServiceId" = ?
+            AND e."SortableUniqueId" COLLATE BINARY < ? COLLATE BINARY
+            AND o."FirstArrivedAt" > ?
+            AND o."FirstArrivedAt" >= 0
+            AND o."LastArrivedAt" >= o."FirstArrivedAt"
+            AND o."FirstArrivedSource" IN ('queue', 'fast')
+          ORDER BY e."SortableUniqueId" COLLATE BINARY ASC, e."Id" COLLATE BINARY ASC
+          LIMIT 1`).bind(serviceId, checkpointSuid, checkpointUpdatedAt).first();
+            if (proven !== null && proven !== undefined) {
+                const event = await this.eventById(serviceId, asString(proven.event_id, "late_lower_suid.event_id"));
+                return event === undefined
+                    ? finish({ kind: "unknown", reason: "late-event-row-disappeared" })
+                    : finish({ kind: "late-lower-suid", event });
+            }
+            // Unknown evidence is checked after proven evidence so an uncertain
+            // row cannot hide a later independently proven violation.
+            const uncertain = await this.database.prepare(`SELECT o."FirstArrivedAt" AS first_arrived_at,
+                o."LastArrivedAt" AS last_arrived_at,
+                o."FirstArrivedSource" AS first_arrived_source
+           FROM dcb_events e
+           JOIN dcb_event_ops o
+             ON o."ServiceId" = e."ServiceId" AND o."Id" = e."Id"
+          WHERE e."ServiceId" = ?
+            AND e."SortableUniqueId" COLLATE BINARY < ? COLLATE BINARY
+            AND (
+              o."FirstArrivedAt" < 0
+              OR o."LastArrivedAt" < o."FirstArrivedAt"
+              OR (
+                o."FirstArrivedAt" > ?
+                AND COALESCE(o."FirstArrivedSource", 'unknown') NOT IN ('queue', 'fast')
+              )
+            )
+          ORDER BY e."SortableUniqueId" COLLATE BINARY ASC, e."Id" COLLATE BINARY ASC
+          LIMIT 1`).bind(serviceId, checkpointSuid, checkpointUpdatedAt).first();
+            if (uncertain !== null && uncertain !== undefined) {
+                const first = asNumber(uncertain.first_arrived_at, "late_lower_suid.first_arrived_at");
+                const last = asNumber(uncertain.last_arrived_at, "late_lower_suid.last_arrived_at");
+                return finish({
+                    kind: "unknown",
+                    reason: first < 0 || last < first ? "arrival-clock-rollback" : "arrival-provenance-untrusted",
+                });
+            }
+            const replay = await this.database.prepare(`SELECT e."Id" AS event_id
+           FROM dcb_events e
+           JOIN dcb_event_ops o
+             ON o."ServiceId" = e."ServiceId" AND o."Id" = e."Id"
+          WHERE e."ServiceId" = ?
+            AND e."SortableUniqueId" COLLATE BINARY < ? COLLATE BINARY
+            AND o."FirstArrivedAt" <= ?
+            AND o."LastArrivedAt" > ?
+            AND o."LastArrivedSource" IN ('queue', 'fast')
+          ORDER BY o."LastArrivedAt" DESC,
+                   e."SortableUniqueId" COLLATE BINARY ASC,
+                   e."Id" COLLATE BINARY ASC
+          LIMIT 1`).bind(serviceId, checkpointSuid, checkpointUpdatedAt, checkpointUpdatedAt).first();
+            if (replay === null || replay === undefined)
+                return finish({ kind: "miss" });
+            const event = await this.eventById(serviceId, asString(replay.event_id, "replay.event_id"));
+            return event === undefined
+                ? finish({ kind: "unknown", reason: "replay-event-row-disappeared" })
+                : finish({ kind: "replay", event });
+        }
+        catch (error) {
+            return finish({ kind: "unknown", reason: errorText(error) });
+        }
+    }
+    /**
+     * G31 source proof: one indexed target-SUID lookup distinguishes pending,
+     * unique stored, and contradictory/incident states. It intentionally never
+     * delegates to readAllEvents, which would make waitFor history-size bound.
+     */
+    async readWaitForTarget(serviceId, suid) {
+        this.ready();
+        assertSortableUniqueId(suid);
+        const row = await this.database.prepare(`WITH target AS (
+         SELECT "Id" AS event_id
+           FROM dcb_events
+          WHERE "ServiceId" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+          ORDER BY "Id" COLLATE BINARY ASC
+          LIMIT 2
+       )
+       SELECT
+         (SELECT COUNT(*) FROM target) AS target_count,
+         (SELECT event_id FROM target ORDER BY event_id COLLATE BINARY ASC LIMIT 1) AS event_id,
+         CASE WHEN EXISTS (
+           SELECT 1
+             FROM serialized_dcb_wait_target_incidents incident
+            WHERE incident.service_id = ? AND incident.suid COLLATE BINARY = ? COLLATE BINARY
+              AND incident.classification IN ('SUID_COLLISION', 'LINEAGE_MISMATCH')
+         ) OR EXISTS (
+           SELECT 1
+             FROM serialized_dcb_delivery_incidents incident
+            WHERE incident.service_id = ? AND incident.suid COLLATE BINARY = ? COLLATE BINARY
+              AND incident.classification = 'SUID_COLLISION'
+         ) THEN 1 ELSE 0 END AS target_incident`).bind(serviceId, suid, serviceId, suid, serviceId, suid).first();
+        if (row === null || row === undefined)
+            throw new Error("D1 wait target lookup returned no row");
+        if (asNumber(row.target_incident, "target_incident") === 1) {
+            return { kind: "unavailable", reason: "incident" };
+        }
+        const count = asNumber(row.target_count, "target_count");
+        if (count === 0)
+            return { kind: "pending" };
+        if (count !== 1 || typeof row.event_id !== "string" || row.event_id.length === 0) {
+            return { kind: "unavailable", reason: "suid-contradiction" };
+        }
+        return { kind: "stored", eventId: row.event_id, suid };
+    }
+    async currentLagBound(serviceId, nowMs) {
+        this.ready();
+        const rows = await this.rows(`SELECT estimate_ms, observed_at FROM serialized_dcb_lag_estimates WHERE service_id = ?`, serviceId);
+        const row = rows[0];
+        if (row === undefined)
+            return 0;
+        const estimate = asNumber(row.estimate_ms, "estimate_ms");
+        const observedAt = asNumber(row.observed_at, "observed_at");
+        const decayNow = nowMs !== undefined && nowMs >= 100_000_000_000 && observedAt >= 100_000_000_000
+            ? nowMs
+            : observedAt;
+        return decayedLagEstimateMs(estimate, observedAt, decayNow);
+    }
+    async lagBoundDiagnostics(serviceId, nowMs) {
+        this.ready();
+        const rows = await this.rows(`SELECT estimate_ms, observed_at FROM serialized_dcb_lag_estimates WHERE service_id = ?`, serviceId);
+        const row = rows[0];
+        if (row === undefined) {
+            return { serviceIdUsed: serviceId, dynamicLagBoundMs: 0, rowFound: false, rawEstimateMs: null, rawObservedAt: null, nowMs };
+        }
+        const rawEstimateMs = asNumber(row.estimate_ms, "estimate_ms");
+        const rawObservedAt = asNumber(row.observed_at, "observed_at");
+        const decayNow = nowMs >= 100_000_000_000 && rawObservedAt >= 100_000_000_000 ? nowMs : rawObservedAt;
+        return {
+            serviceIdUsed: serviceId,
+            dynamicLagBoundMs: decayedLagEstimateMs(rawEstimateMs, rawObservedAt, decayNow),
+            rowFound: true,
+            rawEstimateMs,
+            rawObservedAt,
+            nowMs,
+        };
+    }
+    async listProjectionTags(serviceId) {
+        this.ready();
+        const rows = await this.rows(`SELECT DISTINCT membership.value AS tag
+         FROM dcb_events event, json_each(event."Tags") membership
+        WHERE event."ServiceId" = ?
+        ORDER BY tag COLLATE BINARY ASC`, serviceId);
+        return rows.map((row) => asString(row.tag, "tag"));
+    }
+    async readProjectionCheckpoint(serviceId, projectionId) {
+        this.ready();
+        const rows = await this.rows(`SELECT service_id, projection_id, last_suid, state_json, version, updated_at
+         FROM serialized_dcb_projection_checkpoints
+        WHERE service_id = ? AND projection_id = ?`, serviceId, projectionId);
+        return rows[0] === undefined ? undefined : checkpointFrom(rows[0]);
+    }
+    async advanceProjectionCheckpoint(input) {
+        this.ready();
+        const statement = this.database.prepare(`INSERT INTO serialized_dcb_projection_checkpoints
+         (service_id, projection_id, last_suid, state_json, version, updated_at)
+       SELECT ?, ?, ?, ?, ?, ?
+        WHERE ? IS NULL OR EXISTS (
+          SELECT 1 FROM serialized_dcb_projection_checkpoints current
+           WHERE current.service_id = ? AND current.projection_id = ?
+             AND current.last_suid COLLATE BINARY = ? COLLATE BINARY
+        )
+       ON CONFLICT (service_id, projection_id) DO UPDATE
+          SET last_suid = excluded.last_suid,
+              state_json = excluded.state_json,
+              version = excluded.version,
+              updated_at = excluded.updated_at
+        WHERE serialized_dcb_projection_checkpoints.last_suid COLLATE BINARY = ? COLLATE BINARY`).bind(input.serviceId, input.projectionId, input.lastSuid, input.stateJson, input.version, input.updatedAt, input.expectedLastSuid, input.serviceId, input.projectionId, input.expectedLastSuid, input.expectedLastSuid);
+        const result = await this.write("advanceProjectionCheckpoint", statement).run();
+        // D1's meta.changes is the CAS oracle; no read-then-write race exists.
+        return result.meta.changes === 1;
+    }
+    async projectionLag(serviceId, projectionId, tag) {
+        this.ready();
+        const checkpoint = await this.readProjectionCheckpoint(serviceId, projectionId);
+        const checkpointSuid = checkpoint?.lastSuid ?? "";
+        const rows = await this.rows(`SELECT
+         COALESCE((SELECT event."SortableUniqueId"
+                     FROM dcb_events event, json_each(event."Tags") membership
+                    WHERE event."ServiceId" = ? AND membership.value = ?
+                    ORDER BY event."SortableUniqueId" COLLATE BINARY DESC LIMIT 1), '') AS head_suid,
+         (SELECT COUNT(*)
+            FROM dcb_events event, json_each(event."Tags") membership
+           WHERE event."ServiceId" = ? AND membership.value = ?
+             AND event."SortableUniqueId" COLLATE BINARY > ? COLLATE BINARY) AS behind_events`, serviceId, tag, serviceId, tag, checkpointSuid);
+        const row = rows[0] ?? {};
+        return {
+            serviceId,
+            projectionId,
+            tag,
+            checkpointSuid,
+            headSuid: asString(row.head_suid ?? "", "head_suid"),
+            behindEvents: asNumber(row.behind_events ?? 0, "behind_events"),
+        };
+    }
+    async upsertPending(message, firstObservedAt, lagBoundMs) {
+        this.ready();
+        const expectedJson = jsonArray(message.eventTags);
+        const observedJson = jsonArray([message.tag]);
+        const statements = [
+            this.database.prepare(`INSERT INTO serialized_dcb_pending_arrivals
+           (service_id, event_id, attempt_id, suid, expected_paths, observed_paths, first_observed_at, lag_bound_ms)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (service_id, event_id) DO NOTHING`).bind(message.serviceId, message.eventId, message.attemptId, message.suid, expectedJson, observedJson, firstObservedAt, lagBoundMs),
+            // JSON1 performs the set union inside the atomic UPDATE. There is no
+            // TypeScript read/merge/write window under concurrent deliveries.
+            this.database.prepare(`UPDATE serialized_dcb_pending_arrivals AS pending
+            SET expected_paths = COALESCE((
+                  SELECT json_group_array(value) FROM (
+                    SELECT value FROM json_each(pending.expected_paths)
+                    UNION
+                    SELECT value FROM json_each(?)
+                    ORDER BY value COLLATE BINARY
+                  )
+                ), '[]'),
+                observed_paths = COALESCE((
+                  SELECT json_group_array(value) FROM (
+                    SELECT value FROM json_each(pending.observed_paths)
+                    UNION
+                    SELECT value FROM json_each(?)
+                    ORDER BY value COLLATE BINARY
+                  )
+                ), '[]'),
+                lag_bound_ms = MAX(lag_bound_ms, ?)
+          WHERE service_id = ? AND event_id = ? AND attempt_id = ?
+            AND suid COLLATE BINARY = ? COLLATE BINARY`).bind(expectedJson, observedJson, lagBoundMs, message.serviceId, message.eventId, message.attemptId, message.suid),
+        ];
+        await this.batch("upsertPending", statements);
+        const pending = await this.pendingById(message.serviceId, message.eventId);
+        if (pending === undefined)
+            throw new Error("D1 pending arrival was not persisted");
+        if (pending.attemptId !== message.attemptId || pending.suid !== message.suid) {
+            throw new D1IdentityConflictError(`EventId ${message.eventId} has contradictory pending-arrival identity`);
+        }
+        return pending;
+    }
+    async listPending(serviceId) {
+        this.ready();
+        const rows = serviceId === undefined
+            ? await this.rows(`SELECT service_id, event_id, attempt_id, suid, expected_paths, observed_paths, first_observed_at, lag_bound_ms
+           FROM serialized_dcb_pending_arrivals
+          ORDER BY service_id COLLATE BINARY ASC, event_id COLLATE BINARY ASC`)
+            : await this.rows(`SELECT service_id, event_id, attempt_id, suid, expected_paths, observed_paths, first_observed_at, lag_bound_ms
+           FROM serialized_dcb_pending_arrivals
+          WHERE service_id = ?
+          ORDER BY event_id COLLATE BINARY ASC`, serviceId);
+        return rows.map(pendingFrom);
+    }
+    async appendFinding(finding) {
+        this.ready();
+        const statement = this.database.prepare(`INSERT INTO serialized_dcb_inconsistency_findings
+         (service_id, event_id, path, classification, first_observed_at, lag_bound_ms, observed_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (service_id, event_id, path, classification) DO NOTHING`).bind(finding.serviceId, finding.eventId, finding.path, finding.classification, finding.firstObservedAt, finding.lagBoundMs, finding.observedAt);
+        await this.write("appendFinding", statement).run();
+    }
+    async hasFinding(serviceId, eventId, path, classification) {
+        this.ready();
+        const rows = await this.rows(`SELECT 1 AS present FROM serialized_dcb_inconsistency_findings
+        WHERE service_id = ? AND event_id = ? AND path = ? AND classification = ?`, serviceId, eventId, path, classification);
+        return rows.length !== 0;
+    }
+    async listFindings(serviceId, eventId) {
+        this.ready();
+        const conditions = [];
+        const values = [];
+        if (serviceId !== undefined) {
+            conditions.push("service_id = ?");
+            values.push(serviceId);
+        }
+        if (eventId !== undefined) {
+            conditions.push("event_id = ?");
+            values.push(eventId);
+        }
+        const rows = await this.rows(`SELECT service_id, event_id, path, classification, first_observed_at, lag_bound_ms, observed_at
+         FROM serialized_dcb_inconsistency_findings
+        ${conditions.length === 0 ? "" : `WHERE ${conditions.join(" AND ")}`}
+        ORDER BY sequence ASC`, ...values);
+        return rows.map(findingFrom);
+    }
+    async appendDeliveryIncident(incident) {
+        this.ready();
+        const statement = this.database.prepare(`INSERT INTO serialized_dcb_delivery_incidents
+         (service_id, identity_key, classification, suid, existing_event_id, incoming_event_id, event_id,
+          bound_lineage_id, incoming_lineage_id, observed_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (service_id, identity_key) DO NOTHING`).bind(incident.serviceId, incident.identityKey, incident.classification, incident.suid ?? null, incident.existingEventId ?? null, incident.incomingEventId ?? null, incident.eventId ?? null, incident.boundLineageId ?? null, incident.incomingLineageId ?? null, incident.observedAt);
+        await this.write("appendDeliveryIncident", statement).run();
+    }
+    async hasDeliveryIncident(serviceId, identityKey) {
+        this.ready();
+        return (await this.incidentByIdentity(serviceId, identityKey)) !== undefined;
+    }
+    async listDeliveryIncidents(serviceId) {
+        this.ready();
+        const rows = serviceId === undefined
+            ? await this.rows(`SELECT service_id, identity_key, classification, suid, existing_event_id, incoming_event_id, event_id,
+                bound_lineage_id, incoming_lineage_id, observed_at
+           FROM serialized_dcb_delivery_incidents
+          ORDER BY sequence ASC`)
+            : await this.rows(`SELECT service_id, identity_key, classification, suid, existing_event_id, incoming_event_id, event_id,
+                bound_lineage_id, incoming_lineage_id, observed_at
+           FROM serialized_dcb_delivery_incidents
+          WHERE service_id = ?
+          ORDER BY sequence ASC`, serviceId);
+        return rows.map(incidentFrom);
+    }
+    async batch(operation, statements) {
+        const transformed = await this.options.beforeBatch?.(operation, statements, this.database) ?? statements;
+        await this.database.batch([...transformed]);
+    }
+    write(operation, statement) {
+        return this.options.beforeWrite?.(operation, statement, this.database) ?? statement;
+    }
+    async rows(statement, ...values) {
+        const result = await this.database.prepare(statement).bind(...values).all();
+        return result.results;
+    }
+    async eventById(serviceId, eventId) {
+        const rows = await this.rows(`SELECT e."ServiceId" AS service_id, e."Id" AS event_id,
+              e."SortableUniqueId" AS suid, e."Payload" AS payload,
+              e."EventType" AS event_type, e."Tags" AS event_tags,
+              e."EventDigest" AS event_digest,
+              e."Timestamp" AS timestamp, e."CausationId" AS causation_id,
+              e."CorrelationId" AS correlation_id, e."ExecutedUser" AS executed_user,
+              COALESCE(o."FirstArrivedAt", 0) AS first_arrived_at,
+              COALESCE(o."LastArrivedAt", 0) AS last_arrived_at,
+              COALESCE(o."MaxDeliveryLagMs", 0) AS max_delivery_lag_ms
+         FROM dcb_events e LEFT JOIN dcb_event_ops o
+           ON o."ServiceId" = e."ServiceId" AND o."Id" = e."Id"
+        WHERE e."ServiceId" = ? AND e."Id" = ?`, serviceId, eventId);
+        return rows[0] === undefined ? undefined : this.eventFromRow(rows[0]);
+    }
+    async eventFromRow(row) {
+        const arrivals = await this.rows(`SELECT service_id, event_id, tag, enqueued_at, arrived_at, lag_ms
+         FROM serialized_dcb_event_arrivals
+        WHERE service_id = ? AND event_id = ?
+        ORDER BY tag COLLATE BINARY ASC`, asString(row.service_id, "service_id"), asString(row.event_id, "event_id"));
+        return eventFrom(row, arrivals);
+    }
+    async pendingById(serviceId, eventId) {
+        const rows = await this.rows(`SELECT service_id, event_id, attempt_id, suid, expected_paths, observed_paths, first_observed_at, lag_bound_ms
+         FROM serialized_dcb_pending_arrivals WHERE service_id = ? AND event_id = ?`, serviceId, eventId);
+        return rows[0] === undefined ? undefined : pendingFrom(rows[0]);
+    }
+    async lineageBinding(serviceId) {
+        const rows = await this.rows(`SELECT allocator_lineage_id FROM serialized_dcb_allocator_bindings WHERE service_id = ?`, serviceId);
+        return rows[0] === undefined ? undefined : asString(rows[0].allocator_lineage_id, "allocator_lineage_id");
+    }
+    async collisionEvent(serviceId, suid, eventId) {
+        const rows = await this.rows(`SELECT "Id" AS event_id FROM dcb_events
+        WHERE "ServiceId" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY AND "Id" <> ?
+        ORDER BY "Id" COLLATE BINARY ASC LIMIT 1`, serviceId, suid, eventId);
+        return rows[0] === undefined ? undefined : asString(rows[0].event_id, "event_id");
+    }
+    async incidentByIdentity(serviceId, identityKey) {
+        const rows = await this.rows(`SELECT service_id, identity_key, classification, suid, existing_event_id, incoming_event_id, event_id,
+              bound_lineage_id, incoming_lineage_id, observed_at
+         FROM serialized_dcb_delivery_incidents
+        WHERE service_id = ? AND identity_key = ?`, serviceId, identityKey);
+        return rows[0] === undefined ? undefined : incidentFrom(rows[0]);
+    }
+    async eventArrivalOps(serviceId, eventId) {
+        const row = await this.database.prepare(`SELECT "FirstArrivedAt" AS first_arrived_at, "LastArrivedAt" AS last_arrived_at
+         FROM dcb_event_ops
+        WHERE "ServiceId" = ? AND "Id" = ?`).bind(serviceId, eventId).first();
+        if (row === null || row === undefined)
+            return undefined;
+        return {
+            firstArrivedAt: asNumber(row.first_arrived_at, "event_ops.first_arrived_at"),
+            lastArrivedAt: asNumber(row.last_arrived_at, "event_ops.last_arrived_at"),
+        };
+    }
+    async admissionMutationEvidence(serviceId, eventId, mutationAttemptId) {
+        const row = await this.database.prepare(`SELECT "FirstAdmissionAttemptId" AS first_admission_attempt_id,
+              "LastAdmissionAttemptId" AS last_admission_attempt_id
+         FROM dcb_event_ops
+        WHERE "ServiceId" = ? AND "Id" = ?`).bind(serviceId, eventId).first();
+        const first = row?.first_admission_attempt_id === null || row?.first_admission_attempt_id === undefined
+            ? undefined
+            : asString(row.first_admission_attempt_id, "event_ops.first_admission_attempt_id");
+        const last = row?.last_admission_attempt_id === null || row?.last_admission_attempt_id === undefined
+            ? undefined
+            : asString(row.last_admission_attempt_id, "event_ops.last_admission_attempt_id");
+        if (first === mutationAttemptId)
+            return "first-admission";
+        if (last === mutationAttemptId)
+            return "duplicate-admission";
+        return "unverified";
+    }
+    async bestEffortG69AdmissionAttempt(message, arrivedAt, deliverySource, attemptContext, mutationAttemptId, result, failure, retryReason) {
+        const diagnosticStartedAt = Date.now();
+        const receiptCostMs = () => Math.max(0, Date.now() - diagnosticStartedAt);
+        const appendFailedDiagnostic = async (reason) => {
+            try {
+                await appendG69AdmissionAttempt(this.database, {
+                    serviceId: message.serviceId,
+                    eventId: message.eventId,
+                    suid: message.suid,
+                    tag: message.tag,
+                    deliverySource,
+                    queueMessageId: attemptContext?.queueMessageId ?? null,
+                    attemptId: message.attemptId,
+                    allocatorLineageId: message.allocatorLineageId,
+                    obligationSequence: message.completeness.obligationSequence,
+                    enqueuedAt: message.enqueuedAt,
+                    observedAt: Date.now(),
+                    arrivedAt,
+                    firstArrivedAtBefore: null,
+                    lastArrivedAtBefore: null,
+                    firstArrivedAtAfter: null,
+                    lastArrivedAtAfter: null,
+                    beforeObservedAt: null,
+                    afterObservedAt: null,
+                    observationConsistency: "unverified",
+                    mutationEvidence: "unverified",
+                    diagnosticDurationMs: receiptCostMs(),
+                    status: "failed",
+                    retryReason: reason,
+                });
+            }
+            catch {
+                // The diagnostic table remains best effort even when its own failure
+                // prevents a failed-observation row from being retained.
+            }
+        };
+        try {
+            try {
+                await this.options.beforeG69AdmissionAttempt?.();
+            }
+            catch (error) {
+                await appendFailedDiagnostic(errorText(error));
+                return;
+            }
+            const afterObservedAt = Date.now();
+            const afterResult = this.eventArrivalOps(message.serviceId, message.eventId)
+                .then((after) => ({ after, failed: false }))
+                .catch(() => ({ after: undefined, failed: true }));
+            const mutationResult = this.admissionMutationEvidence(message.serviceId, message.eventId, mutationAttemptId)
+                .then((evidence) => ({ evidence, failed: false }))
+                .catch(() => ({ evidence: "unverified", failed: true }));
+            const [{ after, failed: afterReadFailed }, { evidence: observedMutationEvidence }] = await Promise.all([afterResult, mutationResult]);
+            const status = failure !== undefined
+                ? "failed"
+                : result?.outcome === "stored"
+                    ? observedMutationEvidence === "duplicate-admission" ? "duplicate" : "stored"
+                    : result?.outcome ?? "failed";
+            const finalObservationConsistency = afterReadFailed
+                ? "after-read-failed"
+                : after === undefined
+                    ? "unverified"
+                    : "after-admission";
+            await appendG69AdmissionAttempt(this.database, {
+                serviceId: message.serviceId,
+                eventId: message.eventId,
+                suid: message.suid,
+                tag: message.tag,
+                deliverySource,
+                queueMessageId: attemptContext?.queueMessageId ?? null,
+                attemptId: message.attemptId,
+                allocatorLineageId: message.allocatorLineageId,
+                obligationSequence: message.completeness.obligationSequence,
+                enqueuedAt: message.enqueuedAt,
+                observedAt: afterObservedAt,
+                arrivedAt,
+                firstArrivedAtBefore: null,
+                lastArrivedAtBefore: null,
+                firstArrivedAtAfter: after?.firstArrivedAt ?? null,
+                lastArrivedAtAfter: after?.lastArrivedAt ?? null,
+                beforeObservedAt: null,
+                afterObservedAt,
+                observationConsistency: finalObservationConsistency,
+                mutationEvidence: observedMutationEvidence,
+                diagnosticDurationMs: receiptCostMs(),
+                status,
+                retryReason,
+            });
+        }
+        catch {
+            // Diagnostic evidence is strictly best effort. It must not alter the
+            // durable event, Queue disposition, G44 receipt, or safe frontier.
+        }
+    }
+    ready() {
+        if (!this.initialized)
+            throw new Error("D1EventStore.initialize() must complete before use");
+    }
+}