@sproutboat/runtime 0.23.0 → 0.23.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @sproutboat/runtime
 
+## 0.23.1
+
+### Patch Changes
+
+- 7a7fd34: D1 correctness fixes, in the standalone (embedded) transport and the broker:
+  
+  - **Bytes are no longer lost.** Binding a `Uint8Array`, another typed array, a `DataView` or an `ArrayBuffer` stored NULL in a standalone sprout, along with every parameter after it. It now stores a BLOB, at every compatibility date. On earlier dates a BLOB still reads back as before: as one character per byte.
+  - **`batch()` is one transaction** in a standalone sprout, as it already was through the broker and is in D1: if a statement fails, the ones before it are rolled back. This applies at every compatibility date.
+  - **From compatibility date `2026-10-24`**, D1 follows workerd's rules:
+    - a parameter must be `null`, a number, a string, a boolean or bytes, or the call throws `D1_TYPE_ERROR` (before, `undefined` and objects became NULL);
+    - the number of parameters must match the statement (`D1_ERROR: Wrong number of parameter bindings for SQL query.`);
+    - foreign keys are enforced (`PRAGMA foreign_keys = ON`);
+    - errors read `D1_ERROR: <message>: SQLITE_<CODE>`;
+    - a BLOB reads back as an array of byte values.
+  
+    Apps with an earlier `compatibility_date` keep the old behaviour. To opt in, move the date to `2026-10-24` or later and rebuild.
+  - `meta.changes` is 0 for a statement that only reads. It used to repeat the previous write's count.
+
 ## 0.23.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.23.0",
+  "version": "0.23.1",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/d1-shim.test.js

@@ -0,0 +1,114 @@
+// The D1 shim (`env.DB`) over the broker's D1 store (the production platform's path),
+// at a compatibility date before and after 2026-10-24. The embedded transport's half is
+// test/native-d1.ts.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { createD1Store } from "../../wire/src/d1";
+
+const source = readFileSync(new URL("./native-fetch-prelude.js", import.meta.url), "utf8");
+let store;
+// oxlint-disable-next-line no-function-constructor -- the prelude is prepended as text in production too
+const { makeD1 } = new Function(
+  "Porffor",
+  "__testCall",
+  `${source}\n__sbCall = __testCall; return { makeD1: __sbMakeD1 };`,
+)({ c: () => "" }, (json) => {
+  const msg = JSON.parse(json);
+  try {
+    return JSON.stringify(store.execute({ owner: "app", key: "app/DB", path: ":memory:", name: "DB", msg }));
+  } catch (error) {
+    return JSON.stringify({ ok: false, error: error.message });
+  }
+});
+const fresh = (date) => {
+  globalThis.__sbCompat = date;
+  store?.close();
+  store = createD1Store();
+  return makeD1("DB");
+};
+const caught = (fn) => {
+  try {
+    fn();
+  } catch (error) {
+    return error.message;
+  }
+  return "did not throw";
+};
+
+for (const date of ["2026-09-28", "2026-10-24"]) {
+  test(`${date}: bytes bind as a BLOB, and the parameters after them are kept`, () => {
+    const DB = fresh(date);
+    DB.exec("CREATE TABLE t (a TEXT, b BLOB, c TEXT)");
+    DB.prepare("INSERT INTO t VALUES (?, ?, ?)")
+      .bind("u8", new Uint8Array([0, 255, 7]), "after")
+      .run();
+    DB.prepare("INSERT INTO t VALUES (?, ?, ?)")
+      .bind("ab", new Uint8Array([1, 2]).buffer, "after")
+      .run();
+    DB.prepare("INSERT INTO t VALUES (?, ?, ?)")
+      .bind("view", new DataView(new Uint8Array([9, 8, 7]).buffer, 1, 2), "after")
+      .run();
+    expect(DB.prepare("SELECT a, hex(b) AS h, typeof(b) AS t, c FROM t ORDER BY rowid").all().results).toEqual([
+      { a: "u8", h: "00FF07", t: "blob", c: "after" },
+      { a: "ab", h: "0102", t: "blob", c: "after" },
+      { a: "view", h: "0807", t: "blob", c: "after" },
+    ]);
+  });
+
+  test(`${date}: batch() is one transaction`, () => {
+    const DB = fresh(date);
+    DB.exec("CREATE TABLE t (id INTEGER PRIMARY KEY)");
+    expect(() => DB.batch([DB.prepare("INSERT INTO t VALUES (1)"), DB.prepare("INSERT INTO t VALUES (1)")])).toThrow(
+      /UNIQUE/,
+    );
+    expect(DB.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(0);
+  });
+}
+
+test("before 2026-10-24: lenient parameters, no foreign keys, BLOBs as one char per byte", () => {
+  const DB = fresh("2026-09-28");
+  // (bun:sqlite has always refused a wrong parameter count here; the embedded transport has not.)
+  expect(DB.prepare("SELECT ?1 AS a").bind(undefined).first()).toEqual({ a: null });
+  DB.exec("CREATE TABLE p (id INTEGER PRIMARY KEY); CREATE TABLE c (p INTEGER REFERENCES p(id))");
+  DB.prepare("INSERT INTO c VALUES (99)").run();
+  expect(DB.prepare("SELECT x'00ff' AS b").first("b")).toBe("\u0000ÿ");
+  expect(caught(() => DB.prepare("SELEC 1").all())).toMatch(/^sproutboat d1\.query: /);
+});
+
+test("from 2026-10-24: D1's parameter rules", () => {
+  const DB = fresh("2026-10-24");
+  expect(caught(() => DB.prepare("SELECT ?1").bind(undefined))).toBe(
+    "D1_TYPE_ERROR: Type 'undefined' not supported for value 'undefined'",
+  );
+  expect(caught(() => DB.prepare("SELECT ?1").bind({ a: 1 }))).toBe(
+    "D1_TYPE_ERROR: Type 'object' not supported for value '[object Object]'",
+  );
+  expect(caught(() => DB.prepare("SELECT ?1").bind(10n))).toBe(
+    "D1_TYPE_ERROR: Type 'bigint' not supported for value '10'",
+  );
+  expect(caught(() => DB.prepare("SELECT ?1, ?2").bind(1).all())).toBe(
+    "D1_ERROR: Wrong number of parameter bindings for SQL query.",
+  );
+  expect(caught(() => DB.prepare("SELECT ?1").bind(1, 2).all())).toBe(
+    "D1_ERROR: Wrong number of parameter bindings for SQL query.",
+  );
+  expect(caught(() => DB.prepare("SELECT ?1").all())).toBe(
+    "D1_ERROR: Wrong number of parameter bindings for SQL query.",
+  );
+  expect(DB.prepare("SELECT ?1 AS a, ?1 AS b, ?2 AS c").bind("x", true).first()).toEqual({ a: "x", b: "x", c: 1 });
+});
+
+test("from 2026-10-24: foreign keys, BLOBs as byte arrays, D1's error text", () => {
+  const DB = fresh("2026-10-24");
+  DB.exec("CREATE TABLE p (id INTEGER PRIMARY KEY); CREATE TABLE c (p INTEGER REFERENCES p(id))");
+  expect(caught(() => DB.prepare("INSERT INTO c VALUES (99)").run())).toBe(
+    "D1_ERROR: FOREIGN KEY constraint failed: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_FOREIGNKEY)",
+  );
+  DB.prepare("INSERT INTO p VALUES (1)").run();
+  expect(caught(() => DB.prepare("INSERT INTO p VALUES (1)").run())).toBe(
+    "D1_ERROR: UNIQUE constraint failed: p.id: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_PRIMARYKEY)",
+  );
+  expect(caught(() => DB.prepare("SELECT * FROM nope").all())).toBe("D1_ERROR: no such table: nope: SQLITE_ERROR");
+  expect(DB.prepare("SELECT x'00ff' AS b").first("b")).toEqual([0, 255]);
+  expect(DB.prepare("SELECT count(*) AS n FROM p").run().meta.changes).toBe(0);
+});

package/src/native-fetch-prelude.js

@@ -4809,17 +4809,80 @@ function __sbRpc(op, extra) {
 
 // D1: a Cloudflare-shaped `env.<DB>` (prepare / bind / all / run / raw / first,
 // plus batch and exec). Every call is one broker roundtrip.
+//
+// Bytes (an ArrayBuffer or a typed array) bind as a BLOB at every compatibility date:
+// before, they were stored as NULL. From compatibility date 2026-10-24 D1 calls are
+// strict, as in workerd: a parameter must be null, a number, a string, a boolean or
+// bytes (D1_TYPE_ERROR otherwise), the count must match the statement, foreign keys
+// are enforced, errors read "D1_ERROR: ...", and a BLOB comes back as an array of
+// byte values. Earlier dates keep the old behaviour.
+function __sbD1Strict() {
+  return globalThis.__sbCompat >= "2026-10-24";
+}
+function __sbD1Param(value, strict) {
+  if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {
+    const bytes = value instanceof ArrayBuffer ? new Uint8Array(value) : new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+    let hex = "";
+    for (let i = 0; i < bytes.length; i++) hex += (bytes[i] < 16 ? "0" : "") + bytes[i].toString(16);
+    return { $blob: hex };
+  }
+  if (!strict || value === null || value === true || value === false || Object(value) instanceof Number || __sbIsStr(value)) return value;
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- workerd's D1_TYPE_ERROR names the value's typeof
+  throw new Error("D1_TYPE_ERROR: Type '" + typeof value + "' not supported for value '" + String(value) + "'");
+}
+function __sbD1Rpc(op, extra, strict) {
+  if (!strict) return __sbRpc(op, extra);
+  extra.strict = true;
+  try {
+    return __sbRpc(op, extra);
+  } catch (err) {
+    // "sproutboat d1.query: D1_ERROR: ..." -> "D1_ERROR: ...", as workerd words it.
+    const message = String((err && err.message) || err);
+    const at = message.indexOf("D1_");
+    throw new Error(at > 0 ? message.slice(at) : message);
+  }
+}
+// Strict replies carry columns and rows; build workerd's result objects from them.
+function __sbD1Rows(r) {
+  const rows = r.rows || [];
+  for (let i = 0; i < rows.length; i++)
+    for (let c = 0; c < rows[i].length; c++) {
+      const cell = rows[i][c];
+      if (__sbIsObj(cell) && __sbIsStr(cell.$blob)) {
+        const out = [];
+        for (let k = 0; k + 1 < cell.$blob.length; k += 2) out.push(parseInt(cell.$blob.slice(k, k + 2), 16));
+        rows[i][c] = out;
+      }
+    }
+  return rows;
+}
+function __sbD1Objects(columns, rows) {
+  const out = [];
+  for (let i = 0; i < rows.length; i++) {
+    const row = {};
+    for (let c = 0; c < columns.length; c++) row[columns[c]] = rows[i][c];
+    out.push(row);
+  }
+  return out;
+}
+function __sbD1Result(r, strict) {
+  if (!strict) return { results: r.results || [], success: true, meta: r.meta || {} };
+  return { results: __sbD1Objects(r.columns || [], __sbD1Rows(r)), success: true, meta: r.meta || {} };
+}
 function __sbMakeD1(dbName) {
   function stmt(sql, params) {
     const s = {
       __sql: sql,
       __params: params,
       bind() {
-        return stmt(sql, Array.prototype.slice.call(arguments));
+        const strict = __sbD1Strict();
+        const list = [];
+        for (let i = 0; i < arguments.length; i++) list.push(__sbD1Param(arguments[i], strict));
+        return stmt(sql, list);
       },
       all() {
-        const r = __sbRpc("d1.query", { db: dbName, sql, params });
-        return { results: r.results || [], success: true, meta: r.meta || {} };
+        const strict = __sbD1Strict();
+        return __sbD1Result(__sbD1Rpc("d1.query", { db: dbName, sql, params }, strict), strict);
       },
       run() {
         return s.all();
@@ -4847,17 +4910,17 @@ function __sbMakeD1(dbName) {
       return stmt(String(sql), []);
     },
     batch(statements) {
+      const strict = __sbD1Strict();
       const list = [];
       for (let i = 0; i < (statements || []).length; i++)
         list.push({ sql: statements[i].__sql, params: statements[i].__params });
-      const r = __sbRpc("d1.batch", { db: dbName, statements: list });
+      const r = __sbD1Rpc("d1.batch", { db: dbName, statements: list }, strict);
       const out = [];
-      for (let i = 0; i < (r.results || []).length; i++)
-        out.push({ results: r.results[i].results || [], success: true, meta: r.results[i].meta || {} });
+      for (let i = 0; i < (r.results || []).length; i++) out.push(__sbD1Result(r.results[i], strict));
       return out;
     },
     exec(sql) {
-      __sbRpc("d1.exec", { db: dbName, sql: String(sql) });
+      __sbD1Rpc("d1.exec", { db: dbName, sql: String(sql) }, __sbD1Strict());
       return { count: (String(sql).match(/;/g) || []).length, duration: 0 };
     },
     // Sproutboat extension (not in CF Workers D1): an online, integrity-checked

package/src/transport-embedded.js

@@ -57,6 +57,10 @@ extern int sqlite3_changes(sqlite3*);
 extern int64_t sqlite3_last_insert_rowid(sqlite3*);
 extern const char* sqlite3_errmsg(sqlite3*);
 extern int sqlite3_close(sqlite3*);
+extern int sqlite3_bind_parameter_count(sqlite3_stmt*);
+extern int sqlite3_stmt_readonly(sqlite3_stmt*);
+extern int sqlite3_extended_errcode(sqlite3*);
+extern int sqlite3_error_offset(sqlite3*);
 
 // baronunread/sproutboat#176 — defined in render.js, alongside
 // porf_native_fetch_read_value (which every inline-C block below already
@@ -1293,6 +1297,19 @@ static void sb_putjson_text(sb_buf* b, const char* s, size_t n) {
 // binds as NULL rather than guessing.
 static const char* sb_skip_ws(const char* p) { while (*p == ' ' || *p == '\n' || *p == '\t' || *p == '\r') p++; return p; }
 
+static int sb_hex_nibble(char c) { return c >= 'a' ? c - 'a' + 10 : c >= 'A' ? c - 'A' + 10 : c - '0'; }
+// Past one JSON object (strings and nesting respected), or to the end of the text.
+static const char* sb_json_skip_object(const char* p) {
+  int depth = 0, quoted = 0;
+  for (; *p; p++) {
+    if (quoted) { if (*p == '\\' && p[1]) p++; else if (*p == '"') quoted = 0; continue; }
+    if (*p == '"') quoted = 1;
+    else if (*p == '{' || *p == '[') depth++;
+    else if ((*p == '}' || *p == ']') && --depth == 0) return p + 1;
+  }
+  return p;
+}
+
 static int sb_bind_params(sqlite3_stmt* st, const char* json) {
   const char* p = sb_skip_ws(json);
   if (*p != '[') return 0;
@@ -1338,6 +1355,25 @@ static int sb_bind_params(sqlite3_stmt* st, const char* json) {
       free(out);
       continue;
     }
+    // {"$blob":"HEX"}: the bytes of a D1 bind (an ArrayBuffer or a typed array), bound
+    // as a BLOB. Any other object binds NULL. Before this an object stopped the parse,
+    // so a Uint8Array and every parameter after it were silently stored as NULL.
+    if (*p == '{') {
+      const char* end = sb_json_skip_object(p);
+      const char* hex = strstr(p, "\"$blob\":\"");
+      if (hex && hex < end) {
+        hex += 9;
+        size_t n = 0;
+        while (hex + 2 * n < end && hex[2 * n] != '"' && hex[2 * n + 1] != '"') n++;
+        unsigned char* bytes = (unsigned char*)malloc(n ? n : 1);
+        for (size_t i = 0; i < n; i++)
+          bytes[i] = (unsigned char)(sb_hex_nibble(hex[2 * i]) << 4 | sb_hex_nibble(hex[2 * i + 1]));
+        sqlite3_bind_blob(st, index++, bytes, (int)n, SB_SQLITE_TRANSIENT);
+        free(bytes);
+      } else sqlite3_bind_null(st, index++);
+      p = end;
+      continue;
+    }
     // number (or true/false, bound as 1/0)
     if (*p == 't') { sqlite3_bind_double(st, index++, 1); p += 4; continue; }
     if (*p == 'f') { sqlite3_bind_double(st, index++, 0); p += 5; continue; }
@@ -1349,7 +1385,7 @@ static int sb_bind_params(sqlite3_stmt* st, const char* json) {
       p = endp;
     }
   }
-  return 0;
+  return index - 1; // how many were bound
 }
 
 // --- R2 bodies, without the JSON detour or the SQLite detour ----------------
@@ -1941,23 +1977,52 @@ static char* sb_sql_script(const char* path, const char* sql) {
   return b.p;
 }
 
+// An error reply with SQLite's extended result code and, when SQLite knows it, the byte
+// offset of the error in the SQL (D1 reports both). A message of our own comes with its
+// own code (code < 0: take SQLite's).
+static char* sb_sql_error(sqlite3* db, const char* message, int code, int skip) {
+  sb_buf e = { 0, 0, 0 };
+  const char* m = message ? message : sqlite3_errmsg(db);
+  sb_puts(&e, "{\"ok\":false,\"error\":");
+  sb_putjson_text(&e, m, strlen(m));
+  char tail[64];
+  int offset = message ? -1 : sqlite3_error_offset(db);
+  int k = snprintf(tail, sizeof(tail), ",\"code\":%d,\"offset\":%d}", code >= 0 ? code : sqlite3_extended_errcode(db), offset >= skip ? offset - skip : -1);
+  sb_put(&e, tail, (size_t)k);
+  return e.p;
+}
+
+// D1 calls from compatibility date 2026-10-24 put this comment first: the statement must
+// get exactly as many parameters as it has, like D1.
+#define SB_D1_STRICT "/*sb-d1-strict*/"
+// LTX capture (#141) failed after SQLite committed: the write is in the database but not in
+// the replication log, and the database refuses writes until the process restarts. Said as
+// such (SQLITE_IOERR), never as SQLite's own message, which still reads "not an error".
+#define SB_LTX_FAILED "LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart"
+static int sb_db_capture_failed(const char* path) {
+  for (int i = 0; i < sb_db_count; i++) if (strcmp(sb_db_names[i], path) == 0) return sb_ltx_states[i].failed;
+  return 0;
+}
+
 // Run one statement. Returns malloc'd JSON:
 //   {"ok":true,"cols":[...],"rows":[[...]],"changes":n,"rowid":n}
-// or {"ok":false,"error":"..."}.
+// or {"ok":false,"error":"...","code":n,"offset":n}. In a D1 database (a path under
+// /d1/) a BLOB comes back as {"$blob":"HEX"}; elsewhere as one char per byte.
 static char* sb_sql_run(const char* path, const char* sql, const char* params) {
   sb_buf b = { 0, 0, 0 };
   int idx = sb_db_for(path);
+  if (idx < 0 && sb_db_capture_failed(path)) return sb_sql_error(0, SB_LTX_FAILED, 10, 0);
   if (idx < 0) { sb_puts(&b, "{\"ok\":false,\"error\":\"cannot open database\"}"); return b.p; }
   sqlite3* db = sb_dbs[idx];
+  const int strict = strncmp(sql, SB_D1_STRICT, sizeof(SB_D1_STRICT) - 1) == 0;
+  const int d1 = strstr(path, "/d1/") != 0;
   sqlite3_stmt* st = sb_stmt_get(idx, db, sql);
-  if (!st) {
-    sb_puts(&b, "{\"ok\":false,\"error\":");
-    const char* m = sqlite3_errmsg(db);
-    sb_putjson_text(&b, m, strlen(m));
-    sb_puts(&b, "}");
-    return b.p;
+  if (!st) return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
+  int bound = params && *params ? sb_bind_params(st, params) : 0;
+  if (strict && bound != sqlite3_bind_parameter_count(st)) {
+    sqlite3_reset(st);
+    return sb_sql_error(db, "Wrong number of parameter bindings for SQL query.", 0, 0);
   }
-  if (params && *params) sb_bind_params(st, params);
 
   sb_puts(&b, "{\"ok\":true,\"cols\":[");
   int ncol = sqlite3_column_count(st);
@@ -1984,27 +2049,32 @@ static char* sb_sql_run(const char* path, const char* sql, const char* params) {
       }
       const unsigned char* txt = sqlite3_column_text(st, i);
       int n = sqlite3_column_bytes(st, i);
-      // TEXT is UTF-8 and decodes (#189); a BLOB stays one char per byte.
-      if (t == 4) sb_putjson(&b, txt ? (const char*)txt : "", txt ? (size_t)n : 0);
+      // TEXT is UTF-8 and decodes (#189); a BLOB stays one char per byte, or is hex in D1.
+      if (t == 4 && d1) {
+        static const char* digits = "0123456789abcdef";
+        const unsigned char* bytes = (const unsigned char*)sqlite3_column_blob(st, i);
+        sb_puts(&b, "{\"$blob\":\"");
+        for (int j = 0; j < n; j++) { char pair[2] = { digits[bytes[j] >> 4], digits[bytes[j] & 15] }; sb_put(&b, pair, 2); }
+        sb_puts(&b, "\"}");
+      }
+      else if (t == 4) sb_putjson(&b, txt ? (const char*)txt : "", txt ? (size_t)n : 0);
       else sb_putjson_text(&b, txt ? (const char*)txt : "", txt ? (size_t)n : 0);
     }
     sb_puts(&b, "]");
   }
   char tail[96];
-  int k = snprintf(tail, 96, "],\"changes\":%d,\"rowid\":%lld}", sqlite3_changes(db), (long long)sqlite3_last_insert_rowid(db));
+  // A read-only statement changed nothing: sqlite3_changes still holds the last write's count.
+  int k = snprintf(tail, 96, "],\"changes\":%d,\"rowid\":%lld}", sqlite3_stmt_readonly(st) ? 0 : sqlite3_changes(db), (long long)sqlite3_last_insert_rowid(db));
   sb_put(&b, tail, (size_t)k);
   // Reset, don't finalize: the statement stays compiled in sb_stmt_cache. Reset
   // now (not just on next reuse) so a SELECT stops holding its read transaction.
   sqlite3_reset(st);
-  if (sb_ltx_after(idx)) rc = 10;
+  const int capture_failed = sb_ltx_after(idx) != 0;
+  if (capture_failed) rc = 10;
   if (rc != SB_SQLITE_DONE && rc != SB_SQLITE_ROW) {
     free(b.p);
-    sb_buf e = { 0, 0, 0 };
-    sb_puts(&e, "{\"ok\":false,\"error\":");
-    const char* m = sqlite3_errmsg(db);
-    sb_putjson_text(&e, m, strlen(m));
-    sb_puts(&e, "}");
-    return e.p;
+    if (capture_failed) return sb_sql_error(db, SB_LTX_FAILED, 10, 0);
+    return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
   }
   return b.p;
 }
@@ -3513,19 +3583,16 @@ function __sbEmbeddedDispatch(msg) {
     if (op === "d1.exec") {
       // exec() takes a script; a single prepare would run only its first
       // statement and quietly drop the rest.
+      __sbD1Open(path, msg.strict === true);
       const reply = JSON.parse(__sbSqlScriptRaw(path, String(msg.sql)));
       if (reply.ok === false) throw new Error("sqlite: " + reply.error);
       return { ok: true };
     }
-    if (op === "d1.batch") {
-      const results = [];
-      const list = msg.statements || [];
-      for (let i = 0; i < list.length; i++)
-        results.push(__sbD1Run(path, list[i].sql, list[i].params));
-      return { ok: true, results };
-    }
-    const one = __sbD1Run(path, msg.sql, msg.params);
-    return { ok: true, results: one.results, meta: one.meta, success: true };
+    const strict = msg.strict === true;
+    __sbD1Open(path, strict);
+    if (op === "d1.batch") return { ok: true, results: __sbD1Batch(path, msg.statements || [], strict) };
+    const one = __sbD1Run(path, msg.sql, msg.params, strict);
+    return { ok: true, results: one.results, columns: one.columns, rows: one.rows, meta: one.meta, success: true };
   }
 
   if (op === "d1.backup") {
@@ -3979,16 +4046,99 @@ function __sbEmbeddedDispatch(msg) {
 }
 
 /** One D1 statement, shaped like the broker's d1Run. */
-function __sbD1Run(path, sql, params) {
-  const r = __sbSql(path, String(sql), params || []);
+// BEGIN D1 OPS (lifted by test/native-d1.ts)
+// D1 calls from compatibility date 2026-10-24 come with msg.strict (the shim sets it):
+// exact parameter counts, foreign keys enforced, D1's error text, and rows as arrays with
+// their column names (the shim builds the objects, so duplicate names survive in raw()).
+// A BLOB comes from C as {"$blob":"HEX"}; strict calls get it so, older ones get the one
+// char per byte string they always had.
+var __sbD1Opened = {};
+function __sbD1Open(path, strict) {
+  if (__sbD1Opened[path] === strict) return;
+  __sbD1Opened[path] = strict;
+  __sbSql(path, strict ? "PRAGMA foreign_keys = ON" : "PRAGMA foreign_keys = OFF", []);
+}
+var __sbSqliteCodes = ["", "SQLITE_ERROR", "SQLITE_INTERNAL", "SQLITE_PERM", "SQLITE_ABORT", "SQLITE_BUSY",
+  "SQLITE_LOCKED", "SQLITE_NOMEM", "SQLITE_READONLY", "SQLITE_INTERRUPT", "SQLITE_IOERR", "SQLITE_CORRUPT",
+  "SQLITE_NOTFOUND", "SQLITE_FULL", "SQLITE_CANTOPEN", "SQLITE_PROTOCOL", "SQLITE_EMPTY", "SQLITE_SCHEMA",
+  "SQLITE_TOOBIG", "SQLITE_CONSTRAINT", "SQLITE_MISMATCH", "SQLITE_MISUSE", "SQLITE_NOLFS", "SQLITE_AUTH",
+  "SQLITE_FORMAT", "SQLITE_RANGE", "SQLITE_NOTADB"];
+var __sbSqliteConstraints = { 275: "CHECK", 531: "COMMITHOOK", 787: "FOREIGNKEY", 1043: "FUNCTION",
+  1299: "NOTNULL", 1555: "PRIMARYKEY", 1811: "TRIGGER", 2067: "UNIQUE", 2323: "VTAB", 2579: "ROWID",
+  2835: "PINNED", 3091: "DATATYPE" };
+function __sbD1Error(reply) {
+  const code = Number(reply.code) || 0;
+  const base = __sbSqliteCodes[code & 255] || "";
+  let text = "D1_ERROR: " + reply.error;
+  if (reply.offset >= 0) text += " at offset " + reply.offset;
+  if (base) {
+    text += ": " + base;
+    if (__sbSqliteConstraints[code]) text += " (extended: SQLITE_CONSTRAINT_" + __sbSqliteConstraints[code] + ")";
+  }
+  return new Error(text);
+}
+function __sbD1Bytes(cell) {
+  let out = "";
+  const hex = String(cell.$blob);
+  for (let i = 0; i + 1 < hex.length; i += 2) out += String.fromCharCode(parseInt(hex.slice(i, i + 2), 16));
+  return out;
+}
+function __sbD1Run(path, sql, params, strict) {
+  const r = JSON.parse(__sbSqlRaw(path, (strict ? "/*sb-d1-strict*/" : "") + String(sql), JSON.stringify(params || [])));
+  if (r.ok === false) throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
+  const meta = { changes: r.changes, last_row_id: r.rowid, rows_read: r.rows.length };
+  if (strict) return { columns: r.cols, rows: r.rows, meta };
   const results = [];
   for (let i = 0; i < r.rows.length; i++) {
     const row = {};
-    for (let c = 0; c < r.cols.length; c++) row[r.cols[c]] = r.rows[i][c];
+    for (let c = 0; c < r.cols.length; c++) {
+      const cell = r.rows[i][c];
+      row[r.cols[c]] = cell !== null && Object(cell) === cell ? __sbD1Bytes(cell) : cell;
+    }
     results.push(row);
   }
-  return { results, meta: { changes: r.changes, last_row_id: r.rowid, rows_read: r.rows.length } };
+  return { results, meta };
 }
+// One statement of our own (SAVEPOINT, RELEASE, ...), failing in the caller's terms.
+function __sbD1Control(path, sql, strict) {
+  const r = JSON.parse(__sbSqlRaw(path, sql, "[]"));
+  if (r.ok === false) throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
+}
+// Undo after a failure, best effort: the error the caller sees is the first one. If LTX
+// capture failed, SQLite may already have committed; that error says so, and the database
+// stays closed to writes (the capture latch), so a cleanup failure must not replace it.
+function __sbD1Undo(path, savepoint) {
+  try {
+    __sbD1Control(path, "ROLLBACK TO " + savepoint, false);
+    __sbD1Control(path, "RELEASE " + savepoint, false);
+  } catch (ignored) {
+    return ignored;
+  }
+  return null;
+}
+// One transaction, like D1: a statement that fails undoes the ones before it.
+function __sbD1Batch(path, list, strict) {
+  const results = [];
+  __sbD1Control(path, "SAVEPOINT sb_d1_batch", strict);
+  try {
+    for (let i = 0; i < list.length; i++) results.push(__sbD1Run(path, list[i].sql, list[i].params, strict));
+  } catch (err) {
+    __sbD1Undo(path, "sb_d1_batch");
+    throw err;
+  }
+  __sbD1Release(path, "sb_d1_batch", strict);
+  return results;
+}
+// RELEASE of our outermost savepoint is the commit. A deferred constraint can fail it and
+// leave the transaction open: undo it. A capture failure (code 10) comes after SQLite has
+// committed: nothing to undo, and that error is the one to report.
+function __sbD1Release(path, savepoint, strict) {
+  const r = JSON.parse(__sbSqlRaw(path, "RELEASE " + savepoint, "[]"));
+  if (r.ok !== false) return;
+  if (Number(r.code) !== 10) __sbD1Undo(path, savepoint);
+  throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
+}
+// END D1 OPS
 
 /**
  * R2 object bodies, out of band (#56).

package/test/native-d1.ts

@@ -0,0 +1,283 @@
+import assert from "node:assert/strict";
+import { closeSync, openSync, readFileSync, readdirSync, readSync, writeSync } from "node:fs";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// The embedded transport's SQL runner (sb_sql_run and sb_bind_params), compiled from the
+// transport's own inline C against the system SQLite, the way native-ltx.ts does. Only
+// the C up to the D1 backup code is needed; the few runtime symbols it names are stubbed.
+const transport = await readFile(new URL("../src/transport-embedded.js", import.meta.url), "utf8");
+const start = transport.indexOf("Porffor.c`\n") + "Porffor.c`\n".length;
+const end = transport.indexOf("// #164 — an online");
+assert(start > 20 && end > start, "transport C block markers moved");
+const work = await mkdtemp(join(tmpdir(), "sb-native-d1-"));
+try {
+  await writeFile(
+    join(work, "bearssl.h"),
+    `typedef struct { int x; } br_sha256_context;
+static void br_sha256_init(br_sha256_context* c) { (void)c; }
+static void br_sha256_update(br_sha256_context* c, const void* d, unsigned long n) { (void)c; (void)d; (void)n; }
+static void br_sha256_out(const br_sha256_context* c, void* o) { (void)c; (void)o; }
+`,
+  );
+  await writeFile(join(work, "block.c"), transport.slice(start, end));
+  await writeFile(
+    join(work, "driver.c"),
+    `#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <time.h>
+#include <sys/stat.h>
+typedef struct { double val; int type; } jsval;
+typedef uint32_t u32;
+static uint32_t porf_native_fetch_alloc_bytestring(const char* d, size_t n) { (void)d; (void)n; return 0; }
+#include "block.c"
+const char* sb_standalone_app_name(void) { return "test"; }
+// One call per line: PATH \\t SQL \\t PARAMS_JSON; one reply line each. ":break PATH" makes
+// PATH's next LTX capture fail (native-ltx.ts's :break-position).
+int main(void) {
+  sb_ltx_compat = 1;  // __sbLtxConfigure at compatibility date 2026-10-22 or later
+  char* line = 0; size_t cap = 0;
+  while (getline(&line, &cap, stdin) > 0) {
+    line[strcspn(line, "\\n")] = 0;
+    if (!strncmp(line, ":break ", 7)) { line[strcspn(line, "\\t")] = 0; char p[1024]; snprintf(p, sizeof(p), "%s.ltx/position.tmp", line + 7); mkdir(p, 0700); puts("{}"); fflush(stdout); continue; }
+    char* sql = strchr(line, '\\t'); if (!sql) return 2; *sql++ = 0;
+    char* params = strchr(sql, '\\t'); if (!params) return 2; *params++ = 0;
+    char* out = sb_sql_run(line, sql, params); puts(out); fflush(stdout); free(out);
+  }
+  return 0;
+}
+`,
+  );
+  const binary = join(work, "driver");
+  const compile = Bun.spawnSync(["cc", "-O1", "-w", "-I", work, join(work, "driver.c"), "-lsqlite3", "-o", binary]);
+  assert.equal(compile.exitCode, 0, compile.stderr.toString());
+
+  const d1 = join(work, "data/d1/DB.sqlite");
+  const store = join(work, "data/store.sqlite");
+  const run = (calls: [string, string, unknown[]][]) => {
+    const input = calls.map(([path, sql, params]) => `${path}\t${sql}\t${JSON.stringify(params)}\n`).join("");
+    const p = Bun.spawnSync([binary], { stdin: Buffer.from(input) });
+    assert.equal(p.exitCode, 0, p.stderr.toString());
+    return p.stdout
+      .toString()
+      .trim()
+      .split("\n")
+      .map((l) => JSON.parse(l));
+  };
+  const blob = (bytes: number[]) => ({ $blob: Buffer.from(bytes).toString("hex") });
+
+  // A Uint8Array bind used to stop the parameter parse: it, and every parameter after it,
+  // were stored as NULL (data loss).
+  const [, , stored, other] = run([
+    [d1, "CREATE TABLE t (a TEXT, b BLOB, c TEXT)", []],
+    [d1, "INSERT INTO t VALUES (?1, ?2, ?3)", ["k", blob([0, 255, 127, 0x22]), "after"]],
+    [d1, "SELECT a, b, typeof(b) AS bt, length(b) AS bl, c FROM t", []],
+    [store, "SELECT x'00ff' AS b", []],
+  ]);
+  assert.deepEqual(
+    stored.rows,
+    [["k", { $blob: "00ff7f22" }, "blob", 4, "after"]],
+    "blob stored as a BLOB, later parameters kept",
+  );
+  assert.equal(other.rows[0][0], String(other.rows[0][0]), "outside D1 a BLOB is still one char per byte, not hex");
+
+  // An object that is not a blob binds NULL and the parse carries on (a "}" in a string included).
+  const [, kept] = run([
+    [d1, "INSERT INTO t VALUES (?1, ?2, ?3)", [{ a: "}{" }, 5, "x"]],
+    [d1, "SELECT a, b, c FROM t WHERE c = 'x'", []],
+  ]);
+  assert.deepEqual(kept.rows, [[null, 5, "x"]]);
+
+  // Strict D1 calls (compatibility date 2026-10-24) check the parameter count.
+  const [few, many, right, reuse] = run([
+    [d1, "/*sb-d1-strict*/SELECT ?1, ?2", [1]],
+    [d1, "/*sb-d1-strict*/SELECT ?1", [1, 2]],
+    [d1, "/*sb-d1-strict*/SELECT ?1 AS a", [1]],
+    [d1, "/*sb-d1-strict*/SELECT ?1 AS a, ?1 AS b, ?2 AS c", ["x", "y"]],
+  ]);
+  assert.equal(few.ok, false);
+  assert.equal(few.error, "Wrong number of parameter bindings for SQL query.");
+  assert.equal(many.ok, false);
+  assert.deepEqual(right.rows, [[1]]);
+  assert.deepEqual(reuse.rows, [["x", "x", "y"]]);
+  const [loose] = run([[d1, "SELECT ?1 AS a, ?2 AS b", [1]]]);
+  assert.deepEqual(loose.rows, [[1, null]], "without the marker a missing parameter is NULL, as before");
+
+  // Errors carry SQLite's extended code and the offset in the caller's SQL.
+  const [syntax, unique] = run([
+    [d1, "/*sb-d1-strict*/SELEC 1", []],
+    [d1, "CREATE TABLE u (id INTEGER PRIMARY KEY); INSERT INTO u VALUES (1)", []],
+  ]);
+  assert.equal(syntax.ok, false);
+  assert.equal(syntax.code, 1);
+  assert.equal(syntax.offset, 0);
+  assert.equal(unique.ok, true);
+  const [, dup] = run([
+    [d1, "INSERT INTO u VALUES (1)", []],
+    [d1, "INSERT INTO u VALUES (1)", []],
+  ]);
+  assert.equal(dup.ok, false);
+  assert.equal(dup.code, 1555, "SQLITE_CONSTRAINT_PRIMARYKEY");
+
+  // A read reports no changes, not the last write's.
+  const [write, read] = run([
+    [d1, "INSERT INTO t (a) VALUES ('z')", []],
+    [d1, "SELECT count(*) FROM t", []],
+  ]);
+  assert.equal(write.changes, 1);
+  assert.equal(read.changes, 0);
+  // The transport's D1 ops (JS), on the same C: lifted from BEGIN/END D1 OPS.
+  const opsStart = transport.indexOf("// BEGIN D1 OPS");
+  const opsEnd = transport.indexOf("// END D1 OPS");
+  assert(opsStart > 0 && opsEnd > opsStart, "D1 ops markers moved");
+  // One long-lived driver, so a SAVEPOINT spans calls as it does in a worker: FIFOs give
+  // the lifted (synchronous) ops a synchronous line protocol.
+  const fifoIn = join(work, "in"),
+    fifoOut = join(work, "out");
+  assert.equal(Bun.spawnSync(["mkfifo", fifoIn, fifoOut]).exitCode, 0);
+  const driver = Bun.spawn(["sh", "-c", `exec "${binary}" < "${fifoIn}" > "${fifoOut}"`], {
+    env: { ...process.env, SB_LTX_ENABLE: "1", SB_LTX_DATABASE: "LTX" },
+  });
+  const toDriver = openSync(fifoIn, "w"),
+    fromDriver = openSync(fifoOut, "r");
+  let pending = "";
+  const sqlRaw = (path: string, sql: string, params: string) => {
+    writeSync(toDriver, `${path}\t${sql}\t${params}\n`);
+    const chunk = Buffer.alloc(65536);
+    while (!pending.includes("\n")) {
+      const n = readSync(fromDriver, chunk, 0, chunk.length, null);
+      if (n <= 0) throw new Error("driver exited");
+      pending += chunk.toString("utf8", 0, n);
+    }
+    const line = pending.slice(0, pending.indexOf("\n"));
+    pending = pending.slice(line.length + 1);
+    return line;
+  };
+  const sql = (path: string, text: string, params: unknown[]) => {
+    const r = JSON.parse(sqlRaw(path, text, JSON.stringify(params)));
+    if (r.ok === false) throw new Error("sqlite: " + r.error);
+    return r;
+  };
+  // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
+  const ops = new Function(
+    "__sbSqlRaw",
+    "__sbSql",
+    `${transport.slice(opsStart, opsEnd)}\nreturn { __sbD1Run, __sbD1Batch, __sbD1Open };`,
+  )(sqlRaw, sql);
+  const db2 = join(work, "data/d1/OPS.sqlite");
+  ops.__sbD1Run(db2, "CREATE TABLE p (id INTEGER PRIMARY KEY)", [], false);
+  ops.__sbD1Run(db2, "CREATE TABLE c (id INTEGER PRIMARY KEY, p INTEGER REFERENCES p(id))", [], false);
+  // batch() is one transaction: the failing second insert undoes the first.
+  assert.throws(
+    () =>
+      ops.__sbD1Batch(
+        db2,
+        [
+          { sql: "INSERT INTO p VALUES (5)", params: [] },
+          { sql: "INSERT INTO p VALUES (5)", params: [] },
+        ],
+        false,
+      ),
+    /UNIQUE/,
+  );
+  assert.equal(ops.__sbD1Run(db2, "SELECT count(*) AS n FROM p", [], false).results[0].n, 0, "batch rolled back");
+  assert.equal(
+    ops.__sbD1Batch(
+      db2,
+      [
+        { sql: "INSERT INTO p VALUES (1)", params: [] },
+        { sql: "INSERT INTO p VALUES (2)", params: [] },
+      ],
+      false,
+    ).length,
+    2,
+  );
+  // Old dates: no foreign keys, a BLOB read as one char per byte, errors as before.
+  ops.__sbD1Open(db2, false);
+  ops.__sbD1Run(db2, "INSERT INTO c VALUES (1, 99)", [], false);
+  const oldBlob = ops.__sbD1Run(db2, "SELECT ?1 AS b", [{ $blob: "00ff" }], false).results[0].b;
+  assert.equal(oldBlob, "\u0000ÿ");
+  assert.throws(() => ops.__sbD1Run(db2, "SELEC 1", [], false), /^Error: sqlite: near "SELEC": syntax error$/);
+  // Strict (2026-10-24): foreign keys on, rows with columns, D1's error text.
+  ops.__sbD1Open(db2, true);
+  assert.throws(
+    () => ops.__sbD1Run(db2, "INSERT INTO c VALUES (2, 98)", [], true),
+    (e: Error) =>
+      e.message ===
+      "D1_ERROR: FOREIGN KEY constraint failed: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_FOREIGNKEY)",
+  );
+  const strictRow = ops.__sbD1Run(db2, "SELECT 1 AS a, ?1 AS a", [{ $blob: "0a" }], true);
+  assert.deepEqual([strictRow.columns, strictRow.rows], [["a", "a"], [[1, { $blob: "0a" }]]]);
+  assert.throws(
+    () => ops.__sbD1Run(db2, "SELEC 1", [], true),
+    (e: Error) => e.message === 'D1_ERROR: near "SELEC": syntax error at offset 0: SQLITE_ERROR',
+  );
+  assert.throws(
+    () => ops.__sbD1Run(db2, "INSERT INTO p VALUES (1)", [], true),
+    (e: Error) =>
+      e.message ===
+      "D1_ERROR: UNIQUE constraint failed: p.id: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_PRIMARYKEY)",
+  );
+  assert.throws(
+    () => ops.__sbD1Run(db2, "SELECT ?1", [], true),
+    (e: Error) => e.message === "D1_ERROR: Wrong number of parameter bindings for SQL query.",
+  );
+  // LTX capture on (SB_LTX_ENABLE, database LTX): a batch is one commit, and a capture
+  // that fails at RELEASE (after SQLite committed) surfaces as itself: SQLITE_IOERR with a
+  // message that says so, never "no such savepoint" from the cleanup, and the database then
+  // refuses writes until restart.
+  const ltx = join(work, "data/d1/LTX.sqlite");
+  const generation = () => join(ltx + ".ltx", readFileSync(ltx + ".ltx/position", "utf8").split("\n")[1]);
+  const ltxFiles = () => readdirSync(generation()).filter((n) => n.endsWith(".ltx")).length;
+  ops.__sbD1Open(ltx, true);
+  ops.__sbD1Run(ltx, "CREATE TABLE e (id INTEGER PRIMARY KEY, v TEXT)", [], true);
+  const beforeBatch = ltxFiles();
+  ops.__sbD1Batch(
+    ltx,
+    [
+      { sql: "INSERT INTO e VALUES (1, 'a')", params: [] },
+      { sql: "INSERT INTO e VALUES (2, 'b')", params: [] },
+    ],
+    true,
+  );
+  assert.equal(ltxFiles(), beforeBatch + 1, "a batch is one LTX commit");
+  // Break capture just before the batch's RELEASE.
+  // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
+  const breaking = new Function(
+    "__sbSqlRaw",
+    "__sbSql",
+    `${transport.slice(opsStart, opsEnd)}\nreturn { __sbD1Run, __sbD1Batch };`,
+  )((path: string, text: string, params: string) => {
+    if (text === "RELEASE sb_d1_batch") sqlRaw(":break " + path, "", "");
+    return sqlRaw(path, text, params);
+  }, sql);
+  const LTX_FAILED =
+    "D1_ERROR: LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart: SQLITE_IOERR";
+  assert.throws(
+    () => breaking.__sbD1Batch(ltx, [{ sql: "INSERT INTO e VALUES (3, 'c')", params: [] }], true),
+    (e: Error) => e.message === LTX_FAILED,
+  );
+  assert.throws(
+    () => ops.__sbD1Run(ltx, "INSERT INTO e VALUES (4, 'd')", [], true),
+    (e: Error) => e.message === LTX_FAILED,
+    "writes refused after a capture failure",
+  );
+  assert.throws(
+    () => ops.__sbD1Run(ltx, "SELECT 1", [], false),
+    /^Error: sqlite: LTX capture failed/,
+    "old dates see the same failure",
+  );
+  closeSync(toDriver);
+  closeSync(fromDriver);
+  await driver.exited;
+  console.log(
+    "native d1: sb_sql_run and the D1 ops pass (blob binds, atomic batch, strict counts, foreign keys, error text)",
+  );
+} finally {
+  await rm(work, { recursive: true, force: true });
+}

package/test/native-ltx.ts

@@ -247,6 +247,65 @@ try {
     assert.deepEqual(await readdir(join(root, epoch)), finishedBefore, "idle restart must not rewrite a base");
     assert.equal((await readdir(root)).filter((n) => n.startsWith("epoch-")).length, 1);
   }
+  // A D1 batch() (__sbD1Batch) is a SAVEPOINT around its statements, each its own call,
+  // then RELEASE: one transaction, so one LTX file with the next TXID. A rolled-back batch
+  // (ROLLBACK TO, then RELEASE) commits the pages it touched back unchanged: at most one
+  // more LTX file, and the restored database has none of its rows.
+  {
+    const batchPath = join(work, "batch.sqlite");
+    await run(batchPath, "CREATE TABLE b(id INTEGER PRIMARY KEY,value TEXT);\n");
+    const batchRoot = batchPath + ".ltx";
+    const batchEpoch = (await readdir(batchRoot)).find((n) => n.startsWith("epoch-"));
+    assert(batchEpoch);
+    const ltxFiles = async () => (await readdir(join(batchRoot, batchEpoch))).filter((n) => n.endsWith(".ltx")).sort();
+    const before = await ltxFiles();
+    const lastTxid = BigInt("0x" + before[before.length - 1].split("-")[0]);
+    const replies = await run(
+      batchPath,
+      "SAVEPOINT sb_d1_batch;\nINSERT INTO b VALUES(1,'one');\nINSERT INTO b VALUES(2,'two');\nRELEASE sb_d1_batch;\n",
+    );
+    assert(
+      replies.every((n) => n.startsWith("0 ")),
+      replies.join("\n"),
+    );
+    const after = await ltxFiles();
+    const added = after.filter((n) => !before.includes(n));
+    assert.equal(added.length, 1, "a batch is one LTX file: " + added.join(", "));
+    const [minTxid, maxTxid] = added[0]
+      .replace(".ltx", "")
+      .split("-")
+      .map((h) => BigInt("0x" + h));
+    assert.equal(minTxid, lastTxid + 1n);
+    assert.equal(maxTxid, lastTxid + 1n);
+    const rolledBack = await run(
+      batchPath,
+      "SAVEPOINT sb_d1_batch;\nINSERT INTO b VALUES(3,'three');\nROLLBACK TO sb_d1_batch;\nRELEASE sb_d1_batch;\n",
+    );
+    assert(
+      rolledBack.every((n) => n.startsWith("0 ")),
+      rolledBack.join("\n"),
+    );
+    const afterRollback = await ltxFiles();
+    assert(afterRollback.length <= after.length + 1, "a rolled-back batch writes at most one LTX file");
+    // If it writes one, it holds page 1 only (SQLite bumps the header of the page it had
+    // dirtied: the file change counter and version-valid-for number, bytes 24-27 and 92-95,
+    // so the pre- and post-apply checksums differ); the rows are checked below.
+    for (const name of afterRollback.filter((n) => !after.includes(n))) {
+      const b = new Uint8Array(await readFile(join(batchRoot, batchEpoch, name)));
+      const v = new DataView(b.buffer, b.byteOffset, b.byteLength);
+      assert.equal(v.getUint32(100), 1, "first page of the rolled-back batch's LTX file");
+      assert.equal(v.getUint32(106 + 4 + v.getUint32(106)), 0, "the rolled-back batch's LTX file holds one page");
+    }
+    const batchRestore = join(work, "batch-restored.sqlite");
+    await restore(join(batchRoot, batchEpoch), batchRestore);
+    assert.deepEqual(await readFile(batchRestore), await readFile(batchPath));
+    const check = new Database(batchRestore);
+    assert.deepEqual(check.query("SELECT id, value FROM b ORDER BY id").all(), [
+      { id: 1, value: "one" },
+      { id: 2, value: "two" },
+    ]);
+    check.close();
+  }
   // Size alone is not enough: an offline committed change must invalidate a clean marker.
   const offline = new Database(path);
   offline.exec("UPDATE t SET value='changed-offline' WHERE id=1");