@yielded/auth-persistence 0.1.0-beta.7

package/src/internal/proof-kernel.ts

@@ -0,0 +1,1949 @@
+import {
+  coordinateCommit,
+  CurrentCommitJournal,
+  hasCommitScope,
+  LifecycleHooks,
+  HookConfigurationError,
+} from "@yielded/auth/Hooks";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import {
+  type ProofCompletionPlan,
+  ProofBinding,
+  type ProofAttemptDecision,
+  type ProofCleanupResult,
+  type ProofCompletionDecision,
+  type ProofDeliveryOutcome,
+  type ProofVersion,
+  type ProofBudget,
+  type ProofPolicy,
+  ProofPersistence,
+  type ProofDeliveryClaim,
+  ProofRequestConflict,
+  ProofUnavailable,
+} from "@yielded/auth/Proofs";
+/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */
+import type { Table, sql } from "drizzle-orm";
+import type { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
+import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import type * as SqlError from "effect/unstable/sql/SqlError";
+
+import {
+  CurrentPasswordPreparedTransaction,
+  PasswordPreparedPostconditions,
+} from "../drizzle/PasswordPreparedPostconditions";
+import {
+  type AnyProofPersistenceMapping,
+  requiredProofConstraints,
+  type ProofPersistenceMapping,
+  type ProofAction,
+  type ProofCommandDecision,
+  type ProofContinuationRecord,
+  type ProofScopeKeys,
+  type ProofScopeKind,
+} from "../drizzle/proof-model";
+import { PersistenceMappingError } from "./mapping-error";
+import type { QueryOperations } from "./query-operations";
+
+type AdapterFailure = EffectDrizzleQueryError | PersistenceMappingError | SqlError.SqlError;
+
+export interface ProofSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {
+  readonly getSQL: () => ReturnType<typeof sql>;
+  readonly from: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly where: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly limit: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly orderBy: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly for: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly set: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly values: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+}
+
+export interface ProofSqlDatabase {
+  readonly select: (...args: ReadonlyArray<any>) => ProofSqlQuery;
+  readonly insert: (...args: ReadonlyArray<any>) => ProofSqlQuery;
+  readonly update: (...args: ReadonlyArray<any>) => ProofSqlQuery;
+  readonly delete: (...args: ReadonlyArray<any>) => ProofSqlQuery;
+  readonly transaction: <A, E, R>(
+    body: (transaction: ProofSqlDatabase) => Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | SqlError.SqlError, R>;
+}
+
+export class CurrentProofSql extends Context.Service<CurrentProofSql, ProofSqlDatabase>()(
+  "effect-auth/CurrentProofSql",
+) {}
+
+export interface ProofSqlConfiguration {
+  readonly mode: "interactive" | "synchronous";
+  readonly locking: boolean;
+  readonly standaloneGuard: Effect.Effect<void, ProofUnavailable>;
+  readonly coordinated?: boolean;
+  /** Dialect-native insert-if-absent used to create serialization anchors. */
+  readonly insertIfAbsent: (
+    query: ProofSqlQuery,
+    selfKey: string,
+    selfValue: unknown,
+  ) => ProofSqlQuery;
+}
+
+type Database = ProofSqlDatabase;
+
+type Mapping = AnyProofPersistenceMapping;
+
+interface ScopeEntry {
+  readonly kind: ProofScopeKind;
+  readonly key: string;
+  readonly budget: ProofBudget;
+}
+
+export const makeProofKernel = (operations: QueryOperations) => {
+  const { and, eq, gte, inArray, isNull, lte, notExists, sql, column, updateValues } = operations;
+  const unavailable = () => ProofUnavailable.make({});
+
+  const translateFailure = <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, ProofUnavailable, R> =>
+    reportPersistenceFailure(
+      effect,
+      (error) => Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error),
+    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+
+  const translateIssueFailure = <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, ProofUnavailable | ProofRequestConflict, R> =>
+    reportPersistenceFailure(
+      effect,
+      (error) =>
+        Schema.is(ProofUnavailable)(error) ||
+        Schema.is(ProofRequestConflict)(error) ||
+        Schema.is(HookConfigurationError)(error),
+    ).pipe(
+      Effect.catchCause((cause) =>
+        Effect.failCause(
+          Cause.map(cause, (error) =>
+            Schema.is(ProofRequestConflict)(error) ? error : unavailable(),
+          ),
+        ),
+      ),
+    );
+
+  const conflict = () => ProofRequestConflict.make({});
+
+  const validConstraints = (mapping: Mapping) =>
+    Object.entries(requiredProofConstraints).every(
+      ([key, value]) => mapping.constraints[key as keyof typeof requiredProofConstraints] === value,
+    );
+
+  const selectRows = (query: ProofSqlQuery, locking: boolean) =>
+    locking && typeof query.for === "function" ? query.for("update") : query;
+
+  const allocateVersion = (
+    mapping: Mapping,
+    mode: ProofSqlConfiguration["mode"],
+  ): Effect.Effect<ProofVersion, ProofUnavailable | PersistenceMappingError> => {
+    if (mode === "synchronous")
+      return mapping.allocateVersionSync === undefined
+        ? Effect.fail(unavailable())
+        : Effect.try({
+            try: mapping.allocateVersionSync,
+            catch: (cause) => new PersistenceMappingError({ operation: "mapping", cause }),
+          });
+    if (mapping.allocateVersion !== undefined) return mapping.allocateVersion;
+
+    return mapping.allocateVersionSync === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({
+          try: mapping.allocateVersionSync,
+          catch: (cause) => new PersistenceMappingError({ operation: "mapping", cause }),
+        });
+  };
+
+  const canonicalBinding = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
+
+  const sameBinding = (left: ProofBinding, right: ProofBinding): boolean =>
+    canonicalBinding(left) === canonicalBinding(right);
+
+  const requestColumns = (mapping: Mapping) => ({
+    moduleId: column(mapping.request.table, mapping.request.moduleId),
+    requestId: column(mapping.request.table, mapping.request.requestId),
+    fingerprint: column(mapping.request.table, mapping.request.fingerprint),
+    proofId: column(mapping.request.table, mapping.request.proofId),
+    retentionUntil: column(mapping.request.table, mapping.request.retentionUntil),
+  });
+
+  const seriesColumns = (mapping: Mapping) => ({
+    moduleId: column(mapping.series.table, mapping.series.moduleId),
+    purpose: column(mapping.series.table, mapping.series.purpose),
+    scopeKey: column(mapping.series.table, mapping.series.scopeKey),
+    activeProofId: column(mapping.series.table, mapping.series.activeProofId),
+    lastIssueAt: column(mapping.series.table, mapping.series.lastIssueAt),
+    version: column(mapping.series.table, mapping.series.version),
+  });
+
+  const generationColumns = (mapping: Mapping) => ({
+    moduleId: column(mapping.generation.table, mapping.generation.moduleId),
+    purpose: column(mapping.generation.table, mapping.generation.purpose),
+    proofId: column(mapping.generation.table, mapping.generation.proofId),
+    requestId: column(mapping.generation.table, mapping.generation.requestId),
+    seriesKey: column(mapping.generation.table, mapping.generation.seriesKey),
+    deliveryId: column(mapping.generation.table, mapping.generation.deliveryId),
+    verifierKeyId: column(mapping.generation.table, mapping.generation.verifierKeyId),
+    verifierDigest: column(mapping.generation.table, mapping.generation.verifierDigest),
+    issuedAt: column(mapping.generation.table, mapping.generation.issuedAt),
+    expiresAt: column(mapping.generation.table, mapping.generation.expiresAt),
+    version: column(mapping.generation.table, mapping.generation.version),
+    state: column(mapping.generation.table, mapping.generation.state),
+    sendCount: column(mapping.generation.table, mapping.generation.sendCount),
+    deliveryState: column(mapping.generation.table, mapping.generation.deliveryState),
+    claimVersion: column(mapping.generation.table, mapping.generation.claimVersion),
+    claimDeadline: column(mapping.generation.table, mapping.generation.claimDeadline),
+    retryAt: column(mapping.generation.table, mapping.generation.retryAt),
+    deliveryRetryMillis: column(mapping.generation.table, mapping.generation.deliveryRetryMillis),
+    retentionUntil: column(mapping.generation.table, mapping.generation.retentionUntil),
+  });
+
+  const continuationColumns = (mapping: Mapping) => ({
+    moduleId: column(mapping.continuation.table, mapping.continuation.moduleId),
+    purpose: column(mapping.continuation.table, mapping.continuation.purpose),
+    continuationId: column(mapping.continuation.table, mapping.continuation.continuationId),
+    digest: column(mapping.continuation.table, mapping.continuation.digest),
+    proofId: column(mapping.continuation.table, mapping.continuation.proofId),
+    seriesKey: column(mapping.continuation.table, mapping.continuation.seriesKey),
+    expiresAt: column(mapping.continuation.table, mapping.continuation.expiresAt),
+    consumed: column(mapping.continuation.table, mapping.continuation.consumed),
+    version: column(mapping.continuation.table, mapping.continuation.version),
+    retentionUntil: column(mapping.continuation.table, mapping.continuation.retentionUntil),
+  });
+
+  const scopeColumns = (mapping: Mapping) => ({
+    moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
+    purpose: column(mapping.rateScope.table, mapping.rateScope.purpose),
+    action: column(mapping.rateScope.table, mapping.rateScope.action),
+    scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
+    scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey),
+  });
+
+  const abuseColumns = (mapping: Mapping) => ({
+    moduleId: column(mapping.abuseEvent.table, mapping.abuseEvent.moduleId),
+    purpose: column(mapping.abuseEvent.table, mapping.abuseEvent.purpose),
+    action: column(mapping.abuseEvent.table, mapping.abuseEvent.action),
+    scopeKind: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKind),
+    scopeKey: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKey),
+    commandId: column(mapping.abuseEvent.table, mapping.abuseEvent.commandId),
+    occurredAt: column(mapping.abuseEvent.table, mapping.abuseEvent.occurredAt),
+    retentionUntil: column(mapping.abuseEvent.table, mapping.abuseEvent.retentionUntil),
+  });
+
+  const failureColumns = (mapping: Mapping) => ({
+    moduleId: column(mapping.failureEvent.table, mapping.failureEvent.moduleId),
+    purpose: column(mapping.failureEvent.table, mapping.failureEvent.purpose),
+    seriesKey: column(mapping.failureEvent.table, mapping.failureEvent.seriesKey),
+    commandId: column(mapping.failureEvent.table, mapping.failureEvent.commandId),
+    occurredAt: column(mapping.failureEvent.table, mapping.failureEvent.occurredAt),
+    retentionUntil: column(mapping.failureEvent.table, mapping.failureEvent.retentionUntil),
+  });
+
+  const commandColumns = (mapping: Mapping) => ({
+    moduleId: column(mapping.command.table, mapping.command.moduleId),
+    commandId: column(mapping.command.table, mapping.command.commandId),
+    kind: column(mapping.command.table, mapping.command.kind),
+    decision: column(mapping.command.table, mapping.command.decision),
+    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),
+  });
+
+  const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));
+
+  const lockAuthority = Effect.fn("DrizzleProof.lockAuthority")(function* (
+    mapping: Mapping,
+    moduleId: string,
+    purpose: any,
+    binding: ProofBinding,
+    locking: boolean,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    const authority = mapping.authority;
+    let nativeSubjectId: unknown | undefined;
+
+    // Canonical order: subject, identifier rows, credentials sorted by ID.
+    if (binding._tag !== "Identifier") {
+      if (
+        authority.subject === undefined ||
+        authority.credential === undefined ||
+        authority.subjectId === undefined
+      )
+        return yield* unavailable();
+      nativeSubjectId = yield* authority.subjectId.toNative(binding.revision.subjectId);
+      const subject = authority.subject;
+
+      const rows = yield* selectRows(
+        database
+          .select()
+          .from(subject.table)
+          .where(eq(column(subject.table, subject.id), nativeSubjectId))
+          .limit(1),
+        locking,
+      );
+
+      const row = rows[0];
+
+      if (
+        row === undefined ||
+        !subject.isActiveStatus(row[subject.status]) ||
+        row[subject.securityRevision] !== binding.revision.securityRevision
+      )
+        return false;
+    }
+    const identifier = authority.identifier;
+
+    const identifierRows = yield* selectRows(
+      database
+        .select()
+        .from(identifier.table)
+        .where(
+          and(
+            eq(column(identifier.table, identifier.namespace), binding.identifier.namespace),
+            eq(column(identifier.table, identifier.value), binding.identifier.value),
+          ),
+        ),
+      locking,
+    );
+
+    if (
+      !identifier.isCurrent(
+        {
+          moduleId,
+          purpose,
+          binding,
+          ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }),
+        },
+        identifierRows,
+      )
+    )
+      return false;
+    if (binding._tag === "Identifier") return true;
+    const credential = authority.credential!;
+
+    const expected = [...binding.revision.credentials].sort((a, b) =>
+      a.credentialId.localeCompare(b.credentialId),
+    );
+
+    const rows =
+      expected.length === 0
+        ? []
+        : yield* selectRows(
+            database
+              .select()
+              .from(credential.table)
+              .where(
+                and(
+                  eq(column(credential.table, credential.subjectId), nativeSubjectId),
+                  inArray(
+                    column(credential.table, credential.credentialId),
+                    expected.map((item) => item.credentialId),
+                  ),
+                ),
+              ),
+            locking,
+          );
+
+    if (rows.length !== expected.length) return false;
+
+    const actual = rows
+      .map((row: any) => ({
+        credentialId: row[credential.credentialId] as string,
+        revision: row[credential.revision],
+        active:
+          credential.status === undefined ||
+          credential.isActiveStatus?.(row[credential.status]) === true,
+      }))
+      .sort((a: any, b: any) => a.credentialId.localeCompare(b.credentialId));
+
+    return actual.every(
+      (item: any, index: number) =>
+        item.active &&
+        item.credentialId === expected[index]?.credentialId &&
+        item.revision === expected[index]?.revision,
+    );
+  });
+
+  const scopeEntries = (
+    keys: ProofScopeKeys,
+    binding: ProofBinding,
+    action: ProofAction,
+    policy: ProofPolicy,
+  ): ReadonlyArray<ScopeEntry> => {
+    const suffix = action === "issue" ? "Issues" : "Attempts";
+    const simple = action === "issue" ? "issues" : "attempts";
+
+    const entries: ScopeEntry[] = [
+      { kind: "action", key: "*", budget: policy.abuse[`action${suffix}`] },
+      { kind: "identifier", key: keys.identifier, budget: policy.abuse[simple] },
+    ];
+
+    if (binding._tag !== "Identifier")
+      entries.push({
+        kind: "subject",
+        key: keys.subject,
+        budget: policy.abuse[`subject${suffix}`],
+      });
+
+    return entries;
+  };
+
+  const lockScopes = Effect.fn("DrizzleProof.lockScopes")(function* (
+    mapping: Mapping,
+    configuration: ProofSqlConfiguration,
+    moduleId: string,
+    purpose: any,
+    action: ProofAction,
+    entries: ReadonlyArray<ScopeEntry>,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    const c = scopeColumns(mapping);
+
+    for (const entry of entries) {
+      const values = mapping.rateScope.encodeInsert({
+        moduleId,
+        purpose,
+        action,
+        scopeKind: entry.kind,
+        scopeKey: entry.key,
+      });
+
+      const query = database.insert(mapping.rateScope.table).values(values);
+
+      yield* configuration.insertIfAbsent(query, mapping.rateScope.scopeKey, entry.key);
+      yield* selectRows(
+        database
+          .select()
+          .from(mapping.rateScope.table)
+          .where(
+            and(
+              eq(c.moduleId, moduleId),
+              eq(c.purpose, purpose),
+              eq(c.action, action),
+              eq(c.scopeKind, entry.kind),
+              eq(c.scopeKey, entry.key),
+            ),
+          )
+          .limit(1),
+        configuration.locking,
+      );
+    }
+  });
+
+  const admittedScopes = Effect.fn("DrizzleProof.admittedScopes")(function* (
+    mapping: Mapping,
+    moduleId: string,
+    purpose: any,
+    action: ProofAction,
+    entries: ReadonlyArray<ScopeEntry>,
+    now: number,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    const c = abuseColumns(mapping);
+    const admitted: ScopeEntry[] = [];
+
+    for (const entry of entries) {
+      const rows = yield* selectRows(
+        database
+          .select({ commandId: c.commandId })
+          .from(mapping.abuseEvent.table)
+          .where(
+            and(
+              eq(c.moduleId, moduleId),
+              eq(c.purpose, purpose),
+              eq(c.action, action),
+              eq(c.scopeKind, entry.kind),
+              eq(c.scopeKey, entry.key),
+              gte(c.occurredAt, mapping.encodeInstant(now - entry.budget.windowMillis)),
+            ),
+          )
+          .limit(entry.budget.limit),
+        true,
+      );
+
+      if (rows.length < entry.budget.limit) admitted.push(entry);
+    }
+
+    return admitted;
+  });
+
+  const insertScopeEvents = Effect.fn("Drizzle.insertScopeEvents")(function* (
+    mapping: Mapping,
+    moduleId: string,
+    purpose: any,
+    action: ProofAction,
+    commandId: string,
+    entries: ReadonlyArray<ScopeEntry>,
+    now: number,
+    retentionUntil: number,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    return yield* Effect.forEach(
+      entries,
+      (entry) =>
+        database.insert(mapping.abuseEvent.table).values(
+          mapping.abuseEvent.encodeInsert({
+            moduleId,
+            purpose,
+            action,
+            scopeKind: entry.kind,
+            scopeKey: entry.key,
+            commandId,
+            occurredAtMillis: now,
+            retentionUntilMillis: retentionUntil,
+          }),
+        ),
+      { discard: true },
+    );
+  });
+
+  const ensureSeries = Effect.fn("DrizzleProof.ensureSeries")(function* (
+    mapping: Mapping,
+    configuration: ProofSqlConfiguration,
+    moduleId: string,
+    purpose: any,
+    scopeKey: string,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    const c = seriesColumns(mapping);
+    const initialVersion = yield* allocateVersion(mapping, configuration.mode);
+
+    const query = database
+      .insert(mapping.series.table)
+      .values(
+        mapping.series.encodeInsert({ moduleId, purpose, scopeKey, version: initialVersion }),
+      );
+
+    yield* configuration.insertIfAbsent(query, mapping.series.scopeKey, scopeKey);
+
+    const rows = yield* selectRows(
+      database
+        .select()
+        .from(mapping.series.table)
+        .where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.scopeKey, scopeKey)))
+        .limit(1),
+      configuration.locking,
+    );
+
+    return rows[0] ?? (yield* unavailable());
+  });
+
+  const readGeneration = Effect.fn("Drizzle.readGeneration")(function* (
+    mapping: Mapping,
+    moduleId: string,
+    proofId: string,
+    locking: boolean,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    const c = generationColumns(mapping);
+
+    return yield* selectRows(
+      database
+        .select()
+        .from(mapping.generation.table)
+        .where(and(eq(c.moduleId, moduleId), eq(c.proofId, proofId)))
+        .limit(1),
+      locking,
+    );
+  });
+
+  const failureCount = Effect.fn("DrizzleProof.failureCount")(function* (
+    mapping: Mapping,
+    moduleId: string,
+    purpose: any,
+    seriesKey: string,
+    now: number,
+    policy: ProofPolicy,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    const c = failureColumns(mapping);
+
+    const rows = yield* selectRows(
+      database
+        .select({ commandId: c.commandId })
+        .from(mapping.failureEvent.table)
+        .where(
+          and(
+            eq(c.moduleId, moduleId),
+            eq(c.purpose, purpose),
+            eq(c.seriesKey, seriesKey),
+            gte(c.occurredAt, mapping.encodeInstant(now - policy.abuse.attempts.windowMillis)),
+          ),
+        )
+        .limit(policy.maximumFailedAttempts),
+      true,
+    );
+
+    return rows.length;
+  });
+
+  const commandRow = Effect.fn("Drizzle.commandRow")(function* (
+    mapping: Mapping,
+    moduleId: string,
+    commandId: string,
+    locking: boolean,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    const c = commandColumns(mapping);
+
+    return yield* selectRows(
+      database
+        .select()
+        .from(mapping.command.table)
+        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))
+        .limit(1),
+      locking,
+    );
+  });
+
+  const insertCommand = Effect.fn("Drizzle.insertCommand")(function* (
+    mapping: Mapping,
+    moduleId: string,
+    commandId: string,
+    kind: "attempt" | "complete",
+    decision: ProofCommandDecision,
+    retentionUntil: number,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    return yield* database.insert(mapping.command.table).values(
+      mapping.command.encodeInsert({
+        moduleId,
+        commandId,
+        kind,
+        decision,
+        retentionUntilMillis: retentionUntil,
+      }),
+    );
+  });
+
+  const owned = <A, E, R>(
+    database: Database,
+    mapping: Mapping,
+    configuration: ProofSqlConfiguration,
+    body: Effect.Effect<A, E, R>,
+  ) => {
+    if (!validConstraints(mapping)) return Effect.fail(unavailable());
+
+    const run = coordinateCommit(
+      () =>
+        database.transaction((transaction) =>
+          body.pipe(Effect.provideService(CurrentProofSql, transaction)),
+        ),
+      { mode: configuration.mode },
+    ).pipe(Effect.map((result) => result.value));
+
+    return configuration.coordinated !== true
+      ? Effect.gen(function* () {
+          if (yield* hasCommitScope) return yield* unavailable();
+          yield* configuration.standaloneGuard;
+
+          return yield* run;
+        })
+      : run;
+  };
+
+  const makeSqlProofPersistence = Effect.fn("makeSqlProofPersistence")(function* (
+    database: Database,
+    mapping: Mapping,
+    configuration: ProofSqlConfiguration,
+  ): Effect.fn.Return<ProofPersistence["Service"], never, LifecycleHooks> {
+    const hooks = yield* LifecycleHooks;
+
+    return ProofPersistence.of({
+      issue: (input, prepare) =>
+        owned(
+          database,
+          mapping,
+          configuration,
+          Effect.gen(function* () {
+            const transaction = yield* CurrentProofSql;
+            const journal = yield* CurrentCommitJournal;
+
+            const keys = mapping.scopeKeys({
+              moduleId: input.record.moduleId,
+              purpose: input.record.purpose,
+              binding: input.record.binding,
+            });
+
+            const authorityCurrent = yield* lockAuthority(
+              mapping,
+              input.record.moduleId,
+              input.record.purpose,
+              input.record.binding,
+              configuration.locking,
+            );
+
+            const scopes = scopeEntries(keys, input.record.binding, "issue", input.policy);
+
+            yield* lockScopes(
+              mapping,
+              configuration,
+              input.record.moduleId,
+              input.record.purpose,
+              "issue",
+              scopes.slice(0, 1),
+            );
+            const actionNow = yield* nowMillis;
+
+            const actionOpen =
+              (yield* admittedScopes(
+                mapping,
+                input.record.moduleId,
+                input.record.purpose,
+                "issue",
+                scopes.slice(0, 1),
+                actionNow,
+              )).length === 1;
+
+            if (actionOpen)
+              yield* lockScopes(
+                mapping,
+                configuration,
+                input.record.moduleId,
+                input.record.purpose,
+                "issue",
+                scopes.slice(1),
+              );
+
+            const series = actionOpen
+              ? yield* ensureSeries(
+                  mapping,
+                  configuration,
+                  input.record.moduleId,
+                  input.record.purpose,
+                  keys.series,
+                )
+              : undefined;
+
+            const now = yield* nowMillis;
+            const retentionUntil = now + input.policy.requestRetentionMillis;
+            const rc = requestColumns(mapping);
+
+            let requestRows = yield* selectRows(
+              transaction
+                .select()
+                .from(mapping.request.table)
+                .where(
+                  and(
+                    eq(rc.moduleId, input.record.moduleId),
+                    eq(rc.requestId, input.record.requestId),
+                  ),
+                )
+                .limit(1),
+              configuration.locking,
+            );
+
+            let request = requestRows[0];
+
+            if (request !== undefined) {
+              const retainedUntil = yield* mapping.decodeInstant(
+                request[mapping.request.retentionUntil],
+              );
+
+              if (retainedUntil > now) {
+                if (request[mapping.request.fingerprint] !== input.record.fingerprint)
+                  return yield* conflict();
+                const receipt = yield* mapping.request.decodeReceipt(request);
+
+                return prepare({ _tag: "Existing", receipt }, journal);
+              }
+              yield* transaction
+                .delete(mapping.request.table)
+                .where(
+                  and(
+                    eq(rc.moduleId, input.record.moduleId),
+                    eq(rc.requestId, input.record.requestId),
+                    lte(rc.retentionUntil, mapping.encodeInstant(now)),
+                  ),
+                );
+            }
+
+            const requestInsert = mapping.request.encodeInsert({
+              record: input.record,
+              createdAtMillis: now,
+              retentionUntilMillis: retentionUntil,
+            });
+
+            const requestQuery = transaction.insert(mapping.request.table).values(requestInsert);
+
+            yield* configuration.insertIfAbsent(
+              requestQuery,
+              mapping.request.requestId,
+              input.record.requestId,
+            );
+            requestRows = yield* selectRows(
+              transaction
+                .select()
+                .from(mapping.request.table)
+                .where(
+                  and(
+                    eq(rc.moduleId, input.record.moduleId),
+                    eq(rc.requestId, input.record.requestId),
+                  ),
+                )
+                .limit(1),
+              configuration.locking,
+            );
+            request = requestRows[0];
+
+            if (request === undefined) return yield* unavailable();
+            if (request[mapping.request.fingerprint] !== input.record.fingerprint)
+              return yield* conflict();
+            if (request[mapping.request.proofId] !== input.record.proofId) {
+              const receipt = yield* mapping.request.decodeReceipt(request);
+
+              return prepare({ _tag: "Existing", receipt }, journal);
+            }
+
+            const admitted = actionOpen
+              ? yield* admittedScopes(
+                  mapping,
+                  input.record.moduleId,
+                  input.record.purpose,
+                  "issue",
+                  scopes,
+                  now,
+                )
+              : [];
+
+            const sc = seriesColumns(mapping);
+
+            const lastIssueAt =
+              series?.[mapping.series.lastIssueAt] === null ||
+              series?.[mapping.series.lastIssueAt] === undefined
+                ? undefined
+                : yield* mapping.decodeInstant(series[mapping.series.lastIssueAt]);
+
+            const activeProofId = series?.[mapping.series.activeProofId] as
+              | string
+              | null
+              | undefined;
+
+            const supersedesCurrent =
+              input.supersedes === undefined || input.supersedes === activeProofId;
+
+            const allowed =
+              authorityCurrent &&
+              input.eligible &&
+              admitted.length === scopes.length &&
+              input.record.issuedAtMillis <= now &&
+              input.record.expiresAtMillis > now &&
+              supersedesCurrent &&
+              (lastIssueAt === undefined ||
+                now - lastIssueAt >= input.policy.abuse.resendCooldownMillis);
+
+            const receipt = {
+              requestId: input.record.requestId,
+              reference: {
+                proofId: input.record.proofId,
+                purpose: input.record.purpose,
+                keyId: input.record.verifier.keyId,
+              },
+            };
+
+            const prepared = prepare(
+              allowed
+                ? ({ _tag: "Issued", record: input.record } as const)
+                : ({ _tag: "Suppressed", receipt } as const),
+              journal,
+            );
+
+            if (admitted.length > 0)
+              yield* insertScopeEvents(
+                mapping,
+                input.record.moduleId,
+                input.record.purpose,
+                "issue",
+                input.record.requestId,
+                admitted,
+                now,
+                retentionUntil,
+              );
+            if (!allowed) return prepared;
+            if (activeProofId !== null && activeProofId !== undefined)
+              yield* transaction
+                .update(mapping.generation.table)
+                .set(updateValues<any>([[mapping.generation.state, "superseded"]]))
+                .where(
+                  and(
+                    eq(generationColumns(mapping).moduleId, input.record.moduleId),
+                    eq(generationColumns(mapping).proofId, activeProofId),
+                    eq(generationColumns(mapping).state, "active"),
+                  ),
+                );
+            yield* transaction.insert(mapping.generation.table).values(
+              mapping.generation.encodeInsert({
+                record: input.record,
+                seriesKey: keys.series,
+                retentionUntilMillis: retentionUntil,
+                state: "active",
+                deliveryState: "new",
+                policy: input.policy,
+              }),
+            );
+            const nextVersion = yield* allocateVersion(mapping, configuration.mode);
+
+            yield* transaction
+              .update(mapping.series.table)
+              .set(
+                updateValues<any>([
+                  [mapping.series.activeProofId, input.record.proofId],
+                  [mapping.series.lastIssueAt, mapping.encodeInstant(now)],
+                  [mapping.series.version, nextVersion],
+                ]),
+              )
+              .where(
+                and(
+                  eq(sc.moduleId, input.record.moduleId),
+                  eq(sc.purpose, input.record.purpose),
+                  eq(sc.scopeKey, keys.series),
+                ),
+              );
+
+            return prepared;
+          }),
+        ).pipe(
+          Effect.provideService(CurrentProofSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateIssueFailure,
+        ),
+      attempt: (input, prepare) =>
+        owned(
+          database,
+          mapping,
+          configuration,
+          Effect.gen(function* () {
+            const transaction = yield* CurrentProofSql;
+            const journal = yield* CurrentCommitJournal;
+
+            const keys = mapping.scopeKeys({
+              moduleId: input.moduleId,
+              purpose: input.purpose,
+              binding: input.binding,
+            });
+
+            const authorityCurrent = yield* lockAuthority(
+              mapping,
+              input.moduleId,
+              input.purpose,
+              input.binding,
+              configuration.locking,
+            );
+
+            const scopes = scopeEntries(keys, input.binding, "attempt", input.policy);
+
+            yield* lockScopes(
+              mapping,
+              configuration,
+              input.moduleId,
+              input.purpose,
+              "attempt",
+              scopes.slice(0, 1),
+            );
+            const actionNow = yield* nowMillis;
+
+            const actionOpen =
+              (yield* admittedScopes(
+                mapping,
+                input.moduleId,
+                input.purpose,
+                "attempt",
+                scopes.slice(0, 1),
+                actionNow,
+              )).length === 1;
+
+            if (actionOpen)
+              yield* lockScopes(
+                mapping,
+                configuration,
+                input.moduleId,
+                input.purpose,
+                "attempt",
+                scopes.slice(1),
+              );
+
+            const series = actionOpen
+              ? yield* ensureSeries(
+                  mapping,
+                  configuration,
+                  input.moduleId,
+                  input.purpose,
+                  keys.series,
+                )
+              : undefined;
+
+            const generation = (yield* readGeneration(
+              mapping,
+              input.moduleId,
+              input.proofId,
+              configuration.locking,
+            ))[0];
+
+            const existingCommand = (yield* commandRow(
+              mapping,
+              input.moduleId,
+              input.continuationId,
+              configuration.locking,
+            ))[0];
+
+            if (existingCommand !== undefined) {
+              if (existingCommand[mapping.command.decision] === "rejected")
+                return prepare({ _tag: "Rejected" }, journal);
+
+              return yield* unavailable();
+            }
+            const now = yield* nowMillis;
+
+            const admitted = actionOpen
+              ? yield* admittedScopes(
+                  mapping,
+                  input.moduleId,
+                  input.purpose,
+                  "attempt",
+                  scopes,
+                  now,
+                )
+              : [];
+
+            const failures = yield* failureCount(
+              mapping,
+              input.moduleId,
+              input.purpose,
+              keys.series,
+              now,
+              input.policy,
+            );
+
+            const gc = generationColumns(mapping);
+            const activeProofId = series?.[mapping.series.activeProofId];
+
+            const storedBinding =
+              generation === undefined
+                ? undefined
+                : yield* mapping.generation.decodeBinding(generation);
+
+            const candidateMatches =
+              generation !== undefined &&
+              input.candidate !== undefined &&
+              generation[mapping.generation.verifierKeyId] === input.candidate.keyId &&
+              generation[mapping.generation.verifierDigest] === input.candidate.digest;
+
+            const currentGeneration =
+              generation !== undefined &&
+              generation[mapping.generation.purpose] === input.purpose &&
+              generation[mapping.generation.state] === "active" &&
+              activeProofId === input.proofId &&
+              storedBinding !== undefined &&
+              sameBinding(storedBinding, input.binding) &&
+              Number(yield* mapping.decodeInstant(generation[mapping.generation.expiresAt])) > now;
+
+            const accepted =
+              authorityCurrent &&
+              currentGeneration &&
+              candidateMatches &&
+              admitted.length === scopes.length &&
+              failures < input.policy.maximumFailedAttempts;
+
+            const retentionUntil = now + input.policy.requestRetentionMillis;
+
+            if (!accepted) {
+              const prepared = prepare({ _tag: "Rejected" }, journal);
+
+              yield* insertCommand(
+                mapping,
+                input.moduleId,
+                input.continuationId,
+                "attempt",
+                "rejected",
+                retentionUntil,
+              );
+              yield* insertScopeEvents(
+                mapping,
+                input.moduleId,
+                input.purpose,
+                "attempt",
+                input.continuationId,
+                admitted,
+                now,
+                retentionUntil,
+              );
+              if (
+                admitted.length === scopes.length &&
+                currentGeneration &&
+                !candidateMatches &&
+                failures < input.policy.maximumFailedAttempts
+              )
+                yield* transaction.insert(mapping.failureEvent.table).values(
+                  mapping.failureEvent.encodeInsert({
+                    moduleId: input.moduleId,
+                    purpose: input.purpose,
+                    seriesKey: keys.series,
+                    commandId: input.continuationId,
+                    occurredAtMillis: now,
+                    retentionUntilMillis: retentionUntil,
+                  }),
+                );
+
+              return prepared;
+            }
+            const version = yield* allocateVersion(mapping, configuration.mode);
+
+            const expiresAt = Math.min(
+              Number(yield* mapping.decodeInstant(generation![mapping.generation.expiresAt])),
+              now + input.policy.continuationLifetimeMillis,
+            );
+
+            const continuation: ProofContinuationRecord = {
+              moduleId: input.moduleId,
+              purpose: input.purpose,
+              continuationId: input.continuationId,
+              digest: input.continuationDigest,
+              proofId: input.proofId,
+              seriesKey: keys.series,
+              binding: input.binding,
+              expiresAtMillis: expiresAt,
+              version,
+            };
+
+            const decision: ProofAttemptDecision = {
+              _tag: "Accepted",
+              continuation: {
+                continuationId: input.continuationId,
+                purpose: input.purpose,
+                expiresAtMillis: expiresAt,
+              },
+            };
+
+            const prepared = prepare(decision, journal);
+
+            yield* insertCommand(
+              mapping,
+              input.moduleId,
+              input.continuationId,
+              "attempt",
+              "accepted",
+              retentionUntil,
+            );
+            yield* insertScopeEvents(
+              mapping,
+              input.moduleId,
+              input.purpose,
+              "attempt",
+              input.continuationId,
+              scopes,
+              now,
+              retentionUntil,
+            );
+            yield* transaction
+              .update(mapping.generation.table)
+              .set(updateValues<any>([[mapping.generation.state, "consumed"]]))
+              .where(
+                and(
+                  eq(gc.moduleId, input.moduleId),
+                  eq(gc.proofId, input.proofId),
+                  eq(gc.state, "active"),
+                ),
+              );
+            yield* transaction.insert(mapping.continuation.table).values(
+              mapping.continuation.encodeInsert({
+                ...continuation,
+                retentionUntilMillis: retentionUntil,
+              }),
+            );
+
+            return prepared;
+          }),
+        ).pipe(
+          Effect.provideService(CurrentProofSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      complete: (input, prepare) =>
+        owned(
+          database,
+          mapping,
+          configuration,
+          Effect.gen(function* () {
+            const journal = yield* CurrentCommitJournal;
+
+            return yield* completeIn(mapping, configuration, input, (decision) =>
+              prepare(decision, journal),
+            );
+          }),
+        ).pipe(
+          Effect.provideService(CurrentProofSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      claimDelivery: (input, prepare) =>
+        owned(
+          database,
+          mapping,
+          configuration,
+          Effect.gen(function* () {
+            const transaction = yield* CurrentProofSql;
+            const journal = yield* CurrentCommitJournal;
+
+            const rows = yield* readGeneration(
+              mapping,
+              input.moduleId,
+              input.proofId,
+              configuration.locking,
+            );
+
+            const row = rows[0];
+            const now = yield* nowMillis;
+
+            if (row === undefined) return prepare({ _tag: "Declined" }, journal);
+            const c = generationColumns(mapping);
+            const expiresAt = yield* mapping.decodeInstant(row[mapping.generation.expiresAt]);
+
+            const claimDeadline =
+              row[mapping.generation.claimDeadline] === null ||
+              row[mapping.generation.claimDeadline] === undefined
+                ? undefined
+                : yield* mapping.decodeInstant(row[mapping.generation.claimDeadline]);
+
+            const retryAt =
+              row[mapping.generation.retryAt] === null ||
+              row[mapping.generation.retryAt] === undefined
+                ? undefined
+                : yield* mapping.decodeInstant(row[mapping.generation.retryAt]);
+
+            let state = row[mapping.generation.deliveryState] as string;
+
+            if (state === "claimed" && claimDeadline !== undefined && claimDeadline <= now) {
+              state = "ambiguous";
+              yield* transaction
+                .update(mapping.generation.table)
+                .set(updateValues<any>([[mapping.generation.deliveryState, "ambiguous"]]))
+                .where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+            }
+
+            const canClaim =
+              row[mapping.generation.version] === input.version &&
+              row[mapping.generation.deliveryId] === input.deliveryId &&
+              row[mapping.generation.state] === "active" &&
+              expiresAt > now &&
+              Number(row[mapping.generation.sendCount]) < input.policy.maximumDeliveryAttempts &&
+              (state === "new" ||
+                (state === "ambiguous" &&
+                  input.allowAmbiguousRetry &&
+                  (retryAt === undefined || retryAt <= now)));
+
+            if (!canClaim) return prepare({ _tag: "Declined" }, journal);
+            const claimVersion = yield* allocateVersion(mapping, configuration.mode);
+            const decision: ProofDeliveryClaim = { _tag: "Claimed", claimVersion };
+            const prepared = prepare(decision, journal);
+
+            yield* transaction
+              .update(mapping.generation.table)
+              .set(
+                updateValues<any>([
+                  [mapping.generation.sendCount, Number(row[mapping.generation.sendCount]) + 1],
+                  [mapping.generation.deliveryState, "claimed"],
+                  [mapping.generation.claimVersion, claimVersion],
+                  [
+                    mapping.generation.claimDeadline,
+                    mapping.encodeInstant(now + input.policy.deliveryClaimMillis),
+                  ],
+                  [
+                    mapping.generation.retryAt,
+                    mapping.encodeInstant(now + input.policy.deliveryRetryMillis),
+                  ],
+                ]),
+              )
+              .where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+
+            return prepared;
+          }),
+        ).pipe(
+          Effect.provideService(CurrentProofSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      settleDelivery: (input, prepare) =>
+        owned(
+          database,
+          mapping,
+          configuration,
+          Effect.gen(function* () {
+            const transaction = yield* CurrentProofSql;
+            const journal = yield* CurrentCommitJournal;
+
+            const initial = (yield* readGeneration(
+              mapping,
+              input.moduleId,
+              input.proofId,
+              false,
+            ))[0];
+
+            if (initial === undefined) return prepare(undefined, journal);
+            const keys = initial[mapping.generation.seriesKey] as string;
+
+            yield* ensureSeries(
+              mapping,
+              configuration,
+              input.moduleId,
+              initial[mapping.generation.purpose],
+              keys,
+            );
+
+            const row = (yield* readGeneration(
+              mapping,
+              input.moduleId,
+              input.proofId,
+              configuration.locking,
+            ))[0];
+
+            const prepared = prepare(undefined, journal);
+
+            if (
+              row === undefined ||
+              row[mapping.generation.version] !== input.version ||
+              row[mapping.generation.deliveryId] !== input.deliveryId ||
+              row[mapping.generation.claimVersion] !== input.claimVersion ||
+              row[mapping.generation.deliveryState] !== "claimed"
+            )
+              return prepared;
+            const c = generationColumns(mapping);
+            const outcome: ProofDeliveryOutcome = input.outcome;
+
+            const state =
+              outcome._tag === "Accepted"
+                ? "accepted"
+                : outcome._tag === "DefiniteFailure"
+                  ? "failed"
+                  : "ambiguous";
+
+            const values: Array<readonly [string, unknown]> = [
+              [mapping.generation.deliveryState, state],
+              [mapping.generation.claimDeadline, null],
+            ];
+
+            if (outcome._tag === "Ambiguous")
+              values.push([
+                mapping.generation.retryAt,
+                mapping.encodeInstant(
+                  (yield* nowMillis) + Number(row[mapping.generation.deliveryRetryMillis]),
+                ),
+              ]);
+            if (outcome._tag === "DefiniteFailure")
+              values.push([mapping.generation.state, "cancelled"]);
+            yield* transaction
+              .update(mapping.generation.table)
+              .set(updateValues<any>(values))
+              .where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+            if (outcome._tag === "DefiniteFailure") {
+              const sc = seriesColumns(mapping);
+
+              yield* transaction
+                .update(mapping.series.table)
+                .set(updateValues<any>([[mapping.series.activeProofId, null]]))
+                .where(
+                  and(
+                    eq(sc.moduleId, input.moduleId),
+                    eq(sc.purpose, row[mapping.generation.purpose]),
+                    eq(sc.scopeKey, keys),
+                    eq(sc.activeProofId, input.proofId),
+                  ),
+                );
+            }
+
+            return prepared;
+          }),
+        ).pipe(
+          Effect.provideService(CurrentProofSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      cancel: (input, prepare) =>
+        owned(
+          database,
+          mapping,
+          configuration,
+          Effect.gen(function* () {
+            const transaction = yield* CurrentProofSql;
+            const journal = yield* CurrentCommitJournal;
+
+            const authorityCurrent = yield* lockAuthority(
+              mapping,
+              input.moduleId,
+              input.purpose,
+              input.binding,
+              configuration.locking,
+            );
+
+            const keys = mapping.scopeKeys({
+              moduleId: input.moduleId,
+              purpose: input.purpose,
+              binding: input.binding,
+            });
+
+            const series = yield* ensureSeries(
+              mapping,
+              configuration,
+              input.moduleId,
+              input.purpose,
+              keys.series,
+            );
+
+            const active = series[mapping.series.activeProofId] as string | undefined | null;
+            const prepared = prepare(undefined, journal);
+
+            if (authorityCurrent && active !== undefined && active !== null) {
+              const gc = generationColumns(mapping);
+              const sc = seriesColumns(mapping);
+
+              const row = (yield* readGeneration(
+                mapping,
+                input.moduleId,
+                active,
+                configuration.locking,
+              ))[0];
+
+              const storedBinding =
+                row === undefined ? undefined : yield* mapping.generation.decodeBinding(row);
+
+              if (storedBinding === undefined || !sameBinding(storedBinding, input.binding))
+                return prepared;
+
+              yield* transaction
+                .update(mapping.generation.table)
+                .set(updateValues<any>([[mapping.generation.state, "cancelled"]]))
+                .where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, active)));
+              yield* transaction
+                .update(mapping.series.table)
+                .set(updateValues<any>([[mapping.series.activeProofId, null]]))
+                .where(
+                  and(
+                    eq(sc.moduleId, input.moduleId),
+                    eq(sc.purpose, input.purpose),
+                    eq(sc.scopeKey, keys.series),
+                    eq(sc.activeProofId, active),
+                  ),
+                );
+            }
+
+            return prepared;
+          }),
+        ).pipe(
+          Effect.provideService(CurrentProofSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      cleanup: (input, prepare) =>
+        owned(
+          database,
+          mapping,
+          configuration,
+          Effect.gen(function* () {
+            const transaction = yield* CurrentProofSql;
+            const journal = yield* CurrentCommitJournal;
+
+            const now = yield* nowMillis;
+            const nativeNow = mapping.encodeInstant(now);
+            const gc = generationColumns(mapping);
+            const cc = continuationColumns(mapping);
+            const rc = requestColumns(mapping);
+            const ac = abuseColumns(mapping);
+            const fc = failureColumns(mapping);
+            const mc = commandColumns(mapping);
+            const sc = seriesColumns(mapping);
+            const rsc = scopeColumns(mapping);
+            let remaining = input.limit;
+            let hasMore = false;
+
+            const take = <A>(query: ProofSqlQuery<ReadonlyArray<A>>) =>
+              selectRows(query.limit(remaining + 1), configuration.locking).pipe(
+                Effect.map((rows) => {
+                  if (rows.length > remaining) hasMore = true;
+                  const selected = rows.slice(0, remaining);
+
+                  remaining -= selected.length;
+
+                  return selected;
+                }),
+              );
+
+            // Child rows and secret-bearing generations are removed before their
+            // retained request/decision records. Every selected row counts toward
+            // one caller-wide limit and is locked until this owner commits.
+            const continuations = yield* take(
+              transaction
+                .select({ continuationId: cc.continuationId })
+                .from(mapping.continuation.table)
+                .where(and(eq(cc.moduleId, input.moduleId), lte(cc.retentionUntil, nativeNow)))
+                .orderBy(cc.retentionUntil),
+            );
+
+            const generations = yield* take(
+              transaction
+                .select({ proofId: gc.proofId })
+                .from(mapping.generation.table)
+                .where(and(eq(gc.moduleId, input.moduleId), lte(gc.retentionUntil, nativeNow)))
+                .orderBy(gc.retentionUntil),
+            );
+
+            const requests = yield* take(
+              transaction
+                .select({ requestId: rc.requestId })
+                .from(mapping.request.table)
+                .where(and(eq(rc.moduleId, input.moduleId), lte(rc.retentionUntil, nativeNow)))
+                .orderBy(rc.retentionUntil),
+            );
+
+            const abuse = yield* take(
+              transaction
+                .select({
+                  action: ac.action,
+                  scopeKind: ac.scopeKind,
+                  scopeKey: ac.scopeKey,
+                  commandId: ac.commandId,
+                })
+                .from(mapping.abuseEvent.table)
+                .where(and(eq(ac.moduleId, input.moduleId), lte(ac.retentionUntil, nativeNow)))
+                .orderBy(ac.retentionUntil),
+            );
+
+            const failures = yield* take(
+              transaction
+                .select({ seriesKey: fc.seriesKey, commandId: fc.commandId })
+                .from(mapping.failureEvent.table)
+                .where(and(eq(fc.moduleId, input.moduleId), lte(fc.retentionUntil, nativeNow)))
+                .orderBy(fc.retentionUntil),
+            );
+
+            const commands = yield* take(
+              transaction
+                .select({ commandId: mc.commandId })
+                .from(mapping.command.table)
+                .where(and(eq(mc.moduleId, input.moduleId), lte(mc.retentionUntil, nativeNow)))
+                .orderBy(mc.retentionUntil),
+            );
+
+            const series = yield* take(
+              transaction
+                .select({ purpose: sc.purpose, scopeKey: sc.scopeKey })
+                .from(mapping.series.table)
+                .where(
+                  and(
+                    eq(sc.moduleId, input.moduleId),
+                    isNull(sc.activeProofId),
+                    notExists(
+                      transaction
+                        .select({ one: sql`1` })
+                        .from(mapping.generation.table)
+                        .where(
+                          and(
+                            eq(gc.moduleId, sc.moduleId),
+                            eq(gc.purpose, sc.purpose),
+                            eq(gc.seriesKey, sc.scopeKey),
+                          ),
+                        ),
+                    ),
+                    notExists(
+                      transaction
+                        .select({ one: sql`1` })
+                        .from(mapping.failureEvent.table)
+                        .where(
+                          and(
+                            eq(fc.moduleId, sc.moduleId),
+                            eq(fc.purpose, sc.purpose),
+                            eq(fc.seriesKey, sc.scopeKey),
+                          ),
+                        ),
+                    ),
+                  ),
+                ),
+            );
+
+            const rateScopes = yield* take(
+              transaction
+                .select({
+                  purpose: rsc.purpose,
+                  action: rsc.action,
+                  scopeKind: rsc.scopeKind,
+                  scopeKey: rsc.scopeKey,
+                })
+                .from(mapping.rateScope.table)
+                .where(
+                  and(
+                    eq(rsc.moduleId, input.moduleId),
+                    notExists(
+                      transaction
+                        .select({ one: sql`1` })
+                        .from(mapping.abuseEvent.table)
+                        .where(
+                          and(
+                            eq(ac.moduleId, rsc.moduleId),
+                            eq(ac.purpose, rsc.purpose),
+                            eq(ac.action, rsc.action),
+                            eq(ac.scopeKind, rsc.scopeKind),
+                            eq(ac.scopeKey, rsc.scopeKey),
+                          ),
+                        ),
+                    ),
+                  ),
+                ),
+            );
+
+            // Removing the final history row can make an anchor eligible only after this
+            // transaction/batch commits. One extra page lets the caller reclaim it.
+            hasMore ||= generations.length > 0 || failures.length > 0 || abuse.length > 0;
+            const removed = input.limit - remaining;
+            const prepared = prepare({ removed, hasMore } satisfies ProofCleanupResult, journal);
+
+            if (continuations.length > 0)
+              yield* transaction.delete(mapping.continuation.table).where(
+                and(
+                  eq(cc.moduleId, input.moduleId),
+                  inArray(
+                    cc.continuationId,
+                    continuations.map((row: any) => row.continuationId),
+                  ),
+                  lte(cc.retentionUntil, nativeNow),
+                ),
+              );
+            if (generations.length > 0)
+              yield* transaction
+                .update(mapping.series.table)
+                .set(updateValues<any>([[mapping.series.activeProofId, null]]))
+                .where(
+                  and(
+                    eq(sc.moduleId, input.moduleId),
+                    inArray(
+                      sc.activeProofId,
+                      generations.map((row: any) => row.proofId),
+                    ),
+                  ),
+                );
+            if (generations.length > 0)
+              yield* transaction.delete(mapping.generation.table).where(
+                and(
+                  eq(gc.moduleId, input.moduleId),
+                  inArray(
+                    gc.proofId,
+                    generations.map((row: any) => row.proofId),
+                  ),
+                  lte(gc.retentionUntil, nativeNow),
+                ),
+              );
+            if (requests.length > 0)
+              yield* transaction.delete(mapping.request.table).where(
+                and(
+                  eq(rc.moduleId, input.moduleId),
+                  inArray(
+                    rc.requestId,
+                    requests.map((row: any) => row.requestId),
+                  ),
+                  lte(rc.retentionUntil, nativeNow),
+                ),
+              );
+            for (const row of abuse)
+              yield* transaction
+                .delete(mapping.abuseEvent.table)
+                .where(
+                  and(
+                    eq(ac.moduleId, input.moduleId),
+                    eq(ac.action, row.action),
+                    eq(ac.scopeKind, row.scopeKind),
+                    eq(ac.scopeKey, row.scopeKey),
+                    eq(ac.commandId, row.commandId),
+                    lte(ac.retentionUntil, nativeNow),
+                  ),
+                );
+            for (const row of failures)
+              yield* transaction
+                .delete(mapping.failureEvent.table)
+                .where(
+                  and(
+                    eq(fc.moduleId, input.moduleId),
+                    eq(fc.seriesKey, row.seriesKey),
+                    eq(fc.commandId, row.commandId),
+                    lte(fc.retentionUntil, nativeNow),
+                  ),
+                );
+            if (commands.length > 0)
+              yield* transaction.delete(mapping.command.table).where(
+                and(
+                  eq(mc.moduleId, input.moduleId),
+                  inArray(
+                    mc.commandId,
+                    commands.map((row: any) => row.commandId),
+                  ),
+                  lte(mc.retentionUntil, nativeNow),
+                ),
+              );
+            for (const row of series)
+              yield* transaction.delete(mapping.series.table).where(
+                and(
+                  eq(sc.moduleId, input.moduleId),
+                  eq(sc.purpose, row.purpose),
+                  eq(sc.scopeKey, row.scopeKey),
+                  isNull(sc.activeProofId),
+                  notExists(
+                    transaction
+                      .select({ one: sql`1` })
+                      .from(mapping.generation.table)
+                      .where(
+                        and(
+                          eq(gc.moduleId, sc.moduleId),
+                          eq(gc.purpose, sc.purpose),
+                          eq(gc.seriesKey, sc.scopeKey),
+                        ),
+                      ),
+                  ),
+                ),
+              );
+            for (const row of rateScopes)
+              yield* transaction.delete(mapping.rateScope.table).where(
+                and(
+                  eq(rsc.moduleId, input.moduleId),
+                  eq(rsc.purpose, row.purpose),
+                  eq(rsc.action, row.action),
+                  eq(rsc.scopeKind, row.scopeKind),
+                  eq(rsc.scopeKey, row.scopeKey),
+                  notExists(
+                    transaction
+                      .select({ one: sql`1` })
+                      .from(mapping.abuseEvent.table)
+                      .where(
+                        and(
+                          eq(ac.moduleId, rsc.moduleId),
+                          eq(ac.purpose, rsc.purpose),
+                          eq(ac.action, rsc.action),
+                          eq(ac.scopeKind, rsc.scopeKind),
+                          eq(ac.scopeKey, rsc.scopeKey),
+                        ),
+                      ),
+                  ),
+                ),
+              );
+
+            return prepared;
+          }),
+        ).pipe(
+          Effect.provideService(CurrentProofSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+    });
+  });
+
+  const inspectCompletionIn = Effect.fn("DrizzleProof.inspectCompletionIn")(function* (
+    mapping: Mapping,
+    configuration: ProofSqlConfiguration,
+    input: ProofCompletionPlan["input"],
+    ensure: boolean,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    const authorityCurrent = yield* lockAuthority(
+      mapping,
+      input.moduleId,
+      input.purpose,
+      input.binding,
+      configuration.locking,
+    );
+
+    const keys = mapping.scopeKeys({
+      moduleId: input.moduleId,
+      purpose: input.purpose,
+      binding: input.binding,
+    });
+
+    if (ensure)
+      yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series);
+    const c = continuationColumns(mapping);
+
+    const rows = yield* selectRows(
+      database
+        .select()
+        .from(mapping.continuation.table)
+        .where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId)))
+        .limit(1),
+      configuration.locking,
+    );
+
+    const row = rows[0];
+    const now = yield* nowMillis;
+    const record = row === undefined ? undefined : yield* mapping.continuation.decode(row);
+
+    const completed =
+      authorityCurrent &&
+      row !== undefined &&
+      record !== undefined &&
+      record.moduleId === input.moduleId &&
+      record.continuationId === input.continuationId &&
+      record.purpose === input.purpose &&
+      record.digest === input.continuationDigest &&
+      record.seriesKey === keys.series &&
+      sameBinding(record.binding, input.binding) &&
+      row[mapping.continuation.consumed] === false &&
+      record.expiresAtMillis > now;
+
+    return completed ? { record: record!, row, columns: c } : undefined;
+  });
+
+  /** Nonconsuming same-owner preflight; it never inserts a series or changes expiry. */
+  const checkProofCompletionIn = Effect.fn("Drizzle.checkProofCompletionIn")(function* (
+    mapping: Mapping,
+    configuration: ProofSqlConfiguration,
+    input: ProofCompletionPlan["input"],
+  ) {
+    return yield* inspectCompletionIn(mapping, configuration, input, false).pipe(
+      Effect.map((value) => value !== undefined),
+    );
+  });
+
+  const completeIn = Effect.fn("DrizzleProof.completeIn")(function* <A, E = never, R = never>(
+    mapping: Mapping,
+    configuration: ProofSqlConfiguration,
+    input: ProofCompletionPlan["input"],
+    prepare: (decision: ProofCompletionDecision) => A,
+    protectedMutation?: Effect.Effect<boolean, E, R>,
+  ) {
+    const database = yield* CurrentProofSql;
+
+    const accepted = yield* inspectCompletionIn(mapping, configuration, input, true);
+
+    if (accepted === undefined) return prepare("rejected");
+    const { record, row: original, columns: c } = accepted;
+
+    if (protectedMutation !== undefined && !(yield* protectedMutation)) return yield* unavailable();
+    const value = prepare("completed");
+
+    yield* database
+      .update(mapping.continuation.table)
+      .set(updateValues<any>([[mapping.continuation.consumed, true]]))
+      .where(
+        and(
+          eq(c.moduleId, input.moduleId),
+          eq(c.continuationId, input.continuationId),
+          eq(c.digest, input.continuationDigest),
+          eq(c.consumed, false),
+        ),
+      );
+    yield* insertCommand(
+      mapping,
+      input.moduleId,
+      input.continuationDigest,
+      "complete",
+      "completed",
+      record.expiresAtMillis,
+    );
+
+    const assertApplied = Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>
+      Effect.gen(function* () {
+        const persisted = (yield* selectRows(
+          currentTransaction
+            .select()
+            .from(mapping.continuation.table)
+            .where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId)))
+            .limit(1),
+          false,
+        ))[0];
+
+        const command = (yield* commandRow(
+          mapping,
+          input.moduleId,
+          input.continuationDigest,
+          false,
+        ))[0];
+
+        const decoded =
+          persisted === undefined ? undefined : yield* mapping.continuation.decode(persisted);
+
+        const immutable = [
+          mapping.continuation.moduleId,
+          mapping.continuation.purpose,
+          mapping.continuation.continuationId,
+          mapping.continuation.digest,
+          mapping.continuation.proofId,
+          mapping.continuation.seriesKey,
+          mapping.continuation.version,
+        ];
+
+        if (
+          persisted === undefined ||
+          decoded === undefined ||
+          !sameBinding(decoded.binding, record.binding) ||
+          persisted[mapping.continuation.consumed] !== true ||
+          immutable.some((key) => persisted[key] !== original[key]) ||
+          (yield* mapping.decodeInstant(persisted[mapping.continuation.expiresAt])) !==
+            record.expiresAtMillis ||
+          (yield* mapping.decodeInstant(persisted[mapping.continuation.retentionUntil])) !==
+            (yield* mapping.decodeInstant(original[mapping.continuation.retentionUntil])) ||
+          command === undefined ||
+          command[mapping.command.kind] !== "complete" ||
+          command[mapping.command.decision] !== "completed" ||
+          (yield* mapping.decodeInstant(command[mapping.command.retentionUntil])) !==
+            record.expiresAtMillis
+        )
+          return yield* unavailable();
+
+        if (record.expiresAtMillis <= (yield* nowMillis)) return yield* unavailable();
+      }).pipe(Effect.provideService(CurrentProofSql, currentTransaction)),
+    );
+
+    yield* assertApplied.pipe(Effect.provideService(CurrentPasswordPreparedTransaction, database));
+    const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);
+
+    if (
+      Option.isSome(postconditions) &&
+      !postconditions.value.register(assertApplied.pipe(translateFailure))
+    )
+      return yield* unavailable();
+
+    return value;
+  });
+
+  /** Private same-owner seam for password and identifier mutations. */
+  const completeProofPlanIn = Effect.fn("Drizzle.completeProofPlanIn")(function* <
+    Rq extends Table,
+    S extends Table,
+    G extends Table,
+    Cn extends Table,
+    Rs extends Table,
+    Aev extends Table,
+    F extends Table,
+    C extends Table,
+    Sub extends Table,
+    I extends Table,
+    Cr extends Table,
+    NativeId,
+    A,
+    E,
+    R,
+  >(
+    mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, Aev, F, C, Sub, I, Cr, NativeId>,
+    configuration: ProofSqlConfiguration,
+    plan: ProofCompletionPlan,
+    protectedMutation: Effect.Effect<boolean, E, R>,
+    project: (decision: ProofCompletionDecision) => A,
+  ) {
+    const journal = yield* CurrentCommitJournal;
+
+    return yield* completeIn(
+      mapping as unknown as Mapping,
+      configuration,
+      plan.input,
+      (decision) => plan.prepare(decision, journal, project),
+      protectedMutation,
+    );
+  });
+
+  return { makeSqlProofPersistence, checkProofCompletionIn, completeProofPlanIn };
+};