@yielded/auth-persistence 0.1.0-beta.7

package/src/drizzle/d1-proofs.ts

@@ -0,0 +1,2305 @@
+/* oxlint-disable no-explicit-any -- D1 planning bridges consumer Drizzle tables to Effect SQL statements. */
+import type { D1Client } from "@effect/sql-d1/D1Client";
+import {
+  coordinateCommit,
+  CurrentCommitJournal,
+  hasCommitScope,
+  type CommitJournal,
+  type PreparedCommit,
+  LifecycleHooks,
+  HookConfigurationError,
+} from "@yielded/auth/Hooks";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import {
+  type ProofCompletionPlan,
+  ProofBinding,
+  type ProofAttemptDecision,
+  type ProofCleanupResult,
+  type ProofCompletionDecision,
+  type ProofDeliveryOutcome,
+  type ProofVersion,
+  type ProofBudget,
+  type ProofPolicy,
+  ProofPersistence,
+  type PrepareProofCommit,
+  type ProofDeliveryClaim,
+  ProofRequestConflict,
+  ProofUnavailable,
+} from "@yielded/auth/Proofs";
+import {
+  and,
+  count,
+  eq,
+  gte,
+  inArray,
+  isNull,
+  lte,
+  notExists,
+  or,
+  sql,
+  type AnyRelations,
+  type SQL,
+  type Table,
+} from "drizzle-orm";
+import type { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
+import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
+import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
+import { Cause, Effect, Schema, Context } from "effect";
+import type { Statement } from "effect/unstable/sql/Statement";
+
+import { balancedD1And } from "./d1-generated-statement";
+import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning";
+import { D1BatchStatements } from "./D1BatchStatements";
+import { column, PersistenceMappingError, isMappedConstraintConflict, updateValues } from "./model";
+import {
+  type D1ProofPersistenceMapping,
+  requiredProofConstraints,
+  type ProofAction,
+  type ProofAuthorityInput,
+  type ProofCommandDecision,
+  type ProofContinuationRecord,
+  type ProofPersistenceMapping,
+  type ProofScopeKeys,
+  type ProofScopeKind,
+} from "./proof-model";
+
+type PlanPrepare<Method extends (...args: any[]) => any, A> = (
+  value: Parameters<Parameters<Method>[1]>[0],
+  journal: CommitJournal,
+) => PreparedCommit<A>;
+
+type Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };
+type Mapping = D1ProofPersistenceMapping<
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  unknown
+>;
+interface Planned<A> {
+  readonly receipt: A;
+  readonly statements: ReadonlyArray<Statement<any>>;
+  readonly retryable?: (cause: unknown) => boolean;
+  readonly journalGuard?: PreparedCommit<void>;
+  readonly postconditions?: ReadonlyArray<Statement<any>>;
+}
+
+const unavailable = () => ProofUnavailable.make({});
+
+const everyFailureMatches = (
+  cause: Cause.Cause<unknown>,
+  classify: ((cause: unknown) => boolean) | undefined,
+): boolean =>
+  classify !== undefined &&
+  cause.reasons.length > 0 &&
+  cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
+
+const conflict = () => ProofRequestConflict.make({});
+
+const validConstraints = (mapping: Mapping) =>
+  Object.entries(requiredProofConstraints).every(
+    ([key, value]) => mapping.constraints[key as keyof typeof requiredProofConstraints] === value,
+  );
+
+const canonicalBinding = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
+
+const sameBinding = (left: ProofBinding, right: ProofBinding) =>
+  canonicalBinding(left) === canonicalBinding(right);
+
+const containsFailure = (failure: unknown, predicate: (value: unknown) => boolean): boolean => {
+  const seen = new Set<unknown>();
+  const pending: Array<unknown> = [failure];
+
+  for (let inspected = 0; inspected < 32 && pending.length > 0; inspected++) {
+    const current = pending.shift();
+
+    if (current === undefined || current === null || seen.has(current)) continue;
+    seen.add(current);
+    if (predicate(current)) return true;
+    if (Cause.isCause(current)) {
+      for (const reason of current.reasons) {
+        if (Cause.isFailReason(reason)) pending.push(reason.error);
+        else if (Cause.isDieReason(reason)) pending.push(reason.defect);
+      }
+      continue;
+    }
+    if (typeof current !== "object") continue;
+
+    const wrapped = current as {
+      readonly cause?: unknown;
+      readonly reason?: unknown;
+      readonly message?: unknown;
+    };
+
+    if (wrapped.cause !== undefined) pending.push(wrapped.cause);
+    if (wrapped.reason !== undefined) pending.push(wrapped.reason);
+    if (wrapped.message !== undefined) pending.push(wrapped.message);
+  }
+
+  return false;
+};
+
+// Match only the native workerd/D1 SQLite diagnostic. Query wrappers may echo
+// marker parameters, which is not evidence that the guard ran and rolled back.
+const isGuardFailure = (cause: unknown, marker: string) => {
+  const path = `$[${marker.replaceAll("'", "''")}]`;
+  const nativeMessage = `bad JSON path: '${path}': SQLITE_ERROR`;
+
+  return containsFailure(
+    cause,
+    (value) => value === nativeMessage || value === `D1_ERROR: ${nativeMessage}`,
+  );
+};
+
+type AdapterFailure = PersistenceMappingError | EffectDrizzleQueryError;
+
+const statement = Effect.fn(function* (query: {
+  readonly toSQL: () => { readonly sql: string; readonly params: unknown[] };
+}) {
+  const database = yield* CurrentD1PlanningDatabase;
+  const rendered = query.toSQL();
+
+  return database.$client.unsafe(rendered.sql, rendered.params);
+});
+
+const readEngineNowMillis = Effect.fn("Drizzle.readEngineNowMillis")(function* (mapping: Mapping) {
+  const database = yield* CurrentD1PlanningDatabase;
+
+  return yield* database
+    .select({ value: mapping.d1.engineNowMillis.as("engine_now_millis") })
+    .from(sql`(select 1)`)
+    .pipe(
+      Effect.flatMap((rows) => {
+        const value = Number(rows[0]?.value);
+
+        return Number.isFinite(value) ? Effect.succeed(value) : Effect.fail(unavailable());
+      }),
+    );
+});
+
+const driverValues = (values: object, entries: ReadonlyArray<readonly [string, unknown]>) => ({
+  ...values,
+  ...Object.fromEntries(entries),
+});
+
+const assertion = Effect.fn(function* (condition: SQL, marker: string) {
+  const database = yield* CurrentD1PlanningDatabase;
+
+  return yield* statement(
+    database
+      .select({
+        ok: sql`case when ${condition} then 1 else json_extract('[]', ${`$[${marker}]`}) end`.as(
+          "ok",
+        ),
+      })
+      .from(sql`(select 1)`),
+  );
+});
+
+const allocateVersion = (
+  mapping: Mapping,
+): Effect.Effect<ProofVersion, ProofUnavailable | PersistenceMappingError> =>
+  mapping.allocateVersion !== undefined
+    ? mapping.allocateVersion
+    : mapping.allocateVersionSync === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({
+          try: mapping.allocateVersionSync,
+          catch: (cause) => new PersistenceMappingError({ operation: "mapping", cause }),
+        });
+
+const requestColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.request.table, mapping.request.moduleId),
+  requestId: column(mapping.request.table, mapping.request.requestId),
+  fingerprint: column(mapping.request.table, mapping.request.fingerprint),
+  proofId: column(mapping.request.table, mapping.request.proofId),
+  retentionUntil: column(mapping.request.table, mapping.request.retentionUntil),
+});
+
+const seriesColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.series.table, mapping.series.moduleId),
+  purpose: column(mapping.series.table, mapping.series.purpose),
+  scopeKey: column(mapping.series.table, mapping.series.scopeKey),
+  activeProofId: column(mapping.series.table, mapping.series.activeProofId),
+  lastIssueAt: column(mapping.series.table, mapping.series.lastIssueAt),
+  version: column(mapping.series.table, mapping.series.version),
+});
+
+const generationColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.generation.table, mapping.generation.moduleId),
+  purpose: column(mapping.generation.table, mapping.generation.purpose),
+  proofId: column(mapping.generation.table, mapping.generation.proofId),
+  seriesKey: column(mapping.generation.table, mapping.generation.seriesKey),
+  deliveryId: column(mapping.generation.table, mapping.generation.deliveryId),
+  verifierKeyId: column(mapping.generation.table, mapping.generation.verifierKeyId),
+  verifierDigest: column(mapping.generation.table, mapping.generation.verifierDigest),
+  expiresAt: column(mapping.generation.table, mapping.generation.expiresAt),
+  version: column(mapping.generation.table, mapping.generation.version),
+  state: column(mapping.generation.table, mapping.generation.state),
+  sendCount: column(mapping.generation.table, mapping.generation.sendCount),
+  deliveryState: column(mapping.generation.table, mapping.generation.deliveryState),
+  claimVersion: column(mapping.generation.table, mapping.generation.claimVersion),
+  claimDeadline: column(mapping.generation.table, mapping.generation.claimDeadline),
+  retryAt: column(mapping.generation.table, mapping.generation.retryAt),
+  deliveryRetryMillis: column(mapping.generation.table, mapping.generation.deliveryRetryMillis),
+  retentionUntil: column(mapping.generation.table, mapping.generation.retentionUntil),
+});
+
+const continuationColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.continuation.table, mapping.continuation.moduleId),
+  continuationId: column(mapping.continuation.table, mapping.continuation.continuationId),
+  digest: column(mapping.continuation.table, mapping.continuation.digest),
+  consumed: column(mapping.continuation.table, mapping.continuation.consumed),
+  retentionUntil: column(mapping.continuation.table, mapping.continuation.retentionUntil),
+});
+
+const scopeColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
+  purpose: column(mapping.rateScope.table, mapping.rateScope.purpose),
+  action: column(mapping.rateScope.table, mapping.rateScope.action),
+  scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
+  scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey),
+});
+
+const abuseColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.abuseEvent.table, mapping.abuseEvent.moduleId),
+  purpose: column(mapping.abuseEvent.table, mapping.abuseEvent.purpose),
+  action: column(mapping.abuseEvent.table, mapping.abuseEvent.action),
+  scopeKind: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKind),
+  scopeKey: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKey),
+  commandId: column(mapping.abuseEvent.table, mapping.abuseEvent.commandId),
+  occurredAt: column(mapping.abuseEvent.table, mapping.abuseEvent.occurredAt),
+  retentionUntil: column(mapping.abuseEvent.table, mapping.abuseEvent.retentionUntil),
+});
+
+const failureColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.failureEvent.table, mapping.failureEvent.moduleId),
+  purpose: column(mapping.failureEvent.table, mapping.failureEvent.purpose),
+  seriesKey: column(mapping.failureEvent.table, mapping.failureEvent.seriesKey),
+  commandId: column(mapping.failureEvent.table, mapping.failureEvent.commandId),
+  occurredAt: column(mapping.failureEvent.table, mapping.failureEvent.occurredAt),
+  retentionUntil: column(mapping.failureEvent.table, mapping.failureEvent.retentionUntil),
+});
+
+const commandColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.command.table, mapping.command.moduleId),
+  commandId: column(mapping.command.table, mapping.command.commandId),
+  decision: column(mapping.command.table, mapping.command.decision),
+  retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),
+});
+
+interface ScopeEntry {
+  readonly kind: ProofScopeKind;
+  readonly key: string;
+  readonly budget: ProofBudget;
+}
+
+const scopeEntries = (
+  keys: ProofScopeKeys,
+  binding: ProofBinding,
+  action: ProofAction,
+  policy: ProofPolicy,
+) => {
+  const suffix = action === "issue" ? "Issues" : "Attempts";
+  const simple = action === "issue" ? "issues" : "attempts";
+
+  const entries: ScopeEntry[] = [
+    { kind: "action", key: "*", budget: policy.abuse[`action${suffix}`] },
+    { kind: "identifier", key: keys.identifier, budget: policy.abuse[simple] },
+  ];
+
+  if (binding._tag !== "Identifier")
+    entries.push({ kind: "subject", key: keys.subject, budget: policy.abuse[`subject${suffix}`] });
+
+  return entries;
+};
+
+const scopeCondition = (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  action: ProofAction,
+  entry: ScopeEntry,
+) => {
+  const c = abuseColumns(mapping);
+
+  return sql`(select count(*) from ${mapping.abuseEvent.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.purpose} = ${sql.param(purpose, c.purpose)} and ${c.action} = ${sql.param(action, c.action)} and ${c.scopeKind} = ${sql.param(entry.kind, c.scopeKind)} and ${c.scopeKey} = ${sql.param(entry.key, c.scopeKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(entry.budget.windowMillis)}) < ${entry.budget.limit}`;
+};
+
+const failureCondition = (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  seriesKey: string,
+  policy: ProofPolicy,
+) => {
+  const c = failureColumns(mapping);
+
+  return sql`(select count(*) from ${mapping.failureEvent.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.purpose} = ${sql.param(purpose, c.purpose)} and ${c.seriesKey} = ${sql.param(seriesKey, c.seriesKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(policy.abuse.attempts.windowMillis)}) < ${policy.maximumFailedAttempts}`;
+};
+
+const readScopeAdmission = Effect.fn("DrizzleD1Proof.readScopeAdmission")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  action: ProofAction,
+  entries: ReadonlyArray<ScopeEntry>,
+  now: number,
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+
+  const c = abuseColumns(mapping);
+  const admitted: ScopeEntry[] = [];
+
+  for (const entry of entries) {
+    const rows = yield* database
+      .select({ total: count() })
+      .from(mapping.abuseEvent.table)
+      .where(
+        and(
+          eq(c.moduleId, moduleId),
+          eq(c.purpose, purpose),
+          eq(c.action, action),
+          eq(c.scopeKind, entry.kind),
+          eq(c.scopeKey, entry.key),
+          gte(c.occurredAt, mapping.encodeInstant(now - entry.budget.windowMillis)),
+        ),
+      );
+
+    if (Number(rows[0]?.total ?? 0) < entry.budget.limit) admitted.push(entry);
+  }
+
+  return admitted;
+});
+
+const authority = Effect.fn("DrizzleD1Proof.authority")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  binding: ProofBinding,
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+
+  let nativeSubjectId: unknown | undefined;
+  let subjectCurrent = true;
+  const parts: SQL[] = [];
+
+  if (binding._tag !== "Identifier") {
+    if (
+      mapping.authority.subject === undefined ||
+      mapping.authority.credential === undefined ||
+      mapping.authority.subjectId === undefined
+    )
+      return yield* unavailable();
+    nativeSubjectId = yield* mapping.authority.subjectId.toNative(binding.revision.subjectId);
+    const subject = mapping.authority.subject;
+    const id = column(subject.table, subject.id);
+    const status = column(subject.table, subject.status);
+    const revision = column(subject.table, subject.securityRevision);
+
+    const subjectRows = yield* database
+      .select()
+      .from(subject.table)
+      .where(eq(id, nativeSubjectId))
+      .limit(1);
+
+    const subjectRow = subjectRows[0];
+
+    subjectCurrent =
+      subjectRow !== undefined &&
+      subject.isActiveStatus(subjectRow[subject.status]) &&
+      subjectRow[subject.securityRevision] === binding.revision.securityRevision;
+    parts.push(
+      sql`exists(select 1 from ${subject.table} where ${id} = ${sql.param(nativeSubjectId, id)} and ${status} = ${sql.param(subject.d1ActiveStatusValue, status)} and ${revision} = ${sql.param(binding.revision.securityRevision, revision)})`,
+    );
+  }
+  const identifier = mapping.authority.identifier;
+  const namespace = column(identifier.table, identifier.namespace);
+  const value = column(identifier.table, identifier.value);
+
+  const identifierRows = yield* database
+    .select()
+    .from(identifier.table)
+    .where(and(eq(namespace, binding.identifier.namespace), eq(value, binding.identifier.value)));
+
+  const input: ProofAuthorityInput<unknown> = {
+    moduleId,
+    purpose,
+    binding,
+    ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }),
+  };
+
+  const identifierCurrent = identifier.isCurrent(input, identifierRows);
+
+  parts.push(identifier.d1CurrentCondition(input));
+  let credentialsCurrent = true;
+
+  if (binding._tag !== "Identifier") {
+    const credential = mapping.authority.credential!;
+    const owner = column(credential.table, credential.subjectId);
+    const id = column(credential.table, credential.credentialId);
+    const revision = column(credential.table, credential.revision);
+
+    const status =
+      credential.status === undefined ? undefined : column(credential.table, credential.status);
+
+    const expected = [...binding.revision.credentials].sort((a, b) =>
+      a.credentialId.localeCompare(b.credentialId),
+    );
+
+    const rows =
+      expected.length === 0
+        ? []
+        : yield* database
+            .select()
+            .from(credential.table)
+            .where(
+              and(
+                eq(owner, nativeSubjectId),
+                inArray(
+                  id,
+                  expected.map((item) => item.credentialId),
+                ),
+              ),
+            );
+
+    const actual = rows
+      .map((row: any) => ({
+        id: row[credential.credentialId],
+        revision: row[credential.revision],
+        active:
+          credential.status === undefined ||
+          credential.isActiveStatus?.(row[credential.status]) === true,
+      }))
+      .sort((a: any, b: any) => String(a.id).localeCompare(String(b.id)));
+
+    credentialsCurrent =
+      actual.length === expected.length &&
+      actual.every(
+        (row: any, index: number) =>
+          row.active &&
+          row.id === expected[index]?.credentialId &&
+          row.revision === expected[index]?.revision,
+      );
+    for (const expectedCredential of expected)
+      parts.push(
+        sql`exists(select 1 from ${credential.table} where ${owner} = ${sql.param(nativeSubjectId, owner)} and ${id} = ${sql.param(expectedCredential.credentialId, id)} and ${revision} = ${sql.param(expectedCredential.revision, revision)}${status === undefined ? sql`` : sql` and ${status} = ${sql.param(credential.d1ActiveStatusValue, status)}`})`,
+      );
+  }
+
+  return {
+    current: subjectCurrent && identifierCurrent && credentialsCurrent,
+    condition: balancedD1And(...parts) ?? sql`1 = 1`,
+  };
+});
+
+const anchorStatements = Effect.fn(function* (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  action: ProofAction,
+  entries: ReadonlyArray<ScopeEntry>,
+  seriesKey: string,
+  seriesVersion: ProofVersion,
+  includeSeries: boolean,
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+
+  return [
+    ...(yield* Effect.forEach(
+      entries,
+      Effect.fn(function* (entry) {
+        return yield* statement(
+          database
+            .insert(mapping.rateScope.table)
+            .values(
+              mapping.rateScope.encodeInsert({
+                moduleId,
+                purpose,
+                action,
+                scopeKind: entry.kind,
+                scopeKey: entry.key,
+              }),
+            )
+            .onConflictDoNothing(),
+        );
+      }),
+    )),
+    ...(includeSeries
+      ? [
+          yield* statement(
+            database
+              .insert(mapping.series.table)
+              .values(
+                mapping.series.encodeInsert({
+                  moduleId,
+                  purpose,
+                  scopeKey: seriesKey,
+                  version: seriesVersion,
+                }),
+              )
+              .onConflictDoNothing(),
+          ),
+        ]
+      : []),
+  ];
+});
+
+const insertScopeStatements = Effect.fn(function* (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  action: ProofAction,
+  commandId: string,
+  entries: ReadonlyArray<ScopeEntry>,
+  now: number,
+  retentionUntil: number,
+  marker: string,
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+
+  return (yield* Effect.forEach(
+    entries,
+    Effect.fn(function* (entry) {
+      return [
+        yield* assertion(scopeCondition(mapping, moduleId, purpose, action, entry), marker),
+        yield* statement(
+          database.insert(mapping.abuseEvent.table).values(
+            driverValues(
+              mapping.abuseEvent.encodeInsert({
+                moduleId,
+                purpose,
+                action,
+                scopeKind: entry.kind,
+                scopeKey: entry.key,
+                commandId,
+                occurredAtMillis: now,
+                retentionUntilMillis: retentionUntil,
+              }),
+              [
+                [mapping.abuseEvent.occurredAt, mapping.d1.engineNow],
+                [
+                  mapping.abuseEvent.retentionUntil,
+                  mapping.d1.engineInstantPlus(retentionUntil - now),
+                ],
+              ],
+            ),
+          ),
+        ),
+      ];
+    }),
+  )).flat();
+});
+
+const readSeries = Effect.fn("Drizzle.readSeries")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  key: string,
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+
+  const c = seriesColumns(mapping);
+
+  return yield* database
+    .select()
+    .from(mapping.series.table)
+    .where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.scopeKey, key)))
+    .limit(1);
+});
+
+const readGeneration = Effect.fn("Drizzle.readGeneration")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  proofId: string,
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+
+  const c = generationColumns(mapping);
+
+  return yield* database
+    .select()
+    .from(mapping.generation.table)
+    .where(and(eq(c.moduleId, moduleId), eq(c.proofId, proofId)))
+    .limit(1);
+});
+
+const commandInsert = Effect.fn(function* (
+  mapping: Mapping,
+  moduleId: string,
+  commandId: string,
+  kind: "attempt" | "complete",
+  decision: ProofCommandDecision,
+  retentionUntil: number,
+  nativeRetention?: SQL,
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+
+  return yield* statement(
+    database.insert(mapping.command.table).values(
+      driverValues(
+        mapping.command.encodeInsert({
+          moduleId,
+          commandId,
+          kind,
+          decision,
+          retentionUntilMillis: retentionUntil,
+        }),
+        nativeRetention === undefined ? [] : [[mapping.command.retentionUntil, nativeRetention]],
+      ),
+    ),
+  );
+});
+
+const issuePlan = Effect.fn("Drizzle.issuePlan")(function* <A>(
+  mapping: Mapping,
+  input: Parameters<ProofPersistence["Service"]["issue"]>[0],
+  prepare: PlanPrepare<ProofPersistence["Service"]["issue"], A>,
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+  const journal = yield* CurrentCommitJournal;
+
+  const keys = mapping.scopeKeys({
+    moduleId: input.record.moduleId,
+    purpose: input.record.purpose,
+    binding: input.record.binding,
+  });
+
+  const current = yield* authority(
+    mapping,
+    input.record.moduleId,
+    input.record.purpose,
+    input.record.binding,
+  );
+
+  const now = yield* readEngineNowMillis(mapping);
+  const retentionUntil = now + input.policy.requestRetentionMillis;
+  const rc = requestColumns(mapping);
+
+  const existingRequest = (yield* database
+    .select()
+    .from(mapping.request.table)
+    .where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId)))
+    .limit(1))[0];
+
+  if (existingRequest !== undefined) {
+    const retained = yield* mapping.decodeInstant(existingRequest[mapping.request.retentionUntil]);
+
+    if (retained > now) {
+      if (existingRequest[mapping.request.fingerprint] !== input.record.fingerprint)
+        return yield* conflict();
+      const receipt = yield* mapping.request.decodeReceipt(existingRequest);
+
+      return {
+        receipt: prepare({ _tag: "Existing", receipt }, journal) as PreparedCommit<A>,
+        statements: [],
+      };
+    }
+  }
+  const scopes = scopeEntries(keys, input.record.binding, "issue", input.policy);
+
+  const initiallyAdmitted = yield* readScopeAdmission(
+    mapping,
+    input.record.moduleId,
+    input.record.purpose,
+    "issue",
+    scopes,
+    now,
+  );
+
+  const actionOpen = initiallyAdmitted.some((entry) => entry.kind === "action");
+  const admitted = actionOpen ? initiallyAdmitted : [];
+
+  const existingSeries = actionOpen
+    ? (yield* readSeries(mapping, input.record.moduleId, input.record.purpose, keys.series))[0]
+    : undefined;
+
+  const seriesVersion = yield* allocateVersion(mapping);
+  const active = existingSeries?.[mapping.series.activeProofId] as string | null | undefined;
+
+  const lastIssue =
+    existingSeries?.[mapping.series.lastIssueAt] === null ||
+    existingSeries?.[mapping.series.lastIssueAt] === undefined
+      ? undefined
+      : yield* mapping.decodeInstant(existingSeries[mapping.series.lastIssueAt]);
+
+  const allowed =
+    current.current &&
+    input.eligible &&
+    admitted.length === scopes.length &&
+    input.record.issuedAtMillis <= now &&
+    input.record.expiresAtMillis > now &&
+    (input.supersedes === undefined || input.supersedes === active) &&
+    (lastIssue === undefined || now - lastIssue >= input.policy.abuse.resendCooldownMillis);
+
+  const receipt = {
+    requestId: input.record.requestId,
+    reference: {
+      proofId: input.record.proofId,
+      purpose: input.record.purpose,
+      keyId: input.record.verifier.keyId,
+    },
+  };
+
+  const prepared = prepare(
+    allowed ? { _tag: "Issued", record: input.record } : { _tag: "Suppressed", receipt },
+    journal,
+  );
+
+  const statements: Statement<any>[] = [];
+  const marker = `effect-auth-proof-guard:issue:${input.record.requestId}`;
+
+  if (existingRequest !== undefined)
+    statements.push(
+      yield* statement(
+        database
+          .delete(mapping.request.table)
+          .where(
+            and(
+              eq(rc.moduleId, input.record.moduleId),
+              eq(rc.requestId, input.record.requestId),
+              lte(rc.retentionUntil, mapping.d1.engineNow),
+            ),
+          ),
+      ),
+    );
+  statements.push(
+    yield* statement(
+      database.insert(mapping.request.table).values(
+        driverValues(
+          mapping.request.encodeInsert({
+            record: input.record,
+            createdAtMillis: now,
+            retentionUntilMillis: retentionUntil,
+          }),
+          [
+            [mapping.request.createdAt, mapping.d1.engineNow],
+            [
+              mapping.request.retentionUntil,
+              mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis),
+            ],
+          ],
+        ),
+      ),
+    ),
+    ...(yield* anchorStatements(
+      mapping,
+      input.record.moduleId,
+      input.record.purpose,
+      "issue",
+      actionOpen ? scopes : scopes.slice(0, 1),
+      keys.series,
+      seriesVersion,
+      actionOpen,
+    )),
+    ...(yield* insertScopeStatements(
+      mapping,
+      input.record.moduleId,
+      input.record.purpose,
+      "issue",
+      input.record.requestId,
+      admitted,
+      now,
+      retentionUntil,
+      marker,
+    )),
+  );
+  if (allowed) {
+    const sc = seriesColumns(mapping);
+
+    const seriesCondition = and(
+      eq(sc.moduleId, input.record.moduleId),
+      eq(sc.purpose, input.record.purpose),
+      eq(sc.scopeKey, keys.series),
+      active === null || active === undefined
+        ? or(eq(sc.activeProofId, null), sql`${sc.activeProofId} is null`)
+        : eq(sc.activeProofId, active),
+      lastIssue === undefined
+        ? sql`1 = 1`
+        : lte(
+            sc.lastIssueAt,
+            mapping.d1.engineInstantMinus(input.policy.abuse.resendCooldownMillis),
+          ),
+    );
+
+    statements.push(
+      yield* assertion(
+        and(
+          current.condition,
+          sql`${mapping.d1.engineNowMillis} >= ${input.record.issuedAtMillis}`,
+          sql`${mapping.d1.engineNow} < ${sql.param(mapping.encodeInstant(input.record.expiresAtMillis), generationColumns(mapping).expiresAt)}`,
+          sql`exists(select 1 from ${mapping.series.table} where ${seriesCondition})`,
+        )!,
+        marker,
+      ),
+    );
+    if (active !== null && active !== undefined)
+      statements.push(
+        yield* statement(
+          database
+            .update(mapping.generation.table)
+            .set(updateValues([[mapping.generation.state, "superseded"]]))
+            .where(
+              and(
+                eq(generationColumns(mapping).moduleId, input.record.moduleId),
+                eq(generationColumns(mapping).proofId, active),
+                eq(generationColumns(mapping).state, "active"),
+              ),
+            ),
+        ),
+      );
+    statements.push(
+      yield* statement(
+        database.insert(mapping.generation.table).values(
+          driverValues(
+            mapping.generation.encodeInsert({
+              record: input.record,
+              seriesKey: keys.series,
+              retentionUntilMillis: retentionUntil,
+              state: "active",
+              deliveryState: "new",
+              policy: input.policy,
+            }),
+            [
+              [
+                mapping.generation.retentionUntil,
+                mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis),
+              ],
+            ],
+          ),
+        ),
+      ),
+      yield* statement(
+        database
+          .update(mapping.series.table)
+          .set(
+            updateValues([
+              [mapping.series.activeProofId, input.record.proofId],
+              [mapping.series.lastIssueAt, mapping.d1.engineNow],
+              [mapping.series.version, seriesVersion],
+            ]),
+          )
+          .where(
+            and(
+              eq(sc.moduleId, input.record.moduleId),
+              eq(sc.purpose, input.record.purpose),
+              eq(sc.scopeKey, keys.series),
+            ),
+          ),
+      ),
+    );
+  }
+
+  return {
+    receipt: prepared as PreparedCommit<A>,
+    statements,
+    retryable: (cause: unknown) =>
+      isMappedConstraintConflict(mapping.isRequestConflict, cause) ||
+      isMappedConstraintConflict(mapping.isSeriesConflict, cause) ||
+      isGuardFailure(cause, marker),
+  };
+});
+
+const attemptPlan = Effect.fn("Drizzle.attemptPlan")(function* <A>(
+  mapping: Mapping,
+  input: Parameters<ProofPersistence["Service"]["attempt"]>[0],
+  prepare: PlanPrepare<ProofPersistence["Service"]["attempt"], A>,
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+  const journal = yield* CurrentCommitJournal;
+
+  const keys = mapping.scopeKeys({
+    moduleId: input.moduleId,
+    purpose: input.purpose,
+    binding: input.binding,
+  });
+
+  const current = yield* authority(mapping, input.moduleId, input.purpose, input.binding);
+  const command = commandColumns(mapping);
+
+  const existingCommand = (yield* database
+    .select()
+    .from(mapping.command.table)
+    .where(and(eq(command.moduleId, input.moduleId), eq(command.commandId, input.continuationId)))
+    .limit(1))[0];
+
+  if (existingCommand !== undefined) {
+    if (existingCommand[mapping.command.decision] === "rejected")
+      return {
+        receipt: prepare({ _tag: "Rejected" }, journal) as PreparedCommit<A>,
+        statements: [],
+      };
+
+    return yield* unavailable();
+  }
+  const now = yield* readEngineNowMillis(mapping);
+  const scopes = scopeEntries(keys, input.binding, "attempt", input.policy);
+
+  const initiallyAdmitted = yield* readScopeAdmission(
+    mapping,
+    input.moduleId,
+    input.purpose,
+    "attempt",
+    scopes,
+    now,
+  );
+
+  const actionOpen = initiallyAdmitted.some((entry) => entry.kind === "action");
+  const admitted = actionOpen ? initiallyAdmitted : [];
+
+  const series = actionOpen
+    ? (yield* readSeries(mapping, input.moduleId, input.purpose, keys.series))[0]
+    : undefined;
+
+  const generation = (yield* readGeneration(mapping, input.moduleId, input.proofId))[0];
+  const fc = failureColumns(mapping);
+
+  const failureRows = yield* database
+    .select({ total: count() })
+    .from(mapping.failureEvent.table)
+    .where(
+      and(
+        eq(fc.moduleId, input.moduleId),
+        eq(fc.purpose, input.purpose),
+        eq(fc.seriesKey, keys.series),
+        gte(fc.occurredAt, mapping.encodeInstant(now - input.policy.abuse.attempts.windowMillis)),
+      ),
+    );
+
+  const failures = Number(failureRows[0]?.total ?? 0);
+
+  const storedBinding =
+    generation === undefined ? undefined : yield* mapping.generation.decodeBinding(generation);
+
+  const expires =
+    generation === undefined
+      ? undefined
+      : yield* mapping.decodeInstant(generation[mapping.generation.expiresAt]);
+
+  const currentGeneration =
+    generation !== undefined &&
+    generation[mapping.generation.purpose] === input.purpose &&
+    generation[mapping.generation.state] === "active" &&
+    series?.[mapping.series.activeProofId] === input.proofId &&
+    storedBinding !== undefined &&
+    sameBinding(storedBinding, input.binding) &&
+    expires !== undefined &&
+    expires > now;
+
+  const candidateMatches =
+    generation !== undefined &&
+    input.candidate !== undefined &&
+    generation[mapping.generation.verifierKeyId] === input.candidate.keyId &&
+    generation[mapping.generation.verifierDigest] === input.candidate.digest;
+
+  const accepted =
+    current.current &&
+    currentGeneration &&
+    candidateMatches &&
+    admitted.length === scopes.length &&
+    failures < input.policy.maximumFailedAttempts;
+
+  const retentionUntil = now + input.policy.requestRetentionMillis;
+  const seriesVersion = yield* allocateVersion(mapping);
+
+  const statements: Statement<any>[] = [
+    ...(yield* anchorStatements(
+      mapping,
+      input.moduleId,
+      input.purpose,
+      "attempt",
+      actionOpen ? scopes : scopes.slice(0, 1),
+      keys.series,
+      seriesVersion,
+      actionOpen,
+    )),
+    ...(yield* insertScopeStatements(
+      mapping,
+      input.moduleId,
+      input.purpose,
+      "attempt",
+      input.continuationId,
+      admitted,
+      now,
+      retentionUntil,
+      `effect-auth-proof-guard:attempt:${input.continuationId}`,
+    )),
+  ];
+
+  const marker = `effect-auth-proof-guard:attempt:${input.continuationId}`;
+
+  if (!accepted) {
+    const prepared = prepare({ _tag: "Rejected" }, journal) as PreparedCommit<A>;
+
+    if (
+      admitted.length === scopes.length &&
+      current.current &&
+      currentGeneration &&
+      !candidateMatches &&
+      failures < input.policy.maximumFailedAttempts
+    ) {
+      const gc = generationColumns(mapping);
+      const sc = seriesColumns(mapping);
+
+      statements.push(
+        yield* assertion(
+          and(
+            current.condition,
+            sql`exists(select 1 from ${mapping.series.table} where ${sc.moduleId} = ${sql.param(input.moduleId, sc.moduleId)} and ${sc.purpose} = ${sql.param(input.purpose, sc.purpose)} and ${sc.scopeKey} = ${sql.param(keys.series, sc.scopeKey)} and ${sc.activeProofId} = ${sql.param(input.proofId, sc.activeProofId)})`,
+            sql`exists(select 1 from ${mapping.generation.table} where ${gc.moduleId} = ${sql.param(input.moduleId, gc.moduleId)} and ${gc.proofId} = ${sql.param(input.proofId, gc.proofId)} and ${gc.state} = 'active' and ${gc.expiresAt} > ${mapping.d1.engineNow})`,
+            failureCondition(mapping, input.moduleId, input.purpose, keys.series, input.policy),
+          )!,
+          marker,
+        ),
+        yield* statement(
+          database.insert(mapping.failureEvent.table).values(
+            driverValues(
+              mapping.failureEvent.encodeInsert({
+                moduleId: input.moduleId,
+                purpose: input.purpose,
+                seriesKey: keys.series,
+                commandId: input.continuationId,
+                occurredAtMillis: now,
+                retentionUntilMillis: retentionUntil,
+              }),
+              [
+                [mapping.failureEvent.occurredAt, mapping.d1.engineNow],
+                [
+                  mapping.failureEvent.retentionUntil,
+                  mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis),
+                ],
+              ],
+            ),
+          ),
+        ),
+      );
+    }
+    statements.push(
+      yield* commandInsert(
+        mapping,
+        input.moduleId,
+        input.continuationId,
+        "attempt",
+        "rejected",
+        retentionUntil,
+        mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis),
+      ),
+    );
+
+    return {
+      receipt: prepared,
+      statements,
+      retryable: (cause: unknown) =>
+        isMappedConstraintConflict(mapping.isCommandConflict, cause) ||
+        isMappedConstraintConflict(mapping.isSeriesConflict, cause) ||
+        isGuardFailure(cause, marker),
+    };
+  }
+  const version = yield* allocateVersion(mapping);
+  const continuationExpires = Math.min(expires!, now + input.policy.continuationLifetimeMillis);
+
+  const continuation: ProofContinuationRecord = {
+    moduleId: input.moduleId,
+    purpose: input.purpose,
+    continuationId: input.continuationId,
+    digest: input.continuationDigest,
+    proofId: input.proofId,
+    seriesKey: keys.series,
+    binding: input.binding,
+    expiresAtMillis: continuationExpires,
+    version,
+  };
+
+  const decision: ProofAttemptDecision = {
+    _tag: "Accepted",
+    continuation: {
+      continuationId: input.continuationId,
+      purpose: input.purpose,
+      expiresAtMillis: continuationExpires,
+    },
+  };
+
+  const prepared = prepare(decision, journal) as PreparedCommit<A>;
+  const gc = generationColumns(mapping);
+  const sc = seriesColumns(mapping);
+
+  statements.push(
+    yield* assertion(
+      and(
+        current.condition,
+        failureCondition(mapping, input.moduleId, input.purpose, keys.series, input.policy),
+        sql`exists(select 1 from ${mapping.series.table} where ${sc.moduleId} = ${sql.param(input.moduleId, sc.moduleId)} and ${sc.purpose} = ${sql.param(input.purpose, sc.purpose)} and ${sc.scopeKey} = ${sql.param(keys.series, sc.scopeKey)} and ${sc.activeProofId} = ${sql.param(input.proofId, sc.activeProofId)})`,
+        sql`exists(select 1 from ${mapping.generation.table} where ${gc.moduleId} = ${sql.param(input.moduleId, gc.moduleId)} and ${gc.proofId} = ${sql.param(input.proofId, gc.proofId)} and ${gc.purpose} = ${sql.param(input.purpose, gc.purpose)} and ${gc.state} = 'active' and ${gc.verifierKeyId} = ${sql.param(input.candidate!.keyId, gc.verifierKeyId)} and ${gc.verifierDigest} = ${sql.param(input.candidate!.digest, gc.verifierDigest)} and ${gc.expiresAt} > ${mapping.d1.engineNow})`,
+      )!,
+      marker,
+    ),
+    yield* commandInsert(
+      mapping,
+      input.moduleId,
+      input.continuationId,
+      "attempt",
+      "accepted",
+      retentionUntil,
+      mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis),
+    ),
+    yield* statement(
+      database
+        .update(mapping.generation.table)
+        .set(updateValues([[mapping.generation.state, "consumed"]]))
+        .where(
+          and(
+            eq(gc.moduleId, input.moduleId),
+            eq(gc.proofId, input.proofId),
+            eq(gc.state, "active"),
+          ),
+        ),
+    ),
+    yield* statement(
+      database.insert(mapping.continuation.table).values(
+        driverValues(
+          mapping.continuation.encodeInsert({
+            ...continuation,
+            retentionUntilMillis: retentionUntil,
+          }),
+          [
+            [
+              mapping.continuation.retentionUntil,
+              mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis),
+            ],
+          ],
+        ),
+      ),
+    ),
+  );
+
+  return {
+    receipt: prepared,
+    statements,
+    retryable: (cause: unknown) =>
+      isMappedConstraintConflict(mapping.isCommandConflict, cause) ||
+      isMappedConstraintConflict(mapping.isSeriesConflict, cause) ||
+      isGuardFailure(cause, marker),
+  };
+});
+
+const inspectD1Completion = Effect.fn("DrizzleD1Proof.inspectCompletion")(function* (
+  mapping: Mapping,
+  input: ProofCompletionPlan["input"],
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+
+  const keys = mapping.scopeKeys({
+    moduleId: input.moduleId,
+    purpose: input.purpose,
+    binding: input.binding,
+  });
+
+  const current = yield* authority(mapping, input.moduleId, input.purpose, input.binding);
+  const c = continuationColumns(mapping);
+
+  const row = (yield* database
+    .select()
+    .from(mapping.continuation.table)
+    .where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId)))
+    .limit(1))[0];
+
+  const now = yield* readEngineNowMillis(mapping);
+  const record = row === undefined ? undefined : yield* mapping.continuation.decode(row);
+
+  const accepted =
+    current.current &&
+    record !== undefined &&
+    record.moduleId === input.moduleId &&
+    record.continuationId === input.continuationId &&
+    record.purpose === input.purpose &&
+    record.digest === input.continuationDigest &&
+    record.seriesKey === keys.series &&
+    sameBinding(record.binding, input.binding) &&
+    row[mapping.continuation.consumed] === false &&
+    record.expiresAtMillis > now;
+
+  const immutable = [
+    mapping.continuation.moduleId,
+    mapping.continuation.purpose,
+    mapping.continuation.continuationId,
+    mapping.continuation.digest,
+    mapping.continuation.proofId,
+    mapping.continuation.seriesKey,
+    mapping.continuation.binding,
+    mapping.continuation.expiresAt,
+    mapping.continuation.version,
+    mapping.continuation.retentionUntil,
+  ];
+
+  const exact =
+    row === undefined
+      ? sql`false`
+      : and(...immutable.map((key) => eq(column(mapping.continuation.table, key), row[key])))!;
+
+  return {
+    accepted,
+    record,
+    row,
+    columns: c,
+    condition: and(
+      current.condition,
+      sql`exists(select 1 from ${mapping.continuation.table} where ${exact} and ${c.consumed} = ${sql.param(false, c.consumed)} and ${column(mapping.continuation.table, mapping.continuation.expiresAt)} > ${mapping.d1.engineNow})`,
+    )!,
+    appliedCondition:
+      row === undefined
+        ? sql`false`
+        : sql`exists(select 1 from ${mapping.continuation.table} where ${exact} and ${c.consumed} = ${sql.param(true, c.consumed)} and ${column(mapping.continuation.table, mapping.continuation.expiresAt)} > ${mapping.d1.engineNow})`,
+  };
+});
+
+/** Read-only preflight plus its exact final-engine-time batch predicate. */
+export const checkD1ProofCompletion = Effect.fn("Drizzle.checkD1ProofCompletion")(function* (
+  mapping: Mapping,
+  input: ProofCompletionPlan["input"],
+) {
+  return yield* inspectD1Completion(mapping, input);
+});
+
+const completionPlan = Effect.fn("Drizzle.completionPlan")(function* <A>(
+  mapping: Mapping,
+  input: Parameters<ProofPersistence["Service"]["complete"]>[0],
+  prepare: PrepareProofCommit<ProofCompletionDecision, A>,
+) {
+  const database = yield* CurrentD1PlanningDatabase;
+  const journal = yield* CurrentCommitJournal;
+
+  const inspected = yield* inspectD1Completion(mapping, input);
+  const { accepted, record, columns: c } = inspected;
+  const decision: ProofCompletionDecision = accepted ? "completed" : "rejected";
+  const receipt = prepare(decision, journal) as PreparedCommit<A>;
+
+  if (!accepted) return { receipt, statements: [] };
+
+  const postconditions = [
+    yield* assertion(
+      and(
+        inspected.appliedCondition,
+        sql`exists(select 1 from ${mapping.command.table} where ${column(mapping.command.table, mapping.command.moduleId)} = ${sql.param(input.moduleId, column(mapping.command.table, mapping.command.moduleId))} and ${column(mapping.command.table, mapping.command.commandId)} = ${sql.param(input.continuationDigest, column(mapping.command.table, mapping.command.commandId))} and ${column(mapping.command.table, mapping.command.kind)} = ${sql.param("complete", column(mapping.command.table, mapping.command.kind))} and ${column(mapping.command.table, mapping.command.decision)} = ${sql.param("completed", column(mapping.command.table, mapping.command.decision))} and ${column(mapping.command.table, mapping.command.retentionUntil)} = ${sql.param(mapping.encodeInstant(record!.expiresAtMillis), column(mapping.command.table, mapping.command.retentionUntil))})`,
+      )!,
+      `effect-auth-proof-guard:complete:${input.continuationId}`,
+    ),
+  ];
+
+  const statements = [
+    yield* assertion(
+      inspected.condition,
+      `effect-auth-proof-guard:complete:${input.continuationId}`,
+    ),
+    yield* statement(
+      database
+        .update(mapping.continuation.table)
+        .set(updateValues([[mapping.continuation.consumed, true]]))
+        .where(
+          and(
+            eq(c.moduleId, input.moduleId),
+            eq(c.continuationId, input.continuationId),
+            eq(c.digest, input.continuationDigest),
+            eq(c.consumed, false),
+          ),
+        ),
+    ),
+    yield* commandInsert(
+      mapping,
+      input.moduleId,
+      input.continuationDigest,
+      "complete",
+      "completed",
+      record!.expiresAtMillis,
+    ),
+    ...postconditions,
+  ];
+
+  return {
+    receipt,
+    statements,
+    postconditions,
+    retryable: (cause: unknown) =>
+      isMappedConstraintConflict(mapping.isCommandConflict, cause) ||
+      isGuardFailure(cause, `effect-auth-proof-guard:complete:${input.continuationId}`),
+  };
+});
+
+const makeProofPlans = (mapping: Mapping) => {
+  const run = <A, E, R>(plan: Effect.Effect<Planned<A>, E, R>) =>
+    Effect.gen(function* () {
+      if (!validConstraints(mapping)) return yield* unavailable();
+
+      return yield* plan;
+    });
+
+  return {
+    issue: <A>(
+      input: Parameters<ProofPersistence["Service"]["issue"]>[0],
+      prepare: PlanPrepare<ProofPersistence["Service"]["issue"], A>,
+    ) =>
+      run(
+        Effect.gen(function* () {
+          return yield* issuePlan(mapping, input, prepare);
+        }),
+      ),
+    attempt: <A>(
+      input: Parameters<ProofPersistence["Service"]["attempt"]>[0],
+      prepare: PlanPrepare<ProofPersistence["Service"]["attempt"], A>,
+    ) =>
+      run(
+        Effect.gen(function* () {
+          return yield* attemptPlan(mapping, input, prepare);
+        }),
+      ),
+    complete: <A>(
+      input: Parameters<ProofPersistence["Service"]["complete"]>[0],
+      prepare: PlanPrepare<ProofPersistence["Service"]["complete"], A>,
+    ) =>
+      run(
+        Effect.gen(function* () {
+          return yield* completionPlan(mapping, input, prepare);
+        }),
+      ),
+    claimDelivery: <A>(
+      input: Parameters<ProofPersistence["Service"]["claimDelivery"]>[0],
+      prepare: PlanPrepare<ProofPersistence["Service"]["claimDelivery"], A>,
+    ) =>
+      Effect.gen(function* () {
+        const database = yield* CurrentD1PlanningDatabase;
+
+        return yield* run(
+          Effect.gen(function* () {
+            const journal = yield* CurrentCommitJournal;
+
+            const row = (yield* readGeneration(mapping, input.moduleId, input.proofId))[0];
+            const now = yield* readEngineNowMillis(mapping);
+            const c = generationColumns(mapping);
+
+            if (row === undefined)
+              return { receipt: prepare({ _tag: "Declined" }, journal), statements: [] };
+            const expires = yield* mapping.decodeInstant(row[mapping.generation.expiresAt]);
+
+            const claimDeadline =
+              row[mapping.generation.claimDeadline] === null ||
+              row[mapping.generation.claimDeadline] === undefined
+                ? undefined
+                : yield* mapping.decodeInstant(row[mapping.generation.claimDeadline]);
+
+            const retryAt =
+              row[mapping.generation.retryAt] === null ||
+              row[mapping.generation.retryAt] === undefined
+                ? undefined
+                : yield* mapping.decodeInstant(row[mapping.generation.retryAt]);
+
+            const state = row[mapping.generation.deliveryState] as string;
+
+            const expiredClaim =
+              state === "claimed" && claimDeadline !== undefined && claimDeadline <= now;
+
+            const effectiveState = expiredClaim ? "ambiguous" : state;
+
+            const canClaim =
+              row[mapping.generation.version] === input.version &&
+              row[mapping.generation.deliveryId] === input.deliveryId &&
+              row[mapping.generation.state] === "active" &&
+              expires > now &&
+              Number(row[mapping.generation.sendCount]) < input.policy.maximumDeliveryAttempts &&
+              (effectiveState === "new" ||
+                (effectiveState === "ambiguous" &&
+                  input.allowAmbiguousRetry &&
+                  (retryAt === undefined || retryAt <= now)));
+
+            if (!canClaim) {
+              const statements = expiredClaim
+                ? [
+                    yield* statement(
+                      database
+                        .update(mapping.generation.table)
+                        .set(updateValues([[mapping.generation.deliveryState, "ambiguous"]]))
+                        .where(
+                          and(
+                            eq(c.moduleId, input.moduleId),
+                            eq(c.proofId, input.proofId),
+                            eq(c.deliveryState, "claimed"),
+                            lte(c.claimDeadline, mapping.d1.engineNow),
+                          ),
+                        ),
+                    ),
+                  ]
+                : [];
+
+              return { receipt: prepare({ _tag: "Declined" }, journal), statements };
+            }
+            const claimVersion = yield* allocateVersion(mapping);
+            const decision: ProofDeliveryClaim = { _tag: "Claimed", claimVersion };
+
+            const condition = and(
+              eq(c.moduleId, input.moduleId),
+              eq(c.proofId, input.proofId),
+              eq(c.version, input.version),
+              eq(c.deliveryId, input.deliveryId),
+              eq(c.state, "active"),
+              sql`${c.expiresAt} > ${mapping.d1.engineNow}`,
+              sql`${c.sendCount} < ${input.policy.maximumDeliveryAttempts}`,
+              effectiveState === "new"
+                ? eq(c.deliveryState, "new")
+                : and(
+                    eq(c.deliveryState, "ambiguous"),
+                    or(sql`${c.retryAt} is null`, lte(c.retryAt, mapping.d1.engineNow)),
+                  ),
+            )!;
+
+            return {
+              receipt: prepare(decision, journal),
+              statements: [
+                yield* assertion(
+                  sql`exists(select 1 from ${mapping.generation.table} where ${condition})`,
+                  `effect-auth-proof-guard:claim:${input.proofId}`,
+                ),
+                yield* statement(
+                  database
+                    .update(mapping.generation.table)
+                    .set(
+                      updateValues([
+                        [
+                          mapping.generation.sendCount,
+                          Number(row[mapping.generation.sendCount]) + 1,
+                        ],
+                        [mapping.generation.deliveryState, "claimed"],
+                        [mapping.generation.claimVersion, claimVersion],
+                        [
+                          mapping.generation.claimDeadline,
+                          mapping.d1.engineInstantPlus(input.policy.deliveryClaimMillis),
+                        ],
+                        [
+                          mapping.generation.retryAt,
+                          mapping.d1.engineInstantPlus(input.policy.deliveryRetryMillis),
+                        ],
+                      ]),
+                    )
+                    .where(condition),
+                ),
+              ],
+              retryable: (cause: unknown) =>
+                isGuardFailure(cause, `effect-auth-proof-guard:claim:${input.proofId}`),
+            };
+          }),
+        );
+      }),
+    settleDelivery: <A>(
+      input: Parameters<ProofPersistence["Service"]["settleDelivery"]>[0],
+      prepare: PlanPrepare<ProofPersistence["Service"]["settleDelivery"], A>,
+    ) =>
+      Effect.gen(function* () {
+        const database = yield* CurrentD1PlanningDatabase;
+
+        return yield* run(
+          Effect.gen(function* () {
+            const journal = yield* CurrentCommitJournal;
+
+            const row = (yield* readGeneration(mapping, input.moduleId, input.proofId))[0];
+            const receipt = prepare(undefined, journal);
+
+            if (
+              row === undefined ||
+              row[mapping.generation.version] !== input.version ||
+              row[mapping.generation.deliveryId] !== input.deliveryId ||
+              row[mapping.generation.claimVersion] !== input.claimVersion ||
+              row[mapping.generation.deliveryState] !== "claimed"
+            )
+              return { receipt, statements: [] };
+            const c = generationColumns(mapping);
+            const outcome: ProofDeliveryOutcome = input.outcome;
+
+            const state =
+              outcome._tag === "Accepted"
+                ? "accepted"
+                : outcome._tag === "DefiniteFailure"
+                  ? "failed"
+                  : "ambiguous";
+
+            const values: Array<readonly [string, unknown]> = [
+              [mapping.generation.deliveryState, state],
+              [mapping.generation.claimDeadline, null],
+            ];
+
+            if (outcome._tag === "Ambiguous")
+              values.push([
+                mapping.generation.retryAt,
+                mapping.d1.engineInstantPlus(Number(row[mapping.generation.deliveryRetryMillis])),
+              ]);
+            if (outcome._tag === "DefiniteFailure")
+              values.push([mapping.generation.state, "cancelled"]);
+
+            const condition = and(
+              eq(c.moduleId, input.moduleId),
+              eq(c.proofId, input.proofId),
+              eq(c.version, input.version),
+              eq(c.deliveryId, input.deliveryId),
+              eq(c.claimVersion, input.claimVersion),
+              eq(c.deliveryState, "claimed"),
+            );
+
+            const statements: Statement<any>[] = [
+              yield* statement(
+                database
+                  .update(mapping.generation.table)
+                  .set(updateValues(values))
+                  .where(condition),
+              ),
+            ];
+
+            if (outcome._tag === "DefiniteFailure") {
+              const sc = seriesColumns(mapping);
+
+              statements.push(
+                yield* statement(
+                  database
+                    .update(mapping.series.table)
+                    .set(updateValues([[mapping.series.activeProofId, null]]))
+                    .where(
+                      and(
+                        eq(sc.moduleId, input.moduleId),
+                        eq(sc.purpose, row[mapping.generation.purpose]),
+                        eq(sc.scopeKey, row[mapping.generation.seriesKey]),
+                        eq(sc.activeProofId, input.proofId),
+                        sql`exists(select 1 from ${mapping.generation.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.proofId} = ${sql.param(input.proofId, c.proofId)} and ${c.version} = ${sql.param(input.version, c.version)} and ${c.deliveryId} = ${sql.param(input.deliveryId, c.deliveryId)} and ${c.claimVersion} = ${sql.param(input.claimVersion, c.claimVersion)} and ${c.deliveryState} = 'failed' and ${c.state} = 'cancelled')`,
+                      ),
+                    ),
+                ),
+              );
+            }
+
+            return { receipt, statements };
+          }),
+        );
+      }),
+    cancel: <A>(
+      input: Parameters<ProofPersistence["Service"]["cancel"]>[0],
+      prepare: PlanPrepare<ProofPersistence["Service"]["cancel"], A>,
+    ) =>
+      Effect.gen(function* () {
+        const database = yield* CurrentD1PlanningDatabase;
+
+        return yield* run(
+          Effect.gen(function* () {
+            const journal = yield* CurrentCommitJournal;
+
+            const keys = mapping.scopeKeys({
+              moduleId: input.moduleId,
+              purpose: input.purpose,
+              binding: input.binding,
+            });
+
+            const current = yield* authority(mapping, input.moduleId, input.purpose, input.binding);
+
+            const series = (yield* readSeries(
+              mapping,
+              input.moduleId,
+              input.purpose,
+              keys.series,
+            ))[0];
+
+            const receipt = prepare(undefined, journal);
+            const active = series?.[mapping.series.activeProofId] as string | null | undefined;
+
+            if (!current.current || active === null || active === undefined)
+              return { receipt, statements: [] };
+            const generation = (yield* readGeneration(mapping, input.moduleId, active))[0];
+
+            const storedBinding =
+              generation === undefined
+                ? undefined
+                : yield* mapping.generation.decodeBinding(generation);
+
+            if (storedBinding === undefined || !sameBinding(storedBinding, input.binding))
+              return { receipt, statements: [] };
+            const gc = generationColumns(mapping);
+            const sc = seriesColumns(mapping);
+            const marker = `effect-auth-proof-guard:cancel:${active}`;
+
+            return {
+              receipt,
+              statements: [
+                yield* assertion(
+                  and(
+                    current.condition,
+                    sql`exists(select 1 from ${mapping.series.table} where ${sc.moduleId} = ${sql.param(input.moduleId, sc.moduleId)} and ${sc.purpose} = ${sql.param(input.purpose, sc.purpose)} and ${sc.scopeKey} = ${sql.param(keys.series, sc.scopeKey)} and ${sc.activeProofId} = ${sql.param(active, sc.activeProofId)})`,
+                    sql`exists(select 1 from ${mapping.generation.table} where ${gc.moduleId} = ${sql.param(input.moduleId, gc.moduleId)} and ${gc.proofId} = ${sql.param(active, gc.proofId)} and ${gc.state} = 'active')`,
+                  )!,
+                  marker,
+                ),
+                yield* statement(
+                  database
+                    .update(mapping.generation.table)
+                    .set(updateValues([[mapping.generation.state, "cancelled"]]))
+                    .where(
+                      and(
+                        eq(gc.moduleId, input.moduleId),
+                        eq(gc.proofId, active),
+                        eq(gc.state, "active"),
+                      ),
+                    ),
+                ),
+                yield* statement(
+                  database
+                    .update(mapping.series.table)
+                    .set(updateValues([[mapping.series.activeProofId, null]]))
+                    .where(
+                      and(
+                        eq(sc.moduleId, input.moduleId),
+                        eq(sc.purpose, input.purpose),
+                        eq(sc.scopeKey, keys.series),
+                        eq(sc.activeProofId, active),
+                      ),
+                    ),
+                ),
+              ],
+              retryable: (cause: unknown) => isGuardFailure(cause, marker),
+            };
+          }),
+        );
+      }),
+    cleanup: <A>(
+      input: Parameters<ProofPersistence["Service"]["cleanup"]>[0],
+      prepare: PlanPrepare<ProofPersistence["Service"]["cleanup"], A>,
+    ) =>
+      Effect.gen(function* () {
+        const database = yield* CurrentD1PlanningDatabase;
+
+        return yield* run(
+          Effect.gen(function* () {
+            const journal = yield* CurrentCommitJournal;
+
+            const now = yield* readEngineNowMillis(mapping);
+            const nativeNow = mapping.encodeInstant(now);
+            const gc = generationColumns(mapping);
+            const cc = continuationColumns(mapping);
+            const rc = requestColumns(mapping);
+            const ac = abuseColumns(mapping);
+            const fc = failureColumns(mapping);
+            const mc = commandColumns(mapping);
+            const sc = seriesColumns(mapping);
+            const rsc = scopeColumns(mapping);
+            let remaining = input.limit;
+            let hasMore = false;
+
+            const take = <A>(effect: Effect.Effect<ReadonlyArray<A>, AdapterFailure>) =>
+              effect.pipe(
+                Effect.map((rows) => {
+                  if (rows.length > remaining) hasMore = true;
+                  const selected = rows.slice(0, remaining);
+
+                  remaining -= selected.length;
+
+                  return selected;
+                }),
+              );
+
+            const continuations = yield* take(
+              database
+                .select({ continuationId: cc.continuationId })
+                .from(mapping.continuation.table)
+                .where(and(eq(cc.moduleId, input.moduleId), lte(cc.retentionUntil, nativeNow)))
+                .limit(remaining + 1),
+            );
+
+            const generations = yield* take(
+              database
+                .select({ proofId: gc.proofId })
+                .from(mapping.generation.table)
+                .where(and(eq(gc.moduleId, input.moduleId), lte(gc.retentionUntil, nativeNow)))
+                .limit(remaining + 1),
+            );
+
+            const requests = yield* take(
+              database
+                .select({ requestId: rc.requestId })
+                .from(mapping.request.table)
+                .where(and(eq(rc.moduleId, input.moduleId), lte(rc.retentionUntil, nativeNow)))
+                .limit(remaining + 1),
+            );
+
+            const abuse = yield* take(
+              database
+                .select({
+                  action: ac.action,
+                  scopeKind: ac.scopeKind,
+                  scopeKey: ac.scopeKey,
+                  commandId: ac.commandId,
+                })
+                .from(mapping.abuseEvent.table)
+                .where(and(eq(ac.moduleId, input.moduleId), lte(ac.retentionUntil, nativeNow)))
+                .limit(remaining + 1),
+            );
+
+            const failures = yield* take(
+              database
+                .select({ seriesKey: fc.seriesKey, commandId: fc.commandId })
+                .from(mapping.failureEvent.table)
+                .where(and(eq(fc.moduleId, input.moduleId), lte(fc.retentionUntil, nativeNow)))
+                .limit(remaining + 1),
+            );
+
+            const commands = yield* take(
+              database
+                .select({ commandId: mc.commandId })
+                .from(mapping.command.table)
+                .where(and(eq(mc.moduleId, input.moduleId), lte(mc.retentionUntil, nativeNow)))
+                .limit(remaining + 1),
+            );
+
+            const series = yield* take(
+              database
+                .select({ purpose: sc.purpose, scopeKey: sc.scopeKey })
+                .from(mapping.series.table)
+                .where(
+                  and(
+                    eq(sc.moduleId, input.moduleId),
+                    isNull(sc.activeProofId),
+                    notExists(
+                      database
+                        .select({ one: sql`1` })
+                        .from(mapping.generation.table)
+                        .where(
+                          and(
+                            eq(gc.moduleId, sc.moduleId),
+                            eq(gc.purpose, sc.purpose),
+                            eq(gc.seriesKey, sc.scopeKey),
+                          ),
+                        ),
+                    ),
+                    notExists(
+                      database
+                        .select({ one: sql`1` })
+                        .from(mapping.failureEvent.table)
+                        .where(
+                          and(
+                            eq(fc.moduleId, sc.moduleId),
+                            eq(fc.purpose, sc.purpose),
+                            eq(fc.seriesKey, sc.scopeKey),
+                          ),
+                        ),
+                    ),
+                  ),
+                )
+                .limit(remaining + 1),
+            );
+
+            const rateScopes = yield* take(
+              database
+                .select({
+                  purpose: rsc.purpose,
+                  action: rsc.action,
+                  scopeKind: rsc.scopeKind,
+                  scopeKey: rsc.scopeKey,
+                })
+                .from(mapping.rateScope.table)
+                .where(
+                  and(
+                    eq(rsc.moduleId, input.moduleId),
+                    notExists(
+                      database
+                        .select({ one: sql`1` })
+                        .from(mapping.abuseEvent.table)
+                        .where(
+                          and(
+                            eq(ac.moduleId, rsc.moduleId),
+                            eq(ac.purpose, rsc.purpose),
+                            eq(ac.action, rsc.action),
+                            eq(ac.scopeKind, rsc.scopeKind),
+                            eq(ac.scopeKey, rsc.scopeKey),
+                          ),
+                        ),
+                    ),
+                  ),
+                )
+                .limit(remaining + 1),
+            );
+
+            const marker = `effect-auth-proof-guard:cleanup:${input.moduleId}:${now}`;
+            const statements: Statement<any>[] = [];
+
+            const guardedDelete = Effect.fn(function* (
+              condition: SQL,
+              query: { readonly toSQL: () => { sql: string; params: unknown[] } },
+            ) {
+              statements.push(yield* assertion(condition, marker), yield* statement(query));
+            });
+
+            for (const row of continuations) {
+              const condition = and(
+                eq(cc.moduleId, input.moduleId),
+                eq(cc.continuationId, row.continuationId),
+                lte(cc.retentionUntil, mapping.d1.engineNow),
+              )!;
+
+              yield* guardedDelete(
+                sql`exists(select 1 from ${mapping.continuation.table} where ${condition})`,
+                database.delete(mapping.continuation.table).where(condition),
+              );
+            }
+            for (const row of generations) {
+              const condition = and(
+                eq(gc.moduleId, input.moduleId),
+                eq(gc.proofId, row.proofId),
+                lte(gc.retentionUntil, mapping.d1.engineNow),
+              )!;
+
+              yield* guardedDelete(
+                sql`exists(select 1 from ${mapping.generation.table} where ${condition})`,
+                database
+                  .update(mapping.series.table)
+                  .set(updateValues([[mapping.series.activeProofId, null]]))
+                  .where(and(eq(sc.moduleId, input.moduleId), eq(sc.activeProofId, row.proofId))),
+              );
+              statements.push(
+                yield* statement(database.delete(mapping.generation.table).where(condition)),
+              );
+            }
+            for (const row of requests) {
+              const condition = and(
+                eq(rc.moduleId, input.moduleId),
+                eq(rc.requestId, row.requestId),
+                lte(rc.retentionUntil, mapping.d1.engineNow),
+              )!;
+
+              yield* guardedDelete(
+                sql`exists(select 1 from ${mapping.request.table} where ${condition})`,
+                database.delete(mapping.request.table).where(condition),
+              );
+            }
+            for (const row of abuse) {
+              const condition = and(
+                eq(ac.moduleId, input.moduleId),
+                eq(ac.action, row.action),
+                eq(ac.scopeKind, row.scopeKind),
+                eq(ac.scopeKey, row.scopeKey),
+                eq(ac.commandId, row.commandId),
+                lte(ac.retentionUntil, mapping.d1.engineNow),
+              )!;
+
+              yield* guardedDelete(
+                sql`exists(select 1 from ${mapping.abuseEvent.table} where ${condition})`,
+                database.delete(mapping.abuseEvent.table).where(condition),
+              );
+            }
+            for (const row of failures) {
+              const condition = and(
+                eq(fc.moduleId, input.moduleId),
+                eq(fc.seriesKey, row.seriesKey),
+                eq(fc.commandId, row.commandId),
+                lte(fc.retentionUntil, mapping.d1.engineNow),
+              )!;
+
+              yield* guardedDelete(
+                sql`exists(select 1 from ${mapping.failureEvent.table} where ${condition})`,
+                database.delete(mapping.failureEvent.table).where(condition),
+              );
+            }
+            for (const row of commands) {
+              const condition = and(
+                eq(mc.moduleId, input.moduleId),
+                eq(mc.commandId, row.commandId),
+                lte(mc.retentionUntil, mapping.d1.engineNow),
+              )!;
+
+              yield* guardedDelete(
+                sql`exists(select 1 from ${mapping.command.table} where ${condition})`,
+                database.delete(mapping.command.table).where(condition),
+              );
+            }
+            for (const row of series) {
+              const condition = and(
+                eq(sc.moduleId, input.moduleId),
+                eq(sc.purpose, row.purpose),
+                eq(sc.scopeKey, row.scopeKey),
+                isNull(sc.activeProofId),
+                notExists(
+                  database
+                    .select({ one: sql`1` })
+                    .from(mapping.generation.table)
+                    .where(
+                      and(
+                        eq(gc.moduleId, sc.moduleId),
+                        eq(gc.purpose, sc.purpose),
+                        eq(gc.seriesKey, sc.scopeKey),
+                      ),
+                    ),
+                ),
+              )!;
+
+              yield* guardedDelete(
+                sql`exists(select 1 from ${mapping.series.table} where ${condition})`,
+                database.delete(mapping.series.table).where(condition),
+              );
+            }
+            for (const row of rateScopes) {
+              const condition = and(
+                eq(rsc.moduleId, input.moduleId),
+                eq(rsc.purpose, row.purpose),
+                eq(rsc.action, row.action),
+                eq(rsc.scopeKind, row.scopeKind),
+                eq(rsc.scopeKey, row.scopeKey),
+                notExists(
+                  database
+                    .select({ one: sql`1` })
+                    .from(mapping.abuseEvent.table)
+                    .where(
+                      and(
+                        eq(ac.moduleId, rsc.moduleId),
+                        eq(ac.purpose, rsc.purpose),
+                        eq(ac.action, rsc.action),
+                        eq(ac.scopeKind, rsc.scopeKind),
+                        eq(ac.scopeKey, rsc.scopeKey),
+                      ),
+                    ),
+                ),
+              )!;
+
+              yield* guardedDelete(
+                sql`exists(select 1 from ${mapping.rateScope.table} where ${condition})`,
+                database.delete(mapping.rateScope.table).where(condition),
+              );
+            }
+            // Removing the final history row can make an anchor eligible only after this
+            // transaction/batch commits. One extra page lets the caller reclaim it.
+            hasMore ||= generations.length > 0 || failures.length > 0 || abuse.length > 0;
+            const result: ProofCleanupResult = { removed: input.limit - remaining, hasMore };
+
+            return {
+              receipt: prepare(result, journal),
+              statements,
+              retryable: (cause: unknown) => isGuardFailure(cause, marker),
+            };
+          }),
+        );
+      }),
+  };
+};
+
+export const makeD1ProofPersistenceServices = <
+  Rq extends AnySQLiteTable,
+  S extends AnySQLiteTable,
+  G extends AnySQLiteTable,
+  Cn extends AnySQLiteTable,
+  Rs extends AnySQLiteTable,
+  A extends AnySQLiteTable,
+  F extends AnySQLiteTable,
+  C extends AnySQLiteTable,
+  Sub extends AnySQLiteTable,
+  I extends AnySQLiteTable,
+  Cr extends AnySQLiteTable,
+  NativeId,
+>(
+  database: Database,
+  mapping: D1ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, NativeId>,
+) =>
+  Effect.gen(function* () {
+    const hooks = yield* LifecycleHooks;
+    const plans = makeProofPlans(mapping as unknown as Mapping);
+
+    const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>
+      Effect.gen(function* () {
+        if (yield* hasCommitScope) return yield* unavailable();
+
+        return yield* executeStandalone(plan, 2);
+      }).pipe(
+        Effect.provideService(CurrentD1PlanningDatabase, database),
+        Effect.provideService(LifecycleHooks, hooks),
+      );
+
+    const service: ProofPersistence["Service"] = {
+      issue: (input, prepare) => run(plans.issue(input, prepare)).pipe(translateIssueFailure),
+      attempt: (input, prepare) => run(plans.attempt(input, prepare)).pipe(translateFailure),
+      complete: (input, prepare) => run(plans.complete(input, prepare)).pipe(translateFailure),
+      claimDelivery: (input, prepare) =>
+        run(plans.claimDelivery(input, prepare)).pipe(translateFailure),
+      settleDelivery: (input, prepare) =>
+        run(plans.settleDelivery(input, prepare)).pipe(translateFailure),
+      cancel: (input, prepare) => run(plans.cancel(input, prepare)).pipe(translateFailure),
+      cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure),
+    };
+
+    return { proofPersistence: service };
+  });
+
+type CoordinatorError<E> = E | ProofUnavailable | HookConfigurationError;
+
+/**
+ * Owns one proof transition plus application statements in one D1 batch. It
+ * never replays the owner effect. A reserved guard or named race becomes
+ * ProofUnavailable so the caller can retry the entire command with fresh secrets.
+ */
+export function coordinateD1ProofPersistence<
+  Rq extends AnySQLiteTable,
+  S extends AnySQLiteTable,
+  G extends AnySQLiteTable,
+  Cn extends AnySQLiteTable,
+  Rs extends AnySQLiteTable,
+  Aev extends AnySQLiteTable,
+  F extends AnySQLiteTable,
+  C extends AnySQLiteTable,
+  Sub extends AnySQLiteTable,
+  I extends AnySQLiteTable,
+  Cr extends AnySQLiteTable,
+  NativeId,
+  A,
+  E,
+  R,
+  DatabaseError,
+  DatabaseRequirements,
+>(
+  acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+  options: {
+    readonly mapping: D1ProofPersistenceMapping<Rq, S, G, Cn, Rs, Aev, F, C, Sub, I, Cr, NativeId>;
+  },
+  body: Effect.Effect<A, E, R>,
+): Effect.Effect<
+  A,
+  CoordinatorError<E> | DatabaseError,
+  Exclude<R, ProofPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
+> {
+  return Effect.flatMap(acquire, (database) =>
+    Effect.gen(function* () {
+      const hooks = yield* LifecycleHooks;
+
+      if (yield* hasCommitScope) return yield* unavailable();
+
+      const result = yield* coordinateCommit(
+        () =>
+          Effect.gen(function* () {
+            const statements: Statement<any>[] = [];
+            let mutation: Planned<any> | undefined;
+
+            const nativeCollector = D1BatchStatements.of({
+              append: (statement) => Effect.sync(() => statements.push(statement)),
+            });
+
+            const owner = yield* makeD1Owner(unavailable()).pipe(
+              Effect.provideService(D1BatchStatements, nativeCollector),
+            );
+
+            const plans = makeProofPlans(options.mapping as unknown as Mapping);
+
+            const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>
+              coordinateCommit(
+                () =>
+                  Effect.gen(function* () {
+                    const journal = yield* CurrentCommitJournal;
+                    const planned = yield* plan;
+
+                    yield* owner.check;
+                    if (mutation !== undefined) return yield* unavailable();
+                    const guarded = { ...planned, journalGuard: journal.prepare(undefined) };
+
+                    mutation = guarded;
+                    statements.push(...guarded.statements);
+
+                    return guarded.receipt;
+                  }),
+                { mode: "batch" },
+              ).pipe(
+                Effect.map((result) => result.value),
+                Effect.provideService(CurrentD1PlanningDatabase, database),
+                Effect.provideService(LifecycleHooks, hooks),
+              );
+
+            const service: ProofPersistence["Service"] = {
+              issue: (input, prepare) =>
+                owner.run(run(plans.issue(input, prepare)).pipe(translateIssueFailure)),
+              attempt: (input, prepare) =>
+                owner.run(run(plans.attempt(input, prepare)).pipe(translateFailure)),
+              complete: (input, prepare) =>
+                owner.run(run(plans.complete(input, prepare)).pipe(translateFailure)),
+              claimDelivery: (input, prepare) =>
+                owner.run(run(plans.claimDelivery(input, prepare)).pipe(translateFailure)),
+              settleDelivery: (input, prepare) =>
+                owner.run(run(plans.settleDelivery(input, prepare)).pipe(translateFailure)),
+              cancel: (input, prepare) =>
+                owner.run(run(plans.cancel(input, prepare)).pipe(translateFailure)),
+              cleanup: (input, prepare) =>
+                owner.run(run(plans.cleanup(input, prepare)).pipe(translateFailure)),
+            };
+
+            const provided = Context.make(ProofPersistence, service).pipe(
+              Context.add(D1BatchStatements, owner.collector),
+            );
+
+            const value = yield* owner.close(Effect.provideContext(body, provided));
+
+            if (mutation?.journalGuard !== undefined) {
+              const status = yield* Effect.result(mutation.journalGuard.read);
+
+              if (status._tag === "Success" || status.failure._tag !== "CommitPending")
+                return yield* unavailable();
+            }
+            yield* database.$client.batch(statements).pipe(
+              Effect.catchCause((cause) =>
+                Effect.failCause(
+                  Cause.map(cause, (error) =>
+                    everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error,
+                  ),
+                ),
+              ),
+              translateFailure,
+            );
+
+            return value;
+          }),
+        { mode: "batch" },
+      ).pipe(Effect.provideService(LifecycleHooks, hooks));
+
+      return result.value;
+    }),
+  );
+}
+
+export interface D1ProtectedProofMutation {
+  /** Conditional statements compiled by the owning method adapter. */
+  readonly statements: ReadonlyArray<Statement<any>>;
+  /** Postcondition proving the protected CAS and its invalidations all applied. */
+  readonly appliedCondition: SQL;
+}
+
+export interface D1CompiledProofCompletion<A> {
+  readonly receipt: PreparedCommit<A>;
+  readonly statements: ReadonlyArray<Statement<any>>;
+  readonly postconditions?: ReadonlyArray<Statement<any>>;
+}
+
+/** Private compiler seam for a future same-owner D1 password-reset batch. */
+export const compileD1ProofCompletionPlan = Effect.fn("Drizzle.compileD1ProofCompletionPlan")(
+  function* <
+    Rq extends AnySQLiteTable,
+    S extends AnySQLiteTable,
+    G extends AnySQLiteTable,
+    Cn extends AnySQLiteTable,
+    Rs extends AnySQLiteTable,
+    Aev extends AnySQLiteTable,
+    F extends AnySQLiteTable,
+    C extends AnySQLiteTable,
+    Sub extends AnySQLiteTable,
+    I extends AnySQLiteTable,
+    Cr extends AnySQLiteTable,
+    NativeId,
+    A,
+  >(
+    mapping: D1ProofPersistenceMapping<Rq, S, G, Cn, Rs, Aev, F, C, Sub, I, Cr, NativeId>,
+    plan: ProofCompletionPlan,
+    protectedMutation: D1ProtectedProofMutation,
+    project: (decision: ProofCompletionDecision) => A,
+  ) {
+    const planned = yield* completionPlan<A>(
+      mapping as unknown as Mapping,
+      plan.input,
+      (decision, activeJournal) => plan.prepare(decision, activeJournal, project),
+    );
+
+    // A rejected completion has no protected mutation. For a predicted success,
+    // preserve the fresh continuation/authority guard first, then prove the
+    // method CAS before consuming the continuation and inserting its marker.
+    if (planned.statements.length === 0) return planned;
+    const [freshGuard, ...completionStatements] = planned.statements;
+    const marker = `effect-auth-proof-guard:protected:${plan.input.continuationId}`;
+
+    return {
+      receipt: planned.receipt,
+      statements: [
+        freshGuard!,
+        ...protectedMutation.statements,
+        yield* assertion(protectedMutation.appliedCondition, marker),
+        ...completionStatements,
+      ],
+      postconditions: [
+        yield* assertion(protectedMutation.appliedCondition, marker),
+        ...(planned.postconditions ?? []),
+      ],
+    };
+  },
+);
+
+export type AnyD1ProofMapping = ProofPersistenceMapping<
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  unknown
+>;
+
+const translateFailure = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, ProofUnavailable, R> =>
+  reportPersistenceFailure(
+    effect,
+    (error) => Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error),
+  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+
+const translateIssueFailure = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, ProofUnavailable | ProofRequestConflict, R> =>
+  reportPersistenceFailure(
+    effect,
+    (error) =>
+      Schema.is(ProofUnavailable)(error) ||
+      Schema.is(ProofRequestConflict)(error) ||
+      Schema.is(HookConfigurationError)(error),
+  ).pipe(
+    Effect.catchCause((cause) =>
+      Effect.failCause(
+        Cause.map(cause, (error) =>
+          Schema.is(ProofRequestConflict)(error) ? error : unavailable(),
+        ),
+      ),
+    ),
+  );
+
+const executeStandalone = <A, E, R>(
+  plan: Effect.Effect<Planned<A>, E, R>,
+  retries = 2,
+): Effect.Effect<
+  A,
+  | E
+  | import("@yielded/auth/Hooks").HookConfigurationError
+  | import("effect/unstable/sql/SqlError").SqlError,
+  Exclude<R, CurrentCommitJournal> | CurrentD1PlanningDatabase | LifecycleHooks
+> =>
+  Effect.suspend(() => {
+    let retryable: ((cause: unknown) => boolean) | undefined;
+
+    const once = coordinateCommit(
+      () =>
+        Effect.gen(function* () {
+          const database = yield* CurrentD1PlanningDatabase;
+          const planned = yield* plan;
+
+          retryable = planned.retryable;
+          yield* database.$client.batch(planned.statements);
+
+          return planned.receipt;
+        }),
+      { mode: "batch" },
+    ).pipe(Effect.map((result) => result.value));
+
+    return once.pipe(
+      Effect.catchCause((cause) =>
+        retries > 0 && everyFailureMatches(cause, retryable)
+          ? executeStandalone(plan, retries - 1)
+          : Effect.failCause(cause),
+      ),
+    );
+  });