Function execute_public_migration 

pub fn execute_public_migration(
    backend: &mut impl OneShotBackend,
    id: &str,
    checksum: &str,
    statements: &[String],
) -> Result<PublicMigrateAck, WritePlaneError>

Execute one public migration (extraction plan C6): apply a permanent, checksum-guarded migration identity, where reusing an id with identical bytes is an exact replay and reusing it for different DDL is refused instead of silently accepting schema drift.

Public and deploy/daemon migrations intentionally share one durable tag namespace: a SQL client adopting an existing Rindle deployment must see the already-applied tag rather than minting a duplicate DDL frame under a route-specific prefix. That interplay is why OneShotBackend::with_migration_barrier’s exclusion domain covers deploy migrations too.

The flow splits exactly where the host’s critical section begins. OUTSIDE the barrier, pure work: the empty-id/checksum refusal, per-slot wire validation and script splitting, classification with the public DDL-only refusal, and the canonical content checksum. INSIDE one barrier invocation, the closure over the MigrationSection ops: the data-collision probe, opaque-checksum + statement-vector matching (legacy content-checksum derivation included), the adopt-opaque decision, exact-cursor resolution over the C4 spine wired to the section’s scan, and the fresh apply. Replay identity is the durable tag itself — no idempotency key, no clock, and no lost-race legs: same-tag racers serialize on the barrier.