Module storage 

Connection-only write-plane storage, schema upgrades, and DDL safety guards.

Structs

ProducerCensus

How many distinct producers hold durable watermark state — the growth signal design 306 §4 names as the mitigation for the one contract it cannot enforce server-side.

Constants

PRODUCER_OFFSETS_TABLE

The foreign-write dedup watermark (design 306): one row per producer, overwritten in place.

Functions

ddl_only_violation_message

Enrich the DDL-only guard’s rejection when a DROP TABLE caused SQLite’s implicit foreign-key delete.

ensure_data_migrations_table

Create the captured apply-once data-migration journal.

ensure_log_meta_table

Create the host-local outcome-floor table.

ensure_master_migrations_table

Create the producer/master shape of the DDL migration journal. A daemon with its existing surrogate-key shape calls ensure_migration_identity_columns instead.

ensure_master_run_id_indexes

Index the two run_id columns the master’s post-commit path seeks on — master only, and deliberately not part of ensure_sql_outcomes_table.

ensure_migration_identity_columns

Add the common identity columns to either supported _rindle_migrations table shape.

ensure_producer_offsets_table

Create the foreign-write producer watermark table.

ensure_sql_outcome_identity_column

Add exact-request and resolved-cursor columns to a legacy outcome cache.

ensure_sql_outcomes_table

Create the exact public SQL outcome cache in its current shape.

ensure_writeplane_tables

Create every storage table owned by the producer/master write plane.

pre_ddl_table_names

Snapshot the non-internal table names before a DDL run.

producer_offsets_ddl

The CREATE TABLE for the foreign-write producer watermark. Shared verbatim by every host that mints it — the connection-only bootstrap here, rindled’s cluster DDL, the write-master’s open batch, and the restore’s runtime initialization — so the four cannot drift into two shapes.

producer_offsets_upsert_sql

The producer watermark’s upsert, shared with the capture-aware writers that must run it through their own exec (the row is replicated data, not connection-local bookkeeping) rather than through upsert_producer_seq.

read_lmid

Read the durable last mutation id for client_id, or zero when absent.

read_producer_seq

Read the durable last sequence a producer wrote, or zero when the producer is new.

refuse_broken_foreign_keys

Refuse a DDL run that leaves a dangling foreign key or recreates a referenced table without its referenced key.

statement_is_drop_table

Whether sql is a comment-tolerant DROP TABLE statement.

upsert_lmid

Upsert the durable last mutation id inside the caller’s open transaction.

upsert_producer_seq

Upsert the producer watermark inside the caller’s open transaction. MUST run in the same transaction as the effects it deduplicates, so a crash can never commit an effect without its receipt (design 306 §3.2).

validate_public_ddl_poststate

Validate the producer-side post-state shared by standalone deploy migrations and public SQL DDL. Call this from the schema transaction’s final validation hook, before any outcome/journal tail and before COMMIT, so every refusal rolls the schema and its host bookkeeping back as one unit.