Binary DB v0: Identity, Recovery, and Conversion

The final schema chapter connects physical records to public identity, crash recovery, and admitted conversion. It also states hard capacity limits, explicitly excluded domains and files, and the compatibility boundary for layout v0.

Public Identity And Compact Handles#

• Task identity is authority-scoped and derived from dense record ordinal.
• Change uses C-01..C-64 for ordinal 0..63.
• A published Local Change's Remote identity is the owning Local Task's published Remote Task index paired with the stored Remote Change ordinal; it is not a global Remote Change index.
• Land uses L-01..L-64 for ordinal 0..63 within its owning Change; its full public identity includes the Task and Change identity.
• Patchset uses P-01..P-64 for ordinal 0..63 within its owning Change; its full public identity includes the Task and Change identity.
• Attestation uses A-01..A-64 for ordinal 0..63.
• Review uses R-01..R-64 for ordinal 0..63 within its owning Patchset; its full public identity includes the Task, Change, and Patchset identity.
• Policy Decision uses K-01..K-64 for ordinal 0..63 within its owning Patchset; its full public identity includes the Task, Change, and Patchset identity.
• Waiver uses W-01..W-64 for ordinal 0..63.
• Task Snapshot Link uses S-01..S-256 for ordinal 0..255.
• Stash identity is derived from stash_index, for example STH-000001.
• AIT Tag public identity is its name; stable internal references use the dense tag_index and never require a textual Tag ID.
• Canonical Snapshot identity is SNP- plus a 48-bit hex suffix.
• Tree and Blob public suffixes are 80 bits.
• Tree Pack and Object Pack public suffixes are 48 bits.
• Git repository fingerprints are 96-bit suffixes, import/export generation and operation identities are 64-bit suffixes, Plan hashes are 96-bit suffixes, and Git mapping identities are derived 80-bit GIM-* suffixes.

Every eight-bit workflow handle uses the following bit model within its declared owning scope:

bits 0..5 ordinal 0..63 within (owning identity, kind)
bit 6 tombstone/deleted
bit 7 indirect/extended

Change, Attestation, and Waiver retain their declared Task-scoped allocation. Patchset and Land allocate within their owning Change. Review and Policy Decision allocate within their owning Patchset. Therefore a Patchset or Land ordinal may repeat across different Changes in one Task, and a Review or Policy ordinal may repeat across different Patchsets. The complete owning identity disambiguates every repeated numeric suffix.

Layout v0 assigns no extended-handle payload format. A writer that would exceed a declared ordinal range must fail before writing; it must not interpret the indirect bit as permission to invent one.

Multi-File Write And Recovery Boundary#

Layout v0 defines no workflow wal.bin, journal.bin, transaction-ID field, per-record WAL sequence, or Binary DB activation generation token. A GitGenerationRecord identifies imported Git source state or a deterministic export plan; it is not a database transaction token. The writer transaction layer owns single-writer/per-task locking, dependency-first writes, ordered fsync, append-only commit points, and repairable head/index projections.

The appended detail record is the domain commit point for Patchset, Review, Policy Decision, Waiver, Attestation, and Land creation. Associated task, change, or patchset head records are repairable projections. Land status mutation uses the status-last protocol: terminal/reset data is written and fsynced before status_kind is written and fsynced as the commit marker.

tree_entry_range.bin is the sole ordinal-aligned fixed dependency, never a payload or rebuildable index. Creation writes and fsyncs each required range row before its owning Tree commit record. At a stable activation boundary its count equals the Tree owner-file count; recovery may discard only an uncommitted trailing dependency and must fail closed on a missing committed dependency or an interior ordinal mismatch. Task close mutation occurs entirely inside task.bin; Change archive/reopen mutation occurs entirely inside change.bin. Land creation appends and durably commits one complete land.bin record. Each mutation replaces or appends its one complete fixed record. The transaction layer restores the before-image if an overwrite does not reach its commit point; no ordering between fields inside one record is observable.

Recovery validates every header and record alignment, walks committed detail records, repairs latest_*_index_plus1, counts and next ordinals, recomputes the latest/current Patchset indexes, validates each Remote Change selected Patchset pointer by ownership and liveness without reconstructing it from Patchset metadata, ignores orphan dependency/payload rows, and rejects duplicate ordinals inside each declared identity scope as corruption. The Task indexes for Patchset, Review, Policy Decision, and Land rebuild physical inventory order only. Their owner indexes rebuild ordinal chains and next-ordinal allocation: Change for Patchset and Land, Patchset for Review and Policy Decision. Equal numeric ordinals in distinct owner scopes are valid.

Snapshot creation appends every validated parent edge and fsyncs the edge file before appending the child Snapshot record with bit 4 set. The Snapshot record is the commit point; an interrupted write may leave only orphan edges, which recovery ignores. Recovery also verifies that a remote-head history boundary has no local parents and that a zero-parent non-boundary Snapshot is a true root. A Tag payload is durable before a Tag record append/update.

Tree creation appends normalized Tree-entry rows and the matching fixed range before the Tree commit record. Recovery validates normalized ranges against the owning Tree and validates every physical pack ordinal according to the Tree Pack's sparse-ordinal bit before admitting the pack projection.

Git repository, generation, identity, parent, file, and typed payload rows are dependencies. The immutable Git commit/ref/Tag mapping record is its mapping commit point and is fsynced before its rebuildable index candidates. Recovery ignores dependency rows not reachable from a committed mapping, validates all mapping ranges and numeric AIT references, then rebuilds Git indexes. A Git operation checkpoint writes its cursors and time before writing and fsyncing checkpoint_meta; replay of a completed checkpoint is a no-op reconstructed from immutable mappings.

Bin-to-Bin Conversion Acceptance#

A converter must classify every source field as an exact fixed-field/bit mapping, the one admitted Patchset summary payload, a schema-defined derivation, or an explicitly non-authoritative projection. A field outside those classes fails closed; it must not be copied into a generic payload.

An offline converter writes a separate target generation and may assign new dense physical target record indexes. It preserves source Task order and, for every other authoritative file family, preserves validated source record order among emitted rows. Before writing records it builds a complete source-index to target-index map for every admitted family. It then rewrites every owning index, *_index, *_index_plus1, previous-record link, selected/latest pointer, fixed range start, ordinal-aligned side row, and recalculated payload offset through those maps. Rebuildable .idx files are generated from the completed target authority rather than copied.

Physical renumbering never changes change_ordinal, patch_ordinal, attest_ordinal, review_ordinal, policy_ordinal, waiver_ordinal, land_ordinal, or snapshot_ordinal; their public handles retain the exact source ordinal in each declared scope. Patchset ordinals are preserved within Change, Review ordinals within Patchset, Policy Decision ordinals within Patchset, and Land ordinals within Change. Repetition across different owning Changes or Patchsets is valid and is not renumbered. For Policy Decision, an admitted legacy .../P-##/POL-## identity maps the exact POL-## suffix to Patchset-scoped K-##.

Any duplicate within one declared owner scope, more than 64 rows of one kind in that owner scope, ambiguous ownership, or source ID/fixed-sequence disagreement fails closed. Task Patchset, Review, Policy, and Land inventory links are rebuilt in emitted physical record order. Change Patchset and Land links, and Patchset Review and Policy links, are rebuilt by exact ordinal. Any source reference without exactly one target map entry fails closed. Source files remain immutable, and the fully validated target generation is activated atomically. No old-to-new mapping bin or payload is added.

The only admitted supplied diff_stats disagreement is an explicitly selected offline legacy stale-zero gate. The gate uses an exact configured allowlist of complete Patchset identities; partial, ordinal-only, or wildcard matching is forbidden.

For each named Patchset, the supplied value must be the complete object with files_added = 0, files_changed = 0, files_deleted = 0, and files_modified = 0, plus exactly empty paths.added, paths.deleted, and paths.modified arrays. Its canonical base and revision Snapshot references must both resolve to present, live v0 Snapshot authority, and exact comparison of their complete Trees must succeed and produce a non-empty difference. The converter then uses that recomputed difference only to validate acceptance; the target stores no diff-stat value.

Without the explicit gate, every disagreement fails closed. Even with the gate, an unlisted or partially matched identity, a missing/extra/renamed diff_stats member, a non-zero supplied count, a non-empty supplied path array, a zero recomputed difference, a missing/tombstoned/malformed Snapshot, an unreadable or malformed Tree, or any other disagreement fails closed. No wildcard, ordinal-only match, fallback Snapshot, reconstructed source value, new field, bit, bin, index, payload, record-width change, or layout_id change is admitted.

The only admitted alternate source Task status spelling is an explicitly selected offline gate bound to an exact repository key and complete locked source-manifest digest. The server orchestrator verifies both values before forwarding the gate. Under that gate only, source status = "canceled" maps to the existing TaskRecord.task_meta bit 7, identically to source status = "abandoned". The legacy payload has no Task close-time field, so a converted terminal Task retains closed_at_s = 0 under the existing unknown historical close-time rule.

Without the explicit gate, source status = "canceled" fails closed. Even with it, another manifest, another repository key, a partial or case-folded spelling, or any other unknown Task status fails closed. The gate does not change the conversion report and adds no field, bit, bin, index, payload, record-width change, reconstruction marker, inferred timestamp, or layout_id change.

The first reference-omission exception is an explicitly selected offline legacy salvage mode for a Patchset whose canonical revision_snapshot_id is absent from the same locked source generation's content Snapshot authority. Without that explicit mode the missing reference fails closed. With it, the converter emits no row for that Patchset and emits no Review, Policy Decision or Check, Attestation, or Land that depends on the omitted Patchset. If the omitted Patchset is the owning Change's authoritative current/latest or selected Patchset, the converter emits no row for that Change or any of its Patchsets and dependents; it never chooses a fallback current or selected Patchset. The owning Task remains present.

This exception does not admit an absent or sentinel Patchset Snapshot index, does not fabricate or tombstone a Snapshot, and does not excuse a missing base Snapshot, a malformed Snapshot ID, a tombstoned or corrupt present Snapshot, or any unrelated missing authority. Target Change, Patchset, Review, Policy, Attestation, Land, and Actor rows retain source order among emitted rows, and every surviving fixed reference, chain head, count, selected/latest pointer, ordinal-aligned side row, and rebuildable index is densely remapped. The conversion report must enumerate the omitted Change and Patchset identities and the emitted/omitted dependent-row counts; omission is never silent and never changes source bytes.

The second omission exception is a separately selected named legacy salvage for one exact configured Change identity. That source Change claims landed but has no surviving successful Land and no complete accepted-Patchset/Snapshot closure from which one can be reconstructed. Without the exact named option, conversion fails closed. With it, the converter omits that Change, every Patchset and dependent row owned by it, and every Land row that references it; it does not fabricate a Land, choose a fallback Patchset, infer a timestamp, or affect any other Change. The report must name the selected Change and all dependent-row counts. No wildcard, status-based, or implicit omission is permitted.

The admitted legacy landed-Change normalization is narrower than the omission exceptions above. A Change with current_patchset_number = 0 rebuilds latest/current only from its greatest surviving patch_ordinal and only when its explicit selected pointer identifies that same Patchset. Exact Land rows remain authoritative even when the duplicated Change status or landed_at projection differs. Every attempt is preserved, any successful attempt makes the Change lifecycle landed, and the greatest successful land_ordinal supplies landed state even when a later attempt did not succeed. The current mutable selected pointer need not equal any historical Land's accepted Patchset. These rules discard only duplicated projections, never an authoritative row, and add no field, bit, bin, payload, fallback Patchset, or inferred timestamp.

Before conversion, a server orchestrator may copy source authorities into an isolated frozen generation without acquiring or creating source locks. The freeze operation captures every current authority data file before copying, copies those files rather than trusting the live generation's possibly stale file list, captures the complete source inventory again, and requires exact before/after/copy equality by relative_path, byte_size, and complete SHA-256. It also requires the source registry manifest's exact bytes to remain unchanged across the operation. Any drift fails closed and leaves no published target. The fresh frozen generation uses the existing manifest schema with file lists and fingerprints for exactly those copied bytes. Repository manifest copies and operational lock files are excluded from the data-file list. Conversion accepts that frozen generation only when every declared file matches and no undeclared authority data file exists.

No source lock file is required or created in either the selected source or the frozen copy. The orchestrator may create a missing legacy .bin or .idx as a header-only file only when the selected source manifest explicitly proves that exact file or its entire declared family has zero records, or when the authority class does not contain that whole optional family and no surviving source record can reference it. A partially present family, a non-zero manifest count, an unresolved reference, or missing proof fails closed. Header synthesis is never performed in the selected source root, and the conversion report enumerates every staged header-only file.

The newly admitted missing-time zero cases are limited to RemoteTaskRecord.updated_at_s, RemoteTaskRecord.fetched_at_s, RemoteChangeRecord.fetched_at_s, an archived RemoteChangeRecord.archived_at_s, and ActorRecord.created_at_s/last_seen_at_s. They apply only when the selected legacy source format demonstrably has no corresponding time field. The previously enumerated legacy Task closed_at_s and first successful Land submitted_at_s exceptions remain unchanged. No other missing or invalid time becomes zero, and no zero authorizes a synthetic time or reconstruction bit.

Source identity_source is an annotation, not stored identity. It may be omitted only when absent or when it agrees with the canonical identity derived from the selected authority root and numeric record relationship. A non-default, conflicting, or unresolvable value fails closed. Source published_remote_name is likewise not stored. It may be omitted only when absent/empty or exactly equal to the one remote authority explicitly selected for the conversion; a different or ambiguous remote name fails closed.

A source Snapshot with no parents becomes a true v0 root only when the source authority proves it had no parents. A proven-empty authority therefore remains empty, and two or more independently proven roots remain separate components of one DAG forest. Every surviving non-boundary Snapshot must reach one such root. If source evidence instead shows ancestry whose parents were not imported, the converter sets remote_head_history_boundary; missing evidence that cannot distinguish the two cases fails closed. No converter infers a root or history boundary from position, record order, component size, Line membership, or current-head status alone.

Textual public IDs are parsed only through their declared compact ordinal or hash rules and then validated against the owning fixed records. Source cache keys, derived labels/messages, duplicated names, diff statistics, and result projections may be discarded only under the explicit derivation rules in this authority. Unknown enum text, overflow, disagreement, missing authority, or ambiguous resolution aborts conversion before activation.

Capacity And Expansion#

Writers preflight representable counts and narrow fields before any partial append:

current_count  = (file_size - BIN_HEADER_SIZE) / record_size
projected_count = current_count + records_to_append

Overlong u8/u16 text is an input validation failure, not permission to widen layout v0. Except for the explicitly enumerated Task closed_at_s tail, Change lifecycle tail, Land target-Line tail, and Patchset summary/Worker-Job-locator/time-width corrections, the enumerated Git mapping time-field removals, and the separately scoped operational families, a genuine record/index capacity expansion requires an explicit migration to a new layout_id, converts the complete dependent reference closure, writes separate new files, validates them, and performs an atomic swap. The bounded operational conversions relocate and narrow the Worker Job record, retire its global identity families, add only the two declared local indexes, and append only the declared Patchset locator; the earlier fixed-time correction narrowed only its named timestamp-bearing records and ready index. The u64-second conversion subsequently widens only the complete enumerated normal time-field set. Neither conversion permits altering another field or file. Mixed record widths in one file are forbidden even though the persisted layout number remains one.

Snapshot parent count is capped at 1,024 even though parent_count and parent_ordinal are u16. AIT Tag payloads are capped by u16 payload_len. Git payload and single-field length values are capped by u32; Git SHA-1, fingerprint, generation, operation, and Plan-hash byte arrays have the exact fixed widths declared above. Except for the explicitly removed AIT-generated mapping timestamps, narrowing, truncation, hash-prefix substitution, or accepting SHA-256 Git Object IDs in the 20-byte fields is forbidden.

The one remaining ordinal-aligned side-file family preflights its owner count and all u32 indexes before writing. It is a layout-1 schema extension, not permission to widen an existing record or move its fields into payload.

The Task tail is a one-time layout-1 conversion, not a general widening precedent. Conversion must explicitly select the old local 40-byte or remote 36-byte source layout, rewrite the complete file to the corrected local 44-byte or remote 40-byte layout, and activate only after full validation.

The Change tail is likewise a one-time layout-1 conversion. Conversion of the immediately preceding split representation must explicitly select the 44-byte Change source layout and its aligned 8-byte lifecycle source, rewrite and validate the complete 52-byte change.bin, omit change_lifecycle.bin from the new generation, and activate only after every base-Line, archive-time, owner, and Snapshot relationship validates.

The Land tail is likewise a one-time layout-1 conversion. Conversion of the immediately preceding split representation must explicitly select the 32-byte Local or 36-byte Server Land source layout and its aligned 4-byte target-Line source, rewrite and validate the complete 36-byte Local or 40-byte Server land.bin, omit land_target_line.bin from the new generation, and activate only after every target-Line, owner, Patchset where present, Snapshot, ordinal-chain, status, and timestamp relationship validates.

The Patchset summary locator is likewise a one-time layout-1 conversion. Conversion of a 47-byte source must first form and validate the declared 57-byte prefix plus patchset_summary_payload.bin. The later Worker-Job-locator correction then explicitly selects that exact 57-byte prefix, appends ci_worker_job_index_plus1, writes the complete 61-byte patchset.bin in a separate generation, and atomically activates only after every summary range, same-Repository Worker Job target, and Patchset relationship validates.

The repository-local Worker Job identity change is also a one-time layout-1 conversion. Conversion must explicitly select the declared 100-byte source record when present, remove its u64 job_id, rewrite and validate the complete 92-byte worker_job.bin, replace the superseded global Job sequence/index files with the two declared Repository-local indexes, and activate only after every permanent local index, typed payload, Patchset locator, state, and timestamp validates.

The later Worker Job fixed-record change is another one-time layout-1 conversion. Conversion must explicitly select that exact 92-byte source record and its four typed payload families, resolve and validate their complete closure, write the declared 88-byte worker_job.bin plus worker_job_input_payload.bin in a separate inactive generation, and omit worker_job_request_payload.bin, worker_job_result_payload.bin, worker_job_error_payload.bin, and worker_job_lease_owner_payload.bin from the target. Activation occurs only after every Job kind, fixed reference, normalized input, outcome, related Job, error, lease hash, Patchset locator, state, and timestamp validates.

The no-payload and runtime-lease change is another one-time layout-1 conversion. Conversion must explicitly select that exact 88-byte source record and worker_job_input_payload.bin, resolve and validate their complete closure, write the declared 60-byte worker_job.bin in a separate inactive generation, and omit worker_job_input_payload.bin from the target. It discards the source input ranges and lease_owner_hash only after the fixed references, source payload contract, and quiesced no-running-Job gate validate. Conversion writes no runtime lease replica. Activation occurs only after every Job kind, fixed reference, outcome, related Job, error, Patchset locator, state, and timestamp validates.

The later Worker Job direct-reference change is another one-time layout-1 conversion. Conversion explicitly selects that exact 60-byte source record and writes the declared 52-byte worker_job.bin. For land.process, the old subject Land must resolve to an exact main, direct same-Repository Server Land and its accepted Patchset becomes patchset_index_plus1. For main-seed.refresh, the old subject Patchset and auxiliary prior Snapshot become the two named fields; its old context Line must be exact main and is discarded. Patchset CI, aggregation, and Policy subjects become patchset_index_plus1; a repo.ci subject becomes snapshot_index_plus1 after its old context Line exact-validates as main. Content maintenance and Repository reconciliation require all three old domain references to be zero. The old related-Job reference exact-validates the attached or superseded source outcome when present and is then discarded. Activation occurs only after every new named reference, Job kind, outcome, error, Patchset locator, state, and timestamp validates. This historical rewrite does not make a native v0 enqueue depend on a pre-existing Land.

The fixed-time change is another one-time layout-1 conversion. It selects the exact 33-byte Repository, 52-byte Worker Job, 12-byte ready-index, and 61-byte Patchset predecessors and rewrites the declared 25-byte, 36-byte, eight-byte, and 57-byte targets. Admitted RFC 3339 operational timestamps are normalized and deliberately reduced to whole seconds exactly as declared above. Existing Patchset ci_completed_at_s values must fit u32; an overflow fails before any target write rather than truncating. The Patchset rewrite preserves its first 28 bytes and logical CI, summary, and Job-locator values while shifting the tail to the corrected offsets.

The same correction selects exact 100-byte commit-mapping, 84-byte ref-mapping, and 52-byte Tag-mapping predecessors and writes their declared 92-byte, 76-byte, and 44-byte forms without recorded_at_unix_nanos. Before discarding that AIT-generated value, conversion verifies that physical record order reproduces every source latest-record selection; disagreement fails closed. The signed Git identity timestamp and timezone remain byte-for-byte semantic source data. Activation occurs only after exact record divisibility, every timestamp range and ordering rule, all indexes, and the full dependent reference closure validate in an inactive generation.

The u64-second change is another one-time layout-1 conversion. Its only admitted predecessor selector is exact u32-time-v0; selecting layout_id = 1 alone or guessing from file divisibility is insufficient. The selector denotes the complete immediately preceding active v0 representation whose normal *_at_s fields and widths are enumerated in the correction table above. A missing selector, another selector, an undeclared file, a source file that is not exactly aligned to its named predecessor width, or a mixed-width file fails before any target publication.

Conversion freezes or read-locks the complete source authority and records its full file inventory and fingerprints. For every fixed record it copies all bytes before, between, and after the declared time fields in exact declaration order and zero-extends each little-endian u32 second value to the corresponding little-endian u64. It does not parse, round, reorder, infer, or replace a timestamp. It copies every unaffected payload and object byte exactly. GitIdentityRecord.timestamp_s is not converted. Worker worker_ready.idx is rebuilt from the converted authoritative Job records; all other rebuildable indexes are either rebuilt from converted authority or exact-validated against the unchanged identity and ordinal keys.

The converter writes a complete inactive generation, validates every corrected record with the active v0 codecs, validates the complete cross-file reference and content closure, and compares the still-locked source fingerprint with its captured precondition. Activation requires compatible readers and writers, rechecks that source precondition, and atomically selects only the complete generation while retaining a recoverable previous generation or direct authority. A conversion failure or post-freeze source change leaves the active authority untouched. An active file never mixes the predecessor and corrected record widths, and no runtime may write either representation while conversion or activation holds the authority lock.

Excluded Domains And Files#

Layout v0 does not define:

• wal.bin, journal.bin, or per-domain transaction fields; the declared Git import/export content generation is the only v0 generation-ID exception;
• Local Patchset files, a selected-Patchset cursor in Local Change records, or selected-for-landing authority in immutable Patchset metadata;
• generic ci.bin or job.bin; operational jobs use only the typed Repository-scoped worker_job.bin family, while compact Patchset CI evidence and its selected local Job locator remain in the Patchset record;
• generic patchset_payload.bin, attest_payload.bin, policy_payload.bin, or land_payload.bin; the narrowly typed patchset_summary_payload.bin is the sole Patchset exception;
• Task close time in any payload or side file; the owning Task record's closed_at_s tail field is its sole authority;
• Change base-Line/archive state in any payload or side file; the owning Change record's fixed tail fields are their sole authority;
• Land target-Line identity or normalized Tree-entry ranges in any payload file; the owning Land record tail and fixed Tree range side record declared above are their sole authorities;
• server Stash files;
• a conversion-only Actor file or generic Actor payload; conversion uses the existing actor.bin and actor_payload.bin authority;
• a shared string pool;
• object_pack_data.bin; object bytes remain in their pack container;
• a repository-wide current-Line field in line.bin;
• a Snapshot parent-index extension in snapshot_payload.bin;
• a global published Remote Change index in LocalChangeRecord;
• Git mirror mappings, last-mirrored-head state, mirror direction/phase, operational result JSON, or a generic Git mapping payload;
• Worker Job result JSON, full error text, textual lease-owner identity, or active definitions of worker_job_request_payload.bin, worker_job_result_payload.bin, worker_job_error_payload.bin, and worker_job_lease_owner_payload.bin; worker_job_input_payload.bin, input_len, input_offset, and lease_owner_hash are also retired from active v0;
• a Worker Job Land index, target-Line index, related-Job index, or second Snapshot-reference field; active v0 stores only the named Patchset and single Snapshot references declared in worker_job.bin;
• identity_source, published_remote_name, duplicated AIT Line/Tag names in Git mappings, or a textual stored Line ID;
• a generic operational payload, server scheduler-policy/configuration payload, metrics/time-series store, tracing/log store, notification/outbox store, package artifact bytes, external-provider token vault, or temporary runtime lease replica as Binary DB authority;
• additional server-global operational domains; active operational v0 contains only the global Repository registry/name payload/namespace index and the Repository-scoped Worker Job families declared above;
• a server-global Worker Job fixed record, payload, public sequence, or scheduling/identity index; fixed Job authority and both rebuildable Job indexes remain inside each numeric Repository authority;
• retired runtime/planning sessions or Test inventory/coverage data as Binary authority; and
• a server-global numeric reference into repository workflow/content/Plan authority. Those cross-root references remain exact typed public-identity bytes as declared above.

Legacy SQLite may be read by explicit one-time import/export tooling, but it is not an authoritative runtime fallback. The landed .ait/git-interop/v1 JSON mapping/checkpoint store may likewise be read only by an explicit one-time conversion into the declared Git fixed records and typed payloads; it is not a parallel runtime authority. Optional caches and rebuildable indexes must never become the sole source of a domain relationship.