[marcus-pousette]

Auth-checked local writes held a savepoint across await authorizeLocalOps, as separate runner calls. Anything else on the same connection could land inside it: another crossTab tab, sync appends, or a second auth write. On main:

• a denied write rolls back writes that already resolved
• a second concurrent auth write fails with no such savepoint after its op committed
• reads during authorization see the op before it is authorized

Fix

The op is authorized before anything is written, and no transaction spans the await.

• treecrdt_local_insert/move/delete/payload take an optional trailing token. With a token, the function writes only if minting again gives the same op with no op applied in between (blake3 of the op JSON and the materialized head_seq). Otherwise it writes nothing and returns the op with a new token and outcome: null. Passing NULL only mints.
• createTreecrdtSqliteWriter mints, authorizes, then writes if unchanged, re-authorizing at most 4 times. Auth writes from the same replica take turns, and byte params are copied up front.

API change: only the SQL functions change; the adapter and extension must update together. LocalWriteOptions is unchanged, but authorizeLocalOps now sees the tree without the op, as peers and postgres-napi do, and may run more than once per write. A move from outside a scoped subtree is now denied locally, matching peers.

This is the mechanism from the legacy drafts #193 and #195, without proof storage. Storing op auth atomically with the op is still #256: rows the auth session writes during authorization are not tied to the commit.

Tests

These fail on main:

• wa-sqlite node: the pending op stays hidden; a denied write keeps concurrent writes; concurrent auth writes take turns and both commit
• browser e2e: a denied write in one crossTab tab keeps another tab's write
• sqlite-node with a real SQLite auth session: a scoped move is checked at its source

New coverage for the token check (including a late remote op that leaves the op unchanged), the retry cap, and the payload copy.