the Durable Object's own SQL
the live heap, written in place
from/limit slice the chunk sequence so a restore divides across alarm firings;
chunkDigests is the sha256 of each stored chunk from a verified root, and each chunk is
checked against it as it is read, so rows rewritten after the verify cannot land
Applies a stored snapshot directly into a live heap, one chunk at a time.
Nothing larger than one chunk is allocated: the isolate memory ceiling is non-monotone (128 MiB failed where 160 MiB succeeded), so materialising the image passes repeatedly, then fails in production. Each digest is checked before its chunk is applied.
DecompressionStreamis not used (15.7 ms per MB of output on the edge); fflate inflates synchronously.