One key-identity judge in _write, an unheld-removal refusal at foreign keys, a load that carries unregistered records
instead of refusing, and a load that refuses one key in two stores. The single-file store's commit guard stays the disk judge.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>