open

Opens the database behind driver with the storage key from keyProvider. Fails closed with StorageEncryptionException:

• The database has a bound key: StorageKeyProvider.key must return it (else StorageEncryptionException.KeyUnavailable) and it must be the right key (else StorageEncryptionException.AuthenticationFailed). No key is created. While a storage key rotation is migrating, the retiring key is required and checked the same way (docs/storage-key-rotation.md). Opening never advances or rolls back a rotation.

• A new database: StorageKeyProvider.loadOrCreateKey supplies the key, which is bound to the database.

• A database upgraded from schema version 5 or older still holds plaintext: the key comes from StorageKeyProvider.loadOrCreateKey and every sensitive record is encrypted in one transaction before this returns. If anything fails, the database stays as it was and the next open tries again.

• Downgrade protection (S1, finding F7; docs/storage-encryption.md): a database is migrated from plaintext only if it still looks exactly like one from before record encryption (no key, key check or rotation state, no record type added after milestone 8) and either the provider holds no key yet (genuine first migration) or the database carries a migration intent sealed with the provider's key (an interrupted first migration). Anything else, in particular an encrypted database whose format was set back to 0, fails with StorageEncryptionException.DowngradeRejected and nothing is encrypted.

The provider is called outside any database transaction.