Function refuse_future_schema 

pub fn refuse_future_schema(
    conn: &Connection,
    domain: &SchemaDomain,
) -> Result<(), SqliteStoreError>

Refuse when the file’s ledger already records a version of domain newer than this binary supports, without mutating anything.

This is the crate::profile::OpenOptions::schema_preflight hook: the Primary profile runs it before its mutating pragmas so an old binary leaves a future database’s logical content unmodified. Reading the ledger of a WAL-mode file over a read-write connection may still touch its -wal/-shm sidecars (crate::profile::WriteContact::ReadOnlyWalSidecars); the main database file itself is not written. Files without a ledger (fresh or pre-ledger) pass; the pinned in-transaction re-check in apply_domain_migrations remains the migration-time authority.