Add sanity checks to history entry construction (#1156)

* Add sanity checks to history entry construction

* Add more missing setClientId() calls and delete scrap tool

* Merge branch 'master' into synthetic-requestedby

* Set more client IDs

* Merge branch 'master' into synthetic-requestedby

common/src/testing/java/google/registry/testing/FakeClock.java

@@ -22,6 +22,7 @@ import google.registry.util.Clock;
 import java.util.concurrent.atomic.AtomicLong;
 import javax.annotation.concurrent.ThreadSafe;
 import org.joda.time.DateTime;
+import org.joda.time.Duration;
 import org.joda.time.ReadableDuration;
 import org.joda.time.ReadableInstant;
 
@@ -81,4 +82,14 @@ public final class FakeClock implements Clock {
   public void setTo(ReadableInstant time) {
     currentTimeMillis.set(time.getMillis());
   }
+
+  /** Invokes {@link #setAutoIncrementStep} with one millisecond-step. */
+  public FakeClock setAutoIncrementByOneMilli() {
+    return setAutoIncrementStep(Duration.millis(1));
+  }
+
+  /** Disables the auto-increment mode. */
+  public FakeClock disableAutoIncrement() {
+    return setAutoIncrementStep(Duration.ZERO);
+  }
 }

core/src/main/java/google/registry/backup/BackupUtils.java

@@ -14,7 +14,7 @@
 
 package google.registry.backup;
 
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.api.datastore.EntityTranslator;
 import com.google.common.collect.AbstractIterator;
@@ -45,7 +45,7 @@ public class BackupUtils {
    * {@link OutputStream} in delimited protocol buffer format.
    */
   static void serializeEntity(ImmutableObject entity, OutputStream stream) throws IOException {
-    EntityTranslator.convertToPb(ofy().save().toEntity(entity)).writeDelimitedTo(stream);
+    EntityTranslator.convertToPb(auditedOfy().save().toEntity(entity)).writeDelimitedTo(stream);
   }
 
   /**
@@ -61,11 +61,12 @@ public class BackupUtils {
       @Override
       protected ImmutableObject computeNext() {
         EntityProto proto = new EntityProto();
-        if (proto.parseDelimitedFrom(input)) {  // False means end of stream; other errors throw.
-          return ofy().load().fromEntity(EntityTranslator.createFromPb(proto));
+        if (proto.parseDelimitedFrom(input)) { // False means end of stream; other errors throw.
+          return auditedOfy().load().fromEntity(EntityTranslator.createFromPb(proto));
         }
         return endOfData();
-      }};
+      }
+    };
   }
 
   public static ImmutableList<ImmutableObject> deserializeEntities(byte[] bytes) {

core/src/main/java/google/registry/backup/CommitLogCheckpointAction.java

@@ -18,7 +18,7 @@ import static com.google.appengine.api.taskqueue.QueueFactory.getQueue;
 import static com.google.appengine.api.taskqueue.TaskOptions.Builder.withUrl;
 import static google.registry.backup.ExportCommitLogDiffAction.LOWER_CHECKPOINT_TIME_PARAM;
 import static google.registry.backup.ExportCommitLogDiffAction.UPPER_CHECKPOINT_TIME_PARAM;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;
 
@@ -64,8 +64,7 @@ public final class CommitLogCheckpointAction implements Runnable {
     final CommitLogCheckpoint checkpoint = strategy.computeCheckpoint();
     logger.atInfo().log(
         "Generated candidate checkpoint for time: %s", checkpoint.getCheckpointTime());
-    tm()
-        .transact(
+    tm().transact(
             () -> {
               DateTime lastWrittenTime = CommitLogCheckpointRoot.loadRoot().getLastWrittenTime();
               if (isBeforeOrAt(checkpoint.getCheckpointTime(), lastWrittenTime)) {
@@ -73,7 +72,7 @@ public final class CommitLogCheckpointAction implements Runnable {
                     "Newer checkpoint already written at time: %s", lastWrittenTime);
                 return;
               }
-              ofy()
+              auditedOfy()
                   .saveWithoutBackup()
                   .entities(
                       checkpoint, CommitLogCheckpointRoot.create(checkpoint.getCheckpointTime()));

core/src/main/java/google/registry/backup/DeleteOldCommitLogsAction.java

@@ -17,7 +17,7 @@ package google.registry.backup;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
 import static google.registry.mapreduce.MapreduceRunner.PARAM_DRY_RUN;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static java.lang.Boolean.FALSE;
 import static java.lang.Boolean.TRUE;
@@ -75,9 +75,17 @@ public final class DeleteOldCommitLogsAction implements Runnable {
   @Inject MapreduceRunner mrRunner;
   @Inject Response response;
   @Inject Clock clock;
-  @Inject @Config("commitLogDatastoreRetention") Duration maxAge;
-  @Inject @Parameter(PARAM_DRY_RUN) boolean isDryRun;
-  @Inject DeleteOldCommitLogsAction() {}
+
+  @Inject
+  @Config("commitLogDatastoreRetention")
+  Duration maxAge;
+
+  @Inject
+  @Parameter(PARAM_DRY_RUN)
+  boolean isDryRun;
+
+  @Inject
+  DeleteOldCommitLogsAction() {}
 
   @Override
   public void run() {
@@ -138,12 +146,12 @@ public final class DeleteOldCommitLogsAction implements Runnable {
       // If it isn't a Key<CommitLogManifest> then it should be an EppResource, which we need to
       // load to emit the revisions.
       //
-      Object object = ofy().load().key(key).now();
+      Object object = auditedOfy().load().key(key).now();
       checkNotNull(object, "Received a key to a missing object. key: %s", key);
       checkState(
           object instanceof EppResource,
           "Received a key to an object that isn't EppResource nor CommitLogManifest."
-          + " Key: %s object type: %s",
+              + " Key: %s object type: %s",
           key,
           object.getClass().getName());
 
@@ -224,8 +232,7 @@ public final class DeleteOldCommitLogsAction implements Runnable {
    * OK to delete this manifestKey. If even one source returns "false" (meaning "it's not OK to
    * delete this manifest") then it won't be deleted.
    */
-  static class DeleteOldCommitLogsReducer
-      extends Reducer<Key<CommitLogManifest>, Boolean, Void> {
+  static class DeleteOldCommitLogsReducer extends Reducer<Key<CommitLogManifest>, Boolean, Void> {
 
     private static final long serialVersionUID = -4918760187627937268L;
 
@@ -241,12 +248,12 @@ public final class DeleteOldCommitLogsAction implements Runnable {
       }
 
       public abstract Status status();
+
       public abstract int numDeleted();
 
       static DeletionResult create(Status status, int numDeleted) {
-        return
-            new AutoValue_DeleteOldCommitLogsAction_DeleteOldCommitLogsReducer_DeletionResult(
-                status, numDeleted);
+        return new AutoValue_DeleteOldCommitLogsAction_DeleteOldCommitLogsReducer_DeletionResult(
+            status, numDeleted);
       }
     }
 
@@ -257,8 +264,7 @@ public final class DeleteOldCommitLogsAction implements Runnable {
 
     @Override
     public void reduce(
-        final Key<CommitLogManifest> manifestKey,
-        ReducerInput<Boolean> canDeleteVerdicts) {
+        final Key<CommitLogManifest> manifestKey, ReducerInput<Boolean> canDeleteVerdicts) {
       ImmutableMultiset<Boolean> canDeleteMultiset = ImmutableMultiset.copyOf(canDeleteVerdicts);
       if (canDeleteMultiset.count(TRUE) > 1) {
         getContext().incrementCounter("commit log manifests incorrectly mapped multiple times");
@@ -267,47 +273,54 @@ public final class DeleteOldCommitLogsAction implements Runnable {
         getContext().incrementCounter("commit log manifests referenced multiple times");
       }
       if (canDeleteMultiset.contains(FALSE)) {
-        getContext().incrementCounter(
-            canDeleteMultiset.contains(TRUE)
-            ? "old commit log manifests still referenced"
-            : "new (or nonexistent) commit log manifests referenced");
-        getContext().incrementCounter(
-            "EPP resource revisions handled",
-            canDeleteMultiset.count(FALSE));
+        getContext()
+            .incrementCounter(
+                canDeleteMultiset.contains(TRUE)
+                    ? "old commit log manifests still referenced"
+                    : "new (or nonexistent) commit log manifests referenced");
+        getContext()
+            .incrementCounter("EPP resource revisions handled", canDeleteMultiset.count(FALSE));
         return;
       }
 
-      DeletionResult deletionResult = tm().transactNew(() -> {
-        CommitLogManifest manifest = ofy().load().key(manifestKey).now();
-        // It is possible that the same manifestKey was run twice, if a shard had to be restarted
-        // or some weird failure. If this happens, we want to exit immediately.
-        // Note that this can never happen in dryRun.
-        if (manifest == null) {
-          return DeletionResult.create(DeletionResult.Status.ALREADY_DELETED, 0);
-        }
-        // Doing a sanity check on the date. This is the only place we use the CommitLogManifest,
-        // so maybe removing this test will improve performance. However, unless it's proven that
-        // the performance boost is significant (and we've tested this enough to be sure it never
-        // happens)- the safty of "let's not delete stuff we need from prod" is more important.
-        if (manifest.getCommitTime().isAfter(deletionThreshold)) {
-          return DeletionResult.create(DeletionResult.Status.AFTER_THRESHOLD, 0);
-        }
-        Iterable<Key<CommitLogMutation>> commitLogMutationKeys = ofy().load()
-            .type(CommitLogMutation.class)
-            .ancestor(manifestKey)
-            .keys()
-            .iterable();
-        ImmutableList<Key<?>> keysToDelete = ImmutableList.<Key<?>>builder()
-            .addAll(commitLogMutationKeys)
-            .add(manifestKey)
-            .build();
-        // Normally in a dry run we would log the entities that would be deleted, but those can
-        // number in the millions so we skip the logging.
-        if (!isDryRun) {
-          ofy().deleteWithoutBackup().keys(keysToDelete);
-        }
-        return DeletionResult.create(DeletionResult.Status.SUCCESS, keysToDelete.size());
-      });
+      DeletionResult deletionResult =
+          tm().transactNew(
+                  () -> {
+                    CommitLogManifest manifest = auditedOfy().load().key(manifestKey).now();
+                    // It is possible that the same manifestKey was run twice, if a shard had to be
+                    // restarted or some weird failure. If this happens, we want to exit
+                    // immediately. Note that this can never happen in dryRun.
+                    if (manifest == null) {
+                      return DeletionResult.create(DeletionResult.Status.ALREADY_DELETED, 0);
+                    }
+                    // Doing a sanity check on the date. This is the only place we use the
+                    // CommitLogManifest, so maybe removing this test will improve performance.
+                    // However, unless it's proven that the performance boost is significant (and
+                    // we've tested this enough to be sure it never happens)- the safety of "let's
+                    // not delete stuff we need from prod" is more important.
+                    if (manifest.getCommitTime().isAfter(deletionThreshold)) {
+                      return DeletionResult.create(DeletionResult.Status.AFTER_THRESHOLD, 0);
+                    }
+                    Iterable<Key<CommitLogMutation>> commitLogMutationKeys =
+                        auditedOfy()
+                            .load()
+                            .type(CommitLogMutation.class)
+                            .ancestor(manifestKey)
+                            .keys()
+                            .iterable();
+                    ImmutableList<Key<?>> keysToDelete =
+                        ImmutableList.<Key<?>>builder()
+                            .addAll(commitLogMutationKeys)
+                            .add(manifestKey)
+                            .build();
+                    // Normally in a dry run we would log the entities that would be deleted, but
+                    // those can number in the millions so we skip the logging.
+                    if (!isDryRun) {
+                      auditedOfy().deleteWithoutBackup().keys(keysToDelete);
+                    }
+                    return DeletionResult.create(
+                        DeletionResult.Status.SUCCESS, keysToDelete.size());
+                  });
 
       switch (deletionResult.status()) {
         case SUCCESS:

core/src/main/java/google/registry/backup/ExportCommitLogDiffAction.java

@@ -25,7 +25,7 @@ import static google.registry.backup.BackupUtils.GcsMetadataKeys.NUM_TRANSACTION
 import static google.registry.backup.BackupUtils.GcsMetadataKeys.UPPER_BOUND_CHECKPOINT;
 import static google.registry.backup.BackupUtils.serializeEntity;
 import static google.registry.model.ofy.CommitLogBucket.getBucketKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.DateTimeUtils.isAtOrAfter;
 import static java.nio.channels.Channels.newOutputStream;
@@ -89,11 +89,14 @@ public final class ExportCommitLogDiffAction implements Runnable {
     checkArgument(lowerCheckpointTime.isBefore(upperCheckpointTime));
     // Load the boundary checkpoints - lower is exclusive and may not exist (on the first export,
     // when lowerCheckpointTime is START_OF_TIME), whereas the upper is inclusive and must exist.
-    CommitLogCheckpoint lowerCheckpoint = lowerCheckpointTime.isAfter(START_OF_TIME)
-        ? verifyNotNull(ofy().load().key(CommitLogCheckpoint.createKey(lowerCheckpointTime)).now())
-        : null;
+    CommitLogCheckpoint lowerCheckpoint =
+        lowerCheckpointTime.isAfter(START_OF_TIME)
+            ? verifyNotNull(
+                auditedOfy().load().key(CommitLogCheckpoint.createKey(lowerCheckpointTime)).now())
+            : null;
     CommitLogCheckpoint upperCheckpoint =
-        verifyNotNull(ofy().load().key(CommitLogCheckpoint.createKey(upperCheckpointTime)).now());
+        verifyNotNull(
+            auditedOfy().load().key(CommitLogCheckpoint.createKey(upperCheckpointTime)).now());
 
     // Load the keys of all the manifests to include in this diff.
     List<Key<CommitLogManifest>> sortedKeys = loadAllDiffKeys(lowerCheckpoint, upperCheckpoint);
@@ -117,7 +120,7 @@ public final class ExportCommitLogDiffAction implements Runnable {
       // asynchronously load the entities for the next one.
       List<List<Key<CommitLogManifest>>> keyChunks = partition(sortedKeys, batchSize);
       // Objectify's map return type is asynchronous. Calling .values() will block until it loads.
-      Map<?, CommitLogManifest> nextChunkToExport = ofy().load().keys(keyChunks.get(0));
+      Map<?, CommitLogManifest> nextChunkToExport = auditedOfy().load().keys(keyChunks.get(0));
       for (int i = 0; i < keyChunks.size(); i++) {
         // Force the async load to finish.
         Collection<CommitLogManifest> chunkValues = nextChunkToExport.values();
@@ -125,10 +128,10 @@ public final class ExportCommitLogDiffAction implements Runnable {
         // Since there is no hard bound on how much data this might be, take care not to let the
         // Objectify session cache fill up and potentially run out of memory. This is the only safe
         // point to do this since at this point there is no async load in progress.
-        ofy().clearSessionCache();
+        auditedOfy().clearSessionCache();
         // Kick off the next async load, which can happen in parallel to the current GCS export.
         if (i + 1 < keyChunks.size()) {
-          nextChunkToExport = ofy().load().keys(keyChunks.get(i + 1));
+          nextChunkToExport = auditedOfy().load().keys(keyChunks.get(i + 1));
         }
         exportChunk(gcsStream, chunkValues);
         logger.atInfo().log("Exported %d manifests", chunkValues.size());
@@ -192,7 +195,8 @@ public final class ExportCommitLogDiffAction implements Runnable {
       return ImmutableSet.of();
     }
     Key<CommitLogBucket> bucketKey = getBucketKey(bucketNum);
-    return ofy().load()
+    return auditedOfy()
+        .load()
         .type(CommitLogManifest.class)
         .ancestor(bucketKey)
         .filterKey(">=", CommitLogManifest.createKey(bucketKey, lowerBound))
@@ -208,7 +212,7 @@ public final class ExportCommitLogDiffAction implements Runnable {
         new ImmutableList.Builder<>();
     for (CommitLogManifest manifest : chunk) {
       entities.add(ImmutableList.of(manifest));
-      entities.add(ofy().load().type(CommitLogMutation.class).ancestor(manifest));
+      entities.add(auditedOfy().load().type(CommitLogMutation.class).ancestor(manifest));
     }
     for (ImmutableObject entity : concat(entities.build())) {
       serializeEntity(entity, gcsStream);

core/src/main/java/google/registry/backup/ReplayCommitLogsToSqlAction.java

@@ -16,7 +16,7 @@ package google.registry.backup;
 
 import static google.registry.backup.ExportCommitLogDiffAction.DIFF_FILE_PREFIX;
 import static google.registry.model.ofy.EntityWritePriorities.getEntityPriority;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static javax.servlet.http.HttpServletResponse.SC_NO_CONTENT;
 import static org.joda.time.Duration.standardHours;
@@ -151,7 +151,7 @@ public class ReplayCommitLogsToSqlAction implements Runnable {
   }
 
   private void handleEntityPut(Entity entity) {
-    Object ofyPojo = ofy().toPojo(entity);
+    Object ofyPojo = auditedOfy().toPojo(entity);
     if (ofyPojo instanceof DatastoreEntity) {
       DatastoreEntity datastoreEntity = (DatastoreEntity) ofyPojo;
       datastoreEntity

core/src/main/java/google/registry/backup/RestoreCommitLogsAction.java

@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.Iterators.peekingIterator;
 import static google.registry.backup.BackupUtils.createDeserializingIterator;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.api.datastore.DatastoreService;
 import com.google.appengine.api.datastore.Entity;
@@ -146,10 +146,10 @@ public class RestoreCommitLogsAction implements Runnable {
   private CommitLogManifest restoreOneTransaction(PeekingIterator<ImmutableObject> commitLogs) {
     final CommitLogManifest manifest = (CommitLogManifest) commitLogs.next();
     Result<?> deleteResult = deleteAsync(manifest.getDeletions());
-    List<Entity> entitiesToSave = Lists.newArrayList(ofy().save().toEntity(manifest));
+    List<Entity> entitiesToSave = Lists.newArrayList(auditedOfy().save().toEntity(manifest));
     while (commitLogs.hasNext() && commitLogs.peek() instanceof CommitLogMutation) {
       CommitLogMutation mutation = (CommitLogMutation) commitLogs.next();
-      entitiesToSave.add(ofy().save().toEntity(mutation));
+      entitiesToSave.add(auditedOfy().save().toEntity(mutation));
       entitiesToSave.add(EntityTranslator.createFromPbBytes(mutation.getEntityProtoBytes()));
     }
     saveRaw(entitiesToSave);
@@ -176,7 +176,8 @@ public class RestoreCommitLogsAction implements Runnable {
       return;
     }
     retrier.callWithRetry(
-        () -> ofy().saveWithoutBackup().entities(objectsToSave).now(), RuntimeException.class);
+        () -> auditedOfy().saveWithoutBackup().entities(objectsToSave).now(),
+        RuntimeException.class);
   }
 
   private Result<?> deleteAsync(Set<Key<?>> keysToDelete) {
@@ -185,7 +186,7 @@ public class RestoreCommitLogsAction implements Runnable {
     }
     return dryRun || keysToDelete.isEmpty()
         ? new ResultNow<Void>(null)
-        : ofy().deleteWithoutBackup().keys(keysToDelete);
+        : auditedOfy().deleteWithoutBackup().keys(keysToDelete);
   }
 
 }

core/src/main/java/google/registry/backup/VersionedEntity.java

@@ -47,7 +47,7 @@ import javax.annotation.Nullable;
  *
  * <ul>
  *   <li>Convert an Objectify entity to a Datastore {@link Entity}: {@code
- *       ofy().save().toEntity(..)}
+ *       auditedOfy().save().toEntity(..)}
  *   <li>Entity is serializable, but the more efficient approach is to convert an Entity to a
  *       ProtocolBuffer ({@link com.google.storage.onestore.v3.OnestoreEntity.EntityProto}) and then
  *       to raw bytes.

core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java

@@ -34,7 +34,7 @@ import static google.registry.model.ResourceTransferUtils.denyPendingTransfer;
 import static google.registry.model.ResourceTransferUtils.handlePendingTransferOnDelete;
 import static google.registry.model.ResourceTransferUtils.updateForeignKeyIndexDeletionTime;
 import static google.registry.model.eppcommon.StatusValue.PENDING_DELETE;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_DELETE;
 import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_DELETE_FAILURE;
 import static google.registry.model.reporting.HistoryEntry.Type.HOST_DELETE;
@@ -109,6 +109,7 @@ import org.joda.time.Duration;
  * A mapreduce that processes batch asynchronous deletions of contact and host resources by mapping
  * over all domains and checking for any references to the contacts/hosts in pending deletion.
  */
+@Deprecated
 @Action(
     service = Action.Service.BACKEND,
     path = "/_dr/task/deleteContactsAndHosts",
@@ -335,7 +336,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
         DeletionRequest deletionRequest, boolean hasNoActiveReferences) {
       DateTime now = tm().getTransactionTime();
       EppResource resource =
-          ofy().load().key(deletionRequest.key()).now().cloneProjectedAtTime(now);
+          auditedOfy().load().key(deletionRequest.key()).now().cloneProjectedAtTime(now);
       // Double-check transactionally that the resource is still active and in PENDING_DELETE.
       if (!doesResourceStateAllowDeletion(resource, now)) {
         return DeletionResult.create(Type.ERRORED, "");
@@ -408,7 +409,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
       } else {
         resourceToSave = resource.asBuilder().removeStatusValue(PENDING_DELETE).build();
       }
-      ofy().save().<ImmutableObject>entities(resourceToSave, historyEntry, pollMessage);
+      auditedOfy().save().<ImmutableObject>entities(resourceToSave, historyEntry, pollMessage);
       return DeletionResult.create(
           deleteAllowed ? Type.DELETED : Type.NOT_DELETED, pollMessageText);
     }
@@ -525,7 +526,8 @@ public class DeleteContactsAndHostsAction implements Runnable {
           Key.create(
               checkNotNull(params.get(PARAM_RESOURCE_KEY), "Resource to delete not specified"));
       EppResource resource =
-          checkNotNull(ofy().load().key(resourceKey).now(), "Resource to delete doesn't exist");
+          checkNotNull(
+              auditedOfy().load().key(resourceKey).now(), "Resource to delete doesn't exist");
       checkState(
           resource instanceof ContactResource || resource instanceof HostResource,
           "Cannot delete a %s via this action",

core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java

@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkState;
 import static google.registry.config.RegistryEnvironment.PRODUCTION;
 import static google.registry.mapreduce.MapreduceRunner.PARAM_DRY_RUN;
 import static google.registry.mapreduce.inputs.EppResourceInputs.createEntityInput;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.POST;
 
@@ -125,12 +125,11 @@ public class DeleteLoadTestDataAction implements Runnable {
           Key.create(EppResourceIndex.create(Key.create(resource)));
       final Key<? extends ForeignKeyIndex<?>> fki = ForeignKeyIndex.createKey(resource);
       int numEntitiesDeleted =
-          tm()
-              .transact(
+          tm().transact(
                   () -> {
                     // This ancestor query selects all descendant entities.
                     List<Key<Object>> resourceAndDependentKeys =
-                        ofy().load().ancestor(resource).keys().list();
+                        auditedOfy().load().ancestor(resource).keys().list();
                     ImmutableSet<Key<?>> allKeys =
                         new ImmutableSet.Builder<Key<?>>()
                             .add(fki)
@@ -140,7 +139,7 @@ public class DeleteLoadTestDataAction implements Runnable {
                     if (isDryRun) {
                       logger.atInfo().log("Would hard-delete the following entities: %s", allKeys);
                     } else {
-                      ofy().deleteWithoutBackup().keys(allKeys);
+                      auditedOfy().deleteWithoutBackup().keys(allKeys);
                     }
                     return allKeys.size();
                   });

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -20,7 +20,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.config.RegistryEnvironment.PRODUCTION;
 import static google.registry.mapreduce.MapreduceRunner.PARAM_DRY_RUN;
 import static google.registry.model.ResourceTransferUtils.updateForeignKeyIndexDeletionTime;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registry.Registries.getTldsOfType;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_DELETE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -166,7 +166,7 @@ public class DeleteProberDataAction implements Runnable {
     }
 
     private void deleteDomain(final Key<DomainBase> domainKey) {
-      final DomainBase domain = ofy().load().key(domainKey).now();
+      final DomainBase domain = auditedOfy().load().key(domainKey).now();
 
       DateTime now = DateTime.now(UTC);
 
@@ -220,14 +220,13 @@ public class DeleteProberDataAction implements Runnable {
       final Key<? extends ForeignKeyIndex<?>> fki = ForeignKeyIndex.createKey(domain);
 
       int entitiesDeleted =
-          tm()
-              .transact(
+          tm().transact(
                   () -> {
                     // This ancestor query selects all descendant HistoryEntries, BillingEvents,
                     // PollMessages,
                     // and TLD-specific entities, as well as the domain itself.
                     List<Key<Object>> domainAndDependentKeys =
-                        ofy().load().ancestor(domainKey).keys().list();
+                        auditedOfy().load().ancestor(domainKey).keys().list();
                     ImmutableSet<Key<?>> allKeys =
                         new ImmutableSet.Builder<Key<?>>()
                             .add(fki)
@@ -237,7 +236,7 @@ public class DeleteProberDataAction implements Runnable {
                     if (isDryRun) {
                       logger.atInfo().log("Would hard-delete the following entities: %s", allKeys);
                     } else {
-                      ofy().deleteWithoutBackup().keys(allKeys);
+                      auditedOfy().deleteWithoutBackup().keys(allKeys);
                     }
                     return allKeys.size();
                   });
@@ -268,7 +267,7 @@ public class DeleteProberDataAction implements Runnable {
                 // poll messages, or auto-renews because these will all be hard-deleted the next
                 // time the
                 // mapreduce runs anyway.
-                ofy().save().entities(deletedDomain, historyEntry);
+                auditedOfy().save().entities(deletedDomain, historyEntry);
                 updateForeignKeyIndexDeletionTime(deletedDomain);
                 dnsQueue.addDomainRefreshTask(deletedDomain.getDomainName());
               });

core/src/main/java/google/registry/batch/ExpandRecurringBillingEventsAction.java

@@ -91,7 +91,8 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
 
   @Override
   public void run() {
-    Cursor cursor = ofy().load().key(Cursor.createGlobalKey(RECURRING_BILLING)).now();
+    Cursor cursor =
+        tm().loadByKeyIfPresent(Cursor.createGlobalVKey(RECURRING_BILLING)).orElse(null);
     DateTime executeTime = clock.nowUtc();
     DateTime persistedCursorTime = (cursor == null ? START_OF_TIME : cursor.getCursorTime());
     DateTime cursorTime = cursorTimeParam.orElse(persistedCursorTime);

core/src/main/java/google/registry/batch/ResaveAllEppResourcesAction.java

@@ -15,7 +15,7 @@
 package google.registry.batch;
 
 import static google.registry.mapreduce.MapreduceRunner.PARAM_FAST;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.appengine.tools.mapreduce.Mapper;
@@ -104,13 +104,13 @@ public class ResaveAllEppResourcesAction implements Runnable {
       boolean resaved =
           tm().transact(
                   () -> {
-                    EppResource originalResource = ofy().load().key(resourceKey).now();
+                    EppResource originalResource = auditedOfy().load().key(resourceKey).now();
                     EppResource projectedResource =
                         originalResource.cloneProjectedAtTime(tm().getTransactionTime());
                     if (isFast && originalResource.equals(projectedResource)) {
                       return false;
                     } else {
-                      ofy().save().entity(projectedResource).now();
+                      auditedOfy().save().entity(projectedResource).now();
                       return true;
                     }
                   });

core/src/main/java/google/registry/beam/common/RegistryJpaIO.java

@@ -34,11 +34,11 @@ import org.apache.beam.sdk.coders.SerializableCoder;
 import org.apache.beam.sdk.metrics.Counter;
 import org.apache.beam.sdk.metrics.Metrics;
 import org.apache.beam.sdk.transforms.Create;
-import org.apache.beam.sdk.transforms.Deduplicate;
 import org.apache.beam.sdk.transforms.DoFn;
 import org.apache.beam.sdk.transforms.GroupIntoBatches;
 import org.apache.beam.sdk.transforms.PTransform;
 import org.apache.beam.sdk.transforms.ParDo;
+import org.apache.beam.sdk.transforms.Reshuffle;
 import org.apache.beam.sdk.transforms.SerializableFunction;
 import org.apache.beam.sdk.transforms.WithKeys;
 import org.apache.beam.sdk.util.ShardedKey;
@@ -80,25 +80,9 @@ public final class RegistryJpaIO {
       extends SerializableFunction<JpaTransactionManager, QueryComposer<T>> {}
 
   /**
-   * A {@link PTransform transform} that executes a JPA {@link CriteriaQuery} and adds the results
-   * to the BEAM pipeline. Users have the option to transform the results before sending them to the
-   * next stages.
-   *
-   * <p>The BEAM pipeline may execute this transform multiple times due to transient failures,
-   * loading duplicate results into the pipeline. Before we add dedepuplication support, the easiest
-   * workaround is to map results to {@link KV} pairs, and apply the {@link Deduplicate} transform
-   * to the output of this transform:
-   *
-   * <pre>{@code
-   * PCollection<String> contactIds =
-   *     pipeline
-   *         .apply(RegistryJpaIO.read(
-   *             (JpaTransactionManager tm) -> tm.createQueryComposer...,
-   *             contact -> KV.of(contact.getRepoId(), contact.getContactId()))
-   *         .withCoder(KvCoder.of(StringUtf8Coder.of(), StringUtf8Coder.of())))
-   *         .apply(Deduplicate.keyedValues())
-   *         .apply(Values.create());
-   * }</pre>
+   * A {@link PTransform transform} that transactionally executes a JPA {@link CriteriaQuery} and
+   * adds the results to the BEAM pipeline. Users have the option to transform the results before
+   * sending them to the next stages.
    */
   @AutoValue
   public abstract static class Read<R, T> extends PTransform<PBegin, PCollection<T>> {
@@ -111,20 +95,20 @@ public final class RegistryJpaIO {
 
     abstract SerializableFunction<R, T> resultMapper();
 
-    abstract TransactionMode transactionMode();
-
     abstract Coder<T> coder();
 
     abstract Builder<R, T> toBuilder();
 
     @Override
+    @SuppressWarnings("deprecation") // Reshuffle still recommended by GCP.
     public PCollection<T> expand(PBegin input) {
       return input
           .apply("Starting " + name(), Create.of((Void) null))
           .apply(
               "Run query for " + name(),
               ParDo.of(new QueryRunner<>(queryFactory(), resultMapper())))
-          .setCoder(coder());
+          .setCoder(coder())
+          .apply("Reshuffle", Reshuffle.viaRandomKey());
     }
 
     public Read<R, T> withName(String name) {
@@ -135,10 +119,6 @@ public final class RegistryJpaIO {
       return toBuilder().resultMapper(mapper).build();
     }
 
-    public Read<R, T> withTransactionMode(TransactionMode transactionMode) {
-      return toBuilder().transactionMode(transactionMode).build();
-    }
-
     public Read<R, T> withCoder(Coder<T> coder) {
       return toBuilder().coder(coder).build();
     }
@@ -147,7 +127,6 @@ public final class RegistryJpaIO {
       return new AutoValue_RegistryJpaIO_Read.Builder()
           .name(DEFAULT_NAME)
           .resultMapper(x -> x)
-          .transactionMode(TransactionMode.TRANSACTIONAL)
           .coder(SerializableCoder.of(Serializable.class));
     }
 
@@ -160,8 +139,6 @@ public final class RegistryJpaIO {
 
       abstract Builder<R, T> resultMapper(SerializableFunction<R, T> mapper);
 
-      abstract Builder<R, T> transactionMode(TransactionMode transactionMode);
-
       abstract Builder<R, T> coder(Coder coder);
 
       abstract Read<R, T> build();
@@ -178,22 +155,19 @@ public final class RegistryJpaIO {
 
       @ProcessElement
       public void processElement(OutputReceiver<T> outputReceiver) {
-        // TODO(b/187210388): JpaTransactionManager should support non-transactional query.
-        // TODO(weiminyu): add deduplication
-        jpaTm()
-            .transactNoRetry(
-                () ->
-                    querySupplier.apply(jpaTm()).stream()
-                        .map(resultMapper::apply)
-                        .forEach(outputReceiver::output));
-        // TODO(weiminyu): improve performance by reshuffle.
+        // AppEngineEnvironment is need for handling VKeys, which involve Ofy keys. Unlike
+        // SqlBatchWriter, it is unnecessary to initialize ObjectifyService in this class.
+        try (AppEngineEnvironment env = new AppEngineEnvironment()) {
+          // TODO(b/187210388): JpaTransactionManager should support non-transactional query.
+          jpaTm()
+              .transactNoRetry(
+                  () ->
+                      querySupplier.apply(jpaTm()).withAutoDetachOnLoad(true).stream()
+                          .map(resultMapper::apply)
+                          .forEach(outputReceiver::output));
+        }
       }
     }
-
-    public enum TransactionMode {
-      NOT_TRANSACTIONAL,
-      TRANSACTIONAL;
-    }
   }
 
   /**
@@ -323,8 +297,9 @@ public final class RegistryJpaIO {
 
     @Setup
     public void setup() {
-      // Below is needed as long as Objectify keys are still involved in the handling of SQL
-      // entities (e.g., in VKeys).
+      // AppEngineEnvironment is needed as long as Objectify keys are still involved in the handling
+      // of SQL entities (e.g., in VKeys). ObjectifyService needs to be initialized when conversion
+      // between Ofy entity and Datastore entity is needed.
       try (AppEngineEnvironment env = new AppEngineEnvironment()) {
         ObjectifyService.initOfy();
       }

core/src/main/java/google/registry/beam/initsql/Transforms.java

@@ -19,7 +19,7 @@ import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
 import static google.registry.beam.initsql.BackupPaths.getCommitLogTimestamp;
 import static google.registry.beam.initsql.BackupPaths.getExportFilePatterns;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;
 import static java.util.Comparator.comparing;
@@ -353,7 +353,7 @@ public final class Transforms {
         .getEntity()
         .filter(Transforms::isMigratable)
         .map(Transforms::repairBadData)
-        .map(e -> ofy().toPojo(e))
+        .map(e -> auditedOfy().toPojo(e))
         .map(Transforms::toSqlEntity)
         .orElse(null);
   }

core/src/main/java/google/registry/config/files/premium/example.txt

@@ -1,5 +1,5 @@
-# Example of a reserved list file.  This is simply a CSV file with two
-# columns: sub-domain name and price (specified as currency type and value).
+# Example of a premium list file.  This is simply a CSV file with two
+# columns: sub-domain name, and price (specified as currency type and value).
 #
 # These are manipulated using the "nomulus" tool
 # {create,update,delete,list}_premium_list commands.

core/src/main/java/google/registry/env/common/backend/WEB-INF/web.xml

@@ -391,6 +391,12 @@
     <url-pattern>/_dr/task/wipeOutDatastore</url-pattern>
   </servlet-mapping>
 
+  <!-- Action to create synthetic history entries during async replication to SQL -->
+  <servlet-mapping>
+    <servlet-name>backend-servlet</servlet-name>
+    <url-pattern>/_dr/task/createSyntheticHistoryEntries</url-pattern>
+  </servlet-mapping>
+
   <!-- Security config -->
   <security-constraint>
     <web-resource-collection>

core/src/main/java/google/registry/export/ExportPremiumTermsAction.java

@@ -32,12 +32,12 @@ import com.google.common.net.MediaType;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.registry.Registry;
 import google.registry.model.registry.label.PremiumList.PremiumListEntry;
-import google.registry.model.registry.label.PremiumListDualDao;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
 import google.registry.request.RequestParameters;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
+import google.registry.schema.tld.PremiumListDao;
 import google.registry.storage.drive.DriveConnection;
 import java.io.IOException;
 import java.util.Optional;
@@ -139,9 +139,10 @@ public class ExportPremiumTermsAction implements Runnable {
   private String getFormattedPremiumTerms(Registry registry) {
     String premiumListName = registry.getPremiumList().getName();
     checkState(
-        PremiumListDualDao.exists(premiumListName), "Could not load premium list for " + tld);
+        PremiumListDao.getLatestRevision(premiumListName).isPresent(),
+        "Could not load premium list for " + tld);
     SortedSet<String> premiumTerms =
-        Streams.stream(PremiumListDualDao.loadAllPremiumListEntries(premiumListName))
+        Streams.stream(PremiumListDao.loadAllPremiumListEntries(premiumListName))
             .map(PremiumListEntry::toString)
             .collect(ImmutableSortedSet.toImmutableSortedSet(String::compareTo));
 

core/src/main/java/google/registry/flows/FlowModule.java

@@ -20,6 +20,7 @@ import com.google.common.base.Strings;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.flows.picker.FlowPicker;
+import google.registry.model.contact.ContactHistory;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.metadata.MetadataExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -31,6 +32,7 @@ import google.registry.model.eppinput.ResourceCommand;
 import google.registry.model.eppinput.ResourceCommand.SingleResourceCommand;
 import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.eppoutput.Result;
+import google.registry.model.host.HostHistory;
 import google.registry.model.reporting.HistoryEntry;
 import java.lang.annotation.Documented;
 import java.util.Optional;
@@ -232,20 +234,31 @@ public class FlowModule {
             .setClientId(clientId);
     Optional<MetadataExtension> metadataExtension =
         eppInput.getSingleExtension(MetadataExtension.class);
-    if (metadataExtension.isPresent()) {
-      historyBuilder
-          .setReason(metadataExtension.get().getReason())
-          .setRequestedByRegistrar(metadataExtension.get().getRequestedByRegistrar());
-    }
+    metadataExtension.ifPresent(
+        extension ->
+            historyBuilder
+                .setReason(extension.getReason())
+                .setRequestedByRegistrar(extension.getRequestedByRegistrar()));
     return historyBuilder;
   }
 
+  @Provides
+  static ContactHistory.Builder provideContactHistoryBuilder(
+      HistoryEntry.Builder historyEntryBuilder) {
+    return new ContactHistory.Builder().copyFrom(historyEntryBuilder);
+  }
+
   @Provides
   static DomainHistory.Builder provideDomainHistoryBuilder(
       HistoryEntry.Builder historyEntryBuilder) {
     return new DomainHistory.Builder().copyFrom(historyEntryBuilder);
   }
 
+  @Provides
+  static HostHistory.Builder provideHostHistoryBuilder(HistoryEntry.Builder historyEntryBuilder) {
+    return new HostHistory.Builder().copyFrom(historyEntryBuilder);
+  }
+
   /**
    * Provides a partially filled in {@link EppResponse} builder.
    *
@@ -256,7 +269,7 @@ public class FlowModule {
   static EppResponse.Builder provideEppResponseBuilder(Trid trid) {
     return new EppResponse.Builder()
         .setTrid(trid)
-        .setResultFromCode(Result.Code.SUCCESS);  // Default to success.
+        .setResultFromCode(Result.Code.SUCCESS); // Default to success.
   }
 
   @Provides

core/src/main/java/google/registry/flows/ResourceFlowUtils.java

@@ -16,6 +16,7 @@ package google.registry.flows;
 
 import static com.google.common.collect.Sets.intersection;
 import static google.registry.model.EppResourceUtils.getLinkedDomainKeys;
+import static google.registry.model.EppResourceUtils.isLinked;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.model.index.ForeignKeyIndex.loadAndGetKey;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -62,7 +63,10 @@ public final class ResourceFlowUtils {
 
   private ResourceFlowUtils() {}
 
-  /** In {@link #failfastForAsyncDelete}, check this (arbitrary) number of query results. */
+  /**
+   * In {@link #checkLinkedDomains(String, DateTime, Class, Function)}, check this (arbitrary)
+   * number of query results.
+   */
   private static final int FAILFAST_CHECK_COUNT = 5;
 
   /** Check that the given clientId corresponds to the owner of given resource. */
@@ -73,36 +77,54 @@ public final class ResourceFlowUtils {
     }
   }
 
-  /** Check whether an asynchronous delete would obviously fail, and throw an exception if so. */
-  public static <R extends EppResource> void failfastForAsyncDelete(
+  /**
+   * Check whether if there are domains linked to the resource to be deleted. Throws an exception if
+   * so.
+   *
+   * <p>Note that in datastore this is a smoke test as the query for linked domains is eventually
+   * consistent, so we only check a few domains to fail fast.
+   */
+  public static <R extends EppResource> void checkLinkedDomains(
       final String targetId,
       final DateTime now,
       final Class<R> resourceClass,
-      final Function<DomainBase, ImmutableSet<?>> getPotentialReferences) throws EppException {
-    // Enter a transactionless context briefly.
+      final Function<DomainBase, ImmutableSet<?>> getPotentialReferences)
+      throws EppException {
     EppException failfastException =
-        tm().doTransactionless(
-                () -> {
-                  final ForeignKeyIndex<R> fki = ForeignKeyIndex.load(resourceClass, targetId, now);
-                  if (fki == null) {
-                    return new ResourceDoesNotExistException(resourceClass, targetId);
-                  }
-                  /* Query for the first few linked domains, and if found, actually load them. The
-                   * query is eventually consistent and so might be very stale, but the direct
-                   * load will not be stale, just non-transactional. If we find at least one
-                   * actual reference then we can reliably fail. If we don't find any, we can't
-                   * trust the query and need to do the full mapreduce.
-                   */
-                  Iterable<VKey<DomainBase>> keys =
-                      getLinkedDomainKeys(fki.getResourceKey(), now, FAILFAST_CHECK_COUNT);
+        tm().isOfy()
+            ? tm().doTransactionless(
+                    () -> {
+                      final ForeignKeyIndex<R> fki =
+                          ForeignKeyIndex.load(resourceClass, targetId, now);
+                      if (fki == null) {
+                        return new ResourceDoesNotExistException(resourceClass, targetId);
+                      }
+                      // Query for the first few linked domains, and if found, actually load them.
+                      // The query is eventually consistent and so might be very stale, but the
+                      // direct load will not be stale, just non-transactional. If we find at least
+                      // one  actual reference then we can reliably fail. If we don't find any,
+                      // we can't  trust the query and need to do the full mapreduce.
+                      Iterable<VKey<DomainBase>> keys =
+                          getLinkedDomainKeys(fki.getResourceKey(), now, FAILFAST_CHECK_COUNT);
 
-                  VKey<R> resourceVKey = fki.getResourceKey();
-                  Predicate<DomainBase> predicate =
-                      domain -> getPotentialReferences.apply(domain).contains(resourceVKey);
-                  return tm().loadByKeys(keys).values().stream().anyMatch(predicate)
-                      ? new ResourceToDeleteIsReferencedException()
-                      : null;
-                });
+                      VKey<R> resourceVKey = fki.getResourceKey();
+                      Predicate<DomainBase> predicate =
+                          domain -> getPotentialReferences.apply(domain).contains(resourceVKey);
+                      return tm().loadByKeys(keys).values().stream().anyMatch(predicate)
+                          ? new ResourceToDeleteIsReferencedException()
+                          : null;
+                    })
+            : tm().transact(
+                    () -> {
+                      final ForeignKeyIndex<R> fki =
+                          ForeignKeyIndex.load(resourceClass, targetId, now);
+                      if (fki == null) {
+                        return new ResourceDoesNotExistException(resourceClass, targetId);
+                      }
+                      return isLinked(fki.getResourceKey(), now)
+                          ? new ResourceToDeleteIsReferencedException()
+                          : null;
+                    });
     if (failfastException != null) {
       throw failfastException;
     }
@@ -123,8 +145,7 @@ public final class ResourceFlowUtils {
   }
 
   public static <R extends EppResource & ForeignKeyedEppResource> R loadAndVerifyExistence(
-      Class<R> clazz, String targetId, DateTime now)
-          throws ResourceDoesNotExistException {
+      Class<R> clazz, String targetId, DateTime now) throws ResourceDoesNotExistException {
     return verifyExistence(clazz, targetId, loadByForeignKey(clazz, targetId, now));
   }
 
@@ -156,16 +177,16 @@ public final class ResourceFlowUtils {
   }
 
   /** Check that the given AuthInfo is either missing or else is valid for the given resource. */
-  public static void verifyOptionalAuthInfo(
-      Optional<AuthInfo> authInfo, ContactResource contact) throws EppException {
+  public static void verifyOptionalAuthInfo(Optional<AuthInfo> authInfo, ContactResource contact)
+      throws EppException {
     if (authInfo.isPresent()) {
       verifyAuthInfo(authInfo.get(), contact);
     }
   }
 
   /** Check that the given AuthInfo is either missing or else is valid for the given resource. */
-  public static void verifyOptionalAuthInfo(
-      Optional<AuthInfo> authInfo, DomainBase domain) throws EppException {
+  public static void verifyOptionalAuthInfo(Optional<AuthInfo> authInfo, DomainBase domain)
+      throws EppException {
     if (authInfo.isPresent()) {
       verifyAuthInfo(authInfo.get(), domain);
     }
@@ -229,7 +250,7 @@ public final class ResourceFlowUtils {
   /** Check that the same values aren't being added and removed in an update command. */
   public static void checkSameValuesNotAddedAndRemoved(
       ImmutableSet<?> fieldsToAdd, ImmutableSet<?> fieldsToRemove)
-          throws AddRemoveSameValueException {
+      throws AddRemoveSameValueException {
     if (!intersection(fieldsToAdd, fieldsToRemove).isEmpty()) {
       throw new AddRemoveSameValueException();
     }

core/src/main/java/google/registry/flows/contact/ContactCreateFlow.java

@@ -33,6 +33,7 @@ import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ResourceAlreadyExistsForThisClientException;
 import google.registry.flows.exceptions.ResourceCreateContentionException;
 import google.registry.model.contact.ContactCommand.Create;
+import google.registry.model.contact.ContactHistory;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.metadata.MetadataExtension;
 import google.registry.model.eppinput.ResourceCommand;
@@ -61,7 +62,7 @@ public final class ContactCreateFlow implements TransactionalFlow {
   @Inject ExtensionManager extensionManager;
   @Inject @ClientId String clientId;
   @Inject @TargetId String targetId;
-  @Inject HistoryEntry.Builder historyBuilder;
+  @Inject ContactHistory.Builder historyBuilder;
   @Inject EppResponse.Builder responseBuilder;
   @Inject @Config("contactAndHostRoidSuffix") String roidSuffix;
   @Inject ContactCreateFlow() {}
@@ -93,12 +94,12 @@ public final class ContactCreateFlow implements TransactionalFlow {
     historyBuilder
         .setType(HistoryEntry.Type.CONTACT_CREATE)
         .setModificationTime(now)
-        .setXmlBytes(null)  // We don't want to store contact details in the history entry.
-        .setParent(Key.create(newContact));
+        .setXmlBytes(null) // We don't want to store contact details in the history entry.
+        .setContact(newContact);
     tm().insertAll(
             ImmutableSet.of(
                 newContact,
-                historyBuilder.build().toChildHistoryEntity(),
+                historyBuilder.build(),
                 ForeignKeyIndex.create(newContact, newContact.getDeletionTime()),
                 EppResourceIndex.create(Key.create(newContact))));
     return responseBuilder

core/src/main/java/google/registry/flows/contact/ContactDeleteFlow.java

@@ -15,16 +15,19 @@
 package google.registry.flows.contact;
 
 import static google.registry.flows.FlowUtils.validateClientIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.failfastForAsyncDelete;
+import static google.registry.flows.ResourceFlowUtils.checkLinkedDomains;
 import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
 import static google.registry.flows.ResourceFlowUtils.verifyNoDisallowedStatuses;
 import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
 import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
+import static google.registry.model.ResourceTransferUtils.denyPendingTransfer;
+import static google.registry.model.ResourceTransferUtils.handlePendingTransferOnDelete;
+import static google.registry.model.eppoutput.Result.Code.SUCCESS;
 import static google.registry.model.eppoutput.Result.Code.SUCCESS_WITH_ACTION_PENDING;
+import static google.registry.model.transfer.TransferStatus.SERVER_CANCELLED;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.common.collect.ImmutableSet;
-import com.googlecode.objectify.Key;
 import google.registry.batch.AsyncTaskEnqueuer;
 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
@@ -33,6 +36,7 @@ import google.registry.flows.FlowModule.Superuser;
 import google.registry.flows.FlowModule.TargetId;
 import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
+import google.registry.model.contact.ContactHistory;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.domain.metadata.MetadataExtension;
@@ -40,7 +44,8 @@ import google.registry.model.eppcommon.AuthInfo;
 import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.eppcommon.Trid;
 import google.registry.model.eppoutput.EppResponse;
-import google.registry.model.reporting.HistoryEntry;
+import google.registry.model.eppoutput.Result.Code;
+import google.registry.model.reporting.HistoryEntry.Type;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -63,10 +68,11 @@ import org.joda.time.DateTime;
 @ReportingSpec(ActivityReportField.CONTACT_DELETE)
 public final class ContactDeleteFlow implements TransactionalFlow {
 
-  private static final ImmutableSet<StatusValue> DISALLOWED_STATUSES = ImmutableSet.of(
-      StatusValue.CLIENT_DELETE_PROHIBITED,
-      StatusValue.PENDING_DELETE,
-      StatusValue.SERVER_DELETE_PROHIBITED);
+  private static final ImmutableSet<StatusValue> DISALLOWED_STATUSES =
+      ImmutableSet.of(
+          StatusValue.CLIENT_DELETE_PROHIBITED,
+          StatusValue.PENDING_DELETE,
+          StatusValue.SERVER_DELETE_PROHIBITED);
 
   @Inject ExtensionManager extensionManager;
   @Inject @ClientId String clientId;
@@ -74,10 +80,12 @@ public final class ContactDeleteFlow implements TransactionalFlow {
   @Inject Trid trid;
   @Inject @Superuser boolean isSuperuser;
   @Inject Optional<AuthInfo> authInfo;
-  @Inject HistoryEntry.Builder historyBuilder;
+  @Inject ContactHistory.Builder historyBuilder;
   @Inject AsyncTaskEnqueuer asyncTaskEnqueuer;
   @Inject EppResponse.Builder responseBuilder;
-  @Inject ContactDeleteFlow() {}
+
+  @Inject
+  ContactDeleteFlow() {}
 
   @Override
   public final EppResponse run() throws EppException {
@@ -85,23 +93,45 @@ public final class ContactDeleteFlow implements TransactionalFlow {
     extensionManager.validate();
     validateClientIsLoggedIn(clientId);
     DateTime now = tm().getTransactionTime();
-    failfastForAsyncDelete(targetId, now, ContactResource.class, DomainBase::getReferencedContacts);
+    checkLinkedDomains(targetId, now, ContactResource.class, DomainBase::getReferencedContacts);
     ContactResource existingContact = loadAndVerifyExistence(ContactResource.class, targetId, now);
     verifyNoDisallowedStatuses(existingContact, DISALLOWED_STATUSES);
     verifyOptionalAuthInfo(authInfo, existingContact);
     if (!isSuperuser) {
       verifyResourceOwnership(clientId, existingContact);
     }
-    asyncTaskEnqueuer.enqueueAsyncDelete(
-        existingContact, tm().getTransactionTime(), clientId, trid, isSuperuser);
-    ContactResource newContact =
-        existingContact.asBuilder().addStatusValue(StatusValue.PENDING_DELETE).build();
-    historyBuilder
-        .setType(HistoryEntry.Type.CONTACT_PENDING_DELETE)
-        .setModificationTime(now)
-        .setParent(Key.create(existingContact));
-    tm().insert(historyBuilder.build().toChildHistoryEntity());
+    Type historyEntryType;
+    Code resultCode;
+    ContactResource newContact;
+    if (tm().isOfy()) {
+      asyncTaskEnqueuer.enqueueAsyncDelete(
+          existingContact, tm().getTransactionTime(), clientId, trid, isSuperuser);
+      newContact = existingContact.asBuilder().addStatusValue(StatusValue.PENDING_DELETE).build();
+      historyEntryType = Type.CONTACT_PENDING_DELETE;
+      resultCode = SUCCESS_WITH_ACTION_PENDING;
+    } else {
+      // Handle pending transfers on contact deletion.
+      newContact =
+          existingContact.getStatusValues().contains(StatusValue.PENDING_TRANSFER)
+              ? denyPendingTransfer(existingContact, SERVER_CANCELLED, now, clientId)
+              : existingContact;
+      // Wipe out PII on contact deletion.
+      newContact =
+          newContact.asBuilder().wipeOut().setStatusValues(null).setDeletionTime(now).build();
+      historyEntryType = Type.CONTACT_DELETE;
+      resultCode = SUCCESS;
+    }
+    ContactHistory contactHistory =
+        historyBuilder
+            .setType(historyEntryType)
+            .setModificationTime(now)
+            .setContact(newContact)
+            .build();
+    if (!tm().isOfy()) {
+      handlePendingTransferOnDelete(existingContact, newContact, now, contactHistory);
+    }
+    tm().insert(contactHistory);
     tm().update(newContact);
-    return responseBuilder.setResultFromCode(SUCCESS_WITH_ACTION_PENDING).build();
+    return responseBuilder.setResultFromCode(resultCode).build();
   }
 }

core/src/main/java/google/registry/flows/contact/ContactFlowUtils.java

@@ -20,19 +20,21 @@ import com.google.common.base.CharMatcher;
 import com.google.common.base.Preconditions;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.Sets;
+import com.googlecode.objectify.Key;
 import google.registry.flows.EppException;
 import google.registry.flows.EppException.ParameterValuePolicyErrorException;
 import google.registry.flows.EppException.ParameterValueSyntaxErrorException;
 import google.registry.model.contact.ContactAddress;
+import google.registry.model.contact.ContactHistory;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.contact.PostalInfo;
 import google.registry.model.poll.PendingActionNotificationResponse.ContactPendingActionNotificationResponse;
 import google.registry.model.poll.PollMessage;
-import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.transfer.TransferData;
 import google.registry.model.transfer.TransferResponse.ContactTransferResponse;
 import java.util.Set;
 import javax.annotation.Nullable;
+import org.joda.time.DateTime;
 
 /** Static utility functions for contact flows. */
 public class ContactFlowUtils {
@@ -66,31 +68,35 @@ public class ContactFlowUtils {
 
   /** Create a poll message for the gaining client in a transfer. */
   static PollMessage createGainingTransferPollMessage(
-      String targetId, TransferData transferData, HistoryEntry historyEntry) {
+      String targetId,
+      TransferData transferData,
+      DateTime now,
+      Key<ContactHistory> contactHistoryKey) {
     return new PollMessage.OneTime.Builder()
         .setClientId(transferData.getGainingClientId())
         .setEventTime(transferData.getPendingTransferExpirationTime())
         .setMsg(transferData.getTransferStatus().getMessage())
-        .setResponseData(ImmutableList.of(
-            createTransferResponse(targetId, transferData),
-            ContactPendingActionNotificationResponse.create(
-                  targetId,
-                  transferData.getTransferStatus().isApproved(),
-                  transferData.getTransferRequestTrid(),
-                  historyEntry.getModificationTime())))
-        .setParent(historyEntry)
+        .setResponseData(
+            ImmutableList.of(
+                createTransferResponse(targetId, transferData),
+                ContactPendingActionNotificationResponse.create(
+                    targetId,
+                    transferData.getTransferStatus().isApproved(),
+                    transferData.getTransferRequestTrid(),
+                    now)))
+        .setParentKey(contactHistoryKey)
         .build();
   }
 
   /** Create a poll message for the losing client in a transfer. */
   static PollMessage createLosingTransferPollMessage(
-      String targetId, TransferData transferData, HistoryEntry historyEntry) {
+      String targetId, TransferData transferData, Key<ContactHistory> contactHistoryKey) {
     return new PollMessage.OneTime.Builder()
         .setClientId(transferData.getLosingClientId())
         .setEventTime(transferData.getPendingTransferExpirationTime())
         .setMsg(transferData.getTransferStatus().getMessage())
         .setResponseData(ImmutableList.of(createTransferResponse(targetId, transferData)))
-        .setParent(historyEntry)
+        .setParentKey(contactHistoryKey)
         .build();
   }
 

core/src/main/java/google/registry/flows/contact/ContactTransferApproveFlow.java

@@ -32,6 +32,7 @@ import google.registry.flows.FlowModule.ClientId;
 import google.registry.flows.FlowModule.TargetId;
 import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
+import google.registry.model.contact.ContactHistory;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.metadata.MetadataExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -66,7 +67,7 @@ public final class ContactTransferApproveFlow implements TransactionalFlow {
   @Inject @ClientId String clientId;
   @Inject @TargetId String targetId;
   @Inject Optional<AuthInfo> authInfo;
-  @Inject HistoryEntry.Builder historyBuilder;
+  @Inject ContactHistory.Builder historyBuilder;
   @Inject EppResponse.Builder responseBuilder;
   @Inject ContactTransferApproveFlow() {}
 
@@ -86,15 +87,17 @@ public final class ContactTransferApproveFlow implements TransactionalFlow {
     verifyResourceOwnership(clientId, existingContact);
     ContactResource newContact =
         approvePendingTransfer(existingContact, TransferStatus.CLIENT_APPROVED, now);
-    HistoryEntry historyEntry = historyBuilder
-        .setType(HistoryEntry.Type.CONTACT_TRANSFER_APPROVE)
-        .setModificationTime(now)
-        .setParent(Key.create(existingContact))
-        .build();
+    ContactHistory contactHistory =
+        historyBuilder
+            .setType(HistoryEntry.Type.CONTACT_TRANSFER_APPROVE)
+            .setModificationTime(now)
+            .setContact(newContact)
+            .build();
     // Create a poll message for the gaining client.
     PollMessage gainingPollMessage =
-        createGainingTransferPollMessage(targetId, newContact.getTransferData(), historyEntry);
-    tm().insertAll(ImmutableSet.of(historyEntry.toChildHistoryEntity(), gainingPollMessage));
+        createGainingTransferPollMessage(
+            targetId, newContact.getTransferData(), now, Key.create(contactHistory));
+    tm().insertAll(ImmutableSet.of(contactHistory, gainingPollMessage));
     tm().update(newContact);
     // Delete the billing event and poll messages that were written in case the transfer would have
     // been implicitly server approved.

core/src/main/java/google/registry/flows/contact/ContactTransferCancelFlow.java

@@ -32,6 +32,7 @@ import google.registry.flows.FlowModule.ClientId;
 import google.registry.flows.FlowModule.TargetId;
 import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
+import google.registry.model.contact.ContactHistory;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.metadata.MetadataExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -66,7 +67,7 @@ public final class ContactTransferCancelFlow implements TransactionalFlow {
   @Inject Optional<AuthInfo> authInfo;
   @Inject @ClientId String clientId;
   @Inject @TargetId String targetId;
-  @Inject HistoryEntry.Builder historyBuilder;
+  @Inject ContactHistory.Builder historyBuilder;
   @Inject EppResponse.Builder responseBuilder;
   @Inject ContactTransferCancelFlow() {}
 
@@ -82,15 +83,17 @@ public final class ContactTransferCancelFlow implements TransactionalFlow {
     verifyTransferInitiator(clientId, existingContact);
     ContactResource newContact =
         denyPendingTransfer(existingContact, TransferStatus.CLIENT_CANCELLED, now, clientId);
-    HistoryEntry historyEntry = historyBuilder
-        .setType(HistoryEntry.Type.CONTACT_TRANSFER_CANCEL)
-        .setModificationTime(now)
-        .setParent(Key.create(existingContact))
-        .build();
+    ContactHistory contactHistory =
+        historyBuilder
+            .setType(HistoryEntry.Type.CONTACT_TRANSFER_CANCEL)
+            .setModificationTime(now)
+            .setContact(newContact)
+            .build();
     // Create a poll message for the losing client.
     PollMessage losingPollMessage =
-        createLosingTransferPollMessage(targetId, newContact.getTransferData(), historyEntry);
-    tm().insertAll(ImmutableSet.of(historyEntry.toChildHistoryEntity(), losingPollMessage));
+        createLosingTransferPollMessage(
+            targetId, newContact.getTransferData(), Key.create(contactHistory));
+    tm().insertAll(ImmutableSet.of(contactHistory, losingPollMessage));
     tm().update(newContact);
     // Delete the billing event and poll messages that were written in case the transfer would have
     // been implicitly server approved.

core/src/main/java/google/registry/flows/contact/ContactTransferRejectFlow.java

@@ -32,6 +32,7 @@ import google.registry.flows.FlowModule.ClientId;
 import google.registry.flows.FlowModule.TargetId;
 import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
+import google.registry.model.contact.ContactHistory;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.metadata.MetadataExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -64,7 +65,7 @@ public final class ContactTransferRejectFlow implements TransactionalFlow {
   @Inject Optional<AuthInfo> authInfo;
   @Inject @ClientId String clientId;
   @Inject @TargetId String targetId;
-  @Inject HistoryEntry.Builder historyBuilder;
+  @Inject ContactHistory.Builder historyBuilder;
   @Inject EppResponse.Builder responseBuilder;
   @Inject ContactTransferRejectFlow() {}
 
@@ -80,14 +81,16 @@ public final class ContactTransferRejectFlow implements TransactionalFlow {
     verifyResourceOwnership(clientId, existingContact);
     ContactResource newContact =
         denyPendingTransfer(existingContact, TransferStatus.CLIENT_REJECTED, now, clientId);
-    HistoryEntry historyEntry = historyBuilder
-        .setType(HistoryEntry.Type.CONTACT_TRANSFER_REJECT)
-        .setModificationTime(now)
-        .setParent(Key.create(existingContact))
-        .build();
+    ContactHistory contactHistory =
+        historyBuilder
+            .setType(HistoryEntry.Type.CONTACT_TRANSFER_REJECT)
+            .setModificationTime(now)
+            .setContact(newContact)
+            .build();
     PollMessage gainingPollMessage =
-        createGainingTransferPollMessage(targetId, newContact.getTransferData(), historyEntry);
-    tm().insertAll(ImmutableSet.of(historyEntry.toChildHistoryEntity(), gainingPollMessage));
+        createGainingTransferPollMessage(
+            targetId, newContact.getTransferData(), now, Key.create(contactHistory));
+    tm().insertAll(ImmutableSet.of(contactHistory, gainingPollMessage));
     tm().update(newContact);
     // Delete the billing event and poll messages that were written in case the transfer would have
     // been implicitly server approved.

core/src/main/java/google/registry/flows/contact/ContactTransferRequestFlow.java

@@ -14,6 +14,7 @@
 
 package google.registry.flows.contact;
 
+import static google.registry.flows.FlowUtils.createHistoryKey;
 import static google.registry.flows.FlowUtils.validateClientIsLoggedIn;
 import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
 import static google.registry.flows.ResourceFlowUtils.verifyAuthInfo;
@@ -36,6 +37,7 @@ import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.AlreadyPendingTransferException;
 import google.registry.flows.exceptions.ObjectAlreadySponsoredException;
+import google.registry.model.contact.ContactHistory;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.metadata.MetadataExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -81,7 +83,8 @@ public final class ContactTransferRequestFlow implements TransactionalFlow {
   @Inject @ClientId String gainingClientId;
   @Inject @TargetId String targetId;
   @Inject @Config("contactAutomaticTransferLength") Duration automaticTransferLength;
-  @Inject HistoryEntry.Builder historyBuilder;
+
+  @Inject ContactHistory.Builder historyBuilder;
   @Inject Trid trid;
   @Inject EppResponse.Builder responseBuilder;
   @Inject ContactTransferRequestFlow() {}
@@ -105,11 +108,7 @@ public final class ContactTransferRequestFlow implements TransactionalFlow {
       throw new ObjectAlreadySponsoredException();
     }
     verifyNoDisallowedStatuses(existingContact, DISALLOWED_STATUSES);
-    HistoryEntry historyEntry = historyBuilder
-        .setType(HistoryEntry.Type.CONTACT_TRANSFER_REQUEST)
-        .setModificationTime(now)
-        .setParent(Key.create(existingContact))
-        .build();
+
     DateTime transferExpirationTime = now.plus(automaticTransferLength);
     ContactTransferData serverApproveTransferData =
         new ContactTransferData.Builder()
@@ -120,12 +119,18 @@ public final class ContactTransferRequestFlow implements TransactionalFlow {
             .setPendingTransferExpirationTime(transferExpirationTime)
             .setTransferStatus(TransferStatus.SERVER_APPROVED)
             .build();
+    Key<ContactHistory> contactHistoryKey = createHistoryKey(existingContact, ContactHistory.class);
+    historyBuilder
+        .setId(contactHistoryKey.getId())
+        .setType(HistoryEntry.Type.CONTACT_TRANSFER_REQUEST)
+        .setModificationTime(now);
     // If the transfer is server approved, this message will be sent to the losing registrar. */
     PollMessage serverApproveLosingPollMessage =
-        createLosingTransferPollMessage(targetId, serverApproveTransferData, historyEntry);
+        createLosingTransferPollMessage(targetId, serverApproveTransferData, contactHistoryKey);
     // If the transfer is server approved, this message will be sent to the gaining registrar. */
     PollMessage serverApproveGainingPollMessage =
-        createGainingTransferPollMessage(targetId, serverApproveTransferData, historyEntry);
+        createGainingTransferPollMessage(
+            targetId, serverApproveTransferData, now, contactHistoryKey);
     ContactTransferData pendingTransferData =
         serverApproveTransferData
             .asBuilder()
@@ -137,8 +142,9 @@ public final class ContactTransferRequestFlow implements TransactionalFlow {
             .build();
     // When a transfer is requested, a poll message is created to notify the losing registrar.
     PollMessage requestPollMessage =
-        createLosingTransferPollMessage(targetId, pendingTransferData, historyEntry).asBuilder()
-            .setEventTime(now)  // Unlike the serverApprove messages, this applies immediately.
+        createLosingTransferPollMessage(targetId, pendingTransferData, contactHistoryKey)
+            .asBuilder()
+            .setEventTime(now) // Unlike the serverApprove messages, this applies immediately.
             .build();
     ContactResource newContact = existingContact.asBuilder()
         .setTransferData(pendingTransferData)
@@ -147,7 +153,7 @@ public final class ContactTransferRequestFlow implements TransactionalFlow {
     tm().update(newContact);
     tm().insertAll(
             ImmutableSet.of(
-                historyEntry.toChildHistoryEntity(),
+                historyBuilder.setContact(newContact).build(),
                 requestPollMessage,
                 serverApproveGainingPollMessage,
                 serverApproveLosingPollMessage));

core/src/main/java/google/registry/flows/contact/ContactUpdateFlow.java

@@ -27,7 +27,6 @@ import static google.registry.flows.contact.ContactFlowUtils.validateContactAgai
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.common.collect.ImmutableSet;
-import com.googlecode.objectify.Key;
 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
 import google.registry.flows.FlowModule.ClientId;
@@ -38,6 +37,7 @@ import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ResourceHasClientUpdateProhibitedException;
 import google.registry.model.contact.ContactCommand.Update;
 import google.registry.model.contact.ContactCommand.Update.Change;
+import google.registry.model.contact.ContactHistory;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.contact.PostalInfo;
 import google.registry.model.domain.metadata.MetadataExtension;
@@ -82,7 +82,7 @@ public final class ContactUpdateFlow implements TransactionalFlow {
   @Inject @ClientId String clientId;
   @Inject @TargetId String targetId;
   @Inject @Superuser boolean isSuperuser;
-  @Inject HistoryEntry.Builder historyBuilder;
+  @Inject ContactHistory.Builder historyBuilder;
   @Inject EppResponse.Builder responseBuilder;
   @Inject ContactUpdateFlow() {}
 
@@ -102,11 +102,6 @@ public final class ContactUpdateFlow implements TransactionalFlow {
       verifyAllStatusesAreClientSettable(union(statusesToAdd, statusToRemove));
     }
     verifyNoDisallowedStatuses(existingContact, DISALLOWED_STATUSES);
-    historyBuilder
-        .setType(HistoryEntry.Type.CONTACT_UPDATE)
-        .setModificationTime(now)
-        .setXmlBytes(null)  // We don't want to store contact details in the history entry.
-        .setParent(Key.create(existingContact));
     checkSameValuesNotAddedAndRemoved(statusesToAdd, statusToRemove);
     ContactResource.Builder builder = existingContact.asBuilder();
     Change change = command.getInnerChange();
@@ -150,7 +145,12 @@ public final class ContactUpdateFlow implements TransactionalFlow {
     }
     validateAsciiPostalInfo(newContact.getInternationalizedPostalInfo());
     validateContactAgainstPolicy(newContact);
-    tm().insert(historyBuilder.build().toChildHistoryEntity());
+    historyBuilder
+        .setType(HistoryEntry.Type.CONTACT_UPDATE)
+        .setModificationTime(now)
+        .setXmlBytes(null) // We don't want to store contact details in the history entry.
+        .setContact(newContact);
+    tm().insert(historyBuilder.build());
     tm().update(newContact);
     return responseBuilder.build();
   }

core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java

@@ -502,7 +502,7 @@ public class DomainCreateFlow implements TransactionalFlow {
         .setType(HistoryEntry.Type.DOMAIN_CREATE)
         .setPeriod(period)
         .setModificationTime(now)
-        .setDomainContent(domain)
+        .setDomain(domain)
         .build();
   }
 

core/src/main/java/google/registry/flows/domain/DomainDeleteFlow.java

@@ -331,7 +331,7 @@ public final class DomainDeleteFlow implements TransactionalFlow {
     return historyBuilder
         .setType(HistoryEntry.Type.DOMAIN_DELETE)
         .setModificationTime(now)
-        .setDomainContent(domain)
+        .setDomain(domain)
         .build();
   }
 

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -25,11 +25,8 @@ import static com.google.common.collect.Iterables.any;
 import static com.google.common.collect.Sets.difference;
 import static com.google.common.collect.Sets.intersection;
 import static com.google.common.collect.Sets.union;
-import static google.registry.model.DatabaseMigrationUtils.getPrimaryDatabase;
-import static google.registry.model.common.DatabaseTransitionSchedule.PrimaryDatabase.DATASTORE;
-import static google.registry.model.common.DatabaseTransitionSchedule.TransitionId.REPLAYED_ENTITIES;
 import static google.registry.model.domain.DomainBase.MAX_REGISTRATION_YEARS;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registry.Registries.findTldForName;
 import static google.registry.model.registry.Registries.getTlds;
 import static google.registry.model.registry.Registry.TldState.GENERAL_AVAILABILITY;
@@ -1083,8 +1080,8 @@ public class DomainFlowUtils {
 
   private static List<? extends HistoryEntry> findRecentHistoryEntries(
       DomainBase domainBase, DateTime now, Duration maxSearchPeriod) {
-    if (getPrimaryDatabase(REPLAYED_ENTITIES).equals(DATASTORE)) {
-      return ofy()
+    if (tm().isOfy()) {
+      return auditedOfy()
           .load()
           .type(HistoryEntry.class)
           .ancestor(domainBase)

core/src/main/java/google/registry/flows/domain/DomainRenewFlow.java

@@ -233,7 +233,7 @@ public final class DomainRenewFlow implements TransactionalFlow {
         .setType(HistoryEntry.Type.DOMAIN_RENEW)
         .setPeriod(period)
         .setModificationTime(now)
-        .setDomainContent(newDomain)
+        .setDomain(newDomain)
         .setDomainTransactionRecords(
             ImmutableSet.of(
                 DomainTransactionRecord.create(

core/src/main/java/google/registry/flows/domain/DomainRestoreRequestFlow.java

@@ -190,7 +190,7 @@ public final class DomainRestoreRequestFlow implements TransactionalFlow  {
     return historyBuilder
         .setType(HistoryEntry.Type.DOMAIN_RESTORE)
         .setModificationTime(now)
-        .setDomainContent(newDomain)
+        .setDomain(newDomain)
         .setDomainTransactionRecords(
             ImmutableSet.of(
                 DomainTransactionRecord.create(

core/src/main/java/google/registry/flows/domain/DomainTransferApproveFlow.java

@@ -243,7 +243,7 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
         .setType(HistoryEntry.Type.DOMAIN_TRANSFER_APPROVE)
         .setModificationTime(now)
         .setOtherClientId(gainingClientId)
-        .setDomainContent(newDomain)
+        .setDomain(newDomain)
         .setDomainTransactionRecords(
             union(
                 cancelingRecords,

core/src/main/java/google/registry/flows/domain/DomainTransferCancelFlow.java

@@ -132,7 +132,7 @@ public final class DomainTransferCancelFlow implements TransactionalFlow {
     return historyBuilder
         .setType(HistoryEntry.Type.DOMAIN_TRANSFER_CANCEL)
         .setModificationTime(now)
-        .setDomainContent(newDomain)
+        .setDomain(newDomain)
         .setDomainTransactionRecords(cancelingRecords)
         .build();
   }

core/src/main/java/google/registry/flows/domain/DomainTransferRejectFlow.java

@@ -137,7 +137,7 @@ public final class DomainTransferRejectFlow implements TransactionalFlow {
             union(
                 cancelingRecords,
                 DomainTransactionRecord.create(newDomain.getTld(), now, TRANSFER_NACKED, 1)))
-        .setDomainContent(newDomain)
+        .setDomain(newDomain)
         .build();
   }
 }

core/src/main/java/google/registry/flows/domain/DomainTransferRequestFlow.java

@@ -318,7 +318,7 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
         .setType(HistoryEntry.Type.DOMAIN_TRANSFER_REQUEST)
         .setPeriod(period)
         .setModificationTime(now)
-        .setDomainContent(newDomain)
+        .setDomain(newDomain)
         .setDomainTransactionRecords(
             ImmutableSet.of(
                 DomainTransactionRecord.create(

core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java

@@ -221,7 +221,7 @@ public final class DomainUpdateFlow implements TransactionalFlow {
     return historyBuilder
         .setType(HistoryEntry.Type.DOMAIN_UPDATE)
         .setModificationTime(now)
-        .setDomainContent(newDomain)
+        .setDomain(newDomain)
         .build();
   }
 

core/src/main/java/google/registry/flows/host/HostCreateFlow.java

@@ -45,6 +45,7 @@ import google.registry.model.eppinput.ResourceCommand;
 import google.registry.model.eppoutput.CreateData.HostCreateData;
 import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.host.HostCommand.Create;
+import google.registry.model.host.HostHistory;
 import google.registry.model.host.HostResource;
 import google.registry.model.index.EppResourceIndex;
 import google.registry.model.index.ForeignKeyIndex;
@@ -85,7 +86,7 @@ public final class HostCreateFlow implements TransactionalFlow {
   @Inject ExtensionManager extensionManager;
   @Inject @ClientId String clientId;
   @Inject @TargetId String targetId;
-  @Inject HistoryEntry.Builder historyBuilder;
+  @Inject HostHistory.Builder historyBuilder;
   @Inject DnsQueue dnsQueue;
   @Inject EppResponse.Builder responseBuilder;
 
@@ -128,14 +129,11 @@ public final class HostCreateFlow implements TransactionalFlow {
             .setRepoId(createRepoId(ObjectifyService.allocateId(), roidSuffix))
             .setSuperordinateDomain(superordinateDomain.map(DomainBase::createVKey).orElse(null))
             .build();
-    historyBuilder
-        .setType(HistoryEntry.Type.HOST_CREATE)
-        .setModificationTime(now)
-        .setParent(Key.create(newHost));
+    historyBuilder.setType(HistoryEntry.Type.HOST_CREATE).setModificationTime(now).setHost(newHost);
     ImmutableSet<ImmutableObject> entitiesToSave =
         ImmutableSet.of(
             newHost,
-            historyBuilder.build().toChildHistoryEntity(),
+            historyBuilder.build(),
             ForeignKeyIndex.create(newHost, newHost.getDeletionTime()),
             EppResourceIndex.create(Key.create(newHost)));
     if (superordinateDomain.isPresent()) {

core/src/main/java/google/registry/flows/host/HostDeleteFlow.java

@@ -15,17 +15,18 @@
 package google.registry.flows.host;
 
 import static google.registry.flows.FlowUtils.validateClientIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.failfastForAsyncDelete;
+import static google.registry.flows.ResourceFlowUtils.checkLinkedDomains;
 import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
 import static google.registry.flows.ResourceFlowUtils.verifyNoDisallowedStatuses;
 import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
 import static google.registry.flows.host.HostFlowUtils.validateHostName;
+import static google.registry.model.eppoutput.Result.Code.SUCCESS;
 import static google.registry.model.eppoutput.Result.Code.SUCCESS_WITH_ACTION_PENDING;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.common.collect.ImmutableSet;
-import com.googlecode.objectify.Key;
 import google.registry.batch.AsyncTaskEnqueuer;
+import google.registry.dns.DnsQueue;
 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
 import google.registry.flows.FlowModule.ClientId;
@@ -39,8 +40,11 @@ import google.registry.model.domain.metadata.MetadataExtension;
 import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.eppcommon.Trid;
 import google.registry.model.eppoutput.EppResponse;
+import google.registry.model.eppoutput.Result;
+import google.registry.model.host.HostHistory;
 import google.registry.model.host.HostResource;
 import google.registry.model.reporting.HistoryEntry;
+import google.registry.model.reporting.HistoryEntry.Type;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import javax.inject.Inject;
 import org.joda.time.DateTime;
@@ -65,20 +69,25 @@ import org.joda.time.DateTime;
 @ReportingSpec(ActivityReportField.HOST_DELETE)
 public final class HostDeleteFlow implements TransactionalFlow {
 
-  private static final ImmutableSet<StatusValue> DISALLOWED_STATUSES = ImmutableSet.of(
-      StatusValue.CLIENT_DELETE_PROHIBITED,
-      StatusValue.PENDING_DELETE,
-      StatusValue.SERVER_DELETE_PROHIBITED);
+  private static final ImmutableSet<StatusValue> DISALLOWED_STATUSES =
+      ImmutableSet.of(
+          StatusValue.CLIENT_DELETE_PROHIBITED,
+          StatusValue.PENDING_DELETE,
+          StatusValue.SERVER_DELETE_PROHIBITED);
+
+  private static final DnsQueue dnsQueue = DnsQueue.create();
 
   @Inject ExtensionManager extensionManager;
   @Inject @ClientId String clientId;
   @Inject @TargetId String targetId;
   @Inject Trid trid;
   @Inject @Superuser boolean isSuperuser;
-  @Inject HistoryEntry.Builder historyBuilder;
+  @Inject HostHistory.Builder historyBuilder;
   @Inject AsyncTaskEnqueuer asyncTaskEnqueuer;
   @Inject EppResponse.Builder responseBuilder;
-  @Inject HostDeleteFlow() {}
+
+  @Inject
+  HostDeleteFlow() {}
 
   @Override
   public final EppResponse run() throws EppException {
@@ -87,7 +96,7 @@ public final class HostDeleteFlow implements TransactionalFlow {
     validateClientIsLoggedIn(clientId);
     DateTime now = tm().getTransactionTime();
     validateHostName(targetId);
-    failfastForAsyncDelete(targetId, now, HostResource.class, DomainBase::getNameservers);
+    checkLinkedDomains(targetId, now, HostResource.class, DomainBase::getNameservers);
     HostResource existingHost = loadAndVerifyExistence(HostResource.class, targetId, now);
     verifyNoDisallowedStatuses(existingHost, DISALLOWED_STATUSES);
     if (!isSuperuser) {
@@ -99,16 +108,31 @@ public final class HostDeleteFlow implements TransactionalFlow {
               : existingHost;
       verifyResourceOwnership(clientId, owningResource);
     }
-    asyncTaskEnqueuer.enqueueAsyncDelete(
-        existingHost, tm().getTransactionTime(), clientId, trid, isSuperuser);
-    HostResource newHost =
-        existingHost.asBuilder().addStatusValue(StatusValue.PENDING_DELETE).build();
-    historyBuilder
-        .setType(HistoryEntry.Type.HOST_PENDING_DELETE)
-        .setModificationTime(now)
-        .setParent(Key.create(existingHost));
-    tm().insert(historyBuilder.build().toChildHistoryEntity());
+    HistoryEntry.Type historyEntryType;
+    Result.Code resultCode;
+    HostResource newHost;
+    if (tm().isOfy()) {
+      asyncTaskEnqueuer.enqueueAsyncDelete(
+          existingHost, tm().getTransactionTime(), clientId, trid, isSuperuser);
+      newHost = existingHost.asBuilder().addStatusValue(StatusValue.PENDING_DELETE).build();
+      historyEntryType = Type.HOST_PENDING_DELETE;
+      resultCode = SUCCESS_WITH_ACTION_PENDING;
+    } else {
+      newHost = existingHost.asBuilder().setStatusValues(null).setDeletionTime(now).build();
+      if (existingHost.isSubordinate()) {
+        dnsQueue.addHostRefreshTask(existingHost.getHostName());
+        tm().update(
+                tm().loadByKey(existingHost.getSuperordinateDomain())
+                    .asBuilder()
+                    .removeSubordinateHost(existingHost.getHostName())
+                    .build());
+      }
+      historyEntryType = Type.HOST_DELETE;
+      resultCode = SUCCESS;
+    }
+    historyBuilder.setType(historyEntryType).setModificationTime(now).setHost(newHost);
+    tm().insert(historyBuilder.build());
     tm().update(newHost);
-    return responseBuilder.setResultFromCode(SUCCESS_WITH_ACTION_PENDING).build();
+    return responseBuilder.setResultFromCode(resultCode).build();
   }
 }

core/src/main/java/google/registry/flows/host/HostUpdateFlow.java

@@ -31,7 +31,6 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.util.CollectionUtils.isNullOrEmpty;
 
 import com.google.common.collect.ImmutableSet;
-import com.googlecode.objectify.Key;
 import google.registry.batch.AsyncTaskEnqueuer;
 import google.registry.dns.DnsQueue;
 import google.registry.flows.EppException;
@@ -55,6 +54,7 @@ import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.host.HostCommand.Update;
 import google.registry.model.host.HostCommand.Update.AddRemove;
 import google.registry.model.host.HostCommand.Update.Change;
+import google.registry.model.host.HostHistory;
 import google.registry.model.host.HostResource;
 import google.registry.model.index.ForeignKeyIndex;
 import google.registry.model.reporting.HistoryEntry;
@@ -116,7 +116,7 @@ public final class HostUpdateFlow implements TransactionalFlow {
   @Inject @ClientId String clientId;
   @Inject @TargetId String targetId;
   @Inject @Superuser boolean isSuperuser;
-  @Inject HistoryEntry.Builder historyBuilder;
+  @Inject HostHistory.Builder historyBuilder;
   @Inject AsyncTaskEnqueuer asyncTaskEnqueuer;
   @Inject DnsQueue dnsQueue;
   @Inject EppResponse.Builder responseBuilder;
@@ -205,9 +205,8 @@ public final class HostUpdateFlow implements TransactionalFlow {
         historyBuilder
             .setType(HistoryEntry.Type.HOST_UPDATE)
             .setModificationTime(now)
-            .setParent(Key.create(existingHost))
-            .build()
-            .toChildHistoryEntity());
+            .setHost(newHost)
+            .build());
     tm().updateAll(entitiesToUpdate.build());
     tm().insertAll(entitiesToInsert.build());
     return responseBuilder.build();

core/src/main/java/google/registry/keyring/kms/KmsKeyring.java

@@ -18,12 +18,9 @@ import static com.google.common.base.CaseFormat.LOWER_HYPHEN;
 import static com.google.common.base.CaseFormat.UPPER_UNDERSCORE;
 import static com.google.common.base.Preconditions.checkState;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.Streams;
 import com.google.common.flogger.FluentLogger;
 import com.googlecode.objectify.Key;
 import google.registry.config.RegistryConfig.Config;
@@ -37,7 +34,6 @@ import google.registry.privileges.secretmanager.KeyringSecretStore;
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.Optional;
-import java.util.stream.Stream;
 import javax.inject.Inject;
 import org.bouncycastle.openpgp.PGPException;
 import org.bouncycastle.openpgp.PGPKeyPair;
@@ -51,6 +47,7 @@ import org.bouncycastle.openpgp.PGPPublicKey;
  * @see <a href="https://cloud.google.com/kms/docs/">Google Cloud Key Management Service
  *     Documentation</a>
  */
+// TODO(2021-06-01): rename this class to SecretManagerKeyring and delete KmsSecretRevision
 public class KmsKeyring implements Keyring {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -208,9 +205,9 @@ public class KmsKeyring implements Keyring {
     String encryptedData;
     if (tm().isOfy()) {
       KmsSecret secret =
-          ofy().load().key(Key.create(getCrossTldKey(), KmsSecret.class, keyName)).now();
+          auditedOfy().load().key(Key.create(getCrossTldKey(), KmsSecret.class, keyName)).now();
       checkState(secret != null, "Requested secret '%s' does not exist.", keyName);
-      encryptedData = ofy().load().key(secret.getLatestRevision()).now().getEncryptedValue();
+      encryptedData = auditedOfy().load().key(secret.getLatestRevision()).now().getEncryptedValue();
     } else {
       Optional<KmsSecretRevision> revision =
           tm().transact(() -> KmsSecretRevisionSqlDao.getLatestRevision(keyName));
@@ -221,8 +218,7 @@ public class KmsKeyring implements Keyring {
     try {
       return kmsConnection.decrypt(keyName, encryptedData);
     } catch (Exception e) {
-      throw new KeyringException(
-          String.format("CloudKMS decrypt operation failed for secret %s", keyName), e);
+      return new byte[0];
     }
   }
 
@@ -230,7 +226,7 @@ public class KmsKeyring implements Keyring {
     try {
       return secretStore.getSecret(keyName);
     } catch (Exception e) {
-      return new byte[0];
+      throw new KeyringException("Failed to retrieve secret for " + keyName, e);
     }
   }
 
@@ -243,44 +239,6 @@ public class KmsKeyring implements Keyring {
       return secretStoreData;
     }
     logger.atWarning().log("Values for %s in Datastore and Secret Manager do not match.", keyName);
-    return dsData;
-  }
-
-  /**
-   * Generates the tasks to migrate secrets from Datastore to Secret Manager.
-   *
-   * <p>The keys in the returned {@link ImmutableMap} are the names of the secrets that need
-   * migration. The values in the map are {@link Runnable Runnables} that copy secret data from
-   * Datastore to Secret Manager for their corresponding keys. Only secrets that are absent in
-   * Secret Manager or have inconsistent values are included in the returned map.
-   */
-  public ImmutableMap<String, Runnable> migrationPlan() {
-
-    ImmutableMap.Builder<String, Runnable> tasks = new ImmutableMap.Builder<>();
-
-    ImmutableList<String> labels =
-        Streams.concat(
-                Stream.of(PrivateKeyLabel.values()).map(PrivateKeyLabel::getLabel),
-                Stream.of(PublicKeyLabel.values()).map(PublicKeyLabel::getLabel),
-                Stream.of(StringKeyLabel.values()).map(StringKeyLabel::getLabel))
-            .collect(ImmutableList.toImmutableList());
-
-    for (String keyName : labels) {
-      byte[] dsData;
-      try {
-        dsData = getDecryptedDataFromDatastore(keyName);
-      } catch (IllegalStateException e) {
-        logger.atWarning().log("Cannot load %s from Datastore. Skipping...", keyName);
-        continue;
-      }
-      byte[] secretStoreData = getDataFromSecretStore(keyName);
-      if (Arrays.equals(dsData, secretStoreData)) {
-        logger.atInfo().log("%s is already up to date.\n", keyName);
-        continue;
-      }
-      logger.atInfo().log("%s needs to be migrated.\n", keyName);
-      tasks.put(keyName, () -> secretStore.createOrUpdateSecret(keyName, dsData));
-    }
-    return tasks.build();
+    return secretStoreData;
   }
 }

core/src/main/java/google/registry/keyring/kms/KmsUpdater.java

@@ -36,6 +36,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
 import com.google.common.collect.ImmutableMap;
+import com.google.common.flogger.FluentLogger;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.keyring.api.KeySerializer;
 import google.registry.keyring.kms.KmsKeyring.PrivateKeyLabel;
@@ -57,7 +58,9 @@ import org.bouncycastle.openpgp.PGPPublicKey;
  * The {@link KmsUpdater} accumulates updates to a {@link KmsKeyring} and persists them to KMS and
  * Datastore when closed.
  */
+// TODO(2021-06-01): rename this class to SecretManagerKeyringUpdater
 public final class KmsUpdater {
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
   private final KmsConnection kmsConnection;
   private final KeyringSecretStore secretStore;
@@ -126,29 +129,30 @@ public final class KmsUpdater {
   }
 
   /**
-   * Generates new encryption keys in KMS, encrypts the updated secrets with them, and persists the
-   * encrypted secrets to Datastore.
+   * Persists the secrets in the Secret Manager (primary) and the Datastore (secondary).
    *
-   * <p>The operations in this method are organized so that existing {@link KmsSecretRevision}
-   * entities remain primary and decryptable if a failure occurs.
+   * <p>Updates to the Secret Manager are not transactional. If an error happens, the successful
+   * updates are not reverted; unwritten updates are aborted. This is not a problem right now, since
+   * this class is only used by the {@code UpdateKmsKeyringCommand}, which is invoked manually and
+   * only updates one secret at a time.
    */
   public void update() {
     checkState(!secretValues.isEmpty(), "At least one Keyring value must be persisted");
 
-    persistEncryptedValues(encryptValues(secretValues));
-
-    // Errors when writing to secret store can be thrown to the top, since writes are always
-    // executed by a human user using the UpdateKmsKeyringCommand.
     try {
-      secretValues
-          .entrySet()
-          .forEach(e -> secretStore.createOrUpdateSecret(e.getKey(), e.getValue()));
+      for (Map.Entry<String, byte[]> e : secretValues.entrySet()) {
+        secretStore.createOrUpdateSecret(e.getKey(), e.getValue());
+        logger.atInfo().log("Secret %s updated.", e.getKey());
+      }
     } catch (RuntimeException e) {
       throw new RuntimeException(
           "Failed to persist secrets to Secret Manager. "
               + "Please check the status of Secret Manager and re-run the command.",
           e);
     }
+
+    // TODO(2021-06-01): remove the writes to Datastore
+    persistEncryptedValues(encryptValues(secretValues));
   }
 
   /**

core/src/main/java/google/registry/mapreduce/inputs/ChildEntityReader.java

@@ -15,7 +15,7 @@
 package google.registry.mapreduce.inputs;
 
 import static google.registry.model.EntityClasses.ALL_CLASSES;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.api.datastore.Cursor;
 import com.google.appengine.api.datastore.QueryResultIterator;
@@ -232,7 +232,7 @@ class ChildEntityReader<R extends EppResource, I extends ImmutableObject> extend
     /** Query for children of the current resource and of the current child class. */
     @Override
     public QueryResultIterator<I> getQueryIterator(Cursor cursor) {
-      return startQueryAt(ofy().load().type(type).ancestor(ancestor), cursor).iterator();
+      return startQueryAt(auditedOfy().load().type(type).ancestor(ancestor), cursor).iterator();
     }
 
     @Override

core/src/main/java/google/registry/mapreduce/inputs/CommitLogManifestReader.java

@@ -14,7 +14,7 @@
 
 package google.registry.mapreduce.inputs;
 
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.api.datastore.Cursor;
 import com.google.appengine.api.datastore.QueryResultIterator;
@@ -68,7 +68,8 @@ class CommitLogManifestReader
 
   /** Query for children of this bucket. */
   Query<CommitLogManifest> createBucketQuery() {
-    Query<CommitLogManifest> query = ofy().load().type(CommitLogManifest.class).ancestor(bucketKey);
+    Query<CommitLogManifest> query =
+        auditedOfy().load().type(CommitLogManifest.class).ancestor(bucketKey);
     if (olderThan != null) {
       query = query.filterKey(
           "<",

core/src/main/java/google/registry/mapreduce/inputs/EppResourceBaseReader.java

@@ -15,7 +15,7 @@
 package google.registry.mapreduce.inputs;
 
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.api.datastore.Cursor;
 import com.google.appengine.api.datastore.QueryResultIterator;
@@ -68,7 +68,8 @@ abstract class EppResourceBaseReader<T> extends RetryingInputReader<EppResourceI
 
   /** Query for children of this bucket. */
   Query<EppResourceIndex> query() {
-    Query<EppResourceIndex> query = ofy().load().type(EppResourceIndex.class).ancestor(bucketKey);
+    Query<EppResourceIndex> query =
+        auditedOfy().load().type(EppResourceIndex.class).ancestor(bucketKey);
     return filterKinds.isEmpty() ? query : query.filter("kind in", filterKinds);
   }
 

core/src/main/java/google/registry/mapreduce/inputs/EppResourceEntityReader.java

@@ -14,7 +14,7 @@
 
 package google.registry.mapreduce.inputs;
 
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.tools.mapreduce.InputReader;
 import com.google.common.collect.ImmutableSet;
@@ -62,7 +62,7 @@ class EppResourceEntityReader<R extends EppResource> extends EppResourceBaseRead
     // Loop until we find a value, or nextQueryResult() throws a NoSuchElementException.
     while (true) {
       Key<? extends EppResource> key = nextQueryResult().getKey();
-      EppResource resource = ofy().load().key(key).now();
+      EppResource resource = auditedOfy().load().key(key).now();
       if (resource == null) {
         logger.atSevere().log("EppResourceIndex key %s points at a missing resource", key);
         continue;

core/src/main/java/google/registry/mapreduce/inputs/RetryingInputReader.java

@@ -15,7 +15,7 @@
 package google.registry.mapreduce.inputs;
 
 import static com.google.common.base.Preconditions.checkNotNull;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.api.datastore.Cursor;
 import com.google.appengine.api.datastore.DatastoreTimeoutException;
@@ -150,7 +150,7 @@ abstract class RetryingInputReader<I, T> extends InputReader<T> {
           String.format("Got an unrecoverable failure while reading item %d/%d.", loaded, total),
           e);
     } finally {
-      ofy().clearSessionCache();
+      auditedOfy().clearSessionCache();
     }
   }
 

core/src/main/java/google/registry/model/EppResource.java

@@ -137,7 +137,7 @@ public abstract class EppResource extends BackupGroupRoot implements Buildable {
 
   /** Status values associated with this resource. */
   @Column(name = "statuses")
-  // TODO(mmuller): rename to "statuses" once we're off datastore.
+  // TODO(b/177567432): rename to "statuses" once we're off datastore.
   Set<StatusValue> status;
 
   /**

core/src/main/java/google/registry/model/EppResourceUtils.java

@@ -405,15 +405,18 @@ public final class EppResourceUtils {
                           .setParameter("fkRepoId", key.getSqlKey())
                           .setParameter("now", now.toDate());
                 }
-                return (ImmutableSet<VKey<DomainBase>>)
-                    query
-                        .setMaxResults(limit)
-                        .getResultStream()
-                        .map(
-                            repoId ->
-                                DomainBase.createVKey(
-                                    Key.create(DomainBase.class, (String) repoId)))
-                        .collect(toImmutableSet());
+                @SuppressWarnings("unchecked")
+                ImmutableSet<VKey<DomainBase>> domainBaseKeySet =
+                    (ImmutableSet<VKey<DomainBase>>)
+                        query
+                            .setMaxResults(limit)
+                            .getResultStream()
+                            .map(
+                                repoId ->
+                                    DomainBase.createVKey(
+                                        Key.create(DomainBase.class, (String) repoId)))
+                            .collect(toImmutableSet());
+                return domainBaseKeySet;
               });
     }
   }

core/src/main/java/google/registry/model/ImmutableObject.java

@@ -16,7 +16,7 @@ package google.registry.model;
 
 import static com.google.common.collect.Iterables.transform;
 import static com.google.common.collect.Maps.transformValues;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static java.lang.annotation.ElementType.FIELD;
 import static java.lang.annotation.RetentionPolicy.RUNTIME;
@@ -189,7 +189,7 @@ public abstract class ImmutableObject implements Cloneable {
   private static Object hydrate(Object value) {
     if (value instanceof Key) {
       if (tm().isOfy()) {
-        return hydrate(ofy().load().key((Key<?>) value).now());
+        return hydrate(auditedOfy().load().key((Key<?>) value).now());
       }
       return value;
     } else if (value instanceof Map) {

core/src/main/java/google/registry/model/OteAccountBuilder.java

@@ -39,8 +39,8 @@ import google.registry.model.registrar.RegistrarContact;
 import google.registry.model.registry.Registry;
 import google.registry.model.registry.Registry.TldState;
 import google.registry.model.registry.label.PremiumList;
-import google.registry.model.registry.label.PremiumListDualDao;
 import google.registry.persistence.VKey;
+import google.registry.schema.tld.PremiumListDao;
 import google.registry.util.CidrAddressBlock;
 import java.util.Collection;
 import java.util.Optional;
@@ -295,7 +295,7 @@ public final class OteAccountBuilder {
       boolean isEarlyAccess,
       int roidSuffix) {
     String tldNameAlphaNumerical = tldName.replaceAll("[^a-z0-9]", "");
-    Optional<PremiumList> premiumList = PremiumListDualDao.getLatestRevision(DEFAULT_PREMIUM_LIST);
+    Optional<PremiumList> premiumList = PremiumListDao.getLatestRevision(DEFAULT_PREMIUM_LIST);
     checkState(premiumList.isPresent(), "Couldn't find premium list %s.", DEFAULT_PREMIUM_LIST);
     Registry.Builder builder =
         new Registry.Builder()

core/src/main/java/google/registry/model/contact/ContactBase.java

@@ -287,7 +287,7 @@ public class ContactBase extends EppResource implements ResourceWithTransferData
   }
 
   @Override
-  public Builder asBuilder() {
+  public Builder<? extends ContactBase, ?> asBuilder() {
     return new Builder<>(clone(this));
   }
 

core/src/main/java/google/registry/model/contact/ContactHistory.java

@@ -109,6 +109,9 @@ public class ContactHistory extends HistoryEntry implements SqlEntity {
     if (contactBase != null && contactBase.getContactId() == null) {
       contactBase = null;
     }
+    if (contactBase != null && contactBase.getRepoId() == null) {
+      contactBase = contactBase.asBuilder().setRepoId(parent.getName()).build();
+    }
   }
 
   // In Datastore, save as a HistoryEntry object regardless of this object's type
@@ -194,7 +197,7 @@ public class ContactHistory extends HistoryEntry implements SqlEntity {
       super(instance);
     }
 
-    public Builder setContactBase(@Nullable ContactBase contactBase) {
+    public Builder setContact(@Nullable ContactBase contactBase) {
       // Nullable for the sake of pre-Registry-3.0 history objects
       if (contactBase == null) {
         return this;

core/src/main/java/google/registry/model/domain/DomainBase.java

@@ -54,12 +54,16 @@ import org.joda.time.DateTime;
 @Table(
     name = "Domain",
     indexes = {
+      @Index(columnList = "adminContact"),
+      @Index(columnList = "autorenewEndTime"),
+      @Index(columnList = "billingContact"),
       @Index(columnList = "creationTime"),
       @Index(columnList = "currentSponsorRegistrarId"),
       @Index(columnList = "deletionTime"),
       @Index(columnList = "domainName"),
+      @Index(columnList = "techContact"),
       @Index(columnList = "tld"),
-      @Index(columnList = "autorenewEndTime")
+      @Index(columnList = "registrantContact")
     })
 @WithStringVKey
 @ExternalMessagingName("domain")

core/src/main/java/google/registry/model/domain/DomainContent.java

@@ -127,7 +127,7 @@ public class DomainContent extends EppResource
    *
    * @invariant fullyQualifiedDomainName == fullyQualifiedDomainName.toLowerCase(Locale.ENGLISH)
    */
-  // TODO(b/158858642): Rename this to domainName when we are off Datastore
+  // TODO(b/177567432): Rename this to domainName when we are off Datastore
   @Column(name = "domainName")
   @Index
   String fullyQualifiedDomainName;
@@ -173,8 +173,9 @@ public class DomainContent extends EppResource
   @Transient Set<DelegationSignerData> dsData;
 
   /**
-   * The claims notice supplied when this application or domain was created, if there was one. It's
-   * {@literal @}XmlTransient because it's not returned in an info response.
+   * The claims notice supplied when this domain was created, if there was one.
+   *
+   * <p>It's {@literal @}XmlTransient because it's not returned in an info response.
    */
   @IgnoreSave(IfNull.class)
   @Embedded
@@ -706,7 +707,7 @@ public class DomainContent extends EppResource
     return authInfo;
   }
 
-  /** Returns all referenced contacts from this domain or application. */
+  /** Returns all referenced contacts from this domain. */
   public ImmutableSet<VKey<ContactResource>> getReferencedContacts() {
     return nullToEmptyImmutableCopy(allContacts).stream()
         .map(DesignatedContact::getContactKey)

core/src/main/java/google/registry/model/domain/DomainHistory.java

@@ -345,7 +345,7 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {
       super(instance);
     }
 
-    public Builder setDomainContent(@Nullable DomainContent domainContent) {
+    public Builder setDomain(@Nullable DomainContent domainContent) {
       // Nullable for the sake of pre-Registry-3.0 history objects
       if (domainContent == null) {
         return this;

core/src/main/java/google/registry/model/domain/launch/LaunchPhase.java

@@ -51,8 +51,8 @@ import javax.xml.bind.annotation.XmlValue;
 public class LaunchPhase extends ImmutableObject {
 
   /**
-   * The phase during which trademark holders can submit registrations or applications with
-   * trademark information that can be validated by the server.
+   * The phase during which trademark holders can submit domain registrations with trademark
+   * information that can be validated by the server.
    */
   public static final LaunchPhase SUNRISE = create("sunrise");
 

core/src/main/java/google/registry/model/domain/secdns/DomainDsDataHistory.java

@@ -16,9 +16,7 @@ package google.registry.model.domain.secdns;
 
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.ofy.ObjectifyService;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
-import java.util.Optional;
+import google.registry.schema.replay.SqlOnlyEntity;
 import javax.persistence.Access;
 import javax.persistence.AccessType;
 import javax.persistence.Column;
@@ -27,7 +25,7 @@ import javax.persistence.Id;
 
 /** Entity class to represent a historic {@link DelegationSignerData}. */
 @Entity
-public class DomainDsDataHistory extends DomainDsDataBase implements SqlEntity {
+public class DomainDsDataHistory extends DomainDsDataBase implements SqlOnlyEntity {
 
   @Id Long dsDataHistoryRevisionId;
 
@@ -84,9 +82,4 @@ public class DomainDsDataHistory extends DomainDsDataBase implements SqlEntity {
   public byte[] getDigest() {
     return super.getDigest();
   }
-
-  @Override
-  public Optional<DatastoreEntity> toDatastoreEntity() {
-    return Optional.empty(); // Not persisted in Datastore
-  }
 }

core/src/main/java/google/registry/model/host/HostBase.java

@@ -64,7 +64,7 @@ public class HostBase extends EppResource {
    * from (creationTime, deletionTime) there can only be one host in Datastore with this name.
    * However, there can be many hosts with the same name and non-overlapping lifetimes.
    */
-  // TODO(b/158858642): Rename this to hostName when we are off Datastore
+  // TODO(b/177567432): Rename this to hostName when we are off Datastore
   @Index
   @Column(name = "hostName")
   String fullyQualifiedHostName;

core/src/main/java/google/registry/model/host/HostHistory.java

@@ -110,6 +110,9 @@ public class HostHistory extends HistoryEntry implements SqlEntity {
     if (hostBase != null && hostBase.getHostName() == null) {
       hostBase = null;
     }
+    if (hostBase != null && hostBase.getRepoId() == null) {
+      hostBase = hostBase.asBuilder().setRepoId(parent.getName()).build();
+    }
   }
 
   // In Datastore, save as a HistoryEntry object regardless of this object's type
@@ -195,7 +198,7 @@ public class HostHistory extends HistoryEntry implements SqlEntity {
       super(instance);
     }
 
-    public Builder setHostBase(@Nullable HostBase hostBase) {
+    public Builder setHost(@Nullable HostBase hostBase) {
       // Nullable for the sake of pre-Registry-3.0 history objects
       if (hostBase == null) {
         return this;

core/src/main/java/google/registry/model/index/ForeignKeyIndex.java

@@ -19,7 +19,7 @@ import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.config.RegistryConfig.getEppResourceCachingDuration;
 import static google.registry.config.RegistryConfig.getEppResourceMaxCachedEntries;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.entriesToImmutableMap;
@@ -220,8 +220,8 @@ public abstract class ForeignKeyIndex<E extends EppResource> extends BackupGroup
       Class<ForeignKeyIndex<E>> fkiClass = mapToFkiClass(clazz);
       return ImmutableMap.copyOf(
           inTransaction
-              ? ofy().load().type(fkiClass).ids(foreignKeys)
-              : tm().doTransactionless(() -> ofy().load().type(fkiClass).ids(foreignKeys)));
+              ? auditedOfy().load().type(fkiClass).ids(foreignKeys)
+              : tm().doTransactionless(() -> auditedOfy().load().type(fkiClass).ids(foreignKeys)));
     } else {
       String property = RESOURCE_CLASS_TO_FKI_PROPERTY.get(clazz);
       ImmutableList<ForeignKeyIndex<E>> indexes =
@@ -276,7 +276,7 @@ public abstract class ForeignKeyIndex<E extends EppResource> extends BackupGroup
           ImmutableSet<VKey<ForeignKeyIndex<?>>> typedKeys = ImmutableSet.copyOf(keys);
           ImmutableMap<String, ? extends ForeignKeyIndex<? extends EppResource>> existingFkis =
               loadIndexesFromStore(resourceClass, foreignKeys, false);
-          // ofy() omits keys that don't have values in Datastore, so re-add them in
+          // ofy omits keys that don't have values in Datastore, so re-add them in
           // here with Optional.empty() values.
           return Maps.asMap(
               typedKeys,

core/src/main/java/google/registry/model/ofy/AugmentedDeleter.java

@@ -27,7 +27,7 @@ import java.util.Arrays;
 import java.util.stream.Stream;
 
 /**
- * A Deleter that forwards to {@code ofy().delete()}, but can be augmented via subclassing to
+ * A Deleter that forwards to {@code auditedOfy().delete()}, but can be augmented via subclassing to
  * do custom processing on the keys to be deleted prior to their deletion.
  */
 abstract class AugmentedDeleter implements Deleter {

core/src/main/java/google/registry/model/ofy/CommitLogBucket.java

@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.DiscreteDomain.integers;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.config.RegistryConfig.getCommitLogBucketCount;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
 import com.google.common.collect.ContiguousSet;
@@ -118,7 +118,7 @@ public class CommitLogBucket extends ImmutableObject implements Buildable, Datas
 
   /** Returns the loaded bucket for the given key, or a new object if the bucket doesn't exist. */
   public static CommitLogBucket loadBucket(Key<CommitLogBucket> bucketKey) {
-    CommitLogBucket bucket = ofy().load().key(bucketKey).now();
+    CommitLogBucket bucket = auditedOfy().load().key(bucketKey).now();
     return (bucket == null)
         ? new CommitLogBucket.Builder().setBucketNum(bucketKey.getId()).build()
         : bucket;
@@ -126,7 +126,7 @@ public class CommitLogBucket extends ImmutableObject implements Buildable, Datas
 
   /** Returns the set of all loaded commit log buckets, filling in missing buckets with new ones. */
   public static ImmutableSet<CommitLogBucket> loadAllBuckets() {
-    ofy().load().keys(getAllBucketKeys());  // Load all buckets into session cache at once.
+    auditedOfy().load().keys(getAllBucketKeys()); // Load all buckets into session cache at once.
     ImmutableSet.Builder<CommitLogBucket> allBuckets = new ImmutableSet.Builder<>();
     for (Key<CommitLogBucket> key : getAllBucketKeys()) {
       allBuckets.add(loadBucket(key));

core/src/main/java/google/registry/model/ofy/CommitLogCheckpointRoot.java

@@ -14,7 +14,7 @@
 
 package google.registry.model.ofy;
 
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
 import com.googlecode.objectify.Key;
@@ -49,7 +49,7 @@ public class CommitLogCheckpointRoot extends ImmutableObject implements Datastor
   }
 
   public static CommitLogCheckpointRoot loadRoot() {
-    CommitLogCheckpointRoot root = ofy().load().key(getKey()).now();
+    CommitLogCheckpointRoot root = auditedOfy().load().key(getKey()).now();
     return root == null ? new CommitLogCheckpointRoot() : root;
   }
 

core/src/main/java/google/registry/model/ofy/CommitLogMutation.java

@@ -14,10 +14,11 @@
 
 package google.registry.model.ofy;
 
+
 import static com.google.appengine.api.datastore.EntityTranslator.convertToPb;
 import static com.google.appengine.api.datastore.EntityTranslator.createFromPbBytes;
 import static com.google.common.base.Preconditions.checkNotNull;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.api.datastore.KeyFactory;
 import com.google.common.annotations.VisibleForTesting;
@@ -66,7 +67,7 @@ public class CommitLogMutation extends ImmutableObject implements DatastoreOnlyE
    * converted to a raw Datastore Entity, serialized to bytes, and stored within the mutation.
    */
   public static CommitLogMutation create(Key<CommitLogManifest> parent, Object entity) {
-    return createFromRaw(parent, ofy().save().toEntity(entity));
+    return createFromRaw(parent, auditedOfy().save().toEntity(entity));
   }
 
   /**

core/src/main/java/google/registry/model/ofy/CommitLoggedWork.java

@@ -22,7 +22,7 @@ import static com.google.common.collect.Maps.filterKeys;
 import static com.google.common.collect.Sets.difference;
 import static com.google.common.collect.Sets.union;
 import static google.registry.model.ofy.CommitLogBucket.loadBucket;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;
 
 import com.google.common.collect.ImmutableMap;
@@ -134,7 +134,7 @@ class CommitLoggedWork<R> implements Runnable {
     // asynchronous save and delete operations that haven't been reaped, but that's ok because we
     // already logged all of those keys in {@link TransactionInfo} and now just need to figure out
     // what was loaded.
-    ImmutableSet<Key<?>> keysInSessionCache = ofy().getSessionKeys();
+    ImmutableSet<Key<?>> keysInSessionCache = auditedOfy().getSessionKeys();
     Map<Key<BackupGroupRoot>, BackupGroupRoot> rootsForTouchedKeys =
         getBackupGroupRoots(touchedKeys);
     Map<Key<BackupGroupRoot>, BackupGroupRoot> rootsForUntouchedKeys =
@@ -153,14 +153,16 @@ class CommitLoggedWork<R> implements Runnable {
             .stream()
             .map(entity -> (ImmutableObject) CommitLogMutation.create(manifestKey, entity))
             .collect(toImmutableSet());
-    ofy().saveWithoutBackup()
-      .entities(new ImmutableSet.Builder<>()
-          .add(manifest)
-          .add(bucket.asBuilder().setLastWrittenTime(info.transactionTime).build())
-          .addAll(mutations)
-          .addAll(untouchedRootsWithTouchedChildren)
-          .build())
-      .now();
+    auditedOfy()
+        .saveWithoutBackup()
+        .entities(
+            new ImmutableSet.Builder<>()
+                .add(manifest)
+                .add(bucket.asBuilder().setLastWrittenTime(info.transactionTime).build())
+                .addAll(mutations)
+                .addAll(untouchedRootsWithTouchedChildren)
+                .build())
+        .now();
     ReplayQueue.addInTests(info);
   }
 
@@ -185,8 +187,8 @@ class CommitLoggedWork<R> implements Runnable {
     Set<Key<BackupGroupRoot>> rootKeys = new HashSet<>();
     for (Key<?> key : keys) {
       while (key != null
-          && !BackupGroupRoot.class
-              .isAssignableFrom(ofy().factory().getMetadata(key).getEntityClass())) {
+          && !BackupGroupRoot.class.isAssignableFrom(
+              auditedOfy().factory().getMetadata(key).getEntityClass())) {
         key = key.getParent();
       }
       if (key != null) {
@@ -195,6 +197,6 @@ class CommitLoggedWork<R> implements Runnable {
         rootKeys.add(rootKey);
       }
     }
-    return ImmutableMap.copyOf(ofy().load().keys(rootKeys));
+    return ImmutableMap.copyOf(auditedOfy().load().keys(rootKeys));
   }
 }

core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java

@@ -14,11 +14,12 @@
 
 package google.registry.model.ofy;
 
+import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
 import com.google.common.base.Functions;
@@ -63,7 +64,7 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   private Ofy getOfy() {
-    return injectedOfy == null ? ofy() : injectedOfy;
+    return injectedOfy == null ? auditedOfy() : injectedOfy;
   }
 
   @Override
@@ -246,7 +247,7 @@ public class DatastoreTransactionManager implements TransactionManager {
 
   @Override
   public <T> T loadByEntity(T entity) {
-    return (T) toSqlEntity(ofy().load().entity(toDatastoreEntity(entity)).now());
+    return (T) toSqlEntity(auditedOfy().load().entity(toDatastoreEntity(entity)).now());
   }
 
   @Override
@@ -401,12 +402,14 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   private static class DatastoreQueryComposerImpl<T> extends QueryComposer<T> {
+
     DatastoreQueryComposerImpl(Class<T> entityClass) {
       super(entityClass);
     }
 
     Query<T> buildQuery() {
-      Query<T> result = ofy().load().type(entityClass);
+      checkOnlyOneInequalityField();
+      Query<T> result = auditedOfy().load().type(entityClass);
       for (WhereClause pred : predicates) {
         result = result.filter(pred.fieldName + pred.comparator.getDatastoreString(), pred.value);
       }
@@ -420,7 +423,7 @@ public class DatastoreTransactionManager implements TransactionManager {
 
     @Override
     public Optional<T> first() {
-      return Optional.ofNullable(buildQuery().first().now());
+      return Optional.ofNullable(buildQuery().limit(1).first().now());
     }
 
     @Override
@@ -446,8 +449,23 @@ public class DatastoreTransactionManager implements TransactionManager {
     }
 
     @Override
-    public List<T> list() {
-      return buildQuery().list();
+    public ImmutableList<T> list() {
+      return ImmutableList.copyOf(buildQuery().list());
+    }
+
+    private void checkOnlyOneInequalityField() {
+      // Datastore inequality queries are limited to one property, see
+      // https://cloud.google.com/appengine/docs/standard/go111/datastore/query-restrictions#inequality_filters_are_limited_to_at_most_one_property
+      long numInequalityFields =
+          predicates.stream()
+              .filter(pred -> !pred.comparator.equals(Comparator.EQ))
+              .map(pred -> pred.fieldName)
+              .distinct()
+              .count();
+      checkArgument(
+          numInequalityFields <= 1,
+          "Datastore cannot handle inequality queries on multiple fields, we found %s fields.",
+          numInequalityFields);
     }
   }
 }

core/src/main/java/google/registry/model/ofy/ObjectifyService.java

@@ -66,15 +66,19 @@ public class ObjectifyService {
   /** A singleton instance of our Ofy wrapper. */
   private static final Ofy OFY = new Ofy(null);
 
-  /**
-   * Returns a singleton {@link Ofy} instance.
-   *
-   * <p><b>Deprecated:</b> This will go away once everything injects {@code Ofy}.
-   */
+  /** Returns the singleton {@link Ofy} instance. */
   public static Ofy ofy() {
     return OFY;
   }
 
+  /**
+   * Returns the singleton {@link Ofy} instance, signifying that the caller has been audited for the
+   * Registry 3.0 conversion.
+   */
+  public static Ofy auditedOfy() {
+    return OFY;
+  }
+
   static {
     initOfyOnce();
   }

core/src/main/java/google/registry/model/ofy/ReplayQueue.java

@@ -15,7 +15,7 @@
 package google.registry.model.ofy;
 
 import static google.registry.model.ofy.EntityWritePriorities.getEntityPriority;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 
 import com.google.common.collect.ImmutableMap;
@@ -53,7 +53,7 @@ public class ReplayQueue {
           // not been applied.  Converting the object to an entity and then back again performs
           // those transformations so that we persist the same values to SQL that we have in
           // Datastore.
-          builder.put(entry.getKey(), ofy().toPojo(ofy().toEntity(entry.getValue())));
+          builder.put(entry.getKey(), auditedOfy().toPojo(auditedOfy().toEntity(entry.getValue())));
         }
       }
       queue.add(builder.build());

core/src/main/java/google/registry/model/ofy/TransactionInfo.java

@@ -20,7 +20,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Maps.filterValues;
 import static com.google.common.collect.Maps.toMap;
 import static google.registry.model.ofy.CommitLogBucket.getArbitraryBucketId;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableMap;
@@ -57,7 +57,7 @@ public class TransactionInfo {
 
   TransactionInfo(DateTime now) {
     this.transactionTime = now;
-    ofy().load().key(bucketKey); // Asynchronously load value into session cache.
+    auditedOfy().load().key(bucketKey); // Asynchronously load value into session cache.
   }
 
   TransactionInfo setReadOnly() {

core/src/main/java/google/registry/model/pricing/StaticPremiumListPricingEngine.java

@@ -19,7 +19,7 @@ import static google.registry.util.DomainNameUtils.getTldFromDomainName;
 
 import com.google.common.net.InternetDomainName;
 import google.registry.model.registry.Registry;
-import google.registry.model.registry.label.PremiumListDualDao;
+import google.registry.schema.tld.PremiumListDao;
 import java.util.Optional;
 import javax.inject.Inject;
 import org.joda.money.Money;
@@ -38,7 +38,8 @@ public final class StaticPremiumListPricingEngine implements PremiumPricingEngin
     String tld = getTldFromDomainName(fullyQualifiedDomainName);
     String label = InternetDomainName.from(fullyQualifiedDomainName).parts().get(0);
     Registry registry = Registry.get(checkNotNull(tld, "tld"));
-    Optional<Money> premiumPrice = PremiumListDualDao.getPremiumPrice(label, registry);
+    Optional<Money> premiumPrice =
+        PremiumListDao.getPremiumPrice(registry.getPremiumList().getName(), label);
     return DomainPrices.create(
         premiumPrice.isPresent(),
         premiumPrice.orElse(registry.getStandardCreateCost()),

core/src/main/java/google/registry/model/registrar/Registrar.java

@@ -30,7 +30,7 @@ import static com.google.common.io.BaseEncoding.base64;
 import static google.registry.config.RegistryConfig.getDefaultRegistrarWhoisServer;
 import static google.registry.model.CacheUtils.memoizeWithShortExpiration;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registry.Registries.assertTldsExist;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -236,7 +236,7 @@ public class Registrar extends ImmutableObject
    * Unique registrar client id. Must conform to "clIDType" as defined in RFC5730.
    *
    * @see <a href="http://tools.ietf.org/html/rfc5730#section-4.2">Shared Structure Schema</a>
-   *     <p>TODO(b/177568946): Rename this field to registrarId.
+   *     <p>TODO(b/177567432): Rename this field to registrarId.
    */
   @Id
   @javax.persistence.Id
@@ -301,7 +301,7 @@ public class Registrar extends ImmutableObject
   String failoverClientCertificateHash;
 
   /** An allow list of netmasks (in CIDR notation) which the client is allowed to connect from. */
-  // TODO: Rename to ipAddressAllowList once Cloud SQL migration is complete.
+  // TODO(b/177567432): Rename to ipAddressAllowList once Cloud SQL migration is complete.
   @Column(name = "ip_address_allow_list")
   List<CidrAddressBlock> ipAddressWhitelist;
 
@@ -648,7 +648,7 @@ public class Registrar extends ImmutableObject
 
   private Iterable<RegistrarContact> getContactsIterable() {
     if (tm().isOfy()) {
-      return ofy().load().type(RegistrarContact.class).ancestor(Registrar.this);
+      return auditedOfy().load().type(RegistrarContact.class).ancestor(Registrar.this);
     } else {
       return tm().transact(
               () ->

core/src/main/java/google/registry/model/registrar/RegistrarContact.java

@@ -21,7 +21,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Sets.difference;
 import static com.google.common.io.BaseEncoding.base64;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registrar.Registrar.checkValidEmail;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -69,7 +69,7 @@ import javax.persistence.Transient;
  * *MUST* also modify the persisted Registrar entity with {@link Registrar#contactsRequireSyncing}
  * set to true.
  *
- * <p>TODO(b/163366543): Rename the class name to RegistrarPoc after database migration
+ * <p>TODO(b/177567432): Rename the class name to RegistrarPoc after database migration
  */
 @ReportedOn
 @Entity
@@ -207,7 +207,11 @@ public class RegistrarContact extends ImmutableObject
               if (tm().isOfy()) {
                 ImmutableSet<Key<RegistrarContact>> existingKeys =
                     ImmutableSet.copyOf(
-                        ofy().load().type(RegistrarContact.class).ancestor(registrar).keys());
+                        auditedOfy()
+                            .load()
+                            .type(RegistrarContact.class)
+                            .ancestor(registrar)
+                            .keys());
                 tm().delete(
                         difference(
                                 existingKeys,

core/src/main/java/google/registry/model/registry/Registries.java

@@ -23,7 +23,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Maps.filterValues;
 import static google.registry.model.CacheUtils.memoizeWithShortExpiration;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.entriesToImmutableMap;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
@@ -60,7 +60,7 @@ public final class Registries {
                     () -> {
                       ImmutableSet<String> tlds =
                           tm().isOfy()
-                              ? ofy()
+                              ? auditedOfy()
                                   .load()
                                   .type(Registry.class)
                                   .ancestor(getCrossTldKey())

core/src/main/java/google/registry/model/registry/label/PremiumList.java

@@ -36,7 +36,7 @@ import google.registry.model.annotations.ReportedOn;
 import google.registry.model.registry.Registry;
 import google.registry.schema.replay.DatastoreOnlyEntity;
 import google.registry.schema.replay.NonReplicatedEntity;
-import google.registry.schema.tld.PremiumListSqlDao;
+import google.registry.schema.tld.PremiumListDao;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.math.BigDecimal;
@@ -173,7 +173,7 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
    * <p>Note that this is lazily loaded and thus will throw a {@link LazyInitializationException} if
    * used outside the transaction in which the given entity was loaded. You generally should not be
    * using this anyway as it's inefficient to load all of the PremiumEntry rows if you don't need
-   * them. To check prices, use {@link PremiumListSqlDao#getPremiumPrice} instead.
+   * them. To check prices, use {@link PremiumListDao#getPremiumPrice} instead.
    */
   @Nullable
   public ImmutableMap<String, BigDecimal> getLabelsToPrices() {

core/src/main/java/google/registry/model/registry/label/PremiumListDatastoreDao.java

@@ -1,365 +0,0 @@
-// Copyright 2021 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.registry.label;
-
-import static com.google.common.base.Preconditions.checkState;
-import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static com.google.common.collect.Iterables.partition;
-import static google.registry.config.RegistryConfig.getDomainLabelListCacheDuration;
-import static google.registry.config.RegistryConfig.getSingletonCachePersistDuration;
-import static google.registry.config.RegistryConfig.getStaticPremiumListMaxCachedEntries;
-import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
-import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.BLOOM_FILTER_NEGATIVE;
-import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.CACHED_NEGATIVE;
-import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.CACHED_POSITIVE;
-import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.UNCACHED_NEGATIVE;
-import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.UNCACHED_POSITIVE;
-import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static org.joda.time.DateTimeZone.UTC;
-
-import com.google.auto.value.AutoValue;
-import com.google.common.annotations.VisibleForTesting;
-import com.google.common.cache.CacheBuilder;
-import com.google.common.cache.CacheLoader;
-import com.google.common.cache.CacheLoader.InvalidCacheLoadException;
-import com.google.common.cache.LoadingCache;
-import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.Streams;
-import com.googlecode.objectify.Key;
-import google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome;
-import google.registry.model.registry.label.PremiumList.PremiumListEntry;
-import google.registry.model.registry.label.PremiumList.PremiumListRevision;
-import google.registry.persistence.VKey;
-import google.registry.util.NonFinalForTesting;
-import java.util.List;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.concurrent.ExecutionException;
-import org.joda.money.Money;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
-
-/**
- * DAO for {@link PremiumList} objects stored in Datastore.
- *
- * <p>This class handles both the mapping from string to Datastore-level PremiumList objects as well
- * as the mapping from PremiumList objects to the contents of those premium lists in the Datastore
- * world. Specifically, this deals with retrieving the most recent revision for a given list and
- * retrieving (or writing/deleting) all entries associated with that particular revision. The {@link
- * PremiumList} object itself, in the Datastore world, does not store the premium pricing data.
- */
-public class PremiumListDatastoreDao {
-
-  /** The number of premium list entry entities that are created and deleted per batch. */
-  private static final int TRANSACTION_BATCH_SIZE = 200;
-
-  /**
-   * In-memory cache for premium lists.
-   *
-   * <p>This is cached for a shorter duration because we need to periodically reload this entity to
-   * check if a new revision has been published, and if so, then use that.
-   *
-   * <p>We also cache the absence of premium lists with a given name to avoid unnecessary pointless
-   * lookups. Note that this cache is only applicable to PremiumList objects stored in Datastore.
-   */
-  @NonFinalForTesting
-  static LoadingCache<String, Optional<PremiumList>> premiumListCache =
-      createPremiumListCache(getDomainLabelListCacheDuration());
-
-  @VisibleForTesting
-  public static void setPremiumListCacheForTest(Optional<Duration> expiry) {
-    Duration effectiveExpiry = expiry.orElse(getSingletonCachePersistDuration());
-    premiumListCache = createPremiumListCache(effectiveExpiry);
-  }
-
-  @VisibleForTesting
-  public static LoadingCache<String, Optional<PremiumList>> createPremiumListCache(
-      Duration cachePersistDuration) {
-    return CacheBuilder.newBuilder()
-        .expireAfterWrite(java.time.Duration.ofMillis(cachePersistDuration.getMillis()))
-        .build(
-            new CacheLoader<String, Optional<PremiumList>>() {
-              @Override
-              public Optional<PremiumList> load(final String name) {
-                return tm().doTransactionless(() -> getLatestRevisionUncached(name));
-              }
-            });
-  }
-
-  /**
-   * In-memory cache for {@link PremiumListRevision}s, used for retrieving Bloom filters quickly.
-   *
-   * <p>This is cached for a long duration (essentially indefinitely) because a given {@link
-   * PremiumListRevision} is immutable and cannot ever be changed once created, so its cache need
-   * not ever expire.
-   */
-  static final LoadingCache<Key<PremiumListRevision>, PremiumListRevision>
-      premiumListRevisionsCache =
-          CacheBuilder.newBuilder()
-              .expireAfterWrite(
-                  java.time.Duration.ofMillis(getSingletonCachePersistDuration().getMillis()))
-              .build(
-                  new CacheLoader<Key<PremiumListRevision>, PremiumListRevision>() {
-                    @Override
-                    public PremiumListRevision load(final Key<PremiumListRevision> revisionKey) {
-                      return ofyTm().doTransactionless(() -> ofy().load().key(revisionKey).now());
-                    }
-                  });
-
-  /**
-   * In-memory cache for {@link PremiumListEntry}s for a given label and {@link PremiumListRevision}
-   *
-   * <p>Because the PremiumList itself makes up part of the PremiumListRevision's key, this is
-   * specific to a given premium list. Premium list entries might not be present, as indicated by
-   * the Optional wrapper, and we want to cache that as well.
-   *
-   * <p>This is cached for a long duration (essentially indefinitely) because a given {@link
-   * PremiumListRevision} and its child {@link PremiumListEntry}s are immutable and cannot ever be
-   * changed once created, so the cache need not ever expire.
-   *
-   * <p>A maximum size is set here on the cache because it can potentially grow too big to fit in
-   * memory if there are a large number of distinct premium list entries being queried (both those
-   * that exist, as well as those that might exist according to the Bloom filter, must be cached).
-   * The entries judged least likely to be accessed again will be evicted first.
-   */
-  @NonFinalForTesting
-  static LoadingCache<Key<PremiumListEntry>, Optional<PremiumListEntry>> premiumListEntriesCache =
-      createPremiumListEntriesCache(getSingletonCachePersistDuration());
-
-  @VisibleForTesting
-  public static void setPremiumListEntriesCacheForTest(Optional<Duration> expiry) {
-    Duration effectiveExpiry = expiry.orElse(getSingletonCachePersistDuration());
-    premiumListEntriesCache = createPremiumListEntriesCache(effectiveExpiry);
-  }
-
-  @VisibleForTesting
-  static LoadingCache<Key<PremiumListEntry>, Optional<PremiumListEntry>>
-      createPremiumListEntriesCache(Duration cachePersistDuration) {
-    return CacheBuilder.newBuilder()
-        .expireAfterWrite(java.time.Duration.ofMillis(cachePersistDuration.getMillis()))
-        .maximumSize(getStaticPremiumListMaxCachedEntries())
-        .build(
-            new CacheLoader<Key<PremiumListEntry>, Optional<PremiumListEntry>>() {
-              @Override
-              public Optional<PremiumListEntry> load(final Key<PremiumListEntry> entryKey) {
-                return ofyTm()
-                    .doTransactionless(() -> Optional.ofNullable(ofy().load().key(entryKey).now()));
-              }
-            });
-  }
-
-  public static Optional<PremiumList> getLatestRevision(String name) {
-    return premiumListCache.getUnchecked(name);
-  }
-
-  /**
-   * Returns the premium price for the specified list, label, and TLD, or absent if the label is not
-   * premium.
-   */
-  public static Optional<Money> getPremiumPrice(String premiumListName, String label, String tld) {
-    DateTime startTime = DateTime.now(UTC);
-    Optional<PremiumList> maybePremumList = getLatestRevision(premiumListName);
-    if (!maybePremumList.isPresent()) {
-      return Optional.empty();
-    }
-    PremiumList premiumList = maybePremumList.get();
-    // If we're dealing with a list from SQL, reload from Datastore if necessary
-    if (premiumList.getRevisionKey() == null) {
-      Optional<PremiumList> fromDatastore = getLatestRevision(premiumList.getName());
-      if (fromDatastore.isPresent()) {
-        premiumList = fromDatastore.get();
-      } else {
-        return Optional.empty();
-      }
-    }
-    PremiumListRevision revision;
-    try {
-      revision = premiumListRevisionsCache.get(premiumList.getRevisionKey());
-    } catch (InvalidCacheLoadException | ExecutionException e) {
-      throw new RuntimeException(
-          "Could not load premium list revision " + premiumList.getRevisionKey(), e);
-    }
-    checkState(
-        revision.getProbablePremiumLabels() != null,
-        "Probable premium labels Bloom filter is null on revision '%s'",
-        premiumList.getRevisionKey());
-
-    CheckResults checkResults = checkStatus(revision, label);
-    DomainLabelMetrics.recordPremiumListCheckOutcome(
-        tld,
-        premiumList.getName(),
-        checkResults.checkOutcome(),
-        DateTime.now(UTC).getMillis() - startTime.getMillis());
-
-    return checkResults.premiumPrice();
-  }
-
-  /**
-   * Persists a new or updated PremiumList object and its descendant entities to Datastore.
-   *
-   * <p>The flow here is: save the new premium list entries parented on that revision entity,
-   * save/update the PremiumList, and then delete the old premium list entries associated with the
-   * old revision.
-   *
-   * <p>This is the only valid way to save these kinds of entities!
-   */
-  public static PremiumList save(String name, List<String> inputData) {
-    PremiumList premiumList = new PremiumList.Builder().setName(name).build();
-    ImmutableMap<String, PremiumListEntry> premiumListEntries = premiumList.parse(inputData);
-    final Optional<PremiumList> oldPremiumList = getLatestRevisionUncached(premiumList.getName());
-
-    // Create the new revision (with its Bloom filter) and parent the entries on it.
-    final PremiumListRevision newRevision =
-        PremiumListRevision.create(premiumList, premiumListEntries.keySet());
-    final Key<PremiumListRevision> newRevisionKey = Key.create(newRevision);
-    ImmutableSet<PremiumListEntry> parentedEntries =
-        parentPremiumListEntriesOnRevision(premiumListEntries.values(), newRevisionKey);
-
-    // Save the new child entities in a series of transactions.
-    for (final List<PremiumListEntry> batch : partition(parentedEntries, TRANSACTION_BATCH_SIZE)) {
-      ofyTm().transactNew(() -> ofy().save().entities(batch));
-    }
-
-    // Save the new PremiumList and revision itself.
-    return ofyTm()
-        .transactNew(
-            () -> {
-              DateTime now = ofyTm().getTransactionTime();
-              // Assert that the premium list hasn't been changed since we started this process.
-              Key<PremiumList> key =
-                  Key.create(getCrossTldKey(), PremiumList.class, premiumList.getName());
-              Optional<PremiumList> existing =
-                  ofyTm().loadByKeyIfPresent(VKey.createOfy(PremiumList.class, key));
-              checkOfyFieldsEqual(existing, oldPremiumList);
-              PremiumList newList =
-                  premiumList
-                      .asBuilder()
-                      .setLastUpdateTime(now)
-                      .setCreationTime(
-                          oldPremiumList.isPresent() ? oldPremiumList.get().creationTime : now)
-                      .setRevision(newRevisionKey)
-                      .build();
-              ofy().save().entities(newList, newRevision);
-              premiumListCache.invalidate(premiumList.getName());
-              return newList;
-            });
-  }
-
-  public static void delete(PremiumList premiumList) {
-    ofyTm().transactNew(() -> ofy().delete().entity(premiumList));
-    if (premiumList.getRevisionKey() == null) {
-      return;
-    }
-    for (final List<Key<PremiumListEntry>> batch :
-        partition(
-            ofy().load().type(PremiumListEntry.class).ancestor(premiumList.revisionKey).keys(),
-            TRANSACTION_BATCH_SIZE)) {
-      ofyTm().transactNew(() -> ofy().delete().keys(batch));
-      batch.forEach(premiumListEntriesCache::invalidate);
-    }
-    ofyTm().transactNew(() -> ofy().delete().key(premiumList.getRevisionKey()));
-    premiumListCache.invalidate(premiumList.getName());
-    premiumListRevisionsCache.invalidate(premiumList.getRevisionKey());
-  }
-
-  /** Re-parents the given {@link PremiumListEntry}s on the given {@link PremiumListRevision}. */
-  @VisibleForTesting
-  public static ImmutableSet<PremiumListEntry> parentPremiumListEntriesOnRevision(
-      Iterable<PremiumListEntry> entries, final Key<PremiumListRevision> revisionKey) {
-    return Streams.stream(entries)
-        .map((PremiumListEntry entry) -> entry.asBuilder().setParent(revisionKey).build())
-        .collect(toImmutableSet());
-  }
-
-  /**
-   * Returns all {@link PremiumListEntry PremiumListEntries} in the given {@code premiumList}.
-   *
-   * <p>This is an expensive operation and should only be used when the entire list is required.
-   */
-  public static Iterable<PremiumListEntry> loadPremiumListEntriesUncached(PremiumList premiumList) {
-    return ofy().load().type(PremiumListEntry.class).ancestor(premiumList.revisionKey).iterable();
-  }
-
-  private static Optional<PremiumList> getLatestRevisionUncached(String name) {
-    return Optional.ofNullable(
-        ofy().load().key(Key.create(getCrossTldKey(), PremiumList.class, name)).now());
-  }
-
-  private static void checkOfyFieldsEqual(
-      Optional<PremiumList> oneOptional, Optional<PremiumList> twoOptional) {
-    if (!oneOptional.isPresent()) {
-      checkState(!twoOptional.isPresent(), "Premium list concurrently deleted");
-      return;
-    } else {
-      checkState(twoOptional.isPresent(), "Premium list concurrently deleted");
-    }
-    PremiumList one = oneOptional.get();
-    PremiumList two = twoOptional.get();
-    checkState(
-        Objects.equals(one.revisionKey, two.revisionKey),
-        "Premium list revision key concurrently edited");
-    checkState(Objects.equals(one.name, two.name), "Premium list name concurrently edited");
-    checkState(Objects.equals(one.parent, two.parent), "Premium list parent concurrently edited");
-    checkState(
-        Objects.equals(one.creationTime, two.creationTime),
-        "Premium list creation time concurrently edited");
-  }
-
-  private static CheckResults checkStatus(PremiumListRevision premiumListRevision, String label) {
-    if (!premiumListRevision.getProbablePremiumLabels().mightContain(label)) {
-      return CheckResults.create(BLOOM_FILTER_NEGATIVE, Optional.empty());
-    }
-
-    Key<PremiumListEntry> entryKey =
-        Key.create(Key.create(premiumListRevision), PremiumListEntry.class, label);
-    try {
-      // getIfPresent() returns null if the key is not in the cache
-      Optional<PremiumListEntry> entry = premiumListEntriesCache.getIfPresent(entryKey);
-      if (entry != null) {
-        if (entry.isPresent()) {
-          return CheckResults.create(CACHED_POSITIVE, Optional.of(entry.get().getValue()));
-        } else {
-          return CheckResults.create(CACHED_NEGATIVE, Optional.empty());
-        }
-      }
-
-      entry = premiumListEntriesCache.get(entryKey);
-      if (entry.isPresent()) {
-        return CheckResults.create(UNCACHED_POSITIVE, Optional.of(entry.get().getValue()));
-      } else {
-        return CheckResults.create(UNCACHED_NEGATIVE, Optional.empty());
-      }
-    } catch (InvalidCacheLoadException | ExecutionException e) {
-      throw new RuntimeException("Could not load premium list entry " + entryKey, e);
-    }
-  }
-
-  /** Value type class used by {@link #checkStatus} to return the results of a premiumness check. */
-  @AutoValue
-  abstract static class CheckResults {
-    static CheckResults create(PremiumListCheckOutcome checkOutcome, Optional<Money> premiumPrice) {
-      return new AutoValue_PremiumListDatastoreDao_CheckResults(checkOutcome, premiumPrice);
-    }
-
-    abstract PremiumListCheckOutcome checkOutcome();
-
-    abstract Optional<Money> premiumPrice();
-  }
-
-  private PremiumListDatastoreDao() {}
-}

core/src/main/java/google/registry/model/registry/label/PremiumListDualDao.java

@@ -1,140 +0,0 @@
-// Copyright 2021 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.registry.label;
-
-import static com.google.common.base.Preconditions.checkState;
-import static com.google.common.collect.ImmutableList.toImmutableList;
-import static google.registry.model.DatabaseMigrationUtils.suppressExceptionUnlessInTest;
-
-import com.google.common.collect.Streams;
-import google.registry.model.registry.Registry;
-import google.registry.model.registry.label.PremiumList.PremiumListEntry;
-import google.registry.schema.tld.PremiumListSqlDao;
-import java.util.List;
-import java.util.Optional;
-import org.joda.money.BigMoney;
-import org.joda.money.CurrencyUnit;
-import org.joda.money.Money;
-
-/**
- * DAO for {@link PremiumList} objects that handles the branching paths for SQL and Datastore.
- *
- * <p>For write actions, this class will perform the action against Cloud SQL then, after that
- * success or failure, against Datastore. If Datastore fails, an error is logged (but not thrown).
- *
- * <p>For read actions, when retrieving a price, we will log if the primary and secondary databases
- * have different values (or if the retrieval from Datastore fails).
- */
-public class PremiumListDualDao {
-
-  /**
-   * Retrieves from Cloud SQL and returns the most recent premium list with the given name, or
-   * absent if no such list exists.
-   */
-  public static Optional<PremiumList> getLatestRevision(String premiumListName) {
-      return PremiumListSqlDao.getLatestRevision(premiumListName);
-  }
-
-  /**
-   * Returns the premium price for the specified label and registry.
-   *
-   * <p>Returns absent if the label is not premium or there is no premium list for this registry.
-   *
-   * <p>Retrieves the price from both primary and secondary databases, and logs in the event of a
-   * failure in Datastore (but does not throw an exception).
-   */
-  public static Optional<Money> getPremiumPrice(String label, Registry registry) {
-    if (registry.getPremiumList() == null) {
-      return Optional.empty();
-    }
-    String premiumListName = registry.getPremiumList().getName();
-    Optional<Money> primaryResult;
-      primaryResult = PremiumListSqlDao.getPremiumPrice(premiumListName, label);
-    // Also load the value from Datastore, compare the two results, and log if different.
-    suppressExceptionUnlessInTest(
-        () -> {
-          Optional<Money> secondaryResult =
-              PremiumListDatastoreDao.getPremiumPrice(premiumListName, label, registry.getTldStr());
-          checkState(
-              primaryResult.equals(secondaryResult),
-              "Unequal prices for domain %s.%s from primary SQL DB (%s) and secondary Datastore db"
-                  + " (%s).",
-              label,
-              registry.getTldStr(),
-              primaryResult,
-              secondaryResult);
-        },
-        String.format(
-            "Error loading price of domain %s.%s from Datastore.", label, registry.getTldStr()));
-    return primaryResult;
-  }
-
-  /**
-   * Saves the given list data to both primary and secondary databases.
-   *
-   * <p>Logs but doesn't throw an exception in the event of a failure when writing to Datastore.
-   */
-  public static PremiumList save(String name, List<String> inputData) {
-    PremiumList result = PremiumListSqlDao.save(name, inputData);
-      suppressExceptionUnlessInTest(
-          () -> PremiumListDatastoreDao.save(name, inputData),
-          "Error when saving premium list to Datastore.");
-    return result;
-  }
-
-  /**
-   * Deletes the premium list.
-   *
-   * <p>Logs but doesn't throw an exception in the event of a failure when deleting from Datastore.
-   */
-  public static void delete(PremiumList premiumList) {
-      PremiumListSqlDao.delete(premiumList);
-      suppressExceptionUnlessInTest(
-          () -> PremiumListDatastoreDao.delete(premiumList),
-          "Error when deleting premium list from Datastore.");
-  }
-
-  /** Returns whether or not there exists a premium list with the given name. */
-  public static boolean exists(String premiumListName) {
-    // It may seem like overkill, but loading the list has ways been the way we check existence and
-    // given that we usually load the list around the time we check existence, we'll hit the cache
-    return PremiumListSqlDao.getLatestRevision(premiumListName).isPresent();
-  }
-
-  /**
-   * Returns all {@link PremiumListEntry PremiumListEntries} in the list with the given name.
-   *
-   * <p>This is an expensive operation and should only be used when the entire list is required.
-   */
-  public static Iterable<PremiumListEntry> loadAllPremiumListEntries(String premiumListName) {
-    PremiumList premiumList =
-        getLatestRevision(premiumListName)
-            .orElseThrow(
-                () ->
-                    new IllegalArgumentException(
-                        String.format("No premium list with name %s.", premiumListName)));
-      CurrencyUnit currencyUnit = premiumList.getCurrency();
-      return Streams.stream(PremiumListSqlDao.loadPremiumListEntriesUncached(premiumList))
-          .map(
-              premiumEntry ->
-                  new PremiumListEntry.Builder()
-                      .setPrice(BigMoney.of(currencyUnit, premiumEntry.getPrice()).toMoney())
-                      .setLabel(premiumEntry.getDomainLabel())
-                      .build())
-          .collect(toImmutableList());
-    }
-
-  private PremiumListDualDao() {}
-}

core/src/main/java/google/registry/model/registry/label/ReservedListSqlDao.java

@@ -23,7 +23,7 @@ import java.util.Optional;
 /**
  * A {@link ReservedList} DAO for Cloud SQL.
  *
- * <p>TODO(b/160993806): Rename this class to ReservedListDao after migrating to Cloud SQL.
+ * <p>TODO(b/177567432): Rename this class to ReservedListDao after migrating to Cloud SQL.
  */
 public class ReservedListSqlDao {
 

core/src/main/java/google/registry/model/reporting/HistoryEntry.java

@@ -14,8 +14,10 @@
 
 package google.registry.model.reporting;
 
+import static com.google.common.base.Preconditions.checkArgument;
 import static com.googlecode.objectify.Key.getKind;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableSet;
@@ -383,6 +385,13 @@ public class HistoryEntry extends ImmutableObject implements Buildable, Datastor
 
     @Override
     public T build() {
+      // TODO(mcilwain): Add null checking for id/parent once DB migration is complete.
+      checkArgumentNotNull(getInstance().type, "History entry type must be specified");
+      checkArgumentNotNull(getInstance().modificationTime, "Modification time must be specified");
+      checkArgumentNotNull(getInstance().clientId, "Registrar ID must be specified");
+      checkArgument(
+          !getInstance().type.equals(Type.SYNTHETIC) || !getInstance().requestedByRegistrar,
+          "Synthetic history entries cannot be requested by a registrar");
       return super.build();
     }
 

core/src/main/java/google/registry/model/reporting/HistoryEntryDao.java

@@ -15,7 +15,7 @@
 package google.registry.model.reporting;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
@@ -53,7 +53,7 @@ public class HistoryEntryDao {
       DateTime afterTime, DateTime beforeTime) {
     if (tm().isOfy()) {
       return Streams.stream(
-              ofy()
+              auditedOfy()
                   .load()
                   .type(HistoryEntry.class)
                   .order("modificationTime")
@@ -87,7 +87,7 @@ public class HistoryEntryDao {
       VKey<? extends EppResource> parentKey, DateTime afterTime, DateTime beforeTime) {
     if (tm().isOfy()) {
       return Streams.stream(
-              ofy()
+              auditedOfy()
                   .load()
                   .type(HistoryEntry.class)
                   .ancestor(parentKey.getOfyKey())
@@ -106,7 +106,7 @@ public class HistoryEntryDao {
   public static Iterable<? extends HistoryEntry> loadHistoryObjectsByRegistrars(
       ImmutableCollection<String> registrarIds) {
     if (tm().isOfy()) {
-      return ofy()
+      return auditedOfy()
           .load()
           .type(HistoryEntry.class)
           .filter("clientId in", registrarIds)

core/src/main/java/google/registry/model/reporting/Spec11ThreatMatch.java

@@ -21,10 +21,8 @@ import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 import com.google.common.collect.ImmutableSet;
 import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.SqlOnlyEntity;
 import google.registry.util.DomainNameUtils;
-import java.util.Optional;
 import java.util.Set;
 import javax.persistence.Column;
 import javax.persistence.Entity;
@@ -42,7 +40,7 @@ import org.joda.time.LocalDate;
       @Index(name = "spec11threatmatch_tld_idx", columnList = "tld"),
       @Index(name = "spec11threatmatch_check_date_idx", columnList = "checkDate")
     })
-public class Spec11ThreatMatch extends ImmutableObject implements Buildable, SqlEntity {
+public class Spec11ThreatMatch extends ImmutableObject implements Buildable, SqlOnlyEntity {
 
   /** The type of threat detected. */
   public enum ThreatType {
@@ -110,11 +108,6 @@ public class Spec11ThreatMatch extends ImmutableObject implements Buildable, Sql
     return tld;
   }
 
-  @Override
-  public Optional<DatastoreEntity> toDatastoreEntity() {
-    return Optional.empty(); // Not persisted in Datastore
-  }
-
   @Override
   public Builder asBuilder() {
     return new Builder(clone(this));

core/src/main/java/google/registry/model/server/KmsSecretRevision.java

@@ -49,7 +49,8 @@ import javax.persistence.Transient;
  * succeeds, we will end up with having two exact same revisions that differ only by revisionKey.
  * This is fine though, because we only use the revision with the highest revisionKey.
  *
- * <p>TODO: remove Datastore-specific fields post-Registry-3.0-migration and rename to KmsSecret.
+ * <p>TODO(b/177567432): remove Datastore-specific fields post-Registry-3.0-migration and rename to
+ * KmsSecret.
  *
  * @see <a href="https://cloud.google.com/kms/docs/">Google Cloud Key Management Service
  *     Documentation</a>
@@ -71,7 +72,7 @@ public class KmsSecretRevision extends ImmutableObject implements NonReplicatedE
   /**
    * The revision of this secret.
    *
-   * <p>TODO: change name of the variable to revisionId once we're off Datastore
+   * <p>TODO(b/177567432): change name of the variable to revisionId once we're off Datastore
    */
   @Id
   @javax.persistence.Id

core/src/main/java/google/registry/model/server/KmsSecretRevisionSqlDao.java

@@ -24,7 +24,7 @@ import java.util.Optional;
 /**
  * A {@link KmsSecretRevision} DAO for Cloud SQL.
  *
- * <p>TODO: Rename this class to KmsSecretDao after migrating to Cloud SQL.
+ * <p>TODO(b/177567432): Rename this class to KmsSecretDao after migrating to Cloud SQL.
  */
 public class KmsSecretRevisionSqlDao {
 

core/src/main/java/google/registry/model/server/Lock.java

@@ -15,8 +15,9 @@
 package google.registry.model.server;
 
 import static com.google.common.base.Preconditions.checkArgument;
-import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.isAtOrAfter;
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
 import com.google.auto.value.AutoValue;
 import com.google.common.annotations.VisibleForTesting;
@@ -29,40 +30,59 @@ import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
 import google.registry.persistence.VKey;
-import google.registry.schema.replay.DatastoreOnlyEntity;
+import google.registry.schema.replay.DatastoreAndSqlEntity;
 import google.registry.util.RequestStatusChecker;
 import google.registry.util.RequestStatusCheckerImpl;
 import java.io.Serializable;
 import java.util.Optional;
 import javax.annotation.Nullable;
+import javax.persistence.Column;
+import javax.persistence.IdClass;
+import javax.persistence.PostLoad;
+import javax.persistence.Table;
+import javax.persistence.Transient;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
 
 /**
  * A lock on some shared resource.
  *
- * <p>Locks are either specific to a tld or global to the entire system, in which case a tld of null
- * is used.
+ * <p>Locks are either specific to a tld or global to the entire system, in which case a scope of
+ * GLOBAL is used.
  *
  * <p>This is the "barebone" lock implementation, that requires manual locking and unlocking. For
  * safe calls that automatically lock and unlock, see LockHandler.
  */
 @Entity
 @NotBackedUp(reason = Reason.TRANSIENT)
-public class Lock extends ImmutableObject implements DatastoreOnlyEntity, Serializable {
+@javax.persistence.Entity
+@Table
+@IdClass(Lock.LockId.class)
+public class Lock extends ImmutableObject implements DatastoreAndSqlEntity, Serializable {
 
   private static final long serialVersionUID = 756397280691684645L;
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
-  /** Disposition of locking, for monitoring. */
-  enum LockState { IN_USE, FREE, TIMED_OUT, OWNER_DIED }
+  /**
+   * The scope of a lock that is not specific to a single tld.
+   *
+   * <p>Note: we'd use a null "tld" here for global locks, except Hibernate/Postgres don't allow for
+   * null values in primary-key columns.
+   */
+  static final String GLOBAL = "GLOBAL";
 
-  @VisibleForTesting
-  static LockMetrics lockMetrics = new LockMetrics();
+  /** Disposition of locking, for monitoring. */
+  enum LockState {
+    IN_USE,
+    FREE,
+    TIMED_OUT,
+    OWNER_DIED
+  }
+
+  @VisibleForTesting static LockMetrics lockMetrics = new LockMetrics();
 
   /** The name of the locked resource. */
-  @Id
-  String lockId;
+  @Transient @Id String lockId;
 
   /**
    * Unique log ID of the request that owns this lock.
@@ -73,58 +93,62 @@ public class Lock extends ImmutableObject implements DatastoreOnlyEntity, Serial
    * <p>See {@link RequestStatusCheckerImpl#getLogId} for details about how it's created in
    * practice.
    */
+  @Column(nullable = false)
   String requestLogId;
 
   /** When the lock can be considered implicitly released. */
+  @Column(nullable = false)
   DateTime expirationTime;
 
-  public String getRequestLogId() {
-    return requestLogId;
-  }
+  /** When was the lock acquired. Used for logging. */
+  @Column(nullable = false)
+  DateTime acquiredTime;
+
+  /** The resource name used to create the lock. */
+  @Column(nullable = false)
+  @javax.persistence.Id
+  String resourceName;
+
+  /** The tld used to create the lock, or GLOBAL if it's cross-TLD. */
+  // TODO(b/177567432): rename to "scope" post-Datastore
+  @Column(nullable = false, name = "scope")
+  @javax.persistence.Id
+  String tld;
 
   public DateTime getExpirationTime() {
     return expirationTime;
   }
 
-  public DateTime getAcquiredTime() {
-    return acquiredTime;
+  @PostLoad
+  void postLoad() {
+    lockId = makeLockId(resourceName, tld);
   }
 
-  /** When was the lock acquired. Used for logging. */
-  DateTime acquiredTime;
-
-  /** The resource name used to create lockId. */
-  String resourceName;
-
-  /** The tld used to create lockId. */
-  @Nullable
-  String tld;
-
   /**
-   * Create a new {@link Lock} for the given resource name in the specified tld (which can be null
-   * for cross-tld locks).
+   * Create a new {@link Lock} for the given resource name in the specified tld (or in the GLOBAL
+   * namespace).
    */
-  public static Lock create(
+  private static Lock create(
       String resourceName,
-      @Nullable String tld,
+      String scope,
       String requestLogId,
       DateTime acquiredTime,
       Duration leaseLength) {
     checkArgument(!Strings.isNullOrEmpty(resourceName), "resourceName cannot be null or empty");
     Lock instance = new Lock();
-    // Add the tld to the Lock's id so that it is unique for locks acquiring the same resource
+    // Add the scope to the Lock's id so that it is unique for locks acquiring the same resource
     // across different TLDs.
-    instance.lockId = makeLockId(resourceName, tld);
+    instance.lockId = makeLockId(resourceName, scope);
     instance.requestLogId = requestLogId;
     instance.expirationTime = acquiredTime.plus(leaseLength);
     instance.acquiredTime = acquiredTime;
     instance.resourceName = resourceName;
-    instance.tld = tld;
+    instance.tld = scope;
     return instance;
   }
 
-  private static String makeLockId(String resourceName, @Nullable String tld) {
-    return String.format("%s-%s", tld, resourceName);
+  private static String makeLockId(String resourceName, String scope) {
+    return String.format("%s-%s", scope, resourceName);
   }
 
   @AutoValue
@@ -186,21 +210,23 @@ public class Lock extends ImmutableObject implements DatastoreOnlyEntity, Serial
       Duration leaseLength,
       RequestStatusChecker requestStatusChecker,
       boolean checkThreadRunning) {
-    String lockId = makeLockId(resourceName, tld);
+    String scope = (tld != null) ? tld : GLOBAL;
+    String lockId = makeLockId(resourceName, scope);
     // It's important to use transactNew rather than transact, because a Lock can be used to control
     // access to resources like GCS that can't be transactionally rolled back. Therefore, the lock
     // must be definitively acquired before it is used, even when called inside another transaction.
     AcquireResult acquireResult =
-        ofyTm()
-            .transactNew(
+        tm().transactNew(
                 () -> {
-                  DateTime now = ofyTm().getTransactionTime();
+                  DateTime now = tm().getTransactionTime();
 
                   // Checking if an unexpired lock still exists - if so, the lock can't be acquired.
                   Lock lock =
-                      ofyTm()
-                          .loadByKeyIfPresent(
-                              VKey.createOfy(Lock.class, Key.create(Lock.class, lockId)))
+                      tm().loadByKeyIfPresent(
+                              VKey.create(
+                                  Lock.class,
+                                  new LockId(resourceName, scope),
+                                  Key.create(Lock.class, lockId)))
                           .orElse(null);
                   if (lock != null) {
                     logger.atInfo().log(
@@ -220,43 +246,44 @@ public class Lock extends ImmutableObject implements DatastoreOnlyEntity, Serial
                   }
 
                   Lock newLock =
-                      create(resourceName, tld, requestStatusChecker.getLogId(), now, leaseLength);
+                      create(
+                          resourceName, scope, requestStatusChecker.getLogId(), now, leaseLength);
                   // Locks are not parented under an EntityGroupRoot (so as to avoid write
-                  // contention) and
-                  // don't need to be backed up.
-                  ofyTm().putWithoutBackup(newLock);
+                  // contention) and don't need to be backed up.
+                  tm().putWithoutBackup(newLock);
 
                   return AcquireResult.create(now, lock, newLock, lockState);
                 });
 
     logAcquireResult(acquireResult);
-    lockMetrics.recordAcquire(resourceName, tld, acquireResult.lockState());
+    lockMetrics.recordAcquire(resourceName, scope, acquireResult.lockState());
     return Optional.ofNullable(acquireResult.newLock());
   }
 
   /** Release the lock. */
   public void release() {
     // Just use the default clock because we aren't actually doing anything that will use the clock.
-    ofyTm()
-        .transact(
+    tm().transact(
             () -> {
               // To release a lock, check that no one else has already obtained it and if not
               // delete it. If the lock in Datastore was different then this lock is gone already;
               // this can happen if release() is called around the expiration time and the lock
               // expires underneath us.
               Lock loadedLock =
-                  ofyTm()
-                      .loadByKeyIfPresent(
-                          VKey.createOfy(Lock.class, Key.create(Lock.class, lockId)))
+                  tm().loadByKeyIfPresent(
+                          VKey.create(
+                              Lock.class,
+                              new LockId(resourceName, tld),
+                              Key.create(Lock.class, lockId)))
                       .orElse(null);
               if (Lock.this.equals(loadedLock)) {
-                // Use noBackupOfy() so that we don't create a commit log entry for deleting the
-                // lock.
+                // Use deleteWithoutBackup() so that we don't create a commit log entry for deleting
+                // the lock.
                 logger.atInfo().log("Deleting lock: %s", lockId);
-                ofyTm().deleteWithoutBackup(Lock.this);
+                tm().deleteWithoutBackup(Lock.this);
 
                 lockMetrics.recordRelease(
-                    resourceName, tld, new Duration(acquiredTime, ofyTm().getTransactionTime()));
+                    resourceName, tld, new Duration(acquiredTime, tm().getTransactionTime()));
               } else {
                 logger.atSevere().log(
                     "The lock we acquired was transferred to someone else before we"
@@ -268,4 +295,21 @@ public class Lock extends ImmutableObject implements DatastoreOnlyEntity, Serial
               }
             });
   }
+
+  static class LockId extends ImmutableObject implements Serializable {
+
+    String resourceName;
+
+    // TODO(b/177567432): rename to "scope" post-Datastore
+    @Column(name = "scope")
+    String tld;
+
+    // Required for Hibernate
+    private LockId() {}
+
+    LockId(String resourceName, String tld) {
+      this.resourceName = checkArgumentNotNull(resourceName, "The resource name cannot be null");
+      this.tld = checkArgumentNotNull(tld, "Scope of a lock cannot be null");
+    }
+  }
 }

core/src/main/java/google/registry/model/smd/SignedMarkRevocationList.java

@@ -21,10 +21,8 @@ import static google.registry.util.DateTimeUtils.isBeforeOrAt;
 import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableMap;
 import google.registry.model.ImmutableObject;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.SqlOnlyEntity;
 import java.util.Map;
-import java.util.Optional;
 import javax.persistence.CollectionTable;
 import javax.persistence.Column;
 import javax.persistence.ElementCollection;
@@ -48,7 +46,7 @@ import org.joda.time.DateTime;
  *     functional specifications - SMD Revocation List</a>
  */
 @Entity
-public class SignedMarkRevocationList extends ImmutableObject implements SqlEntity {
+public class SignedMarkRevocationList extends ImmutableObject implements SqlOnlyEntity {
 
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
@@ -104,9 +102,4 @@ public class SignedMarkRevocationList extends ImmutableObject implements SqlEnti
     SignedMarkRevocationListDao.save(this);
     return this;
   }
-
-  @Override
-  public Optional<DatastoreEntity> toDatastoreEntity() {
-    return Optional.empty(); // Not persisted in Datastore
-  }
 }

core/src/main/java/google/registry/model/tmch/ClaimsListDualDatabaseDao.java

@@ -16,9 +16,7 @@ package google.registry.model.tmch;
 
 import static google.registry.config.RegistryConfig.getDomainLabelListCacheDuration;
 import static google.registry.model.CacheUtils.tryMemoizeWithExpiration;
-import static google.registry.model.DatabaseMigrationUtils.isDatastore;
 import static google.registry.model.DatabaseMigrationUtils.suppressExceptionUnlessInTest;
-import static google.registry.model.common.DatabaseTransitionSchedule.TransitionId.CLAIMS_LIST;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
 import com.google.common.base.Supplier;
@@ -31,12 +29,11 @@ import java.util.Optional;
 /**
  * DAO for {@link ClaimsListShard} objects that handles the branching paths for SQL and Datastore.
  *
- * <p>For write actions, this class will perform the action against the primary database then, after
- * * that success or failure, against the secondary database. If the secondary database fails, an
- * error is logged (but not thrown).
+ * <p>For write actions, this class will perform the action against Cloud SQL then, after that
+ * success or failure, against Datastore. If Datastore fails, an error is logged (but not thrown).
  *
- * <p>For read actions, we will log if the primary and secondary databases * have different values
- * (or if the retrieval from the second database fails).
+ * <p>For read actions, we will log if the two databases have different values (or if the retrieval
+ * from Datastore fails).
  */
 public class ClaimsListDualDatabaseDao {
 
@@ -48,18 +45,12 @@ public class ClaimsListDualDatabaseDao {
 
   /**
    * Saves the given {@link ClaimsListShard} to both the primary and secondary databases, logging
-   * and skipping errors in the secondary DB.
+   * and skipping errors in Datastore.
    */
   public static void save(ClaimsListShard claimsList) {
-    if (isDatastore(CLAIMS_LIST)) {
-      claimsList.saveToDatastore();
-      suppressExceptionUnlessInTest(
-          () -> ClaimsListSqlDao.save(claimsList), "Error saving ClaimsList to SQL.");
-    } else {
       ClaimsListSqlDao.save(claimsList);
       suppressExceptionUnlessInTest(
           claimsList::saveToDatastore, "Error saving ClaimsListShard to Datastore.");
-    }
   }
 
   /** Returns the most recent revision of the {@link ClaimsListShard}, from cache. */
@@ -69,42 +60,31 @@ public class ClaimsListDualDatabaseDao {
 
   /** Retrieves and compares the latest revision from the databases. */
   private static ClaimsListShard getUncached() {
-    Optional<ClaimsListShard> primaryResult;
-    if (isDatastore(CLAIMS_LIST)) {
-      primaryResult = ClaimsListShard.getFromDatastore();
-      suppressExceptionUnlessInTest(
-          () -> {
-            Optional<ClaimsListShard> secondaryResult = ClaimsListSqlDao.get();
-            compareClaimsLists(primaryResult, secondaryResult);
-          },
-          "Error loading ClaimsList from SQL.");
-    } else {
-      primaryResult = ClaimsListSqlDao.get();
-      suppressExceptionUnlessInTest(
-          () -> {
-            Optional<ClaimsListShard> secondaryResult = ClaimsListShard.getFromDatastore();
-            compareClaimsLists(primaryResult, secondaryResult);
-          },
-          "Error loading ClaimsListShard from Datastore.");
-    }
-    return primaryResult.orElse(ClaimsListShard.create(START_OF_TIME, ImmutableMap.of()));
+    Optional<ClaimsListShard> cloudSqlResult = ClaimsListSqlDao.get();
+    suppressExceptionUnlessInTest(
+        () -> {
+          Optional<ClaimsListShard> datastoreResult = ClaimsListShard.getFromDatastore();
+          compareClaimsLists(cloudSqlResult, datastoreResult);
+        },
+        "Error loading ClaimsListShard from Datastore.");
+    return cloudSqlResult.orElse(ClaimsListShard.create(START_OF_TIME, ImmutableMap.of()));
   }
 
   private static void compareClaimsLists(
-      Optional<ClaimsListShard> maybePrimary, Optional<ClaimsListShard> maybeSecondary) {
-    if (maybePrimary.isPresent() && !maybeSecondary.isPresent()) {
-      throw new IllegalStateException("Claims list found in primary DB but not in secondary DB.");
+      Optional<ClaimsListShard> maybeCloudSql, Optional<ClaimsListShard> maybeDatastore) {
+    if (maybeCloudSql.isPresent() && !maybeDatastore.isPresent()) {
+      throw new IllegalStateException("Claims list found in Cloud SQL but not in Datastore.");
     }
-    if (!maybePrimary.isPresent() && maybeSecondary.isPresent()) {
-      throw new IllegalStateException("Claims list found in secondary DB but not in primary DB.");
+    if (!maybeCloudSql.isPresent() && maybeDatastore.isPresent()) {
+      throw new IllegalStateException("Claims list found in Datastore but not in Cloud SQL.");
     }
-    if (!maybePrimary.isPresent()) {
+    if (!maybeCloudSql.isPresent()) {
       return;
     }
-    ClaimsListShard primary = maybePrimary.get();
-    ClaimsListShard secondary = maybeSecondary.get();
+    ClaimsListShard sqlList = maybeCloudSql.get();
+    ClaimsListShard datastoreList = maybeDatastore.get();
     MapDifference<String, String> diff =
-        Maps.difference(primary.labelsToKeys, secondary.getLabelsToKeys());
+        Maps.difference(sqlList.labelsToKeys, datastoreList.getLabelsToKeys());
     if (!diff.areEqual()) {
       if (diff.entriesDiffering().size()
               + diff.entriesOnlyOnRight().size()
@@ -112,9 +92,9 @@ public class ClaimsListDualDatabaseDao {
           > 10) {
         throw new IllegalStateException(
             String.format(
-                "Unequal claims lists detected, secondary list with revision id %d has %d"
-                    + " different records than the current primary list.",
-                secondary.getRevisionId(), diff.entriesDiffering().size()));
+                "Unequal claims lists detected, Datastore list with revision id %d has %d"
+                    + " different records than the current Cloud SQL list.",
+                datastoreList.getRevisionId(), diff.entriesDiffering().size()));
       } else {
         StringBuilder diffMessage = new StringBuilder("Unequal claims lists detected:\n");
         diff.entriesDiffering()
@@ -122,22 +102,22 @@ public class ClaimsListDualDatabaseDao {
                 (label, valueDiff) ->
                     diffMessage.append(
                         String.format(
-                            "Domain label %s has key %s in the primary DB and key %s "
-                                + "in the secondary DB.\n",
+                            "Domain label %s has key %s in Cloud SQL and key %s "
+                                + "in Datastore.\n",
                             label, valueDiff.leftValue(), valueDiff.rightValue())));
         diff.entriesOnlyOnLeft()
             .forEach(
                 (label, valueDiff) ->
                     diffMessage.append(
                         String.format(
-                            "Domain label %s with key %s only appears in the primary DB.\n",
+                            "Domain label %s with key %s only appears in Cloud SQL.\n",
                             label, valueDiff)));
         diff.entriesOnlyOnRight()
             .forEach(
                 (label, valueDiff) ->
                     diffMessage.append(
                         String.format(
-                            "Domain label %s with key %s only appears in the secondary DB.\n",
+                            "Domain label %s with key %s only appears in Datastore.\n",
                             label, valueDiff)));
         throw new IllegalStateException(diffMessage.toString());
       }

core/src/main/java/google/registry/model/tmch/ClaimsListShard.java

@@ -19,7 +19,7 @@ import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.base.Throwables.throwIfUnchecked;
 import static com.google.common.base.Verify.verify;
 import static google.registry.model.ofy.ObjectifyService.allocateId;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
@@ -117,7 +117,7 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
    * the DNL List creation datetime from the rfc. Since this field has been used by Datastore, we
    * cannot change its name until we finish the migration.
    *
-   * <p>TODO(b/166784536): Rename this field to tmdbGenerationTime.
+   * <p>TODO(b/177567432): Rename this field to tmdbGenerationTime.
    */
   @Column(name = "tmdb_generation_time", nullable = false)
   DateTime creationTime;
@@ -148,7 +148,7 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
     DateTime creationTime = START_OF_TIME;
     // Grab all of the keys for the shards that belong to the current revision.
     final List<Key<ClaimsListShard>> shardKeys =
-        ofy().load().type(ClaimsListShard.class).ancestor(revisionKey).keys().list();
+        auditedOfy().load().type(ClaimsListShard.class).ancestor(revisionKey).keys().list();
 
     List<ClaimsListShard> shards;
     try {
@@ -160,7 +160,7 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
                   ofyTm()
                       .transactNewReadOnly(
                           () -> {
-                            ClaimsListShard claimsListShard = ofy().load().key(key).now();
+                            ClaimsListShard claimsListShard = auditedOfy().load().key(key).now();
                             checkState(
                                 claimsListShard != null,
                                 "Key not found when loading claims list shards.");
@@ -251,7 +251,7 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
                       ClaimsListShard shard = create(creationTime, labelsToKeysShard);
                       shard.isShard = true;
                       shard.parent = parentKey;
-                      ofy().saveWithoutBackup().entity(shard);
+                      auditedOfy().saveWithoutBackup().entity(shard);
                       return shard;
                     }));
 
@@ -263,12 +263,17 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
                   (getCurrentRevision() == null && oldRevision == null)
                       || getCurrentRevision().equals(oldRevision),
                   "Registries' ClaimsList was updated by someone else while attempting to update.");
-              ofy().saveWithoutBackup().entity(ClaimsListSingleton.create(parentKey));
+              auditedOfy().saveWithoutBackup().entity(ClaimsListSingleton.create(parentKey));
               // Delete the old ClaimsListShard entities.
               if (oldRevision != null) {
-                ofy()
+                auditedOfy()
                     .deleteWithoutBackup()
-                    .keys(ofy().load().type(ClaimsListShard.class).ancestor(oldRevision).keys());
+                    .keys(
+                        auditedOfy()
+                            .load()
+                            .type(ClaimsListShard.class)
+                            .ancestor(oldRevision)
+                            .keys());
               }
             });
   }
@@ -345,7 +350,7 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
    */
   @Nullable
   public static Key<ClaimsListRevision> getCurrentRevision() {
-    ClaimsListSingleton singleton = ofy().load().entity(new ClaimsListSingleton()).now();
+    ClaimsListSingleton singleton = auditedOfy().load().entity(new ClaimsListSingleton()).now();
     return singleton == null ? null : singleton.activeRevision;
   }
 

core/src/main/java/google/registry/model/translators/CommitLogRevisionsTranslatorFactory.java

@@ -16,7 +16,7 @@ package google.registry.model.translators;
 
 import static com.google.common.base.MoreObjects.firstNonNull;
 import static google.registry.config.RegistryConfig.getCommitLogDatastoreRetention;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
@@ -68,7 +68,7 @@ public final class CommitLogRevisionsTranslatorFactory
     DateTime preThresholdTime = firstNonNull(revisions.floorKey(threshold), START_OF_TIME);
     return new ImmutableSortedMap.Builder<DateTime, Key<CommitLogManifest>>(Ordering.natural())
         .putAll(revisions.subMap(preThresholdTime, true, now.withTimeAtStartOfDay(), false))
-        .put(now, ofy().getCommitLogManifestKey())
+        .put(now, auditedOfy().getCommitLogManifestKey())
         .build();
   }
 }

core/src/main/java/google/registry/module/backend/BackendRequestComponent.java

@@ -86,6 +86,7 @@ import google.registry.tmch.TmchCrlAction;
 import google.registry.tmch.TmchDnlAction;
 import google.registry.tmch.TmchModule;
 import google.registry.tmch.TmchSmdrlAction;
+import google.registry.tools.javascrap.CreateSyntheticHistoryEntriesAction;
 
 /** Dagger component with per-request lifetime for "backend" App Engine module. */
 @RequestScope
@@ -129,6 +130,8 @@ interface BackendRequestComponent {
 
   CopyDetailReportsAction copyDetailReportAction();
 
+  CreateSyntheticHistoryEntriesAction createSyntheticHistoryEntriesAction();
+
   DeleteContactsAndHostsAction deleteContactsAndHostsAction();
 
   DeleteExpiredDomainsAction deleteExpiredDomainsAction();

core/src/main/java/google/registry/persistence/transaction/JpaTransactionManagerImpl.java

@@ -69,7 +69,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
 
   // The entity of classes in this set will be simply ignored when passed to modification
   // operations, i.e. insert, put, update and delete. This is to help maintain a single code path
-  // when we switch from ofy() to tm() for the database migration as we don't need have a condition
+  // when we switch from ofy to tm() for the database migration as we don't need have a condition
   // to exclude the Datastore specific entities when the underlying tm() is jpaTm().
   // TODO(b/176108270): Remove this property after database migration.
   private static final ImmutableSet<Class<? extends ImmutableObject>> IGNORED_ENTITY_CLASSES =
@@ -692,8 +692,14 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
 
   private static class JpaQueryComposerImpl<T> extends QueryComposer<T> {
 
+    private static final int DEFAULT_FETCH_SIZE = 1000;
+
     EntityManager em;
 
+    private int fetchSize = DEFAULT_FETCH_SIZE;
+
+    private boolean autoDetachOnLoad = true;
+
     JpaQueryComposerImpl(Class<T> entityClass, EntityManager em) {
       super(entityClass);
       this.em = em;
@@ -716,20 +722,42 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
       return em.createQuery(queryBuilder.build());
     }
 
+    @Override
+    public QueryComposer<T> withAutoDetachOnLoad(boolean autoDetachOnLoad) {
+      this.autoDetachOnLoad = autoDetachOnLoad;
+      return this;
+    }
+
+    @Override
+    public QueryComposer<T> withFetchSize(int fetchSize) {
+      checkArgument(fetchSize >= 0, "FetchSize must not be negative");
+      this.fetchSize = fetchSize;
+      return this;
+    }
+
     @Override
     public Optional<T> first() {
       List<T> results = buildQuery().setMaxResults(1).getResultList();
-      return results.size() > 0 ? Optional.of(results.get(0)) : Optional.empty();
+      return results.size() > 0 ? Optional.of(maybeDetachEntity(results.get(0))) : Optional.empty();
     }
 
     @Override
     public T getSingleResult() {
-      return buildQuery().getSingleResult();
+      return maybeDetachEntity(buildQuery().getSingleResult());
     }
 
     @Override
     public Stream<T> stream() {
-      return buildQuery().getResultStream();
+      if (fetchSize == 0) {
+        logger.atWarning().log("Query result streaming is not enabled.");
+      }
+      TypedQuery<T> query = buildQuery();
+      if (query instanceof org.hibernate.query.Query) {
+        ((org.hibernate.query.Query) query).setFetchSize(fetchSize);
+      } else {
+        logger.atWarning().log("Query implemention does not support result streaming.");
+      }
+      return query.getResultStream().map(this::maybeDetachEntity);
     }
 
     @Override
@@ -739,8 +767,17 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
     }
 
     @Override
-    public List<T> list() {
-      return buildQuery().getResultList();
+    public ImmutableList<T> list() {
+      return buildQuery().getResultList().stream()
+          .map(this::maybeDetachEntity)
+          .collect(ImmutableList.toImmutableList());
+    }
+
+    private T maybeDetachEntity(T entity) {
+      if (autoDetachOnLoad) {
+        em.detach(entity);
+      }
+      return entity;
     }
   }
 }

core/src/main/java/google/registry/persistence/transaction/QueryComposer.java

@@ -17,6 +17,7 @@ package google.registry.persistence.transaction;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 
 import com.google.common.base.Function;
+import com.google.common.collect.ImmutableList;
 import google.registry.persistence.transaction.CriteriaQueryBuilder.WhereOperator;
 import java.util.ArrayList;
 import java.util.List;
@@ -74,6 +75,34 @@ public abstract class QueryComposer<T> {
     return this;
   }
 
+  /**
+   * Applies {@code fetchSize} to the JDBC statement (by calling {@link
+   * java.sql.Statement#setFetchSize}) if the query result is accessed by the {@link #stream}
+   * method. Calling this method is optional. Children of this class will apply a default positive
+   * fetch size if the user does not provide one.
+   *
+   * <p>With many JDBC drivers, including Postgresql, a positive fetch size is required for
+   * streaming large result sets. A zero value, often the drivers' default setting, requires that
+   * the entire result set is buffered.
+   *
+   * <p>The fetch size value, the default as well as the user-provided one, will be applied if and
+   * only if the underlying query implementor supports it. The Hibernate implementations do support
+   * this.
+   */
+  public QueryComposer<T> withFetchSize(int fetchSize) {
+    return this;
+  }
+
+  /**
+   * Specifies if JPA entities should be automatically detached from the persistence context after
+   * loading. The default behavior is auto-detach.
+   *
+   * <p>This configuration has no effect on Datastore queries.
+   */
+  public QueryComposer<T> withAutoDetachOnLoad(boolean autoDetachOnLoad) {
+    return this;
+  }
+
   /** Returns the first result of the query or an empty optional if there is none. */
   public abstract Optional<T> first();
 
@@ -92,7 +121,7 @@ public abstract class QueryComposer<T> {
   public abstract long count();
 
   /** Returns the results of the query as a list. */
-  public abstract List<T> list();
+  public abstract ImmutableList<T> list();
 
   // We have to wrap the CriteriaQueryBuilder predicate factories in our own functions because at
   // the point where we pass them to the Comparator constructor, the compiler can't determine which

core/src/main/java/google/registry/persistence/transaction/Transaction.java

@@ -16,6 +16,7 @@ package google.registry.persistence.transaction;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
@@ -25,7 +26,6 @@ import com.google.common.collect.ImmutableList;
 import com.google.storage.onestore.v3.OnestoreEntity.EntityProto;
 import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
-import google.registry.model.ofy.ObjectifyService;
 import google.registry.persistence.VKey;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
@@ -214,7 +214,7 @@ public class Transaction extends ImmutableObject implements Buildable {
     @Override
     public void serializeTo(ObjectOutputStream out) throws IOException {
       out.writeObject(Type.UPDATE);
-      Entity realEntity = ObjectifyService.ofy().toEntity(entity);
+      Entity realEntity = auditedOfy().toEntity(entity);
       EntityProto proto = EntityTranslator.convertToPb(realEntity);
       out.write(VERSION_ID);
       proto.writeDelimitedTo(out);
@@ -223,7 +223,7 @@ public class Transaction extends ImmutableObject implements Buildable {
     public static Update deserializeFrom(ObjectInputStream in) throws IOException {
       EntityProto proto = new EntityProto();
       proto.parseDelimitedFrom(in);
-      return new Update(ObjectifyService.ofy().toPojo(EntityTranslator.createFromPb(proto)));
+      return new Update(auditedOfy().toPojo(EntityTranslator.createFromPb(proto)));
     }
   }
 

core/src/main/java/google/registry/persistence/transaction/TransactionEntity.java

@@ -14,9 +14,7 @@
 
 package google.registry.persistence.transaction;
 
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
-import java.util.Optional;
+import google.registry.schema.replay.SqlOnlyEntity;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
@@ -30,7 +28,7 @@ import javax.persistence.Table;
  */
 @Entity
 @Table(name = "Transaction")
-public class TransactionEntity implements SqlEntity {
+public class TransactionEntity implements SqlOnlyEntity {
 
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
@@ -44,11 +42,6 @@ public class TransactionEntity implements SqlEntity {
     this.contents = contents;
   }
 
-  @Override
-  public Optional<DatastoreEntity> toDatastoreEntity() {
-    return Optional.empty(); // Not persisted in Datastore per se
-  }
-
   public long getId() {
     return id;
   }

core/src/main/java/google/registry/persistence/transaction/TransactionManager.java

@@ -163,9 +163,9 @@ public interface TransactionManager {
    * Updates an entity in the database without writing commit logs if the underlying database is
    * Datastore.
    *
-   * <p>This method is for the sake of keeping a single code path when replacing ofy() with tm() in
-   * the application code. When the method is invoked with Datastore, it won't write the commit log
-   * backup; when invoked with Cloud SQL, it behaves the same as the method which doesn't have
+   * <p>This method is for the sake of keeping a single code path when replacing ofy calls with tm()
+   * in the application code. When the method is invoked with Datastore, it won't write the commit
+   * log backup; when invoked with Cloud SQL, it behaves the same as the method which doesn't have
    * "WithoutBackup" in its method name because it is not necessary to have the backup mechanism in
    * SQL.
    */
@@ -175,9 +175,9 @@ public interface TransactionManager {
    * Updates all entities in the database without writing any backup if the underlying database is
    * Datastore.
    *
-   * <p>This method is for the sake of keeping a single code path when replacing ofy() with tm() in
-   * the application code. When the method is invoked with Datastore, it won't write the commit log
-   * backup; when invoked with Cloud SQL, it behaves the same as the method which doesn't have
+   * <p>This method is for the sake of keeping a single code path when replacing ofy calls with tm()
+   * in the application code. When the method is invoked with Datastore, it won't write the commit
+   * log backup; when invoked with Cloud SQL, it behaves the same as the method which doesn't have
    * "WithoutBackup" in its method name because it is not necessary to have the backup mechanism in
    * SQL.
    */

core/src/main/java/google/registry/rdap/RdapDomainSearchAction.java

@@ -17,7 +17,7 @@ package google.registry.rdap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.model.index.ForeignKeyIndex.loadAndGetKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.request.Action.Method.GET;
 import static google.registry.request.Action.Method.HEAD;
@@ -206,7 +206,7 @@ public class RdapDomainSearchAction extends RdapSearchActionBase {
     RdapResultSet<DomainBase> resultSet;
     if (isDatastore()) {
       Query<DomainBase> query =
-          ofy()
+          auditedOfy()
               .load()
               .type(DomainBase.class)
               .filter("fullyQualifiedDomainName <", partialStringQuery.getNextInitialString())
@@ -261,7 +261,7 @@ public class RdapDomainSearchAction extends RdapSearchActionBase {
     int querySizeLimit = RESULT_SET_SIZE_SCALING_FACTOR * rdapResultSetMaxSize;
     RdapResultSet<DomainBase> resultSet;
     if (isDatastore()) {
-      Query<DomainBase> query = ofy().load().type(DomainBase.class).filter("tld", tld);
+      Query<DomainBase> query = auditedOfy().load().type(DomainBase.class).filter("tld", tld);
       if (cursorString.isPresent()) {
         query = query.filter("fullyQualifiedDomainName >", cursorString.get());
       }
@@ -546,7 +546,7 @@ public class RdapDomainSearchAction extends RdapSearchActionBase {
       numHostKeysSearched += chunk.size();
       if (isDatastore()) {
         Query<DomainBase> query =
-            ofy()
+            auditedOfy()
                 .load()
                 .type(DomainBase.class)
                 .filter(

core/src/main/java/google/registry/rdap/RdapSearchActionBase.java

@@ -15,7 +15,7 @@
 package google.registry.rdap;
 
 import static com.google.common.base.Charsets.UTF_8;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
 
@@ -358,7 +358,7 @@ public abstract class RdapSearchActionBase extends RdapActionBase {
               "Initial search string must be at least %d characters",
               RdapSearchPattern.MIN_INITIAL_STRING_LENGTH));
     }
-    Query<T> query = ofy().load().type(clazz);
+    Query<T> query = auditedOfy().load().type(clazz);
     if (!partialStringQuery.getHasWildcard()) {
       query = query.filter(filterField, partialStringQuery.getInitialString());
     } else {
@@ -457,7 +457,7 @@ public abstract class RdapSearchActionBase extends RdapActionBase {
               "Initial search string must be at least %d characters",
               RdapSearchPattern.MIN_INITIAL_STRING_LENGTH));
     }
-    Query<T> query = ofy().load().type(clazz).filter(filterField, queryString);
+    Query<T> query = auditedOfy().load().type(clazz).filter(filterField, queryString);
     if (cursorString.isPresent()) {
       if (cursorField.isPresent()) {
         query = query.filter(cursorField.get() + " >", cursorString.get());
@@ -526,7 +526,7 @@ public abstract class RdapSearchActionBase extends RdapActionBase {
               "Initial search string must be at least %d characters",
               RdapSearchPattern.MIN_INITIAL_STRING_LENGTH));
     }
-    Query<T> query = ofy().load().type(clazz);
+    Query<T> query = auditedOfy().load().type(clazz);
     if (!partialStringQuery.getHasWildcard()) {
       query = query.filterKey("=", Key.create(clazz, partialStringQuery.getInitialString()));
     } else {

core/src/main/java/google/registry/rde/RdeStagingMapper.java

@@ -17,7 +17,6 @@ package google.registry.rde;
 import static com.google.common.base.Strings.nullToEmpty;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.model.EppResourceUtils.loadAtPointInTime;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.appengine.tools.mapreduce.Mapper;
@@ -154,7 +153,7 @@ public final class RdeStagingMapper extends Mapper<EppResource, PendingDeposit,
     getContext().incrementCounter("fragmenter resources found", fragmenter.resourcesFound);
 
     // Avoid running out of memory.
-    ofy().clearSessionCache();
+    tm().clearSessionCache();
   }
 
   /** Loading cache that turns a resource into XML for the various points in time and modes. */

core/src/main/java/google/registry/request/auth/AuthenticatedRegistrarAccessor.java

@@ -18,7 +18,7 @@ import static com.google.common.base.MoreObjects.toStringHelper;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.Streams.stream;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.persistence.transaction.TransactionManagerUtil.transactIfJpaTm;
@@ -321,11 +321,15 @@ public class AuthenticatedRegistrarAccessor {
     // Find all registrars that have a registrar contact with this user's ID.
     if (tm().isOfy()) {
       ImmutableList<Key<Registrar>> accessibleClientIds =
-          stream(ofy().load().type(RegistrarContact.class).filter("gaeUserId", user.getUserId()))
+          stream(
+                  auditedOfy()
+                      .load()
+                      .type(RegistrarContact.class)
+                      .filter("gaeUserId", user.getUserId()))
               .map(RegistrarContact::getParent)
               .collect(toImmutableList());
       // Filter out disabled registrars (note that pending registrars still allow console login).
-      ofy().load().keys(accessibleClientIds).values().stream()
+      auditedOfy().load().keys(accessibleClientIds).values().stream()
           .filter(registrar -> registrar.getState() != State.DISABLED)
           .forEach(registrar -> builder.put(registrar.getClientId(), Role.OWNER));
     } else {

core/src/main/java/google/registry/schema/domain/RegistryLock.java

@@ -23,8 +23,7 @@ import google.registry.model.Buildable;
 import google.registry.model.CreateAutoTimestamp;
 import google.registry.model.ImmutableObject;
 import google.registry.model.UpdateAutoTimestamp;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.SqlOnlyEntity;
 import google.registry.util.DateTimeUtils;
 import java.time.ZonedDateTime;
 import java.util.Optional;
@@ -75,7 +74,7 @@ import org.joda.time.Duration;
       @Index(name = "idx_registry_lock_verification_code", columnList = "verificationCode"),
       @Index(name = "idx_registry_lock_registrar_id", columnList = "registrarId")
     })
-public final class RegistryLock extends ImmutableObject implements Buildable, SqlEntity {
+public final class RegistryLock extends ImmutableObject implements Buildable, SqlOnlyEntity {
 
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
@@ -233,11 +232,6 @@ public final class RegistryLock extends ImmutableObject implements Buildable, Sq
     return new Builder(clone(this));
   }
 
-  @Override
-  public Optional<DatastoreEntity> toDatastoreEntity() {
-    return Optional.empty(); // Not persisted in Datastore
-  }
-
   /** Builder for {@link google.registry.schema.domain.RegistryLock}. */
   public static class Builder extends Buildable.Builder<RegistryLock> {
     public Builder() {}