Glossary
SQLite WAL (TCC.db-wal)
The write-ahead log next to TCC.db that holds recent changes and, often, earlier copies of pages containing removed or changed permission rows.
In write-ahead-log mode, SQLite appends changes to a -wal file (here TCC.db-wal) and copies them into the main file at a checkpoint. The file has a 32-byte header (magic 0x377f0682 or 0x377f0683, salts, checksums) and frames of a 24-byte header plus one page. Readers use the newest committed copy of each page.
Older copies from earlier commits, and frames left from a previous WAL generation, can hold earlier versions of rows, including grants later removed. See recovering removed TCC grants from the WAL.