protocol v12 changes (/recoup split, signature changes) plus database sharding plus O(n^2)=>O(n) worst-case complexity reduction on coin balance checks

6 files changed, 2314 insertions, 1775 deletions

diff --git a/src/exchangedb/drop0001.sql b/src/exchangedb/drop0001.sql
index 3dcbb81fa..f28a6b77e 100644
--- a/src/exchangedb/drop0001.sql
+++ b/src/exchangedb/drop0001.sql
@@ -54,10 +54,21 @@ DROP TABLE IF EXISTS reserves CASCADE;
 DROP TABLE IF EXISTS denomination_revocations CASCADE;
 DROP TABLE IF EXISTS denominations CASCADE;
 
-DROP FUNCTION IF EXISTS exchange_do_withdraw(bigint,integer,bytea,bytea,bytea,bytea,bytea,bigint,bigint) ;
+DROP FUNCTION IF EXISTS exchange_do_withdraw(bigint,int,bytea,bytea,bytea,bytea,bytea,bigint,bigint) ;
 
-DROP FUNCTION IF EXISTS exchange_do_withdraw_limit_check(bigint,bigint,bigint,int) ;
+DROP FUNCTION IF EXISTS exchange_do_withdraw_limit_check(bytea,bigint,bigint,int) ;
 
+DROP FUNCTION IF EXISTS exchange_do_deposit;
+
+DROP FUNCTION IF EXISTS exchange_do_melt;
+
+DROP FUNCTION IF EXISTS exchange_do_refund;
+
+DROP FUNCTION IF EXISTS exchange_do_recoup_to_coin;
+
+DROP FUNCTION IF EXISTS exchange_do_recoup_to_reserve;
+
+-- FIXME: drop other stored functions!
 
 -- And we're out of here...
 COMMIT;
diff --git a/src/exchangedb/exchange-0001.sql b/src/exchangedb/exchange-0001.sql
index 1c532d425..33b300bc4 100644
--- a/src/exchangedb/exchange-0001.sql
+++ b/src/exchangedb/exchange-0001.sql
@@ -52,7 +52,7 @@ COMMENT ON COLUMN denominations.age_restrictions
 COMMENT ON COLUMN denominations.denominations_serial
   IS 'needed for exchange-auditor replication logic';
 
-CREATE INDEX IF NOT EXISTS denominations_expire_legal_index
+CREATE INDEX IF NOT EXISTS denominations_by_expire_legal_index
   ON denominations
   (expire_legal);
 
@@ -67,13 +67,13 @@ COMMENT ON TABLE denomination_revocations
 
 
 CREATE TABLE IF NOT EXISTS wire_targets
-(wire_target_serial_id BIGSERIAL UNIQUE
-,h_payto BYTEA NOT NULL CHECK (LENGTH(h_payto)=64)
-,payto_uri VARCHAR NOT NULL
-,kyc_ok BOOLEAN NOT NULL DEFAULT (FALSE)
-,external_id VARCHAR
-,PRIMARY KEY (h_payto)
-);
+  (wire_target_serial_id BIGSERIAL -- UNIQUE
+  ,h_payto BYTEA PRIMARY KEY CHECK (LENGTH(h_payto)=64)
+  ,payto_uri VARCHAR NOT NULL
+  ,kyc_ok BOOLEAN NOT NULL DEFAULT (FALSE)
+  ,external_id VARCHAR
+  )
+  PARTITION BY HASH (h_payto);
 COMMENT ON TABLE wire_targets
   IS 'All senders and recipients of money via the exchange';
 COMMENT ON COLUMN wire_targets.payto_uri
@@ -84,7 +84,9 @@ COMMENT ON COLUMN wire_targets.kyc_ok
   IS 'true if the KYC check was passed successfully';
 COMMENT ON COLUMN wire_targets.external_id
   IS 'Name of the user that was used for OAuth 2.0-based legitimization';
-
+CREATE TABLE IF NOT EXISTS wire_targets_default
+  PARTITION OF wire_targets
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
 
 CREATE TABLE IF NOT EXISTS reserves
   (reserve_uuid BIGSERIAL
@@ -95,122 +97,134 @@ CREATE TABLE IF NOT EXISTS reserves
   ,gc_date INT8 NOT NULL
   )
   PARTITION BY HASH (reserve_pub);
-
 COMMENT ON TABLE reserves
   IS 'Summarizes the balance of a reserve. Updated when new funds are added or withdrawn.';
+COMMENT ON COLUMN reserves.reserve_pub
+  IS 'EdDSA public key of the reserve. Knowledge of the private key implies ownership over the balance.';
+COMMENT ON COLUMN reserves.current_balance_val
+  IS 'Current balance remaining with the reserve';
 COMMENT ON COLUMN reserves.expiration_date
   IS 'Used to trigger closing of reserves that have not been drained after some time';
 COMMENT ON COLUMN reserves.gc_date
   IS 'Used to forget all information about a reserve during garbage collection';
+CREATE TABLE IF NOT EXISTS reserves_default
+  PARTITION OF reserves
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
 
-CREATE TABLE reserves_0 PARTITION OF reserves FOR VALUES WITH (MODULUS 8, REMAINDER 0);
-CREATE TABLE reserves_1 PARTITION OF reserves FOR VALUES WITH (MODULUS 8, REMAINDER 1);
-CREATE TABLE reserves_2 PARTITION OF reserves FOR VALUES WITH (MODULUS 8, REMAINDER 2);
-CREATE TABLE reserves_3 PARTITION OF reserves FOR VALUES WITH (MODULUS 8, REMAINDER 3);
-CREATE TABLE reserves_4 PARTITION OF reserves FOR VALUES WITH (MODULUS 8, REMAINDER 4);
-CREATE TABLE reserves_5 PARTITION OF reserves FOR VALUES WITH (MODULUS 8, REMAINDER 5);
-CREATE TABLE reserves_6 PARTITION OF reserves FOR VALUES WITH (MODULUS 8, REMAINDER 6);
-CREATE TABLE reserves_7 PARTITION OF reserves FOR VALUES WITH (MODULUS 8, REMAINDER 7);
-
-
-
-CREATE INDEX IF NOT EXISTS reserves_expiration_index
+CREATE INDEX IF NOT EXISTS reserves_by_expiration_index
   ON reserves
   (expiration_date
   ,current_balance_val
   ,current_balance_frac
   );
-COMMENT ON INDEX reserves_expiration_index
+COMMENT ON INDEX reserves_by_expiration_index
   IS 'used in get_expired_reserves';
-
-CREATE INDEX IF NOT EXISTS reserves_gc_index
+CREATE INDEX IF NOT EXISTS reserves_by_reserve_uuid_index
+  ON reserves
+  (reserve_uuid);
+CREATE INDEX IF NOT EXISTS reserves_by_gc_date_index
   ON reserves
   (gc_date);
-COMMENT ON INDEX reserves_gc_index
+COMMENT ON INDEX reserves_by_gc_date_index
   IS 'for reserve garbage collection';
 
 
 CREATE TABLE IF NOT EXISTS reserves_in
-  (reserve_in_serial_id BIGSERIAL UNIQUE
-  ,reserve_pub BYTEA NOT NULL REFERENCES reserves (reserve_pub) ON DELETE CASCADE
+  (reserve_in_serial_id BIGSERIAL -- UNIQUE
+  ,reserve_pub BYTEA PRIMARY KEY REFERENCES reserves (reserve_pub) ON DELETE CASCADE
   ,wire_reference INT8 NOT NULL
   ,credit_val INT8 NOT NULL
   ,credit_frac INT4 NOT NULL
-  ,wire_source_serial_id INT8 NOT NULL REFERENCES wire_targets (wire_target_serial_id)
+  ,wire_source_serial_id INT8 NOT NULL -- REFERENCES wire_targets (wire_target_serial_id)
   ,exchange_account_section TEXT NOT NULL
   ,execution_date INT8 NOT NULL
-  ,PRIMARY KEY (reserve_pub, wire_reference)
-  );
+  )
+  PARTITION BY HASH (reserve_pub);
 COMMENT ON TABLE reserves_in
   IS 'list of transfers of funds into the reserves, one per incoming wire transfer';
 COMMENT ON COLUMN reserves_in.wire_source_serial_id
   IS 'Identifies the debited bank account and KYC status';
-CREATE INDEX IF NOT EXISTS reserves_in_execution_index
+COMMENT ON COLUMN reserves_in.reserve_pub
+  IS 'Public key of the reserve. Private key signifies ownership of the remaining balance.';
+COMMENT ON COLUMN reserves_in.credit_val
+  IS 'Amount that was transferred into the reserve';
+CREATE TABLE IF NOT EXISTS reserves_in_default
+  PARTITION OF reserves_in
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
+
+CREATE INDEX IF NOT EXISTS reserves_in_by_reserve_in_serial_id_index
+  ON reserves_in
+  (reserve_in_serial_id);
+CREATE INDEX IF NOT EXISTS reserves_in_by_exchange_account_section_execution_date_index
   ON reserves_in
   (exchange_account_section
   ,execution_date
   );
-CREATE INDEX IF NOT EXISTS reserves_in_exchange_account_serial
+CREATE INDEX IF NOT EXISTS reserves_in_by_exchange_account_reserve_in_serial_id_index
   ON reserves_in
   (exchange_account_section,
   reserve_in_serial_id DESC
   );
 
 
-
 CREATE TABLE IF NOT EXISTS reserves_close
-  (close_uuid BIGSERIAL PRIMARY KEY
+  (close_uuid BIGSERIAL -- UNIQUE / PRIMARY KEY
   ,reserve_pub BYTEA NOT NULL REFERENCES reserves (reserve_pub) ON DELETE CASCADE
   ,execution_date INT8 NOT NULL
   ,wtid BYTEA NOT NULL CHECK (LENGTH(wtid)=32)
-  ,wire_target_serial_id INT8 NOT NULL REFERENCES wire_targets (wire_target_serial_id)
+  ,wire_target_serial_id INT8 NOT NULL -- REFERENCES wire_targets (wire_target_serial_id)
   ,amount_val INT8 NOT NULL
   ,amount_frac INT4 NOT NULL
   ,closing_fee_val INT8 NOT NULL
-  ,closing_fee_frac INT4 NOT NULL);
+  ,closing_fee_frac INT4 NOT NULL)
+  PARTITION BY HASH (reserve_pub);
 COMMENT ON TABLE reserves_close
   IS 'wire transfers executed by the reserve to close reserves';
 COMMENT ON COLUMN reserves_close.wire_target_serial_id
   IS 'Identifies the credited bank account (and KYC status). Note that closing does not depend on KYC.';
+CREATE TABLE IF NOT EXISTS reserves_close_default
+  PARTITION OF reserves_close
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
 
-CREATE INDEX IF NOT EXISTS reserves_close_by_uuid
+CREATE INDEX IF NOT EXISTS reserves_close_by_close_uuid_index
+  ON reserves_close
+  (close_uuid);
+CREATE INDEX IF NOT EXISTS reserves_close_by_reserve_pub_index
   ON reserves_close
   (reserve_pub);
 
 
 CREATE TABLE IF NOT EXISTS reserves_out
-  (reserve_out_serial_id BIGSERIAL UNIQUE
+  (reserve_out_serial_id BIGSERIAL -- UNIQUE
   ,h_blind_ev BYTEA PRIMARY KEY CHECK (LENGTH(h_blind_ev)=64)
   ,denominations_serial INT8 NOT NULL REFERENCES denominations (denominations_serial)
   ,denom_sig BYTEA NOT NULL
-  ,reserve_pub BYTEA NOT NULL REFERENCES reserves (reserve_pub) ON DELETE CASCADE
+  ,reserve_uuid INT8 NOT NULL -- REFERENCES reserves (reserve_uuid) ON DELETE CASCADE
   ,reserve_sig BYTEA NOT NULL CHECK (LENGTH(reserve_sig)=64)
   ,execution_date INT8 NOT NULL
   ,amount_with_fee_val INT8 NOT NULL
   ,amount_with_fee_frac INT4 NOT NULL
-  );
+  )
+  PARTITION BY HASH (h_blind_ev);
 COMMENT ON TABLE reserves_out
   IS 'Withdraw operations performed on reserves.';
 COMMENT ON COLUMN reserves_out.h_blind_ev
   IS 'Hash of the blinded coin, used as primary key here so that broken clients that use a non-random coin or blinding factor fail to withdraw (otherwise they would fail on deposit when the coin is not unique there).';
 COMMENT ON COLUMN reserves_out.denominations_serial
   IS 'We do not CASCADE ON DELETE here, we may keep the denomination data alive';
+CREATE TABLE IF NOT EXISTS reserves_out_default
+  PARTITION OF reserves_out
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
 
-CREATE INDEX IF NOT EXISTS reserves_out_reserve_pub_index
+CREATE INDEX IF NOT EXISTS reserves_out_by_reserve_out_serial_id_index
   ON reserves_out
-  (reserve_pub);
-COMMENT ON INDEX reserves_out_reserve_pub_index
-  IS 'for get_reserves_out';
-
-CREATE INDEX IF NOT EXISTS reserves_out_execution_date
+  (reserve_out_serial_id);
+CREATE INDEX IF NOT EXISTS reserves_out_by_reserve_uuid_and_execution_date_index
   ON reserves_out
-  (execution_date);
+  (reserve_uuid, execution_date);
+COMMENT ON INDEX reserves_out_by_reserve_uuid_and_execution_date_index
+  IS 'for get_reserves_out and exchange_do_withdraw_limit_check';
 
-CREATE INDEX IF NOT EXISTS reserves_out_for_get_withdraw_info
-  ON reserves_out
-  (denominations_serial
-  ,h_blind_ev
-  );
 
 CREATE TABLE IF NOT EXISTS auditors
   (auditor_uuid BIGSERIAL UNIQUE
@@ -297,67 +311,78 @@ COMMENT ON COLUMN extensions.config
 
 
 CREATE TABLE IF NOT EXISTS known_coins
-  (known_coin_id BIGSERIAL UNIQUE
+  (known_coin_id BIGSERIAL -- UNIQUE
+  ,denominations_serial INT8 NOT NULL REFERENCES denominations (denominations_serial) ON DELETE CASCADE
   ,coin_pub BYTEA NOT NULL PRIMARY KEY CHECK (LENGTH(coin_pub)=32)
   ,age_hash BYTEA CHECK (LENGTH(age_hash)=32)
-  ,denominations_serial INT8 NOT NULL REFERENCES denominations (denominations_serial) ON DELETE CASCADE
   ,denom_sig BYTEA NOT NULL
-  );
+  ,remaining_val INT8 NOT NULL
+  ,remaining_frac INT4 NOT NULL
+  )
+  PARTITION BY HASH (coin_pub); -- FIXME: or include denominations_serial? or multi-level partitioning?
 COMMENT ON TABLE known_coins
   IS 'information about coins and their signatures, so we do not have to store the signatures more than once if a coin is involved in multiple operations';
+COMMENT ON COLUMN known_coins.denominations_serial
+  IS 'Denomination of the coin, determines the value of the original coin and applicable fees for coin-specific operations.';
 COMMENT ON COLUMN known_coins.coin_pub
   IS 'EdDSA public key of the coin';
+COMMENT ON COLUMN known_coins.remaining_val
+  IS 'Value of the coin that remains to be spent';
 COMMENT ON COLUMN known_coins.age_hash
   IS 'Optional hash for age restrictions as per DD 24 (active if denom_type has the respective bit set)';
 COMMENT ON COLUMN known_coins.denom_sig
   IS 'This is the signature of the exchange that affirms that the coin is a valid coin. The specific signature type depends on denom_type of the denomination.';
+CREATE TABLE IF NOT EXISTS known_coins_default
+  PARTITION OF known_coins
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
 
-CREATE INDEX IF NOT EXISTS known_coins_by_denomination
+CREATE INDEX IF NOT EXISTS known_coins_by_known_coin_id_index
   ON known_coins
-  (denominations_serial);
-CREATE INDEX IF NOT EXISTS known_coins_by_hashed_coin_pub
-  ON known_coins
-  USING HASH (coin_pub);
+  (known_coin_id);
 
 
 CREATE TABLE IF NOT EXISTS refresh_commitments
-  (melt_serial_id BIGSERIAL UNIQUE
+  (melt_serial_id BIGSERIAL -- UNIQUE
   ,rc BYTEA PRIMARY KEY CHECK (LENGTH(rc)=64)
-  ,old_known_coin_id INT8 NOT NULL REFERENCES known_coins (known_coin_id) ON DELETE CASCADE
+  ,old_coin_pub BYTEA NOT NULL REFERENCES known_coins (coin_pub) ON DELETE CASCADE
   ,old_coin_sig BYTEA NOT NULL CHECK(LENGTH(old_coin_sig)=64)
   ,amount_with_fee_val INT8 NOT NULL
   ,amount_with_fee_frac INT4 NOT NULL
   ,noreveal_index INT4 NOT NULL
-  );
+  )
+  PARTITION BY HASH (rc);
 COMMENT ON TABLE refresh_commitments
   IS 'Commitments made when melting coins and the gamma value chosen by the exchange.';
 COMMENT ON COLUMN refresh_commitments.noreveal_index
   IS 'The gamma value chosen by the exchange in the cut-and-choose protocol';
 COMMENT ON COLUMN refresh_commitments.rc
   IS 'Commitment made by the client, hash over the various client inputs in the cut-and-choose protocol';
-COMMENT ON COLUMN refresh_commitments.old_known_coin_id
+COMMENT ON COLUMN refresh_commitments.old_coin_pub
   IS 'Coin being melted in the refresh process.';
+CREATE TABLE IF NOT EXISTS refresh_commitments_default
+  PARTITION OF refresh_commitments
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
 
-CREATE INDEX IF NOT EXISTS refresh_commitments_old_coin_id_index
+CREATE INDEX IF NOT EXISTS refresh_commitments_by_melt_serial_id_index
   ON refresh_commitments
-  (old_known_coin_id);
-CREATE INDEX IF NOT EXISTS known_coins_by_hashed_rc
+  (melt_serial_id);
+CREATE INDEX IF NOT EXISTS refresh_commitments_by_old_coin_pub_index
   ON refresh_commitments
-  USING HASH (rc);
+  (old_coin_pub);
 
 
 CREATE TABLE IF NOT EXISTS refresh_revealed_coins
-  (rrc_serial BIGSERIAL UNIQUE
-  ,melt_serial_id INT8 NOT NULL REFERENCES refresh_commitments (melt_serial_id) ON DELETE CASCADE
+  (rrc_serial BIGSERIAL -- UNIQUE
+  ,melt_serial_id INT8 NOT NULL -- REFERENCES refresh_commitments (melt_serial_id) ON DELETE CASCADE
   ,freshcoin_index INT4 NOT NULL
   ,link_sig BYTEA NOT NULL CHECK(LENGTH(link_sig)=64)
   ,denominations_serial INT8 NOT NULL REFERENCES denominations (denominations_serial) ON DELETE CASCADE
-  ,coin_ev BYTEA UNIQUE NOT NULL
-  ,h_coin_ev BYTEA NOT NULL CHECK(LENGTH(h_coin_ev)=64)
+  ,coin_ev BYTEA NOT NULL -- UNIQUE
+  ,h_coin_ev BYTEA NOT NULL CHECK(LENGTH(h_coin_ev)=64) -- UNIQUE
   ,ev_sig BYTEA NOT NULL
-  ,PRIMARY KEY (melt_serial_id, freshcoin_index)
-  ,UNIQUE (h_coin_ev)
-  );
+  --  ,PRIMARY KEY (melt_serial_id, freshcoin_index) -- done per shard
+  )
+  PARTITION BY HASH (melt_serial_id);
 COMMENT ON TABLE refresh_revealed_coins
   IS 'Revelations about the new coins that are to be created during a melting session.';
 COMMENT ON COLUMN refresh_revealed_coins.rrc_serial
@@ -372,18 +397,28 @@ COMMENT ON COLUMN refresh_revealed_coins.h_coin_ev
   IS 'hash of the envelope of the new coin to be signed (for lookups)';
 COMMENT ON COLUMN refresh_revealed_coins.ev_sig
   IS 'exchange signature over the envelope';
-
-CREATE INDEX IF NOT EXISTS refresh_revealed_coins_denominations_index
+CREATE TABLE IF NOT EXISTS refresh_revealed_coins_default
+  PARTITION OF refresh_revealed_coins
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
+-- We do require this primary key on each shard!
+ALTER TABLE refresh_revealed_coins_default
+  ADD PRIMARY KEY (melt_serial_id, freshcoin_index);
+
+CREATE INDEX IF NOT EXISTS refresh_revealed_coins_by_rrc_serial_index
   ON refresh_revealed_coins
-  (denominations_serial);
+  (rrc_serial);
+CREATE INDEX IF NOT EXISTS refresh_revealed_coins_by_melt_serial_id_index
+  ON refresh_revealed_coins
+  (melt_serial_id);
 
 
 CREATE TABLE IF NOT EXISTS refresh_transfer_keys
-  (rtc_serial BIGSERIAL UNIQUE
-  ,melt_serial_id INT8 PRIMARY KEY REFERENCES refresh_commitments (melt_serial_id) ON DELETE CASCADE
+  (rtc_serial BIGSERIAL -- UNIQUE
+  ,melt_serial_id INT8 PRIMARY KEY -- REFERENCES refresh_commitments (melt_serial_id) ON DELETE CASCADE
   ,transfer_pub BYTEA NOT NULL CHECK(LENGTH(transfer_pub)=32)
   ,transfer_privs BYTEA NOT NULL
-  );
+  )
+  PARTITION BY HASH (melt_serial_id);
 COMMENT ON TABLE refresh_transfer_keys
   IS 'Transfer keys of a refresh operation (the data revealed to the exchange).';
 COMMENT ON COLUMN refresh_transfer_keys.rtc_serial
@@ -394,14 +429,14 @@ COMMENT ON COLUMN refresh_transfer_keys.transfer_pub
   IS 'transfer public key for the gamma index';
 COMMENT ON COLUMN refresh_transfer_keys.transfer_privs
   IS 'array of TALER_CNC_KAPPA - 1 transfer private keys that have been revealed, with the gamma entry being skipped';
+CREATE TABLE IF NOT EXISTS refresh_transfer_keys_default
+  PARTITION OF refresh_transfer_keys
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
 
-CREATE INDEX IF NOT EXISTS refresh_transfer_keys_coin_tpub
+CREATE INDEX IF NOT EXISTS refresh_transfer_keys_by_rtc_serial_index
   ON refresh_transfer_keys
-  (melt_serial_id
-  ,transfer_pub
-  );
-COMMENT ON INDEX refresh_transfer_keys_coin_tpub
-  IS 'for get_link (unsure if this helps or hurts for performance as there should be very few transfer public keys per rc, but at least in theory this helps the ORDER BY clause)';
+  (rtc_serial);
+
 
 CREATE TABLE IF NOT EXISTS extension_details
   (extension_details_serial_id BIGSERIAL PRIMARY KEY
@@ -413,9 +448,9 @@ COMMENT ON COLUMN extension_details.extension_options
 
 
 CREATE TABLE IF NOT EXISTS deposits
-  (deposit_serial_id BIGSERIAL PRIMARY KEY
+  (deposit_serial_id BIGSERIAL -- PRIMARY KEY
   ,shard INT8 NOT NULL
-  ,known_coin_id INT8 NOT NULL REFERENCES known_coins (known_coin_id) ON DELETE CASCADE
+  ,known_coin_id INT8 NOT NULL -- REFERENCES known_coins (known_coin_id) ON DELETE CASCADE
   ,amount_with_fee_val INT8 NOT NULL
   ,amount_with_fee_frac INT4 NOT NULL
   ,wallet_timestamp INT8 NOT NULL
@@ -426,19 +461,25 @@ CREATE TABLE IF NOT EXISTS deposits
   ,h_contract_terms BYTEA NOT NULL CHECK (LENGTH(h_contract_terms)=64)
   ,coin_sig BYTEA NOT NULL CHECK (LENGTH(coin_sig)=64)
   ,wire_salt BYTEA NOT NULL CHECK (LENGTH(wire_salt)=16)
-  ,wire_target_serial_id INT8 NOT NULL REFERENCES wire_targets (wire_target_serial_id)
+  ,wire_target_serial_id INT8 NOT NULL -- REFERENCES wire_targets (wire_target_serial_id)
   ,tiny BOOLEAN NOT NULL DEFAULT FALSE
   ,done BOOLEAN NOT NULL DEFAULT FALSE
   ,extension_blocked BOOLEAN NOT NULL DEFAULT FALSE
-  ,extension_details_serial_id INT8 REFERENCES extension_details (extension_details_serial_id)
-  ,UNIQUE (known_coin_id, merchant_pub, h_contract_terms)
-  );
+  ,extension_details_serial_id INT8 REFERENCES extension_details (extension_details_serial_id) ON DELETE CASCADE
+  ,UNIQUE (shard, known_coin_id, merchant_pub, h_contract_terms)
+  )
+  PARTITION BY HASH (shard);
+CREATE TABLE IF NOT EXISTS deposits_default
+  PARTITION OF deposits
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
+
 COMMENT ON TABLE deposits
   IS 'Deposits we have received and for which we need to make (aggregate) wire transfers (and manage refunds).';
 COMMENT ON COLUMN deposits.shard
   IS 'Used for load sharding. Should be set based on h_payto and merchant_pub. 64-bit value because we need an *unsigned* 32-bit value.';
 COMMENT ON COLUMN deposits.wire_target_serial_id
-  IS 'Identifies the target bank account and KYC status';COMMENT ON COLUMN deposits.wire_salt
+  IS 'Identifies the target bank account and KYC status';
+COMMENT ON COLUMN deposits.wire_salt
   IS 'Salt used when hashing the payto://-URI to get the h_wire';
 COMMENT ON COLUMN deposits.done
   IS 'Set to TRUE once we have included this deposit in some aggregate wire transfer to the merchant';
@@ -449,15 +490,12 @@ COMMENT ON COLUMN deposits.extension_details_serial_id
 COMMENT ON COLUMN deposits.tiny
   IS 'Set to TRUE if we decided that the amount is too small to ever trigger a wire transfer by itself (requires real aggregation)';
 
-CREATE INDEX IF NOT EXISTS deposits_coin_pub_merchant_contract_index
+-- FIXME: check if we can ALWAYS include the shard in the WHERE clauses,
+-- thereby resulting in a much better use of the index: we could do (shard,deposit_serial_id)!
+CREATE INDEX IF NOT EXISTS deposits_deposit_by_serial_id_index
   ON deposits
-  (known_coin_id
-  ,merchant_pub
-  ,h_contract_terms
-  );
-COMMENT ON INDEX deposits_coin_pub_merchant_contract_index
-  IS 'for get_deposit_for_wtid and test_deposit_done';
-CREATE INDEX IF NOT EXISTS deposits_get_ready_index
+  (deposit_serial_id);
+CREATE INDEX IF NOT EXISTS deposits_for_get_ready_index
   ON deposits
   (shard ASC
   ,done
@@ -465,9 +503,11 @@ CREATE INDEX IF NOT EXISTS deposits_get_ready_index
   ,tiny
   ,wire_deadline ASC
   );
-COMMENT ON INDEX deposits_coin_pub_merchant_contract_index
+COMMENT ON INDEX deposits_for_get_ready_index
   IS 'for deposits_get_ready';
-CREATE INDEX IF NOT EXISTS deposits_iterate_matching_index
+-- FIXME: check if we can ALWAYS include the shard in the WHERE clauses,
+-- thereby resulting in a much better use of the index: we could do (shard,merchant_pub, ...)!
+CREATE INDEX IF NOT EXISTS deposits_for_iterate_matching_index
   ON deposits
   (merchant_pub
   ,wire_target_serial_id
@@ -475,57 +515,87 @@ CREATE INDEX IF NOT EXISTS deposits_iterate_matching_index
   ,extension_blocked
   ,refund_deadline ASC
   );
-COMMENT ON INDEX deposits_iterate_matching_index
+COMMENT ON INDEX deposits_for_iterate_matching_index
   IS 'for deposits_iterate_matching';
 
 
 CREATE TABLE IF NOT EXISTS refunds
-  (refund_serial_id BIGSERIAL UNIQUE
-  ,deposit_serial_id INT8 NOT NULL REFERENCES deposits (deposit_serial_id) ON DELETE CASCADE
+  (refund_serial_id BIGSERIAL -- UNIQUE
+  ,deposit_serial_id INT8 NOT NULL -- REFERENCES deposits (deposit_serial_id) ON DELETE CASCADE
   ,merchant_sig BYTEA NOT NULL CHECK(LENGTH(merchant_sig)=64)
   ,rtransaction_id INT8 NOT NULL
   ,amount_with_fee_val INT8 NOT NULL
   ,amount_with_fee_frac INT4 NOT NULL
-  ,PRIMARY KEY (deposit_serial_id, rtransaction_id)
-  );
+  -- ,PRIMARY KEY (deposit_serial_id, rtransaction_id) -- done per shard!
+  )
+  PARTITION BY HASH (deposit_serial_id);
 COMMENT ON TABLE refunds
   IS 'Data on coins that were refunded. Technically, refunds always apply against specific deposit operations involving a coin. The combination of coin_pub, merchant_pub, h_contract_terms and rtransaction_id MUST be unique, and we usually select by coin_pub so that one goes first.';
 COMMENT ON COLUMN refunds.deposit_serial_id
   IS 'Identifies ONLY the merchant_pub, h_contract_terms and known_coin_id. Multiple deposits may match a refund, this only identifies one of them.';
 COMMENT ON COLUMN refunds.rtransaction_id
   IS 'used by the merchant to make refunds unique in case the same coin for the same deposit gets a subsequent (higher) refund';
+CREATE TABLE IF NOT EXISTS refunds_default
+  PARTITION OF refunds
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
+ALTER TABLE refunds_default
+  ADD PRIMARY KEY (deposit_serial_id, rtransaction_id);
+
+CREATE INDEX IF NOT EXISTS refunds_by_refund_serial_id_index
+  ON refunds
+  (refund_serial_id);
 
 
 CREATE TABLE IF NOT EXISTS wire_out
-  (wireout_uuid BIGSERIAL PRIMARY KEY
+  (wireout_uuid BIGSERIAL -- PRIMARY KEY
   ,execution_date INT8 NOT NULL
   ,wtid_raw BYTEA UNIQUE NOT NULL CHECK (LENGTH(wtid_raw)=32)
-  ,wire_target_serial_id INT8 NOT NULL REFERENCES wire_targets (wire_target_serial_id)
+  ,wire_target_serial_id INT8 NOT NULL -- REFERENCES wire_targets (wire_target_serial_id)
   ,exchange_account_section TEXT NOT NULL
   ,amount_val INT8 NOT NULL
   ,amount_frac INT4 NOT NULL
-  );
+  )
+  PARTITION BY HASH (wtid_raw);
 COMMENT ON TABLE wire_out
   IS 'wire transfers the exchange has executed';
 COMMENT ON COLUMN wire_out.exchange_account_section
   IS 'identifies the configuration section with the debit account of this payment';
 COMMENT ON COLUMN wire_out.wire_target_serial_id
   IS 'Identifies the credited bank account and KYC status';
+CREATE TABLE IF NOT EXISTS wire_out_default
+  PARTITION OF wire_out
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
+
+CREATE INDEX IF NOT EXISTS wire_out_by_wireout_uuid_index
+  ON wire_out
+  (wireout_uuid);
+CREATE INDEX IF NOT EXISTS wire_out_by_wire_target_serial_id_index
+  ON wire_out
+  (wire_target_serial_id);
+
+
 
 CREATE TABLE IF NOT EXISTS aggregation_tracking
-  (aggregation_serial_id BIGSERIAL UNIQUE
-  ,deposit_serial_id INT8 PRIMARY KEY REFERENCES deposits (deposit_serial_id) ON DELETE CASCADE
+  (aggregation_serial_id BIGSERIAL -- UNIQUE
+  ,deposit_serial_id INT8 PRIMARY KEY -- REFERENCES deposits (deposit_serial_id) ON DELETE CASCADE
   ,wtid_raw BYTEA CONSTRAINT wire_out_ref REFERENCES wire_out(wtid_raw) ON DELETE CASCADE DEFERRABLE
-  );
+  )
+  PARTITION BY HASH (deposit_serial_id);
 COMMENT ON TABLE aggregation_tracking
   IS 'mapping from wire transfer identifiers (WTID) to deposits (and back)';
 COMMENT ON COLUMN aggregation_tracking.wtid_raw
   IS 'We first create entries in the aggregation_tracking table and then finally the wire_out entry once we know the total amount. Hence the constraint must be deferrable and we cannot use a wireout_uuid here, because we do not have it when these rows are created. Changing the logic to first INSERT a dummy row into wire_out and then UPDATEing that row in the same transaction would theoretically reduce per-deposit storage costs by 5 percent (24/~460 bytes).';
+CREATE TABLE IF NOT EXISTS aggregation_tracking_default
+  PARTITION OF aggregation_tracking
+  FOR VALUES WITH (MODULUS 1, REMAINDER 0);
 
-CREATE INDEX IF NOT EXISTS aggregation_tracking_wtid_index
+CREATE INDEX IF NOT EXISTS aggregation_tracking_by_aggregation_serial_id_index
+  ON aggregation_tracking
+  (aggregation_serial_id);
+CREATE INDEX IF NOT EXISTS aggregation_tracking_by_wtid_raw_index
   ON aggregation_tracking
   (wtid_raw);
-COMMENT ON INDEX aggregation_tracking_wtid_index
+COMMENT ON INDEX aggregation_tracking_by_wtid_raw_index
   IS 'for lookup_transactions';
 
 
@@ -546,52 +616,58 @@ COMMENT ON TABLE wire_fee
 COMMENT ON COLUMN wire_fee.wire_fee_serial
   IS 'needed for exchange-auditor replication logic';
 
-CREATE INDEX IF NOT EXISTS wire_fee_gc_index
+CREATE INDEX IF NOT EXISTS wire_fee_by_end_date_index
   ON wire_fee
   (end_date);
 
 
 CREATE TABLE IF NOT EXISTS recoup
-  (recoup_uuid BIGSERIAL UNIQUE
-  ,known_coin_id INT8 NOT NULL REFERENCES known_coins (known_coin_id)
+  (recoup_uuid BIGSERIAL -- UNIQUE
+  ,known_coin_id INT8 NOT NULL -- REFERENCES known_coins (known_coin_id)
   ,coin_sig BYTEA NOT NULL CHECK(LENGTH(coin_sig)=64)
   ,coin_blind BYTEA NOT NULL CHECK(LENGTH(coin_blind)=32)
   ,amount_val INT8 NOT NULL
   ,amount_frac INT4 NOT NULL
-  ,timestamp INT8 NOT NULL
-  ,reserve_out_serial_id INT8 NOT NULL REFERENCES reserves_out (reserve_out_serial_id) ON DELETE CASCADE
-  );
+  ,recoup_timestamp INT8 NOT NULL
+  ,reserve_out_serial_id INT8 NOT NULL -- REFERENCES reserves_out (reserve_out_serial_id) ON DELETE CASCADE
+  )
+  PARTITION BY RANGE (known_coin_id);
 COMMENT ON TABLE recoup
   IS 'Information about recoups that were executed between a coin and a reserve. In this type of recoup, the amount is credited back to the reserve from which the coin originated.';
 COMMENT ON COLUMN recoup.known_coin_id
-  IS 'Coin that is being debited in the recoup. Do not CASCADE ON DROP on the known_coin_id, as we may keep the coin alive!';
+  IS 'Coin that is being debited in the recoup. Do not CASCADE ON DROP on the coin_pub, as we may keep the coin alive!';
 COMMENT ON COLUMN recoup.reserve_out_serial_id
   IS 'Identifies the h_blind_ev of the recouped coin and provides the link to the credited reserve.';
 COMMENT ON COLUMN recoup.coin_sig
   IS 'Signature by the coin affirming the recoup, of type TALER_SIGNATURE_WALLET_COIN_RECOUP';
 COMMENT ON COLUMN recoup.coin_blind
   IS 'Denomination blinding key used when creating the blinded coin from the planchet. Secret revealed during the recoup to provide the linkage between the coin and the withdraw operation.';
+CREATE TABLE IF NOT EXISTS recoup_default
+  PARTITION OF recoup
+  DEFAULT;
 
-CREATE INDEX IF NOT EXISTS recoup_by_h_blind_ev
+CREATE INDEX IF NOT EXISTS recoup_by_recoup_uuid_index
+  ON recoup
+  (recoup_uuid);
+CREATE INDEX IF NOT EXISTS recoup_by_reserve_out_serial_id_index
   ON recoup
   (reserve_out_serial_id);
-CREATE INDEX IF NOT EXISTS recoup_for_by_reserve
+CREATE INDEX IF NOT EXISTS recoup_by_known_coin_id_index
   ON recoup
-  (known_coin_id
-  ,reserve_out_serial_id
-  );
+  (known_coin_id);
 
 
 CREATE TABLE IF NOT EXISTS recoup_refresh
-  (recoup_refresh_uuid BIGSERIAL UNIQUE
-  ,known_coin_id INT8 NOT NULL REFERENCES known_coins (known_coin_id)
+  (recoup_refresh_uuid BIGSERIAL -- UNIQUE
+  ,known_coin_id INT8 NOT NULL -- REFERENCES known_coins (known_coin_id)
   ,coin_sig BYTEA NOT NULL CHECK(LENGTH(coin_sig)=64)
   ,coin_blind BYTEA NOT NULL CHECK(LENGTH(coin_blind)=32)
   ,amount_val INT8 NOT NULL
   ,amount_frac INT4 NOT NULL
-  ,timestamp INT8 NOT NULL
-  ,rrc_serial INT8 NOT NULL UNIQUE REFERENCES refresh_revealed_coins (rrc_serial) ON DELETE CASCADE
-  );
+  ,recoup_timestamp INT8 NOT NULL
+  ,rrc_serial INT8 NOT NULL -- REFERENCES refresh_revealed_coins (rrc_serial) ON DELETE CASCADE -- UNIQUE
+  )
+  PARTITION BY RANGE (known_coin_id);
 COMMENT ON TABLE recoup_refresh
   IS 'Table of coins that originated from a refresh operation and that were recouped. Links the (fresh) coin to the melted operation (and thus the old coin). A recoup on a refreshed coin credits the old coin and debits the fresh coin.';
 COMMENT ON COLUMN recoup_refresh.known_coin_id
@@ -600,24 +676,29 @@ COMMENT ON COLUMN recoup_refresh.rrc_serial
   IS 'Link to the refresh operation. Also identifies the h_blind_ev of the recouped coin (as h_coin_ev).';
 COMMENT ON COLUMN recoup_refresh.coin_blind
   IS 'Denomination blinding key used when creating the blinded coin from the planchet. Secret revealed during the recoup to provide the linkage between the coin and the refresh operation.';
+CREATE TABLE IF NOT EXISTS recoup_refresh_default
+  PARTITION OF recoup_refresh
+  DEFAULT;
 
-CREATE INDEX IF NOT EXISTS recoup_refresh_by_h_blind_ev
+CREATE INDEX IF NOT EXISTS recoup_refresh_by_recoup_refresh_uuid_index
+  ON recoup_refresh
+  (recoup_refresh_uuid);
+CREATE INDEX IF NOT EXISTS recoup_refresh_by_rrc_serial_index
   ON recoup_refresh
   (rrc_serial);
-CREATE INDEX IF NOT EXISTS recoup_refresh_for_by_reserve
+CREATE INDEX IF NOT EXISTS recoup_refresh_by_known_coin_id_index
   ON recoup_refresh
-  (known_coin_id
-  ,rrc_serial
-  );
+  (known_coin_id);
 
 
 CREATE TABLE IF NOT EXISTS prewire
   (prewire_uuid BIGSERIAL PRIMARY KEY
-  ,type TEXT NOT NULL
+  ,wire_method TEXT NOT NULL
   ,finished BOOLEAN NOT NULL DEFAULT false
   ,failed BOOLEAN NOT NULL DEFAULT false
   ,buf BYTEA NOT NULL
-  );
+  )
+  PARTITION BY RANGE (prewire_uuid);
 COMMENT ON TABLE prewire
   IS 'pre-commit data for wire transfers we are about to execute';
 COMMENT ON COLUMN prewire.failed
@@ -626,17 +707,20 @@ COMMENT ON COLUMN prewire.finished
   IS 'set to TRUE once bank confirmed receiving the wire transfer request';
 COMMENT ON COLUMN prewire.buf
   IS 'serialized data to send to the bank to execute the wire transfer';
+CREATE TABLE IF NOT EXISTS prewire_default
+  PARTITION OF prewire
+  DEFAULT;
 
-CREATE INDEX IF NOT EXISTS prepare_iteration_index
+CREATE INDEX IF NOT EXISTS prewire_by_finished_index
   ON prewire
   (finished);
-COMMENT ON INDEX prepare_iteration_index
+COMMENT ON INDEX prewire_by_finished_index
   IS 'for gc_prewire';
-
-CREATE INDEX IF NOT EXISTS prepare_get_index
+-- FIXME: find a way to combine these two indices?
+CREATE INDEX IF NOT EXISTS prewire_by_failed_finished_index
   ON prewire
   (failed,finished);
-COMMENT ON INDEX prepare_get_index
+COMMENT ON INDEX prewire_by_failed_finished_index
   IS 'for wire_prepare_data_get';
 
 
@@ -684,7 +768,7 @@ COMMENT ON COLUMN work_shards.end_row
 COMMENT ON COLUMN work_shards.job_name
   IS 'unique name of the job the workers on this shard are performing';
 
-CREATE INDEX IF NOT EXISTS work_shards_index
+CREATE INDEX IF NOT EXISTS work_shards_by_job_name_completed_last_attempt_index
   ON work_shards
   (job_name
   ,completed
@@ -716,7 +800,7 @@ COMMENT ON COLUMN revolving_work_shards.end_row
 COMMENT ON COLUMN revolving_work_shards.job_name
   IS 'unique name of the job the workers on this shard are performing';
 
-CREATE INDEX IF NOT EXISTS revolving_work_shards_index
+CREATE INDEX IF NOT EXISTS revolving_work_shards_by_job_name_active_last_attempt_index
   ON revolving_work_shards
   (job_name
   ,active
@@ -740,7 +824,8 @@ CREATE OR REPLACE FUNCTION exchange_do_withdraw(
   OUT reserve_found BOOLEAN,
   OUT balance_ok BOOLEAN,
   OUT kycok BOOLEAN,
-  OUT account_uuid INT8)
+  OUT account_uuid INT8,
+  OUT ruuid INT8)
 LANGUAGE plpgsql
 AS $$
 DECLARE
@@ -752,6 +837,11 @@ DECLARE
 DECLARE
   reserve_frac INT4;
 BEGIN
+-- Shards: reserves by reserve_pub (SELECT)
+--         reserves_out (INSERT, with CONFLICT detection) by h_blind_ev
+--         reserves by reserve_pub (UPDATE)
+--         reserves_in by reserve_pub (SELECT)
+--         wire_targets by wire_target_serial_id
 
 SELECT denominations_serial INTO denom_serial
   FROM denominations
@@ -764,6 +854,7 @@ THEN
   balance_ok=FALSE;
   kycok=FALSE;
   account_uuid=0;
+  ruuid=0;
   ASSERT false, 'denomination unknown';
   RETURN;
 END IF;
@@ -771,12 +862,13 @@ END IF;
 SELECT
    current_balance_val
   ,current_balance_frac
-  ,expiration_date
   ,gc_date
+  ,reserve_uuid
  INTO
    reserve_val
   ,reserve_frac
   ,reserve_gc
+  ,ruuid
   FROM reserves
  WHERE reserves.reserve_pub=rpub;
 
@@ -787,6 +879,7 @@ THEN
   balance_ok=FALSE;
   kycok=FALSE;
   account_uuid=0;
+  ruuid=0;
   RETURN;
 END IF;
 
@@ -796,7 +889,7 @@ INSERT INTO reserves_out
   (h_blind_ev
   ,denominations_serial
   ,denom_sig
-  ,reserve_pub
+  ,reserve_uuid
   ,reserve_sig
   ,execution_date
   ,amount_with_fee_val
@@ -805,7 +898,7 @@ VALUES
   (h_coin_envelope
   ,denom_serial
   ,denom_sig
-  ,rpub
+  ,ruuid
   ,reserve_sig
   ,now
   ,amount_val
@@ -882,7 +975,7 @@ COMMENT ON FUNCTION exchange_do_withdraw(INT8, INT4, BYTEA, BYTEA, BYTEA, BYTEA,
 
 
 CREATE OR REPLACE FUNCTION exchange_do_withdraw_limit_check(
-  IN rpub BYTEA,
+  IN ruuid INT8,
   IN start_time INT8,
   IN upper_limit_val INT8,
   IN upper_limit_frac INT4,
@@ -894,6 +987,10 @@ DECLARE
 DECLARE
   total_frac INT8; -- INT4 could overflow during accumulation!
 BEGIN
+-- NOTE: Read-only, but crosses shards.
+-- Shards: reserves by reserve_pub
+--         reserves_out by reserve_uuid -- crosses shards!!
+
 
 SELECT
    SUM(amount_with_fee_val) -- overflow here is not plausible
@@ -902,7 +999,7 @@ SELECT
    total_val
   ,total_frac
   FROM reserves_out
- WHERE reserves_out.reserve_pub=rpub
+ WHERE reserve_uuid=ruuid
    AND execution_date > start_time;
 
 -- normalize result
@@ -915,199 +1012,882 @@ below_limit = (total_val < upper_limit_val) OR
               (total_frac <= upper_limit_frac) );
 END $$;
 
-COMMENT ON FUNCTION exchange_do_withdraw_limit_check(BYTEA, INT8, INT8, INT4)
+COMMENT ON FUNCTION exchange_do_withdraw_limit_check(INT8, INT8, INT8, INT4)
   IS 'Check whether the withdrawals from the given reserve since the given time are below the given threshold';
 
 
 
-CREATE OR REPLACE FUNCTION exchange_do_check_coin_balance(
-  IN denom_val INT8, -- value of the denomination of the coin
-  IN denom_frac INT4, -- value of the denomination of the coin
-  IN in_coin_pub BYTEA, -- coin public key
-  IN check_recoup BOOLEAN, -- do we need to check the recoup table?
-  IN zombie_required BOOLEAN, -- do we need a zombie coin?
-  OUT balance_ok BOOLEAN, -- balance satisfied?
-  OUT zombie_ok BOOLEAN) -- zombie satisfied?
+
+CREATE OR REPLACE FUNCTION exchange_do_deposit(
+  IN in_amount_with_fee_val INT8,
+  IN in_amount_with_fee_frac INT4,
+  IN in_h_contract_terms BYTEA,
+  IN in_wire_salt BYTEA,
+  IN in_wallet_timestamp INT8,
+  IN in_exchange_timestamp INT8,
+  IN in_refund_deadline INT8,
+  IN in_wire_deadline INT8,
+  IN in_merchant_pub BYTEA,
+  IN in_receiver_wire_account VARCHAR,
+  IN in_h_payto BYTEA,
+  IN in_known_coin_id INT8,
+  IN in_coin_pub BYTEA,
+  IN in_coin_sig BYTEA,
+  IN in_shard INT8,
+  IN in_extension_blocked BOOLEAN,
+  IN in_extension_details VARCHAR,
+  OUT out_exchange_timestamp INT8,
+  OUT out_balance_ok BOOLEAN,
+  OUT out_conflict BOOLEAN)
 LANGUAGE plpgsql
 AS $$
 DECLARE
-  coin_uuid INT8; -- known_coin_id of coin_pub
+  wtsi INT8; -- wire target serial id
 DECLARE
-  tmp_val INT8; -- temporary result
+  xdi INT8; -- eXstension details serial id
+BEGIN
+-- Shards: INSERT extension_details (by extension_details_serial_id)
+--         INSERT wire_targets (by h_payto), on CONFLICT DO NOTHING;
+--         INSERT deposits (by shard + known_coin_id, merchant_pub, h_contract_terms), ON CONFLICT DO NOTHING;
+--         UPDATE known_coins (by coin_pub)
+
+IF NOT NULL in_extension_details
+THEN
+  INSERT INTO extension_details
+  (extension_options)
+  VALUES
+    (in_extension_details)
+  RETURNING extension_details_serial_id INTO xdi;
+ELSE
+  xdi=NULL;
+END IF;
+
+
+INSERT INTO wire_targets
+  (h_payto
+  ,payto_uri)
+  VALUES
+  (in_h_payto
+  ,in_receiver_wire_account)
+ON CONFLICT (h_payto) DO NOTHING
+  RETURNING wire_target_serial_id INTO wtsi;
+
+IF NOT FOUND
+THEN
+  SELECT wire_target_serial_id
+  INTO wtsi
+  FROM wire_targets
+  WHERE h_payto=in_h_payto;
+END IF;
+
+
+INSERT INTO deposits
+  (shard
+  ,known_coin_id
+  ,amount_with_fee_val
+  ,amount_with_fee_frac
+  ,wallet_timestamp
+  ,exchange_timestamp
+  ,refund_deadline
+  ,wire_deadline
+  ,merchant_pub
+  ,h_contract_terms
+  ,coin_sig
+  ,wire_salt
+  ,wire_target_serial_id
+  ,extension_blocked
+  ,extension_details_serial_id
+  )
+  VALUES
+  (in_shard
+  ,in_known_coin_id
+  ,in_amount_with_fee_val
+  ,in_amount_with_fee_frac
+  ,in_wallet_timestamp
+  ,in_exchange_timestamp
+  ,in_refund_deadline
+  ,in_wire_deadline
+  ,in_merchant_pub
+  ,in_h_contract_terms
+  ,in_coin_sig
+  ,in_wire_salt
+  ,wtsi
+  ,in_extension_blocked
+  ,xdi)
+  ON CONFLICT DO NOTHING;
+
+IF NOT FOUND
+THEN
+  -- Idempotency check: see if an identical record exists.
+  -- Note that by checking 'coin_sig', we implicitly check
+  -- identity over everything that the signature covers.
+  -- We do select over merchant_pub and h_contract_terms
+  -- primarily here to maximally use the existing index.
+  SELECT
+     exchange_timestamp
+   INTO
+     out_exchange_timestamp
+   FROM deposits
+   WHERE
+     shard=in_shard AND
+     known_coin_id=in_known_coin_id AND
+     merchant_pub=in_merchant_pub AND
+     h_contract_terms=in_h_contract_terms AND
+     coin_sig=in_coin_sig;
+
+  IF NOT FOUND
+  THEN
+    -- Deposit exists, but with differences. Not allowed.
+    out_balance_ok=FALSE;
+    out_conflict=TRUE;
+    RETURN;
+  END IF;
+
+  -- Idempotent request known, return success.
+  out_balance_ok=TRUE;
+  out_conflict=FALSE;
+
+  RETURN;
+END IF;
+
+
+out_exchange_timestamp=in_exchange_timestamp;
+
+-- Check and update balance of the coin.
+UPDATE known_coins
+  SET
+    remaining_frac=remaining_frac-in_amount_with_fee_frac
+       + CASE
+         WHEN remaining_frac < in_amount_with_fee_frac
+         THEN 100000000
+         ELSE 0
+         END,
+    remaining_val=remaining_val-in_amount_with_fee_val
+       - CASE
+         WHEN remaining_frac < in_amount_with_fee_frac
+         THEN 1
+         ELSE 0
+         END
+  WHERE coin_pub=in_coin_pub
+    AND ( (remaining_val > in_amount_with_fee_val) OR
+          ( (remaining_frac >= in_amount_with_fee_frac) AND
+            (remaining_val >= in_amount_with_fee_val) ) );
+
+IF NOT FOUND
+THEN
+  -- Insufficient balance.
+  out_balance_ok=FALSE;
+  out_conflict=FALSE;
+  RETURN;
+END IF;
+
+-- Everything fine, return success!
+out_balance_ok=TRUE;
+out_conflict=FALSE;
+
+END $$;
+
+
+
+CREATE OR REPLACE FUNCTION exchange_do_melt(
+  IN in_amount_with_fee_val INT8,
+  IN in_amount_with_fee_frac INT4,
+  IN in_rc BYTEA,
+  IN in_old_coin_pub BYTEA,
+  IN in_old_coin_sig BYTEA,
+  IN in_known_coin_id INT8, -- not used, but that's OK
+  IN in_noreveal_index INT4,
+  IN in_zombie_required BOOLEAN,
+  OUT out_balance_ok BOOLEAN,
+  OUT out_zombie_bad BOOLEAN,
+  OUT out_noreveal_index INT4)
+LANGUAGE plpgsql
+AS $$
+BEGIN
+-- Shards: INSERT refresh_commitments (by rc)
+-- (rare:) SELECT refresh_commitments (by old_coin_pub) -- crosses shards!
+-- (rare:) SEELCT refresh_revealed_coins (by melt_serial_id)
+-- (rare:) PERFORM recoup_refresh (by rrc_serial) -- crosses shards!
+--         UPDATE known_coins (by coin_pub)
+
+INSERT INTO refresh_commitments
+  (rc
+  ,old_coin_pub
+  ,old_coin_sig
+  ,amount_with_fee_val
+  ,amount_with_fee_frac
+  ,noreveal_index
+  )
+  VALUES
+  (in_rc
+  ,in_old_coin_pub
+  ,in_old_coin_sig
+  ,in_amount_with_fee_val
+  ,in_amount_with_fee_frac
+  ,in_noreveal_index)
+  ON CONFLICT DO NOTHING;
+
+IF NOT FOUND
+THEN
+  -- Idempotency check: see if an identical record exists.
+  out_noreveal_index=-1;
+  SELECT
+     noreveal_index
+    INTO
+     out_noreveal_index
+    FROM refresh_commitments
+   WHERE rc=in_rc;
+  out_balance_ok=FOUND;
+  out_zombie_bad=FALSE; -- zombie is OK
+  RETURN;
+END IF;
+
+
+IF in_zombie_required
+THEN
+  -- Check if this coin was part of a refresh
+  -- operation that was subsequently involved
+  -- in a recoup operation.  We begin by all
+  -- refresh operations our coin was involved
+  -- with, then find all associated reveal
+  -- operations, and then see if any of these
+  -- reveal operations was involved in a recoup.
+  PERFORM
+    FROM recoup_refresh
+   WHERE rrc_serial IN
+    (SELECT rrc_serial
+       FROM refresh_revealed_coins
+      WHERE melt_serial_id IN
+      (SELECT melt_serial_id
+         FROM refresh_commitments
+        WHERE old_coin_pub=in_old_coin_pub));
+  IF NOT FOUND
+  THEN
+    out_zombie_bad=TRUE;
+    out_balance_ok=FALSE;
+    RETURN;
+  END IF;
+END IF;
+
+out_zombie_bad=FALSE; -- zombie is OK
+
+
+-- Check and update balance of the coin.
+UPDATE known_coins
+  SET
+    remaining_frac=remaining_frac-in_amount_with_fee_frac
+       + CASE
+         WHEN remaining_frac < in_amount_with_fee_frac
+         THEN 100000000
+         ELSE 0
+         END,
+    remaining_val=remaining_val-in_amount_with_fee_val
+       - CASE
+         WHEN remaining_frac < in_amount_with_fee_frac
+         THEN 1
+         ELSE 0
+         END
+  WHERE coin_pub=in_old_coin_pub
+    AND ( (remaining_val > in_amount_with_fee_val) OR
+          ( (remaining_frac >= in_amount_with_fee_frac) AND
+            (remaining_val >= in_amount_with_fee_val) ) );
+
+IF NOT FOUND
+THEN
+  -- Insufficient balance.
+  out_noreveal_index=-1;
+  out_balance_ok=FALSE;
+  RETURN;
+END IF;
+
+-- Everything fine, return success!
+out_balance_ok=TRUE;
+out_noreveal_index=in_noreveal_index;
+
+END $$;
+
+
+
+CREATE OR REPLACE FUNCTION exchange_do_refund(
+  IN in_amount_with_fee_val INT8,
+  IN in_amount_with_fee_frac INT4,
+  IN in_amount_val INT8,
+  IN in_amount_frac INT4,
+  IN in_deposit_fee_val INT8,
+  IN in_deposit_fee_frac INT4,
+  IN in_h_contract_terms BYTEA,
+  IN in_rtransaction_id INT8,
+  IN in_deposit_shard INT8,
+  IN in_known_coin_id INT8,
+  IN in_coin_pub BYTEA,
+  IN in_merchant_pub BYTEA,
+  IN in_merchant_sig BYTEA,
+  OUT out_not_found BOOLEAN,
+  OUT out_refund_ok BOOLEAN,
+  OUT out_gone BOOLEAN,
+  OUT out_conflict BOOLEAN)
+LANGUAGE plpgsql
+AS $$
 DECLARE
-  tmp_frac INT8; -- temporary result
+  dsi INT8; -- ID of deposit being refunded
 DECLARE
-  spent_val INT8; -- how much of coin was spent?
+  tmp_val INT8; -- total amount refunded
 DECLARE
-  spent_frac INT8; -- how much of coin was spent?
+  tmp_frac INT8; -- total amount refunded
 DECLARE
-  unspent_val INT8; -- how much of coin was refunded?
+  deposit_val INT8; -- amount that was originally deposited
 DECLARE
-  unspent_frac INT8; -- how much of coin was refunded?
+  deposit_frac INT8; -- amount that was originally deposited
 BEGIN
+-- Shards: SELECT deposits (by shard, known_coin_id,h_contract_terms, merchant_pub)
+--         INSERT refunds (by deposit_serial_id, rtransaction_id) ON CONFLICT DO NOTHING
+--         SELECT refunds (by deposit_serial_id)
+--         UPDATE known_coins (by coin_pub)
 
--- Note: possible future optimization: get the coin_uuid from the previous
--- 'ensure_coin_known' and pass that here instead of the coin_pub. Might help
--- a tiny bit with performance.
-SELECT known_coin_id INTO coin_uuid
-  FROM known_coins
- WHERE coin_pub=in_coin_pub;
+SELECT
+   deposit_serial_id
+  ,amount_with_fee_val
+  ,amount_with_fee_frac
+  ,done
+INTO
+   dsi
+  ,deposit_val
+  ,deposit_frac
+  ,out_gone
+FROM deposits
+WHERE shard=in_deposit_shard
+  AND known_coin_id=in_known_coin_id
+  AND h_contract_terms=in_h_contract_terms
+  AND merchant_pub=in_merchant_pub;
 
 IF NOT FOUND
 THEN
-  -- coin unknown, should be impossible!
-  balance_ok=FALSE;
-  zombie_ok=FALSE;
-  ASSERT false, 'coin unknown';
+  -- No matching deposit found!
+  out_refund_ok=FALSE;
+  out_conflict=FALSE;
+  out_not_found=TRUE;
+  out_gone=FALSE;
   RETURN;
 END IF;
 
 
-spent_val = 0;
-spent_frac = 0;
-unspent_val = denom_val;
-unspent_frac = denom_frac;
+INSERT INTO refunds
+  (deposit_serial_id
+  ,merchant_sig
+  ,rtransaction_id
+  ,amount_with_fee_val
+  ,amount_with_fee_frac
+  )
+  VALUES
+  (dsi
+  ,in_merchant_sig
+  ,in_rtransaction_id
+  ,in_amount_with_fee_val
+  ,in_amount_with_fee_frac)
+  ON CONFLICT DO NOTHING;
 
-SELECT
-   SUM(amount_with_fee_val) -- overflow here is not plausible
-  ,SUM(CAST(amount_with_fee_frac AS INT8)) -- compute using 64 bits
-  INTO
-   tmp_val
-  ,tmp_frac
-  FROM deposits
- WHERE known_coin_id=coin_uuid;
+IF NOT FOUND
+THEN
+  -- Idempotency check: see if an identical record exists.
+  -- Note that by checking 'coin_sig', we implicitly check
+  -- identity over everything that the signature covers.
+  -- We do select over merchant_pub and h_contract_terms
+  -- primarily here to maximally use the existing index.
+   PERFORM
+   FROM refunds
+   WHERE
+     deposit_serial_id=dsi AND
+     rtransaction_id=in_rtransaction_id AND
+     amount_with_fee_val=in_amount_with_fee_val AND
+     amount_with_fee_frac=in_amount_with_fee_frac;
+
+  IF NOT FOUND
+  THEN
+    -- Deposit exists, but have conflicting refund.
+    out_refund_ok=FALSE;
+    out_conflict=TRUE;
+    out_not_found=FALSE;
+    RETURN;
+  END IF;
 
-IF tmp_val IS NOT NULL
+  -- Idempotent request known, return success.
+  out_refund_ok=TRUE;
+  out_conflict=FALSE;
+  out_not_found=FALSE;
+  out_gone=FALSE;
+  RETURN;
+END IF;
+
+
+IF out_gone
 THEN
-  spent_val = spent_val + tmp_val;
-  spent_frac = spent_frac + tmp_frac;
+  -- money already sent to the merchant. Tough luck.
+  out_refund_ok=FALSE;
+  out_conflict=FALSE;
+  out_not_found=FALSE;
+  RETURN;
 END IF;
 
+
+
+-- Check refund balance invariant.
 SELECT
    SUM(amount_with_fee_val) -- overflow here is not plausible
   ,SUM(CAST(amount_with_fee_frac AS INT8)) -- compute using 64 bits
   INTO
    tmp_val
   ,tmp_frac
-  FROM refresh_commitments
- WHERE old_known_coin_id=coin_uuid;
-
-IF tmp_val IS NOT NULL
+  FROM refunds
+  WHERE
+    deposit_serial_id=dsi;
+IF tmp_val IS NULL
 THEN
-  spent_val = spent_val + tmp_val;
-  spent_frac = spent_frac + tmp_frac;
+  RAISE NOTICE 'failed to sum up existing refunds';
+  out_refund_ok=FALSE;
+  out_conflict=FALSE;
+  out_not_found=FALSE;
+  RETURN;
 END IF;
 
+-- Normalize result before continuing
+tmp_val = tmp_val + tmp_frac / 100000000;
+tmp_frac = tmp_frac % 100000000;
 
-SELECT
-   SUM(rf.amount_with_fee_val) -- overflow here is not plausible
-  ,SUM(CAST(rf.amount_with_fee_frac AS INT8)) -- compute using 64 bits
-  INTO
-   tmp_val
-  ,tmp_frac
-  FROM deposits
-  JOIN refunds rf
-    USING (deposit_serial_id)
-  WHERE
-    known_coin_id=coin_uuid;
-IF tmp_val IS NOT NULL
+-- Actually check if the deposits are sufficient for the refund. Verbosely. ;-)
+IF (tmp_val < deposit_val)
 THEN
-  unspent_val = unspent_val + tmp_val;
-  unspent_frac = unspent_frac + tmp_frac;
+  out_refund_ok=TRUE;
+ELSE
+  IF (tmp_val = deposit_val) AND (tmp_frac <= deposit_frac)
+  THEN
+    out_refund_ok=TRUE;
+  ELSE
+    out_refund_ok=FALSE;
+  END IF;
 END IF;
 
--- Note: even if 'check_recoup' is true, the tables below
--- are in practice likely empty (as they only apply if
--- the exchange (ever) had to revoke keys).
-IF check_recoup
+IF (tmp_val = deposit_val) AND (tmp_frac = deposit_frac)
 THEN
+  -- Refunds have reached the full value of the original
+  -- deposit. Also refund the deposit fee.
+  in_amount_frac = in_amount_frac + in_deposit_fee_frac;
+  in_amount_val = in_amount_val + in_deposit_fee_val;
+
+  -- Normalize result before continuing
+  in_amount_val = in_amount_val + in_amount_frac / 100000000;
+  in_amount_frac = in_amount_frac % 100000000;
+END IF;
 
-  SELECT
-     SUM(amount_val) -- overflow here is not plausible
-    ,SUM(CAST(amount_frac AS INT8)) -- compute using 64 bits
-    INTO
-     tmp_val
-    ,tmp_frac
-    FROM recoup_refresh
-   WHERE known_coin_id=coin_uuid;
+-- Update balance of the coin.
+UPDATE known_coins
+  SET
+    remaining_frac=remaining_frac+in_amount_frac
+       - CASE
+         WHEN remaining_frac+in_amount_frac >= 100000000
+         THEN 100000000
+         ELSE 0
+         END,
+    remaining_val=remaining_val+in_amount_val
+       + CASE
+         WHEN remaining_frac+in_amount_frac >= 100000000
+         THEN 1
+         ELSE 0
+         END
+  WHERE coin_pub=in_coin_pub;
+
+
+out_conflict=FALSE;
+out_not_found=FALSE;
 
-  IF tmp_val IS NOT NULL
-  THEN
-    spent_val = spent_val + tmp_val;
-    spent_frac = spent_frac + tmp_frac;
-  END IF;
+END $$;
 
+-- COMMENT ON FUNCTION exchange_do_refund(INT8, INT4, BYTEA, BOOLEAN, BOOLEAN)
+--  IS 'Executes a refund operation, checking that the corresponding deposit was sufficient to cover the refunded amount';
+
+
+CREATE OR REPLACE FUNCTION exchange_do_recoup_to_reserve(
+  IN in_reserve_pub BYTEA,
+  IN in_reserve_out_serial_id INT8,
+  IN in_amount_val INT8,
+  IN in_amount_frac INT4,
+  IN in_coin_blind BYTEA,
+  IN in_coin_pub BYTEA,
+  IN in_known_coin_id INT8,
+  IN in_coin_sig BYTEA,
+  IN in_reserve_gc INT8,
+  IN in_reserve_expiration INT8,
+  IN in_recoup_timestamp INT8,
+  OUT out_recoup_ok BOOLEAN,
+  OUT out_internal_failure BOOLEAN,
+  OUT out_recoup_timestamp INT8)
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  tmp_val INT8; -- previous amount recouped
+DECLARE
+  tmp_frac INT8; -- previous amount recouped
+BEGIN
+-- Shards: SELECT known_coins (by coin_pub)
+--         SELECT recoup (by known_coin_id)
+--         UPDATE reserves (by reserve_pub)
+--         INSERT recoup (by known_coin_id)
+
+out_internal_failure=FALSE;
+
+-- Check and update balance of the coin.
+UPDATE known_coins
+  SET
+    remaining_frac=remaining_frac-in_amount_frac
+       + CASE
+         WHEN remaining_frac < in_amount_frac
+         THEN 100000000
+         ELSE 0
+         END,
+    remaining_val=remaining_val-in_amount_val
+       - CASE
+         WHEN remaining_frac < in_amount_frac
+         THEN 1
+         ELSE 0
+         END
+  WHERE coin_pub=in_coin_pub
+    AND ( (remaining_val > in_amount_val) OR
+          ( (remaining_frac >= in_amount_frac) AND
+            (remaining_val >= in_amount_val) ) );
+
+IF NOT FOUND
+THEN
+  -- Check if we already recouped this coin before!
   SELECT
-     SUM(amount_val) -- overflow here is not plausible
-    ,SUM(CAST(amount_frac AS INT8)) -- compute using 64 bits
+       amount_val
+      ,amount_frac
+      ,recoup_timestamp
     INTO
-     tmp_val
-    ,tmp_frac
+       tmp_val
+      ,tmp_frac
+      ,out_recoup_timestamp
     FROM recoup
-   WHERE known_coin_id=coin_uuid;
+    WHERE known_coin_id=in_known_coin_id;
 
-  IF tmp_val IS NOT NULL
+  IF FOUND
   THEN
-    spent_val = spent_val + tmp_val;
-    spent_frac = spent_frac + tmp_frac;
+    -- Idempotent request, all OK!
+    out_recoup_ok= (tmp_val = in_amount_val) AND
+                   (tmp_frac = in_amount_frac);
+    RETURN;
   END IF;
 
+  out_recoup_ok=FALSE;
+  RETURN;
+END IF;
+
+
+-- Credit the reserve and update reserve timers.
+UPDATE reserves
+  SET
+    current_balance_frac=current_balance_frac+in_amount_frac
+       - CASE
+         WHEN current_balance_frac+in_amount_frac >= 100000000
+         THEN 100000000
+         ELSE 0
+         END,
+    current_balance_val=current_balance_val+in_amount_val
+       + CASE
+         WHEN current_balance_frac+in_amount_frac >= 100000000
+         THEN 1
+         ELSE 0
+         END,
+    gc_date=GREATEST(gc_date, in_reserve_gc),
+    expiration_date=GREATEST(expiration_date, in_reserve_expiration)
+  WHERE reserve_pub=in_reserve_pub;
+
+
+IF NOT FOUND
+THEN
+  RAISE NOTICE 'failed to increase reserve balance from recoup';
+  out_recoup_ok=FALSE;
+  out_internal_failure=TRUE;
+  RETURN;
+END IF;
+
+
+INSERT INTO recoup
+  (known_coin_id
+  ,coin_sig
+  ,coin_blind
+  ,amount_val
+  ,amount_frac
+  ,recoup_timestamp
+  ,reserve_out_serial_id
+  )
+VALUES
+  (in_known_coin_id
+  ,in_coin_sig
+  ,in_coin_blind
+  ,in_amount_val
+  ,in_amount_frac
+  ,in_recoup_timestamp
+  ,in_reserve_out_serial_id);
+
+-- Normal end, everything is fine.
+out_recoup_ok=TRUE;
+out_recoup_timestamp=in_recoup_timestamp;
+
+END $$;
+
+-- COMMENT ON FUNCTION exchange_do_recoup_to_reserve(INT8, INT4, BYTEA, BOOLEAN, BOOLEAN)
+--  IS 'Executes a recoup of a coin that was withdrawn from a reserve';
+
+
+
+
+
+
+CREATE OR REPLACE FUNCTION exchange_do_recoup_to_coin(
+  IN in_old_coin_pub BYTEA,
+  IN in_rrc_serial INT8,
+  IN in_amount_val INT8,
+  IN in_amount_frac INT4,
+  IN in_coin_blind BYTEA,
+  IN in_coin_pub BYTEA,
+  IN in_known_coin_id INT8,
+  IN in_coin_sig BYTEA,
+  IN in_recoup_timestamp INT8,
+  OUT out_recoup_ok BOOLEAN,
+  OUT out_internal_failure BOOLEAN,
+  OUT out_recoup_timestamp INT8)
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  tmp_val INT8; -- previous amount recouped
+DECLARE
+  tmp_frac INT8; -- previous amount recouped
+BEGIN
+
+-- Shards: UPDATE known_coins (by coin_pub)
+--         SELECT recoup_refresh (by known_coin_id)
+--         UPDATE known_coins (by coin_pub)
+--         INSERT recoup_refresh (by known_coin_id)
+
+
+out_internal_failure=FALSE;
+
+-- Check and update balance of the coin.
+UPDATE known_coins
+  SET
+    remaining_frac=remaining_frac-in_amount_frac
+       + CASE
+         WHEN remaining_frac < in_amount_frac
+         THEN 100000000
+         ELSE 0
+         END,
+    remaining_val=remaining_val-in_amount_val
+       - CASE
+         WHEN remaining_frac < in_amount_frac
+         THEN 1
+         ELSE 0
+         END
+  WHERE coin_pub=in_coin_pub
+    AND ( (remaining_val > in_amount_val) OR
+          ( (remaining_frac >= in_amount_frac) AND
+            (remaining_val >= in_amount_val) ) );
+
+IF NOT FOUND
+THEN
+  -- Check if we already recouped this coin before!
   SELECT
-     SUM(amount_val) -- overflow here is not plausible
-    ,SUM(CAST(amount_frac AS INT8)) -- compute using 64 bits
+       amount_val
+      ,amount_frac
+      ,recoup_timestamp
     INTO
-     tmp_val
-    ,tmp_frac
+       tmp_val
+      ,tmp_frac
+      ,out_recoup_timestamp
     FROM recoup_refresh
-    JOIN refresh_revealed_coins rrc
-        USING (rrc_serial)
-    JOIN refresh_commitments rfc
-         ON (rrc.melt_serial_id = rfc.melt_serial_id)
-   WHERE rfc.old_known_coin_id=coin_uuid;
+    WHERE known_coin_id=in_known_coin_id;
 
-  IF tmp_val IS NOT NULL
+  IF FOUND
   THEN
-    unspent_val = unspent_val + tmp_val;
-    unspent_frac = unspent_frac + tmp_frac;
-  END IF;
-
-  IF ( (0 < tmp_val) OR (0 < tmp_frac) )
-  THEN
-    -- There was a transaction that justifies the zombie
-    -- status, clear the flag
-    zombie_required=FALSE;
+    -- Idempotent request, all OK!
+    out_recoup_ok= (tmp_val = in_amount_val) AND
+                   (tmp_frac = in_amount_frac);
+    RETURN;
   END IF;
 
+  -- Insufficient balance, not idempotent.
+  out_recoup_ok=FALSE;
+  RETURN;
 END IF;
 
 
--- normalize results
-spent_val = spent_val + spent_frac / 100000000;
-spent_frac = spent_frac % 100000000;
-unspent_val = unspent_val + unspent_frac / 100000000;
-unspent_frac = unspent_frac % 100000000;
+-- Credit the old coin.
+UPDATE known_coins
+  SET
+    remaining_frac=remaining_frac+in_amount_frac
+       - CASE
+         WHEN remaining_frac+in_amount_frac >= 100000000
+         THEN 100000000
+         ELSE 0
+         END,
+    remaining_val=remaining_val+in_amount_val
+       + CASE
+         WHEN remaining_frac+in_amount_frac >= 100000000
+         THEN 1
+         ELSE 0
+         END
+  WHERE coin_pub=in_old_coin_pub;
+
 
--- Actually check if the coin balance is sufficient. Verbosely. ;-)
-IF (unspent_val > spent_val)
+IF NOT FOUND
 THEN
-  balance_ok=TRUE;
-ELSE
-  IF (unspent_val = spent_val) AND (unspent_frac >= spent_frac)
-  THEN
-    balance_ok=TRUE;
-  ELSE
-    balance_ok=FALSE;
-  END IF;
+  RAISE NOTICE 'failed to increase old coin balance from recoup';
+  out_recoup_ok=FALSE;
+  out_internal_failure=TRUE;
+  RETURN;
 END IF;
 
-zombie_ok = NOT zombie_required;
+
+INSERT INTO recoup_refresh
+  (known_coin_id
+  ,coin_sig
+  ,coin_blind
+  ,amount_val
+  ,amount_frac
+  ,recoup_timestamp
+  ,rrc_serial
+  )
+VALUES
+  (in_known_coin_id
+  ,in_coin_sig
+  ,in_coin_blind
+  ,in_amount_val
+  ,in_amount_frac
+  ,in_recoup_timestamp
+  ,in_rrc_serial);
+
+-- Normal end, everything is fine.
+out_recoup_ok=TRUE;
+out_recoup_timestamp=in_recoup_timestamp;
 
 END $$;
 
-COMMENT ON FUNCTION exchange_do_check_coin_balance(INT8, INT4, BYTEA, BOOLEAN, BOOLEAN)
-  IS 'Checks whether the coin has sufficient balance for all the operations associated with it';
 
+-- COMMENT ON FUNCTION exchange_do_recoup_to_coin(INT8, INT4, BYTEA, BOOLEAN, BOOLEAN)
+--  IS 'Executes a recoup-refresh of a coin that was obtained from a refresh-reveal process';
+
+
+
+CREATE OR REPLACE PROCEDURE exchange_do_gc(
+  IN in_ancient_date INT8,
+  IN in_now INT8)
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  reserve_uuid_min INT8; -- minimum reserve UUID still alive
+DECLARE
+  melt_min INT8; -- minimum melt still alive
+DECLARE
+  coin_min INT8; -- minimum known_coin still alive
+DECLARE
+  deposit_min INT8; -- minimum deposit still alive
+DECLARE
+  reserve_out_min INT8; -- minimum reserve_out still alive
+BEGIN
+
+DELETE FROM prewire
+  WHERE finished=TRUE;
+
+DELETE FROM wire_fee
+  WHERE end_date < in_ancient_date;
+
+-- TODO: use closing fee as threshold?
+DELETE FROM reserves
+  WHERE gc_date < in_now
+    AND current_balance_val = 0
+    AND current_balance_frac = 0;
+
+SELECT
+     reserve_out_serial_id
+  INTO
+     reserve_out_min
+  FROM reserves_out
+  ORDER BY reserve_out_serial_id ASC
+  LIMIT 1;
+
+DELETE FROM recoup
+  WHERE reserve_out_serial_id < reserve_out_min;
+
+
+SELECT
+     reserve_uuid
+  INTO
+     reserve_uuid_min
+  FROM reserves
+  ORDER BY reserve_uuid ASC
+  LIMIT 1;
+
+DELETE FROM reserves_out
+  WHERE reserve_uuid < reserve_uuid_min;
+
+
+DELETE FROM denominations
+  WHERE expire_legal < in_now
+    AND denominations_serial NOT IN
+      (SELECT DISTINCT denominations_serial
+         FROM reserves_out)
+    AND denominations_serial NOT IN
+      (SELECT DISTINCT denominations_serial
+         FROM known_coins
+        WHERE known_coin_id IN
+          (SELECT DISTINCT known_coin_id
+             FROM recoup))
+    AND denominations_serial NOT IN
+      (SELECT DISTINCT denominations_serial
+         FROM known_coins
+        WHERE known_coin_id IN
+          (SELECT DISTINCT known_coin_id
+             FROM recoup_refresh));
+
+SELECT
+     melt_serial_id
+  INTO
+     melt_min
+  FROM refresh_commitments
+  ORDER BY melt_serial_id ASC
+  LIMIT 1;
+
+DELETE FROM refresh_revealed_coins
+  WHERE melt_serial_id < melt_min;
+
+DELETE FROM refresh_transfer_keys
+  WHERE melt_serial_id < melt_min;
+
+SELECT
+     known_coin_id
+  INTO
+     coin_min
+  FROM known_coins
+  ORDER BY known_coin_id ASC
+  LIMIT 1;
 
+DELETE FROM deposits
+  WHERE known_coin_id < coin_min;
+
+SELECT
+     deposit_serial_id
+  INTO
+     deposit_min
+  FROM deposits
+  ORDER BY deposit_serial_id ASC
+  LIMIT 1;
+
+DELETE FROM refunds
+  WHERE deposit_serial_id < deposit_min;
+
+DELETE FROM aggregation_tracking
+  WHERE deposit_serial_id < deposit_min;
+
+
+END $$;
 
 
 -- Complete transaction
diff --git a/src/exchangedb/irbt_callbacks.c b/src/exchangedb/irbt_callbacks.c
index ffccbef3b..0e0264e89 100644
--- a/src/exchangedb/irbt_callbacks.c
+++ b/src/exchangedb/irbt_callbacks.c
@@ -233,8 +233,8 @@ irbt_cb_table_reserves_out (struct PostgresClosure *pg,
       &td->details.reserves_out.denominations_serial),
     TALER_PQ_query_param_blinded_denom_sig (
       &td->details.reserves_out.denom_sig),
-    GNUNET_PQ_query_param_auto_from_type (
-      &td->details.reserves_out.reserve_pub),
+    GNUNET_PQ_query_param_uint64 (
+      &td->details.reserves_out.reserve_uuid),
     GNUNET_PQ_query_param_auto_from_type (
       &td->details.reserves_out.reserve_sig),
     GNUNET_PQ_query_param_timestamp (
@@ -404,8 +404,8 @@ irbt_cb_table_refresh_commitments (struct PostgresClosure *pg,
       &td->details.refresh_commitments.amount_with_fee),
     GNUNET_PQ_query_param_uint32 (
       &td->details.refresh_commitments.noreveal_index),
-    GNUNET_PQ_query_param_uint64 (
-      &td->details.refresh_commitments.old_known_coin_id),
+    GNUNET_PQ_query_param_auto_from_type (
+      &td->details.refresh_commitments.old_coin_pub),
     GNUNET_PQ_query_param_end
   };
 
diff --git a/src/exchangedb/lrbt_callbacks.c b/src/exchangedb/lrbt_callbacks.c
index 4711ac86b..04be98696 100644
--- a/src/exchangedb/lrbt_callbacks.c
+++ b/src/exchangedb/lrbt_callbacks.c
@@ -408,9 +408,9 @@ lrbt_cb_table_reserves_out (void *cls,
       TALER_PQ_result_spec_blinded_denom_sig (
         "denom_sig",
         &td.details.reserves_out.denom_sig),
-      GNUNET_PQ_result_spec_auto_from_type (
-        "reserve_pub",
-        &td.details.reserves_out.reserve_pub),
+      GNUNET_PQ_result_spec_uint64 (
+        "reserve_uuid",
+        &td.details.reserves_out.reserve_uuid),
       GNUNET_PQ_result_spec_auto_from_type (
         "reserve_sig",
         &td.details.reserves_out.reserve_sig),
@@ -732,9 +732,9 @@ lrbt_cb_table_refresh_commitments (void *cls,
       GNUNET_PQ_result_spec_uint32 (
         "noreveal_index",
         &td.details.refresh_commitments.noreveal_index),
-      GNUNET_PQ_result_spec_uint64 (
-        "old_known_coin_id",
-        &td.details.refresh_commitments.old_known_coin_id),
+      GNUNET_PQ_result_spec_auto_from_type (
+        "old_coin_pub",
+        &td.details.refresh_commitments.old_coin_pub),
       GNUNET_PQ_result_spec_end
     };
 
@@ -1219,7 +1219,7 @@ lrbt_cb_table_recoup (void *cls,
                                             &td.details.recoup.coin_blind),
       TALER_PQ_RESULT_SPEC_AMOUNT ("amount",
                                    &td.details.recoup.amount),
-      GNUNET_PQ_result_spec_timestamp ("timestamp",
+      GNUNET_PQ_result_spec_timestamp ("recoup_timestamp",
                                        &td.details.recoup.timestamp),
       GNUNET_PQ_result_spec_uint64 ("known_coin_id",
                                     &td.details.recoup.known_coin_id),
@@ -1274,7 +1274,7 @@ lrbt_cb_table_recoup_refresh (void *cls,
         &td.details.recoup_refresh.coin_blind),
       TALER_PQ_RESULT_SPEC_AMOUNT ("amount",
                                    &td.details.recoup_refresh.amount),
-      GNUNET_PQ_result_spec_timestamp ("timestamp",
+      GNUNET_PQ_result_spec_timestamp ("recoup_timestamp",
                                        &td.details.recoup_refresh.timestamp),
       GNUNET_PQ_result_spec_uint64 ("known_coin_id",
                                     &td.details.recoup_refresh.known_coin_id),
diff --git a/src/exchangedb/plugin_exchangedb_postgres.c b/src/exchangedb/plugin_exchangedb_postgres.c
index 5ac344c20..d5290d9c0 100644
--- a/src/exchangedb/plugin_exchangedb_postgres.c
+++ b/src/exchangedb/plugin_exchangedb_postgres.c
@@ -400,16 +400,6 @@ prepare_statements (struct PostgresClosure *pg)
       " WHERE wire_target_serial_id=$1"
       " LIMIT 1;",
       1),
-    /* Used in #postgres_get_kyc_status() */
-    GNUNET_PQ_make_prepare (
-      "get_kyc_status",
-      "SELECT"
-      " kyc_ok"
-      ",wire_target_serial_id AS payment_target_uuid"
-      " FROM wire_targets"
-      " WHERE payto_uri=$1"
-      " LIMIT 1;",
-      1),
     /* Used in #postgres_select_kyc_status() */
     GNUNET_PQ_make_prepare (
       "select_kyc_status",
@@ -519,17 +509,6 @@ prepare_statements (struct PostgresClosure *pg)
     /* Used in postgres_select_reserves_in_above_serial_id() to obtain inbound
        transactions for reserves with serial id '\geq' the given parameter */
     GNUNET_PQ_make_prepare (
-      "reserves_in_get_latest_wire_reference",
-      "SELECT"
-      " wire_reference"
-      " FROM reserves_in"
-      " WHERE exchange_account_section=$1"
-      " ORDER BY reserve_in_serial_id DESC"
-      " LIMIT 1;",
-      1),
-    /* Used in postgres_select_reserves_in_above_serial_id() to obtain inbound
-       transactions for reserves with serial id '\geq' the given parameter */
-    GNUNET_PQ_make_prepare (
       "audit_reserves_in_get_transactions_incr",
       "SELECT"
       " reserves.reserve_pub"
@@ -589,16 +568,6 @@ prepare_statements (struct PostgresClosure *pg)
       "lock_withdraw",
       "LOCK TABLE reserves_out;",
       0),
-    /* Used in #postgres_do_check_coin_balance() to check
-       a coin's balance */
-    GNUNET_PQ_make_prepare (
-      "call_check_coin_balance",
-      "SELECT "
-      " balance_ok"
-      ",zombie_ok"
-      " FROM exchange_do_check_coin_balance"
-      " ($1,$2,$3,$4,$5);",
-      5),
     /* Used in #postgres_do_withdraw() to store
        the signature of a blinded coin with the blinded coin's
        details before returning it during /reserve/withdraw. We store
@@ -613,6 +582,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",balance_ok"
       ",kycok AS kyc_ok"
       ",account_uuid AS payment_target_uuid"
+      ",ruuid"
       " FROM exchange_do_withdraw"
       " ($1,$2,$3,$4,$5,$6,$7,$8,$9);",
       9),
@@ -626,28 +596,58 @@ prepare_statements (struct PostgresClosure *pg)
       " FROM exchange_do_withdraw_limit_check"
       " ($1,$2,$3,$4);",
       4),
-    /* Used in #postgres_insert_withdraw_info() to store
-       the signature of a blinded coin with the blinded coin's
-       details before returning it during /reserve/withdraw. We store
-       the coin's denomination information (public key, signature)
-       and the blinded message as well as the reserve that the coin
-       is being withdrawn from and the signature of the message
-       authorizing the withdrawal. */
+    /* Used in #postgres_do_deposit() to execute a deposit,
+       checking the coin's balance in the process as needed. */
     GNUNET_PQ_make_prepare (
-      "insert_withdraw_info",
-      "INSERT INTO reserves_out "
-      "(h_blind_ev"
-      ",denominations_serial"
-      ",denom_sig"
-      ",reserve_pub"
-      ",reserve_sig"
-      ",execution_date"
-      ",amount_with_fee_val"
-      ",amount_with_fee_frac"
-      ") SELECT $1, denominations_serial, $3, $4, $5, $6, $7, $8"
-      "    FROM denominations"
-      "    WHERE denom_pub_hash=$2;",
+      "call_deposit",
+      "SELECT "
+      " out_exchange_timestamp AS exchange_timestamp"
+      ",out_balance_ok AS balance_ok"
+      ",out_conflict AS conflicted"
+      " FROM exchange_do_deposit"
+      " ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17);",
+      17),
+    /* Used in #postgres_do_melt() to melt a coin. */
+    GNUNET_PQ_make_prepare (
+      "call_melt",
+      "SELECT "
+      " out_balance_ok AS balance_ok"
+      ",out_zombie_bad AS zombie_required"
+      ",out_noreveal_index AS noreveal_index"
+      " FROM exchange_do_melt"
+      " ($1,$2,$3,$4,$5,$6,$7,$8);",
       8),
+    /* Used in #postgres_do_refund() to refund a deposit. */
+    GNUNET_PQ_make_prepare (
+      "call_refund",
+      "SELECT "
+      " out_not_found AS not_found"
+      ",out_refund_ok AS refund_ok"
+      ",out_gone AS gone"
+      ",out_conflict AS conflict"
+      " FROM exchange_do_refund"
+      " ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13);",
+      13),
+    /* Used in #postgres_do_recoup() to recoup a coin to a reserve. */
+    GNUNET_PQ_make_prepare (
+      "call_recoup",
+      "SELECT "
+      " out_recoup_timestamp AS recoup_timestamp"
+      ",out_recoup_ok AS recoup_ok"
+      ",out_internal_failure AS internal_failure"
+      " FROM exchange_do_recoup_to_reserve"
+      " ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11);",
+      11),
+    /* Used in #postgres_do_recoup_refresh() to recoup a coin to a zombie coin. */
+    GNUNET_PQ_make_prepare (
+      "call_recoup_refresh",
+      "SELECT "
+      " out_recoup_timestamp AS recoup_timestamp"
+      ",out_recoup_ok AS recoup_ok"
+      ",out_internal_failure AS internal_failure"
+      " FROM exchange_do_recoup_to_coin"
+      " ($1,$2,$3,$4,$5,$6,$7,$8,$9);",
+      9),
     /* Used in #postgres_get_withdraw_info() to
        locate the response for a /reserve/withdraw request
        using the hash of the blinded message.  Used to
@@ -666,7 +666,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",denom.fee_withdraw_frac"
       " FROM reserves_out"
       "    JOIN reserves"
-      "      USING (reserve_pub)"
+      "      USING (reserve_uuid)"
       "    JOIN denominations denom"
       "      USING (denominations_serial)"
       " WHERE h_blind_ev=$1;",
@@ -687,7 +687,9 @@ prepare_statements (struct PostgresClosure *pg)
       ",amount_with_fee_frac"
       ",denom.fee_withdraw_val"
       ",denom.fee_withdraw_frac"
-      " FROM reserves_out"
+      " FROM reserves"
+      "    JOIN reserves_out"
+      "      USING (reserve_uuid)"
       "    JOIN denominations denom"
       "      USING (denominations_serial)"
       " WHERE reserve_pub=$1;",
@@ -706,7 +708,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",reserve_out_serial_id"
       " FROM reserves_out"
       "    JOIN reserves"
-      "      USING (reserve_pub)"
+      "      USING (reserve_uuid)"
       "    JOIN denominations denom"
       "      USING (denominations_serial)"
       " WHERE reserve_out_serial_id>=$1"
@@ -731,6 +733,7 @@ prepare_statements (struct PostgresClosure *pg)
       "get_known_coin",
       "SELECT"
       " denominations.denom_pub_hash"
+      ",age_hash"
       ",denom_sig"
       " FROM known_coins"
       " JOIN denominations USING (denominations_serial)"
@@ -752,49 +755,72 @@ prepare_statements (struct PostgresClosure *pg)
       "get_coin_denomination",
       "SELECT"
       " denominations.denom_pub_hash"
+      ",known_coin_id"
       " FROM known_coins"
       " JOIN denominations USING (denominations_serial)"
       " WHERE coin_pub=$1"
       " FOR SHARE;",
       1),
-    /* Lock deposit table; NOTE: we may want to eventually shard the
-       deposit table to avoid this lock being the main point of
-       contention limiting transaction performance. */
-    GNUNET_PQ_make_prepare (
-      "lock_known_coins",
-      "LOCK TABLE known_coins;",
-      0),
-    /* Used in #postgres_insert_known_coin() to store
-       the denomination public key and signature for
-       a coin known to the exchange. */
+    /* Used in #postgres_insert_known_coin() to store the denomination public
+       key and signature for a coin known to the exchange.
+
+       See also:
+       https://stackoverflow.com/questions/34708509/how-to-use-returning-with-on-conflict-in-postgresql/37543015#37543015
+    */
     GNUNET_PQ_make_prepare (
       "insert_known_coin",
-      "INSERT INTO known_coins "
-      "(coin_pub"
-      ",denominations_serial"
-      ",denom_sig"
-      ") SELECT $1, denominations_serial, $3 "
-      "    FROM denominations"
-      "   WHERE denom_pub_hash=$2"
-      " ON CONFLICT DO NOTHING;",
-      3),
+      "WITH dd"
+      "  (denominations_serial"
+      "  ,coin_val"
+      "  ,coin_frac"
+      "  ) AS ("
+      "    SELECT "
+      "       denominations_serial"
+      "      ,coin_val"
+      "      ,coin_frac"
+      "        FROM denominations"
+      "        WHERE denom_pub_hash=$2"
+      "  ), input_rows"
+      "    (coin_pub) AS ("
+      "      VALUES ($1::BYTEA)"
+      "  ), ins AS ("
+      "  INSERT INTO known_coins "
+      "  (coin_pub"
+      "  ,denominations_serial"
+      "  ,age_hash"
+      "  ,denom_sig"
+      "  ,remaining_val"
+      "  ,remaining_frac"
+      "  ) SELECT "
+      "     $1"
+      "    ,denominations_serial"
+      "    ,$3"
+      "    ,$4"
+      "    ,coin_val"
+      "    ,coin_frac"
+      "  FROM dd"
+      "  ON CONFLICT (coin_pub) DO NOTHING"
+      "  RETURNING "
+      "     known_coin_id"
+      "  ) "
+      "SELECT "
+      "   FALSE AS existed"
+      "  ,known_coin_id"
+      "  ,NULL AS denom_pub_hash"
+      "  ,NULL AS age_hash"
+      "  FROM ins "
+      "UNION ALL "
+      "SELECT "
+      "   TRUE AS existed"
+      "  ,known_coin_id"
+      "  ,denom_pub_hash"
+      "  ,kc.age_hash"
+      "  FROM input_rows"
+      "  JOIN known_coins kc USING (coin_pub)"
+      "  JOIN denominations USING (denominations_serial)"
+      "  LIMIT 1",
+      4),
 
-    /* Used in #postgres_insert_melt() to store
-       high-level information about a melt operation */
-    GNUNET_PQ_make_prepare (
-      "insert_melt",
-      "INSERT INTO refresh_commitments "
-      "(rc "
-      ",old_known_coin_id "
-      ",old_coin_sig "
-      ",amount_with_fee_val "
-      ",amount_with_fee_frac "
-      ",noreveal_index "
-      ") SELECT $1, known_coin_id, $3, $4, $5, $6"
-      "    FROM known_coins"
-      "   WHERE coin_pub=$2"
-      " ON CONFLICT DO NOTHING",
-      6),
     /* Used in #postgres_get_melt() to fetch
        high-level information about a melt operation */
     GNUNET_PQ_make_prepare (
@@ -803,27 +829,19 @@ prepare_statements (struct PostgresClosure *pg)
       " denoms.denom_pub_hash"
       ",denoms.fee_refresh_val"
       ",denoms.fee_refresh_frac"
-      ",kc.coin_pub AS old_coin_pub"
+      ",old_coin_pub"
       ",old_coin_sig"
       ",amount_with_fee_val"
       ",amount_with_fee_frac"
       ",noreveal_index"
+      ",melt_serial_id"
       " FROM refresh_commitments"
       "   JOIN known_coins kc"
-      "     ON (refresh_commitments.old_known_coin_id = kc.known_coin_id)"
+      "     ON (old_coin_pub = kc.coin_pub)"
       "   JOIN denominations denoms"
       "     ON (kc.denominations_serial = denoms.denominations_serial)"
       " WHERE rc=$1;",
       1),
-    /* Used in #postgres_get_melt_index() to fetch
-       the noreveal index from a previous melt operation */
-    GNUNET_PQ_make_prepare (
-      "get_melt_index",
-      "SELECT"
-      " noreveal_index"
-      " FROM refresh_commitments"
-      " WHERE rc=$1;",
-      1),
     /* Used in #postgres_select_refreshes_above_serial_id() to fetch
        refresh session with id '\geq' the given parameter */
     GNUNET_PQ_make_prepare (
@@ -839,7 +857,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",rc"
       " FROM refresh_commitments"
       "   JOIN known_coins kc"
-      "     ON (refresh_commitments.old_known_coin_id = kc.known_coin_id)"
+      "     ON (refresh_commitments.old_coin_pub = kc.coin_pub)"
       "   JOIN denominations denom"
       "     ON (kc.denominations_serial = denom.denominations_serial)"
       " WHERE melt_serial_id>=$1"
@@ -859,22 +877,15 @@ prepare_statements (struct PostgresClosure *pg)
       ",melt_serial_id"
       " FROM refresh_commitments"
       " JOIN known_coins kc"
-      "   ON (refresh_commitments.old_known_coin_id = kc.known_coin_id)"
+      "   ON (refresh_commitments.old_coin_pub = kc.coin_pub)"
       " JOIN denominations denoms"
       "   USING (denominations_serial)"
-      " WHERE old_known_coin_id="
-      "(SELECT known_coin_id"
-      "   FROM known_coins"
-      "  WHERE coin_pub=$1);",
+      " WHERE old_coin_pub=$1;",
       1),
     /* Store information about the desired denominations for a
        refresh operation, used in #postgres_insert_refresh_reveal() */
     GNUNET_PQ_make_prepare (
       "insert_refresh_revealed_coin",
-      "WITH rcx AS"
-      " (SELECT melt_serial_id"
-      "    FROM refresh_commitments"
-      "   WHERE rc=$1)"
       "INSERT INTO refresh_revealed_coins "
       "(melt_serial_id "
       ",freshcoin_index "
@@ -883,10 +894,9 @@ prepare_statements (struct PostgresClosure *pg)
       ",coin_ev"
       ",h_coin_ev"
       ",ev_sig"
-      ") SELECT rcx.melt_serial_id, $2, $3, "
+      ") SELECT $1, $2, $3, "
       "         denominations_serial, $5, $6, $7"
       "    FROM denominations"
-      "   CROSS JOIN rcx"
       "   WHERE denom_pub_hash=$4;",
       7),
     /* Obtain information about the coins created in a refresh
@@ -895,7 +905,7 @@ prepare_statements (struct PostgresClosure *pg)
       "get_refresh_revealed_coins",
       "SELECT "
       " rrc.freshcoin_index"
-      ",denom.denom_pub"
+      ",denom.denom_pub_hash"
       ",rrc.link_sig"
       ",rrc.coin_ev"
       ",rrc.ev_sig"
@@ -904,8 +914,7 @@ prepare_statements (struct PostgresClosure *pg)
       "      USING (melt_serial_id)"
       "    JOIN denominations denom "
       "      USING (denominations_serial)"
-      " WHERE rc=$1"
-      "   ORDER BY freshcoin_index ASC;",
+      " WHERE rc=$1;",
       1),
 
     /* Used in #postgres_insert_refresh_reveal() to store the transfer
@@ -916,22 +925,8 @@ prepare_statements (struct PostgresClosure *pg)
       "(melt_serial_id"
       ",transfer_pub"
       ",transfer_privs"
-      ") SELECT melt_serial_id, $2, $3"
-      "    FROM refresh_commitments"
-      "   WHERE rc=$1",
+      ") VALUES ($1, $2, $3);",
       3),
-    /* Used in #postgres_get_refresh_reveal() to retrieve transfer
-       keys from /refresh/reveal */
-    GNUNET_PQ_make_prepare (
-      "get_refresh_transfer_keys",
-      "SELECT"
-      " transfer_pub"
-      ",transfer_privs"
-      " FROM refresh_transfer_keys"
-      " JOIN refresh_commitments"
-      "   USING (melt_serial_id)"
-      " WHERE rc=$1;",
-      1),
     /* Used in #postgres_insert_refund() to store refund information */
     GNUNET_PQ_make_prepare (
       "insert_refund",
@@ -943,8 +938,10 @@ prepare_statements (struct PostgresClosure *pg)
       ",amount_with_fee_frac "
       ") SELECT deposit_serial_id, $3, $5, $6, $7"
       "    FROM deposits"
-      "    JOIN known_coins USING (known_coin_id)"
-      "   WHERE coin_pub=$1"
+      "   WHERE known_coin_id="
+      "     (SELECT known_coin_id "
+      "        FROM known_coins"
+      "       WHERE coin_pub=$1)"
       "     AND h_contract_terms=$4"
       "     AND merchant_pub=$2",
       7),
@@ -1224,10 +1221,7 @@ prepare_statements (struct PostgresClosure *pg)
       "       USING (melt_serial_id)"
       "     JOIN denominations denoms"
       "       ON (rrc.denominations_serial = denoms.denominations_serial)"
-      " WHERE old_known_coin_id="
-      "   (SELECT known_coin_id "
-      "      FROM known_coins"
-      "     WHERE coin_pub=$1)"
+      " WHERE old_coin_pub=$1"
       " ORDER BY tp.transfer_pub, rrc.freshcoin_index ASC",
       1),
     /* Used in #postgres_lookup_wire_transfer */
@@ -1356,7 +1350,7 @@ prepare_statements (struct PostgresClosure *pg)
     GNUNET_PQ_make_prepare (
       "wire_prepare_data_insert",
       "INSERT INTO prewire "
-      "(type"
+      "(wire_method"
       ",buf"
       ") VALUES "
       "($1, $2);",
@@ -1380,7 +1374,7 @@ prepare_statements (struct PostgresClosure *pg)
       "wire_prepare_data_get",
       "SELECT"
       " prewire_uuid"
-      ",type"
+      ",wire_method"
       ",buf"
       " FROM prewire"
       " WHERE prewire_uuid >= $1"
@@ -1451,54 +1445,12 @@ prepare_statements (struct PostgresClosure *pg)
       "  AND exchange_account_section=$2"
       " ORDER BY wireout_uuid ASC;",
       2),
-    /* Used in #postgres_insert_recoup_request() to store recoup
-       information */
-    GNUNET_PQ_make_prepare (
-      "recoup_insert",
-      "WITH rx AS"
-      " (SELECT reserve_out_serial_id"
-      "    FROM reserves_out"
-      "   WHERE h_blind_ev=$7)"
-      "INSERT INTO recoup "
-      "(known_coin_id"
-      ",coin_sig"
-      ",coin_blind"
-      ",amount_val"
-      ",amount_frac"
-      ",timestamp"
-      ",reserve_out_serial_id"
-      ") SELECT known_coin_id, $2, $3, $4, $5, $6, rx.reserve_out_serial_id"
-      "    FROM known_coins"
-      "   CROSS JOIN rx"
-      "   WHERE coin_pub=$1;",
-      7),
-    /* Used in #postgres_insert_recoup_refresh_request() to store recoup-refresh
-       information */
-    GNUNET_PQ_make_prepare (
-      "recoup_refresh_insert",
-      "WITH rrx AS"
-      " (SELECT rrc_serial"
-      "    FROM refresh_revealed_coins"
-      "   WHERE h_coin_ev=$7)"
-      "INSERT INTO recoup_refresh "
-      "(known_coin_id"
-      ",coin_sig"
-      ",coin_blind"
-      ",amount_val"
-      ",amount_frac"
-      ",timestamp"
-      ",rrc_serial"
-      ") SELECT known_coin_id, $2, $3, $4, $5, $6, rrx.rrc_serial"
-      "    FROM known_coins"
-      "   CROSS JOIN rrx"
-      "   WHERE coin_pub=$1;",
-      7),
     /* Used in #postgres_select_recoup_above_serial_id() to obtain recoup transactions */
     GNUNET_PQ_make_prepare (
       "recoup_get_incr",
       "SELECT"
       " recoup_uuid"
-      ",timestamp"
+      ",recoup_timestamp"
       ",reserves.reserve_pub"
       ",coins.coin_pub"
       ",coin_sig"
@@ -1515,7 +1467,7 @@ prepare_statements (struct PostgresClosure *pg)
       "    JOIN reserves_out ro"
       "      USING (reserve_out_serial_id)"
       "    JOIN reserves"
-      "      USING (reserve_pub)"
+      "      USING (reserve_uuid)"
       "    JOIN denominations denoms"
       "      ON (coins.denominations_serial = denoms.denominations_serial)"
       " WHERE recoup_uuid>=$1"
@@ -1527,7 +1479,7 @@ prepare_statements (struct PostgresClosure *pg)
       "recoup_refresh_get_incr",
       "SELECT"
       " recoup_refresh_uuid"
-      ",timestamp"
+      ",recoup_timestamp"
       ",old_coins.coin_pub AS old_coin_pub"
       ",old_denoms.denom_pub_hash AS old_denom_pub_hash"
       ",new_coins.coin_pub As coin_pub"
@@ -1545,7 +1497,7 @@ prepare_statements (struct PostgresClosure *pg)
       "    INNER JOIN refresh_commitments rfc"
       "      ON (rrc.melt_serial_id = rfc.melt_serial_id)"
       "    INNER JOIN known_coins old_coins"
-      "      ON (rfc.old_known_coin_id = old_coins.known_coin_id)"
+      "      ON (rfc.old_coin_pub = old_coins.coin_pub)"
       "    INNER JOIN known_coins new_coins"
       "      ON (new_coins.known_coin_id = recoup_refresh.known_coin_id)"
       "    INNER JOIN denominations new_denoms"
@@ -1587,17 +1539,19 @@ prepare_statements (struct PostgresClosure *pg)
       ",coin_blind"
       ",amount_val"
       ",amount_frac"
-      ",timestamp"
+      ",recoup_timestamp"
       ",denoms.denom_pub_hash"
       ",coins.denom_sig"
-      " FROM recoup"
-      "    JOIN known_coins coins"
-      "      USING (known_coin_id)"
-      "    JOIN denominations denoms"
-      "      USING (denominations_serial)"
-      "    JOIN reserves_out ro"
-      "      USING (reserve_out_serial_id)"
-      " WHERE ro.reserve_pub=$1;",
+      " FROM reserves"
+      " JOIN reserves_out ro"
+      "   USING (reserve_uuid)"
+      " JOIN recoup"
+      "   USING (reserve_out_serial_id)"
+      " JOIN known_coins coins"
+      "     USING (known_coin_id)"
+      " JOIN denominations denoms"
+      "   ON (coins.denominations_serial = denoms.denominations_serial)"
+      " WHERE reserve_pub=$1;",
       1),
     /* Used in #postgres_get_coin_transactions() to obtain recoup transactions
        affecting old coins of refreshed coins */
@@ -1609,7 +1563,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",coin_blind"
       ",amount_val"
       ",amount_frac"
-      ",timestamp"
+      ",recoup_timestamp"
       ",denoms.denom_pub_hash"
       ",coins.denom_sig"
       ",recoup_refresh_uuid"
@@ -1623,10 +1577,7 @@ prepare_statements (struct PostgresClosure *pg)
       "    FROM refresh_commitments"
       "       JOIN refresh_revealed_coins rrc"
       "           USING (melt_serial_id)"
-      "    WHERE old_known_coin_id="
-      "       (SELECT known_coin_id"
-      "          FROM known_coins"
-      "         WHERE coin_pub=$1));",
+      "    WHERE old_coin_pub=$1);",
       1),
     /* Used in #postgres_get_reserve_history() */
     GNUNET_PQ_make_prepare (
@@ -1675,13 +1626,13 @@ prepare_statements (struct PostgresClosure *pg)
       ",coin_blind"
       ",amount_val"
       ",amount_frac"
-      ",timestamp"
+      ",recoup_timestamp"
       ",recoup_uuid"
       " FROM recoup"
       " JOIN reserves_out ro"
       "   USING (reserve_out_serial_id)"
       " JOIN reserves"
-      "   USING (reserve_pub)"
+      "   USING (reserve_uuid)"
       " JOIN known_coins coins"
       "   USING (known_coin_id)"
       " JOIN denominations denoms"
@@ -1698,7 +1649,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",coin_blind"
       ",amount_val"
       ",amount_frac"
-      ",timestamp"
+      ",recoup_timestamp"
       ",denoms.denom_pub_hash"
       ",coins.denom_sig"
       ",recoup_refresh_uuid"
@@ -1708,7 +1659,7 @@ prepare_statements (struct PostgresClosure *pg)
       "    JOIN refresh_commitments rfc"
       "      ON (rrc.melt_serial_id = rfc.melt_serial_id)"
       "    JOIN known_coins old_coins"
-      "      ON (rfc.old_known_coin_id = old_coins.known_coin_id)"
+      "      ON (rfc.old_coin_pub = old_coins.coin_pub)"
       "    JOIN known_coins coins"
       "      ON (recoup_refresh.known_coin_id = coins.known_coin_id)"
       "    JOIN denominations denoms"
@@ -1720,9 +1671,10 @@ prepare_statements (struct PostgresClosure *pg)
       "reserve_by_h_blind",
       "SELECT"
       " reserves.reserve_pub"
+      ",reserve_out_serial_id"
       " FROM reserves_out"
       " JOIN reserves"
-      "   USING (reserve_pub)"
+      "   USING (reserve_uuid)"
       " WHERE h_blind_ev=$1"
       " LIMIT 1;",
       1),
@@ -1731,9 +1683,10 @@ prepare_statements (struct PostgresClosure *pg)
       "old_coin_by_h_blind",
       "SELECT"
       " okc.coin_pub AS old_coin_pub"
+      ",rrc_serial"
       " FROM refresh_revealed_coins rrc"
       " JOIN refresh_commitments rcom USING (melt_serial_id)"
-      " JOIN known_coins okc ON (rcom.old_known_coin_id = okc.known_coin_id)"
+      " JOIN known_coins okc ON (rcom.old_coin_pub = okc.coin_pub)"
       " WHERE h_coin_ev=$1"
       " LIMIT 1;",
       1),
@@ -1923,16 +1876,6 @@ prepare_statements (struct PostgresClosure *pg)
       "    FROM denominations"
       "    WHERE denom_pub_hash=$2);",
       2),
-    /* used in #postgres_select_withdraw_amounts_by_account() */
-    GNUNET_PQ_make_prepare (
-      "select_above_date_by_reserves_out",
-      "SELECT"
-      " amount_with_fee_val"
-      ",amount_with_fee_frac"
-      " FROM reserves_out"
-      " WHERE reserve_pub=$1"
-      "  AND execution_date > $2;",
-      2),
     /* used in #postgres_lookup_wire_fee_by_time() */
     GNUNET_PQ_make_prepare (
       "lookup_wire_fee_by_time",
@@ -2214,6 +2157,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",amount_with_fee_val"
       ",amount_with_fee_frac"
       " FROM reserves_out"
+      " JOIN reserves USING (reserve_uuid)"
       " WHERE reserve_out_serial_id > $1"
       " ORDER BY reserve_out_serial_id ASC;",
       1),
@@ -2284,7 +2228,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",amount_with_fee_val"
       ",amount_with_fee_frac"
       ",noreveal_index"
-      ",old_known_coin_id"
+      ",old_coin_pub"
       " FROM refresh_commitments"
       " WHERE melt_serial_id > $1"
       " ORDER BY melt_serial_id ASC;",
@@ -2400,7 +2344,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",coin_blind"
       ",amount_val"
       ",amount_frac"
-      ",timestamp"
+      ",recoup_timestamp"
       ",known_coin_id"
       ",reserve_out_serial_id"
       " FROM recoup"
@@ -2415,7 +2359,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",coin_blind"
       ",amount_val"
       ",amount_frac"
-      ",timestamp"
+      ",recoup_timestamp"
       ",known_coin_id"
       ",rrc_serial"
       " FROM recoup_refresh"
@@ -2505,7 +2449,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",h_blind_ev"
       ",denominations_serial"
       ",denom_sig"
-      ",reserve_pub"
+      ",reserve_uuid"
       ",reserve_sig"
       ",execution_date"
       ",amount_with_fee_val"
@@ -2575,7 +2519,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",amount_with_fee_val"
       ",amount_with_fee_frac"
       ",noreveal_index"
-      ",old_known_coin_id"
+      ",old_coin_pub"
       ") VALUES "
       "($1, $2, $3, $4, $5, $6, $7);",
       7),
@@ -2672,7 +2616,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",coin_blind"
       ",amount_val"
       ",amount_frac"
-      ",timestamp"
+      ",recoup_timestamp"
       ",known_coin_id"
       ",reserve_out_serial_id"
       ") VALUES "
@@ -2686,7 +2630,7 @@ prepare_statements (struct PostgresClosure *pg)
       ",coin_blind"
       ",amount_val"
       ",amount_frac"
-      ",timestamp"
+      ",recoup_timestamp"
       ",known_coin_id"
       ",rrc_serial"
       ") VALUES "
@@ -2845,7 +2789,14 @@ internal_setup (struct PostgresClosure *pg,
       GNUNET_PQ_EXECUTE_STATEMENT_END
     };
 #else
-    struct GNUNET_PQ_ExecuteStatement *es = NULL;
+    struct GNUNET_PQ_ExecuteStatement es[] = {
+      GNUNET_PQ_make_try_execute (
+        "SET SESSION CHARACTERISTICS AS TRANSACTION ISOLATION LEVEL SERIALIZABLE;"),
+      GNUNET_PQ_make_try_execute ("SET enable_sort=OFF;"),
+      GNUNET_PQ_make_try_execute ("SET enable_seqscan=OFF;"),
+      GNUNET_PQ_make_try_execute ("SET autocommit=OFF;"),
+      GNUNET_PQ_EXECUTE_STATEMENT_END
+    };
 #endif
     struct GNUNET_PQ_Context *db_conn;
 
@@ -3873,40 +3824,6 @@ postgres_set_kyc_ok (void *cls,
 
 
 /**
- * Get the KYC status for a bank account.
- *
- * @param cls the @e cls of this struct with the plugin-specific state
- * @param payto_uri payto:// URI that identifies the bank account
- * @param[out] kyc set to the KYC status of the reserve
- * @return transaction status
- */
-static enum GNUNET_DB_QueryStatus
-postgres_get_kyc_status (void *cls,
-                         const char *payto_uri,
-                         struct TALER_EXCHANGEDB_KycStatus *kyc)
-{
-  struct PostgresClosure *pg = cls;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_string (payto_uri),
-    GNUNET_PQ_query_param_end
-  };
-  struct GNUNET_PQ_ResultSpec rs[] = {
-    GNUNET_PQ_result_spec_uint64 ("payment_target_uuid",
-                                  &kyc->payment_target_uuid),
-    GNUNET_PQ_result_spec_auto_from_type ("kyc_ok",
-                                          &kyc->ok),
-    GNUNET_PQ_result_spec_end
-  };
-
-  kyc->type = TALER_EXCHANGEDB_KYC_DEPOSIT;
-  return GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
-                                                   "get_kyc_status",
-                                                   params,
-                                                   rs);
-}
-
-
-/**
  * Get the @a kyc status and @a h_payto by UUID.
  *
  * @param cls the @e cls of this struct with the plugin-specific state
@@ -4367,39 +4284,6 @@ postgres_reserves_in_insert (void *cls,
 
 
 /**
- * Obtain the most recent @a wire_reference that was inserted via @e reserves_in_insert.
- *
- * @param cls the @e cls of this struct with the plugin-specific state
- * @param exchange_account_name name of the section in the exchange's configuration
- *                       for the account that we are tracking here
- * @param[out] wire_reference set to unique reference identifying the wire transfer
- * @return transaction status code
- */
-static enum GNUNET_DB_QueryStatus
-postgres_get_latest_reserve_in_reference (
-  void *cls,
-  const char *exchange_account_name,
-  uint64_t *wire_reference)
-{
-  struct PostgresClosure *pg = cls;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_string (exchange_account_name),
-    GNUNET_PQ_query_param_end
-  };
-  struct GNUNET_PQ_ResultSpec rs[] = {
-    GNUNET_PQ_result_spec_uint64 ("wire_reference",
-                                  wire_reference),
-    GNUNET_PQ_result_spec_end
-  };
-
-  return GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
-                                                   "reserves_in_get_latest_wire_reference",
-                                                   params,
-                                                   rs);
-}
-
-
-/**
  * Locate the response for a /reserve/withdraw request under the
  * key of the hash of the blinded message.
  *
@@ -4456,53 +4340,6 @@ postgres_get_withdraw_info (
 
 
 /**
- * Check coin balance is sufficient to satisfy balance
- * invariants.
- *
- * @param cls the `struct PostgresClosure` with the plugin-specific state
- * @param coin_pub coin to check
- * @param coin_value value of the coin's denomination (avoids internal lookup)
- * @param check_recoup include recoup and recoup_refresh tables in calculation
- * @param zombie_required additionally require coin to be a zombie coin
- * @param[out] balance_ok set to true if the balance was sufficient
- * @param[out] zombie_ok set to true if the zombie requirement was satisfied
- * @return query execution status
- */
-static enum GNUNET_DB_QueryStatus
-postgres_do_check_coin_balance (
-  void *cls,
-  const struct TALER_CoinSpendPublicKeyP *coin_pub,
-  const struct TALER_Amount *coin_value,
-  bool check_recoup,
-  bool zombie_required,
-  bool *balance_ok,
-  bool *zombie_ok)
-{
-  struct PostgresClosure *pg = cls;
-  struct GNUNET_PQ_QueryParam params[] = {
-    TALER_PQ_query_param_amount (coin_value),
-    GNUNET_PQ_query_param_auto_from_type (coin_pub),
-    GNUNET_PQ_query_param_bool (check_recoup),
-    GNUNET_PQ_query_param_bool (zombie_required),
-    GNUNET_PQ_query_param_end
-  };
-  struct GNUNET_PQ_ResultSpec rs[] = {
-    GNUNET_PQ_result_spec_bool ("balance_ok",
-                                balance_ok),
-    GNUNET_PQ_result_spec_bool ("zombie_ok",
-                                zombie_ok),
-    GNUNET_PQ_result_spec_end
-  };
-
-  return GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
-                                                   "call_check_coin_balance",
-                                                   params,
-                                                   rs);
-
-}
-
-
-/**
  * Perform withdraw operation, checking for sufficient balance
  * and possibly persisting the withdrawal details.
  *
@@ -4513,6 +4350,7 @@ postgres_do_check_coin_balance (
  * @param[out] found set to true if the reserve was found
  * @param[out] balance_ok set to true if the balance was sufficient
  * @param[out] kyc_ok set to true if the kyc status of the reserve is satisfied
+ * @param[out] ruuid set to the reserve's UUID (reserves table row)
  * @return query execution status
  */
 static enum GNUNET_DB_QueryStatus
@@ -4522,7 +4360,8 @@ postgres_do_withdraw (
   struct GNUNET_TIME_Timestamp now,
   bool *found,
   bool *balance_ok,
-  struct TALER_EXCHANGEDB_KycStatus *kyc)
+  struct TALER_EXCHANGEDB_KycStatus *kyc,
+  uint64_t *ruuid)
 {
   struct PostgresClosure *pg = cls;
   struct GNUNET_TIME_Timestamp gc;
@@ -4546,6 +4385,8 @@ postgres_do_withdraw (
                                 &kyc->ok),
     GNUNET_PQ_result_spec_uint64 ("payment_target_uuid",
                                   &kyc->payment_target_uuid),
+    GNUNET_PQ_result_spec_uint64 ("ruuid",
+                                  ruuid),
     GNUNET_PQ_result_spec_end
   };
 
@@ -4566,7 +4407,7 @@ postgres_do_withdraw (
  * checks after withdraw operation.
  *
  * @param cls the `struct PostgresClosure` with the plugin-specific state
- * @param reserve_uuid reserve to check
+ * @param ruuid reserve to check
  * @param withdraw_start starting point to accumulate from
  * @param upper_limit maximum amount allowed
  * @param[out] below_limit set to true if the limit was not exceeded
@@ -4575,14 +4416,14 @@ postgres_do_withdraw (
 static enum GNUNET_DB_QueryStatus
 postgres_do_withdraw_limit_check (
   void *cls,
-  const struct TALER_ReservePublicKeyP *reserve_pub,
+  uint64_t ruuid,
   struct GNUNET_TIME_Absolute withdraw_start,
   const struct TALER_Amount *upper_limit,
   bool *below_limit)
 {
   struct PostgresClosure *pg = cls;
   struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_auto_from_type (reserve_pub),
+    GNUNET_PQ_query_param_uint64 (&ruuid),
     GNUNET_PQ_query_param_absolute_time (&withdraw_start),
     TALER_PQ_query_param_amount (upper_limit),
     GNUNET_PQ_query_param_end
@@ -4601,6 +4442,353 @@ postgres_do_withdraw_limit_check (
 
 
 /**
+ * Compute the shard number of a given @a deposit
+ *
+ * @param deposit deposit to compute shard for
+ * @return shard number
+ */
+static uint64_t
+compute_shard (const struct TALER_MerchantPublicKeyP *merchant_pub)
+{
+  uint32_t res;
+
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_kdf (&res,
+                                    sizeof (res),
+                                    merchant_pub,
+                                    sizeof (*merchant_pub),
+                                    "VOID",
+                                    4,
+                                    NULL, 0));
+  /* interpret hash result as NBO for platform independence,
+     convert to HBO and map to [0..2^31-1] range */
+  res = ntohl (res);
+  if (res > INT32_MAX)
+    res += INT32_MIN;
+  GNUNET_assert (res <= INT32_MAX);
+  return (uint64_t) res;
+}
+
+
+/**
+ * Perform deposit operation, checking for sufficient balance
+ * of the coin and possibly persisting the deposit details.
+ *
+ * @param cls the `struct PostgresClosure` with the plugin-specific state
+ * @param deposit deposit operation details
+ * @param known_coin_id row of the coin in the known_coins table
+ * @param[in,out] exchange_timestamp time to use for the deposit (possibly updated)
+ * @param[out] balance_ok set to true if the balance was sufficient
+ * @param[out] in_conflict set to true if the deposit conflicted
+ * @return query execution status
+ */
+static enum GNUNET_DB_QueryStatus
+postgres_do_deposit (
+  void *cls,
+  const struct TALER_EXCHANGEDB_Deposit *deposit,
+  uint64_t known_coin_id,
+  const struct TALER_PaytoHash *h_payto,
+  bool extension_blocked,
+  struct GNUNET_TIME_Timestamp *exchange_timestamp,
+  bool *balance_ok,
+  bool *in_conflict)
+{
+  struct PostgresClosure *pg = cls;
+  uint64_t deposit_shard = compute_shard (&deposit->merchant_pub);
+  struct GNUNET_PQ_QueryParam params[] = {
+    TALER_PQ_query_param_amount (&deposit->amount_with_fee),
+    GNUNET_PQ_query_param_auto_from_type (&deposit->h_contract_terms),
+    GNUNET_PQ_query_param_auto_from_type (&deposit->wire_salt),
+    GNUNET_PQ_query_param_timestamp (&deposit->timestamp),
+    GNUNET_PQ_query_param_timestamp (exchange_timestamp),
+    GNUNET_PQ_query_param_timestamp (&deposit->refund_deadline),
+    GNUNET_PQ_query_param_timestamp (&deposit->wire_deadline),
+    GNUNET_PQ_query_param_auto_from_type (&deposit->merchant_pub),
+    GNUNET_PQ_query_param_string (deposit->receiver_wire_account),
+    GNUNET_PQ_query_param_auto_from_type (h_payto),
+    GNUNET_PQ_query_param_uint64 (&known_coin_id),
+    GNUNET_PQ_query_param_auto_from_type (&deposit->coin.coin_pub),
+    GNUNET_PQ_query_param_auto_from_type (&deposit->csig),
+    GNUNET_PQ_query_param_uint64 (&deposit_shard),
+    GNUNET_PQ_query_param_bool (extension_blocked),
+    (NULL == deposit->extension_details)
+    ? GNUNET_PQ_query_param_null ()
+    : TALER_PQ_query_param_json (deposit->extension_details),
+    GNUNET_PQ_query_param_end
+  };
+  struct GNUNET_PQ_ResultSpec rs[] = {
+    GNUNET_PQ_result_spec_bool ("balance_ok",
+                                balance_ok),
+    GNUNET_PQ_result_spec_bool ("conflicted",
+                                in_conflict),
+    GNUNET_PQ_result_spec_timestamp ("exchange_timestamp",
+                                     exchange_timestamp),
+    GNUNET_PQ_result_spec_end
+  };
+
+  return GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
+                                                   "call_deposit",
+                                                   params,
+                                                   rs);
+}
+
+
+/**
+ * Perform melt operation, checking for sufficient balance
+ * of the coin and possibly persisting the melt details.
+ *
+ * @param cls the `struct PostgresClosure` with the plugin-specific state
+ * @param[in,out] refresh refresh operation details; the noreveal_index
+ *                is set in case the coin was already melted before
+ * @param known_coin_id row of the coin in the known_coins table
+ * @param[in,out] zombie_required true if the melt must only succeed if the coin is a zombie, set to false if the requirement was satisfied
+ * @param[out] balance_ok set to true if the balance was sufficient
+ * @return query execution status
+ */
+static enum GNUNET_DB_QueryStatus
+postgres_do_melt (
+  void *cls,
+  struct TALER_EXCHANGEDB_Refresh *refresh,
+  uint64_t known_coin_id,
+  bool *zombie_required,
+  bool *balance_ok)
+{
+  struct PostgresClosure *pg = cls;
+  struct GNUNET_PQ_QueryParam params[] = {
+    TALER_PQ_query_param_amount (&refresh->amount_with_fee),
+    GNUNET_PQ_query_param_auto_from_type (&refresh->rc),
+    GNUNET_PQ_query_param_auto_from_type (&refresh->coin.coin_pub),
+    GNUNET_PQ_query_param_auto_from_type (&refresh->coin_sig),
+    GNUNET_PQ_query_param_uint64 (&known_coin_id),
+    GNUNET_PQ_query_param_uint32 (&refresh->noreveal_index),
+    GNUNET_PQ_query_param_bool (*zombie_required),
+    GNUNET_PQ_query_param_end
+  };
+  bool is_null;
+  struct GNUNET_PQ_ResultSpec rs[] = {
+    GNUNET_PQ_result_spec_bool ("balance_ok",
+                                balance_ok),
+    GNUNET_PQ_result_spec_bool ("zombie_required",
+                                zombie_required),
+    GNUNET_PQ_result_spec_allow_null (
+      GNUNET_PQ_result_spec_uint32 ("noreveal_index",
+                                    &refresh->noreveal_index),
+      &is_null),
+    GNUNET_PQ_result_spec_end
+  };
+  enum GNUNET_DB_QueryStatus qs;
+
+  qs = GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
+                                                 "call_melt",
+                                                 params,
+                                                 rs);
+  if (is_null)
+    refresh->noreveal_index = UINT32_MAX; /* set to very invalid value */
+  return qs;
+}
+
+
+/**
+ * Perform refund operation, checking for sufficient deposits
+ * of the coin and possibly persisting the refund details.
+ *
+ * @param cls the `struct PostgresClosure` with the plugin-specific state
+ * @param refund refund operation details
+ * @param deposit_fee deposit fee applicable for the coin, possibly refunded
+ * @param known_coin_id row of the coin in the known_coins table
+ * @param[out] not_found set if the deposit was not found
+ * @param[out] refund_ok  set if the refund succeeded (below deposit amount)
+ * @param[out] gone if the merchant was already paid
+ * @param[out] conflict set if the refund ID was re-used
+ * @return query execution status
+ */
+static enum GNUNET_DB_QueryStatus
+postgres_do_refund (
+  void *cls,
+  const struct TALER_EXCHANGEDB_Refund *refund,
+  const struct TALER_Amount *deposit_fee,
+  uint64_t known_coin_id,
+  bool *not_found,
+  bool *refund_ok,
+  bool *gone,
+  bool *conflict)
+{
+  struct PostgresClosure *pg = cls;
+  uint64_t deposit_shard = compute_shard (&refund->details.merchant_pub);
+  struct TALER_Amount amount_without_fee;
+  struct GNUNET_PQ_QueryParam params[] = {
+    TALER_PQ_query_param_amount (&refund->details.refund_amount),
+    TALER_PQ_query_param_amount (&amount_without_fee),
+    TALER_PQ_query_param_amount (deposit_fee),
+    GNUNET_PQ_query_param_auto_from_type (&refund->details.h_contract_terms),
+    GNUNET_PQ_query_param_uint64 (&refund->details.rtransaction_id),
+    GNUNET_PQ_query_param_uint64 (&deposit_shard),
+    GNUNET_PQ_query_param_uint64 (&known_coin_id),
+    GNUNET_PQ_query_param_auto_from_type (&refund->coin.coin_pub),
+    GNUNET_PQ_query_param_auto_from_type (&refund->details.merchant_pub),
+    GNUNET_PQ_query_param_auto_from_type (&refund->details.merchant_sig),
+    GNUNET_PQ_query_param_end
+  };
+  struct GNUNET_PQ_ResultSpec rs[] = {
+    GNUNET_PQ_result_spec_bool ("not_found",
+                                not_found),
+    GNUNET_PQ_result_spec_bool ("refund_ok",
+                                refund_ok),
+    GNUNET_PQ_result_spec_bool ("gone",
+                                gone),
+    GNUNET_PQ_result_spec_bool ("conflict",
+                                conflict),
+    GNUNET_PQ_result_spec_end
+  };
+
+  if (0 >
+      TALER_amount_subtract (&amount_without_fee,
+                             &refund->details.refund_amount,
+                             &refund->details.refund_fee))
+  {
+    GNUNET_break (0);
+    return GNUNET_DB_STATUS_HARD_ERROR;
+  }
+  return GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
+                                                   "call_refund",
+                                                   params,
+                                                   rs);
+}
+
+
+/**
+ * Perform recoup operation, checking for sufficient deposits
+ * of the coin and possibly persisting the recoup details.
+ *
+ * @param cls the `struct PostgresClosure` with the plugin-specific state
+ * @param reserve_pub public key of the reserve to credit
+ * @param reserve_out_serial_id row in the reserves_out table justifying the recoup
+ * @param requested_amount the amount to be recouped
+ * @param coin_bks coin blinding key secret to persist
+ * @param coin_pub public key of the coin being recouped
+ * @param known_coin_id row of the @a coin_pub in the known_coins table
+ * @param coin_sig signature of the coin requesting the recoup
+ * @param[in,out] recoup_timestamp recoup timestamp, set if recoup existed
+ * @param[out] recoup_ok  set if the recoup succeeded (balance ok)
+ * @param[out] internal_failure set on internal failures
+ * @return query execution status
+ */
+static enum GNUNET_DB_QueryStatus
+postgres_do_recoup (
+  void *cls,
+  const struct TALER_ReservePublicKeyP *reserve_pub,
+  uint64_t reserve_out_serial_id,
+  const struct TALER_Amount *requested_amount,
+  const union TALER_DenominationBlindingKeyP *coin_bks,
+  const struct TALER_CoinSpendPublicKeyP *coin_pub,
+  uint64_t known_coin_id,
+  const struct TALER_CoinSpendSignatureP *coin_sig,
+  struct GNUNET_TIME_Timestamp *recoup_timestamp,
+  bool *recoup_ok,
+  bool *internal_failure)
+{
+  struct PostgresClosure *pg = cls;
+  struct GNUNET_TIME_Timestamp reserve_gc
+    = GNUNET_TIME_relative_to_timestamp (pg->legal_reserve_expiration_time);
+  struct GNUNET_TIME_Timestamp reserve_expiration
+    = GNUNET_TIME_relative_to_timestamp (pg->idle_reserve_expiration_time);
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (reserve_pub),
+    GNUNET_PQ_query_param_uint64 (&reserve_out_serial_id),
+    TALER_PQ_query_param_amount (requested_amount),
+    GNUNET_PQ_query_param_auto_from_type (coin_bks),
+    GNUNET_PQ_query_param_auto_from_type (coin_pub),
+    GNUNET_PQ_query_param_uint64 (&known_coin_id),
+    GNUNET_PQ_query_param_auto_from_type (coin_sig),
+    GNUNET_PQ_query_param_timestamp (&reserve_gc),
+    GNUNET_PQ_query_param_timestamp (&reserve_expiration),
+    GNUNET_PQ_query_param_timestamp (recoup_timestamp),
+    GNUNET_PQ_query_param_end
+  };
+  bool is_null;
+  struct GNUNET_PQ_ResultSpec rs[] = {
+    GNUNET_PQ_result_spec_allow_null (
+      GNUNET_PQ_result_spec_timestamp ("recoup_timestamp",
+                                       recoup_timestamp),
+      &is_null),
+    GNUNET_PQ_result_spec_bool ("recoup_ok",
+                                recoup_ok),
+    GNUNET_PQ_result_spec_bool ("internal_failure",
+                                internal_failure),
+    GNUNET_PQ_result_spec_end
+  };
+
+  return GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
+                                                   "call_recoup",
+                                                   params,
+                                                   rs);
+}
+
+
+/**
+ * Perform recoup-refresh operation, checking for sufficient deposits of the
+ * coin and possibly persisting the recoup-refresh details.
+ *
+ * @param cls the `struct PostgresClosure` with the plugin-specific state
+ * @param old_coin_pub public key of the old coin to credit
+ * @param rrc_serial row in the refresh_revealed_coins table justifying the recoup-refresh
+ * @param requested_amount the amount to be recouped
+ * @param coin_bks coin blinding key secret to persist
+ * @param coin_pub public key of the coin being recouped
+ * @param known_coin_id row of the @a coin_pub in the known_coins table
+ * @param coin_sig signature of the coin requesting the recoup
+ * @param[in,out] recoup_timestamp recoup timestamp, set if recoup existed
+ * @param[out] recoup_ok  set if the recoup-refresh succeeded (balance ok)
+ * @param[out] internal_failure set on internal failures
+ * @return query execution status
+ */
+static enum GNUNET_DB_QueryStatus
+postgres_do_recoup_refresh (
+  void *cls,
+  const struct TALER_CoinSpendPublicKeyP *old_coin_pub,
+  uint64_t rrc_serial,
+  const struct TALER_Amount *requested_amount,
+  const union TALER_DenominationBlindingKeyP *coin_bks,
+  const struct TALER_CoinSpendPublicKeyP *coin_pub,
+  uint64_t known_coin_id,
+  const struct TALER_CoinSpendSignatureP *coin_sig,
+  struct GNUNET_TIME_Timestamp *recoup_timestamp,
+  bool *recoup_ok,
+  bool *internal_failure)
+{
+  struct PostgresClosure *pg = cls;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (old_coin_pub),
+    GNUNET_PQ_query_param_uint64 (&rrc_serial),
+    TALER_PQ_query_param_amount (requested_amount),
+    GNUNET_PQ_query_param_auto_from_type (coin_bks),
+    GNUNET_PQ_query_param_auto_from_type (coin_pub),
+    GNUNET_PQ_query_param_uint64 (&known_coin_id),
+    GNUNET_PQ_query_param_auto_from_type (coin_sig),
+    GNUNET_PQ_query_param_timestamp (recoup_timestamp),
+    GNUNET_PQ_query_param_end
+  };
+  bool is_null;
+  struct GNUNET_PQ_ResultSpec rs[] = {
+    GNUNET_PQ_result_spec_allow_null (
+      GNUNET_PQ_result_spec_timestamp ("recoup_timestamp",
+                                       recoup_timestamp),
+      &is_null),
+    GNUNET_PQ_result_spec_bool ("recoup_ok",
+                                recoup_ok),
+    GNUNET_PQ_result_spec_bool ("internal_failure",
+                                internal_failure),
+    GNUNET_PQ_result_spec_end
+  };
+
+  return GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
+                                                   "call_recoup_refresh",
+                                                   params,
+                                                   rs);
+}
+
+
+/**
  * Closure for callbacks invoked via #postgres_get_reserve_history.
  */
 struct ReserveHistoryContext
@@ -4820,7 +5008,7 @@ add_recoup (void *cls,
                                               &recoup->coin_blind),
         GNUNET_PQ_result_spec_auto_from_type ("coin_sig",
                                               &recoup->coin_sig),
-        GNUNET_PQ_result_spec_timestamp ("timestamp",
+        GNUNET_PQ_result_spec_timestamp ("recoup_timestamp",
                                          &recoup->timestamp),
         GNUNET_PQ_result_spec_auto_from_type ("denom_pub_hash",
                                               &recoup->coin.denom_pub_hash),
@@ -5009,218 +5197,6 @@ postgres_get_reserve_history (void *cls,
 
 
 /**
- * Closure for withdraw_amount_by_account_cb()
- */
-struct WithdrawAmountByAccountContext
-{
-  /**
-   * Function to call on each amount.
-   */
-  TALER_EXCHANGEDB_WithdrawHistoryCallback cb;
-
-  /**
-   * Closure for @e cb
-   */
-  void *cb_cls;
-
-  /**
-   * Our plugin's context.
-   */
-  struct PostgresClosure *pg;
-
-  /**
-   * Set to true on failures.
-   */
-  bool failed;
-};
-
-
-/**
- * Helper function for #postgres_select_withdraw_amounts_by_account().
- * To be called with the results of a SELECT statement
- * that has returned @a num_results results.
- *
- * @param cls closure of type `struct WithdrawAmountByAccountContext *`
- * @param result the postgres result
- * @param num_results the number of results in @a result
- */
-static void
-withdraw_amount_by_account_cb (void *cls,
-                               PGresult *result,
-                               unsigned int num_results)
-{
-  struct WithdrawAmountByAccountContext *wac = cls;
-  struct PostgresClosure *pg = wac->pg;
-
-  for (unsigned int i = 0; i < num_results; i++)
-  {
-    struct TALER_Amount val;
-    struct GNUNET_PQ_ResultSpec rs[] = {
-      TALER_PQ_RESULT_SPEC_AMOUNT ("amount_with_fee",
-                                   &val),
-      GNUNET_PQ_result_spec_end
-    };
-
-    if (GNUNET_OK !=
-        GNUNET_PQ_extract_result (result,
-                                  rs,
-                                  i))
-    {
-      GNUNET_break (0);
-      wac->failed = true;
-      return;
-    }
-    wac->cb (wac->cb_cls,
-             &val);
-  }
-}
-
-
-/**
- * Find out all of the amounts that have been withdrawn
- * so far from the same bank account that created the
- * given reserve.
- *
- * @param cls the `struct PostgresClosure` with the plugin-specific state
- * @param reserve_pub reserve to select withdrawals by
- * @param duration how far back should we select withdrawals
- * @param cb function to call on each amount withdrawn
- * @param cb_cls closure for @a cb
- * @return transaction status
- */
-static enum GNUNET_DB_QueryStatus
-postgres_select_withdraw_amounts_by_account (
-  void *cls,
-  const struct TALER_ReservePublicKeyP *reserve_pub,
-  struct GNUNET_TIME_Relative duration,
-  TALER_EXCHANGEDB_WithdrawHistoryCallback cb,
-  void *cb_cls)
-{
-  struct PostgresClosure *pg = cls;
-  struct WithdrawAmountByAccountContext wac = {
-    .pg = pg,
-    .cb = cb,
-    .cb_cls = cb_cls
-  };
-  struct GNUNET_TIME_Absolute start;
-
-  start = GNUNET_TIME_absolute_subtract (GNUNET_TIME_absolute_get (),
-                                         duration);
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_auto_from_type (reserve_pub),
-    GNUNET_PQ_query_param_absolute_time (&start),
-    GNUNET_PQ_query_param_end
-  };
-  enum GNUNET_DB_QueryStatus qs;
-
-  qs = GNUNET_PQ_eval_prepared_multi_select (
-    pg->conn,
-    "select_above_date_by_reserves_out",
-    params,
-    &withdraw_amount_by_account_cb,
-    &wac);
-
-  if (wac.failed)
-  {
-    GNUNET_break (0);
-    qs = GNUNET_DB_STATUS_HARD_ERROR;
-  }
-  return qs;
-}
-
-
-/**
- * Check if we have the specified deposit already in the database.
- *
- * @param cls the `struct PostgresClosure` with the plugin-specific state
- * @param deposit deposit to search for
- * @param[out] deposit_fee set to the deposit fee the exchange charged
- * @param[out] exchange_timestamp set to the time when the exchange received the deposit
- * @return 1 if we know this operation,
- *         0 if this exact deposit is unknown to us,
- *         otherwise transaction error status
- */
-static enum GNUNET_DB_QueryStatus
-postgres_have_deposit (void *cls,
-                       const struct TALER_EXCHANGEDB_Deposit *deposit,
-                       struct TALER_Amount *deposit_fee,
-                       struct GNUNET_TIME_Timestamp *exchange_timestamp)
-{
-  struct PostgresClosure *pg = cls;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_auto_from_type (&deposit->coin.coin_pub),
-    GNUNET_PQ_query_param_auto_from_type (&deposit->h_contract_terms),
-    GNUNET_PQ_query_param_auto_from_type (&deposit->merchant_pub),
-    GNUNET_PQ_query_param_end
-  };
-  struct TALER_EXCHANGEDB_Deposit deposit2;
-  struct GNUNET_PQ_ResultSpec rs[] = {
-    TALER_PQ_RESULT_SPEC_AMOUNT ("amount_with_fee",
-                                 &deposit2.amount_with_fee),
-    GNUNET_PQ_result_spec_timestamp ("wallet_timestamp",
-                                     &deposit2.timestamp),
-    GNUNET_PQ_result_spec_timestamp ("exchange_timestamp",
-                                     exchange_timestamp),
-    GNUNET_PQ_result_spec_timestamp ("refund_deadline",
-                                     &deposit2.refund_deadline),
-    GNUNET_PQ_result_spec_timestamp ("wire_deadline",
-                                     &deposit2.wire_deadline),
-    TALER_PQ_RESULT_SPEC_AMOUNT ("fee_deposit",
-                                 deposit_fee),
-    GNUNET_PQ_result_spec_auto_from_type ("wire_salt",
-                                          &deposit2.wire_salt),
-    GNUNET_PQ_result_spec_string ("receiver_wire_account",
-                                  &deposit2.receiver_wire_account),
-    GNUNET_PQ_result_spec_end
-  };
-  enum GNUNET_DB_QueryStatus qs;
-#if EXPLICIT_LOCKS
-  struct GNUNET_PQ_QueryParam no_params[] = {
-    GNUNET_PQ_query_param_end
-  };
-
-  if (0 > (qs = GNUNET_PQ_eval_prepared_non_select (pg->conn,
-                                                    "lock_deposit",
-                                                    no_params)))
-    return qs;
-#endif
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Getting deposits for coin %s\n",
-              TALER_B2S (&deposit->coin.coin_pub));
-  qs = GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
-                                                 "get_deposit",
-                                                 params,
-                                                 rs);
-  if (0 >= qs)
-    return qs;
-  /* Now we check that the other information in @a deposit
-     also matches, and if not report inconsistencies. */
-  if ( (0 != TALER_amount_cmp (&deposit->amount_with_fee,
-                               &deposit2.amount_with_fee)) ||
-       (GNUNET_TIME_timestamp_cmp (deposit->timestamp,
-                                   !=,
-                                   deposit2.timestamp)) ||
-       (GNUNET_TIME_timestamp_cmp (deposit->refund_deadline,
-                                   !=,
-                                   deposit2.refund_deadline)) ||
-       (0 != strcmp (deposit->receiver_wire_account,
-                     deposit2.receiver_wire_account)) ||
-       (0 != GNUNET_memcmp (&deposit->wire_salt,
-                            &deposit2.wire_salt) ) )
-  {
-    GNUNET_free (deposit2.receiver_wire_account);
-    /* Inconsistencies detected! Does not match!  (We might want to
-       expand the API with a 'get_deposit' function to return the
-       original transaction details to be used for an error message
-       in the future!) FIXME #3838 */
-    return GNUNET_DB_STATUS_SUCCESS_NO_RESULTS;
-  }
-  GNUNET_free (deposit2.receiver_wire_account);
-  return GNUNET_DB_STATUS_SUCCESS_ONE_RESULT;
-}
-
-
-/**
  * Check if we have the specified deposit already in the database.
  *
  * @param cls the `struct PostgresClosure` with the plugin-specific state
@@ -5641,6 +5617,8 @@ postgres_get_known_coin (void *cls,
   struct GNUNET_PQ_ResultSpec rs[] = {
     GNUNET_PQ_result_spec_auto_from_type ("denom_pub_hash",
                                           &coin_info->denom_pub_hash),
+    GNUNET_PQ_result_spec_auto_from_type ("age_hash",
+                                          &coin_info->age_commitment_hash),
     TALER_PQ_result_spec_denom_sig ("denom_sig",
                                     &coin_info->denom_sig),
     GNUNET_PQ_result_spec_end
@@ -5662,6 +5640,7 @@ postgres_get_known_coin (void *cls,
  *
  * @param cls the plugin closure
  * @param coin_pub the public key of the coin to search for
+ * @param[out] known_coin_id set to the ID of the coin in the known_coins table
  * @param[out] denom_hash where to store the hash of the coins denomination
  * @return transaction status code
  */
@@ -5669,6 +5648,7 @@ static enum GNUNET_DB_QueryStatus
 postgres_get_coin_denomination (
   void *cls,
   const struct TALER_CoinSpendPublicKeyP *coin_pub,
+  uint64_t *known_coin_id,
   struct TALER_DenominationHash *denom_hash)
 {
   struct PostgresClosure *pg = cls;
@@ -5679,6 +5659,8 @@ postgres_get_coin_denomination (
   struct GNUNET_PQ_ResultSpec rs[] = {
     GNUNET_PQ_result_spec_auto_from_type ("denom_pub_hash",
                                           denom_hash),
+    GNUNET_PQ_result_spec_uint64 ("known_coin_id",
+                                  known_coin_id),
     GNUNET_PQ_result_spec_end
   };
 
@@ -5693,36 +5675,6 @@ postgres_get_coin_denomination (
 
 
 /**
- * Insert a coin we know of into the DB.  The coin can then be
- * referenced by tables for deposits, refresh and refund
- * functionality.
- *
- * @param cls plugin closure
- * @param coin_info the public coin info
- * @return query result status
- */
-static enum GNUNET_DB_QueryStatus
-insert_known_coin (void *cls,
-                   const struct TALER_CoinPublicInfo *coin_info)
-{
-  struct PostgresClosure *pg = cls;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_auto_from_type (&coin_info->coin_pub),
-    GNUNET_PQ_query_param_auto_from_type (&coin_info->denom_pub_hash),
-    TALER_PQ_query_param_denom_sig (&coin_info->denom_sig),
-    GNUNET_PQ_query_param_end
-  };
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Creating known coin %s\n",
-              TALER_B2S (&coin_info->coin_pub));
-  return GNUNET_PQ_eval_prepared_non_select (pg->conn,
-                                             "insert_known_coin",
-                                             params);
-}
-
-
-/**
  * Count the number of known coins by denomination.
  *
  * @param cls database connection plugin state
@@ -5761,47 +5713,49 @@ postgres_count_known_coins (void *cls,
  *
  * @param cls database connection plugin state
  * @param coin the coin that must be made known
+ * @param[out] known_coin_id set to the unique row of the coin
+ * @param[out] denom_hash set to the denomination hash of the existing
+ *             coin (for conflict error reporting)
+ * @param[out] age_hash set to the conflicting age hash on conflict
  * @return database transaction status, non-negative on success
  */
 static enum TALER_EXCHANGEDB_CoinKnownStatus
 postgres_ensure_coin_known (void *cls,
-                            const struct TALER_CoinPublicInfo *coin)
+                            const struct TALER_CoinPublicInfo *coin,
+                            uint64_t *known_coin_id,
+                            struct TALER_DenominationHash *denom_hash,
+                            struct TALER_AgeHash *age_hash)
 {
   struct PostgresClosure *pg = cls;
   enum GNUNET_DB_QueryStatus qs;
-  struct TALER_DenominationHash denom_pub_hash;
+  bool existed;
   struct GNUNET_PQ_QueryParam params[] = {
     GNUNET_PQ_query_param_auto_from_type (&coin->coin_pub),
+    GNUNET_PQ_query_param_auto_from_type (&coin->denom_pub_hash),
+    GNUNET_PQ_query_param_auto_from_type (&coin->age_commitment_hash),
+    TALER_PQ_query_param_denom_sig (&coin->denom_sig),
     GNUNET_PQ_query_param_end
   };
+  bool is_null = false;
   struct GNUNET_PQ_ResultSpec rs[] = {
-    GNUNET_PQ_result_spec_auto_from_type ("denom_pub_hash",
-                                          &denom_pub_hash),
+    GNUNET_PQ_result_spec_bool ("existed",
+                                &existed),
+    GNUNET_PQ_result_spec_uint64 ("known_coin_id",
+                                  known_coin_id),
+    GNUNET_PQ_result_spec_allow_null (
+      GNUNET_PQ_result_spec_auto_from_type ("age_hash",
+                                            age_hash),
+      &is_null),
+    GNUNET_PQ_result_spec_allow_null (
+      GNUNET_PQ_result_spec_auto_from_type ("denom_pub_hash",
+                                            denom_hash),
+      &is_null),
     GNUNET_PQ_result_spec_end
   };
 
-  /* First, try to simply insert it */
-  qs = insert_known_coin (pg,
-                          coin);
-  switch (qs)
-  {
-  case GNUNET_DB_STATUS_HARD_ERROR:
-    GNUNET_break (0);
-    return TALER_EXCHANGEDB_CKS_HARD_FAIL;
-  case GNUNET_DB_STATUS_SOFT_ERROR:
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                "Serialization failure in insert_known_coin? Strange!\n");
-    return TALER_EXCHANGEDB_CKS_SOFT_FAIL;
-  case GNUNET_DB_STATUS_SUCCESS_NO_RESULTS:
-    /* continued below */
-    break;
-  case GNUNET_DB_STATUS_SUCCESS_ONE_RESULT:
-    return TALER_EXCHANGEDB_CKS_ADDED;
-  }
-
-  /* check if the coin is already known */
+  GNUNET_break (GNUNET_is_zero (&coin->age_commitment_hash)); // FIXME-OEC
   qs = GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
-                                                 "get_known_coin_dh",
+                                                 "insert_known_coin",
                                                  params,
                                                  rs);
   switch (qs)
@@ -5810,52 +5764,31 @@ postgres_ensure_coin_known (void *cls,
     GNUNET_break (0);
     return TALER_EXCHANGEDB_CKS_HARD_FAIL;
   case GNUNET_DB_STATUS_SOFT_ERROR:
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                "Serialization failure in get_known_coin_dh? Strange!\n");
     return TALER_EXCHANGEDB_CKS_SOFT_FAIL;
-  case GNUNET_DB_STATUS_SUCCESS_ONE_RESULT:
-    if (0 == GNUNET_memcmp (&denom_pub_hash,
-                            &coin->denom_pub_hash))
-      return TALER_EXCHANGEDB_CKS_PRESENT;
-    GNUNET_break_op (0);
-    return TALER_EXCHANGEDB_CKS_CONFLICT;
   case GNUNET_DB_STATUS_SUCCESS_NO_RESULTS:
-    /* should be impossible */
-    GNUNET_break (0);
+    GNUNET_break (0); /* should be impossible */
     return TALER_EXCHANGEDB_CKS_HARD_FAIL;
+  case GNUNET_DB_STATUS_SUCCESS_ONE_RESULT:
+    if (! existed)
+      return TALER_EXCHANGEDB_CKS_ADDED;
+    break; /* continued below */
   }
-  /* we should never get here */
-  GNUNET_break (0);
-  return TALER_EXCHANGEDB_CKS_HARD_FAIL;
-}
-
-
-/**
- * Compute the shard number of a given @a deposit
- *
- * @param deposit deposit to compute shard for
- * @return shard number
- */
-static uint64_t
-compute_shard (const struct TALER_EXCHANGEDB_Deposit *deposit)
-{
-  uint32_t res;
-
-  GNUNET_assert (GNUNET_YES ==
-                 GNUNET_CRYPTO_kdf (&res,
-                                    sizeof (res),
-                                    &deposit->merchant_pub,
-                                    sizeof (deposit->merchant_pub),
-                                    deposit->receiver_wire_account,
-                                    strlen (deposit->receiver_wire_account),
-                                    NULL, 0));
-  /* interpret hash result as NBO for platform independence,
-     convert to HBO and map to [0..2^31-1] range */
-  res = ntohl (res);
-  if (res > INT32_MAX)
-    res += INT32_MIN;
-  GNUNET_assert (res <= INT32_MAX);
-  return (uint64_t) res;
+  if ( (! is_null) &&
+       (0 != GNUNET_memcmp (age_hash,
+                            &coin->age_commitment_hash)) )
+  {
+    GNUNET_break (GNUNET_is_zero (age_hash)); // FIXME-OEC
+    GNUNET_break_op (0);
+    return TALER_EXCHANGEDB_CKS_AGE_CONFLICT;
+  }
+  if ( (! is_null) &&
+       (0 != GNUNET_memcmp (denom_hash,
+                            &coin->denom_pub_hash)) )
+  {
+    GNUNET_break_op (0);
+    return TALER_EXCHANGEDB_CKS_DENOM_CONFLICT;
+  }
+  return TALER_EXCHANGEDB_CKS_PRESENT;
 }
 
 
@@ -5885,7 +5818,7 @@ postgres_insert_deposit (void *cls,
     return qs;
   }
   {
-    uint64_t shard = compute_shard (deposit);
+    uint64_t shard = compute_shard (&deposit->merchant_pub);
     struct GNUNET_PQ_QueryParam params[] = {
       GNUNET_PQ_query_param_auto_from_type (&deposit->coin.coin_pub),
       TALER_PQ_query_param_amount (&deposit->amount_with_fee),
@@ -6070,12 +6003,14 @@ postgres_select_refunds_by_coin (
  * @param[out] melt where to store the result; note that
  *             melt->session.coin.denom_sig will be set to NULL
  *             and is not fetched by this routine (as it is not needed by the client)
+ * @param[out] melt_serial_id set to the row ID of @a rc in the refresh_commitments table
  * @return transaction status
  */
 static enum GNUNET_DB_QueryStatus
 postgres_get_melt (void *cls,
                    const struct TALER_RefreshCommitmentP *rc,
-                   struct TALER_EXCHANGEDB_Melt *melt)
+                   struct TALER_EXCHANGEDB_Melt *melt,
+                   uint64_t *melt_serial_id)
 {
   struct PostgresClosure *pg = cls;
   struct GNUNET_PQ_QueryParam params[] = {
@@ -6096,6 +6031,8 @@ postgres_get_melt (void *cls,
                                           &melt->session.coin_sig),
     TALER_PQ_RESULT_SPEC_AMOUNT ("amount_with_fee",
                                  &melt->session.amount_with_fee),
+    GNUNET_PQ_result_spec_uint64 ("melt_serial_id",
+                                  melt_serial_id),
     GNUNET_PQ_result_spec_end
   };
   enum GNUNET_DB_QueryStatus qs;
@@ -6113,74 +6050,12 @@ postgres_get_melt (void *cls,
 
 
 /**
- * Lookup noreveal index of a previous melt operation under the given
- * @a rc.
- *
- * @param cls the `struct PostgresClosure` with the plugin-specific state
- * @param rc commitment hash to use to locate the operation
- * @param[out] noreveal_index returns the "gamma" value selected by the
- *             exchange which is the index of the transfer key that is
- *             not to be revealed to the exchange
- * @return transaction status
- */
-static enum GNUNET_DB_QueryStatus
-postgres_get_melt_index (void *cls,
-                         const struct TALER_RefreshCommitmentP *rc,
-                         uint32_t *noreveal_index)
-{
-  struct PostgresClosure *pg = cls;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_auto_from_type (rc),
-    GNUNET_PQ_query_param_end
-  };
-  struct GNUNET_PQ_ResultSpec rs[] = {
-    GNUNET_PQ_result_spec_uint32 ("noreveal_index",
-                                  noreveal_index),
-    GNUNET_PQ_result_spec_end
-  };
-
-  return GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
-                                                   "get_melt_index",
-                                                   params,
-                                                   rs);
-}
-
-
-/**
- * Store new refresh melt commitment data.
- *
- * @param cls the `struct PostgresClosure` with the plugin-specific state
- * @param refresh_session session data to store
- * @return query status for the transaction
- */
-static enum GNUNET_DB_QueryStatus
-postgres_insert_melt (
-  void *cls,
-  const struct TALER_EXCHANGEDB_Refresh *refresh_session)
-{
-  struct PostgresClosure *pg = cls;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_auto_from_type (&refresh_session->rc),
-    GNUNET_PQ_query_param_auto_from_type (&refresh_session->coin.coin_pub),
-    GNUNET_PQ_query_param_auto_from_type (&refresh_session->coin_sig),
-    TALER_PQ_query_param_amount (&refresh_session->amount_with_fee),
-    GNUNET_PQ_query_param_uint32 (&refresh_session->noreveal_index),
-    GNUNET_PQ_query_param_end
-  };
-
-  return GNUNET_PQ_eval_prepared_non_select (pg->conn,
-                                             "insert_melt",
-                                             params);
-}
-
-
-/**
  * Store in the database which coin(s) the wallet wanted to create
  * in a given refresh operation and all of the other information
  * we learned or created in the /refresh/reveal step.
  *
  * @param cls the @e cls of this struct with the plugin-specific state
- * @param rc identify commitment and thus refresh operation
+ * @param melt_serial_id row ID of the commitment / melt operation in refresh_commitments
  * @param num_rrcs number of coins to generate, size of the @a rrcs array
  * @param rrcs information about the new coins
  * @param num_tprivs number of entries in @a tprivs, should be #TALER_CNC_KAPPA - 1
@@ -6191,7 +6066,7 @@ postgres_insert_melt (
 static enum GNUNET_DB_QueryStatus
 postgres_insert_refresh_reveal (
   void *cls,
-  const struct TALER_RefreshCommitmentP *rc,
+  uint64_t melt_serial_id,
   uint32_t num_rrcs,
   const struct TALER_EXCHANGEDB_RefreshRevealedCoin *rrcs,
   unsigned int num_tprivs,
@@ -6208,13 +6083,12 @@ postgres_insert_refresh_reveal (
   for (uint32_t i = 0; i<num_rrcs; i++)
   {
     const struct TALER_EXCHANGEDB_RefreshRevealedCoin *rrc = &rrcs[i];
-    struct TALER_DenominationHash denom_pub_hash;
     struct TALER_BlindedCoinHash h_coin_ev;
     struct GNUNET_PQ_QueryParam params[] = {
-      GNUNET_PQ_query_param_auto_from_type (rc),
+      GNUNET_PQ_query_param_uint64 (&melt_serial_id),
       GNUNET_PQ_query_param_uint32 (&i),
       GNUNET_PQ_query_param_auto_from_type (&rrc->orig_coin_link_sig),
-      GNUNET_PQ_query_param_auto_from_type (&denom_pub_hash),
+      GNUNET_PQ_query_param_auto_from_type (&rrc->h_denom_pub),
       GNUNET_PQ_query_param_fixed_size (rrc->coin_ev,
                                         rrc->coin_ev_size),
       GNUNET_PQ_query_param_auto_from_type (&h_coin_ev),
@@ -6223,26 +6097,24 @@ postgres_insert_refresh_reveal (
     };
     enum GNUNET_DB_QueryStatus qs;
 
-    TALER_denom_pub_hash (&rrc->denom_pub,
-                          &denom_pub_hash);
     GNUNET_CRYPTO_hash (rrc->coin_ev,
                         rrc->coin_ev_size,
                         &h_coin_ev.hash);
     qs = GNUNET_PQ_eval_prepared_non_select (pg->conn,
                                              "insert_refresh_revealed_coin",
                                              params);
-    if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != qs)
+    if (0 > qs)
       return qs;
   }
 
   {
     struct GNUNET_PQ_QueryParam params[] = {
-      GNUNET_PQ_query_param_auto_from_type (rc),
+      GNUNET_PQ_query_param_uint64 (&melt_serial_id),
       GNUNET_PQ_query_param_auto_from_type (tp),
-      GNUNET_PQ_query_param_fixed_size (tprivs,
-                                        num_tprivs
-                                        * sizeof (struct
-                                                  TALER_TransferPrivateKeyP)),
+      GNUNET_PQ_query_param_fixed_size (
+        tprivs,
+        num_tprivs
+        * sizeof (struct TALER_TransferPrivateKeyP)),
       GNUNET_PQ_query_param_end
     };
 
@@ -6298,38 +6170,60 @@ add_revealed_coins (void *cls,
   grctx->rrcs_len = num_results;
   for (unsigned int i = 0; i < num_results; i++)
   {
-    struct TALER_EXCHANGEDB_RefreshRevealedCoin *rrc = &grctx->rrcs[i];
     uint32_t off;
-    struct GNUNET_PQ_ResultSpec rs[] = {
+    struct GNUNET_PQ_ResultSpec rso[] = {
       GNUNET_PQ_result_spec_uint32 ("freshcoin_index",
                                     &off),
-      TALER_PQ_result_spec_denom_pub ("denom_pub",
-                                      &rrc->denom_pub),
-      GNUNET_PQ_result_spec_auto_from_type ("link_sig",
-                                            &rrc->orig_coin_link_sig),
-      GNUNET_PQ_result_spec_variable_size ("coin_ev",
-                                           (void **) &rrc->coin_ev,
-                                           &rrc->coin_ev_size),
-      TALER_PQ_result_spec_blinded_denom_sig ("ev_sig",
-                                              &rrc->coin_sig),
       GNUNET_PQ_result_spec_end
     };
 
     if (GNUNET_OK !=
         GNUNET_PQ_extract_result (result,
-                                  rs,
+                                  rso,
                                   i))
     {
       GNUNET_break (0);
       grctx->qs = GNUNET_DB_STATUS_HARD_ERROR;
       return;
     }
-    if (off != i)
+    if (off >= num_results)
     {
       GNUNET_break (0);
       grctx->qs = GNUNET_DB_STATUS_HARD_ERROR;
       return;
     }
+    {
+      struct TALER_EXCHANGEDB_RefreshRevealedCoin *rrc = &grctx->rrcs[off];
+      struct GNUNET_PQ_ResultSpec rsi[] = {
+        GNUNET_PQ_result_spec_auto_from_type ("h_denom_pub",
+                                              &rrc->h_denom_pub),
+        GNUNET_PQ_result_spec_auto_from_type ("link_sig",
+                                              &rrc->orig_coin_link_sig),
+        GNUNET_PQ_result_spec_variable_size ("coin_ev",
+                                             (void **) &rrc->coin_ev,
+                                             &rrc->coin_ev_size),
+        TALER_PQ_result_spec_blinded_denom_sig ("ev_sig",
+                                                &rrc->coin_sig),
+        GNUNET_PQ_result_spec_end
+      };
+
+      if (NULL != rrc->coin_ev)
+      {
+        /* duplicate offset, not allowed */
+        GNUNET_break (0);
+        grctx->qs = GNUNET_DB_STATUS_HARD_ERROR;
+        return;
+      }
+      if (GNUNET_OK !=
+          GNUNET_PQ_extract_result (result,
+                                    rsi,
+                                    i))
+      {
+        GNUNET_break (0);
+        grctx->qs = GNUNET_DB_STATUS_HARD_ERROR;
+        return;
+      }
+    }
   }
 }
 
@@ -6353,23 +6247,11 @@ postgres_get_refresh_reveal (void *cls,
   struct PostgresClosure *pg = cls;
   struct GetRevealContext grctx;
   enum GNUNET_DB_QueryStatus qs;
-  struct TALER_TransferPublicKeyP tp;
-  void *tpriv;
-  size_t tpriv_size;
   struct GNUNET_PQ_QueryParam params[] = {
     GNUNET_PQ_query_param_auto_from_type (rc),
     GNUNET_PQ_query_param_end
   };
-  struct GNUNET_PQ_ResultSpec rs[] = {
-    GNUNET_PQ_result_spec_auto_from_type ("transfer_pub",
-                                          &tp),
-    GNUNET_PQ_result_spec_variable_size ("transfer_privs",
-                                         &tpriv,
-                                         &tpriv_size),
-    GNUNET_PQ_result_spec_end
-  };
 
-  /* First get the coins */
   memset (&grctx,
           0,
           sizeof (grctx));
@@ -6398,47 +6280,15 @@ postgres_get_refresh_reveal (void *cls,
     break;
   }
 
-  /* now also get the transfer keys (public and private) */
-  qs = GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
-                                                 "get_refresh_transfer_keys",
-                                                 params,
-                                                 rs);
-  switch (qs)
-  {
-  case GNUNET_DB_STATUS_HARD_ERROR:
-  case GNUNET_DB_STATUS_SOFT_ERROR:
-  case GNUNET_DB_STATUS_SUCCESS_NO_RESULTS:
-    goto cleanup;
-  case GNUNET_DB_STATUS_SUCCESS_ONE_RESULT:
-    break;
-  default:
-    GNUNET_assert (0);
-  }
-  if ( (0 != tpriv_size % sizeof (struct TALER_TransferPrivateKeyP)) ||
-       (TALER_CNC_KAPPA - 1 != tpriv_size / sizeof (struct
-                                                    TALER_TransferPrivateKeyP)) )
-  {
-    GNUNET_break (0);
-    qs = GNUNET_DB_STATUS_HARD_ERROR;
-    GNUNET_PQ_cleanup_result (rs);
-    goto cleanup;
-  }
-
   /* Pass result back to application */
   cb (cb_cls,
       grctx.rrcs_len,
-      grctx.rrcs,
-      tpriv_size / sizeof (struct TALER_TransferPrivateKeyP),
-      (const struct TALER_TransferPrivateKeyP *) tpriv,
-      &tp);
-  GNUNET_PQ_cleanup_result (rs);
-
+      grctx.rrcs);
 cleanup:
   for (unsigned int i = 0; i < grctx.rrcs_len; i++)
   {
     struct TALER_EXCHANGEDB_RefreshRevealedCoin *rrc = &grctx.rrcs[i];
 
-    TALER_denom_pub_free (&rrc->denom_pub);
     TALER_blinded_denom_sig_free (&rrc->coin_sig);
     GNUNET_free (rrc->coin_ev);
   }
@@ -6897,7 +6747,7 @@ add_old_coin_recoup (void *cls,
                                               &recoup->coin_blind),
         TALER_PQ_RESULT_SPEC_AMOUNT ("amount",
                                      &recoup->value),
-        GNUNET_PQ_result_spec_timestamp ("timestamp",
+        GNUNET_PQ_result_spec_timestamp ("recoup_timestamp",
                                          &recoup->timestamp),
         GNUNET_PQ_result_spec_auto_from_type ("denom_pub_hash",
                                               &recoup->coin.denom_pub_hash),
@@ -6965,7 +6815,7 @@ add_coin_recoup (void *cls,
                                               &recoup->coin_blind),
         TALER_PQ_RESULT_SPEC_AMOUNT ("amount",
                                      &recoup->value),
-        GNUNET_PQ_result_spec_timestamp ("timestamp",
+        GNUNET_PQ_result_spec_timestamp ("recoup_timestamp",
                                          &recoup->timestamp),
         GNUNET_PQ_result_spec_uint64 ("recoup_uuid",
                                       &serial_id),
@@ -7026,7 +6876,7 @@ add_coin_recoup_refresh (void *cls,
                                               &recoup->coin_blind),
         TALER_PQ_RESULT_SPEC_AMOUNT ("amount",
                                      &recoup->value),
-        GNUNET_PQ_result_spec_timestamp ("timestamp",
+        GNUNET_PQ_result_spec_timestamp ("recoup_timestamp",
                                          &recoup->timestamp),
         GNUNET_PQ_result_spec_auto_from_type ("denom_pub_hash",
                                               &recoup->coin.denom_pub_hash),
@@ -7946,14 +7796,14 @@ prewire_cb (void *cls,
   for (unsigned int i = 0; i < num_results; i++)
   {
     uint64_t prewire_uuid;
-    char *type;
+    char *wire_method;
     void *buf = NULL;
     size_t buf_size;
     struct GNUNET_PQ_ResultSpec rs[] = {
       GNUNET_PQ_result_spec_uint64 ("prewire_uuid",
                                     &prewire_uuid),
-      GNUNET_PQ_result_spec_string ("type",
-                                    &type),
+      GNUNET_PQ_result_spec_string ("wire_method",
+                                    &wire_method),
       GNUNET_PQ_result_spec_variable_size ("buf",
                                            &buf,
                                            &buf_size),
@@ -7971,7 +7821,7 @@ prewire_cb (void *cls,
     }
     pc->cb (pc->cb_cls,
             prewire_uuid,
-            type,
+            wire_method,
             buf,
             buf_size);
     GNUNET_PQ_cleanup_result (rs);
@@ -8108,15 +7958,9 @@ postgres_gc (void *cls)
   struct PostgresClosure *pg = cls;
   struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
   struct GNUNET_TIME_Absolute long_ago;
-  struct GNUNET_PQ_QueryParam params_none[] = {
-    GNUNET_PQ_query_param_end
-  };
-  struct GNUNET_PQ_QueryParam params_time[] = {
-    GNUNET_PQ_query_param_absolute_time (&now),
-    GNUNET_PQ_query_param_end
-  };
-  struct GNUNET_PQ_QueryParam params_ancient_time[] = {
+  struct GNUNET_PQ_QueryParam params[] = {
     GNUNET_PQ_query_param_absolute_time (&long_ago),
+    GNUNET_PQ_query_param_absolute_time (&now),
     GNUNET_PQ_query_param_end
   };
   struct GNUNET_PQ_Context *conn;
@@ -8133,28 +7977,11 @@ postgres_gc (void *cls)
   {
     struct GNUNET_PQ_PreparedStatement ps[] = {
       /* Used in #postgres_gc() */
-      GNUNET_PQ_make_prepare ("gc_prewire",
-                              "DELETE"
-                              " FROM prewire"
-                              " WHERE finished=true;",
-                              0),
-      GNUNET_PQ_make_prepare ("gc_reserves",
-                              "DELETE"
-                              " FROM reserves"
-                              " WHERE gc_date < $1"
-                              "   AND current_balance_val = 0"
-                              "   AND current_balance_frac = 0;",
-                              1),
-      GNUNET_PQ_make_prepare ("gc_wire_fee",
-                              "DELETE"
-                              " FROM wire_fee"
-                              " WHERE end_date < $1;",
-                              1),
-      GNUNET_PQ_make_prepare ("gc_denominations",
-                              "DELETE"
-                              " FROM denominations"
-                              " WHERE expire_legal < $1;",
-                              1),
+      GNUNET_PQ_make_prepare ("run_gc",
+                              "CALL"
+                              " exchange_do_gc"
+                              " ($1,$2);",
+                              2),
       GNUNET_PQ_PREPARED_STATEMENT_END
     };
 
@@ -8167,24 +7994,10 @@ postgres_gc (void *cls)
   if (NULL == conn)
     return GNUNET_SYSERR;
   ret = GNUNET_OK;
-  if ( (0 > GNUNET_PQ_eval_prepared_non_select (conn,
-                                                "gc_reserves",
-                                                params_time)) ||
-       (0 > GNUNET_PQ_eval_prepared_non_select (conn,
-                                                "gc_prewire",
-                                                params_none)) ||
-       (0 > GNUNET_PQ_eval_prepared_non_select (conn,
-                                                "gc_wire_fee",
-                                                params_ancient_time)) )
+  if (0 > GNUNET_PQ_eval_prepared_non_select (conn,
+                                              "run_gc",
+                                              params))
     ret = GNUNET_SYSERR;
-  /* This one may fail due to foreign key constraints from
-     recoup and reserves_out tables to known_coins; these
-     are NOT using 'ON DROP CASCADE' and might keep denomination
-     keys alive for a bit longer, thus causing this statement
-     to fail. */
-  (void) GNUNET_PQ_eval_prepared_non_select (conn,
-                                             "gc_denominations",
-                                             params_time);
   GNUNET_PQ_disconnect (conn);
   return ret;
 }
@@ -9155,7 +8968,7 @@ recoup_serial_helper_cb (void *cls,
     struct GNUNET_PQ_ResultSpec rs[] = {
       GNUNET_PQ_result_spec_uint64 ("recoup_uuid",
                                     &rowid),
-      GNUNET_PQ_result_spec_timestamp ("timestamp",
+      GNUNET_PQ_result_spec_timestamp ("recoup_timestamp",
                                        &timestamp),
       GNUNET_PQ_result_spec_auto_from_type ("reserve_pub",
                                             &reserve_pub),
@@ -9304,7 +9117,7 @@ recoup_refresh_serial_helper_cb (void *cls,
     struct GNUNET_PQ_ResultSpec rs[] = {
       GNUNET_PQ_result_spec_uint64 ("recoup_refresh_uuid",
                                     &rowid),
-      GNUNET_PQ_result_spec_timestamp ("timestamp",
+      GNUNET_PQ_result_spec_timestamp ("recoup_timestamp",
                                        &timestamp),
       GNUNET_PQ_result_spec_auto_from_type ("old_coin_pub",
                                             &old_coin_pub),
@@ -9535,165 +9348,20 @@ postgres_select_reserve_closed_above_serial_id (
 
 
 /**
- * Function called to add a request for an emergency recoup for a
- * coin.  The funds are to be added back to the reserve.  The function
- * should return the @a deadline by which the exchange will trigger a
- * wire transfer back to the customer's account for the reserve.
- *
- * @param cls closure
- * @param reserve_pub public key of the reserve that is being refunded
- * @param coin information about the coin
- * @param coin_sig signature of the coin of type #TALER_SIGNATURE_WALLET_COIN_RECOUP
- * @param coin_blind blinding key of the coin
- * @param amount total amount to be paid back
- * @param h_blind_ev hash of the blinded coin's envelope (must match reserves_out entry)
- * @param timestamp current time (rounded)
- * @return transaction result status
- */
-static enum GNUNET_DB_QueryStatus
-postgres_insert_recoup_request (
-  void *cls,
-  const struct TALER_ReservePublicKeyP *reserve_pub,
-  const struct TALER_CoinPublicInfo *coin,
-  const struct TALER_CoinSpendSignatureP *coin_sig,
-  const union TALER_DenominationBlindingKeyP *coin_blind,
-  const struct TALER_Amount *amount,
-  const struct TALER_BlindedCoinHash *h_blind_ev,
-  struct GNUNET_TIME_Timestamp timestamp)
-{
-  struct PostgresClosure *pg = cls;
-  struct GNUNET_TIME_Timestamp expiry;
-  struct GNUNET_TIME_Timestamp gc;
-  struct TALER_EXCHANGEDB_Reserve reserve;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_auto_from_type (&coin->coin_pub),
-    GNUNET_PQ_query_param_auto_from_type (coin_sig),
-    GNUNET_PQ_query_param_auto_from_type (coin_blind),
-    TALER_PQ_query_param_amount (amount),
-    GNUNET_PQ_query_param_timestamp (&timestamp),
-    GNUNET_PQ_query_param_auto_from_type (h_blind_ev),
-    GNUNET_PQ_query_param_end
-  };
-  enum GNUNET_DB_QueryStatus qs;
-
-  /* now store actual recoup information */
-  qs = GNUNET_PQ_eval_prepared_non_select (pg->conn,
-                                           "recoup_insert",
-                                           params);
-  if (0 > qs)
-  {
-    GNUNET_break (GNUNET_DB_STATUS_SOFT_ERROR == qs);
-    return qs;
-  }
-
-  /* Update reserve balance */
-  reserve.pub = *reserve_pub;
-  qs = reserves_get_internal (pg,
-                              &reserve);
-  if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != qs)
-  {
-    GNUNET_break (GNUNET_DB_STATUS_SOFT_ERROR == qs);
-    return qs;
-  }
-  if (0 >
-      TALER_amount_add (&reserve.balance,
-                        &reserve.balance,
-                        amount))
-  {
-    GNUNET_break (0);
-    return GNUNET_DB_STATUS_HARD_ERROR;
-  }
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Inserting recoup for coin %s\n",
-              TALER_B2S (&coin->coin_pub));
-  gc = GNUNET_TIME_absolute_to_timestamp (
-    GNUNET_TIME_absolute_add (timestamp.abs_time,
-                              pg->legal_reserve_expiration_time));
-  reserve.gc = GNUNET_TIME_timestamp_max (gc,
-                                          reserve.gc);
-  expiry = GNUNET_TIME_absolute_to_timestamp (
-    GNUNET_TIME_absolute_add (timestamp.abs_time,
-                              pg->idle_reserve_expiration_time));
-  reserve.expiry = GNUNET_TIME_timestamp_max (expiry,
-                                              reserve.expiry);
-  qs = reserves_update (pg,
-                        &reserve);
-  if (0 >= qs)
-  {
-    GNUNET_break (GNUNET_DB_STATUS_SOFT_ERROR == qs);
-    return qs;
-  }
-  return qs;
-}
-
-
-/**
- * Function called to add a request for an emergency recoup for a
- * refreshed coin.  The funds are to be added back to the original coin
- * (which is implied via @a h_blind_ev, see the prepared statement
- * "recoup_by_old_coin" used in #postgres_get_coin_transactions()).
- *
- * @param cls closure
- * @param coin public information about the refreshed coin
- * @param coin_sig signature of the coin of type #TALER_SIGNATURE_WALLET_COIN_RECOUP
- * @param coin_blind blinding key of the coin
- * @param h_blind_ev blinded envelope, as calculated by the exchange
- * @param amount total amount to be paid back
- * @param h_blind_ev hash of the blinded coin's envelope (must match reserves_out entry)
- * @param timestamp a timestamp to store
- * @return transaction result status
- */
-static enum GNUNET_DB_QueryStatus
-postgres_insert_recoup_refresh_request (
-  void *cls,
-  const struct TALER_CoinPublicInfo *coin,
-  const struct TALER_CoinSpendSignatureP *coin_sig,
-  const union TALER_DenominationBlindingKeyP *coin_blind,
-  const struct TALER_Amount *amount,
-  const struct TALER_BlindedCoinHash *h_blind_ev,
-  struct GNUNET_TIME_Timestamp timestamp)
-{
-  struct PostgresClosure *pg = cls;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_auto_from_type (&coin->coin_pub),
-    GNUNET_PQ_query_param_auto_from_type (coin_sig),
-    GNUNET_PQ_query_param_auto_from_type (coin_blind),
-    TALER_PQ_query_param_amount (amount),
-    GNUNET_PQ_query_param_timestamp (&timestamp),
-    GNUNET_PQ_query_param_auto_from_type (h_blind_ev),
-    GNUNET_PQ_query_param_end
-  };
-  enum GNUNET_DB_QueryStatus qs;
-
-  /* now store actual recoup information */
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "Inserting recoup-refresh for coin %s\n",
-              TALER_B2S (&coin->coin_pub));
-  qs = GNUNET_PQ_eval_prepared_non_select (pg->conn,
-                                           "recoup_refresh_insert",
-                                           params);
-  if (0 > qs)
-  {
-    GNUNET_break (GNUNET_DB_STATUS_SOFT_ERROR == qs);
-    return qs;
-  }
-  return qs;
-}
-
-
-/**
  * Obtain information about which reserve a coin was generated
  * from given the hash of the blinded coin.
  *
  * @param cls closure
  * @param h_blind_ev hash of the blinded coin
  * @param[out] reserve_pub set to information about the reserve (on success only)
+ * @param[out] reserve_out_serial_id set to row of the @a h_blind_ev in reserves_out
  * @return transaction status code
  */
 static enum GNUNET_DB_QueryStatus
 postgres_get_reserve_by_h_blind (void *cls,
                                  const struct TALER_BlindedCoinHash *h_blind_ev,
-                                 struct TALER_ReservePublicKeyP *reserve_pub)
+                                 struct TALER_ReservePublicKeyP *reserve_pub,
+                                 uint64_t *reserve_out_serial_id)
 {
   struct PostgresClosure *pg = cls;
   struct GNUNET_PQ_QueryParam params[] = {
@@ -9703,6 +9371,8 @@ postgres_get_reserve_by_h_blind (void *cls,
   struct GNUNET_PQ_ResultSpec rs[] = {
     GNUNET_PQ_result_spec_auto_from_type ("reserve_pub",
                                           reserve_pub),
+    GNUNET_PQ_result_spec_uint64 ("reserve_out_serial_id",
+                                  reserve_out_serial_id),
     GNUNET_PQ_result_spec_end
   };
 
@@ -9723,10 +9393,11 @@ postgres_get_reserve_by_h_blind (void *cls,
  * @return transaction status code
  */
 static enum GNUNET_DB_QueryStatus
-postgres_get_old_coin_by_h_blind (void *cls,
-                                  const struct
-                                  TALER_BlindedCoinHash *h_blind_ev,
-                                  struct TALER_CoinSpendPublicKeyP *old_coin_pub)
+postgres_get_old_coin_by_h_blind (
+  void *cls,
+  const struct TALER_BlindedCoinHash *h_blind_ev,
+  struct TALER_CoinSpendPublicKeyP *old_coin_pub,
+  uint64_t *rrc_serial)
 {
   struct PostgresClosure *pg = cls;
   struct GNUNET_PQ_QueryParam params[] = {
@@ -9736,6 +9407,8 @@ postgres_get_old_coin_by_h_blind (void *cls,
   struct GNUNET_PQ_ResultSpec rs[] = {
     GNUNET_PQ_result_spec_auto_from_type ("old_coin_pub",
                                           old_coin_pub),
+    GNUNET_PQ_result_spec_uint64 ("rrc_serial",
+                                  rrc_serial),
     GNUNET_PQ_result_spec_end
   };
 
@@ -11830,25 +11503,23 @@ libtaler_plugin_exchangedb_postgres_init (void *cls)
     &postgres_iterate_auditor_denominations;
   plugin->reserves_get = &postgres_reserves_get;
   plugin->set_kyc_ok = &postgres_set_kyc_ok;
-  plugin->get_kyc_status = &postgres_get_kyc_status;
   plugin->select_kyc_status = &postgres_select_kyc_status;
   plugin->inselect_wallet_kyc_status = &postgres_inselect_wallet_kyc_status;
   plugin->reserves_in_insert = &postgres_reserves_in_insert;
-  plugin->get_latest_reserve_in_reference =
-    &postgres_get_latest_reserve_in_reference;
   plugin->get_withdraw_info = &postgres_get_withdraw_info;
-  plugin->do_check_coin_balance = &postgres_do_check_coin_balance;
   plugin->do_withdraw = &postgres_do_withdraw;
   plugin->do_withdraw_limit_check = &postgres_do_withdraw_limit_check;
+  plugin->do_deposit = &postgres_do_deposit;
+  plugin->do_melt = &postgres_do_melt;
+  plugin->do_refund = &postgres_do_refund;
+  plugin->do_recoup = &postgres_do_recoup;
+  plugin->do_recoup_refresh = &postgres_do_recoup_refresh;
   plugin->get_reserve_history = &postgres_get_reserve_history;
-  plugin->select_withdraw_amounts_by_account
-    = &postgres_select_withdraw_amounts_by_account;
   plugin->free_reserve_history = &common_free_reserve_history;
   plugin->count_known_coins = &postgres_count_known_coins;
   plugin->ensure_coin_known = &postgres_ensure_coin_known;
   plugin->get_known_coin = &postgres_get_known_coin;
   plugin->get_coin_denomination = &postgres_get_coin_denomination;
-  plugin->have_deposit = &postgres_have_deposit;
   plugin->have_deposit2 = &postgres_have_deposit2;
   plugin->mark_deposit_tiny = &postgres_mark_deposit_tiny;
   plugin->mark_deposit_done = &postgres_mark_deposit_done;
@@ -11857,9 +11528,7 @@ libtaler_plugin_exchangedb_postgres_init (void *cls)
   plugin->insert_deposit = &postgres_insert_deposit;
   plugin->insert_refund = &postgres_insert_refund;
   plugin->select_refunds_by_coin = &postgres_select_refunds_by_coin;
-  plugin->insert_melt = &postgres_insert_melt;
   plugin->get_melt = &postgres_get_melt;
-  plugin->get_melt_index = &postgres_get_melt_index;
   plugin->insert_refresh_reveal = &postgres_insert_refresh_reveal;
   plugin->get_refresh_reveal = &postgres_get_refresh_reveal;
   plugin->get_link_data = &postgres_get_link_data;
@@ -11903,10 +11572,6 @@ libtaler_plugin_exchangedb_postgres_init (void *cls)
     = &postgres_select_recoup_refresh_above_serial_id;
   plugin->select_reserve_closed_above_serial_id
     = &postgres_select_reserve_closed_above_serial_id;
-  plugin->insert_recoup_request
-    = &postgres_insert_recoup_request;
-  plugin->insert_recoup_refresh_request
-    = &postgres_insert_recoup_refresh_request;
   plugin->get_reserve_by_h_blind
     = &postgres_get_reserve_by_h_blind;
   plugin->get_old_coin_by_h_blind
diff --git a/src/exchangedb/test_exchangedb.c b/src/exchangedb/test_exchangedb.c
index 6d334d3c8..49dc8c2db 100644
--- a/src/exchangedb/test_exchangedb.c
+++ b/src/exchangedb/test_exchangedb.c
@@ -113,7 +113,7 @@ mark_prepare_cb (void *cls,
  *
  * @return #GNUNET_OK on success
  */
-static int
+static enum GNUNET_GenericReturnValue
 test_wire_prepare (void)
 {
   FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
@@ -202,7 +202,7 @@ destroy_denom_key_pair (struct DenomKeyPair *dkp)
 
 
 /**
- * Create a denominaiton key pair by registering the denomination in the DB.
+ * Create a denomination key pair by registering the denomination in the DB.
  *
  * @param size the size of the denomination key
  * @param now time to use for key generation, legal expiration will be 3h later.
@@ -340,24 +340,15 @@ static struct TALER_TransferPublicKeyP tpub;
  * @param rowid unique serial ID for the row in our database
  * @param num_freshcoins size of the @a rrcs array
  * @param rrcs array of @a num_freshcoins information about coins to be created
- * @param num_tprivs number of entries in @a tprivs, should be #TALER_CNC_KAPPA - 1
- * @param tprivs array of @e num_tprivs transfer private keys
- * @param tp transfer public key information
  */
 static void
 never_called_cb (void *cls,
                  uint32_t num_freshcoins,
-                 const struct TALER_EXCHANGEDB_RefreshRevealedCoin *rrcs,
-                 unsigned int num_tprivs,
-                 const struct TALER_TransferPrivateKeyP *tprivs,
-                 const struct TALER_TransferPublicKeyP *tp)
+                 const struct TALER_EXCHANGEDB_RefreshRevealedCoin *rrcs)
 {
   (void) cls;
   (void) num_freshcoins;
   (void) rrcs;
-  (void) num_tprivs;
-  (void) tprivs;
-  (void) tp;
   GNUNET_assert (0); /* should never be called! */
 }
 
@@ -370,22 +361,14 @@ never_called_cb (void *cls,
  * @param rowid unique serial ID for the row in our database
  * @param num_freshcoins size of the @a rrcs array
  * @param rrcs array of @a num_freshcoins information about coins to be created
- * @param num_tprivs number of entries in @a tprivs, should be #TALER_CNC_KAPPA - 1
- * @param tprivsr array of @e num_tprivs transfer private keys
- * @param tpr transfer public key information
  */
 static void
 check_refresh_reveal_cb (
   void *cls,
   uint32_t num_freshcoins,
-  const struct TALER_EXCHANGEDB_RefreshRevealedCoin *rrcs,
-  unsigned int num_tprivs,
-  const struct TALER_TransferPrivateKeyP *tprivsr,
-  const struct TALER_TransferPublicKeyP *tpr)
+  const struct TALER_EXCHANGEDB_RefreshRevealedCoin *rrcs)
 {
   (void) cls;
-
-  GNUNET_assert (TALER_CNC_KAPPA - 1 == num_tprivs);
   /* compare the refresh commit coin arrays */
   for (unsigned int cnt = 0; cnt < num_freshcoins; cnt++)
   {
@@ -398,13 +381,9 @@ check_refresh_reveal_cb (
                    GNUNET_memcmp (acoin->coin_ev,
                                   bcoin->coin_ev));
     GNUNET_assert (0 ==
-                   TALER_denom_pub_cmp (&acoin->denom_pub,
-                                        &bcoin->denom_pub));
+                   GNUNET_memcmp (&acoin->h_denom_pub,
+                                  &bcoin->h_denom_pub));
   }
-  GNUNET_assert (0 == GNUNET_memcmp (&tpub, tpr));
-  GNUNET_assert (0 == memcmp (tprivs, tprivsr,
-                              sizeof(struct TALER_TransferPrivateKeyP)
-                              * (TALER_CNC_KAPPA - 1)));
 }
 
 
@@ -431,7 +410,7 @@ static unsigned int auditor_row_cnt;
  * @param rc what is the session hash
  * @return #GNUNET_OK to continue to iterate, #GNUNET_SYSERR to stop
  */
-static int
+static enum GNUNET_GenericReturnValue
 audit_refresh_session_cb (void *cls,
                           uint64_t rowid,
                           const struct TALER_DenominationPublicKey *denom_pub,
@@ -479,9 +458,9 @@ handle_link_data_cb (void *cls,
        NULL != ldlp;
        ldlp = ldlp->next)
   {
-    int found;
+    bool found;
 
-    found = GNUNET_NO;
+    found = false;
     for (unsigned int cnt = 0; cnt < MELT_NEW_COINS; cnt++)
     {
       if ( (0 ==
@@ -491,224 +470,12 @@ handle_link_data_cb (void *cls,
             TALER_blinded_denom_sig_cmp (&ldlp->ev_sig,
                                          &revealed_coins[cnt].coin_sig)) )
       {
-        found = GNUNET_YES;
+        found = true;
         break;
       }
     }
-    GNUNET_assert (GNUNET_NO != found);
-  }
-}
-
-
-/**
- * Function to test melting of coins as part of a refresh session
- *
- * @return #GNUNET_OK if everything went well; #GNUNET_SYSERR if not
- */
-static enum GNUNET_GenericReturnValue
-test_melting (void)
-{
-  struct TALER_EXCHANGEDB_Refresh refresh_session;
-  struct TALER_EXCHANGEDB_Melt ret_refresh_session;
-  struct DenomKeyPair *dkp;
-  struct TALER_DenominationPublicKey *new_denom_pubs;
-  enum GNUNET_GenericReturnValue ret;
-  enum GNUNET_DB_QueryStatus qs;
-  struct GNUNET_TIME_Timestamp now;
-
-  ret = GNUNET_SYSERR;
-  RND_BLK (&refresh_session);
-  dkp = NULL;
-  new_dkp = NULL;
-  new_denom_pubs = NULL;
-  /* create and test a refresh session */
-  refresh_session.noreveal_index = MELT_NOREVEAL_INDEX;
-  /* create a denomination (value: 1; fraction: 100) */
-  now = GNUNET_TIME_timestamp_get ();
-  dkp = create_denom_key_pair (512,
-                               now,
-                               &value,
-                               &fee_withdraw,
-                               &fee_deposit,
-                               &fee_refresh,
-                               &fee_refund);
-  GNUNET_assert (NULL != dkp);
-  /* initialize refresh session melt data */
-  {
-    struct TALER_CoinPubHash c_hash;
-    struct TALER_PlanchetDetail pd;
-    struct TALER_BlindedDenominationSignature bds;
-    union TALER_DenominationBlindingKeyP bks;
-
-    RND_BLK (&refresh_session.coin.coin_pub);
-    TALER_blinding_secret_create (&bks);
-    GNUNET_assert (GNUNET_OK ==
-                   TALER_denom_blind (&dkp->pub,
-                                      &bks,
-                                      NULL, /* FIXME-Oec */
-                                      &refresh_session.coin.coin_pub,
-                                      &c_hash,
-                                      &pd.coin_ev,
-                                      &pd.coin_ev_size));
-    GNUNET_assert (GNUNET_OK ==
-                   TALER_denom_sign_blinded (&bds,
-                                             &dkp->priv,
-                                             pd.coin_ev,
-                                             pd.coin_ev_size));
-    GNUNET_free (pd.coin_ev);
-    GNUNET_assert (GNUNET_OK ==
-                   TALER_denom_sig_unblind (&refresh_session.coin.denom_sig,
-                                            &bds,
-                                            &bks,
-                                            &dkp->pub));
-    TALER_blinded_denom_sig_free (&bds);
-    TALER_denom_pub_hash (&dkp->pub,
-                          &refresh_session.coin.denom_pub_hash);
-    refresh_session.amount_with_fee = amount_with_fee;
-  }
-
-  /* test insert_melt & get_melt */
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
-          plugin->get_melt (plugin->cls,
-                            &refresh_session.rc,
-                            &ret_refresh_session));
-  FAILIF (TALER_EXCHANGEDB_CKS_ADDED !=
-          plugin->ensure_coin_known (plugin->cls,
-                                     &refresh_session.coin));
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->insert_melt (plugin->cls,
-                               &refresh_session));
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->get_melt (plugin->cls,
-                            &refresh_session.rc,
-                            &ret_refresh_session));
-  FAILIF (refresh_session.noreveal_index !=
-          ret_refresh_session.session.noreveal_index);
-  FAILIF (0 !=
-          TALER_amount_cmp (&refresh_session.amount_with_fee,
-                            &ret_refresh_session.session.amount_with_fee));
-  FAILIF (0 !=
-          TALER_amount_cmp (&fee_refresh,
-                            &ret_refresh_session.melt_fee));
-  FAILIF (0 !=
-          GNUNET_memcmp (&refresh_session.rc,
-                         &ret_refresh_session.session.rc));
-  FAILIF (0 != GNUNET_memcmp (&refresh_session.coin_sig,
-                              &ret_refresh_session.session.coin_sig));
-  FAILIF (0 != memcmp (&refresh_session.coin.coin_pub,
-                       &ret_refresh_session.session.coin.coin_pub,
-                       sizeof (refresh_session.coin.coin_pub)));
-  FAILIF (0 !=
-          GNUNET_memcmp (&refresh_session.coin.denom_pub_hash,
-                         &ret_refresh_session.session.coin.denom_pub_hash));
-
-  /* test 'select_refreshes_above_serial_id' */
-  auditor_row_cnt = 0;
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->select_refreshes_above_serial_id (plugin->cls,
-                                                    0,
-                                                    &audit_refresh_session_cb,
-                                                    NULL));
-  FAILIF (1 != auditor_row_cnt);
-
-  new_dkp = GNUNET_new_array (MELT_NEW_COINS,
-                              struct DenomKeyPair *);
-  new_denom_pubs = GNUNET_new_array (MELT_NEW_COINS,
-                                     struct TALER_DenominationPublicKey);
-  revealed_coins
-    = GNUNET_new_array (MELT_NEW_COINS,
-                        struct TALER_EXCHANGEDB_RefreshRevealedCoin);
-  for (unsigned int cnt = 0; cnt < MELT_NEW_COINS; cnt++)
-  {
-    struct TALER_EXCHANGEDB_RefreshRevealedCoin *ccoin;
-    struct GNUNET_TIME_Timestamp now;
-
-    now = GNUNET_TIME_timestamp_get ();
-    new_dkp[cnt] = create_denom_key_pair (RSA_KEY_SIZE,
-                                          now,
-                                          &value,
-                                          &fee_withdraw,
-                                          &fee_deposit,
-                                          &fee_refresh,
-                                          &fee_refund);
-    GNUNET_assert (NULL != new_dkp[cnt]);
-    new_denom_pubs[cnt] = new_dkp[cnt]->pub;
-    ccoin = &revealed_coins[cnt];
-    ccoin->coin_ev_size = (size_t) GNUNET_CRYPTO_random_u64 (
-      GNUNET_CRYPTO_QUALITY_WEAK,
-      (RSA_KEY_SIZE / 8) - 1);
-    ccoin->coin_ev = GNUNET_malloc (ccoin->coin_ev_size);
-    GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
-                                ccoin->coin_ev,
-                                ccoin->coin_ev_size);
-    ccoin->denom_pub = new_dkp[cnt]->pub;
-    GNUNET_assert (GNUNET_OK ==
-                   TALER_denom_sign_blinded (&ccoin->coin_sig,
-                                             &new_dkp[cnt]->priv,
-                                             ccoin->coin_ev,
-                                             ccoin->coin_ev_size));
-  }
-  RND_BLK (&tprivs);
-  RND_BLK (&tpub);
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
-          plugin->get_refresh_reveal (plugin->cls,
-                                      &refresh_session.rc,
-                                      &never_called_cb,
-                                      NULL));
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->insert_refresh_reveal (plugin->cls,
-                                         &refresh_session.rc,
-                                         MELT_NEW_COINS,
-                                         revealed_coins,
-                                         TALER_CNC_KAPPA - 1,
-                                         tprivs,
-                                         &tpub));
-  FAILIF (0 >=
-          plugin->get_refresh_reveal (plugin->cls,
-                                      &refresh_session.rc,
-                                      &check_refresh_reveal_cb,
-                                      NULL));
-  qs = plugin->get_link_data (plugin->cls,
-                              &refresh_session.coin.coin_pub,
-                              &handle_link_data_cb,
-                              NULL);
-  FAILIF (0 >= qs);
-  {
-    /* Just to test fetching a coin with melt history */
-    struct TALER_EXCHANGEDB_TransactionList *tl;
-    enum GNUNET_DB_QueryStatus qs;
-
-    qs = plugin->get_coin_transactions (plugin->cls,
-                                        &refresh_session.coin.coin_pub,
-                                        GNUNET_YES,
-                                        &tl);
-    FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != qs);
-    plugin->free_coin_transaction_list (plugin->cls,
-                                        tl);
-  }
-
-
-  ret = GNUNET_OK;
-drop:
-  if (NULL != revealed_coins)
-  {
-    for (unsigned int cnt = 0; cnt < MELT_NEW_COINS; cnt++)
-    {
-      TALER_blinded_denom_sig_free (&revealed_coins[cnt].coin_sig);
-      GNUNET_free (revealed_coins[cnt].coin_ev);
-    }
-    GNUNET_free (revealed_coins);
-    revealed_coins = NULL;
+    GNUNET_assert (found);
   }
-  destroy_denom_key_pair (dkp);
-  TALER_denom_sig_free (&refresh_session.coin.denom_sig);
-  GNUNET_free (new_denom_pubs);
-  for (unsigned int cnt = 0;
-       (NULL != new_dkp) && (cnt < MELT_NEW_COINS) && (NULL != new_dkp[cnt]);
-       cnt++)
-    destroy_denom_key_pair (new_dkp[cnt]);
-  GNUNET_free (new_dkp);
-  return ret;
 }
 
 
@@ -829,26 +596,23 @@ deposit_cb (void *cls,
 {
   struct TALER_EXCHANGEDB_Deposit *deposit = cls;
 
-  deposit_rowid = rowid;
-  wire_target_row = wire_target;
-  if ( (0 != GNUNET_memcmp (merchant_pub,
-                            &deposit->merchant_pub)) ||
-       (0 != TALER_amount_cmp (amount_with_fee,
-                               &deposit->amount_with_fee)) ||
-       (0 != TALER_amount_cmp (deposit_fee,
-                               &deposit->deposit_fee)) ||
-       (0 != GNUNET_memcmp (h_contract_terms,
-                            &deposit->h_contract_terms)) ||
-       (0 != memcmp (coin_pub,
-                     &deposit->coin.coin_pub,
-                     sizeof (struct TALER_CoinSpendPublicKeyP))) ||
-       (0 != strcmp (payto_uri,
+  if ( (0 == GNUNET_memcmp (merchant_pub,
+                            &deposit->merchant_pub)) &&
+       (0 == TALER_amount_cmp (amount_with_fee,
+                               &deposit->amount_with_fee)) &&
+       (0 == TALER_amount_cmp (deposit_fee,
+                               &deposit->deposit_fee)) &&
+       (0 == GNUNET_memcmp (h_contract_terms,
+                            &deposit->h_contract_terms)) &&
+       (0 == GNUNET_memcmp (coin_pub,
+                            &deposit->coin.coin_pub)) &&
+       (0 == strcmp (payto_uri,
                      deposit->receiver_wire_account)) )
   {
-    GNUNET_break (0);
-    return GNUNET_DB_STATUS_HARD_ERROR;
+    deposit_rowid = rowid;
+    wire_target_row = wire_target;
+    result = 9;
   }
-
   return GNUNET_DB_STATUS_SUCCESS_ONE_RESULT;
 }
 
@@ -1504,11 +1268,12 @@ run (void *cls)
   union TALER_DenominationBlindingKeyP coin_blind;
   struct TALER_ReservePublicKeyP reserve_pub;
   struct TALER_ReservePublicKeyP reserve_pub2;
-  struct DenomKeyPair *dkp;
+  struct TALER_ReservePublicKeyP reserve_pub3;
+  struct DenomKeyPair *dkp = NULL;
   struct TALER_MasterSignatureP master_sig;
   struct TALER_EXCHANGEDB_CollectableBlindcoin cbc;
   struct TALER_EXCHANGEDB_CollectableBlindcoin cbc2;
-  struct TALER_EXCHANGEDB_ReserveHistory *rh;
+  struct TALER_EXCHANGEDB_ReserveHistory *rh = NULL;
   struct TALER_EXCHANGEDB_ReserveHistory *rh_head;
   struct TALER_EXCHANGEDB_BankTransfer *bt;
   struct TALER_EXCHANGEDB_CollectableBlindcoin *withdraw;
@@ -1518,23 +1283,31 @@ run (void *cls)
   struct TALER_EXCHANGEDB_TransactionList *tl;
   struct TALER_EXCHANGEDB_TransactionList *tlp;
   const char *sndr = "payto://x-taler-bank/localhost:8080/1";
+  const char *rcvr = "payto://x-taler-bank/localhost:8080/2";
   unsigned int matched;
   unsigned int cnt;
-  uint64_t rr;
   enum GNUNET_DB_QueryStatus qs;
   struct GNUNET_TIME_Timestamp now;
   struct TALER_WireSalt salt;
   union TALER_DenominationBlindingKeyP bks;
   struct TALER_CoinPubHash c_hash;
+  uint64_t known_coin_id;
+  uint64_t rrc_serial;
+  struct TALER_EXCHANGEDB_Refresh refresh;
+  struct TALER_DenominationPublicKey *new_denom_pubs = NULL;
+  uint64_t reserve_out_serial_id;
+  uint64_t melt_serial_id;
 
-  dkp = NULL;
-  rh = NULL;
-  memset (&deposit.coin.denom_sig,
+  memset (&deposit,
           0,
-          sizeof (deposit.coin.denom_sig));
+          sizeof (deposit));
+  deposit.receiver_wire_account = (char *) rcvr;
   memset (&salt,
           45,
           sizeof (salt));
+  memset (&refresh,
+          0,
+          sizeof (refresh));
   ZR_BLK (&cbc);
   ZR_BLK (&cbc2);
   if (NULL ==
@@ -1571,6 +1344,7 @@ run (void *cls)
   GNUNET_assert (GNUNET_OK ==
                  TALER_string_to_amount (CURRENCY ":0.000010",
                                          &fee_deposit));
+  deposit.deposit_fee = fee_deposit;
   GNUNET_assert (GNUNET_OK ==
                  TALER_string_to_amount (CURRENCY ":0.000010",
                                          &fee_refresh));
@@ -1582,10 +1356,6 @@ run (void *cls)
                                          &amount_with_fee));
 
   result = 4;
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
-          plugin->get_latest_reserve_in_reference (plugin->cls,
-                                                   "exchange-account-1",
-                                                   &rr));
   now = GNUNET_TIME_timestamp_get ();
   FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
           plugin->reserves_in_insert (plugin->cls,
@@ -1595,38 +1365,30 @@ run (void *cls)
                                       sndr,
                                       "exchange-account-1",
                                       4));
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->get_latest_reserve_in_reference (plugin->cls,
-                                                   "exchange-account-1",
-                                                   &rr));
-  FAILIF (4 != rr);
   FAILIF (GNUNET_OK !=
           check_reserve (&reserve_pub,
                          value.value,
                          value.fraction,
                          value.currency));
   now = GNUNET_TIME_timestamp_get ();
+  RND_BLK (&reserve_pub2);
   FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
           plugin->reserves_in_insert (plugin->cls,
-                                      &reserve_pub,
+                                      &reserve_pub2,
                                       &value,
                                       now,
                                       sndr,
                                       "exchange-account-1",
                                       5));
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->get_latest_reserve_in_reference (plugin->cls,
-                                                   "exchange-account-1",
-                                                   &rr));
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->get_latest_reserve_in_reference (plugin->cls,
-                                                   "exchange-account-1",
-                                                   &rr));
-  FAILIF (5 != rr);
   FAILIF (GNUNET_OK !=
           check_reserve (&reserve_pub,
-                         value.value * 2,
-                         value.fraction * 2,
+                         value.value,
+                         value.fraction,
+                         value.currency));
+  FAILIF (GNUNET_OK !=
+          check_reserve (&reserve_pub2,
+                         value.value,
+                         value.fraction,
                          value.currency));
   result = 5;
   now = GNUNET_TIME_timestamp_get ();
@@ -1674,6 +1436,7 @@ run (void *cls)
     bool found;
     bool balance_ok;
     struct TALER_EXCHANGEDB_KycStatus kyc;
+    uint64_t ruuid;
 
     FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             plugin->do_withdraw (plugin->cls,
@@ -1681,23 +1444,29 @@ run (void *cls)
                                  now,
                                  &found,
                                  &balance_ok,
-                                 &kyc));
+                                 &kyc,
+                                 &ruuid));
     GNUNET_assert (found);
     GNUNET_assert (balance_ok);
     GNUNET_assert (! kyc.ok);
   }
   FAILIF (GNUNET_OK !=
           check_reserve (&reserve_pub,
+                         0,
+                         0,
+                         value.currency));
+  FAILIF (GNUNET_OK !=
+          check_reserve (&reserve_pub2,
                          value.value,
                          value.fraction,
                          value.currency));
-
   FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
           plugin->get_reserve_by_h_blind (plugin->cls,
                                           &cbc.h_coin_envelope,
-                                          &reserve_pub2));
+                                          &reserve_pub3,
+                                          &reserve_out_serial_id));
   FAILIF (0 != GNUNET_memcmp (&reserve_pub,
-                              &reserve_pub2));
+                              &reserve_pub3));
 
   FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
           plugin->get_withdraw_info (plugin->cls,
@@ -1735,29 +1504,310 @@ run (void *cls)
                                           &bks,
                                           &dkp->pub));
   deadline = GNUNET_TIME_timestamp_get ();
-  FAILIF (TALER_EXCHANGEDB_CKS_ADDED !=
-          plugin->ensure_coin_known (plugin->cls,
-                                     &deposit.coin));
+  {
+    struct TALER_DenominationHash dph;
+    struct TALER_AgeHash agh;
+
+    FAILIF (TALER_EXCHANGEDB_CKS_ADDED !=
+            plugin->ensure_coin_known (plugin->cls,
+                                       &deposit.coin,
+                                       &known_coin_id,
+                                       &dph,
+                                       &agh));
+  }
+  FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
+          plugin->commit (plugin->cls));
+  {
+    struct GNUNET_TIME_Timestamp deposit_timestamp
+      = GNUNET_TIME_timestamp_get ();
+    bool balance_ok;
+    bool in_conflict;
+    struct TALER_PaytoHash h_payto;
+
+    RND_BLK (&h_payto);
+    deposit.refund_deadline
+      = GNUNET_TIME_relative_to_timestamp (GNUNET_TIME_UNIT_MONTHS);
+    deposit.wire_deadline
+      = GNUNET_TIME_relative_to_timestamp (GNUNET_TIME_UNIT_MONTHS);
+    deposit.amount_with_fee = value;
+    FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+            plugin->do_deposit (plugin->cls,
+                                &deposit,
+                                known_coin_id,
+                                &h_payto,
+                                false,
+                                &deposit_timestamp,
+                                &balance_ok,
+                                &in_conflict));
+    FAILIF (! balance_ok);
+    FAILIF (in_conflict);
+  }
+
+  {
+    bool not_found;
+    bool refund_ok;
+    bool gone;
+    bool conflict;
+
+    refund.coin = deposit.coin;
+    refund.details.merchant_pub = deposit.merchant_pub;
+    RND_BLK (&refund.details.merchant_sig);
+    refund.details.h_contract_terms = deposit.h_contract_terms;
+    refund.details.rtransaction_id = 1;
+    refund.details.refund_amount = value;
+    refund.details.refund_fee = fee_refund;
+    RND_BLK (&refund.details.merchant_sig);
+    FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+            plugin->do_refund (plugin->cls,
+                               &refund,
+                               &fee_deposit,
+                               known_coin_id,
+                               &not_found,
+                               &refund_ok,
+                               &gone,
+                               &conflict));
+    FAILIF (not_found);
+    FAILIF (! refund_ok);
+    FAILIF (gone);
+    FAILIF (conflict);
+
+    FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+            plugin->select_refunds_by_coin (plugin->cls,
+                                            &refund.coin.coin_pub,
+                                            &refund.details.merchant_pub,
+                                            &refund.details.h_contract_terms,
+                                            &check_refund_cb,
+                                            &refund));
+  }
+
+  /* test do_melt */
+  {
+    bool zombie_required = false;
+    bool balance_ok;
+
+    refresh.coin = deposit.coin;
+    RND_BLK (&refresh.coin_sig);
+    RND_BLK (&refresh.rc);
+    refresh.amount_with_fee = value;
+    refresh.noreveal_index = MELT_NOREVEAL_INDEX;
+    FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+            plugin->do_melt (plugin->cls,
+                             &refresh,
+                             known_coin_id,
+                             &zombie_required,
+                             &balance_ok));
+    FAILIF (! balance_ok);
+    FAILIF (zombie_required);
+  }
+
+  /* test get_melt */
+  {
+    struct TALER_EXCHANGEDB_Melt ret_refresh_session;
+
+    FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+            plugin->get_melt (plugin->cls,
+                              &refresh.rc,
+                              &ret_refresh_session,
+                              &melt_serial_id));
+    FAILIF (refresh.noreveal_index !=
+            ret_refresh_session.session.noreveal_index);
+    FAILIF (0 !=
+            TALER_amount_cmp (&refresh.amount_with_fee,
+                              &ret_refresh_session.session.amount_with_fee));
+    FAILIF (0 !=
+            TALER_amount_cmp (&fee_refresh,
+                              &ret_refresh_session.melt_fee));
+    FAILIF (0 !=
+            GNUNET_memcmp (&refresh.rc,
+                           &ret_refresh_session.session.rc));
+    FAILIF (0 != GNUNET_memcmp (&refresh.coin_sig,
+                                &ret_refresh_session.session.coin_sig));
+    FAILIF (0 !=
+            GNUNET_memcmp (&refresh.coin.coin_pub,
+                           &ret_refresh_session.session.coin.coin_pub));
+    FAILIF (0 !=
+            GNUNET_memcmp (&refresh.coin.denom_pub_hash,
+                           &ret_refresh_session.session.coin.denom_pub_hash));
+  }
+
+  {
+    /* test 'select_refreshes_above_serial_id' */
+    auditor_row_cnt = 0;
+    FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+            plugin->select_refreshes_above_serial_id (plugin->cls,
+                                                      0,
+                                                      &audit_refresh_session_cb,
+                                                      NULL));
+    FAILIF (1 != auditor_row_cnt);
+  }
+
+  /* do refresh-reveal */
+  {
+    new_dkp = GNUNET_new_array (MELT_NEW_COINS,
+                                struct DenomKeyPair *);
+    new_denom_pubs = GNUNET_new_array (MELT_NEW_COINS,
+                                       struct TALER_DenominationPublicKey);
+    revealed_coins
+      = GNUNET_new_array (MELT_NEW_COINS,
+                          struct TALER_EXCHANGEDB_RefreshRevealedCoin);
+    for (unsigned int cnt = 0; cnt < MELT_NEW_COINS; cnt++)
+    {
+      struct TALER_EXCHANGEDB_RefreshRevealedCoin *ccoin;
+      struct GNUNET_TIME_Timestamp now;
+
+      now = GNUNET_TIME_timestamp_get ();
+      new_dkp[cnt] = create_denom_key_pair (RSA_KEY_SIZE,
+                                            now,
+                                            &value,
+                                            &fee_withdraw,
+                                            &fee_deposit,
+                                            &fee_refresh,
+                                            &fee_refund);
+      GNUNET_assert (NULL != new_dkp[cnt]);
+      new_denom_pubs[cnt] = new_dkp[cnt]->pub;
+      ccoin = &revealed_coins[cnt];
+      ccoin->coin_ev_size = 1 + (size_t) GNUNET_CRYPTO_random_u64 (
+        GNUNET_CRYPTO_QUALITY_WEAK,
+        (RSA_KEY_SIZE / 8) - 1);
+      ccoin->coin_ev = GNUNET_malloc (ccoin->coin_ev_size);
+      GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                                  ccoin->coin_ev,
+                                  ccoin->coin_ev_size);
+      TALER_denom_pub_hash (&new_dkp[cnt]->pub,
+                            &ccoin->h_denom_pub);
+      GNUNET_assert (GNUNET_OK ==
+                     TALER_denom_sign_blinded (&ccoin->coin_sig,
+                                               &new_dkp[cnt]->priv,
+                                               ccoin->coin_ev,
+                                               ccoin->coin_ev_size));
+    }
+    RND_BLK (&tprivs);
+    RND_BLK (&tpub);
+    FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
+            plugin->get_refresh_reveal (plugin->cls,
+                                        &refresh.rc,
+                                        &never_called_cb,
+                                        NULL));
+    FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+            plugin->insert_refresh_reveal (plugin->cls,
+                                           melt_serial_id,
+                                           MELT_NEW_COINS,
+                                           revealed_coins,
+                                           TALER_CNC_KAPPA - 1,
+                                           tprivs,
+                                           &tpub));
+    {
+      struct TALER_BlindedCoinHash h_coin_ev;
+      struct TALER_CoinSpendPublicKeyP ocp;
+
+      GNUNET_CRYPTO_hash (revealed_coins[0].coin_ev,
+                          revealed_coins[0].coin_ev_size,
+                          &h_coin_ev.hash);
+
+      FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+              plugin->get_old_coin_by_h_blind (plugin->cls,
+                                               &h_coin_ev,
+                                               &ocp,
+                                               &rrc_serial));
+      FAILIF (0 !=
+              GNUNET_memcmp (&ocp,
+                             &refresh.coin.coin_pub));
+    }
+    FAILIF (0 >=
+            plugin->get_refresh_reveal (plugin->cls,
+                                        &refresh.rc,
+                                        &check_refresh_reveal_cb,
+                                        NULL));
+    qs = plugin->get_link_data (plugin->cls,
+                                &refresh.coin.coin_pub,
+                                &handle_link_data_cb,
+                                NULL);
+    FAILIF (0 >= qs);
+    {
+      /* Just to test fetching a coin with melt history */
+      struct TALER_EXCHANGEDB_TransactionList *tl;
+      enum GNUNET_DB_QueryStatus qs;
+
+      qs = plugin->get_coin_transactions (plugin->cls,
+                                          &refresh.coin.coin_pub,
+                                          GNUNET_YES,
+                                          &tl);
+      FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != qs);
+      plugin->free_coin_transaction_list (plugin->cls,
+                                          tl);
+    }
+  }
+
+  /* do recoup-refresh */
+  {
+    struct GNUNET_TIME_Timestamp recoup_timestamp
+      = GNUNET_TIME_timestamp_get ();
+    union TALER_DenominationBlindingKeyP coin_bks;
+    uint64_t new_known_coin_id;
+    struct TALER_CoinPublicInfo new_coin;
+    struct TALER_DenominationHash dph;
+    struct TALER_AgeHash agh;
+    bool recoup_ok;
+    bool internal_failure;
+
+    new_coin = deposit.coin; /* steal basic data */
+    RND_BLK (&new_coin.coin_pub);
+    FAILIF (TALER_EXCHANGEDB_CKS_ADDED !=
+            plugin->ensure_coin_known (plugin->cls,
+                                       &new_coin,
+                                       &new_known_coin_id,
+                                       &dph,
+                                       &agh));
+    RND_BLK (&coin_bks);
+    FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+            plugin->do_recoup_refresh (plugin->cls,
+                                       &deposit.coin.coin_pub,
+                                       rrc_serial,
+                                       &value,
+                                       &coin_bks,
+                                       &new_coin.coin_pub,
+                                       new_known_coin_id,
+                                       &coin_sig,
+                                       &recoup_timestamp,
+                                       &recoup_ok,
+                                       &internal_failure));
+    FAILIF (! recoup_ok);
+    FAILIF (internal_failure);
+  }
+
+  /* do recoup */
   {
     struct TALER_EXCHANGEDB_Reserve pre_reserve;
     struct TALER_EXCHANGEDB_Reserve post_reserve;
     struct TALER_Amount delta;
     struct TALER_EXCHANGEDB_KycStatus kyc;
+    bool recoup_ok;
+    bool internal_failure;
+    struct TALER_Amount requested_amount;
+    struct GNUNET_TIME_Timestamp recoup_timestamp
+      = GNUNET_TIME_timestamp_get ();
 
     pre_reserve.pub = reserve_pub;
     FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             plugin->reserves_get (plugin->cls,
                                   &pre_reserve,
                                   &kyc));
+    requested_amount = value;
+    FAILIF (! TALER_amount_is_zero (&pre_reserve.balance));
     FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-            plugin->insert_recoup_request (plugin->cls,
-                                           &reserve_pub,
-                                           &deposit.coin,
-                                           &coin_sig,
-                                           &coin_blind,
-                                           &value,
-                                           &cbc.h_coin_envelope,
-                                           deadline));
+            plugin->do_recoup (plugin->cls,
+                               &reserve_pub,
+                               reserve_out_serial_id,
+                               &requested_amount,
+                               &coin_blind,
+                               &deposit.coin.coin_pub,
+                               known_coin_id,
+                               &coin_sig,
+                               &recoup_timestamp,
+                               &recoup_ok,
+                               &internal_failure));
+    FAILIF (internal_failure);
+    FAILIF (! recoup_ok);
     post_reserve.pub = reserve_pub;
     FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             plugin->reserves_get (plugin->cls,
@@ -1771,19 +1821,34 @@ run (void *cls)
             TALER_amount_cmp (&delta,
                               &value));
   }
+
+  FAILIF (GNUNET_OK !=
+          plugin->start (plugin->cls,
+                         "test-3"));
+
   FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
           plugin->select_recoup_above_serial_id (plugin->cls,
                                                  0,
                                                  &recoup_cb,
                                                  &coin_blind));
-
-  GNUNET_assert (0 <=
-                 TALER_amount_add (&amount_with_fee,
-                                   &value,
-                                   &value));
+  /* Do reserve close */
+  now = GNUNET_TIME_timestamp_get ();
   GNUNET_assert (GNUNET_OK ==
                  TALER_string_to_amount (CURRENCY ":0.000010",
                                          &fee_closing));
+  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+          plugin->insert_reserve_closed (plugin->cls,
+                                         &reserve_pub2,
+                                         now,
+                                         sndr,
+                                         &wire_out_wtid,
+                                         &amount_with_fee,
+                                         &fee_closing));
+  FAILIF (GNUNET_OK !=
+          check_reserve (&reserve_pub2,
+                         0,
+                         0,
+                         value.currency));
   now = GNUNET_TIME_timestamp_get ();
   FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
           plugin->insert_reserve_closed (plugin->cls,
@@ -1791,15 +1856,16 @@ run (void *cls)
                                          now,
                                          sndr,
                                          &wire_out_wtid,
-                                         &amount_with_fee,
+                                         &value,
                                          &fee_closing));
   FAILIF (GNUNET_OK !=
           check_reserve (&reserve_pub,
                          0,
                          0,
                          value.currency));
-
   result = 7;
+
+  /* check reserve history */
   {
     struct TALER_Amount balance;
 
@@ -1872,7 +1938,7 @@ run (void *cls)
       break;
     }
   }
-  FAILIF (5 != cnt);
+  FAILIF (4 != cnt);
 
   auditor_row_cnt = 0;
   FAILIF (0 >=
@@ -1888,11 +1954,127 @@ run (void *cls)
   FAILIF (3 != auditor_row_cnt);
 
 
-  /* Tests for deposits */
+  auditor_row_cnt = 0;
+  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+          plugin->select_refunds_above_serial_id (plugin->cls,
+                                                  0,
+                                                  &audit_refund_cb,
+                                                  NULL));
+  FAILIF (1 != auditor_row_cnt);
+  qs = plugin->get_coin_transactions (plugin->cls,
+                                      &refund.coin.coin_pub,
+                                      GNUNET_YES,
+                                      &tl);
+  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != qs);
+  GNUNET_assert (NULL != tl);
+  matched = 0;
+  for (tlp = tl; NULL != tlp; tlp = tlp->next)
+  {
+    switch (tlp->type)
+    {
+    case TALER_EXCHANGEDB_TT_DEPOSIT:
+      {
+        struct TALER_EXCHANGEDB_DepositListEntry *have = tlp->details.deposit;
+
+        /* Note: we're not comparing the denomination keys, as there is
+           still the question of whether we should even bother exporting
+           them here. */
+        FAILIF (0 !=
+                GNUNET_memcmp (&have->csig,
+                               &deposit.csig));
+        FAILIF (0 !=
+                GNUNET_memcmp (&have->merchant_pub,
+                               &deposit.merchant_pub));
+        FAILIF (0 !=
+                GNUNET_memcmp (&have->h_contract_terms,
+                               &deposit.h_contract_terms));
+        FAILIF (0 !=
+                GNUNET_memcmp (&have->wire_salt,
+                               &deposit.wire_salt));
+        FAILIF (GNUNET_TIME_timestamp_cmp (have->timestamp,
+                                           !=,
+                                           deposit.timestamp));
+        FAILIF (GNUNET_TIME_timestamp_cmp (have->refund_deadline,
+                                           !=,
+                                           deposit.refund_deadline));
+        FAILIF (GNUNET_TIME_timestamp_cmp (have->wire_deadline,
+                                           !=,
+                                           deposit.wire_deadline));
+        FAILIF (0 != TALER_amount_cmp (&have->amount_with_fee,
+                                       &deposit.amount_with_fee));
+        FAILIF (0 != TALER_amount_cmp (&have->deposit_fee,
+                                       &deposit.deposit_fee));
+        matched |= 1;
+        break;
+      }
+    /* this coin pub was actually never melted... */
+    case TALER_EXCHANGEDB_TT_MELT:
+      FAILIF (0 !=
+              GNUNET_memcmp (&refresh.rc,
+                             &tlp->details.melt->rc));
+      matched |= 2;
+      break;
+    case TALER_EXCHANGEDB_TT_REFUND:
+      {
+        struct TALER_EXCHANGEDB_RefundListEntry *have = tlp->details.refund;
+
+        /* Note: we're not comparing the denomination keys, as there is
+           still the question of whether we should even bother exporting
+           them here. */
+        FAILIF (0 != GNUNET_memcmp (&have->merchant_pub,
+                                    &refund.details.merchant_pub));
+        FAILIF (0 != GNUNET_memcmp (&have->merchant_sig,
+                                    &refund.details.merchant_sig));
+        FAILIF (0 != GNUNET_memcmp (&have->h_contract_terms,
+                                    &refund.details.h_contract_terms));
+        FAILIF (have->rtransaction_id != refund.details.rtransaction_id);
+        FAILIF (0 != TALER_amount_cmp (&have->refund_amount,
+                                       &refund.details.refund_amount));
+        FAILIF (0 != TALER_amount_cmp (&have->refund_fee,
+                                       &refund.details.refund_fee));
+        matched |= 4;
+        break;
+      }
+    case TALER_EXCHANGEDB_TT_RECOUP:
+      {
+        struct TALER_EXCHANGEDB_RecoupListEntry *recoup =
+          tlp->details.recoup;
+
+        FAILIF (0 != GNUNET_memcmp (&recoup->coin_sig,
+                                    &coin_sig));
+        FAILIF (0 != GNUNET_memcmp (&recoup->coin_blind,
+                                    &coin_blind));
+        FAILIF (0 != GNUNET_memcmp (&recoup->reserve_pub,
+                                    &reserve_pub));
+        FAILIF (0 != TALER_amount_cmp (&recoup->value,
+                                       &value));
+        matched |= 8;
+        break;
+      }
+    case TALER_EXCHANGEDB_TT_OLD_COIN_RECOUP:
+      /* TODO: check fields better... */
+      matched |= 16;
+      break;
+    default:
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Unexpected coin history transaction type: %d\n",
+                  tlp->type);
+      FAILIF (1);
+      break;
+    }
+  }
+  FAILIF (31 != matched);
+
+  plugin->free_coin_transaction_list (plugin->cls,
+                                      tl);
+
+
+  /* Tests for deposits+wire */
   TALER_denom_sig_free (&deposit.coin.denom_sig);
   memset (&deposit,
           0,
           sizeof (deposit));
+  deposit.deposit_fee = fee_deposit;
   RND_BLK (&deposit.coin.coin_pub);
   TALER_denom_pub_hash (&dkp->pub,
                         &deposit.coin.denom_pub_hash);
@@ -1917,24 +2099,41 @@ run (void *cls)
   deposit.refund_deadline = deadline;
   deposit.wire_deadline = deadline;
   result = 8;
-  FAILIF (TALER_EXCHANGEDB_CKS_ADDED !=
-          plugin->ensure_coin_known (plugin->cls,
-                                     &deposit.coin));
+  {
+    uint64_t known_coin_id;
+    struct TALER_DenominationHash dph;
+    struct TALER_AgeHash agh;
+
+    FAILIF (TALER_EXCHANGEDB_CKS_ADDED !=
+            plugin->ensure_coin_known (plugin->cls,
+                                       &deposit.coin,
+                                       &known_coin_id,
+                                       &dph,
+                                       &agh));
+  }
   {
     struct GNUNET_TIME_Timestamp now;
     struct GNUNET_TIME_Timestamp r;
     struct TALER_Amount deposit_fee;
+    struct TALER_MerchantWireHash h_wire;
 
     now = GNUNET_TIME_timestamp_get ();
     FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
             plugin->insert_deposit (plugin->cls,
                                     now,
                                     &deposit));
+    TALER_merchant_wire_signature_hash (deposit.receiver_wire_account,
+                                        &deposit.wire_salt,
+                                        &h_wire);
     FAILIF (1 !=
-            plugin->have_deposit (plugin->cls,
-                                  &deposit,
-                                  &deposit_fee,
-                                  &r));
+            plugin->have_deposit2 (plugin->cls,
+                                   &deposit.h_contract_terms,
+                                   &h_wire,
+                                   &deposit.coin.coin_pub,
+                                   &deposit.merchant_pub,
+                                   deposit.refund_deadline,
+                                   &deposit_fee,
+                                   &r));
     FAILIF (GNUNET_TIME_timestamp_cmp (now,
                                        !=,
                                        r));
@@ -1958,13 +2157,13 @@ run (void *cls)
     FAILIF (8 != result);
   }
   auditor_row_cnt = 0;
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+  FAILIF (0 >=
           plugin->select_deposits_above_serial_id (plugin->cls,
                                                    0,
                                                    &audit_deposit_cb,
                                                    NULL));
-  FAILIF (1 != auditor_row_cnt);
-  result = 9;
+  FAILIF (0 == auditor_row_cnt);
+  result = 8;
   sleep (2); /* give deposit time to be ready */
   FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
           plugin->get_ready_deposit (plugin->cls,
@@ -1973,6 +2172,7 @@ run (void *cls)
                                      true,
                                      &deposit_cb,
                                      &deposit));
+  FAILIF (8 == result);
   FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
           plugin->iterate_matching_deposits (plugin->cls,
                                              wire_target_row,
@@ -2019,50 +2219,39 @@ run (void *cls)
                          "test-2"));
   RND_BLK (&deposit2.merchant_pub); /* should fail if merchant is different */
   {
+    struct TALER_MerchantWireHash h_wire;
     struct GNUNET_TIME_Timestamp r;
     struct TALER_Amount deposit_fee;
 
+    TALER_merchant_wire_signature_hash (deposit2.receiver_wire_account,
+                                        &deposit2.wire_salt,
+                                        &h_wire);
     FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
-            plugin->have_deposit (plugin->cls,
-                                  &deposit2,
-                                  &deposit_fee,
-                                  &r));
+            plugin->have_deposit2 (plugin->cls,
+                                   &deposit2.h_contract_terms,
+                                   &h_wire,
+                                   &deposit2.coin.coin_pub,
+                                   &deposit2.merchant_pub,
+                                   deposit2.refund_deadline,
+                                   &deposit_fee,
+                                   &r));
     deposit2.merchant_pub = deposit.merchant_pub;
     RND_BLK (&deposit2.coin.coin_pub); /* should fail if coin is different */
     FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
-            plugin->have_deposit (plugin->cls,
-                                  &deposit2,
-                                  &deposit_fee,
-                                  &r));
+            plugin->have_deposit2 (plugin->cls,
+                                   &deposit2.h_contract_terms,
+                                   &h_wire,
+                                   &deposit2.coin.coin_pub,
+                                   &deposit2.merchant_pub,
+                                   deposit2.refund_deadline,
+                                   &deposit_fee,
+                                   &r));
   }
-  FAILIF (GNUNET_OK !=
-          test_melting ());
   FAILIF (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
           plugin->commit (plugin->cls));
 
 
-  /* test insert_refund! */
-  refund.coin = deposit.coin;
-  refund.details.merchant_pub = deposit.merchant_pub;
-  RND_BLK (&refund.details.merchant_sig);
-  refund.details.h_contract_terms = deposit.h_contract_terms;
-  refund.details.rtransaction_id
-    = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
-                                UINT64_MAX);
-  refund.details.refund_amount = deposit.amount_with_fee;
-  refund.details.refund_fee = fee_refund;
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->insert_refund (plugin->cls,
-                                 &refund));
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->select_refunds_by_coin (plugin->cls,
-                                          &refund.coin.coin_pub,
-                                          &refund.details.merchant_pub,
-                                          &refund.details.h_contract_terms,
-                                          &check_refund_cb,
-                                          &refund));
-
-  /* test recoup / revocation */
+  /* test revocation */
   RND_BLK (&master_sig);
   FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
           plugin->insert_denomination_revocation (plugin->cls,
@@ -2097,128 +2286,6 @@ run (void *cls)
   }
 
 
-  RND_BLK (&coin_sig);
-  RND_BLK (&coin_blind);
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->insert_recoup_request (plugin->cls,
-                                         &reserve_pub,
-                                         &deposit.coin,
-                                         &coin_sig,
-                                         &coin_blind,
-                                         &value,
-                                         &cbc.h_coin_envelope,
-                                         deadline));
-
-  auditor_row_cnt = 0;
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
-          plugin->select_refunds_above_serial_id (plugin->cls,
-                                                  0,
-                                                  &audit_refund_cb,
-                                                  NULL));
-
-  FAILIF (1 != auditor_row_cnt);
-  qs = plugin->get_coin_transactions (plugin->cls,
-                                      &refund.coin.coin_pub,
-                                      GNUNET_YES,
-                                      &tl);
-  FAILIF (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != qs);
-  GNUNET_assert (NULL != tl);
-  matched = 0;
-  for (tlp = tl; NULL != tlp; tlp = tlp->next)
-  {
-    switch (tlp->type)
-    {
-    case TALER_EXCHANGEDB_TT_DEPOSIT:
-      {
-        struct TALER_EXCHANGEDB_DepositListEntry *have = tlp->details.deposit;
-
-        /* Note: we're not comparing the denomination keys, as there is
-           still the question of whether we should even bother exporting
-           them here. */
-        FAILIF (0 !=
-                GNUNET_memcmp (&have->csig,
-                               &deposit.csig));
-        FAILIF (0 !=
-                GNUNET_memcmp (&have->merchant_pub,
-                               &deposit.merchant_pub));
-        FAILIF (0 !=
-                GNUNET_memcmp (&have->h_contract_terms,
-                               &deposit.h_contract_terms));
-        FAILIF (0 !=
-                GNUNET_memcmp (&have->wire_salt,
-                               &deposit.wire_salt));
-        FAILIF (GNUNET_TIME_timestamp_cmp (have->timestamp,
-                                           !=,
-                                           deposit.timestamp));
-        FAILIF (GNUNET_TIME_timestamp_cmp (have->refund_deadline,
-                                           !=,
-                                           deposit.refund_deadline));
-        FAILIF (GNUNET_TIME_timestamp_cmp (have->wire_deadline,
-                                           !=,
-                                           deposit.wire_deadline));
-        FAILIF (0 != TALER_amount_cmp (&have->amount_with_fee,
-                                       &deposit.amount_with_fee));
-        FAILIF (0 != TALER_amount_cmp (&have->deposit_fee,
-                                       &deposit.deposit_fee));
-        matched |= 1;
-        break;
-      }
-#if 0
-    /* this coin pub was actually never melted... */
-    case TALER_EXCHANGEDB_TT_MELT:
-      FAILIF (0 !=
-              GNUNET_memcmp (&melt,
-                             &tlp->details.melt));
-      matched |= 2;
-      break;
-#endif
-    case TALER_EXCHANGEDB_TT_REFUND:
-      {
-        struct TALER_EXCHANGEDB_RefundListEntry *have = tlp->details.refund;
-
-        /* Note: we're not comparing the denomination keys, as there is
-           still the question of whether we should even bother exporting
-           them here. */
-        FAILIF (0 != GNUNET_memcmp (&have->merchant_pub,
-                                    &refund.details.merchant_pub));
-        FAILIF (0 != GNUNET_memcmp (&have->merchant_sig,
-                                    &refund.details.merchant_sig));
-        FAILIF (0 != GNUNET_memcmp (&have->h_contract_terms,
-                                    &refund.details.h_contract_terms));
-        FAILIF (have->rtransaction_id != refund.details.rtransaction_id);
-        FAILIF (0 != TALER_amount_cmp (&have->refund_amount,
-                                       &refund.details.refund_amount));
-        FAILIF (0 != TALER_amount_cmp (&have->refund_fee,
-                                       &refund.details.refund_fee));
-        matched |= 4;
-        break;
-      }
-    case TALER_EXCHANGEDB_TT_RECOUP:
-      {
-        struct TALER_EXCHANGEDB_RecoupListEntry *recoup =
-          tlp->details.recoup;
-
-        FAILIF (0 != GNUNET_memcmp (&recoup->coin_sig,
-                                    &coin_sig));
-        FAILIF (0 != GNUNET_memcmp (&recoup->coin_blind,
-                                    &coin_blind));
-        FAILIF (0 != GNUNET_memcmp (&recoup->reserve_pub,
-                                    &reserve_pub));
-        FAILIF (0 != TALER_amount_cmp (&recoup->value,
-                                       &value));
-        matched |= 8;
-        break;
-      }
-    default:
-      FAILIF (1);
-      break;
-    }
-  }
-  FAILIF (13 != matched);
-
-  plugin->free_coin_transaction_list (plugin->cls,
-                                      tl);
-
   plugin->rollback (plugin->cls);
   FAILIF (GNUNET_OK !=
           test_wire_prepare ());
@@ -2244,6 +2311,22 @@ drop:
                 plugin->drop_tables (plugin->cls));
   if (NULL != dkp)
     destroy_denom_key_pair (dkp);
+  if (NULL != revealed_coins)
+  {
+    for (unsigned int cnt = 0; cnt < MELT_NEW_COINS; cnt++)
+    {
+      TALER_blinded_denom_sig_free (&revealed_coins[cnt].coin_sig);
+      GNUNET_free (revealed_coins[cnt].coin_ev);
+    }
+    GNUNET_free (revealed_coins);
+    revealed_coins = NULL;
+  }
+  GNUNET_free (new_denom_pubs);
+  for (unsigned int cnt = 0;
+       (NULL != new_dkp) && (cnt < MELT_NEW_COINS) && (NULL != new_dkp[cnt]);
+       cnt++)
+    destroy_denom_key_pair (new_dkp[cnt]);
+  GNUNET_free (new_dkp);
   TALER_denom_sig_free (&deposit.coin.denom_sig);
   TALER_blinded_denom_sig_free (&cbc.sig);
   TALER_blinded_denom_sig_free (&cbc2.sig);