every persisted artifact crosses the store as its own type, and raw paths retire to the four recorded owners (#863)
Land A of #863 (decision #851): RepoStore gains a typed read/write pair per
artifact — identity, graph, keyring/escrow and their shared halves, manifest,
purges, attestations, burn log, conflicts, resolved — each owning the file,
the atomic replace, and the absent-file semantics, with the codec staying
where it lives. The engine's save_to/load_from/refresh_hold/gc/verify raw
sites, the op log's capture/restore and ops file, and the bisect session all
migrate through; the ops file and view restore gain the temp+rename atomicity
they lacked, and the op-log capture now waits out the Windows replace window
instead of recording a live file as absent. Absent is now NotFound alone
everywhere but `resolved` (best-effort by contract): a torn read fails loudly
rather than reading as an empty artifact. The migrated getters drop to
pub(crate); `objects/`, the keypair/peers, `git-mirror/`, and doctor keep raw
access as the recorded second owners. 0edf769d · dbf3dbe6…
Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.