B1 deliverable 8. `StoreEngine::snapshot` and every `RepoSnapshot` accessor
were the frozen D0 signatures returning `NotImplemented`; they now capture one
committed root and answer from it.
The frozen signature could not express an absent repository, so contract review
2026-08-07-A adds `StoreError::NoSuchRepository`. Reusing `Conflict`, `NotReady`
or `UnrecognizedLayout` would have made the error a false statement about what
happened and left a caller unable to distinguish it from a genuine instance of
that condition. It is an inability to answer and not a lifecycle state, which is
the distinction the taxonomy turns on: a namespace never bound has no
`RepoState`, so there is no genesis authority to report and none can be
manufactured without fabricating a trust root. A namespace that is bound and
retired is the opposite case, and it captures normally - refusing both would
erase a difference the store knows. `RepoSnapshot` therefore gains `lifecycle`
and `storage_mode`, without which a reader cannot tell an active repository from
a deleted one.
Isolation is structural rather than checked. `IndexKey` has no constructor that
omits a namespace, so the only key `locate` can build is one scoped to its own,
and there is no branch a later edit could invert. An undefined object type code
is `Corruption` and not a miss: the entry was written by this store, so a code
no version of it ever assigned means the run behind it is damaged, and reporting
that as absence would hide it.
Capture is two `Arc` clones and a hash lookup, and holding the root is what pins
every generation behind the locations it can return - a reader cannot be handed
an offset into a segment deleted before it reads. `Debug` is hand-written, since
a derived one would render the whole index into any log line that formatted a
snapshot.
Deliverable 8's acceptance is amended, and the reason is that the design already
succeeded. "A test that fails if someone clones" assumes a clone is a copy;
`CommittedRoot` is entirely `im` persistent structures, so `(*root).clone()`
allocates zero bytes and so does cloning the index. Both were tried as the
negative control and both read zero. The test keeps a measured figure asserted
at exactly zero, which catches materialization, and adds `Arc::ptr_eq`, which
catches the copy the figure cannot. A live control proves the meter moves.
Four integration tests assert the same property through `open`, `submit` and
`snapshot` rather than against a hand-built root - charter item 8. Their two
repositories are co-located on one shard deliberately: separate shards write to
separate journals and separate index deltas, so isolation holds there by
construction and a namespace-blind lookup would still pass. Verified by giving
`locate` a namespace-blind fallback, which fails the isolation assertion at both
levels.
Recorded and not acted on: `segment_generation` is per-shard, so the same
generation and offset pair occurs in every shard's journal. Not ambiguity - a
location is only read through a snapshot, whose namespace determines the shard -
but it means a cross-shard location comparison asserts nothing.
Deliverables 1, 3 and 7 remain. The ignored staging test's blocker list is now
stale in B3's file and is left for B3.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Levi Neuwirth
bac31513e3