- stat_pair/have_pair/delete_pair exported as spec/handler pairs the
embedder assembles (OpsContext-bound); input/output + typed error
schemas per alkcall ADR-016 with namespace-as-resource ACL, the read
action on stat/have, closed-by-default (OQ-09) verified by test
- stat rides Store::stat (the miss answering the typed BLOB_MISSING,
never {len: null}); the non-token have is the pure has probe with
index-corresponded present[]; delete is Visibility::Internal —
external discovery NOT_FOUND, the operator authority context carried
as the registration-time composition authority (not namespace-gated),
GC_REFUSED/BLOB_MISSING typed, fail-fast
- the have renewal form rides the foundation's OpsContext::renew: the
one-digest arity enforced at the schema (if/then) and as the typed
INVALID_RENEWAL_FORM; digests wire-form hex via the key layer's
ingress (INVALID_DIGEST); the fleet arms tested against the harness
server (env-driven, skipping cleanly server-less): the live row
renews with the expiry observed moving, the expired row answers
present: false with the expiry frozen (no renewal), the foreign
token is the validity-domain refusal, and mint_custodial refuses
under fleet
Gates: cargo test (default 73/19/3), cargo test --features ops
(92/19/3), cargo test --all-features against the harness server
(246/125/4), clippy -D warnings across default/ops/all-features plus
the pg-pure checks, cargo fmt --check, cargo doc --no-deps clean.
glm-5.3-flash
5144b6a733