Enum Error 

pub enum Error {
    Missing,
    Verification,
    Io(String),
    GcRefuse,
    KeyInvalid,
    RegistryFull,
}

The store error family — one enum with members at two altitudes (store-api.md §Error model; ADR-012 §6.5, §1).

Variants

Missing

Key absent, on ops that signal absence via Err: read_range and delete (ADR-012 §6.5 ruling 5; store-api.md §Error model).

A miss on get and stat is a value, not an error — they signal absence with None and never carry Missing. The facade’s read paths enforce this behaviorally: both-tier misses resolve Ok(None) on get/stat (see src/store/read.rs and the read-path tests pinning the miss shapes — src/store/tests.rs, tests/conformance/rows.rs; ADR-012 §6.5 ruling 5; store-api.md §Error model).

Verification

Put/get hash-check failure: content does not match the key under the canonical derivation (store-api.md §Error model).

Io(String)

Backend media failure (store-api.md §Error model), covering cursor and staged-put I/O errors surfaced through the same trait error family — stringly because std::io::Error is not stable across versions.

GcRefuse

Direct delete refused: the key is protected — pinned, registered-source-live, or protect-callback-named — and nothing was deleted (ADR-005’s delete-window arbitration at delete time; ADR-012 §1/§4).

Never fires below the facade: arbitration answers flow up as data, and the facade decides and owns the refusal (one enum, both altitudes; store-api.md §Error model). Named GcRefuse per ADR-012 §1 — there is no sweep-abort error.

KeyInvalid

Malformed key bytes at the boundary — truncated, unknown algorithm (ADR-002/hashing): rejects, never guesses (store-api.md §Error model). KeyInvalid never fires at the Backend trait boundary, where keys arrive opaque (one enum, both altitudes).

RegistryFull

The pin-token registry’s admission refusal (ADR-019): a mint at or past the registry’s admission cap — no token issued, no insertion (never an eviction), a custodial guard dropped, no custody taken. Ops-layer only (the registry is ops-layer state): it never fires below the facade, and like GcRefuse it is refusal-shaped — nothing happened, here is why.

Trait Implementations

impl Debug for Error

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Error

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Error

impl Error for Error

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for Error

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Error