One persistence form for the small content-free registers next to the
archive (delivered, presented, and the proxy’s register of
provider-sealed items): 256 JSON shards under
<data dir>/archives/<name>/<2 hex>.json, owner-only, replaced atomically
under a bounded file lock, with no in-memory state — a second process reads
exactly what the first one wrote.
Copy the legacy archive id into project_root: its stored text passes
the admission of a normal archive write there and gets that project’s
own id. The legacy entry is left as it is. Ok names the new id; Err
is the content-free refusal.
The id of the source-bound recovery copy that holds exactly content, if
one was stored (by store_recovery_copy, or by the MCP pipeline for a tool
that declares its sources). A lookup only: nothing is authorized here.
Resolve the id with retrieve_checked, inside the request’s project
scope — that re-admits every source under the current policy and role and
refuses with a typed, content-free reason when rights are gone.
Prune archived entries that exceed the age TTL (max_age_hours) or that push
the on-disk store past its size budget (max_disk_mb). The content file,
metadata, and FTS index are removed together so the two stores stay in sync.
Returns the number of entries removed.
Check the content-address contract used when the archive ID was minted:
a public archive is addressed by its content, a source-bound one by its
authority and content.
Filesystem path of an archived entry’s verbatim content. Exposed so recovery
hints can offer the MCP-free “read this file directly” route alongside
ctx_expand(id=...) — the same content is reachable both ways.
Describe JSON structure: navigate path (dot/slash separated) into parsed
content, then format with describe_json. label appears in error messages.
Shared by archive and ref store paths.
Search content for lines matching pattern (case-insensitive) and return
gutter-prefixed matches. label appears in the result message (e.g. “archive
a1966…” or “reference ref_18bb…”). Shared by archive and ref store paths.
An archive whose partition no longer matches the current partition of
the root it recorded: that project’s identity (remote, package name)
changed since. Served to no project until adopted.
Archives without a source binding that were stored before archives named
their project: served to no project (AP05-G4). Read for the explicit
lean-ctx migrate legacy-context adoption only.
Remove only the on-disk content + metadata files for an archive id, leaving
the FTS index untouched. Used by the FTS cap-enforcer so the .txt/.meta.json
blobs of rows it evicts can’t outlive their index entry as orphans (#417).
Resolve a canonical archive ID under the current policy: untrusted handles
never supply path components, the read never leaves the store, and
source-bound archives are re-admitted against their source.
Store a source-bound, revocable recovery copy of permitted content whose
sources are known (G02): the copy can be handed back only while every
source in authority is still admitted for the reader. Returns the
archive id to put into a recovery handle (ctx_expand(id="…")), or None
when the content may not be stored (withheld or restricted text, an
incomplete authority, a source that no longer admits, archive disabled).