Module shadow 

Shadowed payloads — the files prov can read but must not.

attach --opaque makes a promise: prov will link, move and fixity-check this file, but never read it as a document. When the payload happens to be something prov can parse — a .md, a .yaml — keeping that promise means every scan has to notice the sidecar beside it and skip the file. That check lives here rather than beside the attach verb because the check is a read: the census, the title scan and the id scan all owe it, and none of them is attaching anything.

The convention is the fast path and the content pointer is authoritative. A sidecar under a non-conventional name still claims its payload; it just is not found by probing, which is why attach’s own sweep confirms the pointer rather than trusting the name.

Functions

sidecar_candidates

Every path that could be payload’s sidecar under the <payload>.<ext> convention, in reverse-lookup preference order. The probe half of the lookup; the content pointer confirms a hit (Graph::sidecar_claims).