Struct ArchiveStore 

pub struct ArchiveStore { /* private fields */ }

No Debug implementation: do not accidentally log redactor state or content.

Implementations

impl ArchiveStore

pub fn new(base: &Path, scope_key: &str, logical_id: &str) -> Result<Self>

pub fn with_redactor(self, redactor: Arc<ArchiveRedactor>) -> Self

Opt in to screened tool evidence. Install the SAME trusted policy when reopening a store; retrieval never restores material withheld at seal.

pub fn seal(&self, messages: &[SharedMessage], note: &str) -> Result<ArchiveRef>

pub fn fetch( &self, id: &str, start: usize, limit: usize, ) -> Result<Vec<SharedMessage>>

pub fn fetch_with_provenance( &self, id: &str, start: usize, limit: usize, ) -> Result<Vec<ArchivedMessage>>

start indexes ELIGIBLE messages; source_index retains original offsets. Oversized limits are rejected rather than clamped; start beyond end is empty.

pub fn fetch_note(&self, id: &str) -> Result<String>

Explicit host-only access to the hidden, screened note. Never include it in search descriptors or inject it as system/developer instructions.

pub fn search( &self, query: &str, limit: usize, ) -> Result<Vec<ArchiveDescriptor>>

Case-insensitive literal substring search of eligible source JSON, in publication-slot order. Empty query lists descriptors. Not an exhaustive ranking service: output is bounded by limit, with no hidden-note matches.

pub fn forget(&self, id: &str) -> Result<()>

Durable, idempotent deletion. Replaces content in the SAME slot with a marker; it never frees the slot/digest for reuse. Unknown ids are NotFound. This is logical deletion, not secure erasure of filesystem snapshots.

pub fn export_records(&self) -> Result<Vec<Value>>

Migration-only export of validated eligible evidence and permanent tombstones. Includes hidden notes: this is HOST data, never a model tool. No files, directories, permissions or archive contents are changed.