Struct ArchiveStore 

pub struct ArchiveStore { /* private fields */ }

No Debug implementation: do not accidentally log redactor state or content.

Implementations

impl ArchiveStore

pub fn new(base: &Path, scope_key: &str, logical_id: &str) -> Result<Self>

pub fn with_redactor(self, redactor: Arc<ArchiveRedactor>) -> Self

Opt in to screened tool evidence. Install the SAME trusted policy when reopening a store; retrieval never restores material withheld at seal.

pub fn with_abort(self, abort: Arc<AtomicBool>) -> Self

Once abort is set, an operation that has not been admitted yet (for example one waiting behind another operation in this process) fails with Interrupted without reading or writing any record. Setup before admission (opening the store, projecting a seal) is not undone. An admitted operation always completes, so callers must still treat an abandoned seal as possibly published.

pub fn seal(&self, messages: &[SharedMessage], note: &str) -> Result<ArchiveRef>

pub fn seal_with_note( &self, messages: &[SharedMessage], note: &str, ) -> Result<(ArchiveRef, String)>

seal that also returns the screened note stored with the segment (the earlier note when this projection was already sealed), in the same locked operation.

pub fn fetch( &self, id: &str, start: usize, limit: usize, ) -> Result<Vec<SharedMessage>>

pub fn fetch_with_provenance( &self, id: &str, start: usize, limit: usize, ) -> Result<Vec<ArchivedMessage>>

start indexes ELIGIBLE messages; source_index retains original offsets. Oversized limits are rejected rather than clamped; start beyond end is empty.

pub fn fetch_note(&self, id: &str) -> Result<String>

Explicit host-only access to the hidden, screened note. Never include it in search descriptors or inject it as system/developer instructions.

pub fn search( &self, query: &str, limit: usize, ) -> Result<Vec<ArchiveDescriptor>>

Case-insensitive literal substring search of eligible source JSON, in publication-slot order. Empty query lists descriptors. Not an exhaustive ranking service: output is bounded by limit, with no hidden-note matches.

pub fn forget(&self, id: &str) -> Result<()>

Durable, idempotent deletion. Replaces content in the SAME slot with a marker; it never frees the slot/digest for reuse. Unknown ids are NotFound. This is logical deletion, not secure erasure of filesystem snapshots.

pub fn export_records(&self) -> Result<Vec<Value>>

Migration-only export of validated eligible evidence and permanent tombstones. Includes hidden notes: this is HOST data, never a model tool. No files, directories, permissions or archive contents are changed.