One key-identity judge in _write, an unheld-removal refusal at foreign keys, a load that carries unregistered records
instead of refusing, and a load that refuses one key in two stores. The single-file store's commit guard stays the disk judge.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Probed at b7a68884: only the C# cache arm retypes a key (cache {A,B}
replaces B's record with A); cacheless writes already refuse. TS, Rust
and Python key records by (type, key), so two types coexist at one key
and no leaf has a retype path; leaf parity needs key identity first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
