Tests and docs only. The mutant that removes with the deleter's registration still
survives: registered only decides the global key, which is always the same key.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The removal form of #judge refuses a held record of a type the deleter does not own and
returns the owned one; #deleteNow removes it with one store call and drops the cache
once the store has. Ported from the Python resolution (cut-slot-readonly-py.h5).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
#judge (foreign key, global key, retype and its home, unread slots) is thrown by
#writeNow and #deleteNow and asked by isWritable, so the query cannot disagree with
put. A matrix test pins isWritable against put per key state.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Soul s1: explainedBy requires the arrived id to differ from the reader's own and be
listed compatible (a wider writer under a hand-written own id stays read-only, real
single-file round trip pinned); isWritable asks the record a restamp would replace;
the refusal carries the id the record arrived under; CHANGELOG says putEnvelope marks.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
slots() and the unit arm note slots past the reader's declared ones into a
scope the one payload decode entry opens; the hydrated entry carries the mark
and one check in the write and removal paths refuses with SchemaConflictError
carrying unreadSlots. isWritable and unreadSlots are the live queries.
Consent follows the C# reference: depth 0 and explained by the catalog.
Walker: the C# union-parity read-only vectors and the two slot stores.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>