The host’s on-disk layout for stores: which directory they live under.
One rule shared by create, open, join, and restore, so a host that wants
libraries/<id> instead of coven’s default stores/<id> names it once
here rather than each flow hardwiring (or working around) coven’s own
choice.
The single-writer store lock: an exclusive advisory lock on
<store>/.coven-lock, held for the life of a full open handle (and its
running sync loop). A second full open of the same store is refused with
StoreOpenGuardError::AlreadyOpen while the lock is held — the invariant
that keeps two writers from racing the same db and blob store.
Reject an untrusted cloud_path (the consumer’s readable object key under the
plain scheme, e.g. "Artist - Album/cover.jpg") that could escape its
namespace prefix in the bucket. Unlike a path token, an interior / is
legitimate — the readable path is nested — but every segment still has to be
a canonical path token. Empty, ., .., colon/platform-prefix, backslash,
and NUL forms are refused before an object key is built. The cloud_path
never feeds a local file path, only the cloud object key, so this guards the
keyspace, not the disk.
Reject a single untrusted path token (a blob id/namespace, or a
store_id/sid) that could escape the directory it is joined onto. A safe
token names exactly one child: no separator, no .., no ., no NUL, no : (a
Windows stream/drive reference), non-empty. The single gate every path builder
and every code decoder runs an untrusted token through, so traversal is refused
before any on-disk or cloud path is formed — and a decoded id is a safe single
component by the time any consumer joins it onto a directory.