CLAUDE.md@crates/orbit-store git:20261012.1ed93e1A

Immutable. This exact content never changes and is served at /api/v1/blob/d32f9157cd932934.

# orbit-store

All durable Orbit state that is not a search index. Depends only on `orbit-types` and `orbit-common`; knows nothing of runtimes, commands, or transports. Policy and authorization are `orbit-core`'s; the vector schema is `orbit-search`'s.

- Internal direction is enforced by `scripts/check-dependency-direction.sh` (`make ci-fast`): `contracts` (traits/params/projections; no impls, no `rusqlite`) ← `fs` (locks, path safety, atomic writes, YAML) ← `driver/file` | `driver/sqlite` (never import each other) ← `repository` (live invariants that join drivers) / `workflow` (one-shot import/export/reindex/repair/upgrade) ← `compose` (construction). Retired paths (`src/backend`, `src/file`, `src/sqlite`, `src/task_migration`) must not reappear.
- A live write spanning both drivers joins in `repository/`, never in a driver. A one-shot data movement is a `workflow`, never a side effect of opening a store.
- New capability → trait in `contracts`, one impl in one driver, constructor in `compose`. Shared mechanics → `fs`. Concrete construction and migration access stay in composition/bootstrap/`maintenance`.
- SQLite migrations are append-only: never renumber or edit a shipped entry in `driver/sqlite/migration/ledger.rs`. Feature crates use namespaced registries via `migration/feature.rs`, not the global ledger.
- Crate-root `tests/` holds integration tests through the public `compose`, `contracts`, `maintenance` and `workflow` surfaces; each test runs its fixture in an isolated child process. Admitted unit tests stay in sibling `tests/` dirs; the direction guardrail excludes `**/tests/**`, so their fixtures may cross layers.