A store a deleting role's pass cleared, one arm per backend kind. Only vetStoreBackends and vetPrivateCaches issue one, so no store their passes did not clear gets a handle that can delete.

How the pass resolves a mount's ecosystem to the adapter this build ships, injected so a spec drives the protocol rule over an adapter that fills no maintenance slice.

The rule every declared mirror target meets: its resolved backend offers a control plane this build can sweep. Both store roles refuse a target that fails it, and a writing role ignores it.

Vet each private cache under its own backend declaration and maintenance authority.

Per-target tracing and authentication, resolved before the store handles are built.

What the boot knows about request capacity before any store is built: the gate for each capacity pool, and what the operator declared about those pools.

The pool a store falls in when its backend names none of its own: the store's own authority, so two paths on one host share it.

The spelling a declared capacity's key and a store URL are compared under, so a trailing slash or a difference of case cannot miss a match.

The store's capacity as this boot resolves it: the backend's own description, the operator's declaration where there is one, else the pace a backend publishing no quota is derived to run at.

How a boot builds the probe for one mount's private upstream. Injected, as the store builds are, so a spec drives what a boot does with an answer without an AWS identity.

The builds a boot chooses between: one per Dredger authority, and the serving role's probe. The role picks its own, so a preview's boot never runs the build that holds a delete.

The shipped builds.

The live handle for a cleared store. CodeArtifact discovers its credentials the standard AWS way, and both arms read and dial over one manager of the store's own.

The observing calls for a cleared store, built from the backend's own read capability rather than from a handle with its writes taken away.

The shipped build. It asks the backend the mount declared, over the role's own ambient identity, so no caller's credential reaches the call.

Build the booting role's own capabilities for each cleared store, or every refusal the live environment earns. The builds accumulate, so one launch reports every store that cannot be built.

Plan a target slot with its own credentials and accumulate all backend construction refusals.

Read every probe's answer. A backend reads its own identity and its own faults into an answer, so a throw that reaches here refuses the mount rather than passing for an open question.

What a boot does about the answers it read: an unsafe repository refuses the role, an open question advises, and a safe one says nothing.