Out-of-memory persistent storage: the tree learns to live in a KV store

.gitignore

@@ -14,3 +14,6 @@ formal/tla/tla2tools.jar
 
 # EventDag analysis dumps (lake exe eventdag); regenerable from the tool.
 formal/lean/eventdag-out/
+
+# macOS Finder metadata; never content.
+.DS_Store

AGENTS.md

@@ -40,7 +40,9 @@ it fully clean before every commit.
 ## Contributing a change
 
 One-time setup: everything `just gate` shells out to is a stable Rust
-toolchain (1.85 or later, for edition 2024) with clippy, rustfmt, and
+toolchain (1.92 or later: the workspace source needs 1.92, and the locked
+dependencies move the working floor with `Cargo.lock`, so when in doubt use
+current stable) with clippy, rustfmt, and
 rust-src, a nightly toolchain (merged doctests), `just`, `cargo-nextest`,
 `cargo-rdme`, and python3 with bash (the `tools/` linters). `just ci`
 additionally wants the `wasm32-unknown-unknown` target, `wasm-pack`,
@@ -126,6 +128,12 @@ they pin are perfectly intact.
   which means a new protocol version, never a mutation of an existing one.
   To re-accept deliberately: `just test-all`, then `cargo insta review`
   (install: `cargo install cargo-insta`), then commit the updated
-  `tests/snapshots/*.snap`.
+  `tests/snapshots/*.snap`. One sanctioned exception for tamper sweeps
+  attributing snapshot history: the bookmark `frame_non_trivial` pin
+  (`src/bookmark/format/`) is a ratified *fixture re-pin* — its fixture
+  deliberately carries nested versions so the pin exercises real skyline
+  payload bytes, and the format is attested unchanged by the untouched
+  `frame_empty` pin and the round-trip/corruption suite. Attribute that
+  pin's history to the fixture, never to a protocol change.
 - Redaction leaves no tombstones: deletion-honoring rides on version bounds.
   When reasoning about it, think version ceilings/floors, not markers.