Implement private named vault and mutable root-set surfaces

[flyingrobots]

Outcome

Provide application-friendly private named-vault and mutable root-set surfaces over exact Keep retention namespaces and generations, with optimistic concurrency, privacy-preserving names, and generation-scoped evidence.

Dependencies

• Implement retention namespace generation transitions #19 retention generations
• Implement precise verification reports and corruption refusal #20 verification reports
• Implement deterministic GC planning and identity-preserving compaction #21 GC and compaction
• ADR: define retention-derived lifecycle surfaces #85 lifecycle-surface ADR
• Implement opaque asset, page, and deterministic bundle handles #89 opaque handles

Invariant impact

Names and root-set membership are policy coordinates, not content identity. A successful update must retain exactly the validated handle graph under one exact successor generation or refuse with expected and observed evidence.

Acceptance criteria

• Vault entries map opaque private-name digests to validated handles without storing plaintext names by default.
• The private-name construction has an explicit equality-leak and key-rotation contract.
• Root-set replacement uses exact generation compare-and-swap and never merges stale candidates implicitly.
• Release publishes a successor generation; it never claims immediate physical deletion.
• Read acquisitions pin one complete immutable generation while in use.
• Inspection is bounded and reports verification, retention, and generation posture separately.
• Recovery covers every staged generation, name-index, head, and cleanup crash prefix.
• Concurrency, corruption, property, model, fuzz, and process-death tests pass.

Non-goals

• Git refs or Git history semantics.
• Ambient user identity or ACL policy.
• A mutable truth document.
• Claiming metadata confidentiality beyond the admitted private-name profile.