App-shared backing tier — your own per-app subtree under ~/ISPO/shared/
(spec §19). Writes are PATH-ADDRESSED into your own subtree and need no
grant: an app overwriting its own outputs is free. Each write returns the
resolved identity ({ path }) instead of void.
write / writeBinary are path-addressed: you choose a stable relative
path (an app index, useSharedFile), overwrite your own files freely, and
the host resolves it into your subtree. Addressing another app's subtree is
structurally impossible (the own-subtree boundary predicate).
put mints a collision-free opaque path under your subtree and returns
{ path, url }, where url is an opaque asset ref for rendering the bytes.
Treat it as backing storage plumbing; use files.save or files.publish
when the user should see or share an artifact through Files.
read / list resolve inside your own subtree, symmetric with writes.
Known cross-app backing bytes are consumed through returned assets://
URLs or through Files picker copies, not through a shared-storage grant.
App-shared backing tier — your own per-app subtree under
~/ISPO/shared/(spec §19). Writes are PATH-ADDRESSED into your own subtree and need no grant: an app overwriting its own outputs is free. Each write returns the resolved identity ({ path }) instead ofvoid.write/writeBinaryare path-addressed: you choose a stable relative path (an app index,useSharedFile), overwrite your own files freely, and the host resolves it into your subtree. Addressing another app's subtree is structurally impossible (the own-subtree boundary predicate).putmints a collision-free opaque path under your subtree and returns{ path, url }, whereurlis an opaque asset ref for rendering the bytes. Treat it as backing storage plumbing; usefiles.saveorfiles.publishwhen the user should see or share an artifact through Files.read/listresolve inside your own subtree, symmetric with writes. Known cross-app backing bytes are consumed through returnedassets://URLs or through Files picker copies, not through a shared-storage grant.