Optional
Bind every tree to one fail-closed first-use transaction. The producer's per-keg roots remain valid entrypoints; the shared group controls commit.
Human-readable identity used in collision diagnostics.
Schema 5 admits absent/equal mergeable directories.
Producer-verified closed trees with concrete immutable transport URLs.
Bind every tree to one fail-closed first-use transaction. The producer's per-keg roots remain valid entrypoints; the shared group controls commit.