feat(cloud): metadata coercion, batched get_texts, list_documents, and erase on store delete

crates/lodedb-cloud-core/src/blob_layout.rs

@@ -1,7 +1,7 @@
 //! Content-addressed blob naming for the managed remote layout.
 //!
-//! A managed remote can store artifacts content-addressed —
-//! `blobs/sha256/aa/<sha256>` under a per-tenant prefix — instead of under
+//! A managed remote can store artifacts content-addressed
+//! (`blobs/sha256/aa/<sha256>` under a per-tenant prefix) instead of under
 //! their engine path names. Content addressing is what absorbs the
 //! fork-collision case (two branches committing different artifacts under the
 //! same engine name, e.g. `idx.gen/g7.json`, coexist as two blobs), and the

crates/lodedb-cloud-core/src/client_ops.rs

@@ -110,7 +110,7 @@ pub fn push(
 }
 
 /// Restores `index_key`'s committed generation from `remote` into the local
-/// `dir`, then proves the engine can open the restored copy read-only —
+/// `dir`, then proves the engine can open the restored copy read-only:
 /// restore-verifies-before-accepting as one operation, so no
 /// frontend can offer a pull that skips the check.
 ///

crates/lodedb-cloud-core/src/verify.rs

@@ -87,7 +87,7 @@ pub struct OpenReport {
 /// This reuses `lodedb-core`'s `load_store` with `read_only` (which takes no writer
 /// lock and reads the exact committed manifest, never the `.wal` tail), so it
 /// proves a restored directory is loadable exactly as the embedded engine would
-/// read it — the acceptance check after a restore. Returns
+/// read it, the acceptance check after a restore. Returns
 /// the loaded document/chunk counts. `persistence_dir` is the local directory the
 /// generation was restored into.
 pub fn verify_local_generation_opens(

crates/lodedb-core/src/engine/mod.rs

@@ -1124,9 +1124,9 @@ impl CoreEngine {
 
     /// Whether the ANN cluster index is currently resident in memory for an index
     /// (adopted from a persisted `.tvann` sidecar on a writable/eager open, or
-    /// built by a prior query). Returns `false` when it is not resident — a later
+    /// built by a prior query). Returns `false` when it is not resident (a later
     /// ANN query builds it, adopting a lazy open's deferred sidecar assignment
-    /// first — or when the index is exact. Observability; does not trigger a build.
+    /// first) or when the index is exact. Observability; does not trigger a build.
     pub fn ann_cluster_resident(&self, index_id: &str) -> Result<bool, CoreError> {
         let index = self.index(index_id)?;
         Ok(index.cluster_index.borrow().is_some())

docs/native_core_wal_payloads.md

@@ -23,7 +23,7 @@ root manifest has been published, so replay after a crash is idempotent.
 
 A WAL *segment* is an immutable standalone blob in exactly the file format
 above (header plus CRC-framed records), produced by `encode_wal_segment` with
-no store open — the building block for out-of-band ingest (see
+no store open, the building block for out-of-band ingest (see
 `lodedb.local.segments`). Two deliberate differences from the on-disk
 `<key>.wal`:
 

src/lodedb/cloud/cli.py

@@ -1498,7 +1498,7 @@ def org_export(
     typer.echo(_json.dumps(manifest, indent=2))
 
 
-# ------------------------------------------------- memory verbs (Phase 8d)
+# ------------------------------------------------------------ memory verbs
 # A store is one end user's LodeDB instance, so these take the store name
 # (= the user's id) directly; `store list` is the user listing and
 # `store delete` the forget-the-user verb.

src/lodedb/cloud/client.py

@@ -1,4 +1,4 @@
-"""`lodedb.cloud.Client` — the developer-facing handle, bound to one tenancy.
+"""`lodedb.cloud.Client`: the developer-facing handle, bound to one tenancy.
 
     from lodedb.cloud import Client
 
@@ -9,7 +9,7 @@
 The org and environment are properties of the *credential*, not of every
 call site: `ore_sk_`/`ore_pk_` tokens are minted bound to one environment,
 and the server rejects any other. So the client asks the control plane what
-the token is (`GET /v1/tokens/self`) and binds itself accordingly — code
+the token is (`GET /v1/tokens/self`) and binds itself accordingly. Code
 that connects with a production key and code that connects with a testing
 key are the same code. Personal tokens (`ore_pat_`) span environments, so
 they resolve to the account's only org and default to the ``testing``
@@ -67,7 +67,7 @@ def resolve_tenancy(
     """The (org, environment) this credential addresses.
 
     Explicit values win. An environment-scoped token supplies its own
-    binding and *refuses* a conflicting explicit value — silently ignoring
+    binding and *refuses* a conflicting explicit value. Silently ignoring
     one would aim writes somewhere the caller didn't name. A personal token
     falls back to the account's only org, then to the org's only live
     environment or the seeded ``testing`` default; anything else raises
@@ -80,7 +80,7 @@ def resolve_tenancy(
     except CloudError as error:
         if error.status_code == 404:
             # A control plane too old to introspect tokens: don't guess what
-            # the credential is — name both escape hatches.
+            # the credential is; name both escape hatches.
             raise CloudError(
                 404,
                 "this control plane does not support token introspection — "
@@ -132,7 +132,7 @@ class Client:
     """One credential, one control plane, one bound (org, environment).
 
     Construction resolves credentials and tenancy (see the module
-    docstring) and performs at most two HTTP calls — zero when both
+    docstring) and performs at most two HTTP calls, zero when both
     ``org=`` and ``environment=`` are passed. The client owns one HTTP
     connection pool that every handle it creates shares; close it with
     :meth:`close` or a ``with`` block when done.
@@ -167,9 +167,9 @@ def store(
         warm: bool = False,
         read_your_writes: bool = True,
     ):
-        """A read/write handle over one store — one end user's LodeDB
-        instance, auto-provisioned by its first write, so this makes no
-        HTTP call by default. `warm=True` additionally asks the serving
+        """A read/write handle over one store. A store is one end user's
+        LodeDB instance, auto-provisioned by its first write, so this
+        makes no HTTP call by default. `warm=True` additionally asks the serving
         tier to hydrate it now (first query skips the cold start). `key`
         names the index key when the store holds more than one (rare).
         The handle shares this client's connection pool; closing the
@@ -202,7 +202,7 @@ def store_stats(self) -> dict:
 
     def create_store(self, store: str, key: str | None = None, **options: Any) -> dict:
         """Register a store explicitly (first writes auto-provision, so this
-        is for choosing `mode=`/`preset=`/`expose_text=` up front — or
+        is for choosing `mode=`/`preset=`/`expose_text=` up front, or
         `vector_dim=` for a bring-your-own-vectors store, which accepts
         `add_vectors`/`search_by_vector` and never embeds server-side)."""
         return self._client.create_store(self.org, self.environment, store, key, **options)
@@ -211,10 +211,12 @@ def update_store(self, store: str, key: str, **changes: Any) -> dict:
         """Flip a store's `expose_text`/`mode` flags."""
         return self._client.update_store(self.org, self.environment, store, key, **changes)
 
-    def delete_store(self, store: str) -> dict:
-        """Soft-delete a whole store — forget this end user (restorable for
-        the grace period; the entitlement slot frees immediately)."""
-        return self._client.delete_store(self.org, self.environment, store)
+    def delete_store(self, store: str, *, erase: bool = False) -> dict:
+        """Soft-delete a whole store and forget this end user (restorable
+        for the grace period; the entitlement slot frees immediately).
+        `erase=True` is data-subject erasure: no grace window, restore
+        refuses immediately, and the next lifecycle sweep hard-deletes."""
+        return self._client.delete_store(self.org, self.environment, store, erase=erase)
 
     def restore_store(self, parked_store: str) -> dict:
         return self._client.restore_store(self.org, self.environment, parked_store)
@@ -241,7 +243,7 @@ def rollback_store(self, store: str, snapshot_id: str, key: str | None = None) -
 
     def list_environments(self) -> list[dict]:
         """The bound org's environments (an environment token sees only its
-        own). The pair is fixed — production and testing, seeded at signup;
+        own). The pair is fixed: production and testing, seeded at signup;
         there is no creation surface."""
         return self._client.list_environments(self.org)
 
@@ -276,7 +278,7 @@ def restore_org(self, parked_slug: str) -> dict:
     # ------------------------------------------------------------- tokens
 
     def me(self) -> dict:
-        """The signed-in account (personal tokens only — an environment
+        """The signed-in account (personal tokens only; an environment
         token is not a person and gets a 403)."""
         return self._client.me()