A metadata.json whose list of what the refresh could not decrypt is
damaged must load as an empty store. A backup after an album and a
file's copy stop decrypting removes the album's folder and JSON and the
file's link in its album, and keeps the originals.
Model: opus-5-5
Adds the metadata.json store: loads whole into RAM with id-lookup Maps, rewrites whole through the exported fsync atomic writer (temp, fsync, rename, dir fsync); a missing, unparseable, or wrong-schema file loads as empty (it is a cache); directory 0700, file 0600. No lock file, no public sync().
Model: opus-4-8
sneak
clawbot