Mark the directory complete; refused while any document is still missing.
Append the package handoff; refused before complete() and refused a
handoff whose document is not among its own resources, so a reader that
finds the block can open the document it names and verify every byte.
Staticopen
Publishes verified trees into one staged directory. Each sidecar pair is written atomically and the manifest is rewritten after it, so the manifest only ever names files that are complete on disk and carries their length and digest for a reader to verify before parsing.