Accept one chunk from a peer under CAS discipline: a ref already held must map to byte-identical content — first write wins, and any later conflicting bytes for the same ref are a HashConflict, never an overwrite. Fresh refs store raw. This is the check that makes “content- addressed” mean something on the wire: once any honest peer’s bytes land, no peer can rewrite that ref’s binding.

Known boundary: storage holds inspect-rendered bytes whose structural hash cannot be recomputed from the bytes alone, so a first write still trusts the sender. Full binding needs canonical serialization (the known debug-serialization debt); until then, consistency pinning is the honest check with teeth.

Open a connection to a peer. Stays open for subsequent fetch_refs batches — the selective-pull primitive’s session handle.

Fetch exactly the given refs from an already-connected peer: request, unsolicited-chunk validation, conflict-checked accept. Returns the codebase with the chunks applied. This is the selective transfer primitive: the caller computes the ref set (e.g. a package manifest closure) and the wire moves nothing else.

Every received chunk must answer a ref we actually asked for. A peer sending unsolicited chunks fails the transfer loudly.