emit --verify repairs the storage zone; verify reads the pull zone in
front of it, on purpose, because the edge is what a player gets. A repair
is the first thing that ever makes a content-addressed key serve
different bytes, so between the two a warm PoP still answers with the old
blob and a cold one with the new — and verify's verdict settles nothing
until the zone is purged.
The purge stays out of emit: it is one call for the whole zone after a
repair, against a CDN credential emit deliberately does not hold. The
procedure itself lives in sow-platform's NWSync runbook.
Closes#89.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>