Load every store from ns/<ns>/; refuse flat paths at the verified commit #144

Issue 1 of ledger/prd/namespace-independence-prd.md §6, opened on the principal's instruction (session ledger/sessions/2026-10-namespace-layout-authority.md).

Cites. PRD §3.1 (Layout).

Size. L. Depends on. Nothing.

Appendix C note. Yes: spec v1.9, the layout.

Rulings carried. 62 (every namespace under .decisions/ns/<namespace>/), 63 (no store has another form), 66 as amended by 87 (v1.9 is a specification revision with no format number; no file's content changes).

What it builds. The loader reads each namespace's sets/, roles/, log/ and sig/ from .decisions/ns/<namespace>/; a file's namespace is its directory. A file at the verified commit or in the working tree at .decisions/sets/, .decisions/roles/, .decisions/log/, .decisions/sig/ or .decisions/allowed_signers is a schema fault, and so is a store with no ns/ directory and any of those paths. The writers file every record under its namespace's directory. The root .decisions/ holds only ns/ and the uncommitted index/; the export stays at docs/decisions/<ns>.nt. Protocol: LP-3.34 (new), LP-3.36 (new), LP-3.30 to LP-3.33 as they land, Appendix B row and Appendix C note.

Acceptance criteria (§4.1).

• AC-63. A store with any flat path at the verified commit is a schema fault.

Constraints. CANONICAL_FORM stays v1, no stored digest moves, no format bump. Landing order still decides authority verdicts until issue 12; in this step landing positions read only per-namespace paths.