Byte-range backend over pack and index sections in one immutable bundle.
The parsed TOC hash is the pinned store identity. Every callback opens the path afresh, verifies that identity on the opened descriptor, and only then performs positional section reads. An atomic replacement can therefore never mix the old table with bytes from a new generation.