#3204 @swamp/s3-datastore and @swamp/gcs-datastore: implement datastoreControlPlaneStore() for the format marker read

Background

swamp checks a datastore's format marker before every command that opens it (swamp-club#3189). On S3 and GCS the marker is the control-plane record datastore-format at the datastore-wide <prefix>/_control/datastore-format.

Today core reads it through a fresh sync service's controlPlaneStore(). That works only because the extensions bind their namespace lazily, on the first pull or push. It also costs every command:

• two extra sync services;
• on S3, a HeadBucket credentials preflight plus the GetObject.

swamp-club#3191 adds an optional provider method to core, datastoreControlPlaneStore(), so the read no longer depends on lazy binding and costs one request. Core falls back to the sync-service path when the method is missing, so nothing breaks before this ships.

Ask

Implement datastoreControlPlaneStore() on the providers of @swamp/s3-datastore and @swamp/gcs-datastore:

datastoreControlPlaneStore(): {
  get(key: string, options?: { signal?: AbortSignal }): Promise<Uint8Array | null>;
}

• Read <prefix>/_control/<key>, never under a namespace, and bind nothing.
• Building it creates a client only: no sync service, and no request until get.
• get is one request, with no HeadBucket or credentials preflight.
• Return null only for NotFound / NoSuchKey. Access denied and every other failure reject.
• Honour options.signal: pass it to the request and to retryWithBackoff. Retrying until it aborts is fine; core aborts this read at 3 s.
• Run assertDatastoreControlPlaneStoreConformance from @swamp-club/swamp-testing against ministack and fake-gcs-server. It ships in the @swamp-club/swamp-testing release that publish-testing.yml makes automatically when the swamp-club#3191 PR merges (it touches packages/testing/**). No separate release step is needed.

Also honour options.signal in the sync service's controlPlaneStore().get. Core now passes { signal } there as a second argument, and released extensions keep that request and its retries running after core gives up. That is the path every user stays on until the new method ships.

Verified

A local patch of the pulled 2026.10.08.1 sources, against ministack and fake-gcs-server 1.56.1, solo and namespaced:

• the namespaced repo reads the datastore-wide marker;
• the read is one request;
• a stalled read is abandoned at the cap: 3 s through the new store, 4 s on the fallback.

Numbers are in the swamp-club#3191 PR.