SourceRevisionRef

Identifies an opaque revision of a source.

A revision is opaque to DICE, exactly as docs/design/source-revisions.md describes it: a provider-defined value DICE stores and compares for exact equality, and never parses.

Both halves are checked against SourceIdentityBounds on construction, so a value too long to store or index is refused here, before it can reach a query or a write. Those two ceilings are the only limit either field has, and they live on this type because this type owns the value. Everything downstream that holds a SourceRevisionRef — a revision query, a REST request, evidence carried in from somewhere else, run recording — inherits the same guarantee and adds no cap of its own. So length is never the reason a value that named a source successfully in one place goes on to be refused in another.