Function plan_put 

pub fn plan_put(
    current: Option<&Record>,
    record: Record,
    expected: Option<Revision>,
    now_ms: i64,
    cap: usize,
) -> PutPlan

Decide a consumer put (spec §3.2). A RecordKind::Tombstone record is always Rejected: deletes go through Store::delete_as, and replication writes tombstones through put_raw. Otherwise, a tombstone counts as absent: a create (expected == None) recreates the key past the tombstone, and any Some(_) is NotFound. The one exception is a manifest tombstone (deleted_kind of GraphManifest or VectorManifest), whose retained body is a restore window: a create over it is Rejected with MANIFEST_TOMBSTONE_RECREATE_REJECTED. Replication writes use plan_put_raw.

The store stamps meta.created and meta.updated on every consumer write, inside the same critical section that decides the write, exactly as it stamps a tombstone’s deleted_at (gonzalo#293). A client’s values are overwritten: times a caller can set are times a caller can lie about, and two substrates would disagree about what a record’s history means.

updated is always the write’s time. created is the live record’s created when one is being replaced, so it survives every edit, and the write’s time otherwise — including a recreation over a tombstone, which is a new record at an old key, not a continuation of the deleted one.