Function createValidatingStore

Creates a validating store backed by a delegate.

Each method validates the relevant inputs against the supplied shape before delegating to store:

• entry is checked for absolute-IRI form (no query string, no fragment) — failures rejected as RangeError
• state.id, when present, is checked for equality with entry — mismatches rejected as RangeError, since the entry identifies the target and a contradicting payload identity is a caller error
• model is validated as a template for lookup, with the lookup plain/depth/limit opts forwarded as query-complexity caps
• state is validated as a resource for create/ update/insert; create and update always cap captive expansion at depth 0 (inline captive batches rejected), while insert honours its depth opt (omitted leaves expansion unbounded)

The trusted opt controls whether lookup responses are re-validated against the shape narrowed by the caller's model template before surfacing. Defaults to false — connectors whose backing source isn't trusted to deliver shape-conforming data (for example, a remote REST endpoint) get the safe default. Local stores that compute results themselves should pass trusted: true to skip the redundant pass.

Validation failures surface as TraceError or RangeError rejections per the unified Store error channel.