persist: blob backend — store the ref/CID, never the bytes + 14 tests

blob.sx: a blob ref is {:cid :size :mime}; the blob store is a separate
injected dependency (perform in prod, mock content store in tests).
persist/blob-store puts bytes and returns only the ref; bytes live in a
content-addressed store (artdag/IPFS). Tests assert refs in log/kv never carry
the bytes + content-address dedup. 105/105.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/persist-on-sx.md

@@ -42,7 +42,7 @@ read models (feeds, indices, audit logs) update incrementally.
 
 ## Status (rolling)
 
-`bash lib/persist/conformance.sh` → **91/91** (Phases 1–3 done, Phase 4 in progress)
+`bash lib/persist/conformance.sh` → **105/105** (Phases 1–3 done, Phase 4 in progress)
 
 ## Ground rules
 
@@ -104,7 +104,7 @@ lib/persist/backend.sx              lib/persist/api.sx
 
 ## Phase 4 — Durable backends via kernel IO
 - [x] file/log backend driven through `perform` (IO-suspension boundary)
-- [ ] blob backend interface (store ref/CID; bytes live in artdag/IPFS)
+- [x] blob backend interface (store ref/CID; bytes live in artdag/IPFS)
 - [ ] crash/restart replay test (mock IO platform)
 - [ ] migration notes for swapping mem → durable under a live subsystem
 
@@ -113,6 +113,13 @@ feed/-log, flow store, mod/audit, search index, acl grants, identity sessions al
 become `persist` log or kv. Track each migration in that subsystem's plan.
 
 ## Progress log
+- **Phase 4b (105/105).** `blob.sx` — large objects stay out of persist. A blob
+  ref is `{:cid :size :mime}`; the blob store is a SEPARATE injected dependency
+  (`persist/blob-io` over an injectable transport, perform in prod / mock
+  content store in tests). `persist/blob-store` puts bytes and returns ONLY the
+  ref; `persist/blob-fetch` retrieves bytes via the ref. Mock store is
+  content-addressed (same bytes dedupe). 14 tests assert the invariant: a ref in
+  the log/kv carries the CID, never the bytes (`has-key? :bytes` is false).
 - **Phase 4a (91/91).** `durable.sx` — a backend whose every op crosses the
   kernel IO boundary via `(perform {:op "persist/..." :args (...)})`. The
   transport is injectable: `persist/durable-backend` uses the kernel's