Function require_writable_repo 

pub(crate) fn require_writable_repo(
    state: &AppState,
    authenticated: &str,
    repo: &str,
) -> Result<String, ApiError>

docs/write-pipeline.md’s stage 3, run at the earliest moment a route can run it: the instant the request envelope names a repository.

Resolves the repository, refuses a caller writing into one that is not its own, and then refuses a repository whose didbot_pds::HostedAccount policy does not accept writes. The store performs the last check again on the way past; this one exists so that the answer a frozen account gets is AccountNotWritable rather than whatever stage 4 would have said about its record. “Account frozen” says nothing you write will work until an operator acts and “your record is malformed” says fix this write, and an agent that hears the second when the first is true retries forever.

The envelope has to be parsed to know which repository is meant, so this cannot precede parsing outright the way stages 1 and 2 do — it precedes every judgment of the record, which is what stage 4 in the diagram is.