What that looks like on the wire

Each CItem is one atKey. Sub-collection ids compose namespaces:

<millis>.samples.@bob.atsigns.host-prod-01.nodes.dockerstats.demos@baboonblue18
└─id─┘  └subN┘ └pid┘└subN┘ └─parent id──┘└root┘└──app namespace──┘└──owner──┘

• The atServer indexes on key prefix, so the existing sync and notification machinery works unchanged.
• Values are encrypted client-side; servers can't filter on plaintext.
• The 255-char budget is enforced at subCollection() construction. It fails fast with ArgumentError before any I/O.