Commitedb2031eRecorded25 Aug 2026Repositoryfolio
F3b: insert and delete, the referrer discipline, and the root scan
Message
structural.sgl slice 1. folio-insert-node! renders a validated work item (task/decision/question/update; scalars through the F3a serializer, an optional prose body in the restricted class) and appends it inside a container addressed across BOTH id namespaces -- the folio index for work items, an id: argument field for core sections, since @section["Tasks" id: "tasks"] is exactly how the estate spells its containers. The postcheck proves the new id landed uniquely INSIDE the container and that the node count outside the container's subtree did not move (the escape/injection instrument for a variable-size insert).
folio-delete-node! deletes a work item only after BOTH referrer passes come back empty across the WHOLE ROOT: the semantic pass walks every descriptor for related/transclude node: fields over the doomed subtree's ids, the raw pass scans every file's text with identifier-boundary matching (so t-a never matches inside t-alpha -- the estate's own id-truncation lesson), and Markdown occurrences refuse by policy (this coordinator does not rewrite .md). Any referrer, any uninspectable carrier file -> absolute refusal, no override (ruled). Containers refuse deletion and insertion as SCOPED OUT in those words.
verify-staged gains allowed-lost: ids a delete deliberately removes are subtracted from the persistence invariants and everything else about them stays the stage's own target-check to prove. Delete's exact node delta is deliberately #f: adjacent inter-node whitespace text nodes merge when a span vanishes (measured: a 3-node subtree moved the count by 4), so id-absence and persistence carry the invariant instead.
F3a battery 22/22 green over the changes.
Changed
src/folio/doc/structural.sgl | 481 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
src/folio/doc/transaction.sgl | 27 ++++++++--
2 files changed, 503 insertions(+), 5 deletions(-)Diff
src/folio/doc/structural.sgladded
@@ -0,0 +1,481 @@
+1
;;; (folio doc structural) -- structural operations (F3b): insert, delete,+2
;;; move, and rename-id-with-reference-rewrite, plus the cross-file+3
;;; publication engine they share.+4
;;;+5
;;; Everything here rides the F3a machinery through the deliberately narrow+6
;;; `%txn-` surface: the same coordinator door (in-process mutex, cross-+7
;;; process lock, automatic crash recovery), the same bounded reparse, the+8
;;; same verify pipeline, the same refusal vocabulary. Structural requests+9
;;; NEVER rebase -- D11 amendment 1 -- so every door here refuses+10
;;; 'structural-revision-mismatch on a stale expected revision.+11
;;;+12
;;; SCOPE (ruled 2026-08-25): insert and move handle WORK-ITEM kinds (task,+13
;;; decision, question, update). Structural-container surgery -- inserting+14
;;; phases or milestones, re-parenting sections -- is SCOPED OUT of F3b+15
;;; deliberately, not unsupported: the refusal says so in those words, so a+16
;;; later reader extends this module rather than redesigning around a wall+17
;;; that was never load-bearing.+18
;;;+19
;;; THE REFERRER DISCIPLINE. Delete and rename both answer to the same+20
;;; hazard: a reference left pointing at nothing, or rewritten into nothing,+21
;;; is SILENT KNOWLEDGE LOSS -- the worst outcome available in this component+22
;;; (t-5e4329 is the estate's own case: a note rename that updated zero+23
;;; crosslinks). Two independent passes find referrers: the SEMANTIC pass+24
;;; walks descriptors for `related`/`transclude` `node:` fields (span-+25
;;; addressed, so a rewrite is exact), and the RAW pass scans file text for+26
;;; the id with identifier-boundary checks, sharing nothing with the parser.+27
;;; Any raw occurrence the semantic pass cannot address REFUSES the whole+28
;;; operation -- absolutely, with no override flag (ruled: an override on a+29
;;; silent-loss guard becomes habit).+30
(define-library (folio doc structural)+31
(import (sigil core)+32
(sigil struct)+33
(sigil string)+34
(sigil list)+35
(sigil math)+36
(sigil fs)+37
(sigil path)+38
(sigil io)+39
(folio doc model)+40
(folio doc revision)+41
(folio doc inspect)+42
(folio doc discovery)+43
(folio doc manifest)+44
(folio doc coordinator)+45
(folio doc transaction))+46
(export+47
folio-insert-node! folio-delete-node! folio-rename-id! folio-move-node!+48
sop-result? sop-result-op sop-result-files sop-result-node-id+49
sop-result-detail sop-result-recovery-actions+50
sop-file? sop-file-path sop-file-old-revision sop-file-new-revision+51
sop-file-diff)+52
(begin+53
+54
;; ------------------------------------------------------------------+55
;; Multi-file result+56
;; ------------------------------------------------------------------+57
(define-struct sop-file-record (path) (old-revision) (new-revision) (diff))+58
(define (sop-file path old new diff)+59
(sop-file-record path: path old-revision: old new-revision: new diff: diff))+60
(define (sop-file? v) (sop-file-record? v))+61
(define (sop-file-path f) (sop-file-record-path f))+62
(define (sop-file-old-revision f) (sop-file-record-old-revision f))+63
(define (sop-file-new-revision f) (sop-file-record-new-revision f))+64
(define (sop-file-diff f) (sop-file-record-diff f))+65
+66
(define-struct sop-result-record+67
(op) (files) (node-id) (detail) (recovery))+68
(define (sop-result? v) (sop-result-record? v))+69
(define (sop-result-op r) (sop-result-record-op r))+70
(define (sop-result-files r) (sop-result-record-files r))+71
(define (sop-result-node-id r) (sop-result-record-node-id r))+72
(define (sop-result-detail r) (sop-result-record-detail r))+73
(define (sop-result-recovery-actions r) (sop-result-record-recovery r))+74
+75
;; ------------------------------------------------------------------+76
;; Work-item rendering+77
;;+78
;; The serializer is deliberately minimal: validated scalars into the+79
;; argument group, an optional PROSE body in the F3a-restricted class+80
;; (no @, braces, or newlines -- richer bodies arrive by editing the+81
;; inserted node with folio-edit-body! or the journal doors). Every+82
;; render is verified by the staged reparse reading the values back, so+83
;; a serializer defect refuses rather than publishes.+84
;; ------------------------------------------------------------------+85
(define work-item-kinds '(task decision question update))+86
(define container-kinds-for-insert+87
;; Work items may live in any of these (mirrors the frozen model's+88
;; containment: sections and containers hold work items; work items may+89
;; hold work items). A kind outside this set refuses as SCOPED OUT.+90
'(note section project milestone phase task decision question))+91
+92
(define (render-work-item kind (keys: (id #f) (title #f) (status #f)+93
(priority #f) (due #f) (tags #f)+94
(timestamp #f) (author #f) (commit #f)+95
(body-text #f)))+96
(let ((args+97
(case kind+98
((task)+99
(string-append (%txn-escape-string-literal id)+100
" title: " (%txn-escape-string-literal title)+101
" status: " (%txn-serialize-value 'status status)+102
(if priority (string-append " priority: " (%txn-serialize-value 'priority priority)) "")+103
(if due (string-append " due: " (%txn-serialize-value 'due due)) "")+104
(if tags (string-append " tags: " (%txn-serialize-value 'tags tags)) "")))+105
((decision question)+106
(string-append (%txn-escape-string-literal id)+107
" title: " (%txn-escape-string-literal title)+108
" status: " (%txn-serialize-value 'status status)))+109
((update)+110
(string-append (if id (string-append (%txn-escape-string-literal id) " ") "")+111
"timestamp: " (%txn-escape-string-literal timestamp)+112
(if author (string-append " author: " (%txn-escape-string-literal author)) "")+113
(if commit (string-append " commit: " (%txn-escape-string-literal commit)) "")))+114
(else (error (format "render-work-item: ~a is not a work-item kind" kind))))))+115
(string-append "@" (symbol->string kind) "[" args "]{"+116
(if body-text (string-append "\n@p{" body-text "}\n") "")+117
"}\n")))+118
+119
;; ------------------------------------------------------------------+120
;; Identifier-boundary raw scan. Character class mirrors the flat+121
;; node-id grammar ([a-z0-9] segments joined by hyphens); an occurrence+122
;; counts only when both neighbours are OUTSIDE the class, so `t-a`+123
;; never matches inside `t-alpha` (the estate's own id-truncation lesson,+124
;; t-060d78's third defect).+125
;; ------------------------------------------------------------------+126
(define (id-char? c)+127
(or (and (char>=? c #\a) (char<=? c #\z))+128
(and (char>=? c #\0) (char<=? c #\9))+129
(char=? c #\-)))+130
(define (boundary-occurrences text id)+131
(let ((tl (string-length text)) (il (string-length id)))+132
(let loop ((i 0) (hits '()))+133
(cond+134
((> (+ i il) tl) (reverse hits))+135
((and (equal? (substring text i (+ i il)) id)+136
(or (= i 0) (not (id-char? (string-ref text (- i 1)))))+137
(or (= (+ i il) tl) (not (id-char? (string-ref text (+ i il))))))+138
(loop (+ i il) (cons i hits)))+139
(else (loop (+ i 1) hits))))))+140
+141
;; ------------------------------------------------------------------+142
;; Root population. Every operation that looks beyond one file derives+143
;; its population from discovery's census -- with the denominator kept,+144
;; never a filtered list -- and reads every candidate INSIDE the lock.+145
;; ------------------------------------------------------------------+146
(define (root-population coord)+147
;; Returns (census . entries) where each entry is+148
;; (list rel-path abs-path format bytes-or-#f). Bytes are read for+149
;; every candidate; a read failure carries #f and refuses downstream+150
;; when the file matters. Discovery's candidate records carry the+151
;; path and format; the census keeps the denominator.+152
(let* ((root (coordinator-root coord))+153
(census (discover-sources root))+154
(entries+155
(map (lambda (c)+156
(let* ((path (candidate-path c))+157
(rel (path-relative root path))+158
(bytes (guard (e (#t #f)) (read-file-bytes path))))+159
(list rel path (candidate-format c) bytes)))+160
(census-candidates census))))+161
(cons census entries)))+162
+163
;; ------------------------------------------------------------------+164
;; Referrer discovery for one id (or several), across the population.+165
;; Returns (list semantic-sites raw-only troubles) where+166
;; semantic-sites: (rel-path descriptor node field) per rewritable site+167
;; raw-only: (rel-path context) occurrences with no rewritable span+168
;; troubles: (rel-path reason) files that carry the id but could+169
;; not be inspected -- unrewritable by definition.+170
;; The DECLARATION site (the id field of the owning node) is excluded;+171
;; callers that rewrite it (rename) handle it explicitly on the target.+172
;; ------------------------------------------------------------------+173
(define (find-referrers coord entries ids)+174
(let loop ((rest entries) (semantic '()) (raw-only '()) (troubles '()))+175
(if (null? rest)+176
(list (reverse semantic) (reverse raw-only) (reverse troubles))+177
(let* ((entry (car rest))+178
(rel (list-ref entry 0))+179
(fmt (list-ref entry 2))+180
(bytes (list-ref entry 3)))+181
(cond+182
((not bytes)+183
(loop (cdr rest) semantic raw-only+184
(cons (list rel "unreadable") troubles)))+185
(else+186
(let* ((text (utf8->string bytes))+187
(hits (apply append+188
(map (lambda (id) (boundary-occurrences text id)) ids))))+189
(cond+190
((null? hits) (loop (cdr rest) semantic raw-only troubles))+191
((eq? fmt 'md)+192
;; Markdown notes are never rewritten by this+193
;; coordinator (M-track); an id referenced from one+194
;; is unrewritable BY POLICY and refuses upstream.+195
(loop (cdr rest) semantic+196
(cons (list rel (format "~a occurrence(s) in a Markdown note this coordinator does not rewrite" (length hits)))+197
raw-only)+198
troubles))+199
(else+200
(let ((d (%txn-bounded-descriptor coord bytes text rel+201
(revision-of-bytes bytes)+202
(format "referrer ~a" rel))))+203
(if (txn-refusal? d)+204
(loop (cdr rest) semantic raw-only+205
(cons (list rel (txn-refusal-message d)) troubles))+206
(let ((sites (reference-sites d ids)))+207
;; Every boundary hit must be accounted for by+208
;; a rewritable site or the declaration site;+209
;; the arithmetic is the guard.+210
(let* ((decl (declaration-sites d ids))+211
(accounted (+ (length sites) (length decl))))+212
(if (= accounted (length hits))+213
(loop (cdr rest)+214
(append semantic+215
(map (lambda (s) (cons rel s)) sites))+216
raw-only troubles)+217
(loop (cdr rest)+218
(append semantic+219
(map (lambda (s) (cons rel s)) sites))+220
(cons (list rel (format "~a raw occurrence(s) with no rewritable span (prose, code, or a query spec)"+221
(- (length hits) accounted)))+222
raw-only)+223
troubles)))))))))))))))+224
+225
;; Rewritable reference sites: related/transclude `node:` fields whose+226
;; value is one of `ids`. Returned as (node field) pairs.+227
(define (reference-sites d ids)+228
(let walk ((pending (descriptor-nodes d)) (out '()))+229
(if (null? pending)+230
(reverse out)+231
(let* ((n (car pending))+232
(rest (append (inspected-node-children n) (cdr pending))))+233
(if (memq (inspected-node-name n) '(related transclude))+234
(let ((f (let lp ((fs (inspected-node-fields n)))+235
(cond ((null? fs) #f)+236
((and (eq? (field-name (car fs)) 'node)+237
(member (field-value (car fs)) ids))+238
(car fs))+239
(else (lp (cdr fs)))))))+240
(walk rest (if f (cons (list n f) out) out)))+241
(walk rest out))))))+242
+243
;; Declaration sites: nodes whose OWN id is one of `ids` (the positional+244
;; id field). Rename rewrites these on the owning document.+245
(define (declaration-sites d ids)+246
(let walk ((pending (descriptor-nodes d)) (out '()))+247
(if (null? pending)+248
(reverse out)+249
(let* ((n (car pending))+250
(rest (append (inspected-node-children n) (cdr pending))))+251
(if (member (inspected-node-id n) ids)+252
(walk rest (cons n out))+253
(walk rest out))))))+254
+255
;; ------------------------------------------------------------------+256
;; INSERT+257
;; ------------------------------------------------------------------+258
(define (folio-insert-node! coord path container-id kind expected-revision+259
(keys: (id #f) (title #f) (status #f)+260
(priority #f) (due #f) (tags #f)+261
(timestamp #f) (author #f) (commit #f)+262
(body-text #f)))+263
(unless (coordinator? coord) (error "folio-insert-node!: coord must be a coordinator"))+264
(unless (memq kind work-item-kinds)+265
(error (format "folio-insert-node!: inserting a ~a is SCOPED OUT of F3b by ruling (2026-08-25), not unsupported -- work-item kinds are ~a; structural-container surgery needs its own phase, so extend rather than redesign" kind work-item-kinds)))+266
;; Door validation, symmetric with the journal doors.+267
(case kind+268
((task decision question)+269
(unless (and (string? id) (valid-node-id? id))+270
(error (format "folio-insert-node!: a ~a needs an id in flat node-id syntax" kind)))+271
(unless (and (string? title) (> (string-length title) 0))+272
(error (format "folio-insert-node!: a ~a needs a nonempty title" kind)))+273
(let ((bad (%txn-value-error kind 'status status)))+274
(when bad (error (string-append "folio-insert-node!: " bad)))))+275
((update)+276
(unless (string? timestamp)+277
(error "folio-insert-node!: an update needs a timestamp"))))+278
(when body-text (%txn-require-safe-journal-text "folio-insert-node!" body-text))+279
(when (eq? kind 'task)+280
(when priority+281
(let ((bad (%txn-value-error 'task 'priority priority)))+282
(when bad (error (string-append "folio-insert-node!: " bad)))))+283
(when due+284
(let ((bad (%txn-value-error 'task 'due due)))+285
(when bad (error (string-append "folio-insert-node!: " bad)))))+286
(when tags+287
(let ((bad (%txn-value-error 'task 'tags tags)))+288
(when bad (error (string-append "folio-insert-node!: " bad))))))+289
(let ((stage+290
(lambda (d source rev)+291
(stage-insert d source rev container-id kind+292
(render-work-item kind id: id title: title status: status+293
priority: priority due: due tags: tags+294
timestamp: timestamp author: author+295
commit: commit body-text: body-text)+296
id))))+297
(%txn-run-structural coord path expected-revision stage container-id)))+298
+299
;; Containers are found by TREE WALK on `inspected-node-id`, not through+300
;; `descriptor-node-by-id`: the folio id index covers the folio vocabulary+301
;; (D12's node-id namespace), and a SECTION's id lives in the core+302
;; anchor-kind namespace -- `@section["Tasks" id: "tasks"]` is exactly how+303
;; the estate spells its containers, so insertion must reach it. The walk+304
;; carries its own three-way answer (absent/unique/ambiguous), mirroring+305
;; the index's contract.+306
;; A node "carries" an id for containment purposes when either the folio+307
;; vocabulary declared it (inspected-node-id) or -- for CORE nodes like+308
;; `@section["Tasks" id: "tasks"]` -- an `id:` argument field holds it.+309
;; The two are different NAMESPACES by D12; this lookup spans both only+310
;; to ADDRESS a container, never to rewrite anything: rename touches the+311
;; folio namespace alone.+312
(define (node-carries-id? n id)+313
(or (equal? (inspected-node-id n) id)+314
(let lp ((fs (inspected-node-fields n)))+315
(cond ((null? fs) #f)+316
((and (eq? (field-name (car fs)) 'id)+317
(equal? (field-value (car fs)) id)) #t)+318
(else (lp (cdr fs)))))))+319
+320
(define (find-container d source container-id rev)+321
(let walk ((pending (descriptor-nodes d)) (found '()))+322
(if (null? pending)+323
(cond+324
((null? found)+325
(%txn-refuse 'unknown-node+326
(format "no node with id ~s exists in this document" container-id)+327
current-revision: rev))+328
((null? (cdr found)) (car found))+329
(else+330
(%txn-refuse 'ambiguous-node+331
(format "container id ~s names ~a nodes in this document; resolution is refused"+332
container-id (length found))+333
current-revision: rev)))+334
(let ((n (car pending)))+335
(walk (append (inspected-node-children n) (cdr pending))+336
(if (node-carries-id? n container-id)+337
(cons n found)+338
found))))))+339
+340
(define (stage-insert d source rev container-id kind rendered new-id)+341
(let ((container (find-container d source container-id rev)))+342
(cond+343
((txn-refusal? container) container)+344
((not (memq (inspected-node-name container) container-kinds-for-insert))+345
(%txn-refuse 'scoped-out+346
(format "inserting into a ~a is SCOPED OUT of F3b by ruling (2026-08-25), not unsupported -- extend the containment table if a later phase rules it in" (inspected-node-name container))+347
current-revision: rev+348
target-context: (%txn-node-context source container)))+349
((and new-id (not (eq? (descriptor-id-status d new-id) 'absent)))+350
(%txn-refuse 'insert-id-taken+351
(format "id ~s is already declared in this document" new-id)+352
current-revision: rev))+353
(else+354
(let ((at (%txn-body-insertion-point source container)))+355
(if (not at)+356
(%txn-refuse 'update-target-has-no-body+357
(format "container ~s has neither a braced body nor an @end block to insert into" container-id)+358
current-revision: rev)+359
(let* ((staged (%txn-splice source at at (string-append "\n" rendered)))+360
(byte-at (%txn-scalar->byte-offset source at))+361
(pre-total (descriptor-node-count d))+362
(pre-outside (- pre-total (%txn-subtree-count container))))+363
(list staged byte-at 0 0+364
#f rendered new-id+365
#f ;; delta variable (body optional); the check+366
;; below carries the outside-container invariant+367
(lambda (staged-d)+368
(insert-check staged-d container-id kind new-id+369
pre-outside rev))))))))))+370
+371
(define (insert-check staged-d container-id kind new-id pre-outside rev)+372
(let ((c2 (let walk ((pending (descriptor-nodes staged-d)))+373
(cond ((null? pending) #f)+374
((node-carries-id? (car pending) container-id)+375
(car pending))+376
(else (walk (append (inspected-node-children (car pending))+377
(cdr pending))))))))+378
(cond+379
((not c2)+380
(%txn-refuse 'postcheck-failed+381
(format "the container ~s vanished from the staged document" container-id)+382
current-revision: rev))+383
((and new-id (not (eq? (descriptor-id-status staged-d new-id) 'unique)))+384
(%txn-refuse 'postcheck-failed+385
(format "the inserted node's id ~s did not land uniquely" new-id)+386
current-revision: rev))+387
((and new-id+388
(not (let walk ((pending (inspected-node-children c2)))+389
(cond ((null? pending) #f)+390
((equal? (inspected-node-id (car pending)) new-id) #t)+391
(else (walk (append (inspected-node-children (car pending))+392
(cdr pending))))))))+393
(%txn-refuse 'postcheck-failed+394
(format "the inserted node ~s did not land inside container ~s" new-id container-id)+395
current-revision: rev))+396
((not (= (- (descriptor-node-count staged-d) (%txn-subtree-count c2))+397
pre-outside))+398
(%txn-refuse 'postcheck-failed+399
(format "the insert escaped its container: the node count outside ~s moved" container-id)+400
current-revision: rev))+401
(else #f))))+402
+403
;; ------------------------------------------------------------------+404
;; DELETE+405
;; ------------------------------------------------------------------+406
(define (folio-delete-node! coord path node-id expected-revision)+407
(unless (coordinator? coord) (error "folio-delete-node!: coord must be a coordinator"))+408
(let ((stage+409
(lambda (d source rev)+410
(stage-delete coord d source rev node-id))))+411
(%txn-run-structural coord path expected-revision stage node-id)))+412
+413
(define (stage-delete coord d source rev node-id)+414
(let ((node (find-container d source node-id rev)))+415
(cond+416
((txn-refusal? node) node)+417
((not (memq (inspected-node-name node) work-item-kinds))+418
(%txn-refuse 'scoped-out+419
(format "deleting a ~a is SCOPED OUT of F3b by ruling (2026-08-25), not unsupported -- F3b deletes work items; container deletion needs its own phase" (inspected-node-name node))+420
current-revision: rev+421
target-context: (%txn-node-context source node)))+422
(else+423
;; Every id the deletion would remove must be unreferenced across+424
;; the WHOLE ROOT -- both passes, absolute refusal.+425
(let* ((doomed (cons node-id (%txn-subtree-declared-ids node)))+426
(doomed (filter string? doomed))+427
(population (root-population coord))+428
(found (find-referrers coord (cdr population) doomed))+429
(semantic (list-ref found 0))+430
(raw-only (list-ref found 1))+431
(troubles (list-ref found 2)))+432
(cond+433
((pair? troubles)+434
(%txn-refuse 'referrer-uninspectable+435
(format "cannot prove ~s unreferenced: ~a file(s) carrying its id could not be inspected: ~a"+436
node-id (length troubles) troubles)+437
current-revision: rev retryable: #t))+438
((or (pair? semantic) (pair? raw-only))+439
(%txn-refuse 'node-referenced+440
(format "deleting ~s would strand ~a semantic reference(s) and ~a raw occurrence(s): ~a~a -- deletion refuses while referrers exist (silent knowledge loss is the outcome this door exists to prevent)"+441
node-id (length semantic) (length raw-only)+442
(map car semantic) (map car raw-only))+443
current-revision: rev+444
target-context: (%txn-node-context source node)))+445
(else+446
(let* ((sp (inspected-node-span node))+447
(start (span-scalar-start sp))+448
(end (span-scalar-end sp))+449
(staged (%txn-splice source start end ""))+450
(byte-start (%txn-scalar->byte-offset source start))+451
(byte-end (%txn-scalar->byte-offset source end))+452
(subtree (%txn-subtree-count node)))+453
(list staged byte-start (- byte-end byte-start) 0+454
(substring source start end) #f node-id+455
;; The exact delta is noisy for deletions: adjacent+456
;; inter-node whitespace TEXT nodes merge when a+457
;; span vanishes (measured: a 3-node subtree's+458
;; removal moved the count by 4). The id-absence+459
;; and persistence checks carry the invariant.+460
#f+461
(lambda (staged-d)+462
(cond+463
((not (eq? (descriptor-id-status staged-d node-id) 'absent))+464
(%txn-refuse 'postcheck-failed+465
(format "~s still declared after its deletion" node-id)+466
current-revision: rev))+467
(else #f)))+468
doomed)))))))))+469
+470
(define (filter pred xs)+471
(let loop ((rest xs) (out '()))+472
(cond ((null? rest) (reverse out))+473
((pred (car rest)) (loop (cdr rest) (cons (car rest) out)))+474
(else (loop (cdr rest) out)))))+475
+476
;; Placeholders wired in the next slice; declared so the export list is+477
;; honest from the first commit.+478
(define (folio-rename-id! . args)+479
(error "folio-rename-id!: landing in the next F3b slice"))+480
(define (folio-move-node! . args)+481
(error "folio-move-node!: landing in the next F3b slice"))))src/folio/doc/transaction.sglmodified
@@ -112,7 +112,8 @@
112
%txn-verify-staged %txn-make-line-diff %txn-require-contained-path 113
%txn-require-safe-journal-text %txn-escape-string-literal 114
%txn-body-insertion-point %txn-subtree-count %txn-subtree-declared-ids−115
%txn-body-extent %txn-bytes-equal?)+115
%txn-body-extent %txn-bytes-equal? %txn-run-structural+116
%txn-serialize-value %txn-value-error) 117
(begin 118
119
;; ------------------------------------------------------------------@@ -469,8 +470,16 @@
470
(define (verify-staged coord path old-bytes old-source old-rev 471
staged-source pre-ids splice-byte-start splice-byte-removed 472
inserted-bytes target-check refusal-reason−472
pre-node-count node-delta)−473
(let* ((staged-bytes (string->utf8 staged-source))+473
pre-node-count node-delta allowed-lost)+474
;; `allowed-lost` (F3b): ids the request DELIBERATELY removes -- a+475
;; delete's doomed subtree. They are subtracted from the persistence+476
;; invariants (id-status and the raw scan); everything else about them+477
;; is the stage's own target-check to prove. '() for every other op.+478
(let* ((pre-ids (let loop ((rest pre-ids) (out '()))+479
(cond ((null? rest) (reverse out))+480
((member (car rest) allowed-lost) (loop (cdr rest) out))+481
(else (loop (cdr rest) (cons (car rest) out))))))+482
(staged-bytes (string->utf8 staged-source)) 483
(staged-rev (revision-of-bytes staged-bytes))) 484
(cond 485
;; Byte-exactness outside the splice, PROVEN: original prefix and@@ -667,6 +676,7 @@
676
(update-id (list-ref staged 6)) 677
(node-delta (list-ref staged 7)) 678
(target-check (list-ref staged 8))+679
(allowed-lost (if (> (length staged) 9) (list-ref staged 9) '())) 680
(pre-ids (descriptor-ids d)) 681
(bad (verify-staged coord path bytes source rev 682
staged-source pre-ids@@ -676,7 +686,7 @@
686
(if rebased? 'rebase-postcheck-failed 687
'postcheck-failed) 688
(descriptor-node-count d)−679
node-delta)))+689
node-delta allowed-lost))) 690
(if bad 691
bad 692
(let* ((staged-bytes (string->utf8 staged-source))@@ -1178,7 +1188,7 @@
1188
(coordinator-transact coord 1189
(lambda (recovery-actions) 1190
(unless (file-exists? path)−1181
(error (format "folio-edit-body!: no such file: ~a" path)))+1191
(error (format "structural transaction: no such file: ~a" path))) 1192
(stamp-recovery 1193
(let* ((bytes (read-file-bytes path)) 1194
(rev (revision-of-bytes bytes))@@ -1382,6 +1392,13 @@
1392
(define %txn-subtree-declared-ids subtree-declared-ids) 1393
(define %txn-body-extent body-extent) 1394
(define %txn-bytes-equal? bytes-equal?)+1395
;; The structural runner: mismatch refuses 'structural-revision-mismatch+1396
;; (amendment 1), match runs the stage through the full attempt/verify+1397
;; pipeline, recovery is stamped. Insert and delete ride it exactly as+1398
;; body replacement does.+1399
(define %txn-run-structural run-body-transaction)+1400
(define %txn-serialize-value serialize-value)+1401
(define %txn-value-error value-error) 1402
1403
;; Count a node's direct `update` children. Shared by the two journal 1404
;; target-checks: "an update child EXISTS" is satisfied by any prior