Module manifest 

manifest.jsonl: one row per rev, and one per tag. Rationale: docs/log-vs-snapshot.md §10.1 and §14.2.

The document is revs/{head}; this file is the audit trail beside it. A row carries names and circumstances, never document values — who wrote it, when, where they were standing, what they were looking at, and which entities they named. Nothing folds a row, so nothing here can drift out from under a later build the way a replayed op could.

The chain survives the log it was written for: each row links to the canonical bytes of the one before it, and stamps the blake3 of the rev file it names. Both are hashes over bytes somebody else wrote, so the whole check costs one pass over a small file (TUNING.md, Finding 9).

Target-independent: a scratch session builds the same rows in memory, and the browser reads the same text out of origin storage.

Structs

BreakReport

A fault and where it is. Kept apart from the rows it interrupted so a container can hold on to the report as its read-only reason without also holding the history it came with.

DroppedTail

A final row the writer never finished. Appends are one write_all of the line and its newline followed by an fsync, so a manifest that does not end in a newline ends in a write that was never made durable: the row is dropped and the file truncated back to the last whole line.

History

The history a prefix of rows makes: what the panel lists, what the tags call the revs, and where the session that wrote them stood.

Located

Where in the file something went wrong — enough to render a span-style report without re-reading it.

Row

One line of manifest.jsonl.

Scan

Parse and link, stopping at the first row that does not belong and keeping everything before it.

Verified

One row and where the file holds it.

Enums

End

How the row sequence stopped.

Fault

What a row failed on.

Replays

What replaying one row does. One method rather than an Option per question, so a row cannot answer that it both moves the trail and names a rev.

RowKind

Why a row was written. An undo is a forward record, so the manifest is a complete audit trail rather than an erasure — and this says which of its neighbours it took back.

Tail

Whether the manifest ended where it should have. Not a bool: a dropped tail is something the user is told about.

Constants

TOUCHED

How many entities a row names before it gives up and says so. Beyond it the reader’s recourse is a diff of the two revs, which is an acceptable answer for a grep index and would not have been for a camera.

Functions

broken 🔒

history

The history rows make: the trail replayed through its own policy, the tags projected, and the rows themselves in rev order.

misplaced 🔒

Whether row sits where the manifest can hold it: a rev row takes the next position, a tag names one already taken, and a step names a rev the trail can have reached.

scan

Read text as a chain of rows, verifying every link, every position and every step as it goes.

write_canonical 🔒

Sorted-key, whitespace-free JSON. Written out rather than delegated to serde_json::to_vec over a Value, whose key order is the Map backing serde_json happens to be compiled with — a cargo feature elsewhere in the tree must not be able to change what a manifest hashes to.