Module record 

The circumstances of a write: who, when, where they were standing, and what they were looking at. Rationale: docs/single-author-playbook.md (the author identity and the hash chain) and docs/log-vs-snapshot.md §10.1 (the camera).

These are the fields a manifest row is made of, kept apart from the row itself because the editor builds them at seal and the store writes them: an Attribution crosses that seam.

Target-independent on purpose: the browser reads and writes the same rows, where the container is origin storage rather than a directory.

Structs

Attribution

Who wrote a row, where they were standing, and what they were looking at. One argument rather than three, so a call site that has a path and a camera can supply them without every call site that has neither growing arguments: an &Identity converts into an unplaced attribution on its own.

Camera

Where the author was standing when a row was written: the world point at the centre of their view, and how far in they were zoomed.

Digest

A blake3 digest in the manifest’s durable spelling: 64 lowercase hex characters. One type for both hashes — the chain link and the rev file’s stamp — so the two cannot be spelled differently.

Identity

Who wrote a record: the attribution identity, which must stay meaningful for the life of a decades-lived document. Never a pointer into an account system — the record carries the identity itself, so it survives the death of whatever service verified it.

ScopePath

Where the author was standing when a record was written: the blocks descended into, outermost first, with the empty path meaning the document root. Purely advisory — replay parses it and nothing else reads it but the chrome.

Standing

Where the author was standing, in both spellings a row keeps: the blocks the spotlight filters by, and the names the history row’s scope line reads. Bundled rather than passed as two arguments, because names of a different length than the ids they spell describe nowhere real.

WallTime

When a record was written, in unix milliseconds. An instant rather than a duration, so it is not a core::time::Duration; the conversion from SystemTime goes through one, and the clock that mints these is store::handle::Clock — native-only, so that this module stays target-independent.

Constants

GENESIS 🔒

What the first row chains to. A fixed string rather than zeros, so a hand-written row claiming an all-zero parent is not mistaken for a genuine start of history. Changing it invalidates every existing manifest, which is what the version suffix is for.

UNATTRIBUTED 🔒

The stand-in name for a machine whose environment names nobody. Not a person’s name and not empty, so an audit trail says “we do not know” rather than appearing to attribute the edit.