1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
//! In-memory delta overlay layered over the borrowed base.
//!
//! This is the state model of the MVCC engine: an owned, change-sized
//! delta ([`Overlay`]) layered over the immutable, borrowed base
//! ([`crate::backing::Base`]), unified for reads by a k-way merge
//! ([`MergedState`]) so a lookup sees the overlay first and falls through to
//! the base. Three layers compose:
//!
//! * [`WriteOverlay`] — the MUTABLE delta a single in-flight write transaction accumulates. It
//! records creates, tombstones, property sets/removes, and catalog registrations into per-family
//! maps WITHOUT touching the base, and carries the nine monotonic id allocators (the watermark).
//! It is private to the writer and never shared.
//! * [`Overlay`] — the FROZEN, published delta: the same data, immutable. [`WriteOverlay::freeze`]
//! turns the writer's accumulated delta into one. A published `Arc<Overlay>` is immutable
//! FOREVER; a commit seeds a fresh writer from the parent overlay
//! ([`WriteOverlay::from_overlay`]), applies the new mutations on top, freezes it, and publishes
//! a brand-new `Arc<Overlay>` — it NEVER mutates a published overlay in place.
//! * [`MergedState`] — the borrowed read view that merges an `Overlay` over a base snapshot. Point
//! reads return [`Cow`]: a base-only id borrows from the base (zero clone, the fast path); an
//! overlay-supplied or overlay-overridden id is owned by the overlay; a tombstoned id is absent.
//!
//! Canonical ids are NEVER reused: the overlay only adds records or tombstones
//! them (masking a base record), never renumbers, and the watermark is monotonic
//! across every commit (each fresh writer is seeded from the parent's watermark).
//!
//! # Wiring
//!
//! This overlay/merge model IS the live read/write path. `query.rs`,
//! `projection.rs`, and `database.rs` all read state through [`StateView`] (a
//! [`Snapshot`]'s [`MergedState`], or a writer's [`WriteMergedState`]), and
//! writes accumulate into a [`WriteOverlay`] that a commit freezes into a
//! published [`Overlay`]. The clone-and-apply primitive that proves the merge
//! laws (`Overlay::with_applied`, gated to `cfg(test)`/`cfg(kani)`) mirrors that
//! commit semantics for the proofs; the live path freezes the seeded writer
//! directly.
//!
//! # Performance
//!
//! `perf: unspecified`; this module defines the overlay/merge primitives. Each
//! item below carries its own contract: overlay point reads and mutators are
//! `O(log change)`; building the next overlay (clone the parent, apply the delta)
//! is `O(parent change + delta change)`; merge iterators are `O(base + overlay
//! change)`.
use ;
use crate::;
pub
pub use ;
pub use OverlayLayer;
pub use ;
pub use WriteOverlay;
/// One owned, masked entry in an overlay delta: `Some(record)` adds or overrides
/// the record for that id; `None` is a tombstone that hides the base record (and
/// any earlier overlay record) for that id.
///
/// # Performance
///
/// Copying the variant tag is `O(1)`; cloning a present record is `O(record
/// size)`.
type Delta<R> = ;
/// One subject's property delta (key -> set value, or `None` for a removal
/// tombstone), `Arc`-shared copy-on-write between a frozen parent [`Overlay`]
/// and the writer seeded from it: cloning the outer property map shares each
/// per-subject inner map in `O(1)`, and a writer copies an inner map only when
/// it first mutates that subject (via [`Arc::make_mut`]).
///
/// # Performance
///
/// Cloning is `O(1)`; the first mutation of a shared subject map adds a
/// one-time `O(subject's delta entries)` copy.
pub type SubjectDelta = ;
/// A record keyed by a canonical id, so the per-family delta maps can name their
/// key type generically.
///
/// # Performance
///
/// [`Self::record_id`] is `O(1)`.
pub