1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
//! Module partition, sectioning, crossing, and apply-time runtime.
//!
//! # Concepts
//!
//! A **module** is a name attached to a set of schema files (declared via
//! `modules:` path globs in pgmt.yaml). From that one binding two derived
//! bindings follow: objects belong to the module of their defining file, and
//! migration/baseline sections are tagged with the module whose steps they
//! carry. Files matching no module form the **base** — not a module, no
//! name, always present on every target; it is represented as `None`
//! throughout and printed as [`UNMODULED_DISPLAY`] where a human needs to
//! read it.
//!
//! A **subscription** is the stored, per-target set of modules a database
//! has — the same species of fact as "which migrations ran", so it lives in
//! a table beside the migration-tracking table, never derived from config or
//! catalog contents. A module in the subscription is **established** on that
//! target: its sections run there, and its objects are expected there. The
//! base is established everywhere and never listed.
//!
//! A **re-anchor** is a baseline emitted when object ownership moved between
//! modules (a re-tag, split, or merge). Its remap sections are one-time
//! translation instructions to targets: "objects the source module held now
//! belong to the destination". A plain (checkpoint) baseline carries no
//! remaps and is inert to subscriptions.
//!
//! A **crossing** is a target consuming one re-anchor exactly once: check
//! wholeness (would the relabel orphan objects into a module this target
//! does not subscribe?), rewrite the subscription through the remaps, and
//! record the consumption. Consumption is idempotent by construction — a
//! consumed re-anchor is never evaluated again.
//!
//! **Consumption is recorded in the ledger**, not a side table. When a
//! crossing consumes the re-anchor at version V it writes that re-anchor's own
//! baseline main row — a what-happened fact recorded where what-happened facts
//! live — carrying the file's checksum (which pins the consumed bytes, so an
//! edited re-anchor is detectable against every target that consumed it). It
//! also writes zero-trace `satisfied` section rows for exactly the remap
//! sections it relabeled (those whose source the target holds); an irrelevant
//! crossing that relabels nothing writes the main row and no section rows — a
//! legitimate version-level event that processed no local work.
//!
//! The **consumed-through cursor** is DERIVED from those load-bearing rows: the
//! highest baseline version on the target, whether a provision applied it or a
//! crossing consumed it. The crossing loop keys off re-anchors strictly above
//! it, so a crossing may legitimately change nothing else (an irrelevant remap
//! still consumes and still advances the cursor by writing its row), and
//! pruning a consumed re-anchor file from the repo stays safe. Distinct from
//! the *applied-baseline watermark* (the highest baseline whose sections are
//! all covered on the target — a coverage fact, also computed from section
//! rows), which content-coverage checks use instead.
//!
//! Layout:
//! - [`partition`] — config-time file→module partition, attribution, reference
//! and divergence validation, and the deploy [`ModuleSelection`].
//! - [`sectioning`] — generation-time cutting of diff steps into module-tagged
//! sections, provenance-cut baselines, and migration/baseline rendering.
//! - [`crossing`] — pure re-anchor crossing logic (no database access).
//! - [`runtime`] — apply-time [`ModuleRuntime`]: the stored subscription plus
//! the two-phase crossing, delegating all SQL to the tracking store.
pub use ;
pub use remap_source_held;
pub use ;
pub use ;
pub use ;
// Public API surface reachable through pub-fn signatures and the integration
// tests, but never named by value in the binary crate (which recompiles this
// module tree), so its import lint would flag them. They must stay re-exported:
// `PendingCrossing`, `ModuleGeneration`, and `StepSection` leak from private
// submodules as pub-fn return types, and `validate_module_references` /
// `ModuleReferenceReport` are used by `tests/integration/modules_attribution`.
pub use ;
pub use PendingCrossing;
// `run_eligible` is consumed by the crossing gate (runtime uses it via the
// private submodule) and by the classifier's gate-consistency test; the
// crate-level re-export is for the latter and is otherwise unnamed here.
pub use run_eligible;
// Shared by the apply loop's two-phase gate and the guard's crossing forecast.
pub use acquisition_pairs;
pub use ;
pub use ;