Module invariants 

Invariants 1–4 (spec/invariants.md); every one caught a real bug during prototype validation.

They fall into two halves, and the split is the write boundary.

Invariants 1 and 2 are read-only and core. They run inside the pipeline, and no document is emitted when either fails. Invariant 1b — the enumeration hole — is read-only too, and lives earlier still, in rename_view::merge_raw.

Invariants 3 and 4 build a tree, so they write. Only a consumer that reconstructs a tree is protected by them, which is the shadow-branch builder alone. They run in pipeline::verify, which the caller invokes when it wants them, and they land in the report as Some(TreeReport).

Structs

InvariantReport

TreeReport

Invariants 3 and 4: the half that needs a built tree, and so a write.

Functions

check_fidelity

Invariants 1 and 2. Read-only: the bound list is one port, and that is the whole proof that the core pipeline cannot write.

check_tree

Invariants 3 and 4. Writes: it builds a tree from the hunks, which puts unreferenced loose objects in the odb.

dumb_hunk_count

The deliberately dumb @@ counter. Must never share code with parse.rs — a shared bug would make invariant 4 circular.