Module chunk 

Content-defined chunking of the manifest’s key stream (docs/plans/flint-lean-chunked-manifest-design.md §3).

The pointer layout made a TAKEOVER cheap; it did nothing for a publish, which still writes every entry of the project to change one file. Splitting the sorted key stream into immutable, content- addressed chunks makes a publish rewrite only what it touched.

Everything here is pure and synchronous on purpose: the boundary rule is part of the on-the-wire format, and a format decision that can only be exercised through a store is one nobody tests properly.

Structs

ChunkBody

A chunk object’s body.

ChunkRef

One entry of the pointer’s chunk list.

TombstoneBody

The document’s tombstones (review 2026-09-18, H1e) in the chunked layout: one content-addressed object beside the chunks, named by the pointer, so an unchanged set re-addresses to the object that already exists and the chunk reaper keeps it as it keeps a referenced chunk. The single-object layout carries them inline in the document.

Constants

CHUNK_MAX

Ceiling, so one pathological run cannot recreate the single-object problem this exists to remove.

CHUNK_MIN

Floor. Hash boundaries are geometrically distributed, so without one a project accumulates many tiny objects.

CHUNK_TARGET

Entries per chunk, in expectation. ~1 MiB of compact JSON at the ~277 B/entry this manifest measures: big enough that per-object overhead is noise, small enough that one changed file rewrites ~1 MiB rather than the whole project.

Functions

assemble

Rebuild the entry map from a chunk list and the fetched bodies.

assemble_verified

assemble over bodies whose addresses the caller has ALREADY checked one by one (manifest::load_from checks each as it arrives, so it can tell a stale cache entry from a bad fetch): every other check runs, and no body is hashed twice. A caller that has not checked must use assemble.

check_address_of

A body that does not hash to the address it was fetched by: the store handed back something else (a stale read, a wrong key, a truncated body), or a local copy was damaged.

check_list_order

The chunk list covers the key space in order: each chunk’s first key is past the one before it.

chunk_address

The content address of a chunk body: SHA-256, truncated to 128 bits.

chunk_ranges

The shipped sizing.

chunk_ranges_with

Split a SORTED key stream into content-defined runs, as end-exclusive indices. [] for no keys; the last run always ends at keys.len().

decode_tombstones

encode_tombstones

is_chunk_address

Is addr an address chunk_address could have minted: 32 lowercase hex digits? A pointer is read from the bucket, so an address in it is remote-supplied text. Anything that turns one into a LOCAL path (the chunk cache) must refuse every other shape, .. and / above all.

parse_chunk

Parse chunk i of refs and check it against what the list committed to: its entry count, its first key, and no key at or past the next chunk’s first. The body’s address is the caller’s to have checked. A full load (assemble) and lever G’s view (docview) both parse through here, so a chunk passes the same checks however it is read.

rechunk_with

Re-chunk a document after changes, reusing every chunk of old that neither the changes nor their cascade reach (latency plan §12, claim 1).

split

split_with

Split entries into chunk bodies and their references.