Module store 

Local content-addressed object store.

Layout (under the crate::layout::RepoLayout common dir passed to ObjectStore::open / ObjectStore::init):

.mkit/
  objects/
    <2-hex>/<62-hex>   # raw canonical object bytes, BLAKE3-named

Writes are atomic: bytes are first written to a sibling temp file (<name>.tmp.<pid>.<rand>), made durable, then renamed into place. A crash mid-write leaves only the temp file behind and never produces a visible object that fails the read-time hash check.

Durability comes in three shapes (see crate::batch for the full contract): ObjectStore::write flushes per object (SyncPolicy::PerObject); ObjectStore::batch defers visibility and amortises durability to one full flush per batch — the write path used by every multi-object command (add, commit, pack unpack); and ObjectStore::bulk_writer fsyncs each object’s contents before the rename and batches the dir fsyncs at commit (git import). In all three an object is never visible before its bytes are durable, so a ref or index written after the write/commit returns can never reference a non-durable object.

Reads always verify integrity by recomputing BLAKE3 over the bytes and comparing against the requested hash; mismatch returns StoreError::HashMismatch. The one opt-in exception is ObjectStore::read_unverified (and the DisplaySource adapter built on it), reserved for display-only rendering where a corrupt object should surface as a bad render, never as durable state — see its doc for the full policy (#625).

See docs/specs/SPEC-OBJECTS.md §10 for the path-layout rule.

Re-exports

pub use crate::batch::SyncPolicy;

pub use crate::batch::WriteBatch;

Structs

BulkWriter

Deferred-fsync writer returned by ObjectStore::bulk_writer. See that method for the crash-safety contract.

DisplaySource

Adapter that makes any ObjectSource read without BLAKE3 verification, for display-only rendering (diff, show, and the commit/merge/pull post-op summaries). Wrap the source once at the render call site — DisplaySource::new(&store) — and pass the wrapper wherever a generic S: ObjectSource render function expects its source. Every existing render function (render_stat, emit_entry_patch, LoadedBlob::load/prefix/into_content) works unchanged: the verify/no-verify policy lives entirely in which source gets passed in, never in a flag threaded through render code.

EphemeralSink

In-memory object overlay for ephemeral worktree snapshots (status, diff, conflict/restore safety checks).

ObjectStore

Local content-addressed object store backed by the filesystem.

Enums

StoreError

Errors raised by the ObjectStore surface. Distinct from MkitError so callers can pattern-match on filesystem failures without losing the structured-decode-error variants.

Constants

FORMAT_FILE

File under .mkit/ declaring the object-addressing format. Written at ObjectStore::init and required (and matched) at ObjectStore::open so an older flat-hash-addressed repository is rejected loudly rather than silently mis-read once merkle addressing is in effect.

FORMAT_VALUE

The only supported object-addressing format value (see docs/specs/SPEC-MERKLE-OBJECTS.md): Tree/ChunkedBlob keyed by BMT root.

MAX_RAW_OBJECT_SIZE

Hard cap on raw object size, enforced on both ObjectStore::write and ObjectStore::read.

MAX_TREE_DEPTH

Hard cap on tree-walk recursion depth.

MKIT_DIR

Top-level repository directory name.

OBJECTS_DIR

Subdirectory under .mkit/ that holds raw object files.

Traits

ObjectSink

Write target shared by ObjectStore (per-object durability) and WriteBatch (batched durability), so ingest code can be written once against either sink.

ObjectSource

Read source shared by ObjectStore and snapshot overlays, so tree-diff code can resolve objects from either the durable store or an in-memory EphemeralSink.

Type Aliases

StoreResult

Result alias used throughout this module.