Module record 

Records — the unit of state, collaboration and storage: a type, a stable identity and a home workspace. A file’s identity is its file record, which a rename or move keeps, and its path is only where it sits; records reference other records rather than nesting, so “share the book without my notes” is expressible. One document per record is forced, not chosen: an Automerge change graph names its dependencies by hash, so a filtered stream leaves orphaned changes.

Modules

bootstrap

Idempotent construction of initially empty record slots.

capability

A root widget that chooses which record its document is, and owns work scoped to that record.

index

A workspace’s index of the records it holds. Ownership of the document is the caller’s business. The reference is what grants access: a member reaches only the records the workspace references, and removing one stops future changes but cannot un-share bytes a peer already synced.

person

Records an app holds beside the one it shows.

transfer

Transfer: the explicit verb that takes a record across a workspace boundary.

workspace

Records a workspace holds that every app of that workspace opens beside its own ([collab_types::WORKSPACE_RECORDS]): one per kind and workspace, kept by one app, read and changed from any app’s window.

Structs

BlobRef

A content-addressed blob a record depends on: immutable bytes its content is about or embeds (the PDF an annotation set marks up, an image a document shows). Kept in the record’s metadata, so sync, retention and history see which blobs a record keeps alive.

RecordCheckout

A record named together with its type — what a widget declares it is working on, and what a workspace index holds.

RecordId

The stable identity of a record. Encoded by prefix: file-record:<uuid> (a file, by the durable id its filesystem record carries — see RecordId::identify_file), file:<absolute path> (a file known only by where it is: a not-yet-written Save As target, or a filesystem that can’t hold the durable id), uuid:<uuid> (minted, for a record with no natural name), tab:<tab id> (a window’s scratch document until a file names it, see RecordId::for_tab) and derived:<role>@<id> (see RecordId::derived).

RecordKind

What kind of thing a record is — document, annotation-set, book, playlist. App-owned rather than system-registered, so an app can add a kind without coordinating; the cost is no cross-app library view yet (needs a system-owned type registry, not built here).

RecordOpening

A record opening off the frame (RecordStore::begin_opening), for the window that shows before it.

RecordOwners

Explicit profile-scoped owner registry. Clones share the original registry; weak entries never keep a closed writer alive.

RecordRef

One record’s reference to another: annotations → the document they mark up, a duplicate → the record it was copied from.

RecordRefusal

An action whose change the workspace refused: the record withdrew it, and the app holding the record is told, as it is of an action refused on this device.

RecordReservation

The unique construction owner of a not-yet-live record. Drop cancels only this generation.

RecordSet

The records one app process has open, and which is live. Owns per-record persistence and parking, not collaboration: routing a record’s deltas is the toolkit’s business, since a channel belongs to the connection.

RecordStore

A RecordSet several widgets share via a handle, so two tabs on the same file stay one document; single-threaded on purpose, since a Mutex here would guard against nothing.

StoredRecord

A record held beside the one an app shows: the app’s own of a kind, one of the person’s, or one of the workspace’s (super::workspace), each held the same way. Edits are attributed to the person, recorded as undo steps of their own and synced on the record’s route where it has one.

Enums

HistoryUnavailable

Why a record could not be changed now (RecordStore::with_history_or_why).

RecordOpenError

RecordOpenOutcome

RecordSaveStatus

Whether a record’s changes are stored.

Constants

MAX_DISCOVERED_RECORDS

Upper bound for the records an app learns from one workspace index at once: the index is replicated input, not a request to allocate one local document per entry.

MAX_FORMER_IDS

Former identities a checkout may name for migration.

MAX_RECORD_RELATION_BYTES

The longest relation or label a record reference may carry.

SURFACE

The key of the record identity naming the surface its changes are decided against: the content hash of its app package’s surface.toml.

WORKSPACE_ALIAS

The key a record written while the field was named workspace carries its workspace under; those documents exist, so it is read where it is (see [stored_workspace]) and never written.

Functions

add_blob_reference

Record that this record depends on blob. Idempotent on (hash, relation). Returns whether a reference was added.

add_reference

Idempotent on (target, relation): a reference is a fact, not an event.

author_writer

The actor author’s mount edits a record as, when the record’s writer is record_writer and the host asked for per-author writers; mounts of one profile and device share a document, so this keeps each author’s edits apart. Unique per writer, and the same after a reopen, so history names the same author.

blob_references

Every blob this record depends on.

chain_of_resource_id

The chain a resource published under id is (chain_resource_id), or None when id names no chain.

chain_resource_id

The address the chain chain (whose parts are RecordId::part) is published under, as one resource beside its app’s own.

children_resource_id

The address the child records of kind that parent lists are published under, as one container resource beside the app’s own.

former_identities

Identities this record’s document was known by before adoption, oldest first (see RecordCheckout::formerly).

genesis_actor

The actor that made the genesis of the record doc holds: nobody edits as it, and its changes carry no time, so history lists none of them.

home

The workspace this record was minted in.

identity

The identity stamped into doc, if it holds a record.

init

Stamp a document with the identity of the record it holds; idempotent, so a reopen does not author a change graph entry that says nothing new.

init_scoped

Bind a record document to workspace, never rewriting an existing identity or workspace: a document stamped for another workspace would turn a matching record id into an alias across workspaces. A document naming none may be adopted once, after its identity is checked.

references

Every record this one references.

tick

Run one record tick: if the widget tree names a record other than the live one, park it and check the named one out. tilo_ui::App calls this once per frame, before sync, so a widget that opened a file last frame is editing that file’s document by the time it next reads state. The checkout it returns is the caller’s cue to re-announce its collaboration channel — a checkout is a change of address.

valid_label

Whether value is a label that can travel in a workspace index or record stamp: at most max bytes of ASCII letters, digits, ., _ and -, beginning with a letter.

workspace_scope

The workspace this local replica is bound to, under either key, absent only for records written before records were scoped to a workspace; callers may adopt those once with init_scoped, but must never treat an explicit other workspace as interchangeable.