Give the SCM object store two kinds of object, so a file has somewhere to live

dag/gunbc/scm/checkout.dag

@@ -14,9 +14,16 @@ import gunbc.scm.ancestry { RepositoryCommitRef }
 import gunbc.scm.object_store {
   ObjectId,
   ObjectRecord,
+  SemanticNodeObjectRef,
+  SemanticNodeTarget,
   ObjectStore,
   StoredEdge,
-  find_object,
+  NodeRecordFound,
+  NodeRecordAbsent,
+  NodeRecordIsAuthoredSource,
+  find_node_record,
+  resolve_node_target,
+  node_target_of,
 }
 
 // A COMMIT IS A ROOT IDENTITY AND NOTHING ELSE. No parent, no author, no timestamp, no message, no
@@ -25,11 +32,19 @@ import gunbc.scm.object_store {
 // and a single timeline. Keeping the commit to its root is what lets two commits be compared,
 // deduplicated and reconstructed without consulting any history at all.
 type Commit {
-  root: ObjectId
+  root: SemanticNodeTarget
 }
 
+// AN AUTHORED SOURCE AT A PROGRAM POSITION IS ITS OWN REFUSAL, NOT A MISSING OBJECT.
+//
+// Once the store holds two kinds of object, a checkout can reach an identity that IS present and is
+// a file rather than a program. Reporting that as MissingObject would send an operator looking for
+// bytes that are right there, which is the not-applicable-rendered-as-malformed failure -- the two
+// have opposite remedies. It is also not silently skippable: reconstructing the node without that
+// child would hand back a program the commit does not name.
 type CheckoutRefusal
   = MissingObject { identity: ObjectId }
+  | ObjectIsAuthoredSource { identity: ObjectId }
 
 type CheckoutOutcome
   = CheckedOut { program: Node }
@@ -59,7 +74,7 @@ fn checkout_edge_step(store: ObjectStore, acc: CheckoutEdgeAcc, stored: StoredEd
   match acc.refusal {
     Present { value: _ } => acc
     Absent =>
-      match checkout_object(store: store, identity: stored.target) {
+      match checkout_node_target(store: store, target: stored.target) {
         CheckoutRefused { cause: cause } =>
           CheckoutEdgeAcc { edges: acc.edges, refusal: Present { value: cause } }
         CheckedOut { program: child } =>
@@ -71,6 +86,24 @@ fn checkout_edge_step(store: ObjectStore, acc: CheckoutEdgeAcc, stored: StoredEd
   }
 }
 
+// A TARGET IS RESOLVED HERE, NEVER PREJUDGED. The edge states that a semantic node is REQUIRED at a
+// locator; it says nothing about whether this store satisfies that, and a graft may have supplied it
+// since the edge was written. So the target goes through the store's own three-way resolve and the
+// two negatives stay apart -- absent, or occupied by a file -- because they are different facts with
+// different remedies and only one of them can be repaired by fetching.
+//
+// This used to match on a two-armed target and route the resolved arm straight to checkout_object.
+// That arm is gone: it carried store-relative evidence inside a canonical record, and this function
+// re-resolved it anyway, which was one of the four proofs that it never belonged there.
+fn checkout_node_target(store: ObjectStore, target: SemanticNodeTarget) -> CheckoutOutcome {
+  match resolve_node_target(store: store, target: target) {
+    NodeRecordAbsent { identity: i } => CheckoutRefused { cause: MissingObject { identity: i } }
+    NodeRecordIsAuthoredSource { identity: i } =>
+      CheckoutRefused { cause: ObjectIsAuthoredSource { identity: i } }
+    NodeRecordFound(record) => checkout_record(store: store, record: record)
+  }
+}
+
 fn checkout_record(store: ObjectStore, record: ObjectRecord) -> CheckoutOutcome {
   match fold(
     record.children,
@@ -86,10 +119,18 @@ fn checkout_record(store: ObjectStore, record: ObjectRecord) -> CheckoutOutcome
   }
 }
 
-fn checkout_object(store: ObjectStore, identity: ObjectId) -> CheckoutOutcome {
-  match find_object(store: store, identity: identity) {
-    Absent => CheckoutRefused { cause: MissingObject { identity: identity } }
-    Present { value: record } => checkout_record(store: store, record: record)
+// THE REFUSALS SURVIVE THE BRAND, AND SAYING WHY IS THE HONEST PART. A SemanticNodeObjectRef was
+// minted against an object of node kind IN SOME STORE; it does not carry WHICH store. A reference
+// minted against one store and resolved against another can therefore still find nothing, or find a
+// file -- so these two arms are a live boundary between stores rather than a wall the brand already
+// built. What the brand removes is the AUTHORING mistake: no caller can hand this function a
+// locator it never resolved to a node at all.
+fn checkout_object(store: ObjectStore, identity: SemanticNodeObjectRef) -> CheckoutOutcome {
+  match find_node_record(store: store, identity: identity.locator) {
+    NodeRecordAbsent { identity: i } => CheckoutRefused { cause: MissingObject { identity: i } }
+    NodeRecordIsAuthoredSource { identity: i } =>
+      CheckoutRefused { cause: ObjectIsAuthoredSource { identity: i } }
+    NodeRecordFound(record) => checkout_record(store: store, record: record)
   }
 }
 
@@ -100,7 +141,7 @@ fn checkout_object(store: ObjectStore, identity: ObjectId) -> CheckoutOutcome {
 // agreement, which is precisely the property that makes a monotonic store unable to name a program
 // on its own.
 fn checkout(store: ObjectStore, commit: Commit) -> CheckoutOutcome {
-  checkout_object(store: store, identity: commit.root)
+  checkout_node_target(store: store, target: commit.root)
 }
 
 // The rebuilt program carries OccurrenceSynthetic throughout, because occurrence identity is
@@ -109,7 +150,7 @@ fn checkout(store: ObjectStore, commit: Commit) -> CheckoutOutcome {
 // and reconstruct identically. Round-trip equality is therefore asserted on content identity, never
 // on occurrence provenance -- and asserting it on provenance would be asserting the one property the
 // model says must not matter.
-fn commit_of_root(root: ObjectId) -> Commit {
+fn commit_of_root(root: SemanticNodeTarget) -> Commit {
   Commit { root: root }
 }
 
@@ -177,7 +218,7 @@ fn checkout_repository_at(repo: RepositoryEnvelope, reference: RepositoryCommitR
   match commit_at_reference(commits: repo.commits, reference: reference) {
     Absent => CheckoutReferenceUnresolved { reference: reference }
     Present { value: selected } =>
-      match checkout(store: repo.store, commit: commit_of_root(root: selected.root)) {
+      match checkout(store: repo.store, commit: commit_of_root(root: node_target_of(reference: selected.root))) {
         CheckoutRefused { cause: cause } =>
           CheckoutProgramUnreconstructable { reference: reference, cause: cause }
         CheckedOut { program: program } =>