MerTekStak

Every write names what it expects to change. The ownership guard compares the application, the tenant and the expected generation with what is stored, before anything is written. An edit prepared against generation 184 cannot land on top of 185.

# s/guard.tri: every control-plane write passes this one gate.
outline writeTarget {
    text application = ""
    text tenant = ""
    u64 expectedGeneration = 0
}

private void guard(writeTarget want, text application, text tenant, u64 newest) {
    if (want.application != application) { fail "wrong application" }
    if (want.tenant != tenant) { fail "wrong tenant" }
    if (want.expectedGeneration != newest) { fail "stale generation" }
}

text main(text[] argv) {
    writeTarget late = { application = "northvale.booking", tenant = "northvale", expectedGeneration = 184 }
    text outcome = "written"
    task {
        guard(late, "northvale.booking", "northvale", 185)
    } else (refused) {
        text why = refused.message
        outcome = "refused: " + why
    }
    return outcome    # refused: stale generation
}

Keep every generation as a row. A live edit becomes a generation only after its candidate compiles in a check-only pass. Each row keeps the verified bytes that ran, and a unique claim key lets exactly one edit win each generation number.

# _db/troves/appGeneration.tri: appended, never rewritten.
trove appGeneration {
    text application = ""
    text tenant = ""
    u64 number = 0
    text claimKey = ""
    sha256 source = "0000000000000000000000000000000000000000000000000000000000000000"
    buffer wire = 0x
    u64 rolledBackTo = 0
    check backward = rolledBackTo < number
    unique index byClaim = claimKey
}

Claim, then publish. Publication appends the next row with the claim key application#number. A typed write is conditional. Both 07:55 edits passed the guard and raced for generation 185. The unique index let the first one win and refused the second as superseded, and nothing half-applied.

# s/publish.tri: append generation N+1 while this edit still holds the base.
private text publish(writeTarget want, sha256 source, buffer wire) {
    u64 next = want.expectedGeneration + 1
    text key = want.application + "#" + text(next)
    task {
        appGeneration.insert({ application = want.application, tenant = want.tenant, number = next, claimKey = key, source = source, wire = wire, rolledBackTo = 0 })
    } else (lost) {
        return "superseded"
    }
    return key
}

Roll back by replaying stored bytes. A rollback is one more row: generation 186 carries 184's verified bytes and names 184 as its source. No compiler, source checkout or build machine runs during a rollback.

# s/rollback.tri: the newest generation becomes a copy of an earlier one.
# It runs only after guard(want, ...) has passed.
private text rollBack(writeTarget want, appGeneration prior) {
    u64 next = want.expectedGeneration + 1
    text key = prior.application + "#" + text(next)
    appGeneration.insert({ application = prior.application, tenant = prior.tenant, number = next, claimKey = key, source = prior.source, wire = prior.wire, rolledBackTo = prior.number })
    return "generation " + text(next) + " replays " + text(prior.number)
}

Every release carries its digest chain. The release record links the source digest, each gate verdict with the digest of its evidence, the artifact digest, and the record before it. An auditor recomputes each digest from the stored bytes.

# The release record of generation 185.
text application = "northvale.booking"
u64 generation = 185
sha256 source = "9c1f0e7a4b2d8c3e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f7089a1b"
chest[] gates = [
    { text gate = "booking-suite-test", text verdict = "pass", sha256 evidence = "2b8e61c0f4a95d37e1b20c8f6a4d93e7c5b1a0f2e8d47c6b39a1f05e2d8c7b46" },
    { text gate = "saturday-slots-tape", text verdict = "pass", sha256 evidence = "71d04e9a3c6b2f85e0a1d7c49b3e62f8a05d1c7e94b2a6f30c8e5d1b7a4f9e20" }
]
sha256 artifact = "c40e8b17f2a6d95e3b01c7a4f8e2d6b90a5c3e1f7d48b2a6e9c05f13d7b8a26e"
sha256 previous = "e5a91f3c07d2b84e6a1c9f05d3b7e28a4c6f10d9e2b75a3c8f41e6d0b9a27c53"