store
A content-addressed object store with URL-dispatched backends. A single API surface operates against multiple storage backends (local filesystem, in-memory, HTTP, S3-compatible, WebDAV, FTP/FTPS/SFTP, and a store service tier), selected at open time by the URL scheme. Doc IDs are the SHA-256 of a document's strict canonical bytes, so identity is identical across bindings, backends, compression states, and wire encodings — enabling lossless migration and free dedup. A mutable alias layer maps names to hashes on top of the immutable content.
store:open
[$store:open] -> element — Open a Store against a backend chosen by the URL scheme, with default options.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [$store:get-doc $s $h]]
[doc [item hello]]
store:open-opts
[$store:open-opts] -> element — Open a Store with explicit options for compression, encoding, sharding, auth, caching, and read-only.
[?lib 'cx-platform/store']
[?let [= $s [$store:open-opts "mem://" [map read-only="true"]]] [$store:put-doc $s [doc [item "x"]]]]
cx-err:CXER1110
store:put-doc
[$store:put-doc] -> string — Store a document and return its SHA-256 content hash; identical content stores once. A document containing an [err] at any depth refuses cx-err:CXER0275 (the effect boundary, commands_effects §7.5) unless the optional trailing opts map carries errs=:permit.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [$store:get-doc $s $h]]
[doc [item hello]]
store:put-doc-stream
[$store:put-doc-stream] -> string — Store a document from a readable byte-source in bounded chunks, never holding it fully resident.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $a [$store:put-doc $s [user name=al]]] [= $b [$store:put-doc-stream $s [user name=al]]] [= $a $b]]
true
store:get-doc
[$store:get-doc] -> any — Retrieve the document for a hash, re-validating integrity after decode.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [$store:get-doc $s $h]]
[doc [item hello]]
store:put-doc-text
[$store:put-doc-text] -> string — Store a document given as canonical/parseable TEXT (vs put-doc's node); canonicalizes so the hash and dedup match put-doc of the same doc. The text-body half of the store HTTP server path.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $a [$store:put-doc-text $s "[doc [v 1]]"]] [$count [$store:list-docs $s]]]
1
store:get-doc-text
[$store:get-doc-text] -> [or string [sequence string]] — Return the stored canonical TEXT for a hash (vs get-doc's node), or absence (empty) on a miss — never null, never an err. The text-body half of the store HTTP server path.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [$count [$store:get-doc-text $s "sha2-256:0000000000000000000000000000000000000000000000000000000000000000"]]]
0
store:list-docs
[$store:list-docs] -> [sequence string] — Return the hashes of every document stored in the Store.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h1 [$store:put-doc $s [doc [item "hello"]]]] [= $h2 [$store:put-doc $s [doc [item "hello"]]]] [$store:list-docs $s]]
('sha2-256:6d8460dd10c5fb09c542c81d617efef1eba054a71755f4e1c96a6af7830ddeeb')
store:iter-docs
[$store:iter-docs] -> [sequence element] — Lazily yield hash-and-document pairs, keeping memory bounded regardless of corpus size.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [$store:iter-docs $s]]
([entry hash='sha2-256:6d8460dd10c5fb09c542c81d617efef1eba054a71755f4e1c96a6af7830ddeeb' [doc [item hello]]])
store:query
[$store:query] -> [sequence element] — Evaluate a CXPath (string) against every document — the flat provenance-bearing relation, one [result doc= source= MATCH] tuple per match — or execute a QUOTED planar comprehension (element, stream-2 L99): membership-gated (CXER0120), sandboxed, authorize-before-execute over the extracted slice set, returning the comprehension's own relation.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [root [user name=al]]]] [$count [$store:query $s "//user"]]]
1
store:explain-query
[$store:explain-query] -> element — Report a quoted planar query WITHOUT executing it: [query-plan plan= [slices …] [rewrites …]] — the plan address (= cx:plan-address of the same source), the statically extracted source slice set, and the applied/declined L96 rewrites.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $qp [$store:explain-query $s [?quote [?for [in $o [$store:source $s "//order"]] [yield $o]]]]] [$count $qp//slice]]
1
store:sql
[$store:sql] -> [sequence element] — Run a SQL SELECT over the store (store.md §6.6, the read facade): the SELECT is translated into ONE quoted planar comprehension — a table is the elements of that name, a column an attribute, SQL NULL is absence — and executed by the planar query path, locally or as the wire's query comp=, so it is plan-addressed, authorized over its slice set and refused exactly as a planar query. Projection, WHERE, INNER JOIN, GROUP BY / HAVING with count/sum/avg/min/max, window functions (row_number, rank, dense_rank, aggregates OVER with ROWS frames), ORDER BY, LIMIT/OFFSET; rows answer as [row NAME=value …]. The bounded write side: INSERT / UPDATE / DELETE of ONE per-entity record, attributed through opts {writer: "principal:<id>" authority: …} and recorded as the cx-platform/audit module=sql record, answering [sql-write-result tag= count= old= new=]. Anything outside the subset refuses by name, CXER5012.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://sql"]]
[= $docs ([orders id=1 region=east total=10.5 cust=7], [orders id=2 region=west total=5 cust=8], [orders id=3 region=east total=30 cust=7], [orders id=4 region=east total=20], [customers id=7 name=ann], [customers id=8 name=bob])]
[= $w [?for [in $d $docs] [yield [$store:put-doc $s $d]]]]
[$store:sql $s "SELECT o.id, c.name FROM orders o JOIN customers c ON c.id = o.cust ORDER BY o.id"]]
([row id=1 name=ann], [row id=2 name=bob], [row id=3 name=ann])
store:sql-plan
[$store:sql-plan] -> string — The planar comprehension a SQL SELECT reads as (store.md §6.6), its store handle spelled $srv — the transparency half of the facade: what [$store:sql] runs, without reading a store.
[?lib 'cx-platform/store']
[$store:sql-plan "SELECT id, total FROM orders WHERE region = 'east' AND total > 15 ORDER BY total DESC LIMIT 5"]
'[?for [in $t-orders [$store:source $srv "//orders"]] [where [and [= $t-orders@region "east"] [> $t-orders@total 15]]] [order-by $t-orders@total desc] [take 5] [yield [row id=[$coalesce $t-orders@id null] total=[$coalesce $t-orders@total null]]]]'
store:source
[$store:source] -> [sequence any] — Evaluate a CXPath against every document, returning the matched values only (the query tuples' payloads) — the store-side generator source form for planar comprehensions (code.md 7.8).
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://src"]] [= $h1 [$store:put-doc $s [orders [order sku=a total=5] [order sku=b total=7]]]] [$store:source $s "//order"]]
([order sku=a total=5], [order sku=b total=7])
store:modify-doc
[$store:modify-doc] -> string — Apply a [?modify] action (set-attr, remove, append, rename, [using FN], ... with optional select=) to the doc at a hash and store the result as a new doc, returning its hash; [using FN] runs the lambda client-side per selected node.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [= $h2 [$store:modify-doc $s $h [set-attr name=v value="x"]]] [= $h $h2]]
false
store:put-blob
[$store:put-blob] -> string — Store raw bytes as an OPAQUE document (F1'): identity = hash of the bytes as given — a string's UTF-8, a bytes value's octets (never its 0x… image); byte-exact round-trip, no canonicalization — CX code, images, plain text.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $src "[?def greet ($name) [str-format 'hello, {}' $name]]"] [$eq [$store:get-blob $s [$store:put-blob $s $src]] $src]]
true
store:get-blob
[$store:get-blob] -> [or string [sequence string]] — Return an opaque document's raw bytes, verifying key == hash(bytes) at the read boundary; absence raises CXER1121.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $raw "[order id=1 total=99.5]"] [$eq [$store:get-blob $s [$store:put-blob $s $raw]] $raw]]
true
store:delete-doc
[$store:delete-doc] -> bool — Delete the doc at a hash, returning whether it was present.
[?lib 'cx-platform/store']
[?let [= $s [$store:open-opts "mem://" [map read-only="true"]]] [$store:delete-doc $s "sha2-256:0000000000000000000000000000000000000000000000000000000000000000"]]
cx-err:CXER1110
store:exists
[$store:exists] -> bool — Report whether a doc with the given hash is present — a cheap existence check.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [$store:exists $s $h]]
true
store:capabilities
[$store:capabilities] -> map — Report the Store's read/write/list traits plus its backend, URL, compression, and encoding.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [$store:capabilities $s]]
[map read=true write=true list=true backend=mem url='mem://' compression=none encoding=cxbin]
store:close
[$store:close] -> null — Close the Store; subsequent operations on it raise CXER1130.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $c [$store:close $s]] [$store:list-docs $s]]
cx-err:CXER1130
store:set-alias
[$store:set-alias] -> null — Bind a name to an existing doc hash in the mutable alias layer (last-write-wins).
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [= $a [$store:set-alias $s "latest" $h]] [$store:get-alias $s "latest"]]
'sha2-256:6d8460dd10c5fb09c542c81d617efef1eba054a71755f4e1c96a6af7830ddeeb'
store:get-alias
[$store:get-alias] -> [or string [sequence string]] — Resolve an alias name to its hash, or absence (empty) if it does not resolve.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [= $a [$store:set-alias $s "latest" $h]] [$store:get-alias $s "latest"]]
'sha2-256:6d8460dd10c5fb09c542c81d617efef1eba054a71755f4e1c96a6af7830ddeeb'
store:list-aliases
[$store:list-aliases] -> [sequence element] — Return every name-to-hash alias binding in the Store.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [= $a [$store:set-alias $s "latest" $h]] [$store:list-aliases $s]]
([alias name=latest hash='sha2-256:6d8460dd10c5fb09c542c81d617efef1eba054a71755f4e1c96a6af7830ddeeb'])
store:delete-alias
[$store:delete-alias] -> bool — Remove an alias, returning whether it existed; the underlying doc is untouched.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [= $a [$store:set-alias $s "latest" $h]] [$store:delete-alias $s "latest"]]
true
store:migrate
[$store:migrate] -> element — Copy every doc and alias from one Store to another, losslessly across backends and encodings.
[?lib 'cx-platform/store']
[?let [= $a [$store:open "mem://"]] [= $h [$store:put-doc $a [doc [item "hello"]]]] [= $b [$store:open "mem://"]] [$store:migrate $a $b]]
[migration-report doc-count=1 hashes-verified=1 bytes-written=18]
store:clone
[$store:clone] -> element — Copy every reachable object and doc-ref from a source Store into an EMPTY destination (errors if the destination already holds docs); transfers only objects the destination is missing — the object-identity clone over the wire.
[?lib 'cx-platform/store']
[?let [= $a [$store:open "mem://"]] [= $h [$store:put-doc $a [doc [item "hello"]]]] [= $b [$store:open "mem://"]] [= $r [$store:clone $a $b]] [$store:get-doc $b $h]]
[doc [item hello]]
store:push
[$store:push] -> element — Send the local Store's objects the remote is missing, then advance the remote's refs (have->put-missing->set-ref); content-addressed and idempotent. Works embedded<->embedded and embedded<->daemon.
[?lib 'cx-platform/store']
[?let [= $l [$store:open "mem://"]] [= $h [$store:put-doc $l [doc [v 1]]]] [= $rm [$store:open "mem://"]] [= $r [$store:push $l $rm]] [$store:get-doc $rm $h]]
[doc [v 1]]
store:pull
[$store:pull] -> element — PULL = FETCH + per-ref reconciliation (stream 9, distributed_store §5 — the split, on the record): bring the source's missing objects + doc-refs in, then reconcile the branch-class ALIAS plane (fast-forwards apply; opts.resolutions re-enter as the input table; see reconcile-report). Returns the head-set-bearing [pull-result objects= refs= ok= [heads …] [reconcile-report …]] — never a bare counter. ENFORCING (the agreement law): raises CXER5053 carrying every [conflict] iff the composed report says ok=false — the fetch half and clean fast-forwards have already landed (partial success is reported, never silent); use pull-report to keep conflicts as data. The peer may be LOCAL or a service-tier (cx-store+xsp://) remote — the wire reconciliation reads the peer's aliases + E3 lineage over the profile's aliases/log ops (one examination, two transports); a byte-source remote refuses loud (no lineage to ask), and pull never silently degrades to fetch.
[?lib 'cx-platform/store']
[?let
[= $a [$store:open "mem://pl-a"]]
[= $b [$store:open "mem://pl-b"]]
[= $d1 [$store:put-doc $a [order [id 1]]]]
[= $x1 [$store:set-alias $a "head" $d1]]
[= $p1 [$store:pull $b $a]]
[= $t [$store:get-alias $b "head"]]
[= $d2 [$store:put-doc $a [order [id 1] [line "x"]]]]
[= $x2 [$store:set-alias $a "head" $d2]]
[= $d4 [$store:put-doc $b [order [id 1] [note "n"]]]]
[= $x5 [$store:set-alias $b "head" $d4]]
[= $div [?fallback [$store:pull $b $a] [recover-with [context] [refused [code $err@code] [$count $err/*]]]]]
[= $rep [$store:pull-report $b $a]]
[= $f [$store:fetch $b $a]]
[probe [first-pull $p1] [ff-target [$eq $t $d1]] [diverged $div] [report-ok $rep/@ok] [fetch $f]]]
[probe [first-pull [pull-result objects=2 refs=1 ok=true [heads [stream name='aliases/head' pos=1 hash='sha2-256:59f4fc9c5c13e45e4f86a3c3b89087184d8cb442c919adb6e633c376061cc056'] [stream name=docs pos=1]] [reconcile-report ok=true refs=1 identical=0 advanced=1 ahead=0 conflicts=0 [advance name=head from='' to='sha2-256:59f4fc9c5c13e45e4f86a3c3b89087184d8cb442c919adb6e633c376061cc056']]]] [ff-target true] [diverged [refused [code cx-err:CXER5053] 1]] [report-ok false] [fetch [fetch-result objects=0 refs=2 [heads [stream name='aliases/head' pos=2 hash='sha2-256:23b6269f0ab5dd75c6d6ddffe3bd5d50b7a6604ec8758870bac69c09c5942a0c'] [stream name=docs pos=3]]]]]
store:pull-report
[$store:pull-report] -> element — The never-raising twin of pull (the agreement law: pull raises ⟺ this report says ok=false): the same fetch + reconciliation composition, with divergence answered as DATA — the composed [pull-result ok=false … [reconcile-report … [conflict …]…]] value. Same opts (resolutions input table). Same peer rules (local or service-tier remote; byte-source refuses loud).
[?lib 'cx-platform/store']
[?let
[= $a [$store:open "mem://pl-a"]]
[= $b [$store:open "mem://pl-b"]]
[= $d1 [$store:put-doc $a [order [id 1]]]]
[= $x1 [$store:set-alias $a "head" $d1]]
[= $p1 [$store:pull $b $a]]
[= $t [$store:get-alias $b "head"]]
[= $d2 [$store:put-doc $a [order [id 1] [line "x"]]]]
[= $x2 [$store:set-alias $a "head" $d2]]
[= $d4 [$store:put-doc $b [order [id 1] [note "n"]]]]
[= $x5 [$store:set-alias $b "head" $d4]]
[= $div [?fallback [$store:pull $b $a] [recover-with [context] [refused [code $err@code] [$count $err/*]]]]]
[= $rep [$store:pull-report $b $a]]
[= $f [$store:fetch $b $a]]
[probe [first-pull $p1] [ff-target [$eq $t $d1]] [diverged $div] [report-ok $rep/@ok] [fetch $f]]]
[probe [first-pull [pull-result objects=2 refs=1 ok=true [heads [stream name='aliases/head' pos=1 hash='sha2-256:59f4fc9c5c13e45e4f86a3c3b89087184d8cb442c919adb6e633c376061cc056'] [stream name=docs pos=1]] [reconcile-report ok=true refs=1 identical=0 advanced=1 ahead=0 conflicts=0 [advance name=head from='' to='sha2-256:59f4fc9c5c13e45e4f86a3c3b89087184d8cb442c919adb6e633c376061cc056']]]] [ff-target true] [diverged [refused [code cx-err:CXER5053] 1]] [report-ok false] [fetch [fetch-result objects=0 refs=2 [heads [stream name='aliases/head' pos=2 hash='sha2-256:23b6269f0ab5dd75c6d6ddffe3bd5d50b7a6604ec8758870bac69c09c5942a0c'] [stream name=docs pos=3]]]]]
store:fetch
[$store:fetch] -> element — Bring the remote's objects and refs into the local Store without merging (see pull on the pull/fetch equivalence for a content-addressed store).
[?lib 'cx-platform/store']
[?let [= $rm [$store:open "mem://"]] [= $h [$store:put-doc $rm [doc [v 3]]]] [= $l [$store:open "mem://"]] [= $r [$store:fetch $l $rm]] [$store:get-doc $l $h]]
[doc [v 3]]
store:status
[$store:status] -> element — A snapshot of the store's heads + object economy: backend, docs/objects, the logical/distinct dedup ratio, unflushed refs, and the per-stream HEAD-SET ([heads [stream name= pos= hash?=]…] — 'docs' plus one 'aliases/<name>' stream per ref at its dense E3 position). opts.peer (stream 9, L177 — the ahead/behind half): a peer handle engages the DRY reconcile classification, appending [peer url= identical= ahead= behind= diverged= [stream name= state= ours-pos= theirs-pos=]…] — per-stream :identical/:ahead/:behind/:diverged states (positions are each side's own local coordinates; the classification is the cross-store fact; a staleness scalar is ruled insufficient).
[?lib 'cx-platform/store']
[?let
[= $a [$store:open "mem://st3-a"]]
[= $b [$store:open "mem://st3-b"]]
[= $d1 [$store:put-doc $a [order [id 1]]]]
[= $d1b [$store:put-doc $b [order [id 1]]]]
[= $x1 [$store:set-alias $a "main" $d1]]
[= $x2 [$store:set-alias $b "main" $d1]]
[= $d2 [$store:put-doc $a [order [id 1] [line "x"]]]]
[= $x3 [$store:set-alias $a "main" $d2]]
[= $d4 [$store:put-doc $b [order [id 2]]]]
[= $x4 [$store:set-alias $b "extra" $d4]]
[= $d5 [$store:put-doc $b [order [id 1] [note "n"]]]]
[= $x5 [$store:set-alias $b "boat" $d1]]
[= $x6 [$store:set-alias $a "boat" $d1]]
[= $x7 [$store:set-alias $b "boat" $d5]]
[= $x8 [$store:set-alias $a "boat" $d2]]
[= $st [$store:status $b {peer: $a}]]
[probe [status $st]]]
[probe [status [status backend=mem docs=3 objects=6 logical=7 distinct=6 unflushed=3 [heads [stream name='aliases/boat' pos=2 hash='sha2-256:23b6269f0ab5dd75c6d6ddffe3bd5d50b7a6604ec8758870bac69c09c5942a0c'] [stream name='aliases/extra' pos=1 hash='sha2-256:3c8f5f782a4735fa4313e262e55a07755f13c89fb663775914f748c5ed7d1f75'] [stream name='aliases/main' pos=1 hash='sha2-256:59f4fc9c5c13e45e4f86a3c3b89087184d8cb442c919adb6e633c376061cc056'] [stream name=docs pos=3]] [peer url='mem://st3-a' identical=0 ahead=1 behind=1 diverged=1 [stream name='aliases/boat' state=:diverged ours-pos=2 theirs-pos=2] [stream name='aliases/extra' state=:ahead ours-pos=1 theirs-pos=0] [stream name='aliases/main' state=:behind ours-pos=1 theirs-pos=2]]]]]
store:mounts
[$store:mounts] -> element — Enumerate the stores a store-serve daemon serves — name, backend, capability flags — tenant-filtered, with admin RBAC enforced server-side (a daemon-level op). Inherently service-tier: it needs a cx-store:// handle, and on a local handle it raises CXER5012 (a local handle IS its only store; there is no daemon to enumerate).
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [$store:mounts $s]]
cx-err:CXER5012
store:config-reload
[$store:config-reload] -> element — Trigger a store-serve daemon's runtime config reload: the daemon re-reads its OWN config source (nothing rides the wire) and answers [config-reload applied=... generation=... changed=...], or refuses with CXER1711/CXER1712 verbatim; admin RBAC enforced server-side. Daemon-level like mounts — a local handle raises CXER5012 (there is no daemon config to reload).
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [$store:config-reload $s]]
cx-err:CXER5012
store:verify
[$store:verify] -> element — Whole-graph integrity pass: every live doc must reconstruct from the object graph, or it raises CXER1120 naming the first offending store-key. This is the check that used to run inline on EVERY open of an object-graph store; under demand-paged loading it runs on demand (or from a background task) instead, while per-object integrity is unchanged — every paged read self-verifies its hash, so corruption refuses loudly at first touch. Refuses on the flat document model, whose per-read hash check IS its verification.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "x"]]]] [$store:verify $s]]
[verification valid=true docs=1 objects=2]
store:log
[$store:log] -> [sequence element] — The ref-log: each held doc-ref is one epoch in insertion order (store-key -> doc-root). Old roots persist as objects, so this is the Store's linear history without a separate commit DAG.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [v 1]]]] [$count [$store:log $s]]]
1
store:serve-local
[$store:serve-local] $store $principals -> string — Serve an open store over the store wire (cx-store+xsp://) from inside this process, for tests and corpus cases: each named principal is a freshly minted identity whose grant binds it to the class its map value names ("" = unbound, the bottom class). Answers the URL; serves until the process exits. A class the lattice does not declare refuses CXER1148. Needs the net grant (store.md §6.7, cx-private#1939).
[?lib 'cx-platform/store']
[?let [= $s [$store:open-opts "mem://" [map visibility="public=public top=public+secret"]]] [= $u [$store:serve-local $s [map anon="" top="top"]]] [$str-starts-with $u "cx-store+xsp://127.0.0.1:"]]
true
store:principal-opts
[$store:principal-opts] $url $principal -> element — The client open-opts of a principal serve-local minted for this URL in this process: [map xsp-did=… xsp-seed-env=…], for $store:open-opts or $journal:open. It names the variable that holds the seed, never the seed. A name serve-local did not mint refuses CXER1131.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $u [$store:serve-local $s [map a=""]]] [$store:principal-opts $u "b"]]
cx-err:CXER1131
store:gc
[$store:gc] -> element — Reclaim objects no live doc-ref reaches AND make the result durable (per-substrate compaction); gc = prune + flush. A content-addressed object stays live while ANY ref reaches it, so a shared subtree survives another doc's delete.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $a [$store:put-doc $s [doc [item "x"]]]] [= $b [$store:put-doc $s [doc [item "y"]]]] [= $d [$store:delete-doc $s $a]] [$store:gc $s]]
[gc-result reclaimed=2 objects=2]
store:prune
[$store:prune] -> element — Reclaim objects no live doc-ref reaches (the subset of gc that drops unreachable objects without rewriting durable storage).
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $a [$store:put-doc $s [doc [item "x"]]]] [= $b [$store:put-doc $s [doc [item "y"]]]] [= $d [$store:delete-doc $s $a]] [$store:prune $s]]
[prune-result reclaimed=2 objects=2]
store:rotate-kek
[$store:rotate-kek] -> element — Re-wrap every at-rest envelope's data key from its recorded KEK to a new tenant key (KEK rotation, store.md §9.1): payloads and content addresses untouched, atomic per object, resumable (already-current envelopes skip), fail-closed (an envelope unwrapping under neither key aborts CXER1142). Only meaningful on an encrypted store — a plaintext store raises CXER1141.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [$store:rotate-kek $s "tenant-b"]]
cx-err:CXER1141
store:diff
[$store:diff] -> element — The structural diff of two stored docs BY HASH: identical subtrees share a hash and are skipped in O(1), so the cost is O(changed), not O(size). Returns [diff [change path=... kind=modified|added|removed] ...]; an empty [diff] means identical. Read-only (the plumbing a future structural merge builds on).
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $a [$store:put-doc $s [order [id 1] [amt 100]]]] [= $b [$store:put-doc $s [order [id 1] [amt 200]]]] [$store:diff $s $a $b]]
[diff [change path='/order/amt/[0]' kind=modified]]
store:reconcile-report
[$store:reconcile-report] -> element — Per-ref reconciliation of the alias plane FROM a source store INTO this one (stream 9, distributed_store §4/§5) — the REPORTING surface: never raises. For every branch-class alias on either side (derived caches computation/ and cx-live/ excluded): identical counts; ours-ahead counts (nothing to apply); theirs-ahead FAST-FORWARDS (target doc copied when absent, ref advanced durably); BOTH-moved-past-the-common-base applies NOTHING for that ref and the report carries the ONE Ring-0 [conflict subject= kind=:diverged-advance [base position= hash=] [ours … [diff …]] [theirs … [diff …]] [cas code=CXER1114 expect-pos= actual-pos=]] value — base = the NORMATIVE common base (greatest position at which both lineages record the same target), diffs navigable + patchable (patch(base, ours-diff) ≡ ours), CAS coordinates AS DATA. Partial success is reported, never mixed silently: clean refs advance even when siblings diverge. Returns [reconcile-report ok= refs= identical= advanced= ahead= conflicts= …]; ok=false ⟺ conflicts>0. RESOLUTIONS re-enter as an input table (opts {resolutions: [resolve ref= target=]}): a diverged ref with a resolution records the JOIN — a stored [merge] doc naming base/ours/theirs as locator triples (stream, position, hash) + the target — and the lineage adopts theirs before advancing to the target, so the next reconcile answers AHEAD (converged, never a re-conflict; identical input + identical resolutions => identical end state). resolved= appears only when the seam engaged.
[?lib 'cx-platform/store']
[?let
[= $a [$store:open "mem://rc-a"]]
[= $b [$store:open "mem://rc-b"]]
[= $d1 [$store:put-doc $a [order [id 1]]]]
[= $d1b [$store:put-doc $b [order [id 1]]]]
[= $x1 [$store:set-alias $a "head" $d1]]
[= $x2 [$store:set-alias $b "head" $d1]]
[= $d2 [$store:put-doc $a [order [id 1] [line "x"]]]]
[= $x3 [$store:set-alias $a "head" $d2]]
[= $ff [$store:reconcile-report $b $a]]
[= $again [$store:reconcile-report $b $a]]
[probe [ff $ff] [target [$store:get-alias $b "head"]] [again $again]]]
[probe [ff [reconcile-report ok=true refs=1 identical=0 advanced=1 ahead=0 conflicts=0 [advance name=head from='sha2-256:59f4fc9c5c13e45e4f86a3c3b89087184d8cb442c919adb6e633c376061cc056' to='sha2-256:312707dfc6c3239450adc15165c83202db4d98c2b6fba3ccceb4a54a17d6bc7b']]] [target sha2-256:312707dfc6c3239450adc15165c83202db4d98c2b6fba3ccceb4a54a17d6bc7b] [again [reconcile-report ok=true refs=1 identical=1 advanced=0 ahead=0 conflicts=0]]]
store:reconcile
[$store:reconcile] -> element — The ENFORCING twin of reconcile-report (the XAP compose/compose-report agreement-law pattern): the same walk, the same fast-forwards applied, and it RAISES iff the report says ok=false — CXER5053 E_SYNC_DIVERGED, the err carrying every [conflict] value as children plus the partial-success accounting in its message (applied fast-forwards are never rolled back; per-ref independence). Use reconcile-report to treat conflicts as data; use reconcile where divergence must stop a pipeline.
[?lib 'cx-platform/store']
[?lib 'cx-stdlib/cx']
[?let
[= $a [$store:open "mem://rc3-a"]]
[= $b [$store:open "mem://rc3-b"]]
[= $d1 [$store:put-doc $a [order [id 1]]]]
[= $d1b [$store:put-doc $b [order [id 1]]]]
[= $x1 [$store:set-alias $a "head" $d1]]
[= $x2 [$store:set-alias $b "head" $d1]]
[= $d3 [$store:put-doc $a [order [id 1] [line "y"]]]]
[= $x4 [$store:set-alias $a "head" $d3]]
[= $d4 [$store:put-doc $b [order [id 1] [note "rush"]]]]
[= $x5 [$store:set-alias $b "head" $d4]]
[= $dv [$store:reconcile-report $b $a]]
[= $conf $dv/conflict]
[= $basedoc [$store:get-doc $b $conf/base/@hash]]
[= $oursdoc [$store:get-doc $b $conf/ours/@hash]]
[= $law [$cx:equal [$cx:patch $basedoc [$first $conf/ours/*]] $oursdoc]]
[= $ctext [$cx:canonical $conf]]
[= $stable [= $ctext [$cx:canonical [$cx:parse $ctext]]]]
[= $unmoved [$cx:equal [$store:get-alias $b "head"] $d4]]
[= $enf [?fallback [$store:reconcile $b $a] [recover-with [context] [code $err@code]]]]
[probe [diverged $dv] [law $law] [stable $stable] [unmoved $unmoved] [enforcing $enf]]]
[probe [diverged [reconcile-report ok=false refs=1 identical=0 advanced=0 ahead=0 conflicts=1 [conflict subject=head kind=:diverged-advance [base position=1 hash='sha2-256:59f4fc9c5c13e45e4f86a3c3b89087184d8cb442c919adb6e633c376061cc056'] [ours position=2 hash=sha2-256:ab9d7a9879bcf3cf2493ed198944893dd954d402fcb7bb68f250a24f40075b08 [diff [change kind=element-added path='/order/note' after=note payload=subtree [after [note rush]]]]] [theirs position=2 hash='sha2-256:150a51655bdea44c80a0f7f4960573b09f51702c47f078310fb23b344124f03b' [diff [change kind=element-added path='/order/line' after=line payload=subtree [after [line y]]]]] [cas code=CXER1114 expect-pos=1 actual-pos=2]]]] [law true] [stable true] [unmoved true] [enforcing [code cx-err:CXER5053]]]
store:branch
[$store:branch] -> element — Point a mutable named ref at a doc (branches/tags ARE git refs over the alias layer). Refuses to MOVE an existing branch that points elsewhere (CXER1114, the CAS-safe non-fast-forward reject); creating a new branch or re-pointing to its current target succeeds.
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [v 1]]]] [= $br [$store:branch $s "main" $h]] [= [$store:get-alias $s "main"] $h]]
true
store:branch-force
[$store:branch-force] -> element — Move a named ref to a target UNCONDITIONALLY (the --force that skips the CAS check branch enforces).
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h1 [$store:put-doc $s [doc [v 1]]]] [= $h2 [$store:put-doc $s [doc [v 2]]]] [= $b1 [$store:branch $s "main" $h1]] [= $b2 [$store:branch-force $s "main" $h2]] [= [$store:get-alias $s "main"] $h2]]
true