feat(identity #a): references carry DURABLE identity (bound_to) — O(1) rename, red->green

References now point at the binding's stable @mod#int via a durable bound_to edge (persisted
to the flat log), not by spelling. The resolver prefers it; a rename changes only the binding's
display name, references stay untouched, and a COLD re-render follows identity to the current
name instead of re-deriving by spelling and missing the renamed def.

- resolve.clj: BOUND dynamic + 3 bind sites; bound-target; refers-target prefers bound_to;
  walk symbol arm resolves edged leaves by identity.
- daemon: read-hidden-preds (bound_to filtered from :query/datalog/warm-cache, option-1) but
  DURABLE on the log + survives strip (not a resolve-pred); persist-bound-for-rename!; the
  :identity-deferred reject REMOVED.

Scope held: existing sequential @mod#int ids, NO content-hashes (increment (b), deferred).

RECEIPTS:
- R4 acceptance (cnf_edit_min_rename.clj, VERIFIED IN MAIN): rename ok 2 ops, new name in cold
  render, old gone, recompiles -> PASS. The pre-existing red receipt, unmodified, now green.
- R1 durable edge: 2 bound_to lines in the flat log (@Schema#284,#342 -> #174).
- R5 no CRDT regression: cnf_crdt_insert_receipt + cnf_render_crdt_receipt PASS.
- R6 read-side: :warm-check consistent; :query surfaces 0 bound_to / 0 refers_to rows.

Dangling-edge (concurrent delete-of-target) noted as the gate-v2 follow-on, deferred.

Author: tompassarelli

chartroom/src/resolve.clj

@@ -78,6 +78,7 @@
 ;; render-mode marker predicate value-ids — DYNAMIC, rebound (recomputed against
 ;; the fresh store) inside `resolve-edn!`; store-local ids must match their store.
 (def ^:dynamic Vp nil) (def ^:dynamic KIND nil) (def ^:dynamic REFERS nil)
+(def ^:dynamic BOUND nil)   ; #(a) the DURABLE identity edge `bound_to` (persisted; reference -> binding's @mod#int)
 (def ^:dynamic FIXED nil) (def ^:dynamic QUAL nil)   ; render-mode markers
 (def ^:dynamic CTOR nil)    ; a `->Name` auto-constructor ref: render `->` + the type's name
 (def ^:dynamic ACC  nil)    ; a synth field accessor `<lower(Name)>-<field>`: stores the field
@@ -144,10 +145,17 @@
                         (when (and (string? p) (re-matches #"seg\d+" p)) [(parse-long (subs p 3)) (:r cl)]))))
        (sort-by first) (mapv second)))
 (defn head-sym [e] (when (= "list" (kind-of e)) (sym-val (first (ordered-children e)))))
+(defn bound-target
+  "The DURABLE identity target of reference `L` — the bound_to edge points at the binding's
+   stable @mod#int node-id, not its spelling. nil if L carries no durable edge (legacy/unedged
+   refs fall back to the spelling-derived refers_to)."
+  [L] (when BOUND (let [cs (c/by-lp ctx L BOUND)] (when-let [cid (select-main-1 cs)] (:r (c/claim-of ctx cid))))))
 (defn refers-target
-  "The binding node that reference `L` resolves to in the default-main view (SELECTS via
-   select-main-1 over the derived refers_to group; re-derived per resolve). Not a uniqueness proof."
-  [L] (let [cs (c/by-lp ctx L REFERS)] (when-let [cid (select-main-1 cs)] (:r (c/claim-of ctx cid)))))
+  "The binding node reference `L` resolves to (default-main view). Prefers the DURABLE bound_to
+   identity edge; falls back to the derived refers_to (spelling-walk) for unedged/legacy refs.
+   Not a uniqueness proof (select-main-1)."
+  [L] (or (bound-target L)
+          (let [cs (c/by-lp ctx L REFERS)] (when-let [cid (select-main-1 cs)] (:r (c/claim-of ctx cid))))))
 (defn live-node? [e] (seq (c/by-lp ctx e KIND)))
 
 ;; --- binding extraction -----------------------------------------------------
@@ -308,6 +316,10 @@
     (let [nm (sym-val node)
           local (some #(get % nm) scope)]       ; nearest frame binding nm
       (cond
+        ;; #(a) identity: a reference with a DURABLE bound_to edge resolves by IDENTITY
+        ;; (binding's stable @mod#int), not by spelling — so a target rename (display-name only)
+        ;; leaves this intact and render follows it to the target's CURRENT name. Spelling is the fallback.
+        (bound-target node) (bind! node (bound-target node))
         local (bind! node local)
         ;; free symbol: cross-module value/type import (:refer/:rename/:as), else a
         ;; module-local TYPE used in value position (a constructor `(Point ...)` /
@@ -647,7 +659,7 @@
      (c/set-supersedes-pred! store sup)
      (binding [ctx store, tx t, SUP sup
                file->ents (atom {})
-               Vp (c/value! store "v") KIND (c/value! store "kind") REFERS (c/value! store "refers_to")
+               Vp (c/value! store "v") KIND (c/value! store "kind") REFERS (c/value! store "refers_to") BOUND (c/value! store "bound_to")
                FIXED (c/value! store "keep_spelling") QUAL (c/value! store "qualifier")
                CTOR (c/value! store "ctor_prefix") ACC (c/value! store "accessor_field")
                n-resolved (atom 0) n-unresolved (atom 0) n-xmod (atom 0) n-type (atom 0) n-comment (atom 0)
@@ -776,7 +788,7 @@
      (c/set-supersedes-pred! store sup)
      (binding [ctx store, tx t, SUP sup
                file->ents (atom {})
-               Vp (c/value! store "v") KIND (c/value! store "kind") REFERS (c/value! store "refers_to")
+               Vp (c/value! store "v") KIND (c/value! store "kind") REFERS (c/value! store "refers_to") BOUND (c/value! store "bound_to")
                FIXED (c/value! store "keep_spelling") QUAL (c/value! store "qualifier")
                CTOR (c/value! store "ctor_prefix") ACC (c/value! store "accessor_field")
                n-resolved (atom 0) n-unresolved (atom 0) n-xmod (atom 0) n-type (atom 0) n-comment (atom 0)
@@ -809,7 +821,7 @@
      (c/set-supersedes-pred! store sup)
      (binding [ctx store, tx t, SUP sup
                file->ents (atom {})
-               Vp (c/value! store "v") KIND (c/value! store "kind") REFERS (c/value! store "refers_to")
+               Vp (c/value! store "v") KIND (c/value! store "kind") REFERS (c/value! store "refers_to") BOUND (c/value! store "bound_to")
                FIXED (c/value! store "keep_spelling") QUAL (c/value! store "qualifier")
                CTOR (c/value! store "ctor_prefix") ACC (c/value! store "accessor_field")
                n-resolved (atom 0) n-unresolved (atom 0) n-xmod (atom 0) n-type (atom 0) n-comment (atom 0)

cnf_bound_identity_receipt.clj

@@ -0,0 +1,74 @@
+;; ============================================================================
+;; cnf_bound_identity_receipt.clj — #(a) identity arc: bound_to is DURABLE but
+;; FILTERED from read projections.  R1 (durable edge) + R6 (read-side unaffected).
+;;   bb -cp out cnf_bound_identity_receipt.clj
+;;
+;; After an :edit-min rename on an in-process /tmp daemon:
+;;   R1  the flat log carries durable `bound_to` lines (count > 0).
+;;   R6a :warm-check returns :consistent true (the incrementally-maintained warm
+;;       cache == a fresh whole rebuild — persisting+filtering bound_to didn't
+;;       diverge the cache).
+;;   R6b a :query for ALL triples does NOT surface any `bound_to` triple
+;;       (read-hidden-preds keeps the durable identity edge out of :query/datalog/
+;;       warm-cache — option-1 scope: render+resolve read it off the store directly).
+;;
+;; SAFE: a /tmp COPY of .fram/code.log + in-process daemon (boot-flat!, handle{});
+;; NO socket, NEVER port 7977, NEVER the canonical lodestar log.
+;; ============================================================================
+(require '[clojure.java.io :as io] '[clojure.string :as str]
+         '[fram.cnf :as c] '[fram.fold :as fold] '[fram.query :as q] '[fram.rt])
+(def home (System/getProperty "user.home"))
+(def root (System/getProperty "user.dir"))
+(def code-log (str root "/.fram/code.log"))
+(when-not (.exists (io/file code-log)) (println "SKIP — missing" code-log) (System/exit 0))
+(binding [*command-line-args* []] (load-file "cnf_coord_daemon.clj"))
+
+;; /tmp copy — the daemon writes bound_to back into THIS file, never the source.
+(def flat (str (System/getProperty "java.io.tmpdir") "/bound-identity-" (System/nanoTime) ".code.log"))
+(io/copy (io/file code-log) (io/file flat))
+(boot-flat! flat)
+
+;; rename a real schema helper with in-module references (same target the R4 receipt uses).
+(def resp (handle {:op :edit-min :spec {:op "rename" :module "schema" :old "replace!" :new "supersede-prior!"}}))
+(println "rename replace! -> supersede-prior!:" (pr-str resp))
+
+;; ---- R1: durable bound_to lines in the flat log ----------------------------
+(def flat-txt (slurp flat))
+(def bound-lines (->> (str/split-lines flat-txt) (filter #(str/includes? % "\"bound_to\"")) vec))
+(def r1 (pos? (count bound-lines)))
+(println "\n=== R1 — durable bound_to in the flat log ===")
+(println "  bound_to lines:" (count bound-lines))
+(doseq [l (take 4 bound-lines)] (println "   " l))
+
+;; ---- R6a: warm cache stays consistent with a fresh rebuild -----------------
+(def wc (handle {:op :warm-check}))
+(def r6a (true? (:consistent wc)))
+(println "\n=== R6a — warm-check after the rename ===")
+(println "  :consistent" (:consistent wc) " inc-triples" (:inc-triples wc) " fresh-triples" (:fresh-triples wc))
+
+;; ---- R6b: a :query for ALL triples surfaces NO bound_to --------------------
+;; Datalog over the base `triple(l,p,r)` relation, binding p so we read the predicate.
+;; If bound_to leaked into the read projection it would appear as a (l "bound_to" r) row.
+(def ALLQ {:find "out"
+           :rules [{:head {:rel "out" :args [{:var "l"} {:var "p"} {:var "r"}]}
+                    :body [{:rel "triple" :args [{:var "l"} {:var "p"} {:var "r"}]}]}]})
+(def qres (handle {:op :query :query ALLQ}))
+(def all-rows (:ok qres))
+(def bound-rows (filter (fn [[_ p _]] (= "bound_to" p)) all-rows))
+;; also confirm refers_to (a resolve-pred) is absent (sanity: read-side really is filtered)
+(def refers-rows (filter (fn [[_ p _]] (= "refers_to" p)) all-rows))
+(def r6b (and (seq all-rows) (empty? bound-rows) (empty? refers-rows)))
+(println "\n=== R6b — :query (all triples) does NOT surface bound_to ===")
+(println "  total triple rows:" (count all-rows)
+         " bound_to rows:" (count bound-rows)
+         " refers_to rows:" (count refers-rows)
+         " engine:" (:engine qres))
+
+(println "\n=== VERDICT ===")
+(if (and (:ok resp) r1 r6a r6b)
+  (do (println "PASS — bound_to is DURABLE (R1: flat-log lines) yet INVISIBLE to the read view"
+               "(R6a: warm cache consistent; R6b: :query surfaces zero bound_to/refers_to rows).")
+      (System/exit 0))
+  (do (println "FAIL —"
+               "rename-ok" (boolean (:ok resp)) "R1" r1 "R6a" r6a "R6b" r6b)
+      (System/exit 1)))

cnf_coord_daemon.clj

@@ -48,6 +48,11 @@
 ;; (so :query/:warm-check/the read view never see them); the materialize step rolls
 ;; back the seq-space the resolver's tx consumed.
 (def resolve-preds #{"refers_to" "keep_spelling" "qualifier" "ctor_prefix" "accessor_field" "supersedes"})
+;; #(a) identity: bound_to is DURABLE (persisted to the flat log — an authored identity edge,
+;; reference -> binding's stable @mod#int) but for option-1 scope is kept OUT of read projections
+;; (:query/datalog/warm-cache/tripwire) — render+resolve read it off the store directly. Filtered
+;; HERE (read view) WITHOUT being a resolve-pred (which would strip it from the store + roll back seq).
+(def read-hidden-preds #{"bound_to"})
 (def refers-version (atom -1))       ; the co version refers_to was last materialized at
 
 ;; ---- S3.3: scoped re-resolve state -----------------------------------------
@@ -171,7 +176,7 @@
 ;; claims the flat log ingested, identical whether or not refers_to has been materialized.
 (defn- claim->triple [st cid]
   (let [cl (c/claim-of st cid) pstr (c/literal st (:p cl))]
-    (when-not (or (schema-preds pstr) (resolve-preds pstr))
+    (when-not (or (schema-preds pstr) (resolve-preds pstr) (read-hidden-preds pstr))
       [(s/name-of st (:l cl)) pstr
        (if (c/value-object? st (:r cl)) (c/literal st (:r cl)) (s/name-of st (:r cl)))])))
 
@@ -830,6 +835,34 @@
             op))
         asserts))
 
+;; #(a) O(1) rename precondition: before renaming a def, PERSIST a durable bound_to edge from
+;; every reference of it to the def's stable @mod#int. The rename then changes only the binding's
+;; display name; references keep their identity edge and a cold re-render follows it to the CURRENT
+;; name (instead of re-deriving by spelling and missing the renamed def). Idempotent.
+;;
+;; Runs under dlock (caller). ensure-refers! first materializes the warm refers_to (spelling-derived
+;; on the first rename; identity-preserving on later ones) over `co`; B = the def binding node-id
+;; (def-binding via with-resolve-read, the SAME node refers_to points at). For each reference leaf
+;; whose refers_to lands on B, do-assert a `bound_to` link (leaf -> B's @mod#int). do-assert appends
+;; to the flat log (durable) and commits to the warm store; bound_to is multi-valued + survives
+;; strip-resolve-claims! (not a resolve-pred) and is filtered from read projections (read-hidden-preds).
+(defn- persist-bound-for-rename! [spec]
+  (ensure-refers!)                                   ; materialize warm refers_to (frames + edges)
+  (let [st     (:store @co)
+        REFp   (c/value-id st "refers_to")
+        B      (target-node {:module (:module spec) :name (:old spec)})]
+    (when (and B REFp)
+      (let [BND     (or (c/value-id st "bound_to") (c/value! st "bound_to"))
+            v0      (current-seq @co)
+            B-name  (s/name-of st B)
+            already (set (map #(:l (c/claim-of st %)) (c/by-p st BND)))
+            ref-leaves (->> (c/by-p st REFp)
+                            (map #(c/claim-of st %))
+                            (filter #(= B (:r %)))
+                            (map :l) distinct)]
+        (doseq [leaf ref-leaves :when (not (already leaf))]
+          (do-assert (s/name-of st leaf) "bound_to" B-name v0))))))
+
 ;; do-edit-min: run the verb over a CLONE, harvest its minimal delta as wire ops, and
 ;; commit those through do-assert/do-retract on the REAL `co`. te-naming for new nodes
 ;; is assigned here (the verb mints nameless local entities on the clone).
@@ -842,18 +875,15 @@
     (when-not (#{"set-body" "upsert-form" "insert-form" "rename"} (:op spec))
       (throw (ex-info (str "edit-min: unknown verb '" (:op spec) "' (known: set-body, upsert-form, rename)")
                       {:reject :unknown-verb})))
-    ;; GRAPH RENAME IS IDENTITY-DEFERRED — reject, do NOT silently do the wrong thing.
-    ;; verb-rename! is O(1): it rewrites the DEF binding's spelling only and relies on
-    ;; references following refers_to (identity). On the mainline SPELLING+derive model a
-    ;; cold render re-derives refers_to BY SPELLING, so old-spelled references can't re-resolve
-    ;; to the renamed def → the rename renders the OLD name (measured: cnf_rename_spelling_check.clj
-    ;; — 2 ops, def rewritten, 2 reference leaves still "replace!"). A correct mainline rename is
-    ;; O(N) (rewrite every reference spelling) and is NOT built. Same identity-deferral as gate-v2
-    ;; (docs/VIEWS_AND_BRANCHES.md). Re-enable when references carry identity OR an O(N) rewrite
-    ;; verb lands. (The text-path CLI rename still works as a same-process projection.)
+    ;; #(a) GRAPH RENAME IS NOW O(1) — references carry DURABLE identity. verb-rename! rewrites
+    ;; the DEF binding's spelling only; references follow `bound_to` (the binding's stable @mod#int),
+    ;; persisted HERE before the rename so a cold re-render resolves them by IDENTITY, not by spelling
+    ;; (the old failure: cnf_rename_spelling_check.clj — old-spelled refs re-derived to nothing and
+    ;; rendered the OLD name). persist-bound-for-rename! is idempotent + appends bound_to to the flat
+    ;; log (durable). Content-hashes (increment (b)) are explicitly OUT of scope: identity is the
+    ;; existing sequential @mod#int. (The text-path CLI rename still works as a same-process projection.)
     (when (= "rename" (:op spec))
-      (throw (ex-info "rename requires identity refs; deferred — O(1) graph rename needs identity, mainline is spelling+derive (O(N) spelling-rewrite not built). See docs/VIEWS_AND_BRANCHES.md."
-                      {:reject :identity-deferred})))
+      (locking dlock (persist-bound-for-rename! spec)))
     (let [real   (:store @co)
           clone  (atom @real)                       ; O(1) structural clone; verb writes here only
           since  (:next-id @clone)

cnf_edit_min_rename.clj

@@ -0,0 +1,53 @@
+;; Build B — confirm the RENAME verb (the one whose no-capture check READS refers_to)
+;; still works on the minimal-op path with the whole-corpus walk OFF: do-edit-min
+;; pre-materializes refers_to (ensure-refers!), the clone inherits it, the verb's
+;; capture-check reads the inherited edges. Rename a schema def + confirm the new name
+;; lands in render(log) and it recompiles. NEVER 7977.
+(require '[fram.cnf :as c] '[fram.schema :as s]
+         '[clojure.string :as str] '[clojure.edn :as edn] '[clojure.java.io :as io] '[babashka.process :as proc])
+(def home (System/getProperty "user.home"))
+(def root (System/getProperty "user.dir"))
+(def beagle-home (or (System/getenv "BEAGLE_HOME") (str home "/code/beagle")))
+(def roundtrip-rkt (or (System/getenv "FRAM_ROUNDTRIP") (str beagle-home "/beagle-lib/private/claims-roundtrip.rkt")))
+(def build-all (or (System/getenv "FRAM_BUILD_ALL") (str beagle-home "/bin/beagle-build-all")))
+(def code-log (str root "/.fram/code.log"))
+(def base-env {"BEAGLE_HOME" beagle-home "FRAM_OUT" (str root "/out") "FRAM_ROUNDTRIP" roundtrip-rkt
+               "FRAM_RESOLVE" (str root "/chartroom/src/resolve.clj")})
+(doseq [p [code-log roundtrip-rkt]] (when-not (.exists (io/file p)) (println "SKIP — missing" p) (System/exit 0)))
+(binding [*command-line-args* []] (load-file "cnf_coord_daemon.clj"))
+(def flat (str (System/getProperty "java.io.tmpdir") "/edit-min-rename-" (System/nanoTime) ".code.log"))
+(io/copy (io/file code-log) (io/file flat))
+(defn- port-free? [p] (try (with-open [s (java.net.Socket.)] (.connect s (java.net.InetSocketAddress. "127.0.0.1" (int p)) 300) false) (catch Exception _ true)))
+(def port (or (some #(when (port-free? %) %) [8200 8201 8202 8203]) 8200))
+(boot-flat! flat)
+(def server (future (serve port)))
+(Thread/sleep 500)
+(defn- shutdown! [] (try (future-cancel server) (catch Throwable _ nil)))
+(.addShutdownHook (Runtime/getRuntime) (Thread. shutdown!))
+(println "daemon up:" (:claims (client port {:op :status})) "claims, port" port)
+
+;; rename the schema-internal helper `replace!` -> `supersede-prior!` (a value def with
+;; in-module references — exercises the capture-check + reference-follows-refers_to).
+(def t0 (System/nanoTime))
+(def resp (client port {:op :edit-min :spec {:op "rename" :module "schema" :old "replace!" :new "supersede-prior!"}}))
+(def ms (/ (- (System/nanoTime) t0) 1e6))
+(println (format "rename replace! -> supersede-prior!: %s  (%.1f ms)" (pr-str resp) ms))
+
+(def out (str (System/getProperty "java.io.tmpdir") "/edit-min-rename-out-" (System/nanoTime) ".bclj"))
+(proc/shell {:continue true :extra-env base-env :err :string} "bb" "-cp" "out" "bin/fram-render-code" "schema" "--log" flat "--out" out)
+(def txt (when (.exists (io/file out)) (slurp out)))
+(def renamed (boolean (and txt (str/includes? txt "supersede-prior!") (not (str/includes? txt "replace!")))))
+;; recompile
+(def work (str (System/getProperty "java.io.tmpdir") "/edit-min-rename-rc-" (System/nanoTime)))
+(def src (str work "/src")) (.mkdirs (io/file src)) (def bout (str work "/out")) (.mkdirs (io/file bout))
+(when txt (spit (str src "/schema.bclj") txt))
+(def br (when txt (proc/sh {:out :string :err :string} build-all src "--out" bout)))
+(def recompiles (boolean (and br (re-find #"\b1 built, 0 error\(s\)" (str (:out br) (:err br))))))
+(shutdown!)
+(println "\n=== Build B — rename on the minimal-op path (refers_to-dependent verb) ===")
+(println "  rename ok          :" (boolean (:ok resp)) (str "(" (:ops resp) " ops)"))
+(println "  new name in render :" renamed)
+(println "  recompiles 1/0     :" recompiles)
+(if (and (:ok resp) renamed recompiles)
+  (do (println "\nPASS — rename works with the whole-corpus walk OFF (inherited refers_to drives the capture-check + reference following).") (System/exit 0))
+  (do (println "\nFAIL") (System/exit 1)))