@feltdb/core 0.8.4 → 0.8.6

package/dist/create/server-source/crates/feltdb/tests/revision_model_decision.rs

@@ -0,0 +1,739 @@
+//! The revision model decision experiment.
+//!
+//! This file **implements nothing in the product**. It builds three tiny probes
+//! of what a `StateRevision` could *be*, runs the same seven scenarios against
+//! each, and fills in a decision matrix by execution rather than by preference.
+//!
+//! It is the executable half of `docs/architecture/revision-model-decision.md`.
+//!
+//! # The question
+//!
+//! The [identity and ancestry contract](../../../docs/architecture/revision-identity-and-ancestry.md)
+//! established that content-only identity cannot survive automatic minting, and
+//! that `base` as "the previous state of resource X" is unanswerable because a
+//! `StateRevision` has no resource. So the decision is not which fix to apply.
+//! It is:
+//!
+//! > **What is a `StateRevision` a revision *of*?**
+//!
+//! Three answers are consistent with the evidence:
+//!
+//! | model | a revision is | identity |
+//! | --- | --- | --- |
+//! | **A — State** | a durable content | content alone; ancestry lives outside the revision |
+//! | **B — Historical transition** | a particular occurrence in history | content + parent + a discriminator |
+//! | **C — Resource transition** | a transition belonging to a resource | resource + content + parent + a discriminator |
+//!
+//! # Two invariants, asserted against every model
+//!
+//! These are not model choices. They are the boundary the T5 and T6 findings
+//! draw, and a model that cannot hold them is not a revision model:
+//!
+//! 1. **Once committed, a revision's identity and ancestry are immutable.** A
+//!    record whose historical parent can change after commit is not a durable
+//!    historical object; it is a mutable record that happens to contain
+//!    historical fields.
+//! 2. **A `parent_id` is either a reference to an authoritative revision, or it
+//!    is not a parent.** Parent existence is part of what makes a revision
+//!    valid, not a lookup applied afterwards.
+//!
+//! The probes are deliberately small and their identities are readable strings
+//! rather than hashes: what is under test is the *structure* of identity, not
+//! its encoding.
+//!
+//! Storage cost, compaction economics and copy-on-write are **deliberately
+//! absent**. Measuring them before the object is defined would optimise
+//! something that does not yet exist.
+
+use feltdb::state_model::{StateRevision, StateStore};
+use feltdb::FeltDb;
+use std::collections::BTreeMap;
+use std::sync::Arc;
+use tempfile::TempDir;
+
+type Rid = String;
+
+#[derive(Debug, PartialEq, Eq)]
+enum MintError {
+    /// Invariant 2: the named parent is not an authoritative revision.
+    UnknownParent,
+}
+
+/// The model has no way to express the question, as opposed to answering "no".
+#[derive(Debug, PartialEq, Eq)]
+struct Unsupported(&'static str);
+
+/// What every candidate model must be able to do.
+trait Model {
+    fn name(&self) -> &'static str;
+
+    /// Mint a revision of `content` for `resource`, descending from `parent`.
+    fn mint(
+        &mut self,
+        resource: &str,
+        content: &str,
+        parent: Option<&Rid>,
+    ) -> Result<Rid, MintError>;
+
+    /// The parent of `id` as seen from `resource`.
+    fn parent_of(&self, resource: &str, id: &Rid) -> Option<Rid>;
+
+    /// The revisions of one resource, oldest first.
+    fn history_of(&self, resource: &str) -> Result<Vec<Rid>, Unsupported>;
+
+    /// Retain only the newest `keep` revisions of one resource.
+    fn retain_last(&mut self, resource: &str, keep: usize) -> Result<usize, Unsupported>;
+
+    /// Every durable record, for immutability checking.
+    fn records(&self) -> BTreeMap<Rid, String>;
+}
+
+// ---------------------------------------------------------------------------
+// Model A — a revision is a durable state
+// ---------------------------------------------------------------------------
+
+/// Identity is content. Ancestry is **not a field of the revision** — it is a
+/// separate edge set, so the same state recurring in history is one object
+/// referenced twice rather than one object rewritten twice.
+#[derive(Default)]
+struct StateModel {
+    contents: BTreeMap<Rid, String>,
+    edges: Vec<Edge>,
+}
+
+struct Edge {
+    resource: String,
+    from: Option<Rid>,
+    to: Rid,
+}
+
+impl Model for StateModel {
+    fn name(&self) -> &'static str {
+        "A state"
+    }
+
+    fn mint(
+        &mut self,
+        resource: &str,
+        content: &str,
+        parent: Option<&Rid>,
+    ) -> Result<Rid, MintError> {
+        if let Some(parent) = parent {
+            if !self.contents.contains_key(parent) {
+                return Err(MintError::UnknownParent);
+            }
+        }
+        let id = format!("state:{content}");
+        // Idempotent by construction: the same content is the same bytes.
+        self.contents.insert(id.clone(), content.to_string());
+        self.edges.push(Edge {
+            resource: resource.to_string(),
+            from: parent.cloned(),
+            to: id.clone(),
+        });
+        Ok(id)
+    }
+
+    fn parent_of(&self, resource: &str, id: &Rid) -> Option<Rid> {
+        // The last time this state was reached on this resource.
+        self.edges
+            .iter()
+            .rev()
+            .find(|edge| edge.resource == resource && &edge.to == id)
+            .and_then(|edge| edge.from.clone())
+    }
+
+    fn history_of(&self, resource: &str) -> Result<Vec<Rid>, Unsupported> {
+        Ok(self
+            .edges
+            .iter()
+            .filter(|edge| edge.resource == resource)
+            .map(|edge| edge.to.clone())
+            .collect())
+    }
+
+    fn retain_last(&mut self, resource: &str, keep: usize) -> Result<usize, Unsupported> {
+        let mine: Vec<usize> = self
+            .edges
+            .iter()
+            .enumerate()
+            .filter(|(_, edge)| edge.resource == resource)
+            .map(|(index, _)| index)
+            .collect();
+        let drop_count = mine.len().saturating_sub(keep);
+        let dropped: Vec<usize> = mine.into_iter().take(drop_count).collect();
+        self.edges = std::mem::take(&mut self.edges)
+            .into_iter()
+            .enumerate()
+            .filter(|(index, _)| !dropped.contains(index))
+            .map(|(_, edge)| edge)
+            .collect();
+        // Contents stay: they are shared, and another resource may reference them.
+        Ok(drop_count)
+    }
+
+    fn records(&self) -> BTreeMap<Rid, String> {
+        self.contents.clone()
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Model B — a revision is a historical transition
+// ---------------------------------------------------------------------------
+
+/// Identity is content plus parent plus a monotonic discriminator, so the same
+/// content occurring twice is two revisions. There is **no resource**: a
+/// revision is an occurrence in history, and history is not divided up.
+#[derive(Default)]
+struct TransitionModel {
+    revisions: BTreeMap<Rid, (String, Option<Rid>)>,
+    sequence: u64,
+}
+
+impl Model for TransitionModel {
+    fn name(&self) -> &'static str {
+        "B transition"
+    }
+
+    fn mint(
+        &mut self,
+        _resource: &str,
+        content: &str,
+        parent: Option<&Rid>,
+    ) -> Result<Rid, MintError> {
+        if let Some(parent) = parent {
+            if !self.revisions.contains_key(parent) {
+                return Err(MintError::UnknownParent);
+            }
+        }
+        self.sequence += 1;
+        let id = format!(
+            "occurrence:{}:{}:{content}",
+            self.sequence,
+            parent.map(String::as_str).unwrap_or("root")
+        );
+        self.revisions
+            .insert(id.clone(), (content.to_string(), parent.cloned()));
+        Ok(id)
+    }
+
+    fn parent_of(&self, _resource: &str, id: &Rid) -> Option<Rid> {
+        self.revisions
+            .get(id)
+            .and_then(|(_, parent)| parent.clone())
+    }
+
+    fn history_of(&self, _resource: &str) -> Result<Vec<Rid>, Unsupported> {
+        Err(Unsupported(
+            "a transition belongs to no resource, so a resource has no history",
+        ))
+    }
+
+    fn retain_last(&mut self, _resource: &str, _keep: usize) -> Result<usize, Unsupported> {
+        Err(Unsupported(
+            "retention cannot be scoped to a resource the model cannot name",
+        ))
+    }
+
+    fn records(&self) -> BTreeMap<Rid, String> {
+        self.revisions
+            .iter()
+            .map(|(id, (content, parent))| (id.clone(), format!("{content}|{parent:?}")))
+            .collect()
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Model C — a revision is a transition of a resource
+// ---------------------------------------------------------------------------
+
+/// Identity is resource plus content plus parent plus a discriminator. A
+/// revision knows what it is a revision *of*.
+#[derive(Default)]
+struct ResourceTransitionModel {
+    revisions: BTreeMap<Rid, (String, String, Option<Rid>)>,
+    sequence: u64,
+}
+
+impl Model for ResourceTransitionModel {
+    fn name(&self) -> &'static str {
+        "C resource transition"
+    }
+
+    fn mint(
+        &mut self,
+        resource: &str,
+        content: &str,
+        parent: Option<&Rid>,
+    ) -> Result<Rid, MintError> {
+        if let Some(parent) = parent {
+            if !self.revisions.contains_key(parent) {
+                return Err(MintError::UnknownParent);
+            }
+        }
+        self.sequence += 1;
+        let id = format!(
+            "{resource}@{}:{}:{content}",
+            self.sequence,
+            parent.map(String::as_str).unwrap_or("root")
+        );
+        self.revisions.insert(
+            id.clone(),
+            (resource.to_string(), content.to_string(), parent.cloned()),
+        );
+        Ok(id)
+    }
+
+    fn parent_of(&self, _resource: &str, id: &Rid) -> Option<Rid> {
+        self.revisions
+            .get(id)
+            .and_then(|(_, _, parent)| parent.clone())
+    }
+
+    fn history_of(&self, resource: &str) -> Result<Vec<Rid>, Unsupported> {
+        Ok(self
+            .revisions
+            .iter()
+            .filter(|(_, (owner, _, _))| owner == resource)
+            .map(|(id, _)| id.clone())
+            .collect())
+    }
+
+    fn retain_last(&mut self, resource: &str, keep: usize) -> Result<usize, Unsupported> {
+        let mine = self.history_of(resource)?;
+        let drop_count = mine.len().saturating_sub(keep);
+        for id in mine.into_iter().take(drop_count) {
+            self.revisions.remove(&id);
+        }
+        Ok(drop_count)
+    }
+
+    fn records(&self) -> BTreeMap<Rid, String> {
+        self.revisions
+            .iter()
+            .map(|(id, (owner, content, parent))| {
+                (id.clone(), format!("{owner}|{content}|{parent:?}"))
+            })
+            .collect()
+    }
+}
+
+fn models() -> Vec<Box<dyn Model>> {
+    vec![
+        Box::<StateModel>::default(),
+        Box::<TransitionModel>::default(),
+        Box::<ResourceTransitionModel>::default(),
+    ]
+}
+
+const X: &str = r#"{"title":"X"}"#;
+const Y: &str = r#"{"title":"Y"}"#;
+
+// ---------------------------------------------------------------------------
+// The two invariants, asserted against every model
+// ---------------------------------------------------------------------------
+
+/// **Invariant 1 — a committed revision's identity and ancestry are immutable.**
+///
+/// Run every scenario that rewrote history under today's implementation, and
+/// assert that no already-stored record changed. All three models hold, by
+/// different means: A because a revision has no ancestry to rewrite, B and C
+/// because the rewrite would have a different identity.
+#[test]
+fn every_model_holds_committed_revisions_immutable() {
+    for mut model in models() {
+        let name = model.name();
+        let first = model.mint("tasks:1", X, None).unwrap();
+        let second = model.mint("tasks:1", Y, Some(&first)).unwrap();
+        let before = model.records();
+
+        // The three sequences that corrupt history today.
+        model.mint("tasks:1", X, Some(&second)).unwrap(); // revert
+        model.mint("tasks:1", Y, None).unwrap(); // re-mint a child as a root
+        model.mint("tasks:2", X, None).unwrap(); // same content, other resource
+
+        let after = model.records();
+        for (id, record) in &before {
+            assert_eq!(
+                after.get(id),
+                Some(record),
+                "{name}: the record for {id} changed after commit"
+            );
+        }
+    }
+}
+
+/// **Invariant 2 — a `parent_id` references an authoritative revision, or it is
+/// not a parent.**
+///
+/// Model-independent: all three can enforce it at the mint, and it costs a
+/// containment check. This is the clause T5 should be discharged by — a rule in
+/// the definition of a valid revision, not a lookup bolted on afterwards.
+#[test]
+fn every_model_rejects_a_parent_it_does_not_hold() {
+    for mut model in models() {
+        let name = model.name();
+        let foreign = "state:{\"never\":\"stored\"}".to_string();
+        assert_eq!(
+            model.mint("tasks:1", X, Some(&foreign)),
+            Err(MintError::UnknownParent),
+            "{name}: accepted a parent it does not hold"
+        );
+    }
+}
+
+/// **The real store now holds both — this is what the experiment decided.**
+///
+/// This test asserted the opposite when the experiment was run: `StateStore`
+/// accepted an unheld parent, and re-minting a child's content as a root erased
+/// the parent that child had. Model C was adopted and implemented, and the same
+/// two sequences are now refused at the mint.
+///
+/// It is kept in the experiment file rather than moved because the experiment's
+/// claim was that both invariants are *model-independent and cheap*. This is
+/// that claim, checked against the real store instead of a probe.
+#[test]
+fn the_real_store_now_holds_both_invariants() {
+    let directory = TempDir::new().unwrap();
+    let db = Arc::new(FeltDb::open(directory.path().join("today.log")).unwrap());
+    let store = StateStore::with_feltdb(db).unwrap();
+
+    let first = store
+        .create("tasks:1", X.into(), "decision".into())
+        .unwrap();
+    let second = store.commit(Y.into(), &first, "decision".into()).unwrap();
+    assert_eq!(
+        store.get(&second.id).unwrap().parent_id,
+        Some(first.id.clone())
+    );
+
+    // Invariant 1: beginning the resource again is refused, and a further
+    // commit of the same content is a new revision rather than a rewrite.
+    assert!(
+        store
+            .create("tasks:1", Y.into(), "decision".into())
+            .is_err(),
+        "a resource has one beginning"
+    );
+    let third = store.commit(Y.into(), &second, "decision".into()).unwrap();
+    assert_ne!(
+        third.id, second.id,
+        "the same state again is a new revision"
+    );
+    assert_eq!(
+        store.get(&second.id).unwrap().parent_id,
+        Some(first.id),
+        "the committed revision kept the parent it was committed with"
+    );
+
+    // Invariant 2: a parent the store does not hold is refused.
+    let unheld = StateRevision::at(
+        "tasks:1".into(),
+        r#"{"never":"stored"}"#.into(),
+        None,
+        0,
+        "decision".into(),
+    );
+    assert!(
+        store.commit(X.into(), &unheld, "decision".into()).is_err(),
+        "a parent must resolve to a held revision"
+    );
+}
+
+// ---------------------------------------------------------------------------
+// The seven scenarios
+// ---------------------------------------------------------------------------
+
+/// Whether the two mints produce one identity or two.
+fn same_content_twice(model: &mut dyn Model) -> bool {
+    let first = model.mint("tasks:1", X, None).unwrap();
+    let second = model.mint("tasks:1", X, None).unwrap();
+    first == second
+}
+
+/// Whether a revert lands back on the identity it started from.
+fn revert_reuses_the_original_identity(model: &mut dyn Model) -> bool {
+    let first = model.mint("tasks:1", X, None).unwrap();
+    let second = model.mint("tasks:1", Y, Some(&first)).unwrap();
+    let third = model.mint("tasks:1", X, Some(&second)).unwrap();
+    first == third
+}
+
+/// Whether two resources holding the same content share one identity.
+fn two_resources_share_an_identity(model: &mut dyn Model) -> bool {
+    let one = model.mint("tasks:1", X, None).unwrap();
+    let two = model.mint("tasks:2", X, None).unwrap();
+    one == two
+}
+
+/// Whether re-minting a child's content as a root can disturb the child.
+fn re_minting_a_child_as_a_root_disturbs_it(model: &mut dyn Model) -> bool {
+    let first = model.mint("tasks:1", X, None).unwrap();
+    let second = model.mint("tasks:1", Y, Some(&first)).unwrap();
+    let before = model.parent_of("tasks:1", &second);
+    model.mint("tasks:1", Y, None).unwrap();
+    model.parent_of("tasks:1", &second) != before
+}
+
+/// Whether a foreign parent is refused.
+fn foreign_parent_refused(model: &mut dyn Model) -> bool {
+    model.mint("tasks:1", X, Some(&"nothing:here".to_string())) == Err(MintError::UnknownParent)
+}
+
+/// Whether the history of one resource can be listed.
+fn resource_history_addressable(model: &mut dyn Model) -> bool {
+    model.mint("tasks:1", X, None).unwrap();
+    model.mint("tasks:2", Y, None).unwrap();
+    matches!(model.history_of("tasks:1"), Ok(history) if history.len() == 1)
+}
+
+/// Whether a retention policy can be *stated* — "keep the last k of this
+/// resource" — as opposed to being applied to everything at once.
+fn retention_expressible(model: &mut dyn Model) -> bool {
+    let mut previous = model.mint("tasks:1", X, None).unwrap();
+    for n in 0..4 {
+        previous = model
+            .mint("tasks:1", &format!(r#"{{"n":{n}}}"#), Some(&previous))
+            .unwrap();
+    }
+    model.retain_last("tasks:1", 2).is_ok()
+}
+
+/// Whether following parents from the newest revision terminates.
+fn topology_terminates(model: &mut dyn Model) -> bool {
+    let first = model.mint("tasks:1", X, None).unwrap();
+    let second = model.mint("tasks:1", Y, Some(&first)).unwrap();
+    let third = model.mint("tasks:1", X, Some(&second)).unwrap();
+
+    let mut seen: Vec<Rid> = Vec::new();
+    let mut current = third;
+    for _ in 0..32 {
+        if seen.contains(&current) {
+            return false;
+        }
+        seen.push(current.clone());
+        match model.parent_of("tasks:1", &current) {
+            Some(parent) => current = parent,
+            None => return true,
+        }
+    }
+    false
+}
+
+// ---------------------------------------------------------------------------
+// The decision matrix
+// ---------------------------------------------------------------------------
+
+/// One row of the matrix: a requirement, and what each model does about it.
+struct Row {
+    requirement: &'static str,
+    /// Evaluated per model, in the order A, B, C.
+    evaluate: fn(&mut dyn Model) -> bool,
+    expected: [bool; 3],
+}
+
+/// The matrix, filled by execution.
+///
+/// `expected` is what the probes actually do. Changing a probe without changing
+/// this table fails the suite.
+const MATRIX: &[Row] = &[
+    Row {
+        requirement: "the same content can recur without reusing an identity",
+        evaluate: |m| !same_content_twice(m),
+        expected: [false, true, true],
+    },
+    Row {
+        requirement: "a revert is distinguishable from the state it returns to",
+        evaluate: |m| !revert_reuses_the_original_identity(m),
+        expected: [false, true, true],
+    },
+    Row {
+        requirement: "two resources at the same value are distinguishable",
+        evaluate: |m| !two_resources_share_an_identity(m),
+        expected: [false, true, true],
+    },
+    Row {
+        requirement: "a committed revision's parent is undisturbed by later mints",
+        evaluate: |m| !re_minting_a_child_as_a_root_disturbs_it(m),
+        // A fails this for the same reason it deduplicates: parentage is not a
+        // property of a revision there, so "the parent of R" has no stable
+        // answer. See `model_a_is_sound_only_when_history_is_walked_over_edges`.
+        expected: [false, true, true],
+    },
+    Row {
+        requirement: "a parent must resolve to a held revision",
+        evaluate: foreign_parent_refused,
+        expected: [true, true, true],
+    },
+    Row {
+        requirement: "the history of one resource is addressable",
+        evaluate: resource_history_addressable,
+        expected: [true, false, true],
+    },
+    Row {
+        requirement: "a per-resource retention policy is expressible",
+        evaluate: retention_expressible,
+        expected: [true, false, true],
+    },
+    Row {
+        requirement: "following parents terminates",
+        evaluate: topology_terminates,
+        // A cycles exactly as today's implementation does, and for the same
+        // reason: resolving a parent by *identity* collapses the two occasions
+        // one state was reached.
+        expected: [false, true, true],
+    },
+];
+
+#[test]
+fn the_decision_matrix_is_exactly_this() {
+    let mut drifted = Vec::new();
+    for row in MATRIX {
+        for (index, mut model) in models().into_iter().enumerate() {
+            let actual = (row.evaluate)(model.as_mut());
+            if actual != row.expected[index] {
+                drifted.push(format!(
+                    "  {} / {}: expected {}, observed {}",
+                    row.requirement,
+                    model.name(),
+                    row.expected[index],
+                    actual
+                ));
+            }
+        }
+    }
+    assert!(
+        drifted.is_empty(),
+        "the decision matrix has drifted from the probes:\n{}\n\n\
+         Update docs/architecture/revision-model-decision.md and this table together.",
+        drifted.join("\n")
+    );
+}
+
+/// **What the matrix forces.**
+///
+/// A passes 3 of 8, B passes 6 of 8, C passes 8 of 8.
+///
+/// B fails exactly the two rows that need a resource, and no discriminator added
+/// to its identity can fix that: those rows are unanswerable because the model
+/// has no resource to name, not because its identity is too coarse. Giving B a
+/// resource dimension **is** model C.
+///
+/// A fails the three identity rows by design — a recurring state is one object
+/// referenced twice — and then fails two more as a consequence, because once
+/// identity is shared, "the parent of this revision" stops having one answer.
+/// That is not a defect in the probe; it is what moving ancestry out of the
+/// revision costs, and it is only recoverable under the discipline the next
+/// test describes.
+#[test]
+fn the_matrix_scores_a_three_b_six_c_eight() {
+    let mut scores = [0usize; 3];
+    for row in MATRIX {
+        for (index, mut model) in models().into_iter().enumerate() {
+            if (row.evaluate)(model.as_mut()) {
+                scores[index] += 1;
+            }
+        }
+    }
+    assert_eq!(scores, [3, 6, 8], "A, B, C");
+}
+
+/// **B's failures are the two rows that need a resource, and only those.**
+#[test]
+fn model_b_fails_exactly_the_resource_rows() {
+    let failed: Vec<&str> = MATRIX
+        .iter()
+        .filter(|row| !row.expected[1])
+        .map(|row| row.requirement)
+        .collect();
+    assert_eq!(
+        failed,
+        vec![
+            "the history of one resource is addressable",
+            "a per-resource retention policy is expressible",
+        ]
+    );
+}
+
+/// **Model A is sound — but only if the addressable unit of history is the
+/// edge, not the revision.**
+///
+/// The matrix shows A cycling and losing parentage when ancestry is resolved by
+/// revision identity. That is the tempting reading of "ancestry lives outside
+/// the revision", and it does not work: two occasions of one state are one
+/// identity, so the question has two answers and the walk closes a loop.
+///
+/// Walked over the *edge list* instead — where each edge is a distinct,
+/// ordered occurrence — A is well behaved: the walk strictly decreases in index
+/// and therefore terminates, and no edge is ever rewritten.
+///
+/// So A is not disqualified. It is conditional, and the condition is a real
+/// constraint on every consumer: `base` in model A is an edge lookup, and
+/// `revision.parent` does not exist.
+#[test]
+fn model_a_is_sound_only_when_history_is_walked_over_edges() {
+    let mut model = StateModel::default();
+    let first = model.mint("tasks:1", X, None).unwrap();
+    let second = model.mint("tasks:1", Y, Some(&first)).unwrap();
+    let third = model.mint("tasks:1", X, Some(&second)).unwrap();
+    assert_eq!(first, third, "one object, reached twice");
+
+    // Walk backwards over the edges of this resource, by position.
+    let positions: Vec<usize> = model
+        .edges
+        .iter()
+        .enumerate()
+        .filter(|(_, edge)| edge.resource == "tasks:1")
+        .map(|(index, _)| index)
+        .collect();
+
+    let mut walked = Vec::new();
+    let mut cursor = Some(*positions.last().unwrap());
+    while let Some(position) = cursor {
+        walked.push(model.edges[position].to.clone());
+        let from = model.edges[position].from.clone();
+        cursor = match from {
+            None => None,
+            Some(parent) => positions
+                .iter()
+                .rev()
+                .find(|candidate| **candidate < position && model.edges[**candidate].to == parent)
+                .copied(),
+        };
+        assert!(walked.len() <= 8, "the edge walk must terminate");
+    }
+
+    assert_eq!(
+        walked,
+        vec![third, second, first],
+        "three occasions, in order, from one deduplicated pair of states"
+    );
+}
+
+/// **Why A behaves that way**, stated where it cannot be missed.
+///
+/// A keeps deduplication — the only thing currently bounding storage growth —
+/// but it pays for it by moving ancestry out of the revision. A revision can no
+/// longer be asked for its parent: the question only has an answer relative to a
+/// resource, and if a state recurs on one resource it has more than one answer.
+#[test]
+fn model_a_has_no_well_formed_parent_for_a_revision() {
+    let mut model = StateModel::default();
+    let first = model.mint("tasks:1", X, None).unwrap();
+    let second = model.mint("tasks:1", Y, Some(&first)).unwrap();
+    let third = model.mint("tasks:1", X, Some(&second)).unwrap();
+    assert_eq!(first, third, "one object, reached twice");
+
+    // The same identity has two parents on one resource, depending on when.
+    let parents: Vec<Option<Rid>> = model
+        .edges
+        .iter()
+        .filter(|edge| edge.to == first)
+        .map(|edge| edge.from.clone())
+        .collect();
+    assert_eq!(
+        parents,
+        vec![None, Some(second)],
+        "'the parent of this revision' is not a well-formed question in model A"
+    );
+}