create-feltdb 0.11.8 → 0.11.9

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.11.8';
+export const FELTDB_PACKAGE_VERSION = '0.11.9';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/crates/feltdb/src/lib.rs

@@ -101,6 +101,7 @@ pub mod production_api;
 mod provenance;
 pub mod query_execution_diagnostics;
 pub mod query_performance;
+pub mod read_basis;
 mod references;
 pub mod replay_fuzzing;
 pub mod replica_acknowledgements;
@@ -674,6 +675,224 @@ impl RecordPrecondition {
     }
 }
 
+/// State a decision was read from: records by identity, and equality
+/// predicates over a collection (every record of `collection` whose fields
+/// equal these values, including records that do not exist yet).
+///
+/// Generic: it names collections, ids, fields, and values, never what they mean.
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+pub struct ReadSet {
+    #[serde(default)]
+    pub records: Vec<ReadRecord>,
+    #[serde(default)]
+    pub predicates: Vec<ReadPredicate>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ReadRecord {
+    pub collection: String,
+    pub id: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ReadPredicate {
+    pub collection: String,
+    #[serde(rename = "where")]
+    pub conditions: Vec<ReadCondition>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ReadCondition {
+    pub field: String,
+    pub eq: Value,
+}
+
+/// A read set and what the authority held for it at one moment.
+///
+/// The token is opaque and meaningful only to the authority that issued it. A
+/// transaction fenced by a basis commits only if re-reading the same set,
+/// inside the commit's lock, yields the same token.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ReadBasis {
+    pub reads: ReadSet,
+    pub token: String,
+}
+
+/// Token prefix for read bases this authority issues.
+pub const READ_BASIS_PREFIX: &str = "fr1:";
+/// Largest number of records plus predicates one read set may name.
+pub const READ_SET_LIMIT: usize = 1_000;
+
+impl ReadSet {
+    /// Validate, de-duplicate, and order, so two descriptions of the same reads
+    /// are one read set and one token.
+    pub fn normalised(&self) -> Result<ReadSet> {
+        let valid = |segment: &str| {
+            !segment.is_empty()
+                && segment.len() <= 128
+                && segment
+                    .bytes()
+                    .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+        };
+        let mut records: BTreeMap<(String, String), ReadRecord> = BTreeMap::new();
+        for record in &self.records {
+            if !valid(&record.collection) || !valid(&record.id) {
+                return Err(FlowError::CapabilityError(format!(
+                    "INVALID_READ_SET:invalid read {}:{}",
+                    record.collection, record.id
+                )));
+            }
+            records.insert(
+                (record.collection.clone(), record.id.clone()),
+                record.clone(),
+            );
+        }
+        let mut predicates: BTreeMap<(String, String), ReadPredicate> = BTreeMap::new();
+        for predicate in &self.predicates {
+            if !valid(&predicate.collection) || predicate.conditions.is_empty() {
+                return Err(FlowError::CapabilityError(format!(
+                    "INVALID_READ_SET:a predicate over {} must name at least one field",
+                    predicate.collection
+                )));
+            }
+            let mut conditions = predicate.conditions.clone();
+            if conditions
+                .iter()
+                .any(|condition| condition.field.is_empty())
+            {
+                return Err(FlowError::CapabilityError(
+                    "INVALID_READ_SET:a predicate condition requires a field".into(),
+                ));
+            }
+            conditions.sort_by(|left, right| left.field.cmp(&right.field));
+            let identity = serde_json::to_string(&conditions).unwrap_or_default();
+            predicates.insert(
+                (predicate.collection.clone(), identity),
+                ReadPredicate {
+                    collection: predicate.collection.clone(),
+                    conditions,
+                },
+            );
+        }
+        if records.is_empty() && predicates.is_empty() {
+            return Err(FlowError::CapabilityError(
+                "INVALID_READ_SET:a read set that names nothing fences nothing".into(),
+            ));
+        }
+        if records.len() + predicates.len() > READ_SET_LIMIT {
+            return Err(FlowError::CapabilityError(format!(
+                "INVALID_READ_SET:a read set may name at most {READ_SET_LIMIT} records and predicates"
+            )));
+        }
+        Ok(ReadSet {
+            records: records.into_values().collect(),
+            predicates: predicates.into_values().collect(),
+        })
+    }
+}
+
+/// Where a read set's logical collections and ids live in storage.
+///
+/// One read set, one token semantics; only the storage addressing differs
+/// between the routes that commit transactions.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ReadLayout {
+    /// The direct transaction route: rows under `collection`, keyed `collection:id`.
+    Direct,
+    /// An application state namespace: rows under `namespace:collection`, keyed by id.
+    Namespace(String),
+}
+
+impl ReadLayout {
+    fn capability(&self, collection: &str) -> String {
+        match self {
+            Self::Direct => collection.to_string(),
+            Self::Namespace(namespace) => format!("{namespace}:{collection}"),
+        }
+    }
+
+    fn key(&self, collection: &str, id: &str) -> String {
+        match self {
+            Self::Direct => format!("{collection}:{id}"),
+            Self::Namespace(_) => id.to_string(),
+        }
+    }
+
+    /// The authority scope a token is valid in. A token is never evaluated in
+    /// another scope: it is refused as invalid there, not compared.
+    fn scope_tag(&self) -> String {
+        match self {
+            Self::Direct => "d".into(),
+            Self::Namespace(namespace) => {
+                let digest = format!(
+                    "{:x}",
+                    Sha256::digest(format!("namespace\0{namespace}").as_bytes())
+                );
+                format!("n{}", &digest[..16])
+            }
+        }
+    }
+
+    fn token_prefix(&self) -> String {
+        format!("{READ_BASIS_PREFIX}{}:", self.scope_tag())
+    }
+}
+
+/// What the state a read set names is, now, as one token. Rows are read in
+/// full; tombstoned rows are absent; only the named records and the named
+/// collections' matching rows are read.
+fn read_basis_token(
+    rows: &HashMap<String, BTreeMap<String, StoredRow>>,
+    reads: &ReadSet,
+    layout: &ReadLayout,
+) -> String {
+    let live = |capability: &str, key: &str| {
+        rows.get(capability)
+            .and_then(|bucket| bucket.get(key))
+            .filter(|row| !row.deleted)
+            .map(|row| row.value.clone())
+    };
+    let records: Vec<Value> = reads
+        .records
+        .iter()
+        .map(|record| {
+            let value = live(
+                &layout.capability(&record.collection),
+                &layout.key(&record.collection, &record.id),
+            );
+            serde_json::json!([record.collection, record.id, value])
+        })
+        .collect();
+    let predicates: Vec<Value> = reads
+        .predicates
+        .iter()
+        .map(|predicate| {
+            let matching: Vec<Value> = rows
+                .get(&layout.capability(&predicate.collection))
+                .map(|bucket| {
+                    bucket
+                        .iter()
+                        .filter(|(_, row)| !row.deleted)
+                        .filter(|(_, row)| {
+                            predicate.conditions.iter().all(|condition| {
+                                row.value.get(&condition.field) == Some(&condition.eq)
+                            })
+                        })
+                        .map(|(key, row)| serde_json::json!([key, row.value]))
+                        .collect()
+                })
+                .unwrap_or_default();
+            serde_json::json!([predicate.collection, predicate.conditions, matching])
+        })
+        .collect();
+    let observed = serde_json::json!({ "records": records, "predicates": predicates });
+    format!(
+        "{}{:x}",
+        layout.token_prefix(),
+        Sha256::digest(serde_json::to_vec(&observed).unwrap_or_default())
+    )
+}
+
 /// Which predicate failed, and what the authority actually holds.
 ///
 /// Structured rather than a formatted string, because the caller has to tell a
@@ -704,6 +923,18 @@ pub enum PreconditionFailure {
         expected: String,
         actual: Option<String>,
     },
+    /// State named by a read basis changed after the basis was read.
+    ///
+    /// The tokens are kept for diagnostics inside the authority but never
+    /// serialized: a refusal says that the basis changed, not what it digests.
+    Fence {
+        collection: String,
+        key: String,
+        #[serde(skip_serializing, default)]
+        expected: String,
+        #[serde(skip_serializing, default)]
+        actual: String,
+    },
 }
 
 impl PreconditionFailure {
@@ -713,7 +944,8 @@ impl PreconditionFailure {
             | Self::Missing { collection, .. }
             | Self::Version { collection, .. }
             | Self::Epoch { collection, .. }
-            | Self::Lease { collection, .. } => collection,
+            | Self::Lease { collection, .. }
+            | Self::Fence { collection, .. } => collection,
         }
     }
     /// The storage key, which is namespaced as `collection:id`.
@@ -723,7 +955,8 @@ impl PreconditionFailure {
             | Self::Missing { key, .. }
             | Self::Version { key, .. }
             | Self::Epoch { key, .. }
-            | Self::Lease { key, .. } => key,
+            | Self::Lease { key, .. }
+            | Self::Fence { key, .. } => key,
         }
     }
 }
@@ -762,6 +995,10 @@ impl Display for PreconditionFailure {
                 f,
                 "{collection}/{key} holds lease {actual:?}, expected {expected}"
             ),
+            Self::Fence { collection, .. } => write!(
+                f,
+                "state read by this transaction has changed (read basis over {collection})"
+            ),
         }
     }
 }
@@ -2863,6 +3100,7 @@ impl FeltDb {
     /// the same id once it has re-read state, and a caller that wants the
     /// retry to be a distinct decision may use a new one. Both work; the choice
     /// is the caller's and is asserted in the tests rather than left implied.
+    #[allow(clippy::too_many_arguments)]
     pub fn apply_atomic_transaction_guarded(
         &self,
         transaction_id: &str,
@@ -2872,6 +3110,78 @@ impl FeltDb {
         record_preconditions: &[RecordPrecondition],
         mutations: &[AtomicMutation],
         audit: Option<Value>,
+    ) -> Result<AtomicCommit> {
+        self.apply_atomic_transaction_fenced(
+            transaction_id,
+            payload_hash,
+            expected_parent,
+            preconditions,
+            record_preconditions,
+            &[],
+            mutations,
+            audit,
+        )
+    }
+
+    /// Capture a read basis on the direct route, under the same lock every commit takes.
+    pub fn read_basis(&self, reads: &ReadSet) -> Result<ReadBasis> {
+        self.read_basis_in(reads, &ReadLayout::Direct)
+    }
+
+    /// Capture a read basis in a storage layout, under the same lock every commit takes.
+    pub fn read_basis_in(&self, reads: &ReadSet, layout: &ReadLayout) -> Result<ReadBasis> {
+        let reads = reads.normalised()?;
+        let inner = self.state();
+        let token = read_basis_token(&inner.rows, &reads, layout);
+        Ok(ReadBasis { reads, token })
+    }
+
+    /// `apply_atomic_transaction_guarded`, additionally fenced by read bases.
+    ///
+    /// Each basis is re-evaluated inside the same lock as the writes, after the
+    /// record preconditions and before anything is staged. If the state it
+    /// names differs from what was read -- whichever write path changed it --
+    /// the transaction fails with `PreconditionFailed(Fence)` and applies
+    /// nothing. State outside every basis is never read and never conflicts.
+    #[allow(clippy::too_many_arguments)]
+    pub fn apply_atomic_transaction_fenced(
+        &self,
+        transaction_id: &str,
+        payload_hash: Option<&str>,
+        expected_parent: Option<u64>,
+        preconditions: &[AtomicPrecondition],
+        record_preconditions: &[RecordPrecondition],
+        fences: &[ReadBasis],
+        mutations: &[AtomicMutation],
+        audit: Option<Value>,
+    ) -> Result<AtomicCommit> {
+        self.apply_atomic_transaction_fenced_in(
+            transaction_id,
+            payload_hash,
+            expected_parent,
+            preconditions,
+            record_preconditions,
+            &ReadLayout::Direct,
+            fences,
+            mutations,
+            audit,
+        )
+    }
+
+    /// `apply_atomic_transaction_fenced`, with the read bases addressed in
+    /// `layout`. The same evaluation, inside the same lock, for every route.
+    #[allow(clippy::too_many_arguments)]
+    pub fn apply_atomic_transaction_fenced_in(
+        &self,
+        transaction_id: &str,
+        payload_hash: Option<&str>,
+        expected_parent: Option<u64>,
+        preconditions: &[AtomicPrecondition],
+        record_preconditions: &[RecordPrecondition],
+        layout: &ReadLayout,
+        fences: &[ReadBasis],
+        mutations: &[AtomicMutation],
+        audit: Option<Value>,
     ) -> Result<AtomicCommit> {
         let (commit, events) = {
             let mut inner = self.state();
@@ -3004,6 +3314,38 @@ impl FeltDb {
                 }
             }
 
+            for fence in fences {
+                if !fence.token.starts_with(&layout.token_prefix()) {
+                    return Err(FlowError::CapabilityError(
+                        "INVALID_READ_SET:a read basis was not issued by this authority scope"
+                            .into(),
+                    ));
+                }
+                let reads = fence.reads.normalised()?;
+                let actual = read_basis_token(&inner.rows, &reads, layout);
+                if actual != fence.token {
+                    let collection = reads
+                        .records
+                        .first()
+                        .map(|record| record.collection.clone())
+                        .or_else(|| {
+                            reads
+                                .predicates
+                                .first()
+                                .map(|predicate| predicate.collection.clone())
+                        })
+                        .unwrap_or_default();
+                    return Err(FlowError::PreconditionFailed(Box::new(
+                        PreconditionFailure::Fence {
+                            collection,
+                            key: "read-basis".into(),
+                            expected: fence.token.clone(),
+                            actual,
+                        },
+                    )));
+                }
+            }
+
             // Every precondition held. The authority owns both ends of the
             // public document-version lifecycle inside this lock:
             //
@@ -3977,6 +4319,24 @@ impl FeltDb {
             .cloned())
     }
 
+    /// Fetch several live collection records without materializing collection state.
+    pub fn get_collection_records<'a>(
+        &self,
+        capability: &str,
+        keys: impl IntoIterator<Item = &'a str>,
+    ) -> Result<Vec<StoredRow>> {
+        let inner = self.state();
+        let Some(rows) = inner.rows.get(capability) else {
+            return Ok(Vec::new());
+        };
+        Ok(keys
+            .into_iter()
+            .filter_map(|key| rows.get(key))
+            .filter(|row| !row.deleted)
+            .cloned()
+            .collect())
+    }
+
     /// Subscribe to canonical mutation events.
     pub fn subscribe_changes(&self) -> broadcast::Receiver<ChangeEvent> {
         self.event_tx.subscribe()
@@ -4065,6 +4425,7 @@ impl FeltDb {
     /// Selecting the capability buckets before cloning prevents one application's
     /// read snapshot from materializing every other application's durable rows.
     pub fn state_rows_for_namespace(&self, state_namespace: &str) -> Result<Vec<StoredRow>> {
+        let _span = workload_diagnostics::span(workload_diagnostics::Phase::NamespaceSnapshot);
         let inner = self.state();
         let prefix = format!("{state_namespace}:");
         Ok(inner

package/dist/server-source/crates/feltdb/src/read_basis.rs

@@ -0,0 +1,257 @@
+//! Read-basis fences: commit only if the state a decision read is unchanged.
+//!
+//! ```text
+//!     basis = read_basis(records, predicates)       -- one token, under the lock
+//!     ... decide ...
+//!     commit fenced by basis                        -- re-read under the commit lock
+//!         unchanged  ->  commit
+//!         changed    ->  PreconditionFailed(Fence), ZERO writes
+//! ```
+//!
+//! The fence reads stored rows, not bookkeeping a writer maintains, so it holds
+//! whichever write path changed them. Only the named records and the named
+//! collections' matching rows are read: everything else is outside the fence
+//! and never conflicts.
+
+#[cfg(test)]
+mod tests {
+    use crate::{
+        AtomicMutation, FeltDb, FlowError, PreconditionFailure, ReadBasis, ReadCondition,
+        ReadLayout, ReadPredicate, ReadRecord, ReadSet,
+    };
+    use serde_json::json;
+    use tempfile::TempDir;
+
+    fn db(dir: &TempDir) -> FeltDb {
+        FeltDb::open(dir.path().join("app.log")).expect("open")
+    }
+
+    fn set(collection: &str, id: &str, value: serde_json::Value) -> AtomicMutation {
+        AtomicMutation {
+            capability: collection.to_string(),
+            key: format!("{collection}:{id}"),
+            value: Some(value),
+        }
+    }
+
+    fn delete(collection: &str, id: &str) -> AtomicMutation {
+        AtomicMutation {
+            capability: collection.to_string(),
+            key: format!("{collection}:{id}"),
+            value: None,
+        }
+    }
+
+    fn write(db: &FeltDb, id: &str, mutations: &[AtomicMutation]) {
+        db.apply_atomic_transaction(id, None, &[], mutations, None)
+            .expect("write commits");
+    }
+
+    fn reads() -> ReadSet {
+        ReadSet {
+            records: vec![ReadRecord {
+                collection: "A".into(),
+                id: "a1".into(),
+            }],
+            predicates: vec![ReadPredicate {
+                collection: "B".into(),
+                conditions: vec![ReadCondition {
+                    field: "a".into(),
+                    eq: json!("a1"),
+                }],
+            }],
+        }
+    }
+
+    fn seed(db: &FeltDb) {
+        write(
+            db,
+            "seed",
+            &[
+                set("A", "a1", json!({ "id": "a1", "n": 1 })),
+                set("B", "b1", json!({ "id": "b1", "a": "a1" })),
+                set("B", "b2", json!({ "id": "b2", "a": "a2" })),
+            ],
+        );
+    }
+
+    fn fenced(db: &FeltDb, id: &str, basis: &ReadBasis) -> Result<crate::AtomicCommit, FlowError> {
+        db.apply_atomic_transaction_fenced(
+            id,
+            None,
+            None,
+            &[],
+            &[],
+            std::slice::from_ref(basis),
+            &[set("Z", id, json!({ "id": id }))],
+            None,
+        )
+    }
+
+    fn is_fence_conflict(result: Result<crate::AtomicCommit, FlowError>) -> bool {
+        matches!(result, Err(FlowError::PreconditionFailed(failure)) if matches!(*failure, PreconditionFailure::Fence { .. }))
+    }
+
+    #[test]
+    fn an_unchanged_basis_commits_and_a_changed_one_commits_nothing() {
+        let dir = TempDir::new().unwrap();
+        let db = db(&dir);
+        seed(&db);
+        let basis = db.read_basis(&reads()).unwrap();
+        assert!(fenced(&db, "z1", &basis).is_ok());
+        write(&db, "raw", &[set("A", "a1", json!({ "id": "a1", "n": 2 }))]);
+        assert!(is_fence_conflict(fenced(&db, "z2", &basis)));
+        assert!(
+            db.get_value("Z:z2").unwrap().is_none(),
+            "a refused transaction writes nothing"
+        );
+    }
+
+    #[test]
+    fn records_entering_or_leaving_a_predicate_conflict_and_others_do_not() {
+        let dir = TempDir::new().unwrap();
+        let db = db(&dir);
+        seed(&db);
+        let basis = db.read_basis(&reads()).unwrap();
+        write(
+            &db,
+            "outside",
+            &[
+                set("B", "b3", json!({ "id": "b3", "a": "a9" })),
+                set("C", "c1", json!({ "id": "c1" })),
+            ],
+        );
+        assert!(
+            fenced(&db, "z1", &basis).is_ok(),
+            "writes outside the read set never conflict"
+        );
+
+        write(
+            &db,
+            "enter",
+            &[set("B", "b4", json!({ "id": "b4", "a": "a1" }))],
+        );
+        assert!(is_fence_conflict(fenced(&db, "z2", &basis)));
+
+        let basis = db.read_basis(&reads()).unwrap();
+        write(
+            &db,
+            "leave",
+            &[set("B", "b1", json!({ "id": "b1", "a": "a2" }))],
+        );
+        assert!(is_fence_conflict(fenced(&db, "z3", &basis)));
+    }
+
+    #[test]
+    fn delete_and_recreate_with_different_content_conflicts() {
+        let dir = TempDir::new().unwrap();
+        let db = db(&dir);
+        seed(&db);
+        let basis = db.read_basis(&reads()).unwrap();
+        write(&db, "delete", &[delete("A", "a1")]);
+        write(
+            &db,
+            "recreate",
+            &[set("A", "a1", json!({ "id": "a1", "n": 7 }))],
+        );
+        assert!(is_fence_conflict(fenced(&db, "z1", &basis)));
+    }
+
+    #[test]
+    fn tokens_are_deterministic_and_survive_restart() {
+        let dir = TempDir::new().unwrap();
+        let basis = {
+            let db = db(&dir);
+            seed(&db);
+            let first = db.read_basis(&reads()).unwrap();
+            let mut shuffled = reads();
+            shuffled.records.push(ReadRecord {
+                collection: "A".into(),
+                id: "a1".into(),
+            });
+            assert_eq!(
+                first,
+                db.read_basis(&shuffled).unwrap(),
+                "normalised: duplicates do not matter"
+            );
+            first
+        };
+        let db = db(&dir);
+        assert_eq!(db.read_basis(&reads()).unwrap().token, basis.token);
+        assert!(fenced(&db, "z1", &basis).is_ok());
+    }
+
+    #[test]
+    fn invalid_and_foreign_bases_are_refused_as_invalid_not_as_conflicts() {
+        let dir = TempDir::new().unwrap();
+        let db = db(&dir);
+        seed(&db);
+        assert!(db.read_basis(&ReadSet::default()).is_err());
+        let mut foreign = db.read_basis(&reads()).unwrap();
+        foreign.token = format!("fb1:{}", "0".repeat(64));
+        let result = fenced(&db, "z1", &foreign);
+        assert!(
+            matches!(result, Err(FlowError::CapabilityError(ref message)) if message.starts_with("INVALID_READ_SET:"))
+        );
+    }
+
+    #[test]
+    fn namespace_bases_read_namespace_rows_and_are_scoped_to_their_namespace() {
+        let dir = TempDir::new().unwrap();
+        let db = db(&dir);
+        let ns = ReadLayout::Namespace("tenant-a".into());
+        let row = |collection: &str, id: &str, value: serde_json::Value| AtomicMutation {
+            capability: format!("tenant-a:{collection}"),
+            key: id.to_string(),
+            value: Some(value),
+        };
+        write(
+            &db,
+            "seed",
+            &[
+                row("A", "a1", json!({ "id": "a1", "n": 1 })),
+                row("B", "b1", json!({ "id": "b1", "a": "a1" })),
+            ],
+        );
+        let basis = db.read_basis_in(&reads(), &ns).unwrap();
+        assert!(basis.token.starts_with(&ns.token_prefix()));
+        let commit = |id: &str, layout: &ReadLayout, basis: &ReadBasis| {
+            db.apply_atomic_transaction_fenced_in(
+                id,
+                None,
+                None,
+                &[],
+                &[],
+                layout,
+                std::slice::from_ref(basis),
+                &[row("Z", id, json!({ "id": id }))],
+                None,
+            )
+        };
+        let invalid = |result: Result<crate::AtomicCommit, FlowError>| matches!(result, Err(FlowError::CapabilityError(ref message)) if message.starts_with("INVALID_READ_SET:"));
+        // A token from another scope is invalid, never compared.
+        assert!(invalid(commit("z0", &ReadLayout::Direct, &basis)));
+        assert!(invalid(commit(
+            "z0",
+            &ReadLayout::Namespace("tenant-b".into()),
+            &basis
+        )));
+        let direct = db.read_basis(&reads()).unwrap();
+        assert!(invalid(commit("z0", &ns, &direct)));
+        // Direct-layout writes to the same names are outside the namespace.
+        write(
+            &db,
+            "direct",
+            &[set("A", "a1", json!({ "id": "a1", "n": 9 }))],
+        );
+        assert!(commit("z1", &ns, &basis).is_ok());
+        // A namespace write the basis read refuses the commit.
+        write(
+            &db,
+            "raw",
+            &[row("B", "b9", json!({ "id": "b9", "a": "a1" }))],
+        );
+        let result = commit("z2", &ns, &basis);
+        assert!(is_fence_conflict(result));
+    }
+}