didbot_repo/

repository.rs

//! A repository: records, the tree over them, and the commit that signs it.

use std::collections::{BTreeMap, BTreeSet};
use std::ops::Bound;

use didbot_data::mst::{Rewritten, Tree};
use didbot_data::{dag_cbor, Cid, DataError, Value};
use didbot_key::SigningKey;

use crate::car;
use crate::commit::{Commit, SignedCommit, REPO_VERSION};

/// The key a record sits at in the tree.
///
/// atproto keys a repository by `<collection>/<rkey>` and nothing else — not
/// by the DID, which the commit already carries, and not by anything the
/// server chooses. It is one line, and it is here rather than inlined at both
/// call sites because a repository whose keys are built two ways is a
/// repository with two roots.
#[must_use]
pub fn tree_key(collection: &str, rkey: &str) -> String {
    format!("{collection}/{rkey}")
}

/// Why a repository could not be assembled.
#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
pub enum RepoError {
    /// A record held something the data model has no encoding for.
    ///
    /// Reachable only for a record that reached storage without going through
    /// the write path's validation — the lexicon check refuses floats and
    /// malformed blobs long before this. It is an error rather than a panic
    /// because an export must be able to say *which* record it could not
    /// name, so somebody can go and look at it.
    #[error("`{key}` cannot be encoded: {source}")]
    Record {
        /// The tree key of the offending record.
        key: String,
        /// What the data model refused.
        source: DataError,
    },
}

/// A repository under construction.
///
/// Records go in, and a signature turns the result into something a stranger
/// can check. This builds the whole tree from every record at once. A
/// repository already signed is changed one record at a time through
/// [`Repository::draft`] instead, which lands on the same tree.
#[derive(Debug, Default)]
pub struct Builder {
    leaves: BTreeMap<String, Cid>,
    blocks: BTreeMap<Cid, Vec<u8>>,
}

impl Builder {
    /// A repository with no records in it.
    #[must_use]
    pub fn new() -> Self {
        Self::default()
    }

    /// Adds one record, returning the CID that now names it.
    ///
    /// This is where a record stops being JSON a server happens to hold and
    /// becomes a block with an identity: the CID is the sha-256 of the one
    /// canonical DAG-CBOR encoding of it, and it is the value the tree
    /// keys on and the commit ultimately signs over.
    pub fn insert(
        &mut self,
        collection: &str,
        rkey: &str,
        record: &serde_json::Value,
    ) -> Result<Cid, RepoError> {
        let (key, cid, block) = encode(collection, rkey, record)?;
        self.blocks.insert(cid.clone(), block);
        self.leaves.insert(key, cid.clone());
        Ok(cid)
    }

    /// How many records are in it.
    #[must_use]
    pub fn len(&self) -> usize {
        self.leaves.len()
    }

    /// Whether it holds no records. An empty repository is a real one.
    #[must_use]
    pub fn is_empty(&self) -> bool {
        self.leaves.is_empty()
    }

    /// Builds the tree, writes the commit and signs it.
    ///
    /// `rev` is the caller's, because this crate has no clock and no TID
    /// minter; `prev` is the commit this replaces, which is `None` for a
    /// server that does not keep a commit history.
    #[must_use]
    pub fn commit(self, did: &str, rev: &str, prev: Option<Cid>, key: &SigningKey) -> Repository {
        let tree = Tree::build(&self.leaves);
        let commit = sign(did, &tree, rev, prev, key);
        let mut records: BTreeMap<Cid, Held> = BTreeMap::new();
        for cid in self.leaves.values() {
            if let Some(held) = records.get_mut(cid) {
                held.keys += 1;
            } else if let Some(bytes) = self.blocks.get(cid) {
                records.insert(
                    cid.clone(),
                    Held {
                        bytes: bytes.clone(),
                        keys: 1,
                    },
                );
            }
        }
        Repository {
            commit,
            tree,
            records,
            leaves: self.leaves,
        }
    }
}

/// Encodes a record, answering its tree key, its CID and its block.
///
/// This is where a record stops being JSON a server happens to hold and
/// becomes a block with an identity: the CID is the sha-256 of the one
/// canonical DAG-CBOR encoding of it.
fn encode(
    collection: &str,
    rkey: &str,
    record: &serde_json::Value,
) -> Result<(String, Cid, Vec<u8>), RepoError> {
    let key = tree_key(collection, rkey);
    let value = Value::object_from_json(record).map_err(|source| RepoError::Record {
        key: key.clone(),
        source,
    })?;
    let block = dag_cbor::encode(&value);
    let cid = Cid::of_dag_cbor(&block);
    Ok((key, cid, block))
}

/// Writes and signs the commit over a tree.
fn sign(did: &str, tree: &Tree, rev: &str, prev: Option<Cid>, key: &SigningKey) -> SignedCommit {
    Commit {
        did: did.to_owned(),
        version: REPO_VERSION,
        data: tree.root().clone(),
        rev: rev.to_owned(),
        prev,
    }
    .sign(key)
}

/// A record block, and how many keys name it.
///
/// Two keys holding the same record name one block. Counting them is what
/// lets a removal tell whether the block goes with the key.
#[derive(Debug, Clone)]
struct Held {
    bytes: Vec<u8>,
    keys: usize,
}

/// A signed repository, ready to be handed to somebody who does not trust us.
#[derive(Debug, Clone)]
pub struct Repository {
    commit: SignedCommit,
    /// The tree, kept rather than flattened into blocks, because a proof is a
    /// walk through it and a walk needs the nodes.
    tree: Tree,
    /// The record blocks, keyed by CID. Tree nodes are the tree's.
    records: BTreeMap<Cid, Held>,
    /// Every record's tree key and the CID it names.
    leaves: BTreeMap<String, Cid>,
}

/// The blocks that prove what a repository says about one key.
///
/// A commit block, the Merkle search tree nodes from the root down to where
/// the key sits, and the record itself when there is one. That is all, and
/// the "that is all" is the point: a verifier that is handed every block in
/// the repository has been given an export, and an export is not a proof of
/// anything in particular.
///
/// # What a verifier does with it
///
/// 1. Resolves the DID and takes the public key out of its document.
/// 2. Checks the commit block's signature with it, which fixes `data` — the
///    root of the tree the account signed over — as a fact rather than as
///    this server's word.
/// 3. Walks: hashes the first node block, requires it to be `data`, decodes
///    it, finds which entry range `<collection>/<rkey>` falls in, and follows
///    that link to the next block. A block that hashes to something the
///    parent did not name is not on the path.
/// 4. At the end, either the key is an entry — and its `v` is the CID of a
///    record block that is also in the file — or it is not, and the key is
///    provably not in the repository.
///
/// Every one of those steps fails closed. A missing node breaks step 3, a
/// node lifted from another tree fails the hash comparison in step 3, and a
/// substituted record fails the CID comparison in step 4.
#[derive(Debug, Clone)]
pub struct Proof {
    root: Cid,
    key: String,
    value: Option<Cid>,
    blocks: BTreeMap<Cid, Vec<u8>>,
    nodes: Vec<Cid>,
}

impl Proof {
    /// The commit this proof is against, which is the CAR export's root.
    #[must_use]
    pub fn root(&self) -> &Cid {
        &self.root
    }

    /// The tree key the proof is about, `<collection>/<rkey>`.
    #[must_use]
    pub fn key(&self) -> &str {
        &self.key
    }

    /// The record the key names, or `None` when the proof is of absence.
    #[must_use]
    pub fn record(&self) -> Option<&Cid> {
        self.value.as_ref()
    }

    /// The tree nodes walked, root first.
    #[must_use]
    pub fn nodes(&self) -> &[Cid] {
        &self.nodes
    }

    /// Every block in the proof, keyed by CID.
    #[must_use]
    pub fn blocks(&self) -> &BTreeMap<Cid, Vec<u8>> {
        &self.blocks
    }

    /// The proof as a CARv1 file, rooted at the commit.
    ///
    /// The same container `com.atproto.sync.getRepo` returns, holding a
    /// different set of blocks — which is exactly what upstream's
    /// `getRecord` does, and why a client can point one CAR reader at both.
    #[must_use]
    pub fn to_car(&self) -> Vec<u8> {
        car::write(
            &self.root,
            self.blocks
                .iter()
                .map(|(cid, block)| (cid.clone(), block.clone())),
        )
    }
}

impl Repository {
    /// The signed commit at the top of it.
    #[must_use]
    pub fn commit(&self) -> &SignedCommit {
        &self.commit
    }

    /// The CID of the commit, which is a CAR export's root.
    #[must_use]
    pub fn root(&self) -> Cid {
        self.commit.cid()
    }

    /// The revision this repository committed at.
    #[must_use]
    pub fn rev(&self) -> &str {
        &self.commit.commit().rev
    }

    /// How many records it holds.
    #[must_use]
    pub fn records(&self) -> usize {
        self.leaves.len()
    }

    /// The CID a record is filed under, if the repository holds it.
    #[must_use]
    pub fn record_cid(&self, collection: &str, rkey: &str) -> Option<&Cid> {
        self.leaves.get(&tree_key(collection, rkey))
    }

    /// One block by CID: the commit, a tree node, or a record.
    ///
    /// The three are searched in that order, which is arbitrary — a CID names
    /// exactly one of them or none.
    #[must_use]
    pub fn block(&self, cid: &Cid) -> Option<Vec<u8>> {
        if cid == &self.root() {
            return Some(self.commit.block());
        }
        self.stored(cid).cloned()
    }

    /// A tree node or a record block by CID, without the commit.
    fn stored(&self, cid: &Cid) -> Option<&Vec<u8>> {
        self.tree
            .blocks()
            .get(cid)
            .or_else(|| self.records.get(cid).map(|held| &held.bytes))
    }

    /// The blocks that prove what this repository says about one record.
    ///
    /// Answers for a key the repository does not hold too: see [`Proof`],
    /// where the difference between the two answers is one field.
    #[must_use]
    pub fn proof(&self, collection: &str, rkey: &str) -> Proof {
        let key = tree_key(collection, rkey);
        let path = self.tree.path(&key);
        let mut blocks = BTreeMap::new();
        let root = self.root();
        blocks.insert(root.clone(), self.commit.block());
        for cid in &path.nodes {
            if let Some(block) = self.tree.blocks().get(cid) {
                blocks.insert(cid.clone(), block.clone());
            }
        }
        if let Some(value) = &path.value {
            if let Some(held) = self.records.get(value) {
                blocks.insert(value.clone(), held.bytes.clone());
            }
        }
        Proof {
            root,
            key,
            value: path.value,
            blocks,
            nodes: path.nodes,
        }
    }

    /// The Merkle search tree blocks that cover every key in `keys`, over the
    /// tree as this repository now stands.
    ///
    /// The union of [`Tree::covering_proof`] over each key — not just its
    /// own path, but the paths to its neighbours either side, because a
    /// split or merge moves nodes on both. A caller that touched several
    /// keys in one commit (`com.atproto.repo.applyWrites`) unions their
    /// proofs here rather than calling the tree once per key and merging
    /// itself.
    ///
    /// This is what a `com.atproto.sync.subscribeRepos#commit` frame's
    /// blocks are built from: a relay holds no previous state to walk a
    /// created-only diff against, so it needs enough of the tree to invert
    /// the operations back to `prevData` starting from nothing. See
    /// `docs/conformance.md`.
    ///
    /// Each key's neighbours are found in the repository's own index of
    /// keys, so this walks three paths per key and nothing else.
    #[must_use]
    pub fn covering_proof(&self, keys: &BTreeSet<String>) -> BTreeMap<Cid, Vec<u8>> {
        let mut proof = BTreeMap::new();
        for key in keys {
            let before = self
                .leaves
                .range::<str, _>((Bound::Unbounded, Bound::Excluded(key.as_str())))
                .next_back()
                .map(|(held, _)| held.as_str());
            let after = self
                .leaves
                .range::<str, _>((Bound::Excluded(key.as_str()), Bound::Unbounded))
                .next()
                .map(|(held, _)| held.as_str());
            proof.extend(self.tree.covering_proof_between(key, before, after));
        }
        proof
    }

    /// How many Merkle search tree nodes it took to key them.
    ///
    /// An operator-facing number, and the cheapest signal that the tree is
    /// doing something: a repository whose node count tracks its record count
    /// one for one has a broken height function.
    #[must_use]
    pub fn nodes(&self) -> usize {
        self.tree.len()
    }

    /// Every block in the repository, named.
    ///
    /// The commit, every tree node and every record, which is exactly what
    /// [`Self::to_car`] writes. It exists for a caller keeping a history: the
    /// difference between two repositories' block sets is the set a commit
    /// created, and a caller that has one repository and the CIDs another one
    /// held can work out what to send without either party holding both.
    #[must_use]
    pub fn block_cids(&self) -> BTreeSet<Cid> {
        std::iter::once(self.root())
            .chain(self.tree.blocks().keys().cloned())
            .chain(self.records.keys().cloned())
            .collect()
    }

    /// The whole repository as a CARv1 file.
    ///
    /// Commit first, then the tree nodes and the records in CID order. The
    /// order carries no meaning to a reader — it walks from the root by
    /// following links — but it is fixed, so two exports of the same state
    /// are byte-identical.
    #[must_use]
    pub fn to_car(&self) -> Vec<u8> {
        self.car(|_| true)
    }

    /// The repository as a CARv1 file carrying only the blocks a reader lacks.
    ///
    /// `held` is what the reader is known to have already. The root is the
    /// current commit either way, so a reader walks from the same place; what
    /// changes is how much of the walk it can do out of the file alone.
    ///
    /// The commit block is always written, even when `held` names it. A CAR
    /// whose root is not in it is legal and every reader here can follow one,
    /// but a file that declares a root and then omits it is the kind of
    /// answer that makes a caller wonder whether the transfer failed, and one
    /// block is not worth the doubt.
    ///
    /// Ordering matches [`Self::to_car`]'s, so a diff and a full export agree
    /// about the blocks they have in common.
    #[must_use]
    pub fn to_car_without(&self, held: &BTreeSet<Cid>) -> Vec<u8> {
        self.car(|cid| !held.contains(cid))
    }

    /// The repository as a CARv1 file carrying the commit and the blocks in
    /// `wanted` that it holds.
    ///
    /// The same file [`Self::to_car_without`] writes when `held` is every
    /// other block. This looks each wanted block up rather than walking every
    /// block the repository holds, which is what makes it the one a firehose
    /// frame is written with.
    #[must_use]
    pub fn to_car_with(&self, wanted: &BTreeSet<Cid>) -> Vec<u8> {
        let commit_block = self.commit.block();
        let root = Cid::of_dag_cbor(&commit_block);
        let blocks = wanted
            .iter()
            .filter(|cid| **cid != root)
            .filter_map(|cid| Some((cid.clone(), self.stored(cid)?.clone())));
        car::write(
            &root,
            std::iter::once((root.clone(), commit_block)).chain(blocks),
        )
    }

    /// Opens this repository to be changed one record at a time.
    ///
    /// See [`Draft`]. The repository is moved into the draft, so a caller
    /// sharing it clones it first.
    #[must_use]
    pub fn draft(self) -> Draft {
        Draft {
            repository: self,
            rewritten: Rewritten::default(),
        }
    }

    /// Writes a CAR of the blocks `wanted` accepts, plus the commit.
    fn car(&self, wanted: impl Fn(&Cid) -> bool) -> Vec<u8> {
        let commit_block = self.commit.block();
        let root = Cid::of_dag_cbor(&commit_block);
        let mut blocks: BTreeMap<Cid, Vec<u8>> = self.tree.blocks().clone();
        blocks.extend(
            self.records
                .iter()
                .map(|(cid, held)| (cid.clone(), held.bytes.clone())),
        );
        let blocks = std::iter::once((root.clone(), commit_block))
            .chain(blocks.into_iter().filter(|(cid, _)| wanted(cid)));
        car::write(&root, blocks)
    }
}

/// A signed repository being changed, one record at a time, into its next
/// commit.
///
/// Each change edits the tree in place with [`Tree::insert`] or
/// [`Tree::remove`], and [`Draft::commit`] signs the result. The repository
/// that comes out is the one a [`Builder`] makes from the same records under
/// the same revision: the same tree, the same record blocks and the same
/// signed commit.
///
/// Alongside it comes what the commit changed about the blocks the
/// repository holds, measured against the commit the draft was opened at.
/// That is what a firehose frame and a `since` diff are made of, and working
/// it out here costs only the blocks that moved.
#[derive(Debug)]
pub struct Draft {
    repository: Repository,
    rewritten: Rewritten,
}

impl Draft {
    /// Puts a record at `collection`/`rkey`, replacing whatever was there,
    /// and answers the CID that now names it.
    ///
    /// Fails for a record the data model cannot encode, as
    /// [`Builder::insert`] does. The draft is then left part way through a
    /// change, and the caller drops it.
    pub fn insert(
        &mut self,
        collection: &str,
        rkey: &str,
        record: &serde_json::Value,
    ) -> Result<Cid, RepoError> {
        let (key, cid, block) = encode(collection, rkey, record)?;
        match self.repository.leaves.insert(key.clone(), cid.clone()) {
            Some(old) if old == cid => return Ok(cid),
            Some(old) => self.release(&old),
            None => {}
        }
        if let Some(held) = self.repository.records.get_mut(&cid) {
            held.keys += 1;
        } else {
            self.repository.records.insert(
                cid.clone(),
                Held {
                    bytes: block,
                    keys: 1,
                },
            );
            self.rewritten.then(Rewritten {
                created: BTreeSet::from([cid.clone()]),
                removed: BTreeSet::new(),
            });
        }
        let rewritten = self.repository.tree.insert(&key, cid.clone());
        self.rewritten.then(rewritten);
        Ok(cid)
    }

    /// Takes the record at `collection`/`rkey` out, answering the CID it was
    /// named by, or `None` if the key held nothing.
    pub fn remove(&mut self, collection: &str, rkey: &str) -> Option<Cid> {
        let key = tree_key(collection, rkey);
        let old = self.repository.leaves.remove(&key)?;
        self.release(&old);
        let rewritten = self.repository.tree.remove(&key);
        self.rewritten.then(rewritten);
        Some(old)
    }

    /// Signs the draft as the commit at `rev` following `prev`.
    ///
    /// Answers the repository and the blocks it holds now and did not at the
    /// commit the draft was opened at, and the reverse. The commit blocks are
    /// among them: the new one is created and the old one removed.
    #[must_use]
    pub fn commit(self, rev: &str, prev: Option<Cid>, key: &SigningKey) -> (Repository, Rewritten) {
        let Self {
            mut repository,
            mut rewritten,
        } = self;
        let before = repository.root();
        let did = repository.commit.commit().did.clone();
        repository.commit = sign(&did, &repository.tree, rev, prev, key);
        rewritten.then(Rewritten {
            created: BTreeSet::from([repository.root()]),
            removed: BTreeSet::from([before]),
        });
        (repository, rewritten)
    }

    /// Drops one key's hold on a record block, and the block with the last.
    fn release(&mut self, cid: &Cid) {
        let Some(held) = self.repository.records.get_mut(cid) else {
            return;
        };
        held.keys -= 1;
        if held.keys == 0 {
            self.repository.records.remove(cid);
            self.rewritten.then(Rewritten {
                created: BTreeSet::new(),
                removed: BTreeSet::from([cid.clone()]),
            });
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    fn thing(text: &str) -> serde_json::Value {
        serde_json::json!({
            "$type": "com.example.thing",
            "text": text,
            "emoji": "🜁",
            "createdAt": "2026-08-26T00:00:00Z",
        })
    }

    /// Two revisions of one repository, so a test can talk about what the
    /// second added.
    fn pair() -> (Repository, Repository) {
        let key = SigningKey::generate();
        let mut one = Builder::new();
        one.insert("com.example.thing", "3lqma", &thing("quernstone"))
            .expect("valid");
        let mut two = Builder::new();
        two.insert("com.example.thing", "3lqma", &thing("quernstone"))
            .expect("valid");
        two.insert("com.example.thing", "3lqmb", &thing("farthingale"))
            .expect("valid");
        let one = one.commit("did:web:a.example", "3lqma", None, &key);
        let two = two.commit("did:web:a.example", "3lqmb", Some(one.root()), &key);
        (one, two)
    }

    /// Everything a full export carries is named, and everything named can be
    /// fetched. A history keeping these CIDs is keeping the export's own
    /// vocabulary and not a second one beside it.
    #[test]
    fn the_block_names_are_the_blocks_the_export_holds() {
        let (_, repo) = pair();
        let named = repo.block_cids();
        assert!(named.contains(&repo.root()));
        for cid in &named {
            assert!(
                repo.block(cid).is_some(),
                "{cid} is named and cannot be fetched"
            );
        }
        let read = car::read(&repo.to_car()).expect("a CAR this crate wrote");
        assert_eq!(read.blocks.keys().cloned().collect::<BTreeSet<_>>(), named);
    }

    /// The point of the whole exercise: a reader holding the earlier revision
    /// is sent the new record and the nodes that reach it, and not the record
    /// it already had.
    #[test]
    fn a_diff_leaves_out_what_the_reader_already_holds() {
        let (one, two) = pair();
        let held = one.block_cids();
        let diff = two.to_car_without(&held);
        assert!(diff.len() < two.to_car().len());

        let read = car::read(&diff).expect("a CAR this crate wrote");
        assert_eq!(read.roots, vec![two.root()]);
        let carried: BTreeSet<Cid> = read.blocks.keys().cloned().collect();
        for cid in &two.block_cids() {
            let expected = cid == &two.root() || !held.contains(cid);
            assert_eq!(
                carried.contains(cid),
                expected,
                "{cid} is on the wrong side of the diff"
            );
        }
    }

    /// A reader already at the head is told so with a file holding the commit
    /// and nothing else, rather than with the whole repository.
    #[test]
    fn a_reader_at_the_head_is_sent_only_the_commit() {
        let (_, repo) = pair();
        let read =
            car::read(&repo.to_car_without(&repo.block_cids())).expect("a CAR this crate wrote");
        assert_eq!(read.blocks.len(), 1);
        assert!(read.blocks.contains_key(&repo.root()));
    }

    /// A diff against nothing is the export, byte for byte. Two ways of
    /// writing one repository that disagreed would be a reader's problem
    /// rather than ours.
    #[test]
    fn a_diff_against_nothing_is_the_whole_export() {
        let (_, repo) = pair();
        assert_eq!(repo.to_car_without(&BTreeSet::new()), repo.to_car());
    }

    #[test]
    fn an_empty_repository_still_commits() {
        let key = SigningKey::generate();
        let repo = Builder::new().commit("did:web:a.example", "3lqmnopqrstuv", None, &key);
        assert_eq!(repo.records(), 0);
        assert_eq!(repo.nodes(), 1);
        assert!(repo.commit().verify(&key.verifying_key()).is_ok());
    }

    /// The same records under the same key give the same file, which is what
    /// makes an export cacheable and a test able to compare two of them.
    #[test]
    fn the_same_state_exports_the_same_bytes() {
        let key = SigningKey::generate();
        let build = || {
            let mut builder = Builder::new();
            for (rkey, text) in [("3lqma", "quernstone"), ("3lqmb", "farthingale")] {
                builder
                    .insert("com.example.thing", rkey, &thing(text))
                    .expect("a valid record");
            }
            builder.commit("did:web:a.example", "3lqmnopqrstuv", None, &key)
        };
        assert_eq!(build().to_car(), build().to_car());
    }

    /// Adding a record moves the tree root, which moves the signed bytes,
    /// which moves the commit. If any link in that chain were missing an
    /// export would keep verifying after the repository changed.
    #[test]
    fn a_new_record_moves_the_commit() {
        let key = SigningKey::generate();
        let mut one = Builder::new();
        one.insert("com.example.thing", "3lqma", &thing("quernstone"))
            .expect("valid");
        let mut two = Builder::new();
        two.insert("com.example.thing", "3lqma", &thing("quernstone"))
            .expect("valid");
        two.insert("com.example.thing", "3lqmb", &thing("farthingale"))
            .expect("valid");

        let one = one.commit("did:web:a.example", "3lqma", None, &key);
        let two = two.commit("did:web:a.example", "3lqma", None, &key);
        assert_ne!(one.commit().commit().data, two.commit().commit().data);
        assert_ne!(one.root(), two.root());
    }

    /// A record is keyed by collection and rkey together, so the same rkey in
    /// two collections is two records — as in atproto.
    #[test]
    fn one_rkey_in_two_collections_is_two_records() {
        let mut builder = Builder::new();
        builder
            .insert("com.example.thing", "self", &thing("one"))
            .expect("valid");
        builder
            .insert("app.bsky.actor.profile", "self", &thing("two"))
            .expect("valid");
        assert_eq!(builder.len(), 2);
    }

    #[test]
    fn a_record_the_data_model_cannot_hold_names_itself() {
        let mut builder = Builder::new();
        let error = builder
            .insert(
                "com.example.thing",
                "3lqma",
                &serde_json::json!({"ratio": 1.5}),
            )
            .expect_err("a float has no encoding");
        assert!(
            matches!(&error, RepoError::Record { key, .. } if key == "com.example.thing/3lqma"),
            "{error}"
        );
    }
}