Module schema_lock 

Reading and atomically writing bynk.schema.lock — the driver’s side of CompileOptions::schema_registry (#1078, R2.3/T0.7 residue).

Ported verbatim from what used to be bynk-emit/src/project/schema_registry.rs’s read/write — same crash-safety discipline (temp file + sync_all + rename + best-effort directory fsync), same unchanged-content no-op. Only the location moved: bynk-emit now only ever sees pre-read content (via SchemaLock::On) and hands back serialized content to write (via ProjectOutput::schema_lock) — it touches no disk for this file, same as it no longer does for .bynk sources on the real CLI path (#1077/#1081).

bynk-emit’s own schema_registry::parse/serialize are the pure counterparts this module’s read/write() wrap disk I/O around.

Functions

lock_path

Where the registry lives for a given project root — exposed so callers reporting a write failure can name the actual file, not just the root.

read

Read bynk.schema.lock‘s raw content from project_root, if it exists. Ok(None) means verified absent — no such file — which is the only thing CompileOptions’ SchemaLock::On { existing: None } is allowed to mean (see that type’s own doc). A present-but-unreadable file is a real io::Error, not folded into None — silently treating a permission error, a non-traversable ancestor, or any other stat/read failure as “fresh project” would risk re-baselining a real registry’s history exactly as wrongly as never reading it at all.

read_only

The committed lock as a read-only SchemaLock::On — how check and test reconcile events against bynk.schema.lock (#2078). Nothing is written back: the caller drops ProjectOutput::schema_lock (and a ProjectCheck carries none), so a passing additive change leaves the lock byte-identical for bynkc compile, bynk dev or bynk deploy to record. A missing lock is a fresh project, which baselines silently, exactly as a build treats it. A read failure is a message naming the file, for the caller to report.

write

Write bynk.schema.lock to project_root, atomically (temp file + sync_all + rename + best-effort directory fsync, so a crash mid-write can only leave the intact old file or the intact new one — ledger.rs’s own discipline). A no-op when content is byte-identical to what is already on disk, so a clean rebuild never touches the file’s mtime or produces a spurious git diff.