P2 slice 2: the data root (plan 3.4, 5.5)

ledger_store::root: one private folder for every book, found without the
environment (--root, else the root setup recorded in a file only this
account can write, else the platform default under the home from the
password database). Every folder made 0700, files 0600; a root that is a
link, another user's, open to others, unmarked, or under a folder another
user could swap is refused; no error names it. Setup keeps a recorded
root, never makes a second root or moves books while one holds any, and
leaves a folder holding other things untouched. Books are created and
adopted one at a time; adoption reads the source under its writer lock
(changing nothing in it), copies into staging, re-hashes every stored
file against its name, checks every named file is there, opens and
verifies the copy with the source's head, imports settings for books
that keep none, syncs, and only then renames it into place.
wanderbooks setup makes the root and never prints where it is. Three
review rounds; mutation on the diff (docs/testing.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-store/Cargo.toml

@@ -17,12 +17,18 @@ thiserror = "2"
 sha2 = "0.10"
 hex = "0.4"
 
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
+
 [dev-dependencies]
 tempfile = "3"
 proptest = "1"
 rust_decimal = "1"
 criterion = "0.8.2"
 
+[target.'cfg(unix)'.dev-dependencies]
+libc = "0.2"
+
 [[bench]]
 name = "store"
 harness = false

crates/ledger-store/src/lib.rs

@@ -24,6 +24,7 @@ pub mod format;
 pub mod journal;
 pub mod meta;
 pub mod reconcilable;
+pub mod root;
 pub mod schema;
 pub mod snapshot;
 pub mod store;

crates/ledger-store/src/store.rs

@@ -88,6 +88,12 @@ fn lock_books(data_dir: &Path) -> Result<std::fs::File, StoreError> {
         Err(std::fs::TryLockError::Error(e)) => Err(StoreError::Io(e)),
     }
 }
+/// Take a data dir's writer lock to copy it (adoption, `root.rs`): held,
+/// no other writer can append while the copy is made.
+pub(crate) fn lock_books_for_adoption(data_dir: &Path) -> Result<std::fs::File, StoreError> {
+    lock_books(data_dir)
+}
+
 pub(crate) const BLOBS_DIR: &str = "blobs";
 
 /// One row of an entry listing.
@@ -366,8 +372,8 @@ impl Store {
             let _ = std::fs::remove_file(db_path.with_extension("db-wal"));
             let _ = std::fs::remove_file(db_path.with_extension("db-shm"));
             eprintln!(
-                "wanderbooks: sqlite projection {why}; quarantined to {} and rebuilding from journal",
-                quarantine.display()
+                "wanderbooks: sqlite projection {why}; quarantined to {} beside it and rebuilding from journal",
+                quarantine.file_name().unwrap_or_default().to_string_lossy()
             );
             fresh_db = true;
         }
@@ -401,9 +407,9 @@ impl Store {
             )?;
             apply_line_to_sqlite(&store.conn, &line)?;
             eprintln!(
-                "wanderbooks: the journal's last line was cut off (an append that never finished); set aside {} bytes in {}",
+                "wanderbooks: the journal's last line was cut off (an append that never finished); set aside {} bytes in {} beside it",
                 t.bytes,
-                t.saved_as.display()
+                t.saved_as.file_name().unwrap_or_default().to_string_lossy()
             );
         }
         Ok(store)
@@ -3709,8 +3715,8 @@ impl Store {
                 let keep = self.db_path.with_extension(format!("mismatch.{stamp}"));
                 std::fs::copy(&self.db_path, &keep)?;
                 eprintln!(
-                    "wanderbooks: {why}; kept the old database as {} and rebuilt from the journal",
-                    keep.display()
+                    "wanderbooks: {why}; kept the old database as {} beside it and rebuilt from the journal",
+                    keep.file_name().unwrap_or_default().to_string_lossy()
                 );
                 self.rebuild()?;
                 self.verify()?;
@@ -3729,6 +3735,16 @@ impl Store {
         })
     }
 
+    /// The SHA-256 of every stored file the books name (receipts and
+    /// documents, withdrawn ones included).
+    pub fn stored_blob_shas(&self) -> Result<Vec<String>, StoreError> {
+        let mut stmt = self.conn.prepare("SELECT sha256 FROM blobs")?;
+        let shas = stmt
+            .query_map([], |r| r.get::<_, String>(0))?
+            .collect::<Result<Vec<_>, _>>()?;
+        Ok(shas.into_iter().map(|s| s.to_lowercase()).collect())
+    }
+
     /// Verify every blob's bytes against its SHA-256. Returns the count
     /// checked. Reads all bytes; run on a schedule, not per request.
     pub fn verify_blobs(&self) -> Result<u64, StoreError> {