Add canonical canvas rows, stable identity migration and model operations

internal/platform/canvas_model_guard.go

@@ -0,0 +1,41 @@
+package platform
+
+import (
+	"net/http"
+	"strings"
+)
+
+// Old frozen receipts remain readable. Old whole-snapshot/ownership writers may
+// not edit a migrated tree, even when their old client has not seen the barrier.
+func (s *service) guardLegacyCanonicalRequest(w http.ResponseWriter, r *http.Request, project, account string) (bool, error) {
+	if r.PathValue("material") == "" {
+		return false, nil
+	}
+	path := r.URL.Path
+	legacy := strings.HasSuffix(path, "/canvas")
+	if r.Method != http.MethodGet {
+		for _, part := range []string{"/canvas/subgraphs", "/canvas/connections", "/canvas/transactions", "/canvas/operations"} {
+			legacy = legacy || strings.Contains(path, part)
+		}
+	}
+	if !legacy {
+		return false, nil
+	}
+	tx, err := s.db.BeginTx(r.Context(), nil)
+	if err != nil {
+		return false, err
+	}
+	defer tx.Rollback()
+	if _, _, err = lockMaterial(r.Context(), tx, project, r.PathValue("workspace"), r.PathValue("material"), account); err != nil {
+		return false, err
+	}
+	root, err := canonicalRoot(r.Context(), tx, project, r.PathValue("workspace"), r.PathValue("material"))
+	if err != nil {
+		return false, err
+	}
+	if root == "" {
+		return false, nil
+	}
+	reply(w, 409, response{"error": "canonical_write_required", "root_id": root, "model_path": "canvas/model"})
+	return true, nil
+}