04 — Text-as-code: durable export, roundtrip, import proposal

1. The durable collection as text-as-code

The runtime/290 collection iu_core.autocut.file-001 is the first DURABLE composition this layer can project. text_as_code_roundtrip_proof.py (in this macro folder) exercises the full text_as_code.py contract over it — discovery-driven (the collection is resolved by collection_key, the pieces from fn_iu_collection_render), writing exactly ONE repo file (the export), mutating no database row.

2. The digest contract

The Python CollectionManifest.computed_digest() (md5 over piece_order:iu_id:piece_role joined by |) is recomputed and matched against the SQL-stored manifest_digest that fn_iu_collection_manifest _refresh wrote:

stored_digest   = 3d51e7593c3887dba501e9c40f622a60
computed_digest = 3d51e7593c3887dba501e9c40f622a60
DIGEST_MATCH    = True

The two digest formulas are one contract — the SQL string_agg(piece_order || ':' || iu_id || ':' || piece_role, '|' ORDER BY piece_order) and the Python join produce the same bytes.

3. Export + roundtrip + validate

• Exported to iu-tree/_collections/file/iu_core.autocut.file-001.md (the deterministic collection_manifest_path — the globally-unique collection_key is the filename stem, so no two compositions collide).
• Roundtrip serialize → parse → serialize is byte-identical (roundtrip_collection_manifest = True).
• Validate validate_collection_manifest — clean: 3 pieces, contiguous piece_order 0..2, unique iu_id, stored digest matches recomputation.
• Diff against the empty prior export — added = the one new manifest path, removed/changed empty (a brand-new collection).

4. Non-destructive import proposal

propose_collection_import over the serialized manifest:

acceptable=True  executes=False  digest_match=True  IMPORT_IS_DESTRUCTIVE=False

The importer parses → validates → confirms the digest → produces a CollectionImportProposal. It never applies. IMPORT_IS_DESTRUCTIVE stays False — a durable importer (parse → propose → gated apply) remains a separate, separately-gated macro.

5. The proof verdict

TEXT_AS_CODE_PROOF all_pass=True — digest match ∧ roundtrip ∧ validate ∧ proposal acceptable ∧ not executes ∧ not destructive ∧ diff = one added path. The exported manifest artifact is committed; a test (TestExportedManifest) re-parses, roundtrips, validates and re-proposes it so the contract is regression-locked.