host: Phase 3 — relations WRITE cut-over (attach/detach-child), 132/132

Migrate the container relations write actions onto lib/relations: POST
/internal/actions/attach-child + /detach-child dispatch to relations/relate
and relations/unrelate over the same "type:id" node model, behind the
auth+ACL pipeline (wrap-errors . require-auth . require-permission), mirroring
POST /feed. Closed-loop test: attach -> visible via get-children -> detach ->
gone; 401/403/400 guards. Ledger now models the full relations surface (7
endpoints): container reads+writes migrated, typed relate/unrelate/can-relate
proxied (registry+cardinality validation not in lib/relations). Off-Quart
coverage 45% -> 50%.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/host/relations.sx

@@ -56,3 +56,77 @@
   (list
     (dream-get "/internal/data/get-children" host/relations-children)
     (dream-get "/internal/data/get-parents" host/relations-parents)))
+
+;; ── writes: container relations (attach-child / detach-child) ────────
+;; The write side of get-children/get-parents: a container edge between a parent
+;; (type,id) and child (type,id) under a relation kind. Maps to relations/relate
+;; and relations/unrelate over the same "type:id" node model, so an attach is
+;; immediately visible through get-children. (The TYPED relate/unrelate/can-relate
+;; actions stay on Quart — they carry registry + cardinality validation that
+;; lib/relations does not implement.) Body is the action's JSON params dict.
+
+;; Pull the four node coordinates + kind from a payload; nil if any are absent.
+(define host/-rel-edge
+  (fn (p)
+    (let ((pt (get p :parent-type)) (pid (get p :parent-id))
+          (ct (get p :child-type)) (cid (get p :child-id))
+          (kind (get p :relation-type)))
+      (if (and pt pid ct cid kind)
+        {:parent (host/-rel-node pt pid)
+         :child (host/-rel-node ct cid)
+         :kind (string->symbol kind)
+         :parent-id (str pt ":" pid)
+         :child-id (str ct ":" cid)
+         :relation kind}
+        nil))))
+
+;; POST /internal/actions/attach-child — create the container edge. 201 on success.
+(define host/relations-attach
+  (fn (req)
+    (let ((p (dream-json-body req)))
+      (if (= (type-of p) "dict")
+        (let ((e (host/-rel-edge p)))
+          (if e
+            (begin
+              (relations/relate (get e :parent) (get e :child) (get e :kind))
+              (host/ok-status 201
+                {:parent (get e :parent-id) :child (get e :child-id)
+                 :relation (get e :relation)}))
+            (host/error 400 "missing parameter")))
+        (host/error 400 "invalid payload")))))
+
+;; POST /internal/actions/detach-child — remove the container edge. 200 on success.
+(define host/relations-detach
+  (fn (req)
+    (let ((p (dream-json-body req)))
+      (if (= (type-of p) "dict")
+        (let ((e (host/-rel-edge p)))
+          (if e
+            (begin
+              (relations/unrelate (get e :parent) (get e :child) (get e :kind))
+              (host/ok
+                {:parent (get e :parent-id) :child (get e :child-id)
+                 :relation (get e :relation) :detached true}))
+            (host/error 400 "missing parameter")))
+        (host/error 400 "invalid payload")))))
+
+;; Guarded write route group: each action behind auth + ACL. attach needs
+;; ("relate","relations"); detach needs ("unrelate","relations"). resolve is the
+;; injected token->principal auth policy (same shape as host/feed-write-routes).
+(define host/relations-write-routes
+  (fn (resolve)
+    (list
+      (dream-post "/internal/actions/attach-child"
+        (host/pipeline
+          (list
+            host/wrap-errors
+            (host/require-auth resolve)
+            (host/require-permission "relate" (fn (req) "relations")))
+          host/relations-attach))
+      (dream-post "/internal/actions/detach-child"
+        (host/pipeline
+          (list
+            host/wrap-errors
+            (host/require-auth resolve)
+            (host/require-permission "unrelate" (fn (req) "relations")))
+          host/relations-detach)))))