Struct Store 

pub struct Store { /* private fields */ }

Implementations

impl Store

pub async fn load_parked( &self, cap: usize, rt: &Arc<Runtime>, skip: &HashSet<String>, ) -> Result<Vec<Arc<Process>>>

Load up to cap parked processes: durable rows in None state — a process was created while the resident set was full (see Cache::admit) or a never-started leftover from a crash — and never ran. Oldest first, so the restore pass refills slots FIFO. Parked rows are never resident, so skip only guards against a row whose pid is concurrently admitted (e.g. seeded by tests).

pub async fn load_resumable( &self, cap: usize, rt: &Arc<Runtime>, skip: &HashSet<String>, ) -> Result<Vec<Arc<Process>>>

Load up to cap resumable processes: durable rows that were running when the engine crashed (Ready/Running/Pending), oldest first — the boot-resume working set. The number of matching rows beyond the cap is found with Self::count_resumable; the caller queues their pids for later slots. See Runtime::resume.

pub async fn count_resumable(&self) -> Result<usize>

Count durable rows that were in flight when the engine crashed (Ready/Running/Pending) — used at boot to detect processes that do not fit the resident cap and must wait in the resume queue.

pub async fn load_proc( &self, pid: &str, rt: &Arc<Runtime>, ) -> Result<Option<Arc<Process>>>

pub async fn remove_proc(&self, pid: &str) -> Result<bool>

pub async fn enqueue_next_op(&self, pid: &str, tid: &str) -> Result<()>

but not yet run. Deduplicated per (pid, tid, type) — at most one in-flight record per operation, matching the previous Sign::NEXT_PENDING semantics. Queued on the store writer (FIFO) before the in-memory queue dispatch, after the task state write, so a Pending record always has a durable task behind it.

pub async fn enqueue_exec_op(&self, pid: &str, tid: &str) -> Result<()>

Record a durable outbox entry for task execution. This is the disk overflow queue used when the in-memory scheduler queue is full.

pub async fn enqueue_action_op( &self, pid: &str, tid: &str, event: &str, options: &str, ) -> Result<()>

Record a durable outbox entry for a client action (event + options). Deduplicated per (pid, tid, type), so it is not shadowed by the task’s in-flight next record (an interrupt act keeps its next op Pending while waiting for the client). Written before the action is applied so recovery can re-apply it when the crash happened before the task state write became durable.

pub async fn load_pending_ops(&self) -> Result<Vec<Op>>

Load every outbox record that was not durably completed — the crash replay set. Read exhaustively — the engine replays exactly what this returns, so a page limit must never drop a record (id order, which is stable across restarts).

pub async fn mark_op_dispatched( &self, pid: &str, tid: &str, type: &str, ) -> Result<()>

Mark a record as handed to the in-memory scheduler. Boot recovery still treats this state as replayable; periodic overflow recovery does not.

pub async fn load_overflow_ops(&self, older_than_millis: i64) -> Result<Vec<Op>>

Load stale, not-yet-dispatched overflow records. Dispatched records are deliberately excluded while the engine is running: replaying them would duplicate work that is queued or executing in memory.

pub async fn complete_ops(&self, pid: &str, tid: &str, type: &str) -> Result<()>

Close the in-flight outbox records of a task (Pending/Dispatched/ Overflow → Done), filtered by operation type: a next close must not sweep away a concurrent client-action record of the same task (and vice versa). Must only be called after the operation’s effects (the task state write, including the NEXT_COMPLETE marker) were durably persisted — the writer FIFO order guarantees this.

pub async fn mark_op_overflow( &self, pid: &str, tid: &str, type: &str, ) -> Result<()>

Mark a pending next record as overflowed to the durable scheduler disk queue after the bounded in-memory queue rejected it.

pub async fn remove_ops(&self, pid: &str) -> Result<()>

Drop every outbox record of a process (used when the process is removed).

pub async fn mark_delivered(&self, id: &str) -> Result<()>

Advance a stored delivery from Created to Delivered — the channel handler ran to completion, so the delivery succeeded. Only rows still Created move: a handler that acked (or was closed) while running must never be downgraded. The stored row is read under its document lock (Store::update_delivery), so a close or retry-pass write landing while the handler ran is seen — never overwritten by a stale Created.

pub async fn set_delivery(&self, id: &str, status: DeliveryStatus) -> Result<()>

Ack one delivery row (by its delivery id): set its status.

pub async fn resend_error_deliveries(&self) -> Result<()>

Re-send every error delivery row (reset to Created; the retry timer sends them to their own channels).

pub async fn clear_error_deliveries(&self, pid: Option<String>) -> Result<()>

Delete error delivery rows: all of them or only those of one process.

pub async fn resend_error_delivery( &self, delivery_id: &str, ) -> Result<Option<Delivery>>

Reset one error delivery row back to Created for redelivery. Returns the delivery when it was an error delivery and was reset, None otherwise.

pub async fn clear_error_delivery(&self, delivery_id: &str) -> Result<bool>

Delete one error delivery row. Returns true when the row existed and was in error state and was deleted.

pub async fn upsert_task(&self, task: &Arc<Task>) -> Result<()>

pub async fn upsert_task_data(&self, data: &Task) -> Result<()>

pub async fn upsert_task_vars(&self, task: &Arc<Task>) -> Result<()>

Persist one task scope’s vars row (data + sealed). Called by the persist path only for scopes whose vars actually changed.

pub async fn persist_task_rows(&self, task: &Arc<Task>) -> Result<()>

Durable write of a task lifecycle row and every scope vars row that diverged: the task’s own row, then — walking the parent chain to the root — each ancestor whose vars changed since its last flush (the scope that owns an updated key, which update_data resolved at write time). A lifecycle-only transition (state/timing change, no data touched) writes just the one lifecycle row; scope vars rows are written exactly when the owning scope actually mutated. The dirty flags are cleared only after each row is durable, so a crash between mutations and the next persist loses nothing that the previous design would have kept.

pub async fn mark_proc_complete( &self, pid: &str, end_time: i64, state: TaskState, ) -> Result<()>

pub async fn upsert_proc(&self, proc: &Arc<Process>) -> Result<()>

impl Store

pub fn new(kv: Arc<dyn KvStore>) -> Self

pub fn tasks(&self) -> Arc<dyn DbCollection<Item = Task>>

pub fn procs(&self) -> Arc<dyn DbCollection<Item = Proc>>

pub fn vars(&self) -> Arc<dyn DbCollection<Item = TaskVars>>

pub fn packages(&self) -> Arc<dyn DbCollection<Item = Package>>

pub fn models(&self) -> Arc<dyn DbCollection<Item = Model>>

pub fn messages(&self) -> Arc<dyn DbCollection<Item = Message>>

pub fn deliveries(&self) -> Arc<dyn DbCollection<Item = Delivery>>

pub fn events(&self) -> Arc<dyn DbCollection<Item = Event>>

pub fn ops(&self) -> Arc<dyn DbCollection<Item = Op>>

pub async fn rebuild_indexes(&self) -> Result<usize>

Rebuild all collection index entries from stored data documents.

Run once after upgrading to a version whose index-key value encoding changed (see KvCollection::rebuild_index); calling it repeatedly is harmless (idempotent rewrite).

pub async fn publish(&self, pack: &Package) -> Result<bool>

pub async fn deploy( &self, model: &Workflow, view: Option<&JsonValue>, ) -> Result<bool>

pub async fn rm_model(&self, id: &str) -> Result<bool>

Atomically remove a model and every trigger (events) row of it in one batch: a mid-removal failure can no longer leave stale trigger rows (or a half-cleared event set) behind. Removing an absent model is a no-op that still returns true.

pub async fn with_no_response_deliveries( &self, timeout_millis: i64, max_delivery_retry_times: i32, ) -> Result<Vec<Delivery>>

Collect deliveries with no response: re-arm the ones that were handed over but never acked (Delivered — as well as Created rows that were never successfully dispatched) and mark the ones that exceeded max_delivery_retry_times as errors. Returns every re-armed delivery (the caller re-sends them to their own channels).

The candidate page is a hint, not the decision: every row is re-read under its document lock and acted on from that stored state, so a row the engine closed, the client acked or a manual resend re-armed while this pass runs is left alone instead of being overwritten by a stale read and re-sent after the message already settled.