Struct CompletionFences 

pub struct CompletionFences { /* private fields */ }

Process-incarnation registry of the only generations allowed to complete.

Recovery deliberately starts with an empty registry. Re-dispatch issues a fresh token, so a result carrying any pre-recovery token is refused whether it arrives before or after the new dispatch.

Implementations

impl CompletionFences

pub fn issue( &self, workflow_id: &WorkflowId, run_id: &RunId, activity_id: &ActivityId, attempt: u32, ) -> Result<CompletionToken, ServerError>

Authorize one more delivery of one attempt and return its token.

One generation is held per execution site, and what a call is decides what happens to it:

• a different idempotency_key is a different EXECUTION GENERATION (reset / continue-as-new): the prior generation is superseded whole;
• a higher attempt within the same generation is a genuine RETRY: the prior attempt’s tokens are superseded;
• the SAME attempt within the same generation is a REDELIVERY of work a worker may still be executing, so the new token JOINS the outstanding set rather than replacing it. Both workers hold a token that can be accepted, and the first accepted completion consumes both.

A re-dispatch of an attempt that has already been superseded registers nothing: it is logged with both attempt numbers, and the token it returns is refused as a stale generation when presented, which is the truthful answer for a worker whose attempt no longer exists.

Errors

Returns ServerError::LockPoisoned when fence state cannot be trusted.

pub fn accept( &self, workflow_id: &WorkflowId, activity_id: &ActivityId, submitted: &CompletionToken, ) -> Result<AcceptedGeneration, ServerError>

Consume the current generation when submitted is one of the tokens it still has outstanding.

Comparison and consumption share one mutex critical section, so two concurrent submissions cannot both become truth: the whole generation is removed by the first, and every later presentation of any of its tokens finds no generation at all.

Errors

Returns a typed rejection for a missing generation or a token that is not outstanding in it, or ServerError::LockPoisoned when fence state cannot be trusted.

pub fn restore_if_absent( &self, workflow_id: &WorkflowId, activity_id: &ActivityId, accepted: &AcceptedGeneration, ) -> Result<(), ServerError>

Restore a consumed generation after accepted-path settlement fails.

A concurrently issued newer generation always wins; the accepted generation is restored only while the execution site has no current one.

Errors

Returns ServerError::LockPoisoned when fence state cannot be trusted.

pub fn revoke( &self, workflow_id: &WorkflowId, activity_id: &ActivityId, token: &CompletionToken, ) -> Result<(), ServerError>

Revoke exactly the token this caller issued, and nothing else.

A dispatch that could not place its task withdraws its OWN authorization. It never withdraws a sibling token still held by a live worker executing the same attempt, and it never disturbs a newer retry — a newer attempt already replaced the outstanding set, so the old token is simply absent and the removal is a no-op. The generation is dropped once its last outstanding token is gone.

Errors

Returns ServerError::LockPoisoned when fence state cannot be trusted.

pub fn revoke_current( &self, workflow_id: &WorkflowId, activity_id: &ActivityId, ) -> Result<(), ServerError>

Revoke whichever generation is current while parking for recovery.

A park retires the execution site deliberately, so it takes every token of the current generation with it — including a redelivery’s sibling.

Errors

Returns ServerError::LockPoisoned when fence state cannot be trusted.

pub fn arm_lease(&self, token: &CompletionToken) -> Result<(), ServerError>

Mark token’s lease append as in flight: a completion for it waits at Self::lease_settled until Self::settle_lease runs.

Errors

Returns ServerError::LockPoisoned if the gate lock is poisoned.

pub fn settle_lease(&self, token: &CompletionToken) -> Result<(), ServerError>

The lease append for token has landed, failed, or been abandoned — release every completion waiting on it.

Errors

Returns ServerError::LockPoisoned if the gate lock is poisoned.

pub fn lease_pending( &self, token: &CompletionToken, ) -> Result<bool, ServerError>

Whether token’s lease append is still in flight.

Errors

Returns ServerError::LockPoisoned if the gate lock is poisoned.

pub async fn lease_settled( &self, token: &CompletionToken, ) -> Result<(), ServerError>

Wait until token’s lease append is no longer in flight. Returns at once for a token that was never armed or is already settled.

The completion entry points await this before handing a result to the fence; Self::accept also waits when it can host the wait itself.

Errors

Returns ServerError::LockPoisoned if the gate lock is poisoned.

Trait Implementations

impl Clone for CompletionFences

fn clone(&self) -> CompletionFences

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CompletionFences

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CompletionFences

fn default() -> CompletionFences

Returns the “default value” for a type.