Struct HostUpdateFlow 

pub struct HostUpdateFlow<'a> { /* private fields */ }

One deployment-owned adapter composition. Use a single external process lock for the journal and host operation. This type never acquires a hidden lock, starts a process, selects providers or performs a domain migration.

Implementations

impl<'a> HostUpdateFlow<'a>

pub fn new( journal: &'a FileRecoveryStore, adapter: &'a dyn ActivationAdapter, gate: &'a dyn UpdateRecoveryGate, ) -> Self

Composes an explicitly locked journal, host adapter and recovery gate.

pub fn prepare( &self, request: &ActivationRequest, staged: &StagedArtifact, at_ms: u64, ) -> UpdateResult<()>

Persists intent before drain, snapshot and adapter preparation. On any failure the prepared receipt remains inspectable; recovery must inspect host reality rather than assuming that an interrupted callback did nothing. Supply only bytes already authenticated/verified/staged by Update.

pub fn activate( &self, request: &ActivationRequest, staged: &StagedArtifact, at_ms: u64, ) -> UpdateResult<ActivationEvidence>

Repeats the idempotent preparation boundary before activation so a restarted caller cannot skip a previously failed drain/snapshot callback. A failed activation leaves prepared intent; inspect host reality on restart.

pub fn confirm( &self, evidence: &ActivationEvidence, at_ms: u64, ) -> UpdateResult<()>

Confirms host health, commits the adapter, then records completion. Backend and renderer readiness must both be included in a desktop adapter. Failed health durably requests rollback. Failed/ambiguous commit retains pending intent and never reports success or guesses a rollback.

pub fn rollback(&self) -> UpdateResult<()>

Runs host rollback but does not record completion. The host must re-probe the actual restored identity and supply RecordRolledBack to the journal.