Struct ClusterKillSwitch 

pub struct ClusterKillSwitch { /* private fields */ }

Distributed emergency-halt latch. Cheap to clone via Arc.

Implementations

impl ClusterKillSwitch

pub fn new( replicator: Arc<Replicator>, base_key: impl Into<String>, node: impl Into<String>, ) -> Arc<Self>

Create a switch over replicator, gating on the well-known base_key. node is this node’s stable id (used for LWW register tie-breaking on the epoch counter).

pub fn with_transport( replicator: Arc<Replicator>, base_key: impl Into<String>, node: impl Into<String>, transport: Arc<dyn HaltTransport>, ) -> Arc<Self>

Like new but attaches a HaltTransport so await_quiescence also fans the halt out to remote peers and collects their acks.

pub fn replicator(&self) -> &Arc<Replicator>

Access the backing replicator (telemetry / testing).

pub fn epoch(&self) -> u64

Current epoch (0 if unset).

pub fn engage(&self, reason: HaltReason) -> HaltToken

Engage the latch for the current epoch and record reason. Idempotent at the CRDT level (OR-merge); calling twice is safe.

pub fn is_engaged(&self) -> bool

Read the merged latch state for the current epoch. Survives merge/rebalance because the backing Flag only OR-merges.

pub fn last_reason(&self) -> Option<HaltReason>

Reason recorded by the most recent local engage, if any.

pub fn register_guarded(&self, party: Box<dyn HaltGuarded>) -> AckHandle

Register a guarded party. Returns an AckHandle the party keeps; when its on_halt runs (during await_quiescence) it signals quiescence by calling AckHandle::ack.

pub async fn await_quiescence(&self, timeout: Duration) -> QuiescenceReport

Bring the system to a safe stop and report how many parties acknowledged within timeout.

Always quiesces this node’s local HaltGuarded parties. When a HaltTransport is attached it also broadcasts a HaltPdu::Halt to every peer and waits for a HaltPdu::Ack from each, so the returned QuiescenceReport reflects the whole cluster. timeout bounds the combined wait.

pub async fn apply_pdu(&self, pdu: HaltPdu, local_timeout: Duration)

Apply an inbound HaltPdu delivered by a HaltTransport.

• HaltPdu::Halt — engage this node’s latch for the named epoch, quiesce its local guarded parties (bounded by local_timeout), then ack back to the originator.
• HaltPdu::Ack — record a peer’s ack and wake any in-flight await_quiescence.

pub fn reset(&self, authz: ResetAuthorization) -> Result<u64, ResetError>

Reset the switch by advancing to a fresh epoch (the old epoch’s latched flag is left as an audit record). Requires a valid two-person ResetAuthorization.

See the module docs for why this advances an epoch instead of flipping the flag: a Flag cannot un-latch.