Struct PoolLedger 

pub struct PoolLedger { /* private fields */ }

One lane’s live voucher ledger, shared by every concurrent stream that draws on it. Voucher issuance is serialized through the async issuance mutex — held across compute → sign → send so vouchers reach the node in strict cumulative order — and released the instant the send returns, because there is no ack to wait for (implicit acceptance, ADR 005). The committed watermark advances the moment a send succeeds; a mid-stream VoucherRejected rewinds it through resolve_reject.

Implementations

impl PoolLedger

pub fn new(seed: Cumulative) -> Self

Build a ledger seeded from the lane’s persisted cumulative state (the last voucher issued on earlier streams/invocations). Pass Cumulative::default() for a brand-new lane, and for the unpaid legs — the node’s own-origin BackendSource quotes rate 0, so it never prices, signs, or meters anything.

The cumulative is the only seed there is. A chain draws its own secret at open and is never resumed across a restart, so this constructor takes no lane identity and no key material: what the ledger inherits from a previous process is the money it owes, never the chain it owed it under.

pub fn committed(&self) -> Cumulative

Read the committed cumulative WITHOUT awaiting — the drop-safe reader, and the only one a Drop impl can call. It is the highest voucher whose send succeeded (implicit acceptance) or that a terminal StreamEnd confirmed (confirm_armed_stamped), plus the accrual since, so it is exactly what a completed pull persists.

pub fn paid_bytes(&self) -> U256

The lane bytes this ledger paid for since its seed: how far it grew the cumulative claim the node can redeem. Each voucher and hash-chain reveal adds the bytes it pays for, and a rejection of that same proof takes them back. Content delivered twice is paid for twice and counts twice.

A Self::reseed jump is payment this ledger did not make, so it does not count. A rebase drops claims the node never accepted, so they do not count either; claims below the seed that this ledger signs again after a rebase do count.

An armed voucher whose send did not confirm counts only once a later voucher builds on it, a StreamEnd confirms it, or a retired chain’s fold commits it. Self::settlement counts it from the start.

pub fn settlement(&self) -> Cumulative

The cumulative a cancelled pull must PERSIST — the drop-path counterpart of Self::committed, and what a Drop guard should actually write (#1122).

It is Self::committed, except when a voucher is still armed with its send unconfirmed, in which case it is the HIGHER of the two by amount (the monotone key). Settling high is the safe direction and it is correct: an armed voucher pays for bytes the upstream ALREADY DELIVERED, and the upstream persists a voucher before it would reject it, so an ambiguous failure may leave the upstream holding it — under-reporting would strand the deposit. A voucher the upstream explicitly REJECTED is never here — resolve_reject clears armed and rewinds committed — so this cannot inflate our cumulative for bytes the upstream declined.

pub fn take_unsaved_rebase(&self) -> Option<Cumulative>

Take the watermark the latest rebase moved to, if no persist has recorded it yet. The caller overwrites the lane record with it once and advances from there; every later persist is a monotone advance again. Taking it clears it, so a second persist sees None.

Trait Implementations

impl Debug for PoolLedger

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.