1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
use super::Cut;
use crate::metis::{CausalIdeal, DotSet, Purview, VersionVector};
impl Cut {
/// The empty cut, trivially gap-free (every station's prefix is empty, so no
/// station has a hole).
///
/// The identity for [`merge`](Self::merge) and the absorber for
/// [`meet`](Self::meet), the witness form of [`VersionVector::new`].
#[must_use]
pub const fn bottom() -> Self {
Self(VersionVector::new())
}
/// The interior of a have-set: the greatest gap-free prefix `have` contains,
/// gap-free by PRD 0012's construction ([`DotSet::floor`]).
///
/// This is the honest [`Stability`](crate::metis::Stability) report where
/// receipt may run past holes: the floor cannot over-claim, whatever the
/// arrival order, so wrapping it as a `Cut` witnesses exactly that.
#[must_use]
pub fn floor_of(have: &DotSet) -> Self {
Self(have.floor())
}
/// A causal buffer's delivered cut: the per-sender count of events the buffer
/// has released, gap-free by gate contiguity (PRD 0005/0009).
///
/// The [`Causal`](crate::metis::Causal) gate releases an event only once all
/// its dependencies are delivered, so the delivered set is downward-closed
/// under happens-before, an order ideal; its
/// [`delivered`](crate::metis::Ideal::delivered) vector is therefore a
/// genuine cut by construction, never a high-water over holes.
#[must_use]
pub fn delivered_by<T>(buffer: &CausalIdeal<T>) -> Self {
Self(buffer.delivered().clone())
}
/// The collective-knowledge floor of a [`Purview`]: the greatest gap-free cut
/// every roster peer provably holds, gap-free by construction
/// ([`Purview::common_floor`], the floor of the rows' intersection).
///
/// The intersection may itself run past holes (a peer received a dot out of
/// order); its floor is the honest cut, so wrapping it here witnesses the
/// gap-freedom the raw common knowledge does not carry.
#[must_use]
pub fn common_of(view: &Purview) -> Self {
Self(view.common_floor())
}
/// Wraps a vector a *closure theorem* has already established gap-free.
///
/// The internal boundary, `pub(crate)` and never public: it is a
/// vector-taking door, exactly the shape the public constructor set refuses
/// (it would be the rejected `Horizon` newtype). It is sound only where the
/// caller has itself proved the vector is a cut by a closure over cuts, not
/// by trusting an outside vector's word. The one caller is
/// [`Stability::watermark_cut`](crate::metis::Stability::watermark_cut),
/// which folds by [`VersionVector::meet`] over slots that are each a join of
/// witnessed cuts, so the meet is a cut by the meet/merge closure theorems;
/// it gates the call on *every* report having been witnessed, so no
/// unwitnessed vector ever reaches here.
pub(crate) const fn from_witnessed(vector: VersionVector) -> Self {
Self(vector)
}
}