Struct BufferPool 

pub struct BufferPool { /* private fields */ }

Implementations

impl BufferPool

pub fn new( file: Arc<dyn FileIo>, budget: Arc<MemoryBudget>, frames: usize, ) -> Result<Self>

pub fn compact_cells(&self) -> bool

The cell encoding new cells on this pool are written in.

pub fn set_compact_cells(&self, on: bool)

Install the encoding the DATABASE declares. Called once per open, by the owner that read the header; never derived from build flags after creation, and never changed while a tree is being written.

pub fn resource_limits(&self) -> Option<ResourceLimits>

pub fn tracked_pages(&self) -> (usize, usize)

pub fn stats(&self) -> PoolStats

pub fn page_count(&self) -> u32

Pages allocated in this file so far. The scan uses it as a ceiling on how many leaves a sibling chain can legitimately visit.

pub fn epoch_allocated_bytes(&self) -> u64

Allocations (including reuse) since the last root publication. This counts touched shadow/overflow pages even after dirty-frame eviction.

pub fn set_stamp_gen(&self, gen: u64)

Set the generation stamped into pages sealed from now on (2n): the store calls this at open and after every checkpoint flip.

pub fn free_page(&self, page_no: u32) -> Result<()>

Record page_no as superseded (2n): its replacement was just shadowed into a fresh page. Keyed by the CURRENT epoch; see the free field for when it becomes reusable. Never pages 0/1 (meta).

pub fn set_reuse_limit(&self, limit: u64)

Advance the recycling horizon (2n): pages freed at generations <= limit may be handed out again. The store computes the limit (published - 1, min’d with the oldest live snapshot reader).

pub fn export_free(&self, published_generation: u64) -> Vec<u8>

Serialize the freelist for the checkpoint’s sidecar file (2n step D): [magic 8][version u16][reserved 6][published generation u64], then [freed-at-gen u64][n u32][(page u32, birth u64) * n]… and a crc32c trailer. The publication generation is what makes an old, otherwise valid sidecar unusable beside a newer data file. Loss, mismatch or corruption can therefore only LEAK pages, never recycle live ones. Version 2 adds eight bytes per retired page to avoid losing lifetime evidence on reopen. Version 1 is rejected as derived state, never guessed/migrated.

pub fn import_free(&self, bytes: &[u8], expected_generation: u64) -> bool

Load a persisted freelist (reopen). Anything malformed or stamped for another data generation becomes an empty list (the leak-only posture). Every page number is rejected unless it is inside this exact file.

pub fn free_pages_split(&self) -> (usize, usize)

(eligible-now, waiting-on-horizon) freelist depths (tests/probes).

pub fn free_pages_pending(&self) -> usize

Sum of pages currently waiting on the freelist (tests/probes).

pub fn set_frozen_boundary(&self)

2f: page numbers below this boundary belong to the last PUBLISHED root (the checkpoint a snapshot reader may be standing on) and are immutable – writers shadow them to fresh numbers instead of editing in place. get_mut asserts it. Meta slots (pages 0 and 1) are the publication mechanism itself and are exempt. Boundary 0 = no epoch published yet, everything mutable (fresh store before first publish).

pub fn frozen_boundary(&self) -> u32

pub fn finish_stable_page_epoch(&self)

Experimental stable-page pager owns snapshot versions outside the pool.

pub fn is_frozen(&self, page_no: u32) -> bool

pub fn io_stats(&self) -> Option<&IoStats>

pub fn reset_peak_pins(&self)

Re-baseline the high-water mark to the pins currently held, so a caller can measure the peak over one specific operation.

pub fn sweep_steps(&self) -> u64

Diagnostic: total clock-sweep steps across all victim() calls. A CLOCK pathology shows here as steps >> misses – every hit re-arms a ref bit, so a miss arriving after many hits must strip a large stretch of the table before it finds a victim.

pub fn read_run_uncached( &self, start: u32, n: u32, buf: &mut Vec<u8>, ) -> Result<bool>

Read n consecutive pages in ONE pread into buf, WITHOUT caching them (2e ablation A1, for overflow chains). Returns Ok(false) if any page in the run is resident – a resident frame may be dirtier than disk, so the caller must take the per-page pool path instead. Each page’s checksum is verified at this medium boundary exactly as load verifies it; a failure refuses the whole run and caches nothing.

SACRIFICE (Law 4): pages read this way do not warm the cache – an immediate re-read pays the pread again. Bought: one syscall per chain instead of one per page, and single-use payload pages never evict a hot tree page.

pub fn get(&self, page_no: u32) -> Result<PinnedRead<'_>>

pub fn get_mut(&self, page_no: u32) -> Result<PinnedWrite<'_>>

pub fn allocate(&self) -> Result<PinnedWrite<'_>>

pub fn flush_all(&self, barrier: Barrier) -> Result<()>