Struct ErrorGraph 

pub struct ErrorGraph { /* private fields */ }

Every failure the device is still holding, and how many allocations carry each one.

Implementations

impl ErrorGraph

pub const MAX_SKIPPED: usize = 16

How many Skipped records one failure keeps. Newest win: the walk a read makes starts from the most recent buffers, so keeping the oldest would leave them with no entry to start from, while a deep chain reaching a gap before the root costs nothing — the root is on the node itself and never in the list.

pub fn insert(&mut self, error: ServerError) -> FailureId

Hold error until nothing carries its id any more.

The node starts carried by nothing, so a caller that taints no slice with it must hand it back through prune — otherwise the node waits forever for a decrement that is never coming.

pub fn skipped(&mut self, failure: FailureId, record: Skipped)

Record a launch failure stopped — see Skipped. Keeps the newest MAX_SKIPPED records and counts them all.

pub fn report( &self, failure: FailureId, memory: ManagedMemoryId, ) -> Option<ServerError>

The report a read of memory gets when failure claims its bytes: the root error, and the path from this buffer back toward it, reconstructed by walking the skip records backwards.

pub fn reports( &self, claims: impl Iterator<Item = Claim>, ) -> Result<(), ServerError>

The report a read owes for the claims it found: one error per distinct failure, however many of the buffers carry it, and one per buffer that was never allocated. The second kind is not in the graph, since nothing could carry it, but it is the same answer to the same question.

This is the shape of every “were these bytes written” answer in the system — FailureStore::ensure_written and any harness standing in for it — so the dedup and the wrapping live here rather than once per caller.

Errors

ServerError::Several naming each failure once, in the order the claims were found. The caller has nothing to retry — the bytes are gone — so this is the answer to the read, not a hint to try again.

pub fn untag(&mut self, failure: Option<FailureId>)

One fewer allocation carries failure; the node is dropped when none does.

This is what every shedding path calls — a slice written again, rebound to a new allocation, coalesced away, tombstoned or swept — and the decrement is immediate rather than collected into a list drained later, so a node nothing can reach is never retained just because nothing got around to saying so.

pub fn replace(&mut self, failure: FailureId, error: ServerError)

Swap the error behind failure for error, leaving every carrier pointing at the new one.

This is the exit half of a write scope: entry taints the write set with a provisional node, because the real failure does not exist yet, and exit lands the real one here. A missing node is left missing — the id outlived its carriers, so nothing can read the error either way.

pub fn prune(&mut self, failure: FailureId)

Drop failure if nothing took its id — for a failure that turned out to taint nothing, whose node would otherwise wait forever at zero.

pub fn error(&self, failure: FailureId) -> Option<&ServerError>

The error behind failure.

None means the id outlived its node, which the refcount exists to prevent; a reader treats it as no failure rather than panicking on the device thread.

pub fn len(&self) -> usize

How many failures the device is still holding — the bound the whole design rests on, which is why the property harness watches it.

pub fn is_empty(&self) -> bool

Whether the device is holding no failure at all.

Trait Implementations

impl Debug for ErrorGraph

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ErrorGraph

fn default() -> Self

Returns the “default value” for a type.