Crate flint_store 

The object store behind a trait — L2 step 4 (design review A13, with A6’s conditional-publish contract baked into the signatures).

Only generation ASSEMBLY is backend-specific; everything above this trait (interval log, flush pipeline, eviction, hydration, epoch state machine) is backend-neutral. Backends:

• memory — the in-process test double, implementing the FULL conditional semantics (412/409, stamps, CRC validation, MPU state, epoch CAS). Every backend-neutral tier test runs here.
• s3 — MPU + UploadPartCopy + conditional PUT/Complete per A6/A8.
• Azure Blob (second, per A13): Put Block List with committed-block reuse and NATIVE leases for the epoch. GCS later.

Contract points the signatures enforce:

• No unconditional publish exists. Every write carries either IfMatch (update of a known generation) or IfNoneMatchAny (first generation of a new key). A caller that wants an unguarded overwrite has made a design error upstream (A6).
• The multipart ETag is NOT a content hash and never appears in any integrity role; content identity is the full-object CRC-64/NVME, computed by the flusher from LOCAL truth and validated server-side at publish (a mismatch fails the publish, it does not warn).
• Assembly failure aborts the assembly (A9): no backend may leave a partial MPU behind on an error path it can reach.

Extracted from spdk-csi-driver/src/tier/store/ (2026-08-25) so flint-lean can depend on the store WITHOUT the hub crate’s build (13 binaries, the aws/kube/nfs dep trees). The hub crate re-exports this crate at its old path (crate::tier::store::*), so every existing import keeps working. The s3 backend is feature-gated — test loops that only need the memory double never build the AWS SDK.

Re-exports

pub use counters::RequestCounter;

pub use counters::RequestCounts;

pub use counters::RequestKind;

Modules

counters

Requests a store has sent, by kind.

gate

A bytes-in-flight bound for the UPLOAD path — the write side’s mirror of the checkout window’s fetch_inflight_max_bytes.

layout

Where each flint product keeps the cell that says “I am the writer of this prefix” — and the probe that finds a NEIGHBOUR’s.

memory

The in-process ObjectStore test double.

probe

The version-surface conformance probe.

Structs

BootstrapReport

What bootstrap found/did (A9). errors non-empty ⇒ the tier must refuse to start; warnings are loud-degrade.

ComposeSpec

The flusher’s order for one generation publish.

Crc64Nvme

Streaming CRC-64/NVME (the flusher feeds file ranges through this).

EpochLease

A held lease (write side).

EpochState

Observed epoch state (read side — takeover judgment input).

GenerationStamps

The A6 publish stamps (x-amz-meta-flint-* on S3; each backend maps the bare keys to its metadata namespace). HEAD-based 412 arbitration keys off these — they are how a torn OWN flush is told apart from a genuinely foreign object.

LeaseEcho

What a live lean syncer echoes into its lease-heartbeat cell (boundary-verbs plan §2.6). The schema lives here, beside the cell that carries it, because the WRITER (the syncer) and the READER (the operator) are in different crates and a duplicated mirror struct on either side would drift silently — which is the failure this field exists to detect, not to reproduce.

LifecycleView

One lifecycle rule, reduced to what VERSION RETENTION cares about (lean boundary-verbs plan D8).

ListedObject

ListedVersion

One version of one key (boundary-verbs plan D8’s reclamation and DR surfacing).

ObjectMeta

What HEAD/GET/publish return about an object.

PendingUpload

An in-progress multipart assembly (A9’s hygiene surface).

PosixStamps

The A12 per-object POSIX stamps (flint-mode is octal; times are unix seconds). Enumerated NON-goals of the round-trip: hard-link structure, sockets/FIFOs/devices, and sparseness — see tier::manifest.

RetentionOutcome

What ObjectStore::ensure_noncurrent_retention found or did.

Enums

PartSource

One part of a composed generation, in object order.

PutCondition

A6: every publish is conditional. There is deliberately NO unconditional variant — a caller wanting one has an upstream design error.

StoreError

Traits

ObjectStore

Functions

crc64_combine

CRC-64/NVME of A || B, from the CRCs of A and B and the LENGTH of B. Bytes are never re-read.

crc64_from_b64

The inverse of crc64_to_b64. None for anything that is not a 12-character base64 encoding of exactly 8 bytes — a caller that gets None has been handed something other than a CRC-64, and guessing a number for it would validate a publish against a checksum nobody computed.

crc64_nvme

One-shot convenience.

crc64_to_b64

S3’s wire form: base64 of the checksum’s 8 big-endian bytes.

Type Aliases

StoreResult