Struct DatabaseBuilderReservation 

pub struct DatabaseBuilderReservation { /* private fields */ }

An atomically claimed, identity-bound pathname for building a replacement database image.

Two-phase create protocol. Phase 1 (Connection::reserve_schema_only_builder_target) claims the pathname with create-new/no-follow semantics and retains the descriptor that created it. Phase 2 (Connection::initialize_reserved_schema_only_builder) revalidates and hands back a writable builder connection bound to Self::identity.

Keeping this value alive for the whole build is not bookkeeping — it is the guarantee. Holding the creating descriptor open prevents the inode being recycled, so every later check runs against a stable identity rather than a re-resolved pathname, which is what closes the create-then-swap window. A caller must therefore hold the reservation across construction and finish with Self::revalidate_final_target, not drop it after phase 2.

Every supported native platform rechecks the retained and pathname-opened handles against the reserved identity. Unix additionally requires each handle’s link count to remain exactly one. Windows has no corresponding portable metadata check here, so this type does not promise link-count enforcement there.

Existing paths are never opened, truncated, replaced, or unlinked by reservation: the builder can only ever write to a file it created.

Implementations

impl DatabaseBuilderReservation

pub fn path(&self) -> &Path

Absolute, stable pathname atomically reserved for the builder.

pub const fn identity(&self) -> FileIdentity

Stable identity of the retained create-new descriptor.

pub const fn write_set_page_limit(&self) -> usize

The validated write-set page ceiling recorded for this build.

pub const fn write_set_limit_enforced(&self) -> bool

Whether the recorded write-set ceiling is enforced by the engine during the build.

true: the ceiling is installed on the builder’s pager and checked in SimpleTransaction::write_page / write_page_data before a new page enters the write set, so an over-budget build fails with a typed FrankenError::OutOfRange at the moment of excess rather than at commit. Distinct from page_buffer_max, which caps resident buffers — a memory bound, not a bound on how much of the database is rewritten.

The ceiling covers caller-staged pages; commit-time engine metadata (page 1, freelist serialization) is excluded and is not caller-attributable.

pub fn revalidate_final_target(&self, expected_len: Option<u64>) -> Result<()>

Fail-closed final validation of the retained create-new authority.

Call after the private build and immediately before releasing the reservation. Proves, twice over, that the retained descriptor and the final no-follow pathname resolve to the same regular file of the expected exact length. Unix additionally refuses any link count other than one; Windows preserves the identity/path checks but does not expose equivalent link-count enforcement through this contract.

Errors

FrankenError::CannotOpen on any mismatch, and FrankenError::Unsupported on non-native builds, which refuse rather than skipping the check.

Trait Implementations

impl Debug for DatabaseBuilderReservation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.