Struct PendingDatabaseImagePublication 

pub struct PendingDatabaseImagePublication<'a> { /* private fields */ }

A whole-image publication held open at the last point before commit.

Returned by Connection::begin_database_image_publication. The candidate already carries source-derived change-counter provenance and is open identity-bound and read-only; read it through Self::candidate.

Finish with Self::commit or Self::abandon. Dropping the guard does neither and leaves the candidate carrying provenance it did not earn — it will fail its own receipt check on any later attempt, which is fail-closed but not what the caller asked for, so the drop path logs an error.

Implementations

impl PendingDatabaseImagePublication<'_>

pub fn candidate(&self) -> &Connection

The identity-bound, read-only handle on the pinned candidate.

Every pre-commit read of the candidate must go through this connection; opening the path separately would not be identity-bound.

pub const fn candidate_receipt(&self) -> &DatabaseImageReceipt

Exact receipt of the counter-repaired candidate about to be published.

pub const fn structural_stats(&self) -> Option<&BoundedDatabaseStructuralStats>

Structural proof counters for the pinned candidate.

Some only when the publication was begun with Connection::begin_bounded_database_image_publication. None means no ownership proof ran — the candidate passed quick_check and integrity_check and nothing more, so a caller must not report it as a bounded proof.

pub async fn abandon(self) -> Result<()>

Refuse this publication and restore the candidate’s exact provisional receipt.

The source database is untouched; it was never written.

Errors

Returns FrankenError::DatabaseCorrupt when the candidate could not be proven restored to its provisional bytes, plus any close error.

pub async fn commit(self) -> Result<DatabaseImagePublication>

Cross the commit point: publish the candidate over the source image.

Re-proves that the candidate did not change while the caller held the guard, checks that it still carries source-derived provenance, performs the durable swap, and then rebinds this connection onto the new image. A pre-commit refusal here restores the candidate exactly as Self::abandon would.

Errors

Returns FrankenError::DatabaseCorrupt when the candidate changed during the window or lost its provenance, and any propagated publication error. A failure to rebind after the durable swap is not an error: it is reported as DatabaseImagePublication::CommittedConnectionPoisoned.

Trait Implementations

impl Debug for PendingDatabaseImagePublication<'_>

Available on non-WebAssembly only.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for PendingDatabaseImagePublication<'_>

Available on non-WebAssembly only.

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.