Struct LoggedControlStore 

pub struct LoggedControlStore { /* private fields */ }

A ControlStore whose put_blob and commit_doc are frames first.

Implementations

impl LoggedControlStore

pub fn new(inner: Arc<dyn ControlStore>, log: Arc<Log>) -> Self

Wrap.

pub fn inner(&self) -> &Arc<dyn ControlStore>

The wrapped store.

Trait Implementations

impl ControlStore for LoggedControlStore

fn put_blob(&self, bytes: &[u8]) -> Result<BlobId>

A shard blob is framed and stored WITHOUT a flush of its own (perf twin-apply-fsync, 2026-10-06). A content-addressed blob is part of no state until a document points at it, and the pointer move is ALWAYS a later frame: commit_doc appends its ControlDoc frame durably — that fdatasync covers every blob frame staged before it in the same file — and only then moves the pointer with a durable redb commit, which persists every blob row committed before it. So the log is still written before every state anybody can see, and a crash in between leaves at most an unreferenced blob nothing reaches. Measured (tests/main_doc_write_io.rs): one document change was five frames with ten flushes (five fdatasyncs, five redb fsyncs); it is one of each.

fn get_blob(&self, id: &BlobId) -> Result<Option<Vec<u8>>>

The bytes at this address, or None if nothing was ever stored there.

fn read_doc(&self, name: &str) -> Result<Option<BlobId>>

Which version name is at, or None for a document that has never been written.

fn commit_doc( &self, name: &str, expected: Option<BlobId>, new: BlobId, ) -> Result<bool>

The compare-and-swap. Move name from expected to new, and append the new version to the audit trail, atomically.

fn history(&self, name: &str) -> Result<Vec<DocVersion>>

Every version name has had, oldest first (the control plane’s audit trail).

fn put_blob_unsynced(&self, bytes: &[u8]) -> Result<BlobId>

ControlStore::put_blob for a blob that only a LATER ControlStore::commit_doc makes part of any state (perf twin-apply-fsync, 2026-10-06): the store may keep it without making it durable on its own, because the pointer move that publishes it is durable and persists it — redb’s durable commit persists every earlier commit. Until then it is an unreferenced, content-addressed row nothing can reach, and a crash that takes it takes nothing anybody could see. The default is the durable put_blob.