Struct RedbControlStore 

pub struct RedbControlStore { /* private fields */ }

The redb-backed ControlStore: one file, three tables.

Cheap to clone; every clone is the same database. redb serialises write transactions internally, so two threads committing at once is a wait and never a lock error — which is why ControlStore::commit_doc has one failure mode (the expectation did not hold) where the reference store had two (that, and somebody else holds the lock).

Implementations

impl RedbControlStore

pub fn open(path: impl AsRef<Path>) -> Result<Self>

Open — creating if absent — the control database at path.

pub fn control_db(&self) -> Arc<ControlDb>

The handle the runtime growth suspends and resumes. The same Arc the secret store holds.

pub fn in_memory() -> Result<Self>

A control store with no file under it, for tests and for a --dry-run that must not touch the data path.

pub fn secrets(&self) -> RedbSecretStore

The secret store in this same database (2026-08-10).

Handed out from here rather than opened separately, and that is the whole design: redb takes an exclusive file lock, so a second redb::Database over control.redb would fail. One file, one lock, one handle — and the secrets ride the transaction machinery the control plane already has instead of a second durability story beside it.

It is not on ControlStore. That trait is about documents — put_blob / commit_doc / history — and its test decorators (the CAS-ignoring store tests/control_cost.rs proves the retry loop with, and the counting decorator) exist to break exactly those. A secret has none of that shape, so adding it to the trait would make every decorator carry a method it has no opinion about.

Trait Implementations

impl Clone for RedbControlStore

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl ControlStore for RedbControlStore

fn put_blob(&self, bytes: &[u8]) -> Result<BlobId>

Store these bytes and return their address. Idempotent: storing the same bytes twice is one row and the same id.

fn put_blob_unsynced(&self, bytes: &[u8]) -> Result<BlobId>

ControlStore::put_blob for a blob that only a LATER ControlStore::commit_doc makes part of any state (perf twin-apply-fsync, 2026-10-06): the store may keep it without making it durable on its own, because the pointer move that publishes it is durable and persists it — redb’s durable commit persists every earlier commit. Until then it is an unreferenced, content-addressed row nothing can reach, and a crash that takes it takes nothing anybody could see. The default is the durable put_blob.

fn get_blob(&self, id: &BlobId) -> Result<Option<Vec<u8>>>

The bytes at this address, or None if nothing was ever stored there.

fn read_doc(&self, name: &str) -> Result<Option<BlobId>>

Which version name is at, or None for a document that has never been written.

fn commit_doc( &self, name: &str, expected: Option<BlobId>, new: BlobId, ) -> Result<bool>

The compare-and-swap. Move name from expected to new, and append the new version to the audit trail, atomically.

fn history(&self, name: &str) -> Result<Vec<DocVersion>>

Every version name has had, oldest first (the control plane’s audit trail).

impl Debug for RedbControlStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.