Struct Storage 

pub struct Storage { /* private fields */ }

Mutation admission is serialized by the caller. Read-only work uses a captured selection and independent reader after releasing that admission.

Implementations

impl Storage

pub fn decide_resolved( &mut self, request: &ResolvedMutation, ) -> Result<Admission, Failure>

Decide a resolved request without publishing or retaining another version. Receipt reconciliation precedes every contract and origin check.

Errors

Refuses reused identities, changed dependencies, unconfirmed heads and mutation kinds whose dependencies cannot yet be proved. Propagates reads.

impl Storage

pub fn embed_inherit(&mut self, fork: &str) -> Result<Inherited, Failure>

Gives fork a companion made from its parent’s (F1).

Errors

branch_missing; whatever reading the provenance, a position or a declaration, making the companion or the commit answers.

impl Storage

pub fn embed_commit( &mut self, branch: &str, page: &Page, page_records: NonZeroUsize, ) -> Result<Committed, Failure>

Commits page into branch’s companion: its vectors, its removals and the new position, in one commit. The companion is made on the first page.

Errors

embed_page_too_large past page_records; branch_missing; embed_position_ahead for toward past the head; embed_field_not_declared; embed_model_mismatch; embed_walk_open; embed_position_backwards; embed_walk_backwards; embed_page_outside_walk; embed_vector_length; embed_page_stale_text; whatever a read or the commit answers.

pub fn position( &self, companion: &str, key: &[u8], ) -> Result<Option<Position>, Failure>

The job’s position in companion, or None before its first page.

Errors

Propagates companion read failures or an invalid stored embedding position.

impl Storage

pub fn embed_pending( &self, branch: &str, collection: &str, field: &str, page_records: NonZeroUsize, input_bytes: NonZeroUsize, ) -> Result<Option<Pending>, Failure>

The next page of branch’s walk for collection.field, at most page_records changes; None when the position is at the head and no walk is open.

Errors

branch_missing; embed_field_not_declared; embed_walk_released when a version the walk needs is no longer kept; embed_record_id_corrupt; whatever a read or the diff answers.

impl Storage

pub fn embed_prune( &mut self, branch: &str, page_records: NonZeroUsize, ) -> Result<Pruned, Failure>

Removes, in one commit, up to page_records vector keys of the first field in branch’s companion that the branch does not declare embedded at its head and that has no position (F7).

Errors

branch_missing; embed_vector_key_corrupt for a vector key that is not UTF-8 or names no field; whatever a read or the commit answers.

impl Storage

pub fn embed_rewalk_longer( &mut self, branch: &str, collection: &str, field: &str, ) -> Result<Version, Failure>

Opens the rewalk of branch’s collection.field toward its position’s through, which it answers.

Errors

branch_missing; embed_field_not_declared; embed_rewalk_not_ready when the field has no position of branch’s own with a finished walk; embed_walk_open while a walk or rewalk is open; whatever a read or the commit answers.

impl Storage

pub fn embedding_state( &self, at: &Captured, collection: &str, field: &str, ) -> Result<Embedding, Failure>

How far the job has embedded collection.field against at.

Errors

embed_search_not_ready when at’s branch has no companion or the field no position: nothing is embedded yet, and a search never answers empty for it. Whatever a read answers.

pub fn embedded_field( &self, at: &Captured, collection: &str, field: &str, ) -> Result<(Declaration, Option<Captured>), Failure>

The declaration of collection.field at at, and the companion of at’s branch as it is now.

Errors

embed_field_not_declared; whatever a read answers.

pub fn embedded_fields( &self, at: &Captured, ) -> Result<Vec<(String, String)>, Failure>

Every (collection, field) declared embedded at at (EW1: the walks the embedding thread starts with).

Errors

vector_declaration_corrupt; whatever a read answers.

impl Storage

pub fn fork_provenance(&self, at: &Captured) -> Result<ForkProvenance, Failure>

Read the explicit fork origin at the selected immutable roots.

Errors

Refuses missing or invalid provenance and propagates storage failures.

impl Storage

pub fn pending_discards(&self) -> Result<Vec<(String, Version)>, Failure>

The discards asked for and not finished, as (branch, version) each, read from their intent records (STOR-003 H1b2): what a release’s floor relies on besides heads, forks and merges. An intent that does not decode refuses the listing by its name; none is passed over.

Errors

discard_intent_corrupt, naming the record.

impl Storage

pub fn rebuild_counts( &mut self, request: &CountsRebuild, ) -> Result<Receipt, Failure>

Counts visible content and installs all counters with one branch version.

Errors

Refuses incomplete operations and scan errors before staging; commit errors preserve the common mutation outcome and receipt reconciliation rules.

pub fn audit_counts( access: &Access, reader: &ReadOnlyDatabase, at: &Captured, ) -> Result<CountsAudit, Failure>

Read-only comparison; withheld callers receive no bucket identities or numbers.

Errors

Propagates corrupt metadata, malformed keys and content read failures.

impl Storage

pub fn dead_page( &self, after: Option<&[u8]>, limit: NonZeroUsize, ) -> Result<DeadPage, Failure>

At most limit markers after the key after (from the first when None), oldest key first: one range read of at most limit + 1 on each shard, never the history.

Errors

reference_missing; dead_generation_corrupt; storage failures.

impl Storage

pub fn merge_open( &mut self, id: &str, source: &MergePin, target: &MergePin, ) -> Result<MergePlan, Failure>

Retain three immutable input versions without changing a visible branch.

Errors

Refuses moved pins, reused identities, abandoned plans and storage failures.

pub fn merge_plan(&self, id: &str) -> Result<Option<MergePlan>, Failure>

Read a merge’s control row from the owner’s current service reference.

Errors

Refuses malformed rows and propagates point-read failures.

pub fn merge_abandon(&mut self, id: &str) -> Result<MergePlan, Failure>

Commit abandonment before releasing any retained input reference.

Errors

Refuses missing plans and reports uncertain commits or unlinks explicitly.

impl Storage

pub fn merge_coverage( &self, merge_id: &str, after: Option<&str>, limit: NonZeroUsize, ) -> Result<MergeCoverage, Failure>

List uncovered affected owners; caller-held pages cannot authorize publication.

Errors

Refuses invalid positions, moved inputs or journal revisions and corrupt rows.

impl Storage

pub fn merge_candidate_restart(&mut self, id: &str) -> Result<bool, Failure>

Release a private candidate without changing its inputs or choice journal.

A later page call provisions again at the journal’s current revision.

Errors

Refuses invalid identities and reports uncertain reference removal explicitly.

pub fn merge_candidate_page( &mut self, id: &str, ) -> Result<CandidateAdvance, Failure>

Advance a private candidate from its durable marker, never a caller cursor.

End means the affected-owner walk ended; it is not a seal or a graph proof. Supplied vector changes require the separate field-wide rebuild and refuse here.

Errors

Refuses moved inputs or choices, missing choices, invalid markers and uncertain writes.

impl Storage

pub fn merge_choose( &mut self, request: &MergeChoose, ) -> Result<MergeChoiceRow, Failure>

Admit one immutable choice from owner bytes at the held input versions.

Errors

Refuses invalid owners, tokens, moved pins, unresolved endpoints and conflicting choices.

pub fn merge_choices( &self, id: &str, after: Option<&str>, limit: NonZeroUsize, ) -> Result<MergeChoices, Failure>

Seek one merge’s journal, refusing a cursor if that journal changed.

Errors

Refuses missing or abandoned plans, malformed rows and invalid or stale cursors.

impl Storage

pub fn receipt( &mut self, query: &ReceiptQuery, ) -> Result<Option<Receipt>, Failure>

Reconcile a receipt and retry only its reference fence, not the write.

Errors

Propagates any error from identifier, get_bytes, from_slice or publish_record.

pub fn mutate(&mut self, request: &Mutation) -> Result<Receipt, Failure>

One durable request identity, validation and effect within admission.

Errors

Propagates any error from identifier, to_vec, replay or prepare_change.

pub fn mutate_bounded( &mut self, request: &Mutation, max_page: NonZeroU32, ) -> Result<Receipt, Failure>

Admit imports up to sixty-four pages, preserving receipt-first replay.

Errors

Propagates mutation preparation, admission, replay and durable commit refusals without changing their outcome classification.

pub fn mutate_with_append_prune_limits( &mut self, request: &Mutation, max_page: NonZeroU32, limits: AppendPruneLimits, ) -> Result<Receipt, Failure>

Admit a mutation with the configured retention and import bounds.

Errors

Preserves receipt-first replay and propagates preparation or commit refusals.

impl Storage

pub fn relied_on( &self, branch: &str, discards: &dyn PendingDiscards, ) -> Result<Floor, Failure>

Everything relying on branch’s versions now, its head among them (STOR-003 HR1).

Errors

branch_missing; whatever reading a fork origin, a merge row or the pending discards answers.

impl Storage

pub fn release( &mut self, branch: &str, limit: Option<NonZeroUsize>, rules: &Rules, discards: &dyn PendingDiscards, ) -> Result<Answer, Failure>

history.release {branch, limit} (STOR-003 HR3): takes the oldest versions of branch that nothing relies on and the keep settings let go, at most limit, in this durable order: one decision row; then the older history files, in one ref operation; then the rows, the mark and the decision’s removal in one commit. A pass is then asked for. A decision a crash left is finished here first, taking only what may still go and saying what held the rest.

Every version taken reads whole until that last commit: its row is still in the service tree, and every reclaim pass marks from the service’s rows (STOR-003 R2), whether or not its older file is gone.

No second release runs beside a decision’s owner: this takes the storage mutably, the service holds it behind one lock, and another process is kept out by the writer lock. A call that meets a decision left behind finishes that decision as it was written, asking no keep setting, hold or limit again (HR4-fix2), and decides nothing new.

Errors

release_limit_exceeded for a limit above rules.max_rows; whatever the floor, a read or a commit answers.

pub fn branch_names(&self) -> Vec<String>

Every live branch, for the driver to ask once at start (STOR-003 HR4-fix): the records in memory, no read.

pub fn decided_branches(&self) -> Result<Vec<String>, Failure>

The branches whose release a crash left decided and unfinished: one range read of the decision rows, never the history (STOR-003 HR4). A decision whose branch has no live record is not named.

Errors

Storage failures.

pub fn advanced_since_release(&self, branch: &str) -> usize

branch’s advances since its last release (STOR-003 HR4).

pub fn sync_counts(&self) -> SyncCounts

The durable operations the store has made, for the release driver to count its own by (STOR-003 HR4).

pub fn date_undated_generation( &mut self, request: &UndatedGeneration, ) -> Result<Version, Failure>

DR-11: writes the marker request names in one service commit: its last version the generation’s newest row, discarded at request.at. Refused by name: branch_live while the name has a record (its release reads every generation), generation_marked when the generation has its marker, generation_empty when it has no rows. Reads the generation’s rows once, a page at a time: an operator’s one request, never a release’s wake. Answers the marker’s last version.

Errors

As above; history_row_corrupt, dead_generation_corrupt; storage failures.

impl Storage

pub fn create( config: DatabaseConfig, branch_cache: NodeCacheBudget, long_wait_interval: Duration, ) -> Result<Self, Failure>

Create only in a previously absent directory. Never adopt application data.

Errors

Refuses unsupported writer policies before branch references are created. Propagates any error from try_exists, open or create_branch_with_kind.

pub fn create_kept( config: DatabaseConfig, branch_cache: NodeCacheBudget, kept: KeptLimit, long_wait_interval: Duration, ) -> Result<Self, Failure>

Self::create, each branch record keeping kept previous versions (STOR-003 MD5a).

Errors

As Self::create.

pub fn open( path: &Path, branch_cache: NodeCacheBudget, long_wait_interval: Duration, ) -> Result<Self, Failure>

Reopen a served directory under its existing exclusive writer lock.

Errors

Refuses unsupported writer policies before engine startup. Propagates any error from open.

pub fn open_kept( path: &Path, branch_cache: NodeCacheBudget, kept: KeptLimit, long_wait_interval: Duration, ) -> Result<Self, Failure>

Self::open, each branch record keeping kept previous versions (STOR-003 MD5a).

Errors

As Self::open.

pub fn capture(&self, selection: &Selection) -> Result<Captured, Failure>

Errors

Returns Failure if capture fails.

pub fn catalogue(&self) -> Catalogue

pub fn discard_passes(&self) -> DiscardPasses

What came of the last discard’s ask for a reclaim pass, shared with whoever answers store.stats.

pub fn reader(&self) -> Result<ReadOnlyDatabase, Failure>

A separate immutable reader can perform captured reads concurrently.

Errors

Returns Failure if open or data_dir fails.