Struct PoolStoreWithFallbacks 

pub struct PoolStoreWithFallbacks { /* private fields */ }

A PoolStore with temporary exact-hash lookup fallbacks used during an online migration from the former hot and legacy LMDB tiers.

PoolStore remains the sole writable and enumerable store. Fallbacks are consulted only after a pool miss, so new writes stop extending the legacy migration tail immediately. Explicit deletes fail closed until the fallbacks are removed after migration.

Methods from Deref<Target = PoolStore>

pub fn delete_protection_status( &self, ) -> Result<Option<PoolDeleteProtectionStatus>, StoreError>

pub fn acquire_delete_protection( &self, lease_id: [u8; 32], reason: &str, ) -> Result<PoolDeleteProtectionChange, StoreError>

pub fn hold_delete_protection( &self, lease_id: [u8; 32], expected_record_sha256: [u8; 32], ) -> Result<PoolDeleteProtectionGuard, StoreError>

Hold the exact durable delete-protection record against release while a long-running online retirement audit uses it as an append-only Pool authority. Ordinary writes and physical member moves remain available.

pub fn release_delete_protection( &self, lease_id: [u8; 32], expected_record_sha256: [u8; 32], ) -> Result<PoolDeleteProtectionChange, StoreError>

pub fn maintain( &self, max_items: usize, ) -> Result<PoolMaintenanceReport, StoreError>

pub fn maintain_with_batch_items( &self, max_items: usize, batch_items: usize, ) -> Result<PoolMaintenanceReport, StoreError>

pub fn balance_temperature(&self) -> Result<PoolTemperatureReport, StoreError>

pub fn stop_temperature_worker(&self) -> Result<(), StoreError>

Stop this process’s background temperature balancer.

Exact maintenance and recovery commands use this before taking catalog snapshots so the same Pool handle cannot relocate blobs behind their authority checks.

pub fn add_member( &self, config: PoolMemberConfig, ) -> Result<PoolMemberId, StoreError>

pub fn begin_drain(&self, id: PoolMemberId) -> Result<(), StoreError>

pub fn update_member_limits( &self, id: PoolMemberId, capacity_bytes: u64, max_read_concurrency: u32, max_write_concurrency: u32, ) -> Result<(), StoreError>

pub fn update_member_temperature_watermarks( &self, id: PoolMemberId, low_percent: u8, high_percent: u8, ) -> Result<(), StoreError>

pub fn remove_member(&self, id: PoolMemberId) -> Result<(), StoreError>

pub fn member(&self, id: PoolMemberId) -> Result<PoolMemberStatus, StoreError>

pub fn members(&self) -> Result<Vec<PoolMemberStatus>, StoreError>

pub fn blob_location( &self, hash: &[u8; 32], ) -> Result<Option<PoolMemberId>, StoreError>

pub fn put_sync(&self, hash: [u8; 32], data: &[u8]) -> Result<bool, StoreError>

pub fn put_many_report_sync( &self, items: &[([u8; 32], Vec<u8>)], ) -> Result<PutManyReport, StoreError>

pub fn put_many_optimistic_report_sync( &self, items: &[([u8; 32], Vec<u8>)], ) -> Result<PutManyReport, StoreError>

Insert a locally generated content-addressed batch while trusting catalogued committed locations. Pending locations still take the ordinary repair path; stored and moving locations need no payload read.

pub fn put_many_sync( &self, items: &[([u8; 32], Vec<u8>)], ) -> Result<usize, StoreError>

pub fn put_many_optimistic_sync( &self, items: &[([u8; 32], Vec<u8>)], ) -> Result<usize, StoreError>

pub fn get_sync(&self, hash: &[u8; 32]) -> Result<Option<Vec<u8>>, StoreError>

pub fn get_range_sync( &self, hash: &[u8; 32], start: u64, end_inclusive: u64, ) -> Result<Option<Vec<u8>>, StoreError>

pub fn blob_size_sync(&self, hash: &[u8; 32]) -> Result<Option<u64>, StoreError>

pub fn exists(&self, hash: &[u8; 32]) -> Result<bool, StoreError>

pub fn existing_hashes_in_sorted_candidates( &self, sorted_hashes: &[[u8; 32]], ) -> Result<Vec<bool>, StoreError>

pub fn committed_hashes_in_sorted_candidates( &self, sorted_hashes: &[[u8; 32]], ) -> Result<Vec<bool>, StoreError>

Mark hashes whose pool catalog entries represent committed data.

Pending records deliberately return false so an interrupted migration supplies the source bytes again and lets the ordinary repair/finalize path complete them. Stored and moving records are already durable and can be skipped by an incremental migration without rereading payloads.

pub fn catalog_locations_in_sorted_candidates( &self, sorted_hashes: &[[u8; 32]], ) -> Result<Vec<PoolCatalogLocation>, StoreError>

Return the exact catalog state for one sorted source page using a single read transaction.

Migration reconciliation uses this to distinguish a terminal size-matched Stored record from Missing, crash-left Pending, and non-terminal Moving without loading target payload bytes.

pub fn scan_catalog_locations_after( &self, after: Option<[u8; 32]>, limit: usize, ) -> Result<Vec<([u8; 32], PoolCatalogLocation)>, StoreError>

Scan one bounded raw catalog page in hash order.

Online migration content audits use the raw catalog key as their resumable cursor. Pending and moving rows are returned explicitly: they are not terminal content authorities, but their keys must still advance the scan so a page containing only transient rows makes progress.

pub fn largest_member_map_size_bytes(&self) -> Result<Option<usize>, StoreError>

Largest map size among members that are available in this process.

The pool catalog is a separate LMDB environment and is intentionally not reported as blob capacity.

pub fn delete_sync(&self, hash: &[u8; 32]) -> Result<bool, StoreError>

pub fn delete_many_sync(&self, hashes: &[[u8; 32]]) -> Result<usize, StoreError>

Delete a batch with one transaction per affected member and one pool catalog transaction.

pub fn cleanup_stale_pending_exact_offline_sync( &self, expected: &[PoolStalePending], ) -> Result<PoolStalePendingCleanupReport, StoreError>

Clear one exact, bounded set of crash-abandoned Pending records.

This is deliberately narrower than Self::delete_many_sync: every live location must still equal the authorized (hash, member, size), no hash may be pinned or owned by a move, and no member may contain a physical record for the hash. The catalog and all secondary indexes change in one transaction and are force-synced before success.

A caller must stop and fence every Pool writer before its strict read-only audit and keep that fence through this call. This includes clones and handles in this process: a writer can commit Pending, pause before entering its member gate, and otherwise resume after cleanup. Catalog and member LMDB environments do not provide one atomic cross-environment transaction, so this method intentionally makes no online-safety claim.

pub fn pin_sync(&self, hash: &[u8; 32]) -> Result<(), StoreError>

pub fn unpin_sync(&self, hash: &[u8; 32]) -> Result<(), StoreError>

pub fn pin_count_sync(&self, hash: &[u8; 32]) -> Result<u32, StoreError>

pub fn touch_accessed_sync( &self, hash: &[u8; 32], now: u64, ) -> Result<bool, StoreError>

pub fn touch_many_accessed_sync( &self, hashes: &[[u8; 32]], now: u64, ) -> Result<usize, StoreError>

pub fn last_accessed_at_sync( &self, hash: &[u8; 32], ) -> Result<Option<u64>, StoreError>

pub fn many_last_accessed_at_sync( &self, hashes: &[[u8; 32]], ) -> Result<Vec<([u8; 32], u64)>, StoreError>

pub fn list(&self) -> Result<Vec<[u8; 32]>, StoreError>

pub fn stats(&self) -> Result<StoreStats, StoreError>

pub fn writable_physical_stats(&self) -> Result<StoreStats, StoreError>

Return conservative physical usage for quota admission without scanning the logical Pool catalog.

Every member LMDB maintains its own totals transactionally, so summing those counters is constant in the member count and remains accurate across processes and mixed binary versions. Blobs temporarily duplicated during a move are counted in both members, which is intentionally conservative for writable-space admission. Missing member statistics fail closed rather than undercounting storage.

pub fn force_sync(&self) -> Result<(), StoreError>

pub fn catalog_map_size_bytes(&self) -> u64

Current LMDB virtual map size for the Pool catalog.

pub fn validate_controlled_member_state_exact(&self) -> Result<(), StoreError>

Exhaustively prove every controlled member’s physical indexes and persisted aggregate counters before the first migration mutation.

Controlled reopen performs only constant-time structural checks so bounded mapping epochs do not rescan the complete target. The caller must hold the external writer fence while this one full proof runs and must keep that fence held until migration completion.

pub fn validate_controlled_authority(&self) -> Result<(), StoreError>

Revalidate every controlled catalog/member authority without forcing unrelated writer commits to storage.

This is sufficient before advancing a migration cursor when the migration observed exact Stored rows and performed no target writes. Any batch that attempted target writes must use Self::validate_controlled_authority_and_sync instead.

pub fn validate_controlled_authority_and_sync(&self) -> Result<(), StoreError>

Revalidate every controlled authority and force the catalog/member commits durable before an external migration cursor may advance.

Trait Implementations

impl Deref for PoolStoreWithFallbacks

Available on crate feature lmdb only.

type Target = PoolStore

The resulting type after dereferencing.

fn deref(&self) -> &Self::Target

Dereferences the value.