Struct PoolMigrationAuditStore 

pub struct PoolMigrationAuditStore { /* private fields */ }

Durable, provenance-separated source reconciliation and target body proofs.

A source entry means root independently observed the exact source key and a terminal Stored target catalog location whose catalog supplied the size. It is not a source-body or target-body proof. A target entry means the target body was independently hash-verified. The root controller owns the writable instance. Workers open it read-only.

Implementations

impl PoolMigrationAuditStore

pub fn open(path: &Path, binding: Hash) -> Result<Self, StoreError>

pub fn open_read_only(path: &Path, binding: Hash) -> Result<Self, StoreError>

pub fn path(&self) -> &Path

pub fn binding(&self) -> Hash

pub fn contains_source_reconciled_exact_sorted( &self, candidates: &[(Hash, u64)], ) -> Result<Vec<bool>, StoreError>

Return whether each sorted source candidate already has an exact durable hash/size reconciliation. A conflicting size is corruption, never a cache miss.

pub fn contains_target_exact_sorted( &self, candidates: &[(Hash, u64)], ) -> Result<Vec<bool>, StoreError>

pub fn record_reconciled_source( &self, entries: &[(Hash, u64)], ) -> Result<(), StoreError>

Root-commit exact source-to-target catalog reconciliations.

These entries deliberately do not enter target_verified: the exhaustive target audit must still read and hash every target body.

pub fn begin_target_fenced_epoch( &self, fence_binding: Hash, ) -> Result<(), StoreError>

Start or resume the target-fenced certification epoch. Existing hash/size body proofs remain valid under Pool’s content-addressed, non-replacing write contract. The raw catalog cursor is reset on the first transition so every final catalog row is revisited under the exact held fence.

pub fn target_fence_binding(&self) -> Result<Option<Hash>, StoreError>

pub fn record_verified_target_page( &self, entries: &[(Hash, u64)], cursor: Hash, ) -> Result<(), StoreError>

Commit exact target content proofs and their raw catalog cursor in one force-synced transaction. The cursor can therefore never become durable ahead of the proofs that allowed it to advance.

pub fn prepare_target_import(&self, authority: Hash) -> Result<bool, StoreError>

Prepare a quarantined import bound to the complete certification and evidence authority. Returns true when the caller must rebuild the staging database, or false when an authenticated promotion can be resumed (or has already completed).

Unauthenticated staging rows are never consulted by target queries or exports. A changed authority fails closed for the lifetime of this rollout-bound audit store.

pub fn stage_target_import_entries( &self, authority: Hash, entries: &[(Hash, u64)], ) -> Result<(), StoreError>

Append exact hash/size rows to the untrusted quarantine. This never changes the target proof set visible to migration workers.

pub fn authenticate_target_import( &self, authority: Hash, ) -> Result<(), StoreError>

Make a completely validated staging database eligible for promotion. The caller may invoke this only after authenticated EOF and exact receipt-summary validation. The marker and all prior staging batches are ordered by force-synced LMDB commits.

pub fn promote_authenticated_target_import_batch( &self, authority: Hash, batch_size: usize, ) -> Result<bool, StoreError>

Promote at most one authenticated staging batch into the visible proof set. Returns true once promotion and quarantine cleanup are durable.

A crash can expose only a prefix whose complete source manifest was already authenticated. The promotion cursor and target writes share one LMDB transaction. Each promoted staging row is deleted in that same transaction, so promotion never needs a second full-size copy of the imported proof set. The authenticated marker makes destructive draining safe, while the cursor makes retries exact and idempotent.

pub fn promoted_target_import_authority( &self, ) -> Result<Option<Hash>, StoreError>

pub fn target_cursor(&self) -> Result<Option<Hash>, StoreError>

pub fn reset_target_cursor(&self) -> Result<(), StoreError>

pub fn for_each_source_reconciled_batch( &self, batch_size: usize, visit: impl FnMut(&[(Hash, u64)]) -> Result<(), StoreError>, ) -> Result<PoolMigrationAuditSummary, StoreError>

Stream every reconciled source hash/size record in canonical order.

pub fn for_each_target_verified_batch( &self, batch_size: usize, visit: impl FnMut(&[(Hash, u64)]) -> Result<(), StoreError>, ) -> Result<PoolMigrationAuditSummary, StoreError>

pub fn first_unreconciled_source_key( &self, source: &LmdbBlobReader, page_size: usize, ) -> Result<Option<Hash>, StoreError>

Find the first source key not covered by this durable set.

This scans only the authoritative raw blob keys. It never reads source values, metadata sizes, external file lengths, or payload bodies.

pub fn first_unreconciled_source_key_parallel( &self, source: &LmdbBlobReader, page_size: usize, concurrency: usize, ) -> Result<Option<Hash>, StoreError>

Find the first source key not covered by this durable set using an ordered, coherent-snapshot parallel raw-key scan.

Only source keys are prefetched. LMDB values, metadata sizes, external file lengths, and payload bodies are never requested.

pub fn validate_binding(&self) -> Result<(), StoreError>