Struct PoolStoreReader 

pub struct PoolStoreReader { /* private fields */ }

Strictly read-only view of a PoolStore for exhaustive validation.

Unlike super::PoolStore, this type opens both the catalog and member environments with MDB_RDONLY. It never finalizes Pending locations, updates access temperature, repairs locations, or records adaptive state. A validator can therefore inspect an online or copied Pool without changing any catalog or member bytes.

Implementations

impl PoolStoreReader

pub fn open<P: AsRef<Path>>( path: P, config: PoolStoreConfig, ) -> Result<Self, StoreError>

pub fn open_sequential<P: AsRef<Path>>( path: P, config: PoolStoreConfig, ) -> Result<Self, StoreError>

Open a strict reader for an exhaustive, key-ordered catalog and payload audit with kernel read-ahead enabled on the catalog and every member LMDB.

pub fn open_sequential_with_read_concurrency<P: AsRef<Path>>( path: P, config: PoolStoreConfig, read_concurrency: usize, ) -> Result<Self, StoreError>

Open an exhaustive reader with bounded parallel reads for distinct loose external member files.

pub fn open_with_unavailable_members_for_audit<P: AsRef<Path>>( path: P, config: PoolStoreConfig, ) -> Result<Self, StoreError>

Open a strict read-only validator while retaining unavailable manifest members as explicit per-read errors.

This is intentionally audit-only behavior. Ordinary readers must use Self::open, which fails immediately when any configured member cannot be opened.

pub fn delete_protection_status( &self, ) -> Result<Option<PoolDeleteProtectionStatus>, StoreError>

pub fn hold_delete_protection( &self, lease_id: Hash, expected_record_sha256: Hash, ) -> Result<PoolDeleteProtectionGuard, StoreError>

pub fn blob_location( &self, hash: &Hash, ) -> Result<Option<PoolMemberId>, StoreError>

pub fn member_ids(&self) -> Vec<PoolMemberId>

Return the exact member identities declared by the Pool manifest.

Validators use this to pin the complete target-member set instead of accidentally accepting a newly added or removed member.

pub fn manifest_identity(&self) -> PoolManifestIdentity

Return the complete manifest identity captured by this reader.

pub fn validate_terminal_catalog_and_payloads( &self, ) -> Result<PoolTerminalAudit, StoreError>

Exhaustively prove terminal catalog and physical member state.

Every location must decode as Stored, reference a manifest member, have its exact secondary index entry, and resolve to bytes of the declared size and SHA-256. Each member’s blob and metadata key sets must be identical and exactly match catalog ownership, so missing metadata and addressable member orphans are rejected even when counts coincide. Callers must keep all target Pool writers fenced for the full scan.

pub fn validate_terminal_catalog_and_physical_state( &self, ) -> Result<PoolPhysicalAudit, StoreError>

Exhaustively prove exact catalog/physical-member parity without rereading multi-terabyte payload bodies.

pub fn scan_terminal_catalog_entries_after( &self, after: Option<Hash>, limit: usize, ) -> Result<Vec<(Hash, u64)>, StoreError>

Scan one bounded terminal catalog page without reading payload bytes.

Every row must already be Stored; callers can merge the returned hash/size stream with an independently certified content-evidence stream while target writers remain fenced.

pub fn member_existing_hashes_in_sorted_candidates( &self, member: PoolMemberId, hashes: &[Hash], ) -> Result<Vec<bool>, StoreError>

Mark which sorted candidate hashes physically exist on one exact Pool member. No catalog fallback or mutation is performed.

pub fn read_member_hashes_bounded_unverified( &self, member: PoolMemberId, hashes: &[Hash], byte_limit: u64, ) -> Result<Vec<(Hash, Vec<u8>)>, StoreError>

Read a bounded prefix of sorted, physically present hashes from one exact Pool member without checking their content hashes.

Callers must pass only hashes reported present by Self::member_existing_hashes_in_sorted_candidates and must verify every returned body against its requested hash.

pub fn blob_member_candidates( &self, hashes: &[Hash], ) -> Result<Vec<Vec<PoolMemberId>>, StoreError>

Resolve candidate member order for many hashes with one catalog transaction. Moving records prefer the target and retain the source as a read fallback; pending and stored records contain one candidate.

pub fn blob_catalog_locations( &self, hashes: &[Hash], ) -> Result<Vec<PoolCatalogLocation>, StoreError>

Return exact catalog state for many hashes in one read transaction.

This deliberately exposes Pending and Moving rather than reducing them to read candidates, so a release audit cannot mistake an in-progress write or relocation for terminal residency.

pub fn blob_size_sync(&self, hash: &Hash) -> Result<Option<u64>, StoreError>

pub fn get_sync(&self, hash: &Hash) -> Result<Option<Vec<u8>>, StoreError>

Read and hash-check bytes without finalizing or otherwise touching the catalog. Moving records try the target first and then the source.

pub fn read_hashes_bounded( &self, hashes: &[Hash], byte_limit: u64, ) -> Result<Vec<PoolReadBatchItem>, StoreError>

Resolve a bounded prefix with one catalog transaction and coalesced member reads. The returned prefix always contains at least one item when hashes is non-empty and byte_limit is non-zero.