Struct FailoverController 

pub struct FailoverController { /* private fields */ }

Failover Controller

Implementations

impl FailoverController

pub fn new(config: FailoverConfig) -> Self

Create a new failover controller

pub fn with_backend_template(self, template: BackendConfig) -> Self

Attach a backend-connection template so sync-wait and promotion can actually run SQL against the candidate.

pub async fn set_primary(&self, node_id: NodeId)

Set the current primary

pub async fn get_primary(&self) -> Option<NodeId>

Get the current primary

pub async fn register_candidate(&self, candidate: FailoverCandidate)

Register a failover candidate (standby)

pub async fn remove_candidate(&self, node_id: &NodeId)

Remove a failover candidate

pub async fn update_candidate_lag(&self, node_id: &NodeId, lag_bytes: u64)

Update candidate lag

pub async fn state(&self) -> FailoverState

Get current state

pub async fn on_primary_failed(&self, node_id: NodeId) -> Result<()>

Handle primary failure

pub async fn initiate_failover(&self) -> Result<()>

Initiate failover to best candidate

pub async fn on_old_primary_recovered(&self, node_id: NodeId)

Handle old primary recovery (split-brain prevention).

PostgreSQL has no built-in “demote the current primary” command — re-joining as a standby requires stopping the process and re-initialising (pg_rewind or pg_basebackup). This method therefore cannot fully automate demotion. What it CAN do:

1. Connect to the recovered node and verify whether it still believes it is the primary (pg_is_in_recovery() = false).
2. Emit OldPrimaryRecovered so operators (or an external orchestrator like Patroni / pg_auto_failover) can react.

This is deliberately read-only. Rewriting WAL on a live cluster without operator oversight is the canonical way to lose data; the proxy refuses to do it.

pub async fn manual_failover(&self, target: NodeId) -> Result<()>

Manual failover to specific node

pub fn failover_count(&self) -> u64

Get failover count

pub async fn history(&self) -> Vec<FailoverHistoryEntry>

Get failover history

pub fn take_event_receiver(&mut self) -> Option<Receiver<FailoverEvent>>

Take the event receiver

pub async fn coordinate_failover_replay( &self, journal: &TransactionJournal, failed_node: NodeId, new_primary_endpoint: &NodeEndpoint, ) -> Result<CoordinatedReplayResult>

Coordinate transaction replay after failover (TR integration)

This method orchestrates the replay of in-flight transactions on a new primary after a failover event. It ensures transaction atomicity by:

1. Getting all active transactions from the journal that were on the failed node
2. Waiting for the new primary to catch up to the required LSN
3. Replaying each transaction’s statements on the new primary
4. Verifying results match the original execution (via checksums)