Module cache 

Per-edge query result cache.

Keyed by (fingerprint, params_hash, database, user). The tenant identity (database/user) is carried verbatim in the key — a 64-bit params_hash collision alone can never alias two tenants’ entries (mirrors the query-cache CacheKey).

Internals: one std::sync::Mutex over the LRU map plus a table -> keys reverse index — get/insert are O(1), and a table-targeted invalidate touches only the keys registered under the written tables (O(matching entries), not O(all entries)). Only an empty table set (an unparseable write) falls back to the full scan. The lock is never held across an await (every method is sync).

Version domains

Entry version stamps and invalidation up_to_version bounds must come from the SAME clock or sweeps are meaningless:

• Home role: one local counter (next_version) stamps read misses and mints write versions — a single domain.
• Edge role: writes are versioned by the HOME, so edge entries are stamped with the last observed home version (observed_home_version), never with local mints. Any read that began before a home write therefore carries a stamp < that write’s version and is always swept by its invalidation.

Store races are closed per role: the home re-checks the invalidated_hwm under the map lock (insert_if_fresh), the edge re-checks the invalidation epoch under the map lock (insert_if_epoch) — both piggyback on invalidate() bumping its atomics before taking the map lock, so either the store observes the bump and skips, or the sweep runs after the insert and drops it.

Home epochs

The home’s version clock is per-process; a home restart resets it. Every InvalidationEvent (and the subscribe-time hello frame) carries the home’s per-boot epoch; when the edge observes an epoch change (on_home_epoch) it flushes everything and resets its observed-home clock, so post-restart invalidations sweep correctly instead of silently no-op’ing against pre-restart stamps.

Structs

CacheEntry

One cached query result.

CacheKey

Cache key. database/user are verbatim tenant identity — two tenants can never alias through a params_hash collision.

EdgeCache

LRU + version + TTL cache. Cheap to clone via Arc.

EdgeCacheStats