ic_backup/ports/fence_acquisition/
mod.rs

1//! Application-owned single-update fence acquisition port; no installed implementation.
2
3use crate::model::fence_acquisition::{FenceAcquisitionAcknowledgement, FenceAcquisitionRequest};
4use thiserror::Error;
5
6/// One previously accounted application update for the exact original selected unit.
7///
8/// Before invocation the integration retains exact payload bytes, original plans,
9/// requirements and obligation, plus source references for unfinished restore work.
10/// It durably reserves the original mutation and qualifies fresh exact actual network,
11/// caller, receiver/whole-unit membership, acquisition permissions, application method/
12/// argument semantics, original fence/revisions and outside-snapshot restore custody.
13/// Complete dependency evidence and exclusive dispatch/command custody are required.
14/// The structural request proves none of these facts and is not a dispatch permit.
15///
16/// Invoke only when qualified custody proves this reservation has never been
17/// dispatched. A pending reservation after interruption is not that proof; reconcile
18/// instead. Send exactly its receiver/method/arguments as one host replicated update,
19/// with no proxy/query substitution, implicit funding, mutation batching or hidden
20/// retries or extra remote observations. Provider reissues require distinct prior approved accounting;
21/// they cannot occur within this invocation. Local locks do not exclude remote actors.
22///
23/// An acknowledgement associates retained actual reply bytes and authenticated
24/// context with the exact original authority/attempt. It is not an acquisition
25/// receipt, current Active fence or negative effect proof. Independently qualify
26/// whole-unit original-request attribution before any direct journal settlement.
27/// Provider errors/drop/death retain the consumed pending mutation, obligations and
28/// references; never synthesize nonapplication or a refund. Lost replies require
29/// the reserved reconciliation port, not another invocation of this mutation.
30/// Terminal replay is local and invokes no provider. No automatic release exists.
31pub trait FenceAcquisitionProvider {
32    /// Submit one originally reserved exact application acquisition update.
33    /// # Errors
34    /// Every failure retains consumed pending evidence; no variant proves nonapplication.
35    fn acquire_fence(
36        &mut self,
37        request: &FenceAcquisitionRequest<'_>,
38    ) -> Result<FenceAcquisitionAcknowledgement, FenceAcquisitionProviderError>;
39}
40
41/// Redacted application update failure; no automatic receipt, refund or retry.
42#[derive(Clone, Copy, Debug, Eq, Error, PartialEq)]
43pub enum FenceAcquisitionProviderError {
44    /// No qualified provider, without dispatch.
45    #[error("fence acquisition provider unavailable")]
46    Unavailable,
47    /// Application cannot qualify this exact whole-unit acquisition contract.
48    #[error("fence acquisition contract unsupported")]
49    Unsupported,
50    /// Dispatch/reply/authority outcome is indeterminate; reconcile the pending acquisition.
51    #[error("fence acquisition update indeterminate")]
52    Indeterminate,
53}
ic_backup/ports/fence_acquisition/mod.rs

ic_backup/ports/fence_acquisition/
mod.rs
