Crate kmp_embedded 

Embedded edition composition root (ADR-013): wires the application services over the local store with synchronous in-process projection, and resolves the data directory per the ADR-012 contract and the storage engine per ADR-018. No transport, no infrastructure clients.

Structs

BundleEventRange

Inclusive positions in this bundle’s event stream. Export is a portable replay, not a view over the store’s internal sequence keys: full and filtered bundles both renumber their payload positions from one while preserving every event’s aggregate revision (and therefore every ref). An empty snapshot has neither bound.

BundleHeader

First line of a bundle file: identity and integrity metadata for fail-fast import. Fields added in bundle format 2 default only so format-1 bundles remain readable; every format-2 field is validated before replay.

CommitNativeBundle

The committed head bundle paired with the machine store it protects.

EmbeddedKernel

One opened embedded kernel: the composed service plus the store handle for operational tooling (replay, stats, compaction).

EmbeddedKernelStore

Every kernel persistence port on one local store.

OrphanedProjectBundle

The durability contract lost when an unopenable project store falls back to the shared user store. Selection owns this fact because it is the only layer that knows both paths and the rejected layout reason.

PendingBundleExport

A marker intentionally has no cleanup in Drop: unwinding, a killed process, or an ambiguous backend error are precisely the cases that must remain visible to doctor.

SqliteQualityTelemetryReader

Read-only query adapter for the shareable local quality journal.

StoreMigrationReceipt

What a migration did, kept in the store it produced.

Enums

ResolvedDataDir

Where the data directory came from — logged at startup so the winning resolution rule is always visible.

StorageEngine

The engine behind a data directory’s store/. Chosen once, when the directory is created; recorded as its FORMAT_VERSION; never guessed.

Constants

BUNDLE_FORMAT_VERSION

DATA_DIR_ENV

Explicit data directory override (ADR-012 rule 1).

ENGINE_ENV

Compatibility environment variable. SQLite is the only accepted value.

LEGACY_REDB_FORMAT_VERSION

Layout number used by the removed redb backend. Kept only so current binaries can identify legacy memory and refuse it without touching it.

PENDING_EXPORT_DIR

PROJECT_BUNDLE_PATH

Where a project keeps the committed copy of its memory, relative to the project root.

SUPPORTED_FORMAT_VERSION

The layout this binary creates for a fresh data directory: shareable SQLite (ADR-018).

Functions

clear_pending_bundle_exports

Clears markers after an operator has stopped other writers and explicitly acknowledged that a successful full export contains every committed write.

default_engine_for_data_dir

Implicit engine choice for a data directory when no operator override is present. Existing stores defer to their stamp; fresh stores use SQLite.

ensure_data_dir_skeleton

Creates the non-store part of a KMP data directory.

format_version_path

legacy_quality_telemetry_path

legacy_redb_store_path

Historical format-1 store location. Current binaries never open this file; the path is exposed only for diagnostics and fail-fast detection.

locate_data_dir_from_env

Resolves from the process environment and touches nothing.

merge_bundles

Merges only histories that have a deterministic answer: identical streams or one exact prefix of the other. Two branches that both appended at the same position are a semantic conflict, so KMP refuses to invent an order.

migrate_data_dir

Migrates source_dir into destination_dir, returning what was moved. The destination is created with the default engine.

migrate_data_dir_to

migrate_data_dir with the destination engine chosen. Kept for API compatibility; current binaries only contain SQLite and cannot read format-1 stores.

open_or_migrate_data_dir

Migrate once, reopen afterwards. Safe on every start: a destination that already holds a store is opened as it is, and the returned receipt says whether this call was the one that migrated it.

parse_engine

Parses an engine name the way the environment variable and the CLI spell it. Pure, for testing; resolve_engine_from_env feeds it.

pending_bundle_exports

project_bundle_path

The conventional bundle path for the project data_dir belongs to.

quality_telemetry_path

read_stamped_version

The version stamped in data_dir, without applying the gate.

resolve_data_dir

ADR-012 resolution: env override > project .kernel/ > per-user default. Pure function for testability; resolve_data_dir_from_env feeds it from the process environment.

resolve_data_dir_from_env

Resolves from the process environment and prepares the directory. Every data directory gets the same safety skeleton, regardless of whether it was discovered from a project, supplied explicitly, or created by migration.

resolve_engine_for_data_dir_from_env

Resolves the engine for a particular data directory.

resolve_engine_from_env

The engine KMP_MCP_ENGINE asks for, if it is set. Unset or empty means “no preference”: a fresh directory gets the default, an existing one opens as it is.

store_file_path_for

Where engine keeps its store inside data_dir.

user_data_home

Where user-scope memory lives: the Unix data home when available, then the native Windows local-data directories.

validate_store_layout

Applies the existing-layout gate without creating or opening anything.

verify_bundle

Validates a bundle without opening or mutating a store. This is the recovery check: identity, range, about coverage and digest are all proved before an operator trusts a saved copy.

write_bundle_atomically

Same-directory durable replacement, so a failed export leaves either the previous complete bundle or the next complete bundle, never half a JSONL stream. Unix rename replaces atomically; Windows keeps the previous file beside it until the new one has taken the canonical name.

write_bundle_if_absent

Publishes an immutable bundle without a check-then-replace race. The hard link is an atomic create-if-absent operation on the same filesystem: two snapshot creators can agree on existing content, but neither can replace the other’s recovery point.

Type Aliases

EmbeddedMemoryService

The KMP memory facade composed over one stamped embedded store: every port shares the selected engine, and ingest projects synchronously in-process, which is what makes read_after_write_ready unconditionally true.