Struct SchemaDomain 

pub struct SchemaDomain {
    pub name: &'static str,
    pub migrations: &'static [Migration],
    pub initialize_current: fn(&Transaction<'_>) -> Result<(), Error>,
    pub allowed_existing_versions: &'static [i64],
    pub released_predecessors: &'static [SchemaPredecessor],
    pub bridge_recoverable_versions: &'static [i64],
    pub owned_objects: &'static [SchemaObject],
    pub retired_objects: &'static [SchemaObject],
}

A store’s schema domain: its ledger name plus the ordered migration list.

Fields

name: &'static str

Ledger key. Kebab-case, stable forever (it is persisted in files).

migrations: &'static [Migration]

Ordered migrations, versions contiguous from 1.

initialize_current: fn(&Transaction<'_>) -> Result<(), Error>

Initialize a genuinely fresh domain directly at the current schema.

This is intentionally separate from historical upgrades. A current base initializer may already contain objects that a released predecessor transition creates or rebuilds; replaying the transition on fresh state would either collide or weaken strict collision detection with idempotent DDL.

allowed_existing_versions: &'static [i64]

Exact existing released versions that this binary may open. The current supported version is included for an explicit manifest even though it needs no migration.

released_predecessors: &'static [SchemaPredecessor]

Exact catalog verifiers for every allowed version below current.

bridge_recoverable_versions: &'static [i64]

Exact source versions the explicit offline bridge may infer for an unledgered file of this domain.

This is an authority boundary, not a convenience: catalog equality alone cannot prove whether a data-only migration ran, so a version absent from this list is never inferred even when its DDL fingerprint matches. It lives on the domain rather than at the call site because two answers to “which release wrote this catalog” is exactly the defect this field exists to prevent: Self::bridge_eligibility decides what an operator is told, bridge_unledgered_domain decides what runs, and both read this one list.

owned_objects: &'static [SchemaObject]

Complete set of catalog objects owned by this domain across its current schema. Foreign co-tenant objects are deliberately absent.

retired_objects: &'static [SchemaObject]

Names owned by supported predecessors but intentionally absent from the current schema. They remain reserved for fresh-domain detection and predecessor fingerprints.

Implementations

impl SchemaDomain

pub fn supported_version(&self) -> i64

Highest version this binary knows for the domain.

pub fn bridgeable_source_version(&self, conn: &Connection) -> Option<i64>

The exact source version bridge_unledgered_domain would authenticate conn’s unledgered catalog as, if any.

This asks the question through the very code the bridge asks it with ([authenticate_unledgered_source_version]), against the same caller-authorized source list (Self::bridge_recoverable_versions). Answering it a second, similar way is what produced the defect this replaces: an oracle that consulted only the frozen verifiers called a realm unrecoverable while the bridge, which also accepts an exact code-derived migration prefix, recovered it on the next command.

SCOPE, because a remedy sentence is built from this: it answers about the file’s catalog shape only. It does not read, decode, or admit a single durable record, so it can never promise that every record will be carried forward. An ambiguous or unmatched catalog answers None, exactly as the bridge refuses one.

What makes the narrower answer safe to act on is the bridge’s own contract: a preparation callback refuses per record (MaintenanceRecordRefusal) rather than per domain, so an authenticated catalog does land, and any record that could not come across is named in MaintenanceBridgeReport::refused instead of costing the operator the rest of the file.

pub fn bridge_eligibility(&self, conn: &Connection) -> BridgeEligibility

Whether the explicit offline bridge can authenticate conn’s catalog for this domain. Catalog shape only; see Self::bridgeable_source_version for what this deliberately does not check.

Trait Implementations

impl Debug for SchemaDomain

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.