pub struct Policy { /* private fields */ }Expand description
Ack policy: an AND-combined list of clauses.
The empty policy is rejected by the parser; an “ack immediately”
behaviour can be expressed as in_memory>=1, which is satisfied by
the primary alone.
Implementations§
Source§impl Policy
impl Policy
Sourcepub fn new(clauses: Vec<Clause>) -> Result<Policy, PolicyError>
pub fn new(clauses: Vec<Clause>) -> Result<Policy, PolicyError>
Construct a policy from clauses. Returns an error if the clause
list is empty, contains a zero-count clause, or contains a
clause whose count exceeds MAX_CLUSTER_SIZE.
Sourcepub fn clauses(&self) -> &[Clause]
pub fn clauses(&self) -> &[Clause]
Slice access for callers that need to inspect or display the policy (health endpoint, startup logging).
Sourcepub fn evaluate(&self, cursors: &CursorView<'_>) -> u64
pub fn evaluate(&self, cursors: &CursorView<'_>) -> u64
Highest sequence at which every clause is satisfied given the supplied cursor view.
Returns 0 if no sequence satisfies all clauses — typically
because at least one clause requires more nodes than are
currently connected.
Sourcepub fn evaluate_with_status(&self, cursors: &CursorView<'_>) -> EvalStatus
pub fn evaluate_with_status(&self, cursors: &CursorView<'_>) -> EvalStatus
Like evaluate but also reports whether the
policy is structurally unsatisfiable by the current cluster
shape — i.e. at least one clause’s count exceeds the number
of nodes in the view. The response stage uses this to surface a
policy_degraded health metric and emit periodic warnings; the
gate is stalled while degraded.
Sourcepub fn attribute_blocker(&self, cursors: &CursorView<'_>) -> Option<Blocker>
pub fn attribute_blocker(&self, cursors: &CursorView<'_>) -> Option<Blocker>
Which subsystem supplied the binding cursor — i.e. what the gate was actually waiting on.
Finds the clause that produced durable_pos (the most
constraining one) and reports whether the node at that clause’s
threshold rank was the primary or a replica. This is the honest
answer to “journal or replication?” for any policy shape,
unlike comparing the journal cursor against a fixed replica
level: under disk (persisted>=1) the binding node is
whichever fsynced furthest (usually, not always, the primary),
and under disk+ram (persisted>=1 && in_memory>=2) the
binding replica cursor is in-memory, not persisted.
Returns None when a clause is unsatisfiable by the current
cluster shape — the gate is stalled on missing nodes rather than
on either subsystem’s progress, so no attribution is meaningful.
Not on the hot path: the response stage calls this once per gate open, not per spin iteration.
Sourcepub fn replica_gate_cursor(&self, cursors: &CursorView<'_>) -> Option<u64>
pub fn replica_gate_cursor(&self, cursors: &CursorView<'_>) -> Option<u64>
The tightest replica-supplied clause value — the replica-side cursor this policy is actually waiting on.
Returns None when no clause is supplied by a replica (e.g.
disk while the primary’s fsync leads, so it alone satisfies
persisted>=1), or when a clause is unsatisfiable by the
current cluster shape.
Callers use this to measure replica wait against the level the
policy really gates on rather than a hardcoded one.