Module admin 

Operator admin endpoint — single TCP listener for all server-side commands an operator may send.

Authentication is Ed25519 challenge-response with operator-only keys (the same handshake used for client sessions). After auth, the client sends one ASCII command terminated by \n:

• PROMOTE — replica → primary leadership transition. Sets the shared promote flag; the replica receive loop observes it and exits with the recovered state. Available only when the spawn caller wired a promote flag (typically the replica path).
• ROTATE — archive the current journal segment at the next fsync boundary and start a fresh one. Available only when the spawn caller wired a rotation flag (any node with --max-journal-mib > 0 or runtime rotation enabled).
• ACK-POLICY <disk|ram|disk+ram|two-disks> — change the ack policy. The change is journaled, in order with the events it governs, and takes effect once the nodes the previous policy relied on hold it (see crate::policy_control). On a primary the reply is OK once the entry is published, or an ERR if the input ring stays full past a bounded wait; with no replica connected, ACK-POLICY disk is forced and takes effect once on this node’s disk. On a replica, or a primary still starting, the policy is staged and the reply is OK staged: it is journaled when the node is promoted (or its producer starts) — not forced, so an operator re-sends it once the node serves if it must take effect with no replica connected. Lets an operator resume taking writes under a weaker policy after a promotion (no restart, no client reconnects) and restore the target policy once replicas reattach. Available only when the spawn caller wired the policy mailbox. DURABILITY <local|replicated|hybrid|durably-replicated> is accepted as a deprecated alias for one release and logged at warn!.

A command for which the corresponding flag is None is rejected with ERR <command> not available on this node\n so operators get a clear diagnostic instead of a silent no-op.

The listener stays alive for the lifetime of the process — multiple ROTATEs over a long run, and an eventual PROMOTE on a replica, all flow through the same socket. Concurrent or repeated triggers collapse via CAS in the journal stage / receive loop, so duplicate commands do not queue.

Functions

spawn

Spawn the admin listener on a dedicated thread.