pub enum AckPolicy {
Disk,
Ram,
DiskAndRam,
TwoDisks,
}Expand description
Operator-facing ack policy: which copies of an event must exist
before its response is released. Each variant maps to a named
Clause list composed directly in code. See docs/replication.md
for the menu in operational terms.
clap::ValueEnum derives --ack-policy <disk|ram|disk+ram|two-disks>;
the disk+ram spelling is set explicitly because the derive would
kebab-case the variant to disk-and-ram.
Variants§
Disk
persisted>=1. One fsynced copy, on whichever node’s disk
confirms first. Required when running with --standalone;
appropriate for dev/staging deployments without a replica.
Ram
in_memory>=2. Two nodes hold the event in memory before the
client ack; every disk write trails asynchronously off the ack
path (the journal still fsyncs every batch, it just no longer
gates responses). Survives any single node failure via
failover; loses only the un-fsynced tail on a simultaneous
whole-cluster power loss. For deployments where fsync is slow
(cloud block storage) or where that bounded RPO is an acceptable
trade for the lowest ack latency. Fails closed when no replica
is connected.
DiskAndRam
persisted>=1 && in_memory>=2. One fsynced copy plus a second
copy in another node’s memory. Single-failure-safe with a brief
RAM-only window (~80 µs on PLP-backed NVMe) for the second copy.
The default — typical live deployments. Faster than
TwoDisks: an acknowledgement waits for the
second node to receive the event, not to fsync it. Fails closed
when no replica is connected.
TwoDisks
persisted>=2. Two fsynced copies before the client ack. Zero
RAM-only window; the gate stalls if no replica is currently
connected. Compliance-driven deployments.
Implementations§
Source§impl AckPolicy
impl AckPolicy
Sourcepub fn as_str(self) -> &'static str
pub fn as_str(self) -> &'static str
CLI / log-friendly name. Matches the clap::ValueEnum spelling.
Sourcepub fn parse(s: &str) -> Option<Self>
pub fn parse(s: &str) -> Option<Self>
Parse the admin-channel / CLI wire spelling. Accepts exactly the
strings as_str emits so operators only have to
learn one vocabulary across --ack-policy and the admin
ACK-POLICY command.
Sourcepub fn parse_legacy(s: &str) -> Option<Self>
pub fn parse_legacy(s: &str) -> Option<Self>
Parse the pre-0.15 “durability mode” names, for the deprecated
DURABILITY admin alias. Accepts the current spellings too so
the alias is a strict superset of parse.
Removed with the alias in the next minor release.
Sourcepub fn as_u8(self) -> u8
pub fn as_u8(self) -> u8
Stable u8 discriminant: the byte a journaled AckPolicyChange
carries (to_byte), and the one the health gauges
export.
These values are a wire format, not just an in-process ABI:
they are in every journal holding a policy change, streamed to
every replica with the entries, and a replica decodes the one its
lineage holds with from_byte to judge
auto-promotion (see raft_promotion). So they must stay
stable across releases in two directions — the round-trip
from_u8(as_u8(x)) == Some(x) has to hold, and a value once
released can never be reassigned to a different policy, or a
peer on an older build would silently read the new policy as
the old one. Add new policies on the next free byte; never
renumber. (The bytes predate the current names: they were
assigned to local/hybrid/durably-replicated/replicated
and kept through the rename.)
A peer that does not know a byte gets None and refuses to
auto-promote on it — fail-closed, and the reason replicas must
be upgraded before a primary starts journaling a new policy.
Sourcepub fn from_u8(b: u8) -> Option<Self>
pub fn from_u8(b: u8) -> Option<Self>
Inverse of as_u8. Returns None for an unknown
byte — one a newer build wrote, or a bug. A primary refuses to
start on a lineage holding one; the response stage, meeting one in
a change it journaled itself, logs and retains the prior policy
rather than silently falling back.