Struct MetaGroup 

pub struct MetaGroup<T: RaftTransport> { /* private fields */ }

One member of the dedicated meta control-plane group (spec section 12.1): a ConsensusGroup whose apply sink is a MetaApplySink, plus the bootstrap/membership/propose workflow the node runtime drives.

Implementations

impl<T: RaftTransport> MetaGroup<T>

pub async fn create( config: MetaGroupConfig, group_config: GroupConfig, transport: Arc<T>, ) -> Result<Self, MetaError>

Opens the group’s durable state and starts the raft task with a MetaApplySink installed. group_config must match MetaGroupConfig::group_config (tuned timings are fine; identity and directory are not — mismatches fail closed).

pub fn group(&self) -> &ConsensusGroup<T>

The underlying consensus group (snapshots, membership, transfer, read barriers, shutdown).

pub fn node_id(&self) -> NodeId

This node’s durable id.

pub fn meta_group_id(&self) -> RaftGroupId

The meta group’s durable id.

pub async fn bootstrap( &self, members: &[(NodeId, String)], ) -> Result<(), MetaError>

Bootstraps a pristine meta group with the given voter set of (node_id, rpc_address) pairs (call on one pristine member; check MetaGroup::is_initialized on reopen). The 64-bit raft-id projection of distinct node ids must not collide (ADR: collisions are rejected at cluster bootstrap by this layer — the consensus adapter treats raft ids as opaque).

pub async fn is_initialized(&self) -> Result<bool, MetaError>

Whether this node already holds an initialized membership.

pub async fn add_member( &self, descriptor: &NodeDescriptor, control: &ExecutionControl, ) -> Result<MetaCommandReceipt, MetaError>

Adds one member to the meta group (spec section 12.7’s movement protocol, meta-group form): add learner and wait until it is line-rate, promote it to voter through joint consensus, then register its descriptor in replicated meta state. Registration comes last so the feature-activation voter view (registered, non-decommissioned descriptors) reflects only nodes that actually vote.

pub async fn remove_member( &self, node_id: NodeId, control: &ExecutionControl, ) -> Result<MetaCommandReceipt, MetaError>

Removes one member: the replicated MetaCommand::RemoveNode first (validating the node hosts no remaining replicas), then the joint-consensus removal. Validate-then-act keeps the two membership views from diverging on a refusal, and a retry after a mid-workflow failure is idempotent (RemoveNode of an absent node is a no-op). Leadership must be transferred off the node first (spec section 11.6); removing the current leader fails closed.

pub async fn propose( &self, command_id: [u8; 16], command: MetaCommand, control: &ExecutionControl, ) -> Result<MetaCommandReceipt, MetaError>

Proposes one meta command (quorum durability; spec section 11.3) and waits for commit + apply. command_id is the caller’s idempotency token: a retry with the same id and payload replays the original apply without re-dispatching (S2B-004).

The command rides a COMMAND_TYPE_META_COMMAND catalog envelope. When the apply path refused the command, the typed MetaRejectionReason is returned (and journaled in state); the raft entry itself committed normally.

pub fn state(&self) -> MetaState

A point-in-time clone of the replicated meta state at this node’s applied watermark. For a linearizable view, run ConsensusGroup::read_index (via MetaGroup::group) first.

pub async fn allocate_raft_node_ids( &self, count: u32, control: &ExecutionControl, ) -> Result<Vec<RaftNodeId>, MetaError>

Allocates count fresh per-group raft node ids from the meta-owned allocator (spec section 12.1), returning them in ascending order. Tablet replica raft ids come from this allocator — never the ad-hoc node-id projection the meta group itself uses (see MetaCommand::AllocateRaftNodeIds). The allocation is idempotent under its command id and durable in replicated state, so ids are never reused across failovers and restarts.

pub fn metadata_version(&self) -> MetadataVersion

The local applied watermark (monotonic per applied command).

pub async fn shutdown(&self) -> Result<(), MetaError>

Graceful shutdown of the underlying group.

pub async fn crash(self)

Process-free crash simulation: stops the raft task without the graceful storage close (see ConsensusGroup::crash); everything fsynced survives, which is exactly the split/merge crash-resume contract.