Module node 

Node identity and node descriptor types (spec section 11.1, S2A-001; section 12.1 node descriptor; section 13.7 locality tiers).

Every node persists a NodeIdentity at <node-data>/cluster-meta/identity.json on first boot. The identity binds the node to exactly one cluster for the lifetime of the directory: S2A-001 requires that a node cannot join two clusters without an explicit wipe/reprovision, so bootstrap and join workflows fail closed with ClusterError::ClusterIdentityMismatch when a persisted identity names a different cluster. wipe_identity is the only reset and returns a typed WipedMarker report for the caller to audit; nothing is logged from this module.

All durable writes are atomic: a unique temporary file is written and fsynced, then atomically renamed into place (or hard-linked for create-if-absent creation), followed by a directory fsync — the same idiom the storage core uses for its catalog checkpoints, backed by the shared bottom-layer durability helper. Loading verifies the format version and the payload: unknown versions, unknown fields, corrupt payloads, and reserved all-zero identifiers all fail closed (spec section 4.10).

Structs

BuildVersion

Build version a node advertises (spec section 11.8).

Locality

Ordered locality tiers of a node, coarsest first, following the region, availability zone, rack, node hierarchy of spec section 13.7.

NodeCapacity

Advertised capacity of one node, used by placement (spec section 12.1).

NodeDescriptor

One cluster member as advertised by the meta control plane (spec section 12.1). Defined with the Stage 2A bootstrap workflows; the meta group takes ownership of the replicated copy in Stage 3A.

NodeIdentity

Persisted node identity (spec section 11.1, S2A-001).

VersionInfo

Version and format compatibility envelope every node advertises (spec section 11.8; ADR-0010 decision 5).

WipedMarker

Typed audit report returned by wipe_identity; the caller decides how to log it (this module never logs).

Enums

ClusterError

The one error type of the cluster bootstrap surface.

Incompatibility

One advertised range pair does not overlap; compatibility checks fail closed with the first mismatch found (ADR-0010: never silently degrade).

LocalityParseError

Error returned when parsing a textual Locality fails.

NodeState

Lifecycle state of a cluster node (spec section 12.1). Declaration order is frozen; enum values are never reused (spec section 4.10).

Constants

CLUSTER_META_DIR

Name of the per-node cluster metadata directory under the node data dir.

IDENTITY_FILENAME

Name of the persisted identity file inside CLUSTER_META_DIR.

LOG_FORMAT_VERSION_MAX

Newest committed-command log format this build writes: the FND-003 CommandEnvelope version in mongreldb-log.

LOG_FORMAT_VERSION_MIN

Oldest committed-command log format this build reads: the FND-003 CommandEnvelope minimum in mongreldb-log.

MIN_SUPPORTED_NODE_IDENTITY_FORMAT_VERSION

The oldest identity format version this build accepts.

NODE_IDENTITY_FORMAT_VERSION

The identity format version this build writes.

PROTOCOL_VERSION_MAX

Newest wire-protocol version this build speaks.

PROTOCOL_VERSION_MIN

Oldest wire-protocol version this build accepts (spec section 11.8).

SNAPSHOT_FORMAT_VERSION_MAX

Newest replicated snapshot format this build writes.

SNAPSHOT_FORMAT_VERSION_MIN

Oldest replicated snapshot format this build reads.

Functions

wipe_identity

Explicitly wipe this node’s cluster provisioning state: the identity plus any bootstrap records under cluster-meta/.

Type Aliases

Csprng

Caller-supplied source of cryptographic randomness used to mint identifiers; production passes getrandom::getrandom, tests pass a deterministic filler.