Struct Database 

pub struct Database { /* private fields */ }

A multi-table database: one catalog, one epoch clock, shared caches, a shared WAL, and a live map of name → Arc<Table>.

Implementations

impl Database

pub fn create(root: impl AsRef<Path>) -> Result<Self>

Create a fresh plaintext database at root.

pub fn open(root: impl AsRef<Path>) -> Result<Self>

Open an existing plaintext database.

pub fn visible_epoch(&self) -> Epoch

The current reader-visible epoch.

pub fn catalog_snapshot(&self) -> Catalog

Clone the in-memory catalog (for diagnostics / tests).

pub fn table_id(&self, name: &str) -> Result<u64>

Resolve a table name → id (live tables only). pub(crate) so the transaction layer can stage by name.

pub fn begin(&self) -> Transaction<'_>

Begin a new transaction reading at the current visible epoch.

pub fn transaction<T>( &self, f: impl FnOnce(&mut Transaction<'_>) -> Result<T>, ) -> Result<T>

Run f in a transaction; commit on Ok, rollback on Err.

pub fn snapshot(&self) -> (Snapshot, SnapshotGuard<'_>)

Register a read snapshot at the current visible epoch and return it with a guard that retains it for GC until dropped.

pub fn snapshot_owned(&self) -> (Snapshot, OwnedSnapshotGuard)

Owned (clonable-handle) variant of Self::snapshot for cross-thread retention.

pub fn table_names(&self) -> Vec<String>

Names of all live tables.

pub fn table(&self, name: &str) -> Result<TableHandle>

Look up a live table by name.

pub fn create_table(&self, name: &str, schema: Schema) -> Result<u64>

Create a new table. The DDL is first logged to the shared WAL (Op::Ddl(CreateTable) + TxnCommit) and group-synced so it is durable BEFORE the in-memory catalog and table map are mutated; the catalog checkpoint is rewritten afterwards (spec §15, review fix #16). A reopen that sees a stale catalog still recovers the table by replaying the Ddl.

pub fn drop_table(&self, name: &str) -> Result<()>

Logically drop a table, logging the DDL through the shared WAL first.

pub fn rename_table(&self, name: &str, new_name: &str) -> Result<()>

Rename a live table. name must exist and new_name must not collide with any live table; both checks run under ddl_lock so they are atomic with the rename and with concurrent create_table existence checks (no TOCTOU window). A no-op rename (name == new_name) succeeds without side-effects. The rename is logged to the shared WAL as DdlOp::RenameTable and recovered on reopen; the table_id, schema, and on-disk layout are unchanged (the table is keyed by table_id, so the in-memory object does not move — only the catalog name changes).

pub fn alter_column( &self, table_name: &str, column_name: &str, change: AlterColumn, ) -> Result<ColumnDef>

pub fn gc(&self) -> Result<usize>

Retention-gated garbage collection (spec §6.4, §7.4, §16). Deletes:

• Dropped-table subdirs whose at_epoch < min_active_snapshot.
• Stale _txn/ dirs (aborted/crashed large-txn pending runs).

Returns the number of items reclaimed.

pub fn set_spill_threshold(&self, bytes: u64)

Set the per-table spill threshold (bytes). When a transaction’s staged bytes for a single table exceed this, the rows are written as a uniform-epoch pending run instead of streamed Put records (spec §8.5).

pub fn check(&self) -> Vec<CheckIssue>

Verify multi-table integrity (spec §16). For every live table this: authenticates the manifest; opens each RunRef’s file through RunReader, which verifies the run footer checksum and — for encrypted DBs — the keyed run-metadata MAC; checks each run’s physical row count against its RunRef; flags RunRefs whose file is missing (dangling) and .sr files on disk that no RunRef references (orphan); and verifies flushed_epoch <= current_epoch. Returns the list of issues found (empty = healthy). Orphans are warning-severity; all other findings are error-severity (so Self::doctor quarantines them).

Cost: O(total run bytes) — the footer checksum is verified over each run’s full body, so this is an integrity tool, not a hot path.

pub fn doctor(&self) -> Result<Vec<u64>>

Quarantine unreadable tables (spec §16). Moves corrupt table dirs to _quarantine/<table_id>/, marks them dropped in the catalog, and unmounts them from the live table map so the DB still opens.