Struct ReroutePolicy 

pub struct ReroutePolicy {
    pub reroute_count: AtomicU64,
    pub recovery_count: AtomicU64,
    /* private fields */
}

Policy that removes invalidated routes when peers fail.

When a peer is marked as failed by the FailureDetector:

1. Find every destination with a candidate riding through the failed peer — the protected candidate by bound identity, the ordinary one by transport address.
2. Remove exactly those candidates, atomically per destination, keeping every candidate the failure does not invalidate.

When the peer recovers:

1. Install the route to the peer ITSELF from its live session — protected exactly when that session is a direct adjacency.

Nothing else is written on either edge. Replacement paths come from discovery, which is the only writer with current evidence.

Fields

reroute_count: AtomicU64

Failure events that removed at least one candidate.

recovery_count: AtomicU64

Recoveries that installed the peer’s own route.

Implementations

impl ReroutePolicy

pub fn new( routing_table: Arc<RoutingTable>, peer_addrs: Arc<DashMap<u64, SocketAddr>>, ) -> Self

Create a new reroute policy.

pub fn with_peer_snapshot( self, probe: Arc<dyn Fn(u64) -> Option<PeerSnapshot> + Send + Sync>, ) -> Self

Wire a peer-snapshot probe so failure/recovery decisions can be abandoned when the peer they concern has been replaced by a fresh session mid-callback, and so adjacency is decided from one coherent reading rather than from two maps agreeing.

pub fn set_verdict_check( &self, probe: Arc<dyn Fn(u64, u64) -> bool + Send + Sync>, )

Wire the detector’s verdict-order check, so a delayed failure callback that a recovery has already superseded refuses at the point of mutation.

Takes &self and is idempotent-by-first-write: the detector that answers this check is the same one whose callbacks hold this policy, so it cannot exist yet when the policy is built.

pub fn on_failure(&self, failed_node_id: u64)

Called when the failure detector marks a peer as failed.

Removes every route candidate the failure invalidates.

pub fn on_failure_for_verdict( &self, failed_node_id: u64, failed_epoch: u64, verdict_seq: u64, )

Self::on_failure for a detector verdict, carrying both the incarnation it is about and its position in the verdict order for that peer.

pub fn on_failure_for_incarnation(&self, failed_node_id: u64, failed_epoch: u64)

Self::on_failure for the exact incarnation the detector declared failed.

failed_epoch is the session id the failure verdict is ABOUT (0 when the caller has none). Sampling “the peer’s current session” at callback entry cannot substitute for it: production runs substantial sensing work before this call, so a delayed callback for a dead session can find a REPLACEMENT session already installed and read it twice — seeing no change and treating the live replacement as the thing that failed.

pub fn on_recovery(&self, recovered_node_id: u64)

Called when the failure detector marks a peer as recovered.

Installs the route to the recovered peer itself — and nothing else. See the module doc.

pub fn on_recovery_for_incarnation( &self, recovered_node_id: u64, recovered_epoch: u64, )

Self::on_recovery for the exact incarnation the detector declared recovered — the symmetric guard to Self::on_failure_for_incarnation.

pub fn on_recovery_for_verdict( &self, recovered_node_id: u64, recovered_epoch: u64, verdict_seq: u64, )

Self::on_recovery for a detector verdict, carrying both the incarnation and its position in that peer’s verdict order.