Module decrypt 

Segment-scoped payload decryption.

Decryption belongs at the point records leave the WAL layer, not at each consumer. A record’s AAD binds its ciphertext to the segment preamble it was written under, so only code that still holds the open segment knows the epoch needed to decrypt it. Pushing that knowledge outwards would mean every replay consumer re-deriving it — and any consumer that forgot would silently feed ciphertext into an engine decoder.

SegmentDecryptor is therefore constructed once per segment — by the readers themselves, at open time — and applied to every record before it is handed out. A record that is marked encrypted with no key ring available is a hard WalError::EncryptedRecordWithoutKey, never a passthrough and never a skip.

Structs

SegmentDecryptor

Turns the records of one WAL segment back into plaintext.