Struct NormalReplica 

pub struct NormalReplica { /* private fields */ }

Fixed-three-voter normal VSR path with a bounded pipelined prepare window.

This is one component of VSR, not a complete election or recovery protocol. The caller authenticates sender IDs and validates canonical operations plus application transitions before admission. Returned write tickets schedule disk work; the primary may concurrently send the same prepares to backups. Producer success additionally requires ordered application of committed ops.

Implementations

impl NormalReplica

pub const fn reclaimed_prefix(&self) -> Prefix

Exact prefix released from the live window after application and persistence.

pub fn into_view_change(self, view: u64) -> Result<ViewChange, ViewChangeError>

Consume normal-role ownership and immediately fence its decisions.

The new view must exceed the installed view. Outstanding journal work moves into the view-change core and must settle before a view promise. This transition cannot resume the old normal role, even on failure.

pub fn bootstrap( configuration: Configuration, local: NodeId, generation: JournalGeneration, limits: PipelineLimits, ) -> Result<Self, ReplicationError>

Start a newly formatted, empty group at view zero.

All three durable stores must have been explicitly initialized with this exact configuration. Never use this constructor on restart, lost storage, or a previously used voter identity. It cannot recover existing history. generation must be unique across all writer instances/completions.

pub fn snapshot(&self) -> ReplicaSnapshot

Inspect state without obtaining mutable journal or quorum access.

pub fn prepare( &mut self, from: NodeId, scope: Scope, operations: &[PreparedOperation], ) -> Result<Admission, ReplicationError>

Admit a validated local-primary proposal or authenticated backup prepare.

The full slice is checked before any admission. Retransmissions may overlap retained operations; identical entries do not consume capacity. Missing earlier operations request catch-up; conflicting current history faults this core. One call is bounded by the configured pipeline size.

pub fn complete_write( &mut self, ticket: WriteTicket, ) -> Result<(), ReplicationError>

Observe a complete local write. Page-cache completion casts no vote.

pub fn stored_through(&self) -> OpNumber

Local prefix available for replay and releasing applied live capacity. RAM-confirmed groups may use completed page-cache writes; disk groups require synchronized writes. Neither boundary alone establishes a quorum.

pub fn begin_sync(&self) -> Result<SyncTicket, ReplicationError>

Capture the complete written prefix before submitting a disk barrier.

pub fn complete_sync( &mut self, ticket: SyncTicket, ) -> Result<(), ReplicationError>

Observe an actual successful barrier for its captured prefix only. Fenced completions update disk evidence but cannot advance commit.

pub fn complete_durable_write( &mut self, ticket: WriteTicket, ) -> Result<(), ReplicationError>

Observe an adapter write that also synchronized its complete prefix.

pub fn acknowledgment(&self) -> Result<PrepareOk, ReplicationError>

Construct a backup’s cumulative durable vote, never a transport receipt.

pub fn receive_ack( &mut self, from: NodeId, ack: PrepareOk, ) -> Result<(), ReplicationError>

Count one authenticated backup’s cumulative matching durable prefix. Duplicate deliveries/reconnections do not create extra voters.

pub fn retained_acknowledgment( &self, ) -> Result<RetainedPrepareOk, ReplicationError>

Vote for the complete validated prefix retained by the payload adapter. Physical writes are independent and cannot reclaim this prefix early.

pub fn receive_retained_ack( &mut self, from: NodeId, ack: RetainedPrepareOk, ) -> Result<(), ReplicationError>

Count one distinct backup’s exact retained-memory prefix.

pub fn announcement(&self) -> Result<Commit, ReplicationError>

Construct the primary’s current commit announcement or idle heartbeat.

pub fn start_view(&self) -> Result<Option<StartView>, ReplicationError>

Retransmit the immutable installed-view descriptor after publication. Bootstrap has no descriptor. Later appends do not change this snapshot; lagging backups install it first, then catch up through normal prepares.

pub fn receive_commit( &mut self, from: NodeId, commit: Commit, ) -> Result<(), ReplicationError>

Observe an authenticated primary’s commit, including piggybacked commit. Visibility waits for this backup’s configured local evidence. Missing payload returns HistoryGap; retry the announcement after catch-up.

pub fn apply_through(&mut self, through: Prefix) -> Result<(), ReplicationError>

Report ordered application. Release capacity only through stored_through.

The caller asserts every operation through this exact prefix was applied in order, not only the last one. This is not consumer processing. Payloads needed for retries, replay, or lagging replicas remain in the journal.

pub fn fence(&mut self)

Immediately stop old-view ACKs, commit, admission, and application. Disk completions can still settle for a subsequent view-change report. There is deliberately no un-fence or same-view restart method.

pub fn fail_io( &mut self, generation: JournalGeneration, ) -> Result<(), ReplicationError>

Report uncertain storage failure. Stale generations cannot fault this core.

impl NormalReplica

pub fn recovery_response( &self, nonce: RequestId, ) -> Result<RecoveryResponse, RecoveryError>

Capture a recovery response without adding I/O to normal commit.

The adapter pins this exact accepted prefix, including in-flight writes, before offering its bytes. It must retain/retransmit the same response for this nonce, not recapture a moving tail. Only a new recovery nonce starts a new snapshot. A durable-prefix-only snapshot is unsafe: an earlier ACK from the lost voter may still commit an unsynced accepted operation.

Trait Implementations

impl Debug for NormalReplica

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.