Struct ReplicaDriver 

pub struct ReplicaDriver { /* private fields */ }

Timer and election-message driver for one fixed three-voter group.

No clocks, allocations, I/O, or automatic durability assertions on transitions. Old writes must settle before a promise; a pending promise survives later views.

Implementations

impl ReplicaDriver

pub fn begin_activation(&self) -> Result<ActivationTicket, DriverError>

Authorize worker-side activation of an installed, whole-tail committed image. The primary additionally requires a backup’s new-view durable ACK, even when the selected tail was already known committed before installation.

pub fn complete_activation( &mut self, ticket: ActivationTicket, ) -> Result<(), DriverError>

Report completed image activation only while its captured authority is current. A newer view or changed image rejects a late completion without restoring voting.

pub fn installation_ticket(&self) -> Option<InstallTicket>

Inspect the exact pending selected-log action without granting normal authority.

pub fn begin_primary_install( &mut self, generation: JournalGeneration, ) -> Result<InstallTicket, DriverError>

Begin primary installation after verified quorum selection. The adapter supplies a fresh writer incarnation and performs bounded staging, sync, publication, and application recovery on the storage worker. Rejection retains the original fenced role and any missing-history state.

pub fn begin_backup_install( &mut self, from: NodeId, start: StartView, generation: JournalGeneration, lookup: impl FnMut(LogSource, OpNumber) -> Option<Digest>, ) -> Result<InstallTicket, DriverError>

Begin backup publication after an authenticated current-primary descriptor and this backup’s completed durable promise. History lookup must be pinned and nonblocking; missing evidence retains the fenced role for later retry.

pub fn validate_install_suffix( &mut self, operations: &[PreparedOperation], ) -> Result<(), DriverError>

Validate the next bounded selected suffix chunk, independently of its disk completion. The adapter must validate bodies/application transitions and stage those same bytes; this alone is never durability or commit evidence.

pub fn complete_installation( &mut self, ticket: InstallTicket, applied: Prefix, now: Duration, ) -> Result<(), DriverError>

Finish actual selected-log publication and committed application recovery. A newer observed/requested view suppresses intermediate normal activation. A current installed primary still needs whole-tail quorum and application before fresh appends. Failed or stale completions retain phase ownership.

pub fn complete_abandon( &mut self, ticket: InstallTicket, now: Duration, ) -> Result<(), DriverError>

Resume election after the worker successfully aborted unpublished staging. All admitted staging I/O must have settled; publication must not have begun. A later requested view is required. The old promise/history remain durable, but no normal authority or staged bytes survive this transition.

impl ReplicaDriver

pub fn begin_validation(&self) -> Result<ValidationTicket, DriverError>

Capture the exact live image and authority before worker-side validation.

Validation itself may perform blocking identity-index reads on a worker. Capturing this ticket neither reserves pipeline capacity nor delays timers. Adapters bind speculative and applied images to their exact prefixes. The captured commit boundary separately bounds read/application work.

pub fn begin_validation_after_apply( &self, applying: ValidationTicket, ) -> Result<ValidationTicket, DriverError>

Capture a ticket for validation that the worker runs right after an application through applying.committed(), where applying was captured on the current image. The ticket names that prefix as applied, the image the worker will hold. The core must reach it through apply_through before admission, or admission reports stale validation.

pub fn prepare_validated( &mut self, from: NodeId, ticket: ValidationTicket, operations: &[PreparedOperation], now: Duration, ) -> Result<Admission, DriverError>

Admit worker-validated operations only if their image and authority remain live.

Call before installing speculative plans, writing, or sending PREPARE. Stale validation is rejected without admitting operations or touching disk evidence. The adapter discards its plans and retries against a fresh image. A matching ticket still needs normal membership, lineage, and capacity checks. Commit may advance on the unchanged accepted chain while validation runs; this does not permit any change to the speculative or applied images.

impl ReplicaDriver

pub fn from_normal( normal: NormalReplica, now: Duration, timing: Timing, ) -> Result<Self, DriverError>

Attach scheduling to a bootstrapped or completely installed normal core. Intact restart must instead enter the existing nonvoting recovery path.

pub fn from_view_change( changing: ViewChange, now: Duration, timing: Timing, ) -> Result<Self, DriverError>

Resume scheduling after intact-disk recovery or a superseded installation. The supplied core is already fenced and cannot restore old normal authority.

pub fn normal(&self) -> Option<&NormalReplica>

Inspect normal evidence. No mutable access can bypass scheduling/fencing.

pub fn election_needs_sync(&self) -> bool

A fenced old view needs an actual barrier before publishing its promise.

pub fn scope(&self) -> Scope

Current normal or proposed election scope, not necessarily durable.

pub fn into_role(self) -> Role

Extract phase ownership. Pending I/O still must settle; a replacement driver must preserve newer-view fencing rather than resume an old normal role.

pub fn poll(&mut self, now: Duration) -> Result<Option<Action>, DriverError>

Advance deadlines and emit at most one action, without waiting for I/O. Repeated polls at one instant do not create unbounded retransmission.

pub fn receive( &mut self, from: NodeId, message: Control, now: Duration, ) -> Result<Option<StartView>, DriverError>

Receive one authenticated, wire-validated control. Stale views are ignored. A timeout only sends volatile EXIT_VIEW suspicion until a quorum agrees. A durably promised START_VIEW_CHANGE instead fences older authority, including an intact voter’s restart request. These distinct messages must not be interchanged. Senders must obey the crash-fault protocol, not merely supply a claimed node identity.

A returned START_VIEW needs bounded retention by the adapter until its local promise completes, then verified selected installation. It never activates a normal role here. Exact duplicate installed descriptors return None without reinstalling and permit replay of the normal durable ACK. Normal ACK grants remain adapter-owned.

pub fn complete_promise( &mut self, ticket: PromiseTicket, ) -> Result<(), DriverError>

Observe actual durable publication of the exact outstanding promise.

pub fn fail_promise(&mut self, ticket: PromiseTicket) -> Result<(), DriverError>

Report an uncertain metadata publication. No election retry can reuse it.

pub fn prepare( &mut self, from: NodeId, scope: Scope, operations: &[PreparedOperation], now: Duration, ) -> Result<Admission, DriverError>

Admit an already body/application-validated canonical group. The returned ticket schedules disk work; transmission may overlap that work. Later views require selected installation, never implicit normal activation.

pub fn complete_write(&mut self, ticket: WriteTicket) -> Result<(), DriverError>

Settle actual complete writes, including writes admitted before a timeout. Completion while changing view never restores normal voting or commit.

pub fn complete_buffered_write( &mut self, ticket: WriteTicket, now: Duration, ) -> Result<(), DriverError>

Observe buffered background I/O without asserting stable-storage evidence. Only RAM-confirmed groups may release capacity at this boundary.

pub fn complete_durable_write( &mut self, ticket: WriteTicket, now: Duration, ) -> Result<(), DriverError>

Install exact O_DSYNC completion independently of the group’s confirmation policy.

pub fn apply_through(&mut self, through: Prefix) -> Result<(), DriverError>

Complete deterministic ordered application through an established commit. Application replay/identity-index I/O stays outside this driver.

pub fn fail_io( &mut self, generation: JournalGeneration, ) -> Result<(), DriverError>

Fence on uncertain storage failure. A stale writer cannot fault a new one.

pub fn begin_sync(&self) -> Result<SyncTicket, DriverError>

Capture the written prefix for a real disk barrier, never a simulated ACK.

pub fn complete_sync( &mut self, ticket: SyncTicket, now: Duration, ) -> Result<(), DriverError>

Observe a completed barrier. Commit and persistence deadlines advance independently; a late old-view completion only settles the frozen log.

pub fn select( &mut self, lookup: impl FnMut(LogSource, OpNumber) -> Option<Digest>, ) -> Result<SelectedView, DriverError>

Select after collecting reports, using only nonblocking pinned-history lookup. Missing history/quorum is recoverable. Success is not installed authority.

pub fn history_sources(&self) -> [Option<LogSource>; 3]

Frozen election sources; their bytes still require exact-tail verification.

Trait Implementations

impl Debug for ReplicaDriver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.