Struct ViewChange 

pub struct ViewChange { /* private fields */ }

Fixed-three-voter durable view-change initiation and log selection.

Owns the fenced former normal core. No normal-message entry point is exposed. Retains at most three reports and one pending metadata action. It has no I/O, timers, or allocations on live election transitions. Intact restart allocates only the bounded live pipeline and stays above its last installed normal view. Installation consumes this role and uses a separate completion/activation gate.

Implementations

impl ViewChange

pub fn begin_primary_install( self, generation: JournalGeneration, ) -> Result<InstallingView, RejectedInstallation>

Stage primary installation whose selected tail remains in the journal.

Feed InstallingView::validate_suffix bounded chunks before completion. Durable publication still installs the complete selected log atomically. After activation, a whole-tail new-view ACK and ordered application are required before fresh appends; old operations consume no live ring slots.

pub fn begin_backup_install( self, received: ReceivedStart, generation: JournalGeneration, lookup: impl FnMut(LogSource, OpNumber) -> Option<Digest>, ) -> Result<InstallingView, RejectedInstallation>

Stage bounded-stream backup installation after authenticated START_VIEW.

Same promise, primary, and protected-prefix checks as install_backup. Every selected byte must be validated and durably published before the backup can ACK. Fresh prepares also wait for whole-tail commit/application.

pub fn install_primary( self, generation: JournalGeneration, suffix: &[PreparedOperation], ) -> Result<InstallingView, RejectedInstallation>

Consume the selected primary’s old role and stage atomic installation.

suffix is the verified selected tail strictly after ticket.committed, not the full retained WAL. Transfer/application/storage independently validate earlier history and preserve the protected old committed prefix. Staging checks operation/byte bounds and reuses the old descriptor arena. Rejection returns the fenced role so missing data can be retried.

pub fn install_backup( self, received: ReceivedStart, generation: JournalGeneration, suffix: &[PreparedOperation], lookup: impl FnMut(LogSource, OpNumber) -> Option<Digest>, ) -> Result<InstallingView, RejectedInstallation>

Consume a backup’s fenced role after an authenticated START_VIEW.

Unlike primary selection, this needs no local first/second-phase quorum: the current primary’s installed descriptor supplies protocol authority. It still requires this backup’s completed view promise and verified compatibility with its own possibly higher committed prefix. lookup has the same pinned, nonblocking lineage contract as select. suffix starts after the greater of local and announced commit knowledge.

impl ViewChange

pub fn recover_intact( configuration: Configuration, local: NodeId, generation: JournalGeneration, recovered: RecoveredState, limits: PipelineLimits, ) -> Result<Self, ViewChangeError>

Restart an intact durable voter without granting same-view authority.

Restart from an installed normal view requests its successor, fencing a primary that sent prepares before its local write completed. An already promised but never installed election resumes that same view: it could not have assigned normal operations there. Repeated restarts cannot ratchet that unfinished election. Quorum selection and durable selected installation/activation remain mandatory before any normal authority.

generation must be a fresh writer incarnation. Journal recovery and validation run on the storage worker before calling this sans-I/O method. Retained operations stay on disk; only the live pipeline is preallocated. Canonical application recovery is deferred to selected-view installation.

impl ViewChange

pub fn select( &mut self, lookup: impl FnMut(LogSource, OpNumber) -> Option<Digest>, ) -> Result<SelectedView, ViewChangeError>

Select the highest last-normal-view, then longest accepted lineage.

lookup must be a nonblocking lookup into already verified, pinned canonical history anchored by the supplied source’s exact tail digest. An isolated matching hash or a chunk from another generation is not such evidence. Missing bytes return None; fetch/verify them outside the core. At most six protected-prefix lookups are needed for three voters.

Selection includes this primary’s report and another distinct voter. It protects every reported commit and same-normal-view accepted prefix. Higher-normal-view histories may discard only older uncertain suffixes.

impl ViewChange

pub fn history_sources(&self) -> [Option<LogSource>; 3]

Frozen reported sources available for bounded, externally verified history repair. A report alone supplies no ancestry or installation authority.

pub fn normal_snapshot(&self) -> ReplicaSnapshot

Read-only old-role journal/application evidence for storage scheduling.

pub fn scope(&self) -> Scope

Requested view; it may not yet have a completed durable promise.

pub const fn promised_view(&self) -> u64

Highest view whose promise completion this core has observed.

pub fn advance_view(&mut self, view: u64) -> Result<(), ViewChangeError>

Move toward a later view without discarding an outstanding disk action.

Old reports/selection immediately lose authority. A pending earlier promise must settle before the next can be issued. Its late completion never authorizes messages for either the old or the unpersisted new view.

pub fn complete_write( &mut self, ticket: WriteTicket, ) -> Result<(), ViewChangeError>

Settle a previously admitted complete write without reviving old votes.

pub fn begin_sync(&self) -> Result<SyncTicket, ViewChangeError>

Capture the written prefix for a real barrier on the storage worker.

pub fn complete_sync( &mut self, ticket: SyncTicket, ) -> Result<(), ViewChangeError>

Settle a real disk barrier. It cannot advance old-view commit.

pub fn fail_io( &mut self, generation: JournalGeneration, ) -> Result<(), ViewChangeError>

Report uncertain journal I/O and permanently fault this transition.

pub fn begin_promise(&mut self) -> Result<PromiseTicket, ViewChangeError>

Issue one metadata promise after every accepted operation is synchronized.

Finishing all old writes makes the report immutable, including operations another replica may already have acknowledged before local I/O finished.

pub fn complete_promise( &mut self, ticket: PromiseTicket, ) -> Result<(), ViewChangeError>

Observe successful durable publication of the exact issued promise.

pub fn fail_promise( &mut self, ticket: PromiseTicket, ) -> Result<(), ViewChangeError>

An ambiguous promise failure fences all election messages and selection.

pub fn start_message(&self) -> Result<StartViewChange, ViewChangeError>

Broadcast only after the requested view promise is durably complete.

pub fn receive_start( &mut self, from: NodeId, message: StartViewChange, ) -> Result<(), ViewChangeError>

Collect an authenticated other voter’s first-phase message. Duplicate messages cannot create extra voters or replace local persistence.

pub fn report(&mut self) -> Result<DoViewChange, ViewChangeError>

Freeze the local second-phase report after a first-phase majority. Send it to the configured primary; the primary retains its own report too.

pub fn receive_report( &mut self, from: NodeId, report: DoViewChange, ) -> Result<(), ViewChangeError>

Primary collects immutable, authenticated second-phase reports.

Later views are explicit advance_view events. A new report cannot alter an already selected quorum; changed frozen logs from one voter are faults. Intact restart may repeat the identical log with a fresh writer generation. Keep the first source descriptor unchanged, including after selection: this is one vote, not permission to mix or redirect history chunks.

Trait Implementations

impl Debug for ViewChange

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.