Struct Recovery 

pub struct Recovery { /* private fields */ }

Bounded nonvoting recovery role. Owns no normal or view-change voting state.

Implementations

impl Recovery

pub fn complete_checkpoint( &mut self, ticket: RecoveryTicket, anchor: CheckpointAnchor, state_revision: u64, ) -> Result<(), RecoveryError>

Observe privately decoded canonical state at the pinned original anchor. The adapter must verify schema, bytes, digest, and revision before calling. This grants no vote or publication authority.

pub fn validate_chunk( &mut self, ticket: RecoveryTicket, operations: &[PreparedOperation], ) -> Result<(), RecoveryError>

Validate one count/byte-bounded chunk starting at the current full-WAL cursor.

No descriptors or payloads are retained. The adapter must independently validate canonical bodies/application transitions, authenticate and bind the source/nonce, and stage these same bytes. Rejection leaves the cursor unchanged. Current-view prepares are included, not discarded as uncertain.

pub fn complete( &mut self, ticket: RecoveryTicket, durable: Prefix, applied: Prefix, ) -> Result<RecoveredState, RecoveryError>

Consume actual durable full-store publication and private application validation.

The worker must atomically publish exact configuration, selected history, and promised_view = last_normal_view = ticket.scope().view before reporting durable. applied asserts privately rebuilt canonical state, not consumer processing. Submission, received bytes, and page-cache writes do not qualify.

This returns only validated disk state for ViewChange::recover_intact, never a same-view normal role. The existing fenced election/install gates must still run. Missing-store formatting and runtime orchestration remain separate adapters; an incomplete replacement must reopen nonvoting.

pub fn fail(&mut self, ticket: RecoveryTicket) -> Result<(), RecoveryError>

Fence after an actual uncertain storage error, including an older-view action. Dropping a waiter is not storage failure. Stale callbacks cannot fault a different recovery attempt; no faulted instance may return recovered state.

pub fn complete_repair( &mut self, ticket: RecoveryTicket, repaired: RecoveredState, ) -> Result<RecoveredState, RecoveryError>

Retire fresh recovery authority after physical repair and full private replay of the original local history. Unlike full replacement, this must preserve the original last-normal view. The caller supplies actual durable publication evidence. Success permits only fenced intact restart.

impl Recovery

pub fn new( configuration: Configuration, local: NodeId, generation: JournalGeneration, nonce: RequestId, limits: PipelineLimits, ) -> Result<Self, RecoveryError>

Start explicit lost-state recovery under an externally trusted configuration. nonce and generation must be globally fresh, including after process restart. The caller must not have another live incarnation of this voter.

pub fn receive( &mut self, from: NodeId, response: RecoveryResponse, ) -> Result<(), RecoveryError>

Record one authenticated normal response. Duplicate replies count once.

pub fn observe_view( &mut self, from: NodeId, scope: Scope, ) -> Result<(), RecoveryError>

Observe configured peer authority outside the recovery response exchange. A higher election/normal view supersedes pending recovery but grants no vote. Drain/settle its worker action, then start a fresh nonce-scoped recovery attempt. A timeout alone must not invent higher-view evidence.

pub fn begin_transfer(&mut self) -> Result<RecoveryTicket, RecoveryError>

Freeze the highest-view primary’s source after two distinct other responses. Older-view normal responses with this fresh nonce may witness the quorum.

Trait Implementations

impl Debug for Recovery

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.