Struct NormalReplica 

pub struct NormalReplica { /* private fields */ }

Fixed-three-voter normal VSR path with a bounded pipelined prepare window.

This is one component of VSR, not a complete election or recovery protocol. The caller authenticates sender IDs and validates canonical operations plus application transitions before admission. Returned write tickets schedule disk work; the primary may concurrently send the same prepares to backups. Producer success additionally requires ordered application of committed ops.

Implementations

impl NormalReplica

pub fn prepare( &mut self, from: NodeId, scope: Scope, operations: &[PreparedOperation], ) -> Result<Admission, ReplicationError>

Admit a validated local-primary proposal or authenticated backup prepare.

The full slice is checked before any admission. Retransmissions may overlap retained operations; identical entries do not consume capacity. Missing earlier operations request catch-up; conflicting current history faults this core. One call is bounded by the configured pipeline size.

impl NormalReplica

pub fn acknowledgment(&self) -> Result<PrepareOk, ReplicationError>

Construct a backup’s cumulative durable vote, never a transport receipt.

pub fn receive_ack( &mut self, from: NodeId, ack: PrepareOk, ) -> Result<(), ReplicationError>

Count one authenticated backup’s cumulative matching durable prefix. Duplicate deliveries/reconnections do not create extra voters.

pub fn announcement(&self) -> Result<Commit, ReplicationError>

Construct the primary’s current commit announcement or idle heartbeat.

pub fn start_view(&self) -> Result<Option<StartView>, ReplicationError>

Retransmit the immutable installed-view descriptor after publication. Bootstrap has no descriptor. Later appends do not change this snapshot; lagging backups install it first, then catch up through normal prepares.

pub fn receive_commit( &mut self, from: NodeId, commit: Commit, ) -> Result<(), ReplicationError>

Observe an authenticated primary’s commit, including piggybacked commit. Visibility waits for this backup’s configured local evidence. Missing payload returns HistoryGap; retry the announcement after catch-up. An announcement past the accepted prefix still commits everything this backup accepted in the view, so that much becomes visible at once.

impl NormalReplica

pub const fn reclaimed_prefix(&self) -> Prefix

Exact prefix released from the live window after application and persistence.

pub fn into_view_change(self, view: u64) -> Result<ViewChange, ViewChangeError>

Consume normal-role ownership and immediately fence its decisions.

The new view must exceed the installed view. Outstanding journal work moves into the view-change core and must settle before a view promise. This transition cannot resume the old normal role, even on failure.

pub fn bootstrap( configuration: Configuration, local: NodeId, generation: JournalGeneration, limits: PipelineLimits, ) -> Result<Self, ReplicationError>

Start a newly formatted, empty group at view zero.

All three durable stores must have been explicitly initialized with this exact configuration. Never use this constructor on restart, lost storage, or a previously used voter identity. It cannot recover existing history. generation must be unique across all writer instances/completions.

pub const fn scope(&self) -> Scope

Current group/configuration/view identity, without a full snapshot.

pub fn snapshot(&self) -> ReplicaSnapshot

Inspect state without obtaining mutable journal or quorum access.

pub fn complete_write( &mut self, ticket: WriteTicket, ) -> Result<(), ReplicationError>

Observe a complete local write. Page-cache completion casts no vote.

pub fn stored_through(&self) -> OpNumber

Local synchronized prefix available for replay and releasing applied live capacity. It alone never establishes a quorum.

pub fn begin_sync(&self) -> Result<SyncTicket, ReplicationError>

Capture the complete written prefix before submitting a disk barrier.

pub fn complete_sync( &mut self, ticket: SyncTicket, ) -> Result<(), ReplicationError>

Observe an actual successful barrier for its captured prefix only. Fenced completions update disk evidence but cannot advance commit.

pub fn complete_durable_write( &mut self, ticket: WriteTicket, ) -> Result<(), ReplicationError>

Observe an adapter write that also synchronized its complete prefix.

pub fn apply_through(&mut self, through: Prefix) -> Result<(), ReplicationError>

Report ordered application. Release capacity only through stored_through.

The caller asserts every operation through this exact prefix was applied in order, not only the last one. This is not consumer processing. Payloads needed for retries, replay, or lagging replicas remain in the journal.

pub fn fence(&mut self)

Immediately stop old-view ACKs, commit, admission, and application. Disk completions can still settle for a subsequent view-change report. There is deliberately no un-fence or same-view restart method.

pub fn fail_io( &mut self, generation: JournalGeneration, ) -> Result<(), ReplicationError>

Report uncertain storage failure. Stale generations cannot fault this core.

impl NormalReplica

pub fn recovery_response( &self, nonce: RequestId, ) -> Result<RecoveryResponse, RecoveryError>

Capture a recovery response without adding I/O to normal commit.

The adapter pins this exact accepted prefix, including in-flight writes, before offering its bytes. An unsent candidate may be refreshed before pin admission. Once pinning starts, retain/retransmit that exact response for this nonce. A durable-prefix-only snapshot is unsafe: an earlier ACK from the lost voter may still commit an unsynced accepted operation.

Trait Implementations

impl Debug for NormalReplica

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.