Expand description
Deterministic replication with explicit network and storage evidence.
This core implements normal operation, durable view-change initiation, and log selection and installation for three fixed durable voters. Intact-disk restart leaves the last installed normal view or resumes an unfinished promise, never old primary authority. Lost-state recovery has a bounded fresh-quorum admission, streamed validation, and wire codecs. The runtime journal worker owns immutable donor pins and the segment store has a nonvoting publication gate. Runtime receiving workers and OMQ recovery actors validate transferred history before handing off to fenced restart, never directly to voting. Payload validation, persistence, transport, and deterministic application are separate adapters. Normal metadata storage is preallocated and byte-bounded.
Modules§
- driver
- Deterministic normal-to-election scheduling with explicit durable completions.
- flow
- Bounded local retention and receipt accounting, independent of consensus and durability.
- local
- Explicit single-broker authority and local-durable confirmation.
- recovery
- Fresh-quorum admission for a fixed voter that lost its previous state.
- wire
- Bounded native replica messages. No I/O or implicit consensus authority.
Structs§
- Commit
- Primary’s cumulative commit announcement, also usable as an idle heartbeat.
- Configuration
- Three ordered, distinct voters. Confirmation needs synchronized history on the leader and one backup.
- Configuration
Record - Canonical immutable configuration for three authenticated durable voters.
- Configured
Voter - One persistent voter and its independently authenticated principal binding.
- Digest
- A fixed-width digest or externally supplied identity fingerprint.
Computed integrity digests contain XXH3-128 followed by 16 zero bytes;
see
crate::integrity. External principal fingerprints remain opaque. - DoView
Change - Second view-change phase. A bounded descriptor, never an unbounded log frame.
- Frozen
Log - One immutable, synchronized log description for a view-change report.
- Install
Ticket - Exact selected-log publication action. Not evidence of successful I/O.
- Installing
View - In-flight atomic installation. Neither old nor new normal voting is exposed.
- Journal
Generation - One active journal writer incarnation, supplied by the owning runtime.
- LogSource
- Exact source against which transferred history must be verified.
- Normal
Replica - Fixed-three-voter normal VSR path with a bounded pipelined prepare window.
- OpNumber
- Contiguous group-operation prefix. Zero denotes the empty journal.
- Pipeline
Limits - Bounds on live prepare metadata/payloads and each streamed validation chunk. Frozen recovered/installed history can exceed these bounds and stays on disk.
- Prefix
- Exact canonical group prefix. Zero with the zero digest is genesis.
- Prepare
Ok - Cumulative durable
PREPARE_OK. Sender identity comes from authentication. - Prepared
Operation - Metadata for one already validated canonical operation.
- Promise
Ticket - Storage action that persists a view promise without installing a normal view.
- Received
Start - A
START_VIEWwith the authenticated configured voter that sent it. Backup installation still checks that this voter is the view’s primary. - Recovered
State - Intact durable state independently validated and synchronized on startup.
- Rejected
Installation - Rejected admission together with the original fenced role.
- Replica
Snapshot - Read-only normal state, suitable for adapter scheduling and invariant checks.
- Scope
- Immutable identity and consensus generation carried by normal messages.
- Selected
View - Verified view-change selection, not installed leadership authority.
- Start
View - Immutable
START_VIEWsent only after the primary durably installs this log. Sender identity comes from the authenticated configured primary. - Start
View Change - First view-change phase. Sender identity comes from the authenticated peer.
- Sync
Ticket - Prefix captured when a synchronization request is issued.
- View
Change - Fixed-three-voter durable view-change initiation and log selection.
- Write
Ticket - One admitted, indivisible local write group. Fields cannot be forged externally.
Enums§
- Admission
- Result of atomically validating a complete prepare group.
- Configuration
Record Error - Rejected durable configuration. No error permits silently replacing membership.
- Install
Outcome - Exactly one owned protocol role after installation.
- Replication
Error - Rejected replication event. Capacity and missing history are recoverable; conflicting current lineage faults the normal core.
- Status
- Whether the normal protocol may emit votes, commit, or apply.
- View
Change Error - Rejected election event. Missing history/quorums wait; conflicts fault.
Constants§
- CONFIGURATION_
RECORD_ BYTES - Exact encoded length of a fixed-three-voter durable configuration.