Module flow 

Bounded local retention and receipt accounting, independent of consensus and durability.

Adapters authenticate peers, fence epochs on every packet, retain payloads, verify canonical history, and supply release events only after application. This module performs no I/O, clock reads, hashing, voting, or implicit recovery. Probe deadlines advance only from explicit adapter-supplied monotonic time. See doc/REPLICATION.md for the surrounding probe/repair integration contract.

Structs

Channel

Complete scope and receive incarnation for one independently bound peer.

OpenRequest

Exact report awaiting independently verified local history. New receiver epochs require correlation; known-epoch PUB progress does not.

Operation

Compact metadata for one hash-validated canonical body retained by the adapter.

Probe

One immutable status request, including the tail needed to detect a lost last batch.

ProbeScheduler

Allocation-free, one-outstanding-request scheduler for one authenticated peer.

ProbeTiming

Independent status-query pacing, not election or durable-progress timing.

ReceiveEpoch

Receiver-issued incarnation of volatile retention state.

Receiver

Local retained-body accounting. Capacity is never advertised to a sender. The adapter reserves actual payload backing before retaining a suffix.

Repair

One bounded repair range using existing reservations. Never new send capacity.

Report

Exact cumulative receipt in one receive epoch.

Sender

One peer’s absolute send reservations and bounded sent-but-unreceipted ledger.

Transmitter

One peer’s preallocated local ledger, correlated probes, and bounded repair.

Enums

FlowError

Rejected accounting transition. Every failure leaves existing state unchanged.

ProbeError

Rejected probe transition. Errors preserve the pending request and deadlines.

StatusOutcome

Nonvoting result of an authenticated receipt/status observation.

TransmitError

Rejected send-policy transition. No error supplies durability or quorum evidence.