pub struct Sender { /* private fields */ }Expand description
One peer’s absolute send reservations and bounded sent-but-unreceipted ledger.
No payload ownership or quorum state lives here. Keep one instance per peer; a slow peer cannot consume another peer’s local capacity. Updates allocate no memory.
Implementations§
Source§impl Sender
impl Sender
Sourcepub fn open(
report: Report,
limits: PipelineLimits,
verified_received: Prefix,
) -> Result<Self, FlowError>
pub fn open( report: Report, limits: PipelineLimits, verified_received: Prefix, ) -> Result<Self, FlowError>
Open after a fresh correlated exchange with the bound peer and epoch.
verified_received must come from exact local-history lookup, not a copied
untrusted report field. This comparison grants no election or commit authority.
Opening never implicitly replaces another instance; the adapter must fence
its old packets and status correlation before adopting a new epoch.
limits bounds local sent-but-unreceipted metadata/body ownership, not
the remote receive window. A larger remote window never enlarges it.
Sourcepub fn reopen(
&mut self,
report: Report,
verified_received: Prefix,
) -> Result<(), FlowError>
pub fn reopen( &mut self, report: Report, verified_received: Prefix, ) -> Result<(), FlowError>
Replace an explicitly retired channel after a fresh, history-verified open.
Preserves startup metadata capacity instead of allocating another ledger.
The adapter must fence old payload ownership, validate probe/session/scope
correlation, and independently verify both reported base and receipt history.
verified_received has the same requirements as in open.
Same-channel status belongs in observe; it must never reset send charges.
Sourcepub const fn report(&self) -> Report
pub const fn report(&self) -> Report
Latest verified receiver accounting, including the channel’s fixed base.
Sourcepub const fn channel(&self) -> Channel
pub const fn channel(&self) -> Channel
Exact channel to attach to payloads and check on incoming reports.
Sourcepub const fn sent(&self) -> Prefix
pub const fn sent(&self) -> Prefix
Highest PEER reservation or independently verified PUB receipt. Not evidence of transport submission, persistence, or a quorum.
Sourcepub const fn received(&self) -> Prefix
pub const fn received(&self) -> Prefix
Latest verified volatile receipt. Never use as a durable quorum ACK.
Sourcepub fn available(&self) -> PipelineLimits
pub fn available(&self) -> PipelineLimits
Remaining local outstanding capacity. May be zero; not a reservation. Reports cannot grow the local ledger.
Sourcepub fn outstanding(&self) -> impl ExactSizeIterator<Item = &Operation>
pub fn outstanding(&self) -> impl ExactSizeIterator<Item = &Operation>
Bounded outstanding metadata, in canonical order, for probe/repair planning.
Retransmission reuses these existing reservations rather than calling record_send.
Sourcepub fn record_send(
&mut self,
channel: Channel,
operations: &[Operation],
) -> Result<(), FlowError>
pub fn record_send( &mut self, channel: Channel, operations: &[Operation], ) -> Result<(), FlowError>
Charge local metadata once for a new contiguous suffix in the send path.
Reserve local payload/outbox capacity first. After success the adapter must retain the transmission across local backpressure or fence the whole epoch. Do not call again for a retry, duplicate, or packet still queued locally.
Sourcepub fn observe(&mut self, report: Report) -> Result<bool, FlowError>
pub fn observe(&mut self, report: Report) -> Result<bool, FlowError>
Incorporate same-epoch receipt progress. Return false for stale or exact repeats.
Check the exact receipt boundary and cumulative bytes against reserved sends before freeing metadata. Conflicting same-revision reports and all retractions fail without changing state. Epoch changes require a separate correlated open.