Struct TraceWindow 

pub struct TraceWindow { /* private fields */ }

Sliding window that accumulates events by trace_id.

Uses an LRU cache for O(1) amortized eviction when at capacity.

Implementations

impl TraceWindow

pub fn new(config: WindowConfig) -> Self

pub fn push( &mut self, event: NormalizedEvent, now_ms: u64, ) -> Option<(String, Vec<NormalizedEvent>)>

Push a normalized event into the window.

Returns the LRU-evicted trace (if any) so the caller can run detection on it before discarding. Returns None if no eviction was needed.

pub fn evict(&mut self, now_ms: u64)

Evict traces that have not been updated within the TTL.

Scans the full LRU cache rather than stopping at the first non-expired entry, because clock adjustments (NTP) can cause last_seen_ms and LRU position to diverge, leaving expired traces behind non-expired ones.

The key cloning into a temporary Vec<String> is required because the lru crate does not expose retain() or drain_filter(). At max_active_traces = 10_000 the cost is bounded and runs at most once per tick (~15s). If the lru crate adds in-place removal in a future release, this can be simplified.

pub fn evict_expired( &mut self, now_ms: u64, ) -> Vec<(String, Vec<NormalizedEvent>)>

Evict expired traces and return them for processing.

Unlike evict() which silently drops expired traces, this method returns them so the daemon can run detection before discarding. Scans the full cache to handle clock skew (see evict()).

pub fn drain_all(&mut self) -> Vec<(String, Vec<NormalizedEvent>)>

Drain all traces, returning their events grouped by trace_id.

pub fn active_traces(&self) -> usize

Number of active traces.

pub fn peek_clone(&self, trace_id: &str) -> Option<Vec<NormalizedEvent>>

Clone a trace’s spans without evicting or promoting it in the LRU. Returns None if the trace is not in the window.