Module journal 

Journal record framing.

The journal is an append-only sequence of framed records:

[len u32 LE][check u32 LE][op u8][payload ...]     len = 1 + payload

check is the low 32 bits of xxh3-64 over [op][payload]. Framing is op-agnostic — the op byte’s meaning (Remember, Revise, …) belongs to the engine’s replay layer, which lands with the verbs.

Torn tails vs corruption

There is exactly one writer and appends are sequential, so a crash can only leave a prefix of the last record. That yields a clean rule for scan:

• a record whose frame extends past the end of the buffer is the torn tail: the scan succeeds, drops it, and reports truncated_tail;
• a complete frame with a bad checksum that ends exactly at the buffer end is also treated as a torn tail (a torn write inside the payload of the final record looks like this);
• any other inconsistency — a bad checksum mid-stream, a len of 0 (no valid record has one, and a torn prefix of ≥ 4 bytes always carries a valid len) — is Error::Corrupt.

Structs

JournalEntry

One decoded journal record, borrowing the scanned buffer.

JournalScan

Result of scanning a journal buffer.

Enums

Op

One decoded engine operation (op table). Revise is Remember with revises set — the two share a payload, only the op byte differs.

Functions

encode_entry

Appends one framed record to out (the bytes handed to Storage::append_journal).

scan

Scans a whole journal buffer into records (validation + tail-recovery rules in the module docs).