Struct Stager 

pub struct Stager<S, V, A, H> { /* private fields */ }

The apply substrate: stage → verify → apply → (commit | auto-rollback).

Holds the live version and the previous version behind it, plus the four seams that touch the outside world. Stager::stage_and_apply drives the whole sequence; Stager::live and Stager::previous expose the current pointer state.

Implementations

impl<S, V, A, H> Stager<S, V, A, H>

where S: UpdateSource, V: SignatureVerifier, A: Activator, H: HealthCheck,

pub const fn new( source: S, verifier: V, activator: A, health: H, initial_live: ReleaseId, ) -> Self

Build a stager over its four seams, starting from initial_live as the version already serving.

pub const fn live(&self) -> &ReleaseId

The version currently serving — the committed live pointer.

pub const fn previous(&self) -> Option<&ReleaseId>

The previous version, kept staged so a rollback is a pointer flip. None until the first update commits.

pub fn stage_and_apply( &mut self, release: &ReleaseId, ) -> Result<Outcome, StageError>

Stage release, verify it, apply it, and commit or auto-roll-back on the health check.

The sequence is fixed:

1. download the release to a side location;
2. verify its signature — an unverified bundle returns StageError::Unverified with the live pointer untouched;
3. flip the live pointer to the new version;
4. run the health check — on Health::Healthy commit and return Outcome::Committed; on Health::Unhealthy flip the pointer back to the previous version and return Outcome::RolledBack.

The committed live pointer (Stager::live) only advances in step 4 on a passed health check, so a refused or rolled-back attempt leaves the stager exactly where it started.

Errors

Returns StageError::Download if the source cannot stage the release, StageError::Unverified if the signature does not verify, or StageError::Activate if a pointer flip fails (applying the new version, or — worse — flipping back during a rollback).