Struct EngineState 

pub struct EngineState<S>
where
    S: StorageLayout,
{
    pub resource_open_lane: ResourceOpenLane,
    /* private fields */
}

Fields

resource_open_lane: ResourceOpenLane

Implementations

impl<S> EngineState<S>

where S: StorageLayout,

pub fn blackholed_identity_count(&self) -> usize

pub fn is_identity_blackholed(&self, identity: &IdentityHash) -> bool

pub fn blackholed_identities( &self, ) -> impl Iterator<Item = BlackholedIdentity<&str>>

pub fn blackhole_identity( &mut self, entry: BlackholedIdentity<&str>, interfaces: AttachedInterfaces<'_>, on_removed: &mut impl FnMut(RemovedRoute), ) -> BlackholeIdentityEffect

pub fn unblackhole_identity( &mut self, identity: &IdentityHash, ) -> UnblackholeIdentityEffect

pub fn seed_blackholed_identities<Reason>( &mut self, entries: impl IntoIterator<Item = BlackholedIdentity<Reason>>, now: InstantMillis, interfaces: AttachedInterfaces<'_>, on_removed: &mut impl FnMut(RemovedRoute), ) -> BlackholeSeedEffect

where Reason: AsRef<str>,

pub fn cull_expired_blackholes(&mut self, now: InstantMillis) -> WakeSchedules

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_command_into<F>( &mut self, issued: IssuedCommand, interfaces: AttachedInterfaces<'_>, now: InstantMillis, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

where F: FnMut(&mut [u8]),

pub fn complete_send_single_packet_deferred( &mut self, owed: EncryptOwed, ephemeral_public: X25519PublicKey, shared: X25519SharedSecret, interfaces: AttachedInterfaces<'_>, buf: &mut [u8], sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_command( &mut self, issued: IssuedCommand, interfaces: AttachedInterfaces<'_>, ) -> CommandOutcome

pub fn interface_counts(&self, interface: InterfaceId) -> InterfaceCounts

impl<S> EngineState<S>

where S: StorageLayout,

pub fn settle_timed_out_receipts( &mut self, now: InstantMillis, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

pub fn settle_timed_out_path_requests( &mut self, now: InstantMillis, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

pub fn cull_expired_routes( &mut self, now: InstantMillis, interfaces: AttachedInterfaces<'_>, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

The reference’s two cull arms (RNS 1.4.2 Transport.jobs): RouteRemovalCause::Expired for the aged, RouteRemovalCause::InterfaceGone for the orphaned. The orphan arm is softened by the crate::routing::warmth::DepartedInterfaces grace; the reverse-route and transported-link culls below stay eager like the reference’s, since they carry in-flight work that a bounced lane kills regardless.

pub fn fire_due_scheduled_announces( &mut self, now: InstantMillis, interfaces: AttachedInterfaces<'_>, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

pub fn fire_due_link_deadlines<F>( &mut self, now: InstantMillis, interfaces: AttachedInterfaces<'_>, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

where F: FnMut(&mut [u8]),

impl<S> EngineState<S>

where S: StorageLayout,

pub fn destination_identity_count(&self) -> usize

pub fn destination_identity( &self, destination: &DestinationHash, ) -> Option<DestinationIdentity<'_>>

pub fn destination_identities( &self, ) -> impl Iterator<Item = DestinationIdentity<'_>>

pub fn mark_destination_used( &mut self, destination: &DestinationHash, now: InstantMillis, ) -> DestinationIdentityRetentionEffect<MarkDestinationUsedOutcome>

pub fn retain_destination( &mut self, destination: &DestinationHash, ) -> DestinationIdentityRetentionEffect<RetainDestinationOutcome>

pub fn release_destination( &mut self, destination: &DestinationHash, now: InstantMillis, ) -> DestinationIdentityRetentionEffect<ReleaseDestinationOutcome>

pub fn retain_identity( &mut self, identity: &IdentityHash, ) -> DestinationIdentityRetentionEffect<RetainIdentityOutcome>

pub fn seed_destination_identity( &mut self, identity: DestinationIdentitySeed<'_>, now: InstantMillis, ) -> DestinationIdentitySeedOutcome

pub fn cull_expired_destination_identities( &mut self, now: InstantMillis, ) -> WakeSchedules

impl<S> EngineState<S>

where S: StorageLayout,

pub fn link_count(&self) -> u32

pub fn visit_announce_rate_states(&self, visit: impl FnMut(AnnounceRateState))

pub fn visit_route_snapshots( &self, interfaces: AttachedInterfaces<'_>, visit: impl FnMut(RouteSnapshot), )

pub fn route_snapshot( &self, destination: DestinationHash, interfaces: AttachedInterfaces<'_>, ) -> Option<RouteSnapshot>

impl<S> EngineState<S>

where S: StorageLayout,

pub fn drop_route( &mut self, destination: &DestinationHash, interfaces: AttachedInterfaces<'_>, ) -> DropRouteEffect

pub fn drop_routes_via( &mut self, transport: TransportId, interfaces: AttachedInterfaces<'_>, on_removed: &mut impl FnMut(RemovedRoute), ) -> DropRoutesViaEffect

impl<S> EngineState<S>

where S: StorageLayout,

pub fn resume_announce( &mut self, owed: AnnounceVerifyOwed, interfaces: AttachedInterfaces<'_>, fill_entropy: &mut impl FnMut(&mut [u8]), sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

impl<S> EngineState<S>

where S: StorageLayout,

pub fn resume_decrypt( &mut self, owed: DecryptOwed, shared: X25519SharedSecret, interfaces: AttachedInterfaces<'_>, should_prove: &mut impl FnMut(&ProofRequest<'_>) -> bool, deferred_sign: &mut Option<DeferredProofSign>, sink: &mut impl FnMut(EngineReaction<'_>), )

pub fn resume_ratchet_decrypt( &mut self, owed: RatchetDecryptOwed, opened: OpenedToken<'_>, interfaces: AttachedInterfaces<'_>, should_prove: &mut impl FnMut(&ProofRequest<'_>) -> bool, deferred_sign: &mut Option<DeferredProofSign>, sink: &mut impl FnMut(EngineReaction<'_>), )

impl<S> EngineState<S>

where S: StorageLayout,

pub fn fire_due_held_announces<F>( &mut self, now: InstantMillis, interfaces: AttachedInterfaces<'_>, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

where F: FnMut(&mut [u8]),

RNS 1.4.2 Interface.process_held_announces.

impl<S> EngineState<S>

where S: StorageLayout,

pub fn resume_link_proof<F>( &mut self, owed: LinkProofVerifyOwed, shared: X25519SharedSecret, interfaces: AttachedInterfaces<'_>, now: InstantMillis, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

where F: FnMut(&mut [u8]),

pub fn resume_link_proof_sign( &mut self, owed: LinkProofSignOwed, responder_encryption: X25519PublicKey, shared: X25519SharedSecret, signature: Ed25519Signature, interfaces: AttachedInterfaces<'_>, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_packet_into<F, P, A, K>( &mut self, packet: InboundPacket<'_>, io: IngestIo<'_, F, P, A, K>, ) -> WakeSchedules

where F: FnMut(&mut [u8]), P: FnMut(&ProofRequest<'_>) -> bool, A: FnMut(&ResourceOffer) -> bool, K: FnMut(EngineReaction<'_>),

pub fn ingest_classified_into<F, P, A, K>( &mut self, packet: ClassifiedInboundPacket<'_>, io: IngestIo<'_, F, P, A, K>, ) -> WakeSchedules

where F: FnMut(&mut [u8]), P: FnMut(&ProofRequest<'_>) -> bool, A: FnMut(&ResourceOffer) -> bool, K: FnMut(EngineReaction<'_>),

pub fn ingest_packet_into_deferring<F, P, A, K>( &mut self, packet: InboundPacket<'_>, io: IngestIo<'_, F, P, A, K>, deferred_sign: &mut Option<DeferredProofSign>, deferred: Option<&mut DeferredCrypto>, ) -> WakeSchedules

where F: FnMut(&mut [u8]), P: FnMut(&ProofRequest<'_>) -> bool, A: FnMut(&ResourceOffer) -> bool, K: FnMut(EngineReaction<'_>),

pub fn ingest_classified_into_deferring<F, P, A, K>( &mut self, packet: ClassifiedInboundPacket<'_>, io: IngestIo<'_, F, P, A, K>, deferred_sign: &mut Option<DeferredProofSign>, deferred: Option<&mut DeferredCrypto>, ) -> WakeSchedules

where F: FnMut(&mut [u8]), P: FnMut(&ProofRequest<'_>) -> bool, A: FnMut(&ResourceOffer) -> bool, K: FnMut(EngineReaction<'_>),

impl<S> EngineState<S>

where S: StorageLayout,

pub fn write_proof( &self, owed: &ProofOwed, buf: &mut [u8], ) -> Result<usize, WriteProofError>

Best-effort by RNS 1.4.2 parity: an unwritable proof is dropped; the sender’s timeout-and-resend is the designed recovery, so nothing here is retried.

pub fn write_signed_proof( &self, packet_hash: &PacketHash, signature: &Ed25519Signature, buf: &mut [u8], ) -> Result<usize, WireError>

pub fn write_link_proof( &self, owed: &LinkProofOwed, buf: &mut [u8], ) -> Result<usize, WriteProofError>

Best-effort by RNS 1.4.2 parity: an unwritable link proof is dropped; the initiator’s timeout is the designed recovery.

pub fn write_channel_ack( &self, link_id: &LinkId, packet_hash: &PacketHash, buf: &mut [u8], ) -> Result<usize, WriteChannelAckError>

RNS 1.4.2 Link.receive’s CHANNEL branch: packet.prove() whenever a channel is open, on either side.

pub fn settle_receipt_proof( &mut self, payload: &[u8], proof_packet_hash: PacketHash, arrived_at: InstantMillis, ) -> ProofIngest

RNS 1.4.2 PacketReceipt.validate_proof, both forms. Settlement removes the receipt, so a replayed proof finds nothing; exactly-once is structural.

pub fn settle_receipt_proof_deferred( &mut self, payload: &[u8], proof_destination: &DestinationHash, proof_packet_hash: PacketHash, arrived_at: InstantMillis, ) -> Option<DeferredProof>

pub fn settle_resolved( &mut self, command_id: CommandId, ) -> Option<ProvenReceipt>

impl<S> EngineState<S>

where S: StorageLayout,

pub fn register_plain_destination( &mut self, app_name: &str, aspects: &[&str], ) -> Result<DestinationHash, RegisterDestinationError>

pub fn register_single_destination( &mut self, identity: &IdentityHash, app_name: &str, aspects: &[&str], app_data: &[u8], proof_strategy: ProofStrategy, link_request_policy: LinkRequestPolicy, ratchet_policy: RatchetPolicy, ) -> Result<DestinationHash, RegisterDestinationError>

pub fn register_group_destination( &mut self, identity: &IdentityHash, app_name: &str, aspects: &[&str], shared_key: &[u8], ) -> Result<DestinationHash, RegisterDestinationError>

RNS 1.4.2 GROUP (type 0x01): identity is addressing material only: a GROUP never announces, proves, or ratchets.

pub fn hold_identity( &mut self, identity_secret_key: Zeroizing<[u8; 64]>, ) -> Result<IdentityHash, HoldIdentityError>

pub fn held_identity_hashes(&self) -> &[IdentityHash]

pub fn set_transport_identity( &mut self, identity: &IdentityHash, ) -> Result<(), SetTransportIdentityError>

pub fn set_non_routing_identity( &mut self, identity: &IdentityHash, ) -> Result<(), SetTransportIdentityError>

pub fn set_shared_instance_identity( &mut self, identity: &IdentityHash, ) -> Result<(), SetTransportIdentityError>

pub const fn transport_id(&self) -> Option<TransportId>

pub const fn network_transport_enabled(&self) -> bool

pub fn upstream_app_destinations( &self, ) -> impl Iterator<Item = UpstreamAppDestination>

pub fn set_default_resource_strategy( &mut self, destination: &DestinationHash, strategy: ResourceStrategy, ) -> bool

RNS 1.4.2 apps set Link.resource_strategy in the link-established callback, a de facto per-destination default; stamping at activation outraces a sender’s instant advertise.

pub fn set_maximum_request_bytes( &mut self, destination: &DestinationHash, maximum: ByteLimit, ) -> bool

pub fn register_request_handler( &mut self, destination: &DestinationHash, path: &str, policy: RequestPolicy, ) -> Result<(), TablePushError>

RNS 1.4.2 Destination.register_request_handler; last write wins, and a re-registration starts from an empty allow list.

pub fn register_request_handler_hash( &mut self, destination: &DestinationHash, path_hash: RequestPathHash, policy: RequestPolicy, ) -> Result<(), TablePushError>

Register a request handler when the host has already derived the protocol path hash.

pub fn unregister_request_handler_hash( &mut self, destination: &DestinationHash, path_hash: &RequestPathHash, ) -> bool

Remove a runtime request handler. Requests already admitted before this mutation may still reach the application router; callers that need an immediate content cutoff should update their application state first.

pub fn allow_requester( &mut self, destination: &DestinationHash, path: &str, identity: IdentityHash, ) -> Result<(), RequestHandlerError>

Admit one identified peer to an RequestPolicy::AllowList handler (RNS 1.4.2’s allowed_list)

pub fn disallow_requester( &mut self, destination: &DestinationHash, path: &str, identity: &IdentityHash, ) -> Result<(), RequestHandlerError>

pub fn persisted_route_rows( &self, ) -> impl Iterator<Item = PersistedRouteRow<'_>>

Every routing-table row in the shape the persistence codec carries, for a host’s flush pass.

pub fn persisted_route_destinations( &self, ) -> impl Iterator<Item = DestinationHash>

pub fn persisted_route_row( &self, destination: &DestinationHash, ) -> Option<PersistedRouteRow<'_>>

pub fn seed_route( &mut self, row: &PersistedRouteRow<'_>, now: InstantMillis, ) -> RouteSeedOutcome

Boot-restore for one snapshot row, refusing what storage may have forged: the address binding re-derives and the announce signature re-verifies before anything lands. RNS 1.4.2’s load path instead re-reads the cached announce packet and counts the cache read as a hop (announce_packet.hops += 1); seeding writes the row directly, so hops carries verbatim. A seeded row’s interface gets the departed grace (Departure::MayReturn), holding the route warm until the medium re-derives the same id at attach.

pub fn prepare_persisted_route<'a>( &self, row: PersistedRouteRow<'a>, ) -> Result<PersistedRouteSignaturePending<'a>, PersistedRoutePreflightError>

pub fn seed_verified_route( &mut self, verified: VerifiedPersistedRoute<'_>, now: InstantMillis, ) -> RouteSeedOutcome

impl<S> EngineState<S>

where S: StorageLayout,

pub fn persisted_self_ratchet_rows( &self, ) -> impl Iterator<Item = (DestinationHash, LastRotated, &[X25519SecretKey])>

pub fn persisted_self_ratchet_row( &self, destination: &DestinationHash, ) -> Option<(LastRotated, &[X25519SecretKey])>

pub fn seed_self_ratchets( &mut self, destination: &DestinationHash, last_rotated: LastRotated, secrets_newest_first: impl DoubleEndedIterator<Item = X25519SecretKey>, ) -> SeedSelfRatchetsOutcome

Boot-restore after the recipe re-registers its destinations: only a destination this boot tracks as ratcheted accepts its stored record, and live secrets win over storage.

pub fn replace_persisted_self_ratchets( &mut self, destination: &DestinationHash, last_rotated: LastRotated, secrets_newest_first: impl DoubleEndedIterator<Item = X25519SecretKey>, ) -> SeedSelfRatchetsOutcome

impl<S> EngineState<S>

where S: StorageLayout,

pub fn set_protocol_policy(&mut self, policy: EngineProtocolPolicy)

pub fn new(identity_secret_key: Zeroizing<[u8; 64]>) -> EngineState<S>

Panics

Panics if S declares a zero-capacity held-identities column; such a layout cannot run a node.

pub const fn ingested_packet_count(&self) -> u64

pub const fn ingested_command_count(&self) -> u64

pub fn metrics_snapshot(&self) -> EngineMetricsSnapshot

pub fn route_count(&self) -> usize

pub fn route_count_via(&self, interface: InterfaceId) -> usize

pub fn link_count_via(&self, interface: InterfaceId) -> usize

pub fn transported_link_count_via(&self, interface: InterfaceId) -> usize

pub fn take_dirty_interfaces(&mut self) -> <S as StorageLayout>::DirtyInterfaces

pub fn interface_attached(&mut self, interface: InterfaceId, now: InstantMillis)

pub fn interface_departed( &mut self, interface: InterfaceId, departure: Departure, now: InstantMillis, )

pub fn scheduled_announce_count(&self) -> usize

impl<S> EngineState<S>

where S: StorageLayout,

pub fn persisted_tunnel_rows(&self) -> impl Iterator<Item = PersistedTunnelRow>

pub fn seed_tunnel(&mut self, row: PersistedTunnelRow) -> SeedTunnelOutcome

Unlike seed_route there is nothing to re-verify: a tunnel row carries no keys, so the worst a hostile store plants is warmth on a dead interface, bounded by the row’s own expiry.

pub fn write_tunnel_synthesize( &self, interface: InterfaceId, random_hash: &[u8; 16], buf: &mut [u8], ) -> Result<usize, WriteTunnelSynthesizeError>

impl<S> EngineState<S>

where S: StorageLayout,

pub fn scheduled_announces_wake(&self) -> WakeSchedule

pub fn receipt_timeouts_wake(&self) -> WakeSchedule

pub fn path_request_timeouts_wake(&self) -> WakeSchedule

pub fn link_deadlines_wake(&self) -> WakeSchedule

pub fn resource_deadlines_wake(&self) -> WakeSchedule

pub fn channel_timeouts_wake(&self) -> WakeSchedule

pub fn held_announce_release_wake(&self) -> WakeSchedule

pub fn route_expiry_wake( &self, interfaces: AttachedInterfaces<'_>, ) -> WakeSchedule

pub fn blackhole_expiry_wake(&self) -> WakeSchedule

pub fn destination_identity_expiry_wake(&self) -> WakeSchedule

pub fn wake_schedules( &self, interfaces: AttachedInterfaces<'_>, ) -> WakeSchedules

Recomputes every schedule from live engine state. The manifold never calls this on the hot path; each engine mutation returns a WakeSchedules delta that the manifold merges into a cached copy instead. This full re-derive is the ground truth for those deltas: debug builds assert the merged cache matches it after every merge, so a mutation that moves a deadline without reporting it in its delta surfaces as a loud divergence instead of a silently missed wake.

pub fn next_wake( &self, now: InstantMillis, interfaces: AttachedInterfaces<'_>, ) -> NextWake

impl<S> EngineState<S>

where S: StorageLayout,

pub fn attach_metrics_interface( &mut self, interface: InterfaceId, logical_interface: InterfaceId, )

impl<S> EngineState<S>

where S: StorageLayout,

pub fn write_commanded_announce( &mut self, commanded: &AnnounceNow, now: InstantMillis, fill_entropy: &mut impl FnMut(&mut [u8]), buf: &mut [u8], ) -> CommandedAnnounceWriteOutcome

pub fn write_path_response_for_upstream( &mut self, destination: &DestinationHash, now: InstantMillis, fill_entropy: &mut impl FnMut(&mut [u8]), buf: &mut [u8], ) -> PathResponseWriteOutcome

Answer a path request for one of our own upstream destinations; RNS 1.4.2 Destination.announce(path_response=True). Path responses for foreign tracked destinations re-emit the retained announce instead, over in the scheduled-announce lane.

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_send_group( &self, id: CommandId, send: SendGroup, ) -> CommandOutcome

pub fn write_commanded_send_group( &self, send: &SendGroup, entropy: SendGroupEntropy, buf: &mut [u8], ) -> Result<usize, SendGroupWriteError>

Intentional deviation from RNS 1.4.2 Transport.outbound, which excludes only PLAIN sends from its receipt gate: a GROUP destination carries no identity to prove with, so the reference’s GROUP receipt can only ever time out, and we track none.

impl<S> EngineState<S>

where S: StorageLayout,

pub fn write_commanded_send_single_packet( &mut self, id: CommandId, send: &SendSinglePacket, now: InstantMillis, entropy: SendSinglePacketEntropy, buf: &mut [u8], ) -> SendSinglePacketWriteOutcome

Seals to the peer’s announced ratchet, identity key when it never announced one (RNS 1.4.2 Destination.encrypt).

pub fn prepare_send_single_packet_deferred( &self, id: CommandId, send: SendSinglePacket, now: InstantMillis, entropy: SendSinglePacketEntropy, ) -> SendSinglePacketPrepared

&self and side-effect-free: nothing is tracked until the scalars are back, so an abandoned obligation leaves no orphan receipt.

pub fn finish_send_single_packet_deferred( &mut self, owed: EncryptOwed, ephemeral_public: X25519PublicKey, shared: X25519SharedSecret, buf: &mut [u8], ) -> FinishSendSinglePacketOutcome

The same bytes and row the inline path produces; the only difference is where the X25519 ran.

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_send_to_channel( &self, id: CommandId, send: SendToChannel, ) -> CommandOutcome

pub fn write_commanded_send_to_channel( &mut self, id: CommandId, send: &SendToChannel, now: InstantMillis, iv: &[u8; 16], buf: &mut [u8], ) -> Result<SendToChannelDispatch, SendToChannelWriteError>

The receiver delivers in sequence order, so a sequence number burned on a failed write would be a hole the peer stalls on forever. So the number is consumed only once the send is Tracked, after every fallible step.

pub fn settle_channel_ack( &mut self, link_id: &LinkId, payload: &[u8], proof: DeliveryProof, arrived_at: InstantMillis, ) -> Option<(CommandId, PacketReceiptDelivered)>

RNS 1.4.2 PacketReceipt.validate_proof: the outstanding-hash match gates the ed25519 verify. The reference uses the same order, so proofs naming nothing we sent cost no signature check.

pub fn fire_due_channel_timeouts<F>( &mut self, now: InstantMillis, interfaces: AttachedInterfaces<'_>, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

where F: FnMut(&mut [u8]),

RNS 1.4.2 Channel._packet_timeout. Retransmits are byte-identical (same sequence and IV, so the same packet hash, so the original outstanding entry still settles). A send that exhausts CHANNEL_MAX_TRIES tears the link down.

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_send_to_link( &self, id: CommandId, send: SendToLink, ) -> CommandOutcome

pub fn write_commanded_send_to_link( &mut self, id: CommandId, send: &SendToLink, now: InstantMillis, iv: &[u8; 16], buf: &mut [u8], ) -> Result<SendToLinkDispatch, SendToLinkWriteError>

RNS 1.4.2 Packet(link, data).send().

Seal send’s payload under the link’s session key, bounded by the link’s negotiated MDU, framed directly into buf and owed to the interface the link rides.

The send is tracked as an outstanding receipt: it settles when the responder’s proof validates, or times out at the link’s traffic deadline (max(rtt × 6, 5 ms)).

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_establish_link( &self, id: CommandId, establish: EstablishLink, ) -> CommandOutcome

pub fn write_commanded_link_request( &mut self, id: CommandId, establish: &EstablishLink, now: InstantMillis, entropy: EstablishLinkEntropy, interfaces: AttachedInterfaces<'_>, buf: &mut [u8], ) -> EstablishLinkWriteOutcome

RNS 1.4.2 Link.__init__, which always signals the default MTU and mode.

pub fn write_owed_link_proof( &mut self, accepted: &AcceptedLinkRequest, ephemeral_secret: X25519SecretKey, mtu_ceiling: usize, buf: &mut [u8], ) -> Result<usize, WriteLinkProofError>

RNS 1.4.2 Link.validate_request, echoing the negotiated MTU and mode.

pub fn write_owed_link_proof_with_parts( &mut self, owed: &LinkProofSignOwed, responder_encryption: &X25519PublicKey, shared: &X25519SharedSecret, signature: &Ed25519Signature, buf: &mut [u8], ) -> Result<usize, WriteLinkProofError>

The crypto-pool-friendly twin of Self::write_owed_link_proof; same bytes either way.

pub fn write_owed_link_rtt( &mut self, link_id: &LinkId, responder_encryption: &X25519PublicKey, activation: &LinkActivation, now: InstantMillis, iv: &[u8; 16], buf: &mut [u8], ) -> Result<usize, WriteLinkRttError>

RNS 1.4.2 Link.validate_proof

pub fn write_owed_link_rtt_with_shared( &mut self, link_id: &LinkId, shared: &X25519SharedSecret, activation: &LinkActivation, now: InstantMillis, iv: &[u8; 16], buf: &mut [u8], ) -> Result<usize, WriteLinkRttError>

The crypto-pool-friendly twin of Self::write_owed_link_rtt; same bytes either way.

pub fn pop_timed_out_link(&mut self, now: InstantMillis) -> Option<OverdueLink>

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_identify( &self, id: CommandId, identify: Identify, ) -> CommandOutcome

pub fn write_commanded_identify( &self, identify: &Identify, iv: &[u8; 16], buf: &mut [u8], ) -> Result<IdentifyDispatch, IdentifyWriteError>

RNS 1.4.2 Link.identify verbatim: signed_data = link_id ‖ keys, payload keys ‖ signature, sealed, context LINKIDENTIFY.

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_close_link( &self, id: CommandId, close: CloseLink, ) -> CommandOutcome

pub fn write_owed_link_close( &mut self, link_id: &LinkId, iv: &[u8; 16], buf: &mut [u8], ) -> Result<LinkCloseDispatch, WriteLinkCloseError>

Seal the LINKCLOSE the way RNS 1.4.2 Link.teardown does (the link_id encrypted under the session key) then forget the link; the dropped row zeroizes its key material.

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_send_request( &self, id: CommandId, request: SendRequest, ) -> CommandOutcome

pub fn ingest_respond(&self, id: CommandId, respond: Respond) -> CommandOutcome

pub fn response_fits_packet(&self, link_id: &LinkId, data: &[u8]) -> bool

pub fn response_data_len_fits_packet( &self, link_id: &LinkId, data_len: usize, ) -> bool

pub fn request_fits_packet(&self, link_id: &LinkId, data: &[u8]) -> bool

pub fn write_commanded_send_request( &mut self, id: CommandId, request: &SendRequest, now: InstantMillis, iv: &[u8; 16], buf: &mut [u8], ) -> Result<SendRequestDispatch, LinkRequestWriteError>

pub fn write_commanded_respond( &self, respond: &Respond, iv: &[u8; 16], buf: &mut [u8], ) -> Result<RespondDispatch, LinkRequestWriteError>

Fire-and-forget; the reference sends its response packet and moves on.

impl<S> EngineState<S>

where S: StorageLayout,

pub fn provide_decompressed( &mut self, link_id: LinkId, hash: ResourceHash, plaintext: &[u8], now: InstantMillis, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

Verified exactly like an uncompressed assembly. The host signals its own inflate failure with an empty slice. A borrow-taking entry point beside the command queue (so a mebibyte never rides an enum).

impl<S> EngineState<S>

where S: StorageLayout,

pub fn owed_open_span(&self) -> Option<(LinkId, ResourceHash)>

The next incoming row whose parked open trails its frontier — one chew is dispatchable per row at a time (the spans chain through the state), and a row already Chewing waits for its verdict.

pub fn open_span_job_view( &self, link_id: &LinkId, hash: &ResourceHash, ) -> Option<OpenSpanJobView<'_>>

The owed chew’s worker inputs, borrowed for the runtime to copy into a pool job; begin_open_chew then moves the state out to ride with them.

pub fn begin_open_chew( &mut self, link_id: &LinkId, hash: &ResourceHash, ) -> Option<StreamedOpen>

Move the parked state out for the worker, leaving the dispatched span behind as the verdict’s identity check.

pub fn apply_opened_span( &mut self, verdict: OffloadedOpenSpan<'_>, now: InstantMillis, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

A worker’s span verdict, landing only on the row still marked with exactly this span — one for a row that died or was replaced mid-chew drops silently. The impossible near-miss (a replacement row that dispatched the identical span within one pool round trip) still cannot deliver wrong bytes: the returned state’s MAC midstate would refuse the mismatched transfer at its conclusion.

A transfer that finished arriving while the worker chewed parked as AwaitingOpen; its verdict concludes it here, chewing any small remainder inline — the proof is gated on it and the engine thread has nothing else to run first.

impl<S> EngineState<S>

where S: StorageLayout,

pub fn fire_due_resource_deadlines<F>( &mut self, now: InstantMillis, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

where F: FnMut(&mut [u8]),

impl<S> EngineState<S>

where S: StorageLayout,

pub fn ingest_send_resource_into<F>( &mut self, send: &ResourceSend<'_>, now: InstantMillis, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

where F: FnMut(&mut [u8]),

pub fn ingest_send_static_response_into<F>( &mut self, id: CommandId, respond: &Respond, now: InstantMillis, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

where F: FnMut(&mut [u8]),

pub fn ingest_send_resource_segment_into<F>( &mut self, send: &ResourceSend<'_>, segment: ResourceSegment, now: InstantMillis, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), ) -> WakeSchedules

where F: FnMut(&mut [u8]),

Segment 1 of a split records its hash as the chain’s original_hash; every later segment re-advertises it, so the host threads no hashes of its own.

total_data_bytes is the whole transfer’s uncompressed DATA length. The engine adds the metadata block on top, and RNS 1.4.2 advertises the sum (the d field) on every segment, never the segment’s own size.

A continuation whose live segment failed on the wire before this command reached the engine settles PredecessorFailed without advertising. A pipelining host therefore cannot revive a dead transfer’s tail.

pub fn owed_staged_seal_link(&self) -> Option<LinkId>

The link whose staged continuation owes its deferred seal: the segment ahead of it has served every part and awaits only the proof, so the receiver is busy verifying and this is the window the seal was deferred into. The manifold drains this only after yielding because it shares its thread with the interface writers. The served parts must flush to the wire ahead of a multi-millisecond seal.

pub fn seal_staged_continuation<F>( &mut self, link_id: &LinkId, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), )

where F: FnMut(&mut [u8]),

The deferred seal, run the moment the live segment’s last part is served: the receiver spends the next stretch ingesting and verifying, so the continuation’s seal rides that window instead of sitting on the advertise path.

pub fn staged_seal_job_view( &self, link_id: &LinkId, ) -> Option<StagedSealJobView<'_>>

The owed seal’s worker inputs, borrowed for the manifold to copy into a crypto-pool job; mark_staged_sealing then parks the row until the verdict.

pub fn mark_staged_sealing(&mut self, link_id: &LinkId)

pub fn apply_offloaded_staged_seal( &mut self, verdict: OffloadedStagedSeal<'_>, sink: &mut impl FnMut(EngineReaction<'_>), )

A pool worker’s seal verdict lands on the row only if it still matches the job’s stream nonce and length; a row that died or was replaced meanwhile drops the verdict silently.

pub fn promote_staged_resource<F>( &mut self, link_id: &LinkId, now: InstantMillis, fill_entropy: &mut F, sink: &mut impl FnMut(EngineReaction<'_>), )

where F: FnMut(&mut [u8]),

The staged continuation’s advertisement, owed since its build and released by the live segment’s proof. Runs in the same inbound pass as the proof settle, so the receiver sees the next advertisement exactly where the reference’s sender would first build it.

impl<S> EngineState<S>

where S: StorageLayout,

pub fn write_commanded_path_request( &mut self, id: CommandId, request: &RequestPath, now: InstantMillis, buf: &mut [u8], ) -> PathRequestWriteOutcome

RNS 1.4.2 Transport.request_path emits unconditionally: an existing route never blocks the request, so a suspect path stays refreshable.

pub fn pop_settled_path_request( &mut self, destination: &DestinationHash, ) -> Option<SettledPathRequest>

pub fn pop_timed_out_path_request( &mut self, now: InstantMillis, ) -> Option<ExpiredPathRequest>

Drain one pending request whose timeout has passed. Call repeatedly until None to fully drain. Every pop is that command’s timeout settlement.

Trait Implementations

impl<S> Debug for EngineState<S>

where S: StorageLayout, <S as StorageLayout>::Routes: Debug, <S as StorageLayout>::Announces: Debug, <S as StorageLayout>::History: Debug, <S as StorageLayout>::AppData: Debug, <S as StorageLayout>::ScheduledAnnounces: Debug, <S as StorageLayout>::UpstreamAppDestinations: Debug, <S as StorageLayout>::PacketHashes: Debug, <S as StorageLayout>::Blackholes: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<S> Default for EngineState<S>

where S: StorageLayout,

fn default() -> EngineState<S>

Returns the “default value” for a type.