Module session 

The symmetric sync session (phase D, #406).

One protocol for both roles. Each peer sends Frame::Hello with the account it is syncing and every account-log entry hash it holds, then streams the entries the other lacks and ends with Frame::Done. The two directions run concurrently over one bidirectional stream, so a large transfer in one direction never blocks the other (the deadlock a send-then-receive ordering would cause on a bounded stream).

The session is transport-agnostic — generic over any AsyncRead/AsyncWrite pair — and trusts nothing it receives: every entry is handed to SyncStore::ingest, which re-verifies it from scratch. It is deliberately NOT Send-bound: SyncStore wraps a SQLite connection, so a caller runs one session at a time on a single task (concurrent sessions are a later slice).

Structs

SessionReport

What one session moved. Symmetric: each peer both sends and receives.

Enums

Ingested

Whether an ingested entry was newly stored, so a session can report real transfer versus redelivery without the store leaking its verdict taxonomy.

SessionError

A session that could not complete.

Constants

DEFAULT_IDLE_TIMEOUT

How long the receiver waits for the peer’s next frame before aborting the session as idle. A peer that connects and never sends, or stalls mid-stream, would otherwise hold the (single- session) server forever, blocking every later peer. Generous — a slow but progressing transfer resets it on each frame — while still bounding a silent connection.

MAX_SESSION_ENTRIES

The most entries one session will accept from a peer before aborting. A legitimate transfer for one account is bounded by that account’s stored + parked capacity (a few thousand); this cap is far above that so an honest sync never hits it, while still bounding a peer that streams redelivered or junk entries forever. Paired with the empty-page rejection below, it turns “the receive loop runs until Done” into a bounded transfer, not an open-ended one a peer can hold open (#406: bounded frames, no amplification).

Traits

SyncStore

The store side of a session: what a peer offers and where received entries land. Implemented over the op log for production and over an in-memory map for tests.

Functions

run_session

Run one session to completion over send/recv, syncing account entries with the peer.

run_session_with_idle_timeout

run_session with an explicit idle timeout — the receiver aborts if the peer sends no frame within idle_timeout. Exposed so tests can exercise the timeout without waiting the default.