Module write_gate 

Public-mutation gate.

Centralises the check that decides whether a write coming through any public surface (SQL, HTTP, gRPC, PostgreSQL wire, native wire, admin mutating endpoints) is allowed for this instance.

Two inputs:

• RedDBOptions::read_only — set explicitly by operators.
• ReplicationConfig::role — Replica { .. } is always read-only on public surfaces; internal logical-WAL apply (LogicalChangeApplier) reaches into the store directly and never crosses this gate.

All public mutation paths consult WriteGate::check before dispatching to storage. The replica internal apply path is the privileged surface and bypasses the gate by construction.

Serverless writer-lease state (PLAN.md Phase 5 / W6) is wired through LeaseGateState — runtime flips it to Held after a successful acquire/refresh and back to NotHeld when the lease is lost, released, or has expired. Standalone / replica / lease-not- configured deployments stay on NotRequired so the check is a single atomic load of zero.

Structs

WriteGate

Live policy for public-mutation surfaces.

Enums

LeaseGateState

Serverless writer-lease state wired through the gate.

WriteKind

Categorises the write so the rejection error can name a sensible surface in operator-facing logs without leaking internal call sites.