Struct WriteGate 

pub struct WriteGate { /* private fields */ }

Live policy for public-mutation surfaces.

read_only was originally a bool snapshot taken at runtime construction. PLAN.md Phase 4.3 promotes it to an AtomicBool so POST /admin/readonly can flip the policy without a restart. The ReplicationRole stays immutable — flipping a replica into a primary mid-process would need a full handshake (Phase 3 work in the data-safety plan), and shouldn’t be a single-flag decision.

Implementations

impl WriteGate

pub fn from_options(options: &RedDBOptions) -> Self

pub fn check(&self, kind: WriteKind) -> RedDBResult<()>

Returns Ok(()) if the public surface is allowed to perform kind. Returns RedDBError::ReadOnly otherwise.

Reasoning order is intentional:

1. Replica role — a replica booted with read_only = false must still reject; this is a structural property.
2. Lease lost — the strongest serverless correctness signal. A writer that lost its lease must stop immediately; running while another holder has been promoted causes split-brain.
3. Operator read-only flag — explicit /admin/readonly toggle or boot-time pin; lower priority than lease loss because the operator can revoke it without external coordination.

pub fn check_consent(&self, kind: WriteKind) -> RedDBResult<WriteConsent>

Same as check but on success returns a sealed WriteConsent token. Mutating port methods that take &OperationContext demand ctx.write_consent.is_some(); the only way to mint such a token is to call this method, so forgetting to consult the gate becomes a structural property — not a discipline question.

pub fn is_read_only(&self) -> bool

pub fn role(&self) -> &ReplicationRole

pub fn set_read_only(&self, enabled: bool) -> bool

PLAN.md Phase 4.3 — dynamic read-only toggle. Flipping a replica back to writable here is a no-op for check() because the role check fires first; the operator must change the replication role through a separate, audited path.

Returns the previous read_only value so callers can detect idempotent calls (toggle to the same value = no work to do).

pub fn lease_state(&self) -> LeaseGateState

Current writer-lease gate state. NotRequired for standalone, replica, and lease-disabled serverless instances.

Trait Implementations

impl Debug for WriteGate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.