Struct MembershipCatalog 

pub struct MembershipCatalog { /* private fields */ }

The authorized-member set for one cluster — the control-plane membership catalog.

Membership is explicit: a node appears here only after a successful join (super::join). Autodetect of health and topology ranges over autodetect_candidates — i.e. these members only — never over arbitrary peers that happen to be reachable on the network.

Implementations

impl MembershipCatalog

pub fn new( cluster_id: ClusterId, founders: impl IntoIterator<Item = ClusterMember>, ) -> MembershipCatalog

A catalog for cluster_id seeded with founders. The founding data members are the bootstrap set that later candidates authenticate against; each starts empty.

pub fn cluster_id(&self) -> &ClusterId

pub fn is_authorized(&self, identity: &NodeIdentity) -> bool

Is identity an authorized member of this cluster? This is the gate every control-plane path consults — only an authorized member’s health and topology are autodetected, and only a member may vote or own ranges.

pub fn member(&self, identity: &NodeIdentity) -> Option<&ClusterMember>

pub fn member_mut( &mut self, identity: &NodeIdentity, ) -> Option<&mut ClusterMember>

pub fn admit(&mut self, member: ClusterMember) -> AdmissionOutcome

Admit member as authorized. Idempotent: re-admitting an existing member leaves the catalog (and the member’s range count) untouched, so a reconnecting member never has its ranges reset to zero.

pub fn begin_drain(&mut self, identity: &NodeIdentity) -> Option<bool>

Mark an authorized member draining (planned-removal flow, issue #1000). Returns None if identity is not a member, otherwise whether the state changed (false if it was already draining). A draining member keeps its ranges until drain moves them off, but is no longer a placement target.

pub fn remove(&mut self, identity: &NodeIdentity) -> Option<ClusterMember>

Remove a member from the authorized set, returning the removed ClusterMember (or None if it was not a member). This is the final step of both the planned drain and the force-remove flows; callers gate it on the range-dependency checks in super::drain — the catalog itself does not re-check, so a force remove of a dead member can drop it even while ranges still nominally list it.

pub fn members(&self) -> impl Iterator<Item = &ClusterMember>

Every authorized member, in stable identity order.

pub fn placement_eligible_members(&self) -> impl Iterator<Item = &ClusterMember>

The members eligible to receive new range placements — active data members only, in stable identity order. Draining members and witnesses are excluded, so a rebalancer or a drain’s replica-evacuation never targets a member that is itself on the way out.

pub fn autodetect_candidates(&self) -> impl Iterator<Item = &ClusterMember>

The members autodetect of health/topology is allowed to range over — exactly the authorized members. An arbitrary network peer that has not joined is absent here, so autodetect can never silently adopt it.

pub fn is_autodetect_eligible(&self, identity: &NodeIdentity) -> bool

Whether autodetect may consider identity. True only for authorized members — the rule that “autodetect applies only to authorized members after join, not arbitrary network peers”.

pub fn len(&self) -> usize

pub fn is_empty(&self) -> bool

pub fn data_member_count(&self) -> usize

How many data members the cluster currently has (witnesses excluded). This is the number the resilient baseline is measured in.

pub fn assess_baseline(&self) -> BaselineAssessment

Assess the cluster against the resilient multi-writer baseline of RESILIENT_DATA_MEMBER_BASELINE data members.

Trait Implementations

impl Clone for MembershipCatalog

fn clone(&self) -> MembershipCatalog

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MembershipCatalog

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.