Struct DispositionStore 

pub struct DispositionStore { /* private fields */ }

The rolling per-rule disposition store.

Updated only by the ingestion paths (it never sits in the eval or sink path), so it is strictly additive and cannot affect detection throughput.

Implementations

impl DispositionStore

pub fn new(config: DispositionConfig) -> Self

Create an empty store with the given config.

pub fn config(&self) -> &DispositionConfig

The store’s configuration.

pub fn apply(&mut self, disposition: &Disposition, now: i64) -> IngestOutcome

Apply one disposition at now (epoch seconds), enforcing idempotency.

Returns IngestOutcome::Rejected for an unresolved incident-scoped record (no rule_id), IngestOutcome::Duplicate for a redelivery, and IngestOutcome::Accepted otherwise. The affected rule’s bucket map is pruned to the window on each apply.

pub fn prune(&mut self, now: i64)

Drop buckets older than the window across every rule (called on a periodic tick). Rules left with no buckets are removed.

pub fn ratio(&self, rule_id: &str) -> Option<f64>

The false-positive ratio for one rule over the window, or None when it has fewer than min_sample dispositions.

pub fn summaries(&self) -> Vec<RuleSummary>

A per-rule summary for every rule with at least one disposition, sorted by rule_id for stable output.

pub fn rule_count(&self) -> usize

Number of rules currently tracked.

pub fn snapshot(&self) -> DispositionSnapshot

Capture the store into a versioned snapshot for persistence.

pub fn restore(&mut self, snapshot: DispositionSnapshot, now: i64) -> bool

Restore a snapshot at now, pruning buckets and seen ids past the window. Returns false on a version mismatch (caller starts fresh).

Trait Implementations

impl Debug for DispositionStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.