Struct DurableState 

pub struct DurableState { /* private fields */ }

Durable WAL state owned by a live CoreProvider.

The HLC counter is seeded from WalWriter::last_sequence. On a fresh WAL this is zero and the first commit receives HlcTimestamp::new(1, 0); after reopening, the next timestamp advances past the recovered WAL sequence.

Implementations

impl DurableState

pub fn new(writer: WalWriter) -> Self

Construct durable state from an already-open WAL writer.

pub fn with_audit_log(self, audit: AuditLog) -> Self

Attach an audit log so engine-owned events committed through this provider are mirrored to it (Item 7 / D24).

Mirroring is WAL-first, audit-after: the WAL append is the source of truth and gates the commit; the audit write runs only after it succeeds and is best-effort (a failure is logged, never failing the commit). The event also remains in the WAL, so a failed mirror degrades to the pre-Item-7 WAL-only behavior rather than losing the event. Per the donor lesson “audit lag is recoverable, fiction is not,” the audit can only lag the WAL, never lead it.

pub fn append_audit_event(&self, kind: u16, payload: Vec<u8>) -> bool

Append one engine-owned event to the attached audit log, if any.

The D24 audit log is the durable “events” surface in the snapshot=state / WAL=changes / audit=events split, with retention independent of the WAL lineage. Appends are best-effort and audit-after: the caller stamps the wall clock here, the record is serialized by the caller into an opaque kind-tagged payload, and an append failure is logged and skipped rather than propagated, so the audit can only lag a committed change, never lead it (the donor lesson “audit lag is recoverable, fiction is not”). Returns false when no audit log is attached or the append failed.

The pack-lifecycle producer that previously fed this surface was removed in the extension teardown; the framework remains wired (persisted, reattached on recovery) for future user-action audit events (D24).