Module durable 

Durable write path for event publication.

Governed by spec 067-durable-journal-retention-and-write-limits (FR-003..FR-005): publish() waits for the durable journal write only up to a configured timeout, a timed-out event is rejected — never silently downgraded to in-memory-only delivery — and every timeout produces a structured audit record (spec 036 NFR-006).

Structs

DurableBroker

EventBroker decorator that makes every published event durable before it is delivered: the event is journaled with fsync-before-acknowledgement (066 FR-006) and only then forwarded to the inner broker for live delivery, adopting the journal-assigned cursor as the inner broker’s own cursor for that event (spec 066 FR-007) so the two stay numerically consistent. A write that exceeds the configured timeout rejects the event with journal_write_timeout (067 FR-003/FR-004); if the abandoned write completes later, the writer durably revokes it so it can never surface through replay.

DurableBrokerConfig

Configuration for the durable write path (067 FR-003 default: 2 seconds).

JournalWriteAuditRecord

Structured audit record for durable write-path failures (067 FR-005, consistent with spec 036 NFR-006 observability).

Traits

JournalSink

Durable sink the writer thread appends through. DurableEventJournal is the production implementation; tests inject slow or failing sinks to drive the timeout and revocation paths deterministically.

JournalSource

Read-side of a durable journal: serves replay for cursors the live broker’s in-memory window no longer retains (spec 066 FR-005, FR-008). RwLock<DurableEventJournal> is the production implementation, shared with the write path via DurableBroker::open; tests inject a stub for write-path-only scenarios that never exercise replay.

JournalWriteAuditSink

Receives structured audit records from the durable write path.