Struct DurableBroker 

pub struct DurableBroker<B: EventBroker> { /* private fields */ }

EventBroker decorator that makes every published event durable before it is delivered: the event is journaled with fsync-before-acknowledgement (066 FR-006) and only then forwarded to the inner broker for live delivery, adopting the journal-assigned cursor as the inner broker’s own cursor for that event (spec 066 FR-007) so the two stay numerically consistent. A write that exceeds the configured timeout rejects the event with journal_write_timeout (067 FR-003/FR-004); if the abandoned write completes later, the writer durably revokes it so it can never surface through replay.

subscribe/poll normally delegate to the inner broker’s fast, in-memory delivery. When a requested cursor is older than the inner broker’s retention window, DurableBroker falls back to the durable journal (spec 066 FR-005, FR-008): if the journal still retains the cursor, a durable-mode subscription is created that reads through JournalSource::replay_from for the rest of its lifetime (applying the identical subject_id filter as live delivery, FR-003); if the journal has also reclaimed that history, cursor_expired is returned with the journal’s own oldest available cursor.

Implementations

impl<B: EventBroker> DurableBroker<B>

pub fn new( inner: B, sink: impl JournalSink + 'static, source: Arc<dyn JournalSource>, config: DurableBrokerConfig, audit: Arc<dyn JournalWriteAuditSink>, ) -> Self

Wrap inner with a durable write path backed by sink, and a journal-backed replay fallback backed by source. Production callers should use DurableBroker::open, which guarantees sink and source share the same underlying journal storage; this lower-level constructor exists so tests can inject independent write- and read-side doubles.

pub fn open( root: &Path, inner: B, journal_config: JournalConfig, broker_config: DurableBrokerConfig, audit: Arc<dyn JournalWriteAuditSink>, clock: Arc<dyn BrokerClock>, ) -> Result<Self, JournalError>

Opens (or creates and recovers) a durable journal at root and wraps inner with a write path and journal-backed replay fallback sharing that same storage, so cursors stay consistent across live delivery and durable replay (spec 066 FR-007).

Errors

Returns JournalError when the journal cannot be opened or recovered (066 FR-009).

Trait Implementations

impl<B: EventBroker> EventBroker for DurableBroker<B>

fn publish(&self, event: TraverseEvent) -> Result<(), EventError>

Publish an event. Fails if the event type is not Active in the catalog.

fn subscribe( &self, event_type: &str, from_cursor: &str, ) -> Result<Subscription, EventError>

Create a subscription for the given event_type starting from from_cursor.

fn subscribe_for_subject( &self, event_type: &str, from_cursor: &str, subject_id: Option<&str>, ) -> Result<Subscription, EventError>

Create a subscription optionally limited to one event subject.

fn poll( &self, subscription_id: &str, max_events: usize, ) -> Result<SubscriptionPoll, EventError>

Poll a subscription for up to max_events.

fn cancel(&self, subscription_id: &str) -> Result<(), EventError>

Cancel a subscription and free all associated queues.

fn publish_with_cursor( &self, event: TraverseEvent, cursor: &str, ) -> Result<(), EventError>

Publish an event, threading a pre-assigned durable cursor through to the broker’s own cursor space when the implementation supports cursor injection. DurableBroker uses this to keep live-delivery cursors numerically consistent with the durable journal’s cursor space (spec 066 FR-007), so a cursor issued during live polling remains valid when later resolved through durable replay. The default implementation ignores cursor and behaves like Self::publish.

fn seed_restart_floor(&self, floor: u64)

Establishes a floor below which any cursor, for any event type this broker has not itself observed, is treated as potentially predating this broker instance’s own history (spec 066 FR-007: restart cursor continuity). DurableBroker::open calls this once at construction, seeded from the durable journal’s latest cursor, so a freshly constructed in-memory broker correctly defers stale-looking cursors to durable replay after a restart instead of accepting them outright. The default implementation is a no-op.