Struct InMemoryReplayGuard 

pub struct InMemoryReplayGuard { /* private fields */ }

A bounded, in-process ReplayGuard: an LRU map from id to the digest accepted under it, its retention deadline, and the response it produced.

Suitable when

One process is the sole consumer for the recipient VID it serves, and losing the record on restart is acceptable — that is, the window in which a replay could arrive is shorter than the process’s uptime, or the transport will not redeliver across a restart.

Not suitable when

The consumer is replicated. Two replicas behind a load balancer each hold their own map, so the same document accepted by replica A is Fresh at replica B and the consequential effect happens twice — the exact failure item 11 exists to prevent. Replicated deployments MUST back ReplayGuard with a store shared by every replica, which is why the seam is a trait.

Eviction is by capacity as well as by retain_until: a burst of distinct documents can push an older record out before its retention deadline, and a replay arriving after that would be accepted. Size the capacity above the number of distinct documents the widest acceptance window can hold.

Implementations

impl InMemoryReplayGuard

pub fn new(capacity: usize) -> InMemoryReplayGuard

A guard retaining at most capacity records.

Panics

If capacity is zero. A guard that retains nothing answers Fresh to every arrival, which is indistinguishable from having no guard at all — and would be a silent, total defeat of item 11 rather than a visible misconfiguration.

pub fn len(&self) -> usize

Number of records currently retained. Exposed for tests and metrics.

pub fn is_empty(&self) -> bool

Whether the guard is currently retaining nothing.

pub fn purge_expired(&self, now: DateTime<Utc>)

Drop every record whose retain_until has passed.

claim already treats an individual expired record as absent, so calling this is an optimisation (it reclaims memory) rather than a correctness requirement.

Trait Implementations

impl Default for InMemoryReplayGuard

fn default() -> InMemoryReplayGuard

10 000 records — a few megabytes at typical document sizes, and enough to cover a five-minute acceptance window at ~33 documents per second.

impl ReplayGuard for InMemoryReplayGuard

fn claim<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, id: &'life1 str, digest: &'life2 DocumentDigest, retain_until: Option<DateTime<Utc>>, now: DateTime<Utc>, ) -> Pin<Box<dyn Future<Output = Result<ReplayVerdict, ReplayGuardError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, InMemoryReplayGuard: 'async_trait,

Claim id for execution on behalf of a document with content identity digest.

fn record_response<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, id: &'life1 str, response: Option<&'life2 Value>, ) -> Pin<Box<dyn Future<Output = Result<(), ReplayGuardError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, InMemoryReplayGuard: 'async_trait,

Attach the response a completed execution produced, so a later duplicate can be answered with it per SPEC §7.2 (Disposition of a duplicate) rather than merely absorbed in silence.

fn release<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, id: &'life1 str, digest: &'life2 DocumentDigest, ) -> Pin<Box<dyn Future<Output = Result<(), ReplayGuardError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, InMemoryReplayGuard: 'async_trait,

Release a claim whose execution never began — for example because a check after the claim refused the document.