Struct StreamConfig 

pub struct StreamConfig<'a> {
    pub base_snapshot_key: &'a str,
    pub page_size: usize,
    pub backpressure: BackpressureConfig,
    pub rpo_target: Option<Duration>,
    pub epoch: u64,
    pub owner: Option<&'a str>,
    pub pointer_generation: u64,
}

Configuration for a streaming session.

Fields

base_snapshot_key: &'a str

Object-store key of the base tier-1a snapshot the frames replay onto. Recorded in every generation manifest; restore re-fetches it.

page_size: usize

Page size of the base snapshot — read it from the snapshot header (offset 16, u16 big-endian; the on-disk value 1 means 65 536). Required because the seam does not return it and sync_server.rs’s 4 KB hardcode is the wrong default to inherit.

backpressure: BackpressureConfig

R574-F2: bounded spill buffer + overflow policy + 429/503 backoff for the R2 upload side of the drain loop. Default is behavior-preserving (BackpressurePolicy::Fail — errors bubble immediately, same as before this field existed).

rpo_target: Option<Duration>

R574-T4: the stated RPO bound — the caller’s own scheduler is expected to invoke tail_frames often enough that the watermark never goes stale past this. None (the default) means no target is asserted; RpoStatus::breached is always false in that case, but RpoStatus::watermark_age is still reported so a caller can observe the real gap before picking a number.

R761-T1: DEFAULT_RPO_TARGET (120 s, tailed at DEFAULT_TAIL_INTERVAL = 60 s) is the number to put here absent a reason to pick another — its doc carries the measured write-op table that justifies it. None stays the default so that a caller who has not thought about RPO never gets a breach flag it did not ask for.

epoch: u64

R732-F2 (W245): this writer’s fencing token — the per-tenant epoch handed out by yubaba’s raft state machine (YubabaState::tenant_fencing_token). It is stamped into every frame key, every generation manifest, and the watermark sidecar, and it is checked before a single frame is uploaded: a writer whose epoch is lower than the one already recorded at the sink is a stale owner and bounces with StreamOutcome::Fenced rather than interleaving its frames with the real owner’s.

0 means unfenced, and is the behaviour-preserving default for a single-writer deployment that has no ownership authority to ask. Note that unfenced is not exempt: a 0 writer is still fenced by any sink already stamped with a real epoch, which is exactly what should happen when a tenant has been claimed and a legacy streamer is still running.

owner: Option<&'a str>

R732-F2: opaque label for who holds epoch — a yubaba node id, a hostname, whatever the caller finds useful. Recorded in the manifest and never interpreted here. Purely diagnostic: when you are staring at a fenced stream at 3am, “which owner wrote generation 7” is the first question, and the epoch alone does not answer it.

pointer_generation: u64

R736-T2 (W250): the cross-cell fence — this writer’s belief about the global tenant→cell pointer’s generation (yah_tenant_pointer::PointerRecord::generation). epoch alone fences within one raft group; it says nothing when ownership moves to a different cell, because the two cells run independent raft groups that share no epoch counter. Checked alongside epoch before any frame is uploaded: a writer whose generation is lower than the one already recorded at the sink is a stale cell and bounces with StreamOutcome::Fenced, exactly like a stale epoch.

0 means unfenced — the same behaviour-preserving default as epoch, for a single-cell deployment that has no global pointer to ask. This mirrors yah_tenant_pointer’s FIRST_GENERATION = 1: 0 is what an unfenced writer defaults to and must never be mistakable for a live cross-cell owner. The caller (yubaba’s control plane) resolves the pointer and hands the generation in as a plain u64 — this crate does not link yah_tenant_pointer to read it itself.