Struct CheckpointDecisionStore 

pub struct CheckpointDecisionStore { /* private fields */ }

Durable checkpoint metadata store.

Implementations

impl CheckpointDecisionStore

pub fn new(store: Arc<dyn ObjectStore>) -> Self

Wrap shared storage that must provide native conditional updates.

pub fn local_filesystem(root: impl AsRef<FsPath>) -> Result<Self, DecisionError>

Open crash-durable checkpoint metadata in a caller-owned local directory. The caller must retain its exclusive namespace lease for the store’s write lifetime.

Errors

Returns an I/O error when the directory cannot be created, synchronized, or opened.

pub async fn create_recovery_capsule( &self, capsule: &ClusterRecoveryCapsule, ) -> Result<RecoveryCapsuleRef, DecisionError>

Create the canonical content-addressed body for a cluster recovery capsule.

Identical retries converge on the existing immutable body. The returned reference is safe to publish only after this method succeeds.

Errors

Object-store I/O, malformed capsule content, deployment mismatch, or a conflicting body.

pub async fn load_recovery_capsule( &self, reference: &RecoveryCapsuleRef, ) -> Result<ClusterRecoveryCapsule, DecisionError>

Load and verify one exact content-addressed recovery capsule.

Verification covers the object path, recorded and observed lengths, canonical JSON body, SHA-256 reference, deployment identity, and capsule-internal invariants.

Errors

Object-store I/O, a missing object, malformed content, or any reference mismatch.

pub async fn load_or_create_deployment_id( &self, ) -> Result<String, DecisionError>

Load the checkpoint namespace’s create-once deployment incarnation, creating it when the durable store is empty. Concurrent cluster members converge through object-store CAS.

Errors

Object-store I/O or a malformed/conflicting persisted identity.

pub async fn allocate_checkpoint_id_at_least( &self, minimum: u64, ) -> Result<u64, DecisionError>

Allocate the next globally ordered checkpoint ID at or above minimum.

Shared stores advance one fixed-size durable high-water object with native compare-and- swap. The allocation identity in each proposal reconciles a lost write response without returning an ID won by another coordinator. Node-local filesystems claim immutable blocks and allocate from the active block in memory. They are cancellation-safe under the constructor’s exclusive single-writer namespace contract, remove durable I/O from the hot path, and burn the unused block tail on restart. Gaps are valid and IDs are never reused.

Errors

Object-store I/O, malformed or foreign durable state, a shared store without conditional update support, or exhaustion of the u64 ID space.

pub async fn sink_open_witness( &self, ) -> Result<Option<CheckpointSinkOpenWitness>, DecisionError>

Read the singleton sink-open owner record.

Errors

Object-store I/O, malformed/non-canonical metadata, or foreign deployment state.

pub async fn create_sink_open_witness( &self, pipeline_identity: PipelineIdentity, participant_id: u64, attempt: CheckpointAttempt, committable_sinks: Vec<String>, ) -> Result<CheckpointSinkOpenWitness, DecisionError>

Create the durable witness before invoking any checkpoint-committable sink begin call.

committable_sinks must already be strictly sorted and unique so duplicate runtime names cannot be silently collapsed into one recovery participant.

Errors

Object-store I/O, invalid input, or any malformed, foreign, or conflicting live witness.

pub async fn clear_sink_open_witness( &self, expected: &CheckpointSinkOpenWitness, ) -> Result<(), DecisionError>

Close exactly the supplied witness after its attempt is terminal or fully rolled back.

Closure durably replaces the open state. The tombstone makes an old conditional write harmless after a successor opens and gives ambiguous responses an exact state to reconcile.

Errors

Object-store I/O or a malformed, foreign, or different live witness.

pub async fn record_outcome( &self, epoch: u64, checkpoint_id: u64, scope: CheckpointScope, assignment_fence: Option<CheckpointAssignmentFence>, leader_proof: Option<LeaderProof>, verdict: CheckpointVerdict, recovery_capsule: Option<RecoveryCapsuleRef>, ) -> Result<RecordOutcomeResult, DecisionError>

Create or read the one local terminal outcome allowed for an epoch.

Identical retries return RecordOutcomeResult::Unchanged. A different checkpoint, authority, assignment, recovery image, or verdict returns the durable winner in RecordOutcomeResult::Conflict; it never overwrites that winner.

Errors

Object-store I/O, malformed/non-canonical metadata, or any cluster-scoped proposal.

pub async fn outcome( &self, epoch: u64, ) -> Result<Option<CheckpointOutcome>, DecisionError>

Load the standalone/local terminal outcome for epoch.

None means unresolved; it is never evidence of abort.

Errors

Object-store I/O or a malformed/conflicting outcome body.

pub async fn outcomes(&self) -> Result<Vec<CheckpointOutcome>, DecisionError>

Load every live standalone/local outcome in ascending epoch order.

Continuity-only GC anchors are audited internally but never returned to callers because their checkpoint artifacts may already have been deleted.

Errors

Object-store I/O, a malformed object name/body, or an inventory that changed during read.

pub async fn highest_terminal_outcome( &self, ) -> Result<Option<CheckpointOutcome>, DecisionError>

Greatest terminal outcome, including the continuity anchor when it is the newest closed epoch retained by the store.

Errors

Object-store I/O or malformed/conflicting outcome inventory.

pub async fn outcome_gc_floor_horizon(&self) -> Result<u64, DecisionError>

Greatest durable outcome GC horizon for the current deployment, or zero before pruning.

Errors

Object-store I/O or malformed/conflicting floor metadata.

pub async fn outcome_retention_boundary( &self, ) -> Result<OutcomeRetentionBoundary, DecisionError>

Read scalar continuity metadata for compacted terminal outcomes.

The returned boundary can fence external cursor rollback, but it cannot be used to recover a checkpoint. Recovery must select a live commit from Self::outcomes.

Errors

Object-store I/O or malformed/conflicting floor metadata.

pub async fn prune_outcomes_before( &self, before: u64, ) -> Result<u64, DecisionError>

Advance the outcome GC floor for epoch < before, then best-effort delete raw tombstoned outcomes.

At least one live commit must remain at or above the effective horizon. The embedded anchors preserve terminal and committed-cursor continuity but are never eligible as recovery cuts. Concurrent higher floors supersede this request and are included in the same best-effort sweep.

Errors

Object-store I/O, malformed/conflicting inventory, or a horizon that would remove the last recoverable commit outcome.

Trait Implementations

impl Debug for CheckpointDecisionStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.