Struct CheckpointDecisionStore 

pub struct CheckpointDecisionStore { /* private fields */ }

Durable checkpoint metadata store.

Implementations

impl CheckpointDecisionStore

pub async fn allocate_checkpoint_id_at_least( &self, minimum: u64, ) -> Result<u64, DecisionError>

Allocate the next globally ordered checkpoint ID at or above minimum.

Shared stores advance exactly one ID with native compare-and-swap. A certified local single writer reserves a durable range in the deployment singleton, consumes it in memory, and burns any unused suffix after restart.

Errors

Object-store I/O, malformed or foreign durable state, a shared store without conditional update support, or exhaustion of the u64 ID space.

impl CheckpointDecisionStore

pub async fn create_committed_checkpoint( &self, index: &CommittedCheckpointIndex, ) -> Result<CommittedCheckpointRef, DecisionError>

Create the canonical content-addressed body for a committed checkpoint index.

Identical retries converge on the existing immutable body. The returned reference is safe to publish only after this method succeeds.

Errors

Object-store I/O, malformed index content, deployment mismatch, or a conflicting body.

pub async fn load_committed_checkpoint( &self, reference: &CommittedCheckpointRef, ) -> Result<CommittedCheckpointIndex, DecisionError>

Load and verify one exact content-addressed committed checkpoint index.

Verification covers the object path, recorded and observed lengths, canonical JSON body, SHA-256 reference, deployment identity, and committed-index invariants.

Errors

Object-store I/O, a missing object, malformed content, or any reference mismatch.

pub async fn seal_aborted_committed_checkpoint_candidate( &self, index: &CommittedCheckpointIndex, ) -> Result<(), DecisionError>

Permanently seal the exact content-addressed candidate for an aborted attempt.

The seal occupies the candidate’s existing path, so an in-flight conditional create can either win and be replaced or lose to the seal. Identical retries converge.

Errors

The candidate is malformed or foreign, the path contains different content, or object-store I/O cannot be reconciled to the exact seal.

pub async fn delete_committed_checkpoint( &self, reference: &CommittedCheckpointRef, ) -> Result<(), DecisionError>

Delete one exact committed index after validating any extant body.

Missing objects and ambiguous deletes that removed the object are successful retries.

Errors

The reference, extant index, deployment identity, or object-store operation is invalid.

impl CheckpointDecisionStore

pub async fn load_or_create_deployment_id( &self, ) -> Result<String, DecisionError>

Load the checkpoint namespace’s create-once deployment incarnation, creating it when the durable store is empty. Concurrent cluster members converge through object-store CAS.

Errors

Object-store I/O or a malformed/conflicting persisted identity.

impl CheckpointDecisionStore

pub async fn begin_checkpoint_artifact_inventory( &self, inventory: CheckpointArtifactInventory, ) -> Result<CheckpointArtifactInventoryUpdateResult, DecisionError>

Durably admit one exact local attempt before any checkpoint artifact is written.

Equal retries converge. A different active attempt or a reused terminal attempt conflicts.

Errors

Object-store I/O or a malformed, cluster, or foreign-deployment inventory.

pub async fn complete_checkpoint_artifact_cleanup( &self, expected: &CheckpointArtifactInventory, ) -> Result<CheckpointArtifactInventoryUpdateResult, DecisionError>

Clear an exact local artifact inventory after its durable Abort paths are sealed.

Errors

Object-store I/O or a malformed, cluster, or foreign-deployment inventory.

pub async fn record_outcome( &self, epoch: u64, checkpoint_id: u64, scope: CheckpointScope, assignment_fence: Option<CheckpointAssignmentFence>, leader_proof: Option<LeaderProof>, verdict: CheckpointVerdict, committed_checkpoint: Option<CommittedCheckpointRef>, ) -> Result<RecordOutcomeResult, DecisionError>

Publish the authoritative local terminal outcome.

The singleton CAS is the decision: a crash before it leaves the attempt unresolved, while a crash after it leaves both the latest terminal and latest Commit directly recoverable. Equal retries converge; stale epochs and conflicting outcomes return the durable winner.

Errors

Object-store I/O, malformed metadata, a forked Commit predecessor, or cluster authority.

pub async fn checkpoint_decision_head( &self, ) -> Result<Option<CheckpointDecisionHead>, DecisionError>

Read the exact authoritative local decision head without listing storage.

Errors

Object-store I/O or malformed/foreign head metadata.

pub async fn latest_terminal_outcome( &self, ) -> Result<Option<CheckpointOutcome>, DecisionError>

Read the latest authoritative local terminal outcome without listing storage.

Errors

Object-store I/O or malformed/foreign head metadata.

pub async fn latest_committed_outcome( &self, ) -> Result<Option<CheckpointOutcome>, DecisionError>

Read the latest authoritative local Commit without listing storage.

Errors

Object-store I/O or malformed/foreign head metadata.

impl CheckpointDecisionStore

pub async fn begin_checkpoint_retention( &self, protected: &CommittedCheckpointRef, ) -> Result<CheckpointRetentionUpdateResult, DecisionError>

Start or resume retention for the authoritative latest local Commit.

Errors

The protected cut is stale, its chain is invalid, or durable metadata cannot be updated.

pub async fn advance_checkpoint_retention( &self, expected: &CheckpointRetentionState, ) -> Result<CheckpointRetentionUpdateResult, DecisionError>

Advance one completed retention phase with an exact compare-and-swap.

Errors

The expected state is idle or invalid, or durable metadata cannot be updated.

pub async fn checkpoint_retention_state( &self, ) -> Result<Option<CheckpointRetentionState>, DecisionError>

Read the exact local retention state without listing storage.

Errors

Object-store I/O or malformed/foreign metadata.

impl CheckpointDecisionStore

pub async fn sink_open_witness( &self, ) -> Result<Option<CheckpointSinkOpenWitness>, DecisionError>

Read the singleton sink-open owner record.

Errors

Object-store I/O, malformed/non-canonical metadata, or foreign deployment state.

pub async fn create_sink_open_witness( &self, pipeline_identity: PipelineIdentity, participant_id: u64, attempt: CheckpointAttempt, committable_sinks: Vec<String>, ) -> Result<CheckpointSinkOpenWitness, DecisionError>

Create the durable witness before invoking any checkpoint-committable sink begin call.

committable_sinks must already be strictly sorted and unique so duplicate runtime names cannot be silently collapsed into one recovery participant.

Errors

Object-store I/O, invalid input, or any malformed, foreign, or conflicting live witness.

pub async fn clear_sink_open_witness( &self, expected: &CheckpointSinkOpenWitness, ) -> Result<(), DecisionError>

Close exactly the supplied witness after its attempt is terminal or fully rolled back.

Closure durably replaces the open state. The tombstone makes an old conditional write harmless after a successor opens and gives ambiguous responses an exact state to reconcile.

Errors

Object-store I/O or a malformed, foreign, or different live witness.

impl CheckpointDecisionStore

pub fn new(store: Arc<dyn ObjectStore>) -> Self

Wrap shared storage that must provide native conditional updates.

pub fn local_filesystem(root: impl AsRef<FsPath>) -> Result<Self, DecisionError>

Open crash-durable checkpoint metadata in a caller-owned local directory. The caller must retain its exclusive namespace lease for the store’s write lifetime.

Errors

Returns an I/O error when the directory cannot be created, synchronized, or opened.

Trait Implementations

impl Debug for CheckpointDecisionStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.