Module controller 

Facade over ClusterKv + BarrierCoordinator + membership watch. None on CheckpointCoordinator means single-instance mode.

Structs

ClusterController

Facade composing the cluster-control primitives.

RecoveryAdmissionSnapshot

One coherent recovery-admission view from the shared leader authority. This is evidence, not authority to open intake; callers must revalidate it with the audited leader proof immediately before activation.

RecoveryAnnouncement

Durable announcement for one exact recovery round.

RecoveryFault

One durable fault report covered by a coordinated recovery round.

RecoveryFaultInventory

One atomically observed shared-authority fault inventory.

RecoveryFaultRequest

Opaque process-local identity for one recoverable failure notification.

RecoveryReleaseGuard

Held after this process validates its atomically settled recovery fault and until its local source gate transition is complete. A concurrent fault report cannot cross that transition.

RecoveryRound

Frozen recovery round, assignment certificate, and durable driver term.

RecoveryRoundId

Immutable identity of one coordinated recovery attempt.

RecoveryStoppedReport

Boot-bound phase-one acknowledgement and unresolved prepared-checkpoint inventory.

Enums

CheckpointPrepareObservation

One authority-validated clustered Prepare and its local assignment disposition.

RecoverPhase

Phase of a coordinated recovery round, carried in the control:recover slot.

RecoveryControlError

Classified recovery-control failure. Only Self::Uncertain is retryable.

RecoveryFaultReportOutcome

Durable disposition of one process-local recovery-fault request.

ReleaseCommitStatus

One bounded leader attempt to commit a pending recovery Release.