Struct LeaderLeaseStore 

pub struct LeaderLeaseStore { /* private fields */ }

Append-only object-store authority for the cluster leader.

Implementations

impl LeaderLeaseStore

pub async fn cluster_checkpoint_artifacts( &self, ) -> Result<Option<CheckpointArtifactInventory>, ClusterCheckpointAuthorityError>

Read the unresolved cluster checkpoint artifact inventory, if any.

Errors

Fails when the durable authority head is unavailable or invalid.

pub async fn cluster_checkpoint_artifact_admission( &self, ) -> Result<Option<(CheckpointArtifactInventory, LeaderProof)>, ClusterCheckpointAuthorityError>

Read the unresolved cluster checkpoint artifact inventory and its admitting leader term.

The returned proof identifies the term that admitted the inventory; callers must still certify that term against their current assignment before acting on it.

Errors

Fails when the durable authority head is unavailable or invalid.

impl LeaderLeaseStore

pub async fn publish_assignment_drain( &self, proof: &LeaderProof, assignments: &AssignmentSnapshotStore, proposal: &AssignmentSnapshot, ) -> Result<RotateOutcome, ClusterCheckpointAuthorityError>

Reserve and publish an exact graceful assignment drain through shared authority.

A reservation survives cancellation before snapshot publication. Checkpoint/migration admission sees that reservation; only an exact drain/recovery decision can release it. The supplied store must be the namespace-verified assignment store used by the controller.

Errors

Rejects stale authority, another reserved operation, a changed predecessor, or storage I/O.

pub async fn materialize_reserved_assignment_drain( &self, assignments: &AssignmentSnapshotStore, ) -> Result<Option<RotateOutcome>, ClusterCheckpointAuthorityError>

Materialize an already-admitted drain after cancellation or leader replacement.

This publishes the original fenced intent; it never transfers vnode ownership or reopens intake. A replacement leader settles it through the existing drain/recovery decision path.

Errors

Rejects corrupt/missing proposals or conflicting assignment history.

impl LeaderLeaseStore

pub async fn cluster_attempt_settlement( &self, attempt: CheckpointAttempt, ) -> Result<Option<CheckpointOutcome>, ClusterCheckpointAuthorityError>

Return the exact immutable outcome for attempt, or the first audited terminal outcome known to close that older checkpoint. Compacted continuity anchors are included in the audit.

Errors

Returns an error for a noncanonical attempt identity or an unavailable or invalid durable authority chain.

pub async fn highest_cluster_commit_with_checkpoint( &self, ) -> Result<Option<ClusterCommitHead>, ClusterCheckpointAuthorityError>

Greatest live cluster Commit together with its validated committed checkpoint index and the assignment handoff pin of the same authority record.

The index is loaded through the selected Commit’s own reference. A second lookup by epoch can miss a head that retention retired as soon as a newer Commit landed between the reads. A target Commit clears the handoff pin in the write that moves the head, so a pin read from a later record can describe a newer head than the one returned.

Errors

Returns an error for an unavailable or invalid authority chain, or for a committed index that is missing or mismatched while its Commit is still the head.

pub async fn cluster_attempt_status( &self, attempt: CheckpointAttempt, assignment_fence: &CheckpointAssignmentFence, leader_proof: &LeaderProof, ) -> Result<ClusterAttemptStatus, ClusterCheckpointAuthorityError>

Audit the settlement and commit authority of one admitted cluster checkpoint attempt.

Unlike Self::cluster_attempt_settlement, this distinguishes a live pending attempt from an attempt whose admitting leader term has been durably superseded. The distinction is emitted only when the same audited authority head both retains the exact artifact inventory and proves that its admitting leader proof no longer owns the lease.

Errors

Returns an error for malformed identities, an unavailable or invalid authority chain, or an unsettled attempt that does not exactly match the retained artifact inventory.

impl LeaderLeaseStore

pub async fn acquire_subscription_replay_pin( &self, stream_generation: StreamGeneration, epoch: u64, ) -> Result<SubscriptionReplayPinAcquire, ClusterCheckpointAuthorityError>

Acquire one bounded durable replay pin before loading an historical checkpoint.

Errors

Returns an authority error when the identity is non-canonical or the durable replay-pin registry cannot be validated or updated.

pub async fn renew_subscription_replay_pin( &self, pin: &SubscriptionReplayPin, ) -> Result<bool, ClusterCheckpointAuthorityError>

Renew an exact replay pin. false means it expired or was fenced by cleanup.

Errors

Returns an authority error when the durable replay-pin registry cannot be validated or updated.

pub async fn release_subscription_replay_pin( &self, pin: &SubscriptionReplayPin, ) -> Result<(), ClusterCheckpointAuthorityError>

Release an exact replay pin. Expired or already-released pins are idempotent.

Errors

Returns an authority error when the durable replay-pin registry cannot be validated or updated.

pub async fn reserve_subscription_cleanup_floor( &self, proof: &LeaderProof, requested_epoch: u64, ) -> Result<u64, ClusterCheckpointAuthorityError>

Advance cleanup authority without crossing an unexpired replay pin.

Errors

Returns an authority error when the leader proof is invalid or stale, or the durable replay-pin registry cannot be validated or updated.

impl LeaderLeaseStore

pub async fn topology_catalog_state( &self, ) -> Result<TopologyCatalogState, TopologyError>

Read explicit topology metadata and validate its referenced inventory/deployment.

Missing version metadata means LegacySealed, never an inferred topology version. This method never appends a topology operation or initializes a deployment identity. Existing authority head reconciliation may finish publication of a previously created record.

Errors

Fails closed on malformed, missing or corrupt referenced content or authority.

pub async fn live_topology_commit( &self, ) -> Result<Option<TopologyCommit>, TopologyError>

Commit of the newest migration while it still owns startup, assignment and recovery. None means no committed migration or a settled target: Active with its own committed checkpoint, which then follows ordinary startup, reassignment and recovery.

Errors

Fails closed on malformed or missing referenced evidence or the bounded read deadline.

pub async fn topology_journal_usage( &self, ) -> Result<TopologyJournalUsage, TopologyError>

Retained topology request identities against the fixed journal capacity.

Errors

Fails closed on malformed authority or the bounded read deadline.

pub async fn committed_topology_subscriptions( &self, ) -> Result<Vec<OutputDistributionCertificate>, TopologyError>

Subscription certificates preserved by the newest committed migration. Ordinary startup of a settled target binds these exact generations; deriving them from the changed pipeline identity would silently start new subscription streams.

Errors

Fails closed on malformed or missing referenced evidence or the bounded read deadline.

pub async fn adopt_legacy_topology( &self, proof: &LeaderProof, operation_id: TopologyOperationId, expected_manifest: &CatalogManifestRef, expected_deployment: &str, ) -> Result<TopologyAdoptionOutcome, TopologyError>

Adopt the exact legacy inventory as topology one, preserving all existing authority.

Call only after a coordinated binary upgrade. The new encoding causes older authority readers/writers to fail closed; it does not revoke already-running data-plane actors. Adoption itself never changes the graph, opens gates, or authorizes runtime DDL.

A timeout/cancelled request may have committed. Reread topology_catalog_state and retry the same operation identity/reference. Never infer abort from a lost response.

Errors

Rejects a stale leader proof, changed manifest/deployment, unsealed namespace, malformed artifacts, storage errors, or bounded deadline/CAS exhaustion.

impl LeaderLeaseStore

pub async fn authorize_topology_release( &self, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, input: &TopologyRestoreInput, runtime_id: Uuid, ) -> Result<bool, TopologyError>

Revalidate a published Release against the current full process/assignment roster and fault inventory. Historical Release remains immutable across a harmless leader change.

Errors

Fails closed on damaged authority or the bounded read/process-audit budget.

pub async fn certify_topology_installation( &self, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, input: &TopologyRestoreInput, runtime_id: Uuid, protocol_version: u16, ) -> Result<TopologyAdmissionStatus, TopologyError>

Certify one actual held runtime, through the controller after runtime-owned readiness. A historical restore/retirement receipt is insufficient. Every current owner/evidence process must independently certify protocol five, and identical runtime retries are stable.

Errors

Rejects stale runtime/process/assignment/leader, mixed capability, competing checkpoint, recovery/cleanup or an uncertain 15-second/16-CAS budget. Reread the same operation.

pub async fn certify_topology_recovery_installation( &self, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, input: &TopologyRestoreInput, runtime_id: Uuid, round: &RecoveryRound, epoch: u64, ) -> Result<TopologyAdmissionStatus, TopologyError>

Certify a held replacement runtime under the existing exact stopped/restore round. Before the first topology Release this collects a new full installation roster. An already released topology retains its original roster and requires the recovery readiness terminal.

Errors

Rejects a different target/cut, process term, fault set, round or competing runtime UUID.

pub async fn release_topology_target( &self, proof: &LeaderProof, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, input: &TopologyRestoreInput, ) -> Result<TopologyAdmissionStatus, TopologyError>

Publish Release only for the exact complete current installation roster. This permission does not itself open a local gate or admit a sink epoch. Every local owner must match its receipt and revalidate the current runtime before applying it.

Errors

Rejects incomplete/stale/divergent installation, leader loss, recovery/faults or competing authority. A lost response may have committed Release; retry the same operation/round.

impl LeaderLeaseStore

pub async fn parent_topology_catalog( &self, expected_current: &CatalogManifestRef, ) -> Result<Option<CatalogManifest>, TopologyError>

Load the exact parent catalog of the current committed migration.

Errors

Rejects changed current authority, invalid retained evidence or the bounded deadline.

pub async fn original_topology_catalog( &self, expected_current: &CatalogManifestRef, ) -> Result<Option<CatalogManifest>, TopologyError>

Load the complete original bootstrap after checking the current committed inventory. This is a startup assertion only; it never recreates objects removed by a migration.

Errors

Rejects changed current authority, damaged adoption evidence or the bounded read deadline.

pub async fn retired_topology_names( &self, ) -> Result<BTreeSet<String>, TopologyError>

Read names retired by committed migrations. The existing journal retains at most 64 operations and forbids pruning them. Historical identities remain distinct after recreation.

Errors

Rejects corrupt retained evidence, a changed committed topology or the bounded deadline.

pub async fn retired_topology_generations( &self, ) -> Result<BTreeMap<String, u64>, TopologyError>

Read the latest retired incarnation of each name from the retained committed journal.

Errors

Rejects corrupt retained evidence, changed committed authority or the bounded deadline.

impl LeaderLeaseStore

pub async fn latest_topology_operation_hint( &self, ) -> Result<Option<(TopologyOperationId, u64)>, TopologyError>

Read the latest request identity and its durable progress sequence for an idle worker.

This bounded head observation is only a polling hint. It does not audit referenced blobs or authorize any phase, actor, output or gate change. Workers must read the definitive status and use the existing fenced phase methods before doing work.

Errors

Rejects malformed authority or a read exceeding 15 seconds.

pub async fn topology_operation_status( &self, operation_id: TopologyOperationId, ) -> Result<Option<TopologyAdmissionStatus>, TopologyError>

Read the definitive, payload-bound request status without allocating identities.

Errors

Rejects missing/corrupt referenced evidence or a read that exceeds 15 seconds.

pub async fn admit_topology_plan( &self, proof: &LeaderProof, assignments: &AssignmentSnapshotStore, plan: &TopologyAdmissionPlan, target: &CatalogManifest, ) -> Result<TopologyAdmissionStatus, TopologyError>

Reserve a candidate under current authority. This does not commit or start the graph.

The supplied assignment store must be the configured, namespace-verified store used by the cluster controller. Its normal drain writers must use publish_assignment_drain. Call only after coordinated binary upgrade; cached old actors are not revoked by format 14. Cancellation/lost responses require retry with exactly the same plan and request identity.

Errors

Rejects changed parents, id reuse with different payload, concurrent operations, unresolved checkpoint/recovery/assignment authority, malformed evidence, or bounded contention.

pub async fn abort_topology_plan( &self, proof: &LeaderProof, operation_id: TopologyOperationId, expected_plan: &TopologyPlanRef, ) -> Result<TopologyAdmissionStatus, TopologyError>

Durably abort an exact pre-cut request under current authority. No graph rollback occurs.

Errors

Rejects a stale proof, unknown request, different payload, or bounded contention.

impl LeaderLeaseStore

pub async fn validate_cluster_checkpoint_predecessor( &self, target: &CommittedCheckpointIndex, parent: &CommittedCheckpointIndex, ) -> Result<Option<TopologyMigrationRoot>, ClusterCheckpointAuthorityError>

Validate an exact checkpoint chain edge. A pipeline transition requires the retained, audited topology Commit and participant-complete Release for that exact parent root. Returns its sealed mapping only for that transition; ordinary edges keep strict equality. This is artifact validation, never permission to install actors or open intake.

Errors

Rejects unauthorized identity/inventory changes, corrupt/missing migration evidence and the 15 second read budget. No fingerprint mismatch override is exposed.

impl LeaderLeaseStore

pub async fn commit_topology_target( &self, proof: &LeaderProof, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, input: &TopologyRestoreInput, ) -> Result<TopologyAdmissionStatus, TopologyError>

Atomically change the catalog to the exact restored/retired candidate and pin its root. Every frozen process must have protocol-four preparation evidence and still hold its original process/assignment fence. This decision is irreversible; it never opens intake. Call through the configured controller after runtime-owned terminal observation.

Errors

Rejects stale leader/process/assignment, incomplete capabilities, changed image/root, unresolved checkpoint/recovery/cleanup or 16 CAS attempts within 15 seconds. A cancelled or uncertain write may have committed: query the same operation, never roll back or retry with a new identity. Explicit committed-root reconstruction remains available afterward.

impl LeaderLeaseStore

pub async fn committed_topology_restore_input( &self, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, operation_id: TopologyOperationId, process: LocalProcessAuthorityIdentity, ) -> Result<TopologyRestoreInput, TopologyError>

Authorize private reconstruction of the current committed target before its first checkpoint. The exact immutable migration root is the only authorized parent cut. Replacement leaders and new process boots can reconstruct with the same vnode owner map and stable roster; ownership changes/rescaling remain rejected. This never authorizes actors or intake.

Errors

Rejects an uncommitted/aborted/obsolete target, stale current process/assignment, changed vnode ownership or damaged retained evidence. Reads/rechecks have a total 15 second budget.

impl LeaderLeaseStore

pub async fn topology_checkpoint_operation( &self, proof: &LeaderProof, assignment: &CheckpointAssignmentFence, ) -> Result<Option<TopologyAdmissionStatus>, TopologyError>

Read the reserved old-graph cut owner for checkpoint control, under the exact leader proof. This never validates candidate compatibility or grants target execution.

Errors

Rejects changed authority, assignment evidence, damaged plans, or a bounded read timeout.

pub async fn begin_topology_checkpoint_cut( &self, proof: &LeaderProof, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, operation_id: TopologyOperationId, expected_plan: &TopologyPlanRef, inventory: CheckpointArtifactInventory, ) -> Result<TopologyAdmissionStatus, TopologyError>

Atomically bind a reserved operation to its old-topology attempt and artifact inventory. Sources remain open until this exact barrier reaches capture. No target actor is admitted. The assignment store must be the controller’s configured, namespace-verified store.

Errors

Rejects a stale proof, payload/attempt rebind, changed assignment, unresolved authority, or more than 16 append attempts within 15 seconds. Retry the same binding after ambiguity.

pub async fn complete_topology_checkpoint_cut( &self, proof: &LeaderProof, attempt: CheckpointAttempt, participant: CheckpointParticipant, ) -> Result<TopologyAdmissionStatus, TopologyError>

Record a process’s completed old-cut tail through shared authority. The leader receipt follows globally aggregated external sink settlement; followers report local checkpoint application. The complete frozen roster includes that leader receipt. The runtime caller must hold intake and sink succession and own a live process lease. Receipts prove cut application, not actor retirement, state compatibility or target install.

Errors

Rejects stale authority, an uncommitted/different cut, changed process identity, recovery, or bounded contention. A missing receipt or timeout leaves Quiescing visible.

impl LeaderLeaseStore

pub async fn stage_topology_migration_root( &self, proof: &LeaderProof, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, checkpoint_store: &dyn CheckpointStore, operation_id: TopologyOperationId, expected_plan: &TopologyPlanRef, ) -> Result<TopologyAdmissionStatus, TopologyError>

Pin exact-cut restore requirements for a certified topology candidate. Call through the live controller with its configured authorities and checkpoint reader. No candidate actor, source, output, target catalog Commit or Release is authorized. Identical retries return the retained append, including after a lost response.

Errors

Requires the full certified/current roster, unchanged assignment, current admitting leader and CutPrepared. Rejects unresolved new sources, damaged metadata, aggregate manifests over 16 MiB, roots over 1 MiB or 16 CAS attempts within 15 seconds. Cancellation can leave a successful immutable append; query status or retry the same request identity.

pub async fn stage_topology_migration_root_with_initialization<F, Fut>( &self, proof: &LeaderProof, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, checkpoint_store: &dyn CheckpointStore, operation_id: TopologyOperationId, expected_plan: &TopologyPlanRef, initialize: F, ) -> Result<TopologyAdmissionStatus, TopologyError>

where F: FnOnce(CatalogManifest, ClusterTopologyValidation) -> Fut, Fut: Future<Output = Result<Vec<TopologySourceInitialization>, TopologyError>>,

Stage a root with connector-owned new-source cursors resolved by the DB control path. The callback runs only on the admitting leader after full preparation/assignment checks, only if no sealed source root exists, and at most once in this call. It must not start or consume sources or create sink effects. The first create-only sealed vector wins concurrent attempts; all callers use that vector. Reads before a successful seal grant no boundary. Cancellation after sealing, lost responses and CAS retries never reevaluate that vector. No target Commit, restore or output permit is granted by either the slot or the shared append.

Errors

Requires the same exact certified held cut as downstream-only staging. Rejects damaged or divergent slots, unsupported connector positions, stale authority and exceeded size/deadline bounds. Query the same operation after an ambiguous outcome; never invent another identity.

pub async fn topology_migration_root( &self, operation_id: TopologyOperationId, ) -> Result<Option<TopologyMigrationRoot>, TopologyError>

Read immutable staged requirements for inspection. They grant no restore/output authority.

Errors

Rejects damaged/missing evidence or a read exceeding 15 seconds.

impl LeaderLeaseStore

pub async fn stage_topology_compatibility( &self, descriptor: &ClusterTopologyValidation, ) -> Result<TopologyCompatibilityRef, TopologyError>

Stage the canonical local report without admitting a request or authorizing execution.

Errors

Rejects malformed/oversized evidence, divergent immutable bytes or a 15 second deadline.

pub async fn topology_preparation_input( &self, operation_id: TopologyOperationId, ) -> Result<(TopologyAdmissionStatus, TopologyAdmissionPlan, CatalogManifest, ClusterTopologyValidation), TopologyError>

Read a complete immutable preparation input; participants independently compile its target.

Errors

Rejects unknown requests, legacy protocols, damaged bindings and a 15 second read deadline.

pub async fn certify_topology_participant( &self, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, operation_id: TopologyOperationId, expected_plan: &TopologyPlanRef, identity: LocalProcessAuthorityIdentity, protocol_version: u16, compiled: &ClusterTopologyValidation, ) -> Result<TopologyAdmissionStatus, TopologyError>

Persist one participant’s independently compiled descriptor using the operation’s leader and exact frozen assignment. Call through the local controller after checking live process authority around compilation. A certificate does not authorize restore or target output.

Errors

Rejects divergence, missing capability, stale process/assignment/leader, changed payload, aborted requests, or 16 CAS attempts within 15 seconds. Retry identical evidence on ambiguity.

impl LeaderLeaseStore

pub async fn committed_topology_recovery_input( &self, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, operation_id: TopologyOperationId, process: LocalProcessAuthorityIdentity, ) -> Result<TopologyRecoveryInput, TopologyError>

Select the current target’s greatest committed checkpoint, or its immutable migration root when no target checkpoint has committed. Replacement boots must retain the owner map and stable roster. This permits private reads only, never actors, sink epochs or intake.

Errors

Rejects stale process/assignment/leader, an obsolete target, damaged retained evidence or any newer Commit that cannot be proved to belong to the target. No older-cut fallback is permitted. The complete selection and authority recheck share a 15 second budget.

impl LeaderLeaseStore

pub async fn validate_topology_assignment_proposal( &self, proposal: &CheckpointAssignmentFence, ) -> Result<(), ClusterCheckpointAuthorityError>

Check placement compatibility before fencing processes for an assignment recovery. This is read-only preflight; the shared assignment append rechecks the same constraint. Until a committed target is Active and has committed its own checkpoint, it supports only replacement in the same node slots with its complete vnode map. Afterwards ordinary membership changes and state redistribution apply.

Errors

Rejects uncommitted preparation, changed placement of a live migration, corrupt evidence or a bounded read failure.

impl LeaderLeaseStore

pub async fn topology_restore_input( &self, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, operation_id: TopologyOperationId, process: LocalProcessAuthorityIdentity, ) -> Result<TopologyRestoreInput, TopologyError>

Read exact target restore input for a frozen, currently certified participant. Call through the controller with its configured authorities. This grants only private state preparation and never source start, actor installation, output or intake release.

Errors

Requires CutPrepared, a published root, the admitting leader, complete current process certificates and unchanged assignment. Rejects damaged evidence or a 15 second deadline.

impl LeaderLeaseStore

pub async fn retained_topology_checkpoints( &self, ) -> Result<Vec<CommittedCheckpointRef>, TopologyError>

Return the exact checkpoint roots still pinned by irreversible topology decisions. The operation journal bounds this inventory. These references protect state and replay; they grant neither assignment authority, actor installation nor input Release.

Errors

Rejects missing/corrupt retained evidence, a changed topology/proof or the 15-second budget.

impl LeaderLeaseStore

pub async fn validate_cluster_subscription_certificate( &self, index: &CommittedCheckpointIndex, expected: &OutputDistributionCertificate, actual: &OutputDistributionCertificate, ) -> Result<(), ClusterCheckpointAuthorityError>

Validate one unchanged subscription incarnation against an exact historical checkpoint. A changed pipeline identity requires immutable, participant-complete released roots. All other certificate fields retain strict equality. This grants artifact reads only.

Errors

Rejects foreign deployment/pipeline identities, missing or corrupt transition evidence, changed incarnations/contracts, and the existing 15 second authority read budget.

impl LeaderLeaseStore

pub async fn certify_topology_target_preparation( &self, assignments: &AssignmentSnapshotStore, processes: &ProcessLeaseAuthority, input: &TopologyRestoreInput, protocol_version: u16, ) -> Result<TopologyAdmissionStatus, TopologyError>

Record one participant after it restored the exact private target and observed its old compute/source/sink actors and connector children terminal. The runtime owns that proof; call through its configured controller. This historical observation grants no install, Commit, output or intake release, and does not certify that an image remains resident.

Errors

Rejects missing root/cut, changed requirements, old protocol, stale leader/process/assignment or recovery. The budget is 16 CAS attempts within 15 seconds. A cancelled/uncertain write may have appended: read operation status and retry the same input; never invent a new ID.

impl LeaderLeaseStore

pub fn new(store: Arc<dyn ObjectStore>, ttl_ms: i64) -> Self

Create a leader lease authority.

The store must provide linearizable PutMode::Create/Update and GET ETag or version metadata; unsupported conditional updates fail closed.

pub async fn verify_store_contract( &self, timeout: Duration, ) -> Result<(), LeaseError>

Verify the conditional-write contract required by the mutable authority head.

Validation and cleanup each receive the supplied timeout. The probe uses a unique path and cleanup is attempted after every validation outcome.

Errors

Returns an error when the store does not enforce native conditional writes, omits update metadata, times out, or cannot remove the probe.

pub async fn load(&self) -> Result<Option<LeaderLease>, LeaseError>

Load the highest durable sequence.

Errors

Fails closed on object-store I/O or malformed durable state.

pub async fn begin_cluster_checkpoint_artifacts( &self, proof: &LeaderProof, inventory: CheckpointArtifactInventory, ) -> Result<CheckpointArtifactInventory, ClusterCheckpointAuthorityError>

Admit one exact cluster checkpoint attempt before any participant writes artifacts.

An identical retry returns the durable inventory. A later attempt cannot begin until the current attempt commits or its aborted artifacts are cleaned exactly.

Errors

Fails for a stale proof, foreign deployment, malformed inventory, another active attempt, or object-store failure.

pub async fn finish_cluster_checkpoint_artifact_cleanup( &self, proof: &LeaderProof, expected: &CheckpointArtifactInventory, ) -> Result<(), ClusterCheckpointAuthorityError>

Clear one exact retained inventory after its durable Abort artifact paths are sealed.

Errors

Fails for a stale proof, a different active attempt, a missing matching Abort, malformed inventory, or object-store failure.

pub async fn record_cluster_outcome( &self, proof: &LeaderProof, epoch: u64, checkpoint_id: u64, assignment_fence: CheckpointAssignmentFence, verdict: CheckpointVerdict, committed_checkpoint: Option<CommittedCheckpointRef>, ) -> Result<RecordOutcomeResult, ClusterCheckpointAuthorityError>

Admit one cluster terminal outcome through the exact next leader-authority sequence.

Renewals, takeovers, catalog seals, floor advances, and other decisions all contend on the same create-only object. An identical retry converges on the durable winner.

Errors

Fails closed for a stale proof, non-monotonic or conflicting outcome, malformed committed checkpoint index, or object-store failure.

pub async fn abort_unadmitted_cluster_checkpoint( &self, proof: &LeaderProof, attempt: CheckpointAttempt, assignment_fence: CheckpointAssignmentFence, ) -> Result<RecordOutcomeResult, ClusterCheckpointAuthorityError>

Retire an unused checkpoint reservation only while artifact admission is absent. The same authority append serializes this condition with checkpoint/cut admission. An existing Abort is reusable only if its original append had no admitted artifacts.

Errors

Rejects changed leader proof, admitted artifacts, incompatible terminal outcomes or I/O.

pub async fn record_assignment_drain_decision( &self, proof: &LeaderProof, decision: AssignmentDrainDecision, ) -> Result<RecordAssignmentDrainDecisionResult, ClusterCheckpointAuthorityError>

Admit one assignment-drain settlement through the exact next authority sequence.

Lease renewals, takeovers, checkpoint outcomes, and other decisions contend on that same create-only sequence. An identical retry converges on the durable winner.

Errors

Fails closed for a stale proof, malformed/non-monotonic decision, or storage failure.

pub async fn record_assignment_drain_decision_with_assignments( &self, proof: &LeaderProof, decision: AssignmentDrainDecision, assignments: &AssignmentSnapshotStore, ) -> Result<RecordAssignmentDrainDecisionResult, ClusterCheckpointAuthorityError>

Settle a drain using the cluster’s configured, namespace-verified assignment store. An admitted intent is materialized before its reservation can be cleared.

Errors

Rejects stale authority, conflicting evidence, or failed materialization/decision I/O.

pub async fn assignment_drain_decision( &self, target_version: u64, ) -> Result<Option<AssignmentDrainDecision>, ClusterCheckpointAuthorityError>

Read the immutable settlement for one exact target assignment version.

Errors

Fails closed on malformed or incomplete authority history.

pub async fn assignment_recovery_decision( &self, target_version: u64, ) -> Result<Option<AssignmentRecoveryDecision>, ClusterCheckpointAuthorityError>

Read the immutable recovery authorization for one exact target assignment version.

Errors

Fails closed on malformed, incomplete, or cross-kind authority history.

pub async fn assignment_handoff_checkpoint( &self, target: &CheckpointAssignmentFence, ) -> Result<Option<CommittedCheckpointRef>, ClusterCheckpointAuthorityError>

Read the state handoff checkpoint pinned for one exact target assignment.

Errors

Fails when target is invalid or the durable authority head is unavailable.

pub async fn materialize_assignment_recovery( &self, target_version: u64, ) -> Result<RotateOutcome, ClusterCheckpointAuthorityError>

Materialize the immutable authority winner for one recovery target version.

The caller supplies only the version; an arbitrary staged proposal can never bypass the shared leader-decision chain.

Errors

Fails closed when no recovery decision exists, its proposal is invalid, or storage fails.

pub async fn prune_assignment_drain_decisions_before( &self, proof: &LeaderProof, before_target_version: u64, ) -> Result<u64, ClusterCheckpointAuthorityError>

Advance the shared assignment-decision floor through the exact next authority sequence.

The compatibility-shaped API retains both drain and recovery decisions on one ordered chain. The caller must first durably prune assignment snapshots below the same target-version horizon. Decision-bearing authority records below the durable floor then become eligible for best-effort deletion while the exact terminal anchor preserves chain continuity.

Errors

Fails for a stale proof, invalid horizon, corrupt history, or storage failure.

pub async fn cluster_outcome( &self, epoch: u64, ) -> Result<Option<CheckpointOutcome>, ClusterCheckpointAuthorityError>

Read one live cluster outcome from the shared authority.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn create_committed_checkpoint( &self, index: &CommittedCheckpointIndex, ) -> Result<CommittedCheckpointRef, ClusterCheckpointAuthorityError>

Store one immutable committed-checkpoint index before publishing its Commit outcome.

Errors

Fails when the durable authority cannot create the immutable index.

pub async fn load_committed_checkpoint( &self, reference: &CommittedCheckpointRef, ) -> Result<CommittedCheckpointIndex, ClusterCheckpointAuthorityError>

Load one exact content-addressed committed-checkpoint index.

Errors

Fails when the durable authority cannot load or validate the index.

pub async fn cluster_outcome_with_committed_checkpoint( &self, epoch: u64, ) -> Result<Option<(CheckpointOutcome, Option<CommittedCheckpointIndex>)>, ClusterCheckpointAuthorityError>

Read one live cluster outcome together with its committed checkpoint index. Commit always returns a validated index; Abort returns None.

Errors

Fails when the authority history or selected committed index is unavailable or invalid.

pub async fn cluster_outcome_inventory( &self, ) -> Result<ClusterOutcomeInventory, ClusterCheckpointAuthorityError>

Audit and return every live cluster outcome in ascending epoch order.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn cluster_outcomes( &self, ) -> Result<Vec<CheckpointOutcome>, ClusterCheckpointAuthorityError>

Audit and return every live cluster outcome in ascending epoch order.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn highest_cluster_committed_outcome( &self, ) -> Result<Option<CheckpointOutcome>, ClusterCheckpointAuthorityError>

Greatest live cluster commit recovery cut.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn highest_cluster_terminal_outcome( &self, ) -> Result<Option<CheckpointOutcome>, ClusterCheckpointAuthorityError>

Greatest terminal cluster outcome, including the compacted continuity anchor.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn cluster_artifact_cleanup( &self, ) -> Result<Option<ClusterArtifactCleanupCursor>, ClusterCheckpointAuthorityError>

Read the exact cluster checkpoint artifact cleanup position.

The returned cursor was admitted through the shared leader-authority sequence. None means no destructive checkpoint cleanup is currently authorized.

Errors

Fails when the durable authority head is unavailable or invalid.

pub async fn begin_cluster_artifact_cleanup<V, Fut>( &self, proof: &LeaderProof, protected: CommittedCheckpointRef, validate_artifacts: V, ) -> Result<Option<ClusterArtifactCleanupCursor>, ClusterCheckpointAuthorityError>

where V: Fn(CheckpointOutcome) -> Fut + Send + Sync + 'static, Fut: Future<Output = Result<(), String>> + Send + 'static,

Atomically advance the artifact floor and authorize its first expired checkpoint.

protected must name a live cluster Commit. Its exact predecessor becomes the first cleanup target. An already covered horizon or a protected genesis cut returns None. An identical retry returns the active cursor; a different active segment is rejected.

Errors

Fails for a stale proof, invalid committed-index chain, failed protected-artifact validation, concurrent cleanup segment, or object-store failure.

pub async fn mark_cluster_artifact_data_deleted( &self, proof: &LeaderProof, expected: &ClusterArtifactCleanupCursor, ) -> Result<ClusterArtifactCleanupCursor, ClusterCheckpointAuthorityError>

Durably authorize metadata deletion after the exact current data cleanup completes.

Errors

Fails for a stale proof, stale or non-DeleteData cursor, or object-store failure.

pub async fn mark_cluster_artifact_metadata_deleted( &self, proof: &LeaderProof, expected: &ClusterArtifactCleanupCursor, ) -> Result<Option<ClusterArtifactCleanupCursor>, ClusterCheckpointAuthorityError>

Complete metadata deletion and authorize the exact next expired checkpoint, if any.

The transition clears the journal at genesis or immediately before the previously reclaimed stop boundary. Otherwise it loads the immutable next index and records its exact predecessor and participants before any deletion of that target is allowed.

Errors

Fails for a stale proof, stale or non-DeleteMetadata cursor, a broken predecessor chain, or object-store failure.

pub async fn cluster_outcome_retention_boundary( &self, ) -> Result<ClusterOutcomeRetentionBoundary, ClusterCheckpointAuthorityError>

Exact continuity boundary for cluster outcomes compacted from the authority history.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn begin_new_term( &self, owner: &LeaderLeaseOwner, now_ms: i64, ) -> Result<LeaseOutcome, LeaseError>

Acquire an empty authority as a new term, or rotate the fencing token when this exact process incarnation already owns the durable head. Rival wall clocks never authorize takeover.

Errors

Fails closed on invalid input, object-store I/O, or arithmetic exhaustion.

pub async fn renew_exact( &self, owner: &LeaderLeaseOwner, token: u64, now_ms: i64, ) -> Result<LeaseOutcome, LeaseError>

Renew only the exact durable authority term identified by token.

Errors

Returns LeaseError::Fenced if the durable head is absent or belongs to another owner or term. Also fails closed on invalid input, object-store I/O, or arithmetic exhaustion.

pub fn observe_rival( &self, owner: &LeaderLeaseOwner, lease: &LeaderLease, ) -> Result<LeaderLeaseObservation, LeaseError>

Start a candidate-local observation of a rival durable liveness identity.

Errors

Rejects malformed state or an observation of the candidate itself.

pub async fn try_takeover( &self, owner: &LeaderLeaseOwner, observation: &LeaderLeaseObservation, now_ms: i64, ) -> Result<LeaseOutcome, LeaseError>

Take over only after the rival’s owner, fencing token, and renewal sequence remained current for a full TTL on the candidate’s monotonic clock, or once the rival released its term.

Errors

Fails closed on invalid state, I/O, or arithmetic exhaustion.

Trait Implementations

impl Debug for LeaderLeaseStore

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.