Struct LeaderLeaseStore 

pub struct LeaderLeaseStore { /* private fields */ }

Append-only object-store authority for the cluster leader.

Implementations

impl LeaderLeaseStore

pub async fn cluster_checkpoint_artifacts( &self, ) -> Result<Option<CheckpointArtifactInventory>, ClusterCheckpointAuthorityError>

Read the unresolved cluster checkpoint artifact inventory, if any.

Errors

Fails when the durable authority head is unavailable or invalid.

pub async fn cluster_checkpoint_artifact_admission( &self, ) -> Result<Option<(CheckpointArtifactInventory, LeaderProof)>, ClusterCheckpointAuthorityError>

Read the unresolved cluster checkpoint artifact inventory and its admitting leader term.

The returned proof identifies the term that admitted the inventory; callers must still certify that term against their current assignment before acting on it.

Errors

Fails when the durable authority head is unavailable or invalid.

impl LeaderLeaseStore

pub async fn cluster_attempt_settlement( &self, attempt: CheckpointAttempt, ) -> Result<Option<CheckpointOutcome>, ClusterCheckpointAuthorityError>

Return the exact immutable outcome for attempt, or the first audited terminal outcome known to close that older checkpoint. Compacted continuity anchors are included in the audit.

Errors

Returns an error for a noncanonical attempt identity or an unavailable or invalid durable authority chain.

pub async fn cluster_attempt_status( &self, attempt: CheckpointAttempt, assignment_fence: &CheckpointAssignmentFence, leader_proof: &LeaderProof, ) -> Result<ClusterAttemptStatus, ClusterCheckpointAuthorityError>

Audit the settlement and commit authority of one admitted cluster checkpoint attempt.

Unlike Self::cluster_attempt_settlement, this distinguishes a live pending attempt from an attempt whose admitting leader term has been durably superseded. The distinction is emitted only when the same audited authority head both retains the exact artifact inventory and proves that its admitting leader proof no longer owns the lease.

Errors

Returns an error for malformed identities, an unavailable or invalid authority chain, or an unsettled attempt that does not exactly match the retained artifact inventory.

impl LeaderLeaseStore

pub async fn acquire_subscription_replay_pin( &self, stream_generation: StreamGeneration, epoch: u64, ) -> Result<SubscriptionReplayPinAcquire, ClusterCheckpointAuthorityError>

Acquire one bounded durable replay pin before loading an historical checkpoint.

Errors

Returns an authority error when the identity is non-canonical or the durable replay-pin registry cannot be validated or updated.

pub async fn renew_subscription_replay_pin( &self, pin: &SubscriptionReplayPin, ) -> Result<bool, ClusterCheckpointAuthorityError>

Renew an exact replay pin. false means it expired or was fenced by cleanup.

Errors

Returns an authority error when the durable replay-pin registry cannot be validated or updated.

pub async fn release_subscription_replay_pin( &self, pin: &SubscriptionReplayPin, ) -> Result<(), ClusterCheckpointAuthorityError>

Release an exact replay pin. Expired or already-released pins are idempotent.

Errors

Returns an authority error when the durable replay-pin registry cannot be validated or updated.

pub async fn reserve_subscription_cleanup_floor( &self, proof: &LeaderProof, requested_epoch: u64, ) -> Result<u64, ClusterCheckpointAuthorityError>

Advance cleanup authority without crossing an unexpired replay pin.

Errors

Returns an authority error when the leader proof is invalid or stale, or the durable replay-pin registry cannot be validated or updated.

impl LeaderLeaseStore

pub fn new(store: Arc<dyn ObjectStore>, ttl_ms: i64) -> Self

Create a leader lease authority.

The store must provide linearizable PutMode::Create/Update and GET ETag or version metadata; unsupported conditional updates fail closed.

pub async fn verify_store_contract( &self, timeout: Duration, ) -> Result<(), LeaseError>

Verify the conditional-write contract required by the mutable authority head.

Validation and cleanup each receive the supplied timeout. The probe uses a unique path and cleanup is attempted after every validation outcome.

Errors

Returns an error when the store does not enforce native conditional writes, omits update metadata, times out, or cannot remove the probe.

pub async fn load(&self) -> Result<Option<LeaderLease>, LeaseError>

Load the highest durable sequence.

Errors

Fails closed on object-store I/O or malformed durable state.

pub async fn begin_cluster_checkpoint_artifacts( &self, proof: &LeaderProof, inventory: CheckpointArtifactInventory, ) -> Result<CheckpointArtifactInventory, ClusterCheckpointAuthorityError>

Admit one exact cluster checkpoint attempt before any participant writes artifacts.

An identical retry returns the durable inventory. A later attempt cannot begin until the current attempt commits or its aborted artifacts are cleaned exactly.

Errors

Fails for a stale proof, foreign deployment, malformed inventory, another active attempt, or object-store failure.

pub async fn finish_cluster_checkpoint_artifact_cleanup( &self, proof: &LeaderProof, expected: &CheckpointArtifactInventory, ) -> Result<(), ClusterCheckpointAuthorityError>

Clear one exact retained inventory after its durable Abort artifact paths are sealed.

Errors

Fails for a stale proof, a different active attempt, a missing matching Abort, malformed inventory, or object-store failure.

pub async fn record_cluster_outcome( &self, proof: &LeaderProof, epoch: u64, checkpoint_id: u64, assignment_fence: CheckpointAssignmentFence, verdict: CheckpointVerdict, committed_checkpoint: Option<CommittedCheckpointRef>, ) -> Result<RecordOutcomeResult, ClusterCheckpointAuthorityError>

Admit one cluster terminal outcome through the exact next leader-authority sequence.

Renewals, takeovers, catalog seals, floor advances, and other decisions all contend on the same create-only object. An identical retry converges on the durable winner.

Errors

Fails closed for a stale proof, non-monotonic or conflicting outcome, malformed committed checkpoint index, or object-store failure.

pub async fn record_assignment_drain_decision( &self, proof: &LeaderProof, decision: AssignmentDrainDecision, ) -> Result<RecordAssignmentDrainDecisionResult, ClusterCheckpointAuthorityError>

Admit one assignment-drain settlement through the exact next authority sequence.

Lease renewals, takeovers, checkpoint outcomes, and other decisions contend on that same create-only sequence. An identical retry converges on the durable winner.

Errors

Fails closed for a stale proof, malformed/non-monotonic decision, or storage failure.

pub async fn assignment_drain_decision( &self, target_version: u64, ) -> Result<Option<AssignmentDrainDecision>, ClusterCheckpointAuthorityError>

Read the immutable settlement for one exact target assignment version.

Errors

Fails closed on malformed or incomplete authority history.

pub async fn assignment_recovery_decision( &self, target_version: u64, ) -> Result<Option<AssignmentRecoveryDecision>, ClusterCheckpointAuthorityError>

Read the immutable recovery authorization for one exact target assignment version.

Errors

Fails closed on malformed, incomplete, or cross-kind authority history.

pub async fn assignment_handoff_checkpoint( &self, target: &CheckpointAssignmentFence, ) -> Result<Option<CommittedCheckpointRef>, ClusterCheckpointAuthorityError>

Read the state handoff checkpoint pinned for one exact target assignment.

Errors

Fails when target is invalid or the durable authority head is unavailable.

pub async fn materialize_assignment_recovery( &self, target_version: u64, ) -> Result<RotateOutcome, ClusterCheckpointAuthorityError>

Materialize the immutable authority winner for one recovery target version.

The caller supplies only the version; an arbitrary staged proposal can never bypass the shared leader-decision chain.

Errors

Fails closed when no recovery decision exists, its proposal is invalid, or storage fails.

pub async fn prune_assignment_drain_decisions_before( &self, proof: &LeaderProof, before_target_version: u64, ) -> Result<u64, ClusterCheckpointAuthorityError>

Advance the shared assignment-decision floor through the exact next authority sequence.

The compatibility-shaped API retains both drain and recovery decisions on one ordered chain. The caller must first durably prune assignment snapshots below the same target-version horizon. Decision-bearing authority records below the durable floor then become eligible for best-effort deletion while the exact terminal anchor preserves chain continuity.

Errors

Fails for a stale proof, invalid horizon, corrupt history, or storage failure.

pub async fn cluster_outcome( &self, epoch: u64, ) -> Result<Option<CheckpointOutcome>, ClusterCheckpointAuthorityError>

Read one live cluster outcome from the shared authority.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn create_committed_checkpoint( &self, index: &CommittedCheckpointIndex, ) -> Result<CommittedCheckpointRef, ClusterCheckpointAuthorityError>

Store one immutable committed-checkpoint index before publishing its Commit outcome.

Errors

Fails when the durable authority cannot create the immutable index.

pub async fn load_committed_checkpoint( &self, reference: &CommittedCheckpointRef, ) -> Result<CommittedCheckpointIndex, ClusterCheckpointAuthorityError>

Load one exact content-addressed committed-checkpoint index.

Errors

Fails when the durable authority cannot load or validate the index.

pub async fn cluster_outcome_with_committed_checkpoint( &self, epoch: u64, ) -> Result<Option<(CheckpointOutcome, Option<CommittedCheckpointIndex>)>, ClusterCheckpointAuthorityError>

Read one live cluster outcome together with its committed checkpoint index. Commit always returns a validated index; Abort returns None.

Errors

Fails when the authority history or selected committed index is unavailable or invalid.

pub async fn cluster_outcome_inventory( &self, ) -> Result<ClusterOutcomeInventory, ClusterCheckpointAuthorityError>

Audit and return every live cluster outcome in ascending epoch order.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn cluster_outcomes( &self, ) -> Result<Vec<CheckpointOutcome>, ClusterCheckpointAuthorityError>

Audit and return every live cluster outcome in ascending epoch order.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn highest_cluster_committed_outcome( &self, ) -> Result<Option<CheckpointOutcome>, ClusterCheckpointAuthorityError>

Greatest live cluster commit recovery cut.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn highest_cluster_terminal_outcome( &self, ) -> Result<Option<CheckpointOutcome>, ClusterCheckpointAuthorityError>

Greatest terminal cluster outcome, including the compacted continuity anchor.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn cluster_artifact_cleanup( &self, ) -> Result<Option<ClusterArtifactCleanupCursor>, ClusterCheckpointAuthorityError>

Read the exact cluster checkpoint artifact cleanup position.

The returned cursor was admitted through the shared leader-authority sequence. None means no destructive checkpoint cleanup is currently authorized.

Errors

Fails when the durable authority head is unavailable or invalid.

pub async fn begin_cluster_artifact_cleanup<V, Fut>( &self, proof: &LeaderProof, protected: CommittedCheckpointRef, validate_artifacts: V, ) -> Result<Option<ClusterArtifactCleanupCursor>, ClusterCheckpointAuthorityError>

where V: Fn(CheckpointOutcome) -> Fut + Send + Sync + 'static, Fut: Future<Output = Result<(), String>> + Send + 'static,

Atomically advance the artifact floor and authorize its first expired checkpoint.

protected must name a live cluster Commit. Its exact predecessor becomes the first cleanup target. An already covered horizon or a protected genesis cut returns None. An identical retry returns the active cursor; a different active segment is rejected.

Errors

Fails for a stale proof, invalid committed-index chain, failed protected-artifact validation, concurrent cleanup segment, or object-store failure.

pub async fn mark_cluster_artifact_data_deleted( &self, proof: &LeaderProof, expected: &ClusterArtifactCleanupCursor, ) -> Result<ClusterArtifactCleanupCursor, ClusterCheckpointAuthorityError>

Durably authorize metadata deletion after the exact current data cleanup completes.

Errors

Fails for a stale proof, stale or non-DeleteData cursor, or object-store failure.

pub async fn mark_cluster_artifact_metadata_deleted( &self, proof: &LeaderProof, expected: &ClusterArtifactCleanupCursor, ) -> Result<Option<ClusterArtifactCleanupCursor>, ClusterCheckpointAuthorityError>

Complete metadata deletion and authorize the exact next expired checkpoint, if any.

The transition clears the journal at genesis or immediately before the previously reclaimed stop boundary. Otherwise it loads the immutable next index and records its exact predecessor and participants before any deletion of that target is allowed.

Errors

Fails for a stale proof, stale or non-DeleteMetadata cursor, a broken predecessor chain, or object-store failure.

pub async fn cluster_outcome_retention_boundary( &self, ) -> Result<ClusterOutcomeRetentionBoundary, ClusterCheckpointAuthorityError>

Exact continuity boundary for cluster outcomes compacted from the authority history.

Errors

Fails when the durable authority history is unavailable or invalid.

pub async fn begin_new_term( &self, owner: &LeaderLeaseOwner, now_ms: i64, ) -> Result<LeaseOutcome, LeaseError>

Acquire an empty authority as a new term, or rotate the fencing token when this exact process incarnation already owns the durable head. Rival wall clocks never authorize takeover.

Errors

Fails closed on invalid input, object-store I/O, or arithmetic exhaustion.

pub async fn renew_exact( &self, owner: &LeaderLeaseOwner, token: u64, now_ms: i64, ) -> Result<LeaseOutcome, LeaseError>

Renew only the exact durable authority term identified by token.

Errors

Returns LeaseError::Fenced if the durable head is absent or belongs to another owner or term. Also fails closed on invalid input, object-store I/O, or arithmetic exhaustion.

pub fn observe_rival( &self, owner: &LeaderLeaseOwner, lease: &LeaderLease, ) -> Result<LeaderLeaseObservation, LeaseError>

Start a candidate-local observation of a rival durable liveness identity.

Errors

Rejects malformed state or an observation of the candidate itself.

pub async fn try_takeover( &self, owner: &LeaderLeaseOwner, observation: &LeaderLeaseObservation, now_ms: i64, ) -> Result<LeaseOutcome, LeaseError>

Take over only after the rival’s owner, fencing token, and renewal sequence remained current for a full TTL on the candidate’s monotonic clock.

Errors

Fails closed on early observation, invalid state, I/O, or arithmetic exhaustion.

Trait Implementations

impl Debug for LeaderLeaseStore

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.