Struct StoreDatabase 

pub struct StoreDatabase { /* private fields */ }

Store operations backed by one owned database.

This capability retains the database as a whole. It never copies out the connection, Store directory, schema configuration, clock, gates, blob declarations, or coordination state that database owns.

Implementations

impl StoreDatabase

pub fn new_device_join_attempt_id(&self) -> DeviceJoinAttemptId

pub async fn begin_device_join( &self, record: DeviceJoinJournalRecord, ) -> Result<DeviceJoinJournalRecord, DeviceJoinJournalError>

pub async fn load_device_join( &self, attempt_id: DeviceJoinAttemptId, role: DeviceJoinRole, ) -> Result<Option<DeviceJoinJournalRecord>, DeviceJoinJournalError>

pub async fn advance_device_join( &self, previous: &DeviceJoinJournalRecord, next: DeviceJoinJournalRecord, ) -> Result<(), DeviceJoinJournalError>

pub async fn device_join_status( &self, attempt_id: DeviceJoinAttemptId, role: DeviceJoinRole, ) -> Result<Option<DeviceJoinStatus>, DeviceJoinJournalError>

pub async fn device_join_actions( &self, ) -> Result<Vec<DeviceJoinAction>, DeviceJoinJournalError>

pub async fn owner_device_joins_awaiting_arrival( &self, ) -> Result<Vec<(DeviceJoinAttemptId, StoreDeviceRegistrationRef)>, DeviceJoinJournalError>

Every owner journal row standing at a published activation, with the registration of the device it activated.

The owner’s half of a join ends here and the row is never advanced past it, so this is the whole set of attempts that could be finished.

pub async fn retire_device_join( &self, attempt_id: DeviceJoinAttemptId, role: DeviceJoinRole, ) -> Result<(), DeviceJoinJournalError>

Drop one attempt’s journal row for one role.

The row is this device’s working notes on an exchange, not a record anything later reads: what the join durably produced is the activation commit and the outcome object it named, both of which live in history and are what every other device verifies the join against.

pub async fn forget_for_test( &self, attempt_id: DeviceJoinAttemptId, role: DeviceJoinRole, ) -> Result<(), DeviceJoinJournalError>

impl StoreDatabase

pub async fn read<F, R, E>(&self, read: F) -> Result<Result<R, E>, DbError>

where F: for<'connection> FnOnce(SqlReadContext<'connection>) -> Result<R, E> + Send + 'static, R: Send + 'static, E: Send + 'static,

pub fn schema_version(&self) -> u32

pub fn assert_owns_payload_directory_for_test(&self, store_dir: &StoreDir)

pub fn sync_routing_hash(&self) -> ObjectHash

pub fn has_synced_tables(&self) -> bool

pub fn blob_transition_root(&self, table_name: &str) -> BlobTransitionRoot

pub fn transfer_limits(&self) -> TransferLimits

pub fn set_transfer_limits(&self, limits: TransferLimits)

Replace the transfer limits for every later upload-drain pass and pin call. A pass already running keeps the limit it admitted under.

pub fn blob_tombstone_grace(&self) -> Duration

pub fn has_scoped_graph(&self) -> bool

pub fn stamp(&self) -> String

pub async fn persist_hlc_high_water(&self) -> Result<(), DbError>

pub fn blob_ref_from_change( &self, change: &RowChange, ) -> Result<Option<BlobRef>, BlobDeclError>

pub fn validate_local_blob_cleanup_changes( &self, old_changes: &[RowChange], new_changes: &[RowChange], ) -> Result<(), BlobDeclError>

pub fn receive_wall_ms(&self) -> u64

pub fn new_store_write_id(&self) -> WriteId

pub async fn get_protocol_state( &self, key: &str, ) -> Result<Option<String>, DbError>

pub async fn set_protocol_state( &self, key: &str, value: &str, ) -> Result<(), DbError>

pub async fn get_cache_budget( &self, namespace: &str, ) -> Result<Option<u64>, DbError>

pub async fn write_status( &self, write_id: &WriteId, ) -> Result<WriteStatus, DbError>

pub async fn store_current_publication( &self, ) -> Result<ObservedStorePublication, DbError>

pub fn notify_write_status(&self, write_id: WriteId, status: WriteStatus)

pub async fn membership_load_permit(&self) -> MembershipLoadPermit

pub async fn membership_mutation_permit(&self) -> MembershipMutationPermit

pub async fn store_creation_permit(&self) -> StoreCreationPermit

pub async fn device_exclusion_permit(&self) -> DeviceExclusionPermit

pub async fn author_own_stream(&self) -> OwnStreamAuthorship

Wait for this device’s turn to author its own next Store commit.

Every path that reads the local position to compose a commit, and every path that publishes a device head, takes this and holds it across the pair. Never taken twice in one call chain: a composer holds it until its candidate is either activated or durably persisted, and a publisher of an already-persisted candidate takes it for that publication alone.

pub async fn blob_upload_drain_permit(&self) -> BlobUploadDrainPermit

Wait for this drain’s exclusive turn over the blob upload queue.

Taken before the queue is read and held for the whole pass, so the entries a drain admits are entries no other drain is already running. Never taken twice in one call chain: an upload attempt performs no second drain.

pub async fn snapshot_publication_permit(&self) -> SnapshotPublicationPermit

pub async fn begin_store_creation_attempt( &self, initialized: StoreCreationAttempt, ) -> Result<StoreCreationAttempt, DbError>

pub async fn load_store_creation_attempt( &self, ) -> Result<Option<StoreCreationAttempt>, DbError>

pub async fn advance_store_creation_attempt( &self, previous: StoreCreationAttempt, next: StoreCreationAttempt, ) -> Result<(), DbError>

pub fn new(database: &Database) -> Self

pub fn arm_test_pause( &self, point: DatabaseTestPoint, ) -> (Arc<Notify>, Arc<Notify>)

pub async fn set_invalid_cache_budget_for_test( &self, namespace: &str, value: &str, ) -> Result<(), DbError>

pub async fn reach_test_point(&self, point: DatabaseTestPoint)

pub async fn required_store_root_hash(&self) -> Result<ObjectHash, DbError>

pub async fn scoped_snapshot_counts_for_test( &self, ) -> Result<(i64, i64, i64), DbError>

pub async fn migrated_scoped_snapshot_facts_for_test( &self, ) -> Result<(i64, i64, String), DbError>

pub async fn generation_zero_replay_baseline_for_test( &self, ) -> Result<RetainedReplayBaseline, DbError>

pub async fn replace_generation_zero_replay_authority_for_test( &self, authority_bytes: Vec<u8>, ) -> Result<(), DbError>

pub async fn circle_bootstrap_coverage_ref( &self, circle_id: CircleId, ) -> Result<Option<CircleBootstrapCoverageRef>, DbError>

pub async fn circle_bootstrap_replay_inputs( &self, ) -> Result<Vec<(StoreBatchCommitRef, VerifiedCircleImage)>, DbError>

pub async fn circle_control_activation_count_for_test( &self, circle_id: CircleId, ) -> Result<i64, DbError>

impl StoreDatabase

pub async fn prepare_acknowledgement_activation( &self, expected: StoreAckRef, candidate: PreparedStoreOperationCommit, ) -> Result<(), DbError>

pub async fn begin_acknowledgement_nonactivation( &self, expected: StoreAckRef, nonactivation: VerifiedCandidateNonactivation, ) -> Result<(), DbError>

pub async fn adopt_acknowledgement_head( &self, expected: StoreAckRef, winner: StoreDeviceHead, winner_prepared: PreparedExactObject, ) -> Result<(), DbError>

pub async fn acknowledgement_cleanup_target( &self, expected: StoreAckRef, ) -> Result<Option<CandidateCleanupObject>, DbError>

pub async fn complete_nonactivating_acknowledgement( &self, expected: StoreAckRef, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn eager_row_blob_refs(&self) -> Result<Vec<RowBlobRef>, DbError>

pub async fn stored_blob_reference_state( &self, stored: StoredBlobRef, ) -> Result<StoredBlobReferenceState, DbError>

pub async fn live_row_blob_refs( &self, table: &str, row_ids: Vec<String>, ) -> Result<Vec<Option<RowBlobRef>>, DbError>

The exact current blob-bearing row version for each of row_ids, in the order given, resolved in one read on the connection. None where an id names no live blob-bearing row.

The list form of row_blob_ref: a host about to show a page of rows resolves the page in one call instead of one per row.

pub async fn row_blob_refs_for_root( &self, root_table: &str, root_id: &str, ) -> Result<Vec<RowBlobRef>, DbError>

pub async fn validate_row_blob_ref( &self, reference: &RowBlobRef, ) -> Result<(), DbError>

pub async fn external_blob_for_row( &self, reference: &RowBlobRef, ) -> Result<Option<ExternalBlob>, DbError>

impl StoreDatabase

pub async fn pending_blob_deletes(&self) -> Result<Vec<OutboxEntry>, DbError>

pub async fn remove_blob_delete( &self, entry: &OutboxEntry, ) -> Result<(), DbError>

pub async fn published_blob_drop_intents( &self, max_seq: u64, ) -> Result<Vec<PublishedBlobDropIntent>, DbError>

pub async fn clear_published_blob_drop_intent( &self, intent: &PublishedBlobDropIntent, ) -> Result<(), DbError>

pub async fn pending_blob_uploads(&self) -> Result<Vec<OutboxEntry>, DbError>

pub async fn mark_blob_upload_prepared( &self, entry: &OutboxEntry, authority: PackageAudience, stored: StoredBlobRef, spool_path: PathBuf, ) -> Result<(), DbError>

pub async fn mark_blob_upload_created( &self, entry: &OutboxEntry, ) -> Result<(), DbError>

pub async fn record_outbox_failure( &self, entry: &OutboxEntry, failure: OutboxFailure, attempted_at: &str, ) -> Result<(), DbError>

pub async fn reset_outbox_backoff(&self) -> Result<(), DbError>

pub async fn make_remote_intent_state( &self, root_table: &str, root_id: &str, ) -> Result<Option<MakeRemoteIntentState>, DbError>

pub async fn make_remote_progress( &self, root_table: &str, root_id: &str, ) -> Result<Option<MakeRemoteProgress>, DbError>

pub async fn finish_cancelled_blob_upload( &self, entry: &OutboxEntry, ) -> Result<bool, DbError>

impl StoreDatabase

pub async fn gated_root_locality( &self, root_table: &str, root_id: &str, ) -> Result<Option<bool>, DbError>

pub async fn begin_make_remote( &self, root_table: &str, root_id: &str, root_label: &str, pin: bool, created_at: String, uploads: Vec<(RowBlobRef, PathBuf)>, ) -> Result<Option<bool>, DbError>

pub async fn begin_make_remote_batch( &self, root_table: &str, pin: bool, created_at: String, roots: Vec<MakeRemoteAdmission>, ) -> Result<(), DbError>

pub async fn cancel_make_remote( &self, root_table: &str, root_id: &str, ) -> Result<(), DbError>

pub async fn finalize_created_blob_upload( &self, entry: &OutboxEntry, stamp: String, routing_encryption: Option<EncryptionService>, ) -> Result<PostUpload, DbError>

Complete a Created upload journal entry without exposing a Remote row that lacks exact object authority. Every blob-bearing row below the same gated root must still match its queued row version and have reached Created. The final transaction then flips the gate, clears external-file ownership, records the pending Store write, and binds the transition intent to that write together. The intent and Created handoffs remain until that Store write activates, so a crash cannot make the upload drain mistake a published object for an orphan.

pub async fn commit_make_local( &self, root_table: &str, root_id: &str, stamp: String, routing_encryption: Option<EncryptionService>, materialized: Vec<MaterializedLocalBlob>, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn mark_candidate_cleanup_absent( &self, object: ExactObjectRef, ) -> Result<(), DbError>

pub async fn blocked_merge_candidate( &self, write_id: WriteId, ) -> Result<Option<BlockedMergeCandidate>, DbError>

pub async fn prepared_merge_abandonment_candidates( &self, write_id: WriteId, ) -> Result<Option<PreparedMergeAbandonmentCandidates>, DbError>

pub async fn author_exclusion_activation_for_candidate( &self, root: StoreRootRef, candidate: StoreBatchCommitRef, author: StoreDeviceRegistrationRef, ) -> Result<Option<AuthorExclusionActivationLocator>, DbError>

pub async fn begin_blocked_merge_candidate_nonactivation( &self, root: StoreRootRef, write_id: WriteId, nonactivation: VerifiedCandidateNonactivation, ) -> Result<(), DbError>

pub async fn begin_prepared_merge_abandonment_nonactivation( &self, root: StoreRootRef, write_id: WriteId, candidate_nonactivation: VerifiedCandidateNonactivation, authority_nonactivation: VerifiedCandidateNonactivation, ) -> Result<(), DbError>

pub async fn merge_abandonment_state( &self, write_id: &WriteId, ) -> Result<MergeAbandonmentState, DbError>

pub async fn resume_winning_merge_candidate( &self, write_id: WriteId, ) -> Result<(), DbError>

pub async fn finish_lost_merge_abandonment( &self, write_id: WriteId, ) -> Result<(), DbError>

pub async fn finish_author_excluded_merge_abandonment( &self, write_id: WriteId, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn merge_candidate_cleanup_pending( &self, write_id: &WriteId, ) -> Result<bool, DbError>

pub async fn merge_candidate_cleanup_targets( &self, write_id: WriteId, ) -> Result<Vec<CandidateCleanupObject>, DbError>

pub async fn finish_retracted_merge_candidate_cleanup( &self, write_id: WriteId, ) -> Result<(), DbError>

pub async fn pending_merge_retraction_cleanups( &self, ) -> Result<Vec<StoreBatchCommitRef>, DbError>

pub async fn merge_retraction_cleanup_verification( &self, root: StoreRootRef, candidate: StoreBatchCommitRef, ) -> Result<TerminalCandidateCleanupVerification, DbError>

pub async fn merge_retraction_cleanup_targets( &self, candidate: StoreBatchCommitRef, ) -> Result<Vec<CandidateCleanupObject>, DbError>

pub async fn confirm_merge_retraction_cleanup_nonactivation( &self, root: StoreRootRef, candidate: StoreBatchCommitRef, verified: VerifiedCandidateNonactivation, ) -> Result<(), DbError>

pub async fn finish_merge_retraction_cleanup( &self, candidate: StoreBatchCommitRef, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn merge_candidate_terminal_verifications( &self, root: StoreRootRef, write_id: WriteId, ) -> Result<Vec<TerminalCandidateCleanupVerification>, DbError>

pub async fn reconcile_merge_candidate_terminal_head( &self, root: StoreRootRef, write_id: WriteId, verified: VerifiedCandidateNonactivation, ) -> Result<(), DbError>

pub async fn adopt_alternate_merge_head( &self, write_id: WriteId, winner: StoreDeviceHead, winner_prepared: PreparedExactObject, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn circle_acknowledgement_publication_inputs( &self, ) -> Result<Vec<CircleAckPublicationInput>, DbError>

pub async fn activated_circle_ack( &self, circle_id: CircleId, device_id: StoreDeviceId, ) -> Result<Option<CircleAckRef>, DbError>

The latest activated Circle acknowledgement device_id published for circle_id, or None if that device has never had an acknowledgement activated. Snapshot stability reads this per access-holding device.

pub async fn active_circle_access_devices( &self, circle_id: CircleId, ) -> Result<BTreeSet<StoreDeviceId>, DbError>

The device ids that currently hold active Circle access to circle_id: every active Store device whose owner is a current member of the Circle’s resolved roster. Snapshot stability requires each of these devices to have published a dominating acknowledgement, so a device that holds access but has never acknowledged keeps the snapshot unstable (fail closed). A Closing/Inactive/conflicted Circle authors no snapshot and returns an empty set.

pub async fn circle_current_roster_members( &self, circle_id: CircleId, ) -> Result<BTreeSet<String>, DbError>

The pubkeys in circle_id’s current resolved roster, or an empty set when the Circle is not in an active local state (so it has no snapshot quorum).

pub async fn activated_circle_acks( &self, circle_id: CircleId, ) -> Result<Vec<CircleAckRef>, DbError>

The latest activated Circle acknowledgement every device that has ever acknowledged circle_id published — one per device, including devices whose owner has since been removed from the roster (rows are never deleted, so a removed recipient’s last acknowledgement persists as the evidence bootstrap reclamation reads to prove that recipient lost authority).

pub async fn latest_published_circle_ack( &self, circle_id: CircleId, ) -> Result<Option<PublishedCircleAck>, DbError>

pub async fn outbound_circle_acks_pending(&self) -> Result<bool, DbError>

pub async fn stage_circle_ack( &self, ack: CircleAck, prepared: PreparedExactObject, ) -> Result<CircleAckRef, DbError>

impl StoreDatabase

pub async fn circle_control_covers_strictly( &self, root: StoreRootRef, circle_id: CircleId, covering: &CircleControlCoord, covered: &CircleControlCoord, ) -> Result<bool, DbError>

Whether one activated Circle control strictly covers another in the retained control lineage — covering is a proper successor of covered. Bootstrap reclamation uses this to prove a removed recipient lost authority under a successor control that supersedes its seed’s control. false when the controls are equal or covering is not retained.

pub async fn circle_epoch_access( &self, root: StoreRootRef, circle_id: CircleId, expected_control: CircleControlCoord, ) -> Result<Option<CircleEpochAccess>, DbError>

pub async fn circle_historical_package_keyring( &self, root: StoreRootRef, circle_id: CircleId, expected_control: CircleControlCoord, expected_key_fingerprint: KeyFingerprint, ) -> Result<Option<String>, DbError>

pub async fn verified_circle_activation_context( &self, root: StoreRootRef, circle_id: CircleId, control: CircleControlCoord, ) -> Result<Option<(VerifiedCircleReference, StoreBatchCommitRef)>, DbError>

pub async fn circle_blob_opening_protection( &self, root: StoreRootRef, circle_id: CircleId, expected_control: CircleControlCoord, expected_key_fingerprint: KeyFingerprint, ) -> Result<BlobSpoolProtection, DbError>

pub async fn verified_circle_activation( &self, root: StoreRootRef, circle_id: CircleId, control: CircleControlCoord, ) -> Result<Option<VerifiedCircleReference>, DbError>

pub async fn circle_restore_head( &self, root: StoreRootRef, circle_id: CircleId, controls: Vec<CircleControlCoord>, ) -> Result<Option<(CircleControlCoord, StoreBatchCommitRef)>, DbError>

pub async fn retained_circle_activation_commit_ref( &self, circle_id: CircleId, control: CircleControlCoord, ) -> Result<Option<StoreBatchCommitRef>, DbError>

pub async fn verified_circle_control_coord_covers( &self, root: StoreRootRef, circle_id: CircleId, covering: CircleControlCoord, covered: CircleControlCoord, ) -> Result<bool, DbError>

pub async fn verified_circle_control_covers( &self, root: StoreRootRef, circle_id: CircleId, current: PreparedCircleControl, prior: CircleControlCoord, ) -> Result<bool, DbError>

impl StoreDatabase

pub async fn insert_circle_operation( &self, journal: CircleOperationJournal, prepared_objects: PreparedCircleObjects, ) -> Result<(), DbError>

pub async fn insert_circle_operation_superseding( &self, journal: CircleOperationJournal, superseded: CircleOperationId, prepared_objects: PreparedCircleObjects, ) -> Result<(), DbError>

Insert the terminal deletion operation, superseding the operation that currently holds the Circle’s single operation slot. A closing Circle keeps a waiting close operation there; the deletion removes it and takes the slot in one transaction, so no window leaves the Circle carrying both a pending close and a pending deletion.

pub async fn circle_operation( &self, operation_id: &CircleOperationId, ) -> Result<Option<CircleOperationJournal>, DbError>

pub async fn circle_operation_step( &self, operation_id: &CircleOperationId, step: &str, ) -> Result<PreparedExactObject, DbError>

pub async fn oldest_pending_circle_operation( &self, ) -> Result<Option<CircleOperationJournal>, DbError>

pub async fn waiting_circle_operations( &self, ) -> Result<Vec<CircleOperationJournal>, DbError>

pub async fn complete_circle_operation_upload_step( &self, operation_id: &CircleOperationId, step: &str, ) -> Result<(), DbError>

Record that one upload step finished: the step’s row, and — for a step carrying an object the candidate owns — that object’s uploaded state.

A step whose object is a shared Circle object rather than a candidate-exclusive one records only its row: no remote_objects record exists for it to mark, which is why the operation’s own commit decides that rather than an absent lookup.

The operation beside it is untouched. Both writes are idempotent, so a retry of a step whose transaction already committed is a no-op rather than a conflict, and the foreign key is what refuses a step for an operation that is no longer there.

pub async fn begin_circle_operation_finalization( &self, journal: CircleOperationJournal, prepared_objects: PreparedCircleObjects, ) -> Result<(), DbError>

Replace a closed operation with its freshly prepared finalization.

This is the one transition that rewrites the prepared operation, so it is also the one that has to retire what it replaces: the superseded operation’s upload rows go, because the finalization reuses their step names for different objects, and its spool files go, because nothing names them once the operation that did is gone.

pub async fn substitute_circle_operation_for_test( &self, journal: CircleOperationJournal, ) -> Result<(), DbError>

Replace one operation’s prepared payload with a substituted one, leaving its phase and upload rows where they are.

Production rewrites prepared only at the close-to-finalization boundary. This is how a test hands the publication and activation paths a durable operation that contradicts what it names, to check that they refuse it rather than trusting the row.

pub async fn block_circle_operation( &self, operation_id: &CircleOperationId, block: CircleOperationBlock, ) -> Result<(), DbError>

pub async fn unblock_circle_operation( &self, operation_id: &CircleOperationId, ) -> Result<(), DbError>

pub async fn activate_circle_operation( &self, journal: CircleOperationJournal, verified: VerifiedCircleActivations, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn circle_operation_discard_candidate( &self, operation_id: &CircleOperationId, ) -> Result<CircleOperationDiscardCandidate, DbError>

The candidate a Circle operation would activate, plus the exact grant named by its durable authority-loss block when one exists.

pub async fn begin_circle_operation_discard( &self, root: StoreRootRef, operation_id: &CircleOperationId, nonactivation: VerifiedCandidateNonactivation, ) -> Result<(), DbError>

Record verified nonactivation and move the journal into discarding in one transaction.

pub async fn circle_operation_discard_terminal_verifications( &self, root: StoreRootRef, operation_id: &CircleOperationId, ) -> Result<Vec<TerminalCandidateCleanupVerification>, DbError>

Return the terminal authorities that require fresh head evidence.

pub async fn reconcile_circle_operation_terminal_head( &self, root: StoreRootRef, operation_id: &CircleOperationId, verified: VerifiedCandidateNonactivation, ) -> Result<(), DbError>

Reconcile an activation head against fresh excluded-author evidence.

pub async fn circle_operation_discard_cleanup_targets( &self, operation_id: &CircleOperationId, ) -> Result<Vec<CandidateCleanupObject>, DbError>

Return candidate-exclusive cloud objects still awaiting cleanup.

pub async fn discarding_circle_operations( &self, ) -> Result<Vec<CircleOperationId>, DbError>

Return every Circle operation durably in the discarding state.

pub async fn finish_circle_operation_discard( &self, operation_id: &CircleOperationId, ) -> Result<(), DbError>

Assert terminal cleanup, remove terminal candidate rows, and clear the journal in one transaction.

impl StoreDatabase

pub async fn get_circle_operations( &self, ) -> Result<Vec<CircleOperationInfo>, DbError>

pub async fn circle_states( &self, identity_pubkey: &str, active_store_members: BTreeSet<String>, ) -> Result<Vec<Circle>, DbError>

Every Circle the local identity can see, with its public derived state. A deleted or conflicted Circle stays visible (as Deleted/ControlConflict) rather than silently disappearing; an inactive Circle the identity holds no access to is Inactive.

pub async fn get_circle_members( &self, circle_id: CircleId, identity_pubkey: &str, store_members: BTreeSet<String>, ) -> Result<Vec<CircleMemberInfo>, DbError>

pub async fn circle_authoring_context( &self, circle_id: CircleId, identity_pubkey: &str, ) -> Result<(CircleAuthoringState, StoreBatchCommitRef), DbError>

pub async fn circle_delete_context( &self, circle_id: CircleId, identity_pubkey: &str, ) -> Result<(CircleAuthoringState, StoreBatchCommitRef), DbError>

The authoring context a terminal deletion signs from, accepting any resolved state whose local device holds owner access — Active or Closing. Unlike circle_authoring_context (Active-only, for commands that publish a new active epoch), deletion supersedes an in-flight close, so it authors equally from a closing control’s frozen epoch.

pub async fn circle_control_conflict_branches( &self, circle_id: CircleId, ) -> Result<Option<Vec<CircleControlCoord>>, DbError>

The retained conflicting branch coordinates for a Circle whose control history forked, in canonical order. None when the Circle has no current state or its control is resolved.

pub async fn circle_is_deleted( &self, circle_id: CircleId, ) -> Result<bool, DbError>

Whether the Circle’s control history has terminated in a deletion.

pub async fn current_circle_control( &self, circle_id: CircleId, ) -> Result<Option<CircleControlCoord>, DbError>

The Circle’s currently activated authoring control, or None when the Circle is not in an active local state. Its retained keyring resolves acknowledgements sealed under rotated-away epochs.

pub async fn closing_circle_controls( &self, ) -> Result<Vec<PreparedCircleControl>, DbError>

pub async fn circle_closing_context( &self, circle_id: CircleId, identity_pubkey: &str, ) -> Result<(CircleAuthoringState, StoreBatchCommitRef), DbError>

pub async fn circle_publication_context( &self, circle_id: CircleId, expected_control: CircleControlCoord, ) -> Result<CircleEpochAccess, DbError>

pub async fn current_circle_partition_control( &self, circle_id: CircleId, ) -> Result<CirclePartitionControl, DbError>

The Circle’s current active control coordinate. A durable write captured under an earlier control publishes under this one, so an epoch close that retired the capture-time control does not strand the write: its rows belong to whichever epoch is live when it publishes. Fails when the Circle is not currently active.

pub async fn circle_publication_rotation_block( &self, circle_id: CircleId, active_store_members: BTreeSet<String>, ) -> Result<Option<CirclePublicationBlocked>, DbError>

Whether publishing new content into circle_id is blocked because the Circle’s resolved roster names Store identities that hold no active membership grant at active_store_members. Derived from the current materialized state, so activating a successor roster without those identities clears it with no stored flag to reset.

pub async fn record_circle_close_exclusions( &self, exclusions: Vec<LocalCircleExclusion>, ) -> Result<(), DbError>

pub async fn get_circles( &self, identity_pubkey: &str, active_store_members: BTreeSet<String>, ) -> Result<Vec<CircleInfo>, DbError>

impl StoreDatabase

pub async fn outbound_circle_snapshot_publication( &self, circle_id: CircleId, ) -> Result<Option<DurableCircleSnapshotPublication>, DbError>

pub async fn latest_local_circle_snapshot( &self, circle_id: CircleId, ) -> Result<Option<PublishedCircleSnapshot>, DbError>

pub async fn stage_circle_snapshot_publication( &self, meta: CircleSnapshotMeta, meta_prepared: PreparedExactObject, image: SnapshotDatabaseImage, image_prepared: PreparedExactObject, blobs: Vec<PreparedSnapshotBlob>, ) -> Result<CircleSnapshotRef, DbError>

pub async fn complete_circle_snapshot_publication( &self, accepted: CircleSnapshotRef, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn latest_local_store_device_registration( &self, ) -> Result<Option<DurableDeviceRegistration>, DbError>

pub async fn export_activated_device_continuation( &self, identity_signer: &UserKeypair, ) -> Result<ActivatedContinuation, DbError>

pub async fn install_activated_device_continuation( &self, continuation: ActivatedContinuation, identity_signer: &UserKeypair, device_signer: &UserKeypair, ack_chain: Vec<(StoreAckRef, StoreAck)>, latest_snapshot: Option<(StoreSnapshotRef, SnapshotMeta)>, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn begin_outbound_store_device_exclusion( &self, operation: DurableStoreDeviceExclusionOperation, ) -> Result<DurableStoreDeviceExclusionOperation, DbError>

pub async fn active_outbound_store_device_exclusion( &self, ) -> Result<Option<DurableStoreDeviceExclusionOperation>, DbError>

pub async fn replace_outbound_store_device_exclusion_candidate( &self, expected: DurableStoreDeviceExclusionOperation, replacement: PreparedStoreOperationCommit, ) -> Result<DurableStoreDeviceExclusionOperation, DbError>

pub fn complete_outbound_store_device_exclusion_activation<'a>( &'a self, expected: DurableStoreDeviceExclusionOperation, ) -> Pin<Box<dyn Future<Output = Result<DurableStoreDeviceExclusionOperation, DbError>> + Send + 'a>>

pub async fn complete_outbound_store_device_exclusion_slot_loss( &self, expected: DurableStoreDeviceExclusionOperation, winner: DurableStoreDeviceExclusionObject, ) -> Result<DurableStoreDeviceExclusionOperation, DbError>

pub async fn begin_outbound_store_device_exclusion_nonactivation( &self, expected: DurableStoreDeviceExclusionOperation, nonactivation: VerifiedCandidateNonactivation, ) -> Result<DurableStoreDeviceExclusionOperation, DbError>

pub async fn begin_outbound_store_device_exclusion_replacement( &self, expected: DurableStoreDeviceExclusionOperation, replacement: PreparedStoreOperationCommit, nonactivation: VerifiedCandidateNonactivation, ) -> Result<DurableStoreDeviceExclusionOperation, DbError>

pub async fn nonactivating_store_device_exclusion_cleanup_targets( &self, expected: DurableStoreDeviceExclusionOperation, ) -> Result<Vec<CandidateCleanupObject>, DbError>

pub async fn complete_store_device_exclusion_replacement_cleanup( &self, expected: DurableStoreDeviceExclusionOperation, ) -> Result<DurableStoreDeviceExclusionOperation, DbError>

pub async fn complete_nonactivating_store_device_exclusion( &self, expected: DurableStoreDeviceExclusionOperation, ) -> Result<DurableStoreDeviceExclusionOperation, DbError>

pub async fn mark_store_device_exclusion_authority_uploaded( &self, operation: DurableStoreDeviceExclusionOperation, ) -> Result<(), DbError>

pub async fn outbound_store_device_exclusion_operations( &self, ) -> Result<Vec<DurableStoreDeviceExclusionOperation>, DbError>

impl StoreDatabase

pub async fn prepare_device_join_challenge_publication( &self, challenge: CrossPrincipalProbeChallenge, ) -> Result<DeviceJoinChallengePublicationRecord, DbError>

pub async fn publish_device_join_challenge( &self, authorization: DeviceJoinChallengePublicationAuthorization, challenge: CrossPrincipalProbeChallenge, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn stage_local_store_device_registration( &self, registration: ExactProtocolObject<StoreDeviceRegistration>, initial_ack_ref: StoreAckRef, initial_ack: ExactProtocolObject<StoreAck>, ) -> Result<(), DbError>

pub async fn stage_activated_local_store_device_registration( &self, registration: ExactProtocolObject<StoreDeviceRegistration>, initial_ack_ref: StoreAckRef, initial_ack: ExactProtocolObject<StoreAck>, authority: StoreDeviceRegistrationActivation, ) -> Result<(), DbError>

pub async fn install_existing_local_founder_device( &self, registration: ExactProtocolObject<StoreDeviceRegistration>, initial_ack_ref: StoreAckRef, initial_ack: ExactProtocolObject<StoreAck>, ) -> Result<(), DbError>

pub async fn stage_owner_recovery_registration( &self, registration: ExactProtocolObject<StoreDeviceRegistration>, initial_ack_ref: StoreAckRef, initial_ack: ExactProtocolObject<StoreAck>, activation: StoreDeviceRegistrationActivation, ) -> Result<bool, DbError>

pub async fn oldest_unpublished_store_device_registration( &self, ) -> Result<Option<DurableDeviceRegistration>, DbError>

pub async fn read_local_store_device_registration( &self, sql: &'static str, ) -> Result<Option<DurableDeviceRegistration>, DbError>

pub async fn mark_local_store_device_registration_published( &self, registration: ExactProtocolObject<StoreDeviceRegistration>, initial_ack_ref: StoreAckRef, initial_ack_object: ExactProtocolObject<StoreAck>, ) -> Result<(), DbError>

pub async fn mark_local_store_device_ack_published( &self, registration: ExactProtocolObject<StoreDeviceRegistration>, initial_ack_ref: StoreAckRef, initial_ack_object: ExactProtocolObject<StoreAck>, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn resume_local_device_streams( &self, latest_ack: (StoreAckRef, StoreAck), latest_snapshot: Option<(StoreSnapshotRef, SnapshotMeta)>, ) -> Result<(), DbError>

Record where the local device’s published streams stand on the provider: the acknowledgement head the pulled history activated for it and the snapshot its stream ends on. A restore that adopts a registration the device registered in an earlier life finds the registration’s own first slots already written, so its streams resume from these heads rather than restarting there.

The acknowledgement only ever advances the recorded head; the snapshot is recorded when the local stream is empty and must match when it is not.

impl StoreDatabase

pub fn invert_changeset(changeset: &[u8]) -> Result<Vec<u8>, DbError>

pub fn validate_store_write_routing( &self, routing_encryption: Option<&EncryptionService>, ) -> Result<(), DbError>

pub async fn prepare_store_write( &self, ) -> Result<Option<PreparedStoreWrite>, DbError>

impl StoreDatabase

pub async fn apply_received_merge_materialization( &self, materialization: PreparedMergeMaterialization, retractions: Vec<VerifiedCandidateNonactivation>, local_store_membership: LocalStoreMembership, routing_key: Option<RowRoutingKey>, receiver_wall_ms: u64, ) -> Result<MaterializationOutcome, DbError>

pub async fn materialize_published_store_operation( &self, root: StoreRootRef, verified_commit: VerifiedStoreBatchCommit, registrations: Vec<ActivatedStoreDeviceRegistration>, device_operations: VerifiedStoreDeviceOperations, circle_activations: VerifiedCircleActivations, activation_head: StoreDeviceHead, activation_head_object: ExactObjectRef, history_evidence: RetainedMergeCommitEvidence, membership_objects: Option<VerifiedMergeMembershipObjects>, operation_object_ids: Option<Vec<ObjectHash>>, membership_completion: Option<StoreMembershipJournalCompletion>, ) -> Result<(), DbError>

pub async fn materialize_device_join_activation( &self, root: StoreRootRef, verified_commit: VerifiedStoreBatchCommit, registrations: Vec<ActivatedStoreDeviceRegistration>, device_operations: VerifiedStoreDeviceOperations, activation_head: StoreDeviceHead, activation_head_object: ExactObjectRef, history_evidence: RetainedMergeCommitEvidence, ) -> Result<(), DbError>

pub async fn unrepresented_device_join_bootstrap_commits( &self, plan: DeviceJoinBootstrapPlan, ) -> Result<(DeviceJoinBootstrapPlan, Vec<StoreBatchCommitRef>), DbError>

The plan commits whose rows this database does not already materialize. The joining device resolves row data for exactly these before installing.

pub async fn install_device_join_bootstrap( &self, root: StoreRootRef, resolved: ResolvedDeviceJoinBootstrap, ) -> Result<(), DbError>

pub async fn complete_owner_recovery( &self, verified_commit: VerifiedStoreBatchCommit, activation_head: StoreDeviceHead, activation_head_object: ExactObjectRef, history_evidence: RetainedMergeCommitEvidence, registration: ActivatedStoreDeviceRegistration, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn materialized_frontier( &self, ) -> Result<BTreeMap<String, StoreBatchCommitRef>, DbError>

pub async fn retained_merge_replay_inputs( &self, root: StoreRootRef, ) -> Result<Vec<OwnedVerifiedMergeMaterialization>, DbError>

pub async fn retained_merge_materialization_refs( &self, ) -> Result<Vec<StoreBatchCommitRef>, DbError>

pub async fn retained_merge_materialization( &self, root: StoreRootRef, reference: StoreBatchCommitRef, ) -> Result<OwnedVerifiedMergeMaterialization, DbError>

pub async fn retained_merge_history_frontier( &self, root: StoreRootRef, references: Vec<StoreBatchCommitRef>, ) -> Result<Vec<RetainedMergeHistoryCheckpoint>, DbError>

pub async fn exact_materialized_ref( &self, stream_id: &str, sequence: u64, ) -> Result<Option<StoreBatchCommitRef>, DbError>

pub async fn snapshot_coverage_frontier( &self, ) -> Result<CommitFrontier, DbError>

pub async fn installed_replay_baseline( &self, ) -> Result<InstalledReplayBaseline, DbError>

The baseline a history walk stops at, with the device states it keeps for the covered positions commits above it still name.

pub async fn snapshot_announcement_frontier( &self, ) -> Result<BTreeMap<AuthorStreamId, RetainedAcceptedStoreAnnouncement>, DbError>

pub async fn store_device_state_for_order( &self, order: &StoreCommitOrder, ) -> Result<(StoreDeviceStateRef, ResolvedStoreDeviceState), DbError>

pub async fn store_device_state_for_history_cut( &self, cut: &StoreHistoryCut, ) -> Result<(StoreDeviceStateRef, ResolvedStoreDeviceState), DbError>

pub async fn resolved_store_device_state( &self, reference: &StoreDeviceStateRef, ) -> Result<ResolvedStoreDeviceState, DbError>

pub async fn store_device_exclusion_freezes( &self, ) -> Result<Vec<StoreDeviceProposalAck>, DbError>

pub async fn activated_store_device_registration_records( &self, ) -> Result<Vec<ReferencedStoreDeviceRegistration>, DbError>

pub async fn activated_store_device_registration( &self, reference: StoreDeviceRegistrationRef, ) -> Result<ReferencedStoreDeviceRegistration, DbError>

pub async fn local_activated_registration_ref( &self, ) -> Result<Option<StoreDeviceRegistrationRef>, DbError>

The exact registration this device is activated under, or None before it has one. This is the identity a signed artifact names when it names a device, so it is what a role check compares against.

pub async fn local_blob_write_authority( &self, ) -> Result<ReferencedStoreDeviceRegistration, DbError>

pub async fn activated_store_device_registration_with_authority( &self, root: &StoreRootRef, reference: StoreDeviceRegistrationRef, ) -> Result<ActivatedStoreDeviceRegistration, DbError>

pub async fn activated_store_device_registration_for_device( &self, device_id: StoreDeviceId, ) -> Result<Option<ActivatedStoreDeviceRegistration>, DbError>

pub async fn activated_store_device_registrations( &self, ) -> Result<Vec<StoreDeviceRegistration>, DbError>

impl StoreDatabase

pub async fn outbound_membership_mutation( &self, ) -> Result<Option<DurableMembershipMutation>, DbError>

pub async fn select_membership_author_stream( &self, author_pubkey: &str, author_owner_grant: &MembershipGrantId, reusable: BTreeSet<AuthorStreamId>, ) -> Result<AuthorStreamId, DbError>

pub async fn select_causal_author_stream( &self, key: String, reusable: BTreeSet<AuthorStreamId>, ) -> Result<AuthorStreamId, DbError>

pub async fn stage_membership_mutation( &self, plan_bytes: Vec<u8>, progress_bytes: Vec<u8>, pending_rotation_generation: Option<u64>, ) -> Result<ObjectHash, DbError>

pub async fn stage_membership_candidate_mutation( &self, plan_bytes: Vec<u8>, progress_bytes: Vec<u8>, remote_objects: Vec<ClosedRemoteObject>, pending_rotation_generation: Option<u64>, ) -> Result<ObjectHash, DbError>

pub async fn update_membership_mutation_progress( &self, intent_hash: ObjectHash, progress_bytes: Vec<u8>, ) -> Result<(), DbError>

pub async fn adopt_merge_membership_candidate_head( &self, intent_hash: ObjectHash, plan_bytes: Vec<u8>, previous: RemoteObjectRecord, replacement: ClosedRemoteObject, rotation_generation: Option<u64>, ) -> Result<ObjectHash, DbError>

pub async fn begin_membership_candidate_nonactivation( &self, intent_hash: ObjectHash, candidate: StoreBatchCommitRef, candidate_objects: Vec<ExactObjectRef>, retained_authorities: Vec<ExactObjectRef>, progress_bytes: Vec<u8>, nonactivation: VerifiedCandidateNonactivation, ) -> Result<Vec<CandidateCleanupObject>, DbError>

pub async fn complete_nonactivating_membership_candidate_mutation( &self, intent_hash: ObjectHash, candidate: StoreBatchCommitRef, candidate_objects: Vec<ExactObjectRef>, retained_authorities: Vec<ExactObjectRef>, rotation_generation: Option<u64>, ) -> Result<(), DbError>

pub async fn membership_candidate_cleanup_targets( &self, intent_hash: ObjectHash, candidate: StoreBatchCommitRef, objects: Vec<ExactObjectRef>, ) -> Result<Vec<CandidateCleanupObject>, DbError>

pub async fn record_direct_revoke_activation( &self, intent_hash: ObjectHash, progress_bytes: Vec<u8>, generation: u64, ) -> Result<(), DbError>

pub async fn complete_membership_mutation( &self, intent_hash: ObjectHash, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn load_rotation_gate(&self) -> Result<Option<RotationGate>, DbError>

pub async fn record_peer_rotation( &self, generation: u64, ) -> Result<RotationGate, DbError>

pub async fn complete_peer_rotation_adoption( &self, adopted_generation: u64, ) -> Result<Option<RotationGate>, DbError>

pub async fn complete_local_rotation_adoption( &self, intent_hash: ObjectHash, generation: u64, ) -> Result<Option<RotationGate>, DbError>

impl StoreDatabase

pub async fn load_owner_promotion_journal( &self, promotion_id: OwnerPromotionId, ) -> Result<Option<OwnerPromotionJournal>, DbError>

pub async fn load_owner_promotion_target( &self, key: String, ) -> Result<Option<OwnerPromotionJournal>, DbError>

pub async fn begin_owner_promotion_journal( &self, target_key: String, journal: OwnerPromotionJournal, ) -> Result<OwnerPromotionJournal, DbError>

pub async fn begin_owner_promotion_acceptance_journal( &self, journal: OwnerPromotionJournal, ) -> Result<OwnerPromotionJournal, DbError>

pub async fn advance_owner_promotion_journal( &self, transition: OwnerPromotionJournalTransition, ) -> Result<(), DbError>

pub async fn end_nonactivated_owner_promotion_candidate( &self, transition: OwnerPromotionJournalTransition, candidate: StoreBatchCommitRef, objects: Vec<ExactObjectRef>, nonactivation: VerifiedCandidateNonactivation, ) -> Result<Vec<CandidateCleanupObject>, DbError>

End a promotion whose Store candidate lost its stream position: record the nonactivation against every object that candidate published and advance the journal onto its stale successor in one transaction, returning the objects to delete. The candidate publishes its membership entry and head before the Store head that decides the position, so those sit in create-once slots the promoter’s next attempt composes into; leaving them there would refuse every later membership publication on that stream.

pub async fn owner_promotion_candidate_cleanup_targets( &self, candidate: StoreBatchCommitRef, objects: Vec<ExactObjectRef>, ) -> Result<Vec<CandidateCleanupObject>, DbError>

The published objects of a promotion candidate that already lost, still awaiting deletion. An interrupted cleanup resumes through this: the stale journal names the candidate, and each object’s durable state says whether it is still there.

pub async fn replace_failed_owner_promotion_journal( &self, previous: OwnerPromotionJournal, replacement: OwnerPromotionJournal, ) -> Result<OwnerPromotionJournal, DbError>

impl StoreDatabase

pub async fn stage_owner_recovery_publication( &self, publication: OwnerRecoveryPublication, ) -> Result<OwnerRecoveryPublication, DbError>

pub async fn owner_recovery_publication( &self, ) -> Result<Option<OwnerRecoveryPublication>, DbError>

impl StoreDatabase

pub async fn owed_payload_cleanup(&self) -> Result<Vec<ObjectHash>, DbError>

The payloads still owed a deletion. Empty once every obligation this store committed has been discharged.

pub async fn store_write_payload_claims_for_test( &self, write_id: &WriteId, ) -> Result<Vec<ObjectHash>, DbError>

pub async fn circle_operation_payload_claims_for_test( &self, operation_id: &CircleOperationId, ) -> Result<Vec<ObjectHash>, DbError>

pub async fn retained_replay_payload_claims_for_test( &self, ) -> Result<Vec<ObjectHash>, DbError>

pub async fn outbound_store_snapshot_payload_claims_for_test( &self, ) -> Result<Vec<ObjectHash>, DbError>

pub async fn install_payload_for_test( &self, bytes: Vec<u8>, ) -> Result<ObjectHash, DbError>

pub async fn payload_for_test( &self, hash: ObjectHash, ) -> Result<Vec<u8>, DbError>

pub async fn has_payload_for_test( &self, hash: ObjectHash, ) -> Result<bool, DbError>

pub async fn corrupt_payload_for_test( &self, hash: ObjectHash, bytes: Vec<u8>, ) -> Result<(), DbError>

pub async fn remove_payload_bytes_for_test( &self, hash: ObjectHash, ) -> Result<(), DbError>

pub async fn replace_replay_baseline_device_state_for_test( &self, reference: StoreBatchCommitRef, state: Option<ResolvedStoreDeviceState>, ) -> Result<(), DbError>

pub async fn downgrade_replay_baseline_coven_schema_to_v0_for_test( &self, include_routing: bool, ) -> Result<ObjectHash, DbError>

impl StoreDatabase

pub async fn oldest_prepared_store_write( &self, ) -> Result<Option<PreparedStoreWriteCommit>, DbError>

pub async fn local_commit_base( &self, stream_id: AuthorStreamId, ) -> Result<LocalCommitBase, DbError>

The local device’s own latest position and the materialized frontier that position belongs to, read as one state of the ledger.

A commit order names one history, and both halves of it come from the same table. Reading them separately lets one of this device’s own activations land in between, which leaves its own stream in the frontier one commit ahead of the position it extends. Such an order has no predecessor cut at all — the cut is the frontier with the predecessor inserted, and those two then contradict each other on the author’s own stream — so every operation composed from it is refused. The device driving an operation also runs its sync loop, so that is the ordinary case rather than a hostile one.

Taking this device’s turn to author its own stream is part of the read: the position returned stays this device’s next position for as long as the returned LocalCommitBase is held.

pub async fn latest_local_store_position( &self, stream_id: AuthorStreamId, ) -> Result<Option<StoreBatchCommitRef>, DbError>

impl StoreDatabase

pub async fn table_schema_for_apply(&self) -> Result<TableSchema, DbError>

pub async fn prepare_store_write_commit( &self, stage: StoreWritePreparation, ) -> Result<(), DbError>

pub async fn prepare_merge_candidate_abandonment( &self, stage: MergeCandidateAbandonmentPreparation, ) -> Result<(), DbError>

pub async fn enqueue_store_changeset_for_test( &self, changeset: Vec<u8>, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn prepared_remote_objects( &self, write_id: &WriteId, ) -> Result<Vec<PreparedRemoteObject>, DbError>

pub async fn mark_remote_object_uploaded( &self, expected: RemoteObjectRecord, ) -> Result<RemoteObjectRecord, DbError>

pub async fn retire_uploaded_blob_spools(&self) -> Result<(), DbError>

pub async fn mark_reusable_retained_authority_uploaded( &self, expected: RemoteObjectRecord, ) -> Result<RemoteObjectRecord, DbError>

pub async fn mark_candidate_commit_uploaded( &self, commit: StoreBatchCommitRef, ) -> Result<(), DbError>

pub async fn mark_store_head_uploaded( &self, head: StoreDeviceHeadRef, ) -> Result<(), DbError>

pub async fn prepared_audience_objects( &self, write_id: &WriteId, ) -> Result<PreparedAudienceObjects, DbError>

pub async fn protocol_inert_object( &self, object: ExactObjectRef, ) -> Result<Option<ProtocolInertObject>, DbError>

impl StoreDatabase

pub async fn complete_prepared_store_write( &self, root: StoreRootRef, accepted: StoreBatchCommitRef, nonactivations: Vec<VerifiedCandidateNonactivation>, routing_key: Option<RowRoutingKey>, ) -> Result<CompletePreparedStoreWriteOutcome, DbError>

pub async fn mark_merge_candidate_conflict( &self, write_id: WriteId, nonactivations: Vec<VerifiedCandidateNonactivation>, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn replay_baseline_would_advance( &self, cut: CommitFrontier, ) -> Result<bool, DbError>

Whether adopting cut would move the retained replay baseline or fold a settled write-journal prefix into it.

pub async fn begin_store_reclaim_operation( &self, operation: DurableStoreReclaimOperation, ) -> Result<DurableStoreReclaimOperation, DbError>

pub async fn advance_snapshot_replay_baseline( &self, root: StoreRootRef, proof: VerifiedReplayBaselineRetirementProof, routing_encryption: Option<EncryptionService>, ) -> Result<Option<AdvancedReplayBaseline>, DbError>

Adopt a snapshot admitted for replay retirement and retire the retained history it supersedes.

Ok(None) means the snapshot does not advance this device’s cut, which is the ordinary result once a device has caught up to the newest acknowledged snapshot.

pub async fn store_package_is_retained_for_replay( &self, root: StoreRootRef, target: StorePackageRef, activation: StoreBatchCommitRef, ) -> Result<bool, DbError>

pub async fn circle_package_is_retained_for_replay( &self, root: StoreRootRef, target: CirclePackageRef, activation: StoreBatchCommitRef, ) -> Result<bool, DbError>

pub async fn circle_bootstrap_image_is_retained_for_replay( &self, coverage: CircleBootstrapCoverageRef, ) -> Result<bool, DbError>

Whether a Circle bootstrap image is still the local device’s live seed for its Circle: the circle_bootstrap_coverage row names the same image. Such a bootstrap is a retained replay input and is never eligible for reclamation — the per-Circle analogue of the package retained-replay guard, re-checked before deletion so a seed installed since authoring fails the delete loud.

pub async fn circle_image_is_retained_for_replay( &self, circle_id: CircleId, image: SnapshotImageRef, ) -> Result<bool, DbError>

Whether the local device’s live Circle projection was seeded from this exact image. One circle_bootstrap_coverage row per Circle names whichever image the projection came from — a recipient bootstrap installed on pull or a standalone snapshot installed on restore — so both kinds of image answer the same question against the same row.

pub async fn stored_blob_reclaim_candidates( &self, ) -> Result<Vec<(StoredBlobRef, Vec<StoreBatchCommitRef>)>, DbError>

Every stored row blob this device has an ownership record for, paired with the activated Store commits whose package bindings published it. blob_locators is the stored-blob subset of remote_objects, so it is the exact candidate set without scanning every remote object.

pub async fn stored_blob_is_row_orphaned( &self, stored: StoredBlobRef, ) -> Result<bool, DbError>

Whether no live row in this device’s materialized state binds the blob as a remote reference — the same predicate the member-signed tombstone path applies before deleting a blob body. An unresolved reference is not an answer: it means a row’s locality cannot be decided yet, so it fails rather than counting as an orphan.

pub async fn audience_blob_is_retained_for_replay( &self, stored: StoredBlobRef, ) -> Result<bool, DbError>

Whether an installable image still pins this row blob.

A snapshot or bootstrap image lists the exact blobs a device installing from it must be able to read. Those blobs outlive the rows that published them: a device restoring from an image reads its listed blobs before it has any rows at all, so “no live row binds this blob” does not mean the blob is free. A blob a retained image lists is never eligible, whatever its rows say. Re-checked before deletion, so an image published since the authorization was signed fails the delete loud rather than removing a blob a restore now needs.

pub async fn package_is_retained_by_pending_blob_reclaim( &self, package: ExactObjectRef, ) -> Result<bool, DbError>

Whether a pending audience-blob reclaim still names this package as the one that published its blob. See the session method.

pub async fn store_reclaim_operations( &self, ) -> Result<Vec<DurableStoreReclaimOperation>, DbError>

Every operation the reclaim journal holds, stuck ones included. An existing operation for a target is what blocks re-authorizing it, and a stuck operation blocks it exactly as a running one does.

pub async fn runnable_store_reclaim_operations( &self, ) -> Result<Vec<DurableStoreReclaimOperation>, DbError>

The operations a cycle may still run: everything the journal holds except the ones waiting on a person.

pub async fn stuck_reclaim_operations( &self, ) -> Result<Vec<StuckReclaimOperation>, DbError>

The operations that failed with an error retrying cannot change, with the target and message the host shows.

pub async fn mark_store_reclaim_operation_stuck( &self, operation_id: ObjectHash, error: String, ) -> Result<(), DbError>

Mark one operation stuck, so every later cycle skips it until the host asks for it again.

pub async fn retry_stuck_reclaim_operation( &self, operation_id: ObjectHash, ) -> Result<(), DbError>

Clear one operation’s stuck mark so the next cycle runs it again. Refused when the operation is not stuck.

pub async fn begin_store_reclaim_receipt( &self, expected: DurableStoreReclaimOperation, object: DurableStoreReclaimObject, candidate: PreparedStoreOperationCommit, ) -> Result<DurableStoreReclaimOperation, DbError>

pub async fn mark_store_reclaim_target_absent( &self, expected: DurableStoreReclaimOperation, target: ReclaimTarget, ) -> Result<DurableStoreReclaimOperation, DbError>

pub async fn replace_store_reclaim_candidate( &self, expected: DurableStoreReclaimOperation, replacement: PreparedStoreOperationCommit, ) -> Result<DurableStoreReclaimOperation, DbError>

pub async fn begin_store_reclaim_candidate_replacement( &self, expected: DurableStoreReclaimOperation, replacement: PreparedStoreOperationCommit, nonactivation: VerifiedCandidateNonactivation, ) -> Result<DurableStoreReclaimOperation, DbError>

pub async fn store_reclaim_replacement_cleanup_targets( &self, expected: DurableStoreReclaimOperation, ) -> Result<Vec<CandidateCleanupObject>, DbError>

pub async fn complete_store_reclaim_candidate_replacement( &self, expected: DurableStoreReclaimOperation, ) -> Result<DurableStoreReclaimOperation, DbError>

pub async fn stored_blob_has_snapshot_owner_for_test( &self, stored: StoredBlobRef, ) -> Result<bool, DbError>

Whether a published snapshot generation lists this blob in its image, read straight off the ownership record.

pub async fn stored_blob_reclaim_candidates_for_test( &self, ) -> Result<Vec<(StoredBlobRef, Vec<StoreBatchCommitRef>)>, DbError>

impl StoreDatabase

pub async fn prepare_circle_restore_selection( &self, root: StoreRootRef, ) -> Result<CircleRestoreSelectionIndex, DbError>

pub async fn retained_merge_materialization_by_ref( &self, root: StoreRootRef, reference: StoreBatchCommitRef, ) -> Result<OwnedVerifiedMergeMaterialization, DbError>

pub async fn circle_replay_epoch_index( &self, root: StoreRootRef, ) -> Result<CircleReplayEpochIndex, DbError>

impl StoreDatabase

pub async fn capture_store_snapshot_cut( &self, root: StoreRootRef, temp_dir: PathBuf, routing_encryption: Option<EncryptionService>, ) -> Result<(CreatedSnapshot, CommitFrontier), DbError>

pub async fn capture_circle_snapshot_cut( &self, root: StoreRootRef, temp_dir: PathBuf, routing_encryption: EncryptionService, circle_id: CircleId, ) -> Result<(CreatedSnapshot, CommitFrontier), DbError>

pub async fn capture_circle_snapshot_at_cutoff( &self, root: StoreRootRef, temp_dir: PathBuf, routing_encryption: EncryptionService, routing_key: RowRoutingKey, circle_id: CircleId, cutoff: CommitFrontier, ) -> Result<CreatedSnapshot, DbError>

pub async fn verify_circle_bootstrap_image( &self, image: Vec<u8>, reference: CircleBootstrapRef, circle_id: CircleId, routing_key: Option<RowRoutingKey>, ) -> Result<Vec<u8>, SnapshotImageError>

pub async fn capture_snapshot_image_for_test( &self, root: StoreRootRef, temp_dir: PathBuf, routing_encryption: Option<EncryptionService>, ) -> Result<Vec<u8>, DbError>

pub async fn capture_circle_snapshot_image_for_test( &self, root: StoreRootRef, temp_dir: PathBuf, routing_encryption: EncryptionService, circle_id: CircleId, ) -> Result<Vec<u8>, DbError>

impl StoreDatabase

pub async fn outbound_snapshot_publication( &self, ) -> Result<Option<DurableSnapshotPublication>, DbError>

pub async fn stage_snapshot_publication( &self, meta: SnapshotMeta, meta_prepared: PreparedExactObject, rollup_bytes: Vec<u8>, rollup_prepared: PreparedExactObject, image: SnapshotDatabaseImage, image_prepared: PreparedExactObject, blobs: Vec<PreparedSnapshotBlob>, ) -> Result<StoreSnapshotRef, DbError>

pub async fn latest_local_store_snapshot( &self, ) -> Result<Option<PublishedStoreSnapshot>, DbError>

pub async fn local_store_snapshots( &self, ) -> Result<Vec<PublishedStoreSnapshot>, DbError>

pub async fn complete_snapshot_publication( &self, accepted: StoreSnapshotRef, ) -> Result<(), DbError>

pub async fn snapshot_blob_spool_cleanup_paths( &self, ) -> Result<Vec<PathBuf>, DbError>

pub async fn complete_snapshot_blob_spool_cleanup( &self, path: &Path, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn latest_local_store_ack( &self, ) -> Result<Option<PublishedStoreAck>, DbError>

pub async fn activated_store_ack( &self, registration: &StoreDeviceRegistrationRef, ) -> Result<Option<ActivatedStoreAck>, DbError>

pub async fn stage_store_ack( &self, ack: StoreAck, prepared: PreparedExactObject, ) -> Result<StoreAckRef, DbError>

pub async fn adopt_outbound_store_ack_slot_winner( &self, expected: StoreAckRef, winner_bytes: Vec<u8>, winner_prepared: PreparedExactObject, ) -> Result<(), DbError>

pub async fn oldest_outbound_store_ack( &self, ) -> Result<Option<OutboundStoreAck>, DbError>

pub async fn complete_outbound_store_ack( &self, accepted: StoreAckRef, activating_commit: StoreBatchCommitRef, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn membership_head_cursors( &self, ) -> Result<InitialStoreMembershipAuthority, DbError>

pub async fn persist_membership_head_cursors( &self, head_refs: Vec<MembershipHeadRef>, ) -> Result<(), DbError>

pub async fn local_store_root_ref( &self, ) -> Result<Option<StoreRootRef>, DbError>

pub async fn validated_store_owner( &self, expected_root: &StoreRootRef, ) -> Result<String, DbError>

pub async fn install_store_owner_anchor( &self, anchor: StoreOwnerAnchor, membership: InitialStoreMembershipAuthority, ) -> Result<(), DbError>

pub async fn local_store_founder_graph( &self, ) -> Result<Option<Box<DurableFounderGraph>>, DbError>

pub async fn stage_store_founder_graph( &self, graph: Box<DurableFounderGraph>, ) -> Result<(), DbError>

pub async fn complete_store_founder_graph( &self, expected_root: StoreRootRef, expected_registration: StoreDeviceRegistrationRef, expected_initial_ack: StoreAckRef, expected_membership: FounderMembershipRefs, current_publication: ObservedStorePublication, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn registered_stream_activation( &self, activation_id: StreamActivationId, ) -> Result<Option<RegisteredStreamActivation>, DbError>

impl StoreDatabase

pub async fn replace_blob_row_stamp_for_test( &self, table: &str, row_id: &str, stamp: &str, ) -> Result<(), DbError>

pub async fn replace_blob_row_facts_for_test( &self, table: &str, row_id: &str, size: i64, hash: &str, stamp: &str, ) -> Result<(), DbError>

pub async fn complete_note_blob_transition_to_remote_for_test( &self, reference: RowBlobRef, note_id: String, ) -> Result<(), DbError>

pub async fn plant_blob_namespace_collision_for_test( &self, id: &str, local_hash: &str, remote_hash: &str, ) -> Result<(), DbError>

pub async fn plant_note_cover_blob_row_for_test( &self, id: &str, note_id: &str, size: i64, hash: &str, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn store_write_journal_counts_for_test( &self, ) -> Result<(i64, i64), DbError>

pub async fn seed_prepared_audience_write_for_test( &self, write_id: WriteId, changeset_hash: ObjectHash, ) -> Result<(), DbError>

pub async fn persist_prepared_audience_objects_for_test( &self, write_id: WriteId, remotes: Vec<RemoteObjectRecord>, packages: Vec<PreparedAudiencePackage>, blobs: Vec<PreparedAudienceBlob>, ) -> Result<(), DbError>

pub async fn seed_local_release_rows_for_test( &self, routing_encryption: Option<EncryptionService>, note_id: &str, photo_id: &str, cloud_path: &str, bytes: &[u8], )

pub async fn register_external_blob_for_test( &self, table: &str, row_id: &str, path: &Path, )

pub async fn enqueue_blob_upload_for_test( &self, root_table: &str, root_id: &str, reference: &RowBlobRef, source_path: &Path, created_at: &str, ) -> Result<(), DbError>

pub async fn insert_fixture_position_for_test( &self, note_id: &str, ) -> Result<(), HostWriteError<DbError>>

pub async fn run_host_store_write_for_test<R>( &self, routing_encryption: Option<EncryptionService>, blob_staging: Option<Box<dyn AudienceBlobMoveStaging>>, operation: impl for<'context, 'connection> FnOnce(SqlContext<'context, 'connection>) -> Result<R, DbError> + Send + 'static, ) -> Result<WriteReceipt<R>, HostWriteError<DbError>>

where R: Send + 'static,

pub async fn cleanup_intent_count_for_test( &self, namespace: &str, blob_id: &str, ) -> Result<i64, DbError>

pub async fn coven_table_exists_for_test( &self, table: DatabaseTestTable, ) -> Result<bool, DbError>

pub async fn install_store_write_failure_trigger_for_test( &self, ) -> Result<(), DbError>

pub async fn remove_store_write_failure_trigger_for_test( &self, ) -> Result<(), DbError>

pub async fn write_blob_facts_for_test( &self, write_id: WriteId, ) -> Result<String, DbError>

pub async fn install_test_active_circle( &self, label: String, ) -> Result<CircleId, DbError>

pub async fn install_test_active_circles( &self, labels: Vec<String>, ) -> Result<Vec<CircleId>, DbError>

pub async fn install_test_inactive_circle( &self, label: String, ) -> Result<CircleId, DbError>

pub async fn install_test_active_circle_with_control( &self, label: String, ) -> Result<(CircleId, CircleControlCoord), DbError>

pub async fn insert_write_status_for_test( &self, write_id: WriteId, status: WriteStatus, ) -> Result<(), DbError>

pub async fn delete_write_for_test( &self, write_id: WriteId, ) -> Result<(), DbError>

pub async fn store_write_partition_for_test( &self, write_id: &WriteId, ) -> Result<Vec<u8>, DbError>

pub async fn write_blob_lease_count_for_test( &self, write_id: &WriteId, ) -> Result<i64, DbError>

pub async fn latest_materialized_commit_coordinate_for_test( &self, ) -> Result<(String, u64), DbError>

pub async fn test_query_optional_text( &self, sql: String, ) -> Result<Option<String>, DbError>

The first column of sql’s first row, as text, or None when the query matched nothing. The only way a test reads a database a join or restore installed, which it never holds a handle to.

pub async fn replay_row_count_for_test( &self, root: StoreRootRef, table: String, ) -> Result<i64, DbError>

pub async fn compare_circle_bootstrap_replay_with_missing_coverage_for_test( &self, root: StoreRootRef, routing_key: RowRoutingKey, historical_id: String, late_id: String, ) -> Result<(i64, i64, i64, i64), DbError>

pub async fn circle_bootstrap_coverage_count_for_test( &self, circle_id: CircleId, ) -> Result<i64, DbError>

pub async fn reject_missing_circle_bootstrap_payload_claim_for_test( &self, circle_id: CircleId, ) -> Result<String, DbError>

pub async fn reject_changed_circle_bootstrap_image_hash_for_test( &self, circle_id: CircleId, root: StoreRootRef, activation_commit: &StoreBatchCommitRef, ) -> Result<String, DbError>

pub async fn circle_bootstrap_failure_state_for_test( &self, blob_id: String, circle_id: CircleId, control: String, remote_object_id: String, ) -> Result<(bool, bool, bool, bool), DbError>

pub async fn circle_bootstrap_replay_for_control_for_test( &self, circle_id: CircleId, control: CircleControlCoord, ) -> Result<Option<VerifiedCircleImage>, DbError>

pub async fn forge_circle_close_exclusion_for_test( &self, circle_id: CircleId, ) -> Result<(), DbError>

pub async fn transfer_prepared_write_to_for_test( &self, destination: &Self, write_id: &WriteId, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn sole_author_exclusion_activation_evidence_for_test( &self, ) -> Result<(String, String, String, String), DbError>

pub async fn author_exclusion_activation_evidence_for_test( &self, exclusion: &StoreDeviceExclusionRef, ) -> Result<(String, String), DbError>

pub async fn latest_local_write_facts_for_test( &self, ) -> Result<(String, i64, i64), DbError>

pub async fn install_retracted_device_state_failure_trigger_for_test( &self, ) -> Result<(), DbError>

pub async fn prepared_write_count_for_test( &self, write_id: WriteId, ) -> Result<i64, DbError>

pub async fn begin_remote_candidate_nonactivation_for_test( &self, object_id: ObjectHash, nonactivation: CandidateNonactivation, ) -> Result<(), DbError>

pub async fn install_indexed_shared_blobs_for_test( &self, write_id: WriteId, records: Vec<RemoteObjectRecord>, ) -> Result<(), DbError>

pub async fn tamper_author_exclusion_locator_for_test( &self, exclusion: &StoreDeviceExclusionRef, candidate: &StoreBatchCommitRef, tamper: AuthorExclusionLocatorTamper, ) -> Result<(), DbError>

impl StoreDatabase

pub async fn published_write_commits( &self, ) -> Result<Vec<StoreBatchCommitRef>, DbError>

pub async fn set_write_status( &self, write_id: &WriteId, status: WriteStatus, ) -> Result<(), DbError>

pub async fn block_write_if_unresolved( &self, write_id: &WriteId, block: WriteBlock, ) -> Result<bool, DbError>

Trait Implementations

impl Clone for StoreDatabase

fn clone(&self) -> StoreDatabase

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl DeviceJoinChallengePublicationJournal for StoreDatabase

fn prepare<'life0, 'life1, 'async_trait>( &'life0 self, challenge: &'life1 CrossPrincipalProbeChallenge, ) -> Pin<Box<dyn Future<Output = Result<DeviceJoinChallengePublicationRecord, StorageError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn claim_published<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, authorization: &'life1 DeviceJoinChallengePublicationAuthorization, challenge: &'life2 CrossPrincipalProbeChallenge, ) -> Pin<Box<dyn Future<Output = Result<(), StorageError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Atomically claims publication for these exact signed facts. An exact replay of an existing Published claim succeeds; a claim naming a different authorization is rejected.

impl IdProvider for StoreDatabase

fn new_id(&self) -> String

A fresh unique identifier as a string.

impl ProviderProbeJournal for StoreDatabase

fn load<'life0, 'async_trait>( &'life0 self, probe_id: ProviderProbeId, ) -> Pin<Box<dyn Future<Output = Result<Option<ProviderProbeJournalRecord>, StorageError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

fn begin<'life0, 'async_trait>( &'life0 self, prepared: ProviderProbeJournalRecord, ) -> Pin<Box<dyn Future<Output = Result<ProviderProbeJournalRecord, StorageError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Atomically inserts prepared when absent or returns the exact existing record for this probe id. A different record under the id is corruption.

fn advance<'life0, 'life1, 'async_trait>( &'life0 self, previous: &'life1 ProviderProbeJournalRecord, next: ProviderProbeJournalRecord, ) -> Pin<Box<dyn Future<Output = Result<(), StorageError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Atomically replaces the exact current record. Implementations reject a stale predecessor instead of merging progress.