Enum RemoteObjectRecord 

pub enum RemoteObjectRecord {
    CandidateCommit(CandidateCommitRecord),
    CandidateExclusive(CandidateObjectRecord),
    RetainedAuthority(RetainedAuthorityRecord),
    SharedLiveSet(SharedObjectRecord),
}

Variants

CandidateCommit(CandidateCommitRecord)

CandidateExclusive(CandidateObjectRecord)

RetainedAuthority(RetainedAuthorityRecord)

SharedLiveSet(SharedObjectRecord)

Implementations

impl RemoteObjectRecord

pub fn candidate_commit( identity: StoreBatchCommitRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_store_head( reference: StoreDeviceHeadRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_store_membership_resolution( reference: StoreMembershipConflictResolutionRef, canonical_semantic_bytes: &[u8], stored_bytes: &[u8], candidate: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_exclusive_merge_membership_entry( family: CandidateFamilyId, reference: MembershipEntryRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_exclusive_merge_membership_head( family: CandidateFamilyId, reference: MembershipHeadRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_reclaim_evidence( reference: ReclaimEvidenceRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_reclaim_authorization( reference: ReclaimAuthorizationRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_reclaim_receipt( reference: ReclaimReceiptRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn snapshot_activated_blob( stored: &StoredBlobRef, owner: SnapshotObjectOwner, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn snapshot_activated_image( image: &SnapshotImageRef, owner: SnapshotObjectOwner, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn snapshot_activated_membership_rollup( rollup: &MembershipRollupRef, owner: SnapshotObjectOwner, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

The membership rollup one snapshot generation published, owned by that generation.

The same owner shape the image gets, and for a reason the image does not have: a rollup is content-addressed over the membership frontier, so two generations published over an unchanged membership name the same object. Ownership is what keeps the older generation’s reclaim from deleting the rollup the newer one still points at.

pub fn activated_external_package( domain: SharedLiveSetObjectDomain, package: &AudiencePackage, owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn activated_blob( stored: &StoredBlobRef, owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_owned_blob( stored: &StoredBlobRef, owner: StoreBatchCommitRef, uploaded_verified: bool, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

impl RemoteObjectRecord

pub fn validate(&self) -> Result<(), RemoteObjectRecordError>

Everything this record asserts about itself that does not need its payloads: where those payloads live, that the identity is the one the record is filed under, and that its ownership state holds together.

Byte agreement is Self::validate_payload’s job, and it is checked where bytes arrive from outside this device’s own durable state, rather than on every load. Identity and payload cannot drift apart afterwards: neither hash mutates across transitions, and the two domain changes that do happen re-wrap the same reference.

pub fn validate_payload( &self, canonical_semantic_bytes: &[u8], ) -> Result<(), RemoteObjectRecordError>

Check this record’s identity against the plaintext it names — the whole domain parse, its signature verifications, and its agreement with the reference.

Called where bytes enter from somewhere this device does not already trust: a constructor handed the payload, a pull that parsed it off the wire. Reading back this device’s own durable state does not run it — neither loading the row nor reading the spool file the row names, which is named for the digest of its own contents and was fixed by this record’s identity when it was built.

pub fn into_activated( self, commit: &StoreBatchCommitRef, ) -> Result<Self, RemoteObjectRecordError>

pub fn into_observed_activated( self, commit: &StoreBatchCommitRef, ) -> Result<Self, RemoteObjectRecordError>

pub fn records_verified_upload(&self) -> bool

Whether this device already created these exact bytes at the provider and settled the create.

The record is the evidence, so nothing that holds one needs to read the object back to know its content: the bytes were hashed locally before the upload and the provider’s exact-upload verification settled the create. Reading it back would test the provider’s durability, not this device’s correctness, and an object that later goes missing surfaces on the read that wants it.

pub fn mark_uploaded_verified(&mut self) -> Result<(), RemoteObjectRecordError>

pub fn add_retained_authority_candidate( &mut self, candidate: StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn merge_retained_authority_activation( &mut self, expected: &Self, owner: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn begin_candidate_nonactivation( &mut self, nonactivation: CandidateNonactivation, ) -> Result<Option<ProtocolInertObject>, RemoteObjectRecordError>

pub fn begin_candidate_nonactivation_with_verified_head_nonactivation( &mut self, nonactivation: CandidateNonactivation, head_nonactivation: &VerifiedCandidateHeadNonactivation, ) -> Result<Option<ProtocolInertObject>, RemoteObjectRecordError>

pub fn cleanup_target(&self) -> Option<&ExactObjectRef>

pub fn mark_absent_verified(&mut self) -> Result<(), RemoteObjectRecordError>

pub fn candidate_cleanup_complete( &self, candidate: &StoreBatchCommitRef, ) -> Result<bool, RemoteObjectRecordError>

pub fn candidate_nonactivation_proof( &self, candidate: &StoreBatchCommitRef, ) -> Result<Option<&CandidateNonactivationProof>, RemoteObjectRecordError>

impl RemoteObjectRecord

pub fn merge_blob_activation( &mut self, stored: &StoredBlobRef, owner: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn merge_snapshot_ownership( &mut self, rollup: &MembershipRollupRef, owner: SnapshotObjectOwner, ) -> Result<(), RemoteObjectRecordError>

Add one more snapshot generation to a membership rollup’s owners.

A rollup is content-addressed over the membership frontier, so a generation published while membership stood still names the object an earlier one already owns. Both own it; reclaim deletes it when the last owner goes.

pub fn merge_package_activation( &mut self, domain: &SharedLiveSetObjectDomain, package: &AudiencePackage, owner: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn merge_retained_replay_owner( &mut self, owner: RetainedReplayOwner, ) -> Result<(), RemoteObjectRecordError>

pub fn remove_all_retained_replay_owners( &mut self, ) -> Result<(), RemoteObjectRecordError>

pub fn remove_retained_replay_owner( &mut self, owner: &RetainedReplayOwner, ) -> Result<(), RemoteObjectRecordError>

pub fn retract_activated_candidate( &mut self, nonactivation: CandidateNonactivation, head_nonactivation: Option<&VerifiedCandidateHeadNonactivation>, ) -> Result<Option<ProtocolInertObject>, RemoteObjectRecordError>

pub fn merge_snapshot_owner( &mut self, stored: &StoredBlobRef, owner: SnapshotObjectOwner, ) -> Result<(), RemoteObjectRecordError>

impl RemoteObjectRecord

pub fn object(&self) -> &ExactObjectRef

pub fn payloads(&self) -> &RemoteObjectPayloads

pub fn semantic_payload(&self) -> SemanticPayload<'_>

Where this record’s plaintext is. A stored blob carries its locator in the row, the image domains have no plaintext of their own, and every other domain names its plaintext in the spool by the identity’s semantic hash.

pub fn stored_payload(&self) -> Option<ObjectHash>

The spooled ciphertext this record uploads, when the ciphertext is its own to upload.

pub fn payload_claims(&self) -> BTreeSet<ObjectHash>

Every spool file this record names. The claim it holds while its row exists, and what the row’s deletion lets go of.

pub fn object_id(&self) -> ObjectHash

pub fn is_activated_stored_blob(&self) -> bool

pub fn validate_reclaimable_store_package( &self, target: &StorePackageRef, activation: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn validate_reclaimable_circle_package( &self, target: &CirclePackageRef, activation: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn store_package_is_retained_for_replay( &self, target: &StorePackageRef, activation: &StoreBatchCommitRef, ) -> Result<bool, RemoteObjectRecordError>

pub fn circle_package_is_retained_for_replay( &self, target: &CirclePackageRef, activation: &StoreBatchCommitRef, ) -> Result<bool, RemoteObjectRecordError>

pub fn validate_reclaimable_circle_bootstrap_image( &self, image: &SnapshotImageRef, activation: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

A Circle bootstrap image is reclaimable when its single activating Store commit is its only surviving owner: no pending activation and exactly one activated owner. A bootstrap image accretes a per-activating-commit owner, so more than one means a live successor still references it.

pub fn validate_reclaimable_snapshot_image( &self, image: &SnapshotImageRef, owner: &SnapshotObjectOwner, ) -> Result<(), RemoteObjectRecordError>

A snapshot image is reclaimable when the generation that published it is its only surviving owner: no pending activation and exactly one activated owner, the Snapshot owner naming that stream and generation. A snapshot image accretes no further owners, so anything else means the record is not the one the claim describes.

pub fn validate_reclaimable_membership_rollup( &self, rollup: &MembershipRollupRef, owner: &SnapshotObjectOwner, ) -> Result<(), RemoteObjectRecordError>

A membership rollup is reclaimable when the generation named as its owner is its only owner. A rollup two generations point at carries both, and stays until the other one is reclaimed as well.

pub fn validate_reclaimable_stored_blob( &self, stored: &StoredBlobRef, ) -> Result<(), RemoteObjectRecordError>

A stored blob is reclaimable when it is the exact activated blob the target names. Unlike a package or an image, a blob legitimately carries several activated owners — one per commit that bound it — so ownership count is not the eligibility question here; whether any live row or installable image still needs it is, and the reclaim verified that before reaching closure.

pub fn stored_blob_commit_owners(&self) -> Vec<StoreBatchCommitRef>

The activated Store commits that published this stored blob. A blob accretes one per commit whose package bindings named it, so a republished blob carries several.

pub fn snapshot_owners(&self) -> impl Iterator<Item = &SnapshotObjectOwner>

pub fn retained_replay_owners( &self, ) -> impl Iterator<Item = &RetainedReplayOwner>

Trait Implementations

impl Clone for RemoteObjectRecord

fn clone(&self) -> RemoteObjectRecord

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RemoteObjectRecord

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RemoteObjectRecord

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for RemoteObjectRecord

fn eq(&self, other: &RemoteObjectRecord) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for RemoteObjectRecord

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for RemoteObjectRecord

impl StructuralPartialEq for RemoteObjectRecord