Enum RemoteObjectRecord 

pub enum RemoteObjectRecord {
    CandidateCommit(CandidateCommitRecord),
    CandidateExclusive(CandidateObjectRecord),
    RetainedAuthority(RetainedAuthorityRecord),
    SharedLiveSet(SharedObjectRecord),
}

Variants

CandidateCommit(CandidateCommitRecord)

CandidateExclusive(CandidateObjectRecord)

RetainedAuthority(RetainedAuthorityRecord)

SharedLiveSet(SharedObjectRecord)

Implementations

impl RemoteObjectRecord

pub fn prepared_owner_promotion_request_publication( publication: &RetainedOwnerPromotionRequestPublication, commit: &StoreBatchCommit, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn prepared_membership_head_acceptance( value: &MembershipHeadAcceptance, head: &AuthorHead, prepared: &PreparedExactObject, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_commit( identity: StoreBatchCommitRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_provider_access_grant( reference: StoreMemberProviderAccessGrantRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_device_join_abandonment( reference: DeviceJoinAbandonmentRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_device_registration( reference: StoreDeviceRegistrationRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_exclusive_merge_membership_entry( family: CandidateFamilyId, reference: MembershipEntryRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_exclusive_merge_membership_head( family: CandidateFamilyId, reference: MembershipHeadRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_reclaim_evidence( reference: ReclaimEvidenceRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_reclaim_authorization( reference: ReclaimAuthorizationRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_activated_reclaim_receipt( reference: ReclaimReceiptRef, canonical_signed_bytes: &[u8], stored_bytes: &[u8], owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn snapshot_activated_blob( stored: &StoredBlobRef, owner: SnapshotObjectOwner, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn snapshot_activated_image( image: &SnapshotImageRef, owner: SnapshotObjectOwner, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn snapshot_activated_membership_rollup( rollup: &MembershipRollupRef, owner: SnapshotObjectOwner, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

The membership rollup bound to one exact snapshot metadata candidate. Its metadata slot determines the artifact slot; another snapshot uses another object even when its rollup bytes are identical.

pub fn activated_external_package( domain: SharedLiveSetObjectDomain, package: &AudiencePackage, owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn activated_blob( stored: &StoredBlobRef, owner: StoreBatchCommitRef, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

pub fn candidate_owned_blob( stored: &StoredBlobRef, owner: StoreBatchCommitRef, uploaded_verified: bool, ) -> Result<ClosedRemoteObject, RemoteObjectRecordError>

impl RemoteObjectRecord

pub fn validate(&self) -> Result<(), RemoteObjectRecordError>

Everything this record asserts about itself that does not need its payloads: where those payloads live, that the identity is the one the record is filed under, and that its ownership state holds together.

Byte agreement is Self::validate_payload’s job, and it is checked where bytes arrive from outside this device’s own durable state, rather than on every load. Identity and payload cannot drift apart afterwards: neither hash mutates across transitions, and the two domain changes that do happen re-wrap the same reference.

pub fn validate_payload( &self, canonical_semantic_bytes: &[u8], ) -> Result<(), RemoteObjectRecordError>

Check this record’s identity against the plaintext it names — the whole domain parse, its signature verifications, and its agreement with the reference.

Called where bytes enter from somewhere this device does not already trust: a constructor handed the payload, a pull that parsed it off the wire. Reading back this device’s own durable state does not run it — neither loading the row nor reading the spool file the row names, which is named for the digest of its own contents and was fixed by this record’s identity when it was built.

pub fn into_activated( self, commit: &StoreBatchCommitRef, ) -> Result<Self, RemoteObjectRecordError>

pub fn into_observed_activated( self, commit: &StoreBatchCommitRef, ) -> Result<Self, RemoteObjectRecordError>

pub fn records_verified_upload(&self) -> bool

Whether this device already created these exact bytes at the provider and settled the create.

The record is the evidence, so nothing that holds one needs to read the object back to know its content: the bytes were hashed locally before the upload and the provider’s exact-upload verification settled the create. Reading it back would test the provider’s durability, not this device’s correctness, and an object that later goes missing surfaces on the read that wants it.

pub fn mark_uploaded_verified(&mut self) -> Result<(), RemoteObjectRecordError>

pub fn add_retained_authority_candidate( &mut self, candidate: StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn merge_retained_authority_activation( &mut self, expected: &Self, owner: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn begin_candidate_nonactivation( &mut self, nonactivation: CandidateNonactivation, ) -> Result<Option<ProtocolInertObject>, RemoteObjectRecordError>

pub fn cleanup_target(&self) -> Option<&ExactObjectRef>

pub fn mark_absent_verified(&mut self) -> Result<(), RemoteObjectRecordError>

pub fn candidate_cleanup_complete( &self, candidate: &StoreBatchCommitRef, ) -> Result<bool, RemoteObjectRecordError>

impl RemoteObjectRecord

pub fn merge_blob_activation( &mut self, stored: &StoredBlobRef, owner: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn merge_package_activation( &mut self, domain: &SharedLiveSetObjectDomain, package: &AudiencePackage, owner: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn merge_retained_replay_owner( &mut self, owner: RetainedReplayOwner, ) -> Result<(), RemoteObjectRecordError>

pub fn remove_all_retained_replay_owners( &mut self, ) -> Result<(), RemoteObjectRecordError>

pub fn remove_retained_replay_owner( &mut self, owner: &RetainedReplayOwner, ) -> Result<(), RemoteObjectRecordError>

pub fn merge_snapshot_owner( &mut self, stored: &StoredBlobRef, owner: SnapshotObjectOwner, ) -> Result<(), RemoteObjectRecordError>

pub fn replace_snapshot_owners_for_image( &mut self, owner: Option<&SnapshotObjectOwner>, pending_store_snapshots: &BTreeSet<ObjectSlot>, ) -> Result<(), RemoteObjectRecordError>

Reassign inherited snapshot ownership in an exported database copy. Live records keep their owners through the merge methods instead.

pub fn retire_superseded_store_snapshot_ownership( &mut self, metadata_slot: &ObjectSlot, superseded: &BTreeSet<ObjectSlot>, ) -> Result<(), RemoteObjectRecordError>

Retire superseded Store snapshot leases at an accepted successor. A reused object remains owned by that successor; a dropped blob retains its exact original publication provenance until physical reclaim.

impl RemoteObjectRecord

pub fn release_pending_candidate( self, candidate: &StoreBatchCommitRef, ) -> Result<PendingCandidateRelease, RemoteObjectRecordError>

Remove a candidate’s pending claim without asserting whether that exact candidate was accepted. The caller must hold the durable operation’s completion or discard proof and select its exact manifest. This calculation neither changes the original row nor authorizes a new publication; the operation owns deletion and the final atomic row update.

impl RemoteObjectRecord

pub fn object(&self) -> &ExactObjectRef

pub fn payloads(&self) -> &RemoteObjectPayloads

pub fn semantic_payload(&self) -> SemanticPayload<'_>

Where this record’s plaintext is. A stored blob carries its locator in the row, the image domains have no plaintext of their own, and every other domain names its plaintext in the spool by the identity’s semantic hash.

pub fn stored_payload(&self) -> Option<ObjectHash>

The spooled ciphertext this record uploads, when the ciphertext is its own to upload.

pub fn payload_claims(&self) -> BTreeSet<ObjectHash>

Every spool file this record names. The claim it holds while its row exists, and what the row’s deletion lets go of.

pub fn object_id(&self) -> ObjectHash

pub fn is_activated_stored_blob(&self) -> bool

pub fn validate_reclaimable_store_package( &self, target: &StorePackageRef, activation: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn validate_reclaimable_circle_package( &self, target: &CirclePackageRef, activation: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

pub fn store_package_is_retained_for_replay( &self, target: &StorePackageRef, activation: &StoreBatchCommitRef, ) -> Result<bool, RemoteObjectRecordError>

pub fn circle_package_is_retained_for_replay( &self, target: &CirclePackageRef, activation: &StoreBatchCommitRef, ) -> Result<bool, RemoteObjectRecordError>

pub fn validate_reclaimable_circle_bootstrap_image( &self, image: &SnapshotImageRef, activation: &StoreBatchCommitRef, ) -> Result<(), RemoteObjectRecordError>

A Circle bootstrap image is reclaimable when its single activating Store commit is its only surviving owner: no pending activation and exactly one activated owner. A bootstrap image accretes a per-activating-commit owner, so more than one means a live successor still references it.

pub fn validate_reclaimable_snapshot_image( &self, image: &SnapshotImageRef, owner: &SnapshotObjectOwner, ) -> Result<(), RemoteObjectRecordError>

A snapshot image is reclaimable when the exact snapshot named by the claim is its only surviving owner, with no pending activation.

pub fn validate_reclaimable_membership_rollup( &self, rollup: &MembershipRollupRef, owner: &SnapshotObjectOwner, ) -> Result<(), RemoteObjectRecordError>

A membership rollup is reclaimable when the exact snapshot named as its owner is its only owner. Another snapshot owner keeps the shared object live.

pub fn validate_reclaimable_stored_blob( &self, stored: &StoredBlobRef, ) -> Result<(), RemoteObjectRecordError>

A stored blob is reclaimable when it is the exact activated blob the target names. Unlike a package or an image, a blob legitimately carries several activated owners — one per commit that bound it — so ownership count is not the eligibility question here; whether any live row or installable image still needs it is, and the reclaim verified that before reaching closure.

pub fn stored_blob_commit_owners(&self) -> Vec<StoreBatchCommitRef>

The activated Store commits that published this stored blob. A blob accretes one per commit whose package bindings named it, so a republished blob carries several.

pub fn snapshot_owners(&self) -> impl Iterator<Item = &SnapshotObjectOwner>

pub fn retained_replay_owners( &self, ) -> impl Iterator<Item = &RetainedReplayOwner>

Trait Implementations

impl Clone for RemoteObjectRecord

fn clone(&self) -> RemoteObjectRecord

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RemoteObjectRecord

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RemoteObjectRecord

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for RemoteObjectRecord

fn eq(&self, other: &RemoteObjectRecord) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for RemoteObjectRecord

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for RemoteObjectRecord

impl StructuralPartialEq for RemoteObjectRecord