aarondb/raft_durability

raft_durability — filesystem-backed persistence boundary for cluster Raft

The adapter commits a complete Raft recovery image through an Erlang-owned write/rename/fsync sequence. A recovery image is accepted only when its SHA-256 checksum and term encoding verify. Corruption is an alarm, never a repair path. The state image is opaque to this adapter so callers can keep command, membership, lease, idempotency, and projection-checkpoint state in one atomically recovered envelope.

Types

Error

pub type Error {
  Io(String)
  Corrupt(String)
}

Constructors

```
Io(String)
```
```
Corrupt(String)
```

Store

pub type Store {
  Store(path: String)
}

Constructors

```
Store(path: String)
```

Values

backup

pub fn backup(
  store: Store,
  destination: String,
) -> Result(Nil, Error)

Exports the already verified durable image. It never serializes a partial in-memory state or overwrites the source store.

interrupt_before_rename_for_test

pub fn interrupt_before_rename_for_test(
  path: String,
  partial_bytes: String,
) -> Result(Nil, String)

Test-only fault injection: writes and syncs a partial sibling image then aborts before rename. The previously acknowledged recovery image must remain the only readable state.

load

pub fn load(
  store: Store,
) -> Result(#(raft_runtime.Persisted, String), Error)

Reads exactly one verified image. Missing storage is a normal empty-node bootstrap condition; malformed/torn/corrupt storage is a terminal alarm.

open

pub fn open(path: String) -> Store

overwrite_for_test

pub fn overwrite_for_test(
  path: String,
  bytes: String,
) -> Result(Nil, String)

remove_for_test

pub fn remove_for_test(path: String) -> Result(Nil, String)

save

pub fn save(
  store: Store,
  persisted: raft_runtime.Persisted,
  state_image: String,
) -> Result(Nil, Error)

Atomically writes hard state + log + snapshot + state image and fsyncs both the file and directory before acknowledging success.