Module local 

Linux/local-filesystem packet-A adapter. All writers for a replica set must use the same directory and fixed configuration. Keep fence files in place. LocalReplica acknowledges in memory; DurableReplica commits before acknowledgement and offers checked ordinary restart of an existing committed store.

Structs

CommittedTransaction

One writer’s committed history. The suffix is the existing, unchanged log wire encoding; the 24-byte prefix is LocalReplica::allocation_bytes(). This storage container is not a new transport encoding. Reading it grants no write lease and does not implement packet C’s checked writable restart. For an append-log store, the journal’s base frame and every complete record are reassembled into the frame a whole-history transaction would hold; a torn final record is excluded and the journal is not modified.

DurableReplica

Additive durable API for Linux local filesystems. Fresh constructors create a missing root; the root must then remain in place. All writers use the same fixed root and configuration. Fresh stores keep an append-only writer-<id>.journal: each Accepted/Ok(record) follows appending that one record and syncing the file. Stores written before the append log keep writer-<id>.transaction, which restart still opens and each commit still replaces whole, with file + directory sync, until an explicit migrate_*_to_append_log call; restart never migrates. Any persistence error permanently disables this instance’s writes, retaining its fence until drop. Use the explicit restart constructors for existing stores; fresh constructors never reset a store.

LocalReplica

Owns the OS lock for its entire lifetime. No Clone or mutable state/log access is exposed. Contention yields a read-only instance whose writes fail.

TornTail

Bytes after the last complete record of an append-log store that restart discarded: an entry cut short, zero fill, or a final entry whose checksum fails. Such an append was interrupted before its file sync, so it was never acknowledged. Restart truncates the journal to offset and syncs it. A damaged entry followed by other data is not a torn tail; restart refuses it as History(IntegrityMismatch) and leaves the journal unchanged.

WriteTicket

A generation captured by a caller. Renewal invalidates all older tickets.

Enums

LocalError

Errors from local writer and durable store operations.

Constants

SUPPORTED_MAX_RECORDS

Largest durable history, in records, that SafeMesh supports. Histories are retained forever and restart replays all of them, so restart time and memory grow with this size, as does the append cost of a store not yet migrated to the append log; evidence/retention/results.md records the benchmark that sets it. Ordinary restarts use this as their record cap; _with_limits accepts a caller budget or DecodeLimits::UNLIMITED.