Struct LeaseStore 

pub struct LeaseStore {
    root: PathBuf,
    ttl_ms: u64,
}

Fields

root: PathBuf

ttl_ms: u64

Implementations

impl LeaseStore

pub fn open(registry_root: &Path) -> Result<Self>

<registry_root>/leases/. Creates the directory if missing.

fn content_path(&self, instance_id: &str) -> PathBuf

fn lock_path(&self, instance_id: &str) -> PathBuf

fn epoch_path(&self, instance_id: &str) -> PathBuf

fn read(path: &Path) -> Result<OnDisk>

fn next_epoch(&self, instance_id: &str, floor: u64) -> Result<u64>

Next ownership epoch for instance_id: one past the larger of the persisted counter and floor (the current file’s epoch, which a lease written before the counter existed may carry alone). Must be called inside the key’s critical section.

pub fn claim( &self, instance_id: &str, boot_id: &Arc<str>, block_id: &str, session_id_hint: Option<&str>, ) -> Result<Lease, LeaseError>

Attempt to claim the lease for instance_id. Kept for the subprocess controller’s per-turn claim; see Self::claim_as.

pub fn claim_as( &self, instance_id: &str, boot_id: &Arc<str>, block_id: &str, session_id_hint: Option<&str>, info: &ClaimantInfo, ) -> Result<Lease, LeaseError>

Attempt to claim the lease for instance_id.

• Already held by boot_id (this process) for the same block → idempotent re-claim, timestamp refreshed, epoch kept.
• Held, not yet expired, by another block of this same process → Err(HeldByOther): one driver per agent holds inside a process too (ReAgent P1 on #3738), and the newcomer is the one refused.
• Held by another owner, not yet expired, holder not provably dead → Err(HeldByOther).
• Unreadable and rewritten within the TTL → Err(HeldByOther) (fail closed — see module doc).
• Free, expired, unreadable-and-stale, or held by a dead process → claimed under a new epoch.

The whole read-decide-write sequence runs inside a per- instance_id exclusive lock (see module doc comment), so there’s no window for a concurrent claimer to observe an inconsistent state.

pub fn renew(&self, lease: &Lease) -> Result<(), LeaseError>

Extend a held lease’s TTL. Runs inside the same per-instance_id critical section as claim, so the ownership check and the write are atomic with respect to any concurrent claim/renew/ release for this instance — a caller that lost the lease to a TTL reclaim between its last renew and this one gets a real HeldByOther, never a silent clobber of the new owner’s file.

pub fn verify(&self, lease: &Lease) -> Result<(), LeaseError>

Is lease still ours? The pre-turn fence check: a holder that was suspended past the TTL and reclaimed must find out before it starts another turn, not only at its next renew tick. Does not write.

fn owned_file(&self, lease: &Lease) -> Result<LeaseFile, LeaseError>

Read the lease file and confirm lease’s owner still holds it. Caller holds the critical section.

pub fn release(&self, lease: &Lease) -> Result<(), LeaseError>

Release a held lease. If it’s no longer ours — already TTL-reclaimed by another process, or re-claimed by another block of this same process — this is a safe no-op: deleting would destroy the current holder’s lease, not ours. Idempotent: releasing an already-missing lease is Ok(()). The epoch counter is never removed (see module doc).

pub fn live_holder_other_than( &self, instance_id: &str, own_boot_id: &str, ) -> Result<Option<LeaseHolder>>

The current holder of instance_id’s lease if it is live — unexpired and not provably dead — and is not own_boot_id. The read-only early check callers run before doing anything shared on the agent’s behalf (spec I9); the binding decision is still claim. An unreadable, still-fresh file is reported as held with an empty holder (fail closed).