Trait SessionBackend 

pub trait SessionBackend {
    // Required methods
    fn client_lmid(&mut self, client_id: &str) -> Result<u64, SessionError>;
    fn producer_seq(&mut self, producer: &str) -> Result<u64, SessionError>;
    fn begin(&mut self, guarded: bool) -> Result<(), SessionError>;
    fn exec(
        &mut self,
        sql: &str,
        params: &[OwnedValue],
    ) -> Result<(), SessionError>;
    fn query(
        &mut self,
        sql: &str,
        params: &[OwnedValue],
    ) -> Result<ReadRows, SessionError>;
    fn commit(
        &mut self,
        tail: &CommitTail,
    ) -> Result<SessionCommit, SessionError>;
    fn rollback(&mut self);

    // Provided methods
    fn producer_census(&self) -> Option<u64> { ... }
    fn begin_public(
        &mut self,
        _read_only: bool,
        _isolation: &str,
        _min_cursor: Option<u64>,
    ) -> Result<(), SessionError> { ... }
    fn public_statement(
        &mut self,
        _statement: &SqlStatementRequest,
        _result_byte_limit: usize,
    ) -> Result<StatementResult, StatementRunError> { ... }
    fn public_transaction_open(&self) -> bool { ... }
    fn public_commit_outcome(
        &mut self,
        _transaction_id: &str,
    ) -> Result<Option<Option<String>>, SessionError> { ... }
    fn commit_public(
        &mut self,
        _terminal_key: Option<&str>,
    ) -> Result<SessionCommit, SessionError> { ... }
}

A single serialized write backend that can host ONE interactive mutation session at a time, with the open transaction held as backend state (rindled’s ClusterWriteTxn is an owned handle; the replicator’s txn is inseparable from WriteMaster’s connection + capture ctx + broadcast — a stateful trait fits both).

The engine upholds the invariants — begin only when idle; exec/query/commit/ rollback only while the one session is open; commit/rollback consume the open txn (a failed commit MUST leave the backend rolled back and idle). An impl may debug_assert those rather than re-check. The impl’s owner must roll an open txn back on drop (RAII containment on engine teardown).

CONTRACT: query MUST reject a non-read-only statement (sqlite3_stmt_readonly). The api-server’s compiler only emits SELECTs, but a smuggled write through the read path would bypass rindled’s capture accounting entirely and trip the replicator’s divergence guard only by accident — enforce it, don’t assume it.

Required Methods

fn client_lmid(&mut self, client_id: &str) -> Result<u64, SessionError>

fn producer_seq(&mut self, producer: &str) -> Result<u64, SessionError>

The durable last sequence producer wrote, or 0 when it has written nothing. Unlike the opaque key set this replaced, an absent producer is unambiguous — there is no retention floor to fail closed against, because there is no eviction.

fn begin(&mut self, guarded: bool) -> Result<(), SessionError>

Open the transaction; state lives in self until commit/rollback. guarded installs the public reserved-object authorizer on the writer for every statement in the session.

fn exec(&mut self, sql: &str, params: &[OwnedValue]) -> Result<(), SessionError>

fn query( &mut self, sql: &str, params: &[OwnedValue], ) -> Result<ReadRows, SessionError>

fn commit(&mut self, tail: &CommitTail) -> Result<SessionCommit, SessionError>

The whole per-backend commit tail (bookkeeping + durable commit + fan-out release). On Err the backend has already rolled back — the engine only reports.

fn rollback(&mut self)

Provided Methods

fn producer_census(&self) -> Option<u64>

How many distinct producers this host holds durable watermark state for, or None on a backend that keeps no census (the read-only stub). Observability only — the growth signal for design 306 §4’s one unenforceable contract, never an admission input. Exposed on the trait so the conformance battery can assert both authorities count the same events: the census is maintained by each host’s own commit path, which is exactly where a host can forget to maintain it.

fn begin_public( &mut self, _read_only: bool, _isolation: &str, _min_cursor: Option<u64>, ) -> Result<(), SessionError>

fn public_statement( &mut self, _statement: &SqlStatementRequest, _result_byte_limit: usize, ) -> Result<StatementResult, StatementRunError>

fn public_transaction_open(&self) -> bool

Whether the public transaction still exists after public_statement returns an error. SQLite may abort the whole transaction and make the statement savepoint impossible to rewind (for example after SQLITE_INTERRUPT). The engine must then discard its matching metadata instead of advertising transaction_state: "open" and calling the backend again.

fn public_commit_outcome( &mut self, _transaction_id: &str, ) -> Result<Option<Option<String>>, SessionError>

fn commit_public( &mut self, _terminal_key: Option<&str>, ) -> Result<SessionCommit, SessionError>

Implementors