kyle
2738de4959
Exchange::accept enqueued a pending ack whenever !(duplicate && addressed && released) held, even when the backend store.insert returned Err (store full / backend error). On Err the released flag computed to false, so an ack was still enqueued: a receiver that did not keep the message acked it. For an addressed offer that releases the sender's custody for a message nobody holds; for a broadcast it fires a false confidence event at the sender. Gate the ack enqueue on res.is_ok(): enqueue only when the store actually retained the observation. The existing released-holder exception still applies among kept copies. No bounce is recorded on Err (already the case). Adds a unit test exercising a capped store (StoreError::Full) for both a broadcast and an addressed offer, and a tines-sim property that drives custody with CappedStore-backed nodes and asserts the "at least one holder" invariant still holds when stores fill.
84 lines
2.4 KiB
Rust
84 lines
2.4 KiB
Rust
//! A [`Store`] that delegates to a [`MemStore`] but rejects `insert` with
|
|
//! [`StoreError::Full`] once it has held `capacity` observations.
|
|
//!
|
|
//! `MemStore` is unbounded, so it never fills; this wrapper lets the simulator
|
|
//! exercise the full-store custody path (F1): a receiver whose store is full
|
|
//! must not ack a received observation, or custody is released for a message
|
|
//! nobody holds.
|
|
|
|
use tines_core::{MemStore, Observation, ObservationId, Store, StoreError, Tick, TrimPolicy};
|
|
|
|
/// A capacity-bounded [`Store`]: delegates to a [`MemStore`] but returns
|
|
/// `StoreError::Full` on `insert` once `capacity` observations are held.
|
|
pub struct CappedStore {
|
|
capacity: usize,
|
|
inner: MemStore,
|
|
}
|
|
|
|
impl CappedStore {
|
|
/// A capped store holding at most `capacity` observations.
|
|
pub fn new(capacity: usize) -> Self {
|
|
Self {
|
|
capacity,
|
|
inner: MemStore::new(),
|
|
}
|
|
}
|
|
}
|
|
|
|
impl Default for CappedStore {
|
|
fn default() -> Self {
|
|
// Small enough that a node filling up on received observations rejects
|
|
// later inserts, which is what drives the full-store ack path.
|
|
Self::new(8)
|
|
}
|
|
}
|
|
|
|
impl Store for CappedStore {
|
|
fn insert(&mut self, obs: Observation, now: Tick) -> Result<bool, StoreError> {
|
|
if self.inner.len() >= self.capacity {
|
|
return Err(StoreError::Full);
|
|
}
|
|
self.inner.insert(obs, now)
|
|
}
|
|
|
|
fn contains(&self, id: &ObservationId) -> bool {
|
|
self.inner.contains(id)
|
|
}
|
|
|
|
fn get(&self, id: &ObservationId, now: Tick) -> Option<Observation> {
|
|
self.inner.get(id, now)
|
|
}
|
|
|
|
fn len(&self) -> usize {
|
|
self.inner.len()
|
|
}
|
|
|
|
fn for_each_id(&self, f: &mut dyn FnMut(&ObservationId)) {
|
|
self.inner.for_each_id(f)
|
|
}
|
|
|
|
fn for_each_broadcast_id(&self, f: &mut dyn FnMut(&ObservationId)) {
|
|
self.inner.for_each_broadcast_id(f)
|
|
}
|
|
|
|
fn for_each_addressed_id(&self, f: &mut dyn FnMut(&ObservationId)) {
|
|
self.inner.for_each_addressed_id(f)
|
|
}
|
|
|
|
fn release(&mut self, id: &ObservationId) {
|
|
self.inner.release(id)
|
|
}
|
|
|
|
fn is_released(&self, id: &ObservationId) -> bool {
|
|
self.inner.is_released(id)
|
|
}
|
|
|
|
fn for_each_topic(&self, prefix: &[u8], now: Tick, f: &mut dyn FnMut(&Observation)) {
|
|
self.inner.for_each_topic(prefix, now, f)
|
|
}
|
|
|
|
fn trim(&mut self, policy: &TrimPolicy, now: Tick) -> usize {
|
|
self.inner.trim(policy, now)
|
|
}
|
|
}
|