Module store 

The store behind AuthenticatedLog: sorted runs over rfc9162_tiles, each run’s manifest appended to a log so a signed checkpoint covers the index as well as the entries.

Two layouts, one code path:

• Shared: the manifests are entries of the data log itself. One tree, one checkpoint signs entries and index. Store::open, Index::at.
• Split: the manifests are entries of a second tile log, the index log, each carrying the data tree’s size and root it indexes. The data log holds exactly the caller’s entries, which a consumer that already signs its data leaves needs; the index log has its own checkpoint under the same key. Store::open_split, Index::at_split.

Inside the store that holds the manifests (the data store when shared, the index store when split), beside the tiles:

• runs/<lo>-<hi>: one sealed run, the sorted (key, index) pairs of data entries lo..=hi and a Bloom filter over the keys, in the format RUN_MAGIC describes. Its SHA-256 is the run_hash the logged manifest carries, so a reader checks the file before trusting a seek. The writer writes format v2: each key is stored as the length it shares with the key before it and the bytes that follow (front coding), and each index as a LEB128 varint offset from lo. Runs written as v1 (every key and index in full) stay readable; the manifest binds the file’s hash, not its format.
• runs/live: the manifest indices of the runs a lookup goes through, one per line, oldest first. A cache: when it is missing or stale the live set is rebuilt from the manifest entries in the log.

A manifest entry starts with MANIFEST_MAGIC, carries no lookup keys and, when shared, lies in the entry range of the run sealed after it. Compaction logs a manifest that names the manifest indices it replaces; the replaced runs stay in the store and in the tree, and leave the live set.

Store is the one writer and holds the writer locks. Index answers lookups at tree sizes and roots a caller trusts, without the locks, which is how a verifier that holds signed checkpoints reads the log.

Structs

Index

Lookups at tree sizes and roots the caller trusts, without the writer locks. Every answer carries inclusion paths against those sizes: the entry’s against the data tree, the run manifest’s against the tree that holds the manifests (the same tree when shared), so a caller holding the signed checkpoints proves each hit with their roots and nothing from the store.

Logged

A logged manifest, as the entry carries it: the run it describes, the data tree (size and root) at the moment it was sealed, and the manifest indices of the runs it replaced (none for a seal).

Run

A run file, checked against its manifest. Runs in format v1 and v2 are decoded whole into pairs; a v3 run keeps its bytes and its block index in blocks and decodes a block when a lookup reaches it.

Store

The store: the data writer, the manifest writer when split, the live runs, and the size a trusted checkpoint covers.

Constants

BLOCK_PAIRS

Pairs per block in a v3 run. Each block restarts its front coding, so a lookup decodes only the blocks whose key range can hold the key.

MANIFEST_MAGIC

First bytes of a logged run manifest.

RUN_MAGIC

First bytes of a run file in format v2 (front-coded, one sequence), which readers accept.

RUN_MAGIC_V1

First bytes of a run file in format v1, which readers still accept.

RUN_MAGIC_V3

First bytes of a run file as the writer writes it (format v3: front-coded blocks of BLOCK_PAIRS pairs behind a block index).

Functions

tiles_keys

The key function the tiles layer gets: the caller’s keys for ordinary entries, none for manifest entries.

Type Aliases

Keys

Derives the lookup keys of an entry; shared between the writer’s sidecars and the runs. The identity hash is always a key and need not be returned.

RunCache

Decoded runs by manifest index, shared between lookups so a run file is read and checked once per process rather than once per lookup.