[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_180":-5,"_183":184,"_185":186},"routes/shell",{"_43":44,"_179":-5,"_180":-5,"_181":182},"routes/repo",{"_34":-7,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":32,"_46":32,"_47":32,"_48":32,"_49":32,"_50":32,"_51":52,"_53":52,"_54":32,"_55":-7,"_56":-7,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":65,"_66":67,"_68":69,"_70":71},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-5,"_26":27,"_28":29,"_29":30,"_31":32,"_33":14},"ref","main","path","crates/logic/wake.rs","oid","97b895ff70c81268e1c2fc67208fedf78c23a013","size",10916,"commit","90b43017241f81189453d326d05948f388b34652","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","// Copyright 2026 Deno Land Inc. Apache-2.0 license.\n\n//! Immutable alarm publications and the retirement frontier, without I/O.\n//!\n//! A committed installation owns one key for its entire lifetime. Cleanup\n//! only deletes identities below a proved SQLite frontier, so an unresolved\n//! old DELETE cannot name a later installation. LIST, rather than successful\n//! callbacks, supplies the cleanup inventory after a lost response or restart.\nuse super::Ms;\nuse std::collections::{BTreeMap, HashMap};\n\n/// A SQLite writer epoch and its persistent, non-repeating alarm sequence.\n/// A publication always belongs to a positive ownership epoch. A listed\n/// migration seed uses zero and is older than every real installation.\n#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]\npub struct PublicationId {\n pub epoch: u64,\n pub sequence: u64,\n}\n\nimpl std::fmt::Display for PublicationId {\n fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\n write!(f, \"{:016x}-{:016x}\", self.epoch, self.sequence)\n }\n}\n\nimpl PublicationId {\n pub fn parse(value: &str) -> Option {\n let (epoch, sequence) = value.split_once('-')?;\n if epoch.len() != 16 || sequence.len() != 16 {\n return None;\n }\n let id = Self {\n epoch: u64::from_str_radix(epoch, 16).ok()?,\n sequence: u64::from_str_radix(sequence, 16).ok()?,\n };\n (id.epoch > 0 && id.to_string() == value).then_some(id)\n }\n}\n\n/// The write position and publication identity sampled from one committed\n/// SQLite connection. A mailbox must carry this value, not sample it again.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub struct AlarmSource {\n pub id: PublicationId,\n pub position: u64,\n}\n\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub struct AlarmSnapshot {\n at_ms: Option,\n source: Option,\n}\n\nimpl AlarmSnapshot {\n pub fn without_wake(at_ms: Option) -> Self {\n Self {\n at_ms,\n source: None,\n }\n }\n\n pub fn committed(at_ms: Option, source: AlarmSource) -> Self {\n Self {\n at_ms,\n source: Some(source),\n }\n }\n\n pub fn at_ms(self) -> Option {\n self.at_ms\n }\n\n pub fn source(self) -> Option {\n self.source\n }\n\n /// Other SQLite writes can advance a position without installing an alarm.\n pub fn same_installation(self, other: Self) -> bool {\n self.at_ms == other.at_ms && self.source.map(|s| s.id) == other.source.map(|s| s.id)\n }\n}\n\n#[derive(Clone, Debug, PartialEq, Eq)]\npub struct Publication {\n pub key: String,\n pub alarm: AlarmSnapshot,\n}\n\n/// A projection of durable SQLite truth. The executor must prove replication,\n/// ownership, and replacement publication before it writes this certificate.\n/// A stale certificate is conservative: it protects every later identity,\n/// including an installation whose PUT is still in progress.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub struct Retirement {\n pub id: PublicationId,\n pub at_ms: Option,\n}\n\nimpl Retirement {\n pub fn retires(self, candidate: PublicationId) -> bool {\n candidate < self.id || (candidate == self.id && self.at_ms.is_none())\n }\n}\n\n/// A bounded cache of confirmed publications. Recent keys allow eager cleanup\n/// even when observations coalesce. LIST remains the complete inventory after\n/// overflow, cancellation, lost responses, or restart; no arm waits for DELETE.\n#[derive(Default)]\npub struct WakeCore {\n confirmed: HashMap>,\n}\n\nimpl WakeCore {\n pub fn new() -> Self {\n Self::default()\n }\n\n pub fn publication(&self, cell: &str, alarm: AlarmSnapshot) -> Option {\n let due_ms = alarm.at_ms?;\n let source = alarm.source?;\n if due_ms < 0 || source.id.epoch == 0 || self.covered(cell, alarm) {\n return None;\n }\n Some(Publication {\n key: entry_key(due_ms, cell, source.id),\n alarm,\n })\n }\n\n /// A completion never replaces a newer installation's cache entry.\n pub fn confirm(&mut self, cell: &str, alarm: AlarmSnapshot) {\n let Some(source) = alarm.source else { return };\n if alarm.at_ms.is_some() {\n // A stalled durability proof must not accumulate an unbounded\n // queue. Retain the newest identities, including current coverage.\n const RECENT_PUBLICATIONS: usize = 32;\n let recent = self.confirmed.entry(cell.to_string()).or_default();\n recent.insert(source.id, alarm);\n while recent.len() > RECENT_PUBLICATIONS {\n recent.pop_first();\n }\n }\n }\n\n pub fn covered(&self, cell: &str, alarm: AlarmSnapshot) -> bool {\n alarm.at_ms.is_some()\n && alarm.source.is_some()\n && self\n .confirmed\n .get(cell)\n .and_then(|recent| recent.last_key_value())\n .is_some_and(|(_, confirmed)| confirmed.same_installation(alarm))\n }\n\n /// Drain only identities below the proven frontier. Forgetting a candidate\n /// before its DELETE finishes is safe because the collector can rediscover it.\n pub fn take_retired(&mut self, cell: &str, retirement: Retirement) -> Vec {\n let mut keys = Vec::new();\n if let Some(recent) = self.confirmed.get_mut(cell) {\n recent.retain(|id, alarm| {\n if retirement.retires(*id) {\n keys.push(entry_key(alarm.at_ms.unwrap(), cell, *id));\n false\n } else {\n true\n }\n });\n }\n keys\n }\n\n pub fn forget(&mut self, cell: &str) {\n self.confirmed.remove(cell);\n }\n}\n\n/// Civil date from days since 1970-01-01 (Howard Hinnant's algorithm).\npub(crate) fn civil_from_days(z: i64) -> (i64, u32, u32) {\n let z = z + 719_468;\n let era = if z >= 0 { z } else { z - 146_096 } / 146_097;\n let doe = z - era * 146_097;\n let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;\n let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);\n let mp = (5 * doy + 2) / 153;\n let d = (doy - (153 * mp + 2) / 5 + 1) as u32;\n let m = if mp < 10 { mp + 3 } else { mp - 9 } as u32;\n (yoe + era * 400 + i64::from(m <= 2), m, d)\n}\n\n/// The time bucket a due timestamp falls in: minute precision, UTC,\n/// lexicographically ordered so the waker LISTs due buckets in order.\nfn minute_bucket(due_ms: i64) -> String {\n let mins = due_ms.div_euclid(60_000);\n let (y, mo, d) = civil_from_days(mins.div_euclid(1440));\n let m = mins.rem_euclid(1440);\n format!(\"{y:04}-{mo:02}-{d:02}T{:02}:{:02}\", m / 60, m % 60)\n}\n\nfn days_from_civil(y: i64, m: u32, d: u32) -> i64 {\n let y = y - i64::from(m <= 2);\n let era = if y >= 0 { y } else { y - 399 } / 400;\n let yoe = y - era * 400;\n let mp = i64::from(if m > 2 { m - 3 } else { m + 9 });\n let doy = (153 * mp + 2) / 5 + i64::from(d) - 1;\n era * 146_097 + yoe * 365 + yoe / 4 - yoe / 100 + doy - 719_468\n}\n\n/// The due-minute floor a `YYYY-MM-DDTHH:MM` bucket names, in ms.\nfn parse_minute(minute: &str) -> Option {\n if minute.len() != 16 {\n return None;\n }\n let y: i64 = minute.get(0..4)?.parse().ok()?;\n let mo: u32 = minute.get(5..7)?.parse().ok()?;\n let d: u32 = minute.get(8..10)?.parse().ok()?;\n let h: i64 = minute.get(11..13)?.parse().ok()?;\n let mi: i64 = minute.get(14..16)?.parse().ok()?;\n if minute.get(4..5)? != \"-\"\n || minute.get(7..8)? != \"-\"\n || minute.get(10..11)? != \"T\"\n || minute.get(13..14)? != \":\"\n || !(1..=12).contains(&mo)\n || !(1..=31).contains(&d)\n || !(0..24).contains(&h)\n || !(0..60).contains(&mi)\n {\n return None;\n }\n let ms = (days_from_civil(y, mo, d) * 1440 + h * 60 + mi) * 60_000;\n (minute_bucket(ms) == minute).then_some(ms)\n}\n\npub const ENTRY_PREFIX: &str = \"wake/entries/\";\n\npub fn entry_key(due_ms: i64, cell: &str, id: PublicationId) -> String {\n format!(\"{ENTRY_PREFIX}{}/{cell}/{id}\", minute_bucket(due_ms))\n}\n\n/// An offline inventory hint, never an alarm installation. Its distinct name\n/// cannot collide with a writer or be removed by a legacy minute-key DELETE.\npub fn migration_seed_key(cell: &str) -> String {\n format!(\"{ENTRY_PREFIX}1970-01-01T00:00/{cell}/migration\")\n}\n\n#[derive(Debug, Clone, PartialEq, Eq)]\npub struct ListedEntry {\n pub minute_ms: i64,\n pub cell: String,\n pub id: PublicationId,\n}\n\n/// Reject malformed identities and scopes before they can reach ownership.\npub fn parse_entry_key(key: &str) -> Option {\n let rest = key.strip_prefix(ENTRY_PREFIX)?;\n let mut parts = rest.split('/');\n let minute = parts.next()?;\n let cell = parts.next()?;\n let identity = parts.next()?;\n let id = if identity == \"migration\" && minute == \"1970-01-01T00:00\" {\n PublicationId {\n epoch: 0,\n sequence: 0,\n }\n } else {\n PublicationId::parse(identity)?\n };\n if parts.next().is_some() || !crate::cell::valid_cell_scope(cell) {\n return None;\n }\n Some(ListedEntry {\n minute_ms: parse_minute(minute)?,\n cell: cell.to_string(),\n id,\n })\n}\n\npub fn parse_minute_prefix(prefix: &str) -> Option {\n parse_minute(prefix.strip_prefix(ENTRY_PREFIX)?.trim_end_matches('/'))\n}\n\n/// May this node take the singleton waker-role lease — because it already holds\n/// it, or the current holder's lease has expired? An exactly-expired lease MUST\n/// be claimable (`<=`, not `<`): the waker is a SINGLE role, so a claim that\n/// stalls on the boundary leaves every evicted cell's alarm unwoken until\n/// some other node happens to reclaim.\npub fn waker_may_claim(held_by_us: bool, expires_ms: Ms, now_ms: Ms) -> bool {\n held_by_us || expires_ms <= now_ms\n}\n\n/// The elected waker's decision for one due entry once it has read the\n/// cell's owner record: does this node need to send the `Fleet` hint?\n///\n/// A live owner fires its own alarms. A resident cell fires from the owner's\n/// timer, and a dormant one wakes from the owner's own due scan, which sends\n/// it an `Owned` hint. The elected waker's hint is for everything else: a\n/// cell nobody owns, a cell whose owner's lease has run out, and a cell this\n/// node owns itself. Hinting a live owner's cell risks nothing (the core never\n/// steals), but it costs the elected node an activation permit and an owner\n/// read per entry, for the whole fleet's due set, every tick.\npub fn elected_hint_needed(owner: Option<&str>, node: &str, owner_live: bool) -> bool {\n match owner {\n None => true,\n Some(owner) if owner == node => true,\n Some(_) => !owner_live,\n }\n}\n","editable",false,"branch","documentNavigation","repo","denoland/celld","repoId","a23b8a10-92cf-4dc4-a7ab-a04e58298dde","ownerId","org:42048915","organization",true,"site","nexthub","private","admin","settings","maintainer","triage","starred","stars",1,"watchers","watching","pinned","notify","views",[135,136,137,138,139,140,141,142,143,144,145,146,147],"navigation",{"_57":58,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_103":104},"sources",[],"viewer","meta",{"_85":86,"_87":88,"_89":90,"_45":32,"_91":14,"_92":32,"_51":52,"_53":52},"branches",[14],"tags",[72,73,74,75,76,77,78,79,80,81,82,83,84],"cloneUrl","https://git.nexthub.sh/denoland/celld.git","v0.0.1","v0.0.2","v0.1.0","v0.2.0","v0.2.1","v0.3.0","v0.4.0","v0.4.1","v0.5.0","v0.5.1","v0.6.0","v0.6.1","v0.6.2","description","self-hosted, distributed Durable Objects","owner","denoland","section","","head","empty","pins",[118,119,120],"documents",{"_113":114,"_115":116},"code",{"_110":111,"_112":106},"automations",{"_108":52,"_109":-5},"delivery",{"_105":106,"_107":-5},"tag","7gTA52Z9a1vO6FP6eCQPix9zO4O","releases",0,"applications","workflows","deployments","commits",13,"changes","counts",{"_117":116},"total",38,"issue",{"_121":112,"_123":133,"_15":112,"_125":134,"_55":42,"_127":32,"_128":42,"_129":106},{"_121":130,"_123":131,"_15":130,"_125":132,"_55":42,"_127":32,"_128":42,"_129":106},{"_121":122,"_123":124,"_15":122,"_125":126,"_55":42,"_127":32,"_128":42,"_129":116},"id","issues","name","Issues","filters",{},"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_121":112,"_123":133,"_15":112,"_125":178,"_55":42,"_127":32,"_128":42},{"_121":130,"_123":131,"_15":130,"_125":177,"_55":42,"_127":32,"_128":42},{"_121":122,"_123":124,"_15":122,"_125":176,"_55":42,"_127":32,"_128":42},{"_121":173,"_123":174,"_15":173,"_125":175,"_55":32,"_127":32,"_128":42},{"_121":170,"_123":171,"_15":170,"_125":172,"_55":32,"_127":32,"_128":42},{"_121":108,"_123":168,"_15":99,"_125":169,"_55":32,"_127":32,"_128":42},{"_121":109,"_123":165,"_15":166,"_125":167,"_55":32,"_127":32,"_128":42},{"_121":105,"_123":163,"_15":105,"_125":164,"_55":32,"_127":32,"_128":42},{"_121":159,"_123":160,"_15":161,"_125":162,"_55":32,"_127":32,"_128":42},{"_121":95,"_123":157,"_15":95,"_125":158,"_55":32,"_127":32,"_128":32},{"_121":154,"_123":155,"_15":154,"_125":156,"_55":32,"_127":32,"_128":32},{"_121":151,"_123":152,"_15":151,"_125":153,"_55":32,"_127":32,"_128":32},{"_121":148,"_123":149,"_15":148,"_125":150,"_55":32,"_127":32,"_128":32},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794646712642,"sidebar","expanded"]