Module recovery 

A disaster-recovery drill, judged: which records the capture had to hold, which it lost, and how long recovery took.

A drill runs a contract’s load against a source cluster, captures the restore inputs while the load runs, keeps the load going for the declared post_capture_load, and then loses the whole source cluster. A fresh cluster is restored from the capture alone, and the records are read back.

The capture boundary is the instant the capture started. Every record the source acknowledged before it must be restored: bound_evidence cuts each producer’s ledger there, so the reconciler reports a missing one as lost, by the same rules as a soak. A record acknowledged after the boundary may or may not be restored, which is exactly how the reconciler already treats a send whose outcome is unknown. The ones that are missing are the drill’s data loss: PathRecovery counts them, and the recovery point is the age, at the loss, of the oldest acknowledged record that did not come back.

check_recovery holds the measured recovery point and recovery time against the contract’s RecoveryObjectives.

Structs

Ack

When one send was acknowledged.

Boundary

The two instants a drill is measured from.

CommitAck

One commit the group coordinator acknowledged.

CommitHistory

One committing group’s acknowledged commits.

LoadRecord

What a drill’s load recorded against the source cluster, before the loss.

PathRecovery

How one path came through the loss.

ProducerAcks

One producer’s acknowledgement times.

RecoveryEvidence

The recovery half of a drill’s evidence.

RecoveryVerdict

A drill’s recovery point and recovery time, held against its objectives.

RestoredReadings

What the restored cluster served, after the loss.

Functions

acknowledged_by

The records of acks acknowledged at or before instant.

bound_evidence

The evidence the judge grades a drill by.

check_recovery

Judge a drill’s recovery against the contract’s objectives. None for a contract that is not a drill.

committed_by

The last commit of each partition acknowledged at or before instant.

path_recovery

How ledger’s path came through the loss, given when each of its sends was acknowledged and what the restored cluster’s readers found.