Struct BatchLease 

pub struct BatchLease { /* private fields */ }

A non-cloneable allocation capability, returned only after durable creation.

Holding a BatchLease means “this batch number is burned on disk and is mine alone”. It deliberately does not derive Clone or Copy: the only thing you can do with it is spend it once, in Self::prepare. Dropping it without preparing simply wastes the batch number, which is safe.

Implementations

impl BatchLease

pub fn reserve( directory: &Path, signer: [u8; 32], epoch: u64, batch_id: u64, ) -> Result<Self>

Atomically reserve a fresh batch in an existing, trusted journal directory.

Errors

Duplicate IDs, a zero or range-mode epoch, missing/unwritable directories or durability failures return an error. A record left behind by any failure stays burned. Range allocation uses a disjoint epoch namespace, preventing a single lease from overlapping any RangeLease.

Arguments: directory is the journal (it must already exist and be persistent); signer is the 32-byte Ed25519 public key; epoch and batch_id name the batch. On success the record dsig-v1-<signer hex>-<epoch hex>-<batch hex>.lease exists on stable storage and will stay there forever.

pub fn record(&self) -> &Path

Permanent public record path, possibly covering an entire fixed range. Dropping this permit never removes or reopens its record.

pub fn prepare( self, master_seed: [u8; 32], signer: &SigningKey, ) -> Result<PreparedBatch>

Consume the lease before preparing keys. Identity mismatches burn it too.

Errors

Returns an error if the supplied signing key is not the reserved identity.

Takes self by value, so the lease is gone after this call whether it succeeds or fails: a batch can be prepared at most once. master_seed is the 32-byte secret from which the batch’s 128 one-time keys are derived (see PreparedBatch::new); this function wipes its own copy before returning and never writes it anywhere.