Class ConsensusBackup

java.lang.Object

org.j7m.middleware.consensus.ConsensusBackup

public final class ConsensusBackup
extends Object

Durable, quorum-consistent Raft backup and fresh-generation restore. Export captures a committed application checkpoint, electorate/joint transition and request-identity journal under the hosting node's apply lock after a fresh quorum barrier; it never copies mutable live files. Restore validates the entire bundle and an independent application candidate before creating the target directory. The caller must fence the old application endpoints before routing traffic to a recovery generation. Backups contain sensitive application state and must remain in protected storage; checksums detect corruption and do not replace storage authorization or authenticated provenance.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	ConsensusBackup.Metadata	Immutable verified recovery metadata; resource internals remain opaque.

Method Summary

Modifier and Type	Method	Description
static ConsensusBackup.Metadata	export(NetworkConsensusNode node, Path destination, String schema, Instant deadline)	Exports an immutable backup directory, atomically published after all data and manifest fsyncs.
static ConsensusBackup.Metadata	inspect(Path backup, String expectedSchema)	Verifies manifest, checksum, bounded schema and checkpoint recovery metadata without mutation.
static ConsensusBackup.Metadata	restore(Path backup, NetworkConsensusConfig target, String expectedSchema, long minimumIndex, Supplier<? extends ReplicatedStateMachine> applicationFactory)	Restores a backup to a fresh, offline directory and a new consensus group generation.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

export

public static ConsensusBackup.Metadata export(NetworkConsensusNode node,
 Path destination,
 String schema,
 Instant deadline)
                                       throws IOException

Exports an immutable backup directory, atomically published after all data and manifest fsyncs. Destination must not exist. Concurrent writes may continue after the captured barrier.

Parameters:

node - live current leader with healthy quorum

destination - fresh backup directory with an existing parent

schema - explicit application schema, bound into the manifest

deadline - quorum-barrier deadline; expiry never rolls back already committed source work

Returns:

verified published metadata

Throws:

IOException - on quorum failure, corruption, unsupported filesystem or publication failure

IllegalArgumentException - for invalid schema or destination

inspect

public static ConsensusBackup.Metadata inspect(Path backup,
 String expectedSchema)
                                        throws IOException

Verifies manifest, checksum, bounded schema and checkpoint recovery metadata without mutation.

Parameters:

backup - published backup directory, never a symlink

expectedSchema - required exact application schema

Returns:

verified metadata

Throws:

IOException - for corrupt, unsupported or incompatible backup

IllegalArgumentException - for invalid schema

restore

public static ConsensusBackup.Metadata restore(Path backup,
 NetworkConsensusConfig target,
 String expectedSchema,
 long minimumIndex,
 Supplier<? extends ReplicatedStateMachine> applicationFactory)
                                        throws IOException

Restores a backup to a fresh, offline directory and a new consensus group generation. Electorate IDs and request identities are preserved; endpoints/credentials are supplied by the target configuration. The new group identity prevents old peer frames from joining recovery. Application snapshot compatibility is established by an independent factory candidate; no unknown resource schema is inferred. The old service/routing generation must be fenced first.

Parameters:

backup - immutable published backup directory

target - fresh node configuration; groupId must differ from the source generation

expectedSchema - exact supported application snapshot schema

minimumIndex - smallest acceptable committed recovery index, preventing stale-backup downgrade

applicationFactory - trusted factory producing a fresh application validator, never a live resource

Returns:

verified metadata of the restored source image

Throws:

IOException - if validation fails, target exists or atomic durable publication fails

IllegalArgumentException - for invalid floor, factory or incompatible generation/membership