Replication journal

When configuration selects availability.mode = "dc" or "ha", the OCI implementation records each authoritative metadata mutation through the replication-journal capability. The journal entry and the rows it describes commit in one redb write transaction. A replica cannot observe a manifest, tag, or membership change without its matching entry. For the design pattern, see the transactional outbox pattern; for the mutations themselves, see the distribution specification.

Journal contents

One journal serves the whole node, so each record names the vocabulary that wrote it: an OCI mutation carries the oci-op tag, and a reader takes the records carrying its own tag and passes over the rest. A tag key another writer could plausibly choose would let a reader claim records it cannot apply.

A hosted push or delete records one typed operation:

• publish-manifest records a manifest stored under a repository and includes the tag when the push named one. Manifests are content-addressed and immutable, so publishing a manifest and repointing a tag are distinct operations: retargeting a tag changes no bytes but is a mutation a replica applies in order.
• mount-blob records a blob admitted to a repository's membership, whether pushed directly or mounted from another repository.
• unmount-blob records a blob deletion removing one repository's membership and releasing its quota allocation. Blob deletion is not soft: the distribution specification drops the repository link outright. The bytes stay, so another repository that links the same digest keeps serving it. A replica that has already dropped the membership applies the entry again without effect.
• trash-tag and trash-manifest record a soft delete moving a tag, or a digest and each tag that pointed at it, into repository trash. A trash-manifest entry names the captured tags so a replica trashes the same set.
• restore-tag and restore-manifest record a restore and name the restored tags. A replica restores those whose live slot was free.

Journal exclusions

A replica reconstructs proxy cache state by pulling upstream. The journal omits cache fills, tag freshness, and cache evictions after an upstream 404. A replica also rebuilds referrer descriptors from the pushed manifest bytes in the publish-manifest entry.

none mode

availability.mode = "none" installs no distributed availability resources or journal writer. OCI mutations commit locally and create no journal entry. Configuration selects the mode for the process lifetime.