Module recovery 

Recovery ownership and bounded replacement attempts for one book.

• BookRecoveryState admits one recovery owner, rejects stale failure reports, and cancels obsolete work. Terminal failure suppresses new claims until the adapter resets the state.
• BookRecovery runs replacement attempts, waits for an accepted snapshot, and applies backoff, attempt limits, and a total elapsed-time budget.
• BookRecoveryOutcome carries pending, accepted, or rejected results from the adapter’s frame handling to the recovery runner.

Recovery Lifecycle

The adapter claims an episode before starting work and supplies the replacement operation, retry classification, and error construction. Each attempt receives a child cancellation token and a closed snapshot gate. The adapter opens the gate after the intended connection confirms the write, then accepts a valid snapshot through BookRecovery::accept. Write completion alone never completes recovery.

Adapters

The adapter serializes claims, snapshot acceptance, and failure reporting under its state lock or owning task. It retains the same episode across reconnects to preserve the remaining budget. Removing or resetting its BookRecoveryState cancels the episode; dropping an attempt cancels that attempt’s child token.

Task spawning, subscription correlation, and book cache updates remain adapter-owned.

Structs

BookRecovery

One recovery episode, retained across reconnects until a snapshot or terminal failure.

BookRecoveryState

Owns a book’s recovery and terminal suppression under its adapter’s state lock.

Enums

BookRecoveryOutcome

Outcome published by an adapter’s snapshot and rejection handling.