Struct PerSsaState 

struct PerSsaState {

    ssa_id: SsaId<HoprPseudonym>,
    batch_id: u32,
    phase: SsaPhase,
    commitment_deadline: Option<Instant>,
    recommit_deadline: Option<Instant>,
    recommit_attempts: u8,
    deposit_deadline: Option<Instant>,
    recovery_idle_deadline: Option<Instant>,
    recovery_hard_deadline: Option<Instant>,
    deposit_uhopr: u64,
    phase_entered_at: Instant,
    largest_useful_shares: u64,
    largest_shares_seen: u64,
    target_useful_shares: u64,
    recovered_polynomials: u16,
    next_request_pending_deposit: bool,
    next_requested: bool,
    is_batch_last: bool,
    recovered_pending: bool,
    served_total_at_last_progress: u64,
    served_total_at_front: Option<u64>,
}

Internal state for one supervised SSA.

Fields

ssa_id: SsaId<HoprPseudonym>

batch_id: u32

First SSA index allocated in this request batch.

phase: SsaPhase

commitment_deadline: Option<Instant>

recommit_deadline: Option<Instant>

When to re-request the parts of this commitment that have not arrived, or None while there is nothing to ask for.

Set only once some of the commitment has arrived, and pushed out by every further part, so it measures silence in the delivery rather than elapsed time. A cycle for which nothing was ever delivered leaves it unset and dies on commitment_deadline, which is all the Exit can do about one: it has no scope to name.

recommit_attempts: u8

Re-requests already made for this cycle, capped at MAX_COMMITMENT_RETRANSMISSIONS.

The cap is a count and not a duration on purpose. commitment_deadline bounds the asks in time, which is what protects the Entry, but the packets they cost are this node’s own: at a misconfigured millisecond interval inside a 20-second deadline the time bound alone permits twenty thousand of them. Matching the figure the Entry will answer means none of the asks is wasted either.

deposit_deadline: Option<Instant>

recovery_idle_deadline: Option<Instant>

recovery_hard_deadline: Option<Instant>

deposit_uhopr: u64

What the Entry deposited for this cycle, in µHOPR, or zero until the deposit confirms.

phase_entered_at: Instant

When phase was entered, for hopr_pix_cycle_phase_seconds.

largest_useful_shares: u64

largest_shares_seen: u64

Largest shares_seen observed for this cycle — the liveness counter, which moves for surplus shares too. Also the staleness discriminator for snapshots, since it moves for every share while largest_useful_shares does not.

target_useful_shares: u64

recovered_polynomials: u16

next_request_pending_deposit: bool

next_requested: bool

is_batch_last: bool

Set on the last cycle allocated by SessionPixSupervisor::emit_request_next_ssa, and only on that one.

The successor gate: a batch asks for its replacement once, when its last cycle is nearly recovered. Every other flag here is per-cycle, so without this one each member of a batch would answer its own AlmostRecovered with a whole batch of its own — ssas_per_request batches per batch, compounding, each cycle a separate on-chain deposit for the Entry.

The last cycle rather than the first because the batch is served in index order: gating on the first would ask for the successor a whole batch too early, which is the exposure ssas_per_request deliberately bounds.

If the two-generation admission bound defers that request, next_requested remains set and the supervisor-level successor_request_deferred flag owns the retry; the gate must not be handed to another cycle and spend the request twice.

recovered_pending: bool

Set when Recovered arrives before deposit confirms (i.e. during AwaitingCommitment or AwaitingDeposit). Once deposit is confirmed and the SSA enters Recovering, this flag triggers an immediate tombstone transition — replaying the deferred Recovered event.

served_total_at_last_progress: u64

served_total_at_front: Option<u64>

The Session’s served count when this cycle reached the front of the batch, or None while it is still queued behind one.

Subtracted from the served count at finalization to give the cycle’s own egress. Baselined at the front rather than at the request, because a queued cycle is not being served: the Entry’s emission window is clamped to one cycle, so charging a batch member for everything its predecessors consumed would report the last cycle of a batch as having cost the whole batch. None on a cycle that never reached the front is therefore the honest answer, and it is reported as zero egress rather than as the Session’s whole history.

Implementations

impl PerSsaState

fn new( ssa_id: SsaId<HoprPseudonym>, batch_id: u32, target_useful_shares: u64, now: Instant, ) -> Self

fn enter_phase( &mut self, phase: SsaPhase, now: Instant, ) -> Option<(PixCyclePhase, u64)>

Moves to phase, returning how long the outgoing one lasted in milliseconds.

None for an outgoing Recovered or Closing, which have no PixCyclePhase label — both are retained state rather than live state, so neither is measured.

fn telemetry_summary( &self, outcome: PixCycleOutcome, served_total: u64, ) -> PixCycleSummary

This cycle’s coverage, for the histograms observed once when it finalizes.

fn is_terminal(&self) -> bool

True if this SSA is past the recovery phase.

impl PerSsaState

fn check_deadlines(&self, now: Instant) -> Option<SessionPixCloseReason>

Check which deadline expired, if any.