Struct Dfir 

pub struct Dfir<Tick> { /* private fields */ }

An executable DFIR dataflow, as created by dfir_syntax!. Provides the Self::run, Self::run_available, and Self::run_tick family of methods to execute the dataflow.

Design

The inline codegen generates an async move |df: &mut Context| closure that captures dataflow-specific state (handoff buffers, source iterators) and receives the Context (tick counter, metrics) by reference each tick. Dfir owns both the closure and the context, and coordinates tick lifecycle and idle/wake behavior.

We use a single opaque closure rather than generating a bespoke struct per dataflow because:

• The closure naturally captures exactly the state it needs with correct lifetimes
• No codegen needed for struct definitions, field accessors, or initialization
• Rust’s async closure machinery handles the complex state machine (suspend/resume across .await points) that would be very difficult to replicate in a generated struct

The Tick type parameter is bounded by [TickClosure] (not AsyncFnMut directly) to support type erasure via [TickClosureErased] / DfirErased for heterogeneous collections (e.g., the sim runtime storing multiple locations in a Vec). The concrete (non-erased) path used by trybuild and embedded has zero overhead.

Implementations

impl<Tick: TickClosure> Dfir<Tick>

pub fn meta_graph(&self) -> Option<&DfirGraph>

Available on crate feature meta only.

Return a handle to the meta graph, if set.

pub fn diagnostics(&self) -> Option<&[Diagnostic<SerdeSpan>]>

Available on crate feature meta only.

Returns any diagnostics generated by the surface syntax macro.

pub fn metrics(&self) -> Rc<DfirMetrics>

Returns a reference-counted handle to the continually-updated runtime metrics for this DFIR instance.

pub fn current_tick(&self) -> TickInstant

Gets the current tick (local time) count.

pub fn metrics_intervals(&self) -> DfirMetricsIntervals

Returns a DfirMetricsIntervals handle where each call to DfirMetricsIntervals::take_interval ends the current interval and returns its metrics.

The first call to take_interval returns metrics since this DFIR instance was created. Each subsequent call to take_interval returns metrics since the previous call.

Cloning the handle “forks” it from the original, as afterwards each interval may return different metrics depending on when exactly take_interval is called.

impl<Tick: TickClosure> Dfir<Tick>

pub async fn run_tick(&mut self) -> bool

Run a single tick. Returns true if any subgraph received input data.

Checks both handoff buffers (via work_done flag set in generated recv port code) and external events (via can_start_tick set by wakers/schedule_subgraph).

pub fn run_tick_sync(&mut self) -> bool

Run a single tick synchronously. Panics if the tick yields (async suspension). Returns true if work was done (see Self::run_tick).

pub async fn run_available(&mut self)

Available on crate feature tokio only.

Run ticks as long as work is available, then return.

pub fn run_available_sync(&mut self)

Self::run_available but panics if any tick yields asynchronously.

pub async fn run(&mut self) -> Never

Available on crate feature tokio only.

Run forever, processing ticks when work is available and yielding when idle.

impl<Tick: 'static + for<'a> AsyncFnMut(&'a mut Context) -> bool> Dfir<Tick>

pub fn into_erased(self) -> DfirErased

Type-erase the tick closure for use in heterogeneous collections.

Wraps the concrete async closure in [TickClosureErased], which boxes the future returned by each tick call. This adds one heap allocation per tick, but enables storing multiple Dfirs with different closure types in a single Vec.

Only needed for the sim runtime path. The trybuild and embedded paths keep the concrete type and pay no erasure cost.