Module coverage 

Gap-aware per-sink write coverage: CoverageStore, CoveredRange, and an InMemoryCoverage backend.

Coverage records which source positions have been durably written to which sink, as a set of half-open ranges per (sink, topic, partition), so a hole in the middle (batch 3 failed while 1, 2, 4, 5 landed) is representable — a high-water mark cannot express that and would lose batch 3 silently.

Two invariants from the crate design, enforced here:

• Merge by union, never last-write-wins. Two writers during a rebalance both record the ranges they actually wrote; the union is the truth. LWW would discard one writer’s ranges — the over-claim the design forbids.
• Record only after durable acknowledgement. The store cannot enforce when it is called, but its contract is that record follows the sink’s durable ack, so coverage may lag, never lead (ADR-0053).

Structs

CoveredRange

A half-open covered range [start, end) of source positions.

InMemoryCoverage

A pod-local, in-memory coverage store. Real deployments back this with a durable store colocated with raw (ADR-0053); this is the local write-behind tier and the test/reference implementation. Union-merge semantics are the same regardless of backing.

Enums

CoverageError

Errors a coverage backend can return.

Traits

CoverageStore

Per-sink write coverage: record durably-written spans, read covered ranges, and compute the gaps recovery must replay.