indexcoord

type Lease struct {
	// contains filtered or unexported fields
}

type LeaseAttribution struct {
	// Matched is true when a job record's identity matches the lease holder.
	Matched bool
	// JobID is the matched job's ID (empty when unmatched).
	JobID string
	// PID is the matched job's recorded process ID (0 when unmatched).
	PID int
	// ProcessAlive is the liveness of PID, evaluated only when Matched.
	ProcessAlive bool
	// JobState is the matched job's last recorded state.
	JobState string
}

type LeaseReport struct {
	IndexSetID  string
	Path        string
	Verdict     LeaseVerdict
	Holder      string
	AcquiredAt  time.Time
	ModTime     time.Time
	Detail      string
	Attribution LeaseAttribution
}

type LeaseVerdict string

type ReclaimReport struct {
	IndexSetID string
	Path       string
	Verdict    LeaseVerdict
	Reclaimed  bool
	Holder     string
}

type RecoverStalledOptions struct {
	AuthorityRoot  string
	Confirm        bool // false = dry-run (byte-preserving plan only)
	WaitTimeout    time.Duration
	PollInterval   time.Duration
	HeartbeatGrace time.Duration
	// Now is ignored when Confirm is true. Mutation authorization always uses
	// the library's production clock so callers cannot forge stall age. Dry-run
	// / plan-only may still use Now for inspection (via PlanManagedStalledRecovery).
	Now time.Time
	// Owner is optional; empty mints a new recovery owner id.
	Owner string
	// Deadline, when non-zero, is the absolute monotonic attempt deadline
	// (D-R13-03). Zero means derive from WaitTimeout at attempt entry.
	// Tests may set an already-expired deadline to prove refuse paths.
	Deadline time.Time
}

type RecoverStalledOutcome string

type RecoverStalledResult struct {
	JobID      string                `json:"job_id"`
	Outcome    RecoverStalledOutcome `json:"outcome"`
	Detail     string                `json:"detail,omitempty"`
	Plan       StalledRecoveryPlan   `json:"plan"`
	DryRun     bool                  `json:"dry_run"`
	Owner      string                `json:"recovery_owner,omitempty"`
	Signalled  bool                  `json:"signalled"`
	ForcedKill bool                  `json:"forced_kill"`
	Reclaimed  bool                  `json:"reclaimed"`
	JobState   string                `json:"job_state,omitempty"`
	LeaseAfter LeaseVerdict          `json:"lease_verdict_after,omitempty"`
}

type StalledPlanClass string

type StalledPlanOptions struct {
	// AuthorityRoot is the set-authority directory used for the lease probe.
	// Required when the job has an IndexSetID; empty skips lease correlation and
	// yields indeterminate once identity otherwise looks stalled.
	AuthorityRoot string
	// Now is the observation clock. Zero means time.Now().UTC().
	Now time.Time
	// HeartbeatGrace is how long a live matching process may go without a
	// heartbeat before becoming suspect. Zero uses DefaultStalledHeartbeatGrace.
	// Values below MinStalledHeartbeatGrace are raised to the floor.
	HeartbeatGrace time.Duration
}

type StalledRecoveryPlan struct {
	JobID             string           `json:"job_id"`
	Class             StalledPlanClass `json:"class"`
	Detail            string           `json:"detail,omitempty"`
	JobState          string           `json:"job_state,omitempty"`
	JobType           string           `json:"job_type,omitempty"`
	PID               int              `json:"pid,omitempty"`
	ProcessAlive      bool             `json:"process_alive"`
	RecordedIdentity  string           `json:"recorded_identity,omitempty"`
	ObservedIdentity  string           `json:"observed_identity,omitempty"`
	IndexSetID        string           `json:"index_set_id,omitempty"`
	LeaseVerdict      LeaseVerdict     `json:"lease_verdict,omitempty"`
	LeaseHolder       string           `json:"lease_holder,omitempty"`
	HeartbeatAge      string           `json:"heartbeat_age,omitempty"`
	HeartbeatGrace    string           `json:"heartbeat_grace,omitempty"`
	HeartbeatWriteErr string           `json:"heartbeat_persist_error,omitempty"`
	// SignalCandidate is true only when every gate for a later recover-stalled recover is
	// satisfied (suspect-heartbeat-overdue). plan-stalled never acts on it.
	SignalCandidate bool `json:"signal_candidate"`
	// MayReapUnheld is true for terminal-contradiction when the lease probe is
	// already unheld/missing — process-stop is not required.
	MayReapUnheld bool `json:"may_reap_unheld"`

	// Auth* is the exact plan-time record snapshot for fence CAS. Recover must
	// pass these unchanged into BeginStalledRecovery — never re-read them after
	// plan. Omitted from JSON (operator surface uses formatted fields above).
	AuthSnapshotOK            bool       `json:"-"`
	AuthState                 string     `json:"-"`
	AuthPID                   int        `json:"-"`
	AuthStartMS               uint64     `json:"-"`
	AuthBootID                string     `json:"-"`
	AuthTokenVersion          int        `json:"-"`
	AuthStartTicks            uint64     `json:"-"`
	AuthStartSec              int64      `json:"-"`
	AuthStartUsec             int64      `json:"-"`
	AuthFiletime              uint64     `json:"-"`
	AuthIndexSetID            string     `json:"-"`
	AuthLastHeartbeat         *time.Time `json:"-"`
	AuthHeartbeatPersistError string     `json:"-"`
	AuthRecoveryOwner         string     `json:"-"`
	AuthRecoveryIntent        string     `json:"-"`
}