admission

type Decision struct {
	Admit  bool
	Status int           // HTTP status when !Admit (402 | 403 | 429 | ...)
	Reason string        // machine token for the response header
	Retry  time.Duration // suggested Retry-After (0 => none); rendered by the outlet
}

type Lease struct {
	// contains filtered or unexported fields
}

type NopProvider struct{}

type Provider interface {
	// Decide returns the suspend/enable decision for a tenant slug. An
	// unknown tenant (no row) and the system tenant are always admitted.
	Decide(tenant string) Decision
	// AllowRate reports whether the tenant is under its node-local rate
	// limit; retry is a suggested Retry-After when denied. No limit
	// configured (rps==0) / unknown tenant => allow.
	AllowRate(tenant string) (allow bool, retry time.Duration)
	// AcquireConcurrency takes a node-local concurrency slot for the
	// tenant, registering its release on lease. No limit (cap==0) / unknown
	// tenant => admit without taking a slot. Returns false when at capacity.
	AcquireConcurrency(tenant string, lease *Lease) bool
}

type TenantRuntimeState struct {
	Enabled    bool
	Suspended  bool
	DenyStatus int    // HTTP status to render when denied; 0 => default 403
	DenyReason string // short machine token surfaced as a response header

	// Phase 2 — node-local operational limits. 0 => unlimited.
	RateLimitRPS     float64 // resolved per-second rate (may be fractional, e.g. 50/min => 0.833)
	RateBurst        int     // token-bucket size (max burst); defaults to ceil(2*rps) upstream
	ConcurrencyLimit int     // max simultaneous in-flight requests
}