runtime

type ClusterMemberGC struct {
	Repo ClusterMemberGCRepo

	// TTL: a member unheard-from for longer than this is reclaimed.
	TTL time.Duration

	Interval     time.Duration
	IdleInterval time.Duration

	// OnSwept is an optional metrics observer (sweep, n>0). nil → no-op. Off the hot path.
	OnSwept func(sweep string, n int64)
}

type ClusterMemberGCRepo interface {
	GCStaleClusterMembers(ctx context.Context, ttl time.Duration) (int, error)
}

type ClusterMemberReporter struct {
	Repo ClusterMemberReporterRepo

	// Info is the static per-process payload, gathered once at construction.
	Info store.ClusterMemberInfo

	// InFlight returns the member's current in-flight task count for the beat.
	// nil on a control-only member (no dispatcher) → reported as 0.
	InFlight func() int

	// Shards, when set, is the live source of this member's owned span: each
	// beat reads its current [lo, hi] bounds and stamps Info.Shards before the
	// UPSERT, so the registry's `shards` column tracks DYNAMIC reassignment
	// (the Resharder swaps the same ShardSet). nil → Info.Shards is reported
	// as-is (static/explicit-override members, and the unit tests).
	Shards *ShardSet

	// Workers, when set, is the live source of this member's connected-worker
	// snapshot: each beat calls it and writes the result to the workers JSONB
	// column, so the cluster view tracks dumb workers connecting/dropping. A
	// broker wires it to its ConnectedWorkers snapshot; nil (control/react members
	// and the unit tests) → the column is written "[]". Distinct from the STATIC
	// Info.Config (connect_addr + runtime knobs), which never changes across beats.
	Workers func() json.RawMessage

	// Interval is the beat cadence (default 30s — 3 beats inside the API's 90s
	// NotReady window, well under the GC's 5m TTL).
	Interval time.Duration
	// contains filtered or unexported fields
}

type ClusterMemberReporterRepo interface {
	UpsertClusterMember(ctx context.Context, info store.ClusterMemberInfo, inFlight int, workers json.RawMessage) error
	DeleteClusterMember(ctx context.Context, memberID string) error
}

type Dispatcher struct {
	// Loop bundles the shared execution deps (Pool/Repo/Registry/BrokerID)
	// the runOne… methods read; embedded so the dispatcher reuses Repo for
	// claims + heartbeats and BrokerID/Pool for the pod's single identity.
	*Loop

	HeartbeatEvery time.Duration
	// RequireWithin bounds how stale a worker's per-task liveness attestation may be
	// for the dispatcher to keep heartbeating that task's lease. A task whose worker
	// stopped attesting (silent connection or a wedged handler on a live one) past
	// this window drops out of the refresh set, so its heartbeat_at goes stale and
	// the reaper reclaims it — making heartbeat_at attest live-WORKER execution, not
	// mere broker liveness. Kept comfortably under the reaper's StaleAfter (≥ 2×) so
	// broker-clock skew can't cross it. 0 (the in-process default, where the executor
	// IS the worker) disables the gate: every in-flight task is refreshed.
	RequireWithin time.Duration

	PollMin time.Duration
	// PollMax is the dispatcher's DEEP-IDLE backoff ceiling, shared by every
	// pair: the work_ready NOTIFY carries cascade-re-pend latency, so the poll is
	// only a failsafe sweeper. One pod-level knob (not per pair) — every pair
	// backs off to the same ceiling; a real per-pair need has never appeared.
	PollMax time.Duration
	// DrainGrace is the graceful in-flight drain window on shutdown: when Run's ctx
	// is cancelled, claiming stops but already-claimed tasks (and a broker's parked
	// dispatchStage awaiting a worker's Complete) finish for up to this long before
	// being cancelled. 0 → cancel in-flight at once with ctx.
	DrainGrace time.Duration
	// HotWindow keeps an idle dispatcher sweeping at PollMin for this long after
	// the last activity (claim/completion/wake) before the idle backoff is
	// allowed to grow toward PollMax. Bounds the cost of a coalesced/dropped
	// work_ready NOTIFY to one PollMin instead of the full failsafe backoff.
	HotWindow time.Duration

	// Shards is the pod's CURRENT claim range, read lock-free every sweep via
	// Shards.Snapshot(). A *ShardSet (not a plain []int16) so the Resharder can
	// swap the range at runtime when cluster membership changes; the dispatcher
	// picks up the new range on its next sweep with no restart.
	Shards *ShardSet

	// ClaimGate, when non-nil, is consulted per (kind, kindVersion, task_type) each
	// sweep: a (kind, kindVersion) it rejects is NOT claimed this sweep. The BROKER tier
	// sets it to "is a worker for this (kind, kindVersion) connected?", so a broker
	// never pulls work it can't deliver (the rows stay worker_id IS NULL for
	// another broker / a later poll — no buffer fill, no stranding). A pinned kindVersion
	// whose worker fleet retired parks safely (visible via the zero-worker signal),
	// never mis-routes. nil → claim always (in-process default).
	ClaimGate func(model.Kind, int) bool
	// contains filtered or unexported fields
}

type DispatcherRepo interface {
	// Claim / lease lifecycle.
	WorkQueueTakeBatch(ctx context.Context, kind model.Kind, kindVersion int, taskType store.TaskType, brokerID string, limit int, shards []int16) ([]store.WorkTask, error)
	WorkQueueHeartbeat(ctx context.Context, ids []uuid.UUID, epochs []int64, lo, hi int16) error
	WorkQueueReleaseBroker(ctx context.Context, brokerID string) (int64, error)
	WorkQueueIncrementAttempts(ctx context.Context, id uuid.UUID, shardID int16) error

	// Reaction reads + rollup gate.
	GetComposedGen(ctx context.Context, id uuid.UUID) (int64, error)
	ListDescendants(ctx context.Context, rootID uuid.UUID) ([]store.ResourceRow, error)
	DescendantsSettled(ctx context.Context, rootID uuid.UUID) (bool, error)
	GetOperation(ctx context.Context, id uuid.UUID) (store.ResourceOperation, error)

	// Writes.
	AppendOutbox(ctx context.Context, a store.OutboxAppend) error
	EmitEvent(ctx context.Context, e store.Event) error
	ApplyComposeResult(ctx context.Context, parentID uuid.UUID, parentGeneration int64, workID uuid.UUID, claimEpoch int64, manifestVersion int64, children []model.ChildSpec, edges []model.DepEdge, configs []model.ProviderConfigSpec, pol store.ComposePolicy) (store.ComposeCounts, error)
	ArmScheduleRecheck(ctx context.Context, candidateIDs []uuid.UUID) error
	AnalyzeComposeTables(ctx context.Context) error

	// WithTx returns a DispatcherRepo whose queries run inside tx (the compose
	// fence). The concrete store's WithTx returns *store.Store; dispatcherRepo
	// (loop.go) adapts it to this interface.
	WithTx(tx pgx.Tx) DispatcherRepo
}

type Drainer struct {
	Repo      DrainerRepo
	Listener  Listener // outbox_ready + rollup_recheck wake subscriptions
	Interval  time.Duration
	BatchSize int

	IdleInterval time.Duration
	HotWindow    time.Duration

	// Shards is the control pod's CURRENT drain range, read lock-free each tick
	// via Shards.Snapshot(). A *ShardSet so the Resharder can swap it at runtime
	// on membership change; each band recomputes its sub-slice from the new
	// snapshot on its next tick (snapshot-pointer-cached so an unchanged range
	// costs one pointer compare).
	Shards      *ShardSet
	WorkerCount int
}

type DrainerRepo interface {
	DrainOutboxBatch(ctx context.Context, limit int, shards []int16) (int, error)
	// DrainRollupRechecks re-pends, at a fresh snapshot, the straddled rollup
	// roots the cascade queued in rollup_recheck — the deferred half that closes
	// the rollup straddle race. Empty + cheap on the common no-straddle path.
	DrainRollupRechecks(ctx context.Context, limit int, shards []int16) (int, error)
	// DrainScheduleRechecks schedules a band-scoped batch of the children a wide
	// compose armed in schedule_recheck (OPT-A) — the deferred, drain-paced
	// replacement for the post-commit ScheduleEligible that deadlocked. Empty +
	// cheap once a compose's children are all scheduled.
	DrainScheduleRechecks(ctx context.Context, limit int, shards []int16) (int, error)
}

type KindManifestCache struct {
	// contains filtered or unexported fields
}

type Lease struct {
	WorkID   uuid.UUID
	ShardID  int16
	BrokerID string
	// KindVersion is the claimed row's work_queue.kindVersion — denormalized from the
	// NOT-NULL resources.kind_version at schedule time, so it is always >= 1 (there is
	// no normalize-to-1 step). The broker reads it to route the resulting StageTask to a
	// worker/peer advertising the EXACT (kind, kindVersion); in-process executors ignore it.
	KindVersion int
	// ClaimEpoch is the strict monotonic fencing token this claim carries
	// (work_queue.claim_epoch). It rides the StageTask to the worker and is echoed on
	// the result; the fenced result write (AppendOutbox / StampComposedGen) lands only
	// if the row still bears this epoch. The broker carries it here so the fenced write
	// is owner-independent — the epoch, not the broker identity, is the gate.
	ClaimEpoch int64
	// ManifestVersion is the kind_manifest content hash this claim was enqueued under
	// (work_queue.manifest_version), carried so the compose/result fence checks it
	// without re-reading the lease. 0 = pre-manifest (inert).
	ManifestVersion int64
}

type Listener interface {
	// Listen runs a resilient LISTEN loop on channel until ctx is cancelled,
	// calling onNotify for each notification and reconnecting (with backoff) on
	// any connection error. name tags the reconnect log line. onReady (optional;
	// pass 0 or 1) fires ONCE per successful (re)subscribe, right after the LISTEN
	// registers and BEFORE any notification is awaited — callers use it for a
	// catch-up read that closes the subscribe-vs-read race.
	Listen(ctx context.Context, name, channel string, onNotify func(), onReady ...func())
}

type Loop struct {
	// Tx opens the compose-fence transaction (ApplyComposeResult in one tx via
	// Repo.WithTx). A narrow txBeginner, not the concrete pool — the dispatch
	// core depends on the transaction capability, not the substrate.
	Tx       txBeginner
	Repo     DispatcherRepo
	Listener Listener // work_ready wake subscription
	BrokerID string

	// Dispatch runs a kind's reaction handler: a broker ships it to a dumb worker
	// via its remote fanout executor; the integration test harness injects an
	// in-process executor (test/internal/inproc) that runs handlers directly from a
	// ReactionRegistry. The DB reads/writes around every reaction (gate reads,
	// ApplyComposeResult, ListDescendants, AppendOutbox, …) stay on this
	// lease-holder. nil → the fail-closed noHandlerExecutor (a task fails
	// transiently and re-arms; production always installs the fanout via SetDispatcher).
	Dispatch model.StageDispatcher

	// Manifests is the kind_manifest cache: dispatch reads a kind's reactions
	// from it (selected by Trigger+Emits) to drive the reaction engine. Required —
	// a kind with no manifest can't be dispatched (the task fails loudly).
	Manifests *KindManifestCache

	// MarkLocal, when set, flips a task's in-flight record to local at the moment this
	// pod's OWN goroutine starts the post-Complete apply phase (ApplyComposeResult) — so
	// the long local apply is exempt from the worker-attestation staleness gate and can't
	// reap its own lease mid-apply. Until then the task is worker-attested (kept fresh by
	// the remote worker's WorkHeartbeat), so a never-delivered task correctly lapses and
	// the reaper re-dispatches it. Wired by the Dispatcher to inFlight.markLocal; nil on
	// the in-process test path (whose staleness gate is disabled anyway).
	MarkLocal func(id uuid.UUID)

	// RemoteFanoutCeiling bounds a task whose kind set NO TaskDeadline (the common
	// default) when the executor is REMOTE (a broker fanning out to a dumb
	// worker): such a task otherwise parks the dispatchStage goroutine + its
	// pair.inFlight slot indefinitely if the worker wedges-but-stays-connected (the
	// stream never drops, so the abandon-on-disconnect path can't fire and the DB
	// heartbeat keeps the lease un-reapable). A broker sets this to a generous
	// ceiling (well above the slowest legitimate handler) so a wedged remote task
	// is eventually cancelled via the proven WithTimeout/orphan path below and its
	// slot freed. 0 (the default, and the in-process executor) = unbounded, exactly
	// as before — the in-process dispatch is synchronous and frees its own slot, so
	// it never needs this.
	RemoteFanoutCeiling time.Duration
}

type NotifyRefresher struct {
	// contains filtered or unexported fields
}

type PgxListener struct {
	// contains filtered or unexported fields
}

type ProviderConfigCache struct {

	// OnDefaultChange, if set, is invoked (once) after a reload in which at least
	// one default config CHANGED (spec OR data). Called from the plane's loop
	// goroutine, so it must not block.
	OnDefaultChange func()

	// OnKindConfigChange, if set, is invoked ONCE PER (kind, kindVersion) whose default
	// providerconfig changed in a reload — on EITHER axis (spec or bundle) — with the
	// (kind, kindVersion) and its NEW spec + data (nil = that half absent/deleted). A
	// providerconfig is a MONOLITH of {spec, data}, so it changes and pushes as one: the
	// broker wires this to push the whole thing down every connected worker serving that
	// exact (kind, kindVersion) (the PUSH half of worker config delivery), so an
	// operator's edit reaches workers immediately rather than on their poll — and a v2
	// edit never lands on a v1 worker. Called from the plane's loop goroutine, so it must
	// not block.
	OnKindConfigChange func(kind model.Kind, kindVersion int, spec, data []byte)
	// contains filtered or unexported fields
}

type ReactorDispatcher struct {
	Repo     ReactorRepo
	Listener Listener // lifecycle_ready wake subscription
	// Dispatch is the seam that runs a kind's lifecycle reaction. In production a
	// broker installs its remote executor that ships the reaction to a worker; the
	// integration test harness injects an in-process executor (test/internal/inproc)
	// that runs handlers directly from a ReactionRegistry. Nil falls back to the
	// fail-closed noHandlerExecutor via dispatcher() — a delivery then fails
	// transiently and is retried, never lost.
	Dispatch model.StageDispatcher
	BrokerID string

	Interval     time.Duration
	IdleInterval time.Duration
	HotWindow    time.Duration
	// DrainGrace is the graceful in-flight drain window on shutdown: when Run's ctx
	// is cancelled, claiming stops but in-flight deliveries finish for up to this
	// long before cancellation. 0 → cancel in-flight at once with ctx.
	DrainGrace time.Duration
	BatchSize  int

	// MaxParallel bounds concurrent reactor invocations per tick — an external
	// upload/POST holds a goroutine, so cap the blast radius (the high-risk
	// outbound path). 0 → a sensible default.
	MaxParallel int

	// HeartbeatEvery refreshes this pod's in-flight claims so a slow reactor
	// (a long upload/POST) isn't reaped mid-delivery and double-fired. Pairs with
	// the Reaper's short LifecycleStaleAfter: the stale window must exceed this
	// cadence. 0 → a sensible default.
	HeartbeatEvery time.Duration

	// Shards is the pod's CURRENT claim range, read lock-free each tick via
	// Snapshot(); the Resharder swaps it on membership change.
	Shards *ShardSet

	// ReadyToDispatch, when set, reports whether a reactor KIND can be delivered
	// right now — on a broker that fans deliveries out to dumb workers, this is
	// the fanout's HasSubscriber, so the dispatcher skips a delivery whose reactor
	// kind has NO connected worker instead of parking it (which would block the
	// per-delivery goroutine until one connects). A skipped delivery is left
	// claimed; its heartbeat goes stale and the reaper re-arms it once a worker is
	// up (at-least-once). nil → always ready (the in-process executor case, where a
	// missing handler surfaces as a Terminal error instead).
	ReadyToDispatch func(kind model.Kind) bool
	// contains filtered or unexported fields
}

type ReactorRepo interface {
	ClaimReactorDeliveries(ctx context.Context, brokerID string, limit int, shards []int16) ([]store.ReactorDelivery, error)
	AckReactorDelivery(ctx context.Context, resourceID uuid.UUID, transition string, generation int64, bindingName string, claimEpoch int64) error
	// HeartbeatReactorClaims refreshes heartbeat_at on the SPECIFIC in-flight deliveries
	// the dispatcher holds (keyed by identity + the claim_epoch each was claimed under)
	// so a slow reactor isn't reaped mid-delivery. Epoch-fenced like the work
	// dispatcher's heartbeat — a row a concurrent claim/reap re-issued (bumped epoch)
	// drops out, so the refresh never 40P01-cycles with the re-claimer. Scoped to the
	// pod's shard range for partition pruning.
	HeartbeatReactorClaims(ctx context.Context, keys []store.ReactorLeaseKey, shards []int16) error
}

type Reaper struct {
	Repo       ReaperRepo
	StaleAfter time.Duration
	RetryAfter time.Duration
	Interval   time.Duration
	BatchSize  int

	// LifecycleStaleAfter is the stale-claim window for lifecycle_outbox reactor
	// deliveries — its own knob so a failed or crashed delivery re-arms for
	// another at-least-once attempt. Safe to be short because the
	// ReactorDispatcher heartbeats its in-flight claims (HeartbeatEvery), so a
	// legitimately slow reactor keeps its lease; only a truly dead/failed
	// delivery goes stale. Must exceed the dispatcher's HeartbeatEvery.
	LifecycleStaleAfter time.Duration

	// UnclaimedDeleteAfter is the GC window for abandoned work: a work_queue row
	// that has sat UNCLAIMED (worker_id NULL) this long is hard-deleted, because
	// nothing ever picked it up — its kind has no worker (provider removed /
	// decommissioned). Distinct from StaleAfter, which RECOVERS a stale CLAIMED
	// row (worker died mid-task); this DROPS a never-claimed one. Deliberately
	// long (default 24h) so a transiently-down fleet has ample time to come back
	// and drain its backlog before anything is reclaimed. 0 disables the pass.
	UnclaimedDeleteAfter time.Duration

	IdleInterval time.Duration

	// OrphanSweepEvery throttles the orphan-grace sweep: it runs every Nth tick,
	// not every tick. frozen_until is an ABSOLUTE deadline baked at stamp time,
	// so a coarse cadence only delays a grace-expired teardown by at most one
	// sweep interval — fine for a window measured in tens of seconds to minutes,
	// and it keeps the sweep's per-tick lock-manager footprint off the hot drain
	// path at 1M scale (where LockManager is already the dominant wait). Default
	// 6 → with Interval=5s that's a sweep ~every 30s. 0/1 = every tick.
	OrphanSweepEvery int

	// Shards is the control pod's CURRENT sweep range, read lock-free each tick
	// via Shards.Snapshot(). A *ShardSet so the Resharder can swap it at runtime
	// on membership change; the reaper picks up the new range on its next tick.
	Shards *ShardSet

	// OnSwept is an optional metrics observer: called with (sweep, n) after a sweep
	// that acted on n rows (n>0). nil → no-op (the generic reaper stays metrics-free;
	// the engine wires this to the OTel sweeper counter). Off the hot path.
	OnSwept func(sweep string, n int64)
	// contains filtered or unexported fields
}

type ReaperRepo interface {
	ReapStaleWork(ctx context.Context, staleAfter time.Duration, limit int, shards []int16) (int, error)
	RequeueFailedAndPending(ctx context.Context, retryAfter time.Duration, limit int, shards []int16) (int, error)
	// RecountInflight rebuilds the per-kind concurrency-cap tally for the
	// reaper's shard range — the self-healing edge of the cap.
	RecountInflight(ctx context.Context, shards []int16) error
	// ReapStaleLifecycle frees lifecycle_outbox claims whose dispatcher stopped
	// heartbeating — the at-least-once backstop for reactor deliveries (the
	// dispatcher's own poll is the primary path).
	ReapStaleLifecycle(ctx context.Context, staleAfter time.Duration, limit int, shards []int16) error
	// DeleteUnclaimedWork hard-deletes work_queue rows unclaimed past deleteAfter
	// — abandoned tasks no worker ever picked up. GC, not recovery: a returning
	// worker's fleet gets a fresh row from requeue_failed_and_pending.
	DeleteUnclaimedWork(ctx context.Context, deleteAfter time.Duration, limit int, shards []int16) (int, error)
	// SweepExpiredOrphans tears down composer-dropped children whose orphan-grace
	// window elapsed without a re-emit (frozen_until < now()): finalizer kinds →
	// soft-delete, leaf kinds → hard delete. The deadline is baked into
	// frozen_until by the composer, so there is no duration arg.
	SweepExpiredOrphans(ctx context.Context, limit int, shards []int16) (int, error)
	// SweepDeletable is the level-triggered backstop for reverse-dependency cascade
	// delete: hard-deletes any deletion_requested row whose finalizers are empty AND
	// that has no remaining owned child AND no remaining dependent, so a marked
	// teardown tree collapses bottom-up (a parent waits for its children/dependents).
	SweepDeletable(ctx context.Context, limit int, shards []int16) (int, error)
}

type Resharder struct {
	Repo   ResharderRepo
	Shards *ShardSet

	// MemberID is THIS process's cluster_members id — the row the assignment is
	// computed for. Must match the ClusterMemberReporter's MemberID so the member
	// ranks itself within its registered role.
	MemberID string

	// Total is the shard-space cardinality the range partitions (NumShards).
	Total int

	// LivenessWindow bounds how recent a peer's heartbeat must be to count as a live
	// member in the tiling — the SAME window the mesh uses for peer routing (both
	// set from the TopologyWatcher), so shard ownership and mesh routing never
	// disagree on who is live. Must be ≫ the member-heartbeat cadence so a slow beat
	// never drops a live peer, and ≤ the GC TTL so an excluded member is also on its
	// way to being reclaimed.
	LivenessWindow time.Duration
}

type ResharderRepo interface {
	AssignMemberShards(ctx context.Context, memberID string, total int, livenessWindow time.Duration) (lo, hi int16, ok bool, err error)
}

type ResyncKind struct {
	Interval  time.Duration
	Recompose bool
}

type Resyncer struct {
	Repo ResyncerRepo

	// Interval is how often the sweeper wakes to look for due rows. It
	// is the resolution of resync timing, not the interval itself — a
	// kind with ResyncInterval=5m is swept on whichever tick first finds
	// its rows older than 5m. Kept coarse so the due-row scan (one
	// indexed query per kind) is cheap relative to real work.
	Interval  time.Duration
	BatchSize int

	// Shards is the control pod's CURRENT sweep range, read lock-free each tick
	// via Shards.Snapshot(). A *ShardSet so the Resharder can swap it at runtime.
	Shards *ShardSet

	// OnSwept is an optional metrics observer (sweep, n>0). nil → no-op. Off the hot path.
	OnSwept func(sweep string, n int64)
	// contains filtered or unexported fields
}

type ResyncerRepo interface {
	RequeueForResync(ctx context.Context, kind model.Kind, resyncAfter time.Duration, limit int, shards []int16, recompose bool) (int, error)
}

type ShardSet struct {
	// contains filtered or unexported fields
}

type ShardSnapshot struct {
	Shards []int16
	Lo, Hi int16
}

type SpecGC struct {
	Repo      SpecGCRepo
	KeepN     int
	Interval  time.Duration
	BatchSize int

	IdleInterval time.Duration

	// Shards is the control pod's CURRENT sweep range, read lock-free each tick
	// via Shards.Snapshot(). A *ShardSet so the Resharder can swap it at runtime.
	Shards *ShardSet

	// OnSwept is an optional metrics observer (sweep, n>0). nil → no-op. Off the hot path.
	OnSwept func(sweep string, n int64)
}

type SpecGCRepo interface {
	GCSpecHistory(ctx context.Context, keepN, limit int, shards []int16) (int, error)
}

type TopologyReactor func(ctx context.Context) (changed bool, err error)

type TopologyWatcher struct {
	Listener Listener // cluster_changed wake subscription (ONE for all reactors)

	// LivenessWindow bounds how recent a member's heartbeat must be to count as
	// live. Reactors that filter by liveness read it (via their own store calls);
	// the watcher itself just hands it to them at registration. Must be ≫ the
	// member-heartbeat cadence so a slow beat never drops a live peer, and ≤ the GC
	// TTL so an excluded member is also on its way to being reclaimed.
	LivenessWindow time.Duration

	// Interval is the failsafe re-run cadence (the NOTIFY handles prompt joins/
	// leaves; this catches a crashed peer whose beat aged out without a DELETE).
	Interval time.Duration

	// DebounceWindow coalesces a BURST of cluster_changed NOTIFYs (a scale event's
	// per-pod INSERT/DELETE) into a SINGLE run on the settled topology, so a 1→50
	// scale-out re-tiles + re-dials once, not N times mid-flux. The failsafe Interval
	// still backstops a crashed peer regardless. 0 ⇒ no debounce (every NOTIFY wakes
	// the loop directly; used by tests).
	DebounceWindow time.Duration
	// contains filtered or unexported fields
}