Module failover 

The failover decision — sticky-primary with a bounded sweep.

The client’s complete() is wrapped: try the active endpoint; on a FAILOVER-CLASS error (connect refused or reset, timeout, HTTP 5xx, 429 that survived the endpoint’s own retry, or a circuit-open skip) advance to the next available endpoint in list order. A non-failover error — 401/403 auth, a 4xx request error, a malformed body — returns immediately, because it would be identical on every endpoint and trying the rest would only burn the run deadline while hiding the real cause. On success, active snaps back to the lowest-index healthy endpoint, so serving from a fallback is temporary by construction.

This module holds the entire selection control flow; the wire, adapter and JSON path sit below it untouched. Each complete_once dials a fresh connection, which is what makes a re-dial safe to attempt at all. The only state kept between calls is the cheap per-endpoint health and breaker record.

Structs

SweepResult

The result of one failover sweep, plus the side-channel of breaker and active-endpoint transitions. The sweep observes these but emits nothing itself; the caller turns them into metrics, events and the agentd://intelligence body, which keeps this module free of observability dependencies.

Enums

FailoverClass

How a single endpoint’s outcome is classified for failover.

Functions

classify

Classify an IntelError for the failover sweep. This decides only whether to try ANOTHER endpoint; the same-endpoint transient retry has already run inside complete_once before an error reaches here, so anything classified Failover has already survived that retry.

complete_resilient

Drive one bounded failover sweep for a single logical complete. The sweep visits at most eps.len() distinct endpoints and each of them at most once, so one complete can never loop over the list.

is_auth

Is this a fatal auth failure (401/403)? The all-down backoff needs to distinguish the two: an auth failure on every endpoint is a misconfiguration and exits 4 immediately rather than entering the backoff loop. Retrying a credential error would mask it as a transient outage and leave the operator with a daemon that looks alive but never works.

is_transient_status

HTTP statuses a same-endpoint retry may clear: a 429 rate-limit or an upstream 5xx blip. This set must stay identical to the failover-class HTTP split in classify, or a status could be retried in place yet refuse to fail over (or the reverse). A non-transient 4xx — bad request, auth — is a caller error that is identical on a re-dial and must surface immediately.