Enum RuntimeError 

#[non_exhaustive]
pub enum RuntimeError {
    PolicyDenied(PolicyError),
    PlanContract(String),
    UnknownTenant(String),
    PolicyBundleChanged {
        recorded: Option<Digest>,
        configured: Option<Digest>,
    },
    CanonicalizationChanged {
        recorded: u16,
        implemented: u16,
    },
    NoProvider {
        target: String,
        available: Vec<String>,
    },
    QuotaExceeded(QuotaError),
    ChainBroken {
        seq: Seq,
        detail: String,
    },
    Fenced {
        run: String,
        held: u64,
        current: u64,
    },
    LeaseHeld {
        run: String,
        owner: String,
        remaining_secs: u64,
    },
    Store(StoreError),
    Encoding(Error),
}

Failures reaching the operator.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

PolicyDenied(PolicyError)

PlanContract(String)

UnknownTenant(String)

This process serves no plane for the tenant named.

Refused rather than defaulted, which is the whole point: a fallback plane would answer an unregistered tenant with somebody else’s data, and it would look exactly like working software.

PolicyBundleChanged

An open run would continue under policy semantics other than the bundle recorded at admission.

Fields

recorded: Option<Digest>

configured: Option<Digest>

CanonicalizationChanged

The history was written under a different canonicalization rule.

Not a divergence, and reporting it as one is the defect this exists to remove: every effect key comes out of the canonicalizer, so a rule change moves all of them at once and a healthy run replays as non-determinism. The run is unverifiable by this build, which is a different claim and the one the evidence supports.

The journal chain is unaffected — it hashes the bytes it stored rather than re-canonicalizing them — so the history is intact and readable; it simply cannot be re-derived here. Before format freeze the answer is to recreate; after it, a build that means to read old history implements the old rule and selects on this number.

Fields

recorded: u16

implemented: u16

NoProvider

Nothing on this plane answers to the name run was given.

Carries what the plane does provide, because the question a reader has next is always “then what should I have asked for?” — and the plane is the only party that can answer it. A refusal that names the missing thing and not the available ones sends somebody back to their own source to reconstruct a list this error was already holding.

Fields

target: String

The capability (or skill name) that was asked for.

available: Vec<String>

Every capability this plane provides, sorted. Empty means no skills.

QuotaExceeded(QuotaError)

The tenant is at a ceiling, so nothing was admitted.

Distinct from a policy denial, because they call for opposite responses. A denial says you may not, and retrying is pointless. A quota refusal says not right now, and the caller should come back — a concurrency ceiling clears when a run finishes. Collapsing them would teach callers to retry denials or to give up on back-pressure.

ChainBroken

The journal’s hash chain does not verify. Either a record was altered after the fact, or a writer produced bytes it did not hash.

Fields

seq: Seq

detail: String

Fenced

A write was rejected because another instance owns this run at a higher epoch. Not an error to retry blindly: this instance has been fenced and must drop the run.

Fields

run: String

held: u64

current: u64

LeaseHeld

Another instance holds a live lease on this run. Retryable after the lease expires — unlike Fenced, which never is.

Fields

run: String

owner: String

remaining_secs: u64

Store(StoreError)

Encoding(Error)

Implementations

impl RuntimeError

pub fn from_store(e: StoreError) -> Self

Lift a store error into the operator-facing taxonomy.

Two promotions matter, because both change what a human should do:

• Fenced — “I lost ownership of this run” (drop it; another instance has it), as opposed to “the database is unhappy” (retry).
• Corrupt → ChainBroken — the journal does not verify. That is never a retryable storage hiccup; it means the history has been altered and nothing downstream of it can be trusted. Leaving it as a generic store error would bury the one failure that must never be shrugged off.

pub fn is_terminal_for_owner(&self) -> bool

Whether this run should be abandoned by this instance rather than retried. Both cases are terminal for the current owner: fencing means someone else owns it, and a broken chain means the recorded history can no longer be trusted to describe anything.

Divergence is deliberately not here. It is not a RuntimeError at all — a replay that recomputes a different key quarantines the run, through StepError::NonDeterminism, and a run status is not something an owner abandons. A second spelling of it lived on this enum, unconstructed and pointed at by the crate’s own front page, until a guard noticed.

Trait Implementations

impl Debug for RuntimeError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for RuntimeError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for RuntimeError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<Error> for RuntimeError

fn from(source: Error) -> Self

Converts to this type from the input type.

impl From<PolicyError> for RuntimeError

fn from(source: PolicyError) -> Self

Converts to this type from the input type.

impl From<QuotaError> for RuntimeError

fn from(source: QuotaError) -> Self

Converts to this type from the input type.

impl From<StoreError> for RuntimeError

fn from(source: StoreError) -> Self

Converts to this type from the input type.