Struct WorkerSupervisor 

pub struct WorkerSupervisor { /* private fields */ }

Server-owned supervision of the managed worker fleet.

Implementations

impl WorkerSupervisor

pub fn new( store: Arc<dyn WorkerDeploymentStore>, publisher: ClusterEventPublisher, ) -> Self

Build an UNCOMMISSIONED supervisor over the durable deployment store, publishing desired-state changes onto the deployment-global cluster channel.

The publisher lives HERE — not in the transports — so every desired-state write the supervisor makes (Self::start, Self::stop, and Self::restart through them) reaches the console’s live feed identically whichever transport asked, exactly as the worker-deployment desired-state endpoint publishes its own writes.

Nothing is supervised until Self::commission installs an operator policy: construction is not commissioning, so a server that boots without the config section never spawns anything.

pub fn commission( &self, policy: SupervisionPolicy, executable: ManagedExecutable, ) -> bool

Install the operator’s supervision policy and the executable a builtin deployment means on this server.

Returns false when a commission was already installed, in which case the existing one stands: the restart discipline of a running fleet is not something a later caller gets to swap out underneath it.

pub fn policy(&self) -> Option<SupervisionPolicy>

The installed policy, if this server has one.

pub fn is_commissioned(&self) -> bool

Whether an operator commission is installed.

pub async fn start( &self, name: &str, ) -> Result<ManagedWorkerStatus, SupervisionError>

Start (or adopt) supervision of one deployment, recording the intent durably first. A durable desired-state flip is published onto the cluster channel, so the console’s live feed sees it whichever transport asked.

Idempotent: a deployment already being supervised is reported as it is, without a second process (and, already desiring Running, without a second event).

Errors

Returns SupervisionError::NotCommissioned when no policy is installed — carrying the remedy — SupervisionError::UnknownDeployment for a name with no durable record, and SupervisionError::Store when the record cannot be read or the intent cannot be written.

pub async fn stop( &self, name: &str, ) -> Result<ManagedWorkerStatus, SupervisionError>

Stop one deployment and record the intent durably. The durable desired-state write is published onto the cluster channel, so the console’s live feed sees it whichever transport asked.

The returned status is written only once the process group has been probed empty; a group that survives the termination ladder produces SupervisionError::StopIncomplete instead, so a caller can never read “stopped” off bookkeeping alone.

Errors

Returns SupervisionError::UnknownDeployment for an absent record, SupervisionError::Store when the intent cannot be written, SupervisionError::StopIncomplete when the group cannot be proven empty, and SupervisionError::TaskLost when the supervision task ended abnormally.

pub async fn restart( &self, name: &str, ) -> Result<ManagedWorkerStatus, SupervisionError>

Stop and start one deployment, leaving desired state at Running.

Publishes exactly what it durably writes: a restart of an already-Running deployment changes no desired state and emits no desired-state event; one that flips it inherits Self::start’s.

Errors

Returns the same failures as Self::stop and Self::start.

pub async fn reconcile(&self) -> Result<usize, SupervisionError>

Bring the fleet to its durable desired state.

Called at boot and safe to call again: deployments already supervised are left alone. Returns the number of deployments now supervised.

Errors

Returns SupervisionError::NotCommissioned when no policy is installed, and SupervisionError::Store when the durable listing cannot be read.

pub async fn report(&self) -> Result<ManagedWorkerReport, SupervisionError>

Join durable intent with live supervision for every deployment.

Errors

Returns SupervisionError::Store when the durable listing cannot be read, and SupervisionError::StatePoisoned when a status cell was poisoned by a panicking holder.

pub async fn shutdown(&self) -> Vec<SupervisionError>

Stop every supervised instance, for server shutdown.

Durable desired state is deliberately NOT changed: a server going down is not an operator asking for the fleet to stay down, and the next boot reconciles it back up. Returns one failure per instance that could not be proven stopped — an empty vector is the proof that no worker was orphaned.