Module policy 

Service policies (strict / durable_pending) and the two service clocks. Per-dispatch service policy and the two service clocks.

R1 rules two policies and two clocks, and this module is where a dispatch’s pair is resolved from what the operator actually wrote.

strict is the default, everywhere, always: a dispatch to a queue that is structurally unserved refuses instead of starting a lie. durable_pending is a written opt-in per queue — the run is marked unserved immediately and visibly, then parks durably until a worker arrives.

The two clocks are never conflated:

• the service-availability deadline bounds waiting for a compatible worker to EXIST (NO_LIVE_POLLERS / POLLERS_INCOMPATIBLE);
• the schedule-to-start timeout bounds the hand-off to a worker that already exists (SATURATED).

Both are Option: unset means unbounded, which is exactly today’s behaviour and the only honest default — a server does not get to invent the deadline an operator never declared. What DID change is that an unbounded wait is now loud, typed, and queryable instead of silent.

Structs

QueueServiceConfig

The operator’s queue-service settings.

QueueServiceOverride

One written per-queue policy opt-in.

Enums

QueueServicePolicy

What a dispatch does when its queue is not being served.