Module availability 

Negotiated availability categories and caller-owned retry decisions.

Structs

AvailabilityObservationV1

Safe telemetry projection; intentionally excludes request IDs and business evidence.

DurableOperationReceiptV1

Evidence returned only after the business closure and its selected durability policy completed. The deployment must recover this same evidence by operation identity after response loss; a canonical-copy receipt alone does not prove business completion.

PeerOperationRequestV1

Explicit capability offer and complete signed command envelope. Bound input before decoding.

PeerOperationResponseV1

Complete response body authenticated by a separate response credential.

SignedPeerOperationResponseV1

Authenticated continuation or completion; debug intentionally omits credentials and content.

Enums

AvailabilityErrorV1

Stable, payload-free rejection categories.

AvailabilityReadinessV1

Controlled readiness evidence.

AvailabilityRetryV1

Caller-owned scheduling decision. No decision authorizes reexecution of effects.

AvailabilityRoleV1

Controlled HA role; never accepts a deployment path or free-form status.

NegotiatedPeerOperationV1

Result of one negotiated attempt. A V1 response is never a durable receipt.

PeerOperationCallErrorV1

Local failure, distinct from an authenticated remote rejection or pending result.

PeerOperationOutcomeV1

Remote result. Only Confirmed permits retiring the matching pending operation.

Constants

AVAILABILITY_CAPABILITY_V1

Capability selected explicitly by both peers; never inferred from an HTTP status.

AVAILABILITY_COMMAND_PATH_V1

Separate command profile; frozen V1 request/response shapes remain unchanged.

MAX_AVAILABILITY_RETRY_AFTER_MS

Maximum peer-supplied retry delay.

Functions

operation_binding_hash

Exact operation and content binding for a durable receipt. Providers index by operation_identity_hash and reject reuse with a different binding rather than executing a second closure. Neither digest belongs in diagnostics.

operation_identity_hash

Stable digest of tenant/cluster/service capability, source and idempotency key. The target Core is excluded so failover can recover the original durable identity. This digest is binding evidence, not a secret-safe telemetry label.

operation_request_signing_hash

Stable request authentication binding for this command-only profile.

operation_response_signing_hash

Domain-separated response binding, including request hash, outcome, role and readiness.