Struct SupervisorSpec 

pub struct SupervisorSpec {
    pub estrategia: RestartStrategy,
    pub max_restarts: u32,
    pub restart_window: Option<Duration>,
    pub children: Vec<ChildSpec>,
}

Supervisor-typed slots that live alongside the standard Caixa fields when :kind Supervisor. Held flat in crate::Caixa so the manifest stays a single typed form; this struct exists for validation + conversion.

Fields

estrategia: RestartStrategy

Restart strategy. Defaults to RestartStrategy::OneForOne.

max_restarts: u32

Max restarts within Self::restart_window before the supervisor itself terminates (and its parent supervisor decides what to do). Default 5.

restart_window: Option<Duration>

Sliding window for max_restarts. Authored as a duration string ("60s", "5m"); absent = “never reset”. A Some(0s) is rejected by Self::validate — Erlang/OTP’s MaxIntensity / Period invariant requires a positive window (a zero-period supervisor either trips on the first failure or never trips, depending on operator interpretation, neither of which is the author’s intent). Omit the slot to express “no reset”; carry a positive duration to express the sliding window.

children: Vec<ChildSpec>

Static children. Empty for SimpleOneForOne (children added dynamically); required for the other three strategies.

Implementations

impl SupervisorSpec

pub fn estrategia(&self) -> RestartStrategy

Substrate-canonical per-:supervisor :estrategia OTP-shaped sibling-restart-strategy scalar accessor every consumer that dispatches on the supervisor’s per-sibling restart-decision shape keys off — returns the author-declared :supervisor :estrategia variant verbatim as a RestartStrategy, Copy-projected from the typed slot’s own RestartStrategy storage.

The :supervisor :estrategia slot carries the closed-set OTP-shaped sibling-restart-strategy discriminator (RestartStrategy::OneForOne — restart only the failed child, the Erlang/OTP one_for_one default; RestartStrategy::OneForAll — restart every child on any child failure, the Erlang/OTP one_for_all shared-state cohort default; RestartStrategy::RestForOne — restart the failed child and every child started after it, the Erlang/OTP rest_for_one startup-order default; RestartStrategy::SimpleOneForOne — dynamic children of the same shape, the Erlang/OTP simple_one_for_one per-session default) that every downstream consumer of the Supervisor’s per-sibling restart-decision fan-out shape keys off. Validated by SupervisorSpec::validate to be paired coherently with the sibling :children axis (SimpleOneForOne ↔ children.is_empty() — the cross-slot partition the strategy-arm’s SupervisorError::SimpleOneForOneWithStaticChildren / SupervisorError::NoChildren refusal cascade pins), and every downstream consumer that reads the strategy keys off this scalar (the SupervisorSpec::validate SimpleOneForOne ↔ non-SimpleOneForOne partition-dispatch match arm, the non-SimpleOneForOne-arm declared-but-empty SupervisorError::NoChildren error carrier’s estrategia: field, the future feira app graph per-Supervisor strategy print line, the future wasm-operator’s per-supervisor sibling-restart-strategy branch, the future M4 mesh.pleme.io/v1alpha1/Supervisor CR materializer’s per-strategy admission-webhook resolver, the caixa-operator’s hierarchical reconciliation scheduler’s per-strategy fan-out).

Prior to this lift the .estrategia field was accessed inline at two production sites in caixa-core/src/supervisor.rs — the SupervisorSpec::validate SimpleOneForOne ↔ non-SimpleOneForOne match self.estrategia { … } partition dispatch, and the non-SimpleOneForOne-arm SupervisorError::NoChildren error carrier at estrategia: self.estrategia — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :supervisor :estrategia axis to a richer author surface (a per-cluster strategy override the operator pins through a future :supervisor :estrategia-overrides slot the MESH-COMPOSITION §III.2 supervision-canary roadmap acknowledges, a per-tenant strategy-alias table the M4 CR materializer resolves per-CR, a per-Supervisor dynamic strategy derivation the future adaptive-supervision engine computes from child-failure-history topology, a per-child-cohort strategy split the future RestForCohort extension acknowledged by the INSPIRATIONS.md §II.2 Erlang/OTP absorption roadmap acknowledges) would have had to be threaded through every open-coded copy in lockstep — one consumer reading the raw variant while a peer read the operator-resolved variant would silently split the SupervisorError::NoChildren diagnostic’s quoted strategy from the actual partition-dispatch input the empty-children refusal arm reached under, a two-consumer split at the validator far from the source caixa.lisp with no field naming the strategy-drift root cause. Lifting the resolution rule to a typed method on the substrate primitive means every downstream consumer of the Supervisor’s per-:supervisor sibling-restart-strategy surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

Peer of the sibling M3 mesh-slot crate::Placement::estrategia (921fe1b) Copy-return PlacementStrategy scalar accessor on the per-:placement distribution-strategy axis — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the M2 supervisor-slot per-:supervisor sibling-restart-strategy Copy-composite-enum scalar axis. The two typed axes (Placement::estrategia on the M3 Aplicacao side, SupervisorSpec::estrategia on the M2 Supervisor side) now share one accessor discipline for the shared substrate concept “a Copy-projected closed-set enum-arm discriminator that partitions the downstream renderer’s per-arm fan-out”. First Copy-return accessor on the M2 supervisor-slot SupervisorSpec type — companion to the sibling per-:children crate::ChildSpec::nome (57c61d0) / crate::ChildSpec::versao_requirement (2c053c8) child-caixa scalar accessors on the sibling per-:children String-carry axes. Named estrategia() to match the storage field’s name and the peer crate::Placement::estrategia method-name discipline verbatim; the accessor’s identity name maps onto the canonical OTP-shape supervision vocabulary the RestartStrategy enum’s docstring already carries.

pub const fn max_restarts(&self) -> u32

Substrate-canonical per-:supervisor :max-restarts OTP-shaped MaxIntensity restart-budget scalar accessor every consumer that reads the supervisor’s per-:restart-window restart-budget count keys off — returns the author-declared :supervisor :max-restarts typed u32 verbatim, Copy-projected from the typed slot’s own u32 storage (u32 is Copy, so the accessor returns by value; no borrow of &self past the call). Non-optional (the u32 field carries the restart-budget count as a required axis with a [default_max_restarts]-supplied default; the zero-floor arm SupervisorError::ZeroMaxRestarts and the cap arm SupervisorError::MaxRestartsExceedsCap jointly bracket the accept-set to 1..=SUPERVISOR_MAX_RESTARTS_MAX).

The :supervisor :max-restarts slot carries the Erlang/OTP MaxIntensity restart-budget count that pairs with the sibling :restart-window Period to form the MaxIntensity / Period restart-intensity ratio the supervisor trips its own escalation on (theory/RUNTIME-PATTERNS.md §II.2, Learn You Some Erlang’s {intensity, 5, 60} worker-supervisor default). Every downstream consumer of the Supervisor’s per-:supervisor restart-budget count keys off this scalar (the SupervisorSpec::validate zero-floor + upper-cap bracket at require_positive_bounded_u32(self.max_restarts(), …), the future wasm-operator’s per-supervisor restart-intensity counter’s budget-vs-count comparator, the future M4 mesh.pleme.io/v1alpha1/Supervisor CR materializer’s admission webhook, the caixa-operator’s hierarchical reconciliation scheduler’s per-supervisor escalation-decision branch, every SupervisorError::MaxRestartsExceedsCap variant carrying the offending count verbatim for feira lint rendering).

Prior to this lift the .max_restarts field was accessed inline at one production site in caixa-core/src/supervisor.rs — the SupervisorSpec::validate require_positive_bounded_u32(self .max_restarts, …) bracket-gate call — one open-coded field-access that expressed no compile-time link back to the typed slot. A future extension of the :max-restarts axis to a richer author surface (a per-cluster restart-budget override the operator pins through a future :supervisor :max-restarts-overrides slot the MESH-COMPOSITION §III.2 supervision-canary roadmap acknowledges, a per-tenant restart-budget-alias table the M4 CR materializer resolves per-CR, a per-supervisor dynamic restart-budget derivation the future adaptive-supervision engine computes from child-failure- history topology, a promotion of the plain u32 count to a richer {MaxR, MaxT} tuple once Erlang/OTP’s per-child-cohort restart- budget-partition slot comes into scope) would have had to be threaded through every open-coded copy in lockstep or the validate gate and the future M4 emit path would silently disagree on which restart-budget count a given supervisor resolves to — an author’s :max-restarts 5 would satisfy validate while the emit path silently read a drifted other value (a :max-restarts 10000 no-op supervisor at the emit boundary would carry the author’s declared 5 verbatim in feira lint output while the future wasm-operator’s restart-intensity counter operated under the drifted count), a two-consumer split at the validator far from the source caixa.lisp with no field naming the restart-budget-drift root cause. Lifting the resolution rule to a typed method on the substrate primitive means every downstream consumer of the Supervisor’s per-:supervisor restart-budget-count surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

Peer of the sibling M3 mesh-slot crate::CircuitBreaker::max_failures (3a74062) Copy-return u32 sub-struct required-scalar accessor on the per-:politicas :circuit-breaker :max-failures Envoy- outlier-detection trip-threshold axis — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the M2 supervisor-slot per-:supervisor restart-budget-count Copy-u32 scalar axis. The two typed axes (CircuitBreaker::max_failures on the M3 Aplicacao side, SupervisorSpec::max_restarts on the M2 Supervisor side) now share one accessor discipline for the shared substrate concept “a Copy-projected required u32 count that trips the next-higher protection layer after N events in a rolling window” — both are counters with identical degenerate-at-the-high-end shape and share the paired crate::POLICY_BREAKER_MAX_FAILURES_MAX / SUPERVISOR_MAX_RESTARTS_MAX 1000 cap. Second Copy-return accessor on the M2 supervisor-slot SupervisorSpec type, sibling to the SupervisorSpec::estrategia (eafb619) Copy-composite- enum RestartStrategy accessor. Named max_restarts() to match the storage field’s name verbatim and the peer crate::CircuitBreaker::max_failures method-name discipline; the accessor’s identity maps onto the canonical OTP-shape supervision vocabulary the SupervisorSpec::max_restarts field’s docstring already carries.

pub const fn restart_window(&self) -> Option<Duration>

Substrate-canonical per-:supervisor :restart-window OTP-shaped Period sliding-window scalar accessor every consumer of the supervisor’s MaxIntensity / Period restart-intensity denominator keys off — returns the author-declared :supervisor :restart-window typed Duration verbatim as an Option<Duration>, copied out of the typed slot’s own Option<Duration> storage (Duration is Copy, so Option<Duration> is Copy and the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the canonical “never reset — every restart across the supervisor’s lifetime counts against the sibling :max-restarts budget” sentinel the field’s own docstring names and the peer validate_accepts_none_restart_window pin locks in on the SupervisorSpec::validate entry-side).

The :supervisor :restart-window slot carries the Erlang/OTP Period sliding-observation-interval that pairs with the sibling :max-restarts MaxIntensity restart-budget count to form the MaxIntensity / Period restart-intensity ratio the supervisor trips its own escalation on (theory/RUNTIME-PATTERNS.md §II.2, Learn You Some Erlang’s {intensity, 5, 60} worker-supervisor default). The typed slot’s Option<Duration> accept-set — zero-floor rejected through SupervisorError::RestartWindowZero (Erlang/OTP’s MaxIntensity / Period invariant requires Period > 0; a zero period either trips on the first failure or never trips depending on operator interpretation, neither of which is the author’s intent — omit the slot to express “no reset”; carry a positive duration to express the sliding window), integer-millisecond canonical form enforced through SupervisorError::RestartWindowNotCanonical (the duration codec’s canonical form emits "1500ms" not "1.5s" and the future wasm-operator’s per-supervisor restart-intensity counter quantizes at milliseconds), upper-bounded by SUPERVISOR_RESTART_WINDOW_MAX (1h — the coarsest per- supervisor rolling window any operationally-reachable supervisor can honor without spanning multiple scheduler epochs the hierarchical-reconciliation scheduler treats as independent) — maps onto the future wasm-operator (M3) per-supervisor restart-intensity counter’s rolling-observation-interval, the future M4 mesh.pleme.io/v1alpha1/Supervisor CR materializer’s per-spec.restartWindow admission webhook, and the sibling duration_codec-serialized wire scalar every downstream consumer of the supervisor’s per-:supervisor restart-intensity denominator keys off.

Prior to this lift the .restart_window field was accessed inline at one production site in caixa-core/src/supervisor.rs — the SupervisorSpec::validate if let Some(w) = self.restart_window { … } zero-floor + canonical-form + upper-cap bracket arm — one open-coded field-access that expressed no compile-time link back to the typed slot. A future extension of the :restart-window axis to a richer author surface (a per-cluster restart-window override the operator pins through a future :supervisor :restart-window-overrides slot the MESH-COMPOSITION §III.2 supervision-canary roadmap acknowledges, a per-tenant restart-window-alias table the M4 CR materializer resolves per-CR, a per-supervisor dynamic restart-window derivation the future adaptive-supervision engine computes from child-failure-history topology, a promotion of the plain Option<Duration> window to a richer {observation, cooldown} pair once Erlang/OTP’s per-child-cohort observation-interval- partition slot comes into scope) would have had to be threaded through every open-coded copy in lockstep or the validate gate and the future M4 emit path would silently disagree on which restart-window a given supervisor resolves to — an author’s :restart-window "60s" would satisfy validate while the emit path silently read a drifted other value (a Some(Duration::from_secs(60)) authored slot at the emit boundary would carry the author’s declared window verbatim in feira lint output while the future wasm-operator’s restart-intensity counter operated under a drifted window, or vice versa: an author’s :restart-window () would carry the “never reset” sentinel through validate while the emit path silently substituted a default sliding window), a two-consumer split at the validator far from the source caixa.lisp with no field naming the restart-window-drift root cause. Lifting the resolution rule to a typed method on the substrate primitive means every downstream consumer of the Supervisor’s per-:supervisor restart-intensity-denominator surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

Third Copy-return accessor on the M2 supervisor-slot SupervisorSpec type, closing the last unlifted per-:supervisor scalar-value axis (children: Vec<ChildSpec> carries a Vec payload rather than a Copy-scalar, and the per-:children crate::ChildSpec::nome (57c61d0) / crate::ChildSpec::versao_requirement (2c053c8) child-caixa scalar accessors already close the per-element String-carry axes). Sibling to the peer M2 crate::LimitsSpec::wall_clock (8cb717b) Option<Duration> accessor on the :limits slot’s per-outermost-call wall-clock-deadline axis and the peer M3 crate::MeshPolicy::timeout (7073d0f) Option<Duration> accessor on the :politicas slot’s per-call-deadline axis — all three share the shared substrate concept “a Copy-projected optional Duration that carries a positive integer-millisecond canonical value with a 1ms..=<axis-specific>_MAX accept-set and the paired zero-floor / non-canonical / above-cap refusal cascade” through the same crate::render::require_positive_canonical_bounded_duration bracket-helper the three axes each route through. Named restart_window() to match the storage field’s name verbatim and the peer crate::LimitsSpec::wall_clock / crate::MeshPolicy::timeout method-name discipline; the accessor’s identity maps onto the canonical OTP-shape supervision vocabulary the SupervisorSpec::restart_window field’s docstring already carries.

pub fn children(&self) -> &[ChildSpec]

Substrate-canonical per-:supervisor :children OTP-shaped static-child-list slice accessor every consumer that walks the supervisor’s declared child set keys off — returns the author- declared :supervisor :children Vec<ChildSpec> verbatim as a &[ChildSpec] slice-view, borrowed from the typed slot’s own Vec<ChildSpec> storage (a zero-copy slice-view over the same backing buffer the Serialize/Deserialize derives round-trip through). Non-optional: an empty slice is the load-bearing “author declared :children ()” sentinel every consumer of the cross-slot SimpleOneForOne ↔ children.is_empty() partition keys off (SimpleOneForOne requires the empty slice; the peer three strategies require a non-empty slice — the paired SupervisorError::SimpleOneForOneWithStaticChildren / SupervisorError::NoChildren refusal cascade pins the partition on both arms).

The :supervisor :children slot carries the OTP-shaped static child list the supervisor materializes one ComputeUnit per entry from — the Erlang/OTP supervisor:init/1’s {ok, {SupFlags, ChildSpecs}} ChildSpecs list, projected through the tatara-lisp :children author surface onto a typed Vec<ChildSpec> whose per-element (nome(), versao_requirement(), restart) triple the per-child SupervisorSpec::validate loop already gates through the lifted ChildSpec::nome (57c61d0) / ChildSpec::versao_requirement (2c053c8) scalar accessors. Every downstream consumer that fans on the static child list keys off this slice (the SupervisorSpec::validate SimpleOneForOne ↔ non-SimpleOneForOne partition dispatch’s .is_empty() probe on both arms, the SupervisorSpec::validate per-child DNS-1123 / semver-requirement / duplicate-detection fan-out loop, every future wasm-operator (M3) per-supervisor hierarchical-reconciliation scheduler’s per-child ComputeUnit materialization loop, the future M4 mesh.pleme.io/v1alpha1/Supervisor CR materializer’s per-child admission-webhook fan-out, the future feira app graph per-supervisor tree-print traversal).

Prior to this lift the .children Vec<ChildSpec> was accessed inline at three production sites in caixa-core/src/supervisor.rs — the SupervisorSpec::validate SimpleOneForOne-arm !self.children.is_empty() cross-slot refusal probe, the peer non-SimpleOneForOne-arm self.children.is_empty() SupervisorError::NoChildren refusal probe, and the per-child validate loop’s for child in &self.children traversal head — three open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :supervisor :children axis to a richer author surface (a per-cluster child-set overlay the operator pins through a future :supervisor :children-overrides slot the MESH-COMPOSITION §III.2 supervision-canary roadmap acknowledges, a per-tenant child-set-alias table the M4 CR materializer resolves per-CR, a per-supervisor dynamic-child derivation the future adaptive- supervision engine computes from child-failure-history topology, a promotion of the plain Vec<ChildSpec> to a richer {static, dynamic} partition once Erlang/OTP’s simple_one_for_one dynamic-child slot comes into typed scope) would have had to be threaded through all three open-coded copies in lockstep or one consumer would silently disagree with the peers on which child-set a given supervisor resolves to — the SimpleOneForOne-arm probe reading the raw slot while the peer non-SimpleOneForOne-arm probe read an operator-resolved slot would silently split the partition-dispatch’s two-arm coherence (a supervisor that satisfies neither arm’s precondition, or that satisfies both, at the cost of the paired SimpleOneForOneWithStaticChildren/NoChildren refusal cascade silently drifting from the per-child validate loop’s actual traversal input), a three-consumer split at the validator far from the source caixa.lisp with no field naming the child-set-drift root cause. Lifting the resolution rule to a typed method on the substrate primitive means every downstream consumer of the Supervisor’s per-:supervisor static-child-list surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

First slice-return (&[T]) accessor on any M2 or M3 typed slot — the seed for the same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline the closed crate::LimitsSpec / [BehaviorSpec] / crate::UpgradeFromEntry scalar-accessor families each carry on their Copy / Option<Copy> / Option<&str> axes, extended onto the first Vec-carry axis on the substrate. The four peer Vec-carry axes still unlifted at the time of this seed — crate::Placement::clusters (Vec<String> per-cluster distribution-target list), crate::AplicacaoSpec::membros (Vec<Membro> per-Aplicacao member list), crate::AplicacaoSpec::contratos (Vec<WitContract> per-Aplicacao WIT-typed edge list), crate::UpgradeFromEntry::instructions (Vec<UpgradeInstruction> per-appup migration-instruction list) — inherit this accessor’s discipline as future compounding runs migrate their consumers onto the shared slice-return shape. Fourth (and final) accessor on the M2 supervisor-slot SupervisorSpec type, sibling to the three Copy-return SupervisorSpec::estrategia (eafb619) / SupervisorSpec::max_restarts (7844f4e) / SupervisorSpec::restart_window (7e7b32f) accessors — closes the last unlifted per-:supervisor field axis (the Vec<ChildSpec> static-child-list carrier) so every downstream per-:supervisor reader now routes through a typed dispatch on the substrate primitive. Named children() to match the storage field’s name verbatim and the tatara-lisp author-surface term (:children) the field’s own docstring already carries; the accessor’s identity maps onto the canonical OTP-shape supervision vocabulary the SupervisorSpec::children field’s docstring already reaches for (“Static children …”). Returns &[ChildSpec] (not &Vec<ChildSpec>) because every downstream consumer of the child list treats it as a read-only sequence — the slice-view is the narrowest borrow that supports every present + roadmapped consumer (.is_empty(), .iter(), index, .len()) without leaking the backing Vec’s grow/push/reserve surface that no consumer of the typed view reaches for (the storage-side Vec remains reachable through the pub children field for the mutation-carrying Caixa::supervisor_view fold-in path in manifest.rs:supervisor_view).

pub fn validate(&self) -> Result<(), SupervisorError>

Validate the supervisor’s typed shape — strategy ↔ children invariants, max_restarts > 0, restart_window > 0 when set, per-child non-empty + duplicate-free names.

Mirrors the value-shape discipline applied to every other typed slot:

• Some(Duration::ZERO) on a Duration-bearing axis is the same “0 means the opposite of what you think” footgun closed for :politicas :timeout (Envoy interprets a zero timeout as infinite), :politicas :circuit-breaker :window, and :limits :wall-clock. The MaxIntensity / Period ratio in Erlang/OTP’s supervisor requires Period > 0; a zero period either trips on the first failure or never trips depending on operator interpretation, neither of which is the author’s intent. Omit :restart-window to express “no reset”; carry a positive duration to express the window.
• duplicate :children :caixa names are the same graph-node-set / multiset distinction closed for :membros (4bb3f3d), :placement :clusters (c7c7799), and :entrada :paths (eb3456d). Two children with the same :caixa materialize as two ComputeUnits with the same name in the cluster’s HelmRelease values, one silently overwriting the other. Erlang/OTP’s child_spec.id is required-unique per supervisor; pleme-io enforces the same set-not-multiset shape on :caixa (the load-bearing identity in our renderer).

Trait Implementations

impl Clone for SupervisorSpec

fn clone(&self) -> SupervisorSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SupervisorSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SupervisorSpec

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SupervisorSpec

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SupervisorSpec

impl PartialEq for SupervisorSpec

fn eq(&self, other: &SupervisorSpec) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SupervisorSpec

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SupervisorSpec