Module lifecycle 

The instance state machine and the bounded-restart policy (ADR-099 section 7). Pure: no I/O, no clock of its own (callers pass now_ms), so every rule is table-testable.

The same states serve both sides. A node’s workload-host walks an instance through Loaded, Running, Unhealthy, Restarting, Failed and the teardown states; the controller adds Lost (its node is Dead) and Rescheduled (a replacement was placed elsewhere).

Structs

IllegalTransition

A step that is not allowed.

InstanceLife

One instance’s life on one side of the wire.

LifecyclePolicy

Operator-visible lifecycle settings of one placement.

RestartPolicy

Bounded restarts: at most max_restarts inside window_ms, spaced by an exponential backoff.

Enums

LifecycleState

Where an instance is in its life.

RestartDecision

What to do about an unhealthy instance right now.

Functions

can_transition

Whether from -> to is a legal step.

needs_attached_hardware

Whether spec needs something attached to (or local to) a particular node: any requirement in [HARDWARE_NAMESPACES]. Such a workload’s data source is tied to its node, so moving it is not a failover; it is held and alerted instead. An allow-list: a new namespace never pins by accident.