1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
//! The supervisor: starting an agent CLI, watching it, and writing down what happened.
//!
//! # What lives here and what does not
//!
//! Everything in `layover-core` is a decision that can be checked without running anything —
//! whether a route is permitted, whether an itinerary has Fuel left, what a run should be told.
//! This crate is where those decisions meet an operating system, and it is the first place in the
//! project that can do something irreversible.
//!
//! It deliberately decides nothing. Routing, accounting and prompt composition belong to
//! `layover-core` and are already tested without a process in sight. What this adds is the part
//! that cannot be tested that way: a child that writes to disk, spends money, and may not come
//! back.
//!
//! # The order of operations is a safety property
//!
//! A run is recorded as started **before** the process is spawned, and the record carries the
//! process identifier and the moment it began. That order is not an implementation detail:
//!
//! - A run that was alive when the supervisor died leaves no exit code. The only way to know it
//! existed is to have written it down first.
//! - A record written *after* spawning leaves a window in which a real process is running and
//! nothing knows about it — exactly the window a crash falls into.
//!
//! Recovery needs to say "this was running, and it is confirmed gone". Both halves come from the
//! record written before the spawn.
pub use ;
pub use ;
pub use ;
pub use ;
pub use ;
pub use ;
pub use ;
pub use ;
pub use ;
pub use ;