1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
//! Runs user-owned destructors outside Taskvisor's async runtime paths.
//!
//! `SupervisorBuilder` creates one [`DropDomain`] for each supervisor. Runtime task admission, controller submission,
//! and subscriber construction reserve this domain before Taskvisor accepts their user-owned values.
//! Controller, registry, subscriber, and force-abort cleanup paths carry its bundle until their final
//! retained values are ready for destruction.
//!
//! ```text
//! runtime, controller, or builder
//! │ accepted user value
//! ▼
//! DropDomain ──► DropReservation
//! ▼
//! retained user value
//! ▼
//! DropBundle
//! ▼
//! internal ownership
//! ▼
//! cleanup executor worker
//! ```
//!
//! This isolation prevents a blocking or panicking destructor from running on a Tokio worker, the registry listener,
//! or a controller loop. Cleanup runs on dedicated operating-system threads after internal ownership ends.
//! User destructors do not run under the bundle, capacity, or worker-queue locks.
//! Clean cleanup returns the reserved unit. Poisoned cleanup or a destructor panic retires that unit permanently.
//! Values that never cross an ownership hand-off remain caller-owned and do not enter these workers.
/// Public error label for the supervisor-local ownership budget.
pub const OWNERSHIP_RESOURCE: &str = "owned_user_lifetimes";
pub use ;
pub use DropDomain;
pub use ;
use ;
pub use ;