Enum TenantStatus 

#[non_exhaustive]
pub enum TenantStatus {
    Active,
    Provisioning,
    Degraded,
    Offboarding,
    Archived,
}

A tenant database’s reconciliation status.

Serializes as the registry’s own text ("active"), not the variant name, so a structured log field and a registry row cannot drift apart. round_trips_through_the_registry_text and serializes_as_the_registry_text together pin that.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Active

Reconciled and serving.

Provisioning

Registered, reconciliation not yet succeeded.

Degraded

The last reconciliation failed: requests answer 503 tenant-degraded until a boot succeeds.

Offboarding

Being retired: the export and key shred of docs/TENANT-ONBOARDING.md §2 are under way. It has stopped serving and will not start again.

Archived

Retired. The database is dropped and the keys are destroyed; nothing about this tenant can be served or recovered.

Implementations

impl TenantStatus

pub fn as_str(self) -> &'static str

The registry’s text form, lowercase and stable.

pub fn is_reconciled(self) -> bool

Whether boot-time reconciliation should fly this tenant.

A match and not a negation, which is the whole point. The reconciler asked status != Degraded while there were three statuses, so it was accidentally right; adding Offboarding and Archived silently enrolled both in the fleet, which would have reconnected to a shredded tenant’s database and flipped it back to active. Written this way, the next variant added to this #[non_exhaustive] enum cannot compile until someone says which side of the line it is on.

pub fn is_terminal(self) -> bool

Whether the lifecycle ends here. Only TenantStatus::Archived does: the database is dropped and the data keys are destroyed (docs/TENANT-ONBOARDING.md §2), so there is nothing left to serve and no honest way back. The registry enforces it — see Postgres::register_tenant.

pub const fn admits(self) -> &'static [TenantStatus]

The statuses a tenant may be in and still become this one.

The lifecycle rule, in one place, because more than one writer moves a tenant through it: the reconciler, the offboarding runbook’s tooling and the lifecycle API of #154. A rule that lived in one adapter’s WHERE clause would be a rule the next writer did not have.

Written as “who may become me” rather than “who may I become” so the match is on the target, which is what a caller setting a status has in its hand — and so the list drops straight into the UPDATE’s WHERE as the set of previous values that may be overwritten, making the check part of the same statement rather than a read the write races.

Each status admits itself, because writing the status a tenant is already in changes nothing and a reconciler that runs twice must not fail the second time. TenantStatus::Archived is the exception: it admits nothing, itself included. The row is the record that the database was dropped and the keys destroyed, and a record of an irreversible act is not rewritten.

pub fn can_become(self, next: TenantStatus) -> bool

Whether self may become next. The same rule as TenantStatus::admits, asked from the other end.

pub fn parse(status: &str) -> TenantStatus

Parses the registry’s text form; anything else (a future version wrote a status this binary does not know) reads as TenantStatus::Degraded — refuse, do not guess.

Trait Implementations

impl Clone for TenantStatus

fn clone(&self) -> TenantStatus

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for TenantStatus

impl Debug for TenantStatus

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Display for TenantStatus

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for TenantStatus

impl PartialEq for TenantStatus

fn eq(&self, other: &TenantStatus) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for TenantStatus

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for TenantStatus