Struct PostureOwner 

pub struct PostureOwner { /* private fields */ }

The ONE owner of a fleet posture state machine — a shared, thread-safe shell around the pure PostureStateMachine. Every consumer (every FleetHost, the block pump’s throttle feed, tests) consults THE SAME instance, so there is exactly one posture per process (per hermetic test scope) and no host-local mirrors to drift apart.

Sync: the machine sits behind a parking_lot::Mutex — every consult is a short read-through critical section, never held across an await (the crate has none); the transition feed is the PostureWatch broadcast above.

Implementations

impl PostureOwner

pub fn new(policy: PosturePolicy) -> Self

A fresh owner in FleetPosture::Nominal. Hermetic tests build their own owner and inject it via FleetBoot::owner — NEVER the process global (process/install_process_owner); posture leaking across tests is a failure class (7KAPBB).

pub fn observe_throttle( &self, now_ms: u64, sample: ThrottleSample, ) -> PostureChange

Feed one throttle-poll delta. Publishes to the feed ONLY on a real transition (Held ticks are silent — a subscriber never sees a spurious edge).

Feeder-site contract (TB4QGX T3, ADR-044)

A BOT-side caller of this method MUST also wake the fleet hosts on a non-Held change (the degenbot-bot host waker, arb_engine::fleet_wake::wake_hosts), which emits ONE untrusted, seq-stamped PostureEdge per host. This crate cannot know about host channels (layering), so the wake is the caller’s obligation; the host’s BackstopTick bounds the damage if a feeder forgets, and the hint never carries a posture value — hosts re-read the live owner.

pub fn observe_cause(&self, cause: PostureCause) -> PostureChange

Feed one typed non-throttle cause (FF-T4, Z6XTDX). Publishes to the feed on a real transition like Self::observe_throttle (an idempotent hold-upgrade returns Held and stays silent — the detection site owns the loud lane-death log).

Feeder-site contract (TB4QGX T3, ADR-044)

A BOT-side caller of this method MUST also wake the fleet hosts on a non-Held change; see Self::observe_throttle. On the lane-death (Faulted) arm the wake still fires, and the host drains its held receipts terminally instead of parking them.

pub fn current(&self) -> FleetPosture

The current posture.

pub fn policy(&self) -> PosturePolicy

The active policy (read-through; the Part B operator channel reads and re-tunes through here).

pub fn subscribe(&self) -> PostureWatch

Subscribe a watch: the receiver starts at the CURRENT posture with no pending edge (it observes only transitions from here on).

pub fn retune(&self, new_policy: PosturePolicy)

Swap the policy (the Part B operator channel’s entry point). The swap is atomic under the machine lock and keeps the state + the trailing sample window; the feed re-publishes the current posture so it mirrors the machine post-swap (a no-op unless the posture itself changed — the feed carries only real transitions, and the next observe_throttle re-derives the posture under the new thresholds). Semantic validation of the new policy is the caller’s job.

pub fn admits_lease(&self, class: CordonClass) -> bool

Whether the posture admits new lease intake for class right now (read-through — the dispatcher’s enqueue/T-table gates and the seat hosts’ admission all consult this).

pub fn note_intake_suppressed(&self)

Count a lease grant denied because of the posture (read-through — the tuning loop’s suppression metric).

pub fn sim_intake_cap(&self, slot_cap: usize) -> usize

The sim intake cap in the current posture (read-through).

pub fn counters(&self) -> PostureCounters

Loud-transition counters snapshot (the tuning loop’s metrics).

pub fn lane_death_held(&self) -> bool

The sticky lane-death hold (read-through). A host keys its Faulted transition on this TYPED latch, never on elapsed cordon time (a long recoverable EventBurst/Duty cordon must not fault).

Trait Implementations

impl Debug for PostureOwner

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.