Struct PostureStateMachine 

pub struct PostureStateMachine { /* private fields */ }

The posture state machine. Deterministic: time is monotonic ms fed by the caller.

Implementations

impl PostureStateMachine

pub fn new(policy: PosturePolicy) -> Self

A fresh machine in FleetPosture::Nominal.

pub const fn state(&self) -> FleetPosture

Current posture.

pub const fn counters(&self) -> &PostureCounters

Loud-transition counters (metrics export surface).

pub const fn lane_death_held(&self) -> bool

The sticky lane-death hold (FF-T4): once set, no clean window can ever lift it — the FleetHost Faulted transition (TB4QGX T6) keys on THIS typed latch, never on elapsed cordon time.

pub const fn policy(&self) -> &PosturePolicy

The active policy (operator-channel re-tune reads it through here).

pub fn set_policy(&mut self, policy: PosturePolicy)

Swap the policy (the operator channel’s re-tune). Pure: the state and the trailing sample window are KEPT — a retune never fabricates samples, so the next Self::observe re-derives the posture under the new thresholds. Semantic validation of the new policy is the re-tune caller’s job (the JCI2FW Part B channel).

pub fn observe(&mut self, now_ms: u64, sample: ThrottleSample) -> PostureChange

Feed one throttle-poll delta at now_ms. Returns whether the posture transitioned (and why) — the caller surfaces that loudly.

pub fn observe_cause(&mut self, cause: PostureCause) -> PostureChange

Feed one typed non-throttle cause (FF-T4, Z6XTDX — the DECIDED option (a) input). A PostureCause::LaneDeath enters the cordon from ANY state with its OWN exit discipline: the cordon is sticky (the clean window never lifts it — see Self::maybe_exit), in-flight paths get terminal receipts at the detection site, and the process stays alive under the §6 cordon effects. Idempotent while the hold is already set (the counter still counts every cause).

pub const fn note_intake_suppressed(&mut self)

A lease grant was denied because of the posture (counter only — the dispatcher supplies the typed error).

pub const fn admits_lease(&self, class: CordonClass) -> bool

Whether the posture admits new lease intake for class right now (§6: Never and SimPool lease freely — sim is only intake-FLOORED; Deferrable is held while cordoned).

pub fn sim_intake_cap(&self, slot_cap: usize) -> usize

The sim intake cap in the current posture (§6 effect (b)).

Trait Implementations

impl Debug for PostureStateMachine

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.