Struct PatchSupervisor 

pub struct PatchSupervisor { /* private fields */ }

A snapshot includes every Rust source, manifest, lockfile, build script, and configuration input. Source bytes must come from the exact build that produced the running executable.

Implementations

impl PatchSupervisor

pub fn new( baseline: SourceSnapshot, registered: BTreeMap<String, BTreeSet<String>>, ) -> Self

pub fn with_registrations( baseline: SourceSnapshot, registrations: impl IntoIterator<Item = FunctionRegistration>, ) -> Result<Self, String>

Validate explicit callback and builder registrations against the running executable’s source baseline. Registrations remain fixed for this process.

pub fn revision(&self) -> u64

pub fn admit(&self, sources: SourceSnapshot) -> Result<AdmittedPatch, String>

pub unsafe fn apply( &mut self, patch: AdmittedPatch, current: &SourceSnapshot, table: JumpTable, ) -> Result<u64, String>

Apply on the UI thread between callbacks, only after the patch build succeeded. current is reread after the build; superseded builds cannot load their code.

Safety

The table must be produced by the matching Subsecond toolchain against this running executable, exclusively from patch’s admitted source snapshot. Every non-source build input and dependency must be unchanged. The caller must ensure no other thread is executing patchable code. Source admission cannot validate machine addresses or compiler ABI. This supervisor must be the exclusive dispatch-table owner; independent Subsecond owners and registered Subsecond reload handlers are unsupported.

pub unsafe fn apply_with( &mut self, patch: AdmittedPatch, current: &SourceSnapshot, table: JumpTable, transaction: impl FnOnce() -> Result<(), String>, ) -> Result<u64, String>

Install code provisionally and run a reversible view transaction with the new function bodies. Publish the code revision only if that transaction succeeds. On failure or panic, restore the previously accepted dispatch table; an initial failed patch restores dispatch to the original executable. The transaction must itself restore UI mutations before returning an error or unwinding. This method cannot undo arbitrary application side effects. It must reapply patch.views_to_reapply() through application adapters, or fail; callback-only changes do not request any view reapplication.

Safety

All of apply’s guarantees apply. Retain every accepted patch artifact, unmodified, until this supervisor and its process retire. No independent Subsecond owner or registered Subsecond hot-reload handlers may mutate the dispatch table or UI. The transaction must not publish work that executes patchable code on another thread or after a rejected transaction.

pub fn restart_required(&self) -> Option<&str>

A failed dispatch rollback makes further admission unsafe. The owning development process must build and start a replacement before continuing.