Module lifecycle 

Revision-lifecycle storage guard (A5 of plans/next-gen-deployment.md).

Wraps the pure greentic_deploy_spec::is_valid_transition predicate from greentic-deploy-spec with the storage-side semantics that operator commands and B-phase orchestrators need:

• load the env from a Locked<'_> transaction,
• find the revision by id (typed NotFound),
• walk an accepted_chain of (from, to) edges, advancing the revision through every legal hop until it lands in the final state,
• report a typed InvalidTransition for any edge the spec rejects, and a typed Conflict for a revision that started outside the chain,
• optionally prune the revision from every traffic split and from each matching BundleDeployment.current_revisions (the archive path),
• save the env back through the same Locked<'_> handle so the per-env flock spans the whole load → mutate → save critical section.

cli::revisions::{stage, warm, drain, archive} delegate the inner body of their transact closures to apply_revision_transition, and the same helper is the entrypoint future B-phase consumers (gtc start orchestration #221, B9 warm/ready gate, A7 audit emission) call when they need to drive a revision through the matrix.

The helper does not mint revisions — stage constructs the Revision struct itself and pushes it onto Environment.revisions. The lifecycle guard only owns transitions between existing revisions.

Structs

ActiveSplitRef

Identifies a TrafficSplit (by its (deployment_id, bundle_id) key) for error-reporting purposes. Surfaced in RevisionLifecycleError::ActiveTrafficReference so operators can locate the splits they need to rebalance before retrying the archive.

HealthGateFailure

Why a warm/ready health gate rejected a revision. Shipped by the deployer CLI inside WarmRevisionPayload (the gate is evaluated client-side — closures don’t cross the A8 wire) and surfaced inside RevisionLifecycleError::HealthGateFailed after the transform has flipped the revision’s lifecycle to Failed.

Enums

HealthCheckId

Identifies which health-gate check failed in HealthGateFailure.

LifecycleError

Errors produced by apply_revision_transition. Cleanly maps onto cli::OpError via the From impl in cli/mod.rs. The storage-free variants mirror RevisionLifecycleError 1:1 (see the From impl below); LifecycleError::Store is the local-storage addition.

Functions

apply_revision_transition

Apply a revision lifecycle transition under an already-held env lock.

apply_revision_transition_with_health_gate

Gate-aware variant of apply_revision_transition for the B9 warm/ready health gate.