Module puller 

The shared pump’s modules, under the names Holger’s callers already use. The puller: report, pull, verify, run, ack — the box’s whole side of monetize.v1.Fleet, over any Link (the gRPC client in super::grpc, an in-process guardian in the tests), running each order through the product’s PumpBox.

Moved from Holger’s holger-fleet/src/puller.rs (P4a). What was Holger’s there and is the product’s here: the order kinds and their bodies (PumpBox::run), the health words.

Structs

Addressee

Who this box is on the wire.

Asked

What an ask is answered: the case it opened (a remedy), monetize’s words, and a page to open (empty for every ask a box makes today).

Ctx

What the product’s executor knows about the order’s context.

Fault

Why a call failed: monetize’s word (unauthenticated, unavailable, …) and its sentence.

Pull

What one pull did.

Pulled

What is kept across restarts.

Puller

Signed

One signed call as it goes on the wire.

Enums

Checked

What check made of one wire order, before its body is read.

Constants

FUTURE_SKEW_MS

How far ahead of the box’s clock an order may be dated (the shared pump’s and Gunnar’s five minutes).

STATE_REL

What the puller remembers across restarts.

Traits

Asker

A Fleet.Ask from inside a running order (a pulled growth’s grow_set), signed by this box, on the link the order came on.

Link

The three calls, over whatever carries them.

PumpBox

The product’s half of the pump: what its box reports, and what it does with an order.

Functions

check

The box’s check of one order (the order’s body is the product’s): signed by monetize (monetize-embed order_message under key), then for this box, newer than the last order taken, inside its window (not_after 0 = none), dated no more than FUTURE_SKEW_MS ahead of this box’s clock. An order that does not verify is FORGED — never run, never acked, and it never moves the sequence (a forged high seq must not silence the real ones). Everything else wrong with it is a REFUSAL, acked by name.

fetch

The file a product order carries, pulled (MONETIZE-FIX 2026-11-01: the ONE box never pushes a file into an estate): Fleet.Ask{fetch} on the order’s own link. The ONE box answers only a file an order queued for this box names, checked against its sha256 there; its size is checked here before it is handed to the product’s executor.

grow_set

A pulled growth’s disk resize (Fleet.Ask{grow_set}, every member, gib a disk): monetize’s words, or the case it opened when it said none.