pub struct BootSentinel { /* private fields */ }Expand description
Per-role boot guard. Construct once at the top of main().
Implementations§
Source§impl BootSentinel
impl BootSentinel
Sourcepub fn new(data_dir: &Path, exe: PathBuf, version: impl Into<String>) -> Self
pub fn new(data_dir: &Path, exe: PathBuf, version: impl Into<String>) -> Self
data_dir holds the sentinel/quarantine state; exe is the
live binary path (std::env::current_exe() in production);
version is this binary’s own version string.
Sourcepub fn check_on_boot(&self, max_attempts: u32) -> BootDecision
pub fn check_on_boot(&self, max_attempts: u32) -> BootDecision
Call FIRST in main(), before anything that can crash.
- No sentinel →
Proceed. - Sentinel for a different version (we already rolled back, or
last-good is now live) → clear it,
Proceed. - Sentinel for THIS version → bump attempts; attempts
1..=max_attemptsProceed, and the first that EXCEEDSmax_attemptsrolls back to.last-good+ quarantines the bad version and returnsRolledBack.
Sourcepub fn confirm_healthy(&self) -> Result<()>
pub fn confirm_healthy(&self) -> Result<()>
Call once the process is confirmed healthy (backend: serving;
agent: NATS connected + first heartbeat). Promotes the live exe
to .last-good and clears the sentinel, so this version becomes
the rollback target for the next swap.
Sourcepub fn arm_for_swap(&self, current_exe: &Path, new_version: &str) -> Result<()>
pub fn arm_for_swap(&self, current_exe: &Path, new_version: &str) -> Result<()>
Call at swap time (deploy / self-update), before restarting into
the new binary. Snapshots the CURRENT (outgoing, known-good) exe
to .last-good and writes a fresh sentinel for new_version so
the next boot is gated.
current_exe is the still-running good binary (copy it now,
before it’s overwritten by the swap).
Sourcepub fn is_quarantined(&self, version: &str) -> bool
pub fn is_quarantined(&self, version: &str) -> bool
True if version was rolled back after a failed boot. The
self-update path consults this before swapping so a bad rollout
target isn’t re-attempted in a loop.
Sourcepub fn quarantined_versions(&self) -> Vec<String>
pub fn quarantined_versions(&self) -> Vec<String>
Every quarantined version (#582 Phase 2). The agent reports these in its heartbeat so the SPA rollout view can flag which PCs failed to adopt a target.
Sourcepub fn clear_quarantine(&self, version: &str) -> Result<()>
pub fn clear_quarantine(&self, version: &str) -> Result<()>
Drop version from quarantine (operator re-published a fixed
binary under the same version string).