Struct CompletionPlan 

pub struct CompletionPlan { /* private fields */ }

A validated run-to-completion call, separable from the start request it was planned for.

Separate so a binding can start the exec under its sandbox lock and drive it after releasing the lock: a callback that reaches back into the sandbox must not find the lock held by the call that is invoking it.

Implementations

impl CompletionPlan

pub fn new( request: &StartRequest, options: CompletionOptions, ) -> Result<Self, Error>

Plans a call for request, refusing a timeout_sec no deadline can be built from before anything starts.

pub fn deadline(&self) -> Duration

The client deadline, measured from the start of Self::drive.

pub async fn drive( &self, handle: &ExecHandle, on_output: Option<OutputSink>, ) -> Result<ExecResult, Error>

Drives a started exec to exactly one result.

The steps, each the specified behavior in crates/model/src/run.rs:

1. With a callback, stream to it under the client deadline. The terminal exit event means the output is final, so one ack returns it (BIND-8).
2. Without a callback, or when the stream ended without its exit event (a cut past its reconnect budget, a fatal stream error, the callback answering Break), or when the ack after the exit event failed: wait and ack under what is left of the deadline (BIND-8). Polling is read-only, so this is safe whatever the stream saw.
3. When the client deadline expires in either step: kill the process group, then wait and ack within the client grace (BIND-9). The kill is sent whatever its outcome turns out to be, and a failed kill still gets the ack: the command may have finished by itself, and its real result beats a synthesized one. The daemon answers the kill only once the group is gone, SIGKILLing it after its ten-second kill_grace if it must (measured 2026-09-24, us-east-1), so the kill can take that long before the grace starts.
4. When that ack fails too: a synthesized result, exit code 124, naming both failures (BIND-10). Nothing else synthesizes.

An error is returned only for a failure that says nothing about a deadline: a fatal wait (the exec was collected, the token was refused). A retryable poll failure is retried inside the wait, as ExecHandle::wait always has.

Trait Implementations

impl Clone for CompletionPlan

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CompletionPlan

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.