Module fleet 

The pull channel’s signed forms (5.4, G1-pull): monetize never calls INTO an estate; every estate calls monetize (Fleet.Report, Fleet.Orders, Fleet.Ask) and monetize answers with SignedOrders the box verifies under monetize_pubkey.

Two forms, each a fixed binary layout (not JSON) so the estate’s verifier (gunnar_repair::order) and this crate agree byte for byte with no canonical-JSON rule to share:

• order_message: what monetize signs for ONE order to ONE box (role).
• fleet_call_message: what a box signs with its own Ed25519 appliance key for each call it makes to monetize.

An order is only “please run verb V with these arguments”: the estate runs it through the SAME function its local admin button and its boot check call, and says how it went in the next Report (OrderAck).

Modules

ask

call

The calls a box makes (FleetCall::call).

kind

The order kinds. The body is JSON; unknown fields are ignored. The relay products’ guardian kinds (kind::GUARDIAN, gunnar-repair’s verbs) are defined here; the core’s kinds are monetize_product::pull’s one list (A28 M25), re-exported here under their old names.

refeed

The estate keys a kind::REFEED order may carry, in the words of the feed a box is laid with: the mains’ mail relay (secret.smtp_url, secret.smtp_from, and secret.smtp_ca for a relay on a private CA; monetize-mail FEED_SMTP_*) and a site’s public repositories (public_repositories, comma-separated). A box takes the ones it knows and refuses any other by name.

Structs

Ask

Fleet.Ask body: a request from the estate (new_twin, new_server, recharge, …).

Fetch

The Fleet.Ask kinds that are not a remedy: answered at once, no case opened. A product’s own order (ProductOrder) and the file it may carry (Fetch), MONETIZE-FIX. A file a product order carries, named by its content.

FetchAsk

The Fleet.Ask kinds that are not a remedy: answered at once, no case opened. A product’s own order (ProductOrder) and the file it may carry (Fetch), MONETIZE-FIX. The body of an ask::FETCH ask.

FleetCall

One call from a box to monetize, signed by the box’s own appliance key.

FrontAsk

The body of a front’s ask (ask::FRONT): the fields the old SoldEstate request carried, less the company and the signature — the FleetSigned call names the estate (instance) and the box (role = front) and is signed by the front’s key. role is the box the ask is about (main | twin; for update_report, the box whose step it is); carries is the update report’s <outcome>\n<words>.

GrowGoAhead

Body of a kind::GROW_GO_AHEAD order.

GrowSetAsk

Fleet.Ask body of ask::GROW_SET: the box’s own data disks to gib a disk. No members = every laid data disk of the calling box; gib 0 = what its role is paid to.

OrderAck

What a box says ran (or did not) — sent back in its next Report.

OrdersAfter

Fleet.Orders body: orders after after, held up to wait_ms (≤ LONG_POLL_MAX_MS).

ProductOrder

The Fleet.Ask kinds that are not a remedy: answered at once, no case opened. A product’s own order (ProductOrder) and the file it may carry (Fetch), MONETIZE-FIX. The body of a product’s OWN order kind (MONETIZE-FIX 2026-11-01): a kind the product’s facts declare (monetize_product_guest::facts::OrderKindFacts), queued by the operator on one of his sites and pulled by the role the declaration names. The core checks the params against the declaration and signs the order; what the kind does is the product’s box’s alone. The box acks ok with its answer as detail (its words or JSON), or not ok with its refusal.

Refeed

Body of a kind::REFEED order (MAIL-RELAY + NIGHT-PUBREPO, 2026-10-28): the estate keys fed again, key → value. A secret. value is a secret: the Debug names the keys only.

Report

The box’s heartbeat (Fleet.Report body). Its arrival time is the liveness signal.

SignInAgain

Body of a kind::SIGN_IN_AGAIN order. Never a secret.

SignedOrder

One order to one box, signed by the product’s monetize key.

Enums

CallRefusal

Why monetize refuses a box’s call.

OrderRefusal

Why a box refuses an order.

Constants

CALL_DOMAIN

The domain tag every box’s call signature starts with.

CALL_FRESH_MS

How far a box’s call time may be from monetize’s clock.

FUTURE_SKEW_MS

How far ahead of the box’s clock an order may be dated (the shared pump’s and Gunnar’s five minutes).

KEEP_BOOT_WITHIN

How long a front waits on the shop’s SoldEstate.Upgrade: the shop’s whole keep boot, 2 h, the ONE constant the shop holds its call by (monetize_product::KEEP_BOOT_WITHIN; lane G9, A7 row 9, Gunnar b74ca801). A front that gave up first would count a slow keep boot as lost and ask for a Recharge while the shop still works. How long a whole keep boot may take (audit 7, 2026-10-18; lane G9, A7 row 9): the keep medium imported and cloned, the box stopped, the medium’s run (the provider’s own budget, 45 min at UpCloud), the clone given back and the box started. The shop holds its Upgrade call this long (monetize_cloud::lay::KEEP_BOOT_WITHIN), and every product’s front waits on it exactly as long (monetize_embed::fleet::KEEP_BOOT_WITHIN, Gunnar b74ca801): a front that gave up first would report a failure while the shop still works. ONE constant, here, because the shop’s cloud crate and the fronts’ embed crate both stand on this one.

LONG_POLL_MAX_MS

How long Fleet.Orders is held open at most before it answers empty.

ORDER_DOMAIN

The domain tag every order signature starts with.

UPGRADE_RUNNING

The shop’s words for an Upgrade still running (an upgrade of <host> is already running here, an UNAVAILABLE answer): the front that hears them asks again later (REL-T2-1: the Upgrade is started, then polled). The ONE box says them; the front’s door reads them.

Functions

fleet_call_message

The bytes a box’s call signature covers: CALL_DOMAIN ‖ at (u64 BE) ‖ then product, instance, role, call, body, each as u32 BE length ‖ bytes.

order_message

The bytes an order’s signature covers: ORDER_DOMAIN ‖ seq ‖ issued ‖ not_after (u64 BE) ‖ then product, instance, role, kind, body, each as u32 BE length ‖ bytes.

verify_fleet_call

Verify a box’s call under its appliance key, fresh at now_unix_ms.

verify_order

The box’s check, as strict as the shared pump’s (monetize_estate_side::pump::check): signed under key with STRICT Ed25519 (no small-order key or R), checked first, so a forged order is always OrderRefusal::Signature and never moves the box’s sequence; then for (product, instance, role), newer than last_seq, inside its window at now_unix_ms (not_after 0 = none), and dated no more than FUTURE_SKEW_MS ahead of the box’s clock.