Struct MeshOsLoop 

pub struct MeshOsLoop { /* private fields */ }

Per-node MeshOS instance. Owns the actual + desired state folds, the event-source channel, and the action-executor channel. Cloneable handles (MeshOsHandle) hand out mpsc::Sender<MeshOsEvent> clones for sources to publish on; MeshOsLoop::run is the long-lived task.

Implementations

impl MeshOsLoop

pub fn new(config: MeshOsConfig) -> MeshOsLoopParts

Construct a loop bound to the given config. Returns the loop + its publish handle + the action-queue receiver + the snapshot reader, bundled in MeshOsLoopParts so future additions don’t break the constructor signature.

pub fn dropped_actions_counter(&self) -> Arc<AtomicU64>

Clone the dropped-action counter. The runtime uses this to surface the count through ExecutorStatsSnapshot; tests can also assert against it directly.

pub fn with_probe_registry(self, registry: ProbeRegistry) -> Self

Attach a probe registry. The loop polls each registered probe on every Tick, before reconcile. The registry is shareable + cloneable, so callers retain it to add probes after MeshOsLoop::new returns (the loop has been moved into the spawned task at that point).

pub fn with_scheduler_registry(self, registry: SchedulerRegistry) -> Self

Attach a scheduler registry. The reconcile pass reads the registered scorer to drive Phase D-1 rebalancing. Cloneable + shareable like the probe registry.

pub fn with_recovery_registry(self, registry: RecoveryRegistry) -> Self

Attach a recovery registry. SDK consumers register one RecoveryHandler per group whose slots can be re-placed; the tick handler runs them all once per Tick (after poll_probes, before run_reconcile) so the reconcile pass sees the recovered slot states.

pub fn recovery_registry(&self) -> &RecoveryRegistry

Borrow the recovery registry — SDK consumers register new handlers post-build. The MeshOsRuntime accessor surfaces this so callers don’t have to retain a clone.

pub fn with_executor_failures( self, failures: Arc<RwLock<VecDeque<FailureRecord>>>, ) -> Self

Attach the executor’s recent-failures ring. The loop reads it on every publish_snapshot so the snapshot’s recent_failures field reflects executor-side dispatch failures (the MeshOsSnapshotFold chain-record path is not the only failure surface). The runtime calls this after ActionExecutor::new so both halves of the pair share the same ring.

pub fn with_executor_failure_writer( self, seq: Arc<AtomicU64>, appender: Arc<dyn FailureChainAppender>, ) -> Self

Attach the executor’s failure-seq counter + chain appender so the loop can record its own runtime-side failures (e.g. migration-abort dispatcher errors) with the same monotonic sequence + durable chain dual-write the executor uses. Pair this with Self::with_executor_failures; together the trio makes the loop’s internal record_runtime_failure helper a complete dual write into the snapshot ring + the chain.

pub fn with_control_sink(self, sink: Arc<dyn ControlSink>) -> Self

Attach a ControlSink. When set, the loop translates this-node maintenance state transitions into MeshOsControl events and forwards them through the sink. The SDK installs a sink that routes events to per-daemon control channels via its router; substrate code that doesn’t need the SDK surface can leave this unset.

pub fn with_admin_verifier(self, verifier: Arc<AdminVerifier>) -> Self

Attach an super::ice::AdminVerifier. When set, every MeshOsEvent::SignedIceCommit is gated on signature verification + the cluster’s signature threshold before folding the inner super::event::AdminEvent. Verified commits fold normally; rejected commits drop + emit a failure record so operators see the rejection in the snapshot’s recent_failures ring (substrate slice that wires the failure pipe lands alongside the SDK surface upgrade).

pub fn with_admin_audit_appender( self, appender: Arc<dyn AdminAuditChainAppender>, ) -> Self

Attach a super::audit_chain::AdminAuditChainAppender. The loop’s record_admin_audit path dual-writes every admin commit to both the in-memory ring (snapshot readable) and this appender (chain-backed history). Without an explicit appender the loop uses the no-op default; only the in-memory ring is observable.

pub fn with_log_appender(self, appender: Arc<dyn LogChainAppender>) -> Self

Attach a super::log_chain::LogChainAppender. The loop’s record_log_line path dual-writes every log line to both the in-memory ring (snapshot readable) and this appender (chain-backed history). Without an explicit appender the loop uses the no-op default.

pub fn with_migration_aborter(self, aborter: Arc<dyn MigrationAborter>) -> Self

Attach a super::migration_aborter::MigrationAborter. The loop calls this after folding a verified super::event::AdminEvent::KillMigration; production deployments wire the super::migration_aborter::OrchestratorMigrationAborter adapter so the cluster’s local MigrationOrchestrator actually aborts in-flight migrations. Without an explicit aborter the commit lands on the audit chain but the migration runs to completion.

pub fn with_migration_snapshot_source( self, source: Arc<dyn MigrationSnapshotSource>, ) -> Self

Attach a super::migration_snapshot_source::MigrationSnapshotSource. The loop reads this on every snapshot publish and embeds the result in the snapshot’s in_flight_migrations field — the ICE simulator reads it to enumerate which daemon a KillMigration target would affect.

pub async fn run(self) -> u64

Drive the loop until either:

1. all MeshOsHandle clones drop and the source channel empties (graceful end-of-events), or
2. a MeshOsEvent::Shutdown is dequeued.

Returns the final reconcile_count — used by tests; in production it’s diagnostic-only.