Struct WarmSwap 

pub struct WarmSwap<G, D, L, R> { /* private fields */ }

The warm drain-swap-resume orchestrator over its four control seams.

Holds the admission gate, the drain, the lease control, and the resume seam. WarmSwap::run drives the fixed sequence, delegating the swap core (verify → apply → health check → auto-rollback) to a Stager whose Activator is a process or image swap. The orchestrator adds only the ordering: close before drain, drain before release, release before swap, swap before re-acquire, re-acquire before resume.

Implementations

impl<G, D, L, R> WarmSwap<G, D, L, R>

where G: AdmissionGate, D: Drain, L: LeaseControl, R: Resume,

pub const fn new(gate: G, drain: D, lease: L, resume: R) -> Self

Build a warm-swap orchestrator over its four control seams.

pub fn run<S, V, A, H>( &self, verdict: &Compatibility, stager: &mut Stager<S, V, A, H>, release: &ReleaseId, ) -> Result<WarmSwapReport, WarmSwapError>

where S: UpdateSource, V: SignatureVerifier, A: Activator, H: HealthCheck,

Run the warm drain-swap-resume for a Warm-classified release.

The sequence is fixed and its ordering is the invariant:

1. gate on the classifier — refuse anything but Compatibility::Warm before touching any seam;
2. close admission, so no new turn is admitted while draining;
3. drain to a committed checkpoint — in-flight turns and paused approvals reach their turn_complete marker, captured as a Checkpoint, while the lease is still held;
4. release the lease;
5. swap via the Stager — verify the new binary’s signature, apply the pointer flip, health-check, and auto-roll-back on failure;
6. re-acquire the lease — always, on whichever binary is now live, so the conversation is never left drained-but-dead;
7. resume from the checkpoint, re-driving paused approvals, and verify it restarted from exactly the drained turn.

The lease re-acquire in step 6 runs even when the swap rolled back or its signature was refused, so a failed swap surfaces its error only after the conversation is back under a held lease.

Errors

Returns WarmSwapError::NotWarm when verdict is not warm (nothing is drained or swapped); WarmSwapError::Admission or WarmSwapError::Drain when the pre-swap steps fail (the lease is still held); WarmSwapError::Lease when a release or re-acquire fails; WarmSwapError::Stage when the stager cannot verify or apply the swap (surfaced after the lease is re-acquired); and WarmSwapError::Resume or WarmSwapError::ResumeMismatch when resume fails or restarts from the wrong turn.