Struct HealthPolicy 

pub struct HealthPolicy {
    pub heartbeat_timeout: Duration,
    pub max_replication_lag: u64,
    pub max_recent_errors: u32,
    pub failover_threshold: u8,
    pub degraded_threshold: u8,
    pub grace_period: Duration,
}

The tunables that turn raw signals into a HealthScore and gate failover.

The defaults (HealthPolicy::default) are deliberately conservative: generous enough that an ordinary hiccup does not trip a failover, with a grace period long enough to ride out a transient blip.

Fields

heartbeat_timeout: Duration

Heartbeat age at or beyond which the liveness sub-score bottoms out at 0.

max_replication_lag: u64

Replication lag (LSNs) at or beyond which the lag sub-score bottoms out.

max_recent_errors: u32

Recent-error count at or beyond which the error sub-score bottoms out.

failover_threshold: u8

Score (inclusive) at or below which a member is Failed.

degraded_threshold: u8

Score (inclusive) at or below which a member is at least Degraded. Must be >= failover_threshold.

grace_period: Duration

How long a member must stay continuously Failed before the supervisor will fail it over. The flapping damper: a shorter blip never triggers a transition.

Implementations

impl HealthPolicy

pub fn evaluate(&self, signals: &MemberSignals) -> HealthScore

Combine raw signals into a HealthScore under this policy.

The three serving signals fold into the overall score with a liveness-heavy weighting (liveness 70%, lag 20%, errors 10%): a member whose heartbeat has fully lapsed must be able to reach the failover threshold on liveness alone — a crashed node stops heartbeating but its last-known lag and error counts may still look fine, so trusting them would wedge failover shut. At the same time a live owner that is far behind or erroring is penalised rather than trusted blindly, and a brief heartbeat gap with good lag/errors stays out of the failover band (which a single short fixed timeout could not express). The grace-period signal (unhealthy_for) is not part of the score — it gates the failover action in failover_eligible.

pub fn failover_eligible( &self, score: &HealthScore, signals: &MemberSignals, ) -> bool

Whether a member with this score and these signals is eligible for automatic failover: it must be Failed and have stayed unhealthy for at least the grace period. A Failed member still inside the grace window is held back — the flapping damper.

Trait Implementations

impl Clone for HealthPolicy

fn clone(&self) -> HealthPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for HealthPolicy

impl Debug for HealthPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for HealthPolicy

fn default() -> HealthPolicy

Returns the “default value” for a type.

impl Eq for HealthPolicy

impl PartialEq for HealthPolicy

fn eq(&self, other: &HealthPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for HealthPolicy