Module reaper

Enums§

REAPER_LOCK: Elects the single replica allowed to reap. Every node competes for this one name, so the value matters only in that it must be identical everywhere.

reap_once: Scans all leases once and revokes any that have expired. Returns the number successfully reaped; individual failures are logged and skipped (they’ll be retried on the next pass).
reap_once_if_leader: Runs one reap pass, but only on the replica that holds the reaper lock. Returns None on a standby node, which has nothing to do.
revoke_lease: Revokes one lease by asking its owning engine mount to revoke() it, then removing the lease record. Best-effort: engine failures are reported to the caller but the lease record is only deleted on success, so a failed revoke is retried on the next pass rather than silently lost.
revoke_leases_for_token: Revokes every lease owned by token_id_hash — called when a token is revoked so its dynamic credentials don’t outlive it.
spawn_reaper: Spawns a background task that reaps on a fixed interval for the lifetime of the process, on whichever replica wins the lock.