Struct Lifetime 

pub struct Lifetime {
    pub permanent: Option<PermanentLifetime>,
    pub ephemeral: Option<EphemeralLifetime>,
}

Lifetime slot on ProcessSpec. Exactly one variant should be populated; when both are unset the resolver returns Permanent.

Fields

permanent: Option<PermanentLifetime>

ephemeral: Option<EphemeralLifetime>

Implementations

impl Lifetime

pub fn is_default(&self) -> bool

True when no variant is set — treated as Permanent by the resolver.

pub fn permanent() -> Self

Permanent-only Lifetime — the permanent slot is populated with the zero-sized PermanentLifetime marker and the ephemeral slot is None. Peer of Self::ephemeral on the LifetimeKind closed set; the two composers between them cover every non-ambiguous non-empty corner of the two-slot tagged-union wire shape.

Pre-lift the 4-token Lifetime { permanent: Some(PermanentLifetime {}), ephemeral: None } (equivalently Lifetime { permanent: Some(PermanentLifetime {}), ..Lifetime::default() }) fixture literal was hand-authored at FOUR workspace-wide sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold:

• [crate::crd::tests::permanent_only_process] — Process fixture with the permanent-only lifetime slot for the resolved_ephemeral projection test matrix.
• [tests::resolved_ephemeral_projects_only_the_unambiguous_ephemeral_slot] — the “Permanent-only” branch of the same matrix in this module.
• [tests::single_slot_lifetime] — closed-set helper’s Permanent arm, shared across property tests that walk LifetimeKind::ALL.
• tatara-pool-reconciler::controller_pool::process_from_template — production seed of a pool-member Process’s lifetime slot on the fork path (Pool member starts Permanent; allocation flips it).

Post-lift every callsite reads Lifetime::permanent() and the substrate owns the shape. A future normalization (a warn-log on callers that construct a permanent-only lifetime past a hardening window, an audit trail that stamps a compile-generation onto the zero-sized PermanentLifetime, or a deprecation of the empty marker in favor of a richer permanent variant) lands at THIS ONE substrate function and every downstream consumer inherits the upgrade mechanically.

The ambiguous corner (both permanent AND ephemeral set) is deliberately NOT reachable through this composer — the composer’s contract is “the resolver picks Permanent”, and an ambiguous Lifetime resolves to LifetimeError::Ambiguous, not to Permanent. Tests that exercise the ambiguous corner (e.g. [crate::crd::tests::ambiguous_lifetime_process], [tests::ambiguous_lifetime_errors]) stay hand-authored as struct literals — they need to violate the “exactly one slot” invariant this composer preserves.

Sibling composer: Self::ephemeral on the Ephemeral arm of the same LifetimeKind closed set.

Theory anchor: THEORY.md §VI.1 (generation over composition — the Lifetime { permanent: Some(PermanentLifetime {}), .. } shape recurred at four hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the resolved-variant corner AND the discriminator kind AND the round-trip through Self::variant so a regression that drifted any surface fails at tests::permanent_composer_* here rather than as silent operator-facing skew between the fork-path production seed and the test-side fixture literals).

pub fn ephemeral(e: EphemeralLifetime) -> Self

Ephemeral-only Lifetime — the ephemeral slot is populated with the supplied EphemeralLifetime and the permanent slot is None. Peer of Self::permanent on the LifetimeKind closed set.

Pre-lift the 4-token Lifetime { permanent: None, ephemeral: Some(<e>) } (equivalently Lifetime { ephemeral: Some(<e>), ..Lifetime::default() }) fixture literal was hand-authored at ELEVEN+ workspace-wide sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold, split across production seeds (tatara-process::ephemeral::From<EphemeralSpec> for ProcessSpec — the (defephemeral …) Lisp form’s typed lowering; tatara-pool-reconciler::controller_allocation — the allocator Bind arm flipping a pool-member Process from Permanent to Ephemeral with the requestor’s TTL) and test fixtures across crate::crd, crate::lifetime_clock, this module, tatara-pool-reconciler, and tatara-reconciler::render.

Post-lift every callsite reads Lifetime::ephemeral(<e>) and the substrate owns the shape. A future normalization (a per-fleet TTL floor stamp before storing the inner EphemeralLifetime, an audit trail that records the composed lifetime’s provenance, a shared warn on empty exports at Attested-terminal phases) lands at THIS ONE substrate function and every downstream consumer inherits the upgrade mechanically.

Return-form axis: takes an owned EphemeralLifetime rather than a &EphemeralLifetime, matching every current caller (each constructs the inner EphemeralLifetime directly at the call site as a rvalue-shape struct literal, then hands it to the composer).

The ambiguous corner (both slots set) is NOT reachable through this composer — see Self::permanent’s docs for the parity with the peer + the rationale for keeping ambiguous-corner tests as hand-authored struct literals.

Sibling composer: Self::permanent on the Permanent arm of the same LifetimeKind closed set.

Theory anchor: same as Self::permanent — THEORY.md §VI.1 (generation over composition) + §II.1 invariant 5 (composition preserves proofs).

pub fn variant(&self) -> Result<LifetimeVariant<'_>, LifetimeError>

Resolve to a variant view. Empty resolves to Permanent (a static borrow on the embedded DEFAULT_PERMANENT); ambiguous (both set) is an error.

Sweeps over LifetimeKind::ALL so a third variant added with an ALL entry is structurally honored at this site — no parallel is_some() count, no per-variant if-let chain.

pub fn is_ephemeral(&self) -> bool

True iff ephemeral is set.

pub fn resolved_ephemeral(&self) -> Option<&EphemeralLifetime>

Compound projection: Some(&e) iff Self::variant resolves unambiguously to Ephemeral(e); None for every other outcome (empty → Permanent default, Permanent slot only, or LifetimeError::Ambiguous when BOTH slots are set).

The ambiguous case is deliberately collapsed to None: an operator-authored spec with both permanent: and ephemeral: populated is a mis-configuration, and every production consumer of the pair crate::lifetime_clock::evaluate + crate::lifetime_clock::requeue_with_ttl previously hand-rolled the SAME two-step projection (variant().ok()?.as_ephemeral()) whose Err-arm and Permanent-arm both fell through to the same “no ephemeral action” outcome (AutoTerminate::Skip / default requeue). Lifting that chained collapse to ONE substrate primitive puts “the ephemeral spec now, iff the resolver picked it” behind a single call site and closes the possibility of a per-consumer drift where one branch honors ambiguity and the other doesn’t.

A future third variant added to Lifetime (e.g. Burst for budget-capped non-TTL lifetimes) reaches this projection through the SAME Self::variant resolver + the SAME LifetimeVariant::as_ephemeral discriminator, so the ephemeral-only projection stays intact without a new arm here.

Pinned by resolved_ephemeral_projects_only_the_unambiguous_ephemeral_slot.

Trait Implementations

impl Clone for Lifetime

fn clone(&self) -> Lifetime

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Lifetime

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Lifetime

fn default() -> Lifetime

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Lifetime

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Lifetime

fn schema_name() -> String

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn is_referenceable() -> bool

Whether JSON Schemas generated for this type should be re-used where possible using the $ref keyword.

impl Serialize for Lifetime

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.