Struct BackoffPolicy 

pub struct BackoffPolicy {
    pub first_attempt_grace: Duration,
    pub base: Duration,
    pub ceiling: Duration,
    pub max_attempts: u32,
}

When a pending entry becomes eligible for another relay attempt.

Why: ADR-0034 §2 says “Console retries with backoff” and the first cut had none — every pending entry was re-relayed every 60 s, each non-ack rewriting the full base64 body plus two fsyncs. Until step 4 binds a listener that is every delivery, forever. What: a grace period for a never-attempted entry, exponential spacing keyed on attempts, a ceiling, and a hard stop. Pure — BackoffPolicy::is_due takes now so the rules are testable without sleeping. Test: backoff_holds_off_a_freshly_spooled_entry, backoff_spacing_grows_with_attempts, backoff_respects_the_ceiling, backoff_stops_at_max_attempts.

Fields

first_attempt_grace: Duration

How long a never-attempted entry is left alone after being spooled.

Set to the relay timeout: within that window the request path that spooled it may still be relaying it, and its claim has not necessarily been taken yet at the instant the sweep lists the directory.

base: Duration

Spacing after the first failure; doubles per subsequent attempt.

ceiling: Duration

Upper bound on the spacing, however many attempts have failed.

max_attempts: u32

After this many failed attempts the entry is never relayed again.

It is NOT deleted — it stays on disk and keeps the health signal red, because an undeliverable webhook is an operator problem, not garbage. The cap exists so a permanently unrelayable entry stops costing a full-body rewrite and two fsyncs on every tick.

Implementations

impl BackoffPolicy

pub fn delay_after(&self, attempts: u32) -> Duration

Spacing required after attempts failures.

base << (attempts - 1), saturating into BackoffPolicy::ceiling. The shift is bounded before it is applied, so a large attempt count cannot overflow into a small delay.

Test: backoff_spacing_grows_with_attempts, backoff_respects_the_ceiling.

pub fn is_due(&self, entry: &SpoolEntry, now_unix_ms: u64) -> bool

Whether entry may be relayed again at now_unix_ms.

Why: the sweep’s only admission test. Returning false leaves the entry exactly where it is — pending, durable, and visible to the health scan — so a “not due” entry is never a dropped one. What: false past BackoffPolicy::max_attempts; otherwise the elapsed time since the last attempt (or since receipt, for a never-attempted entry) must meet BackoffPolicy::delay_after. Test: backoff_holds_off_a_freshly_spooled_entry, backoff_stops_at_max_attempts, backoff_admits_an_entry_past_its_delay.

pub fn is_exhausted(&self, entry: &SpoolEntry) -> bool

Whether entry has exhausted its retries and needs an operator.

Distinguished from “not due yet” so the sweep can report the two separately — one resolves itself, the other never will.

Trait Implementations

impl Clone for BackoffPolicy

fn clone(&self) -> BackoffPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for BackoffPolicy

impl Debug for BackoffPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for BackoffPolicy

fn default() -> Self

5 s grace, 30 s base doubling to a 1 h ceiling, giving up after 24 failures — roughly a day of retries for an entry that never lands.

impl Eq for BackoffPolicy

impl PartialEq for BackoffPolicy

fn eq(&self, other: &BackoffPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for BackoffPolicy