Struct DeltaGuard 

pub struct DeltaGuard { /* private fields */ }

Bounds the Active/Inactive/NBA convergence loop within one timestep (SC-079). The outer driver must call Self::tick on every delta-loop iteration, and Self::reset exactly once per timestep (never per delta iteration — DT-050).

Implementations

impl DeltaGuard

pub fn new(max: u32) -> Self

pub fn tick(&mut self, at: SchedTime) -> Result<(), DeltaGuardError>

Call once per delta-loop iteration. Increments the iteration count and returns Err(DeltaGuardError::LivelockExceeded { .. }) once that count exceeds max — never truncates, never logs-and-continues (SC-080/DT-050’s hard-error policy).

pub fn reset(&mut self)

Call once per timestep — when the outer driver’s now advances — never once per delta-loop iteration. Resetting mid-timestep would let a genuine livelock hide behind an unrelated reset call, which is exactly what this guard exists to prevent.

pub fn count(&self) -> u32

NEW (Task 21, wA-sched plan; ledger SC-007) — the current iteration count since the last Self::reset, read-only and side-effect-free (unlike Self::tick, never increments, never errors). Lets the outer driver (sched::control::Engine::run_until) capture a per-timestep high-water mark for black-box integration tests to observe (Engine::max_delta_iterations_in_a_timestep) — SC-007’s acceptance requires proving the delta loop actually converges (a bounded number of passes), not just that it eventually does something; with count private and no getter, no test outside this crate’s own #[cfg(test)] unit tests could observe that bound at all.