[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_179":-5,"_182":183,"_184":185},"routes/shell",{"_41":42,"_178":-5,"_179":-5,"_180":181},"routes/repo",{"_34":-7,"_35":36,"_37":38,"_39":40,"_41":42,"_43":32,"_44":32,"_45":32,"_46":32,"_47":32,"_48":32,"_49":50,"_51":50,"_52":32,"_53":-7,"_54":-7,"_55":56,"_57":58,"_59":60,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-5,"_26":27,"_28":29,"_29":30,"_31":32,"_33":14},"ref","main","path","crates/logic/types.rs","oid","72e388a773e06497868ebd4ff8174768bab494d2","size",53826,"commit","90b43017241f81189453d326d05948f388b34652","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","// Copyright 2026 Deno Land Inc. Apache-2.0 license.\n\n//! The vocabulary the core is written in: what it is told, what it\n//! answers with, and the records it reads and writes.\n//!\n//! Everything here is data. `Event` is the only way in, `Effect` the only\n//! way out, and the rest are the shapes those two carry. No decision is\n//! made in this file — that is `State` in the crate root.\nuse super::*;\n\npub type Ms = i64;\n\npub type CellId = String;\npub type NodeId = String;\npub type RequestId = u64;\npub type WebSocketId = u64;\npub type OpId = u64;\npub type Epoch = u64;\n\n/// One runtime that this node can currently serve locally.\n///\n/// Presence is a read-only projection of the decision core, not a second\n/// inventory maintained by an adapter. Keeping the epoch beside the cell ID\n/// lets management and inspection traffic identify the exact fenced runtime.\n#[derive(Clone, Debug, PartialEq, Eq)]\npub struct PresenceCell {\n pub id: CellId,\n pub epoch: Epoch,\n}\n\n/// Cumulative lifecycle decisions exposed to management from the same state\n/// machine that made them. These are advisory counters, but they are not a\n/// second shell-owned model and replay to the same values for the same events.\n#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]\npub struct ActivitySnapshot {\n pub acquired: u64,\n pub proxied: u64,\n pub expired_owner_leases: u64,\n pub restored: u64,\n pub advanced_epochs: u64,\n /// Shutdown handoffs acknowledged after a successor acquired authority.\n pub handed_off: u64,\n /// Handoff operations that the executor explicitly rejected. A process\n /// deadline can terminate before this counter changes.\n pub handoff_failed: u64,\n /// Balancing moves a peer acquired. A subset of `handed_off`.\n pub rebalanced: u64,\n /// Balancing moves no peer acquired. A subset of `handoff_failed`; the\n /// cell stayed unowned and its next request re-reads ownership.\n pub rebalance_failed: u64,\n /// Cached owner or capacity routes retired after an observed lease\n /// deadline. Counts one per retirement, including healthy renewals;\n /// lease-less adoption replies and explicit invalidations do not count.\n pub remote_route_refreshes: u64,\n}\n\n/// Management-facing lifecycle state derived atomically from [`State`].\n#[derive(Clone, Debug, PartialEq, Eq)]\npub struct PresenceSnapshot {\n pub serving: bool,\n pub cells: Vec,\n pub activity: ActivitySnapshot,\n}\n\nimpl PresenceSnapshot {\n pub fn owned_cells(&self) -> usize {\n self.cells.len()\n }\n}\n\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub struct Config {\n /// Resident cells plus activation reservations may never exceed this.\n pub max_resident: usize,\n /// Complete nonresident routes which may be in flight at once.\n ///\n /// This is deliberately independent of the stateless Worker pool. A warm\n /// request consumes no activation slot, while a cold request holds one\n /// across ownership resolution, capacity waiting, restore, and publish.\n pub max_activations: usize,\n /// Evictions that may hold a durability proof in flight at once.\n ///\n /// A proof is a round trip to the bucket, so draining a node one cell at a\n /// time takes the number of cells times that latency -- a node shedding\n /// five hundred cells against a two hundred millisecond proof refuses\n /// admission for a minute and a half while it walks down. Bounded\n /// concurrency is what makes the walk down finish in a time anyone can\n /// reason about.\n pub max_evictions: usize,\n /// Complete cell handoffs in flight at once during shutdown.\n ///\n /// `max_evictions` is tuned for a background walk down beside live\n /// traffic. This permit remains held through durability, release, and\n /// successor ownership acceptance. The successor's activation ceiling\n /// bounds the asynchronous restore wave after acceptance.\n pub max_releases: usize,\n /// Concurrent outbound WebSockets one cell may hold.\n ///\n /// Distinct from the node-wide pin budget, which counts *cells* held\n /// resident: one socket is enough to pin a cell, so that budget says\n /// nothing about how many a single cell may open. This bounds what one\n /// application can consume on its own behalf.\n pub max_outbound_websockets: usize,\n /// What an evicted cell's ownership record should say.\n ///\n /// Releasing it lets any node take the cell next, which is what makes a\n /// loaded node shed load rather than merely stop hosting it: keeping the\n /// record means every later request for that cell still routes here, to a\n /// node that already decided it has no room. Keeping it is right when the\n /// local eviction snapshot is the point, because a same-node wake is a\n /// rename instead of a restore.\n pub ownership_on_evict: OwnershipOnEvict,\n /// Production executors require a live self-node lease before serving.\n /// Deterministic unit slices which do not exercise node authority can\n /// disable this explicitly.\n pub require_node_lease: bool,\n /// Exact cross-node request protocol this process can authenticate and\n /// understand. A live owner speaking another version is unavailable, not\n /// stale: incompatibility never authorizes takeover.\n pub peer_protocol: u16,\n /// How long an activation effect may remain outstanding before the core\n /// stops waiting for it.\n ///\n /// Without this a swallowed effect is invisible: no event ever arrives, no\n /// timer is watching, and the request waits forever while every piece of\n /// state remains perfectly consistent. celld shipped that and parked\n /// requests past ninety seconds. `None` restores the old behaviour, which\n /// callers use only when they need to observe an indefinite wait.\n pub operation_deadline_ms: Option,\n /// How long a cell waits after a failed dead-owner log recovery\n /// before it re-enters ownership resolution.\n ///\n /// A recovery fails precisely when the owner just died with a deep\n /// open log: the survivors' sweep of that log is what the request\n /// is really waiting for, and a thousand-cell owner measured\n /// ~155 s of it. Failing the request instead turns that window\n /// into minutes of hard errors.\n pub owner_log_recovery_backoff_ms: u64,\n /// How many failed recovery cycles a cell may retry before its\n /// requests fail with `ResolveFailed`.\n ///\n /// A bound, not a target: the shell's own request lifetimes cut a\n /// waiting client far earlier. At the default backoff this covers\n /// the measured sweep above with a wide margin, so the cap only\n /// fires on a recovery that is truly wedged.\n pub owner_log_recovery_attempts: u32,\n /// How close an armed alarm may be before the cell stops being worth\n /// evicting. Inside this window the wake would cost more than the\n /// residency it saves, so the cell is held.\n pub alarm_resident_ms: u64,\n /// How long a cell may sit unused before the node gives it back, with no\n /// pressure involved. `None` keeps every cell resident until something\n /// needs the room.\n pub idle_evict_ms: Option,\n /// Ceilings and low watermarks for load shedding.\n ///\n /// `max_resident` is a hard cap on reservations; this is the softer,\n /// resource-aware question of whether the node is overloaded at all.\n /// Without it a node has only a cell count to reason about, so it meets\n /// memory exhaustion by running into it rather than shedding.\n pub pressure: pressure::PressureConfig,\n}\n\n#[derive(Clone, Debug, PartialEq, Eq)]\npub struct OwnerRecord {\n /// `None` is a deliberately released, fenced record. Epochs never reset.\n pub node: Option,\n pub epoch: Epoch,\n pub etag: String,\n}\n\n/// The routing and authority fields read from `nodes/.json`.\n///\n/// The executor samples wall time and returns the verbatim record. The core,\n/// not the storage adapter, decides whether it is live and routable.\n#[derive(Clone, Debug, PartialEq, Eq)]\npub struct NodeLeaseRecord {\n pub node: NodeId,\n pub addr: String,\n pub expires_ms: u64,\n pub peer_protocol: u16,\n /// Per-process generation; production stores this in\n /// `ownership_index_generation` and, as the same value, in\n /// `probe_public_key`.\n pub generation: String,\n /// The folded node-log state: `None` means this session never opened\n /// a fleet log — it never acked past the bucket. Anything not sealed\n /// gates a takeover of this node's cells behind node-log recovery.\n pub log_state: Option,\n /// Object version observed by the read. Empty only in synthetic events.\n pub etag: String,\n}\n\n/// One advisory fleet-capacity observation returned by the storage shell.\n///\n/// Membership and expiry remain authoritative node-lease facts. Load is only\n/// used to choose where an unowned cell should try to land; the chosen peer\n/// must still atomically admit the handoff before it acquires ownership.\n#[derive(Clone, Debug, PartialEq, Eq)]\npub struct CapacityPeer {\n pub node: NodeId,\n pub addr: String,\n pub expires_ms: u64,\n pub peer_protocol: u16,\n pub sampled_ms: u64,\n /// Confirmed ownership held by this peer, including dormant cells.\n /// `None` from a peer that predates this field.\n pub owned_cells: Option,\n /// The share of fleet ownership this peer wants, relative to the other\n /// weights. `None` from a peer that predates rebalancing.\n pub placement_weight: Option,\n /// The newest bucket format this peer reads (`crate::format`). `None`\n /// from a peer that predates the field, which reads format 1.\n pub bucket_format: Option,\n pub resident_cells: usize,\n pub host_websockets: usize,\n pub rss_bytes: u64,\n /// The allocator-adjusted RSS fallback for ordinary memory pressure.\n /// `None` from a peer that predates the field.\n pub in_use_bytes: Option,\n pub pressured: bool,\n /// Whether every configured memory measurement is below its low\n /// watermark. `None` from a peer that predates this field.\n pub memory_headroom: Option,\n /// Cold routes that have not finished on this peer.\n pub restoring: u64,\n /// This process accepts a signed adoption request and acknowledges it\n /// after it acquires the cell's next ownership epoch.\n pub paced_handoff: bool,\n /// An operator paused balancing on this node. One paused lease stops\n /// every move in the fleet, so a pause from any node is fleet-wide.\n pub rebalance_paused: bool,\n /// This node is handing its cells away. It is not a receiver: for one\n /// lease lifetime after it empties it would otherwise look like the\n /// emptiest node in the fleet, and every cell sent to it fails its\n /// adoption or leaves with the drain.\n pub draining: bool,\n}\n\nimpl CapacityPeer {\n /// Whether this peer's own load report leaves room for another cell.\n ///\n /// The rebalance planner and the handoff executor must return the same\n /// answer here, so both read this one predicate. The planner counts a\n /// peer's room before it releases a batch, and the executor offers each\n /// released cell only to a peer that has room. A peer the planner counts\n /// and the executor then refuses leaves the cell unowned with its epoch\n /// retained, because the release CAS runs before the successor acquire\n /// and nothing puts the record back.\n ///\n /// A saturated ingress-only node is the case that breaks a split rule.\n /// It owns no cells, so it looks like the emptiest receiver in the\n /// fleet and the planner gives it the largest room, while the executor\n /// refuses every cell it is offered.\n pub fn reports_adoption_capacity(&self) -> bool {\n !self.pressured && self.memory_headroom != Some(false)\n }\n}\n\n/// A successor that has acquired a released cell.\n///\n/// The executor obtains this only from a signed peer acknowledgement. The\n/// successor can still be restoring the durable replica when it responds.\n#[derive(Clone, Debug, PartialEq, Eq)]\npub struct AdoptedCell {\n pub node: NodeId,\n pub addr: String,\n pub epoch: Epoch,\n pub peer_protocol: u16,\n}\n\n#[derive(Clone, Debug, PartialEq, Eq)]\npub struct NodeLeaseSpec {\n pub addr: String,\n pub peer_protocol: u16,\n pub generation: String,\n /// The generation named by a clean local reload certificate. An initial\n /// lease CAS can resume local cells only when it replaces this exact,\n /// still-live generation.\n pub resume_generation: Option,\n pub ttl_ms: u64,\n}\n\n#[derive(Clone, Debug, PartialEq, Eq)]\npub enum CasGuard {\n Absent,\n Match(String),\n}\n\n/// See [`Config::ownership_on_evict`].\n#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]\npub enum OwnershipOnEvict {\n /// Publish the cell as unowned so any node may take it next.\n #[default]\n Release,\n /// Keep the record, so a same-node wake can reuse the local snapshot.\n Sticky,\n}\n\n/// Why the node is halting. The shell writes this down: a process that\n/// self-fences and exits without saying why leaves an operator with an exit\n/// code and nothing else.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum HaltReason {\n /// The node lease was not renewed inside its TTL, so this node can no\n /// longer prove it owns anything it is serving.\n NodeLeaseExpired,\n /// A renewal readback found no node lease record, so the record that\n /// published the authority of this process is gone.\n NodeLeaseMissing,\n /// A renewal readback found a node lease record that this process can\n /// neither recognize nor adopt, so it can no longer prove its authority.\n /// The record can be a foreign replacement, or a late self-authored write\n /// that carries a stale folded log stamp; the readback cannot tell them\n /// apart, so the reason names the observation, not an author.\n NodeLeaseMismatch,\n}\n\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum CasOutcome {\n Applied,\n Rejected,\n}\n\n/// Observable result of a successful restore effect. A non-fresh activation\n/// may still discover that no local or replicated database exists; the\n/// adapter reports what happened instead of making the core infer I/O truth.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub struct RestoreOutcome {\n pub restored: bool,\n /// The alarm the restored database already had armed.\n ///\n /// A cell carries its alarm in its own SQLite, so a cell that arrives\n /// here from another node — or wakes cold — has one the isolate has not\n /// re-armed yet. Nothing else tells this node about it: the observer\n /// fires when a *running* isolate calls `setAlarm`, which is exactly the\n /// case this is not. Without it the mirror reads \"no alarm\" and every\n /// residency decision that consults it is wrong in the direction of\n /// shedding a cell that is about to fire.\n pub alarm: Option,\n}\n\n/// See [`RestoreOutcome::alarm`].\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub struct RestoredAlarm {\n pub at_ms: i64,\n /// Whether a durable wake entry already covers it. Read from the same\n /// flusher the observer consults, not assumed: claiming coverage this\n /// node cannot prove is how an alarm gets lost across an eviction.\n pub covered: bool,\n}\n\n#[derive(Clone, Debug, PartialEq, Eq)]\npub enum LeaseCasOutcome {\n Applied { etag: String },\n Rejected,\n}\n\n/// Deterministic timers are versioned effects, not implicit clock reads. A\n/// stale firing from a replaced lease generation is harmless.\n#[derive(Clone, Debug, PartialEq, Eq)]\npub enum Timer {\n NodeLeaseRenew {\n generation: u64,\n },\n NodeLeaseFence {\n generation: u64,\n },\n CellAlarm {\n cell: CellId,\n generation: u64,\n },\n /// Fires if `op` is still outstanding. Identified by operation rather than\n /// by cell, so a completion that lands first simply leaves a stale timer\n /// that finds nothing to expire.\n OperationDeadline {\n op: OpId,\n },\n /// Fires if `cell` is still parked behind the admission gate. Keyed by\n /// cell because a parked cell has no operation: `OperationDeadline` is\n /// armed per emitted effect, and parking is the state of having emitted\n /// none. Without this the queue is the one stall with no bound.\n QueuedActivation {\n cell: CellId,\n generation: u64,\n },\n /// Fires to re-enter ownership resolution after a failed dead-owner\n /// log recovery. Keyed by cell like `QueuedActivation`, because the\n /// backing-off cell holds no operation; the generation discards a\n /// stale retry after the cell moved on.\n OwnerLogRecoveryRetry {\n cell: CellId,\n generation: u64,\n },\n}\n\n/// Every way a cell's state can leave this process, and the one promise the\n/// application treats as if it had.\n///\n/// This enum lists every external route, plus `Sync`. It is deliberately not\n/// `#[non_exhaustive]`, so every exhaustive shell match stops compiling until\n/// somebody decides how a new channel is held and how it is released.\n///\n/// The core stores a channel and hands it back. It never reads it. A `match`\n/// on `Channel` inside `celld-logic` would split one output invariant into a\n/// separate rule for each channel.\n///\n/// An alarm is missing here on purpose, and stays missing. Its consuming\n/// commit does open a barrier -- as `GateOwner::Alarm`, keyed by the cell and\n/// epoch the firing was dispatched against -- but a barrier is not a channel.\n/// The alarm's settlement is not an egress: it is replayed back into the core\n/// rather than released to the shell, it has no request to route by, and the\n/// output gate does not release it to the shell, and it has no request to route\n/// by. A variant here would force the core to match on `Channel` to tell a\n/// release from a replay, which is the one thing this enum exists to prevent.\n#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]\npub enum Channel {\n /// The answer to the cell event itself: an HTTP response, a cell RPC\n /// reply, or a peer-served reply. A response whose body streams takes one\n /// ticket for its head and one more for each chunk, because a chunk the\n /// producer makes after the release can reveal a later write.\n Response,\n /// `fetch()` from a handler to a third party.\n Fetch,\n /// A frame from a `webSocketMessage` handler, captured by the host and\n /// released from the cell's barrier queue.\n WsHibernatable,\n /// A frame on a socket the isolate opened and polls itself. It cannot be\n /// captured, because the handler may be awaiting the reply to the very\n /// frame being held, so it waits on a durability ticket instead.\n WsSelf,\n /// A service-binding call, `env.NAME.fetch()` or its RPC form.\n Service,\n /// A call to another cell: its `fetch` or one of its RPC methods.\n CellRpc,\n /// An operation that changes an application R2 bucket.\n R2,\n /// A connection, write, TLS upgrade, or shutdown on a raw TCP socket.\n Tcp,\n /// A leased Queue batch leaving its broker for a consumer Worker.\n Queue,\n /// The promise `storage.sync()` returns to the handler. Nothing leaves\n /// the process on this route, but the application treats the settled\n /// promise as a durability statement and acts on it through routes the\n /// gate cannot hold: a log line, local work, or the next checkpoint. A\n /// promise that settles before the proof lets the application discard a\n /// recovery path it still needs. So the promise takes the same ticket an\n /// egress takes, and its release is the promise settling.\n Sync,\n}\n\nimpl Channel {\n /// Return the diagnostic name for this channel.\n pub fn as_str(self) -> &'static str {\n match self {\n Channel::Response => \"response\",\n Channel::Fetch => \"fetch\",\n Channel::WsHibernatable => \"ws_hibernatable\",\n Channel::WsSelf => \"ws_self\",\n Channel::Service => \"service\",\n Channel::CellRpc => \"cellrpc\",\n Channel::R2 => \"r2\",\n Channel::Tcp => \"tcp\",\n Channel::Queue => \"queue\",\n Channel::Sync => \"sync\",\n }\n }\n}\n\n/// Which mechanism proved a gated write durable. The fences differ: the\n/// fleet's follower ensemble arbitrates (a takeover seals a member first),\n/// the bucket only stores — so bucket proofs verify ownership before any\n/// reveal and fleet proofs do not need that extra read.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum ProofSource {\n Fleet,\n Bucket,\n}\n\n/// Whether a failed operation definitely did not commit or may have committed\n/// before its caller lost the response.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum Failure {\n Definite,\n Ambiguous,\n}\n\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum WebSocketKind {\n Hibernatable,\n Regular,\n /// A transport the cell opened itself with `new WebSocket(url)`. It pins\n /// its cell exactly as a regular one does -- a live transport cannot move\n /// with ownership -- but unlike an inbound client socket it is created by\n /// application code at a rate the application chooses, so how much of the\n /// node it may hold is budgeted.\n Outbound,\n}\n\n/// How far a wake hint reaches.\n///\n/// Every node lists the fleet's due wake entries on its tick, but only the\n/// node that holds the advisory waker lease may spend I/O on cells it does not\n/// own. `Owned` is every other node's hint: it wakes a cell this node holds\n/// dormant and does nothing else. `Fleet` is the elected waker's hint (and the\n/// boot scan's): it may probe a cell nobody here owns and take over a dead\n/// owner's cell.\n///\n/// The distinction exists because a hint costs an activation permit and an\n/// owner read before the core can learn the cell is someone else's. The\n/// fleet's due set is O(fleet) while a node's own is O(node), so a node that\n/// probed every fleet entry queued its own alarm wakes behind the fleet's:\n/// measured as a 60 s tail against 32 s on seven nodes (2026-09-01).\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum WakeHintScope {\n /// Wake a dormant cell this node owns; ignore every other cell.\n Owned,\n /// Probe ownership and take over a cell whose owner is gone.\n Fleet,\n}\n\n#[derive(Clone, Debug, PartialEq, Eq)]\npub enum Event {\n StartNodeLease {\n now_ms: u64,\n /// The monotonic instant `now_ms` was sampled. The initial lease's\n /// TTL is anchored here; without it the anchor is 0 and every\n /// millisecond of pre-actor startup counts against the first\n /// acquisition (a slow boot then discards a perfectly good lease).\n now_mono_ms: u64,\n spec: NodeLeaseSpec,\n },\n SelfNodeLeaseRead {\n op: OpId,\n now_ms: u64,\n now_mono_ms: u64,\n result: Result, Failure>,\n },\n NodeLeaseCasCompleted {\n op: OpId,\n now_mono_ms: u64,\n result: Result,\n /// The folded log state the shell serialized into THIS attempt's\n /// body. The shell stamps the body from its own slot at\n /// serialization time — after the core chose `desired` — so the\n /// core's readback comparisons must use this value, never its\n /// pre-attempt belief. `None` means the body carried no log\n /// object (bucket posture, or a backend that does not fold).\n stamped_log_state: Option,\n },\n /// The executor scanned the local paths after an exact node-generation\n /// handoff. These cells retain their existing ownership epochs, so the\n /// core can materialize them without reading or changing each owner.\n LocalCellsRead {\n result: Result, Failure>,\n },\n TimerFired {\n timer: Timer,\n now_ms: u64,\n now_mono_ms: u64,\n },\n Request {\n request: RequestId,\n cell: CellId,\n },\n /// Production form of [`Event::Request`] with the sampled clocks. Untimed\n /// model slices retain the compact variant above and use the state's last\n /// observed clocks.\n RequestAt {\n request: RequestId,\n cell: CellId,\n now_mono_ms: u64,\n },\n /// A peer selected this node as a possible landing place for an unowned\n /// cell. Unlike ordinary ingress, this request must refuse immediately if\n /// its advertised capacity has gone stale; waiting here would strand the\n /// forwarding node instead of letting it traverse another candidate.\n CapacityRequestAt {\n request: RequestId,\n cell: CellId,\n now_mono_ms: u64,\n },\n /// A terminating peer asks this node to acquire an unowned cell. The\n /// ownership record must move now, but the runtime stays dormant until\n /// real traffic needs it. This avoids an eager fleet-wide restore wave.\n HandoffRequestAt {\n request: RequestId,\n cell: CellId,\n now_ms: u64,\n now_mono_ms: u64,\n },\n /// An event from a WebSocket that this cell already owns. A regular or\n /// outbound WebSocket pins its resident runtime, so its final events must\n /// still run locally after a shutdown batch marks the cell as quiescing.\n /// The exact WebSocket identity prevents new traffic from using this path.\n WebSocketRequestAt {\n request: RequestId,\n cell: CellId,\n websocket: WebSocketId,\n now_ms: u64,\n now_mono_ms: u64,\n },\n /// The output gate for an effect that work already running on this cell\n /// raised. Only the cell's own isolate raises one, so it belongs to\n /// admitted work and must not queue behind a swap that waits for that\n /// same work to finish.\n GateRequestAt {\n request: RequestId,\n cell: CellId,\n now_mono_ms: u64,\n },\n /// Reserve an idle resident isolate for a top-level Worker request. The\n /// shell falls back to the stateless pool when no resident is available;\n /// choosing and pinning a resident is lifecycle policy and therefore\n /// belongs in the replayable core.\n WorkerRequest {\n request: RequestId,\n },\n /// Stop cold activation work for a planned same-node replacement while\n /// leaving published runtimes and ownership intact. Late shell completions\n /// are stale, so a long restore cannot consume the complete shutdown grace\n /// and disable the certified local-reload path for every resident cell.\n BeginPreserve,\n Cancel {\n request: RequestId,\n },\n ActivityFinished {\n request: RequestId,\n },\n /// An effect is ready to leave the process on `channel`, and it can reveal\n /// this cell's state. The core withholds it until every write it can\n /// reveal is proven durable. This is the output gate, and the whole of it:\n /// every channel arrives here and the core does not branch on which.\n ///\n /// `position` is `Some` when the event that produced this output advanced\n /// the cell's committed WAL to it — the output opens its own barrier and\n /// waits for a proof that covers that position. `position` is `None` when\n /// the event only read: the output trails the newest barrier already open\n /// on the cell, because a reader can start after a write commits and\n /// before its proof lands. Its own start and end positions therefore\n /// decide nothing. A cell with nothing outstanding releases it at once,\n /// so an ordinary read pays no durability latency.\n ///\n /// `observed` is the committed-write position a read-only output saw when\n /// it answered, above the cell's published baseline, when a handler had\n /// advanced it: `None` when the output carries a `position` of its own or\n /// the cell holds no handler write. The core holds the output until a\n /// verified proof covers it, so a reader that answers between another\n /// handler's commit and that handler's ticket waits for the proof the\n /// writer has not asked for yet.\n ///\n /// `epoch` is the activation epoch the shell sampled `position` at, when\n /// it sampled before the request pinned the cell: an in-handler ticket\n /// takes its position in the handler's turn and only then acquires a\n /// request. A reset between the two discards that epoch's unproven writes,\n /// and the request then activates the next epoch, whose proof cannot cover\n /// what the ticket asks about. The core refuses a ticket whose epoch is\n /// not the resident one. `None` when the request was already active on\n /// the cell at the sample, as the response is: a reset deactivates every\n /// request of the cell it discards, so a stale one is refused as not\n /// active rather than by its epoch.\n Output {\n request: RequestId,\n channel: Channel,\n position: Option,\n observed: Option,\n epoch: Option,\n },\n /// The production output event. The monotonic instant keeps the authority\n /// decision and the release inseparable when a handler outlives the node\n /// lease under which it started. Untimed simulations can use [`Event::Output`].\n ///\n /// `epoch` and `observed` carry the same values as on [`Event::Output`],\n /// and the core applies the same rules to them. The production shell sends\n /// only this variant, so both must travel here too; without them, every\n /// released ticket in a production build would skip those checks.\n OutputAt {\n request: RequestId,\n channel: Channel,\n position: Option,\n observed: Option,\n epoch: Option,\n now_mono_ms: u64,\n },\n /// The shell finished proving a gated write durable. `Ok(position)` reports\n /// the committed-write position the replica has *actually* proved durable;\n /// the core acknowledges only when it covers the gated write's position, so\n /// a replicator that proves less than it was asked to cannot force an early\n /// ack. `Err` failed the proof outright.\n ///\n /// `source` says which mechanism proved it, because the two carry different\n /// acknowledgement fences. A fleet proof is already arbitrated: a takeover\n /// seals a follower before restoring, so a stale owner's next ack-all fails\n /// closed. A bucket proof needs ownership verification before anything\n /// is revealed.\n DurableReached {\n op: OpId,\n result: Result,\n source: ProofSource,\n },\n /// The ownership record still names this node at this epoch\n /// (`Ok`), or does not, or could not be read.\n OwnershipVerified {\n op: OpId,\n result: Result<(), Failure>,\n },\n WebSocketOpened {\n cell: CellId,\n websocket: WebSocketId,\n kind: WebSocketKind,\n },\n WebSocketClosed {\n cell: CellId,\n websocket: WebSocketId,\n },\n AlarmObserved {\n cell: CellId,\n alarm: wake::AlarmSnapshot,\n covered: bool,\n now_ms: u64,\n now_mono_ms: u64,\n },\n AlarmFinished {\n op: OpId,\n /// The cell and epoch the firing was dispatched against. The gate the\n /// core opens for the consuming commit is keyed by these, and not by\n /// the alarm's own op: an activity fold can supersede the firing state\n /// while the handler's write is still unproven, and that write exists\n /// — and must hold every reader of the cell — regardless.\n cell: CellId,\n epoch: Epoch,\n now_ms: u64,\n now_mono_ms: u64,\n /// The deadline standing after the handler ran, whether a wake entry\n /// covers it, and the position of the consuming commit if the firing\n /// wrote. The position is sampled last, so it covers the consume\n /// itself, and the core proves it durable before the alarm settles.\n result: Result<(wake::AlarmSnapshot, bool, Option), Failure>,\n },\n /// A due wake entry was found for `cell`. `entry_ms` is the minute the\n /// entry is filed under, so the node that acts on the hint can adopt\n /// that exact entry; `scope` says how far the hint reaches.\n WakeHint {\n cell: CellId,\n entry_ms: i64,\n scope: WakeHintScope,\n },\n WakeHintAt {\n cell: CellId,\n entry_ms: i64,\n scope: WakeHintScope,\n now_mono_ms: u64,\n },\n OwnerRead {\n op: OpId,\n /// Wall-clock observation made when the ownership read completed. It\n /// bounds reuse of a shared owner-node lease without letting the core\n /// read a clock itself.\n now_ms: u64,\n result: Result, Failure>,\n },\n NodeLogRecovered {\n op: OpId,\n result: Result<(), Failure>,\n },\n /// The log tier changed the folded log object the next lease write\n /// must carry (lease-fold): renew NOW so the change is durable before\n /// the caller proceeds. A no-op unless the lease is held.\n NudgeNodeLease {\n now_ms: u64,\n now_mono_ms: u64,\n },\n NodeLeaseRead {\n op: OpId,\n now_ms: u64,\n result: Result, Failure>,\n },\n CapacityPeersRead {\n op: OpId,\n now_ms: u64,\n result: Result, Failure>,\n },\n OwnerCasCompleted {\n op: OpId,\n result: Result,\n },\n OwnerReleased {\n op: OpId,\n result: Result,\n },\n /// A released cell became authoritative on a successor. Its runtime can\n /// still be warming when this event arrives.\n SuccessorAdopted {\n op: OpId,\n result: Result,\n },\n RestoreCompleted {\n op: OpId,\n result: Result,\n },\n RuntimeStarted {\n op: OpId,\n /// The node-wide identity of the V8 heap now holding this cell's\n /// realm. Placement happens in the shell, so the core has to be told;\n /// the walk down groups on it to empty a heap rather than scatter its\n /// cuts across every one. `None` when no runtime placed the cell.\n isolate: Option,\n /// The application generation whose isolate took the cell. The shell\n /// resolves the generation at placement, and a placement that\n /// straddled an adoption lands on the previous one; the swap pump\n /// compares this with the current generation. Zero means the cell\n /// was never stamped, which the pump treats as stale.\n generation: u64,\n result: Result<(), Failure>,\n },\n /// The node adopted a new application generation. Every resident cell on\n /// an older generation moves to it at a safe point, or by force once\n /// `max_age_ms` has passed since this event. A resident cell whose class\n /// is in `eager_classes` — the engine's reserved classes, which hold no\n /// application state worth waiting for — is forced at once.\n GenerationChanged {\n generation: u64,\n now_mono_ms: u64,\n max_age_ms: u64,\n eager_classes: Vec,\n },\n Published {\n op: OpId,\n result: Result<(), Failure>,\n },\n DurabilityChecked {\n op: OpId,\n result: Result<(), Failure>,\n },\n RuntimeStopped {\n op: OpId,\n },\n /// A stop returned an error after its retry deadline. The runtime is\n /// gone, the database stays open, and the cell restarts on it at the\n /// same epoch, as a generation swap does. A pending stop emits no result.\n RuntimeStopFailed {\n op: OpId,\n },\n /// The host rescued the database for new activity instead of completing\n /// the eviction. The runtime restarts through the failed-stop path.\n RuntimeStopCancelled {\n op: OpId,\n },\n /// Attempt a policy eviction without a caller result. Deterministic\n /// policy drivers use this input; the Actor uses `EvictRequested` so a\n /// refusal or an interrupted operation cannot look like success.\n Evict {\n cell: CellId,\n },\n /// Try an explicit eviction now and report admission before its effects\n /// run, so the executor can bind the caller to the accepted operation.\n EvictRequested {\n request: RequestId,\n cell: CellId,\n now_mono_ms: u64,\n },\n /// A periodic resource sample from the edge.\n ///\n /// The core never reads a clock or a proc file; the shell measures and\n /// hands the numbers over, and every decision that follows -- whether the\n /// node is overloaded, whether the latch stays hot, how far to shed --\n /// happens here where a schedule can replay it.\n LoadSampled {\n load: pressure::Load,\n now_mono_ms: u64,\n },\n /// Retire an exact cached remote route after a dispatch failure which is\n /// known not to have executed the request. Newer route generations are\n /// unaffected by delayed failure reports.\n InvalidateRemote {\n cell: CellId,\n node: NodeId,\n epoch: Epoch,\n },\n NodeFenced,\n /// The node is shutting down: release every resident cell and wait for a\n /// successor to publish it. Unlike an on-demand evict this always\n /// releases, whatever `ownership_on_evict` is set to. Complete handoffs\n /// run at most `max_releases` at a time, and a cell that is active when\n /// the drain begins is picked up once its activity finishes.\n ReleaseAll,\n /// Give up to `cells` idle cells to the fleet through the shutdown\n /// handoff pipeline without draining. The core picks dormant cells\n /// first, then hibernatable residents, and skips any cell with work.\n Rebalance {\n cells: usize,\n },\n}\n\n#[derive(Clone, Debug, PartialEq, Eq)]\npub enum Route {\n Local,\n Remote {\n node: NodeId,\n addr: String,\n epoch: Epoch,\n peer_protocol: u16,\n },\n}\n\n/// Exact resident isolate reserved for a top-level Worker request.\n#[derive(Clone, Debug, PartialEq, Eq)]\npub struct WorkerRoute {\n pub cell: CellId,\n pub epoch: Epoch,\n}\n\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum RequestError {\n NodeUnavailable,\n ResolveFailed,\n AcquireFailed,\n RestoreFailed,\n RuntimeFailed,\n PublishFailed,\n NodeFenced,\n PeerIncompatible,\n CapacityExhausted,\n /// A local write ran but its durability could not be proven, so the\n /// response must fail rather than falsely acknowledge the write.\n DurabilityUnproven,\n}\n\n/// A successful local eviction request. A later request can reactivate the cell.\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub enum EvictSuccess {\n /// The awaited eviction completes its runtime stop, including for joined callers.\n Evicted,\n /// The Actor finds settled local absence without a pending lifecycle transition.\n AlreadyAbsent,\n}\n\n/// An eviction refused before an operation starts.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum EvictRefusal {\n NodeUnavailable,\n CellActive,\n CellTransitioning,\n AlarmImminent,\n AlarmUncovered,\n ConcurrencyLimit,\n}\n\n/// An accepted eviction interrupted by a later lifecycle decision.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum EvictCancellation {\n Activity,\n Alarm,\n NodeFenced,\n}\n\n/// An eviction whose completion could not be established.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum EvictFailure {\n Durability,\n DurabilityTimeout,\n RuntimeStop,\n ActorUnavailable,\n ReplyLost,\n}\n\n/// Refusal and cancellation are expected outcomes, not node malfunctions.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum EvictError {\n Refused(EvictRefusal),\n Cancelled(EvictCancellation),\n Failed(EvictFailure),\n}\n\nimpl EvictError {\n /// Stable category shared by Rust diagnostics and HTTP responses.\n pub const fn kind(&self) -> &'static str {\n match self {\n Self::Refused(_) => \"refused\",\n Self::Cancelled(_) => \"cancelled\",\n Self::Failed(_) => \"failed\",\n }\n }\n\n /// Stable reason code. Debug output cannot define the wire contract,\n /// because a Rust variant rename must not change operator clients.\n pub const fn reason(&self) -> &'static str {\n match self {\n Self::Refused(EvictRefusal::NodeUnavailable) => \"node_unavailable\",\n Self::Refused(EvictRefusal::CellActive) => \"cell_active\",\n Self::Refused(EvictRefusal::CellTransitioning) => \"cell_transitioning\",\n Self::Refused(EvictRefusal::AlarmImminent) => \"alarm_imminent\",\n Self::Refused(EvictRefusal::AlarmUncovered) => \"alarm_uncovered\",\n Self::Refused(EvictRefusal::ConcurrencyLimit) => \"eviction_limit\",\n Self::Cancelled(EvictCancellation::Activity) => \"new_activity\",\n Self::Cancelled(EvictCancellation::Alarm) => \"alarm_activity\",\n Self::Cancelled(EvictCancellation::NodeFenced) => \"node_fenced\",\n Self::Failed(EvictFailure::Durability) => \"durability_failed\",\n Self::Failed(EvictFailure::DurabilityTimeout) => \"durability_timeout\",\n Self::Failed(EvictFailure::RuntimeStop) => \"runtime_stop_failed\",\n Self::Failed(EvictFailure::ActorUnavailable) => \"actor_unavailable\",\n Self::Failed(EvictFailure::ReplyLost) => \"reply_lost\",\n }\n }\n}\n\nimpl std::fmt::Display for EvictError {\n fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\n write!(f, \"{}: {}\", self.kind(), self.reason())\n }\n}\n\nimpl std::error::Error for EvictError {}\n\n/// Admission of an explicit caller. The core keeps its operation binding.\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum EvictionAdmission {\n Absent,\n Pending,\n}\n\n/// Work performed outside the core. Every asynchronous effect is versioned;\n/// completion events with an obsolete `op` are ignored.\n#[derive(Clone, Debug, PartialEq, Eq)]\npub enum Effect {\n EvictionAdmission {\n request: RequestId,\n result: Result,\n },\n /// Settle a caller bound to the completed operation. A later activation\n /// or eviction of the same cell cannot change this result.\n EvictionFinished {\n request: RequestId,\n result: Result,\n },\n ScheduleTimer {\n timer: Timer,\n at_mono_ms: u64,\n },\n ReadSelfNodeLease {\n op: OpId,\n },\n CasNodeLease {\n op: OpId,\n guard: CasGuard,\n record: NodeLeaseRecord,\n /// The prior record's peer-visible expiry for a renewal. The shell\n /// uses it to report how much authority remained when the attempt\n /// completed. An initial acquisition has no prior authority.\n authority_expires_ms: Option,\n },\n /// Read the local cell inventory. This is emitted only after the initial\n /// node lease CAS replaced the exact certified predecessor generation.\n ReadLocalCells,\n ReadOwner {\n op: OpId,\n cell: CellId,\n },\n ReadNodeLease {\n op: OpId,\n cell: CellId,\n owner: NodeId,\n },\n /// The takeover interlock, as a core decision (lease-fold): the dead\n /// owner's folded log state was not sealed, so its acked tail may\n /// exist only on its followers. The executor recovers every\n /// non-sealed session of `owner` into the bucket and reports\n /// `NodeLogRecovered`; only then does the claim proceed.\n RecoverNodeLog {\n op: OpId,\n cell: CellId,\n owner: NodeId,\n },\n /// Enumerate recent node leases and return their advisory load records.\n /// Listing and bounded parallel reads are adapter mechanics; selection,\n /// reservations, and exclusions are deterministic core policy.\n ReadCapacityPeers {\n op: OpId,\n cell: CellId,\n },\n CasOwner {\n op: OpId,\n cell: CellId,\n guard: CasGuard,\n epoch: Epoch,\n takeover: bool,\n },\n /// Bring the bucket's wake entry for this cell into line with its alarm.\n ///\n /// Emitted wherever the alarm settles, which is the only place that\n /// knows. An arm needs an entry; a consumed alarm needs its entry gone,\n /// or every later due scan finds a hint for an alarm that already fired\n /// and wakes a cell with nothing to do. The snapshot retains its source\n /// revision through the proof that permits this effect.\n ReconcileWakeEntry {\n cell: CellId,\n alarm: wake::AlarmSnapshot,\n },\n /// Publish an evicted cell as unowned, keeping its epoch, so the next\n /// node to want it can take it without waiting for this one to notice.\n ReleaseOwner {\n op: OpId,\n cell: CellId,\n epoch: Epoch,\n },\n /// Ask a compatible peer to acquire a cell whose owner record was just\n /// released. The result acknowledges authority acquisition. Replica\n /// restore and runtime publication continue outside the donor's shutdown\n /// critical path.\n AdoptReleased {\n op: OpId,\n cell: CellId,\n released_epoch: Epoch,\n /// A balancing move rather than a drain: the successor must be a\n /// peer below its ownership target, and the search is bounded by\n /// the operation deadline instead of the process exit.\n rebalance: bool,\n },\n /// Interrupt the activity which existed when a cell entered its shutdown\n /// handoff batch. The shell maps core request IDs to handler/body aborts\n /// and closes sockets with a restart status.\n CancelCellActivity {\n cell: CellId,\n requests: Vec,\n websockets: Vec,\n /// A firing alarm is a handler without a routed request id. Its exact\n /// operation identifies the shell task to cancel, so a late cancel\n /// cannot affect the next alarm firing for this cell.\n alarm: Option,\n /// A forced generation swap lists only the regular and outbound\n /// sockets, and the cell stays on this node: its hibernatable sockets\n /// and auto-response pair survive. A shutdown handoff lists every\n /// socket and forgets the pair, because the cell is leaving.\n keep_hibernatable: bool,\n },\n Restore {\n op: OpId,\n cell: CellId,\n spec: RestoreSpec,\n },\n StartRuntime {\n op: OpId,\n cell: CellId,\n epoch: Epoch,\n },\n Publish {\n op: OpId,\n cell: CellId,\n epoch: Epoch,\n },\n /// Prove that every commit made before this effect is recoverable from\n /// replica authority. Voluntary eviction cannot begin until this succeeds.\n EnsureDurable {\n op: OpId,\n cell: CellId,\n epoch: Epoch,\n /// Whether a request that arrives during this proof puts the cell back\n /// into service instead of waiting for a successor. The cell still\n /// serves while the proof runs, so an arriving request can cancel the\n /// eviction. A revocable proof is therefore the last point at which\n /// the node can change its mind, so the shell finishes every remote\n /// check it needs here rather than after it takes close exclusion. A\n /// drain has nowhere to put the cell back, so it pays for no check it\n /// does not need.\n ///\n /// The two cancel sites do not test the same thing, which is worth\n /// knowing before either one changes. `request_authorized` refuses to\n /// rescue a cell while the node drains. `worker_request` cancels an\n /// `EnsuringDurability` eviction with no drain test at all. That\n /// asymmetry is safe only because a drain sets this field false: the\n /// shell then does no revocable work, so a rescue costs a cancelled\n /// proof and nothing more, and `LtxRepl::evict` remains the final\n /// authority on whether the cell may be given up.\n revocable: bool,\n },\n /// The output gate: prove the cell's committed `position` is replicated so\n /// a withheld local write response can be released. Unlike\n /// [`Effect::EnsureDurable`] this is per-request and changes no cell phase,\n /// so the cell keeps serving co-resident requests while one response waits.\n AwaitDurable {\n op: OpId,\n cell: CellId,\n epoch: Epoch,\n position: u64,\n },\n /// For bucket-proof acknowledgements, read `own.json` and answer whether it\n /// still names this node at this epoch. The core holds the gated write\n /// until `Event::OwnershipVerified` returns. Fleet-proof acks never\n /// emit this — the ensemble seal is their fence.\n VerifyOwnership {\n op: OpId,\n cell: CellId,\n epoch: Epoch,\n },\n StopRuntime {\n op: OpId,\n cell: CellId,\n epoch: Epoch,\n cause: StopCause,\n /// After a returned error, the shell stops retrying at its deadline\n /// and reports `RuntimeStopFailed`. An in-flight release has no\n /// timeout. A drain and a fence keep retrying returned errors until\n /// the process ends, because their node is leaving.\n bounded: bool,\n },\n /// Give the cell back instead of finishing this eviction stop.\n ///\n /// A request is waiting on a cell in `Phase::Cleaning`, and the stop that\n /// holds it is a bounded eviction, so the node has somewhere to put the\n /// cell back. The shell abandons the stop if it can still do so, and it\n /// reports `RuntimeStopCancelled`, which restarts the cell on its open\n /// database at the epoch it already had.\n ///\n /// The shell decides whether it is still able to. An eviction that has\n /// made its handoff snapshot visible cannot be abandoned: the snapshot is\n /// a full image at one txid and it is the successor's restore artifact, so\n /// a cell that served past it would leave a later restore reading a\n /// complete database that stops short of an acknowledged write. This\n /// effect is therefore a request and not an instruction, and a stop that\n /// declines it reports `RuntimeStopped` as before.\n AbandonEvictionStop {\n op: OpId,\n cell: CellId,\n },\n FireAlarm {\n op: OpId,\n cell: CellId,\n epoch: Epoch,\n scheduled_ms: i64,\n },\n Complete {\n request: RequestId,\n result: Result,\n },\n /// Release a withheld output now that the writes it can reveal are\n /// decided: `Ok` lets it leave, `Err` refuses it. Emitted only for an\n /// output the shell held open via [`Event::OutputAt`].\n ///\n /// `channel` is the one the shell supplied, returned unchanged. It selects\n /// which adapter holds this effect and is the only thing the shell needs\n /// in order to route the release. No operation id rides along: the shell\n /// never learns the one the core assigned, and `(request, channel)` is\n /// unique by construction — `State::validate` enforces it.\n Release {\n request: RequestId,\n channel: Channel,\n result: Result<(), RequestError>,\n },\n /// Complete the synchronous resident-selection decision. `None` means\n /// the executor must use the ordinary stateless Worker pool.\n CompleteWorker {\n request: RequestId,\n route: Option,\n },\n /// Refuse a transport the node cannot afford to hold. The shell closes it;\n /// the cell carries on without it.\n CloseWebSocket {\n cell: CellId,\n websocket: WebSocketId,\n },\n Halt {\n code: i32,\n reason: HaltReason,\n },\n}\n\n/// One database encoded by the local cell path.\n#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]\npub struct LocalCell {\n pub id: CellId,\n pub epoch: Epoch,\n /// The epoch's database is open-able as it stands, so a clean reload\n /// resumes it in place. False for the copy an eviction preserved: it\n /// proves the node held the cell, which is what the ownership\n /// confirmation after a restart needs, but it is not a resumable\n /// epoch. Without it a restarted node confirmed only the cells that\n /// were resident when it died and hid every hibernated one.\n pub live: bool,\n}\n\n#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub enum StopCause {\n Cleanup,\n /// `rebalance` means this eviction hands the cell to the fleet: its\n /// ownership record is released and the local replica is not worth\n /// keeping. An idle eviction is the opposite on both counts -- it\n /// keeps the record so the next activation here renames the file into\n /// place instead of paying a full remote restore.\n Evict {\n rebalance: bool,\n },\n Fence,\n /// A durability proof came back negative, so this runtime's memory and its\n /// local database may hold writes the bucket does not. celld has just told\n /// the caller those writes failed; continuing to serve them is the\n /// divergence, not the failure. Stop, keep no local snapshot, and let the\n /// next activation restore from the bucket.\n Reset,\n /// The cell moves to the current application generation. The runtime\n /// leaves its isolate and is started again at the same epoch on an\n /// isolate of the new generation: no ownership change, no restore, no\n /// replication release. The stop reaches the shell as `Cleaning`, and the\n /// core answers the stop with `StartRuntime` instead of a terminal phase.\n Swap,\n}\n","editable",false,"branch","documentNavigation","repo","denoland/celld","repoId","a23b8a10-92cf-4dc4-a7ab-a04e58298dde","ownerId","org:42048915","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",1,"watchers","watching","pinned","notify","views",[134,135,136,137,138,139,140,141,142,143,144,145,146],"navigation",{"_55":56,"_91":92,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102},"sources",[],"viewer","meta",{"_83":84,"_85":86,"_87":88,"_43":32,"_89":14,"_90":32,"_49":50,"_51":50},"branches",[14],"tags",[70,71,72,73,74,75,76,77,78,79,80,81,82],"cloneUrl","https://git.nexthub.sh/denoland/celld.git","v0.0.1","v0.0.2","v0.1.0","v0.2.0","v0.2.1","v0.3.0","v0.4.0","v0.4.1","v0.5.0","v0.5.1","v0.6.0","v0.6.1","v0.6.2","description","self-hosted, distributed Durable Objects","owner","denoland","section","","head","empty","pins",[116,117,118],"documents",{"_111":112,"_113":114},"code",{"_108":109,"_110":104},"automations",{"_106":50,"_107":-5},"delivery",{"_103":104,"_105":-5},"tag","7gTA52Z9a1vO6FP6eCQPix9zO4O","releases",0,"applications","workflows","deployments","commits",13,"changes","counts",{"_115":114},"total",38,"issue",{"_119":110,"_121":132,"_15":110,"_123":133,"_53":125,"_126":32,"_127":125,"_128":104},{"_119":129,"_121":130,"_15":129,"_123":131,"_53":125,"_126":32,"_127":125,"_128":104},{"_119":120,"_121":122,"_15":120,"_123":124,"_53":125,"_126":32,"_127":125,"_128":114},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_119":110,"_121":132,"_15":110,"_123":177,"_53":125,"_126":32,"_127":125},{"_119":129,"_121":130,"_15":129,"_123":176,"_53":125,"_126":32,"_127":125},{"_119":120,"_121":122,"_15":120,"_123":175,"_53":125,"_126":32,"_127":125},{"_119":172,"_121":173,"_15":172,"_123":174,"_53":32,"_126":32,"_127":125},{"_119":169,"_121":170,"_15":169,"_123":171,"_53":32,"_126":32,"_127":125},{"_119":106,"_121":167,"_15":97,"_123":168,"_53":32,"_126":32,"_127":125},{"_119":107,"_121":164,"_15":165,"_123":166,"_53":32,"_126":32,"_127":125},{"_119":103,"_121":162,"_15":103,"_123":163,"_53":32,"_126":32,"_127":125},{"_119":158,"_121":159,"_15":160,"_123":161,"_53":32,"_126":32,"_127":125},{"_119":93,"_121":156,"_15":93,"_123":157,"_53":32,"_126":32,"_127":32},{"_119":153,"_121":154,"_15":153,"_123":155,"_53":32,"_126":32,"_127":32},{"_119":150,"_121":151,"_15":150,"_123":152,"_53":32,"_126":32,"_127":32},{"_119":147,"_121":148,"_15":147,"_123":149,"_53":32,"_126":32,"_127":32},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794435332837,"sidebar","expanded"]