Struct EndpointHealth 

pub struct EndpointHealth { /* private fields */ }

Per-endpoint passive health tracker. All pick-path reads are atomic; only the observation window takes a lock (report path). Share via Arc from the balancer state; carried across rebuilds for unchanged address:port.

Implementations

impl EndpointHealth

pub fn new() -> Self

Fresh tracker: healthy, empty window.

pub fn with_events(sink: EndpointEvents) -> Self

Fresh tracker with ejection/recovery events (DW-044); see the module docs.

pub fn acquire(&self, params: &HealthParams, now: u64) -> bool

Whether a pick may use this endpoint at now (Unix-epoch ms); consumes one probe slot when the endpoint is half-open. Lock-free.

Side effects: an expired ejection transitions to half-open here (the first pick after eject_ms re-arms the probe budget) — the transition therefore happens lazily on traffic rather than on a timer.

pub fn is_candidate(&self, params: &HealthParams, now: u64) -> bool

Whether a pick MAY consider this endpoint at now (Unix-epoch ms) — non-consuming. The balancer’s candidate filter calls this for every endpoint; the endpoint actually SELECTED then consumes a half-open probe slot via EndpointHealth::consume_probe. Consuming only at selection keeps a half-open attempt from deadlocking: probe slots are never burned by picks that go elsewhere. Side effect: an expired ejection transitions to half-open here (the first traffic after eject_ms re-arms the probe budget) — the transition happens lazily on traffic rather than on a timer.

pub fn consume_probe(&self)

Consume one half-open probe slot for a pick that SELECTED this endpoint. Best-effort: if a concurrent pick took the last slot, this pick still proceeds (one extra request beyond the probe budget may reach a recovering endpoint; the next report re-synchronizes the tracker).

pub fn is_available(&self, now: u64) -> bool

Whether the endpoint is currently available WITHOUT consuming a probe (observability; not the pick path).

pub fn ejections(&self) -> u64

Total times this tracker has ejected an endpoint (observability).

pub fn state_label(&self, now: u64) -> &'static str

Human state label for observability surfaces (admin /health, DW-022): healthy, ejected, or half_open. An ejection whose window has expired but not yet transitioned reports half_open (the next pick arms the probe budget), mirroring Self::is_available’s view of expiry.

pub fn report(&self, params: &HealthParams, now: u64, is_failure: bool)

Report one observation for this endpoint at now (Unix-epoch ms): is_failure = transport error or HTTP status >= 500 (see the module docs for the 1xx-4xx policy). Applies the ejection rules against params.

pub fn report_probe(&self, params: &HealthParams, now: u64, is_failure: bool)

Report one ACTIVE (synthetic probe) observation at now (Unix-epoch ms). Runs the same state machine as EndpointHealth::report — the shared consecutive-failure streak and every ejection/recovery transition — but the observation NEVER enters the rolling failure-ratio window: that window is real traffic only, so probes cannot contaminate the passive ratios (the ratio rule also stays disabled by the caller’s parameters as a second line of defense).

pub fn recovered_at_ms(&self) -> u64

REL-06 (#217): the Unix-epoch ms when the endpoint last recovered from ejection, or 0 if it was never ejected (or the ramp is disabled). Used by the load balancer to compute the recovery ramp weight multiplier.

Trait Implementations

impl Debug for EndpointHealth

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EndpointHealth

fn default() -> EndpointHealth

Returns the “default value” for a type.