Expand description
Panic supervision for accept loops (#120, #130).
One place for the bounded respawn policy every accept surface uses:
the gateway’s data-plane listeners (dwara-bin) and the admin API’s
accept loop (dwara-admin). A panicked accept task is respawned on
the SAME bound socket (callers share their TcpListener behind an
Arc), up to a per-caller cap, after which the surface is given up
on with a loud ERROR log — the process itself keeps running (a dead
accept surface must not take sibling listeners and in-flight work
with it; that is not the shutdown idiom anywhere else either).
This module depends on no other domain: it is pure task plumbing over tokio handles plus tracing.
Functions§
- supervise_
panics - Supervise one accept task for panics: when an incarnation ends
cleanly (shutdown flush completed) supervision is done; when it
panics it is respawned up to
max_respawnstimes with a warning per respawn, and after the cap an ERROR is logged and the surface is left down — loudly, but without aborting the process.