Called while the deployment lease is held, after the route attested and
matched, and before the state write that records the settlement.
AT-LEAST-ONCE and KEYED. A crash between this returning and that write
replays it with the same settlementKey, so anything with an external
effect — a charge, an entitlement, a notification — must be idempotent on
that key. This package cannot make the callback and its own durable write
atomic, so it guarantees the direction that fails safe: never settled
without being attempted.
NO CALLBACK TIMEOUT. By default, the lease renews on a five-minute
heartbeat against a fifteen-minute TTL; both figures are configurable on
the state store. This package imposes no timeout on settle(): it renews
the lease for as long as the callback runs, so a hung callback that keeps
renewing holds the lease indefinitely and blocks every other operation on
the deployment, including decommission. Keep settle() well inside the
default renewal interval and enqueue slow work. Renewal errors are
inspected only after the callback returns; the heartbeat cannot interrupt
or time it out.
If the process dies mid-callback, the lease expires one TTL after the last
successful renewal — fifteen minutes by default — and re-entry re-fires
settle() under the same settlementKey.
A throw propagates. The branch's durable state is left where a re-entry
resumes it, and that re-entry re-attests and settles again under the same
key.
Called while the deployment lease is held, after the route attested and matched, and before the state write that records the settlement.
AT-LEAST-ONCE and KEYED. A crash between this returning and that write replays it with the same
settlementKey, so anything with an external effect — a charge, an entitlement, a notification — must be idempotent on that key. This package cannot make the callback and its own durable write atomic, so it guarantees the direction that fails safe: never settled without being attempted.NO CALLBACK TIMEOUT. By default, the lease renews on a five-minute heartbeat against a fifteen-minute TTL; both figures are configurable on the state store. This package imposes no timeout on
settle(): it renews the lease for as long as the callback runs, so a hung callback that keeps renewing holds the lease indefinitely and blocks every other operation on the deployment, including decommission. Keepsettle()well inside the default renewal interval and enqueue slow work. Renewal errors are inspected only after the callback returns; the heartbeat cannot interrupt or time it out.If the process dies mid-callback, the lease expires one TTL after the last successful renewal — fifteen minutes by default — and re-entry re-fires
settle()under the samesettlementKey.A throw propagates. The branch's durable state is left where a re-entry resumes it, and that re-entry re-attests and settles again under the same key.