Module lifecycle 

The production server LIFECYCLE — the shared state machine that makes a LOGOS Serve “serious and stays serving”: it drains gracefully (never drops an in-flight request), gates readiness separately from liveness, sheds load with bounded backpressure (503, never an unbounded hang), bounds per-request time, survives malformed floods, and stamps every response/log line with a correlation id (secret-safe).

Built ONCE here so BOTH serving tiers inherit the identical, proven behavior: the compiled-AOT tier through super::server::serve / super::server::spawn / super::server::spawn_with_lifecycle, and the interpreter tier (largo serve) by calling the SAME pure decision functions (Lifecycle::admit, Lifecycle::assign_correlation_id, stamp_correlation_id) from its own !Send accept loop.

The decisions are factored as small pure/&self methods on Lifecycle so the two loops — the tokio loop (Send, task-per-connection) and the interpreter’s FuturesUnordered loop (!Send, inline) — share the exact same admission/backpressure/correlation-id law and can never drift.

Structs

DrainOutcome

The outcome of a graceful Lifecycle::drain.

Lifecycle

The shared, cloneable lifecycle handle. One is created per server; the accept loop consults it per connection/request and an orchestrator flips readiness / requests drain through it.

LifecycleConfig

Tunables for the server lifecycle. Every field is public so an embedder can dial them; Default is the deployed shape.

SlotGuard

A held in-flight slot: while it lives, one of the max_inflight slots is occupied and the in-flight gauge counts it. Dropping it (handler returned, panicked, or timed out) frees the slot — RAII, so no path can leak one.

Enums

Admission

The verdict of Lifecycle::admit: whether a request may reach the handler, and if not, WHY — so both tiers answer the identical status.

Constants

CORRELATION_HEADER

The response header that carries the correlation id (canonical casing).

Functions

access_log_line

A structured, SECRET-SAFE request log line: method, path, status, correlation id, and duration — and never an arbitrary request header VALUE (so a secret in Authorization/Cookie can never leak into logs). Returned as a string so the caller decides the sink (both tiers format identically).

service_unavailable

over capacity — shared by both tiers (the readiness/backpressure twin of the wire core’s bad_request/internal_error).

shutdown_requested

The canned 503 a request gets when the server is not ready, draining, or Resolve when the process is asked to stop: SIGTERM or SIGINT on unix, Ctrl-C elsewhere.

stamp_correlation_id

Stamp resp with the correlation-id header (canonical casing), IN PLACE. Shared by both tiers so the header they emit is identical. A handler-set X-Correlation-Id (any casing) is replaced — the lifecycle owns this header exactly as the wire writer owns the framing headers.