The intake breaker of wal: :dual (ADR 0002, section 7). Under dual there is
no degraded mode: a node that cannot confirm in the log refuses, it never acks
on local fsync alone.
closed admits every batch. It opens after intake.breaker_failures
consecutive failed publish attempts, or when the adapter's ready?/1 says no.
open refuses until intake.probe_ms has passed, then lets one batch
through (half_open): its confirm closes the breaker, its failure reopens it.
The probe is a real batch, not a probe record.
The state lives in the pending set's ETS table (Ankusa.Intake.Pending), which
the writer reads inside its own process: no :persistent_term.put, no call,
nothing on the request path but a table read (ground rule 6).
Summary
Functions
The probe batch never published (it turned out to have nothing to publish).
:ok to publish a batch now, {:error, :open} to refuse before touching either half.
The adapter says it is not ready: open the breaker (the reconciler's tick).
Records a publish attempt's outcome (true = confirmed).
:closed, :open or :half_open.
Functions
@spec abort_probe(Ankusa.Intake.Pending.table(), integer()) :: :ok
The probe batch never published (it turned out to have nothing to publish).
@spec admit(Ankusa.Intake.Pending.table(), Ankusa.Config.t(), integer()) :: :ok | {:error, :open}
:ok to publish a batch now, {:error, :open} to refuse before touching either half.
@spec not_ready(Ankusa.Intake.Pending.table(), integer()) :: :ok
The adapter says it is not ready: open the breaker (the reconciler's tick).
@spec record(Ankusa.Intake.Pending.table(), Ankusa.Config.t(), boolean(), integer()) :: :ok
Records a publish attempt's outcome (true = confirmed).
@spec state(Ankusa.Intake.Pending.table()) :: :closed | :open | :half_open
:closed, :open or :half_open.