Database-authoritative exact-cap admission with bounded cross-tenant rotation.
Backend startup synchronizes the configured default cap before starting any dispatcher or worker. Runtime default changes survive restarts until the configured cap changes on a homogeneous deployment. Per-owner overrides remain runtime-managed through Docket's public claim-policy facade.
Responsibility boundary
Docket.Postgres.ClaimPolicy.TenantFair.RingFunction owns the database-side
scheduling state machine: cursor and partition authority, ring traversal,
bounded candidate discovery, exact row locking, authoritative rechecks, run
mutation, and service-epoch accounting.
This module is the application-side Docket.Postgres.ClaimPolicy
implementation. It:
- validates and persists the configured default cap at backend startup;
- normalizes runtime timestamps and derives the expired-claim cutoff;
- builds one data-only
Docket.Postgres.ClaimPolicy.Planwith the five semantic bind values; - resolves the prefix-qualified claim function installed by the migration;
- decodes the unchanged fourteen public columns into leases and poisoned results; and
- emits bounded claim, poison, steal, age, duration, and contention observations after execution.
Docket.Postgres.ClaimPolicy.TenantFair.SQL invokes the claim function with
raw tracing disabled, removes internal inspection rows and columns, and
orders public outcomes by the function's visit and outcome ordinals.
Docket.Postgres.RunStore remains the sole executor of the resulting plan.