Package-level declarations

Identity of one attachment generation — the immutable parent→child edge that carries fairness state (see AttachmentRecord). There is exactly one AttachmentId per generation: changing anything fairness-significant (weight, parent, a reset) mints a new id rather than mutating an existing one, so old generations keep their history forever.

The immutable fact of one attachment generation — a parent→child edge in the fairness tree, together with the child's weight among its siblings.

The three consistent pieces of the temporary fairness-error bound at one parent (design §8.2). While peers are unreconciled — mid-partition, before anti-entropy heals — different peers can independently steer entitlement among a parent's children, so the observed fairness error is bounded, not zero. This exposes the bound's pieces as derived metrics; the module "must not claim tighter than it proves" (design §8.2), so all three are reported and the tests assert they stay ordered observedDeviation ≤ currentBound ≤ configuredWorstCase.

Why a serialized (or locally pre-checked) control act was refused (see ControlOutcome.Conflict).

The outcome of a committed control act, keyed to the log index it committed at. Because every peer applies the committed log against a log-pure projection (see HeddleControlPlane), every peer derives the same outcome for a given index — the proposer reads back its own act's outcome.

How much more service a child could usefully take right now — the child's advertised appetite, and nothing about its authority.

One peer's advertised appetite across the edges it serves — the value carried in a peer's slot of the demand board (design §6).

The parent-facing view of one edge — everything a parent needs to schedule a child, and deliberately nothing more. It exposes how much entitlement was issued down the edge, how much was returned, and how much service was spent through it; the child's queues, identities, placement, and leaf receipts are simply not in this projection. Information hiding here is a hard interface boundary, not a convention (design §4.5).

The replicated, conflict-free tally of who was granted what fairness entitlement, who passed it down, and who spent it.

The coordination-free spend/reserve surface a consumer gates work on — the honest "either node type" contract shared by both heddle front doors.

One edge's replicated virtual-time gauge: an asserted lower bound on its gross virtual service, paired with the base issuance the writer had actually observed when it asserted it.

A Raft-governed HeddleNode: the H4 data-plane surface (reserve/complete/schedule/advertise plus the replicated ledger and liveness) with the H5 control-plane verbs (mint + topology) routed through the consensus log. Returned by heddleGoverned.

The outcome of one HeddlePolicy.pick: delegate amount service units down the edge named by attachment. The caller applies the patch to its ledger before the next pick (design §7.3 step 5).

Identity of one group in the fairness tree — a tenant, a lane, a leaf where work actually runs. Opaque, value-equal, and stably serialized: a GroupId is just a stable string name, compared as a string so every peer orders a set of groups identically.

Everything a HeddleNode needs beyond the fabric: the reference policy's quanta and caps, the §8.2 bound caps, the demand board's staleness window, and the injected randomness/replication/liveness knobs.

One peer's live view of a weighted fair-share session over a Seam — the join point of the fair-share layer (design §15 Phase 4). It bonds four coordination-free pieces onto one fabric:

The reference EEVDF allocation policy — a pure function from edge summaries, demand, and immutable attachment policy to a single delegation choice (design §7). It inspects nothing else: no global queues, no descendants, no wall clock, no randomness, no floating point. Purity is what makes it testable at virtual time and safe to run divergently on partitioned peers — a bad local decision only misplaces entitlement, it can never create any.

An integrity fault EntitlementLedger.validate derives from merged state.

The lifecycle of one attachment generation — a four-point chain climbed in one direction only:

Identity of one mint — a single act of introducing root supply into the ledger. Mints are keyed by MintId rather than by the holder's replica id so that two independently-recorded mints union instead of max-colliding: under control-plane failover the same holder may be credited by more than one committed mint, and each must survive the merge.

One act of introducing root supply: holder is credited amount units at the root path. Keyed in the ledger by a unique MintId so independently-recorded mints union rather than collide (design fix 4).

Names an entitlement path by its final edge. Each group has exactly one active inbound edge, so the edge names the whole path from the root — no List<AttachmentId> is ever needed as a key. The root path has no final edge and is named by the ROOT sentinel.

Tuning for one allocation round (design §7.3). Every field is a hard cap in service units; the round grants the smallest of all the applicable caps.

One immediate child, as the policy sees it: the immutable attachment metadata (record — parent, child and weight), the parent-facing accounting (summary — issued/returned/spent), the child's advertised demand, the replicated virtual-time seat (gauge paired with baseIssued), and the scheduler-local wake clamp (virtualOffset).

An exact rational number — a numerator/denominator pair over Long, kept reduced to lowest terms with a strictly positive denominator.

Decodes a Rational through Rational.of, so a value that arrived over the wire is indistinguishable from one the factory built (#1647, #1752).

Identity of one local reservation — a leaf earmark awaiting completion (design §4.4).

The result of a RevocationSeam.revoke request.

The readIndex()-fenced revocation seam of design §9 #3 — specified, not shipped in v1.

A non-negative quantity of service — the abstract unit the ledger accounts in (CPU-milliseconds, tasks, tokens; whatever the consumer meters). Always >= 0; a negative amount of service is meaningless and is rejected at construction rather than allowed to poison the tally.

A sibling's fairness share, expressed as a positive integer ratio.

Decodes a Weight through Weight.of, so a value that arrived over the wire is indistinguishable from one the factory built (#1647).

Bootstrap a Raft-governed HeddleNode over seam — the consensus-backed front door of design §9, parallel to heddleStatic. The data plane is unchanged from H4 (a replicated ledger, demand board, reservations, and liveness over the seam); what governance adds is that the non-monotone acts — mint and topology reconfiguration — are serialized through the raft log rather than applied locally:

Bootstrap a HeddleNode over seam with a fixed roster and a pre-partitioned mint supplied at bootstrap — the static front door of design §9. There is no runtime mint and no consensus dependency: entitlement is created once here, topology changes are local strict-drain operations (HeddleNode.prepare/HeddleNode.activate/…), and any overlapping reshape simply surfaces as a conflict for the operator to drain. This is the right shape for small fixed rosters and tests; the Raft-backed heddleGoverned front door (mint + reshape serialization on the log) arrives in a later phase.