From nullislabs/shepherd#445 review (comment). Confirmed still valid at HEAD. Follow-up, not blocking. Target: L1 nexum-runtime (src/supervisor.rs).
sweep_providers (supervisor.rs:1583) uses the engine-wide poison_policy (:95 / :1585) and restart_policy::backoff_for (:1593) - byte-identical to sweep_modules. But a dead provider has a strictly larger blast radius than a dead module: one down venue stalls every module routing through it, not just its own workflow. A popular shared adapter (a CoW adapter serving many modules) traps under load and gets the same 1s-then-doubling curve and poison threshold as a niche single-module adapter, with nothing reflecting how many callers are blocked on it.
Options
- Add a per-provider policy override (a faster-detect / wider-tolerance curve keyed on caller count or provider identity).
- Or document why uniform tuning is acceptable at current scale.
Acceptance criteria
- Either a per-provider sweep-policy override, or a stated rationale for uniform tuning at the sweep site.
sweep_providers(supervisor.rs:1583) uses the engine-widepoison_policy(:95/:1585) andrestart_policy::backoff_for(:1593) - byte-identical tosweep_modules. But a dead provider has a strictly larger blast radius than a dead module: one down venue stalls every module routing through it, not just its own workflow. A popular shared adapter (a CoW adapter serving many modules) traps under load and gets the same 1s-then-doubling curve and poison threshold as a niche single-module adapter, with nothing reflecting how many callers are blocked on it.Options
Acceptance criteria