weft/upgrade

Typed requests for transactional, in-place callback upgrades.

The trusted loader loads the new BEAM modules before suspending a loop. Migration sees current state, including work completed since an earlier upgrade. It returns a complete callback set; loading a module alone does not replace captured closures. Message and state types remain stable.

Migration callbacks must be pure. Gleam has no effect system, so this is a trust boundary rather than a sandbox: callbacks can call arbitrary code. Weft isolates computation and bounds its lifetime, but cannot undo effects a dishonest callback performs. Never expose migration to model-authored code running in the harness VM.

Types

Request

</>

The standard OTP change-code arguments, without casting dynamic state.

pub type Request {
  Request(
    module: atom.Atom,
    old_version: dynamic.Dynamic,
    extra: dynamic.Dynamic,
  )
}

Constructors

```
Request(
  module: atom.Atom,
  old_version: dynamic.Dynamic,
  extra: dynamic.Dynamic,
)
```
Arguments

module

The loaded callback module selected by the trusted loader.

old_version

The loader’s old version, including OTP’s downgrade tuple if supplied.

extra

Caller-defined metadata, decoded totally by the migration callback.

Values

prepare

</>

pub fn prepare(
  within: Int,
  compute: fn() -> Result(candidate, String),
) -> Result(candidate, String)

Compute a candidate on the existing bounded task engine.

This is for behaviour implementations, not an application upgrade API. The caller retains its original state until the successful candidate is returned. Deadline, rejection and crash are errors, never partial commits. The deadline bounds computation; scheduler and kill/join latency add to it.

Examples

upgrade.prepare(100, fn() { Ok(candidate) })