Module state 

Pure reducer for the Credential Broker’s per-credential coordination state — fresh / refreshing / failed / needs-reauth. Same shape as every other reducer in this codebase (crates/launcher/src/reducer/, crates/srv/src/reducer.rs, crates/cef/src/reducer/mod.rs): update(&mut State, Command) -> Vec<Event>, no I/O, no async, sub-millisecond lock hold when called from scheduler.rs’s orchestrator.

Internal-only, like the CEF host reducer — this never crosses IPC, so it does not reuse agentmux_common::ipc::{Command, Event} (the srv<->launcher<->host wire protocol); it defines its own local types.

This module never holds a credential’s actual secret/value — only enough coordination state to decide WHEN scheduler.rs’s caller-supplied is_fresh/refresh closures should run, and to make that decision observable. Events are mapped 1:1 to auth.broker.*-prefixed tracing calls by the orchestrator — that prefix lands in muxlog auth’s existing filter regex (\bauth\.\w+|...) with zero changes needed there.

Enums

Command

CredentialState

Coordination state for one registered credential.

Event

RefreshErrorKind

What a registered refresh closure’s failure means for scheduling.

Constants

NEEDS_REAUTH_THRESHOLD

After this many consecutive TRANSIENT refresh failures, a credential is considered permanently broken rather than retried forever — the sweep loop stops hammering a dead refresh_token on every tick. ensure_fresh (on-demand, e.g. right before a reconnect attempt) still re-checks freshness even from NeedsReauth: if an external login has since succeeded, is_fresh() will report true and state naturally moves back to Fresh. No explicit “clear” API needed.

Functions

now_unix 🔒

update

states is the orchestrator’s whole coordination table; generations tracks each id’s CURRENT registration epoch so a completion from a superseded registration can be told apart from a current one (see Event::RunFreshnessCheck’s doc comment); next_generation is a single counter shared across ALL ids, strictly increasing, never reused — deliberately NOT a per-id counter restarted at 0 on each Register, because an unregister-then-re-register sequence would then hand the new registration the SAME generation number the old one had, and a stale completion from the old registration (still in flight when the unregister/re-register raced in) would wrongly pass the staleness check instead of being discarded (reagent re-review on #2275). One reducer call per dispatched command, sub-millisecond, never awaits.