Module hedge 

Preserve a live hedge arm when its sibling exhausts its retries.

Tower still owns latency sampling, warmup, delay, and histogram rotation. Only its arm responses are coordinated: an error cannot win while another arm can still succeed. If every arm fails, preserve an original NotFound error in preference to other failures, regardless of completion order, so sync can re-request the missing block without restarting.

Readiness errors join this same race without dispatching to the failed service. Downloads therefore reports them as DownloadFailed, rather than NetworkServiceError.

Structs

Arm 🔒

One non-cloneable owner, first in the request and then in its response future.

ArmFuture 🔒

An exhausted arm waits until its sibling finishes or drops, without holding inner capacity.

ArmService 🔒

Keep each entire retry sequence inside one hedge arm.

ArmState 🔒

HedgePolicy 🔒

Clone exactly one additional arm; unlike retry payloads, arm ownership is not cloneable.

HedgeRequest 🔒

A request owns its arm even before Tower’s delay and readiness checks have completed.

SuccessHedge 🔒

Tower’s usual hedge, preferring success over an already-completed sibling error.