An effectful rule: its name, the IO that learns its verdict for one version, the resilience knobs, the failure policy, and its per-source circuit breaker.

The breaker is a TVar shared across every evaluation of this rule (it is the one source's health), so repeated failures trip it once and fast-fail subsequent evaluations until the cooldown elapses. erEval is the only part that touches a network or other unreliable resource; everything else is policy.

An EffectfulRule paired with the integer precedence at which it competes (higher wins), mirroring PrecededRule for the pure tier. The precedence is what decides whether the rule could still change the outcome and so whether its IO runs at all.

What to do when an effectful rule cannot be consulted after the harness has exhausted its timeout, retries, and the breaker. The default across the engine is fail-closed; a rule opts out only where availability must beat safety.

The resilience knobs around an effectful rule's IO: a per-attempt timeout, how many retries to make on failure with the backoff before each, and the breaker threshold and cooldown. The breaker clock is the EvalContext.

Sensible defaults for the resilience knobs: a 2-second per-attempt timeout, two retries at 100ms then 250ms, and a breaker tripping after 5 consecutive failures and cooling for 30 seconds. The caller supplies the rule's erEval; the knobs are policy with these defaults.

An ecBackoff schedule compiled to a Control.Retry policy: the retry at iteration n waits the n-th delay (microseconds) before it, and the policy stops (yields Nothing) once the schedule is exhausted — so the list's length is the retry budget. [] admits no retry (a single attempt); [a, b] admits up to two. Inspect the resulting delays without sleeping with simulatePolicy.

The breaker's state, gating whether the guarded operation may be attempted.

A Closed breaker is healthy and counts consecutive failures towards the trip threshold; an Open breaker fast-fails until its instant passes; a HalfOpen breaker has admitted one recovery probe and is waiting on its outcome.

A fresh, healthy breaker (no failures recorded) in a new TVar.

An observer of breaker state changes: invoked with the breaker's new state after a transition commits, so a layer that cares (a state gauge) can record it.

Deliberately telemetry-agnostic — it is just a Breaker -> IO () callback, so the breaker and its callers (Ecluse.Rules.Effectful, the credential refresher) stay free of any metric dependency; the composition root supplies the bridge to the instruments. noBreakerReporter is the inert default: a breaker observed by it records nothing, which is also how a breaker constructed before the telemetry substrate exists behaves until the live observer is installed.

The inert reporter: discards the state, recording nothing.

Evaluate a package version against both tiers, the effectful tier layered on the pure one. Returns the same Decision the pure evalRules would, unless an effectful rule that could still change the outcome takes a position.

The pure tier runs first. Its winning precedence P then bounds the effectful work: only effectful rules ranked at or above P are consulted — a lower-ranked one cannot outrank the pure winner — and the effectful tier is skipped entirely (no IO) when none qualifies, so a rule set with no effectful rules, or none ranked high enough, behaves exactly as the pure tier. The qualifying effectful rules are run through runEffectfulRule (timeout, retry, breaker), and the resulting candidates compete against the pure winner under the same (precedence, deny-before-allow) comparator. An effectful Unavailable that wins is fail-closed to Undecidable.

Run one effectful rule through its resilience harness: the circuit breaker gates the attempt, then the rule's IO runs under a per-attempt timeout with bounded retry and backoff. A clean verdict (Allow/Deny/Abstain) resets the breaker and is returned; an exhausted rule (timeout, exception, the breaker open, or the rule itself yielding Unavailable on every attempt) advances the breaker and resolves per the rule's erOnError — Unavailable (fail-closed) or Abstain (fail-open).

The breaker timing reads the EvalContext clock, so it is deterministic under test. Total — it never throws; a rule failure becomes an outcome.