Module preflight 

Backup preflight: user-declared CEL preconditions a Snapshot must satisfy before its mover Job is launched (the “stronger preflight” of docs/repository-health.md).

This reuses the cel/*Expr foundation from crate::success_expr and crate::identity: compile → execute → require a typed result, length-capped as the cost-budget surrogate, out-of-scope variables rejected at admission. A preflight check returns a bool over a live repository + maintenance environment, evaluated by the controller at reconcile (unlike successExpr, which the mover evaluates against a finished verify result).

CEL environment

Two maps, always present:

• repository — { phase, ready, backendReachable, snapshotCount, indexBlobCount, sizeBytes, lastHealthyKnown, lastHealthyAgeSeconds, lastReverifyKnown, lastReverifyAgeSeconds }.
• maintenance — { hasRun, lastSuccessAgeSeconds }.

Fail-closed sentinels

Every *AgeSeconds / count is an integer; “never / unknown” is encoded as i64::MAX (NOT -1). A naive freshness guard maintenance.lastSuccessAgeSeconds < 604800 then reads i64::MAX < 604800 == false and correctly blocks the backup when the value is unknown, instead of silently passing (which a -1 sentinel would do). The companion *Known / hasRun booleans let an expression branch explicitly when it prefers to.

Structs

PreflightCheck

One named precondition: a CEL bool predicate over the preflight environment.

PreflightInputs

The full environment a preflight check evaluates against. A plain value struct (no kube/tokio) — the controller gathers live repository + maintenance state and fills it; the evaluator is pure.

PreflightSpec

SnapshotPolicy.spec.preflight — named preconditions a backup run must satisfy before the mover Job is created. Opt-in; absent ⇒ no preflight.

Constants

UNKNOWN_AGE

Sentinel for an unknown/never integer input, so a freshness guard fails closed.

Functions

eval_preflight_expr

Evaluate a preflight expression against inputs, requiring a bool result. Maps an evaluation failure to ValidationError::PreflightExprEval and a non-bool result to ValidationError::PreflightExprType.

validate_preflight_expr

Validate a preflight expression at admission: it must compile, and — because CEL reports an out-of-scope variable only at evaluation time — it must trial-evaluate against a representative environment without referencing an undeclared variable, returning a bool. Missing map keys on a data-dependent index are tolerated, mirroring crate::success_expr::validate_success_expr.