milestone 20: declarative configuration for iac

src/web/server.zig

@@ -102,10 +102,31 @@ pub const ReloadFn = *const fn (state: *WebState, io: std.Io) anyerror!void;
 /// false` means several of them are never opened at all (ruling 6). A handler
 /// that finds the collaborator it needs missing answers 503, the same way it
 /// answers a missing snapshot.
+/// Which of the two sources governs this process's configuration (milestone-20
+/// ruling 1). Per-process state, never persisted: authority lives in the
+/// invocation, and the database carries no record of who wrote it.
+///
+/// The `managed_file` path is owned by `serve`'s arena, which outlives every
+/// `WebState`, so nothing here copies it.
+pub const Authority = union(enum) {
+    database,
+    managed_file: []const u8,
+};
+
 pub const WebState = struct {
     gpa: Allocator,
     web: model.Web = .{},
 
+    /// Defaults to `.database`: a `WebState` nobody told about a managed file
+    /// governs nothing declaratively, which is the safe reading — the mutation
+    /// routes stay live rather than a half-wired server refusing every write.
+    authority: Authority = .database,
+    /// When this process loaded the managed file, in epoch seconds. Null in
+    /// database mode, which never reconciles. It answers exactly "this process
+    /// loaded the file at T" and nothing more: a file whose mtime is newer has
+    /// not been loaded by the running process.
+    reconciled_at: ?i64 = null,
+
     handler: ?*dns_handler.Handler = null,
     pause: ?*pause_mod.Pause = null,
     tracker: ?*clients.Tracker = null,