@danypops/vehicle-core 0.3.0 → 0.5.0

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./atomic-json.js";
 export * from "./vehicle-contract.js";
 export * from "./vehicle-errors.js";
+export * from "./vehicle-jobs.js";

package/dist/index.js

@@ -1,3 +1,4 @@
 export * from "./atomic-json.js";
 export * from "./vehicle-contract.js";
 export * from "./vehicle-errors.js";
+export * from "./vehicle-jobs.js";

package/dist/vehicle-contract.d.ts

@@ -1,3 +1,4 @@
+import type { VehicleJobWakeBudget } from "./vehicle-jobs.js";
 export type JsonPrimitive = string | number | boolean | null;
 export type JsonValue = JsonPrimitive | readonly JsonValue[] | {
     readonly [key: string]: JsonValue;
@@ -85,6 +86,12 @@ export interface VehicleFailureDescriptor {
     readonly code: string;
     readonly description: string;
 }
+/** Declares an operation safe to run as a Vehicle Job (detached, polled/tailed/canceled by id). Absent means live-invoke only. */
+export interface VehicleBackgroundCapability {
+    readonly supported: true;
+    readonly defaultWakeBudget: VehicleJobWakeBudget;
+    readonly maxWakeBudget: VehicleJobWakeBudget;
+}
 export interface VehicleOperationDescriptor {
     readonly name: string;
     readonly version: number;
@@ -98,6 +105,7 @@ export interface VehicleOperationDescriptor {
     readonly longRunning: boolean;
     readonly limits: VehicleLimits;
     readonly errors: readonly VehicleFailureDescriptor[];
+    readonly background?: VehicleBackgroundCapability;
 }
 export interface VehicleOperation<Input, Output> {
     readonly descriptor: VehicleOperationDescriptor;
@@ -117,6 +125,7 @@ export interface DefineVehicleOperationOptions<Input, Output> {
     readonly longRunning?: boolean;
     readonly limits: VehicleLimits;
     readonly errors?: readonly VehicleFailureDescriptor[];
+    readonly background?: VehicleBackgroundCapability;
 }
 export interface VehiclePrincipal {
     readonly id: string;
@@ -145,6 +154,8 @@ export interface VehicleOperationContext<Input> {
     readonly idempotencyKey?: string;
     readonly expectedRevision?: string | number;
     readonly approvalCapability?: string;
+    /** Set only for a job execution (VehicleJobStore.submit()); undefined for a plain invoke(). A handler that wants mid-flight input opts in with `for await (const input of context.steerInputs ?? [])`. */
+    readonly steerInputs?: AsyncIterable<unknown>;
     reportProgress(progress: unknown): void;
 }
 export type VehicleOperationHandler<Input, Output> = (context: VehicleOperationContext<Input>) => Promise<Output>;

package/dist/vehicle-contract.js

@@ -84,6 +84,15 @@ export function defineVehicleOperation(options) {
         longRunning: options.longRunning ?? false,
         limits: Object.freeze({ ...options.limits }),
         errors: Object.freeze((options.errors ?? []).map((failure) => Object.freeze({ ...failure }))),
+        ...(options.background
+            ? {
+                background: Object.freeze({
+                    supported: true,
+                    defaultWakeBudget: Object.freeze({ ...options.background.defaultWakeBudget }),
+                    maxWakeBudget: Object.freeze({ ...options.background.maxWakeBudget }),
+                }),
+            }
+            : {}),
     });
     return Object.freeze({ descriptor, input: options.input, output: options.output });
 }
@@ -114,6 +123,28 @@ function validateOperationMetadata(options) {
         (!Number.isSafeInteger(options.idempotency.retentionMs) || options.idempotency.retentionMs < 1)) {
         throw new Error("Vehicle keyed idempotency retentionMs must be a positive integer");
     }
+    if (options.background) {
+        if (!options.longRunning) {
+            throw new Error("Vehicle operation with a background capability must also set longRunning: true");
+        }
+        for (const [budgetName, budget] of [
+            ["defaultWakeBudget", options.background.defaultWakeBudget],
+            ["maxWakeBudget", options.background.maxWakeBudget],
+        ]) {
+            if (!Number.isSafeInteger(budget.maxCount) || budget.maxCount < 1) {
+                throw new Error(`Vehicle operation background.${budgetName}.maxCount must be a positive integer`);
+            }
+            if (!Number.isSafeInteger(budget.maxBytes) || budget.maxBytes < 1) {
+                throw new Error(`Vehicle operation background.${budgetName}.maxBytes must be a positive integer`);
+            }
+        }
+        if (options.background.defaultWakeBudget.maxCount > options.background.maxWakeBudget.maxCount) {
+            throw new Error("Vehicle operation background.defaultWakeBudget.maxCount must not exceed maxWakeBudget.maxCount");
+        }
+        if (options.background.defaultWakeBudget.maxBytes > options.background.maxWakeBudget.maxBytes) {
+            throw new Error("Vehicle operation background.defaultWakeBudget.maxBytes must not exceed maxWakeBudget.maxBytes");
+        }
+    }
 }
 function cloneJson(value) {
     const serialized = JSON.stringify(value);

package/dist/vehicle-errors.d.ts

@@ -1,6 +1,6 @@
 import type { JsonValue, VehicleSchemaIssue } from "./vehicle-contract.js";
 export type VehicleFailureCategory = "validation" | "not_found" | "conflict" | "authorization" | "capacity" | "timeout" | "cancelled" | "unavailable" | "internal";
-export type VehicleCoreErrorCode = "duplicate-owner" | "not-found" | "invalid-input" | "invalid-output" | "permission-denied" | "request-too-large" | "response-too-large" | "cancelled" | "deadline-exceeded" | "handler-failed" | "policy-failed" | "idempotency-key-required" | "client-closed" | "operation-unavailable";
+export type VehicleCoreErrorCode = "duplicate-owner" | "not-found" | "invalid-input" | "invalid-output" | "permission-denied" | "request-too-large" | "response-too-large" | "cancelled" | "deadline-exceeded" | "handler-failed" | "policy-failed" | "idempotency-key-required" | "client-closed" | "operation-unavailable" | "background-not-supported" | "job-not-found" | "job-not-steerable" | "job-steer-queue-full";
 export interface VehicleRecovery {
     readonly operation?: string;
     readonly message: string;

package/dist/vehicle-jobs.d.ts

@@ -0,0 +1,114 @@
+/** Pure pieces of Vehicle Jobs: a termination-reason resolver and a bounded wake-log accumulator. Orchestration lives in vehicle-server's VehicleJobStore. */
+export type VehicleJobStatus = "running" | "succeeded" | "failed" | "canceled";
+/** Highest precedence first -- an explicit cancel always wins even if the handler also settled around the same time. "orphaned" is a restart-reconciliation outcome: a job that was still "running" when its process died, so nothing ever really failed or succeeded -- the record's own status just goes stale. */
+export declare const VEHICLE_JOB_TERMINATION_PRECEDENCE: readonly ["canceled", "timeout", "orphaned", "failed", "succeeded"];
+export type VehicleJobTerminationReason = (typeof VEHICLE_JOB_TERMINATION_PRECEDENCE)[number];
+export declare function resolveVehicleJobTerminationReason(candidates: readonly VehicleJobTerminationReason[]): VehicleJobTerminationReason;
+/** "always" keeps every notification; "transition" drops one identical to the last (hash dedup); "first-only" keeps just the first. */
+export type VehicleJobNotifyMode = "always" | "transition" | "first-only";
+export interface VehicleJobWakeBudget {
+    readonly maxCount: number;
+    readonly maxBytes: number;
+}
+export type VehicleJobWakeDropReason = "count-budget-exhausted" | "byte-budget-exhausted" | "deduplicated-transition" | "superseded-by-first-only";
+export interface VehicleJobWakeEntry {
+    readonly seq: number;
+    readonly at: number;
+    readonly progress: unknown;
+}
+export interface VehicleJobWakeAppendResult {
+    readonly accepted: boolean;
+    readonly entry?: VehicleJobWakeEntry;
+    readonly dropReason?: VehicleJobWakeDropReason;
+}
+export interface VehicleJobWakeLogOptions {
+    readonly notifyMode: VehicleJobNotifyMode;
+    readonly budget: VehicleJobWakeBudget;
+    /** Defaults to Date.now. */
+    readonly now?: () => number;
+}
+/** Bounds a job's accumulated progress notifications by count+bytes, same discipline as enforcePayloadSize but across a job's whole lifetime. */
+export declare class VehicleJobWakeLog {
+    private readonly options;
+    private readonly entries;
+    private usedBytes;
+    private nextSeq;
+    private lastHash;
+    private acceptedFirst;
+    private readonly now;
+    constructor(options: VehicleJobWakeLogOptions);
+    append(progress: unknown): VehicleJobWakeAppendResult;
+    /** Entries with seq strictly greater than `cursor`. */
+    since(cursor: number): readonly VehicleJobWakeEntry[];
+    /** Highest seq issued so far (0 if none accepted yet). */
+    get cursor(): number;
+}
+/** Read-only replay side of a wake log -- both a live VehicleJobWakeLog and a restored (no-longer-appendable) job satisfy this with the same tail() semantics. */
+export interface VehicleJobWakeLogReader {
+    since(cursor: number): readonly VehicleJobWakeEntry[];
+    readonly cursor: number;
+}
+/** Wraps a fixed, already-finalized list of entries (e.g. restored from disk) in the same reader shape a live VehicleJobWakeLog exposes, so VehicleJobStore.tail() doesn't need to special-case a restored job. */
+export declare function createStaticVehicleJobWakeLog(entries: readonly VehicleJobWakeEntry[]): VehicleJobWakeLogReader;
+/**
+ * A job's mid-flight input channel -- the "steer" primitive. Bounded FIFO:
+ * push() while a handler isn't yet reading buffers up to maxQueueSize, then
+ * refuses further input rather than growing unboundedly or silently
+ * overwriting an unread entry. A handler consumes it via `for await (const
+ * input of context.steerInputs)`, which ends cleanly once close() is
+ * called (VehicleJobStore does this at job finalization).
+ */
+export interface VehicleJobSteerPushResult {
+    readonly accepted: boolean;
+    readonly dropReason?: "queue-full" | "channel-closed";
+}
+export declare class VehicleJobSteerChannel implements AsyncIterable<unknown> {
+    private readonly maxQueueSize;
+    private readonly buffer;
+    private readonly waiters;
+    private closed;
+    constructor(maxQueueSize?: number);
+    push(value: unknown): VehicleJobSteerPushResult;
+    /** Ends every pending and future iteration with done:true; further push() calls report "channel-closed". Idempotent. */
+    close(): void;
+    [Symbol.asyncIterator](): AsyncIterator<unknown>;
+}
+/**
+ * Vehicle Jobs run as in-process promises, not child processes -- there is
+ * no PID to reuse, but the same identity-confusion risk vstack's
+ * {pid, startToken, comm} design guards against still applies in a
+ * generalized form: a persisted job record written by one process
+ * instance must never be mistaken for one this (possibly restarted)
+ * instance can still resolve. Each VehicleJobStore construction gets a
+ * fresh random instanceToken; a persisted record's own stamped token only
+ * ever matches the instance that wrote it. A mismatch means "the original
+ * run is gone", the same conclusion vstack's identityMatches() reaches by
+ * comparing a live process's actual pid/start-time/command against a
+ * stored snapshot -- this is that same check with no process to inspect.
+ */
+export declare function vehicleJobIdentityMatches(recordInstanceToken: string, currentInstanceToken: string): boolean;
+/** Minimal shape selectVehicleJobsForEviction needs from a job record -- kept separate from VehicleJobSnapshot so vehicle-server doesn't have to construct a full snapshot just to ask "should this be swept". */
+export interface VehicleJobEvictionCandidate {
+    readonly jobId: string;
+    readonly status: VehicleJobStatus;
+    readonly delivered: boolean;
+    readonly updatedAt: number;
+}
+export interface VehicleJobRetentionOptions {
+    /** Hard cap on total retained job records (of any status). A running job is never evicted regardless of this cap. */
+    readonly maxRetainedJobs: number;
+    /** A delivered terminal job becomes eligible for eviction once this many ms have passed since it was delivered (== updatedAt at delivery time). */
+    readonly deliveredRetentionMs: number;
+    readonly now: number;
+}
+/**
+ * Pure eviction-selection policy, kept separate from VehicleJobStore's own
+ * bookkeeping so the bounded-retention rule is independently testable.
+ * Preference order: (1) delivered and past deliveredRetentionMs, oldest
+ * first; (2) once still over maxRetainedJobs, any delivered terminal job,
+ * oldest first; (3) only as a last resort, an undelivered terminal job,
+ * oldest first -- a real loss (a caller may still want that result), but
+ * an unbounded store is a worse failure mode. A running job is never a
+ * candidate.
+ */
+export declare function selectVehicleJobsForEviction(candidates: readonly VehicleJobEvictionCandidate[], options: VehicleJobRetentionOptions): readonly string[];

package/dist/vehicle-jobs.js

@@ -0,0 +1,182 @@
+/** Pure pieces of Vehicle Jobs: a termination-reason resolver and a bounded wake-log accumulator. Orchestration lives in vehicle-server's VehicleJobStore. */
+/** Highest precedence first -- an explicit cancel always wins even if the handler also settled around the same time. "orphaned" is a restart-reconciliation outcome: a job that was still "running" when its process died, so nothing ever really failed or succeeded -- the record's own status just goes stale. */
+export const VEHICLE_JOB_TERMINATION_PRECEDENCE = ["canceled", "timeout", "orphaned", "failed", "succeeded"];
+export function resolveVehicleJobTerminationReason(candidates) {
+    if (candidates.length === 0)
+        throw new Error("resolveVehicleJobTerminationReason requires at least one candidate");
+    for (const reason of VEHICLE_JOB_TERMINATION_PRECEDENCE) {
+        if (candidates.includes(reason))
+            return reason;
+    }
+    throw new Error(`Unrecognized Vehicle job termination candidate(s): ${candidates.join(", ")}`);
+}
+/** Bounds a job's accumulated progress notifications by count+bytes, same discipline as enforcePayloadSize but across a job's whole lifetime. */
+export class VehicleJobWakeLog {
+    options;
+    entries = [];
+    usedBytes = 0;
+    nextSeq = 1;
+    lastHash;
+    acceptedFirst = false;
+    now;
+    constructor(options) {
+        this.options = options;
+        this.now = options.now ?? Date.now;
+    }
+    append(progress) {
+        if (this.options.notifyMode === "first-only" && this.acceptedFirst) {
+            return { accepted: false, dropReason: "superseded-by-first-only" };
+        }
+        const serialized = safeJsonStringify(progress);
+        if (this.options.notifyMode === "transition") {
+            const hash = fnv1aHash(serialized);
+            if (hash === this.lastHash)
+                return { accepted: false, dropReason: "deduplicated-transition" };
+            this.lastHash = hash;
+        }
+        const bytes = new TextEncoder().encode(serialized).byteLength;
+        if (this.entries.length >= this.options.budget.maxCount)
+            return { accepted: false, dropReason: "count-budget-exhausted" };
+        if (this.usedBytes + bytes > this.options.budget.maxBytes)
+            return { accepted: false, dropReason: "byte-budget-exhausted" };
+        const entry = { seq: this.nextSeq++, at: this.now(), progress };
+        this.entries.push(entry);
+        this.usedBytes += bytes;
+        this.acceptedFirst = true;
+        return { accepted: true, entry };
+    }
+    /** Entries with seq strictly greater than `cursor`. */
+    since(cursor) {
+        return this.entries.filter((entry) => entry.seq > cursor);
+    }
+    /** Highest seq issued so far (0 if none accepted yet). */
+    get cursor() {
+        return this.nextSeq - 1;
+    }
+}
+function safeJsonStringify(value) {
+    let serialized;
+    try {
+        serialized = JSON.stringify(value);
+    }
+    catch (error) {
+        throw new Error("Vehicle job progress value is not JSON-serializable", { cause: error });
+    }
+    if (serialized === undefined)
+        throw new Error("Vehicle job progress value is not JSON-serializable");
+    return serialized;
+}
+/** Non-cryptographic (FNV-1a) -- dedup only. */
+function fnv1aHash(value) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < value.length; i++) {
+        hash ^= value.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return (hash >>> 0).toString(16);
+}
+/** Wraps a fixed, already-finalized list of entries (e.g. restored from disk) in the same reader shape a live VehicleJobWakeLog exposes, so VehicleJobStore.tail() doesn't need to special-case a restored job. */
+export function createStaticVehicleJobWakeLog(entries) {
+    const sorted = [...entries].sort((a, b) => a.seq - b.seq);
+    const cursor = sorted.length > 0 ? sorted[sorted.length - 1].seq : 0;
+    return {
+        since: (cursorArg) => sorted.filter((entry) => entry.seq > cursorArg),
+        cursor,
+    };
+}
+export class VehicleJobSteerChannel {
+    maxQueueSize;
+    buffer = [];
+    waiters = [];
+    closed = false;
+    constructor(maxQueueSize = 64) {
+        this.maxQueueSize = maxQueueSize;
+    }
+    push(value) {
+        if (this.closed)
+            return { accepted: false, dropReason: "channel-closed" };
+        const waiter = this.waiters.shift();
+        if (waiter) {
+            waiter({ value, done: false });
+            return { accepted: true };
+        }
+        if (this.buffer.length >= this.maxQueueSize)
+            return { accepted: false, dropReason: "queue-full" };
+        this.buffer.push(value);
+        return { accepted: true };
+    }
+    /** Ends every pending and future iteration with done:true; further push() calls report "channel-closed". Idempotent. */
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        for (const waiter of this.waiters.splice(0))
+            waiter({ value: undefined, done: true });
+    }
+    [Symbol.asyncIterator]() {
+        return {
+            next: () => {
+                if (this.buffer.length > 0)
+                    return Promise.resolve({ value: this.buffer.shift(), done: false });
+                if (this.closed)
+                    return Promise.resolve({ value: undefined, done: true });
+                return new Promise((resolve) => this.waiters.push(resolve));
+            },
+        };
+    }
+}
+/**
+ * Vehicle Jobs run as in-process promises, not child processes -- there is
+ * no PID to reuse, but the same identity-confusion risk vstack's
+ * {pid, startToken, comm} design guards against still applies in a
+ * generalized form: a persisted job record written by one process
+ * instance must never be mistaken for one this (possibly restarted)
+ * instance can still resolve. Each VehicleJobStore construction gets a
+ * fresh random instanceToken; a persisted record's own stamped token only
+ * ever matches the instance that wrote it. A mismatch means "the original
+ * run is gone", the same conclusion vstack's identityMatches() reaches by
+ * comparing a live process's actual pid/start-time/command against a
+ * stored snapshot -- this is that same check with no process to inspect.
+ */
+export function vehicleJobIdentityMatches(recordInstanceToken, currentInstanceToken) {
+    return recordInstanceToken === currentInstanceToken;
+}
+/**
+ * Pure eviction-selection policy, kept separate from VehicleJobStore's own
+ * bookkeeping so the bounded-retention rule is independently testable.
+ * Preference order: (1) delivered and past deliveredRetentionMs, oldest
+ * first; (2) once still over maxRetainedJobs, any delivered terminal job,
+ * oldest first; (3) only as a last resort, an undelivered terminal job,
+ * oldest first -- a real loss (a caller may still want that result), but
+ * an unbounded store is a worse failure mode. A running job is never a
+ * candidate.
+ */
+export function selectVehicleJobsForEviction(candidates, options) {
+    const terminal = candidates.filter((candidate) => candidate.status !== "running");
+    const byAgeAscending = (a, b) => a.updatedAt - b.updatedAt;
+    const evicted = new Set();
+    for (const candidate of terminal) {
+        if (candidate.delivered && options.now - candidate.updatedAt >= options.deliveredRetentionMs)
+            evicted.add(candidate.jobId);
+    }
+    const remainingCount = () => candidates.length - evicted.size;
+    if (remainingCount() > options.maxRetainedJobs) {
+        const deliveredOldestFirst = terminal.filter((candidate) => candidate.delivered && !evicted.has(candidate.jobId)).sort(byAgeAscending);
+        for (const candidate of deliveredOldestFirst) {
+            if (remainingCount() <= options.maxRetainedJobs)
+                break;
+            evicted.add(candidate.jobId);
+        }
+    }
+    if (remainingCount() > options.maxRetainedJobs) {
+        const undeliveredOldestFirst = terminal
+            .filter((candidate) => !candidate.delivered && !evicted.has(candidate.jobId))
+            .sort(byAgeAscending);
+        for (const candidate of undeliveredOldestFirst) {
+            if (remainingCount() <= options.maxRetainedJobs)
+                break;
+            evicted.add(candidate.jobId);
+        }
+    }
+    return [...evicted];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@danypops/vehicle-core",
-	"version": "0.3.0",
+	"version": "0.5.0",
 	"description": "Vehicle's runtime-neutral wire contract: operation descriptors, schema codecs, failure shapes. Zero runtime dependencies, zero Bun-specific code -- the one thing every Vehicle client and server package depends on.",
 	"license": "MIT",
 	"type": "module",

package/src/index.ts

@@ -1,3 +1,4 @@
 export * from "./atomic-json.js";
 export * from "./vehicle-contract.js";
 export * from "./vehicle-errors.js";
+export * from "./vehicle-jobs.js";

package/src/vehicle-contract.ts

@@ -1,3 +1,5 @@
+import type { VehicleJobWakeBudget } from "./vehicle-jobs.js";
+
 export type JsonPrimitive = string | number | boolean | null;
 export type JsonValue = JsonPrimitive | readonly JsonValue[] | { readonly [key: string]: JsonValue };
 export type JsonSchema = Readonly<Record<string, JsonValue>>;
@@ -137,6 +139,13 @@ export interface VehicleFailureDescriptor {
 	readonly description: string;
 }
 
+/** Declares an operation safe to run as a Vehicle Job (detached, polled/tailed/canceled by id). Absent means live-invoke only. */
+export interface VehicleBackgroundCapability {
+	readonly supported: true;
+	readonly defaultWakeBudget: VehicleJobWakeBudget;
+	readonly maxWakeBudget: VehicleJobWakeBudget;
+}
+
 export interface VehicleOperationDescriptor {
 	readonly name: string;
 	readonly version: number;
@@ -150,6 +159,7 @@ export interface VehicleOperationDescriptor {
 	readonly longRunning: boolean;
 	readonly limits: VehicleLimits;
 	readonly errors: readonly VehicleFailureDescriptor[];
+	readonly background?: VehicleBackgroundCapability;
 }
 
 export interface VehicleOperation<Input, Output> {
@@ -171,6 +181,7 @@ export interface DefineVehicleOperationOptions<Input, Output> {
 	readonly longRunning?: boolean;
 	readonly limits: VehicleLimits;
 	readonly errors?: readonly VehicleFailureDescriptor[];
+	readonly background?: VehicleBackgroundCapability;
 }
 
 export interface VehiclePrincipal {
@@ -202,6 +213,8 @@ export interface VehicleOperationContext<Input> {
 	readonly idempotencyKey?: string;
 	readonly expectedRevision?: string | number;
 	readonly approvalCapability?: string;
+	/** Set only for a job execution (VehicleJobStore.submit()); undefined for a plain invoke(). A handler that wants mid-flight input opts in with `for await (const input of context.steerInputs ?? [])`. */
+	readonly steerInputs?: AsyncIterable<unknown>;
 	reportProgress(progress: unknown): void;
 }
 
@@ -260,6 +273,15 @@ export function defineVehicleOperation<Input, Output>(
 		longRunning: options.longRunning ?? false,
 		limits: Object.freeze({ ...options.limits }),
 		errors: Object.freeze((options.errors ?? []).map((failure) => Object.freeze({ ...failure }))),
+		...(options.background
+			? {
+					background: Object.freeze({
+						supported: true as const,
+						defaultWakeBudget: Object.freeze({ ...options.background.defaultWakeBudget }),
+						maxWakeBudget: Object.freeze({ ...options.background.maxWakeBudget }),
+					}),
+				}
+			: {}),
 	});
 	return Object.freeze({ descriptor, input: options.input, output: options.output });
 }
@@ -293,6 +315,28 @@ function validateOperationMetadata<Input, Output>(options: DefineVehicleOperatio
 	) {
 		throw new Error("Vehicle keyed idempotency retentionMs must be a positive integer");
 	}
+	if (options.background) {
+		if (!options.longRunning) {
+			throw new Error("Vehicle operation with a background capability must also set longRunning: true");
+		}
+		for (const [budgetName, budget] of [
+			["defaultWakeBudget", options.background.defaultWakeBudget],
+			["maxWakeBudget", options.background.maxWakeBudget],
+		] as const) {
+			if (!Number.isSafeInteger(budget.maxCount) || budget.maxCount < 1) {
+				throw new Error(`Vehicle operation background.${budgetName}.maxCount must be a positive integer`);
+			}
+			if (!Number.isSafeInteger(budget.maxBytes) || budget.maxBytes < 1) {
+				throw new Error(`Vehicle operation background.${budgetName}.maxBytes must be a positive integer`);
+			}
+		}
+		if (options.background.defaultWakeBudget.maxCount > options.background.maxWakeBudget.maxCount) {
+			throw new Error("Vehicle operation background.defaultWakeBudget.maxCount must not exceed maxWakeBudget.maxCount");
+		}
+		if (options.background.defaultWakeBudget.maxBytes > options.background.maxWakeBudget.maxBytes) {
+			throw new Error("Vehicle operation background.defaultWakeBudget.maxBytes must not exceed maxWakeBudget.maxBytes");
+		}
+	}
 }
 
 function cloneJson<T extends JsonValue>(value: T): T {

package/src/vehicle-errors.ts

@@ -25,7 +25,11 @@ export type VehicleCoreErrorCode =
 	| "policy-failed"
 	| "idempotency-key-required"
 	| "client-closed"
-	| "operation-unavailable";
+	| "operation-unavailable"
+	| "background-not-supported"
+	| "job-not-found"
+	| "job-not-steerable"
+	| "job-steer-queue-full";
 
 export interface VehicleRecovery {
 	readonly operation?: string;

package/src/vehicle-jobs.ts

@@ -0,0 +1,255 @@
+/** Pure pieces of Vehicle Jobs: a termination-reason resolver and a bounded wake-log accumulator. Orchestration lives in vehicle-server's VehicleJobStore. */
+
+export type VehicleJobStatus = "running" | "succeeded" | "failed" | "canceled";
+
+/** Highest precedence first -- an explicit cancel always wins even if the handler also settled around the same time. "orphaned" is a restart-reconciliation outcome: a job that was still "running" when its process died, so nothing ever really failed or succeeded -- the record's own status just goes stale. */
+export const VEHICLE_JOB_TERMINATION_PRECEDENCE = ["canceled", "timeout", "orphaned", "failed", "succeeded"] as const;
+export type VehicleJobTerminationReason = (typeof VEHICLE_JOB_TERMINATION_PRECEDENCE)[number];
+
+export function resolveVehicleJobTerminationReason(candidates: readonly VehicleJobTerminationReason[]): VehicleJobTerminationReason {
+	if (candidates.length === 0) throw new Error("resolveVehicleJobTerminationReason requires at least one candidate");
+	for (const reason of VEHICLE_JOB_TERMINATION_PRECEDENCE) {
+		if (candidates.includes(reason)) return reason;
+	}
+	throw new Error(`Unrecognized Vehicle job termination candidate(s): ${candidates.join(", ")}`);
+}
+
+/** "always" keeps every notification; "transition" drops one identical to the last (hash dedup); "first-only" keeps just the first. */
+export type VehicleJobNotifyMode = "always" | "transition" | "first-only";
+
+export interface VehicleJobWakeBudget {
+	readonly maxCount: number;
+	readonly maxBytes: number;
+}
+
+export type VehicleJobWakeDropReason =
+	| "count-budget-exhausted"
+	| "byte-budget-exhausted"
+	| "deduplicated-transition"
+	| "superseded-by-first-only";
+
+export interface VehicleJobWakeEntry {
+	readonly seq: number;
+	readonly at: number;
+	readonly progress: unknown;
+}
+
+export interface VehicleJobWakeAppendResult {
+	readonly accepted: boolean;
+	readonly entry?: VehicleJobWakeEntry;
+	readonly dropReason?: VehicleJobWakeDropReason;
+}
+
+export interface VehicleJobWakeLogOptions {
+	readonly notifyMode: VehicleJobNotifyMode;
+	readonly budget: VehicleJobWakeBudget;
+	/** Defaults to Date.now. */
+	readonly now?: () => number;
+}
+
+/** Bounds a job's accumulated progress notifications by count+bytes, same discipline as enforcePayloadSize but across a job's whole lifetime. */
+export class VehicleJobWakeLog {
+	private readonly entries: VehicleJobWakeEntry[] = [];
+	private usedBytes = 0;
+	private nextSeq = 1;
+	private lastHash: string | undefined;
+	private acceptedFirst = false;
+	private readonly now: () => number;
+
+	constructor(private readonly options: VehicleJobWakeLogOptions) {
+		this.now = options.now ?? Date.now;
+	}
+
+	append(progress: unknown): VehicleJobWakeAppendResult {
+		if (this.options.notifyMode === "first-only" && this.acceptedFirst) {
+			return { accepted: false, dropReason: "superseded-by-first-only" };
+		}
+		const serialized = safeJsonStringify(progress);
+		if (this.options.notifyMode === "transition") {
+			const hash = fnv1aHash(serialized);
+			if (hash === this.lastHash) return { accepted: false, dropReason: "deduplicated-transition" };
+			this.lastHash = hash;
+		}
+		const bytes = new TextEncoder().encode(serialized).byteLength;
+		if (this.entries.length >= this.options.budget.maxCount) return { accepted: false, dropReason: "count-budget-exhausted" };
+		if (this.usedBytes + bytes > this.options.budget.maxBytes) return { accepted: false, dropReason: "byte-budget-exhausted" };
+
+		const entry: VehicleJobWakeEntry = { seq: this.nextSeq++, at: this.now(), progress };
+		this.entries.push(entry);
+		this.usedBytes += bytes;
+		this.acceptedFirst = true;
+		return { accepted: true, entry };
+	}
+
+	/** Entries with seq strictly greater than `cursor`. */
+	since(cursor: number): readonly VehicleJobWakeEntry[] {
+		return this.entries.filter((entry) => entry.seq > cursor);
+	}
+
+	/** Highest seq issued so far (0 if none accepted yet). */
+	get cursor(): number {
+		return this.nextSeq - 1;
+	}
+}
+
+function safeJsonStringify(value: unknown): string {
+	let serialized: string | undefined;
+	try {
+		serialized = JSON.stringify(value);
+	} catch (error) {
+		throw new Error("Vehicle job progress value is not JSON-serializable", { cause: error });
+	}
+	if (serialized === undefined) throw new Error("Vehicle job progress value is not JSON-serializable");
+	return serialized;
+}
+
+/** Non-cryptographic (FNV-1a) -- dedup only. */
+function fnv1aHash(value: string): string {
+	let hash = 0x811c9dc5;
+	for (let i = 0; i < value.length; i++) {
+		hash ^= value.charCodeAt(i);
+		hash = Math.imul(hash, 0x01000193);
+	}
+	return (hash >>> 0).toString(16);
+}
+
+/** Read-only replay side of a wake log -- both a live VehicleJobWakeLog and a restored (no-longer-appendable) job satisfy this with the same tail() semantics. */
+export interface VehicleJobWakeLogReader {
+	since(cursor: number): readonly VehicleJobWakeEntry[];
+	readonly cursor: number;
+}
+
+/** Wraps a fixed, already-finalized list of entries (e.g. restored from disk) in the same reader shape a live VehicleJobWakeLog exposes, so VehicleJobStore.tail() doesn't need to special-case a restored job. */
+export function createStaticVehicleJobWakeLog(entries: readonly VehicleJobWakeEntry[]): VehicleJobWakeLogReader {
+	const sorted = [...entries].sort((a, b) => a.seq - b.seq);
+	const cursor = sorted.length > 0 ? sorted[sorted.length - 1]!.seq : 0;
+	return {
+		since: (cursorArg) => sorted.filter((entry) => entry.seq > cursorArg),
+		cursor,
+	};
+}
+
+/**
+ * A job's mid-flight input channel -- the "steer" primitive. Bounded FIFO:
+ * push() while a handler isn't yet reading buffers up to maxQueueSize, then
+ * refuses further input rather than growing unboundedly or silently
+ * overwriting an unread entry. A handler consumes it via `for await (const
+ * input of context.steerInputs)`, which ends cleanly once close() is
+ * called (VehicleJobStore does this at job finalization).
+ */
+export interface VehicleJobSteerPushResult {
+	readonly accepted: boolean;
+	readonly dropReason?: "queue-full" | "channel-closed";
+}
+
+export class VehicleJobSteerChannel implements AsyncIterable<unknown> {
+	private readonly buffer: unknown[] = [];
+	private readonly waiters: ((result: IteratorResult<unknown>) => void)[] = [];
+	private closed = false;
+
+	constructor(private readonly maxQueueSize: number = 64) {}
+
+	push(value: unknown): VehicleJobSteerPushResult {
+		if (this.closed) return { accepted: false, dropReason: "channel-closed" };
+		const waiter = this.waiters.shift();
+		if (waiter) {
+			waiter({ value, done: false });
+			return { accepted: true };
+		}
+		if (this.buffer.length >= this.maxQueueSize) return { accepted: false, dropReason: "queue-full" };
+		this.buffer.push(value);
+		return { accepted: true };
+	}
+
+	/** Ends every pending and future iteration with done:true; further push() calls report "channel-closed". Idempotent. */
+	close(): void {
+		if (this.closed) return;
+		this.closed = true;
+		for (const waiter of this.waiters.splice(0)) waiter({ value: undefined, done: true });
+	}
+
+	[Symbol.asyncIterator](): AsyncIterator<unknown> {
+		return {
+			next: (): Promise<IteratorResult<unknown>> => {
+				if (this.buffer.length > 0) return Promise.resolve({ value: this.buffer.shift(), done: false });
+				if (this.closed) return Promise.resolve({ value: undefined, done: true });
+				return new Promise((resolve) => this.waiters.push(resolve));
+			},
+		};
+	}
+}
+
+/**
+ * Vehicle Jobs run as in-process promises, not child processes -- there is
+ * no PID to reuse, but the same identity-confusion risk vstack's
+ * {pid, startToken, comm} design guards against still applies in a
+ * generalized form: a persisted job record written by one process
+ * instance must never be mistaken for one this (possibly restarted)
+ * instance can still resolve. Each VehicleJobStore construction gets a
+ * fresh random instanceToken; a persisted record's own stamped token only
+ * ever matches the instance that wrote it. A mismatch means "the original
+ * run is gone", the same conclusion vstack's identityMatches() reaches by
+ * comparing a live process's actual pid/start-time/command against a
+ * stored snapshot -- this is that same check with no process to inspect.
+ */
+export function vehicleJobIdentityMatches(recordInstanceToken: string, currentInstanceToken: string): boolean {
+	return recordInstanceToken === currentInstanceToken;
+}
+
+/** Minimal shape selectVehicleJobsForEviction needs from a job record -- kept separate from VehicleJobSnapshot so vehicle-server doesn't have to construct a full snapshot just to ask "should this be swept". */
+export interface VehicleJobEvictionCandidate {
+	readonly jobId: string;
+	readonly status: VehicleJobStatus;
+	readonly delivered: boolean;
+	readonly updatedAt: number;
+}
+
+export interface VehicleJobRetentionOptions {
+	/** Hard cap on total retained job records (of any status). A running job is never evicted regardless of this cap. */
+	readonly maxRetainedJobs: number;
+	/** A delivered terminal job becomes eligible for eviction once this many ms have passed since it was delivered (== updatedAt at delivery time). */
+	readonly deliveredRetentionMs: number;
+	readonly now: number;
+}
+
+/**
+ * Pure eviction-selection policy, kept separate from VehicleJobStore's own
+ * bookkeeping so the bounded-retention rule is independently testable.
+ * Preference order: (1) delivered and past deliveredRetentionMs, oldest
+ * first; (2) once still over maxRetainedJobs, any delivered terminal job,
+ * oldest first; (3) only as a last resort, an undelivered terminal job,
+ * oldest first -- a real loss (a caller may still want that result), but
+ * an unbounded store is a worse failure mode. A running job is never a
+ * candidate.
+ */
+export function selectVehicleJobsForEviction(
+	candidates: readonly VehicleJobEvictionCandidate[],
+	options: VehicleJobRetentionOptions,
+): readonly string[] {
+	const terminal = candidates.filter((candidate) => candidate.status !== "running");
+	const byAgeAscending = (a: VehicleJobEvictionCandidate, b: VehicleJobEvictionCandidate) => a.updatedAt - b.updatedAt;
+
+	const evicted = new Set<string>();
+	for (const candidate of terminal) {
+		if (candidate.delivered && options.now - candidate.updatedAt >= options.deliveredRetentionMs) evicted.add(candidate.jobId);
+	}
+
+	const remainingCount = () => candidates.length - evicted.size;
+	if (remainingCount() > options.maxRetainedJobs) {
+		const deliveredOldestFirst = terminal.filter((candidate) => candidate.delivered && !evicted.has(candidate.jobId)).sort(byAgeAscending);
+		for (const candidate of deliveredOldestFirst) {
+			if (remainingCount() <= options.maxRetainedJobs) break;
+			evicted.add(candidate.jobId);
+		}
+	}
+	if (remainingCount() > options.maxRetainedJobs) {
+		const undeliveredOldestFirst = terminal
+			.filter((candidate) => !candidate.delivered && !evicted.has(candidate.jobId))
+			.sort(byAgeAscending);
+		for (const candidate of undeliveredOldestFirst) {
+			if (remainingCount() <= options.maxRetainedJobs) break;
+			evicted.add(candidate.jobId);
+		}
+	}
+	return [...evicted];
+}