@volter/supercode-orchestrator 0.5.47 → 0.5.48

package/README.md

@@ -525,10 +525,12 @@ failed/timeout fires without replaying them; a restart advances a stale claim
 once. `callOperator` addresses the live socket, with no cold-write fallback.
 `Orchestrator({executeJob})` is the corresponding in-process API for embedders.
 
-The daemon acquires its exclusive lease before loading state. A crash during the
-short acquisition critical section leaves `orchestrator.acquire`; subsequent
-starts fail closed until an operator inspects and removes that guard. Normal
-stops remove only their own lease. Native `jobs.resume` computes the first fire
+The daemon serves a home only while it holds the home's claim, Hermes's
+`gateway.lock` (an flock the kernel releases when its holder dies). A second
+daemon on the home waits for the claim and serves the home as soon as the first
+is gone, however it ended; nothing fails closed or waits for a person. The
+serving daemon records itself in `orchestrator.lock` for `supercode orchestrator
+status` and the operator verbs; a normal stop removes only its own record. Native `jobs.resume` computes the first fire
 for a job that was created paused with no next-run timestamp.
 
 ## Hosted daemon lifecycle

package/bin/runtime.mjs

@@ -53,7 +53,7 @@
 // Everything it prints is one JSON object per line on stdout.
 
 import { SenderIdentityRecord } from '@volter/teams/sender-identity';
-import { existsSync, mkdirSync, rmdirSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
@@ -75,7 +75,8 @@ import { httpJobExecutor } from '../hosted.mjs';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
 
 /** How long a starting daemon waits for a stopping predecessor to release the home's lease. */
-const LEASE_HANDOFF_MS = 20_000;
+/** How often a daemon waiting for the home's claim asks for it again. */
+const CLAIM_RETRY_MS = 2_000;
 
 /// Adapter selector -> constructor. A `platforms:` block picks its adapter by
 /// `extra.adapter` when it has one and by the block's own name otherwise, so
@@ -388,16 +389,16 @@ function profileReport(name, profile) {
   };
 }
 
-// ---------------------------------------------------------------- the lease
+// ---------------------------------------------------------------- who serves the home
 
-/** The lease file, shared with `supercode orchestrator status|stop` (Rust `Lease`). */
+/** The record of the daemon serving the home, shared with `supercode orchestrator status|stop` (Rust `Lease`). */
 const readLock = readLease;
 
 function writeLock(root, lease) {
   writeFileSync(join(root, LOCK_FILE), `${JSON.stringify(lease, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
 }
 
-/** Only ever removes a lease this process holds. */
+/** Only ever removes the record this process wrote. */
 function clearLock(root) {
   const held = readLock(root);
   if (held && held.pid !== process.pid) return;
@@ -677,35 +678,26 @@ async function main() {
   let crashed = false;
   let gatewayLock = null;
   if (!args.once) {
-    // One daemon per home: its lease (and the acquisition guard serializing a lease's replacement) keeps a second daemon
-    // from firing the home's cron jobs, holding its channel adapters and driving its bindings twice, and tells a restart
-    // that its predecessor crashed (§4.7). None of it guards the board, whose one dispatcher is `workflow serve`. An
-    // acquisition guard left by a crash fails closed; inspect it before removing it manually.
-    // A service manager's restart starts this one while the last is still stopping (launchd's kickstart -k did, and
-    // this one exited 'already serving'): a live predecessor gets a moment to let go before it counts as serving.
-    for (let waited = 0; waited < LEASE_HANDOFF_MS; waited += 250) {
-      const previous = readLock(root);
-      if (!previous || previous.pid === process.pid || !leaseIsLive(previous)) break;
-      await new Promise((resolve) => setTimeout(resolve, 250));
-    }
-    const guard = join(root, 'orchestrator.acquire');
-    mkdirSync(guard);
-    try {
-      const previous = readLock(root);
-      if (previous && leaseIsLive(previous)) {
-        say('error', { root, message: `already serving ${root} (pid ${previous.pid})` });
-        throw new Error(`already serving ${root}`);
+    // One runtime serves a home: whoever holds its claim, Hermes's own gateway lock (`<home>/gateway.lock`, an flock the
+    // kernel releases the moment its holder dies, however it died). So its cron jobs fire once, its channel adapters
+    // are held once and its bindings are driven once, and a Hermes gateway on the home refuses while this daemon
+    // serves it. A second daemon does not exit and nothing waits for a person: it waits for the claim and serves the
+    // home as soon as the first is gone (a service manager's restart, a crash, kill -9).
+    for (let said = false; ;) {
+      try { gatewayLock = await holdGatewayLock(root); break; }
+      catch (error) {
+        if (!/ is served by /.test(error.message)) { say('error', { root, message: error.message }); process.exit(1); }
+        if (!said) { say('log', { level: 'info', message: `${error.message}; this daemon serves the home when that one ends` }); said = true; }
+        await new Promise((resolve) => setTimeout(resolve, CLAIM_RETRY_MS));
       }
-      crashed = Boolean(previous);
-      if (previous) unlinkSync(join(root, LOCK_FILE));
-      writeLock(root, { pid: process.pid, started_at: new Date().toISOString(), root, ...thisHost(), executor_url: args.executorUrl ?? null });
-    } finally {
-      rmdirSync(guard);
     }
-    // One runtime per home: Hermes's own gateway lock, held for as long as this daemon lives, so a Hermes
-    // gateway on this home refuses to start, and this daemon refuses a home a Hermes gateway serves.
+    // Who serves the home now (`orchestrator.lock`), for `supercode orchestrator status` and the operator verbs' live
+    // door. A record left behind is a predecessor that never stopped cleanly: this start replays for it (§4.7).
+    const previous = readLock(root);
+    crashed = Boolean(previous && previous.pid !== process.pid);
+    if (previous) unlinkSync(join(root, LOCK_FILE));
+    writeLock(root, { pid: process.pid, started_at: new Date().toISOString(), root, ...thisHost(), executor_url: args.executorUrl ?? null });
     try {
-      gatewayLock = await holdGatewayLock(root);
       // the home in both forms before it is loaded: a Hermes home is adopted as it stands
       for (const change of adoptHome(root)) say('log', { level: 'info', message: `home: ${change}` });
     } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.47",
+  "version": "0.5.48",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {