@zq-silk/yui 0.5.3 → 0.6.1

package/dist/controller/runtime.js

@@ -7,27 +7,98 @@ import { AGENT_OPERATIONAL_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, YUI_M
 import { hasRuntimeCleanupObligation, runtimeLifecycleSignalKey, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { agentProcessReadinessProbe, ExecutorRegistry } from "../executor/executorRegistry.js";
 import { activeLiveRoleAgentSession, roleAgentSessionResumeMode } from "../executor/agentExecutor.js";
-import { effectiveLaunchSnapshotsCompatible, resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
+import { effectiveLaunchSnapshotsCompatible, effectiveLaunchSnapshotsCompatibleForTaskMain, resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
 import { isTaskOwnedWorkspace } from "../worktree/managedWorkspace.js";
 import { FileRoleLaunchPlanner } from "../executor/fileRoleLaunchPlanner.js";
 import { openCompatibleFileTaskStore } from "../storage/compatibleTaskStore.js";
+import { SqliteTaskStore } from "../storage/sqliteStore.js";
+import { AsyncTaskStoreClient, resolveStoreWorkerEnabledForHome } from "../storage/storeRpc.js";
 import { FileTaskWorkspacePreparer } from "../repository/taskWorkspacePreparer.js";
 import { NodeCommandExecutor } from "../tmux/commandExecutor.js";
 import { TmuxManager, yuiTmuxServerName } from "../tmux/tmuxManager.js";
 import { FileTaskRuntimeIsolation, TmuxPromptPushAdapter, TmuxSessionHost } from "../runtime/index.js";
 import { startFileTaskController } from "./controller.js";
 import { FileSchedulerStoreAdapter } from "./fileSchedulerStoreAdapter.js";
+import { openSchedulerTelemetry } from "../telemetry/telemetryWiring.js";
+import { createFileArtifactPort, createLinuxProcessPort, DurableJobSupervisor } from "./jobSupervisor.js";
+import { createDurableJobControl } from "./jobControl.js";
 import { FileRuntimeEventInbox } from "./runtimeEventInbox.js";
-import { FileRuntimeEventProcessor } from "./runtimeEventProcessor.js";
+import { AsyncRuntimeEventProcessor, FileRuntimeEventProcessor, createAsyncRuntimeObserver } from "./runtimeEventProcessor.js";
 import { RuntimeLaunchCoordinator } from "./runtimeLaunchCoordinator.js";
 import { ephemeralDomainFromEnvironment, recordEphemeralTmuxTarget } from "./domainIdentity.js";
 import { createEphemeralResourceReaper } from "./ephemeralResourceReaper.js";
 import { scanControllerResourceInventory } from "./resourceInventoryLinux.js";
+import { ResourceInventoryClient } from "./resourceInventoryRpc.js";
+import { createResourceAutoGc } from "../resources/autoResourceGc.js";
 import { createRuntimeResourceActivityTracker } from "./resourceInventory.js";
+import { SessionOwnerReconciliation } from "./sessionOwnerReconciliation.js";
+/** Refreshes only the exact Task runtime generation folded by the event transaction. */
+export function refreshAppliedTaskRuntimeDescriptor(store, planner, input) {
+    if (input.launchId === undefined)
+        return;
+    const run = input.runId === undefined
+        ? null
+        : store.getAgentRun(input.taskId, input.runId);
+    if (input.runId !== undefined && run === null) {
+        throw new Error("Prepared Task runtime generation is not current.");
+    }
+    // A terminal completion has already settled this exact Run and no later
+    // prompt can use its descriptor. Acknowledge the applied provider fact
+    // without republishing a dead generation.
+    if (run !== null && run.status !== "active")
+        return;
+    const session = store.getTaskRoleSessionSet(input.taskId, input.roleName)
+        ?.sessions[input.agentId];
+    const effective = run?.effective ?? session?.effective;
+    if (effective === undefined
+        || session === undefined
+        || session.agentId !== input.agentId
+        || session.adapterId !== input.adapterId
+        || session.launchId !== input.launchId
+        || session.nativeSessionId !== input.nativeSessionId
+        || (run !== null && (run.roleName !== input.roleName
+            || run.effective.agentId !== input.agentId
+            || run.effective.adapterId !== input.adapterId))) {
+        throw new Error("Prepared Task runtime generation is not current.");
+    }
+    planner.refreshTaskRuntimeDescriptor({
+        ...input,
+        launchId: input.launchId,
+        workspace: effective.workspace.root
+    });
+}
 /** Production composition root for the lean FileTaskStore + tmux Controller. */
 export async function startFileTaskControllerRuntime(home, options = {}) {
-    const store = options.store ?? openCompatibleFileTaskStore(home);
-    const schedulerStore = options.schedulerStore ?? new FileSchedulerStoreAdapter(store);
+    // The Home decides the backend (Issue 01): a layout-7 Home runs SQLite with
+    // the persistence worker on by default; YUI_STORE_WORKER=0/false forces the
+    // in-process SQLite connection. The non-worker path opens the Home-decided
+    // backend through the compatibility opener (SQLite for layout 7, file store
+    // with normalization for older layouts).
+    const useWorker = resolveStoreWorkerEnabledForHome(home, options.environment ?? process.env);
+    const store = options.store
+        ?? (useWorker
+            // Transitional: the scheduler/planner still use a sync store. The worker
+            // owns the event-processing hot path; the scheduler migration is the next
+            // step (see work-item-5 remaining call sites). Both connections point at
+            // the same WAL db and serialize via BEGIN IMMEDIATE + busy_timeout.
+            ? new SqliteTaskStore(home)
+            : openCompatibleFileTaskStore(home));
+    // When the worker backend is active, the db-touching observer folds run in
+    // the worker (off the main event loop). The client is closed on shutdown.
+    const asyncStoreClient = useWorker
+        ? new AsyncTaskStoreClient(home, {
+            environment: options.environment,
+            observerModule: new URL("./fileSchedulerStoreAdapter.js", import.meta.url)
+        })
+        : undefined;
+    // When the worker backend is active, the blocking /proc inventory scan runs
+    // in the inventory worker (off the main event loop); the scheduler and the
+    // ephemeral reaper consume the same inventory shape through this client (§3.3).
+    const inventoryClient = useWorker
+        ? new ResourceInventoryClient()
+        : undefined;
+    const schedulerStore = options.schedulerStore
+        ?? new FileSchedulerStoreAdapter(store, openSchedulerTelemetry(home, options.environment ?? process.env));
     const domainIdentity = options.domainIdentity
         ?? ephemeralDomainFromEnvironment(options.environment ?? process.env);
     const planner = options.planner ?? new FileRoleLaunchPlanner(home, store, {
@@ -45,7 +116,27 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
                 }
             })
     });
-    const sessionHost = options.sessionHost ?? new TmuxSessionHost(planner, tmux);
+    const sessionOwners = new SessionOwnerReconciliation({
+        home,
+        store,
+        environment: options.environment,
+        tmux,
+        onWarning: options.onError
+    });
+    const sessionHost = options.sessionHost ?? new TmuxSessionHost(planner, tmux, {
+        onHostCreated: ({ binding, pane }) => {
+            sessionOwners.recordHostOwner({
+                owner: binding.owner,
+                agentId: binding.agentId,
+                adapterId: binding.adapterId,
+                launchId: binding.launchId,
+                ...(binding.nativeSessionId === undefined
+                    ? {}
+                    : { nativeSessionId: binding.nativeSessionId }),
+                ...(pane.pid === undefined ? {} : { panePid: pane.pid })
+            });
+        }
+    });
     const promptPush = options.promptPush
         ?? new TmuxPromptPushAdapter(tmux, agentProcessReadinessProbe);
     const runtimeIsolation = options.runtimeIsolation
@@ -67,7 +158,19 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             : {
                 inspectOwners: (owners) => sessionHost.inspectOwners(owners)
             }),
-        stopOwner: (owner) => (sessionHost.stopOwner(owner)),
+        stopOwner: (owner) => {
+            // Issue 03: the durable `stopped` transition is gated on physical
+            // exit proof. A blocked result keeps the Session non-terminal and
+            // preserves owner records for Operator recovery.
+            return sessionOwners.terminateOwner(owner).then((result) => {
+                if (result.outcome === "stop-blocked") {
+                    (options.onError ?? (() => undefined))(new Error(`Role runtime cleanup could not prove physical exit: ${result.remaining
+                        .map(({ record, detail }) => `${record.launchId}: ${detail}`)
+                        .join("; ")}`));
+                }
+                return result.outcome === "stop-confirmed";
+            });
+        },
         ...(runtimeIsolation.cleanupTaskLaunch === undefined
             ? {}
             : {
@@ -95,19 +198,32 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         onCleanupRequired: signalRuntimeCleanup,
         runtimeIsolation
     });
+    // One inventory scan per scheduler pass. When the worker backend is active
+    // the blocking /proc scan runs in the inventory worker; otherwise it runs on
+    // the main thread (file backend, unchanged).
+    const scanInventory = (panes) => inventoryClient !== undefined
+        ? inventoryClient.scan({
+            currentHome: home,
+            scope: "current",
+            panes,
+            ...(options.environment === undefined
+                ? {}
+                : { environment: options.environment })
+        })
+        : scanControllerResourceInventory({
+            currentHome: home,
+            scope: "current",
+            panes,
+            ...(options.environment === undefined
+                ? {}
+                : { environment: options.environment })
+        });
     const delivery = options.delivery ?? new ExecutorRegistry(planner, tmux, agentProcessReadinessProbe, {
         sessionHost,
         promptPush,
         launchCoordinator,
         roleResourceInventory: async (panes, inputs) => {
-            const inventory = await scanControllerResourceInventory({
-                currentHome: home,
-                scope: "current",
-                panes,
-                ...(options.environment === undefined
-                    ? {}
-                    : { environment: options.environment })
-            });
+            const inventory = await scanInventory(panes);
             return inventory.resources.flatMap((resource) => {
                 if (resource.kind !== "agent-session")
                     return [];
@@ -182,9 +298,76 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
                 // recovery bounded to that domain; cross-home cleanup remains an
                 // explicit `controller cleanup --all` inventory operation.
                 scope: "current",
-                environment: options.environment
+                environment: options.environment,
+                // When the worker backend is active, the reaper's scan runs in the
+                // inventory worker too (same cadence, same inventory shape).
+                ...(inventoryClient === undefined
+                    ? {}
+                    : {
+                        scan: () => inventoryClient.scan({
+                            currentHome: home,
+                            scope: "current",
+                            ...(options.environment === undefined
+                                ? {}
+                                : { environment: options.environment })
+                        })
+                    })
             }));
+    // Issue 10: automatic Resource GC. The runner self-skips unless
+    // resourcesGcMode=quarantine and resourcesGcAutoQuarantine=true, so wiring
+    // it unconditionally costs one config read per full pass when disabled.
+    const resourceAutoGc = options.resourceAutoGc
+        ?? createResourceAutoGc({
+            home,
+            store,
+            environment: options.environment
+        });
     const lifecycleDispatcher = createRuntimeLifecycleDispatcher(store, schedulerStore, sessionHost, options.dispatcher, signalRuntimeCleanup, launchCoordinator, planner);
+    // f7/rr5: Share one inbox between the supervisor's terminal channel and
+    // the runtime event processor. When a Job reaches a terminal state, the
+    // supervisor enqueues a durable-job-terminal event; the processor drains
+    // it on the next pass, waking the Controller immediately instead of
+    // waiting for the poll interval.
+    const runtimeEventInbox = new FileRuntimeEventInbox(home);
+    const jobSupervisor = new DurableJobSupervisor({
+        store: schedulerStore,
+        process: createLinuxProcessPort(),
+        artifacts: createFileArtifactPort(home),
+        // rr6/f1: Bounded supervision wake. The supervisor signals the Controller
+        // after spawning a runner (queued→running adoption) and when a runner
+        // exits (terminal harvest), so a quick job converges without waiting for
+        // the recovery interval. Closes over runningRuntime, which is assigned
+        // once startFileTaskController resolves; a wake during shutdown is a
+        // no-op. The recovery interval stays the cross-restart fallback.
+        wake: (taskId) => {
+            try {
+                runningRuntime?.signal(`task:${taskId}`);
+            }
+            catch {
+                // Controller stopped; the recovery interval remains the fallback.
+            }
+        },
+        terminalEvents: {
+            deliverTerminalEvent(notice) {
+                try {
+                    runtimeEventInbox.enqueueDurableJobTerminal({
+                        scope: "task",
+                        taskId: notice.taskId,
+                        jobId: notice.jobId,
+                        status: notice.status,
+                        outcome: notice.outcome
+                    });
+                }
+                catch (error) {
+                    // Best-effort terminal channel: the terminal transition already
+                    // committed. A delivery failure must not fail the reconcile pass.
+                    (options.onError ?? (() => undefined))(error);
+                }
+            }
+        },
+        onError: options.onError
+    });
+    const jobControl = createDurableJobControl(store);
     const running = await startFileTaskController(home, schedulerStore, delivery, lifecycleDispatcher, {
         intervalMs: options.intervalMs
             ?? reconciliationIntervalMilliseconds(store.getConfig().reconciliationIntervalSeconds),
@@ -194,7 +377,10 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         now: options.now,
         onError: options.onError,
         lifecycleHost,
+        jobSupervisor,
+        jobControl,
         ...(resourceReaper === undefined ? {} : { resourceReaper }),
+        resourceAutoGc,
         onExpiredEphemeralDomain: (domain) => {
             if (domain.yuiHome !== home)
                 return;
@@ -202,11 +388,17 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         },
         workspacePreparer,
         runtimeEventProcessor: options.runtimeEventProcessor
-            ?? new FileRuntimeEventProcessor(new FileRuntimeEventInbox(home), schedulerStore, {
-                onTaskRuntimeApplied: (input) => {
-                    planner.refreshTaskRuntimeDescriptor(input);
-                }
-            }),
+            ?? (useWorker && asyncStoreClient !== undefined
+                ? new AsyncRuntimeEventProcessor(runtimeEventInbox, createAsyncRuntimeObserver((method, args) => asyncStoreClient.invokeObserver(method, args)), {
+                    onTaskRuntimeApplied: (input) => {
+                        refreshAppliedTaskRuntimeDescriptor(store, planner, input);
+                    }
+                })
+                : new FileRuntimeEventProcessor(runtimeEventInbox, schedulerStore, {
+                    onTaskRuntimeApplied: (input) => {
+                        refreshAppliedTaskRuntimeDescriptor(store, planner, input);
+                    }
+                })),
         domainIdentity,
         ...(options.configuration !== undefined
             ? { configuration: options.configuration }
@@ -220,8 +412,29 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     });
     runningController = running;
     runningRuntime = running.runtime;
+    // Issue 03: read-only startup reconciliation. Surfaces durable/physical
+    // Session mismatches (including generations whose durable map was cleared)
+    // without changing stop or archive behavior. Cleanup stays an explicit
+    // Operator action in exact-owner-cleanup mode.
+    try {
+        const startupReport = sessionOwners.report();
+        if (startupReport.summary.livePhysicalRoots > 0) {
+            (options.onError ?? (() => undefined))(new Error(`Session reconciliation: ${startupReport.summary.livePhysicalRoots} `
+                + `live physical root(s) across ${startupReport.summary.owners} owner record(s); `
+                + "run `yui session reconcile --report` for details."));
+        }
+    }
+    catch (error) {
+        (options.onError ?? (() => undefined))(error);
+    }
     return {
         ...running,
+        close: async () => {
+            await running.close();
+            // Release the worker's database connections when the worker backend is active.
+            await asyncStoreClient?.close();
+            await inventoryClient?.close();
+        },
         store,
         schedulerStore,
         planner,
@@ -325,7 +538,7 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                 throw applicationError("INVALID_PARAMS", `Configured Agent does not match Role: ${effective.agentId}.`);
             }
             validateLifecycleEnvironment(request.environment, agent);
-            const mode = roleAgentSessionResumeMode(sessions, effective.agentId, effective);
+            const mode = roleAgentSessionResumeMode(sessions, effective.agentId, effective, managedWorkspace);
             const session = sessions?.sessions[effective.agentId];
             const owner = request.scope === "task"
                 ? { scope: "task", taskId: request.taskId, roleName: request.roleName }
@@ -447,7 +660,10 @@ function assertRuntimeLaunchRequestCurrent(store, request) {
             || session.nativeSessionId !== request.nativeSessionId) {
             throw new Error(`Native session changed: ${request.owner.roleName}.`);
         }
-        if (!effectiveLaunchSnapshotsCompatible(session.effective, request.effective)) {
+        const sessionEffectiveCompatible = request.owner.scope === "task"
+            ? effectiveLaunchSnapshotsCompatibleForTaskMain(session.effective, request.effective, request.managedWorkspace)
+            : effectiveLaunchSnapshotsCompatible(session.effective, request.effective);
+        if (!sessionEffectiveCompatible) {
             throw new Error(`Native session effective launch changed: ${request.owner.roleName}.`);
         }
     }