lorenz 0.1.0

package/packages/dispatch-coordinator/dist/coordinator.js

@@ -0,0 +1,529 @@
+// The DispatchCoordinator: STEP 1 is a 1:1 passthrough over the proven
+// @lorenz/worker-pool WorkerPool.
+//
+// With the default settings (slotsPerMachine=1) and the NULL McpEndpointManager
+// (perRunEndpoint=false, mcpEndpoint=null), every operation here is byte-identical
+// at the runtime boundary to calling the underlying WorkerPool directly:
+//   - acquireRunSlot calls pool.acquire and, on `leased`, mints a RunSlot whose
+//     release/fail/heartbeat delegate straight to the wrapped WorkerLease (so the
+//     pool's exactly-once leaseId/generation/DESTROYED guards and poison/healthy
+//     classification are unchanged); a `no_capacity` result is returned with the
+//     SAME typed reason; a THROWN pool fault PROPAGATES verbatim so the runtime's
+//     catch emits worker_pool_acquire_error.
+//   - the coordinator itself is the orchestrator's capacity authority: governs()/
+//     canAcquire() re-read live pool state each call, and the coordinator is a
+//     reload-surviving singleton, so an orchestrator that captured it in its ctor
+//     is never stranded by a reconcile.
+//   - reconcile/drain/hydrate delegate verbatim; snapshot is the pool snapshot
+//     extended with a `slots` view derived from the live registry.
+//
+// The coordinator owns the authoritative per-slot registry (minted-but-unsettled
+// slots) used for collision detection, recycle-driven fail-fast, the tunnel
+// ceiling, and the snapshot.slots view.
+/**
+ * Thrown by {@link DispatchCoordinator.acquireRunSlot} when the per-run MCP
+ * endpoint fails to OPEN after the WorkerLease was already bound. The just-bound
+ * lease has been settled HEALTHY before this is thrown (the worker itself is fine -
+ * only the endpoint failed - so it must NOT be poisoned), and NO half-open ssh
+ * child / RunSlot is left behind. The runtime catches this exactly like any other
+ * thrown acquire fault and emits `worker_pool_acquire_error` (never a partial run).
+ * `cause` carries the underlying manager error; `workerHost`/`runKey` identify the
+ * run the endpoint was being opened for.
+ */
+export class EndpointOpenError extends Error {
+    cause;
+    workerHost;
+    runKey;
+    constructor(args) {
+        super(`mcp_endpoint_open_failed: ${args.workerHost}#${args.runKey}: ${errorMessage(args.cause)}`);
+        this.name = "EndpointOpenError";
+        this.cause = args.cause;
+        this.workerHost = args.workerHost;
+        this.runKey = args.runKey;
+    }
+}
+/** Extracts a stable message from an unknown thrown value for the structured error. */
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * The ISSUE-SCOPED per-run key (`${issueId}#${slotIndex}`) feeding the per-run
+ * endpoint/tunnel key (`${workerHost}#${runKey}`). It MUST include the issueId so
+ * DIFFERENT issues co-residing on ONE workerHost (slotsPerMachine>1; every
+ * non-ensemble issue uses slotIndex 0) never collide on the tunnel/port. The
+ * ceiling/collision guards remain keyed on (issueId, slotIndex), and the workspace
+ * stays issue-isolated by its own identifier path, so only this endpoint key
+ * changes. Both `acquireRunSlot` (open) and `createRunSlot` (slot.runKey) derive the
+ * key here so the bound slot's `runKey` is byte-identical to the key the endpoint
+ * was opened with.
+ */
+function runKeyFor(issueId, slotIndex) {
+    return `${issueId}#${slotIndex}`;
+}
+/**
+ * A `workerHost` is LOCAL (no per-run tunnel is minted; acp keeps its own
+ * endpoint) when it is empty. A pool lease's `workerHost` is otherwise always a
+ * real ssh address. Mirrors {@link createPerRunEndpointManager}'s host routing so
+ * the tunnel-exhaustion ceiling counts ONLY real remote tunnels: a local slot
+ * consumes no `ssh -N` child, so it must never be gated by (nor count against) the
+ * ceiling.
+ */
+function isLocalWorkerHost(workerHost) {
+    return workerHost.length === 0;
+}
+/**
+ * Thrown by {@link DispatchCoordinator.acquireRunSlot} when a freshly-bound lease
+ * would place a SECOND live RunSlot with the SAME `(issueId, slotIndex)` on the
+ * SAME machine. `(issueId, slotIndex)` is the key that feeds both the per-run
+ * `runKey` (`${slotIndex}`) AND the workspace slot suffix, so two co-resident slots
+ * sharing it would collide on BOTH the per-run endpoint/tunnel key and the
+ * workspace dir. Rather than silently disambiguate (openQuestion #1), the
+ * coordinator ASSERTS-AND-REJECTS: the just-bound lease is settled HEALTHY (the worker
+ * itself is fine) and NO slot is registered, so this invariant violation surfaces
+ * loudly. The runtime maps the throw to `worker_pool_acquire_error` exactly like any
+ * other acquire fault, leaving the first slot untouched.
+ */
+export class RunSlotCollisionError extends Error {
+    issueId;
+    slotIndex;
+    machineLeaseId;
+    constructor(args) {
+        super(`run_slot_collision: (issueId=${args.issueId}, slotIndex=${args.slotIndex}) already live on machine ${args.machineLeaseId}`);
+        this.name = "RunSlotCollisionError";
+        this.issueId = args.issueId;
+        this.slotIndex = args.slotIndex;
+        this.machineLeaseId = args.machineLeaseId;
+    }
+}
+/**
+ * Mints a {@link RunSlot} wrapping a settled-once {@link WorkerLease}. STEP 1 always
+ * passes `mcpEndpoint = null` (the null manager mints nothing) so release/fail are
+ * byte-identical to the underlying lease settle. The slot holds a single
+ * `settled` flag so release/fail are exactly-once on THIS handle (a second call is
+ * a no-op and never reaches the lease); the lease itself stays the authoritative
+ * leaseId/generation/DESTROYED guard for the recycle path.
+ */
+function createRunSlot(args) {
+    const { lease, issueId, slotIndex, endpoint, mcpEndpointManager, onSettled, logEvent } = args;
+    // runKey is the ISSUE-SCOPED per-run key (`${issueId}#${slotIndex}`). It feeds the
+    // per-run endpoint/tunnel key (`${workerHost}#${runKey}`), so it MUST include the
+    // issueId: with slotsPerMachine>1, DIFFERENT issues can co-reside on ONE workerHost
+    // and a bare `${slotIndex}` (0 for every non-ensemble issue) would collide across
+    // issues -> shared tunnel/port, broken per-run isolation. The workspace dir stays
+    // issue-isolated by its own identifier path; only this endpoint key needs the issue.
+    const runKey = runKeyFor(issueId, slotIndex);
+    // slotId is the registry key: unique per (issue, slot, lease generation).
+    const slotId = `${issueId}#${slotIndex}#${lease.leaseId}`;
+    let settled = false;
+    // The single settle path: close THIS slot's endpoint exactly once (a no-op for
+    // the null endpoint), delegate to the wrapped lease, then deregister. A second
+    // call short-circuits before touching the lease, so settle is exactly-once on
+    // this handle while the lease's own guard remains authoritative for the pool.
+    //
+    // Endpoint cleanup is BEST-EFFORT: we attempt manager.release FIRST (preserving
+    // the close-endpoint-BEFORE-settle ordering so no hung tunnel points at a worker
+    // about to be returned/recycled), but if it REJECTS - a local mcp server stop /
+    // tunnel close that throws - we must NEVER leave the worker lease unsettled or the
+    // slot registered. The lease settle + deregister (which also releases any tunnel
+    // reservation via onSettled) therefore run in a `finally`, so capacity + tunnel
+    // accounting is released regardless. The endpoint error is logged, never thrown
+    // to the caller (the runtime would otherwise see a rejected run finalizer instead
+    // of a clean settle). The settled-once guard is preserved.
+    const settle = async (run) => {
+        if (settled)
+            return;
+        settled = true;
+        try {
+            await mcpEndpointManager.release(endpoint);
+        }
+        catch (releaseError) {
+            logEvent({
+                event: "worker_pool_endpoint_release_failed",
+                slotId,
+                issueId,
+                slotIndex,
+                workerHost: lease.workerHost,
+                error: errorMessage(releaseError),
+            });
+        }
+        finally {
+            await run();
+            onSettled(slotId);
+        }
+    };
+    return {
+        slotId,
+        machineLeaseId: lease.workerId,
+        issueId,
+        slotIndex,
+        leaseId: lease.leaseId,
+        workerHost: lease.workerHost,
+        runKey,
+        mcpEndpoint: endpoint,
+        acquiredAtMs: lease.acquiredAtMs,
+        heartbeat() {
+            lease.heartbeat();
+        },
+        async release(outcome) {
+            await settle(async () => lease.release(outcome));
+        },
+        async fail(reason) {
+            await settle(async () => lease.fail(reason));
+        },
+    };
+}
+/**
+ * Constructs the STEP 1 passthrough {@link DispatchCoordinator}. `settings` is
+ * retained for the later reconcile/co-residence paths; in STEP 1 it is not read
+ * past construction (the pool owns the live settings). The injected
+ * `mcpEndpointManager` is the null passthrough in STEP 1, so every minted slot
+ * carries `mcpEndpoint = null` and the coordinator advertises
+ * `perRunEndpoint = false`.
+ */
+export function createDispatchCoordinator(deps) {
+    const { pool, mcpEndpointManager } = deps;
+    // Best-effort cleanup-fault sink: when the runtime injects no logEvent (the
+    // legacy passthrough callers), endpoint-close faults in the settle path are
+    // silently swallowed (the lease still settles regardless).
+    const logEvent = deps.logEvent ?? (() => { });
+    // The authoritative live-slot registry keyed by slotId. A slot is added on a
+    // successful lease-bind and removed on settle; the snapshot.slots view is derived
+    // from it, and the recycle callback below scans it by machine.
+    const slots = new Map();
+    // In-flight `slot.fail` promises started by the recycle callback below, which must
+    // stay synchronous (it runs inside the pool's per-worker mutex) and so cannot await
+    // them. `drain` awaits this set AFTER the pool drain so per-run endpoint /
+    // local-MCP-server / reverse-tunnel cleanup for every recycled slot finishes
+    // BEFORE drain returns and the daemon stops the local server - otherwise shutdown
+    // races live slot teardown and strands those resources.
+    const pendingRecycleFails = new Set();
+    // SYNCHRONOUS tunnel reservations held while an acquire is between the ceiling
+    // check and a successful registration. The ceiling check passes and increments
+    // this in the SAME JS tick (before any `await mcpEndpointManager.open`), so two
+    // concurrent acquires can never both slip past a maxConcurrentTunnels ceiling:
+    // the second sees the first's pending reservation. Each reservation is released
+    // exactly once - on open FAILURE, on a post-open guard rejection, or on slot
+    // settlement (via the slot's onSettled) - mirroring the worker pool's single-flight
+    // reservedProvisions counter. A negative count is impossible because every
+    // increment is paired with exactly one release.
+    let reservedTunnels = 0;
+    // The live settings the coordinator reads for the tunnel-exhaustion ceiling.
+    // `reconcile` updates this in place so a config reload that raises/lowers the
+    // ceiling takes effect WITHOUT reconstructing the singleton (the live-slot
+    // registry is preserved across the reload). The pool owns its own live settings;
+    // this reference is only read for the coordinator-owned tunnel budget.
+    let currentSettings = deps.settings;
+    // Counts LIVE per-run tunnels: registered slots whose `mcpEndpoint` is non-null
+    // (a local / null-endpoint slot consumes no tunnel budget) PLUS the pending
+    // reservations held by in-flight acquires that have passed the ceiling check but
+    // not yet registered. Including the reservations is what closes the
+    // concurrent-acquire race: registration happens only AFTER `await
+    // mcpEndpointManager.open`, so without the reservation a second acquire would
+    // count zero live tunnels while the first is still mid-open and over-open the
+    // ceiling. The registered refcount stays exact via the open-on-bind /
+    // close-on-settle lifecycle; the reservation covers the open-in-flight gap.
+    const liveTunnelCount = () => {
+        let count = reservedTunnels;
+        for (const slot of slots.values()) {
+            if (slot.mcpEndpoint !== null)
+                count += 1;
+        }
+        return count;
+    };
+    // Recycle-vs-endpoint ordering invariant: the pool fires this INSIDE the per-worker
+    // mutex immediately BEFORE it destroys a machine. We fail every still-open
+    // RunSlot bound to that worker CLEANLY - `slot.fail` closes the endpoint (killing
+    // the local ssh -N child so no hung tunnel is left pointing at the now-dead
+    // host), THEN settles the lease, THEN deregisters - so a poisoned/recycled
+    // machine never strands an endpoint and sibling runs see a clean per-run failure.
+    // The callback must stay synchronous (it runs inside the mutex), so the matching
+    // slots are snapshotted now and their settle is fire-and-forget; `slot.fail` is
+    // idempotent so a normal release racing in afterwards is a no-op (exactly-once
+    // across BOTH the recycle and the normal path). A settle error is swallowed so a
+    // misbehaving endpoint close can never block the pool's teardown.
+    //
+    // Registration is DEFENSIVE: the runtime keeps accepting a bare `WorkerPool`
+    // (wrapped in a null-endpoint passthrough coordinator) for one release to avoid
+    // mass test churn, and an older/partial pool injected that way may predate
+    // `onMachineRecycling`. The hook is best-effort - a pool without it simply has no
+    // recycle-driven fail-fast (the lease settle path still tears the worker down) - so
+    // we register only when the pool provides it, never throwing on the passthrough.
+    if (typeof pool.onMachineRecycling === "function") {
+        pool.onMachineRecycling((workerId) => {
+            const affected = [];
+            for (const slot of slots.values()) {
+                if (slot.machineLeaseId === workerId)
+                    affected.push(slot);
+            }
+            for (const slot of affected) {
+                // Track the fire-and-forget fail so `drain` can await it (the callback itself
+                // must not block the pool's in-mutex teardown). Self-removes on settle.
+                const failed = slot.fail("machine_recycled").catch(() => {
+                    // The slot's lease/endpoint guard is authoritative; swallow so a recycle
+                    // teardown is never blocked by a slot's settle failure.
+                });
+                pendingRecycleFails.add(failed);
+                void failed.finally(() => pendingRecycleFails.delete(failed));
+            }
+        });
+    }
+    const capabilities = { perRunEndpoint: mcpEndpointManager.perRunEndpoint };
+    return {
+        capabilities,
+        async acquireRunSlot(req) {
+            // A throw here (ledger / filesystem / provider fault) PROPAGATES verbatim:
+            // the runtime's catch maps it to worker_pool_acquire_error. We do NOT wrap it.
+            // `AcquireRunSlotRequest` is structurally the pool's `AcquireRequest`, so the
+            // request is forwarded 1:1 (no field copy that would re-introduce undefined
+            // under exactOptionalPropertyTypes).
+            const acquired = await pool.acquire(req);
+            if (acquired.status !== "leased") {
+                // Preserve the SAME typed no_capacity reason the pool returned; the
+                // runtime maps every reason onto the single worker_host_capacity event.
+                return { status: "no_capacity", reason: acquired.reason };
+            }
+            // (issueId, slotIndex) uniqueness invariant (STEP 3 / T3b): `(issueId,
+            // slotIndex)` feeds BOTH the per-run `runKey` (`${slotIndex}`) and the
+            // workspace slot suffix, so the coordinator must NEVER place two live slots
+            // sharing it on ONE machine - they would collide on the endpoint/tunnel key
+            // AND the workspace dir. We check the registry RIGHT AFTER bind and BEFORE
+            // opening the endpoint (so a colliding endpoint is never minted): if a live
+            // slot already holds this (issueId, slotIndex) on this worker, settle the
+            // just-bound lease HEALTHY (the worker is fine) and assert-and-reject rather than
+            // silently disambiguate (openQuestion #1). The runtime maps the throw to
+            // worker_pool_acquire_error, leaving the first slot untouched.
+            const machineLeaseId = acquired.lease.workerId;
+            for (const existing of slots.values()) {
+                if (existing.issueId === req.issueId &&
+                    existing.slotIndex === req.slotIndex &&
+                    existing.machineLeaseId === machineLeaseId) {
+                    try {
+                        await acquired.lease.release("healthy");
+                    }
+                    catch {
+                        // Swallow: the collision is the surfaced fault; the worker is healthy.
+                    }
+                    throw new RunSlotCollisionError({
+                        issueId: req.issueId,
+                        slotIndex: req.slotIndex,
+                        machineLeaseId,
+                    });
+                }
+            }
+            // STEP 3 (T3c #1): tunnel-exhaustion ceiling. When `maxConcurrentTunnels` is
+            // set, opening another per-run endpoint that would exceed it surfaces as a
+            // TYPED `no_capacity` ('tunnel_exhausted'), NEVER an unhandled throw inside
+            // acquireRunSlot. We check this AFTER lease-bind + the collision guard but
+            // BEFORE the open so a budget-exhausted slot never mints (then has to tear
+            // down) a tunnel. The ceiling counts ONLY live remote tunnels and applies
+            // ONLY when this open would actually mint one - a local (empty) host
+            // (and the null passthrough, which mints nothing) consumes no `ssh -N` child,
+            // so it is neither gated by nor counted against the budget. The just-bound
+            // WorkerLease is settled HEALTHY (the worker is fine; only the tunnel budget is
+            // exhausted) and NO slot is registered, so a sibling run recovers via the
+            // single `worker_host_capacity` dispatch signal instead of seeing a fault.
+            //
+            // The ceiling check + the reservation are a SINGLE synchronous step (no
+            // `await` between `liveTunnelCount()` and `reservedTunnels += 1`): two
+            // concurrent acquires therefore cannot both pass it, because the second's
+            // count includes the first's pending reservation. The reservation is held
+            // across the (awaited) open so the gap between check and registration cannot
+            // be over-subscribed; it is released on open FAILURE and otherwise handed off
+            // to the slot's settlement (so the budget is freed exactly once when the run
+            // finishes). Mirrors the worker pool's reservedProvisions single-flight.
+            const runKey = runKeyFor(req.issueId, req.slotIndex);
+            const tunnelCeiling = currentSettings.maxConcurrentTunnels;
+            // Whether THIS run actually consumes a per-run MCP endpoint. The Codex/appserver
+            // executor runs its dynamic tools IN-PROCESS and ignores the endpoint, so a
+            // run that needs none must SKIP the open AND the tunnel reservation/ceiling
+            // entirely (it would otherwise be SKIPPED by an open failure / port-forward
+            // restriction / maxConcurrentTunnels for an endpoint it never uses). Only
+            // ACP/Claude reads `/mcp` over the reverse tunnel. Defaults to `true`
+            // (the existing ACP behaviour) when a legacy caller omits the field.
+            const needsMcpEndpoint = req.needsMcpEndpoint ?? true;
+            const wouldOpenTunnel = needsMcpEndpoint &&
+                mcpEndpointManager.perRunEndpoint &&
+                !isLocalWorkerHost(acquired.lease.workerHost);
+            let tunnelReserved = false;
+            if (wouldOpenTunnel && tunnelCeiling !== undefined) {
+                if (liveTunnelCount() >= tunnelCeiling) {
+                    // Settle the just-bound lease HEALTHY (best-effort; a settle hiccup must
+                    // not mask the capacity signal) and return the typed no_capacity reason.
+                    try {
+                        await acquired.lease.release("healthy");
+                    }
+                    catch {
+                        // Swallow: the worker is healthy; the capacity signal is what we surface.
+                    }
+                    return { status: "no_capacity", reason: "tunnel_exhausted" };
+                }
+                // Take the reservation in the SAME JS tick the ceiling check passed.
+                reservedTunnels += 1;
+                tunnelReserved = true;
+            }
+            // Releases this acquire's pending tunnel reservation exactly once (a no-op if
+            // none was taken or it was already released/handed off).
+            const releaseReservation = () => {
+                if (tunnelReserved) {
+                    tunnelReserved = false;
+                    reservedTunnels -= 1;
+                }
+            };
+            // STEP 2: open the WHOLE per-run endpoint AFTER the lease-bind (the null
+            // manager still mints nothing, keeping the single-slot/local path
+            // byte-identical). The runKey is the issue-scoped `${issueId}#${slotIndex}`.
+            // SKIP the open entirely for a run that consumes no endpoint (Codex/appserver):
+            // the slot binds with a null endpoint (no reservation was taken, since
+            // wouldOpenTunnel is false when needsMcpEndpoint is false) so it can never be
+            // SKIPPED by an open failure / port-forward restriction for an endpoint it
+            // would never use. Falls through to the SHARED register-the-slot path below.
+            let endpoint = null;
+            if (needsMcpEndpoint) {
+                try {
+                    endpoint = await mcpEndpointManager.open({
+                        // Thread the FULL workflow Settings the REQUEST carries (NOT the
+                        // coordinator's WorkerPoolSettings). The concrete per-run manager reads
+                        // `settings.server.port` via acquireAgentMcpEndpointForRun to build the
+                        // remote endpoint; a WorkerPoolSettings has no server.port, so forwarding it
+                        // would fail every acquire and never dispatch. The null manager ignores it.
+                        // The production runtime ALWAYS supplies the full Settings here; the
+                        // `?? currentSettings` bridge only covers a legacy passthrough caller that
+                        // pre-dates the request field (which already injects a full Settings as its
+                        // coordinator `settings`), so the no-server.port WorkerPoolSettings never
+                        // reaches the concrete manager.
+                        settings: req.settings ?? currentSettings,
+                        workerHost: acquired.lease.workerHost,
+                        runKey,
+                    });
+                }
+                catch (openError) {
+                    // The endpoint failed to OPEN after the lease was already bound. The worker
+                    // itself is fine (only the endpoint failed), so settle the just-bound lease
+                    // HEALTHY - never poison it - and leave NO half-open child / RunSlot. The
+                    // pending tunnel reservation is released here (the open never minted a
+                    // tunnel) so a failed open never strands budget. A failure to settle here
+                    // must not mask the original open error, so the settle is best-effort.
+                    // Rethrow a structured acquire error the runtime maps to
+                    // worker_pool_acquire_error.
+                    releaseReservation();
+                    try {
+                        await acquired.lease.release("healthy");
+                    }
+                    catch {
+                        // Swallow: the original endpoint-open failure is the surfaced cause.
+                    }
+                    throw new EndpointOpenError({
+                        cause: openError,
+                        workerHost: acquired.lease.workerHost,
+                        runKey,
+                    });
+                }
+            }
+            const slot = createRunSlot({
+                lease: acquired.lease,
+                issueId: req.issueId,
+                slotIndex: req.slotIndex,
+                endpoint,
+                mcpEndpointManager,
+                logEvent,
+                onSettled: (slotId) => {
+                    slots.delete(slotId);
+                },
+            });
+            slots.set(slot.slotId, slot);
+            // Hand the budget from the pending reservation to the now-registered slot in
+            // the SAME synchronous tick as the `slots.set` (no `await` between them, so a
+            // concurrent acquire can never observe a moment where neither the reservation
+            // nor the registered slot is counted). A registered slot whose `mcpEndpoint`
+            // is non-null is itself counted by `liveTunnelCount`, so keeping the
+            // reservation too would DOUBLE-count this tunnel; release it here.
+            releaseReservation();
+            return { status: "bound", slot };
+        },
+        // The coordinator IS the orchestrator's capacity authority: both methods
+        // re-read live pool state on every call (never a cached snapshot), so a
+        // reconcile that disables the pool is observed immediately.
+        governs() {
+            return pool.isEnabled();
+        },
+        canAcquire() {
+            return pool.canAcquire();
+        },
+        onCapacityAvailable(cb) {
+            // Forward to the pool's additive hook when present. Registration is
+            // DEFENSIVE like onMachineRecycling above: an older/partial pool injected
+            // via the bare-workerPool passthrough may predate the hook, in which case the
+            // runtime simply keeps its interval-only polling.
+            pool.onCapacityAvailable?.(cb);
+        },
+        async reconcile(next) {
+            // Load any out-of-tree driver module FIRST (only when the next settings are
+            // enabled, mirroring the pool's disable path which skips swapDriver
+            // entirely): the injected loader dynamic-imports + registers the module so
+            // the pool's registry resolution below stays synchronous. A load failure
+            // rejects here, BEFORE the pool is touched - the same transactional
+            // last-good behavior as a pool rollback. A module registered for a
+            // reconcile that later throws is harmless: the registry is a catalog, and
+            // an unused entry is inert.
+            if (next.enabled)
+                await deps.driverLoader?.(next.driver);
+            // Reconcile the pool NEXT: pool.reconcile -> swapDriver -> registry resolve
+            // can THROW (e.g. worker_pool_driver_unavailable) when a reload changes the
+            // driver to an unavailable kind, and the pool rolls itself back to last-good
+            // on that throw. Only AFTER it succeeds do we commit the coordinator-owned
+            // settings (the tunnel-exhaustion ceiling) so a rejected reload cannot strand
+            // currentSettings on a config the pool refused - keeping the reload
+            // transactional end-to-end. The live-slot registry is preserved across the
+            // reload (so per-issue accounting and the tunnel refcount cannot desync), and
+            // the singleton is NOT reconstructed.
+            pool.reconcile(next);
+            currentSettings = next;
+        },
+        async drain(opts) {
+            await pool.drain(opts);
+            // The pool's force-destroy fired the recycle callback for every worker, starting
+            // each bound slot's fail() (fire-and-forget there). Await those so per-run
+            // endpoint / local-server / tunnel cleanup is fully settled before drain
+            // returns and the daemon stops the local MCP server and exits.
+            if (pendingRecycleFails.size > 0) {
+                await Promise.allSettled([...pendingRecycleFails]);
+            }
+        },
+        async hydrate() {
+            await pool.hydrate();
+        },
+        snapshot() {
+            const base = pool.snapshot();
+            const slotEntries = [];
+            for (const slot of slots.values()) {
+                slotEntries.push({
+                    slotId: slot.slotId,
+                    machineLeaseId: slot.machineLeaseId,
+                    issueId: slot.issueId,
+                    slotIndex: slot.slotIndex,
+                    workerHost: slot.workerHost,
+                    remotePort: remotePortFromEndpoint(slot.mcpEndpoint),
+                });
+            }
+            return { ...base, slots: slotEntries };
+        },
+    };
+}
+/**
+ * The remote port a slot's per-run MCP endpoint is bound to, derived from the
+ * lease URL (`http://127.0.0.1:<remotePort>/...` on the worker side). `null`
+ * when no endpoint is bound (null endpoint manager, local worker host, or a
+ * URL without an explicit port).
+ */
+function remotePortFromEndpoint(endpoint) {
+    if (!endpoint)
+        return null;
+    try {
+        const port = Number(new URL(endpoint.url).port);
+        return Number.isInteger(port) && port > 0 ? port : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=coordinator.js.map

package/packages/dispatch-coordinator/dist/coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.js","sourceRoot":"","sources":["../src/coordinator.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kCAAkC;AAClC,EAAE;AACF,gFAAgF;AAChF,mFAAmF;AACnF,yEAAyE;AACzE,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,6CAA6C;AAC7C,kFAAkF;AAClF,+EAA+E;AAC/E,kFAAkF;AAClF,wCAAwC;AACxC,+EAA+E;AAC/E,mEAAmE;AACnE,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,wCAAwC;AAkCxC;;;;;;;;;GASG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACxB,KAAK,CAAU;IACxB,UAAU,CAAS;IACnB,MAAM,CAAS;IAExB,YAAY,IAA4D;QACtE,KAAK,CACH,6BAA6B,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,CAAC;CACF;AAED,uFAAuF;AACvF,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,SAAiB;IACnD,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,cAAc,CAAS;IAEhC,YAAY,IAAoE;QAC9E,KAAK,CACH,gCAAgC,IAAI,CAAC,OAAO,eAAe,IAAI,CAAC,SAAS,6BAA6B,IAAI,CAAC,cAAc,EAAE,CAC5H,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;CACF;AAwFD;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAQtB;IACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC9F,mFAAmF;IACnF,kFAAkF;IAClF,oFAAoF;IACpF,kFAAkF;IAClF,kFAAkF;IAClF,qFAAqF;IACrF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,MAAM,MAAM,GAAG,GAAG,OAAO,IAAI,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,EAAE;IACF,gFAAgF;IAChF,iFAAiF;IACjF,gFAAgF;IAChF,mFAAmF;IACnF,iFAAiF;IACjF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,2DAA2D;IAC3D,MAAM,MAAM,GAAG,KAAK,EAAE,GAAwB,EAAiB,EAAE;QAC/D,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,QAAQ,CAAC;gBACP,KAAK,EAAE,qCAAqC;gBAC5C,MAAM;gBACN,OAAO;gBACP,SAAS;gBACT,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,YAAY,CAAC,YAAY,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,EAAE,CAAC;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,cAAc,EAAE,KAAK,CAAC,QAAQ;QAC9B,OAAO;QACP,SAAS;QACT,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM;QACN,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS;YACP,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAsB;YAClC,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAmC;IAEnC,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAC1C,4EAA4E;IAC5E,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAS,EAAE,GAAE,CAAC,CAAC,CAAC;IACnD,6EAA6E;IAC7E,kFAAkF;IAClF,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEzC,mFAAmF;IACnF,oFAAoF;IACpF,2EAA2E;IAC3E,6EAA6E;IAC7E,kFAAkF;IAClF,wDAAwD;IACxD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAiB,CAAC;IAErD,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,oFAAoF;IACpF,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,iFAAiF;IACjF,uEAAuE;IACvE,IAAI,eAAe,GAAuB,IAAI,CAAC,QAAQ,CAAC;IAExD,gFAAgF;IAChF,4EAA4E;IAC5E,iFAAiF;IACjF,oEAAoE;IACpE,kEAAkE;IAClE,8EAA8E;IAC9E,8EAA8E;IAC9E,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,eAAe,GAAG,GAAW,EAAE;QACnC,IAAI,KAAK,GAAG,eAAe,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,oFAAoF;IACpF,2EAA2E;IAC3E,kFAAkF;IAClF,4EAA4E;IAC5E,2EAA2E;IAC3E,kFAAkF;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,+EAA+E;IAC/E,iFAAiF;IACjF,kEAAkE;IAClE,EAAE;IACF,6EAA6E;IAC7E,gFAAgF;IAChF,2EAA2E;IAC3E,kFAAkF;IAClF,oFAAoF;IACpF,iFAAiF;IACjF,IAAI,OAAO,IAAI,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;QAClD,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAgB,EAAE,EAAE;YAC3C,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,cAAc,KAAK,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,8EAA8E;gBAC9E,wEAAwE;gBACxE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACtD,yEAAyE;oBACzE,wDAAwD;gBAC1D,CAAC,CAAC,CAAC;gBACH,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChC,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,EAAE,cAAc,EAAE,kBAAkB,CAAC,cAAc,EAAW,CAAC;IAEpF,OAAO;QACL,YAAY;QAEZ,KAAK,CAAC,cAAc,CAAC,GAA0B;YAC7C,2EAA2E;YAC3E,+EAA+E;YAC/E,8EAA8E;YAC9E,4EAA4E;YAC5E,qCAAqC;YACrC,MAAM,QAAQ,GAAkB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAExD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjC,oEAAoE;gBACpE,wEAAwE;gBACxE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC;YAED,uEAAuE;YACvE,uEAAuE;YACvE,4EAA4E;YAC5E,4EAA4E;YAC5E,2EAA2E;YAC3E,4EAA4E;YAC5E,0EAA0E;YAC1E,kFAAkF;YAClF,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC/C,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtC,IACE,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;oBAChC,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;oBACpC,QAAQ,CAAC,cAAc,KAAK,cAAc,EAC1C,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACP,uEAAuE;oBACzE,CAAC;oBACD,MAAM,IAAI,qBAAqB,CAAC;wBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,6EAA6E;YAC7E,2EAA2E;YAC3E,4EAA4E;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,0EAA0E;YAC1E,qEAAqE;YACrE,8EAA8E;YAC9E,2EAA2E;YAC3E,gFAAgF;YAChF,0EAA0E;YAC1E,2EAA2E;YAC3E,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,6EAA6E;YAC7E,8EAA8E;YAC9E,6EAA6E;YAC7E,yEAAyE;YACzE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,aAAa,GAAG,eAAe,CAAC,oBAAoB,CAAC;YAC3D,iFAAiF;YACjF,4EAA4E;YAC5E,4EAA4E;YAC5E,4EAA4E;YAC5E,0EAA0E;YAC1E,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC;YACtD,MAAM,eAAe,GACnB,gBAAgB;gBAChB,kBAAkB,CAAC,cAAc;gBACjC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,IAAI,eAAe,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,eAAe,EAAE,IAAI,aAAa,EAAE,CAAC;oBACvC,yEAAyE;oBACzE,yEAAyE;oBACzE,IAAI,CAAC;wBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACP,0EAA0E;oBAC5E,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBAC/D,CAAC;gBACD,qEAAqE;gBACrE,eAAe,IAAI,CAAC,CAAC;gBACrB,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,8EAA8E;YAC9E,yDAAyD;YACzD,MAAM,kBAAkB,GAAG,GAAS,EAAE;gBACpC,IAAI,cAAc,EAAE,CAAC;oBACnB,cAAc,GAAG,KAAK,CAAC;oBACvB,eAAe,IAAI,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC;YAEF,yEAAyE;YACzE,kEAAkE;YAClE,6EAA6E;YAC7E,gFAAgF;YAChF,uEAAuE;YACvE,8EAA8E;YAC9E,2EAA2E;YAC3E,6EAA6E;YAC7E,IAAI,QAAQ,GAAoD,IAAI,CAAC;YACrE,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC;wBACvC,iEAAiE;wBACjE,wEAAwE;wBACxE,wEAAwE;wBACxE,6EAA6E;wBAC7E,4EAA4E;wBAC5E,qEAAqE;wBACrE,2EAA2E;wBAC3E,4EAA4E;wBAC5E,0EAA0E;wBAC1E,gCAAgC;wBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAK,eAAuC;wBAClE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;wBACrC,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,SAAS,EAAE,CAAC;oBACnB,4EAA4E;oBAC5E,4EAA4E;oBAC5E,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,uEAAuE;oBACvE,yDAAyD;oBACzD,6BAA6B;oBAC7B,kBAAkB,EAAE,CAAC;oBACrB,IAAI,CAAC;wBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACP,qEAAqE;oBACvE,CAAC;oBACD,MAAM,IAAI,iBAAiB,CAAC;wBAC1B,KAAK,EAAE,SAAS;wBAChB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;wBACrC,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ;gBACR,kBAAkB;gBAClB,QAAQ;gBACR,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;oBACpB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;aACF,CAAC,CAAC;YACH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7B,6EAA6E;YAC7E,8EAA8E;YAC9E,8EAA8E;YAC9E,6EAA6E;YAC7E,qEAAqE;YACrE,mEAAmE;YACnE,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,OAAO;YACL,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,CAAC;QAED,UAAU;YACR,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3B,CAAC;QAED,mBAAmB,CAAC,EAAc;YAChC,oEAAoE;YACpE,0EAA0E;YAC1E,8EAA8E;YAC9E,kDAAkD;YAClD,IAAI,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,IAAwB;YACtC,4EAA4E;YAC5E,oEAAoE;YACpE,2EAA2E;YAC3E,yEAAyE;YACzE,oEAAoE;YACpE,mEAAmE;YACnE,0EAA0E;YAC1E,4BAA4B;YAC5B,IAAI,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzD,4EAA4E;YAC5E,4EAA4E;YAC5E,6EAA6E;YAC7E,2EAA2E;YAC3E,8EAA8E;YAC9E,oEAAoE;YACpE,2EAA2E;YAC3E,8EAA8E;YAC9E,sCAAsC;YACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrB,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,IAAkD;YAC5D,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,iFAAiF;YACjF,2EAA2E;YAC3E,yEAAyE;YACzE,+DAA+D;YAC/D,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,QAAQ;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,WAAW,GAA2B,EAAE,CAAC;YAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,UAAU,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;iBACrD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,QAAsC;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/packages/dispatch-coordinator/dist/gate.d.ts

@@ -0,0 +1,24 @@
+import type { WorkerPoolSettings } from "@lorenz/domain";
+/** The subset of a coordinator's capabilities the gate consumes. */
+export interface SlotsPerMachineGateCapabilities {
+    readonly perRunEndpoint: boolean;
+}
+/**
+ * Returns an operator-facing error message when `workerPool` would be unsafe to run,
+ * or `null` when it passes. Co-residence packs multiple run slots onto one machine,
+ * so `slotsPerMachine > 1` requires BOTH:
+ *
+ *  1. a coordinator that advertises `capabilities.perRunEndpoint === true` (each
+ *     RunSlot owns its own MCP endpoint - token + local-server + tunnel - so two
+ *     co-resident runs never share or tear out each other's endpoint), and
+ *  2. an explicit `worker.worker_pool.co_residence` operator opt-in, because a single
+ *     poisoned worker fails every co-resident run on recycle: widening that blast
+ *     radius is a deliberate tradeoff, not just a capability.
+ *
+ * `slotsPerMachine === 1` (the default), an absent pool, a DISABLED pool (a dormant
+ * `max_in_flight > 1` is unused while the pool is off - runs go static/local), or
+ * absent capabilities all return `null` - the gate never triggers, so the
+ * single-tenant path stays byte-identical.
+ */
+export declare function checkSlotsPerMachineGate(workerPool: WorkerPoolSettings | undefined, capabilities: SlotsPerMachineGateCapabilities | undefined): string | null;
+//# sourceMappingURL=gate.d.ts.map

package/packages/dispatch-coordinator/dist/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,oEAAoE;AACpE,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,YAAY,EAAE,+BAA+B,GAAG,SAAS,GACxD,MAAM,GAAG,IAAI,CAkBf"}

package/packages/dispatch-coordinator/dist/gate.js

@@ -0,0 +1,47 @@
+// Pure predicate behind the `worker.worker_pool.slots_per_machine > 1` co-residence
+// safety gate. Extracted here (a leaf, dependency-light module) so the SAME check
+// drives BOTH enforcement points without duplication or drift:
+//
+//   1. the daemon STARTUP gate (`assertSlotsPerMachineGate` in the CLI), which
+//      throws the returned message, and
+//   2. the runtime RELOAD guard (`reloadWorkflowIfConfigured`), which keeps the
+//      last-good settings and emits `workflow_reload_failed` with the message
+//      instead of reconciling the live pool onto unsafe co-resident settings.
+//
+// Keeping it pure (settings + capability flag in, message-or-null out) means the
+// reload path can run the exact gate the daemon ran at startup, closing the hole
+// where a live daemon could reload `max_in_flight > 1` past a gate that only ran
+// once at boot.
+/**
+ * Returns an operator-facing error message when `workerPool` would be unsafe to run,
+ * or `null` when it passes. Co-residence packs multiple run slots onto one machine,
+ * so `slotsPerMachine > 1` requires BOTH:
+ *
+ *  1. a coordinator that advertises `capabilities.perRunEndpoint === true` (each
+ *     RunSlot owns its own MCP endpoint - token + local-server + tunnel - so two
+ *     co-resident runs never share or tear out each other's endpoint), and
+ *  2. an explicit `worker.worker_pool.co_residence` operator opt-in, because a single
+ *     poisoned worker fails every co-resident run on recycle: widening that blast
+ *     radius is a deliberate tradeoff, not just a capability.
+ *
+ * `slotsPerMachine === 1` (the default), an absent pool, a DISABLED pool (a dormant
+ * `max_in_flight > 1` is unused while the pool is off - runs go static/local), or
+ * absent capabilities all return `null` - the gate never triggers, so the
+ * single-tenant path stays byte-identical.
+ */
+export function checkSlotsPerMachineGate(workerPool, capabilities) {
+    if (!workerPool || workerPool.enabled === false || workerPool.slotsPerMachine <= 1)
+        return null;
+    if (capabilities?.perRunEndpoint !== true) {
+        return ("worker.worker_pool.max_in_flight > 1 requires a dispatch coordinator with per-run MCP " +
+            "endpoints (capabilities.perRunEndpoint), which the current build does not provide");
+    }
+    if (workerPool.coResidence !== true) {
+        return ("worker.worker_pool.max_in_flight > 1 requires the explicit worker.worker_pool.co_residence " +
+            "opt-in: co-residence shares one machine across runs, so a poisoned worker fails every " +
+            "co-resident run on recycle. Set worker.worker_pool.co_residence: true to accept this " +
+            "blast radius");
+    }
+    return null;
+}
+//# sourceMappingURL=gate.js.map

package/packages/dispatch-coordinator/dist/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kFAAkF;AAClF,+DAA+D;AAC/D,EAAE;AACF,+EAA+E;AAC/E,wCAAwC;AACxC,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,gBAAgB;AAShB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAA0C,EAC1C,YAAyD;IAEzD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,IAAI,UAAU,CAAC,eAAe,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhG,IAAI,YAAY,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,CACL,wFAAwF;YACxF,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO,CACL,6FAA6F;YAC7F,wFAAwF;YACxF,uFAAuF;YACvF,cAAc,CACf,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/packages/dispatch-coordinator/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { createDispatchCoordinator, EndpointOpenError, RunSlotCollisionError, type DispatchCoordinator, type CreateDispatchCoordinatorDeps, type AcquireRunSlotResult, type NoCapacityReason, type CapacityProbe, type DispatchCoordinatorSnapshot, type RunSlotSnapshotEntry, } from "./coordinator.js";
+export { type RunSlot, type AcquireRunSlotRequest, type McpEndpointManager } from "./types.js";
+export { nullEndpointManager, createNullEndpointManager } from "./nullEndpointManager.js";
+export { createPerRunEndpointManager, type CreatePerRunEndpointManagerDeps, type AcquireAgentMcpEndpointForRun, } from "./mcpEndpointManager.js";
+export { checkSlotsPerMachineGate, type SlotsPerMachineGateCapabilities } from "./gate.js";
+//# sourceMappingURL=index.d.ts.map

package/packages/dispatch-coordinator/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/F,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EACL,2BAA2B,EAC3B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,GACnC,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,wBAAwB,EAAE,KAAK,+BAA+B,EAAE,MAAM,WAAW,CAAC"}