Expand description
Answers scheduling mutation intents with granted or denied decisions.
This is the daemon’s only path for mutating runtime scheduling state through
claims, leases, and run settlement. Read-only queries are not coordination
and remain on Store. Rust’s sibling-module visibility cannot enforce the
boundary, so daemon code must not call the wrapped store methods directly.
§Lease invariants
A lease is time-bounded ownership of a ticket by the daemon, taken
atomically at claim time. In the leases table ticket_id is the PRIMARY
KEY and run_id is UNIQUE, so the database engine enforces at most one
lease per ticket and per run. That is the durable guard against
double-spawn, backstopping the conditional UPDATE ... WHERE state='ready'
inside claim_ticket.
Leases are held only by the daemon. owner_id records which daemon process
took the claim. Workers never hold, renew, or observe leases: a worker’s
only credential is a per-run capability token granting the worker verbs on
its own run. The daemon-to-worker relationship is delegation of access to a
run, never sub-leasing of ownership of a ticket.
expires_at_ms gates renewal only. An expired lease cannot be renewed, so a
revived process cannot resurrect a claim recovery has decided is lost.
Liveness of a run is determined by process identity — pid, pid start time,
and process group id — never by lease expiry.
A lease is released by deleting its row: on settlement (finish_run) or on
claim rollback (abort_claim). An expired-but-present lease row is evidence
of an owner that died mid-work.
The daemon renews the lease of every run it actively supervises, from the
periodic reconcile pass, so expires_at_ms is truthful for as long as a run
is alive. Renewal is a statement of fact, not an authority: a renewal denial
is logged and changes no scheduling decision, and recovery still keys off
process identity rather than the clock. Because renewal is strict, a daemon
that was down past the TTL re-arms an adopted run’s lapsed lease through
Coordination::readopt instead.
Structs§
- Coordination
- RunExit
- Facts about an agent’s exit, recorded at the checkpoint that hands the run to aftercare.
- RunStart
- Facts about a launched agent process, recorded when the run turns
running.
Enums§
- Claim
- Claim
Denial - Exit
- Ownership of a run’s exit processing. Whoever is granted the checkpoint owns aftercare; the supervisor and crash recovery race for it deliberately.
- Exit
Denial - Renewal
- Renewal
Denial - Start
- Start
Denial