Struct LoadedWorkspace 

pub struct LoadedWorkspace {

    pub key: WorkspaceKey,
    pub graph: ArcSwap<CodeGraph>,
    pub state: AtomicU8,
    pub last_accessed: RwLock<Instant>,
    pub memory_bytes: AtomicUsize,
    pub memory_high_water_bytes: AtomicUsize,
    pub pinned: bool,
    pub last_error: RwLock<Option<DaemonError>>,
    pub last_good_at: RwLock<Option<SystemTime>>,
    pub retry_count: AtomicU32,
    pub rebuild_lane: Mutex<Option<PendingRebuild>>,
    pub rebuild_cancelled: AtomicBool,
    pub rebuild_in_flight: AtomicBool,
    pub last_indexed_git_state: RwLock<Option<LastIndexedGitState>>,
    pub nl_translator: OnceCell<Arc<Translator>>,
}

Per-workspace runtime state owned by the super::WorkspaceManager::workspaces map.

Mutating state:

• graph, state, memory_bytes, memory_high_water_bytes, retry_count, rebuild_cancelled are all atomic — queries and status readers can observe them without taking a mutex.
• last_accessed, last_error, last_good_at are short-critical- section RwLocks — writers are the dispatcher / router at publish/fail time.
• rebuild_lane is a tokio::sync::Mutex per A2 §J.4; the dispatcher holds it briefly to coalesce pending work.

Construction is expensive only in that ArcSwap::new allocates one Arc<CodeGraph> up front. A fresh workspace is initialised with an empty-but-live CodeGraph; the real graph is installed by the first publish_and_retain.

Fields

key: WorkspaceKey

Identity key under which the manager stores this workspace.

Immutable for the lifetime of the workspace; if the config fingerprint or root mode change, the workspace is unloaded under the old key and freshly loaded under a new key.

graph: ArcSwap<CodeGraph>

Published graph. Readers call graph.load_full().

Only [crate::workspace::publish::publish_and_retain] swaps a new graph in; eviction stores a fresh empty graph so the ArcSwap remains non-null (simpler than Option-wrapping).

state: AtomicU8

Current lifecycle state. Stored as AtomicU8 to keep the status read path lock-free; round-trip via WorkspaceState::as_u8 / WorkspaceState::from_u8.

last_accessed: RwLock<Instant>

Last wall-clock time a query observed this workspace, used by LRU eviction (§G.7). Short critical section; RwLock keeps contention negligible.

memory_bytes: AtomicUsize

Current heap_bytes of the published graph. Updated on every successful publish_and_retain. Reads use Relaxed ordering — the authoritative aggregate lives on super::admission::AdmissionState.

memory_high_water_bytes: AtomicUsize

Peak memory_bytes observed over this workspace’s loaded lifetime. Per Amendment 2 §D:

High-water marks are monotonic over the workspace’s loaded lifetime — they reset only on unload/eviction (fresh LoadedWorkspace), not on rebuilds or backoff.

Updated via fetch_max alongside every memory_bytes store.

pinned: bool

Whether LRU eviction must skip this workspace.

last_error: RwLock<Option<DaemonError>>

Most recent build/load error, if any. None in the WorkspaceState::Loaded steady state. Populated on transition into WorkspaceState::Failed and read back by the router when surfacing meta.last_error on stale responses.

last_good_at: RwLock<Option<SystemTime>>

Wall-clock of the most recent successful rebuild. Used by the router to compute age_hours for the stale_serve_max_age_hours cap and the JSON-RPC -32002 error error.data.age_hours payload.

retry_count: AtomicU32

Count of consecutive failed rebuilds. Drives the exponential backoff schedule (§G.7 / plan Step 6: 30s → 60s → 120s → 300s → 600s). Reset to 0 on every successful publish.

rebuild_lane: Mutex<Option<PendingRebuild>>

At most one queued rebuild per workspace. None when the dispatcher’s lane is idle. Filled / coalesced by the dispatcher (Task 7).

rebuild_cancelled: AtomicBool

Lock-free cancellation signal for in-flight rebuilds. Set by evict_lru / explicit unload and polled by the rebuild pipeline at each pass boundary. Once set, the running rebuild aborts, drops its RebuildReservation, and never publishes.

rebuild_in_flight: AtomicBool

Runner-role gate for the per-workspace rebuild serial consumer (A2 §J.2, Task 7 Phase 7b1). When true, exactly one crate::RebuildDispatcher::handle_changes call is actively running the full rebuild pipeline (the Phase B drain loop in rebuild.rs). A concurrent caller observing true under the Self::rebuild_lane lock MUST park its coalesced PendingRebuild in the lane and return Ok(()) without executing — the active runner will drain the lane at its next drain-loop iteration.

Invariant

All normal-path transitions of this flag happen while Self::rebuild_lane is held. DrainLoopSentinel::drop in rebuild.rs is the sole recovery exception — it stores false without the lane on the unwind path, with the narrow-race semantics documented on that type.

Authorised modifiers

• RebuildDispatcher::handle_changes Phase A (false → true under lane).
• RebuildDispatcher::handle_changes Phase B drain-loop exit (true → false under lane, when the lane is empty or the top-of-loop eviction gate fires).
• DrainLoopSentinel::drop panic-safety path (true → false, bare atomic store, narrow race).

Nothing in WorkspaceManager (execute_eviction, publish_and_retain, the retention reaper) touches this flag. It is dispatcher-local coordination, independent of the rebuild_cancelled eviction signal.

last_indexed_git_state: RwLock<Option<LastIndexedGitState>>

Git state that the currently-published graph was indexed against (Task 7 Phase 7b2, A2 §I / §J.2).

Read by the per-workspace watcher bridge as the last_git_state argument to sqry_core::watch::SourceTreeWatcher::wait_for_changes_cancellable so the classifier has a valid baseline on every debounce window.

Advanced ONLY by crate::RebuildDispatcher::execute_one_rebuild after crate::WorkspaceManager::publish_and_retain succeeds, using the git_state_at_enqueue snapshot attached to the PendingRebuild that produced the publish. A failed rebuild MUST leave this field unchanged so the next wait_for_changes_cancellable call still sees the divergent state and retries.

Invariant

• Only execute_one_rebuild’s successful-publish arm writes this field.
• Watcher-side event receipt, cancellation, or rebuild failure never write this field.
• The write happens under parking_lot::RwLock — short critical section, no cross-lock ordering concerns.

None on workspace construction (no rebuild has published yet). The first successful execute_one_rebuild driven by the watcher bridge (which attaches git_state_at_enqueue = Some(...)) populates this field.

nl_translator: OnceCell<Arc<Translator>>

NL07 — lazily-initialised, per-workspace sqry_nl::Translator backing the daemon-hosted sqry_ask MCP tool.

Init cost is heavy (O(seconds) — N parallel ONNX session loads from the sqry_nl::classifier::ClassifierPool) so the daemon defers it to the first sqry_ask call against the workspace via OnceCell::get_or_try_init. Subsequent calls receive a cheap Arc<Translator> clone.

Lifetime: tied to LoadedWorkspace itself. Workspace eviction (LRU, explicit unload, daemon shutdown) drops the OnceCell, which drops the Arc<Translator>, which drops the pool’s N classifier sessions and frees their model weights. No explicit cleanup required.

Concurrency: the cell itself is Send + Sync. The Translator inside uses an internal sync pool that the daemon’s MCP host calls under tokio::task::spawn_blocking so the daemon’s tokio runtime never blocks on recv().

Implementations

impl LoadedWorkspace

pub fn new(key: WorkspaceKey, pinned: bool) -> Self

Construct a fresh workspace entry with an empty initial graph.

The empty graph is Arc-cheap (sub-kilobyte) so keeping the ArcSwap non-null for the entire workspace lifetime avoids an Option layer on the query path. Eviction stores another empty graph through the same ArcSwap; re-load overwrites it.

pub fn load_state(&self) -> WorkspaceState

Atomic state read. Round-trips through WorkspaceState::from_u8; a discriminant outside the current range panics (it is a telemetry-corruption bug, not a recoverable condition).

pub fn store_state(&self, new_state: WorkspaceState)

Atomic state write.

pub fn update_memory(&self, new_bytes: usize) -> usize

Update memory_bytes and keep memory_high_water_bytes monotonic. Matches Amendment 2 §D:

Every time memory_bytes is assigned (initial load, full rebuild completion, incremental rebuild’s ArcSwap::store), immediately call memory_high_water_bytes.fetch_max(new, Relaxed).

Returns the previous memory_bytes value so the caller can compute the delta the admission accounting needs.

pub fn touch(&self)

Stamp last_accessed = now on a query. Held under an RwLock so the query hot path never blocks — writers contend only with other writers.

pub fn record_success(&self, at: SystemTime)

Record a successful build’s wall-clock + reset retry counter.

pub fn record_failure(&self, err: DaemonError) -> u32

Record a failed build and return the new retry count. The dispatcher uses this to pick the exponential-backoff schedule.

Trait Implementations

impl Debug for LoadedWorkspace

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.