Writer admission authority

This program moves bundled writer admission to one dedicated worker while preserving current authority, FIFO ordering, final host COMMIT authorization, and receipt settlement. No schema, persistence, configuration, or update migration is proposed. Restart reconstructs process-local authority through the existing owners.

The bottleneck is host scheduling, not the cost of a Boolean check. A traced chat.send ACK spent 673 of 765 ms waiting for admission; the preceding change measured ACK p50/p99 of 1,209/1,693 ms with 20 senders (prior measurement). A feasibility probe answered from shared state in 0.064 ms but incorrectly granted after policy revocation. Forwarding the live callback instead waited through a 200 ms host stall. Those diagnostic observations justify transferring authority ownership contracts; they do not predict production latency.

The first slice transfers profile revision/status checks through shared cells and adds a read-only admission service factory with two typed profile checks. Bound and current-settled operations use the same canonical state as host assertions. The factory is exercised through real worker tests; production dispatch stays with the host until remaining dependencies can transfer. A measured intermediate host-to-service preparation detour added latency and was removed. Native publishers fence immediately before physical COMMIT; known rollback preserves the prior revision, while uncertain native outcomes stay fenced. Retired generations never revive through delayed descriptor delivery. First creation retires unresolved profile authority even when the database admission itself remains valid across path-to-file identity promotion. The lifecycle publishes that promotion through its existing shared integrity revision before changing identity, including worker-only creation and alias reconciliation. The existing worker-task owner handles service failure, termination and restart.

This slice transfers no policy payload or native write grant. Descriptors retain their exact shared buffers directly, so no service registration map can reclaim or substitute a generation. Mixed physical/request/run authority, final host COMMIT and settlement remain on their existing path. Descriptors also retain the existing shared admission-revocation cell, so worker-only close refuses reads before asynchronous drainage. Service reads do not certify the remaining physical custody still checked by the host. Later owners must supply those contracts and native-to-service transport before transaction admission can bypass the host.

Current owners and required transfers

Source locations below refer to commit 4ca02f6c720e6346a0d57b158cc38484fdf5c8da; paths start at src/. Admission composes these owners; none alone authorizes a write. Each row names the current read, mutation boundary, and proposed transferable facts.

Shared publication and retention

Each owner exports an immutable descriptor containing its kind, process epoch, exact identity/generation and retained dependency references. Each mutable subject has owner-written atomic cells: revision, status (ready, pending, uncertain, revoked) and the existing lifetime/reference state. Variable-sized policy facts travel as immutable revision-tagged messages. The service stores those payloads as a projection; the shared cells remain canonical. Missing, partial or mismatched revisions refuse or return the owner's existing retryable pending result. Use non-reused generations; retire before counter wrap.

Publication order is mandatory:

1. Prepare replacement facts without exposing them. Synchronously invalidate the old revision/status before changing authoritative state or granting the native effect that changes it. Preserve owner-specific rollback semantics: permanent retirement stays permanent; aborted tentative config activation must not revoke an accepted source that remains current.
2. Perform the mutation under the current owner. Preserve pending/uncertain distinctions until native settlement establishes the result.
3. Install new immutable facts in the service, then let their original owner publish the matching ready revision after installation acknowledgment. Delayed payloads cannot overwrite a later revision. Unrelated keys stay valid; no per-write registry rebuild or filesystem polling.

A reader loads all dependency revisions/statuses, evaluates the typed operation, then rechecks all of them as one attempt before publishing its decision. The writer's final check of those references immediately before the native stage is that stage's authority linearization point. A revocation observed at either boundary denies; later revocation retains today's next-boundary/rollback semantics. Final host COMMIT revalidation remains mandatory. This is not a durable capability or permission to use a prior answer after an await.

The proof obligation for each owner is a complete writer inventory: all paths that change a consumed fact must invalidate first, including worker COMMIT, config activation, deletion, repair and shutdown. A post-change listener cannot satisfy it. Publish a pending revision before an effect whose result is not yet available; stalled publication may delay work but cannot grant stale work. Test the actual publisher, not a synthetic revocation helper alone.

Retain physical generations using the open-time reconciliation in the retention repair: keep the original physical identity, acquire/reconcile the reference before exposing the handle, balance abandoned references, retry metadata closure only, and reject explicit retirement or replacement. Integrate that repair before service cutover; do not duplicate its protocol. Authority descriptors likewise remain retained by operation custody until settlement and native cleanup, not merely until a grant/reply. Revocation and memory reclamation are different transitions.

Service and typed operations

The broker owns one admission worker per Gateway process. It retains the existing per-database FIFO and sends only the current job, exact dependencies, stage and transaction facts through private ports. The service owns decision execution, not SQLite connections, policy mutation, scheduling order or receipts.

Initial operations are assertBoundRevision and readCurrentSettledFacts for profile authority. Later owner modules provide assertRunBinding, authorizeOperatorPolicy, authorizeSessionTarget, validatePreparedSources, acceptConversationAlternatives and authorizePendingInputCustody. Each has a closed input/result type and a defined effect owner. Preserve the actor sequence: accepted/current check → native observation → policy operation → current/accepted check → grant. Preserve ordered preparation, including planners that await while holding the foreground FIFO; move it earlier only with equivalence proof. Transaction-dependent decisions consume the native transaction's preimage. Bookkeeping required before grant moves to its named owner or completes before dispatch; it cannot become an asynchronous notification.

Final host COMMIT authorization, native COMMIT, receipt publication and settlement remain unchanged. Thus host stalls can still delay COMMIT, dispatch and ACK publication. Measure those separately; this program first removes repeated admission delivery waits and their FIFO occupancy, not all main-thread latency. Cold creation/schema preparation stays host-required until its owner is migrated.

Opaque released SDK guards are another explicit host-required case: config/sessions/session-source-authority.ts:47–67,127–156 permits arbitrary synchronous SQLite reads. Keep that adapter and public behavior; migrate all bundled callers of each typed operation together and delete their old callback path. An unsupported callback must never fall through to a shared allow snapshot. Universal SDK off-thread admission requires a separately reviewed public contract.

Service failure must refuse ungranted requests and route dispatched work through existing native retirement/settlement. A terminated worker cannot publish its own death, and synchronous waits cannot rely on port-close callbacks. Before cutover, implement bounded service-response waits: the native waiter atomically expires its pending request without host scheduling; expiry never grants authority. The broker supervisor closes the failed service epoch before replacement. Size the internal wait budget from slow-host measurements; add no user configuration. Preserve completed receipts; report unknown writes as unknown and reconcile through the existing owner, never replay automatically. Replacement uses a fresh service epoch and fresh registrations after old native custody settles. Gateway crash/restart discards shared memory and rehydrates canonical persisted state; no authority survives by token or pathname alone.

Incremental delivery and proof

Land one owner per PR. First transfer profile revisions/status and their existing pre-COMMIT fence, with a service skeleton exercising those two typed reads. Keep mixed operations explicitly host-required until every dependency is transferable; do not claim chat latency improvement from this first slice. Then migrate broker/execution/maintenance custody, request/run/operator owners, config/tool policy, and session/sharing/source operations, in that dependency order. Split each group into its individual owners. Each PR lists callers, mutation coverage, removed callback code, retained public contracts and measured cost; earlier PRs remain safe without later ones.

Required adversarial proof uses barriers through real owner paths: revoke during payload delivery and evaluation; mutate config/membership while the host is blocked; retain then retire in both message orders; replace the physical file; reuse a run ID; disconnect accepted versus unaccepted sources; pending/unknown profile COMMIT; callback-induced revocation; duplicate/delayed grants and receipts; service/native crash before grant, after grant and after COMMIT. Assert refusal, permanent versus retryable state, unchanged FIFO ordering, preserved committed facts and balanced retention. Include process restart and stale-epoch rejection. Run the retained host path and migrated path against identical contract fixtures.

For every executable slice, use a synthetic isolated Team sandbox and four preselected A-B-B-A blocks, identical instrumentation/builds, fresh state per run and no discarded failures. Reuse the writer workload from the writer-count measurement: 20 sessions × five turns, one excluded warmup each, 20 history messages/session, 400 history reads, 100 metadata updates/probe rounds, four subscribers, visible observer, tool events and control plane. Also repeat the 20-sender chat.send protocol from the prior ACK measurement, preserving its fixture and pacing.

Report admission delivery by stage, FIFO hold/occupancy, queue p50/p95, ACK p50/p99, main-thread CPU/event-loop delay, service CPU and allocation, successful operations and refusals. Compare four paired block ratios with uncertainty and retain failed runs. Expect lower non-COMMIT delivery wait and FIFO occupancy; no numeric speedup is established by this document. Neutral results within noise still qualify requested/simplifying changes; added complexity needs demonstrated benefit. Local validation stays changed-file formatting/lint and a handful of focused tests; PR CI owns full gates. Benchmarks use only the constrained sandbox, never production data or normal-validation leases.