sched: gate scheduled resumes on the shared execution slot, with drain tracking (B2)

2026-09-09 17:23:28 +07:00
parent fd2f85ef96
commit ada0239a1c
8 changed files with 459 additions and 15 deletions
@@ -337,11 +337,16 @@ all mutating admin ops clear the old revision's unadmitted work and
 advance the watermark BEFORE the revision bump or flag flip lands, so a
 crash can only leave the op unapplied (retryable), never a new revision
 that backfills. Occurrence pages carry the stored history plus a live
-held-candidate `pending` synthesis on the first page. Manual runs and
-resumes bypass scheduler capacity by design (unchanged API behavior);
-scheduler capacity governs scheduled dispatch only, and a scheduled
-interrupted run resumed manually reconciles its terminal history through
-recovery.
+held-candidate `pending` synthesis on the first page. Manual runs bypass
+scheduler capacity by design (unchanged API behavior); capacity governs
+scheduled dispatch plus scheduled resumes. A scheduled interrupted run
+resumed through the run API acquires a server execution slot through the
+scheduler's own accounting before dispatch — rejection leaves no resume
+attempt behind — holds the durable executing mark for the re-execution
+(visible to capacity and drain like any live execution), and releases
+the slot when its stopped result is persisted. A resumed scheduled run
+reconciles its terminal history live through the same idempotent
+recording as dispatch; restart recovery still repairs torn boundaries.

 Known limitations: pointing one composition's stores inside another live
 composition's store subtree (without sharing its identical roots) is