refactor(core): modularize filesystem, database, and session state

Merged
HA
13d ago
+5831-4737

SessionManager, PostgresDialect, and SqlFs combined unrelated state and behavior in large files. This change gives each state domain one owner and keeps the existing entry points as coordinating adapters.

  • SessionCatalog owns session lifetime, metadata, local locks, accounting, eviction, and shutdown. RuntimeAdmission owns language quotas and queues. TenantBackends owns tenant connections and filesystem factories.
  • PostgreSQL blob, sandbox, namespace, and ingest modules own complete database operations. PostgresDialect retains the pool and transaction creation. SQL statements, parameters, and transaction ordering are preserved.
  • CoherentView owns the installed path/epoch image and atomic cache publication. Its private FileContents owns content fills. ScriptPersistence owns scope/transaction lifetime and replay. NamespaceOperations owns path reservations and dispatches complete file, tree, link, and ingest algorithms.
  • Worker commands use typed handlers and effect classification. Worker outcome and recovery state stays with its owner. Shared script completion preserves primary errors. Lease-loss context lives in one neutral execution module.

Source ownership maps link responsibilities to modules and behavioral tests. Session creation now also rejects worker attachments that finish after shutdown begins, with a regression test and changeset. A new regression protects live epoch sampling after writer-lock waits and concurrent reloads.

Each of the three extraction phases passed independent review, pnpm check, and disposable pnpm verify:local in the isolated implementation checkout. Each live phase passed 258 integration tests with zero skips, 92 HTTP/MCP checks, and 90 live SDK checks. Independent PostgreSQL review compared 118 protocol cases; SqlFs review compared 324 facade executions and checked 45 public signatures/getters.

The delivered checkout passes typecheck and lint and independent final delivery review. Review fixes passed 146 focused tests and seven tests against disposable PostgreSQL, including root ingestion and overwrite behavior. Ten scope-transition and rename regression cases failed before the fixes. An independent cached-read comparison returned bytes before the fix and rejected the condemned scope afterward. All active hosted PR checks passed on ec36315. The full local pnpm verify:architecture passed 265 integration tests with zero skips and 723 live HTTP/MCP, SDK, worker-failure, stream-finalization, input-budget, and tenant checks.

Worker recovery also treats coherence failures after execution dispatch as unknown outcomes, because durable writes may already have committed. Regression coverage checks that earlier failures retain their existing classification.

Cubic review corrections tighten scope-transition checks, cache-read verdicts, rename inode/kind handling, and root ingestion. Source ownership documentation describes both scope modes, root blob commits, language admission, shutdown drain limits, and available verification commands. The PR has one patch changeset.

Integration & API CI runs on pushes to main, while PRs retain lint/typecheck, unit tests, build, SDK, and security checks. The resolver integration fixture no longer reinstalls migration 0001 over the current migrated database; all existing assertions are retained. The failing ordered sequence reproduced three symlink failures before this fix and passed all 58 tests afterward.