Subc runtime runs on a dedicated 16 MiB-stack thread (Windows main-stack overflow)

Merged
AF
6d ago
+2011-48

Stacked on #1098; this PR's own change is the last commit(s) after de0c479870. Until #1098 merges, the diff also shows #1098.

Why. In the subc daemon, main → run_subc_mode → run_subc_mode_inner built a current-thread Tokio runtime and block_on'd run_module_loop on the process main thread. On Windows that thread has a 1 MiB stack reserve. run_module_loop's poll frame measured about 579 KB, above a 328 KB tool-handler frame, and the daemon overflowed mid-request; that showed up as scope_end_kill terminal-reply timeouts in #1098's merge-queue runs. #1098 boxes the control and tool futures (down to about 555 KB), but that leaves under half the stack free.

Change. The whole runtime lifecycle now runs on a joined aft-subc-runtime OS thread with an explicit 16 MiB stack on every platform. The exit-code mapping is unchanged (graceful 0, connection lost 3, actor fatal 4, startup error 1). A runtime-thread panic resumes on the caller with its original payload. A thread-spawn failure is a fail-loud startup error. gh-shim, early CLI and standalone paths don't enter the wrapper.

Tests. The worker runs on a distinct named thread and preserves results. Panics keep their original payload. The real module poll path (hello, health check, goodbye) completes on a 4 MiB stack, a quarter of the production budget. Bypassing the worker makes the distinct-thread test fail. 1,459 subc lib tests pass on Linux, and 16 scope_end_kill tests plus the stack tests pass natively on Windows, along with the Windows target check.

Summary by cubic

Runs the subc daemon's Tokio runtime on a dedicated 16 MiB-stack OS thread so Windows no longer overflows the 1 MiB main-thread reserve mid-request, and adds the flow-callable diagnostics.findings management query for ALF's self-diagnosis.

  • The runtime is created, polled, and shut down on a joined aft-subc-runtime thread; exit-code mapping is unchanged (graceful 0, connection lost 3, actor fatal 4, startup error 1). A runtime-thread panic resumes on the caller with its original payload; a spawn failure is a fail-loud startup error. gh-shim, early CLI, and standalone paths don't enter the wrapper. Tool-handler construction and control dispatch stay boxed/noinline to keep the poll frame small.
  • diagnostics.findings reads only evidence the serving process already keeps (health rollup, cold-build limiter, LSP retry, persisted-format floors), with contended reads returning an explicit unknown finding. Flow-scoped management routes keep the daemon scope stamp; worker and tool routes are refused, and other flow-scoped management requests are refused before any provider read. subc-protocol is bumped to 0.33.5 for its flow_operations API, and pinned v1 vectors are vendored with LF-only bytes and SHA-256 provenance.