[lifecycle-RSK] Run-state kernel #1790

Tracking

• Umbrella: [Umbrella] Task lifecycle gap remediation — LIFE-GAP-001..040 #1688
• Assignee: @edelauna
• Design doc: docs/architecture/task-lifecycle-target-architecture.md (not yet on main)
• Ticket plan: docs/architecture/task-lifecycle-run-state-kernel-tickets.md (not yet on main)

Context

Task models run state with 11 run fields and 2 dispatch locks. The fields overlap in time: an ask can be pending while a stream is live or after it ends, and the abort latches stay set across both. The type system cannot tell a legal combination from an illegal one. The fix is orthogonal regions, latches, a pure transition function, derived getters, and an actor per task. This epic builds the kernel with shadow-then-strangle migration. It does not change the persisted reducers.

Scope

In scope: the in-memory run-state kernel. It replaces the run-state fields on Task with orthogonal regions (phase, stream, ask), latches, a turn sub-machine, a pure transition function, and derived getters. It uses shadow-then-strangle migration. It also fixes three code races that block the migration (#1801, #1802, #1803). The maintainer product requirements PR-1 to PR-8 in the design doc set the target behavior.

Out of scope:

1. Persisted ownership and generation (P1) and crash recovery (P2). These carry the data-loss risk. They stay a separate program.
2. Tool-call identity and approval correlation (LIFE-GAP-036, 037, 038). These are P4 and P5 identity work. The kernel stores toolCallId and approvalId as optional opaque strings. P4-010 guards detached writes with the kernel generation, so it depends on [lifecycle-RSK] RSK-10: Route stream, ask, and turn-field writes through events #1804.
3. Queued user input. The queued-input bugs come from Task#ask, not from run state.
4. Concurrent sibling fan-out.

Decisions

1. Use orthogonal regions of discriminated unions and a pure reducer. Do not add xstate.
2. Keep the persisted reducers (src/core/task-persistence/taskLifecycle.ts) unchanged. The kernel is a separate in-memory submodel (task-lifecycle-model.md, Extending the model).
3. Model abort, abandoned, disposed, and reason as latches. Latches never return to false within one instance. didFinishAbortingStream is not a latch. It lives on the live stream as cleanupFinished, so every instance gets the same cancel timing (PR-2).
4. The kernel always runs from [lifecycle-RSK] RSK-04: Add the run field, write helpers, and the projection #1794. Only the divergence comparison is gated.
5. Route every write of a field through a write helper before any read of that field flips. The helper sets the field and drives the event. The field stays authoritative until its read flip.
6. There is no runtime kill switch after a read flip. Rollback of a flip is a revert of that flip PR. Each flip PR covers one field family, so a revert stays small.
7. The design doc "Known code races" table is the only ignore list for the comparison. Each entry names its fix ticket or its reason to allow.

Rollout gate

The divergence comparison runs when one of these conditions is true:

1. process.env.PKG_RELEASE_CHANNEL === "prerelease". src/esbuild.mjs:50 defines this value, and the nightly workflow sets it (.github/workflows/nightly-publish.yml:80, 89).
2. contextProxy.extensionMode is vscode.ExtensionMode.Development or vscode.ExtensionMode.Test. ClineProvider.ts:1046 checks Development in the same style. No non-test file in src checks Production today.

Do not add a new define. Do not add a user setting. The gate controls only the comparison and its log. It never controls the kernel computation or the read source, so a read never sees an inert kernel.

Sub-issues in dependency order

Listed in dependency order.

• [lifecycle-RSK] RSK-01: Add the pure run-state kernel module #1791 Add the pure run-state kernel module
• [lifecycle-RSK] RSK-02: Extend the bounded model-check to the kernel #1792 Extend the bounded model-check to the kernel
• [Story 4.2a] DispatchState machine refactor #374 DispatchState machine refactor ([Story 4.2a] DispatchState machine refactor #374, related: its parent is [Epic 4] Parallel Tool Execution #359)
• [lifecycle-RSK] RSK-12: Remove the dead isPaused field #1793 Remove the dead isPaused field
• [lifecycle-RSK] RSK-19: Keep the first abort reason #1802 Keep the first abort reason
• [lifecycle-RSK] RSK-20: Check abort before an ask posts #1803 Check abort before an ask posts
• [lifecycle-RSK] RSK-04: Add the run field, write helpers, and the projection #1794 Add the run field, write helpers, and the projection
• [lifecycle-RSK] RSK-05: Add the divergence comparison and a metric #1795 Add the divergence comparison and a metric
• [lifecycle-RSK] RSK-06: Route latch and phase writes through events #1796 Route latch and phase writes through events
• [lifecycle-RSK] RSK-07: Flip abort and abortReason reads #1797 Flip abort and abortReason reads
• [lifecycle-RSK] RSK-08: Flip abandoned reads #1798 Flip abandoned reads
• [lifecycle-RSK] RSK-11: Flip isInitialized reads #1799 Flip isInitialized reads
• [lifecycle-RSK] RSK-09: Add the turn sub-machine #1800 Add the turn sub-machine
• [lifecycle-RSK] RSK-17: Reset didFinishAbortingStream for each request #1801 Reset didFinishAbortingStream for each request
• [lifecycle-RSK] RSK-10: Route stream, ask, and turn-field writes through events #1804 Route stream, ask, and turn-field writes through events
• [lifecycle-RSK] RSK-16: Flip stream and turn-field reads #1805 Flip stream and turn-field reads
• [lifecycle-RSK] RSK-13: Wrap run state in a task actor with a serialized mailbox #1806 Wrap run state in a task actor with a serialized mailbox
• [lifecycle-RSK] RSK-14: Route the provider through actor messages #1807 Route the provider through actor messages
• [lifecycle-RSK] RSK-15: Add the RunState to persisted-status consistency check #1808 Add the RunState to persisted-status consistency check

Withdrawn number: RSK-18 is not used.

• RSK-18 would have checked abort again before a stream starts. That early throw skips the chunk-loop catch, which marks the api_req_started row cancelled and sets the reason. The kernel allows race R-2 instead, and the request guard (Task.ts:4615) stops the model call.

Field surface

Counts are Task-owned references in src at the audited commit. Tests and comment lines are excluded. The abort count excludes .abort() method calls on controllers and processes. The isInitialized count excludes 6 references on other classes. Route the writes before you flip the reads.

Follow-up issues outside this epic

The product requirements create these issues. They are not RSK tickets, because they do not change run state.

LIFE-GAP-039 is in the gap report register, and LIFE-BLK-P1-039 owns it in the remediation blocks.