The outer ring for the domain added in #4597: SQL repositories, the run
launcher, the thread lookup, and the run-completion listener implementing
the ports it declared, plus the HTTP router and the poller that drive
them. All of it is instantiated in one composition root, so no route or
lifespan hook builds an adapter of its own.
With the ports filled, the pre-hexagonal implementation is deleted rather
than left alongside: `app/scheduler/service.py` and its router mixed
policy, persistence, and HTTP into one class, which is why its rules were
only reachable through a live database. Keeping both would leave two
implementations of the same rules writing to the same table.
Three of the domain's contracts needed real work on this side rather than
a straight port of the pre-#4597 adapters:
- The launcher now distinguishes certain failure from doubt. Only a 4xx
is certain enough to raise LaunchFailedError, which releases the task's
single active slot; a 5xx, an arbitrary exception, or a reply whose
identity will not decode all raise LaunchIndeterminateError and keep
the slot held. Guessing "failed" after the launch request was sent is
what re-opens #4452's duplicate execution.
- The task repository implements the optimistic token. `save` is a
conditional UPDATE on `version` rather than read-check-write, because
the latter lets two savers observe the same version and both commit;
every other committed write increments it. This needs a column, so it
ships with migration 0011 -- the only schema change in the slice, and
the reason the alembic head pins move.
- The router builds commands with plain `None` for "not supplied", and
maps ConcurrentUpdateError onto a retryable 409.
The concurrency invariants are pinned by contract suites that run each
port against both the in-memory double and real sqlite -- including a new
TestOptimisticConcurrency covering what invalidates an earlier read --
plus the dispatch-race tests against a real database.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
6f84a4094d