Module execute 

The request engine (spec §4.3/§4.4/§4.7/§5): the ordered pipeline every tool call runs through. Returns either a worker result Value (plus a snapshot of the active canonicalizer for the caller to canonicalize addresses) or a structured ErrorEnvelope.

Structs

BootingResetGuard 🔒

RAII guard resetting a Booting slot back to Empty if a respawn future is dropped before reaching a terminal state (R5 cancellation-safety). Drop cannot await, so it uses a sync try_lock; on contention it detaches a cleanup task. Idempotent: only resets if the slot is still Booting.

Enums

RpcOutcome 🔒

SlotKind 🔒

Copyable classification of the worker slot, so a caller can inspect state and THEN take a &mut borrow without an overlapping-borrow error (R2 seat-D).

Functions

attach_program

Attach a program. The active-program + canon commit happens ATOMICALLY inside the engine under the worker lock (via commit_attach_if_needed) — NOT here (R2 seat-C). This wrapper only supplies the poison-key selector and runs the same crash/respawn engine (§4.3).

call_worker

Run one tool call. selector is the poison/short-circuit key component (e.g. the function arg, or the program_path); pass "" for selector-less calls. Returns (result_value, canon_snapshot).

commit_attach_if_needed 🔒

If the just-succeeded call was attach_program, commit the new active program + canonicalizer into the holder WHILE THE SLOT LOCK IS STILL HELD (R2 seat-C atomicity). A parse failure leaves the prior attachment intact.

current_canon

Snapshot the active canonicalizer (for canonicalizing an error-path candidate list).

poison_terminal 🔒

Terminal “reproducible crash” error (spec §4.3 poison-pill).

publish_ready 🔒

Publish a freshly-booted worker into the slot (from Booting) and wake warming waiters. Disarms the cancellation guard INSIDE the lock, after the write (R6 seat-P).

reset_booting_to_empty 🔒

Reset a Booting slot back to Empty (retryable) after a failed respawn; wake warming waiters. Only resets if still Booting. Disarms the guard INSIDE the lock, after the write (R6 seat-P).

respawn_and_retry 🔒

Reboot a fresh worker (OUTSIDE the lock; slot is Booting so concurrent callers get WORKER_WARMING), re-attach last good, and retry ONCE before publishing. A second crash poisons the selector.

rpc_once 🔒

One RPC with poison-on-drop (§4.4) + rpc_deadline (§4.7). A transport error OR a deadline overrun is a crash (respawn); a worker Failure frame is a domain error (worker alive).

run_with_respawn 🔒

Acquire the worker mutex and run the RPC. On a transport crash, respawn OUTSIDE the lock (R3 seat-G) and retry once; a second crash on the same request poisons the selector (§4.3). Attach state commits atomically under the lock (R2 seat-C).

server_busy 🔒

slot_kind 🔒

wait_until_ready 🔒

Wait until the worker slot is Ready, kicking a single-flight background boot if Empty. Waits up to warming_deadline (in ≤250 ms slices, woken early by boot_done); a boot longer than the budget returns WORKER_WARMING. Holds the slot lock only for the instantaneous state checks, never across the wait, and never while holding a permit (R2 seat-A).

worker_warming 🔒