Session Concurrency Ceiling Delivery Plan

Overview

Add a shared instance-wide admission ceiling for agent sessions. Preserve the existing orchestrator launch seams, durable task metadata, and executor callbacks. Close the recovery, replay, stale-callback, and queue ownership gaps found during review.

Delivery flow

launch seam -> admission controller -> reservation or deferred_launch CAS
  -> executor callback -> confirm/release -> sweep replay -> task update

The controller owns live admission state. The task repository owns the durable retry record. The executor owns process identity. These ownership boundaries remain separate during repair.

Verification strategy

Run focused orchestrator tests for cold resume, callback identity, Office replay, dynamic relaunch outcomes, queue retry, and deferred-record conflicts.
Run focused task-service tests for nested ceiling prompt edits.
Run go test -race for the orchestrator package because reservations and callback release are concurrent.
Run the documentation coverage evaluator through the PR workflow after push.

Work orders

Task 01: Preserve ceiling launch ownership

Risks

The opt-in session ceiling plan replaces the CPU-derived default and environment-only configuration with disabled defaults and live Settings. The results here describe the original delivery; they do not verify that follow-up.

Follow-up: queued session ownership adds passive-origin enforcement and task queue visibility. Existing manual override semantics and the completed work order remain unchanged.

A repository read failure before a process callback is treated as not owned, so a reservation can wait for the sweep instead of being released by an ambiguous callback.
The startup ceiling is environment-only. Operators must restart the backend after changing it.

2.1 KiB Raw Blame History