refactor(runtime): make Fiber the sole lifecycle owner

[likun666661]

Purpose

This is a focused ownership-model experiment stacked on #3250 at 7a7acf58b48a6ffcabe19248c3ea681ea20387e2.

It proposes one invariant:

A Fiber is the sole runtime lifecycle and resource owner. A Context is a non-owning capability view created by and permanently bound to exactly one Fiber.

The temporary stacked base branch makes this review show only the ownership refactor. It is not intended to replace main; the branch can be retargeted after the underlying foundation is settled.

Model

Entry desired specification
└─ Fiber runtime projection and sole authority
├─ lifecycle/error/dependencies
├─ child Fibers
├─ Effects/resources
└─ Context canonical plugin-facing capability view
└─ derived views same Fiber, different environment metadata

If an environment needs independent failure, disposal, or resources, it should be represented by a child Fiber rather than another owning Context.

Changes

• Fiber.parent points directly to a parent Fiber; Context ancestry no longer doubles as runtime ownership.
• Every Fiber owns one canonical context; derived Context views must be created by that Fiber.
• Context.plugin() delegates to Fiber.mount() and Context.effect() delegates to Fiber.own().
• Cross-Fiber Context derivation and mounting are rejected.
• Context ownership/topology fields are immutable and cannot be overwritten through metadata.
• Fiber identity is stable: the thenable Proxy is removed in favor of explicit fiber.await().
• Cleanup failure remains observable on the owning Fiber as FAILED/error and prevents unsafe automatic reactivation until disposal.

Invariants covered by tests

• Context metadata cannot replace fiber, parent, root, or logger.
• Multiple Context views attach their Effects and child Fibers to one owner Fiber.
• Service-loss cleanup failure is retained and prevents automatic recovery over potentially leaked resources.
• Existing composition-loader behavior remains unchanged.

Validation

• Focused plugin kernel and composition loader: 63/63 passing.
• Strict targeted TypeScript compilation: passing.
• Biome check and git diff --check: passing.

Review focus

The main question is whether this ownership split is a better K0 boundary than allowing Context ancestry to participate in lifecycle authority. API naming and compatibility can be adjusted after that boundary is agreed.

Generative tooling disclosure

OpenAI Codex made a substantive contribution to the design, implementation, tests, and PR wording. The commit carries a Generated-by: Codex trailer.

[likun666661]

Purpose

This is a focused ownership-model experiment stacked on #3250 at 7a7acf58b48a6ffcabe19248c3ea681ea20387e2.

It proposes one invariant:

A Fiber is the sole runtime lifecycle and resource owner. A Context is a non-owning capability view created by and permanently bound to exactly one Fiber.

The temporary stacked base branch makes this review show only the ownership refactor. It is not intended to replace main; the branch can be retargeted after the underlying foundation is settled.

Model

Entry desired specification
└─ Fiber runtime projection and sole authority
├─ lifecycle/error/dependencies
├─ child Fibers
├─ Effects/resources
└─ Context canonical plugin-facing capability view
└─ derived views same Fiber, different environment metadata

If an environment needs independent failure, disposal, or resources, it should be represented by a child Fiber rather than another owning Context.

Changes

• Fiber.parent points directly to a parent Fiber; Context ancestry no longer doubles as runtime ownership.
• Every Fiber owns one canonical context; derived Context views must be created by that Fiber.
• Context.plugin() delegates to Fiber.mount() and Context.effect() delegates to Fiber.own().
• Cross-Fiber Context derivation and mounting are rejected.
• Context ownership/topology fields are immutable and cannot be overwritten through metadata.
• Fiber identity is stable: the thenable Proxy is removed in favor of explicit fiber.await().
• Cleanup failure remains observable on the owning Fiber as FAILED/error and prevents unsafe automatic reactivation until disposal.

Invariants covered by tests

• Context metadata cannot replace fiber, parent, root, or logger.
• Multiple Context views attach their Effects and child Fibers to one owner Fiber.
• Service-loss cleanup failure is retained and prevents automatic recovery over potentially leaked resources.
• Existing composition-loader behavior remains unchanged.

Validation

• Focused plugin kernel and composition loader: 63/63 passing.
• Strict targeted TypeScript compilation: passing.
• Biome check and git diff --check: passing.

Review focus

The main question is whether this ownership split is a better K0 boundary than allowing Context ancestry to participate in lifecycle authority. API naming and compatibility can be adjusted after that boundary is agreed.

Generative tooling disclosure

OpenAI Codex made a substantive contribution to the design, implementation, tests, and PR wording. The commit carries a Generated-by: Codex trailer.

[likun666661]

Purpose

This is a focused ownership-model experiment stacked on #3250 at 7a7acf58b48a6ffcabe19248c3ea681ea20387e2.

It proposes one invariant:

A Fiber is the sole runtime lifecycle and resource owner. A Context is a non-owning capability view created by and permanently bound to exactly one Fiber.

The temporary stacked base branch makes this review show only the ownership refactor. It is not intended to replace main; the branch can be retargeted after the underlying foundation is settled.

Model

Entry desired specification
└─ Fiber runtime projection and sole authority
├─ lifecycle/error/dependencies
├─ child Fibers
├─ Effects/resources
└─ Context canonical plugin-facing capability view
└─ derived views same Fiber, different environment metadata

If an environment needs independent failure, disposal, or resources, it should be represented by a child Fiber rather than another owning Context.

Changes

• Fiber.parent points directly to a parent Fiber; Context ancestry no longer doubles as runtime ownership.
• Every Fiber owns one canonical context; derived Context views must be created by that Fiber.
• Context.plugin() delegates to Fiber.mount() and Context.effect() delegates to Fiber.own().
• Cross-Fiber Context derivation and mounting are rejected.
• Context ownership/topology fields are immutable and cannot be overwritten through metadata.
• Fiber identity is stable: the thenable Proxy is removed in favor of explicit fiber.await().
• Cleanup failure remains observable on the owning Fiber as FAILED/error and prevents unsafe automatic reactivation until disposal.

Invariants covered by tests

• Context metadata cannot replace fiber, parent, root, or logger.
• Multiple Context views attach their Effects and child Fibers to one owner Fiber.
• Service-loss cleanup failure is retained and prevents automatic recovery over potentially leaked resources.
• Existing composition-loader behavior remains unchanged.

Validation

• Focused plugin kernel and composition loader: 63/63 passing.
• Strict targeted TypeScript compilation: passing.
• Biome check and git diff --check: passing.

Review focus

The main question is whether this ownership split is a better K0 boundary than allowing Context ancestry to participate in lifecycle authority. API naming and compatibility can be adjusted after that boundary is agreed.

Generative tooling disclosure

OpenAI Codex made a substantive contribution to the design, implementation, tests, and PR wording. The commit carries a Generated-by: Codex trailer.

[likun666661]

Purpose

This is a focused ownership-model experiment stacked on #3250 at 7a7acf58b48a6ffcabe19248c3ea681ea20387e2.

It proposes one invariant:

A Fiber is the sole runtime lifecycle and resource owner. A Context is a non-owning capability view created by and permanently bound to exactly one Fiber.

The temporary stacked base branch makes this review show only the ownership refactor. It is not intended to replace main; the branch can be retargeted after the underlying foundation is settled.

Model

Entry desired specification
└─ Fiber runtime projection and sole authority
├─ lifecycle/error/dependencies
├─ child Fibers
├─ Effects/resources
└─ Context canonical plugin-facing capability view
└─ derived views same Fiber, different environment metadata

If an environment needs independent failure, disposal, or resources, it should be represented by a child Fiber rather than another owning Context.

Changes

• Fiber.parent points directly to a parent Fiber; Context ancestry no longer doubles as runtime ownership.
• Every Fiber owns one canonical context; derived Context views must be created by that Fiber.
• Context.plugin() delegates to Fiber.mount() and Context.effect() delegates to Fiber.own().
• Cross-Fiber Context derivation and mounting are rejected.
• Context ownership/topology fields are immutable and cannot be overwritten through metadata.
• Fiber identity is stable: the thenable Proxy is removed in favor of explicit fiber.await().
• Cleanup failure remains observable on the owning Fiber as FAILED/error and prevents unsafe automatic reactivation until disposal.

Invariants covered by tests

• Context metadata cannot replace fiber, parent, root, or logger.
• Multiple Context views attach their Effects and child Fibers to one owner Fiber.
• Service-loss cleanup failure is retained and prevents automatic recovery over potentially leaked resources.
• Existing composition-loader behavior remains unchanged.

Validation

• Focused plugin kernel and composition loader: 63/63 passing.
• Strict targeted TypeScript compilation: passing.
• Biome check and git diff --check: passing.

Review focus

The main question is whether this ownership split is a better K0 boundary than allowing Context ancestry to participate in lifecycle authority. API naming and compatibility can be adjusted after that boundary is agreed.

Generative tooling disclosure

OpenAI Codex made a substantive contribution to the design, implementation, tests, and PR wording. The commit carries a Generated-by: Codex trailer.

[likun666661]

Purpose

This is a focused ownership-model experiment stacked on #3250 at 7a7acf58b48a6ffcabe19248c3ea681ea20387e2.

It proposes one invariant:

A Fiber is the sole runtime lifecycle and resource owner. A Context is a non-owning capability view created by and permanently bound to exactly one Fiber.

The temporary stacked base branch makes this review show only the ownership refactor. It is not intended to replace main; the branch can be retargeted after the underlying foundation is settled.

Model

Entry desired specification
└─ Fiber runtime projection and sole authority
├─ lifecycle/error/dependencies
├─ child Fibers
├─ Effects/resources
└─ Context canonical plugin-facing capability view
└─ derived views same Fiber, different environment metadata

If an environment needs independent failure, disposal, or resources, it should be represented by a child Fiber rather than another owning Context.

Changes

• Fiber.parent points directly to a parent Fiber; Context ancestry no longer doubles as runtime ownership.
• Every Fiber owns one canonical context; derived Context views must be created by that Fiber.
• Context.plugin() delegates to Fiber.mount() and Context.effect() delegates to Fiber.own().
• Cross-Fiber Context derivation and mounting are rejected.
• Context ownership/topology fields are immutable and cannot be overwritten through metadata.
• Fiber identity is stable: the thenable Proxy is removed in favor of explicit fiber.await().
• Cleanup failure remains observable on the owning Fiber as FAILED/error and prevents unsafe automatic reactivation until disposal.

Invariants covered by tests

• Context metadata cannot replace fiber, parent, root, or logger.
• Multiple Context views attach their Effects and child Fibers to one owner Fiber.
• Service-loss cleanup failure is retained and prevents automatic recovery over potentially leaked resources.
• Existing composition-loader behavior remains unchanged.

Validation

• Focused plugin kernel and composition loader: 63/63 passing.
• Strict targeted TypeScript compilation: passing.
• Biome check and git diff --check: passing.

Review focus

The main question is whether this ownership split is a better K0 boundary than allowing Context ancestry to participate in lifecycle authority. API naming and compatibility can be adjusted after that boundary is agreed.

Generative tooling disclosure

OpenAI Codex made a substantive contribution to the design, implementation, tests, and PR wording. The commit carries a Generated-by: Codex trailer.

[likun666661]

Purpose

This is a focused ownership-model experiment stacked on #3250 at 7a7acf58b48a6ffcabe19248c3ea681ea20387e2.

It proposes one invariant:

A Fiber is the sole runtime lifecycle and resource owner. A Context is a non-owning capability view created by and permanently bound to exactly one Fiber.

The temporary stacked base branch makes this review show only the ownership refactor. It is not intended to replace main; the branch can be retargeted after the underlying foundation is settled.

Model

Entry desired specification
└─ Fiber runtime projection and sole authority
├─ lifecycle/error/dependencies
├─ child Fibers
├─ Effects/resources
└─ Context canonical plugin-facing capability view
└─ derived views same Fiber, different environment metadata

If an environment needs independent failure, disposal, or resources, it should be represented by a child Fiber rather than another owning Context.

Changes

• Fiber.parent points directly to a parent Fiber; Context ancestry no longer doubles as runtime ownership.
• Every Fiber owns one canonical context; derived Context views must be created by that Fiber.
• Context.plugin() delegates to Fiber.mount() and Context.effect() delegates to Fiber.own().
• Cross-Fiber Context derivation and mounting are rejected.
• Context ownership/topology fields are immutable and cannot be overwritten through metadata.
• Fiber identity is stable: the thenable Proxy is removed in favor of explicit fiber.await().
• Cleanup failure remains observable on the owning Fiber as FAILED/error and prevents unsafe automatic reactivation until disposal.

Invariants covered by tests

• Context metadata cannot replace fiber, parent, root, or logger.
• Multiple Context views attach their Effects and child Fibers to one owner Fiber.
• Service-loss cleanup failure is retained and prevents automatic recovery over potentially leaked resources.
• Existing composition-loader behavior remains unchanged.

Validation

• Focused plugin kernel and composition loader: 63/63 passing.
• Strict targeted TypeScript compilation: passing.
• Biome check and git diff --check: passing.

Review focus

The main question is whether this ownership split is a better K0 boundary than allowing Context ancestry to participate in lifecycle authority. API naming and compatibility can be adjusted after that boundary is agreed.

Generative tooling disclosure

OpenAI Codex made a substantive contribution to the design, implementation, tests, and PR wording. The commit carries a Generated-by: Codex trailer.

[likun666661]

Purpose

This is a focused ownership-model experiment stacked on #3250 at 7a7acf58b48a6ffcabe19248c3ea681ea20387e2.

It proposes one invariant:

A Fiber is the sole runtime lifecycle and resource owner. A Context is a non-owning capability view created by and permanently bound to exactly one Fiber.

The temporary stacked base branch makes this review show only the ownership refactor. It is not intended to replace main; the branch can be retargeted after the underlying foundation is settled.

Model

Entry desired specification
└─ Fiber runtime projection and sole authority
├─ lifecycle/error/dependencies
├─ child Fibers
├─ Effects/resources
└─ Context canonical plugin-facing capability view
└─ derived views same Fiber, different environment metadata

If an environment needs independent failure, disposal, or resources, it should be represented by a child Fiber rather than another owning Context.

Changes

• Fiber.parent points directly to a parent Fiber; Context ancestry no longer doubles as runtime ownership.
• Every Fiber owns one canonical context; derived Context views must be created by that Fiber.
• Context.plugin() delegates to Fiber.mount() and Context.effect() delegates to Fiber.own().
• Cross-Fiber Context derivation and mounting are rejected.
• Context ownership/topology fields are immutable and cannot be overwritten through metadata.
• Fiber identity is stable: the thenable Proxy is removed in favor of explicit fiber.await().
• Cleanup failure remains observable on the owning Fiber as FAILED/error and prevents unsafe automatic reactivation until disposal.

Invariants covered by tests

• Context metadata cannot replace fiber, parent, root, or logger.
• Multiple Context views attach their Effects and child Fibers to one owner Fiber.
• Service-loss cleanup failure is retained and prevents automatic recovery over potentially leaked resources.
• Existing composition-loader behavior remains unchanged.

Validation

• Focused plugin kernel and composition loader: 63/63 passing.
• Strict targeted TypeScript compilation: passing.
• Biome check and git diff --check: passing.

Review focus

The main question is whether this ownership split is a better K0 boundary than allowing Context ancestry to participate in lifecycle authority. API naming and compatibility can be adjusted after that boundary is agreed.

Generative tooling disclosure

OpenAI Codex made a substantive contribution to the design, implementation, tests, and PR wording. The commit carries a Generated-by: Codex trailer.

[likun666661]

Purpose

This is a focused ownership-model experiment stacked on #3250 at 7a7acf58b48a6ffcabe19248c3ea681ea20387e2.

It proposes one invariant:

A Fiber is the sole runtime lifecycle and resource owner. A Context is a non-owning capability view created by and permanently bound to exactly one Fiber.

The temporary stacked base branch makes this review show only the ownership refactor. It is not intended to replace main; the branch can be retargeted after the underlying foundation is settled.

Model

Entry desired specification
└─ Fiber runtime projection and sole authority
├─ lifecycle/error/dependencies
├─ child Fibers
├─ Effects/resources
└─ Context canonical plugin-facing capability view
└─ derived views same Fiber, different environment metadata

If an environment needs independent failure, disposal, or resources, it should be represented by a child Fiber rather than another owning Context.

Changes

• Fiber.parent points directly to a parent Fiber; Context ancestry no longer doubles as runtime ownership.
• Every Fiber owns one canonical context; derived Context views must be created by that Fiber.
• Context.plugin() delegates to Fiber.mount() and Context.effect() delegates to Fiber.own().
• Cross-Fiber Context derivation and mounting are rejected.
• Context ownership/topology fields are immutable and cannot be overwritten through metadata.
• Fiber identity is stable: the thenable Proxy is removed in favor of explicit fiber.await().
• Cleanup failure remains observable on the owning Fiber as FAILED/error and prevents unsafe automatic reactivation until disposal.

Invariants covered by tests

• Context metadata cannot replace fiber, parent, root, or logger.
• Multiple Context views attach their Effects and child Fibers to one owner Fiber.
• Service-loss cleanup failure is retained and prevents automatic recovery over potentially leaked resources.
• Existing composition-loader behavior remains unchanged.

Validation

• Focused plugin kernel and composition loader: 63/63 passing.
• Strict targeted TypeScript compilation: passing.
• Biome check and git diff --check: passing.

Review focus

The main question is whether this ownership split is a better K0 boundary than allowing Context ancestry to participate in lifecycle authority. API naming and compatibility can be adjusted after that boundary is agreed.

Generative tooling disclosure

OpenAI Codex made a substantive contribution to the design, implementation, tests, and PR wording. The commit carries a Generated-by: Codex trailer.