refactor(daemon): move singletons into per-daemon layers

[FreshlyBrewedCode]

Part of #32 · Closes #38

Four maps lived at module scope: server/runs.ts's active-run registry, server/pubsub.ts's subscribers, lib/dedupe.ts's dedupeRegistry, and lib/workspace.ts's refreshGates. So two daemons could not run in one process, and every feature since #13 had to add another optional test-seam field (dedupeRegistry?, registry?, now?, beforeStart?). This PR turns them into per-daemon Effect services composed into the daemon's ManagedRuntime (ADR 0009 §5) and removes those seams. The daemon also cancels its active runs on shutdown.

What changed

Per-daemon state as Effect layers

• RunRegistry, RunPubSub, DedupeRegistry and RefreshGates are now Context.Services, each with a Layer that builds fresh state.
• src/server/daemon-runtime.ts merges them with AgentRuntimeLayer (feat(runtime): add Effect composition root and agent runtime service #56) into DaemonLayer. startDaemon builds one ManagedRuntime per daemon and builds the layers eagerly at startup (await runtime.context()).
• startTrackedRun, dispatchChildRun, makeScheduleFire and the HTTP handlers read services from the runtime with serviceOf(runtime, Service). The HTTP handlers stay plain functions. The scheduler loop runs on the daemon runtime and reads DedupeRegistry and Clock.Clock from context.
• dedupeRegistry?, registry?, now? and beforeStart? are gone. Tests build a fresh runtime with createTestDaemon(adapter).
• src/server/two-daemons.test.ts starts two full daemons in one process. It asserts separate run lists, registries, pubsub streams and dedupe keys, and that the two runtimes share no service instance.

Cancel active runs on shutdown

• DaemonHandle.stop() (idempotent) runs these steps in order:
  1. interrupt the scheduler
  2. RunRegistry.shutdown(timeout): close admission (DaemonShuttingDownError, which HTTP returns as 503), cancel running handles and reserved slots, and wait a bounded time for them to settle
  3. server.stop (live SSE clients still see the cancellations)
  4. runtime.dispose()
  5. wait briefly for cancelled runs to record their end
• An acquireRelease finalizer on the registry layer also cancels runs if the runtime is disposed without stop().
• factory serve's SIGINT/SIGTERM handler calls stop(). Runs are recorded as RunCancelled instead of reading back as interrupted after a restart, and exec and opencode child processes are killed.
• Agent-step cancel used to wait up to ~20s, because Stream.fromAsyncIterable's finalizer awaited the generator's return(), which queues behind a pending next(). The adapter iterable is now wrapped: next() races the abort signal, and return() resolves immediately while the adapter tears down in the background. That teardown is capped at 1s (AGENT_TEARDOWN_GRACE_MS), because @tanstack/ai can hold an aborted stream open forever; the sandbox kills opencode's process group on abort. POST /cancel during an agent step now takes ~25ms instead of ~22s.

Also

• startTrackedRun checks admission before claiming the dedupe key, so a start refused at the concurrency limit no longer holds its key. Before this, an overlap: "skip" schedule stuck on skipped-overlap until restart. This bug is also on main.
• Every start now reserves a registry slot, so shutdown can see runs that are still allocating a workspace. A second start with a run id that is still reserving is refused instead of starting twice.
• Restored the refactor(runtime): move headless permission setup into the agent adapter #55 prepareWorkspace wiring that an earlier rebase had dropped, along with the rationale comments and Represent domain failures as Schema.TaggedError #34 tests deleted in that rebase.

Notes for reviewers

• Atomicity (D24/D29, Dedupe keys on run start #15): all layers are synchronous, and services are resolved before the critical section. The closed check, admission, dedupe claim and slot reservation run as one synchronous stretch with no await or yield between them. M1 and L1 hold the reservation window open with a gate in refreshGates instead of depending on clone timing. Two tests cover a synchronous double start: one with a limit (ConcurrencyLimitError) and one with the same run id (refused).
• startRun takes an AgentRunner (runFork/runPromise) instead of ManagedRuntime<AgentRuntime>. ManagedRuntime isn't assignable from a runtime that provides more services, and this avoids a cast.

Verification

• bun run check: 347 pass, 0 fail. bun run test:e2e: 15/15.
• New tests in src/server/shutdown.test.ts:
  • an exec run cancelled by stop
  • a reserved slot cancelled by stop
  • stop is idempotent
  • dispose without stop still cancels
  • an adapter that never yields again is cancelled in <500ms
  • stop finishes within its bound when teardown hangs
• Smoke test against a real daemon with opencode/big-pickle:
  • A normal run completes with structured output and usage intact.
  • With an agent step waiting on the model plus an exec sleep 300 run, SIGTERM and SIGINT exit 143/130 in about 1s. A start sent during shutdown gets 503. After restart both runs read RunCancelled, and no opencode or sleep processes are left.

Stack

1. refactor(cli): replace hand-rolled parsers with effect/unstable/cli #52: Parse CLI with Effect CLI (issue Parse CLI arguments with effect/unstable/cli #33)
2. refactor(errors): represent domain failures as Schema.TaggedError #53: Domain errors as tagged errors (issue Represent domain failures as Schema.TaggedError #34)
3. refactor(runtime): move chunk interpretation into the agent adapter #54: Move chunk interpretation into adapter (issue Move chunk interpretation into the agent adapter #35)
4. refactor(runtime): move headless permission setup into the agent adapter #55: Move headless permission setup into the agent adapter (issue Move headless permission setup out of the workspace allocator #37)
5. feat(runtime): add Effect composition root and agent runtime service #56: Agent runtime service (issue Add an Effect composition root and make the agent runtime a service #36)
6. refactor(daemon): move singletons into per-daemon layers #57: Move singletons into per-daemon layers (issue Move the daemon's remaining singletons into layers #38) ← this PR

🤖 Generated with Claude Code