Function index_run_supervised

src/mcp/mcp.c:7772–7974

Run index_repository in a supervised worker subprocess with skip-and-continue * (Stage 3c). Returns the response string (caller frees): * - the worker's own response on a clean first run (the common path); * - after a crash/hang, the response from a clean single-threaded RECOVERY run * that quarantines the culprit file(s) — status="indexed" with them listed in * skipped[] as phase

 * A physical CBM host never falls back to its in-process pipeline: an initial
 * start/protocol failure is returned as an explicit error response. */
static char *index_run_supervised(cbm_mcp_server_t *srv, const char *args) {
    invalidate_cached_store(srv);

    /* First attempt: normal parallel run. */
    cbm_index_worker_result_t wr;
    int rc = cbm_index_spawn_worker_with_log_cancel(
        args, false, NULL, NULL, srv ? srv->index_log_callback : NULL,
        srv ? srv->index_log_context : NULL, srv ? &srv->pipeline_cancel_requested : NULL, &wr);
    cbm_mcp_supervised_result_disposition_t disposition =
        cbm_mcp_supervised_result_disposition(rc, &wr);

    if (disposition == CBM_MCP_SUPERVISED_RESULT_FALLBACK) {
        cbm_proc_outcome_t outcome = wr.outcome;
        cbm_index_worker_result_free(&wr);
        invalidate_cached_store(srv);
        return build_worker_failure_response(args, outcome);
    }
    if (disposition == CBM_MCP_SUPERVISED_RESULT_UNSAFE_TERMINAL) {
        char *failure =
            build_worker_unsafe_terminal_response(args, wr.outcome, wr.cancellation_requested);
        cbm_index_worker_result_free(&wr);
        invalidate_cached_store(srv);
        return failure;
    }
    if (disposition == CBM_MCP_SUPERVISED_RESULT_SUCCESS) {
        /* Clean exit → transfer the worker's response (the common path). */
        char *resp = wr.response; /* transfer ownership to caller (may be NULL) */
        wr.response = NULL;
        cbm_index_worker_result_free(&wr);
        invalidate_cached_store(srv);
        return resp;
    }

    /* Crash / hang / nonzero exit → skip-and-continue recovery. Re-run the
     * worker PARALLEL (there are no sequential production runs) with the
     * per-file marker JOURNAL armed; after each failed run the journal's
     * open-S set is the in-flight SUSPECT set. A file is quarantined only
     * when it appears in the suspect sets of TWO CONSECUTIVE failed runs
     * (intersection — a stale or merely unlucky in-flight file rotates out),
     * and only ONE file per round: the OLDEST open S in the intersection
     * (for a hang the oldest still-open file IS the stuck one; for a crash
     * it is the longest-running suspect — the best single deterministic
     * pick). A clean run then indexes the good files and reports the
     * quarantined ones as phase="crash"/"hang" skips via the ordinary
     * Stage-2 skip plumbing. The old design re-ran SINGLE-THREADED to keep
     * one exact marker; at scale that fell into the sequential crawl, went
     * quiet, was killed as a hang mid-pass, and the stale marker got FOUR
     * innocent ms-typescript fixtures quarantined one 15-minute retry at a
     * time. */
    cbm_proc_outcome_t last_outcome = wr.outcome;
    cbm_index_worker_result_free(&wr);

    char marker_path[CBM_SZ_1K];
    char quarantine_path[CBM_SZ_1K];
    supervisor_tmp_path(marker_path, sizeof(marker_path), ".marker");
    supervisor_tmp_path(quarantine_path, sizeof(quarantine_path), ".quarantine");
    (void)remove(marker_path);
    /* Start the quarantine list empty (truncate any stale file). */