Function index_run_supervised

src/mcp/mcp.c:3645–3815

Run index_repository in a supervised worker subprocess with skip-and-continue * (Stage 3c). Returns the response string (caller frees): * - the worker's own response on a clean first run (the common path); * - after a crash/hang, the response from a clean single-threaded RECOVERY run * that quarantines the culprit file(s) — status="indexed" with them listed in * skipped[] as phase

 * Returns NULL only when the worker could not be spawned at all, so the caller
 * degrades to the in-process path. */
static char *index_run_supervised(cbm_mcp_server_t *srv, const char *args) {
    supervisor_invalidate_store(srv);

    /* First attempt: normal parallel run. */
    cbm_index_worker_result_t wr;
    int rc = cbm_index_spawn_worker(args, false, NULL, NULL, &wr);

    if (rc != 0 || wr.outcome == CBM_PROC_SPAWN_FAILED) {
        cbm_index_worker_result_free(&wr);
        supervisor_invalidate_store(srv);
        return NULL; /* degrade to in-process */
    }
    if (wr.outcome == CBM_PROC_CLEAN) {
        /* Clean exit → transfer the worker's response (the common path). If the
         * worker exited clean but wrote no response (a degenerate case, e.g. a
         * self binary that does not act as an index worker), resp is NULL and the
         * caller degrades to the in-process path — a clean run never needs the
         * crash-recovery loop. */
        char *resp = wr.response; /* transfer ownership to caller (may be NULL) */
        wr.response = NULL;
        cbm_index_worker_result_free(&wr);
        supervisor_invalidate_store(srv);
        return resp;
    }

    /* Crash / hang / nonzero exit → skip-and-continue recovery. Re-run the
     * worker PARALLEL (there are no sequential production runs) with the
     * per-file marker JOURNAL armed; after each failed run the journal's
     * open-S set is the in-flight SUSPECT set. A file is quarantined only
     * when it appears in the suspect sets of TWO CONSECUTIVE failed runs
     * (intersection — a stale or merely unlucky in-flight file rotates out),
     * and only ONE file per round: the OLDEST open S in the intersection
     * (for a hang the oldest still-open file IS the stuck one; for a crash
     * it is the longest-running suspect — the best single deterministic
     * pick). A clean run then indexes the good files and reports the
     * quarantined ones as phase="crash"/"hang" skips via the ordinary
     * Stage-2 skip plumbing. The old design re-ran SINGLE-THREADED to keep
     * one exact marker; at scale that fell into the sequential crawl, went
     * quiet, was killed as a hang mid-pass, and the stale marker got FOUR
     * innocent ms-typescript fixtures quarantined one 15-minute retry at a
     * time. */
    cbm_proc_outcome_t last_outcome = wr.outcome;
    cbm_index_worker_result_free(&wr);

    char marker_path[CBM_SZ_1K];
    char quarantine_path[CBM_SZ_1K];
    supervisor_tmp_path(marker_path, sizeof(marker_path), ".marker");
    supervisor_tmp_path(quarantine_path, sizeof(quarantine_path), ".quarantine");
    (void)remove(marker_path);
    /* Start the quarantine list empty (truncate any stale file). */
    FILE *qinit = cbm_fopen(quarantine_path, "wb");
    if (qinit) {
        (void)fclose(qinit);
    }

    int cap = 100;
    const char *cap_env = getenv("CBM_INDEX_MAX_RESTARTS");
    if (cap_env && cap_env[0]) {