Scheduler

Scheduler

Concise reference for the verter_scheduler crate.

Live surface (current tree): the submit_request / submit_batch / submit_batch_atomic submission API, the live TaskKind variant set (Source / Analysis / Artifact), owner-affine CPU vs I/O pool routing (OwnerCommand<Cpu> / OwnerCommand<Io>, bounded SchedulerCpuPool::try_submit via try_acquire_owned), and dual pool isolation — the host-injected scheduler stage cpu_pool (+ io_pool) plus the separate host-owned HostCpuPool coordinator shared by every host batch API, with per-batch account_batch_submission accounting. Dual pool isolation is the authority for the live pool model.

submit_batch is non-atomic (N separate Submission::NewRequest items; the pump may observe the batch half-admitted, submit_count bumped per item). submit_batch_atomic lands ONE Submission::NewRequestBatch { requests: Vec<QueuedRequest> } that the driver drains as a unit and admits under a SINGLE dag.lock() acquisition via handle_new_request_batch (generation bumps + supersede sweeps + waiter registration for every request inside one critical section): the pump can never observe a half-admitted batch, one batch is ONE wake + ONE submit_count bump, and a source-updating batch supersedes every file's old generation atomically. Both paths share one admission core — prepare_request (pre-lock: queued-lifetime gate + live-node lookup, dropping the nodes DashMap guard BEFORE locking, the AB-BA-safe DAG-first ordering; it never creates or re-homes a node, carrying the resolved language forward as PreparedRequest.requested_language instead), admit_prepared_under_lock (sole place a request bumps generation, runs the supersede sweep, registers the waiter, admits work — including the LANGUAGE RE-HOME, which advances a published file's generation and therefore must be atomic with its sweep; it resolves the live FileNode and revalidates the queued lifetime first, since removal/reset may have invalidated it during preparation), and an AdmissionPostWork accumulator firing deferred dedup callbacks + clearing auto-ingest tracking AFTER the lock releases. SchedulerDag::register_request returns Option<DedupJoinerEvent> (fired post-unlock via DedupJoinerEvent::fire) instead of invoking on_dedup_joiner under the DAG lock — the callback may re-enter the scheduler, so it must not run while admission holds the mutex.

Source completion advances to Analysis only when Analysis is demanded. Demand is the union of (1) direct Analysis or Artifact request groups, (2) admitted DAG consumers gated on that file-generation's Analysis identity, and (3) pre-admission Artifact blocker-registry entries carrying that identity. A Source-only request is signalled after dependency facts are integrated and then stops; a later Analysis/Artifact request admits the missing stage normally. Checking only direct request waiters is incorrect: an auto-ingested macro dependency may be required by an Artifact blocker before it owns a direct waiter or an admitted downstream node.

Source snapshot publication and Source-stage readiness are distinct. The worker may publish generation-coherent snapshot bytes before the driver has integrated extracted dependencies and late blockers. FileNode therefore carries an explicit ready flag plus integrated-generation fence (generation zero is valid): request admission and the Source already-satisfied short circuit consult current_integrated_source, while completion processing reads the raw current snapshot and advances the fence only after dependency integration under the scheduler state lock. A request arriving in that window joins the still-live Source identity; it must not admit Analysis early or receive an early Source result.

Late Analysis demand is handled by one lock-held ensure_analysis_for_demand transition. Direct Analysis admission and both blocker-registration paths use it. A dependency that legitimately completed a Source-only request can therefore acquire Analysis later; the absence of a live Source identity is not mistaken for a dead producer. Terminal producer failure remains typed for blocker demand, while a direct request retains the same-generation recovery path.

The blocker registry maintains a DepKey-keyed reverse demand refcount at every record/replace/drain/clear/scrub/owner-removal/retirement/reset funnel. has_analysis_demand probes that index directly instead of scanning all owner blocker sets under the global scheduler state lock.

The test for "by construction" is an enumeration, not an intuition. The one structural claim in this area that held — submit being the sole admission primitive — held only because every writer of by_identity was enumerated repository-wide and exactly one insert was found. Two sibling claims made from intuition rather than enumeration ("no public API widening", "the captured node is unusable by construction") were both FALSE: the first because pub mod dag re-exports the module, the second because a leading underscore suppresses a lint and is not access control. Before writing "by construction", enumerate.

File admission requires a live object witness.

WorkNodeIdentity::{FileStage, Artifact} and the corresponding DepKey variants include the process-unique FileNode incarnation as well as generation. SchedulerDag::submit_file accepts the actual node and checks canonical, incarnation, generation and its object-lifetime retirement marker under the lifecycle hold. Its unchecked insertion primitive is private; raw identity submission is test-only. Cache-node admission has a separate entry point. Neither queued work nor a delayed worker can reconstruct authority from a replacement node at the same generation.

Queued requests bind to a submission lifetime during submission under dag.lock(). That lifetime starts with the initial object incarnation and survives language re-home, so later queued source updates still reach the replacement. Removal/reset ends it; a new node receives a fresh lifetime. Work identities still carry the unique object incarnation, and retired objects cannot admit or publish work. prepare_request carries only the lifetime scalar and never creates a replacement for an obsolete inbox item. Fresh requests may load any readable SourceLoader backing after removal; scheduler removal does not permanently suppress paths. A missing backing file produces a terminal dependency failure.

retire_generations_below performs the backward sweep of file waiters, admitted nodes, dependency waiters, blocker records and failure records. It stores no DAG retirement floor. Admission's live-object check rejects later stale work, including gates on stages that were never admitted.

Dependency edges have one representation, dag::dep_edges::DepEdges. A node's deps_remaining maps each DepKey to the edge's sequence number; the store maps the DepKey to its waiters keyed by that sequence (edge-admission order) and indexes every gated file dependency by (canonical, generation) across incarnations. Link and unlink touch both sides in one step, so complete/cancel remove a node's edges by key (no sibling rescans) and retirement reaches waiters of never-admitted producers through the file index alone (no global key scan). Removal drives off the per-canonical node, blocker-owner, blocker-reference and terminal-failure indices; no removal path scans a DAG-wide map. SchedulerDag::dependency_occupancy (and Scheduler::dependency_occupancy) reports the edge store, its file index and the blocker reference index as membership counts plus backing capacity in every build — including the summed capacity of the nested per-generation and per-canonical hash tables, which keep their backing while any member survives; reset releases those tables' backing storage. TaskRegistry::wait_graph_occupancy reports the wait-for graph the same way, including the per-producer waiter sets.

remove marks the object retired, signals Shutdown, cancels work, scrubs records, unpublishes the node and publishes its source-root Absent state under one DAG hold. Stranded-waiter wakes run after unlock. reset uses the same ordering for all members and DAG clear, excluding cooperative admission as well as the stopped driver. Invalidation and close revalidate the sampled object after acquiring the lock.

Scheduler tombstones and DAG retirement floors have no storage. External artifact publication is fenced by a scheduler-minted SourceWitness (canonical, node incarnation, generation), handed out only with a source snapshot by try_get_witnessed_source. commit_artifact(witness, profile, data) publishes only into the live, unretired node object the witness was captured from at the witnessed generation; remove_artifact_not_newer_than(witness, profile) evicts only from that object and only artifacts no newer than the witnessed generation. try_get_source_for_witness gives the host's block-content publication fence the same answer. A witness from a removed, reset or re-homed node is rejected even when its successor serves the same content at the same generation. The scheduler keeps no generation floors: a removed or reset file's successor starts at generation 0. Committed SourceSnapshot and AnalysisSnapshot carry the committing node's incarnation, stamped by the driver, and version() returns a SourceVersion (incarnation, generation) ordered incarnation-first, so a successor's versions order after its predecessor's and never compare equal to them. StageExecutor::execute_source receives the incarnation; the host's revision token (HostSourceRevisionToken carries the committing host's own SourceVersion on every ingress, ingested envelopes included — never the registering owner's identity), its raw-template version rail and its upsert commit fence key on it. Internal admission, dispatch, publication, completion and failure use full incarnation identity.

Preparation must still name a live submission lifetime at admission. Preparation drops the node map guard before taking dag.lock(). The admission core revalidates PreparedRequest.prepared_lifetime against the published node before any mutation. Language re-home preserves this lifetime while allocating a new object incarnation; removal/reset invalidates it. A mismatch terminalizes the sender (Shutdown when absent, Superseded when replaced by another lifetime). Registration precedes work admission, so a refused submit_file must also terminalize the waiter rather than leave it parked.

A node published at submission can still lack admitted Source work. Its current-generation Source admission marker distinguishes this pending producer from a dead producer. Generation advance resets the marker so a queued reload also remains gating before inbox admission. Both explicit blocker registration and Source-completion dependency integration start or track that producer before recording Analysis blockers. The initial generation is advanced above zero before those blockers are built. Explicit registration revalidates its captured owner incarnation/generation under every dependency mutation hold, including iterations after inbox backpressure has executed callbacks. No host callback or inbox send runs under the lifecycle hold.

Generation allocation/advance uses checked arithmetic within one node object: exhaustion refuses further advancement on that node, and leaves no history, rather than wrapping to a generation the same object already published. Across a removal, reset or re-home the successor object restarts its own sequence, and safety comes from its never-reused incarnation, not from the generation: SourceVersion/SourceWitness (and the host's registered-source file incarnation and native-host bind check) compare the incarnation too, so a successor's same-numbered generation never authorizes work for its predecessor.

Generation-advance rule (both directions). A generation advance and its supersede sweep are ONE critical section under dag.lock() (invalidate, close_file, admit_prepared_under_lock including the language re-home). That covers the sweep direction only: the sweep is purely BACKWARD-LOOKING and can never retire an identity admitted after it ran. So admission of DERIVED work needs the matching forward gate. handle_stage_complete checks on entry, then runs extract_deps UNLOCKED — a real window in which an invalidate can retire the generation. So the ONLY thing outside the lock is that executor call (pure computation, unbounded host cost). Everything the Source completion publishes AND everything it CONSUMES — forward edges, the destructive deferred-blocker drain, dependency auto-ingest + admission, the Artifact blocker registry write, Source-waiter signalling, conditional Analysis admission, complete(Source-G) — happens under ONE dag.lock() hold gated on stage_completion_is_current. Consumption matters as much as publication: a stale completion draining a LATER generation's deferred blockers discards them and lets that generation's Artifact work run ungated, and stale forward edges persist because later extraction unions rather than replaces.

The gate is incarnation + generation + generation-coherent committed Source snapshot. The incarnation is FileNode::incarnation_id(), a process-unique monotonic id, and it MUST be carried from dispatch on Submission::StageComplete { incarnation }. Re-deriving it by map lookup compares the live node with itself and passes vacuously — two node objects for the same canonical can sit at the SAME generation, so the generation check cannot catch a replacement either. When Analysis is demanded, it is admitted BEFORE complete(Source-G) so the file is never briefly without a live stage identity (a concurrent dead-producer classification would read that as a Source-failed corpse). A Source-only request intentionally has no downstream identity after completion. On refusal it publishes and consumes NOTHING and calls refuse_stale_stage_completion, which cancels the dequeued identity idempotently — safe against a later generation because WorkNodeIdentity::FileStage carries incarnation and generation — signals the retired generation's waiter groups so a refusal can never strand a request (a no-op when a sweep already drained them), requeues stranded waiters after the lock drops, bumps the test/semantic-observe-only stale_completion_refusals, and only THEN debug_assert!s.

StageExecutor::extract_deps is host-specific. The session host returns only macro type dependencies as blocker_ids, because those are the dependencies the scheduler's Artifact gate consumes. Ordinary imports and external src edges are owned by the workspace parsed-edge graph and MUST NOT be resolved a second time merely to populate the session scheduler's unused forward_deps; session compilation is host-owned rather than execute_artifact-owned. The generic scheduler still records whatever forward_deps another executor returns. Priority inheritance for a completion is likewise canonical-local: highest_priority_for_file reads the DAG canonical reverse-index bucket, never the whole node map.

The same single-hold rule applies one stage down: admit_pending_artifacts holds ONE lock across the profile snapshot and every admission it drives, plus a liveness pre-check. Snapshotting, releasing, then re-locking per profile let an invalidate bump and sweep in the gap, admitting Artifact-G after the sweep.

Node creation must be an atomic ENSURE, never a replace: auto-ingest uses nodes.entry(..).or_insert_with(..), not contains_key + insert. The check-then-act form let a concurrent creator's FileNode be replaced at the same generation, orphaning the incarnation already-dispatched work ran against.

Without these gates the stale identity is admitted and later skipped on the dispatch-time generation-mismatch arm, which never releases the capacity reservation parked at dispatch, so the DAG ledger — the sole admission gate — leaks capacity on every race. BatchHandle carries one CompletionHandle per input in submission order; wait_batch(&self, &BatchHandle) returns results in INPUT order and never surfaces a partial set. Pump discipline is preserved throughout: dispatch / wait / parse / compile / callbacks all run outside the DAG lock, and capacity stays reserved at dequeue time. compile_many IS wired onto atomic batch admission: its source-upsert stage routes every input through VerterHost::upsert_many_with_priority (the upsert engine), which lands ONE submit_batch_atomic + ONE wait_batch for the whole batch rather than one upsert per file. Per-call worker count is NOT a parameter of compile_many — concurrency is the construction-time host-owned HostCpuPool (HostConfig::host_cpu_threads); see Dual pool isolation.

A leaf substrate for the cache-runtime DAG design has LANDED. G3 wired CpuConcurrencySemaphore as the scheduler CPU transport bound: SchedulerCpuPool::try_submit(OwnerCommand<Cpu>) calls try_acquire_owned before rayon::spawn and returns Full when saturated (SchedulerCpuPool::new(threads, transport_capacity), floored at threads * 4, must dominate dag_budget.cpu). Admission<T> is the named admission-outcome type. Still UNWIRED as a submission-path argument: CancellationToken (cancellation.rs), the opaque SchedulerCacheId newtype in cache_id.rs, and the caller-side DedupeHook trait + DedupeJoiner + NoDedupeHook (dedupe_hook.rs). The live submit entry points still return CompletionHandle / BatchHandle, not Admission. Sections below describe each.

The rest of the cache-runtime DAG design target is still NOT on the tree: the submit_dag / CacheNodeDag DAG surface, the KeyedJob / CacheNodeDagNode types, the expanded Load / Parse / CacheNode TaskKind variants, DAG semantics (dependency gating, priority inheritance, cancellation propagation, bounded admission / backpressure), and the wiring of CpuConcurrencySemaphore onto DAG node dispatch (the CPU transport wiring is live — see above). Every section describing those un-landed surfaces carries an explicit "Not yet implemented" banner. The typed SchedulerCpuPool / SchedulerIoPool pools and owner-affine try_submit are on the current tree.

Binding implementation spec: .claude/skills/type-cache-architecture/SKILL.md (Blocks 6 and 7). When in doubt, the plan wins; this skill derives from the plan body.

Driver park and teardown

The submission inbox is bounded to 1024 items. Normal submitters wait for capacity; a driver or single-threaded inline submitter consumes older inbox items if the queue is full, then enqueues its own item. Batches still occupy one slot and are admitted atomically. Wake notifications use try_send: when the inbox is full, its existing items already cause another pump pass. The private teardown channel remains independent of inbox capacity. The pressure contract is inbox_depth_max <= 1024, with no dropped request or stage completion while the scheduler is live. A full inbox can delay a submitter but cannot park its own sole consumer. Stage execution returns its terminal StageComplete to the caller instead of sending it: the inline pump (and a pool worker that inline-ran a dependency) delivers it through the same drain-capable submission path, while a pool task waits for capacity because it is never the inbox's consumer. No parse or stage dispatch is duplicated on that path.

The native driver loop (driver_loop_native) parks between wakes on three things at once, reported as DriverPark: its own private teardown channel (Scheduler::driver_teardown), the shared submission inbox, and an idle re-pump deadline. The idle deadline is a missed-wake backstop for stranded ready work, not priority aging.

The teardown signal never travels through the inbox. The submission inbox is a MULTI-consumer channel — every cooperative pump drains it (drain_inbox_for_pump), the driver's own dispatch loop included — so a teardown posted there can be consumed before the driver reaches its park. The driver would then sleep out the whole idle interval while the thread joining it (reset() / Drop, i.e. every host close()) waits with it. The driver_teardown channel has exactly one consumer, the parked driver, so the signal cannot be swallowed. It has capacity one (a second signal carries no extra meaning) and restart_driver drains it before spawning the next driver, so a signal the outgoing driver never consumed cannot stop the incoming one on arrival.

Guard: teardown_stops_the_driver_when_its_wake_was_consumed_before_the_park.

Crate dependency invariant

verter_scheduler MUST NOT depend on any higher-level crate. Dependency runs one-way: higher-level crates depend on verter_scheduler, never the reverse. The skill never names a symbol living in a higher-level crate — any such reference is a cycle and a violation.

Guard: crates/verter_scheduler/tests/cases/no_session_dep.rs::scheduler_does_not_depend_on_verter_session walks crates/verter_scheduler/Cargo.toml, every .rs file under crates/verter_scheduler/src/** (parsed with syn::parse_file), AND this skill markdown. Asserts NO mention of any higher-level crate appears in any use statement, any dependencies / dev-dependencies table, OR any skill prose substring. The guard treats the skill as a substrate input so a relapse in this file fails the build.

Generic dedupe-hook surface

The DedupeHook trait IS on the current tree, in crates/verter_scheduler/src/dedupe_hook.rs. It is the caller-side pre-admission singleflight hook: the calling crate implements it over its own in-flight table and the scheduler probes it BEFORE a submission reaches the DAG, so a caller already holding an equivalent live flight can skip the scheduler round-trip entirely and attach as a joiner. The scheduler owns NO in-flight cache table — the calling crate deduplicates BEFORE submitting.

DISTINCT from the scheduler-internal post-unlock DedupJoinerEvent (crate::dag): that is the waiter-notify fired after the DAG lock releases, once admission has already joined a request onto an existing waiter group. DedupeHook runs on the caller's side before a submission is even constructed; DedupJoinerEvent runs inside admission. Two different lifecycle points, two different types.

// crates/verter_scheduler/src/dedupe_hook.rs
pub trait DedupeHook: Send + Sync {
    /// Probe whether `identity` is already known to the caller's
    /// in-flight table. If `Some`, the caller blocks on the existing
    /// flight and the scheduler skips enqueue; if `None`, the
    /// submission proceeds to admission as usual.
    fn probe(&self, identity: &WorkNodeIdentity) -> Option<DedupeJoiner>;
}

/// Opaque handle the caller uses to attach a completion as a joiner
/// on an in-flight flight (no public fields).
#[derive(Debug)]
pub struct DedupeJoiner { /* opaque */ }

/// The genuine no-op hook used wherever a caller supplies no in-flight
/// table — `probe` always returns `None`. NOT a stub: its contract IS
/// "never deduplicate".
#[derive(Debug, Clone, Copy, Default)]
pub struct NoDedupeHook;

The probe key is crate::dag::WorkNodeIdentity — the scheduler's own dedupe identity and the single dedupe-identity authority. NO parallel DedupKey type: any public dedupe key is a thin wrapper/derivation of WorkNodeIdentity, never a separate key, so there is one source of truth for dedupe identity (leaf-boundary invariant H20). The trait, DedupeJoiner, and NoDedupeHook are fully owned by verter_scheduler; no method signature or struct field on any references a higher-level crate.

The submission path probes the hook before admission. On Some, the caller blocks on the existing flight and the scheduler skips enqueue (surfaced as Admission::DedupeJoined, see Admission substrate); on None, the submission proceeds to admission. The scheduler never imports any concrete in-flight-table type from a higher-level crate. Wiring the hook into submit_request / submit_dag as an explicit &dyn DedupeHook argument on those entry points is a future sub-block — the trait substrate is landed and unwired.

Admission substrate

Admission<T> (scheduler.rs, LANDED) is the typed result of a submission attempt, generic over the success-handle type T. Exactly three variants — no speculative fourth case:

pub enum Admission<T> {
    /// Admitted into the DAG; carries the caller's handle.
    Admitted(T),
    /// Collapsed onto an in-flight flight by a caller-side
    /// `DedupeHook` probe; carries the opaque `DedupeJoiner`.
    DedupeJoined(crate::dedupe_hook::DedupeJoiner),
    /// Admission declined under the capacity ledger WITHOUT mutating
    /// readiness. The caller retries or blocks on capacity.
    Backpressured,
}

Landed substrate, UNWIRED onto the live entry points: (submit_request / submit_batch / submit_batch_atomic) still return their existing CompletionHandle / BatchHandle shapes, not Admission. Routing those entry points through Admission is a future sub-block.

CancellationToken substrate

CancellationToken (cancellation.rs, LANDED) is a cheap, clonable, thread-safe one-shot latch — a transparent Arc<AtomicBool>. clone() is a refcount bump, cancel() a single Release store, is_cancelled() a single Acquire load; all clones share one flag and cancel() is idempotent. It is the substrate the un-landed DAG design uses for per-node cancellation propagation (CacheNodeDagNode.cancellation_token), but on the current tree it is UNWIRED — no submission path or work node carries one yet.

KeyedJob, DedupKey, and CacheNodeDagNode lifecycle

Not yet implemented — cache-runtime DAG design. The KeyedJob / DedupKey / CacheNodeDagNode / CacheNodeDag / submit_dag types and the whole lifecycle here are the un-landed design target from .claude/skills/type-cache-architecture/SKILL.md; none are on the current tree. Live submission surface: Scheduler::submit_request / submit_batch (returning a BatchHandle) over the live TaskKind set Source / Analysis / Artifact, dispatched onto the host-injected scheduler cpu_pool via nonblocking cpu_pool.try_submit(...) (see Dual pool isolation). Types and steps below describe the intended shape.

Dedupe-identity reconciliation: the LANDED dedupe authority is crate::dag::WorkNodeIdentity (the DedupeHook::probe key — see Generic dedupe-hook surface). The illustrative DedupKey struct below is an earlier draft shape; when the DAG surface lands its dedupe key MUST be WorkNodeIdentity (or a thin derivation of it), NOT a parallel key type. There is one dedupe-identity source of truth.

KeyedJob is the submission identity. CacheNodeDagNode is the ready-queue envelope the driver dispatches. The inbox-level enum driver::Submission is a separate type owning its own discriminator variants.

#[derive(Clone, Debug, PartialEq, Eq, Hash)]
pub struct DedupKey {
    pub canonical: std::sync::Arc<str>,
    pub stage: TargetStage,
    pub content_hash: u64,
}

#[derive(Clone, Debug)]
pub struct KeyedJob {
    pub dedup_key: DedupKey,
    pub stage: TargetStage,
    pub priority: Priority,
    /// World generation under which the job was enqueued. Dispatch
    /// reads `node.keyed_job.generation` directly; `CacheNodeDagNode`
    /// has no `generation()` accessor.
    pub generation: u64,
}

KeyedJob carries NO task / task_kind field. The task discriminator lives on CacheNodeDagNode.task_kind only — one source of truth.

Not yet implemented — cache-runtime DAG design (Block 7). The submit_dag / CacheNodeDag / SchedulerCpuPool / per-task cpu_concurrency_semaphore lifecycle below is the Block 7 design target from .claude/skills/type-cache-architecture/SKILL.md; NOT on the current tree. On the current tree the scheduler exposes submit_request (no submit_dag), the live TaskKind set is Source / Analysis / Artifact, and CPU stage work dispatches via the host-injected scheduler cpu_pool.try_submit(...) (see Dual pool isolation for the authoritative live pool model). Steps below describe the intended DAG flow once Block 7 lands.

Lifecycle (Block 7 design target):

1. Caller-side dedupe. Cache-runtime callers consult their in-flight table FIRST. A matching flight short-circuits — no scheduler submission happens.
2. Submit. Caller invokes Scheduler::submit_request(req) or Scheduler::submit_dag(dag) (optionally passing a DedupeHook). submit_request lands a driver::Submission::NewRequest on the inbox. submit_dag constructs a CacheNodeDag and pushes its ready nodes into the bounded ready queue as upstream gates fire.
3. Scheduler-side dedupe probe. Driver computes dedup_key_for(req) and consults pending_requests (the scheduler's own per-process inbox-level dedupe). A duplicate DedupKey attaches the caller's CompletionSender<RequestResult> as a joiner on the existing flight; no new job enqueued.
4. Admission. A non-dedup submission is admitted to the priority ready queue (Arc<crossbeam_queue::ArrayQueue<Arc<CacheNodeDagNode>>> — the inner Arc is required because CacheNodeDagNode is not Clone: its CacheNodeCompletionSender wraps a single-use tokio::sync::oneshot::Sender, so the same node lives on both the ready queue and DagState.nodes only via Arc-sharing), subject to the bounded-admission policy below. Per-call CPU concurrency is enforced by the worker dispatch site (per-task cpu_concurrency_semaphore.acquire()), not by admission.
5. Execution. Driver pops a ready node and dispatches via TaskKind routing:
   • Load → IoPool::submit;
   • Parse / CacheNode / CPU Analysis / CPU Artifact → SchedulerCpuPool::submit.
6. Completion. pending_requests cleared; every joiner receives the result through their attached CompletionSender<RequestResult>; DAG dependents are re-evaluated for readiness. The worker's per-task CpuConcurrencyPermit drops via RAII immediately after the task body returns, releasing the semaphore counter and notifying one waiter.