refactor(stack): flatten the owner process layers

[jgoux]

Problem

The owner process had accumulated parallel structures:

• RPC handlers that only forwarded to Owner, with errors rewrapped through three types.
• Seven maps keyed by instance id, and the composition held in two places.
• Service-specific routes and credential rules inside Owner.ts.

Definition changes ran on the caller's fiber. A client disconnecting mid-createService could leave an instance in state.json that the live owner didn't know about, or leak a network namespace so that the next destroy failed.

Change

• Owner builds the RPC handlers directly, with one error mapping. OwnerError, the mirrored interface and the pass-through handlers are gone.
• One instance registry and one composition, both owned by the orchestrator.
• Credential rules move to host/Credentials and shared routes to host/Endpoints.
• Definition changes run in the owner scope:
  • A disconnected caller ends only its own wait.
  • Shutdown waits for changes in flight and rejects new ones.
  • Config-changing restarts go through the same gate.
  • A failed creation rolls back credentials it introduced.
• One container sweep path, one snapshot/reset helper, and typed saved state with unique instance ids.
• RPC error messages are always strings.
• Unused orchestrator operations and RPCs are deleted.

Stack

Part 3 of 8 of the stack package simplification, based on #6835. Review and merge in order:

1. fix(stack): stop Postgres containers with a fast shutdown #6834 fix(stack): stop Postgres containers with a fast shutdown
2. fix(stack): harden readiness, port claims, and container storage #6835 fix(stack): harden readiness, port claims, and container storage
3. refactor(stack): flatten the owner process layers #6836 refactor(stack): flatten the owner process layers ← this PR
4. refactor(stack): unify the database snapshot protocol across engines #6837 refactor(stack): unify the database snapshot protocol across engines
5. feat(stack): lease owners with a lock and bind session stacks to creators #6838 feat(stack): lease owners with a lock and bind session stacks to creators
6. feat(stack): ship the functions bootstrap with the package #6839 feat(stack): ship the functions bootstrap with the package
7. refactor(stack): own composition policy and stack lookup in the package #6840 refactor(stack): own composition policy and stack lookup in the package
8. feat(stack): add a testing entrypoint and derive the Promise API #6841 feat(stack): add a testing entrypoint and derive the Promise API

🤖 Generated with Claude Code

[github-actions]

🤖 AI Review

All three findings are confirmed. Saved definitions can become visible before live registration completes; a config restart can delay shutdown while waiting for prerequisite readiness; and a new architecture table attributes a lease to StackHost that the current code does not acquire.

Findings

Severity	Location	Category	Sources	Claim
🟠 MAJOR	packages/stack/src/Owner.ts:414	consistency	codex	Concurrent get/list calls can return a newly saved service before the owner registers it, so start or status can fail for an ID that was just returned.
🟡 MINOR	packages/stack/src/Owner.ts:591	concurrency	claude	A config-changing restart holds the definition gate through prerequisite readiness, delaying shutdown and other definition changes if a prerequisite remains unhealthy.
⚪ NIT	packages/stack/ARCHITECTURE.md:430	documentation	claude	The new module table says StackHost owns a lease, but the current host acquires a control listener and has no separate stack lease.

Stats

Claude findings: 2 · Codex findings: 1 · Confirmed: 3 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[jgoux]

AI review triage

Fixed in eb6b2d2:

• The ARCHITECTURE module table no longer claims a lease on this branch.
  Rejected with evidence: 1 finding (the reasons are in each thread).

Deferred (valid, but out of scope for this PR; recorded here):

• The owner saves a new instance before registering it live, so another client's get/list can briefly return an id that start/status reject as unknown. That's retryable, inherited from the base, and narrowed here. The proper fix is to serve get/list through the owner.

Every review thread on this PR has been answered and resolved.

🤖 Addressed by Claude Code