RFC-035: Served operation ownership

[aaltshuler]

Summary

Defines the server lifetime boundary for every served graph operation.

Key decisions:

• one generation-pinned admission cell with independently closeable read-observer and write lanes;
• admitted writes move into cancellation-independent server-owned tasks, while reads remain request-owned and generation-pinned through body completion;
• disconnect, timeout, or receiver loss never replays a write and never pretends to roll it back;
• bounded transition drain returns exact proof or DrainPending without aborting work or granting recovery authority;
• same-process generation replacement is proof-gated, while cross-process replacement remains stop-before-start;
• one absolute shutdown deadline covers connections, generations, and registered task sets, with an enforced process cutoff.

This is a design document only. It changes no runtime or storage format.

Scope boundary

RFC-035 owns admission, operation lifetime, cancellation, transition drain, and shutdown. It does not classify recovery, build runtime generations, schedule recovery, or classify substrate errors.

Series

• RFC-034 durable recovery authority: RFC-034: Durable recovery authority and outcomes #496
• RFC-036 atomic runtime activation and graph supervision: RFC-036: Atomic runtime activation and graph supervision #499
• Replaces the implementation direction in feat(server): own writes beyond request cancellation #490.
• PR Carry a typed classification on storage failures #491 remains independent and unchanged.

Recommended review and merge order: RFC-034, RFC-035, RFC-036.

Validation

• AGENTS and docs index check
• Markdown whitespace checks
• all external references returned HTTP 200
• independent adversarial and cross-series reviews; final result: no findings

Greptile Summary

The PR adds RFC-035, defining ownership and lifecycle boundaries for served graph operations.

• Keeps reads request-owned while pinning their served generation through response completion.
• Transfers admitted writes into server-owned tasks that survive request cancellation.
• Defines independently closeable admission lanes, proof-gated generation transitions, and a single absolute shutdown deadline.
• Specifies lifecycle errors, observability requirements, and implementation acceptance tests.

Confidence Score: 5/5

The documentation-only PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
docs/rfcs/0035-served-operation-ownership.md	Adds a design-only specification for generation-pinned reads, server-owned writes, transition draining, and process-wide shutdown ownership without changing runtime behavior or storage formats.

_{Reviews (2): Last reviewed commit: "docs(rfc): define served operation owner..." | Re-trigger Greptile}