[stormer78]

PR 9 of the remediation plan on #589: the runtime restructure.

Closes #528, closes #529, closes #534, closes #555, closes #556, closes #565, closes #557. Part of #535, part of #537.

Changes

#528 StateHandler::main_loop becomes state_handler/runtime/: a Runtime struct holding the loop-local state, one method per select! arm (arms.rs, inbound_arm.rs, timers.rs), and a short router in Runtime::run. The arm bodies moved unchanged. There is a harness that drives single arms and the whole loop.

#529 The join is driven from the loop that owns it, with no nested event loop:

• join_flow/driver.rs is a JoinDriver driven by both the runtime and the State-A loop.
• Resolve, discovery and the five launch stages run off the loop on DispatchDomain::Join.
• A JoinSaga in core (openvtc-core/src/join/) records each step and its compensation. Network steps are split into I/O and apply halves. SubjectSigner reads the signer off the config and signs without it.
• Esc, F10 or an error cancels any stage before the submit, and the saga undoes it. A generation counter drops stale results. Keys pressed while a job runs are queued and replayed in order.
• Submit is past the point of no return. An exit during it waits for it to finish, so the request is recorded and the persona kept. A loop stop mid-submit keeps the persona and listener instead of forgetting them. Inbound from the community being submitted to is held until the pending record exists, then processed. The old nested loop got this by not reading inbound at all.
• Bug fixed: on main, a failed submit (other than a signer failure) forgot the persona even when it was reused, and could remove another persona's key_info. The saga forgets only a persona this join minted.

#534 A PendingReplies table owned by the runtime replaces the three process-global reply-correlation statics in core (renewal, profile queries, elections). TTLs and caps are the same; entries are recorded on the loop before the spawn. community_request.rs holds the shared request/reply engine; rooms and elections run on it, and repos uses its helpers.

#535 (part) Every TUI save goes through SaveScheduler, and settings_actions::save_config is gone. Forced saves flush, which is awaited and still durable before success is reported. flush now leaves the config dirty while an older background save is in flight, so that save cannot have the last word. One spawn shape: a Job trait plus background_dispatch::dispatch, used by most spawners and by community-context's VTA work. Remaining:

• Some spawners still claim and spawn directly, because preparation with side effects precedes the claim: DeleteDid, VRC request, inbox, relationship, witness, mediator reconnect.
• Elections ticket and cast, the Rooms VTA call and the repos probe each need their own job type.
• The vetting jobs claim their domain elsewhere.
• Vetting's and community_context's loop handlers are not reducer + effect, and sync_from_config is not split per panel.

#556 The published state is Arc<State> behind a Shared<T> view, instead of three deep copies per turn. There is no dirty tracking (R23's objection stands). The session-reconcile arm skips the broadcast only when it changed nothing; the 2 s VTA-sync tick always republishes, so time-based displays keep moving.

#555 The post-quantum proof check is remembered per credential. did-git-sign detection runs off the loop, at startup and when a view that shows it opens; sync_from_config no longer reads files.

#565 VTA retry back-off is jittered. OPENVTC_DEBUG_LOG rotates past 50 MiB. Relationship keys are looked up by id prefix through a sorted map. Persona labels and membership counts are maps built once per sync.

#557 (rest) regenerate_persona_keys takes &TDK. Personas hydrate three at a time, in a fixed order; one that fails no longer stops the rest.

#537 (part)

• Runtime arm tests and a join-saga test with a failure injected at every stage.
• The cancel, resolve-queue and stale-outcome tests, and the submit-stage tests.
• A new test-ignored CI job runs the #[ignore]d e2e suites on every PR (SHA-pinned, --locked, 60 min timeout).
• CONTRIBUTING states the policy: a test is ignored only for being slow or needing an in-process service, never for being flaky.
• Coverage floors are not set.

Also: bip39 moves to openvtc-core's dev-dependencies (only tests use it; cargo 1.100 warned).

Review

An independent review traced:

• every exit of main's join flow against the driver: outcomes, messages and persisted effects;
• compensation;
• key queuing;
• PendingReplies;
• Shared<T>;
• the save path.

It found two medium issues. Exit during the submit forgot the persona after the request was sent, and an early community reply could be dropped. Both are fixed here with tests. It also found three low issues, all fixed: the overlapping flush, guards that left a launch locked, and slower time-based redraws.

Behaviour changes (R3.6)

• The app no longer freezes during a join. Esc, F10 or an error cancels and undoes any stage before the submit. During the submit, an exit waits for it.
• "Joining a community failed (internal error)." appears if a join job panics.
• A failed submit no longer forgets a reused persona.
• Personas after one that fails to load are still loaded. Their progress lines can interleave.
• No wire types or config formats changed.

Testing

2,369 passed / 37 ignored on main, and 2,436 passed / 37 ignored on this branch (default features, and also with --no-default-features). --include-ignored: 2,473 passed, 0 failed. -p openvtc --features dev-overrides: 1,100 passed.

All exit 0: cargo fmt --all --check, clippy -D warnings (default, --no-default-features, dev-overrides), RUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps, cargo machete. Not tried against a live stack.

Pre-merge checklist

• No new reqwest::Client::new() / bare fetch(); all clients have finite timeouts (R1.2): none added
• No lock held across a network await (R1.3): join I/O runs in off-loop jobs with owned inputs
• No local state committed before its remote effect, or the flow is resumable with an idempotency key (R2.1): the saga records each step before its effect and compensates in reverse; the submit is not compensated once it may have gone out
• Every retry is bounded + backed off; non-idempotent ops are not blind-retried (R1.4): VTA retry is bounded at 3 and now jittered; persona hydration is bounded at 3 concurrent
• Accept/poll/listen loops survive transient errors (R1.5): the inbound and timer arms are unchanged; held inbound is bounded (64)
• Acks/deletes happen only after durable handoff (R1.6): unchanged
• New/changed wire types: camelCase, deny_unknown_fields where security-relevant, schema registered, all consumers (incl. JS) updated (R3.*): none
• Config absence = most restrictive; fail-closed if enforcement can't start (R5.*): unchanged
• Logs/status claim only what was verified; background-job failures are surfaced (R6.*): a join-job panic is reported; a stopped mid-submit join says the request may have been sent
• "Process dies on the next line" answered for every mutation touched (R2.1): saga compensation plus forced flushes; a flush overlapped by an older save is re-saved
• Deviations from this guide flagged explicitly with rule numbers: none