[0xmhha]

Summary

ResumeRun (v0.4.0) exists so that output after a dropped stream can be recovered. That only works if the run keeps going after the drop. This PR documents the change in run lifecycle; the backend implements it in kingsejong-lang/playground-backend#8. Docs only; the .proto files are unchanged.

Design

• RPC_DESIGN §2: a run outlives its stream.
  • Closing the stream before Accepted cancels the call, and nothing runs.
  • After Accepted, a closed or lost stream does not stop the run. This covers an aborted fetch, a network drop and a gateway restart. The run continues until it finishes, hits a limit or is cancelled.
  • Stop means Cancel.
  • The run keeps its concurrency slot until Finished.
• RPC_DESIGN table. Cancel no longer says "(+ aborting the stream)".
• SECURITY_PROTOCOL L5. A run counts toward the concurrency limit until Finished, including after its stream dropped.
• SECURITY_PROTOCOL L7. Closing a stream ends only the stream. The run stays bounded by its wall-time limit.
• SECURITY_PROTOCOL §6. Losing a gateway pod drops streams, but not the runs behind them. Clients reattach with ResumeRun instead of GetExecution.

Testing

• Docs only, so the rendered Markdown was reviewed.
• The behaviour is tested in playground-backend#8 (unit, gateway and stack tests).

Not verified

• The comment on ExecutionService.Cancel in execution.proto still reads "e.g. from another tab". It is left unchanged because this PR changes no proto files, and it can be reworded in the next contract release.