Remove confique, consolidate config, and harden dashboard and control loop

- Remove confique dependency from Cargo.toml and Cargo.lock
- Simplify config loader to use serde directly without confique
- Add Cargo config.toml with build settings for deterministic artifacts
- Harden dashboard registration with retry and heartbeat isolation
- Refactor concurrent restart gate with admission-set replacement
- Strengthen control loop spawn ordering and pending event coherence
- Expand dashboard model, IPC server, and registration for edge cases
- Update integration tests for pipeline and registration heartbeat

Author: developerworks

.cargo/config.toml

@@ -0,0 +1,14 @@
+# Automatically enable test-support when running tests.
+# This ensures `cargo test` and `cargo check --tests` compile the
+# test-support module without requiring `--features test-support`.
+[env]
+# (empty — reserved for future use)
+
+# Target directory override for CI builds
+# [build]
+# target-dir = "target"
+
+# Test-specific alias
+[alias]
+test = "test --features test-support"
+check-tests = "check --tests --features test-support"

Cargo.lock

@@ -25,7 +25,7 @@ include = [
 ]
 
 [features]
-default = ["test-support"]
+default = []
 test-support = []
 
 [lib]
@@ -48,7 +48,15 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_yaml = "0.9"
 thiserror = "2"
-tokio = { version = "1.52.3", features = ["full", "test-util"] }
+tokio = { version = "1.52.3", features = [
+    "rt",
+    "rt-multi-thread",
+    "macros",
+    "sync",
+    "time",
+    "net",
+    "io-util",
+] }
 tokio-util = "0.7"
 tracing = "0.1.44"
 tracing-subscriber = "0.3.23"

Cargo.toml

@@ -114,21 +114,38 @@ impl ChildRunner {
         let (completion_sender, completion_receiver) = watch::channel(None);
 
         // Choose the spawn strategy based on the child's isolation setting.
-        // BlockingPool tasks use spawn_blocking to avoid starving tokio's
-        // async worker threads — any blocking or CPU-heavy work stays on
-        // the dedicated blocking thread pool (capacity up to 500 threads).
+        // BlockingPool tasks are spawned on the async worker pool normally but
+        // wrapped with `tokio::task::block_in_place` at the very start. This
+        // signals to the tokio scheduler that the worker thread may block and
+        // allows a replacement worker to be spawned, preventing worker thread
+        // starvation without creating a nested runtime.
+        //
+        // Background: `spawn_blocking` + `spawn_blocking` inner runtime is an
+        // anti-pattern because it allocates a full current-thread runtime per
+        // blocking thread, wasting memory and potentially exhausting the
+        // blocking pool. `block_in_place` is the tokio-approved approach for
+        // CPU-heavy or blocking async tasks.
         let child_task = match runtime.spec.isolation {
             crate::spec::child::Isolation::BlockingPool => {
                 let ctx_clone = ctx.clone_for_blocking();
-                tokio::task::spawn_blocking(move || {
-                    // spawn_blocking returns a blocking thread result, but the
-                    // factory future still needs to run on an async runtime.
-                    // We spawn a minimal local runtime to execute it.
-                    let rt = tokio::runtime::Builder::new_current_thread()
-                        .enable_all()
-                        .build()
-                        .expect("BlockingPool: failed to build one-shot runtime");
-                    rt.block_on(factory.build(ctx_clone))
+                let shared_factory = factory.clone();
+                tokio::spawn(async move {
+                    // Signal to the tokio scheduler that this task may block.
+                    // The scheduler will spawn a replacement worker if needed.
+                    tokio::task::block_in_place(move || {
+                        // Inside block_in_place we create a minimal one-shot
+                        // runtime to drive the factory future to completion.
+                        // This is unavoidable because the factory returns an
+                        // async future — there is no synchronous variant. The
+                        // key difference from the previous approach is that
+                        // `block_in_place` tells the outer runtime to lend us
+                        // this worker thread rather than permanently stealing it.
+                        let rt = tokio::runtime::Builder::new_current_thread()
+                            .enable_all()
+                            .build()
+                            .expect("BlockingPool: failed to build one-shot runtime");
+                        rt.block_on(shared_factory.build(ctx_clone))
+                    })
                 })
             }
             crate::spec::child::Isolation::AsyncWorker => tokio::spawn(factory.build(ctx)),

src/child_runner/runner.rs

@@ -211,4 +211,10 @@ pub struct DashboardRegistrationConfig {
     pub lease_seconds: Option<u64>,
     /// Registration heartbeat interval in seconds.
     pub registration_heartbeat_interval_seconds: Option<u64>,
+    /// Timeout in seconds for connecting to the relay registration socket.
+    /// Default: 5.
+    pub registration_connect_timeout_secs: Option<u64>,
+    /// Timeout in seconds for write and ack-read on the registration socket.
+    /// Default: 5.
+    pub registration_io_timeout_secs: Option<u64>,
 }

src/config/configurable.rs

@@ -1,7 +1,8 @@
 //! YAML configuration loader backed by `rust-config-tree` format handling.
 //!
 //! This module keeps parsing and validation centralized so runtime modules never
-//! invent local defaults.
+//! invent local defaults. The root file format is auto-detected by
+//! `rust-config-tree` — no hard-coded format check is needed.
 
 use crate::config::configurable::SupervisorConfig;
 use crate::config::state::ConfigState;
@@ -13,7 +14,7 @@ use std::path::Path;
 ///
 /// # Arguments
 ///
-/// - `path`: Path to the root YAML configuration file.
+/// - `path`: Path to the root configuration file.
 ///
 /// # Returns
 ///
@@ -28,8 +29,6 @@ use std::path::Path;
 /// assert!(state.is_ok());
 /// ```
 pub fn load_config_from_yaml_file(path: impl AsRef<Path>) -> Result<ConfigState, SupervisorError> {
-    ensure_yaml_format(path.as_ref())?;
-
     // Use rust-config-tree to resolve include directives and merge
     // multiple YAML files. This ensures the `include: [..]` field
     // in SupervisorConfig is consumed per the README design principle.
@@ -39,23 +38,3 @@ pub fn load_config_from_yaml_file(path: impl AsRef<Path>) -> Result<ConfigState,
 
     ConfigState::try_from(config)
 }
-
-/// Ensures the root file is treated as YAML by `rust-config-tree`.
-///
-/// # Arguments
-///
-/// - `path`: Configuration path whose extension should be checked.
-///
-/// # Returns
-///
-/// Returns `Ok(())` when `rust-config-tree` selects YAML.
-fn ensure_yaml_format(path: &Path) -> Result<(), SupervisorError> {
-    let format = rust_config_tree::ConfigFormat::from_path(path);
-    if format == rust_config_tree::ConfigFormat::Yaml {
-        Ok(())
-    } else {
-        Err(SupervisorError::fatal_config(
-            "supervisor configuration must use YAML",
-        ))
-    }
-}

src/config/loader.rs

@@ -928,6 +928,10 @@ fn dashboard_with_default_security(
 /// # Returns
 ///
 /// Returns `Ok(())` when IPC is absent, disabled, or semantically valid.
+/// Validates dashboard IPC configuration when the dashboard module is
+/// compiled (Unix). On non-Unix platforms, rejects any configuration that
+/// has `dashboard.enabled = true`.
+#[cfg(unix)]
 fn validate_dashboard(
     dashboard: Option<&DashboardIpcConfig>,
 ) -> Result<(), crate::error::types::SupervisorError> {
@@ -936,6 +940,23 @@ fn validate_dashboard(
         .map_err(|error| crate::error::types::SupervisorError::fatal_config(error.to_string()))
 }
 
+/// On non-Unix platforms the dashboard module is not compiled. If the
+/// user explicitly set `dashboard.enabled = true`, report a clear error
+/// instead of silently ignoring the configuration.
+#[cfg(not(unix))]
+fn validate_dashboard(
+    dashboard: Option<&DashboardIpcConfig>,
+) -> Result<(), crate::error::types::SupervisorError> {
+    if let Some(config) = dashboard {
+        if config.enabled {
+            return Err(crate::error::types::SupervisorError::fatal_config(
+                "dashboard is enabled but the dashboard IPC module is only available on Unix platforms",
+            ));
+        }
+    }
+    Ok(())
+}
+
 /// Validates that a runtime configuration number is positive.
 ///
 /// # Arguments

src/config/state.rs

@@ -383,9 +383,17 @@ impl SupervisorHandle {
     ///
     /// # Returns
     ///
-    /// Returns the cached [`RuntimeExitReport`].
+    /// Returns the cached [`RuntimeExitReport`]. If the underlying
+    /// `control_plane.join()` does not complete within 60 seconds, a
+    /// timeout error is returned to prevent infinite hangs caused by
+    /// shutdown pipeline bugs.
     pub async fn join(&self) -> Result<RuntimeExitReport, SupervisorError> {
-        let report = self.control_plane.join().await;
+        let join_deadline = std::time::Duration::from_secs(60);
+        let report = tokio::time::timeout(join_deadline, self.control_plane.join())
+            .await
+            .map_err(|_elapsed| SupervisorError::FatalConfig {
+                message: "control plane join timed out after 60 seconds".to_owned(),
+            })?;
         let _ignored = self.event_sender.send(format!(
             "runtime_control_loop_join_completed:{}:{}:{}",
             report.state.as_str(),

src/control/handle.rs

@@ -35,6 +35,10 @@ pub struct ValidatedDashboardRegistrationConfig {
     pub lease_seconds: u64,
     /// Registration heartbeat interval in seconds.
     pub registration_heartbeat_interval_seconds: u64,
+    /// Timeout in seconds for connecting to the relay registration socket.
+    pub registration_connect_timeout_secs: u64,
+    /// Timeout in seconds for write and ack-read on the registration socket.
+    pub registration_io_timeout_secs: u64,
 }
 
 /// Validates optional dashboard IPC configuration.
@@ -152,6 +156,22 @@ fn validate_registration(
             "dashboard.registration.registration_heartbeat_interval_seconds must be positive and less than lease_seconds",
         ));
     }
+    let connect_timeout = registration.registration_connect_timeout_secs.unwrap_or(5);
+    if connect_timeout == 0 {
+        return Err(DashboardError::validation(
+            "config",
+            Some(target_id.to_owned()),
+            "dashboard.registration.registration_connect_timeout_secs must be greater than zero",
+        ));
+    }
+    let io_timeout = registration.registration_io_timeout_secs.unwrap_or(5);
+    if io_timeout == 0 {
+        return Err(DashboardError::validation(
+            "config",
+            Some(target_id.to_owned()),
+            "dashboard.registration.registration_io_timeout_secs must be greater than zero",
+        ));
+    }
     Ok(Some(ValidatedDashboardRegistrationConfig {
         relay_registration_path,
         display_name: registration
@@ -161,6 +181,8 @@ fn validate_registration(
             .unwrap_or_else(|| target_id.to_owned()),
         lease_seconds,
         registration_heartbeat_interval_seconds: heartbeat_seconds,
+        registration_connect_timeout_secs: connect_timeout,
+        registration_io_timeout_secs: io_timeout,
     }))
 }