Independently supervised execution, recovery, and mid-task input coordination.

Jobs are protected by renewable store claims. A claim generation fences an expired worker from committing after another runner has recovered the same descriptor. Recovery is intentionally at-least-once: applications should use Snodo.Extensions.Tasks.Work.idempotency_key for external side effects.

Executors may explicitly return {:retry, error, status_message}. The descriptor's finite retry policy is applied by the durable transition, the claim is released during backoff, and store-authoritative claim eligibility remains the source of truth after local timers or process restarts.

Request contexts and transport handles never enter runner state. An optional application-owned Snodo.Extensions.Tasks.WorkExecutor resolves persisted work on both the initial claim and every recovery claim.

Configure :instrumentation with an Snodo.Instrumentation sink to observe job starts/stops and every store transition attempted by the runner. Events include task identity and lifecycle classifications, never work input, authorization values, results, errors, or input responses.

Limits

• :max_jobs - the most workers this runner runs at once, default 32. create_task/5 refuses a new task at the limit with {:error, {:capacity_exceeded, :max_jobs}} before storing it, and start_task/4 returns the same error and leaves the stored task unclaimed. A due retry waits for a free slot, and recovery claims no more work than the free slots. The count is this runner's own: its workers are processes in this BEAM, and none survive a restart.
• :max_runtime_ms - how long one worker may run, default 3,600,000 (one hour), or :infinity. The time counts from the claim that started the worker and includes time spent waiting for input. A worker that runs longer is stopped and its task fails.
• :reap_interval_ms - how often the runner calls Store.reap/1, default 60,000. nil turns periodic reaping off.

The store limits on stored and active tasks are options of each store.