feat(GA): close P0-5 (single-instance caps) + P1-2 (unbounded growth)

Lands the two GA-gating launch-readiness items, scoped to the v1
single-instance topology decision.

P0-5 (realtime/feed in-memory, no cluster coordination) — accepted as
single-instance/non-HA for v1 with memory backstops:
- InMemoryFeedAdapter defaults maxItems to DEFAULT_MAX_FEED_ITEMS (100k)
- InMemoryRealtimeAdapter defaults maxSubscriptions to DEFAULT_MAX_SUBSCRIPTIONS (50k)
- 0 = explicit unbounded opt-out; both plugins document the non-HA contract
- HA (Redis realtime adapter + DB feed adapter) recorded as post-GA roadmap

P1-2 (unbounded execution logs / job runs / event log):
- service-job: new JobRunRetention sweeper (mirrors NotificationRetention),
  default-on at 30d, swept every 6h via an unref'd timer wired in
  JobServicePlugin kernel:ready (DB path); retentionDays:0 disables
- service-messaging: retention flipped default-on (0 -> 90d). Behaviour
  change: notification history now auto-prunes at 90d (set 0 to keep forever)
- service-automation: exec-log ring buffer cap made configurable via
  AutomationServicePluginOptions.maxLogSize (default unchanged at 1000)

+11 tests across feed/realtime/job/automation; all touched packages build
(incl. DTS) and test green. launch-readiness.md updated (P0-5/P1-2 verified,
topology checkbox, HA roadmap). Changesets included.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

.changeset/ga-p0-5-single-instance-caps.md

@@ -0,0 +1,25 @@
+---
+"@objectstack/service-feed": minor
+"@objectstack/service-realtime": minor
+---
+
+feat(P0-5): default-on memory caps for in-memory feed/realtime (single-instance GA)
+
+Launch-readiness P0-5 is resolved by formally scoping v1 to **single-instance**
+(non-HA) and shipping memory backstops so the process-local adapters can't grow
+until OOM:
+
+- `InMemoryFeedAdapter` now defaults `maxItems` to `DEFAULT_MAX_FEED_ITEMS`
+  (100k) instead of unbounded. `createFeedItem` throws loudly at the cap
+  (fail-loud beats a silent OOM kill).
+- `InMemoryRealtimeAdapter` now defaults `maxSubscriptions` to
+  `DEFAULT_MAX_SUBSCRIPTIONS` (50k).
+- Passing `0` is an explicit unbounded opt-out (tests / short-lived processes).
+- Both plugin JSDocs now state the non-HA contract; HA (a Redis-backed realtime
+  adapter over the existing `RedisPubSub`, and a DB-backed feed adapter) is a
+  documented post-GA fast-follow.
+
+**Behaviour change:** a deployment that previously relied on unbounded in-memory
+feed/realtime will now hit the cap and receive an error past the ceiling — set
+`maxItems: 0` / `maxSubscriptions: 0` to restore the old behaviour, or raise the
+number.

.changeset/ga-p1-2-job-run-retention.md

@@ -0,0 +1,19 @@
+---
+"@objectstack/service-job": minor
+---
+
+feat(P1-2): default-on retention for the sys_job_run execution log
+
+Every job execution appended a `sys_job_run` row with no cleanup path, so the
+table grew unbounded on long-running deployments (launch-readiness P1-2). New
+`JobRunRetention` (mirroring `service-messaging`'s `NotificationRetention`)
+performs a bulk `delete sys_job_run where created_at < cutoff` under a system
+context. `JobServicePlugin` wires it **default-on** at `kernel:ready` (DB-backed
+adapter only) — runs once on boot then every 6h via an unref'd timer.
+
+- `retentionDays` defaults to `DEFAULT_JOB_RUN_RETENTION_DAYS` (30); set `0` to
+  disable (rows kept forever; operator owns cleanup).
+- `retentionSweepMs` defaults to `DEFAULT_JOB_RUN_SWEEP_MS` (6h).
+
+**Behaviour change:** job-run history older than 30 days is now pruned by
+default. Set `retentionDays: 0` to keep the previous keep-forever behaviour.

.changeset/ga-p1-2-messaging-automation-retention.md

@@ -0,0 +1,20 @@
+---
+"@objectstack/service-messaging": minor
+"@objectstack/service-automation": minor
+---
+
+feat(P1-2): messaging retention default-on; automation log cap configurable
+
+Closes the remaining two P1-2 unbounded-growth items (launch-readiness):
+
+- **service-messaging** — notification-pipeline retention is now **default-on**.
+  `MessagingServicePlugin`'s `retentionDays` defaults to
+  `DEFAULT_NOTIFICATION_RETENTION_DAYS` (90) instead of `0`; the
+  already-built/tested sweeper now prunes `sys_notification` (+ delivery / inbox /
+  receipt) older than 90 days by default. **Behaviour change:** notification
+  history auto-prunes at 90d — set `retentionDays: 0` to keep it forever.
+- **service-automation** — the in-memory execution-log ring buffer (already
+  bounded; no OOM risk) gets a tunable window via
+  `AutomationServicePluginOptions.maxLogSize`, defaulting to
+  `DEFAULT_MAX_EXECUTION_LOG_SIZE` (1000, unchanged). Durable
+  `sys_automation_run`-style persistence remains a post-GA HA item.

docs/launch-readiness.md

@@ -97,7 +97,17 @@ fix or acceptance.**
 - **Action (cluster launch):** Provide a Redis-backed realtime adapter and a
   DB-backed feed adapter, **or** formally restrict v1 to single-instance and
   document it as non-HA. Enforce a `maxItems` cap if shipping in-memory feed.
-- **Owner:** _______  ·  Verify ☐  ·  Sign-off ☐  ·  Notes: _______
+- **Decision = single-instance for v1 (non-HA).** Recorded: realtime/feed stay
+  process-local for GA; HA is a post-GA fast-follow (the Redis primitive already
+  exists — `service-cluster-redis`'s `RedisPubSub` — so the realtime adapter is a
+  wrap, and a DB-backed feed adapter is the larger remaining piece). Both plugin
+  JSDocs now state the non-HA contract explicitly.
+- **Backstops shipped:** safety caps are now **default-on** — `InMemoryFeedAdapter`
+  caps at `DEFAULT_MAX_FEED_ITEMS` (100k) and `InMemoryRealtimeAdapter` at
+  `DEFAULT_MAX_SUBSCRIPTIONS` (50k); `createFeedItem`/`subscribe` throw loudly at
+  the cap (fail-loud beats silent OOM). `0` is an explicit unbounded opt-out
+  (tests / short-lived processes). +4 tests (default-cap + opt-out, both packages).
+- **Owner:** _______  ·  Verify ✅ (confirmed real @ `main`)  ·  Sign-off ☐  ·  Notes: **Accepted for v1 as single-instance/non-HA**; caps default-on + documented. HA adapters tracked as post-GA roadmap. Awaiting human sign-off.
 
 ---
 
@@ -130,7 +140,27 @@ fix or acceptance.**
 - **Risk:** Long-running pods OOM; history tables grow without bound.
 - **Action:** Make retention **default-on** for all event/run tables; schedule
   sweepers at startup; persist automation logs to a table rather than memory.
-- **Owner:** _______  ·  Verify ☐  ·  Sign-off ☐  ·  Notes: _______
+- **Verification finding (corrected scope):** only one of the three is truly
+  unbounded. **automation** exec logs are *already* a bounded 1000-entry ring
+  buffer (`engine.ts` `recordLog` — `splice`); memory-safe today, never persisted
+  → no OOM risk. **`sys_job_run`** is the real leak: append-only, zero retention.
+  **messaging** retention was fully built + tested (`NotificationRetention`) but
+  shipped opt-in (`retentionDays: 0`).
+- **Fixes shipped:**
+  - **service-job** — new `JobRunRetention` (mirrors `NotificationRetention`):
+    bulk `delete sys_job_run where created_at < cutoff` under a system context,
+    **default-on** at `DEFAULT_JOB_RUN_RETENTION_DAYS` (30d), swept every 6h via
+    an unref'd timer wired in `JobServicePlugin`'s `kernel:ready` (DB path only);
+    `retentionDays: 0` disables. +5 tests.
+  - **service-messaging** — flipped `retentionDays` default `0 → 90`
+    (`DEFAULT_NOTIFICATION_RETENTION_DAYS`); sweeper/timer/shutdown already
+    existed. **Behaviour change**: notification history now auto-prunes at 90d by
+    default (set `0` to keep the old keep-forever behaviour). Changeset notes it.
+  - **service-automation** — exec-log ring buffer cap made configurable via
+    `AutomationServicePluginOptions.maxLogSize` (default unchanged at 1000,
+    `DEFAULT_MAX_EXECUTION_LOG_SIZE`); +2 tests. Durable `sys_automation_run`-style
+    persistence is deferred to the HA fast-follow (roadmap), not a GA blocker.
+- **Owner:** _______  ·  Verify ✅ (confirmed real @ `main`; scope corrected)  ·  Sign-off ☐  ·  Notes: `sys_job_run` retention is the one true fix; messaging default-flipped; automation already bounded (now tunable). Awaiting human sign-off.
 
 ### P1-3 — Graceful shutdown (mostly a false positive; one real drain bug fixed)
 - **Area:** `core` (`kernel.ts`), `cli` (`serve.ts`), `plugin-hono-server` (`adapter.ts`)
@@ -196,6 +226,10 @@ notes, not treated as blockers.
 - ☐ **Unverified features — confirm stub vs. minimal, then include or exclude:**
   `knowledge-ragflow`, `connector-openapi` (the sweep could not locate full
   implementations; the packages exist — verify scope before GA).
+- ☐ **HA / multi-node (post-GA fast-follow, from P0-5 decision):** Redis-backed
+  realtime adapter (wrap `service-cluster-redis`'s `RedisPubSub`), DB-backed feed
+  adapter, and persisting automation execution logs to a table (currently a
+  process-local 1000-entry ring buffer — see P1-2). Not needed for single-instance v1.
 - ☐ **Proposed ADRs (roadmap):** ADR-0021 (analytics semantic layer),
   ADR-0022/0023/0024 (connectors / OpenAPI→connector / MCP connectors),
   ADR-0025/0026 (plugin & client-UI distribution), ADR-0027 (metadata authoring
@@ -211,7 +245,8 @@ notes, not treated as blockers.
 - ☐ Pending changesets reviewed (4 at last check) and version bump intentional.
 - ☐ `pnpm run release` path verified (`build` → `build-console.sh` → `changeset publish`).
 - ☐ Required env vars documented for go-live (at minimum `OS_AUTH_SECRET`; see P0-1).
-- ☐ Deployment topology decided: **single-instance** vs. **HA/cluster** (drives P0-5).
+- ☑ Deployment topology decided: **single-instance** for v1 (drives P0-5; HA is a
+  post-GA fast-follow). Realtime/feed run process-local with default-on memory caps.
 
 ---
 

packages/services/service-automation/src/engine.test.ts

@@ -2,7 +2,7 @@
 
 import { describe, it, expect, beforeEach } from 'vitest';
 import { LiteKernel } from '@objectstack/core';
-import { AutomationEngine } from './engine.js';
+import { AutomationEngine, DEFAULT_MAX_EXECUTION_LOG_SIZE } from './engine.js';
 import { AutomationServicePlugin } from './plugin.js';
 import { registerScreenNodes } from './builtin/screen-nodes.js';
 import { InMemorySuspendedRunStore } from './suspended-run-store.js';
@@ -30,6 +30,30 @@ describe('AutomationEngine', () => {
         engine = new AutomationEngine(createTestLogger());
     });
 
+    describe('Execution-log ring buffer (P1-2)', () => {
+        it('defaults the cap to DEFAULT_MAX_EXECUTION_LOG_SIZE', () => {
+            const e = new AutomationEngine(createTestLogger());
+            expect(DEFAULT_MAX_EXECUTION_LOG_SIZE).toBeGreaterThan(0);
+            expect((e as unknown as { maxLogSize: number }).maxLogSize).toBe(
+                DEFAULT_MAX_EXECUTION_LOG_SIZE,
+            );
+        });
+
+        it('honours a configured maxLogSize and evicts oldest beyond it', async () => {
+            const e = new AutomationEngine(createTestLogger(), undefined, { maxLogSize: 3 });
+            expect((e as unknown as { maxLogSize: number }).maxLogSize).toBe(3);
+
+            // Drive the private ring buffer directly: push 5, keep newest 3.
+            const rec = (e as any).recordLog.bind(e);
+            for (let i = 0; i < 5; i++) {
+                rec({ id: `run_${i}`, flowName: 'f', status: 'success' });
+            }
+            const buf = (e as unknown as { executionLogs: Array<{ id: string }> }).executionLogs;
+            expect(buf).toHaveLength(3);
+            expect(buf.map((l) => l.id)).toEqual(['run_2', 'run_3', 'run_4']);
+        });
+    });
+
     describe('Node Executor Registration', () => {
         it('should register a node executor', () => {
             const executor: NodeExecutor = {

packages/services/service-automation/src/engine.ts

@@ -197,6 +197,26 @@ export interface ConnectorDescriptor {
 
 // ─── Core Automation Engine ─────────────────────────────────────────
 
+/**
+ * Default ceiling on the in-memory execution-log ring buffer. Execution logs are
+ * process-local and diagnostic only (launch-readiness.md P1-2); the buffer keeps
+ * the most recent N entries and evicts the oldest, so memory is bounded
+ * regardless of throughput. Operators tune the window via
+ * {@link AutomationServicePluginOptions.maxLogSize}. Durable, queryable run
+ * history is the DB-backed `sys_automation_run` store (a post-GA HA item), not
+ * this buffer.
+ */
+export const DEFAULT_MAX_EXECUTION_LOG_SIZE = 1000;
+
+/** Construction options for {@link AutomationEngine}. */
+export interface AutomationEngineOptions {
+    /**
+     * Max in-memory execution-log entries retained (ring buffer; oldest evicted).
+     * Defaults to {@link DEFAULT_MAX_EXECUTION_LOG_SIZE}. Must be > 0.
+     */
+    maxLogSize?: number;
+}
+
 /**
  * Execution step log entry. Part of a {@link SuspendedRun}'s persisted state, so
  * it survives serialization to a durable {@link SuspendedRunStore}.
@@ -334,7 +354,7 @@ export class AutomationEngine implements IAutomationService {
     /** Connectors registered by integration plugins, keyed by connector name (ADR-0018 §Addendum). */
     private connectors = new Map<string, RegisteredConnector>();
     private executionLogs: ExecutionLogEntry[] = [];
-    private maxLogSize = 1000;
+    private readonly maxLogSize: number;
     private logger: Logger;
     /**
      * Runs paused at a node, keyed by runId (ADR-0019). In-memory hot cache —
@@ -354,9 +374,10 @@ export class AutomationEngine implements IAutomationService {
      */
     private resuming = new Set<string>();
 
-    constructor(logger: Logger, store?: SuspendedRunStore) {
+    constructor(logger: Logger, store?: SuspendedRunStore, options?: AutomationEngineOptions) {
         this.logger = logger;
         this.store = store;
+        this.maxLogSize = options?.maxLogSize ?? DEFAULT_MAX_EXECUTION_LOG_SIZE;
     }
 
     /**

packages/services/service-automation/src/index.ts

@@ -1,8 +1,9 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 // Core engine
-export { AutomationEngine } from './engine.js';
+export { AutomationEngine, DEFAULT_MAX_EXECUTION_LOG_SIZE } from './engine.js';
 export type {
+    AutomationEngineOptions,
     NodeExecutor,
     NodeExecutionResult,
     FlowTrigger,

packages/services/service-automation/src/plugin.ts

@@ -24,6 +24,13 @@ export interface AutomationServicePluginOptions {
      * survives a process restart and can be resumed after a cold boot.
      */
     suspendedRunStore?: 'auto' | 'memory';
+    /**
+     * Max in-memory execution-log entries retained per process (ring buffer;
+     * oldest evicted). The buffer is diagnostic-only and already bounded
+     * (launch-readiness.md P1-2); this just makes the window tunable. Defaults
+     * to {@link DEFAULT_MAX_EXECUTION_LOG_SIZE} (1000).
+     */
+    maxLogSize?: number;
 }
 
 /**
@@ -71,7 +78,9 @@ export class AutomationServicePlugin implements Plugin {
     }
 
     async init(ctx: PluginContext): Promise<void> {
-        this.engine = new AutomationEngine(ctx.logger);
+        this.engine = new AutomationEngine(ctx.logger, undefined, {
+            maxLogSize: this.options.maxLogSize,
+        });
 
         // Register as global service — other plugins access via ctx.getService('automation')
         ctx.registerService('automation', this.engine);

packages/services/service-feed/src/feed-service-plugin.ts

@@ -21,6 +21,12 @@ export interface FeedServicePluginOptions {
  * Registers a Feed/Chatter service with the kernel during the init phase.
  * Currently supports in-memory storage for single-process environments.
  *
+ * **v1 deployment contract (launch-readiness.md P0-5): single-instance only.**
+ * The in-memory adapter is process-local and non-durable — feed data is lost on
+ * restart and is not shared across nodes. A default `maxItems` safety cap is
+ * enforced (see {@link InMemoryFeedAdapter}) so the store can't grow until OOM.
+ * HA (a DB-backed feed adapter) is a post-GA fast-follow.
+ *
  * @example
  * ```ts
  * import { ObjectKernel } from '@objectstack/core';

packages/services/service-feed/src/in-memory-feed-adapter.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { describe, it, expect } from 'vitest';
-import { InMemoryFeedAdapter } from './in-memory-feed-adapter';
+import { InMemoryFeedAdapter, DEFAULT_MAX_FEED_ITEMS } from './in-memory-feed-adapter';
 import type { IFeedService, CreateFeedItemInput } from '@objectstack/spec/contracts';
 
 /** Helper to create a standard comment input. */
@@ -125,6 +125,24 @@ describe('InMemoryFeedAdapter', () => {
       .rejects.toThrow(/Maximum feed item limit reached/);
   });
 
+  it('enforces a default maxItems cap when none is configured (P0-5 backstop)', async () => {
+    // The cap is default-on so a long-running single-instance feed can't grow
+    // until OOM. Adapter constructed with no options uses the default cap.
+    const feed = new InMemoryFeedAdapter();
+    expect(DEFAULT_MAX_FEED_ITEMS).toBeGreaterThan(0);
+    expect(Number.isFinite(DEFAULT_MAX_FEED_ITEMS)).toBe(true);
+    expect((feed as unknown as { maxItems: number }).maxItems).toBe(DEFAULT_MAX_FEED_ITEMS);
+  });
+
+  it('treats maxItems: 0 as an explicit unbounded opt-out', async () => {
+    const feed = new InMemoryFeedAdapter({ maxItems: 0 });
+    expect((feed as unknown as { maxItems: number }).maxItems).toBe(0);
+    for (let i = 0; i < 5; i++) {
+      await feed.createFeedItem(commentInput({ body: `c${i}` }));
+    }
+    expect(feed.getItemCount()).toBe(5);
+  });
+
   // ==========================================
   // Feed Listing & Filtering
   // ==========================================