Type-safe `spawn_child` for cross-domain typed tasks

[deepjoy]

Problem

TaskContext::spawn_child() takes an untyped TaskSubmission, requiring manual type-name strings and payload_json() serialization. This loses the compile-time safety that the typed API (DomainHandle::submit_with()) provides.

// Current: untyped, error-prone
ctx.spawn_child(
    TaskSubmission::new("scan-l1-dir")        // string must match TypedTask::TASK_TYPE
        .key(&format!("{}:{}", bucket, prefix))
        .priority(ctx.record().priority)
        .payload_json(&ScanL1DirTask {        // no compile-time check that this matches the type name
            bucket, dir_prefix, scan_start_ns, scope,
        })?,
).await?;

Problems:

1. Task type string is manually specified — typo = runtime error, not compile error.
2. Payload type isn't checked against the task type — you could serialize ScanL2Task with the "scan-l1-dir" type name and it would compile fine.
3. Domain prefix ("scanner::") must be manually omitted or included depending on whether spawn_child auto-prefixes — easy to get wrong.

Same-domain workaround via ctx.domain()

For cross-domain children, the docs suggest:

let storage = ctx.domain::<Storage>();
storage.submit_with(Upload { ... })
    .parent(ctx.record().id)
    .await?;

This is type-safe but requires knowing the parent ID and manually threading it. For same-domain children (the common case), spawn_child is the natural API but lacks type safety.

Proposal

Add a typed spawn_child variant on TaskContext, or a helper on DomainHandle:

Option A: Typed method on TaskContext

impl TaskContext {
    pub async fn spawn_child_typed<T: TypedTask>(
        &self,
        task: T,
    ) -> Result<SubmitOutcome, StoreError> {
        let mut sub = TaskSubmission::new(
            &format!("{}::{}", T::Domain::NAME, T::TASK_TYPE)
        )
        .payload_json(&task)?;

        if let Some(key) = task.key() {
            sub = sub.key(key);
        }
        // apply tags, config defaults, etc.

        self.spawn_child(sub).await
    }
}

Option B: Builder pattern on TaskContext

// Same type safety as DomainHandle::submit_with, but auto-sets parent
ctx.spawn_child_with(ScanL1DirTask { bucket, dir_prefix, .. })
    .priority(Priority::BACKGROUND)
    .key(&format!("{}:{}", bucket, prefix))
    .await?;

This mirrors DomainHandle::submit_with() but automatically sets the parent ID from ctx.record().id.

Option C: Convenience on DomainHandle

// On the domain handle returned by ctx.domain()
let scanner = ctx.domain::<Scanner>();
scanner.submit_with(ScanL1DirTask { .. })
    .child_of(ctx)  // sets parent_id from context, inherits TTL, tags
    .priority(Priority::BACKGROUND)
    .await?;

Preference

Option B is the most ergonomic — mirrors the existing submit_with pattern while keeping the auto-parenting benefit of spawn_child. Option C is a lighter change (just sugar on the existing builder) but child_of(ctx) is less discoverable than a dedicated method.

[deepjoy]

Implemented in remove-unsafe-api branch — this went with Option B (builder pattern on context) plus Option C (child_of on the submit builder) for cross-domain children.

What landed

• DomainTaskContext<'a, D> — domain-parameterized wrapper that replaces &TaskContext in TypedExecutor. Zero-cost (&TaskContext + PhantomData<D>).
• ctx.spawn_child_with(task) — type-safe same-domain child spawning. Only accepts T: TypedTask<Domain = D>. Returns a ChildSpawnBuilder with .key(), .priority(), .ttl(), .group() overrides.
• ctx.spawn_children_with(tasks) — batch variant for homogeneous children.
• .child_of(&ctx) on DomainSubmitBuilder — ergonomic cross-domain children.
• Untyped API removed from public surface — TaskExecutor, TaskContext, Domain::raw_executor(), DomainHandle::submit_raw() are now pub(crate).

Before / After

// BEFORE: untyped, error-prone
ctx.spawn_child(
    TaskSubmission::new("scan-l1-dir")
        .key(&format!("{}:{}", bucket, prefix))
        .payload_json(&ScanL1DirTask { bucket, prefix, .. })?,
).await?;

// AFTER: compile-time safe
ctx.spawn_child_with(ScanL1DirTask { bucket, prefix, .. })
    .key(&format!("{}:{}", bucket, prefix))
    .await?;

// Cross-domain children:
ctx.domain::<Analytics>()
    .submit_with(ScanStartedEvent { .. })
    .child_of(&ctx)
    .await?;

Docs

• Migration guide: docs/migrating-to-0.6.md