@bastani/atomic 0.9.26-alpha.4 → 0.9.26-alpha.6

package/dist/builtin/workflows/src/extension/index.bundle.mjs

@@ -76,6 +76,92 @@ function raceAbort(operation, signal) {
   });
 }
 
+// dist/builtin/workflows/src/durable/dbos-database-diagnostics.ts
+function redactedDatabaseEndpoint(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return "unparseable PostgreSQL endpoint";
+  }
+}
+function redactedDatabaseMessage(message, url) {
+  let safe = message.replace(/postgres(?:ql)?:\/\/[^\s"'<>]+/gi, (value2) => redactedDatabaseEndpoint(value2));
+  let configuredSecrets = [];
+  if (url !== undefined) {
+    try {
+      const parsed = new URL(url);
+      configuredSecrets = [parsed.username, parsed.password, ...parsed.searchParams.values()].flatMap((secret) => {
+        try {
+          return [secret, decodeURIComponent(secret)];
+        } catch {
+          return [secret];
+        }
+      }).filter((secret) => secret.length > 0);
+    } catch {
+      return "PostgreSQL diagnostic could not be safely redacted; check the configured endpoint.";
+    }
+  }
+  safe = safe.replace(/\b(password|passwd|token|secret|sslpassword|user(?:name)?)\s*(?:([=:])\s*|((?:is|was)\s+)|\s+)(?:"([^"]*)"|'([^']*)'|([^\s,;]+))/gi, (match, key, separator, filler, doubleQuoted, singleQuoted, bare) => {
+    const value2 = doubleQuoted ?? singleQuoted ?? bare ?? "";
+    const isUserContext = /^user(?:name)?$/i.test(key);
+    if (separator === undefined && !isUserContext && !configuredSecrets.includes(value2))
+      return match;
+    const rendered = doubleQuoted !== undefined ? '"[redacted]"' : singleQuoted !== undefined ? "'[redacted]'" : "[redacted]";
+    return `${key}${separator ?? " "}${filler ?? ""}${rendered}`;
+  });
+  for (const secret of new Set(configuredSecrets)) {
+    if (secret.length < 4)
+      continue;
+    const escaped = secret.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const expression = new RegExp(`(?<![\\p{L}\\p{N}_\\[])${escaped}(?![\\p{L}\\p{N}_\\]])`, "gu");
+    safe = safe.replace(expression, "[redacted]");
+  }
+  return safe;
+}
+function databaseDependencyMessage(message, diagnostics) {
+  const safe = redactedDatabaseMessage(message, diagnostics?.url);
+  if (diagnostics === undefined)
+    return safe;
+  const failure = diagnostics.failure === undefined ? "" : ` Last probe/recovery failure: ${redactedDatabaseMessage(diagnostics.failure, diagnostics.url)}`;
+  return `${safe} Provider: ${diagnostics.provider}; endpoint: ${redactedDatabaseEndpoint(diagnostics.url)}.${failure}`;
+}
+
+// dist/builtin/workflows/src/durable/dbos-process-owner.ts
+function emptyOwner2() {
+  return {
+    version: 1,
+    state: "uninitialized",
+    configured: undefined,
+    active: undefined,
+    launchPromise: undefined,
+    shutdownPromise: undefined,
+    failure: undefined,
+    wrappers: undefined,
+    leases: new Set
+  };
+}
+function ownerBag2() {
+  return globalThis;
+}
+function getDbosProcessOwner() {
+  const bag = ownerBag2();
+  const existing = bag[DBOS_PROCESS_OWNER_KEY];
+  if (existing !== undefined && existing.version === 1)
+    return existing;
+  const created = emptyOwner2();
+  bag[DBOS_PROCESS_OWNER_KEY] = created;
+  return created;
+}
+var DBOS_PROCESS_OWNER_KEY;
+var init_dbos_process_owner = __esm(() => {
+  DBOS_PROCESS_OWNER_KEY = Symbol.for("atomic-workflows/dbos-process-owner@1");
+});
+
 // dist/builtin/workflows/src/durable/dbos-admission.ts
 import { AsyncLocalStorage } from "node:async_hooks";
 function isDbosDependencyError(error) {
@@ -94,6 +180,8 @@ async function boundedAdmission(operation, signal, timeoutMs = DBOS_ADMISSION_TI
     return await raceAbort(operation(controller.signal), controller.signal);
   } catch (error) {
     controller.abort(error);
+    if (isDbosDependencyError(error) && error.admissionDetail !== undefined)
+      throw new DbosDependencyError(error.admissionDetail, null);
     throw error;
   } finally {
     clearTimeout(timer);
@@ -102,10 +190,13 @@ async function boundedAdmission(operation, signal, timeoutMs = DBOS_ADMISSION_TI
 }
 var DBOS_ADMISSION_TIMEOUT_MS = 1e4, DbosDependencyError, key2, bag, dbosAdmissionContext;
 var init_dbos_admission = __esm(() => {
+  init_dbos_process_owner();
   DbosDependencyError = class DbosDependencyError extends Error {
     code = "ATOMIC_DBOS_DEPENDENCY";
-    constructor(message = "Workflow database unavailable during admission. Restore PostgreSQL before retrying.") {
-      super(message);
+    admissionDetail;
+    constructor(message = "Workflow database unavailable during admission. Restore PostgreSQL before retrying.", diagnostics = getDbosProcessOwner().databaseDiagnostics?.(), admissionDetail) {
+      super(databaseDependencyMessage(message, diagnostics ?? undefined));
+      this.admissionDetail = admissionDetail === undefined ? undefined : redactedDatabaseMessage(admissionDetail);
       this.name = "DbosDependencyError";
     }
   };
@@ -115,6 +206,602 @@ var init_dbos_admission = __esm(() => {
   dbosAdmissionContext = bag[key2];
 });
 
+// dist/builtin/workflows/src/durable/dbos-admission-pool.ts
+function fenceDbosAdmissionPool(pool) {
+  const connect = pool.connect.bind(pool);
+  async function acquire(signal) {
+    if (signal.aborted)
+      throw sdkDependencyError();
+    const pending = connect().then((client) => {
+      if (signal.aborted) {
+        client.release(true);
+        throw sdkDependencyError();
+      }
+      return fencedClient(client, signal);
+    });
+    try {
+      return await raceAbort(pending, signal);
+    } catch (error) {
+      throw databaseError(error, signal);
+    }
+  }
+  function scopedConnect(callback) {
+    const signal = dbosAdmissionContext.getStore();
+    if (signal === undefined) {
+      if (callback === undefined)
+        return connect();
+      connect(callback);
+      return;
+    }
+    const pending = acquire(signal);
+    if (callback === undefined)
+      return pending;
+    pending.then((client) => callback(undefined, client, client.release), (error) => callback(error, undefined, () => {}));
+  }
+  pool.connect = scopedConnect;
+  return pool;
+}
+function fencedClient(client, signal) {
+  let released = false;
+  const release = (error) => {
+    if (released)
+      return;
+    released = true;
+    signal.removeEventListener("abort", abort);
+    client.release(error);
+  };
+  const abort = () => release(true);
+  signal.addEventListener("abort", abort, { once: true });
+  const query = new Proxy(client.query, {
+    apply(target, _receiver, args) {
+      const values = [...args];
+      const last = values.at(-1);
+      const callback = typeof last === "function" ? values.pop() : undefined;
+      const pending = (async () => {
+        if (signal.aborted || released)
+          throw sdkDependencyError();
+        try {
+          return await raceAbort(new Promise((resolve, reject) => {
+            Reflect.apply(target, client, [
+              ...values,
+              (error, result) => {
+                if (error)
+                  reject(error);
+                else
+                  resolve(result);
+              }
+            ]);
+          }), signal);
+        } catch (error) {
+          throw databaseError(error, signal);
+        }
+      })();
+      if (callback === undefined)
+        return pending;
+      pending.then((result) => callback(null, result), (error) => callback(error));
+    }
+  });
+  return new Proxy(client, {
+    get(target, property, receiver) {
+      if (property === "query")
+        return query;
+      if (property === "release")
+        return release;
+      return Reflect.get(target, property, receiver);
+    }
+  });
+}
+function sdkDependencyError(message) {
+  const reported = message === undefined ? new DbosDependencyError : new DbosDependencyError(message, null);
+  return new DbosDependencyError(undefined, null, reported.message);
+}
+function databaseError(error, signal) {
+  if (signal?.aborted)
+    return sdkDependencyError();
+  if (isDbosDependencyError(error))
+    return sdkDependencyError(error.admissionDetail ?? error.message);
+  const pending = [error];
+  const seen = new Set;
+  while (pending.length > 0) {
+    const value2 = pending.pop();
+    if (typeof value2 !== "object" || value2 === null || seen.has(value2))
+      continue;
+    seen.add(value2);
+    if ("cause" in value2)
+      pending.push(value2.cause);
+    if ("error" in value2)
+      pending.push(value2.error);
+    if ("errors" in value2 && Array.isArray(value2.errors))
+      pending.push(...value2.errors);
+    const code = "code" in value2 && typeof value2.code === "string" ? value2.code : undefined;
+    const message = value2 instanceof Error ? value2.message : "";
+    if (code !== undefined && (/^(?:08|53|57)[0-9A-Z]{3}$|^40003$/.test(code) || connectionErrnos.has(code)) || code === undefined && connectionMessages.has(message)) {
+      return sdkDependencyError();
+    }
+  }
+  return error;
+}
+var connectionErrnos, connectionMessages;
+var init_dbos_admission_pool = __esm(() => {
+  init_dbos_admission();
+  connectionErrnos = new Set([
+    "ECONNRESET",
+    "ECONNREFUSED",
+    "ECONNABORTED",
+    "EHOSTUNREACH",
+    "ENETUNREACH",
+    "ETIMEDOUT",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "EPIPE"
+  ]);
+  connectionMessages = new Set([
+    "Connection terminated unexpectedly",
+    "Connection terminated due to connection timeout",
+    "Client has encountered a connection error and is not queryable",
+    "timeout exceeded when trying to connect",
+    "Client was closed and is not queryable",
+    "Postgres connection pool changed while acquiring a connection"
+  ]);
+});
+
+// dist/builtin/workflows/src/durable/dbos-row-guard.ts
+import { createHash as createHash2 } from "node:crypto";
+async function installDbosRowGuard(client) {
+  const ready = await client.query("SELECT to_regclass('dbos.workflow_status') IS NOT NULL AS status, to_regclass('dbos.operation_outputs') IS NOT NULL AS operations");
+  if (!ready.rows[0]?.status && !ready.rows[0]?.operations)
+    return;
+  if (!ready.rows[0]?.status || !ready.rows[0]?.operations)
+    throw new Error("Atomic workflow database schema is incomplete");
+  if (await validateInstalledGuard(client))
+    return;
+  await client.query("BEGIN");
+  try {
+    await client.query("SELECT pg_advisory_xact_lock(3419, 9003)");
+    if (await validateInstalledGuard(client)) {
+      await client.query("COMMIT");
+      return;
+    }
+    await client.query(guardSql);
+    await client.query("CREATE TABLE IF NOT EXISTS dbos.atomic_guard_protocol (singleton boolean PRIMARY KEY CHECK(singleton), fingerprint text NOT NULL)");
+    await client.query("INSERT INTO dbos.atomic_guard_protocol VALUES (true, $1) ON CONFLICT DO NOTHING", [
+      fingerprint
+    ]);
+    await client.query("COMMIT");
+  } catch (error) {
+    await client.query("ROLLBACK");
+    throw error;
+  }
+}
+async function validateInstalledGuard(client) {
+  const installed = await client.query("SELECT to_regclass('dbos.atomic_guard_protocol') IS NOT NULL AS present");
+  if (!installed.rows[0]?.present)
+    return false;
+  const validated = await client.query("SELECT fingerprint, (SELECT count(*)::int FROM pg_trigger WHERE tgrelid IN ('dbos.workflow_status'::regclass,'dbos.operation_outputs'::regclass) AND tgname = 'atomic_generation_guard' AND tgenabled = 'O' AND tgtype = 31 AND tgfoid = 'dbos.atomic_guard_row()'::regprocedure) AS triggers, (SELECT count(*)::int FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_projection' AND tgenabled = 'O' AND tgtype = 21 AND tgfoid = 'dbos.atomic_project_metadata()'::regprocedure) AS projections FROM dbos.atomic_guard_protocol WHERE singleton");
+  if (validated.rows.length !== 1 || validated.rows[0].fingerprint !== fingerprint || validated.rows[0].triggers !== 2 || validated.rows[0].projections !== 1)
+    throw new Error("Atomic database ownership guard schema is incompatible or incomplete");
+  return true;
+}
+var guardSql = `
+CREATE TABLE IF NOT EXISTS dbos.atomic_owner_generation (
+ root text PRIMARY KEY, owner text, generation bigint,
+ terminal boolean NOT NULL DEFAULT false, claim text, claimant text, protocol integer NOT NULL DEFAULT 1 CHECK(protocol = 1)
+);
+CREATE TABLE IF NOT EXISTS dbos.atomic_guard_rows (workflow_uuid text PRIMARY KEY, root text NOT NULL);
+CREATE OR REPLACE FUNCTION dbos.atomic_metadata(value text) RETURNS jsonb
+LANGUAGE plpgsql IMMUTABLE SET search_path = pg_catalog AS $$
+DECLARE decoded jsonb;
+BEGIN
+ IF value IS NULL THEN RETURN NULL; END IF;
+ BEGIN decoded := value::jsonb; EXCEPTION WHEN invalid_text_representation THEN RETURN NULL; END;
+ IF decoded->>'__dbos_serializer' = 'superjson' THEN decoded := decoded->'json'; END IF;
+ IF decoded->>'__atomicDurableMetadata' IS DISTINCT FROM 'true' OR decoded->>'version' IS DISTINCT FROM '3' THEN RETURN NULL; END IF;
+ RETURN decoded->'metadata';
+END $$;
+CREATE OR REPLACE FUNCTION dbos.atomic_guard_row() RETURNS trigger
+LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE
+ row_value jsonb; id text; root_id text; authority jsonb; state dbos.atomic_owner_generation%ROWTYPE;
+ meta jsonb; prior jsonb; prior_generation bigint; next_generation bigint; absorbing boolean;
+ allowed boolean; cap_owner text; cap_generation bigint; claim_token text;
+BEGIN
+ row_value := CASE WHEN TG_OP = 'DELETE' THEN to_jsonb(OLD) ELSE to_jsonb(NEW) END;
+ id := row_value->>'workflow_uuid';
+ root_id := split_part(id, ':checkpoint:', 1);
+ IF TG_OP = 'UPDATE' AND to_jsonb(OLD)->>'workflow_uuid' IS DISTINCT FROM id AND (
+  EXISTS(SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = to_jsonb(OLD)->>'workflow_uuid') OR
+  (TG_TABLE_NAME = 'workflow_status' AND to_jsonb(OLD)->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')) OR
+  (TG_TABLE_NAME = 'operation_outputs' AND EXISTS(SELECT 1 FROM dbos.workflow_status WHERE workflow_uuid = to_jsonb(OLD)->>'workflow_uuid' AND name IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')))
+ ) THEN
+  IF NULLIF(current_setting('atomic.row_authority',true),'') IS NULL OR current_setting('atomic.row_authority',true) = 'null' THEN RETURN NULL; END IF;
+  RAISE EXCEPTION 'Atomic workflow identities are immutable';
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND NOT (
+  COALESCE(row_value->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint'), false) OR
+  COALESCE(to_jsonb(OLD)->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint'), false) OR
+  EXISTS(SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = id)
+ ) THEN
+  IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+ END IF;
+ authority := NULLIF(current_setting('atomic.row_authority', true), '')::jsonb;
+ IF TG_TABLE_NAME = 'operation_outputs' AND NOT EXISTS (
+  SELECT 1 FROM dbos.workflow_status WHERE workflow_uuid = id AND name IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')
+ ) AND NOT EXISTS (SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = id) THEN
+  IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+ END IF;
+ INSERT INTO dbos.atomic_guard_rows VALUES(id, root_id) ON CONFLICT DO NOTHING;
+ INSERT INTO dbos.atomic_guard_rows SELECT workflow_uuid, root_id FROM dbos.workflow_status
+  WHERE workflow_uuid = root_id AND name = 'atomicWorkflowHandle' ON CONFLICT DO NOTHING;
+ INSERT INTO dbos.atomic_owner_generation(root) VALUES(root_id)
+  ON CONFLICT(root) DO UPDATE SET root = EXCLUDED.root RETURNING * INTO state;
+ IF state.owner IS NULL THEN
+  IF TG_TABLE_NAME <> 'workflow_status' OR TG_OP = 'DELETE' OR row_value->>'status' <> 'SUCCESS'
+   OR id NOT LIKE root_id || ':checkpoint:__atomic_metadata:%'
+   OR authority->>'root' IS DISTINCT FROM root_id OR authority->>'enroll' IS DISTINCT FROM 'true' THEN
+   IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+  END IF;
+  meta := dbos.atomic_metadata(row_value->>'output');
+  IF meta IS NULL OR meta->>'workflowId' IS DISTINCT FROM root_id THEN
+   RAISE EXCEPTION 'Atomic metadata encoding is unavailable for enrollment';
+  END IF;
+  SELECT candidate.metadata, candidate.generation INTO prior, prior_generation FROM (
+   SELECT dbos.atomic_metadata(output) AS metadata,
+    split_part(substring(workflow_uuid FROM length(root_id) + 13), ':', 2)::bigint AS generation
+   FROM dbos.workflow_status
+   WHERE workflow_uuid LIKE root_id || ':checkpoint:__atomic_metadata:%' AND status = 'SUCCESS'
+  ) candidate WHERE candidate.metadata IS NOT NULL
+  ORDER BY COALESCE(candidate.metadata->>'status' IN ('completed', 'cancelled') OR
+   (candidate.metadata->>'status' IN ('failed','blocked') AND candidate.metadata->>'resumable' = 'false'), false) DESC,
+   candidate.generation DESC LIMIT 1;
+  IF prior_generation IS DISTINCT FROM (authority->>'generation')::bigint
+   OR prior->>'ownerExecutorId' IS DISTINCT FROM authority->>'owner' THEN
+   RAISE EXCEPTION 'Atomic ownership generation changed before enrollment';
+  END IF;
+ ELSE
+  IF authority->>'root' IS DISTINCT FROM root_id THEN RETURN NULL; END IF;
+  cap_owner := authority->>'owner'; cap_generation := (authority->>'generation')::bigint;
+  allowed := cap_owner = state.owner AND cap_generation = state.generation AND (
+   authority->>'actor' = state.owner OR
+   (authority->>'claim' = state.claim AND authority->>'actor' = state.claimant) OR
+   (authority->>'claim' IS NOT NULL AND authority->>'checkpoint' = id));
+  IF NOT COALESCE(allowed, false) THEN RAISE EXCEPTION 'Atomic ownership generation changed; stale database writes are refused'; END IF;
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND TG_OP = 'UPDATE' THEN
+  IF OLD.status = 'SUCCESS' AND OLD.name = 'atomicWorkflowCheckpoint' THEN
+   IF NEW.output IS DISTINCT FROM OLD.output OR NEW.status <> 'SUCCESS' THEN RAISE EXCEPTION 'Completed Atomic checkpoints are immutable'; END IF;
+   RETURN NEW;
+  END IF;
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND TG_OP <> 'DELETE' AND row_value->>'status' = 'SUCCESS'
+  AND id LIKE root_id || ':checkpoint:__atomic_metadata:%' THEN
+  meta := dbos.atomic_metadata(row_value->>'output');
+  IF meta IS NULL OR meta->>'workflowId' IS DISTINCT FROM root_id OR meta->>'ownerExecutorId' IS DISTINCT FROM authority->>'actor' THEN RAISE EXCEPTION 'Atomic metadata encoding or owner is unavailable'; END IF;
+  next_generation := split_part(substring(id FROM length(root_id) + 13), ':', 2)::bigint;
+  absorbing := COALESCE(meta->>'status' IN ('completed', 'cancelled') OR
+   (meta->>'status' IN ('failed','blocked') AND meta->>'resumable' = 'false'), false);
+  claim_token := meta->>'transitionClaimId';
+  IF state.root IS NOT NULL AND (next_generation < state.generation OR (state.terminal AND NOT absorbing)) THEN
+   RAISE EXCEPTION 'Atomic terminal or newer generation cannot be overwritten';
+  END IF;
+  IF state.owner IS NOT NULL AND authority->>'actor' <> state.owner THEN
+   IF id NOT LIKE '%:claim' OR next_generation <> state.generation + 1 OR claim_token IS DISTINCT FROM authority->>'claim' OR meta->>'ownerExecutorId' IS DISTINCT FROM authority->>'actor' THEN
+    RAISE EXCEPTION 'Atomic ownership transfer requires an exact generation claim';
+   END IF;
+  END IF;
+ END IF;
+ IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+END $$;
+CREATE OR REPLACE FUNCTION dbos.atomic_project_metadata() RETURNS trigger
+LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE root_id text; meta jsonb; authority jsonb; state dbos.atomic_owner_generation%ROWTYPE; projected_generation bigint; absorbing boolean;
+BEGIN
+ IF NEW.name <> 'atomicWorkflowCheckpoint' OR NEW.status <> 'SUCCESS' THEN RETURN NEW; END IF;
+ root_id := split_part(NEW.workflow_uuid, ':checkpoint:', 1);
+ IF NEW.workflow_uuid NOT LIKE root_id || ':checkpoint:__atomic_metadata:%' THEN RETURN NEW; END IF;
+ IF TG_OP = 'UPDATE' THEN IF OLD.status = 'SUCCESS' THEN RETURN NEW; END IF; END IF;
+ authority := NULLIF(current_setting('atomic.row_authority', true), '')::jsonb;
+ SELECT * INTO state FROM dbos.atomic_owner_generation WHERE root = root_id FOR UPDATE;
+ IF state.owner IS NULL AND authority->>'enroll' IS DISTINCT FROM 'true' THEN RETURN NEW; END IF;
+ meta := dbos.atomic_metadata(NEW.output);
+ projected_generation := split_part(substring(NEW.workflow_uuid FROM length(root_id) + 13), ':', 2)::bigint;
+ absorbing := COALESCE(meta->>'status' IN ('completed','cancelled') OR (meta->>'status' IN ('failed','blocked') AND meta->>'resumable' = 'false'), false);
+ UPDATE dbos.atomic_owner_generation SET owner = meta->>'ownerExecutorId', generation = projected_generation,
+  terminal = absorbing, claim = CASE WHEN NEW.workflow_uuid LIKE '%:claim' THEN meta->>'transitionClaimId' END,
+  claimant = CASE WHEN NEW.workflow_uuid LIKE '%:claim' THEN authority->>'actor' END WHERE root = root_id;
+ RETURN NEW;
+END $$;
+DO $$ BEGIN
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_guard') THEN
+  CREATE TRIGGER atomic_generation_guard BEFORE INSERT OR UPDATE OR DELETE ON dbos.workflow_status
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_guard_row();
+ END IF;
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.operation_outputs'::regclass AND tgname = 'atomic_generation_guard') THEN
+  CREATE TRIGGER atomic_generation_guard BEFORE INSERT OR UPDATE OR DELETE ON dbos.operation_outputs
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_guard_row();
+ END IF;
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_projection') THEN
+  CREATE TRIGGER atomic_generation_projection AFTER INSERT OR UPDATE ON dbos.workflow_status
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_project_metadata();
+ END IF;
+END $$;
+`, fingerprint;
+var init_dbos_row_guard = __esm(() => {
+  fingerprint = createHash2("sha256").update(guardSql).digest("hex");
+});
+
+// dist/builtin/workflows/src/durable/dbos-owner-fence.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+import { createHash as createHash3 } from "node:crypto";
+function lockKey(identity) {
+  const digest = createHash3("sha256").update(`atomic-workflow-fence:${identity}`).digest();
+  return [digest.readInt32BE(0), digest.readInt32BE(4)];
+}
+function isDatabaseExecutor(executorId) {
+  return /^atomic-db-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(executorId ?? "");
+}
+
+class DbosOwnerFence {
+  pool;
+  executorId;
+  endPool;
+  lifetime;
+  lost = false;
+  closing;
+  closed = false;
+  get invalidated() {
+    return this.lost;
+  }
+  constructor(pool, executorId, endPool) {
+    this.pool = pool;
+    this.executorId = executorId;
+    this.endPool = endPool;
+  }
+  fail() {
+    this.lost = true;
+    return new DbosDependencyError("Workflow database unavailable: ownership connection was lost; this execution generation cannot write again");
+  }
+  owner() {
+    if (this.lost)
+      return Promise.reject(this.fail());
+    this.lifetime ??= (async () => {
+      const client = await this.pool().connect();
+      client.on("error", () => {
+        this.fail();
+      });
+      client.on("end", () => {
+        this.fail();
+      });
+      try {
+        await client.query("SELECT set_config('application_name', $1, false)", [`atomic-owner:${this.executorId}`]);
+        const held = await client.query("SELECT pg_try_advisory_lock($1, $2) AS held", [
+          ...lockKey(this.executorId)
+        ]);
+        if (!held.rows[0]?.held || this.lost)
+          throw this.fail();
+        await client.query("SELECT pg_advisory_lock_shared($1, $2)", [...lockKey(this.executorId)]);
+        await client.query("SELECT pg_advisory_unlock($1, $2)", [...lockKey(this.executorId)]);
+        return client;
+      } catch (error) {
+        this.fail();
+        client.release(true);
+        throw error;
+      }
+    })().catch((error) => {
+      this.fail();
+      throw error;
+    });
+    return this.lifetime;
+  }
+  async liveness(executorId) {
+    if (!isDatabaseExecutor(executorId))
+      return "unknown";
+    const client = await this.pool().connect();
+    try {
+      await client.query("BEGIN");
+      const result = await client.query("SELECT pg_try_advisory_xact_lock($1, $2) AS held", [
+        ...lockKey(executorId)
+      ]);
+      return result.rows[0]?.held ? "dead" : "alive";
+    } finally {
+      try {
+        await client.query("ROLLBACK");
+      } finally {
+        client.release();
+      }
+    }
+  }
+  async recover(executorId, callback) {
+    if (!isDatabaseExecutor(executorId))
+      return;
+    const client = await this.pool().connect();
+    const fail = () => {
+      this.fail();
+    };
+    client.on("error", fail);
+    client.on("end", fail);
+    try {
+      await client.query("BEGIN");
+      const result = await client.query("SELECT pg_try_advisory_xact_lock($1, $2) AS held", [
+        ...lockKey(executorId)
+      ]);
+      if (!result.rows[0]?.held)
+        return;
+      return await callback();
+    } finally {
+      try {
+        await client.query("ROLLBACK");
+      } finally {
+        client.removeListener("error", fail);
+        client.removeListener("end", fail);
+        client.release();
+      }
+    }
+  }
+  async write(workflowId, callback, claim = false) {
+    try {
+      return await this.writeLocked(workflowId, callback, claim);
+    } catch (error) {
+      const mapped = databaseError(error);
+      throw this.lost && isDbosDependencyError(mapped) ? this.fail() : mapped;
+    }
+  }
+  async writeLocked(workflowId, callback, claim) {
+    const context = writeContext.getStore();
+    const active = context?.fence === this ? context.workflows : undefined;
+    if (active?.has(workflowId)) {
+      if (this.lost)
+        throw this.fail();
+      return await callback();
+    }
+    const owner = await this.owner();
+    const client = await this.pool().connect();
+    const fail = () => {
+      this.fail();
+    };
+    client.on("error", fail);
+    client.on("end", fail);
+    try {
+      await client.query("BEGIN");
+      await client.query("SELECT set_config('application_name', $1, false)", [`atomic-guard:${workflowId}`]);
+      await client.query("SET LOCAL statement_timeout = '10000ms'");
+      await client.query("SELECT pg_advisory_xact_lock_shared($1, $2)", [...lockKey(this.executorId)]);
+      await client.query("SELECT pg_advisory_xact_lock($1, $2)", [...lockKey(`workflow:${workflowId}`)]);
+      if (claim)
+        await client.query("SELECT pg_advisory_xact_lock($1, $2)", [...lockKey(`sql:${workflowId}`)]);
+      if (this.lost)
+        throw this.fail();
+      try {
+        await owner.query("SELECT 1");
+      } catch {
+        throw this.fail();
+      }
+      if (this.lost)
+        throw this.fail();
+      return await writeContext.run({ fence: this, workflows: new Map([...active ?? [], [workflowId, claim]]) }, callback);
+    } finally {
+      try {
+        await client.query("ROLLBACK");
+      } finally {
+        client.removeListener("error", fail);
+        client.removeListener("end", fail);
+        client.release();
+      }
+    }
+  }
+  async withRowAuthority(authority, callback) {
+    return await rowContext.run(authority, callback);
+  }
+  protectPool(pool) {
+    const connect = pool.connect.bind(pool);
+    const acquire = async () => {
+      const active = writeContext.getStore();
+      const client = await connect();
+      try {
+        await installDbosRowGuard(client);
+        await client.query("SELECT set_config('atomic.row_authority', $1, false)", [
+          JSON.stringify(rowContext.getStore() ?? null)
+        ]);
+      } catch (error) {
+        client.release(true);
+        throw error;
+      }
+      if (active === undefined)
+        return client;
+      const fence = active.fence;
+      try {
+        if (fence.lost)
+          throw fence.fail();
+        await client.query("SELECT set_config('application_name', $1, false)", [
+          `atomic-sql:${[...active.workflows.keys()][0]}`
+        ]);
+        for (const identity of [
+          fence.executorId,
+          ...[...active.workflows].filter(([, claim]) => !claim).map(([id]) => `sql:${id}`)
+        ]) {
+          const held = await client.query("SELECT pg_try_advisory_lock_shared($1, $2) AS held", [...lockKey(identity)]);
+          if (!held.rows[0]?.held)
+            throw fence.fail();
+        }
+        try {
+          await (await fence.owner()).query("SELECT 1");
+        } catch {
+          throw fence.fail();
+        }
+        if (fence.lost)
+          throw fence.fail();
+      } catch (error) {
+        client.release(true);
+        throw error;
+      }
+      let released = false;
+      const release = () => {
+        if (released)
+          return;
+        released = true;
+        client.release(true);
+      };
+      const query = new Proxy(client.query, {
+        apply: (target, _receiver, args) => {
+          if (!fence.lost && !released)
+            return Reflect.apply(target, client, args);
+          const error = fence.fail();
+          const callback = args.at(-1);
+          if (typeof callback === "function") {
+            queueMicrotask(() => callback(error));
+            return;
+          }
+          return Promise.reject(error);
+        }
+      });
+      return new Proxy(client, {
+        get(target, property, receiver) {
+          if (property === "release")
+            return release;
+          if (property === "query")
+            return query;
+          return Reflect.get(target, property, receiver);
+        }
+      });
+    };
+    function scopedConnect(callback) {
+      const pending = acquire();
+      if (callback === undefined)
+        return pending;
+      pending.then((client) => callback(undefined, client, client.release), (error) => callback(error, undefined, () => {}));
+    }
+    pool.connect = scopedConnect;
+    return pool;
+  }
+  close() {
+    this.closed = true;
+    this.lost = true;
+    this.closing ??= (async () => {
+      if (this.lifetime !== undefined) {
+        const client = await this.lifetime.catch(() => {
+          return;
+        });
+        client?.release(true);
+      }
+      await this.endPool();
+    })();
+    return this.closing;
+  }
+}
+var contextKey, contextBag, writeContext, rowContextKey, rowContextBag, rowContext;
+var init_dbos_owner_fence = __esm(() => {
+  init_dbos_admission();
+  init_dbos_admission_pool();
+  init_dbos_row_guard();
+  contextKey = Symbol.for("atomic-workflows/dbos-owner-write-context@1");
+  contextBag = globalThis;
+  contextBag[contextKey] ??= new AsyncLocalStorage2;
+  writeContext = contextBag[contextKey];
+  rowContextKey = Symbol.for("atomic-workflows/dbos-row-authority@1");
+  rowContextBag = globalThis;
+  rowContextBag[rowContextKey] ??= new AsyncLocalStorage2;
+  rowContext = rowContextBag[rowContextKey];
+});
+
 // ../../node_modules/@dbos-inc/dbos-sdk/dist/src/error.js
 var require_error = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -30271,137 +30958,6 @@ SELECT
   } });
 });
 
-// dist/builtin/workflows/src/durable/dbos-admission-pool.ts
-function fenceDbosAdmissionPool(pool) {
-  const connect = pool.connect.bind(pool);
-  async function acquire(signal) {
-    if (signal.aborted)
-      throw new DbosDependencyError;
-    const pending = connect().then((client) => {
-      if (signal.aborted) {
-        client.release(true);
-        throw new DbosDependencyError;
-      }
-      return fencedClient(client, signal);
-    });
-    try {
-      return await raceAbort(pending, signal);
-    } catch (error) {
-      throw databaseError(error, signal);
-    }
-  }
-  function scopedConnect(callback) {
-    const signal = dbosAdmissionContext.getStore();
-    if (signal === undefined) {
-      if (callback === undefined)
-        return connect();
-      connect(callback);
-      return;
-    }
-    const pending = acquire(signal);
-    if (callback === undefined)
-      return pending;
-    pending.then((client) => callback(undefined, client, client.release), (error) => callback(error, undefined, () => {}));
-  }
-  pool.connect = scopedConnect;
-  return pool;
-}
-function fencedClient(client, signal) {
-  let released = false;
-  const release = (error) => {
-    if (released)
-      return;
-    released = true;
-    signal.removeEventListener("abort", abort);
-    client.release(error);
-  };
-  const abort = () => release(true);
-  signal.addEventListener("abort", abort, { once: true });
-  const query = new Proxy(client.query, {
-    apply(target, _receiver, args) {
-      const values = [...args];
-      const last = values.at(-1);
-      const callback = typeof last === "function" ? values.pop() : undefined;
-      const pending = (async () => {
-        if (signal.aborted || released)
-          throw new DbosDependencyError;
-        try {
-          return await raceAbort(new Promise((resolve, reject) => {
-            Reflect.apply(target, client, [
-              ...values,
-              (error, result) => {
-                if (error)
-                  reject(error);
-                else
-                  resolve(result);
-              }
-            ]);
-          }), signal);
-        } catch (error) {
-          throw databaseError(error, signal);
-        }
-      })();
-      if (callback === undefined)
-        return pending;
-      pending.then((result) => callback(null, result), (error) => callback(error));
-    }
-  });
-  return new Proxy(client, {
-    get(target, property, receiver) {
-      if (property === "query")
-        return query;
-      if (property === "release")
-        return release;
-      return Reflect.get(target, property, receiver);
-    }
-  });
-}
-function databaseError(error, signal) {
-  if (signal.aborted)
-    return new DbosDependencyError;
-  const pending = [error];
-  const seen = new Set;
-  while (pending.length > 0) {
-    const value2 = pending.pop();
-    if (typeof value2 !== "object" || value2 === null || seen.has(value2))
-      continue;
-    seen.add(value2);
-    if ("cause" in value2)
-      pending.push(value2.cause);
-    if ("error" in value2)
-      pending.push(value2.error);
-    if ("errors" in value2 && Array.isArray(value2.errors))
-      pending.push(...value2.errors);
-    const code = "code" in value2 && typeof value2.code === "string" ? value2.code : undefined;
-    const message = value2 instanceof Error ? value2.message : "";
-    if (code !== undefined && (/^(?:08|53|57)[0-9A-Z]{3}$|^40003$/.test(code) || connectionErrnos.has(code)) || code === undefined && connectionMessages.has(message)) {
-      return new DbosDependencyError;
-    }
-  }
-  return error;
-}
-var connectionErrnos, connectionMessages;
-var init_dbos_admission_pool = __esm(() => {
-  init_dbos_admission();
-  connectionErrnos = new Set([
-    "ECONNRESET",
-    "ECONNREFUSED",
-    "ECONNABORTED",
-    "EHOSTUNREACH",
-    "ENETUNREACH",
-    "ETIMEDOUT",
-    "ENOTFOUND",
-    "EAI_AGAIN",
-    "EPIPE"
-  ]);
-  connectionMessages = new Set([
-    "Connection terminated unexpectedly",
-    "Connection terminated due to connection timeout",
-    "Client has encountered a connection error and is not queryable",
-    "timeout exceeded when trying to connect"
-  ]);
-});
-
 // dist/builtin/workflows/src/durable/dbos-default-postgres-url.ts
 function defaultPostgresUrl(database, host = process.env.PGHOST || "localhost", port = process.env.PGPORT || "5432") {
   const url = new URL("postgresql://localhost");
@@ -30686,7 +31242,12 @@ function defaultDatabaseUrl(name) {
 function configureAdmissionDatabase(sdk, config, launchLock = withDbosLaunchLock) {
   const systemDatabaseUrl = config.systemDatabaseUrl ?? defaultDatabaseUrl(config.name);
   const health = resolvedPostgresHealth(systemDatabaseUrl);
-  const createPool = () => {
+  getDbosProcessOwner().databaseDiagnostics = () => ({
+    provider: health === undefined ? config.systemDatabaseUrl === undefined ? "docker" : "configured" : "managed",
+    url: health?.endpoint ?? systemDatabaseUrl,
+    failure: health?.lastFailure?.message
+  });
+  const createPool = (fenced = true) => {
     let unsubscribe;
     const managed = createRecoverablePostgresPool(systemDatabaseUrl, {
       beforeConnect: health === undefined ? undefined : () => health.check(),
@@ -30696,14 +31257,38 @@ function configureAdmissionDatabase(sdk, config, launchLock = withDbosLaunchLock
     });
     unsubscribe = health?.subscribe(managed.invalidate);
     health?.start();
-    return fenceDbosAdmissionPool(managed.pool);
+    return fenced ? fenceDbosAdmissionPool(managed.pool) : managed.pool;
   };
   let pool = createPool();
+  const createFence = (executorId) => {
+    const fencePool = createPool(false);
+    const created = new DbosOwnerFence(() => fencePool, executorId, () => fencePool.end());
+    const owner = getDbosProcessOwner();
+    owner.executorFences ??= new Set;
+    owner.executorFences.add(created);
+    return created;
+  };
+  let fence = createFence(config.executorID);
+  getDbosProcessOwner().executorFence = fence;
+  getDbosProcessOwner().createExecutorFence = () => {
+    const executorId = `atomic-db-${crypto.randomUUID()}`;
+    getDbosProcessOwner().executorId = executorId;
+    const next = createFence(executorId);
+    getDbosProcessOwner().executorFence = next;
+    return next;
+  };
+  pool = fence.protectPool(pool);
   sdk.setConfig({ ...config, systemDatabaseUrl, systemDatabasePool: pool });
   const launch = async () => {
+    if (fence.closed) {
+      const executorId = `atomic-db-${crypto.randomUUID()}`;
+      getDbosProcessOwner().executorId = executorId;
+      fence = createFence(executorId);
+      getDbosProcessOwner().executorFence = fence;
+    }
     if (pool.ended) {
-      pool = createPool();
-      sdk.setConfig({ ...config, systemDatabaseUrl, systemDatabasePool: pool });
+      pool = fence.protectPool(createPool());
+      sdk.setConfig({ ...config, executorID: fence.executorId, systemDatabaseUrl, systemDatabasePool: pool });
     }
     const urlToEnsure = health === undefined ? systemDatabaseUrl : await health.check();
     const result = await import_datasource2.ensurePGDatabase({ urlToEnsure, logger: () => {} });
@@ -30723,6 +31308,8 @@ var import_datasource2;
 var init_dbos_admission_config = __esm(() => {
   init_dbos_admission_pool();
   init_dbos_launch_lock();
+  init_dbos_owner_fence();
+  init_dbos_process_owner();
   init_dbos_recoverable_pool();
   import_datasource2 = __toESM(require_datasource(), 1);
 });
@@ -81358,7 +81945,7 @@ function getDurableBackendProcessOwner() {
 }
 
 // dist/builtin/workflows/src/durable/dbos-backend.ts
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 
 // dist/builtin/workflows/src/durable/format-version.ts
 var DURABLE_FORMAT_VERSION = 3;
@@ -82221,10 +82808,10 @@ function isForeignLiveWorkflow(candidate, localExecutorId, now = Date.now()) {
     return false;
   if (candidate.ownerExecutorId === undefined || candidate.ownerExecutorId === localExecutorId)
     return false;
-  return now - candidate.updatedAt < FOREIGN_LIVE_WORKFLOW_WINDOW_MS;
+  return candidate.ownerLiveness === "alive" || now - candidate.updatedAt < FOREIGN_LIVE_WORKFLOW_WINDOW_MS;
 }
 function isLiveRunningWorkflow(candidate, now = Date.now()) {
-  return candidate.status === "running" && now - candidate.updatedAt < FOREIGN_LIVE_WORKFLOW_WINDOW_MS;
+  return candidate.status === "running" && (candidate.ownerLiveness === "alive" || now - candidate.updatedAt < FOREIGN_LIVE_WORKFLOW_WINDOW_MS);
 }
 
 // dist/builtin/workflows/src/durable/durable-hash.ts
@@ -82274,7 +82861,7 @@ class InMemoryDurableBackend {
   workflows = new Map;
   promptReservations = new Map;
   deletedWorkflowIds = new Set;
-  registerWorkflow(handle) {
+  registerWorkflow(handle, authoritativeOwner = false) {
     this.deletedWorkflowIds.delete(handle.workflowId);
     const existing = this.workflows.get(handle.workflowId);
     const completedCheckpoints = handle.completedCheckpoints ?? existing?.handle.completedCheckpoints ?? 0;
@@ -82288,7 +82875,7 @@ class InMemoryDurableBackend {
       status: handle.status,
       ...handle.invocationCwd !== undefined ? { invocationCwd: handle.invocationCwd } : existing?.handle.invocationCwd !== undefined ? { invocationCwd: existing.handle.invocationCwd } : {},
       ...handle.origin !== undefined ? { origin: handle.origin } : existing?.handle.origin !== undefined ? { origin: existing.handle.origin } : {},
-      modelOwner: existing?.handle.modelOwner ?? handle.modelOwner,
+      modelOwner: authoritativeOwner ? handle.modelOwner : existing?.handle.modelOwner ?? handle.modelOwner,
       ...handle.workflowCwd !== undefined ? { workflowCwd: handle.workflowCwd } : existing?.handle.workflowCwd !== undefined ? { workflowCwd: existing.handle.workflowCwd } : {},
       ...handle.repositoryRoot !== undefined ? { repositoryRoot: handle.repositoryRoot } : existing?.handle.repositoryRoot !== undefined ? { repositoryRoot: existing.handle.repositoryRoot } : {},
       ...handle.gitWorktreeRoot !== undefined ? { gitWorktreeRoot: handle.gitWorktreeRoot } : existing?.handle.gitWorktreeRoot !== undefined ? { gitWorktreeRoot: existing.handle.gitWorktreeRoot } : {},
@@ -82302,7 +82889,9 @@ class InMemoryDurableBackend {
       ...handle.rootWorkflowId !== undefined ? { rootWorkflowId: handle.rootWorkflowId } : {},
       ...handle.resumable !== undefined ? { resumable: handle.resumable } : {},
       ...workflowFailureFields(hasWorkflowFailureMetadata(handle) ? handle : handle.status === "running" ? undefined : existing?.handle),
-      ...handle.ownerExecutorId !== undefined ? { ownerExecutorId: handle.ownerExecutorId } : existing?.handle.ownerExecutorId !== undefined ? { ownerExecutorId: existing.handle.ownerExecutorId } : {}
+      ...handle.ownerExecutorId !== undefined ? { ownerExecutorId: handle.ownerExecutorId } : existing?.handle.ownerExecutorId !== undefined ? { ownerExecutorId: existing.handle.ownerExecutorId } : {},
+      ...handle.ownerLiveness !== undefined ? { ownerLiveness: handle.ownerLiveness } : {},
+      ...handle.legacyRecoveryPending === true ? { legacyRecoveryPending: true } : {}
     };
     if (existing)
       existing.handle = full;
@@ -82452,11 +83041,14 @@ class InMemoryDurableBackend {
     if (pendingPrompts !== undefined)
       this.promptReservations.delete(workflowId);
   }
-  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt) {
-    const current = this.workflows.get(workflowId)?.handle;
+  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt, modelOwner) {
+    const record = this.workflows.get(workflowId);
+    const current = record?.handle;
     if (current === undefined || !expected.includes(current.status) || expectedUpdatedAt !== undefined && current.updatedAt !== expectedUpdatedAt)
       return false;
     this.setWorkflowStatus(workflowId, status, pendingPrompts, resumable);
+    if (modelOwner !== undefined && record !== undefined)
+      record.handle = { ...record.handle, modelOwner };
     return true;
   }
   adjustPendingPrompts(workflowId, delta) {
@@ -82529,6 +83121,7 @@ class InMemoryDurableBackend {
       pendingStageMessages: h.pendingStageMessages ?? [],
       ...h.possibleStages !== undefined ? { possibleStages: h.possibleStages } : {},
       ...h.ownerExecutorId !== undefined ? { ownerExecutorId: h.ownerExecutorId } : {},
+      ...h.legacyRecoveryPending === true ? { legacyRecoveryPending: true } : {},
       ...h.sessionFile !== undefined ? { sessionFile: h.sessionFile } : {},
       ...h.label !== undefined ? { label: h.label } : {},
       ...h.rootWorkflowId !== undefined ? { rootWorkflowId: h.rootWorkflowId } : {},
@@ -85359,6 +85952,7 @@ function encodeMetadata(metadata) {
       } : {},
       ...metadata.ownerExecutorId !== undefined ? { ownerExecutorId: metadata.ownerExecutorId } : {},
       ...metadata.transitionClaimId !== undefined ? { transitionClaimId: metadata.transitionClaimId } : {},
+      ...metadata.legacyRecoveryPending === true ? { legacyRecoveryPending: true } : {},
       ...metadata.sessionFile !== undefined ? { sessionFile: metadata.sessionFile } : {},
       ...metadata.label !== undefined ? { label: metadata.label } : {},
       ...metadata.rootWorkflowId !== undefined ? { rootWorkflowId: metadata.rootWorkflowId } : {},
@@ -85421,7 +86015,7 @@ function parseDurableWorkflowMetadata(value2, workflowId) {
     return;
   const possibleStages = coercePossibleStages(serialized.possibleStages);
   const metadata = value2;
-  if (metadata.workflowId !== workflowId || typeof metadata.workflowId !== "string" || typeof metadata.name !== "string" || typeof metadata.inputs !== "object" || metadata.inputs === null || Array.isArray(metadata.inputs) || typeof metadata.status !== "string" || !isDurableWorkflowStatus(metadata.status) || typeof metadata.completedCheckpoints !== "number" || typeof metadata.createdAt !== "number" || typeof metadata.pendingPrompts !== "number" || typeof metadata.promptReservationEpoch !== "string" || typeof metadata.updatedAt !== "number" || metadata.ownerExecutorId !== undefined && typeof metadata.ownerExecutorId !== "string" || metadata.transitionClaimId !== undefined && typeof metadata.transitionClaimId !== "string" || metadata.sessionFile !== undefined && typeof metadata.sessionFile !== "string" || metadata.label !== undefined && typeof metadata.label !== "string" || metadata.rootWorkflowId !== undefined && typeof metadata.rootWorkflowId !== "string" || metadata.resumable !== undefined && typeof metadata.resumable !== "boolean" || metadata.exited !== undefined && typeof metadata.exited !== "boolean" || metadata.exitReason !== undefined && typeof metadata.exitReason !== "string" || metadata.error !== undefined && typeof metadata.error !== "string" || metadata.failureKind !== undefined && !isWorkflowFailureKind(metadata.failureKind) || metadata.failureCode !== undefined && !isWorkflowFailureCode(metadata.failureCode) || metadata.failureRecoverability !== undefined && !isWorkflowFailureRecoverability(metadata.failureRecoverability) || metadata.failureDisposition !== undefined && !isWorkflowFailureDisposition(metadata.failureDisposition) || metadata.failedToolNodeId !== undefined && typeof metadata.failedToolNodeId !== "string" || metadata.invocationCwd !== undefined && typeof metadata.invocationCwd !== "string" || metadata.workflowCwd !== undefined && typeof metadata.workflowCwd !== "string" || metadata.repositoryRoot !== undefined && typeof metadata.repositoryRoot !== "string" || metadata.gitWorktreeRoot !== undefined && typeof metadata.gitWorktreeRoot !== "string")
+  if (metadata.workflowId !== workflowId || typeof metadata.workflowId !== "string" || typeof metadata.name !== "string" || typeof metadata.inputs !== "object" || metadata.inputs === null || Array.isArray(metadata.inputs) || typeof metadata.status !== "string" || !isDurableWorkflowStatus(metadata.status) || typeof metadata.completedCheckpoints !== "number" || typeof metadata.createdAt !== "number" || typeof metadata.pendingPrompts !== "number" || typeof metadata.promptReservationEpoch !== "string" || typeof metadata.updatedAt !== "number" || metadata.ownerExecutorId !== undefined && typeof metadata.ownerExecutorId !== "string" || metadata.transitionClaimId !== undefined && typeof metadata.transitionClaimId !== "string" || metadata.legacyRecoveryPending !== undefined && metadata.legacyRecoveryPending !== true || metadata.sessionFile !== undefined && typeof metadata.sessionFile !== "string" || metadata.label !== undefined && typeof metadata.label !== "string" || metadata.rootWorkflowId !== undefined && typeof metadata.rootWorkflowId !== "string" || metadata.resumable !== undefined && typeof metadata.resumable !== "boolean" || metadata.exited !== undefined && typeof metadata.exited !== "boolean" || metadata.exitReason !== undefined && typeof metadata.exitReason !== "string" || metadata.error !== undefined && typeof metadata.error !== "string" || metadata.failureKind !== undefined && !isWorkflowFailureKind(metadata.failureKind) || metadata.failureCode !== undefined && !isWorkflowFailureCode(metadata.failureCode) || metadata.failureRecoverability !== undefined && !isWorkflowFailureRecoverability(metadata.failureRecoverability) || metadata.failureDisposition !== undefined && !isWorkflowFailureDisposition(metadata.failureDisposition) || metadata.failedToolNodeId !== undefined && typeof metadata.failedToolNodeId !== "string" || metadata.invocationCwd !== undefined && typeof metadata.invocationCwd !== "string" || metadata.workflowCwd !== undefined && typeof metadata.workflowCwd !== "string" || metadata.repositoryRoot !== undefined && typeof metadata.repositoryRoot !== "string" || metadata.gitWorktreeRoot !== undefined && typeof metadata.gitWorktreeRoot !== "string")
     return;
   const { origin, possibleStages: rawPossibleStages, ...metadataWithoutOrigin } = metadata;
   return {
@@ -85896,40 +86490,20 @@ function classifyDbosDeletionTombstone(records, workflowId) {
   return isCurrentDurableFormat(raw.version) ? "current" : "unknown";
 }
 
-// dist/builtin/workflows/src/durable/dbos-process-owner.ts
-var DBOS_PROCESS_OWNER_KEY = Symbol.for("atomic-workflows/dbos-process-owner@1");
-function emptyOwner2() {
-  return {
-    version: 1,
-    state: "uninitialized",
-    configured: undefined,
-    active: undefined,
-    launchPromise: undefined,
-    shutdownPromise: undefined,
-    failure: undefined,
-    wrappers: undefined,
-    leases: new Set
-  };
-}
-function ownerBag2() {
-  return globalThis;
-}
-function getDbosProcessOwner() {
-  const bag = ownerBag2();
-  const existing = bag[DBOS_PROCESS_OWNER_KEY];
-  if (existing !== undefined && existing.version === 1)
-    return existing;
-  const created = emptyOwner2();
-  bag[DBOS_PROCESS_OWNER_KEY] = created;
-  return created;
-}
+// dist/builtin/workflows/src/durable/dbos-backend.ts
+init_dbos_process_owner();
 
 // dist/builtin/workflows/src/durable/dbos-sdk-handle.ts
-var ATOMIC_EXECUTOR_ID = `atomic-${process.pid.toString(36)}-${crypto.randomUUID().slice(0, 8)}`;
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
+init_dbos_owner_fence();
+init_dbos_process_owner();
 function getAtomicExecutorId() {
-  return ATOMIC_EXECUTOR_ID;
+  const owner = getDbosProcessOwner();
+  owner.executorId ??= `atomic-db-${crypto.randomUUID()}`;
+  return owner.executorId;
 }
-function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
+function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow, fence, previousExecutorIds = []) {
   const checkpointId = (workflowId, stepName) => `${workflowId}:checkpoint:${stepName}`;
   async function stepRecord(status, prefix) {
     if (status.status !== "SUCCESS")
@@ -85943,10 +86517,18 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
     const output = status.output === undefined || typeof status.output === "string" ? await dbos.retrieveWorkflow(id).getResult() : status.output;
     return { stepName, output, completedAt: status.createdAt };
   }
-  return {
+  const raw = {
     launch: () => dbos.launch(),
     shutdown: () => dbos.shutdown(),
     async startWorkflow(workflowId, name, inputs) {
+      if (fence !== undefined) {
+        const existing = await raw.retrieveWorkflow(workflowId);
+        if (existing !== undefined) {
+          if (existing.name !== name || !isDeepStrictEqual2(existing.inputs, inputs))
+            throw new Error("Workflow root identity changed during admission");
+          return;
+        }
+      }
       try {
         await dbos.startWorkflow(mainWorkflow, { workflowID: workflowId })(name, { ...inputs });
       } catch (err) {
@@ -85965,7 +86547,10 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
       await dbos.cancelWorkflow(workflowId, { cancelChildren: true });
     },
     async resumeWorkflow(workflowId) {
-      await dbos.resumeWorkflow(workflowId);
+      if (fence === undefined)
+        await dbos.resumeWorkflow(workflowId);
+      else if (await raw.retrieveWorkflow(workflowId) === undefined)
+        throw new Error("Workflow root is unavailable for resume");
     },
     async listAllWorkflows() {
       const statuses = await dbos.listWorkflows({
@@ -85994,6 +86579,12 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
       return status !== undefined && (status.workflowID ?? status.workflowId) === id ? stepRecord(status, prefix) : undefined;
     },
     async recordStepOutput(workflowId, stepName, output) {
+      if (fence !== undefined) {
+        const id = checkpointId(workflowId, stepName);
+        const existing = (await dbos.listWorkflows({ workflowIDs: [id], limit: 1 }))[0];
+        if (existing?.status !== undefined && ["PENDING", "ENQUEUED", "CANCELLED", "ERROR", "DELAYED"].includes(existing.status))
+          await dbos.deleteWorkflows([id], false);
+      }
       let handle;
       try {
         handle = await dbos.startWorkflow(checkpointWorkflow, { workflowID: checkpointId(workflowId, stepName) })(workflowId, stepName, output);
@@ -86017,6 +86608,135 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
       await dbos.deleteWorkflows([...new Set([workflowId, ...checkpointIds])], true);
     }
   };
+  if (fence === undefined)
+    return raw;
+  const claims = new AsyncLocalStorage3;
+  const rowAuthority = (workflowId, current) => ({
+    root: workflowId,
+    actor: fence.executorId,
+    ...current.kind === "current" ? { owner: current.metadata.ownerExecutorId, generation: current.generation } : {},
+    enroll: current.kind === "unavailable" || current.kind === "current" && isDatabaseExecutor(current.metadata.ownerExecutorId)
+  });
+  const mutate = async (workflowId, callback, step) => fence.write(workflowId, async () => {
+    const current = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+    const claimed = claims.getStore();
+    if (claimed === undefined && current.kind === "current" && current.metadata.ownerExecutorId !== fence.executorId)
+      throw new Error("Workflow database ownership changed; stale executor writes are refused");
+    let output = step === undefined ? undefined : classifyLatestMetadata([{ stepName: step.name, output: step.output }], workflowId);
+    let persistedStep = step;
+    if (step !== undefined && output?.kind === "current" && current.kind === "current" && !step.name.endsWith(":claim") && output.metadata.ownerExecutorId === fence.executorId && output.generation <= current.generation) {
+      const updatedAt = Math.max(current.generation + 1, output.metadata.updatedAt, Date.now());
+      persistedStep = {
+        name: metadataStepName(updatedAt),
+        output: encodeMetadata({ ...output.metadata, updatedAt })
+      };
+      output = classifyLatestMetadata([{ stepName: persistedStep.name, output: persistedStep.output }], workflowId);
+    }
+    const authority = claimed?.authority ?? rowAuthority(workflowId, current);
+    const capability = output?.kind === "current" && step?.name.endsWith(":claim") ? {
+      ...authority,
+      claim: output.metadata.transitionClaimId,
+      checkpoint: checkpointId(workflowId, step.name)
+    } : authority;
+    const record = persistedStep;
+    await fence.withRowAuthority(capability, record === undefined ? callback : () => raw.recordStepOutput(workflowId, record.name, record.output));
+    if (claimed !== undefined && output?.kind === "current")
+      claimed.authority = {
+        ...capability,
+        owner: output.metadata.ownerExecutorId,
+        generation: output.generation
+      };
+  });
+  return {
+    ...raw,
+    executorId: fence.executorId,
+    generationLost: () => fence.invalidated,
+    forkGeneration: () => {
+      const next = getDbosProcessOwner().createExecutorFence?.();
+      if (next === undefined)
+        throw new Error("Workflow ownership fence cannot create a recovery generation");
+      fence.close().catch(() => {});
+      return createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow, next, [
+        ...previousExecutorIds,
+        fence.executorId
+      ]);
+    },
+    adoptPreviousGeneration: async (workflowId) => {
+      if (previousExecutorIds.length === 0)
+        return;
+      return await fence.write(workflowId, async () => {
+        const current = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+        if (current.kind !== "current" || current.metadata.ownerExecutorId === fence.executorId)
+          return;
+        const previousExecutorId = current.metadata.ownerExecutorId;
+        if (previousExecutorId === undefined || !previousExecutorIds.includes(previousExecutorId))
+          throw new Error("Workflow database ownership changed; stale executor writes are refused");
+        const metadata = {
+          ...current.metadata,
+          ownerExecutorId: fence.executorId,
+          transitionClaimId: crypto.randomUUID(),
+          updatedAt: Math.max(Date.now(), current.metadata.updatedAt + 1)
+        };
+        const adopted = await fence.recover(previousExecutorId, async () => {
+          await fence.withRowAuthority({
+            ...rowAuthority(workflowId, current),
+            claim: metadata.transitionClaimId,
+            checkpoint: checkpointId(workflowId, claimMetadataStepName(current.generation))
+          }, () => raw.recordStepOutput(workflowId, claimMetadataStepName(current.generation), encodeMetadata(metadata)));
+          return metadata;
+        });
+        if (adopted === undefined)
+          throw new Error("Workflow previous execution generation is still active");
+        return adopted;
+      }, true);
+    },
+    enrollLegacyWorkflow: async (workflowId, modelOwner) => fence.write(workflowId, async () => {
+      const current = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+      if (current.kind !== "current" || isDatabaseExecutor(current.metadata.ownerExecutorId) && current.metadata.legacyRecoveryPending !== true || !["running", "paused", "blocked"].includes(current.metadata.status) || current.metadata.rootWorkflowId !== undefined && current.metadata.rootWorkflowId !== workflowId)
+        return;
+      const metadata = {
+        ...current.metadata,
+        modelOwner,
+        ownerExecutorId: fence.executorId,
+        status: "blocked",
+        resumable: true,
+        legacyRecoveryPending: true,
+        updatedAt: Math.max(Date.now(), current.metadata.updatedAt + 1)
+      };
+      const retry = isDatabaseExecutor(current.metadata.ownerExecutorId);
+      const transitionClaimId = crypto.randomUUID();
+      const stepName = retry ? claimMetadataStepName(current.generation) : metadataStepName(Math.max(current.generation + 1, metadata.updatedAt));
+      const persist = () => fence.withRowAuthority({
+        ...rowAuthority(workflowId, current),
+        enroll: true,
+        ...retry ? { claim: transitionClaimId, checkpoint: checkpointId(workflowId, stepName) } : {}
+      }, () => raw.recordStepOutput(workflowId, stepName, encodeMetadata({ ...metadata, ...retry ? { transitionClaimId } : {} })));
+      if (retry) {
+        const recovered = await fence.recover(current.metadata.ownerExecutorId, async () => {
+          await persist();
+          return true;
+        });
+        if (recovered !== true)
+          return;
+      } else
+        await persist();
+      return metadata;
+    }, true),
+    ownerLiveness: (executorId) => fence.liveness(executorId),
+    withWorkflowClaim: (workflowId, callback) => fence.write(workflowId, async () => {
+      const authoritative = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+      const claim = () => claims.run({ authority: { ...rowAuthority(workflowId, authoritative), claim: crypto.randomUUID() } }, callback);
+      if (authoritative.kind === "current" && authoritative.metadata.status === "running" && authoritative.metadata.ownerExecutorId !== fence.executorId) {
+        return await fence.recover(authoritative.metadata.ownerExecutorId, claim) ?? false;
+      }
+      return await claim();
+    }, true),
+    startWorkflow: (id, name, inputs) => mutate(id, () => raw.startWorkflow(id, name, inputs)),
+    cancelWorkflow: (id) => mutate(id, () => raw.cancelWorkflow(id)),
+    resumeWorkflow: (id) => mutate(id, () => raw.resumeWorkflow(id)),
+    recordStepOutput: (id, step, output) => mutate(id, () => raw.recordStepOutput(id, step, output), { name: step, output }),
+    deleteWorkflowData: (id) => mutate(id, () => raw.deleteWorkflowData(id))
+  };
 }
 function isDbosDuplicateWorkflowError(err) {
   const msg = err instanceof Error ? err.message : String(err);
@@ -86043,6 +86763,7 @@ function statusToInfo(status, fallbackId) {
 }
 
 // dist/builtin/workflows/src/durable/dbos-system-database-url.ts
+init_dbos_process_owner();
 function nonEmptyTrimmed(value2) {
   const trimmed = value2?.trim();
   return trimmed === undefined || trimmed.length === 0 ? undefined : trimmed;
@@ -86057,9 +86778,7 @@ class DbosSystemDatabaseConflictError extends Error {
 function redactDatabaseUrl(url) {
   try {
     const parsed = new URL(url);
-    if (parsed.password !== "")
-      parsed.password = "***";
-    return parsed.toString();
+    return parsed.host;
   } catch {
     return "the requested database";
   }
@@ -86099,6 +86818,8 @@ async function configureDbosDurableBackend(config) {
   const sdk = await importDbosSdk();
   const owner = getDbosProcessOwner();
   const existing = owner.wrappers;
+  if (existing !== undefined && owner.executorFence === undefined)
+    throw new Error("Existing workflow executor has no database ownership fence; restart the host before recovering workflows");
   let launch = owner.active?.launch ?? (() => sdk.launch());
   let checkReady;
   if (existing === undefined) {
@@ -86121,12 +86842,30 @@ async function configureDbosDurableBackend(config) {
   if (existing === undefined) {
     owner.wrappers = { mainWorkflow, checkpointWorkflow };
   }
+  let backendFence = owner.executorFence;
+  let backend = new DbosDurableBackend(createRealDbosHandle(sdk, mainWorkflow, checkpointWorkflow, backendFence), {
+    checkReady
+  });
   return {
-    backend: new DbosDurableBackend(createRealDbosHandle(sdk, mainWorkflow, checkpointWorkflow), {
-      checkReady
-    }),
-    launch,
-    shutdown: () => sdk.shutdown()
+    get backend() {
+      return backend;
+    },
+    launch: async () => {
+      await launch();
+      if (backendFence !== owner.executorFence && backendFence?.closed) {
+        backendFence = owner.executorFence;
+        backend = new DbosDurableBackend(createRealDbosHandle(sdk, mainWorkflow, checkpointWorkflow, backendFence), { checkReady });
+      }
+    },
+    shutdown: async () => {
+      const results = await Promise.allSettled([
+        sdk.shutdown(),
+        ...[...owner.executorFences ?? []].map((fence) => fence.close())
+      ]);
+      const errors = results.filter((result) => result.status === "rejected").map((result) => result.reason instanceof Error ? result.reason : new Error(String(result.reason)));
+      if (errors.length > 0)
+        throw new AggregateError(errors, "Workflow database shutdown failed");
+    }
   };
 }
 async function importDbosSdk() {
@@ -86159,13 +86898,18 @@ class DbosDurableBackend {
   unavailableAdmissions = new Set;
   unavailableCheckpoints = new Set;
   pendingRecoveryAdmissions = new Set;
+  ownerLiveness = new Map;
   admissionMetadataAttempted = new Set;
   admissionSettlements = new Map;
   admissionRecoveries = new Map;
   admissionRecoveryControllers = new Map;
+  fixedGeneration = false;
+  generationIsCurrent;
+  rebindInitialAdmission;
+  admitted = false;
   constructor(sdk, options) {
     this.sdk = sdk;
-    this.executorId = options?.executorId ?? getAtomicExecutorId();
+    this.executorId = options?.executorId ?? sdk.executorId ?? getAtomicExecutorId();
     this.onUnavailable = options?.onUnavailable;
     this.checkReady = options?.checkReady;
     this.promptReservations = new DbosPromptReservationTracker({
@@ -86176,6 +86920,55 @@ class DbosDurableBackend {
       }
     });
   }
+  async enrollLegacyWorkflow(workflowId, options) {
+    if (options.olderWorkersStopped !== true || this.sdk.enrollLegacyWorkflow === undefined)
+      return false;
+    this.ensureGeneration();
+    return await boundedAdmission((signal) => dbosAdmissionContext.run(signal, async () => {
+      signal.throwIfAborted();
+      const metadata = await this.sdk.enrollLegacyWorkflow(workflowId, options.modelOwner);
+      signal.throwIfAborted();
+      if (metadata === undefined)
+        return false;
+      this.applyMetadata(workflowId, metadata);
+      this.current.add(workflowId);
+      return true;
+    }), options.signal);
+  }
+  executionView() {
+    if (this.fixedGeneration || this.sdk.forkGeneration === undefined)
+      return this;
+    this.ensureGeneration();
+    const view = new DbosDurableBackend(this.sdk, {
+      executorId: this.executorId,
+      checkReady: this.checkReady,
+      onUnavailable: this.onUnavailable
+    });
+    const reservations = view.promptReservations;
+    Object.assign(view, this);
+    Object.assign(view, {
+      promptReservations: reservations,
+      fixedGeneration: true,
+      generationIsCurrent: () => this.sdk === view.sdk,
+      rebindInitialAdmission: () => {
+        this.ensureGeneration();
+        view.sdk = this.sdk;
+        view.executorId = this.executorId;
+      }
+    });
+    return view;
+  }
+  ensureGeneration() {
+    if (this.fixedGeneration) {
+      if (this.generationIsCurrent?.() === false)
+        throw new DbosDependencyError("Workflow database ownership generation changed; stale execution writes are refused");
+      return;
+    }
+    if (this.sdk.generationLost?.() && this.sdk.forkGeneration !== undefined) {
+      this.sdk = this.sdk.forkGeneration();
+      this.executorId = this.sdk.executorId ?? this.executorId;
+    }
+  }
   isAdmissionUnavailable(workflowId) {
     return this.unavailableAdmissions.has(workflowId);
   }
@@ -86192,6 +86985,8 @@ class DbosDurableBackend {
     return this.admissionSettlements.has(workflowId);
   }
   admitWorkflow(workflowId, registration, signal) {
+    if (!this.admitted)
+      this.rebindInitialAdmission?.();
     const pending = this.performAdmission(workflowId, registration, signal);
     this.admissionSettlements.set(workflowId, pending);
     pending.then(() => {
@@ -86199,6 +86994,7 @@ class DbosDurableBackend {
         this.admissionSettlements.delete(workflowId);
     }, () => {});
     return pending.then(async () => {
+      this.admitted = true;
       await dbosAdmissionContext.run(signal, () => this.flush(workflowId));
       signal.throwIfAborted();
       this.admissionMetadataAttempted.delete(workflowId);
@@ -86219,12 +87015,13 @@ class DbosDurableBackend {
         await this.flushWrites(workflowId);
         signal.throwIfAborted();
       }), signal);
+      this.ensureGeneration();
       this.admissionUnavailable = false;
       this.unavailableAdmissions.delete(workflowId);
       this.unavailableCheckpoints.delete(workflowId);
       this.pendingRecoveryAdmissions.delete(workflowId);
     } catch (error) {
-      if (isDbosDependencyError(error)) {
+      if (isDbosDependencyError(error) && this.generationIsCurrent?.() !== false) {
         this.admissionMetadataAttempted.delete(workflowId);
         this.admissionUnavailable = true;
         this.unavailableAdmissions.add(workflowId);
@@ -86250,6 +87047,7 @@ class DbosDurableBackend {
     });
   }
   registerWorkflow(handle) {
+    this.ensureGeneration();
     if (this.invalid.has(handle.workflowId)) {
       throw new DurableNestedTopologyError(`workflow ${handle.workflowId} contains malformed current DBOS records`);
     }
@@ -86291,6 +87089,7 @@ class DbosDurableBackend {
     return persisted;
   }
   recordCheckpoint(checkpoint) {
+    this.ensureGeneration();
     if (!this.isWorkflowLoadable(checkpoint.workflowId))
       return;
     this.mem.recordCheckpoint(checkpoint);
@@ -86319,7 +87118,7 @@ class DbosDurableBackend {
       });
       signal.throwIfAborted();
     }), options?.signal ?? dbosAdmissionContext.getStore(), undefined, "Workflow database checkpoint timed out. Restore PostgreSQL and inspect the run before resuming; external outcomes may be unknown.").catch((error) => {
-      if (isDbosDependencyError(error)) {
+      if (isDbosDependencyError(error) && this.generationIsCurrent?.() !== false) {
         this.unavailableCheckpoints.add(checkpoint.workflowId);
         const errors = this.writeErrors.get(checkpoint.workflowId);
         if (errors !== undefined)
@@ -86367,12 +87166,14 @@ class DbosDurableBackend {
     return this.mem.listCheckpoints(workflowId);
   }
   getWorkflow(workflowId) {
-    return this.mem.getWorkflow(workflowId);
+    const handle = this.mem.getWorkflow(workflowId);
+    return handle === undefined || this.sdk.ownerLiveness === undefined ? handle : { ...handle, ownerLiveness: this.ownerLiveness.get(handle.ownerExecutorId ?? "") ?? "unknown" };
   }
   getLoadableWorkflow(workflowId) {
-    return this.isWorkflowLoadable(workflowId) ? this.mem.getWorkflow(workflowId) : undefined;
+    return this.isWorkflowLoadable(workflowId) ? this.getWorkflow(workflowId) : undefined;
   }
   setWorkflowStatus(workflowId, status, pendingPrompts, resumable, failure) {
+    this.ensureGeneration();
     if (status === "cancelled" || status === "completed" || resumable === false) {
       this.admissionRecoveryControllers.get(workflowId)?.abort(new Error("Workflow recovery superseded by terminal control."));
     }
@@ -86396,9 +87197,10 @@ class DbosDurableBackend {
       await this.writeMetadata(workflowId);
     });
   }
-  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt) {
+  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt, modelOwner) {
+    this.ensureGeneration();
     let records = [];
-    return await transitionDbosWorkflowStatus({
+    const transition = () => transitionDbosWorkflowStatus({
       expectedStatuses: expected,
       status,
       flush: () => this.flush(workflowId),
@@ -86412,14 +87214,25 @@ class DbosDurableBackend {
         const pendingPrompts = this.promptReservations.hydrate(workflowId, entry.pendingPrompts, records, entry.promptReservationEpoch);
         this.applyMetadata(workflowId, { ...entry, pendingPrompts });
       },
-      claim: (authoritative, generation) => this.claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable),
+      claim: (authoritative, generation) => this.claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable, modelOwner),
       write: async () => {
+        const handle = this.mem.getWorkflow(workflowId);
+        if (handle !== undefined)
+          this.mem.registerWorkflow({
+            ...handle,
+            legacyRecoveryPending: undefined,
+            ...modelOwner !== undefined ? { modelOwner } : {}
+          }, true);
         this.setWorkflowStatus(workflowId, status, pendingPrompts, resumable);
         await this.flush(workflowId);
       }
     });
+    if (this.sdk.withWorkflowClaim === undefined)
+      return await transition();
+    await this.flush(workflowId);
+    return await this.sdk.withWorkflowClaim(workflowId, transition);
   }
-  async claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable) {
+  async claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable, modelOwner) {
     const stepName = claimMetadataStepName(generation);
     const transitionClaimId = crypto.randomUUID();
     const claim = {
@@ -86427,6 +87240,8 @@ class DbosDurableBackend {
       status,
       ...pendingPrompts !== undefined ? { pendingPrompts } : {},
       ...resumable !== undefined ? { resumable } : {},
+      ...modelOwner === undefined ? {} : { modelOwner },
+      legacyRecoveryPending: undefined,
       ownerExecutorId: this.executorId,
       transitionClaimId,
       updatedAt: Math.max(Date.now(), authoritative.updatedAt + 1)
@@ -86568,7 +87383,7 @@ class DbosDurableBackend {
         this.mem.recordCheckpoint(classified.checkpoint);
       }
       const handle = this.getLoadableWorkflow(workflowId);
-      return handle === undefined ? { kind: "malformed" } : { kind: "current", handle };
+      return handle === undefined ? { kind: "malformed" } : await this.withOwnerLiveness(handle);
     }
     const info = await this.sdk.retrieveWorkflow(workflowId);
     if (info !== undefined)
@@ -86591,6 +87406,7 @@ class DbosDurableBackend {
     }
   }
   reconcileWorkflowAdmission(workflowId, signal) {
+    this.ensureGeneration();
     signal?.throwIfAborted();
     if (!this.unavailableAdmissions.has(workflowId) && !this.unavailableCheckpoints.has(workflowId))
       return Promise.resolve();
@@ -86605,11 +87421,13 @@ class DbosDurableBackend {
         return;
       if (metadata.resumable === false || metadata.status === "cancelled" || metadata.status === "completed")
         return;
-      if (!await reconcileDbosAdmission(this.sdk, this.promptReservations.metadata(workflowId, metadata), this.unavailableAdmissions.has(workflowId), this.checkReady)) {
+      if (!await reconcileDbosAdmission(this.sdk, { ...this.promptReservations.metadata(workflowId, metadata), ownerExecutorId: this.executorId }, this.unavailableAdmissions.has(workflowId), this.checkReady)) {
         await this.suppressWorkflow(workflowId);
         return;
       }
       admissionSignal.throwIfAborted();
+      await this.sdk.adoptPreviousGeneration?.(workflowId);
+      admissionSignal.throwIfAborted();
       const info = await this.sdk.retrieveWorkflow(workflowId);
       if (info === undefined)
         return;
@@ -86646,7 +87464,7 @@ class DbosDurableBackend {
       return { kind: deletion === "current" ? "deleted" : "malformed" };
     }
     const metadata = classifyLatestMetadata(records, info.workflowId);
-    if (metadata.kind !== "current" || expected !== undefined && (metadata.metadata.name !== expected.name || !isDeepStrictEqual2(metadata.metadata.inputs, expected.inputs))) {
+    if (metadata.kind !== "current" || expected !== undefined && (metadata.metadata.name !== expected.name || !isDeepStrictEqual3(metadata.metadata.inputs, expected.inputs))) {
       await this.suppressWorkflow(info.workflowId);
       return { kind: "malformed" };
     }
@@ -86680,10 +87498,17 @@ class DbosDurableBackend {
     });
     const handle = this.getLoadableWorkflow(info.workflowId);
     if (handle !== undefined)
-      return { kind: "current", handle };
+      return await this.withOwnerLiveness(handle);
     await this.suppressWorkflow(info.workflowId);
     return { kind: "malformed" };
   }
+  async withOwnerLiveness(handle) {
+    if (this.sdk.ownerLiveness === undefined)
+      return { kind: "current", handle };
+    const ownerLiveness = await this.sdk.ownerLiveness(handle.ownerExecutorId);
+    this.ownerLiveness.set(handle.ownerExecutorId ?? "", ownerLiveness);
+    return { kind: "current", handle: { ...handle, ownerLiveness } };
+  }
   async suppressWorkflow(workflowId) {
     this.invalid.add(workflowId);
     this.current.delete(workflowId);
@@ -86697,10 +87522,21 @@ class DbosDurableBackend {
       return Promise.resolve();
     const previous = this.writeQueues.get(workflowId) ?? Promise.resolve();
     const next = previous.then(async () => {
+      this.ensureGeneration();
+      const adopted = await this.sdk.adoptPreviousGeneration?.(workflowId);
+      const local = this.mem.getWorkflow(workflowId);
+      if (adopted !== undefined && local !== undefined)
+        this.mem.registerWorkflow({
+          ...local,
+          ownerExecutorId: adopted.ownerExecutorId,
+          updatedAt: Math.max(local.updatedAt, adopted.updatedAt + 1)
+        }, true);
       if (!signal?.aborted)
         await fn();
     });
     const tracked = next.catch((err) => {
+      if (this.generationIsCurrent?.() === false)
+        return;
       const error = err instanceof Error ? err : new Error(String(err));
       const errors = this.writeErrors.get(workflowId) ?? [];
       errors.push(error);
@@ -86737,7 +87573,7 @@ class DbosDurableBackend {
   applyMetadata(workflowId, metadata) {
     if (metadata.workflowId !== workflowId)
       return;
-    this.mem.registerWorkflow(metadata);
+    this.mem.registerWorkflow(metadata, true);
   }
 }
 
@@ -86773,7 +87609,7 @@ import { tmpdir, uptime } from "node:os";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute3, join as join5, relative as relative2, sep as sep2 } from "node:path";
 
 // dist/builtin/workflows/src/durable/dbos-embedded-postgres-root.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import {
   chmod,
   chown,
@@ -87256,8 +88092,8 @@ async function snapshotSourceRuntime(root, publisher, progress) {
   const rootStat = await lstat(root);
   assertRuntimeRoot(root, rootStat);
   const rootRealPath = await realpath(root);
-  const sourceHash = createHash2("sha256");
-  const sealedHash = createHash2("sha256");
+  const sourceHash = createHash4("sha256");
+  const sealedHash = createHash4("sha256");
   await hashSourceEntry(sourceHash, sealedHash, root, ".", rootRealPath, publisher, progress);
   return { sourceIdentity: sourceHash.digest("hex"), sealedIdentity: sealedHash.digest("hex") };
 }
@@ -87522,7 +88358,7 @@ async function snapshotSealedManifest(root, progress) {
   const rootStat = await lstat(root);
   assertRuntimeRoot(root, rootStat);
   const rootRealPath = await realpath(root);
-  const hash = createHash2("sha256");
+  const hash = createHash4("sha256");
   const entries = [];
   await hashSealedEntry(hash, root, ".", rootRealPath, progress, entries);
   return { version: 1, sealedIdentity: hash.digest("hex"), entries };
@@ -87756,6 +88592,13 @@ function resolveEmbeddedPostgresTarget(host) {
 init_dbos_admission();
 var HEALTH_INTERVAL_MS = 5000;
 var RECOVERY_ATTEMPTS = 3;
+function isMonitoringConnectionTimeout(error) {
+  if (!(error instanceof Error))
+    return false;
+  if ("code" in error)
+    return error.code === "ETIMEDOUT";
+  return error.message === "timeout expired" || error.message === "Connection terminated due to connection timeout";
+}
 function isMonitoringConnectionFailure(error) {
   if (!(error instanceof Error))
     return false;
@@ -87776,6 +88619,7 @@ class PostgresHealth {
   attempts = 0;
   nextRecoveryAt = 0;
   failure;
+  healthySinceFailure = false;
   revision = 0;
   listeners = new Set;
   constructor(operations) {
@@ -87784,6 +88628,18 @@ class PostgresHealth {
   get lastFailure() {
     return this.failure;
   }
+  get endpoint() {
+    return this.operations.url?.();
+  }
+  retainFailure(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const safe = redactedDatabaseMessage(message, this.endpoint);
+    this.failure = new Error(safe);
+    this.healthySinceFailure = false;
+  }
+  dependencyFailure(message) {
+    return new DbosDependencyError(message, this.endpoint === undefined ? undefined : { provider: "managed", url: this.endpoint, failure: this.failure?.message });
+  }
   subscribe(listener) {
     this.listeners.add(listener);
     return () => this.listeners.delete(listener);
@@ -87806,12 +88662,15 @@ class PostgresHealth {
         await this.operations.validate?.(client);
       }
     } catch (error) {
-      this.failure = error instanceof Error ? error : new Error(String(error));
+      this.retainFailure(error);
       if (!isQueryReadTimeout(error)) {
         this.invalidate();
-        throw error;
+        if (this.endpoint === undefined)
+          throw error;
+        const failure = this.dependencyFailure("Managed PostgreSQL connection validation refused. Preserve its data and ownership records.");
+        throw error instanceof DbosDependencyError ? failure : new Error(failure.message);
       }
-      throw new DbosDependencyError("Managed PostgreSQL did not answer a connection identity check in time.");
+      throw this.dependencyFailure("Managed PostgreSQL did not answer a connection identity check in time.");
     }
   }
   check() {
@@ -87850,9 +88709,9 @@ class PostgresHealth {
       try {
         identity = await this.operations.probe();
       } catch (retryError) {
-        if (!isMonitoringConnectionFailure(retryError))
+        if (isMonitoringConnectionTimeout(retryError) || !isMonitoringConnectionFailure(retryError))
           throw retryError;
-        this.failure = retryError;
+        this.retainFailure(retryError);
         return;
       }
     }
@@ -87867,6 +88726,7 @@ class PostgresHealth {
     this.available = identity;
     this.attempts = 0;
     this.nextRecoveryAt = 0;
+    this.healthySinceFailure = true;
     return identity.url;
   }
   async refresh() {
@@ -87875,20 +88735,22 @@ class PostgresHealth {
       if (ready !== undefined)
         return ready;
     } catch (error) {
-      if (isQueryReadTimeout(error)) {
-        this.failure = new DbosDependencyError("Managed PostgreSQL did not answer a health check in time.");
-        throw this.failure;
+      if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error)) {
+        this.retainFailure(new Error("Managed PostgreSQL did not answer a health check in time."));
+        throw this.dependencyFailure("Managed PostgreSQL did not answer a health check in time.");
       }
-      this.failure = error instanceof Error ? error : new Error(String(error));
+      this.retainFailure(error);
       if (!(error instanceof Error && ("code" in error) && error.code === "53300"))
         this.invalidate();
-      throw error;
+      throw this.endpoint === undefined ? error : this.dependencyFailure("Managed PostgreSQL recovery refused after a health probe failure. Preserve its data and ownership records.");
+    }
+    if (this.attempts === 0 && (this.failure === undefined || this.healthySinceFailure)) {
+      this.retainFailure(new Error("Managed PostgreSQL failed its live health check."));
+      this.healthySinceFailure = false;
     }
-    if (this.attempts === 0)
-      this.failure = new DbosDependencyError("Managed PostgreSQL failed its live health check.");
     this.invalidate();
     if ((this.operations.now ?? Date.now)() < this.nextRecoveryAt)
-      throw new DbosDependencyError("Managed Postgres recovery is cooling down after bounded attempts.");
+      throw this.dependencyFailure("Managed Postgres recovery is cooling down after bounded attempts.");
     while (!this.stopped && this.attempts < RECOVERY_ATTEMPTS) {
       const attempt = this.attempts++;
       if (attempt > 0)
@@ -87901,12 +88763,12 @@ class PostgresHealth {
         if (ready !== undefined)
           return ready;
       } catch (error) {
-        this.failure = error instanceof Error ? error : new Error(String(error));
+        this.retainFailure(error);
       }
     }
     this.attempts = 0;
     this.nextRecoveryAt = (this.operations.now ?? Date.now)() + HEALTH_INTERVAL_MS;
-    throw new DbosDependencyError("Managed Postgres is unavailable after bounded recovery. Preserve its data and ownership records.");
+    throw this.dependencyFailure("Managed Postgres is unavailable after bounded recovery. Preserve its data and ownership records.");
   }
 }
 
@@ -88181,7 +89043,7 @@ async function probePostgresIdentity(port) {
     const result = await client.query(POSTGRES_IDENTITY_SQL);
     return result.rows[0];
   } catch (error) {
-    if (isQueryReadTimeout(error))
+    if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error))
       throw error;
     const code = error instanceof Error && "code" in error ? error.code : undefined;
     if (code === "ECONNREFUSED" || code === "ECONNRESET" || code === "EPIPE" || code === "57P01" || code === "57P02" || code === "57P03" || error instanceof Error && /timeout|timed out|connection terminated/i.test(error.message))
@@ -88354,7 +89216,7 @@ async function ensureCluster(options = {}) {
         try {
           return await existingServerProbe()(probePort);
         } catch (error) {
-          if (isQueryReadTimeout(error))
+          if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error))
             return;
           throw error;
         }
@@ -88562,6 +89424,8 @@ async function ensureCluster(options = {}) {
           const server = current.server;
           if (!server)
             throw new Error("Managed Postgres published identity is missing.");
+          if (managedPostmaster(current) === undefined)
+            return;
           if (!managedPostgresRuntimeHealthy(current, server.port)) {
             verifyManagedPostmasterProcess(current, server);
             return;
@@ -88578,6 +89442,7 @@ async function ensureCluster(options = {}) {
         };
         health = new PostgresHealth({
           probe: () => inspect(),
+          url: embeddedDbosSystemDatabaseUrl,
           validate: async (client) => {
             const identity = await inspect(async () => {
               const query = { text: POSTGRES_IDENTITY_SQL, query_timeout: POSTGRES_HEALTH_QUERY_TIMEOUT_MS };
@@ -89665,6 +90530,9 @@ async function requireDockerSuccess(action, args) {
   throw new Error(`Could not ${action}: ${commandFailureDetail(result)}`);
 }
 
+// dist/builtin/workflows/src/durable/dbos-lifecycle.ts
+init_dbos_process_owner();
+
 // dist/builtin/workflows/src/durable/dbos-registration-diagnostics.ts
 var cachedErrorModule;
 var errorModuleLoad;
@@ -90464,6 +91332,9 @@ function createDurableAdmissionSettlement(input, signal) {
   };
 }
 
+// dist/builtin/workflows/src/runs/background/quit.ts
+init_dbos_admission();
+
 // dist/builtin/workflows/src/shared/resume-continuation.ts
 var RESUME_CONTINUATION_PROMPT = "Continue where you left off. If you believe you are finished with your original task (or a redefined task if the user told you), stop.";
 
@@ -91850,7 +92721,8 @@ async function quitRunWithAction(runId, opts, action) {
       if (await settle() === "refused")
         return { ok: false, runId, reason: "already_ended" };
     } catch (error) {
-      if (!suspendedByAbort)
+      const alreadyDependencyPaused = isDbosDependencyError(error) && current.status === "paused" && current.phase === "blocked_dependency";
+      if (!suspendedByAbort && !alreadyDependencyPaused)
         throw error;
       const preservedProgress = hasDurableQuitProgress(runId);
       publish(preservedProgress);
@@ -94385,6 +95257,9 @@ function registerWorkflowLifecycleHandlers(pi, deps) {
   });
 }
 
+// dist/builtin/workflows/src/extension/extension-runtime-state.ts
+init_dbos_process_owner();
+
 // dist/builtin/workflows/src/durable/workflow-heartbeat-anchor.ts
 var WORKFLOW_HEARTBEAT_ANCHOR_CHECKPOINT_NAME = "workflow-heartbeat-anchor";
 function asPersistedAnchorOutput(output) {
@@ -101185,7 +102060,7 @@ function createRegistry(initial = []) {
 
 // dist/builtin/workflows/src/extension/discovery-loaders.ts
 import { readdir as readdir3, stat as stat2 } from "node:fs/promises";
-import { extname, isAbsolute as isAbsolute14, join as join30, resolve as resolve14 } from "node:path";
+import { extname, isAbsolute as isAbsolute14, join as join30, resolve as resolve15 } from "node:path";
 
 // ../../node_modules/jiti/lib/jiti-static.mjs
 var import_jiti = __toESM(require_jiti(), 1);
@@ -101640,12 +102515,12 @@ function raceAbort2(promise, signal) {
   });
 }
 // dist/builtin/workflows/src/runs/foreground/executor-hil.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { createAskUserQuestionToolDefinition } from "@bastani/atomic";
 
 // dist/builtin/workflows/src/shared/prompt-callsite-context.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
-var promptCallerStacks = new AsyncLocalStorage2;
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "node:async_hooks";
+var promptCallerStacks = new AsyncLocalStorage4;
 function withPromptCallerStack(stack, delegate) {
   if (stack === undefined)
     return delegate();
@@ -101939,7 +102814,7 @@ function makePrompt(descriptor) {
   };
 }
 function stableHash(value2) {
-  return createHash3("sha256").update(JSON.stringify(value2)).digest("hex").slice(0, 32);
+  return createHash5("sha256").update(JSON.stringify(value2)).digest("hex").slice(0, 32);
 }
 function promptDescriptorHash(descriptor) {
   if (isCustomPromptDescriptor(descriptor)) {
@@ -102532,6 +103407,7 @@ function hasInvocationData(checkpoints, replayKey) {
 
 // dist/builtin/workflows/src/engine/run.ts
 init_dbos_admission();
+init_dbos_process_owner();
 
 // dist/builtin/workflows/src/runs/foreground/executor-direct-helpers.ts
 import { isAbsolute as isAbsolute12, join as join28, resolve as resolve12 } from "node:path";
@@ -106792,6 +107668,16 @@ function workflowStartupFailureMessage(admission, snapshotError, fallback) {
 // dist/builtin/workflows/src/durable/resume-runtime.ts
 init_dbos_admission();
 
+// dist/builtin/workflows/src/durable/sdk-recovery-scope.ts
+init_dbos_owner_fence();
+import { resolve as resolve13 } from "node:path";
+function isSdkDurableRunInScope(handle, cwd) {
+  return cwd !== undefined && handle.invocationCwd !== undefined && resolve13(cwd) === resolve13(handle.invocationCwd) && handle.modelOwner !== undefined && (handle.rootWorkflowId === undefined || handle.rootWorkflowId === handle.workflowId);
+}
+function isSdkCrashedRunAdoptable(handle, cwd) {
+  return isSdkDurableRunInScope(handle, cwd) && handle.status === "running" && handle.ownerExecutorId !== undefined && handle.ownerExecutorId !== getAtomicExecutorId() && !isLiveRunningWorkflow(handle) && isDatabaseExecutor(handle.ownerExecutorId) && handle.ownerLiveness === "dead";
+}
+
 // dist/builtin/workflows/src/durable/tool-resume-frontier.ts
 function resolveToolResumeFrontier(source, backend) {
   const fail = (detail) => ({
@@ -106975,6 +107861,11 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
       message: `Workflow ${resolved.workflowId} is ${handle.status}, not resumable.`
     };
   }
+  const requestedOwner = deps.baseRunOpts.modelOwner;
+  const adopting = requestedOwner !== undefined && requestedOwner !== handle.modelOwner && (handle.modelOwner !== undefined || handle.origin === "agent");
+  if (adopting && !isSdkCrashedRunAdoptable(handle, deps.baseRunOpts.cwd)) {
+    return { ok: false, reason: "owned_elsewhere", message: "Workflow instance belongs to another caller/session." };
+  }
   const def = handle.invocationCwd === undefined ? deps.registry.get(handle.name) : await deps.resolveDefinition?.(handle.name, handle.invocationCwd) ?? deps.registry.get(handle.name);
   if (def === undefined) {
     return { ok: false, reason: "workflow_not_found", message: `Workflow definition not found: ${handle.name}` };
@@ -107024,6 +107915,22 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
     failedToolNodeId: handle.failedToolNodeId
   };
   const sourceSnapshot = toolContinuation?.source ?? deps.baseRunOpts.store?.runs().find((run) => run.id === resolved.workflowId);
+  let adoptedClaimUpdatedAt;
+  const rollbackStartup = async (onRestored) => {
+    if (adopting) {
+      const current = backend.getWorkflow(resolved.workflowId);
+      if (adoptedClaimUpdatedAt === undefined || current?.modelOwner !== requestedOwner)
+        return false;
+      const restored = await backend.transitionWorkflowStatus(resolved.workflowId, ["running"], handle.status, handle.pendingPrompts, handle.resumable, adoptedClaimUpdatedAt);
+      if (restored)
+        onRestored?.();
+      return restored;
+    }
+    backend.setWorkflowStatus(resolved.workflowId, handle.status, handle.pendingPrompts, handle.resumable, sourceFailure);
+    await backend.flush(resolved.workflowId);
+    onRestored?.();
+    return true;
+  };
   let claimed;
   try {
     claimed = await boundedAdmission((signal) => dbosAdmissionContext.run(signal, async () => {
@@ -107034,10 +107941,14 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
       }
       unsettled.add(resolved.workflowId);
       try {
-        const accepted = await backend.transitionWorkflowStatus(resolved.workflowId, [handle.status], "running", undefined, undefined, resolved.updatedAt);
-        if (accepted && signal.aborted && backend.getWorkflow(resolved.workflowId)?.status === "running") {
-          backend.setWorkflowStatus(resolved.workflowId, handle.status, handle.pendingPrompts, handle.resumable, sourceFailure);
-          await backend.flush(resolved.workflowId);
+        const accepted = await backend.transitionWorkflowStatus(resolved.workflowId, [handle.status], "running", undefined, undefined, resolved.updatedAt, adopting ? requestedOwner : undefined);
+        if (accepted && adopting) {
+          const current = backend.getWorkflow(resolved.workflowId);
+          if (current?.status === "running" && current.modelOwner === requestedOwner)
+            adoptedClaimUpdatedAt = current.updatedAt;
+        }
+        if (accepted && !adopting && signal.aborted && backend.getWorkflow(resolved.workflowId)?.status === "running") {
+          await rollbackStartup();
         }
         return accepted;
       } finally {
@@ -107064,7 +107975,7 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
     ...deps.baseRunOpts,
     ...handle.invocationCwd !== undefined ? { cwd: handle.invocationCwd } : {},
     ...handle.origin !== undefined ? { origin: handle.origin } : {},
-    modelOwner: handle.modelOwner,
+    modelOwner: adopting ? requestedOwner : handle.modelOwner,
     runId: resolved.workflowId,
     durableBackend: backend,
     ...toolContinuation === undefined ? {} : { continuation: toolContinuation }
@@ -107090,10 +108001,10 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
       }
     });
   } catch (error) {
-    backend.setWorkflowStatus(resolved.workflowId, handle.status, handle.pendingPrompts, handle.resumable, sourceFailure);
-    await backend.flush(resolved.workflowId);
-    if (sourceSnapshot !== undefined)
-      deps.baseRunOpts.store?.recordRunStart(sourceSnapshot);
+    await rollbackStartup(() => {
+      if (sourceSnapshot !== undefined)
+        deps.baseRunOpts.store?.recordRunStart(sourceSnapshot);
+    });
     return {
       ok: false,
       reason: "startup_failed",
@@ -107107,12 +108018,14 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
     const snapshot = deps.baseRunOpts.store?.runs().find((run) => run.id === accepted.runId);
     const error = workflowStartupFailureMessage(admission, snapshot?.error, `Workflow ${resolved.workflowId} ended before startup admission`);
     if (!backend.isAdmissionUnavailable?.(resolved.workflowId)) {
-      if (sourceSnapshot === undefined)
+      if (!adopting && sourceSnapshot === undefined)
         deps.baseRunOpts.store?.removeRun(accepted.runId);
-      backend.setWorkflowStatus(resolved.workflowId, handle.status, handle.pendingPrompts, handle.resumable, sourceFailure);
-      await backend.flush(resolved.workflowId);
-      if (sourceSnapshot !== undefined)
-        deps.baseRunOpts.store?.recordRunStart(sourceSnapshot);
+      await rollbackStartup(() => {
+        if (adopting && sourceSnapshot === undefined)
+          deps.baseRunOpts.store?.removeRun(accepted.runId);
+        if (sourceSnapshot !== undefined)
+          deps.baseRunOpts.store?.recordRunStart(sourceSnapshot);
+      });
     }
     return {
       ok: false,
@@ -112518,9 +113431,9 @@ class StageSessionController {
 }
 
 // dist/builtin/workflows/src/runs/foreground/stage-runner-output.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { mkdir as mkdir7, writeFile as writeFile11 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute13, join as join29, resolve as resolve13 } from "node:path";
+import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute13, join as join29, resolve as resolve14 } from "node:path";
 var DEFAULT_MAX_OUTPUT_BYTES = 200 * 1024;
 var DEFAULT_MAX_OUTPUT_LINES = 5000;
 function normalizeMaxOutput2(maxOutput) {
@@ -112584,7 +113497,7 @@ function formatByteSize(bytes) {
   return `${value2.toFixed(1)} ${units[unitIndex]}`;
 }
 function transcriptPath(runId, outputPath) {
-  const digest = createHash4("sha256").update(outputPath).digest("hex").slice(0, 16);
+  const digest = createHash6("sha256").update(outputPath).digest("hex").slice(0, 16);
   return join29(workflowArtifactRunPath(runId), "transcripts", `${digest}-${basename6(outputPath)}.transcript.md`);
 }
 function appendContent(lines, content) {
@@ -112630,7 +113543,7 @@ function renderTranscript(messages, fallbackOutput) {
 `);
 }
 function savedOutputReference(outputPath, fullOutput, transcriptPathValue, transcriptText, transcriptAvailable, warning) {
-  const absolutePath = resolve13(outputPath);
+  const absolutePath = resolve14(outputPath);
   const bytes = Buffer.byteLength(fullOutput, "utf8");
   const lines = countLines(fullOutput);
   const transcriptBytes = Buffer.byteLength(transcriptText, "utf8");
@@ -112645,8 +113558,8 @@ function resolveOutputPath(output, runtimeCwd, requestedCwd) {
     return;
   if (isAbsolute13(output))
     return output;
-  const baseCwd = requestedCwd === undefined ? runtimeCwd : isAbsolute13(requestedCwd) ? requestedCwd : resolve13(runtimeCwd, requestedCwd);
-  return resolve13(baseCwd, output);
+  const baseCwd = requestedCwd === undefined ? runtimeCwd : isAbsolute13(requestedCwd) ? requestedCwd : resolve14(runtimeCwd, requestedCwd);
+  return resolve14(baseCwd, output);
 }
 function degenerateWarning(fullOutput) {
   return fullOutput.trim().length === 0 ? "WARNING: the stage artifact is empty; search the companion transcript for this stage's work." : undefined;
@@ -113686,7 +114599,8 @@ async function run(def, inputs, opts = {}) {
     ownController.abort(callerSignal?.reason);
   };
   const exit = createWorkflowExitManager({ runId, exitScope, controller: ownController });
-  const backendView = opts.durableBackend ?? getDurableBackend();
+  const sourceBackend = opts.durableBackend ?? getDurableBackend();
+  const backendView = sourceBackend.executionView?.() ?? sourceBackend;
   const rootBackend = opts.durableRootBackend ?? backendView;
   const durableBackend = opts.durableScope !== undefined ? new ScopedDurableBackend(backendView, opts.durableScope) : backendView;
   const inheritedElapsedMs = opts.parentRun === undefined ? inheritedRunElapsedMs({ backend: durableBackend, runId, continuationSource: opts.continuation?.source }) : undefined;
@@ -114202,7 +115116,7 @@ async function run(def, inputs, opts = {}) {
         if (control === latestControl && !ownController.signal.aborted && isDbosDependencyError(error)) {
           activeStore.recordRunExecutionState(runId, {
             phase: "blocked_dependency",
-            dependencyError: `Workflow database unavailable during ${status === "paused" ? "pause" : "resume"}; persistence not confirmed.`
+            dependencyError: `Workflow database unavailable during ${status === "paused" ? "pause" : "resume"}; persistence not confirmed. ${error.message}`
           });
           if (status === "paused")
             return;
@@ -114249,7 +115163,7 @@ async function run(def, inputs, opts = {}) {
       if (!admission.admitting)
         return pausePersistence;
       backgroundAdmissionControl(durableBackend, runId, pausePersistence, (error, resumable) => {
-        admissionControlError = unknownErrorMessage(error);
+        admissionControlError = databaseDependencyMessage(unknownErrorMessage(error), getDbosProcessOwner().databaseDiagnostics?.());
         runSnapshot.error = admissionControlError;
         activeStore.recordRunPaused(runId, undefined, { resumable });
         return runSnapshot.error;
@@ -114266,7 +115180,7 @@ async function run(def, inputs, opts = {}) {
         } catch (error) {
           if (admission.failed) {
             scheduler.releaseRun();
-            throw error;
+            throw new Error(admissionControlError ?? databaseDependencyMessage(unknownErrorMessage(error), getDbosProcessOwner().databaseDiagnostics?.()));
           }
         }
         if (generation !== pauseGeneration)
@@ -114339,12 +115253,21 @@ async function run(def, inputs, opts = {}) {
     }).catch((error) => {
       const isTopologyError = typeof error === "object" && error !== null && "name" in error && error.name === "DurableNestedTopologyError";
       if (!isDbosDependencyError(error) && !isTopologyError) {
-        durableAdmissionFailure = { error };
-        classifiedFailures.set(error, classifyWorkflowFailure({
+        const admissionDetail = unknownErrorMessage(error);
+        const diagnostics = getDbosProcessOwner().databaseDiagnostics?.();
+        const safeMessage = databaseDependencyMessage(admissionDetail, diagnostics);
+        activeStore.recordRunExecutionState(runId, {
+          phase: "blocked_dependency",
+          dependencyError: safeMessage
+        });
+        const safeError = new Error(safeMessage);
+        durableAdmissionFailure = { error: safeError };
+        classifiedFailures.set(safeError, classifyWorkflowFailure({
           code: "ATOMIC_DURABLE_ADMISSION_REJECTED",
-          message: unknownErrorMessage(error),
-          cause: error
+          message: safeMessage,
+          cause: safeError
         }));
+        throw safeError;
       }
       throw error;
     }), ownController.signal);
@@ -114437,6 +115360,17 @@ async function run(def, inputs, opts = {}) {
     const gracefulQuit = observedQuitCancellation() ?? observedTaskTailQuit ?? findWorkflowGracefulQuit(err) ?? findWorkflowGracefulQuit(ownController.signal.reason);
     if (gracefulQuit !== undefined)
       return suspendForGracefulQuit(gracefulQuit);
+    if (isDbosDependencyError(err) && durableBackend.isCheckpointUnavailable?.(runId) && (durableBackend.getWorkflow(runId)?.completedCheckpoints ?? 0) > 0) {
+      await admittedTools.closeAndDrain();
+      activeStore.recordRunPaused(runId, undefined, { resumable: true });
+      activeStore.recordRunExecutionState(runId, { phase: "blocked_dependency", dependencyError: err.message });
+      return {
+        runId,
+        status: "paused",
+        stages: [...runSnapshot.stages],
+        toolNodes: [...runSnapshot.toolNodes ?? []]
+      };
+    }
     await admittedTools.closeAndDrain();
     if (ownController.signal.aborted)
       await Promise.allSettled([...pendingChildWorkflows]);
@@ -114775,7 +115709,7 @@ async function loadFromPaths(pathsOrMap, kind, baseCwd, diagnostics) {
   const all = [];
   const entries = Array.isArray(pathsOrMap) ? pathsOrMap.map((p) => ({ rawPath: p })) : Object.entries(pathsOrMap).map(([name, p]) => ({ rawPath: p, configuredName: name }));
   for (const { rawPath, configuredName } of entries) {
-    const absPath = isAbsolute14(rawPath) ? rawPath : resolve14(baseCwd, rawPath);
+    const absPath = isAbsolute14(rawPath) ? rawPath : resolve15(baseCwd, rawPath);
     let pathStats;
     try {
       pathStats = await stat2(absPath);
@@ -115548,7 +116482,8 @@ function createDurableResumeRuntime(deps) {
           baseRunOpts: {
             ...deps.baseRunOpts(options?.policy),
             ...options?.budget === undefined ? {} : { budget: options.budget },
-            ...options?.actor === undefined ? {} : { resumeActor: options.actor }
+            ...options?.actor === undefined ? {} : { resumeActor: options.actor },
+            ...options?.modelOwner === undefined ? {} : { modelOwner: options.modelOwner }
           },
           durableBackend: backend,
           resolveDefinition: async (name, cwd) => (await discoverWorkflows({ cwd: cwd ?? deps.runtimeCwd })).registry.get(name),
@@ -115654,7 +116589,11 @@ function createExtensionRuntime(opts = {}) {
   const resolvePossibleStageEntry = opts.resolvePossibleStageEntry;
   const beforeRestoreCompleted = opts.beforeRestoreCompleted;
   const ensureDbosReady = async () => {
-    return await initializeDurableBackend(durabilityWarningSink);
+    if (opts.prepareDatabase !== undefined)
+      await opts.prepareDatabase();
+    const backend = await initializeDurableBackend(durabilityWarningSink);
+    opts.databaseReady?.();
+    return backend;
   };
   function runOptions(policy) {
     const defaultSessionDir = resolveDefaultStageSessionDir?.();
@@ -115925,6 +116864,95 @@ function createStatusWriter(store, config, opts = {}) {
   };
 }
 
+// dist/builtin/workflows/src/extension/workflow-database-settings.ts
+import { readFileSync as readFileSync7 } from "node:fs";
+import { readFile as readFile6 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { join as join33, resolve as resolve16 } from "node:path";
+import { getAgentDir as getAgentDir3, getAgentDirs as getAgentDirs3, getProjectConfigDirs, SettingsManager } from "@bastani/atomic";
+var DATABASE_SETTING_KEYS = new Set(["systemDatabaseUrl", "systemDatabaseUrlFile"]);
+function databaseSettings(settings) {
+  const workflows = settings.workflows;
+  if (workflows === undefined || workflows === null || Array.isArray(workflows))
+    return;
+  if (typeof workflows !== "object")
+    throw new TypeError("workflows must be an array of paths or an object");
+  return workflows.durability;
+}
+function readSettingsFile(directory) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync7(join33(directory, "settings.json"), "utf8").replace(/^\uFEFF/, ""));
+  } catch {
+    return;
+  }
+  return parsed !== null && typeof parsed === "object" ? parsed : undefined;
+}
+function settingsDirectoryDeclaringDatabase(directories) {
+  let declaring;
+  for (const directory of directories) {
+    const settings = readSettingsFile(directory);
+    if (settings !== undefined && databaseSettings(settings) !== undefined)
+      declaring ??= directory;
+  }
+  return declaring ?? directories[0];
+}
+async function resolveWorkflowDatabaseSettings(global2, project, directories) {
+  const projectDatabase = databaseSettings(project);
+  const database = projectDatabase !== undefined ? projectDatabase : databaseSettings(global2);
+  if (database === undefined)
+    return;
+  if (database === null || typeof database !== "object" || Array.isArray(database)) {
+    throw new TypeError("workflows.durability must be an object");
+  }
+  if (Object.keys(database).some((key) => !DATABASE_SETTING_KEYS.has(key))) {
+    throw new TypeError("workflows.durability supports only systemDatabaseUrl or systemDatabaseUrlFile");
+  }
+  const { systemDatabaseUrl: url, systemDatabaseUrlFile: file } = database;
+  if (url !== undefined && file !== undefined) {
+    throw new TypeError("Set only one of workflows.durability.systemDatabaseUrl and systemDatabaseUrlFile");
+  }
+  let value2 = url;
+  if (file !== undefined) {
+    if (typeof file !== "string" || file.trim() === "") {
+      throw new TypeError("workflows.durability.systemDatabaseUrlFile must be a non-empty path");
+    }
+    const path = file.startsWith("~/") || file.startsWith("~\\") ? join33(homedir3(), file.slice(2)) : resolve16(projectDatabase === undefined ? directories.global : directories.project, file);
+    try {
+      value2 = await readFile6(path, "utf8");
+    } catch {
+      throw new Error("Cannot read workflows.durability.systemDatabaseUrlFile; check its path and permissions");
+    }
+  }
+  if (value2 === undefined)
+    return;
+  if (typeof value2 !== "string" || value2.trim() === "") {
+    throw new TypeError("Workflow database selection must contain a non-empty Postgres URL");
+  }
+  try {
+    const parsed = new URL(value2.trim());
+    if (!["postgres:", "postgresql:"].includes(parsed.protocol) || parsed.hostname === "")
+      throw new Error;
+  } catch {
+    throw new TypeError("Workflow database selection must contain a valid Postgres URL");
+  }
+  return value2.trim();
+}
+async function prepareWorkflowDatabaseSettings(cwd, projectTrusted) {
+  if (process.env.DBOS_SYSTEM_DATABASE_URL?.trim())
+    return;
+  const manager = SettingsManager.create(cwd, getAgentDir3(), { projectTrusted });
+  if (manager.drainErrors().length > 0)
+    throw new Error("Cannot read workflow database settings; repair settings.json");
+  const projectDirectories = getProjectConfigDirs(cwd);
+  const url = await resolveWorkflowDatabaseSettings(manager.getGlobalSettings(), manager.getProjectSettings(), {
+    global: settingsDirectoryDeclaringDatabase(getAgentDirs3()),
+    project: projectTrusted ? settingsDirectoryDeclaringDatabase(projectDirectories) : projectDirectories[0]
+  });
+  if (url !== undefined)
+    requestDbosSystemDatabaseUrl(url);
+}
+
 // dist/builtin/workflows/src/extension/workflow-heartbeat-notice.ts
 var WORKFLOW_HEARTBEAT_TITLE = "WORKFLOW HEARTBEAT";
 var WORKFLOW_HEARTBEAT_GLYPH = "♥";
@@ -117076,6 +118104,45 @@ function createWorkflowExtensionRuntimeState(pi, adapters, options = {}) {
   const resolveDefaultStageSessionDir = () => hostStageSessionDir.current;
   const discoveryRef = { current: null };
   const resolvePossibleStageEntry = (normalizedName) => discoveryRef.current?.sources.find((source) => source.id === normalizedName)?.filePath ?? resolveBuiltinDefinitionSource(normalizedName);
+  let databasePreparation;
+  const prepareDatabase = () => {
+    const cwd = resolveCwd();
+    const trusted = pi.getResourceLoaderInheritanceSnapshot?.()?.projectTrusted ?? false;
+    const key = JSON.stringify([cwd, trusted]);
+    if (databasePreparation?.key === key)
+      return databasePreparation.promise;
+    const promise = prepareWorkflowDatabaseSettings(cwd, trusted).catch((error) => {
+      if (databasePreparation?.promise === promise)
+        databasePreparation = undefined;
+      throw error;
+    });
+    databasePreparation = { key, promise };
+    return promise;
+  };
+  const databaseReady = (ctx) => {
+    const owner = getDbosProcessOwner();
+    const describeDatabase = owner.databaseDiagnostics;
+    if (owner.state !== "ready" || describeDatabase === undefined)
+      return;
+    if (owner.announcedDatabaseDiagnostics === describeDatabase)
+      return;
+    const diagnostics = describeDatabase();
+    const dockerFallback = diagnostics.provider === "docker";
+    let host = "unknown host";
+    try {
+      host = new URL(diagnostics.url).host;
+    } catch {}
+    const message = `Workflow database: ${dockerFallback ? "Docker fallback" : diagnostics.provider} (${host})`;
+    if (ctx?.hasUI && ctx.ui?.notify) {
+      try {
+        ctx.ui.notify(message, "info");
+        owner.announcedDatabaseDiagnostics = describeDatabase;
+      } catch {}
+    } else if (dockerFallback) {
+      owner.announcedDatabaseDiagnostics = describeDatabase;
+      console.error(message);
+    }
+  };
   const startupDiscovery = discoverStartupWorkflowsSync();
   const runtimeRef = {
     current: createExtensionRuntime({
@@ -117089,7 +118156,9 @@ function createWorkflowExtensionRuntimeState(pi, adapters, options = {}) {
       config: runtimeConfigRef.current,
       resolvePossibleStageEntry,
       resolveDefaultStageSessionDir,
-      beforeRestoreCompleted
+      beforeRestoreCompleted,
+      prepareDatabase,
+      databaseReady
     })
   };
   const configLoadRef = { current: null };
@@ -117154,7 +118223,9 @@ function createWorkflowExtensionRuntimeState(pi, adapters, options = {}) {
       ...models === undefined ? {} : { models },
       ...durabilityWarningSink === undefined ? {} : { durabilityWarningSink },
       resolveDefaultStageSessionDir,
-      beforeRestoreCompleted
+      beforeRestoreCompleted,
+      prepareDatabase,
+      databaseReady: () => databaseReady(ctx)
     });
   }
   let lazyDiscoveryPromise = null;
@@ -117193,7 +118264,9 @@ function createWorkflowExtensionRuntimeState(pi, adapters, options = {}) {
       config: runtimeConfigRef.current,
       resolvePossibleStageEntry,
       resolveDefaultStageSessionDir,
-      beforeRestoreCompleted
+      beforeRestoreCompleted,
+      prepareDatabase,
+      databaseReady
     });
   }
   function isWorkflowDiscoveryCurrent(generation) {
@@ -120794,7 +121867,7 @@ function createSessionRunControl(host) {
       const ctx = executeContext(host.context());
       if (args.runId !== undefined && (args.action === "status" || args.action === "stages"))
         rejectUnknownRunPrefix(host.store, args.runId);
-      return await host.execute(args, ctx);
+      return await host.execute(args, ctx, undefined, undefined, "sdk");
     } catch (error) {
       throw error instanceof Error ? translateThrown(error, args.runId) : error;
     }
@@ -120845,7 +121918,8 @@ function createSessionRunControl(host) {
         action: "resume",
         runId,
         ...options?.stageId === undefined ? {} : { stageId: options.stageId },
-        ...options?.message === undefined ? {} : { message: options.message }
+        ...options?.message === undefined ? {} : { message: options.message },
+        ...options?.legacyRecovery === undefined ? {} : { legacyRecovery: options.legacyRecovery }
       }));
     }
   };
@@ -120854,6 +121928,32 @@ function createSessionRunControl(host) {
 // dist/builtin/workflows/src/extension/workflow-tool.ts
 import { getSupportedThinkingLevels } from "@bastani/pi-ai/compat";
 
+// dist/builtin/workflows/src/extension/workflow-legacy-recovery.ts
+init_dbos_owner_fence();
+async function enrollLegacySdkRecovery(args, ctx, access, runtime, owner, signal) {
+  const id = args.runId;
+  signal?.throwIfAborted();
+  if (access !== "sdk" || args.action !== "resume" || args.legacyRecovery?.olderWorkersStopped !== true || args.stageId !== undefined || args.all === true || id === undefined || !isFullRunId(id)) {
+    throw new WorkflowInstanceOwnershipError("Legacy recovery requires an SDK root resume with its full UUID and confirmation that older workers have stopped.");
+  }
+  if (owner.store.runs().some((run) => run.id === id)) {
+    throw new WorkflowInstanceOwnershipError("Legacy enrollment cannot replace a locally attached workflow executor.");
+  }
+  const inspected = await runtime.inspectDurableWorkflow(id);
+  if (inspected.kind !== "found")
+    throw new WorkflowInstanceOwnershipError(inspected.message);
+  const backend = getDurableBackend();
+  const handle = backend.getLoadableWorkflow(id);
+  const interruptedEnrollment = handle?.legacyRecoveryPending === true && handle.ownerLiveness === "dead" && ["blocked", "paused"].includes(handle.status);
+  if (handle === undefined || !isSdkDurableRunInScope(handle, typeof ctx.cwd === "string" ? ctx.cwd : undefined) || handle.ownerExecutorId === undefined || isDatabaseExecutor(handle.ownerExecutorId) && !interruptedEnrollment || !["running", "paused", "blocked"].includes(handle.status) || backend.enrollLegacyWorkflow === undefined) {
+    throw new WorkflowInstanceOwnershipError("Legacy recovery is unavailable for this run or working directory; inspect it without taking ownership.");
+  }
+  signal?.throwIfAborted();
+  if (!await backend.enrollLegacyWorkflow(id, { olderWorkersStopped: true, modelOwner: workflowCaller(ctx), signal })) {
+    throw new WorkflowInstanceOwnershipError("Legacy workflow ownership changed while enrollment was pending; inspect it again before retrying.");
+  }
+}
+
 // dist/builtin/workflows/src/extension/workflow-status-summary.ts
 var workflowStatusRenderRuns = new WeakMap;
 function setWorkflowStatusRenderRuns(result, runs) {
@@ -122324,7 +123424,7 @@ function durableInspectionError(action, runId, message) {
 }
 function makeExecuteWorkflowTool(runtime, reloadWorkflowResources, ensureWorkflowResourcesLoaded = () => {}, owner = captureWorkflowOwnerResources()) {
   const { store, toolControlRegistry } = owner;
-  return async function executeWorkflowTool(args, ctx, signal, onRunAccepted) {
+  return async function executeWorkflowTool(args, ctx, signal, onRunAccepted, access) {
     signal?.throwIfAborted();
     if (args.action === undefined)
       return {
@@ -122344,7 +123444,13 @@ function makeExecuteWorkflowTool(runtime, reloadWorkflowResources, ensureWorkflo
         stages: []
       };
     }
-    const authorize = (id) => assertWorkflowInstanceOwner(id, ctx, store);
+    const recoveryCwd = typeof ctx.cwd === "string" ? ctx.cwd : undefined;
+    const authorize = (id) => {
+      const handle = getDurableBackend().getLoadableWorkflow(id);
+      if (access === "sdk" && isFullRunId(args.runId?.trim() ?? "") && (action === "status" || action === "stages" || action === "resume" && handle !== undefined && isSdkCrashedRunAdoptable(handle, recoveryCwd)) && !store.runs().some((run) => run.id === id) && handle !== undefined && isSdkDurableRunInScope(handle, recoveryCwd))
+        return;
+      assertWorkflowInstanceOwner(id, ctx, store);
+    };
     if (action === "status" && args.runId === undefined) {
       for (const run of topLevelWorkflowRuns(store.runs()))
         authorize(run.id);
@@ -122359,8 +123465,16 @@ function makeExecuteWorkflowTool(runtime, reloadWorkflowResources, ensureWorkflo
       }
     }
     const policy = workflowPolicyFromContext(ctx);
-    const getRuntime = () => typeof runtime === "function" ? runtime(ctx) : runtime;
     const awaitRequest = (operation) => raceAbort(operation, signal);
+    const getRuntime = () => {
+      const resolved = typeof runtime === "function" ? runtime(ctx) : runtime;
+      if (access !== "sdk")
+        return resolved;
+      return {
+        ...resolved,
+        resumeDurableWorkflow: (id, options) => resolved.resumeDurableWorkflow(id, { ...options, modelOwner: workflowCaller(ctx) })
+      };
+    };
     const ensureWorkflowResourcesVisible = async () => {
       try {
         await awaitRequest(Promise.resolve(ensureWorkflowResourcesLoaded()));
@@ -122466,6 +123580,9 @@ function makeExecuteWorkflowTool(runtime, reloadWorkflowResources, ensureWorkflo
       case "quit":
         return awaitRequest(workflowQuitAction(args, owner, { getRuntime, authorize }));
       case "resume":
+        if (args.legacyRecovery !== undefined) {
+          await awaitRequest(enrollLegacySdkRecovery(args, ctx, access, getRuntime(), owner, signal));
+        }
         return awaitRequest(workflowResumeAction(args, {
           getRuntime,
           policy,