@bastani/atomic 0.9.26-alpha.4 → 0.9.26-alpha.6

package/dist/builtin/workflows/src/index.js

@@ -63,6 +63,92 @@ function raceAbort2(operation, signal) {
   });
 }
 
+// dist/builtin/workflows/src/durable/dbos-database-diagnostics.ts
+function redactedDatabaseEndpoint(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return "unparseable PostgreSQL endpoint";
+  }
+}
+function redactedDatabaseMessage(message, url) {
+  let safe = message.replace(/postgres(?:ql)?:\/\/[^\s"'<>]+/gi, (value) => redactedDatabaseEndpoint(value));
+  let configuredSecrets = [];
+  if (url !== undefined) {
+    try {
+      const parsed = new URL(url);
+      configuredSecrets = [parsed.username, parsed.password, ...parsed.searchParams.values()].flatMap((secret) => {
+        try {
+          return [secret, decodeURIComponent(secret)];
+        } catch {
+          return [secret];
+        }
+      }).filter((secret) => secret.length > 0);
+    } catch {
+      return "PostgreSQL diagnostic could not be safely redacted; check the configured endpoint.";
+    }
+  }
+  safe = safe.replace(/\b(password|passwd|token|secret|sslpassword|user(?:name)?)\s*(?:([=:])\s*|((?:is|was)\s+)|\s+)(?:"([^"]*)"|'([^']*)'|([^\s,;]+))/gi, (match, key, separator, filler, doubleQuoted, singleQuoted, bare) => {
+    const value = doubleQuoted ?? singleQuoted ?? bare ?? "";
+    const isUserContext = /^user(?:name)?$/i.test(key);
+    if (separator === undefined && !isUserContext && !configuredSecrets.includes(value))
+      return match;
+    const rendered = doubleQuoted !== undefined ? '"[redacted]"' : singleQuoted !== undefined ? "'[redacted]'" : "[redacted]";
+    return `${key}${separator ?? " "}${filler ?? ""}${rendered}`;
+  });
+  for (const secret of new Set(configuredSecrets)) {
+    if (secret.length < 4)
+      continue;
+    const escaped = secret.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const expression = new RegExp(`(?<![\\p{L}\\p{N}_\\[])${escaped}(?![\\p{L}\\p{N}_\\]])`, "gu");
+    safe = safe.replace(expression, "[redacted]");
+  }
+  return safe;
+}
+function databaseDependencyMessage(message, diagnostics) {
+  const safe = redactedDatabaseMessage(message, diagnostics?.url);
+  if (diagnostics === undefined)
+    return safe;
+  const failure = diagnostics.failure === undefined ? "" : ` Last probe/recovery failure: ${redactedDatabaseMessage(diagnostics.failure, diagnostics.url)}`;
+  return `${safe} Provider: ${diagnostics.provider}; endpoint: ${redactedDatabaseEndpoint(diagnostics.url)}.${failure}`;
+}
+
+// dist/builtin/workflows/src/durable/dbos-process-owner.ts
+function emptyOwner() {
+  return {
+    version: 1,
+    state: "uninitialized",
+    configured: undefined,
+    active: undefined,
+    launchPromise: undefined,
+    shutdownPromise: undefined,
+    failure: undefined,
+    wrappers: undefined,
+    leases: new Set
+  };
+}
+function ownerBag() {
+  return globalThis;
+}
+function getDbosProcessOwner() {
+  const bag = ownerBag();
+  const existing = bag[DBOS_PROCESS_OWNER_KEY];
+  if (existing !== undefined && existing.version === 1)
+    return existing;
+  const created = emptyOwner();
+  bag[DBOS_PROCESS_OWNER_KEY] = created;
+  return created;
+}
+var DBOS_PROCESS_OWNER_KEY;
+var init_dbos_process_owner = __esm(() => {
+  DBOS_PROCESS_OWNER_KEY = Symbol.for("atomic-workflows/dbos-process-owner@1");
+});
+
 // dist/builtin/workflows/src/durable/dbos-admission.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 function isDbosDependencyError(error) {
@@ -81,6 +167,8 @@ async function boundedAdmission(operation, signal, timeoutMs = DBOS_ADMISSION_TI
     return await raceAbort2(operation(controller.signal), controller.signal);
   } catch (error) {
     controller.abort(error);
+    if (isDbosDependencyError(error) && error.admissionDetail !== undefined)
+      throw new DbosDependencyError(error.admissionDetail, null);
     throw error;
   } finally {
     clearTimeout(timer);
@@ -89,10 +177,13 @@ async function boundedAdmission(operation, signal, timeoutMs = DBOS_ADMISSION_TI
 }
 var DBOS_ADMISSION_TIMEOUT_MS = 1e4, DbosDependencyError, key2, bag, dbosAdmissionContext;
 var init_dbos_admission = __esm(() => {
+  init_dbos_process_owner();
   DbosDependencyError = class DbosDependencyError extends Error {
     code = "ATOMIC_DBOS_DEPENDENCY";
-    constructor(message = "Workflow database unavailable during admission. Restore PostgreSQL before retrying.") {
-      super(message);
+    admissionDetail;
+    constructor(message = "Workflow database unavailable during admission. Restore PostgreSQL before retrying.", diagnostics = getDbosProcessOwner().databaseDiagnostics?.(), admissionDetail) {
+      super(databaseDependencyMessage(message, diagnostics ?? undefined));
+      this.admissionDetail = admissionDetail === undefined ? undefined : redactedDatabaseMessage(admissionDetail);
       this.name = "DbosDependencyError";
     }
   };
@@ -102,6 +193,602 @@ var init_dbos_admission = __esm(() => {
   dbosAdmissionContext = bag[key2];
 });
 
+// dist/builtin/workflows/src/durable/dbos-admission-pool.ts
+function fenceDbosAdmissionPool(pool) {
+  const connect = pool.connect.bind(pool);
+  async function acquire(signal) {
+    if (signal.aborted)
+      throw sdkDependencyError();
+    const pending = connect().then((client) => {
+      if (signal.aborted) {
+        client.release(true);
+        throw sdkDependencyError();
+      }
+      return fencedClient(client, signal);
+    });
+    try {
+      return await raceAbort2(pending, signal);
+    } catch (error) {
+      throw databaseError(error, signal);
+    }
+  }
+  function scopedConnect(callback) {
+    const signal = dbosAdmissionContext.getStore();
+    if (signal === undefined) {
+      if (callback === undefined)
+        return connect();
+      connect(callback);
+      return;
+    }
+    const pending = acquire(signal);
+    if (callback === undefined)
+      return pending;
+    pending.then((client) => callback(undefined, client, client.release), (error) => callback(error, undefined, () => {}));
+  }
+  pool.connect = scopedConnect;
+  return pool;
+}
+function fencedClient(client, signal) {
+  let released = false;
+  const release = (error) => {
+    if (released)
+      return;
+    released = true;
+    signal.removeEventListener("abort", abort);
+    client.release(error);
+  };
+  const abort = () => release(true);
+  signal.addEventListener("abort", abort, { once: true });
+  const query = new Proxy(client.query, {
+    apply(target, _receiver, args) {
+      const values = [...args];
+      const last = values.at(-1);
+      const callback = typeof last === "function" ? values.pop() : undefined;
+      const pending = (async () => {
+        if (signal.aborted || released)
+          throw sdkDependencyError();
+        try {
+          return await raceAbort2(new Promise((resolve, reject) => {
+            Reflect.apply(target, client, [
+              ...values,
+              (error, result) => {
+                if (error)
+                  reject(error);
+                else
+                  resolve(result);
+              }
+            ]);
+          }), signal);
+        } catch (error) {
+          throw databaseError(error, signal);
+        }
+      })();
+      if (callback === undefined)
+        return pending;
+      pending.then((result) => callback(null, result), (error) => callback(error));
+    }
+  });
+  return new Proxy(client, {
+    get(target, property, receiver) {
+      if (property === "query")
+        return query;
+      if (property === "release")
+        return release;
+      return Reflect.get(target, property, receiver);
+    }
+  });
+}
+function sdkDependencyError(message) {
+  const reported = message === undefined ? new DbosDependencyError : new DbosDependencyError(message, null);
+  return new DbosDependencyError(undefined, null, reported.message);
+}
+function databaseError(error, signal) {
+  if (signal?.aborted)
+    return sdkDependencyError();
+  if (isDbosDependencyError(error))
+    return sdkDependencyError(error.admissionDetail ?? error.message);
+  const pending = [error];
+  const seen = new Set;
+  while (pending.length > 0) {
+    const value = pending.pop();
+    if (typeof value !== "object" || value === null || seen.has(value))
+      continue;
+    seen.add(value);
+    if ("cause" in value)
+      pending.push(value.cause);
+    if ("error" in value)
+      pending.push(value.error);
+    if ("errors" in value && Array.isArray(value.errors))
+      pending.push(...value.errors);
+    const code = "code" in value && typeof value.code === "string" ? value.code : undefined;
+    const message = value instanceof Error ? value.message : "";
+    if (code !== undefined && (/^(?:08|53|57)[0-9A-Z]{3}$|^40003$/.test(code) || connectionErrnos.has(code)) || code === undefined && connectionMessages.has(message)) {
+      return sdkDependencyError();
+    }
+  }
+  return error;
+}
+var connectionErrnos, connectionMessages;
+var init_dbos_admission_pool = __esm(() => {
+  init_dbos_admission();
+  connectionErrnos = new Set([
+    "ECONNRESET",
+    "ECONNREFUSED",
+    "ECONNABORTED",
+    "EHOSTUNREACH",
+    "ENETUNREACH",
+    "ETIMEDOUT",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "EPIPE"
+  ]);
+  connectionMessages = new Set([
+    "Connection terminated unexpectedly",
+    "Connection terminated due to connection timeout",
+    "Client has encountered a connection error and is not queryable",
+    "timeout exceeded when trying to connect",
+    "Client was closed and is not queryable",
+    "Postgres connection pool changed while acquiring a connection"
+  ]);
+});
+
+// dist/builtin/workflows/src/durable/dbos-row-guard.ts
+import { createHash as createHash3 } from "node:crypto";
+async function installDbosRowGuard(client) {
+  const ready = await client.query("SELECT to_regclass('dbos.workflow_status') IS NOT NULL AS status, to_regclass('dbos.operation_outputs') IS NOT NULL AS operations");
+  if (!ready.rows[0]?.status && !ready.rows[0]?.operations)
+    return;
+  if (!ready.rows[0]?.status || !ready.rows[0]?.operations)
+    throw new Error("Atomic workflow database schema is incomplete");
+  if (await validateInstalledGuard(client))
+    return;
+  await client.query("BEGIN");
+  try {
+    await client.query("SELECT pg_advisory_xact_lock(3419, 9003)");
+    if (await validateInstalledGuard(client)) {
+      await client.query("COMMIT");
+      return;
+    }
+    await client.query(guardSql);
+    await client.query("CREATE TABLE IF NOT EXISTS dbos.atomic_guard_protocol (singleton boolean PRIMARY KEY CHECK(singleton), fingerprint text NOT NULL)");
+    await client.query("INSERT INTO dbos.atomic_guard_protocol VALUES (true, $1) ON CONFLICT DO NOTHING", [
+      fingerprint
+    ]);
+    await client.query("COMMIT");
+  } catch (error) {
+    await client.query("ROLLBACK");
+    throw error;
+  }
+}
+async function validateInstalledGuard(client) {
+  const installed = await client.query("SELECT to_regclass('dbos.atomic_guard_protocol') IS NOT NULL AS present");
+  if (!installed.rows[0]?.present)
+    return false;
+  const validated = await client.query("SELECT fingerprint, (SELECT count(*)::int FROM pg_trigger WHERE tgrelid IN ('dbos.workflow_status'::regclass,'dbos.operation_outputs'::regclass) AND tgname = 'atomic_generation_guard' AND tgenabled = 'O' AND tgtype = 31 AND tgfoid = 'dbos.atomic_guard_row()'::regprocedure) AS triggers, (SELECT count(*)::int FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_projection' AND tgenabled = 'O' AND tgtype = 21 AND tgfoid = 'dbos.atomic_project_metadata()'::regprocedure) AS projections FROM dbos.atomic_guard_protocol WHERE singleton");
+  if (validated.rows.length !== 1 || validated.rows[0].fingerprint !== fingerprint || validated.rows[0].triggers !== 2 || validated.rows[0].projections !== 1)
+    throw new Error("Atomic database ownership guard schema is incompatible or incomplete");
+  return true;
+}
+var guardSql = `
+CREATE TABLE IF NOT EXISTS dbos.atomic_owner_generation (
+ root text PRIMARY KEY, owner text, generation bigint,
+ terminal boolean NOT NULL DEFAULT false, claim text, claimant text, protocol integer NOT NULL DEFAULT 1 CHECK(protocol = 1)
+);
+CREATE TABLE IF NOT EXISTS dbos.atomic_guard_rows (workflow_uuid text PRIMARY KEY, root text NOT NULL);
+CREATE OR REPLACE FUNCTION dbos.atomic_metadata(value text) RETURNS jsonb
+LANGUAGE plpgsql IMMUTABLE SET search_path = pg_catalog AS $$
+DECLARE decoded jsonb;
+BEGIN
+ IF value IS NULL THEN RETURN NULL; END IF;
+ BEGIN decoded := value::jsonb; EXCEPTION WHEN invalid_text_representation THEN RETURN NULL; END;
+ IF decoded->>'__dbos_serializer' = 'superjson' THEN decoded := decoded->'json'; END IF;
+ IF decoded->>'__atomicDurableMetadata' IS DISTINCT FROM 'true' OR decoded->>'version' IS DISTINCT FROM '3' THEN RETURN NULL; END IF;
+ RETURN decoded->'metadata';
+END $$;
+CREATE OR REPLACE FUNCTION dbos.atomic_guard_row() RETURNS trigger
+LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE
+ row_value jsonb; id text; root_id text; authority jsonb; state dbos.atomic_owner_generation%ROWTYPE;
+ meta jsonb; prior jsonb; prior_generation bigint; next_generation bigint; absorbing boolean;
+ allowed boolean; cap_owner text; cap_generation bigint; claim_token text;
+BEGIN
+ row_value := CASE WHEN TG_OP = 'DELETE' THEN to_jsonb(OLD) ELSE to_jsonb(NEW) END;
+ id := row_value->>'workflow_uuid';
+ root_id := split_part(id, ':checkpoint:', 1);
+ IF TG_OP = 'UPDATE' AND to_jsonb(OLD)->>'workflow_uuid' IS DISTINCT FROM id AND (
+  EXISTS(SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = to_jsonb(OLD)->>'workflow_uuid') OR
+  (TG_TABLE_NAME = 'workflow_status' AND to_jsonb(OLD)->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')) OR
+  (TG_TABLE_NAME = 'operation_outputs' AND EXISTS(SELECT 1 FROM dbos.workflow_status WHERE workflow_uuid = to_jsonb(OLD)->>'workflow_uuid' AND name IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')))
+ ) THEN
+  IF NULLIF(current_setting('atomic.row_authority',true),'') IS NULL OR current_setting('atomic.row_authority',true) = 'null' THEN RETURN NULL; END IF;
+  RAISE EXCEPTION 'Atomic workflow identities are immutable';
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND NOT (
+  COALESCE(row_value->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint'), false) OR
+  COALESCE(to_jsonb(OLD)->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint'), false) OR
+  EXISTS(SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = id)
+ ) THEN
+  IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+ END IF;
+ authority := NULLIF(current_setting('atomic.row_authority', true), '')::jsonb;
+ IF TG_TABLE_NAME = 'operation_outputs' AND NOT EXISTS (
+  SELECT 1 FROM dbos.workflow_status WHERE workflow_uuid = id AND name IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')
+ ) AND NOT EXISTS (SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = id) THEN
+  IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+ END IF;
+ INSERT INTO dbos.atomic_guard_rows VALUES(id, root_id) ON CONFLICT DO NOTHING;
+ INSERT INTO dbos.atomic_guard_rows SELECT workflow_uuid, root_id FROM dbos.workflow_status
+  WHERE workflow_uuid = root_id AND name = 'atomicWorkflowHandle' ON CONFLICT DO NOTHING;
+ INSERT INTO dbos.atomic_owner_generation(root) VALUES(root_id)
+  ON CONFLICT(root) DO UPDATE SET root = EXCLUDED.root RETURNING * INTO state;
+ IF state.owner IS NULL THEN
+  IF TG_TABLE_NAME <> 'workflow_status' OR TG_OP = 'DELETE' OR row_value->>'status' <> 'SUCCESS'
+   OR id NOT LIKE root_id || ':checkpoint:__atomic_metadata:%'
+   OR authority->>'root' IS DISTINCT FROM root_id OR authority->>'enroll' IS DISTINCT FROM 'true' THEN
+   IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+  END IF;
+  meta := dbos.atomic_metadata(row_value->>'output');
+  IF meta IS NULL OR meta->>'workflowId' IS DISTINCT FROM root_id THEN
+   RAISE EXCEPTION 'Atomic metadata encoding is unavailable for enrollment';
+  END IF;
+  SELECT candidate.metadata, candidate.generation INTO prior, prior_generation FROM (
+   SELECT dbos.atomic_metadata(output) AS metadata,
+    split_part(substring(workflow_uuid FROM length(root_id) + 13), ':', 2)::bigint AS generation
+   FROM dbos.workflow_status
+   WHERE workflow_uuid LIKE root_id || ':checkpoint:__atomic_metadata:%' AND status = 'SUCCESS'
+  ) candidate WHERE candidate.metadata IS NOT NULL
+  ORDER BY COALESCE(candidate.metadata->>'status' IN ('completed', 'cancelled') OR
+   (candidate.metadata->>'status' IN ('failed','blocked') AND candidate.metadata->>'resumable' = 'false'), false) DESC,
+   candidate.generation DESC LIMIT 1;
+  IF prior_generation IS DISTINCT FROM (authority->>'generation')::bigint
+   OR prior->>'ownerExecutorId' IS DISTINCT FROM authority->>'owner' THEN
+   RAISE EXCEPTION 'Atomic ownership generation changed before enrollment';
+  END IF;
+ ELSE
+  IF authority->>'root' IS DISTINCT FROM root_id THEN RETURN NULL; END IF;
+  cap_owner := authority->>'owner'; cap_generation := (authority->>'generation')::bigint;
+  allowed := cap_owner = state.owner AND cap_generation = state.generation AND (
+   authority->>'actor' = state.owner OR
+   (authority->>'claim' = state.claim AND authority->>'actor' = state.claimant) OR
+   (authority->>'claim' IS NOT NULL AND authority->>'checkpoint' = id));
+  IF NOT COALESCE(allowed, false) THEN RAISE EXCEPTION 'Atomic ownership generation changed; stale database writes are refused'; END IF;
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND TG_OP = 'UPDATE' THEN
+  IF OLD.status = 'SUCCESS' AND OLD.name = 'atomicWorkflowCheckpoint' THEN
+   IF NEW.output IS DISTINCT FROM OLD.output OR NEW.status <> 'SUCCESS' THEN RAISE EXCEPTION 'Completed Atomic checkpoints are immutable'; END IF;
+   RETURN NEW;
+  END IF;
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND TG_OP <> 'DELETE' AND row_value->>'status' = 'SUCCESS'
+  AND id LIKE root_id || ':checkpoint:__atomic_metadata:%' THEN
+  meta := dbos.atomic_metadata(row_value->>'output');
+  IF meta IS NULL OR meta->>'workflowId' IS DISTINCT FROM root_id OR meta->>'ownerExecutorId' IS DISTINCT FROM authority->>'actor' THEN RAISE EXCEPTION 'Atomic metadata encoding or owner is unavailable'; END IF;
+  next_generation := split_part(substring(id FROM length(root_id) + 13), ':', 2)::bigint;
+  absorbing := COALESCE(meta->>'status' IN ('completed', 'cancelled') OR
+   (meta->>'status' IN ('failed','blocked') AND meta->>'resumable' = 'false'), false);
+  claim_token := meta->>'transitionClaimId';
+  IF state.root IS NOT NULL AND (next_generation < state.generation OR (state.terminal AND NOT absorbing)) THEN
+   RAISE EXCEPTION 'Atomic terminal or newer generation cannot be overwritten';
+  END IF;
+  IF state.owner IS NOT NULL AND authority->>'actor' <> state.owner THEN
+   IF id NOT LIKE '%:claim' OR next_generation <> state.generation + 1 OR claim_token IS DISTINCT FROM authority->>'claim' OR meta->>'ownerExecutorId' IS DISTINCT FROM authority->>'actor' THEN
+    RAISE EXCEPTION 'Atomic ownership transfer requires an exact generation claim';
+   END IF;
+  END IF;
+ END IF;
+ IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+END $$;
+CREATE OR REPLACE FUNCTION dbos.atomic_project_metadata() RETURNS trigger
+LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE root_id text; meta jsonb; authority jsonb; state dbos.atomic_owner_generation%ROWTYPE; projected_generation bigint; absorbing boolean;
+BEGIN
+ IF NEW.name <> 'atomicWorkflowCheckpoint' OR NEW.status <> 'SUCCESS' THEN RETURN NEW; END IF;
+ root_id := split_part(NEW.workflow_uuid, ':checkpoint:', 1);
+ IF NEW.workflow_uuid NOT LIKE root_id || ':checkpoint:__atomic_metadata:%' THEN RETURN NEW; END IF;
+ IF TG_OP = 'UPDATE' THEN IF OLD.status = 'SUCCESS' THEN RETURN NEW; END IF; END IF;
+ authority := NULLIF(current_setting('atomic.row_authority', true), '')::jsonb;
+ SELECT * INTO state FROM dbos.atomic_owner_generation WHERE root = root_id FOR UPDATE;
+ IF state.owner IS NULL AND authority->>'enroll' IS DISTINCT FROM 'true' THEN RETURN NEW; END IF;
+ meta := dbos.atomic_metadata(NEW.output);
+ projected_generation := split_part(substring(NEW.workflow_uuid FROM length(root_id) + 13), ':', 2)::bigint;
+ absorbing := COALESCE(meta->>'status' IN ('completed','cancelled') OR (meta->>'status' IN ('failed','blocked') AND meta->>'resumable' = 'false'), false);
+ UPDATE dbos.atomic_owner_generation SET owner = meta->>'ownerExecutorId', generation = projected_generation,
+  terminal = absorbing, claim = CASE WHEN NEW.workflow_uuid LIKE '%:claim' THEN meta->>'transitionClaimId' END,
+  claimant = CASE WHEN NEW.workflow_uuid LIKE '%:claim' THEN authority->>'actor' END WHERE root = root_id;
+ RETURN NEW;
+END $$;
+DO $$ BEGIN
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_guard') THEN
+  CREATE TRIGGER atomic_generation_guard BEFORE INSERT OR UPDATE OR DELETE ON dbos.workflow_status
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_guard_row();
+ END IF;
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.operation_outputs'::regclass AND tgname = 'atomic_generation_guard') THEN
+  CREATE TRIGGER atomic_generation_guard BEFORE INSERT OR UPDATE OR DELETE ON dbos.operation_outputs
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_guard_row();
+ END IF;
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_projection') THEN
+  CREATE TRIGGER atomic_generation_projection AFTER INSERT OR UPDATE ON dbos.workflow_status
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_project_metadata();
+ END IF;
+END $$;
+`, fingerprint;
+var init_dbos_row_guard = __esm(() => {
+  fingerprint = createHash3("sha256").update(guardSql).digest("hex");
+});
+
+// dist/builtin/workflows/src/durable/dbos-owner-fence.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
+import { createHash as createHash4 } from "node:crypto";
+function lockKey(identity) {
+  const digest = createHash4("sha256").update(`atomic-workflow-fence:${identity}`).digest();
+  return [digest.readInt32BE(0), digest.readInt32BE(4)];
+}
+function isDatabaseExecutor(executorId) {
+  return /^atomic-db-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(executorId ?? "");
+}
+
+class DbosOwnerFence {
+  pool;
+  executorId;
+  endPool;
+  lifetime;
+  lost = false;
+  closing;
+  closed = false;
+  get invalidated() {
+    return this.lost;
+  }
+  constructor(pool, executorId, endPool) {
+    this.pool = pool;
+    this.executorId = executorId;
+    this.endPool = endPool;
+  }
+  fail() {
+    this.lost = true;
+    return new DbosDependencyError("Workflow database unavailable: ownership connection was lost; this execution generation cannot write again");
+  }
+  owner() {
+    if (this.lost)
+      return Promise.reject(this.fail());
+    this.lifetime ??= (async () => {
+      const client = await this.pool().connect();
+      client.on("error", () => {
+        this.fail();
+      });
+      client.on("end", () => {
+        this.fail();
+      });
+      try {
+        await client.query("SELECT set_config('application_name', $1, false)", [`atomic-owner:${this.executorId}`]);
+        const held = await client.query("SELECT pg_try_advisory_lock($1, $2) AS held", [
+          ...lockKey(this.executorId)
+        ]);
+        if (!held.rows[0]?.held || this.lost)
+          throw this.fail();
+        await client.query("SELECT pg_advisory_lock_shared($1, $2)", [...lockKey(this.executorId)]);
+        await client.query("SELECT pg_advisory_unlock($1, $2)", [...lockKey(this.executorId)]);
+        return client;
+      } catch (error) {
+        this.fail();
+        client.release(true);
+        throw error;
+      }
+    })().catch((error) => {
+      this.fail();
+      throw error;
+    });
+    return this.lifetime;
+  }
+  async liveness(executorId) {
+    if (!isDatabaseExecutor(executorId))
+      return "unknown";
+    const client = await this.pool().connect();
+    try {
+      await client.query("BEGIN");
+      const result = await client.query("SELECT pg_try_advisory_xact_lock($1, $2) AS held", [
+        ...lockKey(executorId)
+      ]);
+      return result.rows[0]?.held ? "dead" : "alive";
+    } finally {
+      try {
+        await client.query("ROLLBACK");
+      } finally {
+        client.release();
+      }
+    }
+  }
+  async recover(executorId, callback) {
+    if (!isDatabaseExecutor(executorId))
+      return;
+    const client = await this.pool().connect();
+    const fail = () => {
+      this.fail();
+    };
+    client.on("error", fail);
+    client.on("end", fail);
+    try {
+      await client.query("BEGIN");
+      const result = await client.query("SELECT pg_try_advisory_xact_lock($1, $2) AS held", [
+        ...lockKey(executorId)
+      ]);
+      if (!result.rows[0]?.held)
+        return;
+      return await callback();
+    } finally {
+      try {
+        await client.query("ROLLBACK");
+      } finally {
+        client.removeListener("error", fail);
+        client.removeListener("end", fail);
+        client.release();
+      }
+    }
+  }
+  async write(workflowId, callback, claim = false) {
+    try {
+      return await this.writeLocked(workflowId, callback, claim);
+    } catch (error) {
+      const mapped = databaseError(error);
+      throw this.lost && isDbosDependencyError(mapped) ? this.fail() : mapped;
+    }
+  }
+  async writeLocked(workflowId, callback, claim) {
+    const context = writeContext.getStore();
+    const active = context?.fence === this ? context.workflows : undefined;
+    if (active?.has(workflowId)) {
+      if (this.lost)
+        throw this.fail();
+      return await callback();
+    }
+    const owner = await this.owner();
+    const client = await this.pool().connect();
+    const fail = () => {
+      this.fail();
+    };
+    client.on("error", fail);
+    client.on("end", fail);
+    try {
+      await client.query("BEGIN");
+      await client.query("SELECT set_config('application_name', $1, false)", [`atomic-guard:${workflowId}`]);
+      await client.query("SET LOCAL statement_timeout = '10000ms'");
+      await client.query("SELECT pg_advisory_xact_lock_shared($1, $2)", [...lockKey(this.executorId)]);
+      await client.query("SELECT pg_advisory_xact_lock($1, $2)", [...lockKey(`workflow:${workflowId}`)]);
+      if (claim)
+        await client.query("SELECT pg_advisory_xact_lock($1, $2)", [...lockKey(`sql:${workflowId}`)]);
+      if (this.lost)
+        throw this.fail();
+      try {
+        await owner.query("SELECT 1");
+      } catch {
+        throw this.fail();
+      }
+      if (this.lost)
+        throw this.fail();
+      return await writeContext.run({ fence: this, workflows: new Map([...active ?? [], [workflowId, claim]]) }, callback);
+    } finally {
+      try {
+        await client.query("ROLLBACK");
+      } finally {
+        client.removeListener("error", fail);
+        client.removeListener("end", fail);
+        client.release();
+      }
+    }
+  }
+  async withRowAuthority(authority, callback) {
+    return await rowContext.run(authority, callback);
+  }
+  protectPool(pool) {
+    const connect = pool.connect.bind(pool);
+    const acquire = async () => {
+      const active = writeContext.getStore();
+      const client = await connect();
+      try {
+        await installDbosRowGuard(client);
+        await client.query("SELECT set_config('atomic.row_authority', $1, false)", [
+          JSON.stringify(rowContext.getStore() ?? null)
+        ]);
+      } catch (error) {
+        client.release(true);
+        throw error;
+      }
+      if (active === undefined)
+        return client;
+      const fence = active.fence;
+      try {
+        if (fence.lost)
+          throw fence.fail();
+        await client.query("SELECT set_config('application_name', $1, false)", [
+          `atomic-sql:${[...active.workflows.keys()][0]}`
+        ]);
+        for (const identity of [
+          fence.executorId,
+          ...[...active.workflows].filter(([, claim]) => !claim).map(([id]) => `sql:${id}`)
+        ]) {
+          const held = await client.query("SELECT pg_try_advisory_lock_shared($1, $2) AS held", [...lockKey(identity)]);
+          if (!held.rows[0]?.held)
+            throw fence.fail();
+        }
+        try {
+          await (await fence.owner()).query("SELECT 1");
+        } catch {
+          throw fence.fail();
+        }
+        if (fence.lost)
+          throw fence.fail();
+      } catch (error) {
+        client.release(true);
+        throw error;
+      }
+      let released = false;
+      const release = () => {
+        if (released)
+          return;
+        released = true;
+        client.release(true);
+      };
+      const query = new Proxy(client.query, {
+        apply: (target, _receiver, args) => {
+          if (!fence.lost && !released)
+            return Reflect.apply(target, client, args);
+          const error = fence.fail();
+          const callback = args.at(-1);
+          if (typeof callback === "function") {
+            queueMicrotask(() => callback(error));
+            return;
+          }
+          return Promise.reject(error);
+        }
+      });
+      return new Proxy(client, {
+        get(target, property, receiver) {
+          if (property === "release")
+            return release;
+          if (property === "query")
+            return query;
+          return Reflect.get(target, property, receiver);
+        }
+      });
+    };
+    function scopedConnect(callback) {
+      const pending = acquire();
+      if (callback === undefined)
+        return pending;
+      pending.then((client) => callback(undefined, client, client.release), (error) => callback(error, undefined, () => {}));
+    }
+    pool.connect = scopedConnect;
+    return pool;
+  }
+  close() {
+    this.closed = true;
+    this.lost = true;
+    this.closing ??= (async () => {
+      if (this.lifetime !== undefined) {
+        const client = await this.lifetime.catch(() => {
+          return;
+        });
+        client?.release(true);
+      }
+      await this.endPool();
+    })();
+    return this.closing;
+  }
+}
+var contextKey, contextBag, writeContext, rowContextKey, rowContextBag, rowContext;
+var init_dbos_owner_fence = __esm(() => {
+  init_dbos_admission();
+  init_dbos_admission_pool();
+  init_dbos_row_guard();
+  contextKey = Symbol.for("atomic-workflows/dbos-owner-write-context@1");
+  contextBag = globalThis;
+  contextBag[contextKey] ??= new AsyncLocalStorage3;
+  writeContext = contextBag[contextKey];
+  rowContextKey = Symbol.for("atomic-workflows/dbos-row-authority@1");
+  rowContextBag = globalThis;
+  rowContextBag[rowContextKey] ??= new AsyncLocalStorage3;
+  rowContext = rowContextBag[rowContextKey];
+});
+
 // ../../node_modules/@dbos-inc/dbos-sdk/dist/src/error.js
 var require_error = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -30258,137 +30945,6 @@ SELECT
   } });
 });
 
-// dist/builtin/workflows/src/durable/dbos-admission-pool.ts
-function fenceDbosAdmissionPool(pool) {
-  const connect = pool.connect.bind(pool);
-  async function acquire(signal) {
-    if (signal.aborted)
-      throw new DbosDependencyError;
-    const pending = connect().then((client) => {
-      if (signal.aborted) {
-        client.release(true);
-        throw new DbosDependencyError;
-      }
-      return fencedClient(client, signal);
-    });
-    try {
-      return await raceAbort2(pending, signal);
-    } catch (error) {
-      throw databaseError(error, signal);
-    }
-  }
-  function scopedConnect(callback) {
-    const signal = dbosAdmissionContext.getStore();
-    if (signal === undefined) {
-      if (callback === undefined)
-        return connect();
-      connect(callback);
-      return;
-    }
-    const pending = acquire(signal);
-    if (callback === undefined)
-      return pending;
-    pending.then((client) => callback(undefined, client, client.release), (error) => callback(error, undefined, () => {}));
-  }
-  pool.connect = scopedConnect;
-  return pool;
-}
-function fencedClient(client, signal) {
-  let released = false;
-  const release = (error) => {
-    if (released)
-      return;
-    released = true;
-    signal.removeEventListener("abort", abort);
-    client.release(error);
-  };
-  const abort = () => release(true);
-  signal.addEventListener("abort", abort, { once: true });
-  const query = new Proxy(client.query, {
-    apply(target, _receiver, args) {
-      const values = [...args];
-      const last = values.at(-1);
-      const callback = typeof last === "function" ? values.pop() : undefined;
-      const pending = (async () => {
-        if (signal.aborted || released)
-          throw new DbosDependencyError;
-        try {
-          return await raceAbort2(new Promise((resolve, reject) => {
-            Reflect.apply(target, client, [
-              ...values,
-              (error, result) => {
-                if (error)
-                  reject(error);
-                else
-                  resolve(result);
-              }
-            ]);
-          }), signal);
-        } catch (error) {
-          throw databaseError(error, signal);
-        }
-      })();
-      if (callback === undefined)
-        return pending;
-      pending.then((result) => callback(null, result), (error) => callback(error));
-    }
-  });
-  return new Proxy(client, {
-    get(target, property, receiver) {
-      if (property === "query")
-        return query;
-      if (property === "release")
-        return release;
-      return Reflect.get(target, property, receiver);
-    }
-  });
-}
-function databaseError(error, signal) {
-  if (signal.aborted)
-    return new DbosDependencyError;
-  const pending = [error];
-  const seen = new Set;
-  while (pending.length > 0) {
-    const value = pending.pop();
-    if (typeof value !== "object" || value === null || seen.has(value))
-      continue;
-    seen.add(value);
-    if ("cause" in value)
-      pending.push(value.cause);
-    if ("error" in value)
-      pending.push(value.error);
-    if ("errors" in value && Array.isArray(value.errors))
-      pending.push(...value.errors);
-    const code = "code" in value && typeof value.code === "string" ? value.code : undefined;
-    const message = value instanceof Error ? value.message : "";
-    if (code !== undefined && (/^(?:08|53|57)[0-9A-Z]{3}$|^40003$/.test(code) || connectionErrnos.has(code)) || code === undefined && connectionMessages.has(message)) {
-      return new DbosDependencyError;
-    }
-  }
-  return error;
-}
-var connectionErrnos, connectionMessages;
-var init_dbos_admission_pool = __esm(() => {
-  init_dbos_admission();
-  connectionErrnos = new Set([
-    "ECONNRESET",
-    "ECONNREFUSED",
-    "ECONNABORTED",
-    "EHOSTUNREACH",
-    "ENETUNREACH",
-    "ETIMEDOUT",
-    "ENOTFOUND",
-    "EAI_AGAIN",
-    "EPIPE"
-  ]);
-  connectionMessages = new Set([
-    "Connection terminated unexpectedly",
-    "Connection terminated due to connection timeout",
-    "Client has encountered a connection error and is not queryable",
-    "timeout exceeded when trying to connect"
-  ]);
-});
-
 // dist/builtin/workflows/src/durable/dbos-default-postgres-url.ts
 function defaultPostgresUrl(database, host = process.env.PGHOST || "localhost", port = process.env.PGPORT || "5432") {
   const url = new URL("postgresql://localhost");
@@ -30673,7 +31229,12 @@ function defaultDatabaseUrl(name) {
 function configureAdmissionDatabase(sdk, config, launchLock = withDbosLaunchLock) {
   const systemDatabaseUrl = config.systemDatabaseUrl ?? defaultDatabaseUrl(config.name);
   const health = resolvedPostgresHealth(systemDatabaseUrl);
-  const createPool = () => {
+  getDbosProcessOwner().databaseDiagnostics = () => ({
+    provider: health === undefined ? config.systemDatabaseUrl === undefined ? "docker" : "configured" : "managed",
+    url: health?.endpoint ?? systemDatabaseUrl,
+    failure: health?.lastFailure?.message
+  });
+  const createPool = (fenced = true) => {
     let unsubscribe;
     const managed = createRecoverablePostgresPool(systemDatabaseUrl, {
       beforeConnect: health === undefined ? undefined : () => health.check(),
@@ -30683,14 +31244,38 @@ function configureAdmissionDatabase(sdk, config, launchLock = withDbosLaunchLock
     });
     unsubscribe = health?.subscribe(managed.invalidate);
     health?.start();
-    return fenceDbosAdmissionPool(managed.pool);
+    return fenced ? fenceDbosAdmissionPool(managed.pool) : managed.pool;
   };
   let pool = createPool();
+  const createFence = (executorId) => {
+    const fencePool = createPool(false);
+    const created = new DbosOwnerFence(() => fencePool, executorId, () => fencePool.end());
+    const owner = getDbosProcessOwner();
+    owner.executorFences ??= new Set;
+    owner.executorFences.add(created);
+    return created;
+  };
+  let fence = createFence(config.executorID);
+  getDbosProcessOwner().executorFence = fence;
+  getDbosProcessOwner().createExecutorFence = () => {
+    const executorId = `atomic-db-${crypto.randomUUID()}`;
+    getDbosProcessOwner().executorId = executorId;
+    const next = createFence(executorId);
+    getDbosProcessOwner().executorFence = next;
+    return next;
+  };
+  pool = fence.protectPool(pool);
   sdk.setConfig({ ...config, systemDatabaseUrl, systemDatabasePool: pool });
   const launch = async () => {
+    if (fence.closed) {
+      const executorId = `atomic-db-${crypto.randomUUID()}`;
+      getDbosProcessOwner().executorId = executorId;
+      fence = createFence(executorId);
+      getDbosProcessOwner().executorFence = fence;
+    }
     if (pool.ended) {
-      pool = createPool();
-      sdk.setConfig({ ...config, systemDatabaseUrl, systemDatabasePool: pool });
+      pool = fence.protectPool(createPool());
+      sdk.setConfig({ ...config, executorID: fence.executorId, systemDatabaseUrl, systemDatabasePool: pool });
     }
     const urlToEnsure = health === undefined ? systemDatabaseUrl : await health.check();
     const result = await import_datasource2.ensurePGDatabase({ urlToEnsure, logger: () => {} });
@@ -30710,6 +31295,8 @@ var import_datasource2;
 var init_dbos_admission_config = __esm(() => {
   init_dbos_admission_pool();
   init_dbos_launch_lock();
+  init_dbos_owner_fence();
+  init_dbos_process_owner();
   init_dbos_recoverable_pool();
   import_datasource2 = __toESM(require_datasource(), 1);
 });
@@ -35420,7 +36007,7 @@ function isDurableWorkflowResumable(candidate) {
 }
 var FOREIGN_LIVE_WORKFLOW_WINDOW_MS = 120000;
 function isLiveRunningWorkflow(candidate, now = Date.now()) {
-  return candidate.status === "running" && now - candidate.updatedAt < FOREIGN_LIVE_WORKFLOW_WINDOW_MS;
+  return candidate.status === "running" && (candidate.ownerLiveness === "alive" || now - candidate.updatedAt < FOREIGN_LIVE_WORKFLOW_WINDOW_MS);
 }
 
 // dist/builtin/workflows/src/durable/durable-hash.ts
@@ -35470,7 +36057,7 @@ class InMemoryDurableBackend {
   workflows = new Map;
   promptReservations = new Map;
   deletedWorkflowIds = new Set;
-  registerWorkflow(handle) {
+  registerWorkflow(handle, authoritativeOwner = false) {
     this.deletedWorkflowIds.delete(handle.workflowId);
     const existing = this.workflows.get(handle.workflowId);
     const completedCheckpoints = handle.completedCheckpoints ?? existing?.handle.completedCheckpoints ?? 0;
@@ -35484,7 +36071,7 @@ class InMemoryDurableBackend {
       status: handle.status,
       ...handle.invocationCwd !== undefined ? { invocationCwd: handle.invocationCwd } : existing?.handle.invocationCwd !== undefined ? { invocationCwd: existing.handle.invocationCwd } : {},
       ...handle.origin !== undefined ? { origin: handle.origin } : existing?.handle.origin !== undefined ? { origin: existing.handle.origin } : {},
-      modelOwner: existing?.handle.modelOwner ?? handle.modelOwner,
+      modelOwner: authoritativeOwner ? handle.modelOwner : existing?.handle.modelOwner ?? handle.modelOwner,
       ...handle.workflowCwd !== undefined ? { workflowCwd: handle.workflowCwd } : existing?.handle.workflowCwd !== undefined ? { workflowCwd: existing.handle.workflowCwd } : {},
       ...handle.repositoryRoot !== undefined ? { repositoryRoot: handle.repositoryRoot } : existing?.handle.repositoryRoot !== undefined ? { repositoryRoot: existing.handle.repositoryRoot } : {},
       ...handle.gitWorktreeRoot !== undefined ? { gitWorktreeRoot: handle.gitWorktreeRoot } : existing?.handle.gitWorktreeRoot !== undefined ? { gitWorktreeRoot: existing.handle.gitWorktreeRoot } : {},
@@ -35498,7 +36085,9 @@ class InMemoryDurableBackend {
       ...handle.rootWorkflowId !== undefined ? { rootWorkflowId: handle.rootWorkflowId } : {},
       ...handle.resumable !== undefined ? { resumable: handle.resumable } : {},
       ...workflowFailureFields(hasWorkflowFailureMetadata(handle) ? handle : handle.status === "running" ? undefined : existing?.handle),
-      ...handle.ownerExecutorId !== undefined ? { ownerExecutorId: handle.ownerExecutorId } : existing?.handle.ownerExecutorId !== undefined ? { ownerExecutorId: existing.handle.ownerExecutorId } : {}
+      ...handle.ownerExecutorId !== undefined ? { ownerExecutorId: handle.ownerExecutorId } : existing?.handle.ownerExecutorId !== undefined ? { ownerExecutorId: existing.handle.ownerExecutorId } : {},
+      ...handle.ownerLiveness !== undefined ? { ownerLiveness: handle.ownerLiveness } : {},
+      ...handle.legacyRecoveryPending === true ? { legacyRecoveryPending: true } : {}
     };
     if (existing)
       existing.handle = full;
@@ -35648,11 +36237,14 @@ class InMemoryDurableBackend {
     if (pendingPrompts !== undefined)
       this.promptReservations.delete(workflowId);
   }
-  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt) {
-    const current = this.workflows.get(workflowId)?.handle;
+  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt, modelOwner) {
+    const record = this.workflows.get(workflowId);
+    const current = record?.handle;
     if (current === undefined || !expected.includes(current.status) || expectedUpdatedAt !== undefined && current.updatedAt !== expectedUpdatedAt)
       return false;
     this.setWorkflowStatus(workflowId, status, pendingPrompts, resumable);
+    if (modelOwner !== undefined && record !== undefined)
+      record.handle = { ...record.handle, modelOwner };
     return true;
   }
   adjustPendingPrompts(workflowId, delta) {
@@ -35725,6 +36317,7 @@ class InMemoryDurableBackend {
       pendingStageMessages: h.pendingStageMessages ?? [],
       ...h.possibleStages !== undefined ? { possibleStages: h.possibleStages } : {},
       ...h.ownerExecutorId !== undefined ? { ownerExecutorId: h.ownerExecutorId } : {},
+      ...h.legacyRecoveryPending === true ? { legacyRecoveryPending: true } : {},
       ...h.sessionFile !== undefined ? { sessionFile: h.sessionFile } : {},
       ...h.label !== undefined ? { label: h.label } : {},
       ...h.rootWorkflowId !== undefined ? { rootWorkflowId: h.rootWorkflowId } : {},
@@ -37791,10 +38384,11 @@ function hasInvocationData(checkpoints, replayKey) {
 
 // dist/builtin/workflows/src/engine/run.ts
 init_dbos_admission();
+init_dbos_process_owner();
 
 // dist/builtin/workflows/src/durable/backend-process-owner.ts
 var DURABLE_BACKEND_PROCESS_OWNER_KEY = Symbol.for("atomic-workflows/durable-backend-process-owner@1");
-function emptyOwner() {
+function emptyOwner2() {
   return {
     version: 1,
     injectedBackend: undefined,
@@ -37804,21 +38398,21 @@ function emptyOwner() {
     warningReported: false
   };
 }
-function ownerBag() {
+function ownerBag2() {
   return globalThis;
 }
 function getDurableBackendProcessOwner() {
-  const bag = ownerBag();
+  const bag = ownerBag2();
   const existing = bag[DURABLE_BACKEND_PROCESS_OWNER_KEY];
   if (existing !== undefined && existing.version === 1)
     return existing;
-  const created = emptyOwner();
+  const created = emptyOwner2();
   bag[DURABLE_BACKEND_PROCESS_OWNER_KEY] = created;
   return created;
 }
 
 // dist/builtin/workflows/src/durable/dbos-backend.ts
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 init_dbos_admission();
 
 // dist/builtin/workflows/src/durable/dbos-admission-recovery.ts
@@ -38487,6 +39081,7 @@ function encodeMetadata(metadata) {
       } : {},
       ...metadata.ownerExecutorId !== undefined ? { ownerExecutorId: metadata.ownerExecutorId } : {},
       ...metadata.transitionClaimId !== undefined ? { transitionClaimId: metadata.transitionClaimId } : {},
+      ...metadata.legacyRecoveryPending === true ? { legacyRecoveryPending: true } : {},
       ...metadata.sessionFile !== undefined ? { sessionFile: metadata.sessionFile } : {},
       ...metadata.label !== undefined ? { label: metadata.label } : {},
       ...metadata.rootWorkflowId !== undefined ? { rootWorkflowId: metadata.rootWorkflowId } : {},
@@ -38549,7 +39144,7 @@ function parseDurableWorkflowMetadata(value, workflowId) {
     return;
   const possibleStages = coercePossibleStages(serialized.possibleStages);
   const metadata = value;
-  if (metadata.workflowId !== workflowId || typeof metadata.workflowId !== "string" || typeof metadata.name !== "string" || typeof metadata.inputs !== "object" || metadata.inputs === null || Array.isArray(metadata.inputs) || typeof metadata.status !== "string" || !isDurableWorkflowStatus(metadata.status) || typeof metadata.completedCheckpoints !== "number" || typeof metadata.createdAt !== "number" || typeof metadata.pendingPrompts !== "number" || typeof metadata.promptReservationEpoch !== "string" || typeof metadata.updatedAt !== "number" || metadata.ownerExecutorId !== undefined && typeof metadata.ownerExecutorId !== "string" || metadata.transitionClaimId !== undefined && typeof metadata.transitionClaimId !== "string" || metadata.sessionFile !== undefined && typeof metadata.sessionFile !== "string" || metadata.label !== undefined && typeof metadata.label !== "string" || metadata.rootWorkflowId !== undefined && typeof metadata.rootWorkflowId !== "string" || metadata.resumable !== undefined && typeof metadata.resumable !== "boolean" || metadata.exited !== undefined && typeof metadata.exited !== "boolean" || metadata.exitReason !== undefined && typeof metadata.exitReason !== "string" || metadata.error !== undefined && typeof metadata.error !== "string" || metadata.failureKind !== undefined && !isWorkflowFailureKind(metadata.failureKind) || metadata.failureCode !== undefined && !isWorkflowFailureCode(metadata.failureCode) || metadata.failureRecoverability !== undefined && !isWorkflowFailureRecoverability(metadata.failureRecoverability) || metadata.failureDisposition !== undefined && !isWorkflowFailureDisposition(metadata.failureDisposition) || metadata.failedToolNodeId !== undefined && typeof metadata.failedToolNodeId !== "string" || metadata.invocationCwd !== undefined && typeof metadata.invocationCwd !== "string" || metadata.workflowCwd !== undefined && typeof metadata.workflowCwd !== "string" || metadata.repositoryRoot !== undefined && typeof metadata.repositoryRoot !== "string" || metadata.gitWorktreeRoot !== undefined && typeof metadata.gitWorktreeRoot !== "string")
+  if (metadata.workflowId !== workflowId || typeof metadata.workflowId !== "string" || typeof metadata.name !== "string" || typeof metadata.inputs !== "object" || metadata.inputs === null || Array.isArray(metadata.inputs) || typeof metadata.status !== "string" || !isDurableWorkflowStatus(metadata.status) || typeof metadata.completedCheckpoints !== "number" || typeof metadata.createdAt !== "number" || typeof metadata.pendingPrompts !== "number" || typeof metadata.promptReservationEpoch !== "string" || typeof metadata.updatedAt !== "number" || metadata.ownerExecutorId !== undefined && typeof metadata.ownerExecutorId !== "string" || metadata.transitionClaimId !== undefined && typeof metadata.transitionClaimId !== "string" || metadata.legacyRecoveryPending !== undefined && metadata.legacyRecoveryPending !== true || metadata.sessionFile !== undefined && typeof metadata.sessionFile !== "string" || metadata.label !== undefined && typeof metadata.label !== "string" || metadata.rootWorkflowId !== undefined && typeof metadata.rootWorkflowId !== "string" || metadata.resumable !== undefined && typeof metadata.resumable !== "boolean" || metadata.exited !== undefined && typeof metadata.exited !== "boolean" || metadata.exitReason !== undefined && typeof metadata.exitReason !== "string" || metadata.error !== undefined && typeof metadata.error !== "string" || metadata.failureKind !== undefined && !isWorkflowFailureKind(metadata.failureKind) || metadata.failureCode !== undefined && !isWorkflowFailureCode(metadata.failureCode) || metadata.failureRecoverability !== undefined && !isWorkflowFailureRecoverability(metadata.failureRecoverability) || metadata.failureDisposition !== undefined && !isWorkflowFailureDisposition(metadata.failureDisposition) || metadata.failedToolNodeId !== undefined && typeof metadata.failedToolNodeId !== "string" || metadata.invocationCwd !== undefined && typeof metadata.invocationCwd !== "string" || metadata.workflowCwd !== undefined && typeof metadata.workflowCwd !== "string" || metadata.repositoryRoot !== undefined && typeof metadata.repositoryRoot !== "string" || metadata.gitWorktreeRoot !== undefined && typeof metadata.gitWorktreeRoot !== "string")
     return;
   const { origin, possibleStages: rawPossibleStages, ...metadataWithoutOrigin } = metadata;
   return {
@@ -39024,40 +39619,20 @@ function classifyDbosDeletionTombstone(records, workflowId) {
   return isCurrentDurableFormat(raw.version) ? "current" : "unknown";
 }
 
-// dist/builtin/workflows/src/durable/dbos-process-owner.ts
-var DBOS_PROCESS_OWNER_KEY = Symbol.for("atomic-workflows/dbos-process-owner@1");
-function emptyOwner2() {
-  return {
-    version: 1,
-    state: "uninitialized",
-    configured: undefined,
-    active: undefined,
-    launchPromise: undefined,
-    shutdownPromise: undefined,
-    failure: undefined,
-    wrappers: undefined,
-    leases: new Set
-  };
-}
-function ownerBag2() {
-  return globalThis;
-}
-function getDbosProcessOwner() {
-  const bag = ownerBag2();
-  const existing = bag[DBOS_PROCESS_OWNER_KEY];
-  if (existing !== undefined && existing.version === 1)
-    return existing;
-  const created = emptyOwner2();
-  bag[DBOS_PROCESS_OWNER_KEY] = created;
-  return created;
-}
+// dist/builtin/workflows/src/durable/dbos-backend.ts
+init_dbos_process_owner();
 
 // dist/builtin/workflows/src/durable/dbos-sdk-handle.ts
-var ATOMIC_EXECUTOR_ID = `atomic-${process.pid.toString(36)}-${crypto.randomUUID().slice(0, 8)}`;
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "node:async_hooks";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
+init_dbos_owner_fence();
+init_dbos_process_owner();
 function getAtomicExecutorId() {
-  return ATOMIC_EXECUTOR_ID;
+  const owner = getDbosProcessOwner();
+  owner.executorId ??= `atomic-db-${crypto.randomUUID()}`;
+  return owner.executorId;
 }
-function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
+function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow, fence, previousExecutorIds = []) {
   const checkpointId = (workflowId, stepName) => `${workflowId}:checkpoint:${stepName}`;
   async function stepRecord(status, prefix) {
     if (status.status !== "SUCCESS")
@@ -39071,10 +39646,18 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
     const output = status.output === undefined || typeof status.output === "string" ? await dbos.retrieveWorkflow(id).getResult() : status.output;
     return { stepName, output, completedAt: status.createdAt };
   }
-  return {
+  const raw = {
     launch: () => dbos.launch(),
     shutdown: () => dbos.shutdown(),
     async startWorkflow(workflowId, name, inputs) {
+      if (fence !== undefined) {
+        const existing = await raw.retrieveWorkflow(workflowId);
+        if (existing !== undefined) {
+          if (existing.name !== name || !isDeepStrictEqual2(existing.inputs, inputs))
+            throw new Error("Workflow root identity changed during admission");
+          return;
+        }
+      }
       try {
         await dbos.startWorkflow(mainWorkflow, { workflowID: workflowId })(name, { ...inputs });
       } catch (err) {
@@ -39093,7 +39676,10 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
       await dbos.cancelWorkflow(workflowId, { cancelChildren: true });
     },
     async resumeWorkflow(workflowId) {
-      await dbos.resumeWorkflow(workflowId);
+      if (fence === undefined)
+        await dbos.resumeWorkflow(workflowId);
+      else if (await raw.retrieveWorkflow(workflowId) === undefined)
+        throw new Error("Workflow root is unavailable for resume");
     },
     async listAllWorkflows() {
       const statuses = await dbos.listWorkflows({
@@ -39122,6 +39708,12 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
       return status !== undefined && (status.workflowID ?? status.workflowId) === id ? stepRecord(status, prefix) : undefined;
     },
     async recordStepOutput(workflowId, stepName, output) {
+      if (fence !== undefined) {
+        const id = checkpointId(workflowId, stepName);
+        const existing = (await dbos.listWorkflows({ workflowIDs: [id], limit: 1 }))[0];
+        if (existing?.status !== undefined && ["PENDING", "ENQUEUED", "CANCELLED", "ERROR", "DELAYED"].includes(existing.status))
+          await dbos.deleteWorkflows([id], false);
+      }
       let handle;
       try {
         handle = await dbos.startWorkflow(checkpointWorkflow, { workflowID: checkpointId(workflowId, stepName) })(workflowId, stepName, output);
@@ -39145,6 +39737,135 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
       await dbos.deleteWorkflows([...new Set([workflowId, ...checkpointIds])], true);
     }
   };
+  if (fence === undefined)
+    return raw;
+  const claims = new AsyncLocalStorage4;
+  const rowAuthority = (workflowId, current) => ({
+    root: workflowId,
+    actor: fence.executorId,
+    ...current.kind === "current" ? { owner: current.metadata.ownerExecutorId, generation: current.generation } : {},
+    enroll: current.kind === "unavailable" || current.kind === "current" && isDatabaseExecutor(current.metadata.ownerExecutorId)
+  });
+  const mutate = async (workflowId, callback, step) => fence.write(workflowId, async () => {
+    const current = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+    const claimed = claims.getStore();
+    if (claimed === undefined && current.kind === "current" && current.metadata.ownerExecutorId !== fence.executorId)
+      throw new Error("Workflow database ownership changed; stale executor writes are refused");
+    let output = step === undefined ? undefined : classifyLatestMetadata([{ stepName: step.name, output: step.output }], workflowId);
+    let persistedStep = step;
+    if (step !== undefined && output?.kind === "current" && current.kind === "current" && !step.name.endsWith(":claim") && output.metadata.ownerExecutorId === fence.executorId && output.generation <= current.generation) {
+      const updatedAt = Math.max(current.generation + 1, output.metadata.updatedAt, Date.now());
+      persistedStep = {
+        name: metadataStepName(updatedAt),
+        output: encodeMetadata({ ...output.metadata, updatedAt })
+      };
+      output = classifyLatestMetadata([{ stepName: persistedStep.name, output: persistedStep.output }], workflowId);
+    }
+    const authority = claimed?.authority ?? rowAuthority(workflowId, current);
+    const capability = output?.kind === "current" && step?.name.endsWith(":claim") ? {
+      ...authority,
+      claim: output.metadata.transitionClaimId,
+      checkpoint: checkpointId(workflowId, step.name)
+    } : authority;
+    const record = persistedStep;
+    await fence.withRowAuthority(capability, record === undefined ? callback : () => raw.recordStepOutput(workflowId, record.name, record.output));
+    if (claimed !== undefined && output?.kind === "current")
+      claimed.authority = {
+        ...capability,
+        owner: output.metadata.ownerExecutorId,
+        generation: output.generation
+      };
+  });
+  return {
+    ...raw,
+    executorId: fence.executorId,
+    generationLost: () => fence.invalidated,
+    forkGeneration: () => {
+      const next = getDbosProcessOwner().createExecutorFence?.();
+      if (next === undefined)
+        throw new Error("Workflow ownership fence cannot create a recovery generation");
+      fence.close().catch(() => {});
+      return createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow, next, [
+        ...previousExecutorIds,
+        fence.executorId
+      ]);
+    },
+    adoptPreviousGeneration: async (workflowId) => {
+      if (previousExecutorIds.length === 0)
+        return;
+      return await fence.write(workflowId, async () => {
+        const current = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+        if (current.kind !== "current" || current.metadata.ownerExecutorId === fence.executorId)
+          return;
+        const previousExecutorId = current.metadata.ownerExecutorId;
+        if (previousExecutorId === undefined || !previousExecutorIds.includes(previousExecutorId))
+          throw new Error("Workflow database ownership changed; stale executor writes are refused");
+        const metadata = {
+          ...current.metadata,
+          ownerExecutorId: fence.executorId,
+          transitionClaimId: crypto.randomUUID(),
+          updatedAt: Math.max(Date.now(), current.metadata.updatedAt + 1)
+        };
+        const adopted = await fence.recover(previousExecutorId, async () => {
+          await fence.withRowAuthority({
+            ...rowAuthority(workflowId, current),
+            claim: metadata.transitionClaimId,
+            checkpoint: checkpointId(workflowId, claimMetadataStepName(current.generation))
+          }, () => raw.recordStepOutput(workflowId, claimMetadataStepName(current.generation), encodeMetadata(metadata)));
+          return metadata;
+        });
+        if (adopted === undefined)
+          throw new Error("Workflow previous execution generation is still active");
+        return adopted;
+      }, true);
+    },
+    enrollLegacyWorkflow: async (workflowId, modelOwner) => fence.write(workflowId, async () => {
+      const current = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+      if (current.kind !== "current" || isDatabaseExecutor(current.metadata.ownerExecutorId) && current.metadata.legacyRecoveryPending !== true || !["running", "paused", "blocked"].includes(current.metadata.status) || current.metadata.rootWorkflowId !== undefined && current.metadata.rootWorkflowId !== workflowId)
+        return;
+      const metadata = {
+        ...current.metadata,
+        modelOwner,
+        ownerExecutorId: fence.executorId,
+        status: "blocked",
+        resumable: true,
+        legacyRecoveryPending: true,
+        updatedAt: Math.max(Date.now(), current.metadata.updatedAt + 1)
+      };
+      const retry = isDatabaseExecutor(current.metadata.ownerExecutorId);
+      const transitionClaimId = crypto.randomUUID();
+      const stepName = retry ? claimMetadataStepName(current.generation) : metadataStepName(Math.max(current.generation + 1, metadata.updatedAt));
+      const persist = () => fence.withRowAuthority({
+        ...rowAuthority(workflowId, current),
+        enroll: true,
+        ...retry ? { claim: transitionClaimId, checkpoint: checkpointId(workflowId, stepName) } : {}
+      }, () => raw.recordStepOutput(workflowId, stepName, encodeMetadata({ ...metadata, ...retry ? { transitionClaimId } : {} })));
+      if (retry) {
+        const recovered = await fence.recover(current.metadata.ownerExecutorId, async () => {
+          await persist();
+          return true;
+        });
+        if (recovered !== true)
+          return;
+      } else
+        await persist();
+      return metadata;
+    }, true),
+    ownerLiveness: (executorId) => fence.liveness(executorId),
+    withWorkflowClaim: (workflowId, callback) => fence.write(workflowId, async () => {
+      const authoritative = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+      const claim = () => claims.run({ authority: { ...rowAuthority(workflowId, authoritative), claim: crypto.randomUUID() } }, callback);
+      if (authoritative.kind === "current" && authoritative.metadata.status === "running" && authoritative.metadata.ownerExecutorId !== fence.executorId) {
+        return await fence.recover(authoritative.metadata.ownerExecutorId, claim) ?? false;
+      }
+      return await claim();
+    }, true),
+    startWorkflow: (id, name, inputs) => mutate(id, () => raw.startWorkflow(id, name, inputs)),
+    cancelWorkflow: (id) => mutate(id, () => raw.cancelWorkflow(id)),
+    resumeWorkflow: (id) => mutate(id, () => raw.resumeWorkflow(id)),
+    recordStepOutput: (id, step, output) => mutate(id, () => raw.recordStepOutput(id, step, output), { name: step, output }),
+    deleteWorkflowData: (id) => mutate(id, () => raw.deleteWorkflowData(id))
+  };
 }
 function isDbosDuplicateWorkflowError(err) {
   const msg = err instanceof Error ? err.message : String(err);
@@ -39171,6 +39892,7 @@ function statusToInfo(status, fallbackId) {
 }
 
 // dist/builtin/workflows/src/durable/dbos-system-database-url.ts
+init_dbos_process_owner();
 function nonEmptyTrimmed(value) {
   const trimmed = value?.trim();
   return trimmed === undefined || trimmed.length === 0 ? undefined : trimmed;
@@ -39185,9 +39907,7 @@ class DbosSystemDatabaseConflictError extends Error {
 function redactDatabaseUrl(url) {
   try {
     const parsed = new URL(url);
-    if (parsed.password !== "")
-      parsed.password = "***";
-    return parsed.toString();
+    return parsed.host;
   } catch {
     return "the requested database";
   }
@@ -39227,6 +39947,8 @@ async function configureDbosDurableBackend(config) {
   const sdk = await importDbosSdk();
   const owner = getDbosProcessOwner();
   const existing = owner.wrappers;
+  if (existing !== undefined && owner.executorFence === undefined)
+    throw new Error("Existing workflow executor has no database ownership fence; restart the host before recovering workflows");
   let launch = owner.active?.launch ?? (() => sdk.launch());
   let checkReady;
   if (existing === undefined) {
@@ -39249,12 +39971,30 @@ async function configureDbosDurableBackend(config) {
   if (existing === undefined) {
     owner.wrappers = { mainWorkflow, checkpointWorkflow };
   }
+  let backendFence = owner.executorFence;
+  let backend = new DbosDurableBackend(createRealDbosHandle(sdk, mainWorkflow, checkpointWorkflow, backendFence), {
+    checkReady
+  });
   return {
-    backend: new DbosDurableBackend(createRealDbosHandle(sdk, mainWorkflow, checkpointWorkflow), {
-      checkReady
-    }),
-    launch,
-    shutdown: () => sdk.shutdown()
+    get backend() {
+      return backend;
+    },
+    launch: async () => {
+      await launch();
+      if (backendFence !== owner.executorFence && backendFence?.closed) {
+        backendFence = owner.executorFence;
+        backend = new DbosDurableBackend(createRealDbosHandle(sdk, mainWorkflow, checkpointWorkflow, backendFence), { checkReady });
+      }
+    },
+    shutdown: async () => {
+      const results = await Promise.allSettled([
+        sdk.shutdown(),
+        ...[...owner.executorFences ?? []].map((fence) => fence.close())
+      ]);
+      const errors = results.filter((result) => result.status === "rejected").map((result) => result.reason instanceof Error ? result.reason : new Error(String(result.reason)));
+      if (errors.length > 0)
+        throw new AggregateError(errors, "Workflow database shutdown failed");
+    }
   };
 }
 async function importDbosSdk() {
@@ -39287,13 +40027,18 @@ class DbosDurableBackend {
   unavailableAdmissions = new Set;
   unavailableCheckpoints = new Set;
   pendingRecoveryAdmissions = new Set;
+  ownerLiveness = new Map;
   admissionMetadataAttempted = new Set;
   admissionSettlements = new Map;
   admissionRecoveries = new Map;
   admissionRecoveryControllers = new Map;
+  fixedGeneration = false;
+  generationIsCurrent;
+  rebindInitialAdmission;
+  admitted = false;
   constructor(sdk, options) {
     this.sdk = sdk;
-    this.executorId = options?.executorId ?? getAtomicExecutorId();
+    this.executorId = options?.executorId ?? sdk.executorId ?? getAtomicExecutorId();
     this.onUnavailable = options?.onUnavailable;
     this.checkReady = options?.checkReady;
     this.promptReservations = new DbosPromptReservationTracker({
@@ -39304,6 +40049,55 @@ class DbosDurableBackend {
       }
     });
   }
+  async enrollLegacyWorkflow(workflowId, options) {
+    if (options.olderWorkersStopped !== true || this.sdk.enrollLegacyWorkflow === undefined)
+      return false;
+    this.ensureGeneration();
+    return await boundedAdmission((signal) => dbosAdmissionContext.run(signal, async () => {
+      signal.throwIfAborted();
+      const metadata = await this.sdk.enrollLegacyWorkflow(workflowId, options.modelOwner);
+      signal.throwIfAborted();
+      if (metadata === undefined)
+        return false;
+      this.applyMetadata(workflowId, metadata);
+      this.current.add(workflowId);
+      return true;
+    }), options.signal);
+  }
+  executionView() {
+    if (this.fixedGeneration || this.sdk.forkGeneration === undefined)
+      return this;
+    this.ensureGeneration();
+    const view = new DbosDurableBackend(this.sdk, {
+      executorId: this.executorId,
+      checkReady: this.checkReady,
+      onUnavailable: this.onUnavailable
+    });
+    const reservations = view.promptReservations;
+    Object.assign(view, this);
+    Object.assign(view, {
+      promptReservations: reservations,
+      fixedGeneration: true,
+      generationIsCurrent: () => this.sdk === view.sdk,
+      rebindInitialAdmission: () => {
+        this.ensureGeneration();
+        view.sdk = this.sdk;
+        view.executorId = this.executorId;
+      }
+    });
+    return view;
+  }
+  ensureGeneration() {
+    if (this.fixedGeneration) {
+      if (this.generationIsCurrent?.() === false)
+        throw new DbosDependencyError("Workflow database ownership generation changed; stale execution writes are refused");
+      return;
+    }
+    if (this.sdk.generationLost?.() && this.sdk.forkGeneration !== undefined) {
+      this.sdk = this.sdk.forkGeneration();
+      this.executorId = this.sdk.executorId ?? this.executorId;
+    }
+  }
   isAdmissionUnavailable(workflowId) {
     return this.unavailableAdmissions.has(workflowId);
   }
@@ -39320,6 +40114,8 @@ class DbosDurableBackend {
     return this.admissionSettlements.has(workflowId);
   }
   admitWorkflow(workflowId, registration, signal) {
+    if (!this.admitted)
+      this.rebindInitialAdmission?.();
     const pending = this.performAdmission(workflowId, registration, signal);
     this.admissionSettlements.set(workflowId, pending);
     pending.then(() => {
@@ -39327,6 +40123,7 @@ class DbosDurableBackend {
         this.admissionSettlements.delete(workflowId);
     }, () => {});
     return pending.then(async () => {
+      this.admitted = true;
       await dbosAdmissionContext.run(signal, () => this.flush(workflowId));
       signal.throwIfAborted();
       this.admissionMetadataAttempted.delete(workflowId);
@@ -39347,12 +40144,13 @@ class DbosDurableBackend {
         await this.flushWrites(workflowId);
         signal.throwIfAborted();
       }), signal);
+      this.ensureGeneration();
       this.admissionUnavailable = false;
       this.unavailableAdmissions.delete(workflowId);
       this.unavailableCheckpoints.delete(workflowId);
       this.pendingRecoveryAdmissions.delete(workflowId);
     } catch (error) {
-      if (isDbosDependencyError(error)) {
+      if (isDbosDependencyError(error) && this.generationIsCurrent?.() !== false) {
         this.admissionMetadataAttempted.delete(workflowId);
         this.admissionUnavailable = true;
         this.unavailableAdmissions.add(workflowId);
@@ -39378,6 +40176,7 @@ class DbosDurableBackend {
     });
   }
   registerWorkflow(handle) {
+    this.ensureGeneration();
     if (this.invalid.has(handle.workflowId)) {
       throw new DurableNestedTopologyError(`workflow ${handle.workflowId} contains malformed current DBOS records`);
     }
@@ -39419,6 +40218,7 @@ class DbosDurableBackend {
     return persisted;
   }
   recordCheckpoint(checkpoint) {
+    this.ensureGeneration();
     if (!this.isWorkflowLoadable(checkpoint.workflowId))
       return;
     this.mem.recordCheckpoint(checkpoint);
@@ -39447,7 +40247,7 @@ class DbosDurableBackend {
       });
       signal.throwIfAborted();
     }), options?.signal ?? dbosAdmissionContext.getStore(), undefined, "Workflow database checkpoint timed out. Restore PostgreSQL and inspect the run before resuming; external outcomes may be unknown.").catch((error) => {
-      if (isDbosDependencyError(error)) {
+      if (isDbosDependencyError(error) && this.generationIsCurrent?.() !== false) {
         this.unavailableCheckpoints.add(checkpoint.workflowId);
         const errors = this.writeErrors.get(checkpoint.workflowId);
         if (errors !== undefined)
@@ -39495,12 +40295,14 @@ class DbosDurableBackend {
     return this.mem.listCheckpoints(workflowId);
   }
   getWorkflow(workflowId) {
-    return this.mem.getWorkflow(workflowId);
+    const handle = this.mem.getWorkflow(workflowId);
+    return handle === undefined || this.sdk.ownerLiveness === undefined ? handle : { ...handle, ownerLiveness: this.ownerLiveness.get(handle.ownerExecutorId ?? "") ?? "unknown" };
   }
   getLoadableWorkflow(workflowId) {
-    return this.isWorkflowLoadable(workflowId) ? this.mem.getWorkflow(workflowId) : undefined;
+    return this.isWorkflowLoadable(workflowId) ? this.getWorkflow(workflowId) : undefined;
   }
   setWorkflowStatus(workflowId, status, pendingPrompts, resumable, failure) {
+    this.ensureGeneration();
     if (status === "cancelled" || status === "completed" || resumable === false) {
       this.admissionRecoveryControllers.get(workflowId)?.abort(new Error("Workflow recovery superseded by terminal control."));
     }
@@ -39524,9 +40326,10 @@ class DbosDurableBackend {
       await this.writeMetadata(workflowId);
     });
   }
-  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt) {
+  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt, modelOwner) {
+    this.ensureGeneration();
     let records = [];
-    return await transitionDbosWorkflowStatus({
+    const transition = () => transitionDbosWorkflowStatus({
       expectedStatuses: expected,
       status,
       flush: () => this.flush(workflowId),
@@ -39540,14 +40343,25 @@ class DbosDurableBackend {
         const pendingPrompts = this.promptReservations.hydrate(workflowId, entry.pendingPrompts, records, entry.promptReservationEpoch);
         this.applyMetadata(workflowId, { ...entry, pendingPrompts });
       },
-      claim: (authoritative, generation) => this.claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable),
+      claim: (authoritative, generation) => this.claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable, modelOwner),
       write: async () => {
+        const handle = this.mem.getWorkflow(workflowId);
+        if (handle !== undefined)
+          this.mem.registerWorkflow({
+            ...handle,
+            legacyRecoveryPending: undefined,
+            ...modelOwner !== undefined ? { modelOwner } : {}
+          }, true);
         this.setWorkflowStatus(workflowId, status, pendingPrompts, resumable);
         await this.flush(workflowId);
       }
     });
+    if (this.sdk.withWorkflowClaim === undefined)
+      return await transition();
+    await this.flush(workflowId);
+    return await this.sdk.withWorkflowClaim(workflowId, transition);
   }
-  async claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable) {
+  async claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable, modelOwner) {
     const stepName = claimMetadataStepName(generation);
     const transitionClaimId = crypto.randomUUID();
     const claim = {
@@ -39555,6 +40369,8 @@ class DbosDurableBackend {
       status,
       ...pendingPrompts !== undefined ? { pendingPrompts } : {},
       ...resumable !== undefined ? { resumable } : {},
+      ...modelOwner === undefined ? {} : { modelOwner },
+      legacyRecoveryPending: undefined,
       ownerExecutorId: this.executorId,
       transitionClaimId,
       updatedAt: Math.max(Date.now(), authoritative.updatedAt + 1)
@@ -39696,7 +40512,7 @@ class DbosDurableBackend {
         this.mem.recordCheckpoint(classified.checkpoint);
       }
       const handle = this.getLoadableWorkflow(workflowId);
-      return handle === undefined ? { kind: "malformed" } : { kind: "current", handle };
+      return handle === undefined ? { kind: "malformed" } : await this.withOwnerLiveness(handle);
     }
     const info = await this.sdk.retrieveWorkflow(workflowId);
     if (info !== undefined)
@@ -39719,6 +40535,7 @@ class DbosDurableBackend {
     }
   }
   reconcileWorkflowAdmission(workflowId, signal) {
+    this.ensureGeneration();
     signal?.throwIfAborted();
     if (!this.unavailableAdmissions.has(workflowId) && !this.unavailableCheckpoints.has(workflowId))
       return Promise.resolve();
@@ -39733,11 +40550,13 @@ class DbosDurableBackend {
         return;
       if (metadata.resumable === false || metadata.status === "cancelled" || metadata.status === "completed")
         return;
-      if (!await reconcileDbosAdmission(this.sdk, this.promptReservations.metadata(workflowId, metadata), this.unavailableAdmissions.has(workflowId), this.checkReady)) {
+      if (!await reconcileDbosAdmission(this.sdk, { ...this.promptReservations.metadata(workflowId, metadata), ownerExecutorId: this.executorId }, this.unavailableAdmissions.has(workflowId), this.checkReady)) {
         await this.suppressWorkflow(workflowId);
         return;
       }
       admissionSignal.throwIfAborted();
+      await this.sdk.adoptPreviousGeneration?.(workflowId);
+      admissionSignal.throwIfAborted();
       const info = await this.sdk.retrieveWorkflow(workflowId);
       if (info === undefined)
         return;
@@ -39774,7 +40593,7 @@ class DbosDurableBackend {
       return { kind: deletion === "current" ? "deleted" : "malformed" };
     }
     const metadata = classifyLatestMetadata(records, info.workflowId);
-    if (metadata.kind !== "current" || expected !== undefined && (metadata.metadata.name !== expected.name || !isDeepStrictEqual2(metadata.metadata.inputs, expected.inputs))) {
+    if (metadata.kind !== "current" || expected !== undefined && (metadata.metadata.name !== expected.name || !isDeepStrictEqual3(metadata.metadata.inputs, expected.inputs))) {
       await this.suppressWorkflow(info.workflowId);
       return { kind: "malformed" };
     }
@@ -39808,10 +40627,17 @@ class DbosDurableBackend {
     });
     const handle = this.getLoadableWorkflow(info.workflowId);
     if (handle !== undefined)
-      return { kind: "current", handle };
+      return await this.withOwnerLiveness(handle);
     await this.suppressWorkflow(info.workflowId);
     return { kind: "malformed" };
   }
+  async withOwnerLiveness(handle) {
+    if (this.sdk.ownerLiveness === undefined)
+      return { kind: "current", handle };
+    const ownerLiveness = await this.sdk.ownerLiveness(handle.ownerExecutorId);
+    this.ownerLiveness.set(handle.ownerExecutorId ?? "", ownerLiveness);
+    return { kind: "current", handle: { ...handle, ownerLiveness } };
+  }
   async suppressWorkflow(workflowId) {
     this.invalid.add(workflowId);
     this.current.delete(workflowId);
@@ -39825,10 +40651,21 @@ class DbosDurableBackend {
       return Promise.resolve();
     const previous = this.writeQueues.get(workflowId) ?? Promise.resolve();
     const next = previous.then(async () => {
+      this.ensureGeneration();
+      const adopted = await this.sdk.adoptPreviousGeneration?.(workflowId);
+      const local = this.mem.getWorkflow(workflowId);
+      if (adopted !== undefined && local !== undefined)
+        this.mem.registerWorkflow({
+          ...local,
+          ownerExecutorId: adopted.ownerExecutorId,
+          updatedAt: Math.max(local.updatedAt, adopted.updatedAt + 1)
+        }, true);
       if (!signal?.aborted)
         await fn();
     });
     const tracked = next.catch((err) => {
+      if (this.generationIsCurrent?.() === false)
+        return;
       const error = err instanceof Error ? err : new Error(String(err));
       const errors = this.writeErrors.get(workflowId) ?? [];
       errors.push(error);
@@ -39865,7 +40702,7 @@ class DbosDurableBackend {
   applyMetadata(workflowId, metadata) {
     if (metadata.workflowId !== workflowId)
       return;
-    this.mem.registerWorkflow(metadata);
+    this.mem.registerWorkflow(metadata, true);
   }
 }
 
@@ -39901,7 +40738,7 @@ import { tmpdir, uptime } from "node:os";
 import { basename as basename3, dirname as dirname3, isAbsolute as isAbsolute3, join as join4, relative as relative2, sep as sep2 } from "node:path";
 
 // dist/builtin/workflows/src/durable/dbos-embedded-postgres-root.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import {
   chmod,
   chown,
@@ -40384,8 +41221,8 @@ async function snapshotSourceRuntime(root, publisher, progress) {
   const rootStat = await lstat(root);
   assertRuntimeRoot(root, rootStat);
   const rootRealPath = await realpath(root);
-  const sourceHash = createHash3("sha256");
-  const sealedHash = createHash3("sha256");
+  const sourceHash = createHash5("sha256");
+  const sealedHash = createHash5("sha256");
   await hashSourceEntry(sourceHash, sealedHash, root, ".", rootRealPath, publisher, progress);
   return { sourceIdentity: sourceHash.digest("hex"), sealedIdentity: sealedHash.digest("hex") };
 }
@@ -40650,7 +41487,7 @@ async function snapshotSealedManifest(root, progress) {
   const rootStat = await lstat(root);
   assertRuntimeRoot(root, rootStat);
   const rootRealPath = await realpath(root);
-  const hash = createHash3("sha256");
+  const hash = createHash5("sha256");
   const entries = [];
   await hashSealedEntry(hash, root, ".", rootRealPath, progress, entries);
   return { version: 1, sealedIdentity: hash.digest("hex"), entries };
@@ -40884,6 +41721,13 @@ function resolveEmbeddedPostgresTarget(host) {
 init_dbos_admission();
 var HEALTH_INTERVAL_MS = 5000;
 var RECOVERY_ATTEMPTS = 3;
+function isMonitoringConnectionTimeout(error) {
+  if (!(error instanceof Error))
+    return false;
+  if ("code" in error)
+    return error.code === "ETIMEDOUT";
+  return error.message === "timeout expired" || error.message === "Connection terminated due to connection timeout";
+}
 function isMonitoringConnectionFailure(error) {
   if (!(error instanceof Error))
     return false;
@@ -40904,6 +41748,7 @@ class PostgresHealth {
   attempts = 0;
   nextRecoveryAt = 0;
   failure;
+  healthySinceFailure = false;
   revision = 0;
   listeners = new Set;
   constructor(operations) {
@@ -40912,6 +41757,18 @@ class PostgresHealth {
   get lastFailure() {
     return this.failure;
   }
+  get endpoint() {
+    return this.operations.url?.();
+  }
+  retainFailure(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const safe = redactedDatabaseMessage(message, this.endpoint);
+    this.failure = new Error(safe);
+    this.healthySinceFailure = false;
+  }
+  dependencyFailure(message) {
+    return new DbosDependencyError(message, this.endpoint === undefined ? undefined : { provider: "managed", url: this.endpoint, failure: this.failure?.message });
+  }
   subscribe(listener) {
     this.listeners.add(listener);
     return () => this.listeners.delete(listener);
@@ -40934,12 +41791,15 @@ class PostgresHealth {
         await this.operations.validate?.(client);
       }
     } catch (error) {
-      this.failure = error instanceof Error ? error : new Error(String(error));
+      this.retainFailure(error);
       if (!isQueryReadTimeout(error)) {
         this.invalidate();
-        throw error;
+        if (this.endpoint === undefined)
+          throw error;
+        const failure = this.dependencyFailure("Managed PostgreSQL connection validation refused. Preserve its data and ownership records.");
+        throw error instanceof DbosDependencyError ? failure : new Error(failure.message);
       }
-      throw new DbosDependencyError("Managed PostgreSQL did not answer a connection identity check in time.");
+      throw this.dependencyFailure("Managed PostgreSQL did not answer a connection identity check in time.");
     }
   }
   check() {
@@ -40978,9 +41838,9 @@ class PostgresHealth {
       try {
         identity = await this.operations.probe();
       } catch (retryError) {
-        if (!isMonitoringConnectionFailure(retryError))
+        if (isMonitoringConnectionTimeout(retryError) || !isMonitoringConnectionFailure(retryError))
           throw retryError;
-        this.failure = retryError;
+        this.retainFailure(retryError);
         return;
       }
     }
@@ -40995,6 +41855,7 @@ class PostgresHealth {
     this.available = identity;
     this.attempts = 0;
     this.nextRecoveryAt = 0;
+    this.healthySinceFailure = true;
     return identity.url;
   }
   async refresh() {
@@ -41003,20 +41864,22 @@ class PostgresHealth {
       if (ready !== undefined)
         return ready;
     } catch (error) {
-      if (isQueryReadTimeout(error)) {
-        this.failure = new DbosDependencyError("Managed PostgreSQL did not answer a health check in time.");
-        throw this.failure;
+      if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error)) {
+        this.retainFailure(new Error("Managed PostgreSQL did not answer a health check in time."));
+        throw this.dependencyFailure("Managed PostgreSQL did not answer a health check in time.");
       }
-      this.failure = error instanceof Error ? error : new Error(String(error));
+      this.retainFailure(error);
       if (!(error instanceof Error && ("code" in error) && error.code === "53300"))
         this.invalidate();
-      throw error;
+      throw this.endpoint === undefined ? error : this.dependencyFailure("Managed PostgreSQL recovery refused after a health probe failure. Preserve its data and ownership records.");
+    }
+    if (this.attempts === 0 && (this.failure === undefined || this.healthySinceFailure)) {
+      this.retainFailure(new Error("Managed PostgreSQL failed its live health check."));
+      this.healthySinceFailure = false;
     }
-    if (this.attempts === 0)
-      this.failure = new DbosDependencyError("Managed PostgreSQL failed its live health check.");
     this.invalidate();
     if ((this.operations.now ?? Date.now)() < this.nextRecoveryAt)
-      throw new DbosDependencyError("Managed Postgres recovery is cooling down after bounded attempts.");
+      throw this.dependencyFailure("Managed Postgres recovery is cooling down after bounded attempts.");
     while (!this.stopped && this.attempts < RECOVERY_ATTEMPTS) {
       const attempt = this.attempts++;
       if (attempt > 0)
@@ -41029,12 +41892,12 @@ class PostgresHealth {
         if (ready !== undefined)
           return ready;
       } catch (error) {
-        this.failure = error instanceof Error ? error : new Error(String(error));
+        this.retainFailure(error);
       }
     }
     this.attempts = 0;
     this.nextRecoveryAt = (this.operations.now ?? Date.now)() + HEALTH_INTERVAL_MS;
-    throw new DbosDependencyError("Managed Postgres is unavailable after bounded recovery. Preserve its data and ownership records.");
+    throw this.dependencyFailure("Managed Postgres is unavailable after bounded recovery. Preserve its data and ownership records.");
   }
 }
 
@@ -41309,7 +42172,7 @@ async function probePostgresIdentity(port) {
     const result = await client.query(POSTGRES_IDENTITY_SQL);
     return result.rows[0];
   } catch (error) {
-    if (isQueryReadTimeout(error))
+    if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error))
       throw error;
     const code = error instanceof Error && "code" in error ? error.code : undefined;
     if (code === "ECONNREFUSED" || code === "ECONNRESET" || code === "EPIPE" || code === "57P01" || code === "57P02" || code === "57P03" || error instanceof Error && /timeout|timed out|connection terminated/i.test(error.message))
@@ -41482,7 +42345,7 @@ async function ensureCluster(options = {}) {
         try {
           return await existingServerProbe()(probePort);
         } catch (error) {
-          if (isQueryReadTimeout(error))
+          if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error))
             return;
           throw error;
         }
@@ -41690,6 +42553,8 @@ async function ensureCluster(options = {}) {
           const server = current.server;
           if (!server)
             throw new Error("Managed Postgres published identity is missing.");
+          if (managedPostmaster(current) === undefined)
+            return;
           if (!managedPostgresRuntimeHealthy(current, server.port)) {
             verifyManagedPostmasterProcess(current, server);
             return;
@@ -41706,6 +42571,7 @@ async function ensureCluster(options = {}) {
         };
         health = new PostgresHealth({
           probe: () => inspect(),
+          url: embeddedDbosSystemDatabaseUrl,
           validate: async (client) => {
             const identity = await inspect(async () => {
               const query = { text: POSTGRES_IDENTITY_SQL, query_timeout: POSTGRES_HEALTH_QUERY_TIMEOUT_MS };
@@ -42793,6 +43659,9 @@ async function requireDockerSuccess(action, args) {
   throw new Error(`Could not ${action}: ${commandFailureDetail(result)}`);
 }
 
+// dist/builtin/workflows/src/durable/dbos-lifecycle.ts
+init_dbos_process_owner();
+
 // dist/builtin/workflows/src/durable/dbos-registration-diagnostics.ts
 var cachedErrorModule;
 var errorModuleLoad;
@@ -48534,6 +49403,11 @@ var jobTracker = singleton5.facade;
 
 // dist/builtin/workflows/src/durable/resume-runtime.ts
 init_dbos_admission();
+
+// dist/builtin/workflows/src/durable/sdk-recovery-scope.ts
+init_dbos_owner_fence();
+
+// dist/builtin/workflows/src/durable/resume-runtime.ts
 var pendingResumes = new WeakMap;
 var unsettledResumeClaims = new WeakMap;
 
@@ -54059,7 +54933,7 @@ class StageSessionController {
 }
 
 // dist/builtin/workflows/src/runs/foreground/stage-runner-output.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { mkdir as mkdir3, writeFile as writeFile2 } from "node:fs/promises";
 import { basename as basename6, dirname as dirname10, isAbsolute as isAbsolute11, join as join13, resolve as resolve10 } from "node:path";
 var DEFAULT_MAX_OUTPUT_BYTES = 200 * 1024;
@@ -54125,7 +54999,7 @@ function formatByteSize(bytes) {
   return `${value.toFixed(1)} ${units[unitIndex]}`;
 }
 function transcriptPath(runId, outputPath) {
-  const digest = createHash4("sha256").update(outputPath).digest("hex").slice(0, 16);
+  const digest = createHash6("sha256").update(outputPath).digest("hex").slice(0, 16);
   return join13(workflowArtifactRunPath(runId), "transcripts", `${digest}-${basename6(outputPath)}.transcript.md`);
 }
 function appendContent(lines, content) {
@@ -55227,7 +56101,8 @@ async function run(def, inputs, opts = {}) {
     ownController.abort(callerSignal?.reason);
   };
   const exit = createWorkflowExitManager({ runId, exitScope, controller: ownController });
-  const backendView = opts.durableBackend ?? getDurableBackend();
+  const sourceBackend = opts.durableBackend ?? getDurableBackend();
+  const backendView = sourceBackend.executionView?.() ?? sourceBackend;
   const rootBackend = opts.durableRootBackend ?? backendView;
   const durableBackend = opts.durableScope !== undefined ? new ScopedDurableBackend(backendView, opts.durableScope) : backendView;
   const inheritedElapsedMs = opts.parentRun === undefined ? inheritedRunElapsedMs({ backend: durableBackend, runId, continuationSource: opts.continuation?.source }) : undefined;
@@ -55743,7 +56618,7 @@ async function run(def, inputs, opts = {}) {
         if (control === latestControl && !ownController.signal.aborted && isDbosDependencyError(error)) {
           activeStore.recordRunExecutionState(runId, {
             phase: "blocked_dependency",
-            dependencyError: `Workflow database unavailable during ${status === "paused" ? "pause" : "resume"}; persistence not confirmed.`
+            dependencyError: `Workflow database unavailable during ${status === "paused" ? "pause" : "resume"}; persistence not confirmed. ${error.message}`
           });
           if (status === "paused")
             return;
@@ -55790,7 +56665,7 @@ async function run(def, inputs, opts = {}) {
       if (!admission.admitting)
         return pausePersistence;
       backgroundAdmissionControl(durableBackend, runId, pausePersistence, (error, resumable) => {
-        admissionControlError = unknownErrorMessage(error);
+        admissionControlError = databaseDependencyMessage(unknownErrorMessage(error), getDbosProcessOwner().databaseDiagnostics?.());
         runSnapshot.error = admissionControlError;
         activeStore.recordRunPaused(runId, undefined, { resumable });
         return runSnapshot.error;
@@ -55807,7 +56682,7 @@ async function run(def, inputs, opts = {}) {
         } catch (error) {
           if (admission.failed) {
             scheduler.releaseRun();
-            throw error;
+            throw new Error(admissionControlError ?? databaseDependencyMessage(unknownErrorMessage(error), getDbosProcessOwner().databaseDiagnostics?.()));
           }
         }
         if (generation !== pauseGeneration)
@@ -55880,12 +56755,21 @@ async function run(def, inputs, opts = {}) {
     }).catch((error) => {
       const isTopologyError = typeof error === "object" && error !== null && "name" in error && error.name === "DurableNestedTopologyError";
       if (!isDbosDependencyError(error) && !isTopologyError) {
-        durableAdmissionFailure = { error };
-        classifiedFailures.set(error, classifyWorkflowFailure({
+        const admissionDetail = unknownErrorMessage(error);
+        const diagnostics = getDbosProcessOwner().databaseDiagnostics?.();
+        const safeMessage = databaseDependencyMessage(admissionDetail, diagnostics);
+        activeStore.recordRunExecutionState(runId, {
+          phase: "blocked_dependency",
+          dependencyError: safeMessage
+        });
+        const safeError = new Error(safeMessage);
+        durableAdmissionFailure = { error: safeError };
+        classifiedFailures.set(safeError, classifyWorkflowFailure({
           code: "ATOMIC_DURABLE_ADMISSION_REJECTED",
-          message: unknownErrorMessage(error),
-          cause: error
+          message: safeMessage,
+          cause: safeError
         }));
+        throw safeError;
       }
       throw error;
     }), ownController.signal);
@@ -55978,6 +56862,17 @@ async function run(def, inputs, opts = {}) {
     const gracefulQuit = observedQuitCancellation() ?? observedTaskTailQuit ?? findWorkflowGracefulQuit(err) ?? findWorkflowGracefulQuit(ownController.signal.reason);
     if (gracefulQuit !== undefined)
       return suspendForGracefulQuit(gracefulQuit);
+    if (isDbosDependencyError(err) && durableBackend.isCheckpointUnavailable?.(runId) && (durableBackend.getWorkflow(runId)?.completedCheckpoints ?? 0) > 0) {
+      await admittedTools.closeAndDrain();
+      activeStore.recordRunPaused(runId, undefined, { resumable: true });
+      activeStore.recordRunExecutionState(runId, { phase: "blocked_dependency", dependencyError: err.message });
+      return {
+        runId,
+        status: "paused",
+        stages: [...runSnapshot.stages],
+        toolNodes: [...runSnapshot.toolNodes ?? []]
+      };
+    }
     await admittedTools.closeAndDrain();
     if (ownController.signal.aborted)
       await Promise.allSettled([...pendingChildWorkflows]);