@deksden-com/dd-flow-cli 0.9.0-beta.104 → 0.9.0-beta.106

package/dist/storage/import-guard.js

@@ -0,0 +1,102 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+/** Outside the replaced runtime tree, so a copied source receipt cannot make
+ * an incomplete target look ready. A failed target is diagnostic evidence. */
+export function importGuardPath(home) {
+    const absolute = canonicalHome(home);
+    return path.join(path.dirname(absolute), `.${path.basename(absolute)}.dd-flow-import.json`);
+}
+function canonicalHome(home) {
+    let existing = path.resolve(home);
+    const suffix = [];
+    while (!fs.existsSync(existing)) {
+        suffix.unshift(path.basename(existing));
+        existing = path.dirname(existing);
+    }
+    return path.join(fs.realpathSync(existing), ...suffix);
+}
+function readImportGuard(home) {
+    const file = importGuardPath(home);
+    if (!fs.existsSync(file))
+        return null;
+    let guard;
+    try {
+        guard = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        throw new AppError("snapshot_import_incomplete", "Snapshot import guard is unreadable; preserve this target for diagnosis", 1, { guard_path: file });
+    }
+    if (guard.schema_id !== "dd-flow/import-guard@1" || guard.runtime_home !== canonicalHome(home)
+        || !/^[0-9a-f-]{36}$/.test(guard.import_id) || !/^[a-f0-9]{64}$/.test(guard.source_manifest_sha256)
+        || !path.isAbsolute(guard.project_root) || !path.isAbsolute(guard.workspace_root)
+        || !["in_progress", "completed"].includes(guard.status)) {
+        throw new AppError("snapshot_import_incomplete", "Snapshot import guard does not identify this target", 1, { guard_path: file });
+    }
+    return guard;
+}
+export function assertImportAdmission(home, permit) {
+    const guard = readImportGuard(home);
+    if (guard?.status === "in_progress" && guard.import_id !== permit)
+        throw new AppError("snapshot_import_incomplete", "Snapshot import has not completed; preserve this target for diagnosis and restore into fresh targets", 1, { guard_path: importGuardPath(home), import_id: guard.import_id });
+}
+function durableWrite(file, bytes, create) {
+    const target = create ? file : `${file}.tmp-${crypto.randomUUID()}`;
+    try {
+        fs.writeFileSync(target, bytes, { flag: "wx", mode: 0o600 });
+        const descriptor = fs.openSync(target, "r");
+        try {
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        if (!create)
+            fs.renameSync(target, file);
+        const directory = fs.openSync(path.dirname(file), "r");
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+    }
+    finally {
+        if (!create)
+            fs.rmSync(target, { force: true });
+    }
+}
+export function beginSnapshotImport(input) {
+    const importId = crypto.randomUUID();
+    const guard = { schema_id: "dd-flow/import-guard@1", import_id: importId, status: "in_progress", source_manifest_sha256: input.sourceManifestSha256,
+        runtime_home: canonicalHome(input.home), project_root: path.resolve(input.projectRoot), workspace_root: path.resolve(input.workspaceRoot) };
+    durableWrite(importGuardPath(input.home), `${JSON.stringify(guard)}\n`, true);
+    return importId;
+}
+/** A fork with its own matching intent may rebuild a completed import when
+ * its final fork receipt was lost. Fence the existing home before removing any
+ * copied files; an interrupted rebuild remains closed to productive opens. */
+export function rearmCompletedSnapshotImport(input) {
+    const guard = readImportGuard(input.home);
+    if (!guard)
+        return null;
+    if (guard.status !== "completed" || guard.project_root !== path.resolve(input.projectRoot)
+        || guard.workspace_root !== path.resolve(input.workspaceRoot)
+        || guard.source_manifest_sha256 !== input.sourceManifestSha256) {
+        throw new AppError("snapshot_import_incomplete", "Existing import does not match this completed fork; preserve it for diagnosis", 1, { guard_path: importGuardPath(input.home) });
+    }
+    const importId = crypto.randomUUID();
+    durableWrite(importGuardPath(input.home), `${JSON.stringify({ ...guard, import_id: importId, status: "in_progress" })}\n`, false);
+    return importId;
+}
+export function completeSnapshotImport(home, importId, completed) {
+    const guard = readImportGuard(home);
+    if (!guard || guard.import_id !== importId || guard.status !== "in_progress"
+        || guard.project_root !== path.resolve(completed.projectRoot)
+        || guard.workspace_root !== path.resolve(completed.workspaceRoot)
+        || guard.source_manifest_sha256 !== completed.sourceManifestSha256) {
+        throw new AppError("snapshot_import_incomplete", "Import completion does not match its source and target paths", 1, { guard_path: importGuardPath(home) });
+    }
+    durableWrite(importGuardPath(home), `${JSON.stringify({ ...guard, status: "completed" })}\n`, false);
+}

package/dist/storage/native-cleanup.js

@@ -0,0 +1,52 @@
+import { AppError, errorRecord } from "../shared/errors.js";
+/** Cleanup must not replace the operation's primary failure, including thrown null/undefined. */
+export function withStoreCleanup(operation, cleanup, details = () => ({})) {
+    let failed = false;
+    let primary;
+    let result;
+    try {
+        result = operation();
+    }
+    catch (error) {
+        failed = true;
+        primary = error;
+    }
+    try {
+        cleanup();
+    }
+    catch (error) {
+        const secondary = { ...details(), store_cleanup_errors: [errorRecord(error)] };
+        if (failed) {
+            const original = errorRecord(primary);
+            throw new AppError(original.code, original.message, original.exitCode, {
+                ...original.details, ...secondary,
+                store_cleanup_errors: [...(Array.isArray(original.details.store_cleanup_errors) ? original.details.store_cleanup_errors : []), ...secondary.store_cleanup_errors]
+            });
+        }
+        throw new AppError("store_cleanup_failed", "Store operation completed but cleanup failed", 1, secondary);
+    }
+    if (failed)
+        throw primary;
+    return result;
+}
+/** A failed rollback makes even an enclosing savepoint's connection unsafe to reuse. */
+export function rollbackStoreTransaction(db, sql, primary) {
+    try {
+        db.exec(sql);
+    }
+    catch (error) {
+        let closeError;
+        try {
+            db.close();
+        }
+        catch (close) {
+            closeError = errorRecord(close);
+        }
+        const original = errorRecord(primary);
+        throw new AppError(original.code, original.message, original.exitCode, {
+            ...original.details, transaction_cleanup_error: errorRecord(error),
+            ...(closeError ? { transaction_close_error: closeError } : {})
+        });
+    }
+    throw primary;
+}

package/dist/storage/projection-lock.js

@@ -0,0 +1,73 @@
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { processStartedAt } from "../services/managed-processes.js";
+import { AppError, errorRecord } from "../shared/errors.js";
+/** One filesystem publisher per entity; no SQLite writer is held while waiting. */
+export function withProjectionLock(lockPath, operation) {
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+    const owner = { pid: process.pid, started_at: selfStartedAt() };
+    const wait = new Int32Array(new SharedArrayBuffer(4));
+    const observed = new Map();
+    for (let tries = 0;; tries++) {
+        try {
+            fs.mkdirSync(lockPath);
+            try {
+                fs.writeFileSync(`${lockPath}/owner.json`, JSON.stringify(owner));
+            }
+            catch (error) {
+                fs.rmdirSync(lockPath);
+                throw error;
+            }
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            let stale = false;
+            let observedInode;
+            try {
+                observedInode = fs.statSync(lockPath).ino;
+                const current = JSON.parse(fs.readFileSync(`${lockPath}/owner.json`, "utf8"));
+                try {
+                    process.kill(current.pid, 0);
+                    if (!observed.has(current.pid))
+                        observed.set(current.pid, processStartedAt(current.pid));
+                    stale = Boolean(current.started_at && observed.get(current.pid) !== current.started_at);
+                }
+                catch (probe) {
+                    stale = probe.code === "ESRCH";
+                }
+            }
+            catch {
+                stale = false;
+            }
+            if (stale) {
+                try {
+                    if (observedInode !== undefined && fs.statSync(lockPath).ino === observedInode) {
+                        const moved = `${lockPath}.stale-${crypto.randomUUID()}`;
+                        fs.renameSync(lockPath, moved);
+                        fs.rmSync(moved, { recursive: true });
+                    }
+                }
+                catch { /* Another publisher may own it now. */ }
+                continue;
+            }
+            if (tries >= 80)
+                throw new AppError("publication_pending", "Projection publisher is busy", 1, { effect: "committed", lock_path: lockPath });
+            Atomics.wait(wait, 0, 0, 50);
+        }
+    }
+    try {
+        return operation();
+    }
+    catch (error) {
+        throw new AppError("publication_pending", "Committed projection needs reconciliation", 1, { effect: "committed", cause: errorRecord(error), lock_path: lockPath });
+    }
+    finally {
+        fs.rmSync(lockPath, { recursive: true, force: true });
+    }
+}
+let ownStart;
+function selfStartedAt() { if (ownStart === undefined)
+    ownStart = processStartedAt(process.pid); return ownStart; }

package/dist/storage/writer-contract.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import { AppError } from "../shared/errors.js";
+import { rollbackStoreTransaction } from "./native-cleanup.js";
 export const STORE_WRITER_VERSION = 2;
 const version = STORE_WRITER_VERSION;
 const table = "dd_flow_writer_contract";
@@ -24,8 +25,7 @@ export function executeStoreSchema(db, sql, initialize = false) {
         db.exec(ownsTransaction ? "COMMIT" : "RELEASE dd_flow_schema_change");
     }
     catch (error) {
-        db.exec(ownsTransaction ? "ROLLBACK" : "ROLLBACK TO dd_flow_schema_change; RELEASE dd_flow_schema_change");
-        throw error;
+        rollbackStoreTransaction(db, ownsTransaction ? "ROLLBACK" : "ROLLBACK TO dd_flow_schema_change; RELEASE dd_flow_schema_change", error);
     }
 }
 /** Registration is connection-local and never changes historical input bytes. */
@@ -71,7 +71,7 @@ export function installStoreWriterContract(db) {
     }
     catch (error) {
         if (ownsTransaction)
-            db.exec("ROLLBACK");
+            rollbackStoreTransaction(db, "ROLLBACK", error);
         throw error;
     }
 }

package/dist/storage/writer-migration.js

@@ -4,6 +4,7 @@ import crypto from "node:crypto";
 import { DatabaseSync } from "node:sqlite";
 import { AppError } from "../shared/errors.js";
 import { installStoreWriterContract, readStoreWriterContract, registerStoreWriter, STORE_WRITER_VERSION } from "./writer-contract.js";
+import { rollbackStoreTransaction, withStoreCleanup } from "./native-cleanup.js";
 /** Explicit one-store cutover. The caller must separately drain external owners. */
 export function migrateStoreWriter(file, backup) {
     if (!path.isAbsolute(file) || !path.isAbsolute(backup) || file === backup || !fs.existsSync(file) || !fs.statSync(file).isFile())
@@ -12,12 +13,19 @@ export function migrateStoreWriter(file, backup) {
     const destination = path.join(fs.realpathSync(path.dirname(backup)), path.basename(backup));
     if (fs.lstatSync(file).isSymbolicLink() || [source, `${source}-wal`, `${source}-shm`, `${source}-journal`].includes(destination))
         throw new AppError("store_migration_path_invalid", "Backup cannot alias the source database or its SQLite sidecars", 1);
+    let existing;
     try {
-        const existing = fs.lstatSync(backup);
+        existing = fs.lstatSync(backup);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (existing) {
         if (!existing.isFile() || existing.isSymbolicLink())
             throw new AppError("store_migration_path_invalid", "Backup path already exists", 1);
         const reader = new DatabaseSync(file, { readOnly: true });
-        try {
+        return withStoreCleanup(() => {
             const recorded = reader.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = 'dd_flow_writer_migrations'").get()
                 ? reader.prepare("SELECT receipt_json FROM dd_flow_writer_migrations WHERE backup_path = ?").get(destination) : null;
             const receipt = recorded ? JSON.parse(String(recorded.receipt_json)) : null;
@@ -25,17 +33,11 @@ export function migrateStoreWriter(file, backup) {
                 throw new AppError("store_migration_path_invalid", "Existing backup has no matching committed migration receipt", 1);
             }
             return receipt;
-        }
-        finally {
-            reader.close();
-        }
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
+        }, () => reader.close());
     }
     const db = new DatabaseSync(file);
-    try {
+    let committed = false;
+    return withStoreCleanup(() => {
         db.exec("PRAGMA busy_timeout = 1000");
         registerStoreWriter(db);
         db.exec("BEGIN IMMEDIATE");
@@ -52,51 +54,32 @@ export function migrateStoreWriter(file, backup) {
                 if (tables.has(table) && db.prepare(`SELECT 1 FROM ${table} WHERE ${predicate} LIMIT 1`).get())
                     throw new AppError("store_migration_not_drained", "Store still contains unresolved writer ownership", 1, { table });
             }
+            // Explicit drained cutover, not a live-runtime writer path: keep backup, durability
+            // and hash inside this barrier so the receipt describes exactly the fenced source.
             // A separate reader sees committed WAL while this connection prevents new writes.
             const reader = new DatabaseSync(file, { readOnly: true });
-            try {
-                reader.exec(`VACUUM INTO '${backup.replaceAll("'", "''")}'`);
-            }
-            finally {
-                reader.close();
-            }
+            withStoreCleanup(() => reader.exec(`VACUUM INTO '${backup.replaceAll("'", "''")}'`), () => reader.close());
             const descriptor = fs.openSync(backup, "r");
-            try {
-                fs.fsyncSync(descriptor);
-            }
-            finally {
-                fs.closeSync(descriptor);
-            }
+            withStoreCleanup(() => fs.fsyncSync(descriptor), () => fs.closeSync(descriptor));
             const directory = fs.openSync(path.dirname(backup), "r");
-            try {
-                fs.fsyncSync(directory);
-            }
-            finally {
-                fs.closeSync(directory);
-            }
+            withStoreCleanup(() => fs.fsyncSync(directory), () => fs.closeSync(directory));
             const verification = new DatabaseSync(backup, { readOnly: true });
-            try {
+            withStoreCleanup(() => {
                 const check = verification.prepare("PRAGMA integrity_check").get();
                 if (Object.values(check)[0] !== "ok" || readStoreWriterContract(verification) !== previous)
                     throw new AppError("store_migration_backup_invalid", "Backup failed integrity or contract verification", 1);
-            }
-            finally {
-                verification.close();
-            }
+            }, () => verification.close());
             const receipt = { database: file, backup, backup_sha256: crypto.createHash("sha256").update(fs.readFileSync(backup)).digest("hex"), previous_version: previous, writer_version: STORE_WRITER_VERSION };
             db.exec("CREATE TABLE IF NOT EXISTS dd_flow_writer_migrations (backup_path TEXT PRIMARY KEY, receipt_json TEXT NOT NULL)");
             db.prepare("INSERT INTO dd_flow_writer_migrations VALUES (?, ?)").run(destination, JSON.stringify(receipt));
             installStoreWriterContract(db);
             db.exec("COMMIT");
+            committed = true;
             return receipt;
         }
         catch (error) {
-            if (db.isTransaction)
-                db.exec("ROLLBACK");
-            throw error;
+            rollbackStoreTransaction(db, "ROLLBACK", error);
         }
-    }
-    finally {
-        db.close();
-    }
+    }, () => { if (db.isOpen)
+        db.close(); }, () => ({ effect: committed ? "committed" : "uncommitted" }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.104",
+  "version": "0.9.0-beta.106",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {

package/tools/repair-paused-run-status.mjs

@@ -5,27 +5,26 @@ import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { parseArgs } from 'node:util';
-import { DatabaseSync } from 'node:sqlite';
-import { registerStoreWriter } from '../dist/storage/writer-contract.js';
-import { setFlowRunRecoveryPaused, completeFlowRun } from '../dist/services/runs.js';
+import { createContext } from '../dist/runtime/context.js';
+import { appendFlowRunTimelineEvent, gitFacts, publishRunProjections } from '../dist/services/runs.js';
+import { appendAudit } from '../dist/services/audit.js';
 
 const { values } = parseArgs({ options: { home: { type: 'string' }, run: { type: 'string' }, project: { type: 'string' }, apply: { type: 'boolean', default: false }, 'cancel-abandoned': { type: 'boolean', default: false } } });
 if (!values.home || !values.run || !values.project) throw new Error('Usage: --home <runtime> --project <project-id> --run <run-id> [--apply]');
-const home = fs.realpathSync(values.home), file = path.join(home, 'db.sqlite');
-const db = new DatabaseSync(file, { readOnly: !values.apply });
-let runtimePath, original, backup, report, changed = false;
+const home = fs.realpathSync(values.home);
+const context = createContext({ ...process.env, DD_FLOW_HOME: home }, values.apply ? 'hook' : 'read_existing');
+const db = context.db;
+let runtimePath, original, backup, report;
 try {
-  db.exec('PRAGMA busy_timeout=4000');
-  if (values.apply) { registerStoreWriter(db); db.exec('BEGIN IMMEDIATE'); }
-  const run = db.prepare('SELECT * FROM runs WHERE project_id=? AND id=?').get(values.project, values.run);
+  const run = db.get('SELECT * FROM runs WHERE project_id=? AND id=?', [values.project, values.run]);
   if (!run) throw new Error('RUN not found');
-  const guard = db.prepare('SELECT * FROM run_recovery_guards WHERE project_id=? AND run_id=? ORDER BY generation DESC LIMIT 1').get(values.project, values.run);
+  const guard = db.get('SELECT * FROM run_recovery_guards WHERE project_id=? AND run_id=? ORDER BY generation DESC LIMIT 1', [values.project, values.run]);
   const cancel = values['cancel-abandoned'];
   if (cancel) {
     if (fs.existsSync(run.project_root)) throw new Error('Abandoned-fixture cancellation requires an absent project directory');
     for (const table of ['works', 'sessions', 'run_controllers']) {
-      if (!db.prepare("SELECT 1 FROM sqlite_schema WHERE type='table' AND name=?").get(table)) continue;
-      if (db.prepare(`SELECT 1 FROM ${table} WHERE project_id=? AND run_id=? LIMIT 1`).get(values.project, values.run)) throw new Error('Abandoned-fixture cancellation requires no Work, Session or controller history');
+      if (!db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name=?", [table])) continue;
+      if (db.get(`SELECT 1 FROM ${table} WHERE project_id=? AND run_id=? LIMIT 1`, [values.project, values.run])) throw new Error('Abandoned-fixture cancellation requires no Work, Session or controller history');
     }
     if (guard) throw new Error('A recovery-owned RUN requires recovery reconciliation');
   }
@@ -41,19 +40,45 @@ try {
     if (values.apply) {
       backup = `${runtimePath}.status-repair-${crypto.randomUUID()}.json`;
       fs.writeFileSync(backup, JSON.stringify({ recovery_id: guard?.recovery_id ?? null, row: run, runtime: original.toString('utf8') }), { flag: 'wx', mode: 0o600 });
-      const context = { ddFlowHome: home, env: { ...process.env, DD_FLOW_HOME: home }, now: () => new Date().toISOString(), db: {
-        path: file, writable: true, get: (sql, params = []) => db.prepare(sql).get(...params), all: (sql, params = []) => db.prepare(sql).all(...params), run: (sql, params = []) => db.prepare(sql).run(...params), exec: sql => db.exec(sql)
-      } };
-      changed = true;
-      if (cancel) completeFlowRun(context, { projectRoot: run.project_root, runId: run.id, status: 'cancelled', manualOverrideReason: 'Operator requested cleanup of abandoned fixture: project removed; no Work, Session or controller history.' });
-      else setFlowRunRecoveryPaused(context, values.project, values.run, true);
+      const git = cancel ? gitFacts(run.workspace_root) : null;
+      db.writeTransaction(() => {
+        const current = db.get('SELECT * FROM runs WHERE project_id=? AND id=?', [values.project, values.run]);
+        const currentGuard = db.get('SELECT * FROM run_recovery_guards WHERE project_id=? AND run_id=? ORDER BY generation DESC LIMIT 1', [values.project, values.run]);
+        if (!current || current.status !== 'running' || current.index_json !== run.index_json || current.runtime_path !== run.runtime_path) throw new Error('RUN changed after repair preparation');
+        if (cancel) {
+          if (currentGuard) throw new Error('A recovery-owned RUN requires recovery reconciliation');
+          for (const table of ['works', 'sessions', 'run_controllers']) {
+            if (db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name=?", [table]) && db.get(`SELECT 1 FROM ${table} WHERE project_id=? AND run_id=? LIMIT 1`, [values.project, values.run])) throw new Error('Abandoned-fixture cancellation requires no Work, Session or controller history');
+          }
+        } else if (!currentGuard || currentGuard.recovery_id !== guard.recovery_id || currentGuard.generation !== guard.generation || currentGuard.status !== guard.status) throw new Error('Recovery guard changed after repair preparation');
+        const index = JSON.parse(current.index_json), now = context.now();
+        if (index.status !== 'running') throw new Error('RUN index changed after repair preparation');
+        index.status = cancel ? 'cancelled' : 'paused';
+        index.updated_at = now;
+        index.runtime_revision = (index.runtime_revision ?? 0) + 1;
+        if (cancel) {
+          for (const stage of index.stage_runs) if (['running', 'pending', 'paused', 'blocked'].includes(stage.status)) {
+            stage.status = 'skipped'; stage.updated_at = now; stage.completed_at = now;
+            const elapsed = Date.parse(now) - Date.parse(stage.started_at ?? '');
+            stage.duration_ms = Number.isFinite(elapsed) && elapsed >= 0 ? elapsed : null;
+          }
+          if (!['vnext_specify', 'vnext_protocolize'].includes(index.flow_kind)) index.attempts = index.stage_runs.map(stage => ({ stage: stage.stage, attempt_number: Number((stage.attempt ?? 'try-001').replace('try-', '')) || 1, root: stage.dir, archive: null, status: stage.status, started_at: stage.started_at ?? now, finished_at: stage.completed_at ?? null }));
+          index.verdict = 'cancelled'; index.next_action = null; index.completed_at = now; index.finished_at = now;
+          const elapsed = Date.parse(now) - Date.parse(index.started_at ?? current.created_at);
+          index.duration_ms = Number.isFinite(elapsed) && elapsed >= 0 ? elapsed : null;
+          index.execution = { project_root: index.execution?.project_root ?? current.project_root, workspace_root: index.execution?.workspace_root ?? current.workspace_root, git };
+        }
+        const updated = db.run('UPDATE runs SET status=?, verdict=?, next_action=?, index_json=?, updated_at=?, completed_at=? WHERE project_id=? AND id=? AND status=? AND index_json=?', [index.status, index.verdict, index.next_action, JSON.stringify(index), now, index.completed_at ?? null, values.project, values.run, 'running', current.index_json]);
+        if (updated.changes !== 1) throw new Error('RUN changed before repair commit');
+        if (cancel) {
+          const reason = 'Operator requested cleanup of abandoned fixture: project removed; no Work, Session or controller history.';
+          appendAudit(context, { projectId: values.project, eventType: 'flow_run.manual_override', payload: { run_id: run.id, status: 'cancelled', verdict: 'cancelled', next_action: null, reason } });
+          appendFlowRunTimelineEvent(context, values.project, run.id, { at: now, type: 'run_manual_override', status: 'cancelled', reason });
+        }
+        if (!cancel) db.afterCommit(() => publishRunProjections(context, values.project, run.id));
+      }, 'repair-paused-run-status');
     }
     report = { run_id: run.id, from: 'running', to: cancel ? 'cancelled' : 'paused', recovery_id: guard?.recovery_id ?? null, applied: values.apply, backup };
   }
-  if (values.apply) db.exec('COMMIT');
   console.log(JSON.stringify(report));
-} catch (error) {
-  if (values.apply && db.isTransaction) db.exec('ROLLBACK');
-  if (changed && original) { const temporary = `${runtimePath}.repair-rollback`; fs.writeFileSync(temporary, original); fs.renameSync(temporary, runtimePath); }
-  throw error;
 } finally { db.close(); }