@kontextmind/kxm 0.7.50 → 0.7.51

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.50",
+      "version": "0.7.51",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -53,6 +53,48 @@ All notable user-facing changes are documented here. The project follows [Semant
   arrival order, so a backdated timestamp cannot jump the queue; persisted records
   are cross-checked against every duplicated column on read; and the intake schema
   no longer admits contradictory states.
+- **A coordinator rebind could widen a tool ceiling by clearing its allow list.**
+  An absent or empty allow list imposes no restriction, so dropping a populated one
+  is now refused (`coordinator_rebind_clears_allowlist`). Resume drains held intent
+  to exhaustion instead of stopping at a page cap, and fails loudly rather than
+  half-resuming. Coordinator fingerprints are computed over the normalised
+  authority, so identities bound by 0.7.46 with unordered effect lists no longer
+  require a policy rebind after upgrade — and the equivalence test is shared, so a
+  row written by 0.7.46 is not a `coordinator_write_lost` conflict just because it
+  was found by losing an insert race instead of reading the slot.
+- **A failed `BEGIN` poisoned the database connection.** The transaction marker was
+  claimed before `BEGIN` and the statement sat outside the `try/finally`, so a
+  `BEGIN` that gave up on a busy writer left every later transaction failing with a
+  misleading "nested transactions are not allowed". The marker is now claimed only
+  after a successful `BEGIN`, genuine lock contention surfaces as
+  `runtime_transaction_busy` — decided by SQLite's **result code**, on both runtimes
+  this ships on: Node's `errcode` and `bun:sqlite`'s `errno` (extended codes land on
+  their primaries, so `SQLITE_BUSY_RECOVERY`, `SQLITE_BUSY_SNAPSHOT` and
+  `SQLITE_LOCKED_SHAREDCACHE` all count), then a symbolic `SQLITE_BUSY*` /
+  `SQLITE_LOCKED*` / `SQLITE_PROTOCOL*` name, with anchored message text used only
+  when an error carries neither. A code **or** a SQLite result name wins over the text
+  in both directions, so a permanent error — `SQLITE_FULL`, `SQLITE_CANTOPEN` — quoting
+  "database is locked" is not mistaken for contention, and `bun:sqlite`'s symbolic
+  `code` is read as the result name it is while Node's own `ERR_SQLITE_ERROR` is not.
+  Any other `BEGIN` failure keeps its own error instead of looking retryable. A contended connection then refuses further write-mode `BEGIN`s for one
+  second (`TRANSACTION_BUSY_BACKOFF_MS`), so retries **inside that window** fail fast
+  rather than paying the 5-second busy timeout once per attempt; a retry after the
+  window can pay it again. The window is measured with `process.hrtime` and belongs to
+  the clock that armed it, so neither a system clock change nor an injected test clock
+  can extend, shorten or clear another caller's throttle, and a clock that returns a
+  non-finite number is refused rather than trusted (`runtime_transaction_clock_invalid`)
+  wherever a reading is taken — checking a pending deadline, and arming a fresh one. The
+  clock is read at two call sites, not on every `BEGIN`. Zero reads are limited to
+  successful write-mode transactions with no pending deadline, successful `DEFERRED`
+  transactions with or without one, permanent `BEGIN` failures with no pending deadline, and
+  a nested-transaction rejection; a `DEFERRED` transaction skips the deadline check, but a
+  contended `BEGIN DEFERRED` failure still reads the clock and arms a deadline. Two further
+  cases are measured rather than asserted by the committed suite — a clean success, and a
+  permanent failure, each following an expired deadline, read it once. So this guards the
+  seam rather than every transaction, and the counts we assert are named separately from the
+  counts we observed. The throttle is per connection
+  object in this process — it is not cross-process, and it does not leak to another
+  connection to the same database.
 
 ## 0.7.0 - 2026-09-11
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.50",
+  "version": "0.7.51",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.50",
+  "version": "0.7.51",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/mcp-server.js

@@ -17121,7 +17121,7 @@ async function deliverInboxNotification(messageId, delivered, notify) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.50";
+var VERSION = "0.7.51";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();
 var meshClient;

package/plugins/kxm/dist/runtime-supervisor.js

@@ -17645,12 +17645,76 @@ function openDatabase(file, description, spec) {
   }
 }
 var activeTransactions = /* @__PURE__ */ new WeakSet();
-function withDatabaseTransaction(database, work, mode = "IMMEDIATE") {
+var TRANSACTION_BUSY_BACKOFF_MS = 1e3;
+function monotonicNowMs() {
+  return Number(process.hrtime.bigint() / 1000000n);
+}
+var transactionThrottles = /* @__PURE__ */ new WeakMap();
+function finiteNow(clock, label) {
+  const now = clock();
+  if (typeof now !== "number" || !Number.isFinite(now)) {
+    throw databaseError(
+      "runtime_transaction_clock_invalid",
+      "transaction",
+      `${label} must return a finite monotonic number; got ${String(now)}`
+    );
+  }
+  return now;
+}
+var CONTENTION_PRIMARY_CODES = [5, 6, 15];
+var CONTENTION_SYMBOLIC_NAMES = /^SQLITE_(?:BUSY|LOCKED|PROTOCOL)(?:_[A-Z0-9]+)?$/;
+var SQLITE_RESULT_NAMES = /^SQLITE_[A-Z][A-Z0-9_]*$/;
+var CONTENTION_MESSAGES = /^(?:database is locked|database table is locked|locking protocol|SQLITE_BUSY|SQLITE_LOCKED|SQLITE_PROTOCOL)(?:$|[\s.:])/i;
+function isTransactionContention(error) {
+  const carrier = error;
+  for (const value of [carrier?.errcode, carrier?.errCode, carrier?.errno]) {
+    if (typeof value === "number" && Number.isInteger(value)) return CONTENTION_PRIMARY_CODES.includes(value & 255);
+  }
+  for (const value of [carrier?.code, carrier?.name]) {
+    if (typeof value === "string" && SQLITE_RESULT_NAMES.test(value)) {
+      return CONTENTION_SYMBOLIC_NAMES.test(value);
+    }
+  }
+  return CONTENTION_MESSAGES.test(error instanceof Error ? error.message : String(error));
+}
+function withDatabaseTransaction(database, work, mode = "IMMEDIATE", clock = monotonicNowMs) {
   if (activeTransactions.has(database)) {
     throw databaseError("runtime_transaction_nested", "transaction", "nested transactions are not allowed");
   }
+  if (mode !== "DEFERRED") {
+    const deadlines = transactionThrottles.get(database);
+    const until = deadlines?.get(clock);
+    if (until !== void 0) {
+      const remaining = until - finiteNow(clock, "the transaction clock");
+      if (remaining > 0) {
+        throw databaseError(
+          "runtime_transaction_busy",
+          "transaction",
+          `a previous BEGIN was blocked on this database; retry deferred ${String(remaining)}ms`
+        );
+      }
+      deadlines?.delete(clock);
+    }
+  }
+  try {
+    database.exec(`BEGIN ${mode}`);
+  } catch (error) {
+    if (!isTransactionContention(error)) throw error;
+    const now = finiteNow(clock, "the transaction clock");
+    let deadlines = transactionThrottles.get(database);
+    if (deadlines === void 0) {
+      deadlines = /* @__PURE__ */ new WeakMap();
+      transactionThrottles.set(database, deadlines);
+    }
+    deadlines.set(clock, now + TRANSACTION_BUSY_BACKOFF_MS);
+    throw databaseError(
+      "runtime_transaction_busy",
+      "transaction",
+      `BEGIN ${mode} blocked by another transaction: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
   activeTransactions.add(database);
-  database.exec(`BEGIN ${mode}`);
+  if (mode !== "DEFERRED") transactionThrottles.get(database)?.delete(clock);
   try {
     const result = work();
     database.exec("COMMIT");
@@ -18558,7 +18622,14 @@ var KxmRunEventStore = class {
     `).get(projectId, coordinatorId, idempotencyKey);
     return row ? intakeFromRow(row) : void 0;
   }
-  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
+  /**
+   * Intake rows in the given dispatch states, in arrival order (replay-safe).
+   *
+   * `rowid` gives same-store arrival order, which is what queue priority needs
+   * here. It is **not** a durable sequence: this repository backs stores up with
+   * `VACUUM INTO`, and a vacuum may renumber implicit rowids. An explicit
+   * immutable arrival sequence is tracked in the plan's schema-v6 follow-ups.
+   */
   intakeInStates(projectId, states, limit = 100) {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");

package/plugins/kxm/dist/runtime.js

@@ -17816,12 +17816,76 @@ function openDatabase(file, description, spec) {
   }
 }
 var activeTransactions = /* @__PURE__ */ new WeakSet();
-function withDatabaseTransaction(database, work, mode = "IMMEDIATE") {
+var TRANSACTION_BUSY_BACKOFF_MS = 1e3;
+function monotonicNowMs() {
+  return Number(process.hrtime.bigint() / 1000000n);
+}
+var transactionThrottles = /* @__PURE__ */ new WeakMap();
+function finiteNow(clock, label) {
+  const now = clock();
+  if (typeof now !== "number" || !Number.isFinite(now)) {
+    throw databaseError(
+      "runtime_transaction_clock_invalid",
+      "transaction",
+      `${label} must return a finite monotonic number; got ${String(now)}`
+    );
+  }
+  return now;
+}
+var CONTENTION_PRIMARY_CODES = [5, 6, 15];
+var CONTENTION_SYMBOLIC_NAMES = /^SQLITE_(?:BUSY|LOCKED|PROTOCOL)(?:_[A-Z0-9]+)?$/;
+var SQLITE_RESULT_NAMES = /^SQLITE_[A-Z][A-Z0-9_]*$/;
+var CONTENTION_MESSAGES = /^(?:database is locked|database table is locked|locking protocol|SQLITE_BUSY|SQLITE_LOCKED|SQLITE_PROTOCOL)(?:$|[\s.:])/i;
+function isTransactionContention(error) {
+  const carrier = error;
+  for (const value of [carrier?.errcode, carrier?.errCode, carrier?.errno]) {
+    if (typeof value === "number" && Number.isInteger(value)) return CONTENTION_PRIMARY_CODES.includes(value & 255);
+  }
+  for (const value of [carrier?.code, carrier?.name]) {
+    if (typeof value === "string" && SQLITE_RESULT_NAMES.test(value)) {
+      return CONTENTION_SYMBOLIC_NAMES.test(value);
+    }
+  }
+  return CONTENTION_MESSAGES.test(error instanceof Error ? error.message : String(error));
+}
+function withDatabaseTransaction(database, work, mode = "IMMEDIATE", clock = monotonicNowMs) {
   if (activeTransactions.has(database)) {
     throw databaseError("runtime_transaction_nested", "transaction", "nested transactions are not allowed");
   }
+  if (mode !== "DEFERRED") {
+    const deadlines = transactionThrottles.get(database);
+    const until = deadlines?.get(clock);
+    if (until !== void 0) {
+      const remaining = until - finiteNow(clock, "the transaction clock");
+      if (remaining > 0) {
+        throw databaseError(
+          "runtime_transaction_busy",
+          "transaction",
+          `a previous BEGIN was blocked on this database; retry deferred ${String(remaining)}ms`
+        );
+      }
+      deadlines?.delete(clock);
+    }
+  }
+  try {
+    database.exec(`BEGIN ${mode}`);
+  } catch (error) {
+    if (!isTransactionContention(error)) throw error;
+    const now = finiteNow(clock, "the transaction clock");
+    let deadlines = transactionThrottles.get(database);
+    if (deadlines === void 0) {
+      deadlines = /* @__PURE__ */ new WeakMap();
+      transactionThrottles.set(database, deadlines);
+    }
+    deadlines.set(clock, now + TRANSACTION_BUSY_BACKOFF_MS);
+    throw databaseError(
+      "runtime_transaction_busy",
+      "transaction",
+      `BEGIN ${mode} blocked by another transaction: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
   activeTransactions.add(database);
-  database.exec(`BEGIN ${mode}`);
+  if (mode !== "DEFERRED") transactionThrottles.get(database)?.delete(clock);
   try {
     const result = work();
     database.exec("COMMIT");
@@ -18998,7 +19062,14 @@ var KxmRunEventStore = class {
     `).get(projectId, coordinatorId, idempotencyKey);
     return row ? intakeFromRow(row) : void 0;
   }
-  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
+  /**
+   * Intake rows in the given dispatch states, in arrival order (replay-safe).
+   *
+   * `rowid` gives same-store arrival order, which is what queue priority needs
+   * here. It is **not** a durable sequence: this repository backs stores up with
+   * `VACUUM INTO`, and a vacuum may renumber implicit rowids. An explicit
+   * immutable arrival sequence is tracked in the plan's schema-v6 follow-ups.
+   */
   intakeInStates(projectId, states, limit = 100) {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");
@@ -30289,6 +30360,7 @@ export {
   SUBAGENT_TYPES,
   SteelClient,
   SubagentManager,
+  TRANSACTION_BUSY_BACKOFF_MS,
   VIEWPORT_PRESETS,
   WIN_NPM_INNER_EXE,
   acceptKxmRun,
@@ -30344,6 +30416,7 @@ export {
   hashKxmTokenProof,
   isKnownHarnessId,
   isKxmRuntimeContextClosed,
+  isTransactionContention,
   isWindowsHarnessShim,
   kxmDeclaredExecutorIds,
   kxmDeclaredRepositoryIds,

package/plugins/kxm/dist/server.js

@@ -11537,12 +11537,76 @@ function openDatabase(file, description, spec) {
   }
 }
 var activeTransactions = /* @__PURE__ */ new WeakSet();
-function withDatabaseTransaction(database, work, mode = "IMMEDIATE") {
+var TRANSACTION_BUSY_BACKOFF_MS = 1e3;
+function monotonicNowMs() {
+  return Number(process.hrtime.bigint() / 1000000n);
+}
+var transactionThrottles = /* @__PURE__ */ new WeakMap();
+function finiteNow(clock, label) {
+  const now = clock();
+  if (typeof now !== "number" || !Number.isFinite(now)) {
+    throw databaseError(
+      "runtime_transaction_clock_invalid",
+      "transaction",
+      `${label} must return a finite monotonic number; got ${String(now)}`
+    );
+  }
+  return now;
+}
+var CONTENTION_PRIMARY_CODES = [5, 6, 15];
+var CONTENTION_SYMBOLIC_NAMES = /^SQLITE_(?:BUSY|LOCKED|PROTOCOL)(?:_[A-Z0-9]+)?$/;
+var SQLITE_RESULT_NAMES = /^SQLITE_[A-Z][A-Z0-9_]*$/;
+var CONTENTION_MESSAGES = /^(?:database is locked|database table is locked|locking protocol|SQLITE_BUSY|SQLITE_LOCKED|SQLITE_PROTOCOL)(?:$|[\s.:])/i;
+function isTransactionContention(error) {
+  const carrier = error;
+  for (const value of [carrier?.errcode, carrier?.errCode, carrier?.errno]) {
+    if (typeof value === "number" && Number.isInteger(value)) return CONTENTION_PRIMARY_CODES.includes(value & 255);
+  }
+  for (const value of [carrier?.code, carrier?.name]) {
+    if (typeof value === "string" && SQLITE_RESULT_NAMES.test(value)) {
+      return CONTENTION_SYMBOLIC_NAMES.test(value);
+    }
+  }
+  return CONTENTION_MESSAGES.test(error instanceof Error ? error.message : String(error));
+}
+function withDatabaseTransaction(database, work, mode = "IMMEDIATE", clock = monotonicNowMs) {
   if (activeTransactions.has(database)) {
     throw databaseError("runtime_transaction_nested", "transaction", "nested transactions are not allowed");
   }
+  if (mode !== "DEFERRED") {
+    const deadlines = transactionThrottles.get(database);
+    const until = deadlines?.get(clock);
+    if (until !== void 0) {
+      const remaining = until - finiteNow(clock, "the transaction clock");
+      if (remaining > 0) {
+        throw databaseError(
+          "runtime_transaction_busy",
+          "transaction",
+          `a previous BEGIN was blocked on this database; retry deferred ${String(remaining)}ms`
+        );
+      }
+      deadlines?.delete(clock);
+    }
+  }
+  try {
+    database.exec(`BEGIN ${mode}`);
+  } catch (error) {
+    if (!isTransactionContention(error)) throw error;
+    const now = finiteNow(clock, "the transaction clock");
+    let deadlines = transactionThrottles.get(database);
+    if (deadlines === void 0) {
+      deadlines = /* @__PURE__ */ new WeakMap();
+      transactionThrottles.set(database, deadlines);
+    }
+    deadlines.set(clock, now + TRANSACTION_BUSY_BACKOFF_MS);
+    throw databaseError(
+      "runtime_transaction_busy",
+      "transaction",
+      `BEGIN ${mode} blocked by another transaction: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
   activeTransactions.add(database);
-  database.exec(`BEGIN ${mode}`);
+  if (mode !== "DEFERRED") transactionThrottles.get(database)?.delete(clock);
   try {
     const result = work();
     database.exec("COMMIT");

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.50",
+  "version": "0.7.51",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/database.ts

@@ -213,21 +213,226 @@ export function openDatabase(file: string, description: string, spec: DatabaseSc
 
 const activeTransactions = new WeakSet<DatabaseSync>();
 
+/**
+ * How long a connection refuses to retry a `BEGIN` that lost the write race.
+ *
+ * SQLite's busy timeout is per connection, so a `BEGIN` against a locked
+ * database waits the full timeout before failing. Callers that recover from a
+ * lost write open several transactions in a row; without this window each of
+ * them pays the timeout, and a suite run showed that turning one 4-second test
+ * into 17 minutes. The old code got that speed by accident — it left the
+ * connection permanently marked as in-transaction after a failed `BEGIN`, which
+ * is the defect fixed below — so the backoff replaces the fast-fail without
+ * re-introducing the poison.
+ *
+ * Two limits, both deliberate:
+ * - It is a **throttle, not a queue**. A caller whose lock cleared 1 ms later is
+ *   still refused for the rest of the window; the refusal is explicit
+ *   (`runtime_transaction_busy`, message says `retry deferred`) and bounded by
+ *   this constant. A retry after the window may pay the busy timeout again.
+ * - It is **per connection object, in this process**. It is not a cross-process
+ *   backoff and does not leak to another connection to the same file.
+ */
+export const TRANSACTION_BUSY_BACKOFF_MS = 1_000;
+
+/**
+ * Monotonic elapsed time, deliberately not `Date.now()`.
+ *
+ * A wall-clock step backwards would otherwise keep a long-gone write lock
+ * refusing transactions until real time caught up, and a step forward would end
+ * the throttle early. `hrtime.bigint()` is relative to an arbitrary past origin
+ * and never moves backwards, so the window is bounded by
+ * {@link TRANSACTION_BUSY_BACKOFF_MS} no matter what the system clock does.
+ *
+ * Injectable: production callers never pass it, and a test drives it directly so
+ * the window is stepped rather than raced or slept through.
+ */
+export type MonotonicClock = () => number;
+
+function monotonicNowMs(): number {
+  return Number(process.hrtime.bigint() / 1_000_000n);
+}
+
+/**
+ * Pending throttle per connection, **keyed by the clock that armed it**.
+ *
+ * The nesting is the fix, not tidiness. A deadline is a number from *some* clock,
+ * and the injectable `clock` exists only so a test can step the window; comparing
+ * a deadline armed by one clock against a reading taken from another is how an
+ * injected "one hour from now" throttles a production caller that never passed a
+ * clock at all — and how that same caller could clear a deadline it never armed.
+ * Each clock domain therefore gets its own deadline and can only read, expire or
+ * replace its own. The inner map is **weak in the clock**: it keeps no otherwise
+ * unreachable clock function alive, so an attempt that builds a fresh closure per
+ * call leaves nothing behind once that closure is collected. A clock that *is*
+ * retained keeps its entry until it expires or is replaced — collection is neither
+ * immediate nor size-bounded, and no committed test measures any of this, because no
+ * production caller passes a clock.
+ */
+const transactionThrottles = new WeakMap<DatabaseSync, WeakMap<MonotonicClock, number>>();
+
+/**
+ * A clock reading this helper can reason about.
+ *
+ * Scope, stated as measured rather than as a slogan. The clock is read at **two call
+ * sites**: checking an existing deadline on a non-`DEFERRED` attempt, and arming after a
+ * contended `BEGIN` failure. Reads per call, each reproduced by an assertion in
+ * `test/core/intake.test.ts`: clean success with no pending entry 0; successful
+ * `DEFERRED`, pending entry present or not, 0; fresh contention 1; refusal inside a window
+ * 1; an expired deadline followed by renewed contention 2 in that call; a permanent
+ * `BEGIN` failure with no pending entry 0; a nested-transaction rejection 0.
+ *
+ * Which means it is wrong in both directions to say either "every `BEGIN` validates the
+ * clock" or "the *only* transaction that skips it is a clean uncontended success" — the
+ * second was mine, twice, and the second correction to it was still a slogan. The tests
+ * count; the prose only points at them. Production cannot reach the guard at all, because
+ * the default is `hrtime`; it exists so the injectable seam cannot become a silent
+ * bypass.
+ */
+function finiteNow(clock: MonotonicClock, label: string): number {
+  const now = clock();
+  if (typeof now !== "number" || !Number.isFinite(now)) {
+    throw databaseError(
+      "runtime_transaction_clock_invalid",
+      "transaction",
+      `${label} must return a finite monotonic number; got ${String(now)}`,
+    );
+  }
+  return now;
+}
+
+/**
+ * Is this `BEGIN` failure contention for the write lock, as opposed to a
+ * programming or environment error?
+ *
+ * Only contention may be retried, and only contention earns the throttle window.
+ * Anything else — "cannot start a transaction within a transaction", a closed
+ * connection, a miscompiled statement — must surface unchanged, or a permanent
+ * bug looks like a transient one and the caller retries forever.
+ *
+ * SQLite's **numeric result code decides** where one exists, because it is stable
+ * across versions while message text is not: the primary code is `code & 0xff`, so
+ * extended forms land on their primaries — `SQLITE_BUSY_RECOVERY` (261) and
+ * `SQLITE_BUSY_SNAPSHOT` (517) on `SQLITE_BUSY` (5), `SQLITE_LOCKED_SHAREDCACHE`
+ * (262) on `SQLITE_LOCKED` (6). `SQLITE_PROTOCOL` (15) is included deliberately:
+ * SQLite raises it when repeated attempts to start a transaction under WAL exhaust
+ * the retry count, which is a lock-acquisition retry condition, not a broken
+ * database.
+ *
+ * Where both runtimes expose one, **the number wins over the text**: Node spells it
+ * `errcode`, `bun:sqlite` spells it `errno` (verified on Bun 1.3.14, where a shared-
+ * cache `BEGIN` arrives as `errno: 262`, `code: "SQLITE_LOCKED_SHAREDCACHE"`,
+ * message "database schema is locked: shared"). A symbolic `code`/`name` of the form
+ * `SQLITE_BUSY*`/`SQLITE_LOCKED*`/`SQLITE_PROTOCOL*` is accepted next, and bare
+ * message matching is the last resort — applied only when neither exists, so a
+ * wrapper that merely quotes "database is locked" alongside a permanent code is not
+ * mistaken for contention.
+ *
+ * Deliberately **not** contention: `SQLITE_FULL` / "database or disk is full",
+ * "unable to open database file", and WAL shared-memory I/O failures. Those stay
+ * broken until something outside this connection changes.
+ */
+/** Node: `errcode`. Bun: `errno`. Both spell the extended code as a number. */
+const CONTENTION_PRIMARY_CODES: readonly number[] = [5, 6, 15];
+/** `bun:sqlite` puts the symbolic name in `code`; Node puts its own kind there. */
+const CONTENTION_SYMBOLIC_NAMES = /^SQLITE_(?:BUSY|LOCKED|PROTOCOL)(?:_[A-Z0-9]+)?$/;
+/** Any SQLite result name. If one is present it decides, so text cannot argue. */
+const SQLITE_RESULT_NAMES = /^SQLITE_[A-Z][A-Z0-9_]*$/;
+const CONTENTION_MESSAGES =
+  /^(?:database is locked|database table is locked|locking protocol|SQLITE_BUSY|SQLITE_LOCKED|SQLITE_PROTOCOL)(?:$|[\s.:])/i;
+
+export function isTransactionContention(error: unknown): boolean {
+  const carrier = error as { errcode?: unknown; errCode?: unknown; errno?: unknown; code?: unknown; name?: unknown }
+    | undefined;
+  // A numeric code wins first, then a symbolic result name, and both win **over the
+  // message**: `errno` is what `bun:sqlite` exposes for the extended result code while
+  // its `code` field holds the symbolic name, and Node spells the number `errcode`.
+  // All three properties are read; what the list orders is which **integer value
+  // decides** — a present `errcode` outranks `errCode`, which outranks `errno`, and a
+  // later number is never consulted. Text is consulted only when the error carries
+  // neither a number nor a SQLite result name, so no wrapper quoting an older
+  // "database is locked" can outvote a code on either runtime.
+  for (const value of [carrier?.errcode, carrier?.errCode, carrier?.errno]) {
+    if (typeof value === "number" && Number.isInteger(value)) return CONTENTION_PRIMARY_CODES.includes(value & 0xff);
+  }
+  for (const value of [carrier?.code, carrier?.name]) {
+    // A result **name** is as authoritative as a number, and in both directions:
+    // `SQLITE_FULL` wearing a "database is locked" message is not contention. Node
+    // spells its own error kind `ERR_SQLITE_ERROR`, which is deliberately not a
+    // SQLite result name and so never reaches a verdict here.
+    if (typeof value === "string" && SQLITE_RESULT_NAMES.test(value)) {
+      return CONTENTION_SYMBOLIC_NAMES.test(value);
+    }
+  }
+  return CONTENTION_MESSAGES.test(error instanceof Error ? error.message : String(error));
+}
+
 export function withDatabaseTransaction<T>(
   database: DatabaseSync,
   work: () => T,
   mode: "IMMEDIATE" | "DEFERRED" | "EXCLUSIVE" = "IMMEDIATE",
+  clock: MonotonicClock = monotonicNowMs,
 ): T {
   if (activeTransactions.has(database)) {
     throw databaseError("runtime_transaction_nested", "transaction", "nested transactions are not allowed");
   }
+  // A DEFERRED BEGIN takes no write lock, so it is exempt from the *check*: refusing
+  // it would deny legitimate work over a contention it did not ask for. Exempt from
+  // the check only — shared-cache schema locks can still make a deferred `BEGIN`
+  // fail, and that failure arms a deadline like any other, because the next attempt
+  // would stall the same way.
+  if (mode !== "DEFERRED") {
+    const deadlines = transactionThrottles.get(database);
+    const until = deadlines?.get(clock);
+    if (until !== undefined) {
+      const remaining = until - finiteNow(clock, "the transaction clock");
+      if (remaining > 0) {
+        throw databaseError(
+          "runtime_transaction_busy",
+          "transaction",
+          `a previous BEGIN was blocked on this database; retry deferred ${String(remaining)}ms`,
+        );
+      }
+      deadlines?.delete(clock);
+    }
+  }
+  // Claim the marker only once BEGIN has succeeded. If BEGIN throws — another
+  // writer held the database past the busy timeout — a connection that never
+  // entered a transaction must not be left permanently marked as inside one,
+  // which would fail every later transaction on it with a misleading
+  // "nested" error. `finally` cannot cover this: it only runs after the try.
+  try {
+    database.exec(`BEGIN ${mode}`);
+  } catch (error) {
+    if (!isTransactionContention(error)) throw error;
+    const now = finiteNow(clock, "the transaction clock");
+    let deadlines = transactionThrottles.get(database);
+    if (deadlines === undefined) {
+      deadlines = new WeakMap<MonotonicClock, number>();
+      transactionThrottles.set(database, deadlines);
+    }
+    deadlines.set(clock, now + TRANSACTION_BUSY_BACKOFF_MS);
+    throw databaseError(
+      "runtime_transaction_busy",
+      "transaction",
+      `BEGIN ${mode} blocked by another transaction: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
   activeTransactions.add(database);
-  database.exec(`BEGIN ${mode}`);
+  // A successful write-mode BEGIN means this connection is holding the slot, so any
+  // earlier contention is over. A DEFERRED success proves nothing about the write
+  // lock and must not clear a throttle that another caller's contention armed.
+  if (mode !== "DEFERRED") transactionThrottles.get(database)?.delete(clock);
   try {
     const result = work();
     database.exec("COMMIT");
     return result;
   } catch (error) {
+    // A failed ROLLBACK usually means the connection is gone. Clearing the marker
+    // is bookkeeping, not proof: it does **not** show SQLite exited the
+    // transaction, and nothing here invalidates a handle whose rollback failed.
+    // Pre-existing, named rather than papered over — the caller receives the
+    // original error.
     try { database.exec("ROLLBACK"); } catch { /* ignore rollback error if connection dead */ }
     throw error;
   } finally {

package/plugins/kxm/src/intake.ts

@@ -98,7 +98,45 @@ const ACTOR_ID_RE = /^.{1,200}$/;
 
 /** Canonical SHA-256 over the authority ceiling — the coordinator's fingerprint. */
 export function kxmCeilingHash(authority: KxmCoordinatorAuthority): string {
-  return `sha256:${createHash("sha256").update(stableStringify(authority), "utf8").digest("hex")}`;
+  return `sha256:${createHash("sha256").update(stableStringify(normalizeAuthority(authority)), "utf8").digest("hex")}`;
+}
+
+/**
+ * Does an already-stored coordinator express this ceiling?
+ *
+ * A row written before set normalisation existed carries a fingerprint that
+ * `kxmCeilingHash` no longer reproduces, so comparing the stored hash alone is
+ * not enough: recompute over the authority it kept. Every path that asks this
+ * question — the initial slot lookup and **both** lost-write read-backs — must
+ * go through here, or an upgrade makes the same row equivalent on lookup and a
+ * `coordinator_write_lost` conflict on the race path.
+ *
+ * A legacy row is returned as stored, so its `ceilingHash` is historical: a
+ * caller must not assume every persisted hash uses today's algorithm.
+ */
+function ceilingsMatch(stored: KxmCoordinatorRecord, ceilingHash: string): boolean {
+  return stored.ceilingHash === ceilingHash || kxmCeilingHash(stored.authority) === ceilingHash;
+}
+
+function normalizeAuthority(authority: KxmCoordinatorAuthority): KxmCoordinatorAuthority {
+  const tools = authority.tools;
+  return {
+    repositoryAccess: authority.repositoryAccess,
+    effects: canonicalSet(authority.effects ?? []),
+    ...(tools !== undefined
+      ? {
+          tools: {
+            ...(tools.preset !== undefined ? { preset: tools.preset } : {}),
+            ...(tools.allow !== undefined ? { allow: canonicalSet(tools.allow) } : {}),
+            ...(tools.deny !== undefined ? { deny: canonicalSet(tools.deny) } : {}),
+          },
+        }
+      : {}),
+  };
+}
+
+function canonicalSet(values: readonly string[]): string[] {
+  return [...new Set(values)].sort();
 }
 
 /**
@@ -131,7 +169,7 @@ export function bindKxmCoordinator(
 
   if (existing) {
     const current = JSON.parse(existing.record) as KxmCoordinatorRecord;
-    if (current.ceilingHash === ceilingHash) {
+    if (ceilingsMatch(current, ceilingHash)) {
       return { coordinator: current, created: false };
     }
     if (!input.rebind) {
@@ -169,11 +207,11 @@ export function bindKxmCoordinator(
       record: kxmCanonicalJson(record as unknown as JsonValue),
     });
     if (!replaced) {
-      // Another process got the same policy through. Return its identity when it
-      // reached the ceiling we asked for; anything else is a real conflict.
+      // Another process reached the same ceiling first. Return its identity when it
+      // is the ceiling we asked for; anything else is a real conflict.
       const winner = context.eventStore.coordinatorInSlot(context.projectId, role, channel);
       const record2 = winner ? (JSON.parse(winner.record) as KxmCoordinatorRecord) : undefined;
-      if (record2 && record2.ceilingHash === ceilingHash) {
+      if (record2 && ceilingsMatch(record2, ceilingHash)) {
         return { coordinator: record2, created: false };
       }
       throw runtimeError("coordinator_write_lost", existing.coordinatorId, "the coordinator slot changed underneath this rebind");
@@ -196,7 +234,7 @@ export function bindKxmCoordinator(
     configRevision: context.configRevision,
     ceilingHash,
   };
-  return { ...persistCoordinator(context, record), created: true };
+  return persistCoordinator(context, record);
 }
 
 /** Resolve a coordinator by id; unknown identity fails closed. */
@@ -210,10 +248,15 @@ export function resolveKxmCoordinator(context: KxmRuntimeContext, coordinatorId:
  * Accept one internal message at the intake boundary.
  *
  * Duplicate ingress (same idempotency key, same content) returns the original
- * record and cannot create another task. The same key with **different** content
+ * record and cannot produce a second admission record. This layer deduplicates
+ * *intake and admission*; creating a task is the M2 consumer's job, so nothing here can
+ * promise anything about tasks. The same key with **different** content
  * is rejected: a reused key must not smuggle a different payload. Payloads
- * classified `secret` are never persisted — only their hash, so intake cannot
- * become a secret store. While the project is paused the message is durable with
+ * classified `secret` are never persisted — only their hash, so a caller that
+ * classifies honestly gets a store that will not hold that payload. The scope is
+ * exactly that: classification is caller-asserted, so this is a storage decision
+ * under a label, not secret detection, and intake is still not a place to keep
+ * credentials. While the project is paused the message is durable with
  * a held dispatch intent instead of being dropped.
  */
 export function acceptKxmIntakeMessage(
@@ -429,28 +472,45 @@ export function isKxmProjectPaused(context: KxmRuntimeContext): boolean {
   return context.eventStore.projectControl(context.projectId)?.paused === true;
 }
 
+/** How many held rows one drain page reads. Bounds a page, not the whole drain. */
+const INTAKE_DRAIN_PAGE_ROWS = 500;
+
 function releaseHeldIntake(context: KxmRuntimeContext, now: string): KxmIntakeMessage[] {
   const released: KxmIntakeMessage[] = [];
   // Drain every held row. A paging loop, not a single capped page: stranding the
   // 501st message behind a "resume releases held intent" claim is a lie of omission.
-  for (let page = 0; page < 1000; page += 1) {
-    const held = context.eventStore.intakeInStates(context.projectId, ["held_paused"], 500);
-    if (held.length === 0) break;
+  //
+  // What is still true after that fix: the loop holds one write transaction and
+  // retains every released message, so total work and memory grow with the held
+  // backlog even though each read is bounded. Measured on an in-memory store: 150k
+  // held rows with 64-byte payloads took 4.5 s synchronously and ~95 MiB of heap;
+  // 500k maximum-size payloads would retain ~7.6 GiB before any database overhead,
+  // and an allocation failure will not reliably arrive as `intake_drain_stalled`.
+  // Resume is finite because the write lock keeps ingress out of the loop, so this
+  // is a throughput and memory limit, not a correctness hole. Bounding it is a
+  // pre-condition of M2 sustained traffic, not of this contract — see "Still open".
+  for (;;) {
+    const held = context.eventStore.intakeInStates(context.projectId, ["held_paused"], INTAKE_DRAIN_PAGE_ROWS);
+    if (held.length === 0) return released;
+    let progressed = false;
     for (const row of held) {
       const message = JSON.parse(row.record) as KxmIntakeMessage;
       const next: KxmIntakeMessage = { ...message, dispatch: { state: "ready", updatedAt: now } };
       validateIntakeMessage(next, next.messageId);
       if (context.eventStore.updateIntakeDispatch(row.messageId, "held_paused", { state: "ready", record: kxmCanonicalJson(next as unknown as JsonValue) })) {
         released.push(next);
+        progressed = true;
       }
     }
-    const stillHeld = context.eventStore.intakeInStates(context.projectId, ["held_paused"], 1).length;
-    if (stillHeld === 0) break;
+    if (!progressed) {
+      // Cannot move anything: fail loudly inside the caller's transaction, which
+      // rolls the resume back, rather than half-resuming and leaving rows held.
+      throw runtimeError("intake_drain_stalled", context.projectId, `held intake did not drain; ${String(held.length)} row(s) still held`);
+    }
   }
-  return released;
 }
 
-function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRecord): { coordinator: KxmCoordinatorRecord } {
+function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRecord): { coordinator: KxmCoordinatorRecord; created: boolean } {
   validateCoordinator(record, record.coordinatorId);
   const inserted = context.eventStore.insertCoordinatorIfAbsent({
     coordinatorId: record.coordinatorId,
@@ -462,13 +522,13 @@ function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRe
     boundAt: record.boundAt,
     record: kxmCanonicalJson(record as unknown as JsonValue),
   });
-  if (inserted) return { coordinator: record };
+  if (inserted) return { coordinator: record, created: true };
   // Lost the race for an empty slot: binding is create-once, so the winner is the
   // answer whenever it reached the same ceiling. Only a different ceiling is a
-  // conflict worth reporting.
+  // conflict worth reporting. The loser must not report that it created anything.
   const winner = context.eventStore.coordinatorInSlot(record.projectId, record.role, record.channel);
   const won = winner ? (JSON.parse(winner.record) as KxmCoordinatorRecord) : undefined;
-  if (won && won.ceilingHash === record.ceilingHash) return { coordinator: won };
+  if (won && ceilingsMatch(won, record.ceilingHash)) return { coordinator: won, created: false };
   throw runtimeError("coordinator_write_lost", record.coordinatorId, "the coordinator slot was claimed by a different ceiling");
 }
 
@@ -502,6 +562,12 @@ function assertCeilingNotWidened(
     if (newlyAllowed.length > 0) {
       throw runtimeError("coordinator_rebind_widens_tools", coordinatorId, `a rebind may not allow new tools: ${newlyAllowed.join(", ")}`);
     }
+    // Tool evaluation applies no allowlist restriction when the list is empty or
+    // absent (`commands.ts` gates only on a non-empty allow list), so dropping a
+    // populated list is a widening even though every entry it named is gone.
+    if (allowedBefore.size > 0 && (nextTools.allow ?? []).length === 0) {
+      throw runtimeError("coordinator_rebind_clears_allowlist", coordinatorId, "a rebind may not drop or empty a populated allow list; an absent allow list imposes no restriction");
+    }
     const deniedBefore = new Set(previousTools.deny ?? []);
     const undenied = [...deniedBefore].filter((tool) => !(nextTools.deny ?? []).includes(tool));
     if (undenied.length > 0) {
@@ -540,24 +606,9 @@ function validateAuthority(authority: KxmCoordinatorAuthority): KxmCoordinatorAu
   }
   // Sets are stored canonically: order and repeats carry no authority, and leaving
   // them as supplied would let an equivalent ceiling masquerade as a rebind.
-  return {
-    repositoryAccess: authority.repositoryAccess,
-    effects: canonicalSet(effects),
-    ...(tools !== undefined
-      ? {
-          tools: {
-            ...(tools.preset !== undefined ? { preset: tools.preset } : {}),
-            ...(tools.allow !== undefined ? { allow: canonicalSet(tools.allow) } : {}),
-            ...(tools.deny !== undefined ? { deny: canonicalSet(tools.deny) } : {}),
-          },
-        }
-      : {}),
-  };
+  return normalizeAuthority(authority);
 }
 
-function canonicalSet(values: readonly string[]): string[] {
-  return [...new Set(values)].sort();
-}
 
 function validateActor<T extends { kind: KxmCoordinatorRecord["boundBy"]["kind"]; id: string }>(actor: T, field: string): T {
   const kinds: string[] = ["human", "runtime", "hub", "agent", "adapter"];

package/plugins/kxm/src/mcp-server.ts

@@ -8,7 +8,7 @@ import { AGENT_COMMANDS_MAP, enforceToolPolicy, getMcpTools, reconcileInbox } fr
 import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 
-const VERSION = "0.7.50";
+const VERSION = "0.7.51";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();
 let meshClient: HubClient | undefined;

package/plugins/kxm/src/runtime-store.ts

@@ -1255,7 +1255,14 @@ export class KxmRunEventStore {
     return row ? intakeFromRow(row) : undefined;
   }
 
-  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
+  /**
+   * Intake rows in the given dispatch states, in arrival order (replay-safe).
+   *
+   * `rowid` gives same-store arrival order, which is what queue priority needs
+   * here. It is **not** a durable sequence: this repository backs stores up with
+   * `VACUUM INTO`, and a vacuum may renumber implicit rowids. An explicit
+   * immutable arrival sequence is tracked in the plan's schema-v6 follow-ups.
+   */
   intakeInStates(projectId: string, states: readonly KxmIntakeMessageRow["dispatchState"][], limit = 100): KxmIntakeMessageRow[] {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");