@opengeni/db 0.6.0 → 0.7.0

package/drizzle/0058_turn_admission_usage_enrollment.sql

@@ -0,0 +1,158 @@
+-- One-way production remediation after the 0057 session-control cutover.
+--
+-- 1. Provider response usage has exactly one authoritative current event. SDK
+--    wrapper duplicates stay in the audit log with an explicit association.
+-- 2. Workflow repair enrolls every durable state that needs a session workflow,
+--    including approval/capacity waits and pending control settlement.
+
+ALTER TABLE "session_events"
+  DROP CONSTRAINT "session_events_turn_association_check";
+
+ALTER TABLE "session_events"
+  ADD COLUMN "duplicate_of_event_id" uuid,
+  ADD COLUMN "duplicate_reason" text;
+
+ALTER TABLE "session_events"
+  ADD CONSTRAINT "session_events_duplicate_of_event_fk"
+  FOREIGN KEY ("duplicate_of_event_id")
+  REFERENCES "session_events"("id") ON DELETE RESTRICT;
+
+ALTER TABLE "session_events"
+  ADD CONSTRAINT "session_events_turn_association_check"
+  CHECK (
+    "turn_association" IS NULL
+    OR "turn_association" IN ('current', 'late_rejected', 'duplicate')
+  );
+
+-- Keep the earliest event as the authoritative observation. Every later event
+-- for the same turn/provider-response source remains queryable and points to
+-- that canonical row; nothing is deleted or disguised as a late attempt write.
+WITH ranked AS (
+  SELECT
+    e."id",
+    first_value(e."id") OVER (
+      PARTITION BY
+        e."workspace_id",
+        e."session_id",
+        e."turn_id",
+        e."payload" ->> 'sourceKey'
+      ORDER BY e."sequence", e."id"
+    ) AS "canonical_id",
+    row_number() OVER (
+      PARTITION BY
+        e."workspace_id",
+        e."session_id",
+        e."turn_id",
+        e."payload" ->> 'sourceKey'
+      ORDER BY e."sequence", e."id"
+    ) AS "ordinal"
+  FROM "session_events" e
+  WHERE e."type" = 'agent.model.usage'
+    AND e."turn_association" = 'current'
+    AND e."turn_id" IS NOT NULL
+    AND nullif(e."payload" ->> 'sourceKey', '') IS NOT NULL
+)
+UPDATE "session_events" e
+SET "turn_association" = 'duplicate',
+    "duplicate_of_event_id" = ranked."canonical_id",
+    "duplicate_reason" = 'duplicate_provider_response_usage'
+FROM ranked
+WHERE e."id" = ranked."id"
+  AND ranked."ordinal" > 1;
+
+ALTER TABLE "session_events"
+  ADD CONSTRAINT "session_events_duplicate_classification_check"
+  CHECK (
+    (
+      "turn_association" = 'duplicate'
+      AND "type" = 'agent.model.usage'
+      AND "duplicate_of_event_id" IS NOT NULL
+      AND "duplicate_of_event_id" <> "id"
+      AND nullif("duplicate_reason", '') IS NOT NULL
+    )
+    OR (
+      "turn_association" IS DISTINCT FROM 'duplicate'
+      AND "duplicate_of_event_id" IS NULL
+      AND "duplicate_reason" IS NULL
+    )
+  );
+
+CREATE UNIQUE INDEX "session_events_current_model_usage_source_uq"
+  ON "session_events" (
+    "workspace_id",
+    "session_id",
+    "turn_id",
+    (("payload" ->> 'sourceKey'))
+  )
+  WHERE "type" = 'agent.model.usage'
+    AND "turn_association" = 'current'
+    AND "turn_id" IS NOT NULL
+    AND nullif("payload" ->> 'sourceKey', '') IS NOT NULL;
+
+-- The old name described database claimability, not the actual operational
+-- contract. A workflow must also be enrolled while it waits for approval or
+-- capacity, and any pending Pause/Steer control needs a workflow to settle it.
+DROP FUNCTION opengeni_private.list_claimable_sessions(integer);
+
+CREATE FUNCTION opengeni_private.list_enrollable_sessions(p_limit integer)
+RETURNS TABLE (
+  account_id uuid,
+  workspace_id uuid,
+  session_id uuid,
+  temporal_workflow_id text
+)
+LANGUAGE sql
+SECURITY DEFINER
+AS $$
+  SELECT DISTINCT
+    s.account_id,
+    s.workspace_id,
+    s.id,
+    coalesce(s.temporal_workflow_id, 'session-' || s.id::text)
+  FROM sessions s
+  JOIN workspaces w ON w.id = s.workspace_id
+  WHERE
+    -- Controls are durable intent. Even a closed inference gate must enroll a
+    -- workflow long enough to settle the pending Pause/Steer fence.
+    s.pending_control_event_id IS NOT NULL
+    OR (
+      s.control_state = 'active'
+      AND (
+        w.inference_state = 'active'
+        OR s.workspace_run_exception_generation = w.inference_generation
+      )
+      AND (
+        EXISTS (
+          SELECT 1 FROM session_turns t
+          WHERE t.workspace_id = s.workspace_id
+            AND t.session_id = s.id
+            AND t.status IN ('queued', 'recovering', 'waiting_capacity', 'requires_action')
+        )
+        OR EXISTS (
+          SELECT 1 FROM session_system_updates u
+          WHERE u.workspace_id = s.workspace_id
+            AND u.session_id = s.id
+            AND u.state = 'pending'
+        )
+        OR EXISTS (
+          SELECT 1 FROM session_goals g
+          WHERE g.workspace_id = s.workspace_id
+            AND g.session_id = s.id
+            AND g.status = 'active'
+        )
+      )
+    )
+  ORDER BY s.id
+  LIMIT greatest(1, least(coalesce(p_limit, 1000), 10000));
+$$;
+
+REVOKE ALL ON FUNCTION opengeni_private.list_enrollable_sessions(integer) FROM PUBLIC;
+
+DO $$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.list_enrollable_sessions(integer)
+      TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0059_workspace_pause_control_kind.sql

@@ -0,0 +1,12 @@
+-- Workspace Pause is a first-class durable control kind. The 0057 constraint
+-- predates that control path and must match the canonical runtime state machine.
+
+ALTER TABLE "sessions"
+  DROP CONSTRAINT "sessions_pending_control_kind_check";
+
+ALTER TABLE "sessions"
+  ADD CONSTRAINT "sessions_pending_control_kind_check"
+  CHECK (
+    "pending_control_kind" IS NULL
+    OR "pending_control_kind" IN ('pause', 'workspace_pause', 'steer')
+  );

package/drizzle/0060_session_system_update_deferral.sql

@@ -0,0 +1,10 @@
+-- A failed internal-only inference preserves ordinary internal updates without
+-- making them independently runnable again. They become eligible when a real
+-- prompt or a genuinely new pending internal update starts the next inference.
+
+ALTER TABLE "session_system_updates"
+  DROP CONSTRAINT "system_updates_state_check";
+
+ALTER TABLE "session_system_updates"
+  ADD CONSTRAINT "system_updates_state_check"
+  CHECK ("state" IN ('pending', 'deferred', 'delivered', 'cancelled', 'failed'));

package/drizzle/0061_session_workflow_wake_outbox.sql

@@ -0,0 +1,157 @@
+-- OPE-50: replace the blind periodic scan of "enrollable" sessions with a
+-- transactional, revisioned, coalescing delivery ledger. Postgres is the
+-- durable work source; a Temporal signal is an idempotent nudge.
+
+CREATE TABLE "session_workflow_wake_outbox" (
+  "session_id" uuid PRIMARY KEY,
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "temporal_workflow_id" text NOT NULL,
+  "wake_revision" bigint NOT NULL DEFAULT 1,
+  "delivered_revision" bigint NOT NULL DEFAULT 0,
+  "reason" text NOT NULL,
+  "attempts" integer NOT NULL DEFAULT 0,
+  "next_attempt_at" timestamptz NOT NULL DEFAULT now(),
+  "last_error" text,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "session_workflow_wake_outbox_revision_check"
+    CHECK ("wake_revision" > 0 AND "delivered_revision" >= 0
+      AND "delivered_revision" <= "wake_revision"),
+  CONSTRAINT "session_workflow_wake_outbox_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "session_workflow_wake_outbox_workspace_session_fk"
+    FOREIGN KEY ("workspace_id", "session_id")
+    REFERENCES "sessions"("workspace_id", "id") ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX "session_workflow_wake_outbox_workspace_session_uq"
+  ON "session_workflow_wake_outbox" ("workspace_id", "session_id");
+CREATE INDEX "session_workflow_wake_outbox_pending_idx"
+  ON "session_workflow_wake_outbox" ("next_attempt_at", "updated_at", "session_id")
+  WHERE "wake_revision" > "delivered_revision";
+
+ALTER TABLE "session_workflow_wake_outbox" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "session_workflow_wake_outbox" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "session_workflow_wake_outbox"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- Workspace control retries now persist the exact control deliveries they own.
+-- Canonicalize pre-cutover receipts once so runtime code has one result shape;
+-- any still-pending historical control is independently seeded below.
+UPDATE "runtime_control_operations"
+SET "result" = jsonb_set("result", '{controls}', '[]'::jsonb, true)
+WHERE "scope" = 'workspace'
+  AND jsonb_typeof("result") = 'object'
+  AND NOT ("result" ? 'controls');
+
+-- Claim only committed revisions that still need delivery. The due timestamp
+-- is advanced before delivery, so a process death becomes retryable after the
+-- bounded backoff. Acknowledgements are revision-scoped: an old delivery can
+-- never hide a newer committed wake.
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE FUNCTION opengeni_private.claim_session_workflow_wakes(p_limit integer)
+    RETURNS TABLE (
+      account_id uuid,
+      workspace_id uuid,
+      session_id uuid,
+      temporal_workflow_id text,
+      wake_revision bigint,
+      control_event_id uuid
+    )
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      RETURN QUERY
+        WITH due AS (
+          SELECT o.session_id
+          FROM %1$I.session_workflow_wake_outbox o
+          WHERE o.wake_revision > o.delivered_revision
+            AND o.next_attempt_at <= now()
+          ORDER BY o.next_attempt_at, o.updated_at, o.session_id
+          FOR UPDATE SKIP LOCKED
+          LIMIT greatest(1, least(coalesce(p_limit, 100), 1000))
+        )
+        UPDATE %1$I.session_workflow_wake_outbox o
+        SET attempts = o.attempts + 1,
+            next_attempt_at = now() + make_interval(
+              secs => least(300, greatest(1, power(2, least(o.attempts, 8))::integer))
+            ),
+            updated_at = now()
+        FROM due
+        WHERE o.session_id = due.session_id
+        RETURNING o.account_id, o.workspace_id, o.session_id,
+          o.temporal_workflow_id, o.wake_revision,
+          (SELECT s.pending_control_event_id FROM %1$I.sessions s WHERE s.id = o.session_id)
+            AS control_event_id;
+    END $function$;
+  $create$, target_schema);
+END $migration$;
+REVOKE ALL ON FUNCTION opengeni_private.claim_session_workflow_wakes(integer) FROM PUBLIC;
+
+-- One-time cutover seed. This is intentionally the final use of an eligibility
+-- scan: it converts already-committed pre-outbox work into explicit revisions.
+-- Runtime repair after this migration reads only the outbox.
+INSERT INTO "session_workflow_wake_outbox" (
+  "session_id", "account_id", "workspace_id", "temporal_workflow_id", "reason"
+)
+SELECT DISTINCT
+  s."id",
+  s."account_id",
+  s."workspace_id",
+  coalesce(s."temporal_workflow_id", 'session-' || s."id"::text),
+  'cutover_seed'
+FROM "sessions" s
+JOIN "workspaces" w ON w."id" = s."workspace_id"
+WHERE
+  s."pending_control_event_id" IS NOT NULL
+  OR (
+    s."control_state" = 'active'
+    AND (
+      w."inference_state" = 'active'
+      OR s."workspace_run_exception_generation" = w."inference_generation"
+    )
+    AND (
+      EXISTS (
+        SELECT 1 FROM "session_turns" t
+        WHERE t."workspace_id" = s."workspace_id"
+          AND t."session_id" = s."id"
+          AND t."status" IN ('queued', 'recovering', 'waiting_capacity', 'requires_action')
+      )
+      OR EXISTS (
+        SELECT 1 FROM "session_system_updates" u
+        WHERE u."workspace_id" = s."workspace_id"
+          AND u."session_id" = s."id"
+          AND u."state" = 'pending'
+      )
+      OR EXISTS (
+        SELECT 1 FROM "session_goals" g
+        WHERE g."workspace_id" = s."workspace_id"
+          AND g."session_id" = s."id"
+          AND g."status" = 'active'
+      )
+      OR s."compact_requested" = true
+    )
+  );
+
+DROP FUNCTION opengeni_private.list_enrollable_sessions(integer);
+
+DO $$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.session_workflow_wake_outbox TO opengeni_app',
+      target_schema
+    );
+    GRANT EXECUTE ON FUNCTION opengeni_private.claim_session_workflow_wakes(integer)
+      TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0062_session_list_snapshot_reaper.sql

@@ -0,0 +1,48 @@
+-- OPE-44: session list reads are serializable and subject-scoped. Performing a
+-- global expired-row delete inside every read makes concurrent API replicas
+-- conflict on the same rows. Move TTL cleanup to one bounded SKIP LOCKED
+-- reaper operation and keep the request transaction strictly request-local.
+
+CREATE INDEX "session_list_snapshots_expiry_reaper_idx"
+  ON "session_list_snapshots" ("expires_at", "id");
+
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE FUNCTION opengeni_private.reap_expired_session_list_snapshots(p_limit integer)
+    RETURNS integer
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE deleted_count integer;
+    BEGIN
+      WITH victims AS (
+        SELECT s.id
+        FROM %1$I.session_list_snapshots s
+        WHERE s.expires_at < now()
+        ORDER BY s.expires_at, s.id
+        FOR UPDATE SKIP LOCKED
+        LIMIT greatest(1, least(coalesce(p_limit, 500), 5000))
+      ), deleted AS (
+        DELETE FROM %1$I.session_list_snapshots s
+        USING victims
+        WHERE s.id = victims.id
+        RETURNING s.id
+      )
+      SELECT count(*)::integer INTO deleted_count FROM deleted;
+      RETURN deleted_count;
+    END $function$;
+  $create$, target_schema);
+END $migration$;
+
+REVOKE ALL ON FUNCTION opengeni_private.reap_expired_session_list_snapshots(integer) FROM PUBLIC;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.reap_expired_session_list_snapshots(integer)
+      TO opengeni_app;
+  END IF;
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -8,6 +8,11 @@
     "url": "git+https://github.com/Cloudgeni-ai/opengeni.git",
     "directory": "packages/db"
   },
+  "files": [
+    "dist",
+    "src",
+    "drizzle"
+  ],
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -26,19 +31,15 @@
       "types": "./dist/migrate.d.ts",
       "import": "./dist/migrate.js"
     },
+    "./session-control-cutover-audit": {
+      "types": "./dist/session-control-cutover-audit.d.ts",
+      "import": "./dist/session-control-cutover-audit.js"
+    },
     "./provision-roles": {
       "types": "./dist/provision-roles.d.ts",
       "import": "./dist/provision-roles.js"
     }
   },
-  "files": [
-    "dist",
-    "src",
-    "drizzle"
-  ],
-  "engines": {
-    "node": ">=18"
-  },
   "publishConfig": {
     "access": "public",
     "provenance": true
@@ -47,15 +48,18 @@
     "generate": "drizzle-kit generate",
     "migrate": "bun src/migrate.ts",
     "provision-roles": "bun src/provision-roles.ts",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsgo --noEmit",
     "build": "tsup",
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codex": "^0.2.1",
-    "@opengeni/config": "^0.3.0",
-    "@opengeni/contracts": "^0.9.0",
+    "@opengeni/codex": "^0.2.2",
+    "@opengeni/config": "^0.5.0",
+    "@opengeni/contracts": "^0.10.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
+  },
+  "engines": {
+    "node": ">=18"
   }
 }

package/src/codex-token-resolver.ts

@@ -12,14 +12,10 @@
 // refresh helpers and the @opengeni/config key — keeping the refresh-CAS + RLS
 // invariants co-located with the rows they protect.
 //
-// CROSS-PROCESS SAFETY is preserved unchanged: the single-flight `inflight` map is
-// process-module-scoped, so worker and api each get their own — that is CORRECT
-// (each process coalesces its own concurrent refreshes). The real cross-process
-// guard is the (id, version) CAS inside recordCodexTokenRefresh: if the api
-// refreshes a token while a worker turn refreshes the same account, the loser's
-// CAS writes 0 rows (stale version) and it re-reads the winner's token, so the
-// one-time refresh token is never double-spent. RLS is untouched (every accessor
-// wraps withWorkspaceRls internally).
+// CROSS-PROCESS SAFETY: the process-module `inflight` map coalesces local callers,
+// while a Postgres advisory transaction lock serializes API/worker replicas. A
+// waiter re-reads after taking that lock and skips refresh when the version moved.
+// The existing (id,version) CAS remains the final stale-family write fence.
 
 import { environmentsEncryptionKeyBytes, type Settings } from "@opengeni/config";
 import {
@@ -40,6 +36,7 @@ import {
   recordCodexAccountUsage,
   recordCodexTokenRefresh,
   setCodexCredentialStatus,
+  withCodexCredentialRefreshLock,
   type CodexCredentialForRun,
   type Database,
 } from "./index";
@@ -63,6 +60,7 @@ export type CodexAuthDeps = {
   refresh: typeof refreshCodexToken;
   encrypt: typeof encryptEnvironmentValue;
   keyBytes: typeof environmentsEncryptionKeyBytes;
+  withRefreshLock: typeof withCodexCredentialRefreshLock;
 };
 
 const defaultDeps: CodexAuthDeps = {
@@ -72,6 +70,7 @@ const defaultDeps: CodexAuthDeps = {
   refresh: refreshCodexToken,
   encrypt: encryptEnvironmentValue,
   keyBytes: environmentsEncryptionKeyBytes,
+  withRefreshLock: withCodexCredentialRefreshLock,
 };
 
 export function buildCodexTokenResolver(
@@ -92,7 +91,10 @@ export function buildCodexTokenResolver(
     isFedramp: cred.isFedramp,
   });
 
-  const performRefresh = async (cred: CodexCredentialForRun): Promise<CodexTokenSnapshot> => {
+  const performRefresh = async (
+    refreshDb: Database,
+    cred: CodexCredentialForRun,
+  ): Promise<CodexTokenSnapshot> => {
     try {
       const next = await deps.refresh(cred.tokens.refreshToken);
       const tokens = {
@@ -107,7 +109,7 @@ export function buildCodexTokenResolver(
       // Compare-and-set on the loaded (id, version): if a disconnect→reconnect
       // replaced the row mid-refresh, this writes 0 rows and we must NOT clobber
       // the new credential with our now-defunct rotated tokens.
-      const persisted = await deps.recordRefresh(db, {
+      const persisted = await deps.recordRefresh(refreshDb, {
         id: cred.id,
         version: cred.version,
         workspaceId,
@@ -119,40 +121,73 @@ export function buildCodexTokenResolver(
         // The row changed under us. Our rotated tokens belong to a stale family;
         // fall back to whatever is connected NOW (a reconnect leaves an active
         // row). If nothing active remains, a relogin is genuinely required.
-        const current = await deps.loadCredential(db, settings, workspaceId, credentialId);
+        const current = await deps.loadCredential(refreshDb, settings, workspaceId, credentialId);
         if (current && current.status === "active") {
           return snapshot(current);
         }
-        throw new CodexReloginRequired("Codex credential changed during token refresh; reconnect required.");
+        throw new CodexReloginRequired(
+          "Codex credential changed during token refresh; reconnect required.",
+        );
       }
-      return { accessToken: tokens.access_token, chatgptAccountId: cred.chatgptAccountId, isFedramp: cred.isFedramp };
+      return {
+        accessToken: tokens.access_token,
+        chatgptAccountId: cred.chatgptAccountId,
+        isFedramp: cred.isFedramp,
+      };
     } catch (error) {
       if (error instanceof CodexReloginRequired) {
         // Stamp needs_relogin ONLY if the row we refreshed is STILL current
         // (compare-and-set on the loaded id+version). A relogin triggered by the
         // OLD token family must never stamp needs_relogin onto a freshly
         // reconnected credential.
-        await deps.setStatus(db, workspaceId, "needs_relogin", error.message, { id: cred.id, version: cred.version });
+        await deps.setStatus(refreshDb, workspaceId, "needs_relogin", error.message, {
+          id: cred.id,
+          version: cred.version,
+        });
       }
       throw error;
     }
   };
 
-  // ALL refreshes — whether triggered by proactive staleness (getToken) or by a
-  // 401 retry (refresh) — coalesce onto one in-flight promise per credential
-  // instance, so concurrent calls can never double-spend the one-time refresh
-  // token (which would trigger refresh_token_reused -> needs_relogin).
+  // ALL refreshes — whether proactive or a 401 retry — coalesce locally and then
+  // serialize globally before any rotating refresh token reaches the provider.
   const doRefresh = (cred: CodexCredentialForRun): Promise<CodexTokenSnapshot> => {
     const key = `${cred.id}:${cred.version}`;
     const existing = inflight.get(key);
     if (existing) {
       return existing;
     }
-    const promise = performRefresh(cred).finally(() => {
-      if (inflight.get(key) === promise) {
-        inflight.delete(key);
-      }
-    });
+    const promise = deps
+      .withRefreshLock(db, workspaceId, credentialId, async (lockedDb) => {
+        try {
+          const current = await deps.loadCredential(lockedDb, settings, workspaceId, credentialId);
+          if (!current || current.status !== "active") {
+            throw new CodexReloginRequired(
+              "Codex credential became unavailable while waiting to refresh.",
+            );
+          }
+          if (current.version !== cred.version) {
+            return { ok: true as const, value: snapshot(current) };
+          }
+          return { ok: true as const, value: await performRefresh(lockedDb, current) };
+        } catch (error) {
+          // withCodexCredentialRefreshLock uses an advisory TRANSACTION lock.
+          // performRefresh may persist `needs_relogin` before surfacing a
+          // permanent OAuth failure; throwing from this callback would roll that
+          // status write back with the outer transaction. Return the failure so
+          // the transaction commits, then rethrow after the lock is released.
+          return { ok: false as const, error };
+        }
+      })
+      .then((outcome) => {
+        if (!outcome.ok) throw outcome.error;
+        return outcome.value;
+      })
+      .finally(() => {
+        if (inflight.get(key) === promise) {
+          inflight.delete(key);
+        }
+      });
     inflight.set(key, promise);
     return promise;
   };