@ricsam/r5d-worker 0.0.122 → 0.0.124

package/dist/mjs/main.mjs

@@ -4,7 +4,9 @@ import { getWorkerPlanPath, getWorkerPlansPath, validatePlanId } from "./plan-pa
 import { createPlanMarkdown, updateTaskCheckbox } from "./plan-parser.mjs";
 import { lintPlans, formatPlanLintErrors } from "./plan-lint.mjs";
 import fs from "node:fs";
-import { WorkerRecoveryStore, workerOperationDigest } from "./recovery-store.mjs";
+import { WorkerRecoveryJournal, WorkerRecoveryJournalBusyError } from "./recovery-journal.mjs";
+import { SessionFileMutationTracker } from "./session-file-mutations.mjs";
+import { workerOperationDigest } from "./recovery-store.mjs";
 import { WorkerOutputWindow } from "./recovery-output-window.mjs";
 import {
   createWorkerCommandLauncher,
@@ -26,6 +28,12 @@ import { installCliUpdate, readInstalledCliVersion } from "./cli-update.mjs";
 import { gitTransportSecurityArgs, workerGitProcessEnvironment } from "./git-process-environment.mjs";
 import { terminateProcessTree } from "./process-tree.mjs";
 import { ProjectCheckoutGarbageCollector } from "./project-checkout-garbage.mjs";
+import {
+  assertControlCommandArgv,
+  CONTROL_COMMAND_RUNTIME_MS,
+  controlCommandEnvironment,
+  resolveControlCommandExecutable
+} from "./control-command-policy.mjs";
 import { createPtyOutputCoalescer } from "./pty-output-coalescer.mjs";
 import { openWorkerPortForwardRelay } from "./port-forward-client.mjs";
 import {
@@ -52,9 +60,11 @@ import {
   runWorkspaceCommand
 } from "./workspace-command-sync-policy.mjs";
 import { WorkspaceMutationGate } from "./workspace-mutation-gate.mjs";
+import { WorkspaceMountHoldAbortedError, WorkspaceMountHoldFence } from "./workspace-mount-hold-fence.mjs";
+import { installWorkspaceFilesystemExecutorFailureHandler, workspaceFilesystemExecutor } from "./workspace-filesystem-executor.mjs";
 import { WorkspaceProjectionLedger } from "./workspace-projection-ledger.mjs";
 import { WorkspaceSyncCoalescer } from "./workspace-sync-coalescer.mjs";
-import { checkoutPathMovePublicationComplete, preserveProjectCheckoutPathMove } from "./workspace-path-move.mjs";
+import { checkoutPathMovePublicationComplete } from "./workspace-path-move.mjs";
 import { busyProjectConfigurationChangeIds, deferredProjectConfigurationPendingBranches } from "./workspace-project-config-policy.mjs";
 import { creatorLocalProjectBranchIsAuthorized, workerProjectBranchDisposition } from "./workspace-preserve-only-policy.mjs";
 import { assertProjectBranchDeletionIncarnation } from "./workspace-branch-incarnation-policy.mjs";
@@ -84,6 +94,7 @@ import {
   deleteProjectMirrorBranch,
   ensureProjectWorktrees,
   inventoryProjectCheckouts,
+  PROJECT_WORKTREE_SNAPSHOT_OWNER_SESSION_ID,
   observeProjectMirrorHeads,
   projectBranchMayExistAfterCreateFailure,
   projectOriginBranchName,
@@ -96,11 +107,6 @@ import {
   parseProjectMirrorRefsTokensMessage,
   planProjectMirrorObservationFetch
 } from "./project-mirror-fetch-policy.mjs";
-import {
-  PROJECT_SNAPSHOT_RECOVERY_HELPER_COMMAND,
-  recoverProjectSnapshotsInChild,
-  runProjectSnapshotRecoveryHelper
-} from "./project-snapshot-recovery-runner.mjs";
 import {
   ProjectWorkspacePendingBranchPathChangeError,
   ProjectWorkspaceStateStore,
@@ -129,7 +135,7 @@ function workerServerHeartbeatAction(input) {
   return input.probeElapsedMs >= input.timeoutMs ? "terminate" : "wait";
 }
 const WORKSPACE_HYDRATION_LEASE_OPERATION_PREFIX = "hydration:";
-function createWorkspaceHydrationLeaseHooks(send, options = {}) {
+function createWorkspaceHydrationLeaseHooks(send, options) {
   const yieldToEventLoop = options.yieldToEventLoop ?? (() => new Promise((resolve) => setImmediate(resolve)));
   const log = options.log ?? ((line) => process.stdout.write(`${line}
 `));
@@ -150,13 +156,17 @@ function createWorkspaceHydrationLeaseHooks(send, options = {}) {
       log(
         `[r5d-worker] released hydration lease ${context.transactionId} after ${startedAt === void 0 ? "?" : Math.round(now() - startedAt)}ms`
       );
+    },
+    holdMounts(mountIds, description) {
+      return options.fence.hold(mountIds, description);
     }
   };
 }
 const workerLifecycleTestHarness = {
   boundedWorkerLifecycleProgress,
   workerServerHeartbeatAction,
-  createWorkspaceHydrationLeaseHooks
+  createWorkspaceHydrationLeaseHooks,
+  workerCommandHasWorkspaceEffect
 };
 class ProjectWorkspaceConfigurationDeferredError extends Error {
 }
@@ -177,6 +187,26 @@ const PTY_FOREGROUND_POLL_MS = 1e3;
 const PTY_FOREGROUND_IDLE_ENABLED = process.env.R5D_PTY_FOREGROUND_IDLE !== "0";
 const PTY_TMP_PATH_PREFIX = "r5d-worker-tmp://";
 let workerCommandLauncher;
+const trustedControlPath = process.env.PATH;
+let capacityReportTimer;
+let capacityReportSocket = null;
+let lastCapacityReport;
+function scheduleCapacityReport(force = false) {
+  if (force) lastCapacityReport = void 0;
+  if (capacityReportTimer) return;
+  capacityReportTimer = setTimeout(() => {
+    capacityReportTimer = void 0;
+    const ws = capacityReportSocket;
+    if (!ws || ws.readyState !== WebSocket.OPEN || !workerCommandLauncher) return;
+    const capacity = { ...workerCommandLauncher.capacityReport(), reportedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    const { reportedAt: _reportedAt, ...comparable } = capacity;
+    const serialized = JSON.stringify(comparable);
+    if (serialized === lastCapacityReport) return;
+    lastCapacityReport = serialized;
+    sendWorkerMessage(ws, { type: "capacity_report", capacity });
+  }, 100);
+  capacityReportTimer.unref?.();
+}
 const activeProcesses = /* @__PURE__ */ new Map();
 const credentialBearingProcessGroups = /* @__PURE__ */ new Map();
 const credentialBearingProcessGroupTargets = /* @__PURE__ */ new Map();
@@ -189,7 +219,7 @@ const workspaceSyncPriorityPtyTargets = /* @__PURE__ */ new Map();
 let currentWorkerSocket = null;
 const workerRuntimeId = crypto.randomUUID();
 const workerOutputWindow = new WorkerOutputWindow();
-let recoveryStore;
+let recoveryJournal;
 let workerReconnectAttempt = 0;
 let workerRecoveryId;
 let workerExecutionLeaseDeadline = 0;
@@ -201,13 +231,13 @@ let runtimeExitPromise;
 function fenceWorkerRuntimeOperations() {
   launcherFailureInProgress = true;
   workerAdmissionGeneration += 1;
-  for (const operation of recoveryStore?.operations() ?? []) {
-    if (operation.state !== "completed") recoveryStore?.unknown(operation.requestId);
+  for (const operation of recoveryJournal?.activeAndPendingOperations() ?? []) {
+    if (operation.state !== "completed") recoveryJournal?.unknown(operation.requestId);
   }
   for (const runId of workerCommandLauncher?.activeIds ?? []) {
     infrastructureStoppedRunIds.add(runId);
     cancelledProcessRuns.add(runId);
-    recoveryStore?.unknownRun(runId);
+    recoveryJournal?.unknownRun(runId);
   }
   for (const runId of activeProcesses.keys()) infrastructureStoppedRunIds.add(runId);
 }
@@ -216,13 +246,21 @@ function exitWorkerRuntime(code) {
   fenceWorkerRuntimeOperations();
   runtimeExitPromise = (async () => {
     await Promise.race([
-      Promise.allSettled([terminateActiveCredentialBearingChildren(), workerCommandLauncher?.close()]),
+      Promise.allSettled([terminateActiveCredentialBearingChildren(), workerCommandLauncher?.close(), recoveryJournal?.flush()]),
       Bun.sleep(4e3)
     ]);
     process.exit(code);
   })();
   return runtimeExitPromise;
 }
+function handleRecoveryJournalFailure(error) {
+  if (launcherFailureInProgress) return;
+  fenceWorkerRuntimeOperations();
+  process.stderr.write(`[r5d-worker] ${error.message}; stopping runtime for recovery journal restart
+`);
+  currentWorkerSocket?.close(1012, "Recovery journal failure");
+  void exitWorkerRuntime(WORKER_RECONNECT_EXIT_CODE);
+}
 function handleWorkerCommandLauncherFailure(error) {
   if (!workerCommandLauncher || launcherFailureInProgress) return;
   fenceWorkerRuntimeOperations();
@@ -243,7 +281,7 @@ async function retryWorkerServerRead(read) {
     try {
       return await read();
     } catch (error) {
-      if (!recoveryStore || !isWorkerCommunicationFailure(error instanceof Error ? error.message : String(error))) throw error;
+      if (!recoveryJournal || !isWorkerCommunicationFailure(error instanceof Error ? error.message : String(error))) throw error;
       deadline ??= Date.now() + WORKER_RECOVERY_TIMEOUT_MS;
       if (workerLeaseExpired || Date.now() >= deadline) throw new WorkerServerUnavailableError("Worker communication recovery expired");
       currentWorkerSocket?.close(1012, "Communication recovery");
@@ -265,9 +303,10 @@ function renewWorkerExecutionLease(leaseMs) {
 `);
       });
       closeAllPtys();
-      for (const operation of recoveryStore?.operations() ?? []) {
+      for (const operation of recoveryJournal?.activeAndPendingOperations() ?? []) {
         if (operation.sessionId && operation.state !== "completed") {
-          recoveryStore?.cancelSession(operation.sessionId);
+          void recoveryJournal?.cancelSession(operation.sessionId);
+          abortPendingReservations("Execution lease expired before command start", operation.sessionId);
           void workerCommandLauncher?.cancelSession(operation.sessionId).catch((error) => {
             process.stderr.write(`[r5d-worker] expired command launcher cancellation failed: ${error}
 `);
@@ -277,7 +316,7 @@ function renewWorkerExecutionLease(leaseMs) {
       for (const [runId, active] of activeProcesses) {
         if (!active.sessionId) continue;
         infrastructureStoppedRunIds.add(runId);
-        recoveryStore?.unknownRun(runId);
+        recoveryJournal?.unknownRun(runId);
         cancelledProcessRuns.add(runId);
         closeProcessStdin(active);
         void terminateProcessTree(active.process).catch(
@@ -292,6 +331,31 @@ function renewWorkerExecutionLease(leaseMs) {
 }
 let workerAdmissionGeneration = 0;
 const workspaceMutationGate = new WorkspaceMutationGate();
+const workspaceMountHoldFence = new WorkspaceMountHoldFence();
+const projectMountId = (projectId, branchName) => `project:${projectId}:${encodeURIComponent(branchName)}`;
+const pendingReservationAborts = /* @__PURE__ */ new Map();
+const sessionFileMutations = new SessionFileMutationTracker();
+function registerPendingReservation(key, sessionId) {
+  abortPendingReservation(key, "Reservation superseded by a newer request with the same id");
+  const controller = new AbortController();
+  pendingReservationAborts.set(key, { controller, sessionId });
+  return controller;
+}
+function unregisterPendingReservation(key, controller) {
+  if (pendingReservationAborts.get(key)?.controller === controller) pendingReservationAborts.delete(key);
+}
+function abortPendingReservation(key, reason) {
+  const pending = pendingReservationAborts.get(key);
+  if (!pending) return;
+  pendingReservationAborts.delete(key);
+  pending.controller.abort(new WorkspaceMountHoldAbortedError(reason));
+}
+function abortPendingReservations(reason, sessionId) {
+  for (const [key, pending] of [...pendingReservationAborts]) {
+    if (sessionId !== void 0 && pending.sessionId !== sessionId) continue;
+    abortPendingReservation(key, reason);
+  }
+}
 let workspaceSyncQueue = Promise.resolve();
 let startupProjectSnapshotRecoveryCompleted = false;
 const checkoutGarbageCollectors = /* @__PURE__ */ new Map();
@@ -326,6 +390,17 @@ const workspaceSyncSingleFlight = {
   },
   afterCurrent() {
     return workspaceSyncQueue;
+  },
+  mountHold(target, signal) {
+    if (target.type !== "project") return null;
+    const mountIds = [projectMountId(target.projectId, target.branchName)];
+    if (!workspaceMountHoldFence.isHeld(mountIds)) return null;
+    const holder = workspaceMountHoldFence.describeHold(mountIds);
+    process.stdout.write(
+      `[r5d-worker] command for ${target.projectId}/${target.branchName} waits for ${holder ?? "a workspace filesystem job"}
+`
+    );
+    return workspaceMountHoldFence.waitForRelease(mountIds, { signal });
   }
 };
 let githubCredential = null;
@@ -982,14 +1057,15 @@ async function runGitAsync(args, options = {}) {
     env: workerGitProcessEnvironment(),
     ...bounded ? { detached: true } : {}
   });
-  const completion = Promise.all([
-    new Response(subprocess.stdout).text(),
-    new Response(subprocess.stderr).text(),
-    subprocess.exited
-  ]).then(([stdout, stderr, exitCode]) => ({ stdout, stderr, exitCode }));
+  const completion = Promise.all([new Response(subprocess.stdout).text(), new Response(subprocess.stderr).text(), subprocess.exited]).then(
+    ([stdout, stderr, exitCode]) => ({ stdout, stderr, exitCode })
+  );
   let timer;
   const timedOut = bounded ? new Promise((_resolve, reject) => {
-    timer = setTimeout(() => reject(new GitTransportTimeoutError(`git ${args.join(" ")} timed out after ${options.timeoutMs}ms`)), options.timeoutMs);
+    timer = setTimeout(
+      () => reject(new GitTransportTimeoutError(`git ${args.join(" ")} timed out after ${options.timeoutMs}ms`)),
+      options.timeoutMs
+    );
   }) : null;
   try {
     const { stdout, stderr, exitCode } = timedOut ? await Promise.race([completion, timedOut]) : await completion;
@@ -2078,12 +2154,12 @@ async function streamCommandOutput(stream, onData) {
       }
       const text = decoder.decode(chunk.value, { stream: true });
       if (text.length > 0) {
-        onData(text);
+        await onData(text);
       }
     }
     const trailing = decoder.decode();
     if (trailing.length > 0) {
-      onData(trailing);
+      await onData(trailing);
     }
   } finally {
     reader.releaseLock();
@@ -2222,12 +2298,21 @@ function mutationQueueKey(target, resolved) {
   }
   return `${describeWorkerSessionTarget(target)}:${path.posix.normalize(resolved.repoRelativePath)}`;
 }
-function readWorkerTextFile(branchPath, filePath, offset, limit, builtInPaths) {
+async function statIfExists(targetPath) {
+  try {
+    return await fs.promises.stat(targetPath);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return null;
+    throw error;
+  }
+}
+async function readWorkerTextFile(branchPath, filePath, offset, limit, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
-  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isFile()) {
     throw new Error(`File not found: ${resolved.displayPath}`);
   }
-  const buffer = fs.readFileSync(resolved.absolutePath);
+  const buffer = await fs.promises.readFile(resolved.absolutePath);
   const formatted = formatLineNumberedContent(buffer.toString("utf8"), offset, limit);
   return {
     type: "read",
@@ -2237,25 +2322,25 @@ function readWorkerTextFile(branchPath, filePath, offset, limit, builtInPaths) {
     ...formatted
   };
 }
-function writeWorkerTextFile(branchPath, filePath, content, builtInPaths) {
+async function writeWorkerTextFile(branchPath, filePath, content, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
-  fs.mkdirSync(path.dirname(resolved.absolutePath), { recursive: true });
-  fs.writeFileSync(resolved.absolutePath, content, "utf8");
+  await fs.promises.mkdir(path.dirname(resolved.absolutePath), { recursive: true });
+  await fs.promises.writeFile(resolved.absolutePath, content, "utf8");
   return {
     type: "write",
     file: resolved.displayPath,
     gitBlobHash: getGitBlobHashForContent(content)
   };
 }
-function editWorkerTextFile(branchPath, filePath, edits, builtInPaths) {
+async function editWorkerTextFile(branchPath, filePath, edits, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
   if (!Array.isArray(edits) || edits.length === 0) {
     throw new Error("edit requires at least one replacement");
   }
-  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isFile()) {
     throw new Error(`File not found: ${resolved.displayPath}`);
   }
-  const originalContent = fs.readFileSync(resolved.absolutePath, "utf8");
+  const originalContent = await fs.promises.readFile(resolved.absolutePath, "utf8");
   const ranges = edits.map((edit, index) => {
     if (edit.oldText === edit.newText) {
       throw new Error(`edits[${index}].oldText and edits[${index}].newText must be different`);
@@ -2287,7 +2372,7 @@ function editWorkerTextFile(branchPath, filePath, edits, builtInPaths) {
   for (const range of [...sortedRanges].reverse()) {
     nextContent = nextContent.slice(0, range.start) + range.edit.newText + nextContent.slice(range.end);
   }
-  fs.writeFileSync(resolved.absolutePath, nextContent, "utf8");
+  await fs.promises.writeFile(resolved.absolutePath, nextContent, "utf8");
   return {
     type: "edit",
     file: resolved.displayPath,
@@ -2320,7 +2405,7 @@ async function executePlanOperation(input) {
       let created = false;
       if (message.createIfMissing) {
         try {
-          fs.writeFileSync(resolved.absolutePath, createPlanMarkdown(message.planId), { encoding: "utf8", flag: "wx" });
+          await fs.promises.writeFile(resolved.absolutePath, createPlanMarkdown(message.planId), { encoding: "utf8", flag: "wx" });
           created = true;
         } catch (error) {
           if (error.code !== "EEXIST") throw error;
@@ -2329,11 +2414,16 @@ async function executePlanOperation(input) {
       return {
         type: "read_plan",
         created,
-        read: readWorkerTextFile(resolvedTarget.rootPath, filePath, void 0, void 0, builtInPaths)
+        read: await readWorkerTextFile(resolvedTarget.rootPath, filePath, void 0, void 0, builtInPaths)
       };
     }
-    const content = fs.readFileSync(resolved.absolutePath, "utf8");
-    writeWorkerTextFile(resolvedTarget.rootPath, filePath, updateTaskCheckbox(content, message.taskId, message.checked), builtInPaths);
+    const content = await fs.promises.readFile(resolved.absolutePath, "utf8");
+    await writeWorkerTextFile(
+      resolvedTarget.rootPath,
+      filePath,
+      updateTaskCheckbox(content, message.taskId, message.checked),
+      builtInPaths
+    );
     return {
       type: "update_task_status",
       planId: message.planId,
@@ -2354,7 +2444,11 @@ async function executeReadFileOperation(input) {
     rootDir: input.rootDir,
     access: "read"
   });
-  return readWorkerTextFile(input.resolvedTarget.rootPath, input.message.filePath, input.message.offset, input.message.limit, builtInPaths);
+  const resolved = resolveWorkerFilePath(input.resolvedTarget.rootPath, input.message.filePath, builtInPaths);
+  return withFileMutationQueue(
+    mutationQueueKey(input.resolvedTarget.target, resolved),
+    () => readWorkerTextFile(input.resolvedTarget.rootPath, input.message.filePath, input.message.offset, input.message.limit, builtInPaths)
+  );
 }
 async function executeWriteFileOperation(input) {
   const builtInPaths = await prepareBuiltInToolPathsForTarget({
@@ -2407,16 +2501,16 @@ function wildcardToRegex(pattern) {
 function normalizeFindPattern(pattern) {
   return /[*?]/.test(pattern) ? pattern : `*${pattern}*`;
 }
-function walkWorkerEntries(branchPath, start) {
+async function walkWorkerEntries(branchPath, start) {
   const entries = [];
   const visitedDirectories = /* @__PURE__ */ new Set();
-  const realVirtualRoot = start.scope === "virtual" ? fs.realpathSync(start.virtualRootPath) : null;
-  const visit = (absolutePath, isRoot) => {
+  const realVirtualRoot = start.scope === "virtual" ? await fs.promises.realpath(start.virtualRootPath) : null;
+  const visit = async (absolutePath, isRoot) => {
     let stat;
     try {
-      stat = fs.statSync(absolutePath);
+      stat = await fs.promises.stat(absolutePath);
       if (realVirtualRoot) {
-        assertInsideRoot(realVirtualRoot, fs.realpathSync(absolutePath), `${start.displayPath} path`);
+        assertInsideRoot(realVirtualRoot, await fs.promises.realpath(absolutePath), `${start.displayPath} path`);
       }
     } catch (error) {
       if (isRoot) throw error;
@@ -2429,7 +2523,7 @@ function walkWorkerEntries(branchPath, start) {
     if (!stat.isDirectory()) return;
     let realDirectoryPath;
     try {
-      realDirectoryPath = fs.realpathSync(absolutePath);
+      realDirectoryPath = await fs.promises.realpath(absolutePath);
     } catch (error) {
       if (isRoot) throw error;
       return;
@@ -2438,25 +2532,25 @@ function walkWorkerEntries(branchPath, start) {
     visitedDirectories.add(realDirectoryPath);
     let children;
     try {
-      children = fs.readdirSync(absolutePath, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      children = (await fs.promises.readdir(absolutePath, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
     } catch (error) {
       if (isRoot) throw error;
       return;
     }
     for (const child of children) {
       if (IGNORED_ENTRY_NAMES.has(child.name)) continue;
-      visit(path.join(absolutePath, child.name), false);
+      await visit(path.join(absolutePath, child.name), false);
     }
   };
-  visit(start.absolutePath, true);
+  await visit(start.absolutePath, true);
   return entries;
 }
 function isProbablyText(bytes) {
   return !bytes.subarray(0, Math.min(bytes.length, 4096)).includes(0);
 }
-function grepWorkerFiles(branchPath, input, builtInPaths) {
+async function grepWorkerFiles(branchPath, input, builtInPaths) {
   const start = resolveWorkerFilePath(branchPath, input.path ?? ".", builtInPaths);
-  if (!fs.existsSync(start.absolutePath)) {
+  if (!await statIfExists(start.absolutePath)) {
     throw new Error(`Path not found: ${start.displayPath}`);
   }
   const limit = normalizeToolLimit(input.limit, 100, 1e3);
@@ -2466,12 +2560,12 @@ function grepWorkerFiles(branchPath, input, builtInPaths) {
   const lines = [];
   let matchCount = 0;
   let truncated = false;
-  for (const entry of walkWorkerEntries(branchPath, start)) {
+  for (const entry of await walkWorkerEntries(branchPath, start)) {
     if (!entry.stat.isFile()) continue;
     if (globRegex && !globRegex.test(entry.matchPath)) continue;
     let bytes;
     try {
-      bytes = fs.readFileSync(entry.absolutePath);
+      bytes = await fs.promises.readFile(entry.absolutePath);
     } catch {
       continue;
     }
@@ -2524,9 +2618,9 @@ async function executeGrepOperation(input) {
     builtInPaths
   );
 }
-function findWorkerFiles(branchPath, input, builtInPaths) {
+async function findWorkerFiles(branchPath, input, builtInPaths) {
   const start = resolveWorkerFilePath(branchPath, input.path ?? ".", builtInPaths);
-  if (!fs.existsSync(start.absolutePath) || !fs.statSync(start.absolutePath).isDirectory()) {
+  if (!(await statIfExists(start.absolutePath))?.isDirectory()) {
     throw new Error(`Directory not found: ${start.displayPath}`);
   }
   const pattern = normalizeFindPattern(input.pattern ?? "*");
@@ -2536,7 +2630,7 @@ function findWorkerFiles(branchPath, input, builtInPaths) {
   const matches = [];
   let count = 0;
   let truncated = false;
-  for (const entry of walkWorkerEntries(branchPath, start)) {
+  for (const entry of await walkWorkerEntries(branchPath, start)) {
     if (entry.absolutePath === start.absolutePath) continue;
     const isDirectory = entry.stat.isDirectory();
     if (entryType === "file" && !entry.stat.isFile()) continue;
@@ -2581,13 +2675,13 @@ async function executeFindOperation(input) {
     builtInPaths
   );
 }
-function listWorkerDirectory(branchPath, inputPath = ".", inputLimit, builtInPaths) {
+async function listWorkerDirectory(branchPath, inputPath = ".", inputLimit, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, inputPath, builtInPaths);
-  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isDirectory()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isDirectory()) {
     throw new Error(`Directory not found: ${resolved.displayPath}`);
   }
   const limit = normalizeToolLimit(inputLimit, 200, 1e3);
-  const entries = fs.readdirSync(resolved.absolutePath, { withFileTypes: true }).filter((entry) => !IGNORED_ENTRY_NAMES.has(entry.name)).sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name));
+  const entries = (await fs.promises.readdir(resolved.absolutePath, { withFileTypes: true })).filter((entry) => !IGNORED_ENTRY_NAMES.has(entry.name)).sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name));
   const displayed = entries.slice(0, limit).map((entry) => `${entry.name}${entry.isDirectory() ? "/" : ""}`);
   const truncated = entries.length > displayed.length;
   const hint = truncated ? "\n... truncated. Increase limit to continue." : "";
@@ -2638,36 +2732,40 @@ function resolveWorkerCodePath(branchPath, inputPath) {
   }
   return { absolutePath, displayPath };
 }
-function listWorkerCodeDirectory(branchPath, inputPath) {
+async function listWorkerCodeDirectory(branchPath, inputPath) {
   const resolved = resolveWorkerCodePath(branchPath, inputPath);
-  if (!fs.statSync(resolved.absolutePath).isDirectory()) {
+  if (!(await fs.promises.stat(resolved.absolutePath)).isDirectory()) {
     throw new Error(`Code directory not found: ${resolved.displayPath}`);
   }
-  const entries = fs.readdirSync(resolved.absolutePath, { withFileTypes: true }).filter((entry) => entry.name.toLowerCase() !== ".git").flatMap((entry) => {
+  const listed = (await fs.promises.readdir(resolved.absolutePath, { withFileTypes: true })).filter(
+    (entry) => entry.name.toLowerCase() !== ".git"
+  );
+  const entries = [];
+  for (const entry of listed) {
     const entryPath = path.posix.join(resolved.displayPath, entry.name);
     try {
       const resolvedEntry = resolveWorkerCodePath(branchPath, entryPath);
-      const stats = fs.statSync(resolvedEntry.absolutePath);
-      if (!stats.isFile() && !stats.isDirectory()) return [];
-      return [
-        {
-          name: entry.name,
-          type: stats.isDirectory() ? "directory" : "file",
-          size: stats.isDirectory() ? null : stats.size,
-          mtime: stats.mtime.toISOString()
-        }
-      ];
+      const stats = await fs.promises.stat(resolvedEntry.absolutePath);
+      if (!stats.isFile() && !stats.isDirectory()) continue;
+      entries.push({
+        name: entry.name,
+        type: stats.isDirectory() ? "directory" : "file",
+        size: stats.isDirectory() ? null : stats.size,
+        mtime: stats.mtime.toISOString()
+      });
     } catch {
-      return [];
     }
-  }).sort((left, right) => Number(right.type === "directory") - Number(left.type === "directory") || left.name.localeCompare(right.name));
+  }
+  entries.sort(
+    (left, right) => Number(right.type === "directory") - Number(left.type === "directory") || left.name.localeCompare(right.name)
+  );
   return { type: "code_list", path: resolved.displayPath, entries };
 }
-function readWorkerCodeFile(branchPath, inputPath) {
+async function readWorkerCodeFile(branchPath, inputPath) {
   const resolved = resolveWorkerCodePath(branchPath, inputPath);
-  const stats = fs.statSync(resolved.absolutePath);
+  const stats = await fs.promises.stat(resolved.absolutePath);
   if (!stats.isFile()) throw new Error(`Code file not found: ${resolved.displayPath}`);
-  const bytes = fs.readFileSync(resolved.absolutePath);
+  const bytes = await fs.promises.readFile(resolved.absolutePath);
   return {
     type: "code_read",
     path: resolved.displayPath,
@@ -2676,17 +2774,17 @@ function readWorkerCodeFile(branchPath, inputPath) {
     base64: bytes.toString("base64")
   };
 }
-function executeCodeListOperation(input) {
+async function executeCodeListOperation(input) {
   if (input.resolvedTarget.target.type !== "project") throw new Error("Code listing requires a project branch target");
   return listWorkerCodeDirectory(input.resolvedTarget.rootPath, input.message.path);
 }
-function executeCodeReadOperation(input) {
+async function executeCodeReadOperation(input) {
   if (input.resolvedTarget.target.type !== "project") throw new Error("Code reading requires a project branch target");
   return readWorkerCodeFile(input.resolvedTarget.rootPath, input.message.path);
 }
-function readWorkerImageFile(branchPath, filePath, builtInPaths) {
+async function readWorkerImageFile(branchPath, filePath, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
-  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isFile()) {
     throw new Error(`File not found: ${resolved.displayPath}`);
   }
   const extension = path.extname(resolved.absolutePath).toLowerCase();
@@ -2694,7 +2792,7 @@ function readWorkerImageFile(branchPath, filePath, builtInPaths) {
   if (!mediaType) {
     throw new Error("read supports PNG and JPEG image inputs only");
   }
-  const bytes = fs.readFileSync(resolved.absolutePath);
+  const bytes = await fs.promises.readFile(resolved.absolutePath);
   const dimensions = readImageDimensions(bytes, mediaType);
   return {
     type: "view_file_bytes",
@@ -2794,6 +2892,10 @@ function cancelWorkerCommandLaunch(resources) {
   });
 }
 async function acquireWorkerCommandLaunch(ws, message, assertAdmission) {
+  if (message.type === "exec_start" && message.commandClass === "control") {
+    assertControlCommandArgv(message.argv);
+    if (message.interactive) throw new Error("Control commands cannot be interactive");
+  }
   const id = message.type === "pty_open" ? `pty:${message.ptyId}` : message.runId;
   const operationId = message.type === "pty_open" ? id : `exec:${id}`;
   sendWorkerMessage(ws, { type: "heartbeat_lease", operationId, active: true });
@@ -2802,6 +2904,7 @@ async function acquireWorkerCommandLaunch(ws, message, assertAdmission) {
       id,
       kind: message.type,
       ..."workspaceEffect" in message && message.workspaceEffect === "none" ? { workspaceEffect: "none" } : {},
+      ...message.type === "exec_start" && message.commandClass === "control" ? { commandClass: "control" } : {},
       ..."sessionId" in message && message.sessionId ? { sessionId: message.sessionId } : {},
       assertAdmission: () => {
         assertAdmission();
@@ -2949,8 +3052,17 @@ async function executeStreamingCommand(input) {
     });
     const cwd = resolveCommandCwd(input.resolvedTarget.rootPath, input.message.cwd);
     const interactive = input.message.interactive === true;
+    const control = input.message.commandClass === "control";
+    let argv = input.message.argv;
+    let environment = workerChildProcessEnvironment([githubProcessEnv(), input.message.env ?? {}, targetProcessEnv2]);
+    if (control) {
+      assertControlCommandArgv(argv);
+      if (interactive) throw new Error("Control commands cannot be interactive");
+      argv = [resolveControlCommandExecutable(trustedControlPath, (program, options) => Bun.which(program, options)), ...argv.slice(1)];
+      environment = controlCommandEnvironment(environment, trustedControlPath);
+    }
     input.assertAdmission();
-    const subprocess = Bun.spawn(input.resources.wrap(input.message.argv), {
+    const subprocess = Bun.spawn(input.resources.wrap(argv), {
       cwd,
       // Without an explicit stdin the process reads /dev/null and interactive
       // prompts see immediate EOF; "pipe" keeps stdin open for exec_stdin.
@@ -2958,7 +3070,7 @@ async function executeStreamingCommand(input) {
       stdout: "pipe",
       stderr: "pipe",
       detached: true,
-      env: workerChildProcessEnvironment([githubProcessEnv(), input.message.env ?? {}, targetProcessEnv2])
+      env: environment
     });
     spawnedProcess = subprocess;
     credentialBearingProcessGroups.set(subprocess.pid, subprocess);
@@ -2973,12 +3085,13 @@ async function executeStreamingCommand(input) {
       pid: subprocess.pid,
       processGroupId: process.platform === "win32" ? void 0 : subprocess.pid,
       credentialId: input.message.credentialId,
-      argv: input.message.argv,
+      argv,
       command: input.message.command,
       cwd,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...interactive ? { interactive: true, stdin: subprocess.stdin } : {},
-      ...input.message.workspaceEffect === "none" ? { workspaceEffect: "none" } : {}
+      ...input.message.workspaceEffect === "none" ? { workspaceEffect: "none" } : {},
+      ...control ? { commandClass: "control" } : {}
     });
     settlePreparation();
     started = true;
@@ -2990,7 +3103,8 @@ async function executeStreamingCommand(input) {
       pid: subprocess.pid,
       ...process.platform === "win32" ? {} : { processGroupId: subprocess.pid }
     });
-    if (input.message.timeoutMs) {
+    const timeoutMs = control ? Math.min(input.message.timeoutMs ?? CONTROL_COMMAND_RUNTIME_MS, CONTROL_COMMAND_RUNTIME_MS) : input.message.timeoutMs;
+    if (timeoutMs) {
       timeout = setTimeout(() => {
         timedOut = true;
         cancelWorkerCommandLaunch(input.resources);
@@ -3001,30 +3115,32 @@ async function executeStreamingCommand(input) {
 `
           );
         });
-      }, input.message.timeoutMs);
+      }, timeoutMs);
     }
     const [exitCode] = await Promise.all([
       subprocess.exited,
-      streamCommandOutput(subprocess.stdout, (data) => {
-        sendWorkerMessage(input.ws, {
+      streamCommandOutput(
+        subprocess.stdout,
+        (data) => sendWorkerOutput(input.ws, {
           type: "exec_output",
           runId: input.message.runId,
           stream: "stdout",
           data
-        });
-      }),
-      streamCommandOutput(subprocess.stderr, (data) => {
-        sendWorkerMessage(input.ws, {
+        })
+      ),
+      streamCommandOutput(
+        subprocess.stderr,
+        (data) => sendWorkerOutput(input.ws, {
           type: "exec_output",
           runId: input.message.runId,
           stream: "stderr",
           data
-        });
-      })
+        })
+      )
     ]);
     const diagnostic = await input.resources.diagnose();
     if (diagnostic) {
-      sendWorkerMessage(input.ws, {
+      await sendWorkerOutput(input.ws, {
         type: "exec_output",
         runId: input.message.runId,
         stream: "stderr",
@@ -3096,6 +3212,33 @@ async function reapCompletedCredentialBearingProcessGroup(runId, subprocess) {
     );
   }
 }
+async function cancelProcessRun(runId) {
+  let resourceCancellationError;
+  try {
+    await workerCommandLauncher?.cancel(runId);
+  } catch (error) {
+    resourceCancellationError = error instanceof Error ? error.message : String(error);
+  }
+  const active = activeProcesses.get(runId);
+  let cancelled = resourceCancellationError === void 0;
+  let cancelMessage;
+  if (active) {
+    try {
+      closeProcessStdin(active);
+      await terminateProcessTree(active.process);
+      cancelMessage = `Stopped ${active.command}`;
+    } catch (error) {
+      cancelled = false;
+      cancelMessage = `Failed to stop ${active.command}: ${error instanceof Error ? error.message : String(error)}`;
+    }
+  } else {
+    cancelledProcessRuns.add(runId);
+    abortPendingReservation(`run:${runId}`, "Cancellation queued before command start");
+    cancelMessage = "Cancellation queued before command start";
+  }
+  if (resourceCancellationError) cancelMessage += `; job resource termination failed: ${resourceCancellationError}`;
+  return { cancelled, message: cancelMessage };
+}
 function closeProcessStdin(active) {
   if (!active?.stdin) {
     return;
@@ -3121,21 +3264,35 @@ function sendReplayWorkerMessage(ws, message) {
 }
 function sendWorkerMessage(ws, message) {
   if (launcherFailureInProgress) return;
-  if (recoveryStore && "requestId" in message && typeof message.requestId === "string" && recoveryStore.isUnknown(message.requestId))
-    return;
   const transportError = "error" in message && typeof message.error === "string" ? message.error : message.type === "workspace_sync_result" && message.result.outcome === "failed" ? message.result.error : void 0;
-  if (recoveryStore && transportError && isWorkerCommunicationFailure(transportError) && "requestId" in message && typeof message.requestId === "string") {
-    recoveryStore.unknown(message.requestId);
+  if (recoveryJournal && transportError && isWorkerCommunicationFailure(transportError) && "requestId" in message && typeof message.requestId === "string") {
+    recoveryJournal.unknown(message.requestId);
     currentWorkerSocket?.close(1012, "Communication recovery");
     return;
   }
-  const recorded = recoveryStore?.record(message) ?? message;
-  if ((message.type === "exec_exit" || message.type === "exec_error") && infrastructureStoppedRunIds.has(message.runId)) {
-    recoveryStore?.unknownRun(message.runId);
+  if (!recoveryJournal) {
+    sendReplayWorkerMessage(ws, message);
     return;
   }
-  if (message.type === "exec_output" && workerRecoveryId !== void 0) return;
-  sendReplayWorkerMessage(ws, recorded);
+  recoveryJournal.send(message);
+}
+function sendWorkerOutput(ws, frame) {
+  if (launcherFailureInProgress) return Promise.resolve();
+  if (!recoveryJournal) {
+    sendReplayWorkerMessage(ws, frame);
+    return Promise.resolve();
+  }
+  return recoveryJournal.sendOutput(frame);
+}
+function deliverJournaledWorkerMessage(message) {
+  const target = currentWorkerSocket;
+  if ((message.type === "exec_exit" || message.type === "exec_error") && typeof message.runId === "string" && infrastructureStoppedRunIds.has(message.runId)) {
+    recoveryJournal?.unknownRun(message.runId);
+    return true;
+  }
+  if (!target || target.readyState !== WebSocket.OPEN) return false;
+  if (message.type === "exec_output" && workerRecoveryId !== void 0) return false;
+  return sendReplayWorkerMessage(target, message);
 }
 function sendSerializedWorkerMessage(ws, serialized) {
   sendWorkerMessage(ws, JSON.parse(serialized));
@@ -3164,7 +3321,8 @@ function buildActiveProcessReports() {
     ...active.cwd ? { cwd: active.cwd } : {},
     startedAt: active.startedAt,
     ...active.interactive ? { interactive: true } : {},
-    ...active.workspaceEffect === "none" ? { workspaceEffect: "none" } : {}
+    ...active.workspaceEffect === "none" ? { workspaceEffect: "none" } : {},
+    ...active.commandClass ? { commandClass: active.commandClass } : {}
   }));
 }
 function sendActiveProcessReport(ws) {
@@ -3686,6 +3844,7 @@ async function startWorker(options, projectRuntime = {
   validateLabel(label);
   if (!workerCommandLauncher) {
     const launcher = await createWorkerCommandLauncher({
+      onCapacityChange: () => scheduleCapacityReport(),
       configuration: process.env.R5D_WORKER_COMMAND_LAUNCHER,
       env: commandLauncherEnvironment(),
       onFailure: handleWorkerCommandLauncherFailure
@@ -3696,9 +3855,19 @@ async function startWorker(options, projectRuntime = {
 `);
   }
   const rootDir = path.resolve(options.rootDir ?? process.env.R5D_ROOT ?? defaultRootDir());
-  recoveryStore ??= new WorkerRecoveryStore(
-    path.join(rootDir, ".worker-recovery", createHash("sha256").update(`${baseUrl}\0${label}`).digest("hex"), "protocol.sqlite")
-  );
+  if (!recoveryJournal) {
+    const journal = await WorkerRecoveryJournal.open({
+      filename: path.join(
+        rootDir,
+        ".worker-recovery",
+        createHash("sha256").update(`${baseUrl}\0${label}`).digest("hex"),
+        "protocol.sqlite"
+      )
+    });
+    journal.deliver = deliverJournaledWorkerMessage;
+    journal.onFailure = handleRecoveryJournalFailure;
+    recoveryJournal = journal;
+  }
   const projectsRoot = path.join(rootDir, "projects");
   const syncRoot = path.join(rootDir, "sync");
   const workspaceShadowRoot = path.join(syncRoot, "workspace");
@@ -3801,7 +3970,6 @@ async function startWorker(options, projectRuntime = {
   const bearerAuthHeader = `Authorization: Bearer ${token}`;
   const workerCredentialUsername = credentialUsernameForAuthHeader(bearerAuthHeader);
   const projectBranchKey = (projectId, branchName) => `${projectId}\0${branchName}`;
-  const projectMountId = (projectId, branchName) => `project:${projectId}:${encodeURIComponent(branchName)}`;
   const projectPlanMountId = (projectId, branchName) => `plan:${projectId}:${encodeURIComponent(branchName)}`;
   const workspaceProjectRelativePath = (projectId, branchName) => path.posix.join("projects", projectId, "branches", encodeURIComponent(branchName));
   const workspacePlanRelativePath = (projectId, branchName) => path.posix.join("plans", projectId, encodeURIComponent(branchName));
@@ -3884,7 +4052,8 @@ async function startWorker(options, projectRuntime = {
       sourcePath: configuredProjectBranchPath(projectsRoot, project, branchName),
       planSourcePath: path.join(planRoot, project.projectId, ...branchName.split("/"))
     }));
-    removeProjectWorktrees({ projectRoot, branchNames: branches.map(({ branchName }) => branchName) });
+    const removed = removeProjectWorktrees({ projectsRoot, projectRoot, branchNames: branches.map(({ branchName }) => branchName) });
+    if (removed.stagedForCollectionPath) checkoutGarbageCollector.enqueue(removed.stagedForCollectionPath);
     for (const branch of branches) {
       fs.rmSync(branch.planSourcePath, { recursive: true, force: true });
       const key = projectBranchKey(project.projectId, branch.branchName);
@@ -3972,14 +4141,14 @@ async function startWorker(options, projectRuntime = {
       )
     };
   };
-  const stageDurableWorkspaceDeletions = () => {
+  const stageDurableWorkspaceDeletions = async () => {
     for (const deletion of projectWorkspaceState.pendingTreeDeletions) {
       const cleanupConfig = cleanupConfigForDurableDeletion(deletion);
       if (deletion.kind === "project") {
         if (!deletion.projectDeleted) {
           const nextProject = projectConfigById.get(deletion.projectId);
           if (!nextProject) throw new Error(`Checkout-path move lost desired project ${deletion.projectId}`);
-          preserveProjectCheckoutPathMove({
+          await workspaceFilesystemExecutor().run("project_checkout_path_move", {
             oldProjectRoot: deletion.managedPath,
             newProjectRoot: configuredProjectRoot(projectsRoot, nextProject),
             projectsDurabilityRoot: projectsRoot,
@@ -4346,7 +4515,7 @@ async function startWorker(options, projectRuntime = {
           }
         }
         if (transitionReseedRequired) {
-          projectWorkspaceState = projectWorkspaceStateStore.recordEnabledRepositoryTransition({
+          projectWorkspaceState = await projectWorkspaceStateStore.recordEnabledRepositoryTransition({
             projectId: project.projectId,
             transitionId: project.repositoryTransitionId
           });
@@ -4515,7 +4684,7 @@ async function startWorker(options, projectRuntime = {
       )
     ];
     if (publishedTombstoneIds.length > 0) {
-      projectWorkspaceState = projectWorkspaceStateStore.recordTreePublication({
+      projectWorkspaceState = await projectWorkspaceStateStore.recordTreePublication({
         tombstoneIds: publishedTombstoneIds,
         publishedHead
       });
@@ -4534,7 +4703,7 @@ async function startWorker(options, projectRuntime = {
         forgetLocalProjectMirrorRefsTokens(deletion.projectId, deletion.branchName);
       }
       if (deletion.tombstoneId && !deletion.projectDeleted) {
-        projectWorkspaceState = projectWorkspaceStateStore.recordMirrorRefDeletion({
+        projectWorkspaceState = await projectWorkspaceStateStore.recordMirrorRefDeletion({
           tombstoneId: deletion.tombstoneId,
           branchName: deletion.branchName
         });
@@ -4731,7 +4900,10 @@ async function startWorker(options, projectRuntime = {
     };
   };
   const workspaceHydrationTransactionHooks = createWorkspaceHydrationLeaseHooks(
-    (message) => sendWorkerMessageFromCurrentSource(ws, message)
+    (message) => sendWorkerMessageFromCurrentSource(ws, message),
+    {
+      fence: workspaceMountHoldFence
+    }
   );
   const performWorkspaceSync = async (input) => {
     if (!workspaceRemoteUrl || !workspaceCredentialHelper || !workspaceCredentialUsername || !workspaceGitIdentity) {
@@ -5389,7 +5561,7 @@ async function startWorker(options, projectRuntime = {
           (project) => project.preserveOnlyBranches.map(({ branchId, branchName }) => ({ branchId, projectId: project.projectId, branchName }))
         );
         if (!incidentDeferral.incidentId) {
-          projectWorkspaceState = projectWorkspaceStateStore.reconcile({
+          projectWorkspaceState = await projectWorkspaceStateStore.reconcile({
             desiredProjects: message.projects,
             preserveOnlyBranches
           });
@@ -5400,7 +5572,7 @@ async function startWorker(options, projectRuntime = {
               (candidate) => candidate.projectId === project.projectId && candidate.branchName === branch.branchName
             );
             if (pending2 && pending2.branchId === branch.branchId) {
-              projectWorkspaceState = projectWorkspaceStateStore.clearPendingCreatedBranch(pending2);
+              projectWorkspaceState = await projectWorkspaceStateStore.clearPendingCreatedBranch(pending2);
             }
           }
         }
@@ -5568,7 +5740,7 @@ async function startWorker(options, projectRuntime = {
         for (const projectId of [...readyProjectIds]) {
           if (!projectConfigById.has(projectId)) readyProjectIds.delete(projectId);
         }
-        stageDurableWorkspaceDeletions();
+        await stageDurableWorkspaceDeletions();
         const mountsBeforeGit = buildWorkspaceMounts();
         await hydrateWorkspaceGitMounts(
           workspaceShadowRoot,
@@ -5614,7 +5786,12 @@ async function startWorker(options, projectRuntime = {
         const connectSyncMs = Date.now() - connectSyncStartedAtMs;
         const result = syncResult.telemetry ? syncResult : {
           ...syncResult,
-          telemetry: { totalMs: connectSyncMs, queueMs: 0, prepareMs: lastWorkspaceSyncMirrorObservationMs, synchronizeMs: connectSyncMs }
+          telemetry: {
+            totalMs: connectSyncMs,
+            queueMs: 0,
+            prepareMs: lastWorkspaceSyncMirrorObservationMs,
+            synchronizeMs: connectSyncMs
+          }
         };
         assertConfigurationSyncStillAdmitted();
         if (receiptGeneration !== workspaceConfigurationReceiptGeneration) {
@@ -5633,7 +5810,7 @@ async function startWorker(options, projectRuntime = {
             ) ? [deletion.tombstoneId] : []
           );
           if (layoutCleanupIds.length > 0) {
-            projectWorkspaceState = projectWorkspaceStateStore.recordTreePublication({
+            projectWorkspaceState = await projectWorkspaceStateStore.recordTreePublication({
               tombstoneIds: layoutCleanupIds,
               publishedHead
             });
@@ -5740,26 +5917,33 @@ async function startWorker(options, projectRuntime = {
     if (startupProjectSnapshotRecoveryCompleted) return;
     sendLifecycleProgress({ phase: "recovering", operationId, detail: "Checking interrupted workspace transactions" });
     const snapshotRecovery = await workspaceSyncSingleFlight.runExclusive(
-      async () => await recoverProjectSnapshotsInChild({
-        projectsRoot,
-        snapshotRoot: projectWorktreeSnapshotsRoot,
-        onProgress: (progress) => {
-          const lifecycleProgress = {
-            phase: "recovering",
-            operationId,
-            detail: describeSnapshotProgress(progress),
-            completedBytes: progress.completedBytes,
-            completedItems: progress.completedBranches,
-            totalItems: progress.totalBranches,
-            ...progress.totalBytes === void 0 ? {} : { totalBytes: progress.totalBytes }
-          };
-          sendLifecycleProgress(lifecycleProgress);
-          process.stdout.write(
-            `[r5d-worker] ${lifecycleProgress.detail}: ${progress.completedBranches}/${progress.totalBranches} branch(es), ${progress.completedBytes}/${progress.totalBytes ?? "?"} bytes
+      async () => await workspaceFilesystemExecutor().run(
+        "project_snapshots_recover",
+        {
+          projectsRoot,
+          temporaryRoot: projectWorktreeSnapshotsRoot,
+          currentProcessId: process.pid,
+          currentOwnerSessionId: PROJECT_WORKTREE_SNAPSHOT_OWNER_SESSION_ID
+        },
+        {
+          onProgress: (progress) => {
+            const lifecycleProgress = {
+              phase: "recovering",
+              operationId,
+              detail: describeSnapshotProgress(progress),
+              completedBytes: progress.completedBytes,
+              completedItems: progress.completedBranches,
+              totalItems: progress.totalBranches,
+              ...progress.totalBytes === void 0 ? {} : { totalBytes: progress.totalBytes }
+            };
+            sendLifecycleProgress(lifecycleProgress);
+            process.stdout.write(
+              `[r5d-worker] ${lifecycleProgress.detail}: ${progress.completedBranches}/${progress.totalBranches} branch(es), ${progress.completedBytes}/${progress.totalBytes ?? "?"} bytes
 `
-          );
+            );
+          }
         }
-      })
+      )
     );
     if (snapshotRecovery.restored.length > 0) {
       process.stdout.write(`[r5d-worker] restored ${snapshotRecovery.restored.length} interrupted project snapshot(s)
@@ -5854,7 +6038,7 @@ async function startWorker(options, projectRuntime = {
       type: "hello",
       resumableProtocol: WORKER_RESUMABLE_PROTOCOL,
       runtimeId: workerRuntimeId,
-      ledgerId: recoveryStore.ledgerId,
+      ledgerId: recoveryJournal.ledgerId,
       startupReady: startupRecoveryComplete,
       hostInfo: {
         hostname: hostname(),
@@ -5873,6 +6057,7 @@ async function startWorker(options, projectRuntime = {
           workspaceConfigResetToCanonicalV1: true,
           projectBranchDeletionFastAckV1: true,
           projectBranchDeletionStagedRemovalV1: true,
+          commandControlLaneV1: workerCommandLauncher?.supportsControlLane === true,
           projectMirrorLeaseV1: true,
           projectMirrorRefsTokensV1: true,
           projectBranchWorkingTreeModeV1: true
@@ -5881,16 +6066,39 @@ async function startWorker(options, projectRuntime = {
       }
     };
     sendSerializedWorkerMessage(ws, JSON.stringify(hello));
+    let outputPumpInFlight = false;
     outputReplayTimer = setInterval(() => {
-      if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws) return;
-      for (const output of recoveryStore.output()) {
-        if (!sendReplayWorkerMessage(ws, output)) break;
-      }
+      if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws || outputPumpInFlight || !recoveryJournal) return;
+      outputPumpInFlight = true;
+      void (async () => {
+        try {
+          for await (const page of recoveryJournal.outputReplay(void 0)) {
+            for (const output of page) {
+              if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws || !sendReplayWorkerMessage(ws, output)) return;
+            }
+          }
+        } catch (error) {
+          process.stderr.write(`[r5d-worker] output replay pump failed: ${error instanceof Error ? error.message : String(error)}
+`);
+        } finally {
+          outputPumpInFlight = false;
+        }
+      })();
     }, 250);
     outputReplayTimer.unref();
+    let terminalPumpInFlight = false;
     terminalReplayTimer = setInterval(() => {
-      if (workerRecoveryId !== void 0) return;
-      for (const terminal of recoveryStore?.terminals() ?? []) sendReplayWorkerMessage(ws, terminal);
+      if (workerRecoveryId !== void 0 || terminalPumpInFlight || !recoveryJournal) return;
+      terminalPumpInFlight = true;
+      void recoveryJournal.terminals().then((terminals) => {
+        if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws) return;
+        for (const terminal of terminals) sendReplayWorkerMessage(ws, terminal);
+      }).catch((error) => {
+        process.stderr.write(`[r5d-worker] terminal replay pump failed: ${error instanceof Error ? error.message : String(error)}
+`);
+      }).finally(() => {
+        terminalPumpInFlight = false;
+      });
     }, 5e3);
     terminalReplayTimer.unref();
     process.stdout.write("[r5d-worker] connected\n");
@@ -5903,28 +6111,37 @@ async function startWorker(options, projectRuntime = {
       if (message.type === "recovery_request") {
         workerRecoveryId = message.recoveryId;
         sendActiveProcessReport(ws);
-        sendWorkerMessage(ws, {
-          type: "recovery_state",
-          recoveryId: message.recoveryId,
-          runtimeId: workerRuntimeId,
-          ledgerId: recoveryStore.ledgerId,
-          operations: recoveryStore.operations()
-        });
-        const cursors = new Map(recoveryStore.outputCursors().map((cursor) => [cursor.runId, cursor]));
-        for (const cursor of message.outputOffsets) cursors.set(cursor.runId, cursor);
-        workerOutputWindow.reset([...cursors.values()]);
-        for (const response of recoveryStore.responses(message.requests)) sendReplayWorkerMessage(ws, response);
-        for (const output of recoveryStore.output(message.outputOffsets)) {
-          while (true) {
-            if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId || ws.readyState !== WebSocket.OPEN || workerLeaseExpired)
-              return;
-            if (sendReplayWorkerMessage(ws, output)) break;
-            await Bun.sleep(10);
+        recoveryJournal.pauseDelivery();
+        try {
+          const state = await recoveryJournal.recoveryState(message.requests);
+          if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId) return;
+          sendWorkerMessage(ws, {
+            type: "recovery_state",
+            recoveryId: message.recoveryId,
+            runtimeId: workerRuntimeId,
+            ledgerId: recoveryJournal.ledgerId,
+            operations: state.operations
+          });
+          const cursors = new Map(state.cursors.map((cursor) => [cursor.runId, cursor]));
+          for (const cursor of message.outputOffsets) cursors.set(cursor.runId, cursor);
+          workerOutputWindow.reset([...cursors.values()]);
+          for (const response of state.responses) sendReplayWorkerMessage(ws, response);
+          for await (const page of recoveryJournal.outputReplay(message.outputOffsets)) {
+            for (const output of page) {
+              while (true) {
+                if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId || ws.readyState !== WebSocket.OPEN || workerLeaseExpired)
+                  return;
+                if (sendReplayWorkerMessage(ws, output)) break;
+                await Bun.sleep(10);
+              }
+            }
           }
+          if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId) return;
+          for (const terminal of state.terminals) sendReplayWorkerMessage(ws, terminal);
+          sendWorkerMessage(ws, { type: "recovery_complete", recoveryId: message.recoveryId });
+        } finally {
+          recoveryJournal.resumeDelivery();
         }
-        if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId) return;
-        for (const terminal of recoveryStore.terminals()) sendReplayWorkerMessage(ws, terminal);
-        sendWorkerMessage(ws, { type: "recovery_complete", recoveryId: message.recoveryId });
         return;
       }
       if (message.type === "recovery_ready") {
@@ -5939,17 +6156,23 @@ async function startWorker(options, projectRuntime = {
         return;
       }
       if (message.type === "operation_result_ack") {
-        recoveryStore.acknowledgeResult(message.requestId);
+        recoveryJournal.acknowledgeResult(message.requestId);
         return;
       }
       if (message.type === "exec_output_ack") {
-        recoveryStore.acknowledgeOutput(message.runId, message.stream, message.nextOffset);
+        recoveryJournal.acknowledgeOutput(message.runId, message.stream, message.nextOffset);
         workerOutputWindow.acknowledge(message.runId, message.stream, message.nextOffset);
         return;
       }
       if (message.type === "cancel_session") {
-        recoveryStore.cancelSession(message.sessionId);
+        const durableCancellation = recoveryJournal.cancelSession(message.sessionId);
+        abortPendingReservations("Session cancelled before command start", message.sessionId);
         await Promise.all([
+          durableCancellation,
+          // File writes already in flight for the session settle before the
+          // acknowledgement; queued ones re-check the cancellation before
+          // their first write and never start.
+          sessionFileMutations.settled(message.sessionId),
           workerCommandLauncher?.cancelSession(message.sessionId),
           ...[...activeProcesses].filter(([, active]) => active.sessionId === message.sessionId).map(async ([runId, active]) => {
             cancelledProcessRuns.add(runId);
@@ -5964,27 +6187,74 @@ async function startWorker(options, projectRuntime = {
       if (!startupRecoveryComplete && message.type !== "ping") return;
       if (currentWorkerSocket !== ws) return;
       const operationRequestId = "requestId" in message && typeof message.requestId === "string" && message.type !== "workspace_config" ? message.requestId : void 0;
+      if (message.type === "cancel") {
+        const admission = recoveryJournal.admit({ ...message, requestId: message.requestId });
+        const cancelled = await cancelProcessRun(message.runId);
+        let admitted;
+        try {
+          admitted = await admission;
+        } catch (error) {
+          if (!(error instanceof WorkerRecoveryJournalBusyError)) throw error;
+          process.stderr.write(`[r5d-worker] cancel ${message.runId} stopped the run but was not durably admitted: ${error.message}
+`);
+          return;
+        }
+        if (admitted.admission === "conflict") {
+          ws.close(1008, "Operation identity conflict");
+          return;
+        }
+        sendWorkerMessage(ws, { type: "operation_received", requestId: message.requestId });
+        if (admitted.admission !== "new") {
+          if (admitted.response && admitted.admission !== "unknown") sendReplayWorkerMessage(ws, admitted.response);
+          return;
+        }
+        sendSerializedWorkerMessage(
+          ws,
+          JSON.stringify({
+            type: "cancel_result",
+            requestId: message.requestId,
+            runId: message.runId,
+            cancelled: cancelled.cancelled,
+            message: cancelled.message
+          })
+        );
+        return;
+      }
       if (operationRequestId) {
-        const admission = recoveryStore.admit({ ...message, requestId: operationRequestId });
-        if (admission === "conflict") {
+        let admitted;
+        try {
+          admitted = await recoveryJournal.admit({ ...message, requestId: operationRequestId });
+        } catch (error) {
+          if (!(error instanceof WorkerRecoveryJournalBusyError)) throw error;
+          process.stderr.write(`[r5d-worker] ${message.type} ${operationRequestId} was not admitted: ${error.message}
+`);
+          return;
+        }
+        if (admitted.admission === "conflict") {
           ws.close(1008, "Operation identity conflict");
           return;
         }
         sendWorkerMessage(ws, { type: "operation_received", requestId: operationRequestId });
-        if (admission !== "new") {
-          const response = recoveryStore.response(operationRequestId);
-          if (response && admission !== "unknown") sendReplayWorkerMessage(ws, response);
-          if (!(admission === "unknown" && message.type === "delete_project_branch" && recoveryStore.readmitUnknownBranchDeletion(operationRequestId))) {
+        if (admitted.admission !== "new") {
+          if (admitted.response && admitted.admission !== "unknown") sendReplayWorkerMessage(ws, admitted.response);
+          if (!(admitted.admission === "unknown" && message.type === "delete_project_branch" && await recoveryJournal.readmitUnknownBranchDeletion(
+            operationRequestId,
+            "sessionId" in message && typeof message.sessionId === "string" ? message.sessionId : void 0
+          ))) {
             return;
           }
         }
+        if (recoveryJournal.isRequestCancelled(operationRequestId)) {
+          recoveryJournal.unknown(operationRequestId);
+          return;
+        }
       }
       const messageAdmissionGeneration = workerAdmissionGeneration;
       const admissionCredentials = configuredCredentialGenerationFingerprint;
       const assertMessageAdmission = () => {
         if (operationRequestId) {
-          if (workerLeaseExpired || recoveryStore.isRequestCancelled(operationRequestId) || admissionCredentials !== configuredCredentialGenerationFingerprint || shutdownAfterClose || !workspaceConfigured) {
-            recoveryStore.unknown(operationRequestId);
+          if (workerLeaseExpired || recoveryJournal.isRequestCancelled(operationRequestId) || admissionCredentials !== configuredCredentialGenerationFingerprint || shutdownAfterClose || !workspaceConfigured) {
+            recoveryJournal.unknown(operationRequestId);
             throw new StaleWorkerAdmissionError();
           }
           return;
@@ -5999,6 +6269,8 @@ async function startWorker(options, projectRuntime = {
         });
       };
       if (message.type === "connected") {
+        capacityReportSocket = ws;
+        scheduleCapacityReport(true);
         return;
       }
       if (message.type === "project_mirror_refs_tokens") {
@@ -6119,7 +6391,7 @@ async function startWorker(options, projectRuntime = {
           }
           recoveryDeadline ??= Date.now() + WORKER_RECOVERY_TIMEOUT_MS;
           if (workerLeaseExpired || Date.now() >= recoveryDeadline) {
-            recoveryStore.unknown(message.requestId);
+            recoveryJournal.unknown(message.requestId);
             return;
           }
           currentWorkerSocket?.close(1012, "Communication recovery");
@@ -6149,7 +6421,7 @@ async function startWorker(options, projectRuntime = {
             projectId: message.projectId,
             branchName: message.targetBranch
           };
-          const created = await workspaceSyncSingleFlight.runBranchMutation(() => {
+          const created = await workspaceSyncSingleFlight.runBranchMutation(async () => {
             if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
               throw new Error(
                 `Project branch creation was fenced while queued by workspace incident ${deferredWorkspaceConfiguration?.incidentId ?? activeWorkspaceIncidentId}`
@@ -6164,7 +6436,7 @@ async function startWorker(options, projectRuntime = {
             const pendingWasRecorded = projectWorkspaceState.locallyPendingCreatedBranches.some(
               ({ projectId, branchName }) => projectId === message.projectId && branchName === message.targetBranch
             );
-            projectWorkspaceState = projectWorkspaceStateStore.recordPendingCreatedBranch(pendingBranch);
+            projectWorkspaceState = await projectWorkspaceStateStore.recordPendingCreatedBranch(pendingBranch);
             let gitBranchCreated = false;
             try {
               if (!readyProjectIds.has(project.projectId)) {
@@ -6185,7 +6457,7 @@ async function startWorker(options, projectRuntime = {
                 }
                 return { branchPath: existingPath, baseCommitHash: existingBranch.baseCommitHash };
               }
-              const createdBranch = createOrRetryLinkedProjectBranch({
+              const createdBranch = await createOrRetryLinkedProjectBranch({
                 projectRoot: configuredProjectRoot(projectsRoot, project),
                 primaryBranchName: primaryProjectBranch(project),
                 sourceBranchName: message.sourceBranch,
@@ -6210,7 +6482,7 @@ async function startWorker(options, projectRuntime = {
               return createdBranch;
             } catch (error) {
               if (!pendingWasRecorded && !gitBranchCreated && !projectBranchMayExistAfterCreateFailure(error)) {
-                projectWorkspaceState = projectWorkspaceStateStore.rollbackPendingCreatedBranch(pendingBranch);
+                projectWorkspaceState = await projectWorkspaceStateStore.rollbackPendingCreatedBranch(pendingBranch);
               }
               throw error;
             }
@@ -6254,7 +6526,7 @@ async function startWorker(options, projectRuntime = {
         });
         try {
           const deletionKey = projectBranchKey(message.projectId, message.branchName);
-          const deletionNeedsSync = await workspaceSyncSingleFlight.runBranchMutation(() => {
+          const deletionNeedsSync = await workspaceSyncSingleFlight.runBranchMutation(async () => {
             if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
               throw new Error(
                 `Project branch deletion was fenced while queued by workspace incident ${deferredWorkspaceConfiguration?.incidentId ?? activeWorkspaceIncidentId}`
@@ -6281,12 +6553,12 @@ async function startWorker(options, projectRuntime = {
             if (!configuredBranch && !pendingLocalBranch && !hasDurableTombstone && !pendingMirrorDeletes.has(deletionKey)) {
               return false;
             }
-            projectWorkspaceState = projectWorkspaceStateStore.beginBranchDeletion({
+            projectWorkspaceState = await projectWorkspaceStateStore.beginBranchDeletion({
               projectId: message.projectId,
               branchName: message.branchName
             });
             if (pendingLocalBranch) {
-              projectWorkspaceState = projectWorkspaceStateStore.clearPendingCreatedBranch(pendingLocalBranch);
+              projectWorkspaceState = await projectWorkspaceStateStore.clearPendingCreatedBranch(pendingLocalBranch);
             }
             pendingCreatedBranchPublicationNotBefore.delete(pendingCreatedBranchKey(message.projectId, message.branchName));
             if (pendingMirrorDeletes.has(deletionKey)) return true;
@@ -6390,7 +6662,7 @@ async function startWorker(options, projectRuntime = {
       }
       if (message.type === "exec_terminal_ack") {
         pendingProcessTerminals.delete(message.runId);
-        recoveryStore.acknowledgeTerminal(message.runId);
+        recoveryJournal.acknowledgeTerminal(message.runId);
         return;
       }
       if (message.type === "port_forward_connect") {
@@ -6445,42 +6717,6 @@ async function startWorker(options, projectRuntime = {
         sendSerializedWorkerMessage(ws, JSON.stringify({ type: "pong" }));
         return;
       }
-      if (message.type === "cancel") {
-        let resourceCancellationError;
-        try {
-          await workerCommandLauncher?.cancel(message.runId);
-        } catch (error) {
-          resourceCancellationError = error instanceof Error ? error.message : String(error);
-        }
-        const active = activeProcesses.get(message.runId);
-        let cancelled = resourceCancellationError === void 0;
-        let cancelMessage;
-        if (active) {
-          try {
-            closeProcessStdin(active);
-            await terminateProcessTree(active.process);
-            cancelMessage = `Stopped ${active.command}`;
-          } catch (error) {
-            cancelled = false;
-            cancelMessage = `Failed to stop ${active.command}: ${error instanceof Error ? error.message : String(error)}`;
-          }
-        } else {
-          cancelledProcessRuns.add(message.runId);
-          cancelMessage = "Cancellation queued before command start";
-        }
-        if (resourceCancellationError) cancelMessage += `; job resource termination failed: ${resourceCancellationError}`;
-        sendSerializedWorkerMessage(
-          ws,
-          JSON.stringify({
-            type: "cancel_result",
-            requestId: message.requestId,
-            runId: message.runId,
-            cancelled,
-            message: cancelMessage
-          })
-        );
-        return;
-      }
       if (message.type === "exec_stdin") {
         const sendAck = (payload) => sendSerializedWorkerMessage(
           ws,
@@ -6561,10 +6797,20 @@ async function startWorker(options, projectRuntime = {
         let mutationLeaseTransferred = false;
         try {
           resources = await acquireWorkerCommandLaunch(ws, message, assertMessageAdmission);
-          await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
-            workspaceSyncPriorityPtyTargets.set(message.ptyId, message.target);
-            if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
-          });
+          const reservationAbort = registerPendingReservation(`pty:${message.ptyId}`, void 0);
+          try {
+            await reserveWorkspaceCommandAfterCurrentSync(
+              message.target,
+              workspaceSyncSingleFlight,
+              () => {
+                workspaceSyncPriorityPtyTargets.set(message.ptyId, message.target);
+                if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
+              },
+              { signal: reservationAbort.signal }
+            );
+          } finally {
+            unregisterPendingReservation(`pty:${message.ptyId}`, reservationAbort);
+          }
           releaseWorkspaceMutation = await acquireWorkspaceCommandMutation(message.target, workspaceSyncSingleFlight);
           if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
             throw new Error(
@@ -6629,6 +6875,7 @@ async function startWorker(options, projectRuntime = {
       }
       if (message.type === "pty_close") {
         const activePty = activePtys.get(message.ptyId);
+        abortPendingReservation(`pty:${message.ptyId}`, "Shell closed before it started");
         await closePty(message);
         if (activePty && targetMayMutateVisibleWorkspace(activePty.target)) {
           markWorkspaceDirty({ type: "process_terminal", detail: `pty ${message.ptyId} closed` }, true, activePty.target);
@@ -6665,11 +6912,21 @@ async function startWorker(options, projectRuntime = {
         try {
           resources = await acquireWorkerCommandLaunch(ws, message, assertMessageAdmission);
           if (hasWorkspaceEffect) {
-            await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
-              workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
-              targetReserved = true;
-              if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
-            });
+            const reservationAbort = registerPendingReservation(`run:${message.runId}`, message.sessionId);
+            try {
+              await reserveWorkspaceCommandAfterCurrentSync(
+                message.target,
+                workspaceSyncSingleFlight,
+                () => {
+                  workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
+                  targetReserved = true;
+                  if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
+                },
+                { signal: reservationAbort.signal }
+              );
+            } finally {
+              unregisterPendingReservation(`run:${message.runId}`, reservationAbort);
+            }
           }
           const runCommand = async () => {
             if (!workspaceCommandTransportIsAllowed(deferredWorkspaceConfiguration, activeWorkspaceIncidentId, "exec")) {
@@ -6721,7 +6978,7 @@ async function startWorker(options, projectRuntime = {
           cancelledProcessRuns.delete(message.runId);
         }
         if (infrastructureStoppedRunIds.has(message.runId)) {
-          recoveryStore.unknown(message.requestId);
+          recoveryJournal.unknown(message.requestId);
           return;
         }
         sendSerializedWorkerMessage(ws, JSON.stringify(result));
@@ -6754,8 +7011,10 @@ async function startWorker(options, projectRuntime = {
         const runCommand = async () => {
           try {
             const resolvedTarget = resolveMessageTarget(message.target);
-            process.stdout.write(`[r5d-worker] exec_start ${message.runId}: ${message.argv.join(" ")}
-`);
+            process.stdout.write(
+              `[r5d-worker] exec_start ${message.runId}${message.commandClass === "control" ? " (control)" : ""}: ${message.argv.join(" ")}
+`
+            );
             await executeStreamingCommand({
               resources,
               ws,
@@ -6793,11 +7052,21 @@ async function startWorker(options, projectRuntime = {
           try {
             resources = await acquireWorkerCommandLaunch(ws, message, assertMessageAdmission);
             if (hasWorkspaceEffect) {
-              await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
-                workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
-                targetReserved = true;
-                if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
-              });
+              const reservationAbort = registerPendingReservation(`run:${message.runId}`, message.sessionId);
+              try {
+                await reserveWorkspaceCommandAfterCurrentSync(
+                  message.target,
+                  workspaceSyncSingleFlight,
+                  () => {
+                    workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
+                    targetReserved = true;
+                    if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
+                  },
+                  { signal: reservationAbort.signal }
+                );
+              } finally {
+                unregisterPendingReservation(`run:${message.runId}`, reservationAbort);
+              }
             }
             await runReservedWorkspaceCommand(message.target, workspaceSyncSingleFlight, runCommand, () => {
               if (targetReserved) {
@@ -6832,16 +7101,40 @@ async function startWorker(options, projectRuntime = {
           return;
         }
         const reservesVisibleWorkspace = targetMayMutateVisibleWorkspace(message.target);
-        const mutatesVisibleWorkspace = (message.type === "write" || message.type === "edit" || message.type === "update_task_status" || message.type === "read_plan" && message.createIfMissing) && targetMayMutateVisibleWorkspace(message.target);
+        const mutatesFiles = message.type === "write" || message.type === "edit" || message.type === "update_task_status" || message.type === "read_plan" && message.createIfMissing;
+        const mutatesVisibleWorkspace = mutatesFiles && targetMayMutateVisibleWorkspace(message.target);
         if (reservesVisibleWorkspace) {
-          await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
-            workspaceSyncPriorityOperationTargets.set(message.requestId, message.target);
-            if (mutatesVisibleWorkspace) recordVisibleWorkspaceMutation(message.target);
-          });
+          const reservationAbort = registerPendingReservation(
+            `op:${message.requestId}`,
+            "sessionId" in message && typeof message.sessionId === "string" ? message.sessionId : void 0
+          );
+          try {
+            await reserveWorkspaceCommandAfterCurrentSync(
+              message.target,
+              workspaceSyncSingleFlight,
+              () => {
+                workspaceSyncPriorityOperationTargets.set(message.requestId, message.target);
+                if (mutatesVisibleWorkspace) recordVisibleWorkspaceMutation(message.target);
+              },
+              { signal: reservationAbort.signal }
+            );
+          } catch (error) {
+            sendSerializedWorkerMessage(
+              ws,
+              JSON.stringify({
+                type: "operation_result",
+                requestId: message.requestId,
+                error: error instanceof Error ? error.message : String(error)
+              })
+            );
+            return;
+          } finally {
+            unregisterPendingReservation(`op:${message.requestId}`, reservationAbort);
+          }
         }
         let dirtyTrigger;
         try {
-          const result = await runWorkspaceCommand(message.target, workspaceSyncSingleFlight, async () => {
+          const operation = runWorkspaceCommand(message.target, workspaceSyncSingleFlight, async () => {
             const resolvedTarget = resolveMessageTarget(message.target);
             return await executeOperation({
               message,
@@ -6852,6 +7145,8 @@ async function startWorker(options, projectRuntime = {
               assertAdmission: assertMessageAdmission
             });
           });
+          if (mutatesFiles && typeof message.sessionId === "string") sessionFileMutations.track(message.sessionId, operation);
+          const result = await operation;
           sendSerializedWorkerMessage(
             ws,
             JSON.stringify({
@@ -6935,6 +7230,7 @@ async function startWorker(options, projectRuntime = {
       projectRuntime.configuration.deferred = deferredWorkspaceConfiguration;
     }
     if (currentWorkerSocket === ws) currentWorkerSocket = null;
+    abortPendingReservations("Worker connection closed before command start");
     workerRecoveryId = "reconnecting";
     const reason = event.reason ? `: ${event.reason}` : "";
     process.stderr.write(`[r5d-worker] disconnected (${event.code}${reason})
@@ -6968,6 +7264,11 @@ async function startWorker(options, projectRuntime = {
   });
 }
 function installWorkerRuntimeFailureLogging() {
+  installWorkspaceFilesystemExecutorFailureHandler((error) => {
+    process.stderr.write(`[r5d-worker] ${error.message}; restarting the worker runtime
+`);
+    void exitWorkerRuntime(WORKER_RECONNECT_EXIT_CODE);
+  });
   process.on("uncaughtException", (error) => {
     process.stderr.write(`[r5d-worker] uncaught exception: ${error instanceof Error ? error.stack ?? error.message : String(error)}
 `);
@@ -6980,11 +7281,6 @@ function installWorkerRuntimeFailureLogging() {
   });
 }
 async function main() {
-  if (process.argv[2] === PROJECT_SNAPSHOT_RECOVERY_HELPER_COMMAND) {
-    const exitCode2 = runProjectSnapshotRecoveryHelper(process.argv.slice(3));
-    if (exitCode2 !== 0) process.exit(exitCode2);
-    return;
-  }
   const parsed = parseArgs(process.argv.slice(2));
   if (parsed.command === "help") {
     printHelp();