@ricsam/r5d-worker 0.0.122 → 0.0.124

package/dist/cjs/main.cjs

@@ -61,6 +61,8 @@ var import_plan_paths = require("./plan-paths.cjs");
 var import_plan_parser = require("./plan-parser.cjs");
 var import_plan_lint = require("./plan-lint.cjs");
 var import_node_fs = __toESM(require("node:fs"), 1);
+var import_recovery_journal = require("./recovery-journal.cjs");
+var import_session_file_mutations = require("./session-file-mutations.cjs");
 var import_recovery_store = require("./recovery-store.cjs");
 var import_recovery_output_window = require("./recovery-output-window.cjs");
 var import_command_launcher = require("./command-launcher.cjs");
@@ -75,6 +77,7 @@ var import_cli_update = require("./cli-update.cjs");
 var import_git_process_environment = require("./git-process-environment.cjs");
 var import_process_tree = require("./process-tree.cjs");
 var import_project_checkout_garbage = require("./project-checkout-garbage.cjs");
+var import_control_command_policy = require("./control-command-policy.cjs");
 var import_pty_output_coalescer = require("./pty-output-coalescer.cjs");
 var import_port_forward_client = require("./port-forward-client.cjs");
 var import_registry_auth = require("./registry-auth.cjs");
@@ -82,6 +85,8 @@ var import_workspace_incident_state = require("./workspace-incident-state.cjs");
 var import_workspace_automatic_sync_policy = require("./workspace-automatic-sync-policy.cjs");
 var import_workspace_command_sync_policy = require("./workspace-command-sync-policy.cjs");
 var import_workspace_mutation_gate = require("./workspace-mutation-gate.cjs");
+var import_workspace_mount_hold_fence = require("./workspace-mount-hold-fence.cjs");
+var import_workspace_filesystem_executor = require("./workspace-filesystem-executor.cjs");
 var import_workspace_projection_ledger = require("./workspace-projection-ledger.cjs");
 var import_workspace_sync_coalescer = require("./workspace-sync-coalescer.cjs");
 var import_workspace_path_move = require("./workspace-path-move.cjs");
@@ -94,7 +99,6 @@ var import_supervisor = require("./supervisor.cjs");
 var import_managed_paths = require("./managed-paths.cjs");
 var import_project_worktrees = require("./project-worktrees.cjs");
 var import_project_mirror_fetch_policy = require("./project-mirror-fetch-policy.cjs");
-var import_project_snapshot_recovery_runner = require("./project-snapshot-recovery-runner.cjs");
 var import_project_workspace_state = require("./project-workspace-state.cjs");
 var import_workspace_git_sync = require("./workspace-git-sync.cjs");
 const import_meta = {};
@@ -110,7 +114,7 @@ function workerServerHeartbeatAction(input) {
   return input.probeElapsedMs >= input.timeoutMs ? "terminate" : "wait";
 }
 const WORKSPACE_HYDRATION_LEASE_OPERATION_PREFIX = "hydration:";
-function createWorkspaceHydrationLeaseHooks(send, options = {}) {
+function createWorkspaceHydrationLeaseHooks(send, options) {
   const yieldToEventLoop = options.yieldToEventLoop ?? (() => new Promise((resolve) => setImmediate(resolve)));
   const log = options.log ?? ((line) => process.stdout.write(`${line}
 `));
@@ -131,13 +135,17 @@ function createWorkspaceHydrationLeaseHooks(send, options = {}) {
       log(
         `[r5d-worker] released hydration lease ${context.transactionId} after ${startedAt === void 0 ? "?" : Math.round(now() - startedAt)}ms`
       );
+    },
+    holdMounts(mountIds, description) {
+      return options.fence.hold(mountIds, description);
     }
   };
 }
 const workerLifecycleTestHarness = {
   boundedWorkerLifecycleProgress,
   workerServerHeartbeatAction,
-  createWorkspaceHydrationLeaseHooks
+  createWorkspaceHydrationLeaseHooks,
+  workerCommandHasWorkspaceEffect
 };
 class ProjectWorkspaceConfigurationDeferredError extends Error {
 }
@@ -158,6 +166,26 @@ const PTY_FOREGROUND_POLL_MS = 1e3;
 const PTY_FOREGROUND_IDLE_ENABLED = process.env.R5D_PTY_FOREGROUND_IDLE !== "0";
 const PTY_TMP_PATH_PREFIX = "r5d-worker-tmp://";
 let workerCommandLauncher;
+const trustedControlPath = process.env.PATH;
+let capacityReportTimer;
+let capacityReportSocket = null;
+let lastCapacityReport;
+function scheduleCapacityReport(force = false) {
+  if (force) lastCapacityReport = void 0;
+  if (capacityReportTimer) return;
+  capacityReportTimer = setTimeout(() => {
+    capacityReportTimer = void 0;
+    const ws = capacityReportSocket;
+    if (!ws || ws.readyState !== WebSocket.OPEN || !workerCommandLauncher) return;
+    const capacity = { ...workerCommandLauncher.capacityReport(), reportedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    const { reportedAt: _reportedAt, ...comparable } = capacity;
+    const serialized = JSON.stringify(comparable);
+    if (serialized === lastCapacityReport) return;
+    lastCapacityReport = serialized;
+    sendWorkerMessage(ws, { type: "capacity_report", capacity });
+  }, 100);
+  capacityReportTimer.unref?.();
+}
 const activeProcesses = /* @__PURE__ */ new Map();
 const credentialBearingProcessGroups = /* @__PURE__ */ new Map();
 const credentialBearingProcessGroupTargets = /* @__PURE__ */ new Map();
@@ -170,7 +198,7 @@ const workspaceSyncPriorityPtyTargets = /* @__PURE__ */ new Map();
 let currentWorkerSocket = null;
 const workerRuntimeId = crypto.randomUUID();
 const workerOutputWindow = new import_recovery_output_window.WorkerOutputWindow();
-let recoveryStore;
+let recoveryJournal;
 let workerReconnectAttempt = 0;
 let workerRecoveryId;
 let workerExecutionLeaseDeadline = 0;
@@ -182,13 +210,13 @@ let runtimeExitPromise;
 function fenceWorkerRuntimeOperations() {
   launcherFailureInProgress = true;
   workerAdmissionGeneration += 1;
-  for (const operation of recoveryStore?.operations() ?? []) {
-    if (operation.state !== "completed") recoveryStore?.unknown(operation.requestId);
+  for (const operation of recoveryJournal?.activeAndPendingOperations() ?? []) {
+    if (operation.state !== "completed") recoveryJournal?.unknown(operation.requestId);
   }
   for (const runId of workerCommandLauncher?.activeIds ?? []) {
     infrastructureStoppedRunIds.add(runId);
     cancelledProcessRuns.add(runId);
-    recoveryStore?.unknownRun(runId);
+    recoveryJournal?.unknownRun(runId);
   }
   for (const runId of activeProcesses.keys()) infrastructureStoppedRunIds.add(runId);
 }
@@ -197,13 +225,21 @@ function exitWorkerRuntime(code) {
   fenceWorkerRuntimeOperations();
   runtimeExitPromise = (async () => {
     await Promise.race([
-      Promise.allSettled([terminateActiveCredentialBearingChildren(), workerCommandLauncher?.close()]),
+      Promise.allSettled([terminateActiveCredentialBearingChildren(), workerCommandLauncher?.close(), recoveryJournal?.flush()]),
       Bun.sleep(4e3)
     ]);
     process.exit(code);
   })();
   return runtimeExitPromise;
 }
+function handleRecoveryJournalFailure(error) {
+  if (launcherFailureInProgress) return;
+  fenceWorkerRuntimeOperations();
+  process.stderr.write(`[r5d-worker] ${error.message}; stopping runtime for recovery journal restart
+`);
+  currentWorkerSocket?.close(1012, "Recovery journal failure");
+  void exitWorkerRuntime(import_supervisor.WORKER_RECONNECT_EXIT_CODE);
+}
 function handleWorkerCommandLauncherFailure(error) {
   if (!workerCommandLauncher || launcherFailureInProgress) return;
   fenceWorkerRuntimeOperations();
@@ -224,7 +260,7 @@ async function retryWorkerServerRead(read) {
     try {
       return await read();
     } catch (error) {
-      if (!recoveryStore || !isWorkerCommunicationFailure(error instanceof Error ? error.message : String(error))) throw error;
+      if (!recoveryJournal || !isWorkerCommunicationFailure(error instanceof Error ? error.message : String(error))) throw error;
       deadline ??= Date.now() + import_recovery_protocol.WORKER_RECOVERY_TIMEOUT_MS;
       if (workerLeaseExpired || Date.now() >= deadline) throw new WorkerServerUnavailableError("Worker communication recovery expired");
       currentWorkerSocket?.close(1012, "Communication recovery");
@@ -246,9 +282,10 @@ function renewWorkerExecutionLease(leaseMs) {
 `);
       });
       closeAllPtys();
-      for (const operation of recoveryStore?.operations() ?? []) {
+      for (const operation of recoveryJournal?.activeAndPendingOperations() ?? []) {
         if (operation.sessionId && operation.state !== "completed") {
-          recoveryStore?.cancelSession(operation.sessionId);
+          void recoveryJournal?.cancelSession(operation.sessionId);
+          abortPendingReservations("Execution lease expired before command start", operation.sessionId);
           void workerCommandLauncher?.cancelSession(operation.sessionId).catch((error) => {
             process.stderr.write(`[r5d-worker] expired command launcher cancellation failed: ${error}
 `);
@@ -258,7 +295,7 @@ function renewWorkerExecutionLease(leaseMs) {
       for (const [runId, active] of activeProcesses) {
         if (!active.sessionId) continue;
         infrastructureStoppedRunIds.add(runId);
-        recoveryStore?.unknownRun(runId);
+        recoveryJournal?.unknownRun(runId);
         cancelledProcessRuns.add(runId);
         closeProcessStdin(active);
         void (0, import_process_tree.terminateProcessTree)(active.process).catch(
@@ -273,6 +310,31 @@ function renewWorkerExecutionLease(leaseMs) {
 }
 let workerAdmissionGeneration = 0;
 const workspaceMutationGate = new import_workspace_mutation_gate.WorkspaceMutationGate();
+const workspaceMountHoldFence = new import_workspace_mount_hold_fence.WorkspaceMountHoldFence();
+const projectMountId = (projectId, branchName) => `project:${projectId}:${encodeURIComponent(branchName)}`;
+const pendingReservationAborts = /* @__PURE__ */ new Map();
+const sessionFileMutations = new import_session_file_mutations.SessionFileMutationTracker();
+function registerPendingReservation(key, sessionId) {
+  abortPendingReservation(key, "Reservation superseded by a newer request with the same id");
+  const controller = new AbortController();
+  pendingReservationAborts.set(key, { controller, sessionId });
+  return controller;
+}
+function unregisterPendingReservation(key, controller) {
+  if (pendingReservationAborts.get(key)?.controller === controller) pendingReservationAborts.delete(key);
+}
+function abortPendingReservation(key, reason) {
+  const pending = pendingReservationAborts.get(key);
+  if (!pending) return;
+  pendingReservationAborts.delete(key);
+  pending.controller.abort(new import_workspace_mount_hold_fence.WorkspaceMountHoldAbortedError(reason));
+}
+function abortPendingReservations(reason, sessionId) {
+  for (const [key, pending] of [...pendingReservationAborts]) {
+    if (sessionId !== void 0 && pending.sessionId !== sessionId) continue;
+    abortPendingReservation(key, reason);
+  }
+}
 let workspaceSyncQueue = Promise.resolve();
 let startupProjectSnapshotRecoveryCompleted = false;
 const checkoutGarbageCollectors = /* @__PURE__ */ new Map();
@@ -307,6 +369,17 @@ const workspaceSyncSingleFlight = {
   },
   afterCurrent() {
     return workspaceSyncQueue;
+  },
+  mountHold(target, signal) {
+    if (target.type !== "project") return null;
+    const mountIds = [projectMountId(target.projectId, target.branchName)];
+    if (!workspaceMountHoldFence.isHeld(mountIds)) return null;
+    const holder = workspaceMountHoldFence.describeHold(mountIds);
+    process.stdout.write(
+      `[r5d-worker] command for ${target.projectId}/${target.branchName} waits for ${holder ?? "a workspace filesystem job"}
+`
+    );
+    return workspaceMountHoldFence.waitForRelease(mountIds, { signal });
   }
 };
 let githubCredential = null;
@@ -963,14 +1036,15 @@ async function runGitAsync(args, options = {}) {
     env: (0, import_git_process_environment.workerGitProcessEnvironment)(),
     ...bounded ? { detached: true } : {}
   });
-  const completion = Promise.all([
-    new Response(subprocess.stdout).text(),
-    new Response(subprocess.stderr).text(),
-    subprocess.exited
-  ]).then(([stdout, stderr, exitCode]) => ({ stdout, stderr, exitCode }));
+  const completion = Promise.all([new Response(subprocess.stdout).text(), new Response(subprocess.stderr).text(), subprocess.exited]).then(
+    ([stdout, stderr, exitCode]) => ({ stdout, stderr, exitCode })
+  );
   let timer;
   const timedOut = bounded ? new Promise((_resolve, reject) => {
-    timer = setTimeout(() => reject(new GitTransportTimeoutError(`git ${args.join(" ")} timed out after ${options.timeoutMs}ms`)), options.timeoutMs);
+    timer = setTimeout(
+      () => reject(new GitTransportTimeoutError(`git ${args.join(" ")} timed out after ${options.timeoutMs}ms`)),
+      options.timeoutMs
+    );
   }) : null;
   try {
     const { stdout, stderr, exitCode } = timedOut ? await Promise.race([completion, timedOut]) : await completion;
@@ -2059,12 +2133,12 @@ async function streamCommandOutput(stream, onData) {
       }
       const text = decoder.decode(chunk.value, { stream: true });
       if (text.length > 0) {
-        onData(text);
+        await onData(text);
       }
     }
     const trailing = decoder.decode();
     if (trailing.length > 0) {
-      onData(trailing);
+      await onData(trailing);
     }
   } finally {
     reader.releaseLock();
@@ -2203,12 +2277,21 @@ function mutationQueueKey(target, resolved) {
   }
   return `${describeWorkerSessionTarget(target)}:${import_node_path.default.posix.normalize(resolved.repoRelativePath)}`;
 }
-function readWorkerTextFile(branchPath, filePath, offset, limit, builtInPaths) {
+async function statIfExists(targetPath) {
+  try {
+    return await import_node_fs.default.promises.stat(targetPath);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return null;
+    throw error;
+  }
+}
+async function readWorkerTextFile(branchPath, filePath, offset, limit, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
-  if (!import_node_fs.default.existsSync(resolved.absolutePath) || !import_node_fs.default.statSync(resolved.absolutePath).isFile()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isFile()) {
     throw new Error(`File not found: ${resolved.displayPath}`);
   }
-  const buffer = import_node_fs.default.readFileSync(resolved.absolutePath);
+  const buffer = await import_node_fs.default.promises.readFile(resolved.absolutePath);
   const formatted = formatLineNumberedContent(buffer.toString("utf8"), offset, limit);
   return {
     type: "read",
@@ -2218,25 +2301,25 @@ function readWorkerTextFile(branchPath, filePath, offset, limit, builtInPaths) {
     ...formatted
   };
 }
-function writeWorkerTextFile(branchPath, filePath, content, builtInPaths) {
+async function writeWorkerTextFile(branchPath, filePath, content, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
-  import_node_fs.default.mkdirSync(import_node_path.default.dirname(resolved.absolutePath), { recursive: true });
-  import_node_fs.default.writeFileSync(resolved.absolutePath, content, "utf8");
+  await import_node_fs.default.promises.mkdir(import_node_path.default.dirname(resolved.absolutePath), { recursive: true });
+  await import_node_fs.default.promises.writeFile(resolved.absolutePath, content, "utf8");
   return {
     type: "write",
     file: resolved.displayPath,
     gitBlobHash: getGitBlobHashForContent(content)
   };
 }
-function editWorkerTextFile(branchPath, filePath, edits, builtInPaths) {
+async function editWorkerTextFile(branchPath, filePath, edits, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
   if (!Array.isArray(edits) || edits.length === 0) {
     throw new Error("edit requires at least one replacement");
   }
-  if (!import_node_fs.default.existsSync(resolved.absolutePath) || !import_node_fs.default.statSync(resolved.absolutePath).isFile()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isFile()) {
     throw new Error(`File not found: ${resolved.displayPath}`);
   }
-  const originalContent = import_node_fs.default.readFileSync(resolved.absolutePath, "utf8");
+  const originalContent = await import_node_fs.default.promises.readFile(resolved.absolutePath, "utf8");
   const ranges = edits.map((edit, index) => {
     if (edit.oldText === edit.newText) {
       throw new Error(`edits[${index}].oldText and edits[${index}].newText must be different`);
@@ -2268,7 +2351,7 @@ function editWorkerTextFile(branchPath, filePath, edits, builtInPaths) {
   for (const range of [...sortedRanges].reverse()) {
     nextContent = nextContent.slice(0, range.start) + range.edit.newText + nextContent.slice(range.end);
   }
-  import_node_fs.default.writeFileSync(resolved.absolutePath, nextContent, "utf8");
+  await import_node_fs.default.promises.writeFile(resolved.absolutePath, nextContent, "utf8");
   return {
     type: "edit",
     file: resolved.displayPath,
@@ -2301,7 +2384,7 @@ async function executePlanOperation(input) {
       let created = false;
       if (message.createIfMissing) {
         try {
-          import_node_fs.default.writeFileSync(resolved.absolutePath, (0, import_plan_parser.createPlanMarkdown)(message.planId), { encoding: "utf8", flag: "wx" });
+          await import_node_fs.default.promises.writeFile(resolved.absolutePath, (0, import_plan_parser.createPlanMarkdown)(message.planId), { encoding: "utf8", flag: "wx" });
           created = true;
         } catch (error) {
           if (error.code !== "EEXIST") throw error;
@@ -2310,11 +2393,16 @@ async function executePlanOperation(input) {
       return {
         type: "read_plan",
         created,
-        read: readWorkerTextFile(resolvedTarget.rootPath, filePath, void 0, void 0, builtInPaths)
+        read: await readWorkerTextFile(resolvedTarget.rootPath, filePath, void 0, void 0, builtInPaths)
       };
     }
-    const content = import_node_fs.default.readFileSync(resolved.absolutePath, "utf8");
-    writeWorkerTextFile(resolvedTarget.rootPath, filePath, (0, import_plan_parser.updateTaskCheckbox)(content, message.taskId, message.checked), builtInPaths);
+    const content = await import_node_fs.default.promises.readFile(resolved.absolutePath, "utf8");
+    await writeWorkerTextFile(
+      resolvedTarget.rootPath,
+      filePath,
+      (0, import_plan_parser.updateTaskCheckbox)(content, message.taskId, message.checked),
+      builtInPaths
+    );
     return {
       type: "update_task_status",
       planId: message.planId,
@@ -2335,7 +2423,11 @@ async function executeReadFileOperation(input) {
     rootDir: input.rootDir,
     access: "read"
   });
-  return readWorkerTextFile(input.resolvedTarget.rootPath, input.message.filePath, input.message.offset, input.message.limit, builtInPaths);
+  const resolved = resolveWorkerFilePath(input.resolvedTarget.rootPath, input.message.filePath, builtInPaths);
+  return withFileMutationQueue(
+    mutationQueueKey(input.resolvedTarget.target, resolved),
+    () => readWorkerTextFile(input.resolvedTarget.rootPath, input.message.filePath, input.message.offset, input.message.limit, builtInPaths)
+  );
 }
 async function executeWriteFileOperation(input) {
   const builtInPaths = await prepareBuiltInToolPathsForTarget({
@@ -2388,16 +2480,16 @@ function wildcardToRegex(pattern) {
 function normalizeFindPattern(pattern) {
   return /[*?]/.test(pattern) ? pattern : `*${pattern}*`;
 }
-function walkWorkerEntries(branchPath, start) {
+async function walkWorkerEntries(branchPath, start) {
   const entries = [];
   const visitedDirectories = /* @__PURE__ */ new Set();
-  const realVirtualRoot = start.scope === "virtual" ? import_node_fs.default.realpathSync(start.virtualRootPath) : null;
-  const visit = (absolutePath, isRoot) => {
+  const realVirtualRoot = start.scope === "virtual" ? await import_node_fs.default.promises.realpath(start.virtualRootPath) : null;
+  const visit = async (absolutePath, isRoot) => {
     let stat;
     try {
-      stat = import_node_fs.default.statSync(absolutePath);
+      stat = await import_node_fs.default.promises.stat(absolutePath);
       if (realVirtualRoot) {
-        assertInsideRoot(realVirtualRoot, import_node_fs.default.realpathSync(absolutePath), `${start.displayPath} path`);
+        assertInsideRoot(realVirtualRoot, await import_node_fs.default.promises.realpath(absolutePath), `${start.displayPath} path`);
       }
     } catch (error) {
       if (isRoot) throw error;
@@ -2410,7 +2502,7 @@ function walkWorkerEntries(branchPath, start) {
     if (!stat.isDirectory()) return;
     let realDirectoryPath;
     try {
-      realDirectoryPath = import_node_fs.default.realpathSync(absolutePath);
+      realDirectoryPath = await import_node_fs.default.promises.realpath(absolutePath);
     } catch (error) {
       if (isRoot) throw error;
       return;
@@ -2419,25 +2511,25 @@ function walkWorkerEntries(branchPath, start) {
     visitedDirectories.add(realDirectoryPath);
     let children;
     try {
-      children = import_node_fs.default.readdirSync(absolutePath, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      children = (await import_node_fs.default.promises.readdir(absolutePath, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
     } catch (error) {
       if (isRoot) throw error;
       return;
     }
     for (const child of children) {
       if (IGNORED_ENTRY_NAMES.has(child.name)) continue;
-      visit(import_node_path.default.join(absolutePath, child.name), false);
+      await visit(import_node_path.default.join(absolutePath, child.name), false);
     }
   };
-  visit(start.absolutePath, true);
+  await visit(start.absolutePath, true);
   return entries;
 }
 function isProbablyText(bytes) {
   return !bytes.subarray(0, Math.min(bytes.length, 4096)).includes(0);
 }
-function grepWorkerFiles(branchPath, input, builtInPaths) {
+async function grepWorkerFiles(branchPath, input, builtInPaths) {
   const start = resolveWorkerFilePath(branchPath, input.path ?? ".", builtInPaths);
-  if (!import_node_fs.default.existsSync(start.absolutePath)) {
+  if (!await statIfExists(start.absolutePath)) {
     throw new Error(`Path not found: ${start.displayPath}`);
   }
   const limit = normalizeToolLimit(input.limit, 100, 1e3);
@@ -2447,12 +2539,12 @@ function grepWorkerFiles(branchPath, input, builtInPaths) {
   const lines = [];
   let matchCount = 0;
   let truncated = false;
-  for (const entry of walkWorkerEntries(branchPath, start)) {
+  for (const entry of await walkWorkerEntries(branchPath, start)) {
     if (!entry.stat.isFile()) continue;
     if (globRegex && !globRegex.test(entry.matchPath)) continue;
     let bytes;
     try {
-      bytes = import_node_fs.default.readFileSync(entry.absolutePath);
+      bytes = await import_node_fs.default.promises.readFile(entry.absolutePath);
     } catch {
       continue;
     }
@@ -2505,9 +2597,9 @@ async function executeGrepOperation(input) {
     builtInPaths
   );
 }
-function findWorkerFiles(branchPath, input, builtInPaths) {
+async function findWorkerFiles(branchPath, input, builtInPaths) {
   const start = resolveWorkerFilePath(branchPath, input.path ?? ".", builtInPaths);
-  if (!import_node_fs.default.existsSync(start.absolutePath) || !import_node_fs.default.statSync(start.absolutePath).isDirectory()) {
+  if (!(await statIfExists(start.absolutePath))?.isDirectory()) {
     throw new Error(`Directory not found: ${start.displayPath}`);
   }
   const pattern = normalizeFindPattern(input.pattern ?? "*");
@@ -2517,7 +2609,7 @@ function findWorkerFiles(branchPath, input, builtInPaths) {
   const matches = [];
   let count = 0;
   let truncated = false;
-  for (const entry of walkWorkerEntries(branchPath, start)) {
+  for (const entry of await walkWorkerEntries(branchPath, start)) {
     if (entry.absolutePath === start.absolutePath) continue;
     const isDirectory = entry.stat.isDirectory();
     if (entryType === "file" && !entry.stat.isFile()) continue;
@@ -2562,13 +2654,13 @@ async function executeFindOperation(input) {
     builtInPaths
   );
 }
-function listWorkerDirectory(branchPath, inputPath = ".", inputLimit, builtInPaths) {
+async function listWorkerDirectory(branchPath, inputPath = ".", inputLimit, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, inputPath, builtInPaths);
-  if (!import_node_fs.default.existsSync(resolved.absolutePath) || !import_node_fs.default.statSync(resolved.absolutePath).isDirectory()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isDirectory()) {
     throw new Error(`Directory not found: ${resolved.displayPath}`);
   }
   const limit = normalizeToolLimit(inputLimit, 200, 1e3);
-  const entries = import_node_fs.default.readdirSync(resolved.absolutePath, { withFileTypes: true }).filter((entry) => !IGNORED_ENTRY_NAMES.has(entry.name)).sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name));
+  const entries = (await import_node_fs.default.promises.readdir(resolved.absolutePath, { withFileTypes: true })).filter((entry) => !IGNORED_ENTRY_NAMES.has(entry.name)).sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name));
   const displayed = entries.slice(0, limit).map((entry) => `${entry.name}${entry.isDirectory() ? "/" : ""}`);
   const truncated = entries.length > displayed.length;
   const hint = truncated ? "\n... truncated. Increase limit to continue." : "";
@@ -2619,36 +2711,40 @@ function resolveWorkerCodePath(branchPath, inputPath) {
   }
   return { absolutePath, displayPath };
 }
-function listWorkerCodeDirectory(branchPath, inputPath) {
+async function listWorkerCodeDirectory(branchPath, inputPath) {
   const resolved = resolveWorkerCodePath(branchPath, inputPath);
-  if (!import_node_fs.default.statSync(resolved.absolutePath).isDirectory()) {
+  if (!(await import_node_fs.default.promises.stat(resolved.absolutePath)).isDirectory()) {
     throw new Error(`Code directory not found: ${resolved.displayPath}`);
   }
-  const entries = import_node_fs.default.readdirSync(resolved.absolutePath, { withFileTypes: true }).filter((entry) => entry.name.toLowerCase() !== ".git").flatMap((entry) => {
+  const listed = (await import_node_fs.default.promises.readdir(resolved.absolutePath, { withFileTypes: true })).filter(
+    (entry) => entry.name.toLowerCase() !== ".git"
+  );
+  const entries = [];
+  for (const entry of listed) {
     const entryPath = import_node_path.default.posix.join(resolved.displayPath, entry.name);
     try {
       const resolvedEntry = resolveWorkerCodePath(branchPath, entryPath);
-      const stats = import_node_fs.default.statSync(resolvedEntry.absolutePath);
-      if (!stats.isFile() && !stats.isDirectory()) return [];
-      return [
-        {
-          name: entry.name,
-          type: stats.isDirectory() ? "directory" : "file",
-          size: stats.isDirectory() ? null : stats.size,
-          mtime: stats.mtime.toISOString()
-        }
-      ];
+      const stats = await import_node_fs.default.promises.stat(resolvedEntry.absolutePath);
+      if (!stats.isFile() && !stats.isDirectory()) continue;
+      entries.push({
+        name: entry.name,
+        type: stats.isDirectory() ? "directory" : "file",
+        size: stats.isDirectory() ? null : stats.size,
+        mtime: stats.mtime.toISOString()
+      });
     } catch {
-      return [];
     }
-  }).sort((left, right) => Number(right.type === "directory") - Number(left.type === "directory") || left.name.localeCompare(right.name));
+  }
+  entries.sort(
+    (left, right) => Number(right.type === "directory") - Number(left.type === "directory") || left.name.localeCompare(right.name)
+  );
   return { type: "code_list", path: resolved.displayPath, entries };
 }
-function readWorkerCodeFile(branchPath, inputPath) {
+async function readWorkerCodeFile(branchPath, inputPath) {
   const resolved = resolveWorkerCodePath(branchPath, inputPath);
-  const stats = import_node_fs.default.statSync(resolved.absolutePath);
+  const stats = await import_node_fs.default.promises.stat(resolved.absolutePath);
   if (!stats.isFile()) throw new Error(`Code file not found: ${resolved.displayPath}`);
-  const bytes = import_node_fs.default.readFileSync(resolved.absolutePath);
+  const bytes = await import_node_fs.default.promises.readFile(resolved.absolutePath);
   return {
     type: "code_read",
     path: resolved.displayPath,
@@ -2657,17 +2753,17 @@ function readWorkerCodeFile(branchPath, inputPath) {
     base64: bytes.toString("base64")
   };
 }
-function executeCodeListOperation(input) {
+async function executeCodeListOperation(input) {
   if (input.resolvedTarget.target.type !== "project") throw new Error("Code listing requires a project branch target");
   return listWorkerCodeDirectory(input.resolvedTarget.rootPath, input.message.path);
 }
-function executeCodeReadOperation(input) {
+async function executeCodeReadOperation(input) {
   if (input.resolvedTarget.target.type !== "project") throw new Error("Code reading requires a project branch target");
   return readWorkerCodeFile(input.resolvedTarget.rootPath, input.message.path);
 }
-function readWorkerImageFile(branchPath, filePath, builtInPaths) {
+async function readWorkerImageFile(branchPath, filePath, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
-  if (!import_node_fs.default.existsSync(resolved.absolutePath) || !import_node_fs.default.statSync(resolved.absolutePath).isFile()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isFile()) {
     throw new Error(`File not found: ${resolved.displayPath}`);
   }
   const extension = import_node_path.default.extname(resolved.absolutePath).toLowerCase();
@@ -2675,7 +2771,7 @@ function readWorkerImageFile(branchPath, filePath, builtInPaths) {
   if (!mediaType) {
     throw new Error("read supports PNG and JPEG image inputs only");
   }
-  const bytes = import_node_fs.default.readFileSync(resolved.absolutePath);
+  const bytes = await import_node_fs.default.promises.readFile(resolved.absolutePath);
   const dimensions = readImageDimensions(bytes, mediaType);
   return {
     type: "view_file_bytes",
@@ -2775,6 +2871,10 @@ function cancelWorkerCommandLaunch(resources) {
   });
 }
 async function acquireWorkerCommandLaunch(ws, message, assertAdmission) {
+  if (message.type === "exec_start" && message.commandClass === "control") {
+    (0, import_control_command_policy.assertControlCommandArgv)(message.argv);
+    if (message.interactive) throw new Error("Control commands cannot be interactive");
+  }
   const id = message.type === "pty_open" ? `pty:${message.ptyId}` : message.runId;
   const operationId = message.type === "pty_open" ? id : `exec:${id}`;
   sendWorkerMessage(ws, { type: "heartbeat_lease", operationId, active: true });
@@ -2783,6 +2883,7 @@ async function acquireWorkerCommandLaunch(ws, message, assertAdmission) {
       id,
       kind: message.type,
       ..."workspaceEffect" in message && message.workspaceEffect === "none" ? { workspaceEffect: "none" } : {},
+      ...message.type === "exec_start" && message.commandClass === "control" ? { commandClass: "control" } : {},
       ..."sessionId" in message && message.sessionId ? { sessionId: message.sessionId } : {},
       assertAdmission: () => {
         assertAdmission();
@@ -2930,8 +3031,17 @@ async function executeStreamingCommand(input) {
     });
     const cwd = resolveCommandCwd(input.resolvedTarget.rootPath, input.message.cwd);
     const interactive = input.message.interactive === true;
+    const control = input.message.commandClass === "control";
+    let argv = input.message.argv;
+    let environment = workerChildProcessEnvironment([githubProcessEnv(), input.message.env ?? {}, targetProcessEnv2]);
+    if (control) {
+      (0, import_control_command_policy.assertControlCommandArgv)(argv);
+      if (interactive) throw new Error("Control commands cannot be interactive");
+      argv = [(0, import_control_command_policy.resolveControlCommandExecutable)(trustedControlPath, (program, options) => Bun.which(program, options)), ...argv.slice(1)];
+      environment = (0, import_control_command_policy.controlCommandEnvironment)(environment, trustedControlPath);
+    }
     input.assertAdmission();
-    const subprocess = Bun.spawn(input.resources.wrap(input.message.argv), {
+    const subprocess = Bun.spawn(input.resources.wrap(argv), {
       cwd,
       // Without an explicit stdin the process reads /dev/null and interactive
       // prompts see immediate EOF; "pipe" keeps stdin open for exec_stdin.
@@ -2939,7 +3049,7 @@ async function executeStreamingCommand(input) {
       stdout: "pipe",
       stderr: "pipe",
       detached: true,
-      env: workerChildProcessEnvironment([githubProcessEnv(), input.message.env ?? {}, targetProcessEnv2])
+      env: environment
     });
     spawnedProcess = subprocess;
     credentialBearingProcessGroups.set(subprocess.pid, subprocess);
@@ -2954,12 +3064,13 @@ async function executeStreamingCommand(input) {
       pid: subprocess.pid,
       processGroupId: process.platform === "win32" ? void 0 : subprocess.pid,
       credentialId: input.message.credentialId,
-      argv: input.message.argv,
+      argv,
       command: input.message.command,
       cwd,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...interactive ? { interactive: true, stdin: subprocess.stdin } : {},
-      ...input.message.workspaceEffect === "none" ? { workspaceEffect: "none" } : {}
+      ...input.message.workspaceEffect === "none" ? { workspaceEffect: "none" } : {},
+      ...control ? { commandClass: "control" } : {}
     });
     settlePreparation();
     started = true;
@@ -2971,7 +3082,8 @@ async function executeStreamingCommand(input) {
       pid: subprocess.pid,
       ...process.platform === "win32" ? {} : { processGroupId: subprocess.pid }
     });
-    if (input.message.timeoutMs) {
+    const timeoutMs = control ? Math.min(input.message.timeoutMs ?? import_control_command_policy.CONTROL_COMMAND_RUNTIME_MS, import_control_command_policy.CONTROL_COMMAND_RUNTIME_MS) : input.message.timeoutMs;
+    if (timeoutMs) {
       timeout = setTimeout(() => {
         timedOut = true;
         cancelWorkerCommandLaunch(input.resources);
@@ -2982,30 +3094,32 @@ async function executeStreamingCommand(input) {
 `
           );
         });
-      }, input.message.timeoutMs);
+      }, timeoutMs);
     }
     const [exitCode] = await Promise.all([
       subprocess.exited,
-      streamCommandOutput(subprocess.stdout, (data) => {
-        sendWorkerMessage(input.ws, {
+      streamCommandOutput(
+        subprocess.stdout,
+        (data) => sendWorkerOutput(input.ws, {
           type: "exec_output",
           runId: input.message.runId,
           stream: "stdout",
           data
-        });
-      }),
-      streamCommandOutput(subprocess.stderr, (data) => {
-        sendWorkerMessage(input.ws, {
+        })
+      ),
+      streamCommandOutput(
+        subprocess.stderr,
+        (data) => sendWorkerOutput(input.ws, {
           type: "exec_output",
           runId: input.message.runId,
           stream: "stderr",
           data
-        });
-      })
+        })
+      )
     ]);
     const diagnostic = await input.resources.diagnose();
     if (diagnostic) {
-      sendWorkerMessage(input.ws, {
+      await sendWorkerOutput(input.ws, {
         type: "exec_output",
         runId: input.message.runId,
         stream: "stderr",
@@ -3077,6 +3191,33 @@ async function reapCompletedCredentialBearingProcessGroup(runId, subprocess) {
     );
   }
 }
+async function cancelProcessRun(runId) {
+  let resourceCancellationError;
+  try {
+    await workerCommandLauncher?.cancel(runId);
+  } catch (error) {
+    resourceCancellationError = error instanceof Error ? error.message : String(error);
+  }
+  const active = activeProcesses.get(runId);
+  let cancelled = resourceCancellationError === void 0;
+  let cancelMessage;
+  if (active) {
+    try {
+      closeProcessStdin(active);
+      await (0, import_process_tree.terminateProcessTree)(active.process);
+      cancelMessage = `Stopped ${active.command}`;
+    } catch (error) {
+      cancelled = false;
+      cancelMessage = `Failed to stop ${active.command}: ${error instanceof Error ? error.message : String(error)}`;
+    }
+  } else {
+    cancelledProcessRuns.add(runId);
+    abortPendingReservation(`run:${runId}`, "Cancellation queued before command start");
+    cancelMessage = "Cancellation queued before command start";
+  }
+  if (resourceCancellationError) cancelMessage += `; job resource termination failed: ${resourceCancellationError}`;
+  return { cancelled, message: cancelMessage };
+}
 function closeProcessStdin(active) {
   if (!active?.stdin) {
     return;
@@ -3102,21 +3243,35 @@ function sendReplayWorkerMessage(ws, message) {
 }
 function sendWorkerMessage(ws, message) {
   if (launcherFailureInProgress) return;
-  if (recoveryStore && "requestId" in message && typeof message.requestId === "string" && recoveryStore.isUnknown(message.requestId))
-    return;
   const transportError = "error" in message && typeof message.error === "string" ? message.error : message.type === "workspace_sync_result" && message.result.outcome === "failed" ? message.result.error : void 0;
-  if (recoveryStore && transportError && isWorkerCommunicationFailure(transportError) && "requestId" in message && typeof message.requestId === "string") {
-    recoveryStore.unknown(message.requestId);
+  if (recoveryJournal && transportError && isWorkerCommunicationFailure(transportError) && "requestId" in message && typeof message.requestId === "string") {
+    recoveryJournal.unknown(message.requestId);
     currentWorkerSocket?.close(1012, "Communication recovery");
     return;
   }
-  const recorded = recoveryStore?.record(message) ?? message;
-  if ((message.type === "exec_exit" || message.type === "exec_error") && infrastructureStoppedRunIds.has(message.runId)) {
-    recoveryStore?.unknownRun(message.runId);
+  if (!recoveryJournal) {
+    sendReplayWorkerMessage(ws, message);
     return;
   }
-  if (message.type === "exec_output" && workerRecoveryId !== void 0) return;
-  sendReplayWorkerMessage(ws, recorded);
+  recoveryJournal.send(message);
+}
+function sendWorkerOutput(ws, frame) {
+  if (launcherFailureInProgress) return Promise.resolve();
+  if (!recoveryJournal) {
+    sendReplayWorkerMessage(ws, frame);
+    return Promise.resolve();
+  }
+  return recoveryJournal.sendOutput(frame);
+}
+function deliverJournaledWorkerMessage(message) {
+  const target = currentWorkerSocket;
+  if ((message.type === "exec_exit" || message.type === "exec_error") && typeof message.runId === "string" && infrastructureStoppedRunIds.has(message.runId)) {
+    recoveryJournal?.unknownRun(message.runId);
+    return true;
+  }
+  if (!target || target.readyState !== WebSocket.OPEN) return false;
+  if (message.type === "exec_output" && workerRecoveryId !== void 0) return false;
+  return sendReplayWorkerMessage(target, message);
 }
 function sendSerializedWorkerMessage(ws, serialized) {
   sendWorkerMessage(ws, JSON.parse(serialized));
@@ -3145,7 +3300,8 @@ function buildActiveProcessReports() {
     ...active.cwd ? { cwd: active.cwd } : {},
     startedAt: active.startedAt,
     ...active.interactive ? { interactive: true } : {},
-    ...active.workspaceEffect === "none" ? { workspaceEffect: "none" } : {}
+    ...active.workspaceEffect === "none" ? { workspaceEffect: "none" } : {},
+    ...active.commandClass ? { commandClass: active.commandClass } : {}
   }));
 }
 function sendActiveProcessReport(ws) {
@@ -3667,6 +3823,7 @@ async function startWorker(options, projectRuntime = {
   validateLabel(label);
   if (!workerCommandLauncher) {
     const launcher = await (0, import_command_launcher.createWorkerCommandLauncher)({
+      onCapacityChange: () => scheduleCapacityReport(),
       configuration: process.env.R5D_WORKER_COMMAND_LAUNCHER,
       env: (0, import_command_launcher.commandLauncherEnvironment)(),
       onFailure: handleWorkerCommandLauncherFailure
@@ -3677,9 +3834,19 @@ async function startWorker(options, projectRuntime = {
 `);
   }
   const rootDir = import_node_path.default.resolve(options.rootDir ?? process.env.R5D_ROOT ?? defaultRootDir());
-  recoveryStore ??= new import_recovery_store.WorkerRecoveryStore(
-    import_node_path.default.join(rootDir, ".worker-recovery", (0, import_node_crypto.createHash)("sha256").update(`${baseUrl}\0${label}`).digest("hex"), "protocol.sqlite")
-  );
+  if (!recoveryJournal) {
+    const journal = await import_recovery_journal.WorkerRecoveryJournal.open({
+      filename: import_node_path.default.join(
+        rootDir,
+        ".worker-recovery",
+        (0, import_node_crypto.createHash)("sha256").update(`${baseUrl}\0${label}`).digest("hex"),
+        "protocol.sqlite"
+      )
+    });
+    journal.deliver = deliverJournaledWorkerMessage;
+    journal.onFailure = handleRecoveryJournalFailure;
+    recoveryJournal = journal;
+  }
   const projectsRoot = import_node_path.default.join(rootDir, "projects");
   const syncRoot = import_node_path.default.join(rootDir, "sync");
   const workspaceShadowRoot = import_node_path.default.join(syncRoot, "workspace");
@@ -3782,7 +3949,6 @@ async function startWorker(options, projectRuntime = {
   const bearerAuthHeader = `Authorization: Bearer ${token}`;
   const workerCredentialUsername = credentialUsernameForAuthHeader(bearerAuthHeader);
   const projectBranchKey = (projectId, branchName) => `${projectId}\0${branchName}`;
-  const projectMountId = (projectId, branchName) => `project:${projectId}:${encodeURIComponent(branchName)}`;
   const projectPlanMountId = (projectId, branchName) => `plan:${projectId}:${encodeURIComponent(branchName)}`;
   const workspaceProjectRelativePath = (projectId, branchName) => import_node_path.default.posix.join("projects", projectId, "branches", encodeURIComponent(branchName));
   const workspacePlanRelativePath = (projectId, branchName) => import_node_path.default.posix.join("plans", projectId, encodeURIComponent(branchName));
@@ -3865,7 +4031,8 @@ async function startWorker(options, projectRuntime = {
       sourcePath: configuredProjectBranchPath(projectsRoot, project, branchName),
       planSourcePath: import_node_path.default.join(planRoot, project.projectId, ...branchName.split("/"))
     }));
-    (0, import_project_worktrees.removeProjectWorktrees)({ projectRoot, branchNames: branches.map(({ branchName }) => branchName) });
+    const removed = (0, import_project_worktrees.removeProjectWorktrees)({ projectsRoot, projectRoot, branchNames: branches.map(({ branchName }) => branchName) });
+    if (removed.stagedForCollectionPath) checkoutGarbageCollector.enqueue(removed.stagedForCollectionPath);
     for (const branch of branches) {
       import_node_fs.default.rmSync(branch.planSourcePath, { recursive: true, force: true });
       const key = projectBranchKey(project.projectId, branch.branchName);
@@ -3953,14 +4120,14 @@ async function startWorker(options, projectRuntime = {
       )
     };
   };
-  const stageDurableWorkspaceDeletions = () => {
+  const stageDurableWorkspaceDeletions = async () => {
     for (const deletion of projectWorkspaceState.pendingTreeDeletions) {
       const cleanupConfig = cleanupConfigForDurableDeletion(deletion);
       if (deletion.kind === "project") {
         if (!deletion.projectDeleted) {
           const nextProject = projectConfigById.get(deletion.projectId);
           if (!nextProject) throw new Error(`Checkout-path move lost desired project ${deletion.projectId}`);
-          (0, import_workspace_path_move.preserveProjectCheckoutPathMove)({
+          await (0, import_workspace_filesystem_executor.workspaceFilesystemExecutor)().run("project_checkout_path_move", {
             oldProjectRoot: deletion.managedPath,
             newProjectRoot: configuredProjectRoot(projectsRoot, nextProject),
             projectsDurabilityRoot: projectsRoot,
@@ -4327,7 +4494,7 @@ async function startWorker(options, projectRuntime = {
           }
         }
         if (transitionReseedRequired) {
-          projectWorkspaceState = projectWorkspaceStateStore.recordEnabledRepositoryTransition({
+          projectWorkspaceState = await projectWorkspaceStateStore.recordEnabledRepositoryTransition({
             projectId: project.projectId,
             transitionId: project.repositoryTransitionId
           });
@@ -4496,7 +4663,7 @@ async function startWorker(options, projectRuntime = {
       )
     ];
     if (publishedTombstoneIds.length > 0) {
-      projectWorkspaceState = projectWorkspaceStateStore.recordTreePublication({
+      projectWorkspaceState = await projectWorkspaceStateStore.recordTreePublication({
         tombstoneIds: publishedTombstoneIds,
         publishedHead
       });
@@ -4515,7 +4682,7 @@ async function startWorker(options, projectRuntime = {
         forgetLocalProjectMirrorRefsTokens(deletion.projectId, deletion.branchName);
       }
       if (deletion.tombstoneId && !deletion.projectDeleted) {
-        projectWorkspaceState = projectWorkspaceStateStore.recordMirrorRefDeletion({
+        projectWorkspaceState = await projectWorkspaceStateStore.recordMirrorRefDeletion({
           tombstoneId: deletion.tombstoneId,
           branchName: deletion.branchName
         });
@@ -4712,7 +4879,10 @@ async function startWorker(options, projectRuntime = {
     };
   };
   const workspaceHydrationTransactionHooks = createWorkspaceHydrationLeaseHooks(
-    (message) => sendWorkerMessageFromCurrentSource(ws, message)
+    (message) => sendWorkerMessageFromCurrentSource(ws, message),
+    {
+      fence: workspaceMountHoldFence
+    }
   );
   const performWorkspaceSync = async (input) => {
     if (!workspaceRemoteUrl || !workspaceCredentialHelper || !workspaceCredentialUsername || !workspaceGitIdentity) {
@@ -5370,7 +5540,7 @@ async function startWorker(options, projectRuntime = {
           (project) => project.preserveOnlyBranches.map(({ branchId, branchName }) => ({ branchId, projectId: project.projectId, branchName }))
         );
         if (!incidentDeferral.incidentId) {
-          projectWorkspaceState = projectWorkspaceStateStore.reconcile({
+          projectWorkspaceState = await projectWorkspaceStateStore.reconcile({
             desiredProjects: message.projects,
             preserveOnlyBranches
           });
@@ -5381,7 +5551,7 @@ async function startWorker(options, projectRuntime = {
               (candidate) => candidate.projectId === project.projectId && candidate.branchName === branch.branchName
             );
             if (pending2 && pending2.branchId === branch.branchId) {
-              projectWorkspaceState = projectWorkspaceStateStore.clearPendingCreatedBranch(pending2);
+              projectWorkspaceState = await projectWorkspaceStateStore.clearPendingCreatedBranch(pending2);
             }
           }
         }
@@ -5549,7 +5719,7 @@ async function startWorker(options, projectRuntime = {
         for (const projectId of [...readyProjectIds]) {
           if (!projectConfigById.has(projectId)) readyProjectIds.delete(projectId);
         }
-        stageDurableWorkspaceDeletions();
+        await stageDurableWorkspaceDeletions();
         const mountsBeforeGit = buildWorkspaceMounts();
         await (0, import_workspace_git_sync.hydrateWorkspaceGitMounts)(
           workspaceShadowRoot,
@@ -5595,7 +5765,12 @@ async function startWorker(options, projectRuntime = {
         const connectSyncMs = Date.now() - connectSyncStartedAtMs;
         const result = syncResult.telemetry ? syncResult : {
           ...syncResult,
-          telemetry: { totalMs: connectSyncMs, queueMs: 0, prepareMs: lastWorkspaceSyncMirrorObservationMs, synchronizeMs: connectSyncMs }
+          telemetry: {
+            totalMs: connectSyncMs,
+            queueMs: 0,
+            prepareMs: lastWorkspaceSyncMirrorObservationMs,
+            synchronizeMs: connectSyncMs
+          }
         };
         assertConfigurationSyncStillAdmitted();
         if (receiptGeneration !== workspaceConfigurationReceiptGeneration) {
@@ -5614,7 +5789,7 @@ async function startWorker(options, projectRuntime = {
             ) ? [deletion.tombstoneId] : []
           );
           if (layoutCleanupIds.length > 0) {
-            projectWorkspaceState = projectWorkspaceStateStore.recordTreePublication({
+            projectWorkspaceState = await projectWorkspaceStateStore.recordTreePublication({
               tombstoneIds: layoutCleanupIds,
               publishedHead
             });
@@ -5721,26 +5896,33 @@ async function startWorker(options, projectRuntime = {
     if (startupProjectSnapshotRecoveryCompleted) return;
     sendLifecycleProgress({ phase: "recovering", operationId, detail: "Checking interrupted workspace transactions" });
     const snapshotRecovery = await workspaceSyncSingleFlight.runExclusive(
-      async () => await (0, import_project_snapshot_recovery_runner.recoverProjectSnapshotsInChild)({
-        projectsRoot,
-        snapshotRoot: projectWorktreeSnapshotsRoot,
-        onProgress: (progress) => {
-          const lifecycleProgress = {
-            phase: "recovering",
-            operationId,
-            detail: describeSnapshotProgress(progress),
-            completedBytes: progress.completedBytes,
-            completedItems: progress.completedBranches,
-            totalItems: progress.totalBranches,
-            ...progress.totalBytes === void 0 ? {} : { totalBytes: progress.totalBytes }
-          };
-          sendLifecycleProgress(lifecycleProgress);
-          process.stdout.write(
-            `[r5d-worker] ${lifecycleProgress.detail}: ${progress.completedBranches}/${progress.totalBranches} branch(es), ${progress.completedBytes}/${progress.totalBytes ?? "?"} bytes
+      async () => await (0, import_workspace_filesystem_executor.workspaceFilesystemExecutor)().run(
+        "project_snapshots_recover",
+        {
+          projectsRoot,
+          temporaryRoot: projectWorktreeSnapshotsRoot,
+          currentProcessId: process.pid,
+          currentOwnerSessionId: import_project_worktrees.PROJECT_WORKTREE_SNAPSHOT_OWNER_SESSION_ID
+        },
+        {
+          onProgress: (progress) => {
+            const lifecycleProgress = {
+              phase: "recovering",
+              operationId,
+              detail: describeSnapshotProgress(progress),
+              completedBytes: progress.completedBytes,
+              completedItems: progress.completedBranches,
+              totalItems: progress.totalBranches,
+              ...progress.totalBytes === void 0 ? {} : { totalBytes: progress.totalBytes }
+            };
+            sendLifecycleProgress(lifecycleProgress);
+            process.stdout.write(
+              `[r5d-worker] ${lifecycleProgress.detail}: ${progress.completedBranches}/${progress.totalBranches} branch(es), ${progress.completedBytes}/${progress.totalBytes ?? "?"} bytes
 `
-          );
+            );
+          }
         }
-      })
+      )
     );
     if (snapshotRecovery.restored.length > 0) {
       process.stdout.write(`[r5d-worker] restored ${snapshotRecovery.restored.length} interrupted project snapshot(s)
@@ -5835,7 +6017,7 @@ async function startWorker(options, projectRuntime = {
       type: "hello",
       resumableProtocol: import_recovery_protocol.WORKER_RESUMABLE_PROTOCOL,
       runtimeId: workerRuntimeId,
-      ledgerId: recoveryStore.ledgerId,
+      ledgerId: recoveryJournal.ledgerId,
       startupReady: startupRecoveryComplete,
       hostInfo: {
         hostname: (0, import_node_os.hostname)(),
@@ -5854,6 +6036,7 @@ async function startWorker(options, projectRuntime = {
           workspaceConfigResetToCanonicalV1: true,
           projectBranchDeletionFastAckV1: true,
           projectBranchDeletionStagedRemovalV1: true,
+          commandControlLaneV1: workerCommandLauncher?.supportsControlLane === true,
           projectMirrorLeaseV1: true,
           projectMirrorRefsTokensV1: true,
           projectBranchWorkingTreeModeV1: true
@@ -5862,16 +6045,39 @@ async function startWorker(options, projectRuntime = {
       }
     };
     sendSerializedWorkerMessage(ws, JSON.stringify(hello));
+    let outputPumpInFlight = false;
     outputReplayTimer = setInterval(() => {
-      if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws) return;
-      for (const output of recoveryStore.output()) {
-        if (!sendReplayWorkerMessage(ws, output)) break;
-      }
+      if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws || outputPumpInFlight || !recoveryJournal) return;
+      outputPumpInFlight = true;
+      void (async () => {
+        try {
+          for await (const page of recoveryJournal.outputReplay(void 0)) {
+            for (const output of page) {
+              if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws || !sendReplayWorkerMessage(ws, output)) return;
+            }
+          }
+        } catch (error) {
+          process.stderr.write(`[r5d-worker] output replay pump failed: ${error instanceof Error ? error.message : String(error)}
+`);
+        } finally {
+          outputPumpInFlight = false;
+        }
+      })();
     }, 250);
     outputReplayTimer.unref();
+    let terminalPumpInFlight = false;
     terminalReplayTimer = setInterval(() => {
-      if (workerRecoveryId !== void 0) return;
-      for (const terminal of recoveryStore?.terminals() ?? []) sendReplayWorkerMessage(ws, terminal);
+      if (workerRecoveryId !== void 0 || terminalPumpInFlight || !recoveryJournal) return;
+      terminalPumpInFlight = true;
+      void recoveryJournal.terminals().then((terminals) => {
+        if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws) return;
+        for (const terminal of terminals) sendReplayWorkerMessage(ws, terminal);
+      }).catch((error) => {
+        process.stderr.write(`[r5d-worker] terminal replay pump failed: ${error instanceof Error ? error.message : String(error)}
+`);
+      }).finally(() => {
+        terminalPumpInFlight = false;
+      });
     }, 5e3);
     terminalReplayTimer.unref();
     process.stdout.write("[r5d-worker] connected\n");
@@ -5884,28 +6090,37 @@ async function startWorker(options, projectRuntime = {
       if (message.type === "recovery_request") {
         workerRecoveryId = message.recoveryId;
         sendActiveProcessReport(ws);
-        sendWorkerMessage(ws, {
-          type: "recovery_state",
-          recoveryId: message.recoveryId,
-          runtimeId: workerRuntimeId,
-          ledgerId: recoveryStore.ledgerId,
-          operations: recoveryStore.operations()
-        });
-        const cursors = new Map(recoveryStore.outputCursors().map((cursor) => [cursor.runId, cursor]));
-        for (const cursor of message.outputOffsets) cursors.set(cursor.runId, cursor);
-        workerOutputWindow.reset([...cursors.values()]);
-        for (const response of recoveryStore.responses(message.requests)) sendReplayWorkerMessage(ws, response);
-        for (const output of recoveryStore.output(message.outputOffsets)) {
-          while (true) {
-            if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId || ws.readyState !== WebSocket.OPEN || workerLeaseExpired)
-              return;
-            if (sendReplayWorkerMessage(ws, output)) break;
-            await Bun.sleep(10);
+        recoveryJournal.pauseDelivery();
+        try {
+          const state = await recoveryJournal.recoveryState(message.requests);
+          if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId) return;
+          sendWorkerMessage(ws, {
+            type: "recovery_state",
+            recoveryId: message.recoveryId,
+            runtimeId: workerRuntimeId,
+            ledgerId: recoveryJournal.ledgerId,
+            operations: state.operations
+          });
+          const cursors = new Map(state.cursors.map((cursor) => [cursor.runId, cursor]));
+          for (const cursor of message.outputOffsets) cursors.set(cursor.runId, cursor);
+          workerOutputWindow.reset([...cursors.values()]);
+          for (const response of state.responses) sendReplayWorkerMessage(ws, response);
+          for await (const page of recoveryJournal.outputReplay(message.outputOffsets)) {
+            for (const output of page) {
+              while (true) {
+                if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId || ws.readyState !== WebSocket.OPEN || workerLeaseExpired)
+                  return;
+                if (sendReplayWorkerMessage(ws, output)) break;
+                await Bun.sleep(10);
+              }
+            }
           }
+          if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId) return;
+          for (const terminal of state.terminals) sendReplayWorkerMessage(ws, terminal);
+          sendWorkerMessage(ws, { type: "recovery_complete", recoveryId: message.recoveryId });
+        } finally {
+          recoveryJournal.resumeDelivery();
         }
-        if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId) return;
-        for (const terminal of recoveryStore.terminals()) sendReplayWorkerMessage(ws, terminal);
-        sendWorkerMessage(ws, { type: "recovery_complete", recoveryId: message.recoveryId });
         return;
       }
       if (message.type === "recovery_ready") {
@@ -5920,17 +6135,23 @@ async function startWorker(options, projectRuntime = {
         return;
       }
       if (message.type === "operation_result_ack") {
-        recoveryStore.acknowledgeResult(message.requestId);
+        recoveryJournal.acknowledgeResult(message.requestId);
         return;
       }
       if (message.type === "exec_output_ack") {
-        recoveryStore.acknowledgeOutput(message.runId, message.stream, message.nextOffset);
+        recoveryJournal.acknowledgeOutput(message.runId, message.stream, message.nextOffset);
         workerOutputWindow.acknowledge(message.runId, message.stream, message.nextOffset);
         return;
       }
       if (message.type === "cancel_session") {
-        recoveryStore.cancelSession(message.sessionId);
+        const durableCancellation = recoveryJournal.cancelSession(message.sessionId);
+        abortPendingReservations("Session cancelled before command start", message.sessionId);
         await Promise.all([
+          durableCancellation,
+          // File writes already in flight for the session settle before the
+          // acknowledgement; queued ones re-check the cancellation before
+          // their first write and never start.
+          sessionFileMutations.settled(message.sessionId),
           workerCommandLauncher?.cancelSession(message.sessionId),
           ...[...activeProcesses].filter(([, active]) => active.sessionId === message.sessionId).map(async ([runId, active]) => {
             cancelledProcessRuns.add(runId);
@@ -5945,27 +6166,74 @@ async function startWorker(options, projectRuntime = {
       if (!startupRecoveryComplete && message.type !== "ping") return;
       if (currentWorkerSocket !== ws) return;
       const operationRequestId = "requestId" in message && typeof message.requestId === "string" && message.type !== "workspace_config" ? message.requestId : void 0;
+      if (message.type === "cancel") {
+        const admission = recoveryJournal.admit({ ...message, requestId: message.requestId });
+        const cancelled = await cancelProcessRun(message.runId);
+        let admitted;
+        try {
+          admitted = await admission;
+        } catch (error) {
+          if (!(error instanceof import_recovery_journal.WorkerRecoveryJournalBusyError)) throw error;
+          process.stderr.write(`[r5d-worker] cancel ${message.runId} stopped the run but was not durably admitted: ${error.message}
+`);
+          return;
+        }
+        if (admitted.admission === "conflict") {
+          ws.close(1008, "Operation identity conflict");
+          return;
+        }
+        sendWorkerMessage(ws, { type: "operation_received", requestId: message.requestId });
+        if (admitted.admission !== "new") {
+          if (admitted.response && admitted.admission !== "unknown") sendReplayWorkerMessage(ws, admitted.response);
+          return;
+        }
+        sendSerializedWorkerMessage(
+          ws,
+          JSON.stringify({
+            type: "cancel_result",
+            requestId: message.requestId,
+            runId: message.runId,
+            cancelled: cancelled.cancelled,
+            message: cancelled.message
+          })
+        );
+        return;
+      }
       if (operationRequestId) {
-        const admission = recoveryStore.admit({ ...message, requestId: operationRequestId });
-        if (admission === "conflict") {
+        let admitted;
+        try {
+          admitted = await recoveryJournal.admit({ ...message, requestId: operationRequestId });
+        } catch (error) {
+          if (!(error instanceof import_recovery_journal.WorkerRecoveryJournalBusyError)) throw error;
+          process.stderr.write(`[r5d-worker] ${message.type} ${operationRequestId} was not admitted: ${error.message}
+`);
+          return;
+        }
+        if (admitted.admission === "conflict") {
           ws.close(1008, "Operation identity conflict");
           return;
         }
         sendWorkerMessage(ws, { type: "operation_received", requestId: operationRequestId });
-        if (admission !== "new") {
-          const response = recoveryStore.response(operationRequestId);
-          if (response && admission !== "unknown") sendReplayWorkerMessage(ws, response);
-          if (!(admission === "unknown" && message.type === "delete_project_branch" && recoveryStore.readmitUnknownBranchDeletion(operationRequestId))) {
+        if (admitted.admission !== "new") {
+          if (admitted.response && admitted.admission !== "unknown") sendReplayWorkerMessage(ws, admitted.response);
+          if (!(admitted.admission === "unknown" && message.type === "delete_project_branch" && await recoveryJournal.readmitUnknownBranchDeletion(
+            operationRequestId,
+            "sessionId" in message && typeof message.sessionId === "string" ? message.sessionId : void 0
+          ))) {
             return;
           }
         }
+        if (recoveryJournal.isRequestCancelled(operationRequestId)) {
+          recoveryJournal.unknown(operationRequestId);
+          return;
+        }
       }
       const messageAdmissionGeneration = workerAdmissionGeneration;
       const admissionCredentials = configuredCredentialGenerationFingerprint;
       const assertMessageAdmission = () => {
         if (operationRequestId) {
-          if (workerLeaseExpired || recoveryStore.isRequestCancelled(operationRequestId) || admissionCredentials !== configuredCredentialGenerationFingerprint || shutdownAfterClose || !workspaceConfigured) {
-            recoveryStore.unknown(operationRequestId);
+          if (workerLeaseExpired || recoveryJournal.isRequestCancelled(operationRequestId) || admissionCredentials !== configuredCredentialGenerationFingerprint || shutdownAfterClose || !workspaceConfigured) {
+            recoveryJournal.unknown(operationRequestId);
             throw new StaleWorkerAdmissionError();
           }
           return;
@@ -5980,6 +6248,8 @@ async function startWorker(options, projectRuntime = {
         });
       };
       if (message.type === "connected") {
+        capacityReportSocket = ws;
+        scheduleCapacityReport(true);
         return;
       }
       if (message.type === "project_mirror_refs_tokens") {
@@ -6100,7 +6370,7 @@ async function startWorker(options, projectRuntime = {
           }
           recoveryDeadline ??= Date.now() + import_recovery_protocol.WORKER_RECOVERY_TIMEOUT_MS;
           if (workerLeaseExpired || Date.now() >= recoveryDeadline) {
-            recoveryStore.unknown(message.requestId);
+            recoveryJournal.unknown(message.requestId);
             return;
           }
           currentWorkerSocket?.close(1012, "Communication recovery");
@@ -6130,7 +6400,7 @@ async function startWorker(options, projectRuntime = {
             projectId: message.projectId,
             branchName: message.targetBranch
           };
-          const created = await workspaceSyncSingleFlight.runBranchMutation(() => {
+          const created = await workspaceSyncSingleFlight.runBranchMutation(async () => {
             if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
               throw new Error(
                 `Project branch creation was fenced while queued by workspace incident ${deferredWorkspaceConfiguration?.incidentId ?? activeWorkspaceIncidentId}`
@@ -6145,7 +6415,7 @@ async function startWorker(options, projectRuntime = {
             const pendingWasRecorded = projectWorkspaceState.locallyPendingCreatedBranches.some(
               ({ projectId, branchName }) => projectId === message.projectId && branchName === message.targetBranch
             );
-            projectWorkspaceState = projectWorkspaceStateStore.recordPendingCreatedBranch(pendingBranch);
+            projectWorkspaceState = await projectWorkspaceStateStore.recordPendingCreatedBranch(pendingBranch);
             let gitBranchCreated = false;
             try {
               if (!readyProjectIds.has(project.projectId)) {
@@ -6166,7 +6436,7 @@ async function startWorker(options, projectRuntime = {
                 }
                 return { branchPath: existingPath, baseCommitHash: existingBranch.baseCommitHash };
               }
-              const createdBranch = (0, import_project_worktrees.createOrRetryLinkedProjectBranch)({
+              const createdBranch = await (0, import_project_worktrees.createOrRetryLinkedProjectBranch)({
                 projectRoot: configuredProjectRoot(projectsRoot, project),
                 primaryBranchName: primaryProjectBranch(project),
                 sourceBranchName: message.sourceBranch,
@@ -6191,7 +6461,7 @@ async function startWorker(options, projectRuntime = {
               return createdBranch;
             } catch (error) {
               if (!pendingWasRecorded && !gitBranchCreated && !(0, import_project_worktrees.projectBranchMayExistAfterCreateFailure)(error)) {
-                projectWorkspaceState = projectWorkspaceStateStore.rollbackPendingCreatedBranch(pendingBranch);
+                projectWorkspaceState = await projectWorkspaceStateStore.rollbackPendingCreatedBranch(pendingBranch);
               }
               throw error;
             }
@@ -6235,7 +6505,7 @@ async function startWorker(options, projectRuntime = {
         });
         try {
           const deletionKey = projectBranchKey(message.projectId, message.branchName);
-          const deletionNeedsSync = await workspaceSyncSingleFlight.runBranchMutation(() => {
+          const deletionNeedsSync = await workspaceSyncSingleFlight.runBranchMutation(async () => {
             if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
               throw new Error(
                 `Project branch deletion was fenced while queued by workspace incident ${deferredWorkspaceConfiguration?.incidentId ?? activeWorkspaceIncidentId}`
@@ -6262,12 +6532,12 @@ async function startWorker(options, projectRuntime = {
             if (!configuredBranch && !pendingLocalBranch && !hasDurableTombstone && !pendingMirrorDeletes.has(deletionKey)) {
               return false;
             }
-            projectWorkspaceState = projectWorkspaceStateStore.beginBranchDeletion({
+            projectWorkspaceState = await projectWorkspaceStateStore.beginBranchDeletion({
               projectId: message.projectId,
               branchName: message.branchName
             });
             if (pendingLocalBranch) {
-              projectWorkspaceState = projectWorkspaceStateStore.clearPendingCreatedBranch(pendingLocalBranch);
+              projectWorkspaceState = await projectWorkspaceStateStore.clearPendingCreatedBranch(pendingLocalBranch);
             }
             pendingCreatedBranchPublicationNotBefore.delete((0, import_workspace_automatic_sync_policy.pendingCreatedBranchKey)(message.projectId, message.branchName));
             if (pendingMirrorDeletes.has(deletionKey)) return true;
@@ -6371,7 +6641,7 @@ async function startWorker(options, projectRuntime = {
       }
       if (message.type === "exec_terminal_ack") {
         pendingProcessTerminals.delete(message.runId);
-        recoveryStore.acknowledgeTerminal(message.runId);
+        recoveryJournal.acknowledgeTerminal(message.runId);
         return;
       }
       if (message.type === "port_forward_connect") {
@@ -6426,42 +6696,6 @@ async function startWorker(options, projectRuntime = {
         sendSerializedWorkerMessage(ws, JSON.stringify({ type: "pong" }));
         return;
       }
-      if (message.type === "cancel") {
-        let resourceCancellationError;
-        try {
-          await workerCommandLauncher?.cancel(message.runId);
-        } catch (error) {
-          resourceCancellationError = error instanceof Error ? error.message : String(error);
-        }
-        const active = activeProcesses.get(message.runId);
-        let cancelled = resourceCancellationError === void 0;
-        let cancelMessage;
-        if (active) {
-          try {
-            closeProcessStdin(active);
-            await (0, import_process_tree.terminateProcessTree)(active.process);
-            cancelMessage = `Stopped ${active.command}`;
-          } catch (error) {
-            cancelled = false;
-            cancelMessage = `Failed to stop ${active.command}: ${error instanceof Error ? error.message : String(error)}`;
-          }
-        } else {
-          cancelledProcessRuns.add(message.runId);
-          cancelMessage = "Cancellation queued before command start";
-        }
-        if (resourceCancellationError) cancelMessage += `; job resource termination failed: ${resourceCancellationError}`;
-        sendSerializedWorkerMessage(
-          ws,
-          JSON.stringify({
-            type: "cancel_result",
-            requestId: message.requestId,
-            runId: message.runId,
-            cancelled,
-            message: cancelMessage
-          })
-        );
-        return;
-      }
       if (message.type === "exec_stdin") {
         const sendAck = (payload) => sendSerializedWorkerMessage(
           ws,
@@ -6542,10 +6776,20 @@ async function startWorker(options, projectRuntime = {
         let mutationLeaseTransferred = false;
         try {
           resources = await acquireWorkerCommandLaunch(ws, message, assertMessageAdmission);
-          await (0, import_workspace_command_sync_policy.reserveWorkspaceCommandAfterCurrentSync)(message.target, workspaceSyncSingleFlight, () => {
-            workspaceSyncPriorityPtyTargets.set(message.ptyId, message.target);
-            if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
-          });
+          const reservationAbort = registerPendingReservation(`pty:${message.ptyId}`, void 0);
+          try {
+            await (0, import_workspace_command_sync_policy.reserveWorkspaceCommandAfterCurrentSync)(
+              message.target,
+              workspaceSyncSingleFlight,
+              () => {
+                workspaceSyncPriorityPtyTargets.set(message.ptyId, message.target);
+                if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
+              },
+              { signal: reservationAbort.signal }
+            );
+          } finally {
+            unregisterPendingReservation(`pty:${message.ptyId}`, reservationAbort);
+          }
           releaseWorkspaceMutation = await (0, import_workspace_command_sync_policy.acquireWorkspaceCommandMutation)(message.target, workspaceSyncSingleFlight);
           if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
             throw new Error(
@@ -6610,6 +6854,7 @@ async function startWorker(options, projectRuntime = {
       }
       if (message.type === "pty_close") {
         const activePty = activePtys.get(message.ptyId);
+        abortPendingReservation(`pty:${message.ptyId}`, "Shell closed before it started");
         await closePty(message);
         if (activePty && targetMayMutateVisibleWorkspace(activePty.target)) {
           markWorkspaceDirty({ type: "process_terminal", detail: `pty ${message.ptyId} closed` }, true, activePty.target);
@@ -6646,11 +6891,21 @@ async function startWorker(options, projectRuntime = {
         try {
           resources = await acquireWorkerCommandLaunch(ws, message, assertMessageAdmission);
           if (hasWorkspaceEffect) {
-            await (0, import_workspace_command_sync_policy.reserveWorkspaceCommandAfterCurrentSync)(message.target, workspaceSyncSingleFlight, () => {
-              workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
-              targetReserved = true;
-              if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
-            });
+            const reservationAbort = registerPendingReservation(`run:${message.runId}`, message.sessionId);
+            try {
+              await (0, import_workspace_command_sync_policy.reserveWorkspaceCommandAfterCurrentSync)(
+                message.target,
+                workspaceSyncSingleFlight,
+                () => {
+                  workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
+                  targetReserved = true;
+                  if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
+                },
+                { signal: reservationAbort.signal }
+              );
+            } finally {
+              unregisterPendingReservation(`run:${message.runId}`, reservationAbort);
+            }
           }
           const runCommand = async () => {
             if (!workspaceCommandTransportIsAllowed(deferredWorkspaceConfiguration, activeWorkspaceIncidentId, "exec")) {
@@ -6702,7 +6957,7 @@ async function startWorker(options, projectRuntime = {
           cancelledProcessRuns.delete(message.runId);
         }
         if (infrastructureStoppedRunIds.has(message.runId)) {
-          recoveryStore.unknown(message.requestId);
+          recoveryJournal.unknown(message.requestId);
           return;
         }
         sendSerializedWorkerMessage(ws, JSON.stringify(result));
@@ -6735,8 +6990,10 @@ async function startWorker(options, projectRuntime = {
         const runCommand = async () => {
           try {
             const resolvedTarget = resolveMessageTarget(message.target);
-            process.stdout.write(`[r5d-worker] exec_start ${message.runId}: ${message.argv.join(" ")}
-`);
+            process.stdout.write(
+              `[r5d-worker] exec_start ${message.runId}${message.commandClass === "control" ? " (control)" : ""}: ${message.argv.join(" ")}
+`
+            );
             await executeStreamingCommand({
               resources,
               ws,
@@ -6774,11 +7031,21 @@ async function startWorker(options, projectRuntime = {
           try {
             resources = await acquireWorkerCommandLaunch(ws, message, assertMessageAdmission);
             if (hasWorkspaceEffect) {
-              await (0, import_workspace_command_sync_policy.reserveWorkspaceCommandAfterCurrentSync)(message.target, workspaceSyncSingleFlight, () => {
-                workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
-                targetReserved = true;
-                if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
-              });
+              const reservationAbort = registerPendingReservation(`run:${message.runId}`, message.sessionId);
+              try {
+                await (0, import_workspace_command_sync_policy.reserveWorkspaceCommandAfterCurrentSync)(
+                  message.target,
+                  workspaceSyncSingleFlight,
+                  () => {
+                    workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
+                    targetReserved = true;
+                    if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
+                  },
+                  { signal: reservationAbort.signal }
+                );
+              } finally {
+                unregisterPendingReservation(`run:${message.runId}`, reservationAbort);
+              }
             }
             await (0, import_workspace_command_sync_policy.runReservedWorkspaceCommand)(message.target, workspaceSyncSingleFlight, runCommand, () => {
               if (targetReserved) {
@@ -6813,16 +7080,40 @@ async function startWorker(options, projectRuntime = {
           return;
         }
         const reservesVisibleWorkspace = targetMayMutateVisibleWorkspace(message.target);
-        const mutatesVisibleWorkspace = (message.type === "write" || message.type === "edit" || message.type === "update_task_status" || message.type === "read_plan" && message.createIfMissing) && targetMayMutateVisibleWorkspace(message.target);
+        const mutatesFiles = message.type === "write" || message.type === "edit" || message.type === "update_task_status" || message.type === "read_plan" && message.createIfMissing;
+        const mutatesVisibleWorkspace = mutatesFiles && targetMayMutateVisibleWorkspace(message.target);
         if (reservesVisibleWorkspace) {
-          await (0, import_workspace_command_sync_policy.reserveWorkspaceCommandAfterCurrentSync)(message.target, workspaceSyncSingleFlight, () => {
-            workspaceSyncPriorityOperationTargets.set(message.requestId, message.target);
-            if (mutatesVisibleWorkspace) recordVisibleWorkspaceMutation(message.target);
-          });
+          const reservationAbort = registerPendingReservation(
+            `op:${message.requestId}`,
+            "sessionId" in message && typeof message.sessionId === "string" ? message.sessionId : void 0
+          );
+          try {
+            await (0, import_workspace_command_sync_policy.reserveWorkspaceCommandAfterCurrentSync)(
+              message.target,
+              workspaceSyncSingleFlight,
+              () => {
+                workspaceSyncPriorityOperationTargets.set(message.requestId, message.target);
+                if (mutatesVisibleWorkspace) recordVisibleWorkspaceMutation(message.target);
+              },
+              { signal: reservationAbort.signal }
+            );
+          } catch (error) {
+            sendSerializedWorkerMessage(
+              ws,
+              JSON.stringify({
+                type: "operation_result",
+                requestId: message.requestId,
+                error: error instanceof Error ? error.message : String(error)
+              })
+            );
+            return;
+          } finally {
+            unregisterPendingReservation(`op:${message.requestId}`, reservationAbort);
+          }
         }
         let dirtyTrigger;
         try {
-          const result = await (0, import_workspace_command_sync_policy.runWorkspaceCommand)(message.target, workspaceSyncSingleFlight, async () => {
+          const operation = (0, import_workspace_command_sync_policy.runWorkspaceCommand)(message.target, workspaceSyncSingleFlight, async () => {
             const resolvedTarget = resolveMessageTarget(message.target);
             return await executeOperation({
               message,
@@ -6833,6 +7124,8 @@ async function startWorker(options, projectRuntime = {
               assertAdmission: assertMessageAdmission
             });
           });
+          if (mutatesFiles && typeof message.sessionId === "string") sessionFileMutations.track(message.sessionId, operation);
+          const result = await operation;
           sendSerializedWorkerMessage(
             ws,
             JSON.stringify({
@@ -6916,6 +7209,7 @@ async function startWorker(options, projectRuntime = {
       projectRuntime.configuration.deferred = deferredWorkspaceConfiguration;
     }
     if (currentWorkerSocket === ws) currentWorkerSocket = null;
+    abortPendingReservations("Worker connection closed before command start");
     workerRecoveryId = "reconnecting";
     const reason = event.reason ? `: ${event.reason}` : "";
     process.stderr.write(`[r5d-worker] disconnected (${event.code}${reason})
@@ -6949,6 +7243,11 @@ async function startWorker(options, projectRuntime = {
   });
 }
 function installWorkerRuntimeFailureLogging() {
+  (0, import_workspace_filesystem_executor.installWorkspaceFilesystemExecutorFailureHandler)((error) => {
+    process.stderr.write(`[r5d-worker] ${error.message}; restarting the worker runtime
+`);
+    void exitWorkerRuntime(import_supervisor.WORKER_RECONNECT_EXIT_CODE);
+  });
   process.on("uncaughtException", (error) => {
     process.stderr.write(`[r5d-worker] uncaught exception: ${error instanceof Error ? error.stack ?? error.message : String(error)}
 `);
@@ -6961,11 +7260,6 @@ function installWorkerRuntimeFailureLogging() {
   });
 }
 async function main() {
-  if (process.argv[2] === import_project_snapshot_recovery_runner.PROJECT_SNAPSHOT_RECOVERY_HELPER_COMMAND) {
-    const exitCode2 = (0, import_project_snapshot_recovery_runner.runProjectSnapshotRecoveryHelper)(process.argv.slice(3));
-    if (exitCode2 !== 0) process.exit(exitCode2);
-    return;
-  }
   const parsed = parseArgs(process.argv.slice(2));
   if (parsed.command === "help") {
     printHelp();